To make kaslr_offset detection code happy. calc_kaslr_offset() requires valid CR3 and IDTR values in order to find kernel start virtual and physical addresses. One of CPUs might have zeroed ITDR register caused by triggering triple fault. If CPU #0 has zeroed IDTR, walk through other CPUs to get valid and not zeroed value. In case of only one CPU, we should use another approach such as page tree walking to get kasr offset. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; --- vmware_vmss.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/vmware_vmss.c b/vmware_vmss.c index b168f29..8aa0de0 100644 --- a/vmware_vmss.c +++ b/vmware_vmss.c @@ -881,6 +881,27 @@ vmware_vmss_get_cr3_idtr(ulong *cr3, ulong *idtr) *cr3 = vmss.regs64[0]->cr[3]; *idtr = vmss.regs64[0]->idtr; + /* + * debug.guest is generated on guest triple fault. One of the possible + * ways to triple fault is: zeroing IDTR and int3. + * This is used in linux to reboot machine using triple fault: + * "reboot=t" cmdline. + * In that case CPU which triggered triple fault will have zeroed + * IDTR. IDTR and CR3 are used to calculate kaslr offset and phys + * base. + * If IDTR on CPU0 is zeroed and we have several CPUs, return IDTR from + * another CPU. + */ + if (vmss.num_vcpus > 1 && *idtr == 0) { + int i; + for (i = 0; i < vmss.num_vcpus; i++) { + if (vmss.vcpu_regs[i] == REGS_PRESENT_ALL) { + *idtr = vmss.regs64[i]->idtr; + break; + } + } + } + return TRUE; } -- 2.11.0

Hi Daisuke, Sure! What was the issue with sadump? In vmware guest dump, IDTR on one of CPUs is zeroed, if it is CPU #0 - then use IDTR from another CPU. I see, kaslr_helper has retry logic for sadump case. Can you provide more info about it. And I will try to generalize it. Thanks, —Alexey

This method requires only valid CR3. It walks through page tree starting from __START_KERNEL_map to get real _stext and its physical address. _stext_vmlinux has to be initialized. So, requesting it by "st->_stext_vmlinux = UNINITIALIZED;" for sadump and vmware backends. Other backends may use "--kaslr=auto" to get similar effect. This method is used as backup one for getting kaslr offset, if IDTR is not valid (zeroed). It might happen when kernel invalidates IDT, for example triggering triple fault on reboot (reboot=t cmdline). This method does not support PTI (Page Table Isolation) case where CR3 points to the isolated page tree. So, use it only when CR3 points to "full" kernel. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; --- kaslr_helper.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ symbols.c | 4 +- 2 files changed, 118 insertions(+), 1 deletion(-) diff --git a/kaslr_helper.c b/kaslr_helper.c index 02a7e48..d06ee44 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -323,6 +323,104 @@ quit: } /* + * Find virtual (VA) and physical (PA) addresses of kernel start + * + * va: + * Actual address of the kernel start (_stext) placed + * randomly by kaslr feature. To be more accurate, + * VA = _stext(from vmlinux) + kaslr_offset + * + * pa: + * Physical address where the kerenel is placed. + * + * In nokaslr case, VA = _stext (from vmlinux) + * In kaslr case, virtual address of the kernel placement goes + * in this range: ffffffff80000000..ffffffff9fffffff, or + * __START_KERNEL_map..+512MB + * + * https://www.kernel.org/doc/Documentation/x86/x86_64/mm.txt + * + * Randomized VA will be the first valid page starting from + * ffffffff80000000 (__START_KERNEL_map). Page tree entry of + * this page will contain the PA of the kernel start. + * + * NOTES: + * 1. This method does not support PTI (Page Table Isolation) + * case where CR3 points to the isolated page tree. + * 2. 4-level paging support only, as caller (calc_kaslr_offset) + * does not support 5-level paging. + */ +static int +find_kernel_start(ulong *va, ulong *pa) +{ + int i, pgd_idx, pud_idx, pmd_idx, pte_idx; + uint64_t pgd_pte, pud_pte, pmd_pte, pte; + + pgd_idx = pgd_index(__START_KERNEL_map); + pud_idx = pud_index(__START_KERNEL_map); + pmd_idx = pmd_index(__START_KERNEL_map); + pte_idx = pte_index(__START_KERNEL_map); + + for (; pgd_idx < PTRS_PER_PGD; pgd_idx++) { + pgd_pte = ULONG(machdep->pgd + pgd_idx * sizeof(uint64_t)); + if (pgd_pte & _PAGE_PRESENT) + break; + pud_idx = pmd_idx = pte_idx = 0; + } + if (pgd_idx == PTRS_PER_PGD) + return FALSE; + + FILL_PUD(pgd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pud_idx < PTRS_PER_PUD; pud_idx++) { + pud_pte = ULONG(machdep->pud + pud_idx * sizeof(uint64_t)); + if (pud_pte & _PAGE_PRESENT) + break; + pmd_idx = pte_idx = 0; + } + if (pud_idx == PTRS_PER_PUD) + return FALSE; + if (pud_pte & _PAGE_PSE) { + /* 1GB page */ + *va = (~__VIRTUAL_MASK) | ((ulong)pgd_idx << __PGDIR_SHIFT) | + ((ulong)pud_idx << PUD_SHIFT); + *pa = pud_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PMD(pud_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pmd_idx < PTRS_PER_PMD; pmd_idx++) { + pmd_pte = ULONG(machdep->pmd + pmd_idx * sizeof(uint64_t)); + if (pmd_pte & _PAGE_PRESENT) + break; + pte_idx = 0; + } + if (pmd_idx == PTRS_PER_PMD) + return FALSE; + if (pmd_pte & _PAGE_PSE) { + /* 2MB page */ + *va = (~__VIRTUAL_MASK) | ((ulong)pgd_idx << __PGDIR_SHIFT) | + ((ulong)pud_idx << PUD_SHIFT) | (pmd_idx << PMD_SHIFT); + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PTBL(pmd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pte_idx < PTRS_PER_PTE; pte_idx++) { + pte = ULONG(machdep->ptbl + pte_idx * sizeof(uint64_t)); + if (pte & _PAGE_PRESENT) + break; + } + if (pte_idx == PTRS_PER_PTE) + return FALSE; + + *va = (~__VIRTUAL_MASK) | ((ulong)pgd_idx << __PGDIR_SHIFT) | + ((ulong)pud_idx << PUD_SHIFT) | (pmd_idx << PMD_SHIFT) | + (pte_idx << PAGE_SHIFT); + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; +} + +/* * Calculate kaslr_offset and phys_base * * kaslr_offset: @@ -449,6 +547,22 @@ retry: goto quit; } + if (idtr == 0 && st->_stext_vmlinux && (st->_stext_vmlinux != UNINITIALIZED)) { + ulong va, pa; + ret = find_kernel_start(&va, &pa); + if (ret == FALSE) + goto quit; + if (CRASHDEBUG(1)) { + fprintf(fp, "calc_kaslr_offset: _stext(vmlinux): %lx\n", st->_stext_vmlinux); + fprintf(fp, "calc_kaslr_offset: kernel start VA: %lx\n", va); + fprintf(fp, "calc_kaslr_offset: kernel start PA: %lx\n", pa); + } + kaslr_offset = va - st->_stext_vmlinux; + phys_base = pa - (va - __START_KERNEL_map); + + goto found; + } + /* Convert virtual address of IDT table to physical address */ if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) { if (SADUMP_DUMPFILE()) @@ -509,6 +623,7 @@ retry: fprintf(fp, "kaslr_helper: asssuming the kdump 1st kernel.\n"); } +found: if (CRASHDEBUG(1)) { fprintf(fp, "calc_kaslr_offset: kaslr_offset=%lx\n", kaslr_offset); diff --git a/symbols.c b/symbols.c index 70b1455..430459a 100644 --- a/symbols.c +++ b/symbols.c @@ -634,8 +634,10 @@ kaslr_init(void) } } - if (SADUMP_DUMPFILE() || VMSS_DUMPFILE()) + if (SADUMP_DUMPFILE() || VMSS_DUMPFILE()) { kt->flags2 |= KASLR_CHECK; + st->_stext_vmlinux = UNINITIALIZED; + } } /* -- 2.11.0

And also this logic is based on the kernel logic that such pgt pair is generated even when PTI is disabled at runtime. But I think you should test with PTI disabled for in case. I see. At least I don't have Ice Lake machine and I cannot share such crash dump. As I said in another mail, the comment from me was wrong; I was confused by pgd. Yes. Please remove the condition idtr == 0. By this, we can calculate kaslr_offset in earlier kernel boot phase where IDTR is not configured. Also, this gives up the search immediately. Please keep searching remaining registers, at least for sadump format. Please do linux_banner sanity check for in case at least for sadump format. Thanks. HATAYAMA, Daisuke

Qemu and VMWare facilities rely only on CPU #0 to provide CR3 and IDTR. But these registers can be not initialized or clobbered, depending on the state of CPU. For example, kernel can trigger triple fault by zeroing IDTR and doing int3. This is used in Linux to reboot machine using triple fault: "reboot=t" cmdline. In that case CPU which triggered triple fault will have zeroed IDTR. Generalize the method used by Sadump facility to analyze every pair of registers from all available CPUs. Create subfunctions for easy reading. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; --- defs.h | 8 +- diskdump.c | 6 ++ kaslr_helper.c | 278 +++++++++++++++++++++++++++++++++------------------------ netdump.c | 6 ++ sadump.c | 36 ++------ vmware_vmss.c | 14 ++- 6 files changed, 195 insertions(+), 153 deletions(-) diff --git a/defs.h b/defs.h index 00786c2..d024756 100644 --- a/defs.h +++ b/defs.h @@ -6457,6 +6457,7 @@ void display_ELF_note(int, int, void *, FILE *); void *netdump_get_prstatus_percpu(int); int kdump_kaslr_check(void); void display_vmcoredd_note(void *ptr, FILE *ofp); +int kdump_get_nr_cpus(void); QEMUCPUState *kdump_get_qemucpustate(int); void kdump_device_dump_info(FILE *); void kdump_device_dump_extract(int, char *, FILE *); @@ -6505,6 +6506,7 @@ void process_elf32_notes(void *, ulong); void process_elf64_notes(void *, ulong); void dump_registers_for_compressed_kdump(void); int diskdump_kaslr_check(void); +int diskdump_get_nr_cpus(void); QEMUCPUState *diskdump_get_qemucpustate(int); void diskdump_device_dump_info(FILE *); void diskdump_device_dump_extract(int, char *, FILE *); @@ -6623,7 +6625,8 @@ void sadump_unset_zero_excluded(void); struct sadump_data; struct sadump_data *get_sadump_data(void); int sadump_calc_kaslr_offset(ulong *); -int sadump_get_cr3_idtr(ulong *, ulong *); +int sadump_get_nr_cpus(void); +int sadump_get_cr3_idtr(int, ulong *, ulong *); /* * qemu.c @@ -6676,7 +6679,8 @@ void get_vmware_vmss_regs(struct bt_info *, ulong *, ulong *); int vmware_vmss_memory_dump(FILE *); void dump_registers_for_vmss_dump(void); int vmware_vmss_valid_regs(struct bt_info *); -int vmware_vmss_get_cr3_idtr(ulong *, ulong *); +int vmware_vmss_get_nr_cpus(void); +int vmware_vmss_get_cr3_idtr(int, ulong *, ulong *); int vmware_vmss_phys_base(ulong *phys_base); int vmware_vmss_set_phys_base(ulong); diff --git a/diskdump.c b/diskdump.c index 63a08a1..b33fcf3 100644 --- a/diskdump.c +++ b/diskdump.c @@ -2517,6 +2517,12 @@ diskdump_kaslr_check() } #ifdef X86_64 +int +diskdump_get_nr_cpus(void) +{ + return dd->num_qemu_notes; +} + QEMUCPUState * diskdump_get_qemucpustate(int cpu) { diff --git a/kaslr_helper.c b/kaslr_helper.c index bb19e54..a0b537e 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -240,21 +240,30 @@ get_vmcoreinfo(ulong elfcorehdr, ulong *addr, int *len) } static int -qemu_get_cr3_idtr(ulong *cr3, ulong *idtr) +qemu_get_nr_cpus(void) +{ + if (DISKDUMP_DUMPFILE()) + return diskdump_get_nr_cpus(); + else if (KDUMP_DUMPFILE()) + return kdump_get_nr_cpus(); + + return 0; +} + +static int +qemu_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) { QEMUCPUState *cpustat; - if (DISKDUMP_DUMPFILE()) { - cpustat = diskdump_get_qemucpustate(0); - } else if (KDUMP_DUMPFILE()) { - cpustat = kdump_get_qemucpustate(0); - } else { + if (DISKDUMP_DUMPFILE()) + cpustat = diskdump_get_qemucpustate(cpu); + else if (KDUMP_DUMPFILE()) + cpustat = kdump_get_qemucpustate(cpu); + else return FALSE; - } - if (!cpustat) { + if (!cpustat) return FALSE; - } *cr3 = cpustat->cr[3]; *idtr = cpustat->idt.base; @@ -321,18 +330,55 @@ quit: return ret; } +static int +get_nr_cpus(void) +{ + if (SADUMP_DUMPFILE()) + return sadump_get_nr_cpus(); + else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) + return qemu_get_nr_cpus(); + else if (VMSS_DUMPFILE()) + return vmware_vmss_get_nr_cpus(); + + return 0; +} + +static int +get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +{ + if (SADUMP_DUMPFILE()) + return sadump_get_cr3_idtr(cpu, cr3, idtr); + else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) + return qemu_get_cr3_idtr(cpu, cr3, idtr); + else if (VMSS_DUMPFILE()) + return vmware_vmss_get_cr3_idtr(cpu, cr3, idtr); + + return FALSE; +} + +#define BANNER "Linux version" +static int +verify_kaslr_offset(ulong kaslr_offset) +{ + char buf[sizeof(BANNER)]; + ulong linux_banner_paddr; + + if (!kvtop(NULL, st->linux_banner_vmlinux + kaslr_offset, + &linux_banner_paddr, CRASHDEBUG(1))) + return FALSE; + + if (!readmem(linux_banner_paddr, PHYSADDR, buf, sizeof(buf), + "linux_banner", RETURN_ON_ERROR)) + return FALSE; + + if (!STRNEQ(buf, BANNER)) + return FALSE; + + return TRUE; +} + /* - * Calculate kaslr_offset and phys_base - * - * kaslr_offset: - * The difference between original address in System.map or vmlinux and - * actual address placed randomly by kaslr feature. To be more accurate, - * kaslr_offset = actual address - original address - * - * phys_base: - * Physical address where the kerenel is placed. In other words, it's a - * physical address of __START_KERNEL_map. This is also decided randomly by - * kaslr. + * IDT based method to calculate kaslr_offset and phys_base * * kaslr offset and phys_base are calculated as follows: * @@ -370,17 +416,61 @@ quit: * Note that the address (A) cannot be used instead of (E) because (A) is * not direct map address, it's a fixed map address. * - * This solution works in most every case, but does not work in the - * following case. + * NOTE: This solution works in most every case, but does not work in the + * following case. If the dump is captured on early stage of kernel boot, + * IDTR points to the early IDT table(early_idts) instead of normal + * IDT(idt_table). Need enhancement. + */ +int +calc_kaslr_offset_from_idt(uint64_t idtr, uint64_t pgd, ulong *kaslr_offset, ulong *phys_base) +{ + uint64_t idtr_paddr; + ulong divide_error_vmcore; + int verbose = CRASHDEBUG(1)? 1: 0; + + if (!idtr) + return FALSE; + + /* Convert virtual address of IDT table to physical address */ + if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) + return FALSE; + + /* Now we can calculate kaslr_offset and phys_base */ + divide_error_vmcore = get_vec0_addr(idtr_paddr); + *kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; + *phys_base = idtr_paddr - + (st->idt_table_vmlinux + *kaslr_offset - __START_KERNEL_map); + + if (verbose) { + fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); + fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); + fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); + fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", + st->divide_error_vmlinux); + fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", + divide_error_vmcore); + } + return TRUE; +} + +/* + * Calculate kaslr_offset and phys_base * - * 1) If the dump is captured on early stage of kernel boot, IDTR points - * early IDT table(early_idts) instead of normal IDT(idt_table). - * 2) If the dump is captured whle kdump is working, IDTR points - * IDT table of 2nd kernel, not 1st kernel. + * kaslr_offset: + * The difference between original address in System.map or vmlinux and + * actual address placed randomly by kaslr feature. To be more accurate, + * kaslr_offset = actual address - original address * - * Current implementation does not support the case 1), need - * enhancement in the future. For the case 2), get kaslr_offset and - * phys_base as follows. + * phys_base: + * Physical address where the kerenel is placed. In other words, it's a + * physical address of __START_KERNEL_map. This is also decided randomly by + * kaslr. + * + * It walks through all available CPUs registers to calculate the offset/base. + * + * Also, it considers the case where dump is captured whle kdump is working, + * IDTR points to the IDT table of 2nd kernel, not 1st kernel. + * In that case, get kaslr_offset and phys_base as follows. * * 1) Get kaslr_offset and phys_base using the above solution. * 2) Get kernel boot parameter from "saved_command_line" @@ -396,110 +486,66 @@ quit: int calc_kaslr_offset(ulong *ko, ulong *pb) { - uint64_t cr3 = 0, idtr = 0, pgd = 0, idtr_paddr; - ulong divide_error_vmcore; + uint64_t cr3 = 0, idtr = 0, pgd = 0; ulong kaslr_offset, phys_base; ulong kaslr_offset_kdump, phys_base_kdump; - int ret = FALSE; - int verbose = CRASHDEBUG(1)? 1: 0; + int cpu, nr_cpus; if (!machine_type("X86_64")) return FALSE; -retry: - if (SADUMP_DUMPFILE()) { - if (!sadump_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { - if (!qemu_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else if (VMSS_DUMPFILE()) { - if (!vmware_vmss_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else - return FALSE; + nr_cpus = get_nr_cpus(); - if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) - pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); - else - pgd = cr3 & ~CR3_PCID_MASK; + for (cpu = 0; cpu < nr_cpus; cpu++) { + if (!get_cr3_idtr(cpu, &cr3, &idtr)) + continue; - /* - * Set up for kvtop. - * - * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some - * variables are not initialized yet. Set up them here to call kvtop(). - * - * TODO: XEN and 5-level is not supported - */ - vt->kernel_pgd[0] = pgd; - machdep->last_pgd_read = vt->kernel_pgd[0]; - machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; - machdep->machspec->pgdir_shift = PGDIR_SHIFT; - machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; - if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), - "pgd", RETURN_ON_ERROR)) { - if (SADUMP_DUMPFILE()) - goto retry; - else - goto quit; - } + if (!cr3) + continue; - /* Convert virtual address of IDT table to physical address */ - if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) { - if (SADUMP_DUMPFILE()) - goto retry; + if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) + pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); else - goto quit; - } + pgd = cr3 & ~CR3_PCID_MASK; + + /* + * Set up for kvtop. + * + * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some + * variables are not initialized yet. Set up them here to call kvtop(). + * + * TODO: XEN and 5-level is not supported + */ + vt->kernel_pgd[0] = pgd; + machdep->last_pgd_read = vt->kernel_pgd[0]; + machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; + machdep->machspec->pgdir_shift = PGDIR_SHIFT; + machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; + if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), + "pgd", RETURN_ON_ERROR)) + continue; - /* Now we can calculate kaslr_offset and phys_base */ - divide_error_vmcore = get_vec0_addr(idtr_paddr); - kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; - phys_base = idtr_paddr - - (st->idt_table_vmlinux + kaslr_offset - __START_KERNEL_map); - - if (SADUMP_DUMPFILE()) { - char buf[sizeof("Linux version")]; - ulong linux_banner_paddr; - - if (!kvtop(NULL, - st->linux_banner_vmlinux + kaslr_offset, - &linux_banner_paddr, - verbose)) - goto retry; - - if (!readmem(linux_banner_paddr, - PHYSADDR, - buf, - sizeof(buf), - "linux_banner", - RETURN_ON_ERROR)) - goto retry; - - if (!STRNEQ(buf, "Linux version")) - goto retry; - } + if (!calc_kaslr_offset_from_idt(idtr, pgd, &kaslr_offset, &phys_base)) + continue; - if (CRASHDEBUG(1)) { - fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); - fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); - fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); - fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", - st->divide_error_vmlinux); - fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", - divide_error_vmcore); + if (verify_kaslr_offset(kaslr_offset)) + goto found; } + vt->kernel_pgd[0] = 0; + machdep->last_pgd_read = 0; + return FALSE; + +found: /* * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd * kernel. If we are in 2nd kernel, get kaslr_offset/phys_base * from vmcoreinfo */ - if (get_kaslr_offset_from_vmcoreinfo( - kaslr_offset, &kaslr_offset_kdump, &phys_base_kdump)) { - kaslr_offset = kaslr_offset_kdump; - phys_base = phys_base_kdump; + if (get_kaslr_offset_from_vmcoreinfo(kaslr_offset, &kaslr_offset_kdump, + &phys_base_kdump)) { + kaslr_offset = kaslr_offset_kdump; + phys_base = phys_base_kdump; } else if (CRASHDEBUG(1)) { fprintf(fp, "kaslr_helper: failed to determine which kernel was running at crash,\n"); fprintf(fp, "kaslr_helper: asssuming the kdump 1st kernel.\n"); @@ -514,11 +560,9 @@ retry: *ko = kaslr_offset; *pb = phys_base; - ret = TRUE; -quit: vt->kernel_pgd[0] = 0; machdep->last_pgd_read = 0; - return ret; + return TRUE; } #else int diff --git a/netdump.c b/netdump.c index 2ca39e2..c76d9dd 100644 --- a/netdump.c +++ b/netdump.c @@ -5197,6 +5197,12 @@ kdump_kaslr_check(void) } #ifdef X86_64 +int +kdump_get_nr_cpus(void) +{ + return nd->num_qemu_notes; +} + QEMUCPUState * kdump_get_qemucpustate(int cpu) { diff --git a/sadump.c b/sadump.c index f313528..08893c4 100644 --- a/sadump.c +++ b/sadump.c @@ -1671,44 +1671,20 @@ get_sadump_data(void) } #ifdef X86_64 -static int -get_sadump_smram_cpu_state_any(struct sadump_smram_cpu_state *smram) +int +sadump_get_nr_cpus(void) { - ulong offset; - struct sadump_header *sh = sd->dump_header; - static int apicid; - struct sadump_smram_cpu_state scs; - - if (apicid >= sh->nr_cpus) - return FALSE; - - offset = sd->sub_hdr_offset + sizeof(uint32_t) + - sd->dump_header->nr_cpus * sizeof(struct sadump_apic_state) + - apicid * sizeof(scs); - - while (apicid < sh->nr_cpus) { - apicid++; - if (!read_device(&scs, sizeof(scs), &offset)) { - error(INFO, "sadump: cannot read sub header " - "cpu_state\n"); - return FALSE; - } - if (scs.Cr3 && (scs.IdtUpper || scs.IdtLower)) { - *smram = scs; - return TRUE; - } - } - - return FALSE; + /* apicids */ + return sd->dump_header->nr_cpus; } int -sadump_get_cr3_idtr(ulong *cr3, ulong *idtr) +sadump_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) { struct sadump_smram_cpu_state scs; memset(&scs, 0, sizeof(scs)); - if (!get_sadump_smram_cpu_state_any(&scs)) + if (!sadump_get_smram_cpu_state(cpu, &scs)) return FALSE; *cr3 = scs.Cr3; diff --git a/vmware_vmss.c b/vmware_vmss.c index b168f29..952ac48 100644 --- a/vmware_vmss.c +++ b/vmware_vmss.c @@ -873,13 +873,19 @@ vmware_vmss_valid_regs(struct bt_info *bt) } int -vmware_vmss_get_cr3_idtr(ulong *cr3, ulong *idtr) +vmware_vmss_get_nr_cpus(void) { - if (vmss.num_vcpus == 0 || vmss.vcpu_regs[0] != REGS_PRESENT_ALL) + return vmss.num_vcpus; +} + +int +vmware_vmss_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +{ + if (cpu >= vmss.num_vcpus || vmss.vcpu_regs[cpu] != REGS_PRESENT_ALL) return FALSE; - *cr3 = vmss.regs64[0]->cr[3]; - *idtr = vmss.regs64[0]->idtr; + *cr3 = vmss.regs64[cpu]->cr[3]; + *idtr = vmss.regs64[cpu]->idtr; return TRUE; } -- 2.11.0

This method requires only valid CR3. It walks through page tree starting from __START_KERNEL_map to get real _stext and its physical address. _stext_vmlinux has to be initialized. So, requesting it by "st->_stext_vmlinux = UNINITIALIZED;" for sadump and vmware backends. Other backends may use "--kaslr=auto" to get similar effect. Use this method as a default and IDTR base as a backup. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; --- kaslr_helper.c | 155 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- symbols.c | 5 +- 2 files changed, 157 insertions(+), 3 deletions(-) diff --git a/kaslr_helper.c b/kaslr_helper.c index f9ed56b..5945a3d 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -379,6 +379,152 @@ verify_kaslr_offset(ulong kaslr_offset) } /* + * Find virtual (VA) and physical (PA) addresses of kernel start + * + * va: + * Actual address of the kernel start (_stext) placed + * randomly by kaslr feature. To be more accurate, + * VA = _stext(from vmlinux) + kaslr_offset + * + * pa: + * Physical address where the kerenel is placed. + * + * In nokaslr case, VA = _stext (from vmlinux) + * In kaslr case, virtual address of the kernel placement goes + * in this range: ffffffff80000000..ffffffff9fffffff, or + * __START_KERNEL_map..+512MB + * + * https://www.kernel.org/doc/Documentation/x86/x86_64/mm.txt + * + * Randomized VA will be the first valid page starting from + * ffffffff80000000 (__START_KERNEL_map). Page tree entry of + * this page will contain the PA of the kernel start. + */ +static int +find_kernel_start(uint64_t pgd, ulong *va, ulong *pa) +{ + int i, pgd_idx, p4d_idx, pud_idx, pmd_idx, pte_idx; + uint64_t pgd_pte, pud_pte, pmd_pte, pte; + + pgd_idx = pgd_index(__START_KERNEL_map); + if (machdep->flags & VM_5LEVEL) + p4d_idx = p4d_index(__START_KERNEL_map); + pud_idx = pud_index(__START_KERNEL_map); + pmd_idx = pmd_index(__START_KERNEL_map); + pte_idx = pte_index(__START_KERNEL_map); + + /* If the VM is in 5-level page table */ + if (machdep->flags & VM_5LEVEL) + *va = ~((1UL << 57) - 1); + else + *va = ~__VIRTUAL_MASK; + + FILL_PGD(pgd & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pgd_idx < PTRS_PER_PGD; pgd_idx++) { + pgd_pte = ULONG(machdep->pgd + pgd_idx * sizeof(uint64_t)); + if (pgd_pte & _PAGE_PRESENT) + break; + p4d_idx = pud_idx = pmd_idx = pte_idx = 0; + } + if (pgd_idx == PTRS_PER_PGD) + return FALSE; + *va |= (ulong)pgd_idx << __PGDIR_SHIFT; + + if (machdep->flags & VM_5LEVEL) { + FILL_P4D(pgd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; p4d_idx < PTRS_PER_P4D; p4d_idx++) { + /* reuse pgd_pte */ + pgd_pte = ULONG(machdep->machspec->p4d + p4d_idx * sizeof(uint64_t)); + if (pgd_pte & _PAGE_PRESENT) + break; + pud_idx = pmd_idx = pte_idx = 0; + } + if (p4d_idx == PTRS_PER_P4D) + return FALSE; + *va |= (ulong)p4d_idx << P4D_SHIFT; + } + + FILL_PUD(pgd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pud_idx < PTRS_PER_PUD; pud_idx++) { + pud_pte = ULONG(machdep->pud + pud_idx * sizeof(uint64_t)); + if (pud_pte & _PAGE_PRESENT) + break; + pmd_idx = pte_idx = 0; + } + if (pud_idx == PTRS_PER_PUD) + return FALSE; + *va |= (ulong)pud_idx << PUD_SHIFT; + if (pud_pte & _PAGE_PSE) { + /* 1GB page */ + *pa = pud_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PMD(pud_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pmd_idx < PTRS_PER_PMD; pmd_idx++) { + pmd_pte = ULONG(machdep->pmd + pmd_idx * sizeof(uint64_t)); + if (pmd_pte & _PAGE_PRESENT) + break; + pte_idx = 0; + } + if (pmd_idx == PTRS_PER_PMD) + return FALSE; + *va |= pmd_idx << PMD_SHIFT; + if (pmd_pte & _PAGE_PSE) { + /* 2MB page */ + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PTBL(pmd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pte_idx < PTRS_PER_PTE; pte_idx++) { + pte = ULONG(machdep->ptbl + pte_idx * sizeof(uint64_t)); + if (pte & _PAGE_PRESENT) + break; + } + if (pte_idx == PTRS_PER_PTE) + return FALSE; + + *va |= pte_idx << PAGE_SHIFT; + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; +} + +/* + * Page Tables based method to calculate kaslr_offset and phys_base. + * It uses VA and PA of kernel start. + * + * kaslr offset and phys_base are calculated as follows: + * + * kaslr_offset = VA - st->_stext_vmlinux + * phys_base = PA - (VA - __START_KERNEL_map) + */ +int +calc_kaslr_offset_from_page_tables(uint64_t pgd, ulong *kaslr_offset, + ulong *phys_base) +{ + ulong va, pa; + + if (!st->_stext_vmlinux || st->_stext_vmlinux == UNINITIALIZED) { + fprintf(fp, "%s: st->_stext_vmlinux must be initialized\n", + __FUNCTION__); + return FALSE; + } + if (!find_kernel_start(pgd, &va, &pa)) + return FALSE; + + if (CRASHDEBUG(1)) { + fprintf(fp, "calc_kaslr_offset: _stext(vmlinux): %lx\n", st->_stext_vmlinux); + fprintf(fp, "calc_kaslr_offset: kernel start VA: %lx\n", va); + fprintf(fp, "calc_kaslr_offset: kernel start PA: %lx\n", pa); + } + + *kaslr_offset = va - st->_stext_vmlinux; + *phys_base = pa - (va - __START_KERNEL_map); + return TRUE; +} + +/* * IDT based method to calculate kaslr_offset and phys_base * * kaslr offset and phys_base are calculated as follows: @@ -534,8 +680,13 @@ calc_kaslr_offset(ulong *ko, ulong *pb) "pgd", RETURN_ON_ERROR)) continue; - if (!calc_kaslr_offset_from_idt(idtr, pgd, &kaslr_offset, &phys_base)) - continue; + if (!calc_kaslr_offset_from_page_tables(pgd, &kaslr_offset, + &phys_base)) { + if (!calc_kaslr_offset_from_idt(idtr, pgd, + &kaslr_offset, + &phys_base)) + continue; + } if (verify_kaslr_offset(kaslr_offset)) goto found; diff --git a/symbols.c b/symbols.c index 70b1455..08e9995 100644 --- a/symbols.c +++ b/symbols.c @@ -634,8 +634,11 @@ kaslr_init(void) } } - if (SADUMP_DUMPFILE() || VMSS_DUMPFILE()) + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) { + /* Need for kaslr_offset and phys_base */ kt->flags2 |= KASLR_CHECK; + st->_stext_vmlinux = UNINITIALIZED; + } } /* -- 2.11.0

Use LA57 bit in CR4 to check whether 5-level paging enabled. Initialize machdep to 5-level paging operation mode used by x86_64_kvtop. Replaced *_get_cr3_idtr() set of functions by *_get_cr3_cr4_idtr(). Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; --- defs.h | 4 ++-- kaslr_helper.c | 31 ++++++++++++++++++++----------- sadump.c | 3 ++- vmware_vmss.c | 3 ++- 4 files changed, 26 insertions(+), 15 deletions(-) diff --git a/defs.h b/defs.h index d024756..9594950 100644 --- a/defs.h +++ b/defs.h @@ -6626,7 +6626,7 @@ struct sadump_data; struct sadump_data *get_sadump_data(void); int sadump_calc_kaslr_offset(ulong *); int sadump_get_nr_cpus(void); -int sadump_get_cr3_idtr(int, ulong *, ulong *); +int sadump_get_cr3_cr4_idtr(int, ulong *, ulong *, ulong *); /* * qemu.c @@ -6680,7 +6680,7 @@ int vmware_vmss_memory_dump(FILE *); void dump_registers_for_vmss_dump(void); int vmware_vmss_valid_regs(struct bt_info *); int vmware_vmss_get_nr_cpus(void); -int vmware_vmss_get_cr3_idtr(int, ulong *, ulong *); +int vmware_vmss_get_cr3_cr4_idtr(int, ulong *, ulong *, ulong *); int vmware_vmss_phys_base(ulong *phys_base); int vmware_vmss_set_phys_base(ulong); diff --git a/kaslr_helper.c b/kaslr_helper.c index a0b537e..f9ed56b 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -251,7 +251,7 @@ qemu_get_nr_cpus(void) } static int -qemu_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +qemu_get_cr3_cr4_idtr(int cpu, ulong *cr3, ulong *cr4, ulong *idtr) { QEMUCPUState *cpustat; @@ -266,6 +266,7 @@ qemu_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) return FALSE; *cr3 = cpustat->cr[3]; + *cr4 = cpustat->cr[4]; *idtr = cpustat->idt.base; return TRUE; @@ -344,14 +345,14 @@ get_nr_cpus(void) } static int -get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +get_cr3_cr4_idtr(int cpu, ulong *cr3, ulong *cr4, ulong *idtr) { if (SADUMP_DUMPFILE()) - return sadump_get_cr3_idtr(cpu, cr3, idtr); + return sadump_get_cr3_cr4_idtr(cpu, cr3, cr4, idtr); else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) - return qemu_get_cr3_idtr(cpu, cr3, idtr); + return qemu_get_cr3_cr4_idtr(cpu, cr3, cr4, idtr); else if (VMSS_DUMPFILE()) - return vmware_vmss_get_cr3_idtr(cpu, cr3, idtr); + return vmware_vmss_get_cr3_cr4_idtr(cpu, cr3, cr4, idtr); return FALSE; } @@ -483,10 +484,11 @@ calc_kaslr_offset_from_idt(uint64_t idtr, uint64_t pgd, ulong *kaslr_offset, ulo #define PTI_USER_PGTABLE_BIT PAGE_SHIFT #define PTI_USER_PGTABLE_MASK (1 << PTI_USER_PGTABLE_BIT) #define CR3_PCID_MASK 0xFFFull +#define CR4_LA57 (1 << 12) int calc_kaslr_offset(ulong *ko, ulong *pb) { - uint64_t cr3 = 0, idtr = 0, pgd = 0; + uint64_t cr3 = 0, cr4 = 0, idtr = 0, pgd = 0; ulong kaslr_offset, phys_base; ulong kaslr_offset_kdump, phys_base_kdump; int cpu, nr_cpus; @@ -497,7 +499,7 @@ calc_kaslr_offset(ulong *ko, ulong *pb) nr_cpus = get_nr_cpus(); for (cpu = 0; cpu < nr_cpus; cpu++) { - if (!get_cr3_idtr(cpu, &cr3, &idtr)) + if (!get_cr3_cr4_idtr(cpu, &cr3, &cr4, &idtr)) continue; if (!cr3) @@ -514,13 +516,20 @@ calc_kaslr_offset(ulong *ko, ulong *pb) * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some * variables are not initialized yet. Set up them here to call kvtop(). * - * TODO: XEN and 5-level is not supported + * TODO: XEN is not supported */ vt->kernel_pgd[0] = pgd; machdep->last_pgd_read = vt->kernel_pgd[0]; - machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; - machdep->machspec->pgdir_shift = PGDIR_SHIFT; - machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; + if (cr4 & CR4_LA57) { + machdep->flags |= VM_5LEVEL; + machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_5LEVEL; + machdep->machspec->pgdir_shift = PGDIR_SHIFT_5LEVEL; + machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD_5LEVEL; + } else { + machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; + machdep->machspec->pgdir_shift = PGDIR_SHIFT; + machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; + } if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), "pgd", RETURN_ON_ERROR)) continue; diff --git a/sadump.c b/sadump.c index 08893c4..d75c66b 100644 --- a/sadump.c +++ b/sadump.c @@ -1679,7 +1679,7 @@ sadump_get_nr_cpus(void) } int -sadump_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +sadump_get_cr3_cr4_idtr(int cpu, ulong *cr3, ulong *cr4, ulong *idtr) { struct sadump_smram_cpu_state scs; @@ -1688,6 +1688,7 @@ sadump_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) return FALSE; *cr3 = scs.Cr3; + *cr4 = scs.Cr4; *idtr = ((uint64_t)scs.IdtUpper)<<32 | (uint64_t)scs.IdtLower; return TRUE; diff --git a/vmware_vmss.c b/vmware_vmss.c index 952ac48..52d58e8 100644 --- a/vmware_vmss.c +++ b/vmware_vmss.c @@ -879,12 +879,13 @@ vmware_vmss_get_nr_cpus(void) } int -vmware_vmss_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +vmware_vmss_get_cr3_cr4_idtr(int cpu, ulong *cr3, ulong *cr4, ulong *idtr) { if (cpu >= vmss.num_vcpus || vmss.vcpu_regs[cpu] != REGS_PRESENT_ALL) return FALSE; *cr3 = vmss.regs64[cpu]->cr[3]; + *cr4 = vmss.regs64[cpu]->cr[4]; *idtr = vmss.regs64[cpu]->idtr; return TRUE; -- 2.11.0

Qemu and VMWare facilities rely only on CPU #0 to provide CR3 and IDTR. But these registers can be not initialized or clobbered, depending on the state of CPU. For example, kernel can trigger triple fault by zeroing IDTR and doing int3. This is used in Linux to reboot machine using triple fault: "reboot=t" cmdline. In that case CPU which triggered triple fault will have zeroed IDTR. Generalize the method used by Sadump facility to analyze every pair of registers from all available CPUs. Create subfunctions for easy reading. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; Acked-by: Lianbo Jiang <lijiang(a)redhat.com&gt; --- defs.h | 8 +- diskdump.c | 6 ++ kaslr_helper.c | 278 +++++++++++++++++++++++++++++++++------------------------ netdump.c | 6 ++ sadump.c | 36 ++------ vmware_vmss.c | 14 ++- 6 files changed, 195 insertions(+), 153 deletions(-) diff --git a/defs.h b/defs.h index 00786c2..d024756 100644 --- a/defs.h +++ b/defs.h @@ -6457,6 +6457,7 @@ void display_ELF_note(int, int, void *, FILE *); void *netdump_get_prstatus_percpu(int); int kdump_kaslr_check(void); void display_vmcoredd_note(void *ptr, FILE *ofp); +int kdump_get_nr_cpus(void); QEMUCPUState *kdump_get_qemucpustate(int); void kdump_device_dump_info(FILE *); void kdump_device_dump_extract(int, char *, FILE *); @@ -6505,6 +6506,7 @@ void process_elf32_notes(void *, ulong); void process_elf64_notes(void *, ulong); void dump_registers_for_compressed_kdump(void); int diskdump_kaslr_check(void); +int diskdump_get_nr_cpus(void); QEMUCPUState *diskdump_get_qemucpustate(int); void diskdump_device_dump_info(FILE *); void diskdump_device_dump_extract(int, char *, FILE *); @@ -6623,7 +6625,8 @@ void sadump_unset_zero_excluded(void); struct sadump_data; struct sadump_data *get_sadump_data(void); int sadump_calc_kaslr_offset(ulong *); -int sadump_get_cr3_idtr(ulong *, ulong *); +int sadump_get_nr_cpus(void); +int sadump_get_cr3_idtr(int, ulong *, ulong *); /* * qemu.c @@ -6676,7 +6679,8 @@ void get_vmware_vmss_regs(struct bt_info *, ulong *, ulong *); int vmware_vmss_memory_dump(FILE *); void dump_registers_for_vmss_dump(void); int vmware_vmss_valid_regs(struct bt_info *); -int vmware_vmss_get_cr3_idtr(ulong *, ulong *); +int vmware_vmss_get_nr_cpus(void); +int vmware_vmss_get_cr3_idtr(int, ulong *, ulong *); int vmware_vmss_phys_base(ulong *phys_base); int vmware_vmss_set_phys_base(ulong); diff --git a/diskdump.c b/diskdump.c index 63a08a1..b33fcf3 100644 --- a/diskdump.c +++ b/diskdump.c @@ -2517,6 +2517,12 @@ diskdump_kaslr_check() } #ifdef X86_64 +int +diskdump_get_nr_cpus(void) +{ + return dd->num_qemu_notes; +} + QEMUCPUState * diskdump_get_qemucpustate(int cpu) { diff --git a/kaslr_helper.c b/kaslr_helper.c index bb19e54..a0b537e 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -240,21 +240,30 @@ get_vmcoreinfo(ulong elfcorehdr, ulong *addr, int *len) } static int -qemu_get_cr3_idtr(ulong *cr3, ulong *idtr) +qemu_get_nr_cpus(void) +{ + if (DISKDUMP_DUMPFILE()) + return diskdump_get_nr_cpus(); + else if (KDUMP_DUMPFILE()) + return kdump_get_nr_cpus(); + + return 0; +} + +static int +qemu_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) { QEMUCPUState *cpustat; - if (DISKDUMP_DUMPFILE()) { - cpustat = diskdump_get_qemucpustate(0); - } else if (KDUMP_DUMPFILE()) { - cpustat = kdump_get_qemucpustate(0); - } else { + if (DISKDUMP_DUMPFILE()) + cpustat = diskdump_get_qemucpustate(cpu); + else if (KDUMP_DUMPFILE()) + cpustat = kdump_get_qemucpustate(cpu); + else return FALSE; - } - if (!cpustat) { + if (!cpustat) return FALSE; - } *cr3 = cpustat->cr[3]; *idtr = cpustat->idt.base; @@ -321,18 +330,55 @@ quit: return ret; } +static int +get_nr_cpus(void) +{ + if (SADUMP_DUMPFILE()) + return sadump_get_nr_cpus(); + else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) + return qemu_get_nr_cpus(); + else if (VMSS_DUMPFILE()) + return vmware_vmss_get_nr_cpus(); + + return 0; +} + +static int +get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +{ + if (SADUMP_DUMPFILE()) + return sadump_get_cr3_idtr(cpu, cr3, idtr); + else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) + return qemu_get_cr3_idtr(cpu, cr3, idtr); + else if (VMSS_DUMPFILE()) + return vmware_vmss_get_cr3_idtr(cpu, cr3, idtr); + + return FALSE; +} + +#define BANNER "Linux version" +static int +verify_kaslr_offset(ulong kaslr_offset) +{ + char buf[sizeof(BANNER)]; + ulong linux_banner_paddr; + + if (!kvtop(NULL, st->linux_banner_vmlinux + kaslr_offset, + &linux_banner_paddr, CRASHDEBUG(1))) + return FALSE; + + if (!readmem(linux_banner_paddr, PHYSADDR, buf, sizeof(buf), + "linux_banner", RETURN_ON_ERROR)) + return FALSE; + + if (!STRNEQ(buf, BANNER)) + return FALSE; + + return TRUE; +} + /* - * Calculate kaslr_offset and phys_base - * - * kaslr_offset: - * The difference between original address in System.map or vmlinux and - * actual address placed randomly by kaslr feature. To be more accurate, - * kaslr_offset = actual address - original address - * - * phys_base: - * Physical address where the kerenel is placed. In other words, it's a - * physical address of __START_KERNEL_map. This is also decided randomly by - * kaslr. + * IDT based method to calculate kaslr_offset and phys_base * * kaslr offset and phys_base are calculated as follows: * @@ -370,17 +416,61 @@ quit: * Note that the address (A) cannot be used instead of (E) because (A) is * not direct map address, it's a fixed map address. * - * This solution works in most every case, but does not work in the - * following case. + * NOTE: This solution works in most every case, but does not work in the + * following case. If the dump is captured on early stage of kernel boot, + * IDTR points to the early IDT table(early_idts) instead of normal + * IDT(idt_table). Need enhancement. + */ +static int +calc_kaslr_offset_from_idt(uint64_t idtr, uint64_t pgd, ulong *kaslr_offset, ulong *phys_base) +{ + uint64_t idtr_paddr; + ulong divide_error_vmcore; + int verbose = CRASHDEBUG(1)? 1: 0; + + if (!idtr) + return FALSE; + + /* Convert virtual address of IDT table to physical address */ + if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) + return FALSE; + + /* Now we can calculate kaslr_offset and phys_base */ + divide_error_vmcore = get_vec0_addr(idtr_paddr); + *kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; + *phys_base = idtr_paddr - + (st->idt_table_vmlinux + *kaslr_offset - __START_KERNEL_map); + + if (verbose) { + fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); + fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); + fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); + fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", + st->divide_error_vmlinux); + fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", + divide_error_vmcore); + } + return TRUE; +} + +/* + * Calculate kaslr_offset and phys_base * - * 1) If the dump is captured on early stage of kernel boot, IDTR points - * early IDT table(early_idts) instead of normal IDT(idt_table). - * 2) If the dump is captured whle kdump is working, IDTR points - * IDT table of 2nd kernel, not 1st kernel. + * kaslr_offset: + * The difference between original address in System.map or vmlinux and + * actual address placed randomly by kaslr feature. To be more accurate, + * kaslr_offset = actual address - original address * - * Current implementation does not support the case 1), need - * enhancement in the future. For the case 2), get kaslr_offset and - * phys_base as follows. + * phys_base: + * Physical address where the kerenel is placed. In other words, it's a + * physical address of __START_KERNEL_map. This is also decided randomly by + * kaslr. + * + * It walks through all available CPUs registers to calculate the offset/base. + * + * Also, it considers the case where dump is captured whle kdump is working, + * IDTR points to the IDT table of 2nd kernel, not 1st kernel. + * In that case, get kaslr_offset and phys_base as follows. * * 1) Get kaslr_offset and phys_base using the above solution. * 2) Get kernel boot parameter from "saved_command_line" @@ -396,110 +486,66 @@ quit: int calc_kaslr_offset(ulong *ko, ulong *pb) { - uint64_t cr3 = 0, idtr = 0, pgd = 0, idtr_paddr; - ulong divide_error_vmcore; + uint64_t cr3 = 0, idtr = 0, pgd = 0; ulong kaslr_offset, phys_base; ulong kaslr_offset_kdump, phys_base_kdump; - int ret = FALSE; - int verbose = CRASHDEBUG(1)? 1: 0; + int cpu, nr_cpus; if (!machine_type("X86_64")) return FALSE; -retry: - if (SADUMP_DUMPFILE()) { - if (!sadump_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { - if (!qemu_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else if (VMSS_DUMPFILE()) { - if (!vmware_vmss_get_cr3_idtr(&cr3, &idtr)) - return FALSE; - } else - return FALSE; + nr_cpus = get_nr_cpus(); - if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) - pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); - else - pgd = cr3 & ~CR3_PCID_MASK; + for (cpu = 0; cpu < nr_cpus; cpu++) { + if (!get_cr3_idtr(cpu, &cr3, &idtr)) + continue; - /* - * Set up for kvtop. - * - * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some - * variables are not initialized yet. Set up them here to call kvtop(). - * - * TODO: XEN and 5-level is not supported - */ - vt->kernel_pgd[0] = pgd; - machdep->last_pgd_read = vt->kernel_pgd[0]; - machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; - machdep->machspec->pgdir_shift = PGDIR_SHIFT; - machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; - if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), - "pgd", RETURN_ON_ERROR)) { - if (SADUMP_DUMPFILE()) - goto retry; - else - goto quit; - } + if (!cr3) + continue; - /* Convert virtual address of IDT table to physical address */ - if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) { - if (SADUMP_DUMPFILE()) - goto retry; + if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) + pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); else - goto quit; - } + pgd = cr3 & ~CR3_PCID_MASK; + + /* + * Set up for kvtop. + * + * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some + * variables are not initialized yet. Set up them here to call kvtop(). + * + * TODO: XEN and 5-level is not supported + */ + vt->kernel_pgd[0] = pgd; + machdep->last_pgd_read = vt->kernel_pgd[0]; + machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; + machdep->machspec->pgdir_shift = PGDIR_SHIFT; + machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; + if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), + "pgd", RETURN_ON_ERROR)) + continue; - /* Now we can calculate kaslr_offset and phys_base */ - divide_error_vmcore = get_vec0_addr(idtr_paddr); - kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; - phys_base = idtr_paddr - - (st->idt_table_vmlinux + kaslr_offset - __START_KERNEL_map); - - if (SADUMP_DUMPFILE()) { - char buf[sizeof("Linux version")]; - ulong linux_banner_paddr; - - if (!kvtop(NULL, - st->linux_banner_vmlinux + kaslr_offset, - &linux_banner_paddr, - verbose)) - goto retry; - - if (!readmem(linux_banner_paddr, - PHYSADDR, - buf, - sizeof(buf), - "linux_banner", - RETURN_ON_ERROR)) - goto retry; - - if (!STRNEQ(buf, "Linux version")) - goto retry; - } + if (!calc_kaslr_offset_from_idt(idtr, pgd, &kaslr_offset, &phys_base)) + continue; - if (CRASHDEBUG(1)) { - fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); - fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); - fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); - fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", - st->divide_error_vmlinux); - fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", - divide_error_vmcore); + if (verify_kaslr_offset(kaslr_offset)) + goto found; } + vt->kernel_pgd[0] = 0; + machdep->last_pgd_read = 0; + return FALSE; + +found: /* * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd * kernel. If we are in 2nd kernel, get kaslr_offset/phys_base * from vmcoreinfo */ - if (get_kaslr_offset_from_vmcoreinfo( - kaslr_offset, &kaslr_offset_kdump, &phys_base_kdump)) { - kaslr_offset = kaslr_offset_kdump; - phys_base = phys_base_kdump; + if (get_kaslr_offset_from_vmcoreinfo(kaslr_offset, &kaslr_offset_kdump, + &phys_base_kdump)) { + kaslr_offset = kaslr_offset_kdump; + phys_base = phys_base_kdump; } else if (CRASHDEBUG(1)) { fprintf(fp, "kaslr_helper: failed to determine which kernel was running at crash,\n"); fprintf(fp, "kaslr_helper: asssuming the kdump 1st kernel.\n"); @@ -514,11 +560,9 @@ retry: *ko = kaslr_offset; *pb = phys_base; - ret = TRUE; -quit: vt->kernel_pgd[0] = 0; machdep->last_pgd_read = 0; - return ret; + return TRUE; } #else int diff --git a/netdump.c b/netdump.c index 2ca39e2..c76d9dd 100644 --- a/netdump.c +++ b/netdump.c @@ -5197,6 +5197,12 @@ kdump_kaslr_check(void) } #ifdef X86_64 +int +kdump_get_nr_cpus(void) +{ + return nd->num_qemu_notes; +} + QEMUCPUState * kdump_get_qemucpustate(int cpu) { diff --git a/sadump.c b/sadump.c index f313528..08893c4 100644 --- a/sadump.c +++ b/sadump.c @@ -1671,44 +1671,20 @@ get_sadump_data(void) } #ifdef X86_64 -static int -get_sadump_smram_cpu_state_any(struct sadump_smram_cpu_state *smram) +int +sadump_get_nr_cpus(void) { - ulong offset; - struct sadump_header *sh = sd->dump_header; - static int apicid; - struct sadump_smram_cpu_state scs; - - if (apicid >= sh->nr_cpus) - return FALSE; - - offset = sd->sub_hdr_offset + sizeof(uint32_t) + - sd->dump_header->nr_cpus * sizeof(struct sadump_apic_state) + - apicid * sizeof(scs); - - while (apicid < sh->nr_cpus) { - apicid++; - if (!read_device(&scs, sizeof(scs), &offset)) { - error(INFO, "sadump: cannot read sub header " - "cpu_state\n"); - return FALSE; - } - if (scs.Cr3 && (scs.IdtUpper || scs.IdtLower)) { - *smram = scs; - return TRUE; - } - } - - return FALSE; + /* apicids */ + return sd->dump_header->nr_cpus; } int -sadump_get_cr3_idtr(ulong *cr3, ulong *idtr) +sadump_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) { struct sadump_smram_cpu_state scs; memset(&scs, 0, sizeof(scs)); - if (!get_sadump_smram_cpu_state_any(&scs)) + if (!sadump_get_smram_cpu_state(cpu, &scs)) return FALSE; *cr3 = scs.Cr3; diff --git a/vmware_vmss.c b/vmware_vmss.c index b168f29..952ac48 100644 --- a/vmware_vmss.c +++ b/vmware_vmss.c @@ -873,13 +873,19 @@ vmware_vmss_valid_regs(struct bt_info *bt) } int -vmware_vmss_get_cr3_idtr(ulong *cr3, ulong *idtr) +vmware_vmss_get_nr_cpus(void) { - if (vmss.num_vcpus == 0 || vmss.vcpu_regs[0] != REGS_PRESENT_ALL) + return vmss.num_vcpus; +} + +int +vmware_vmss_get_cr3_idtr(int cpu, ulong *cr3, ulong *idtr) +{ + if (cpu >= vmss.num_vcpus || vmss.vcpu_regs[cpu] != REGS_PRESENT_ALL) return FALSE; - *cr3 = vmss.regs64[0]->cr[3]; - *idtr = vmss.regs64[0]->idtr; + *cr3 = vmss.regs64[cpu]->cr[3]; + *idtr = vmss.regs64[cpu]->idtr; return TRUE; } -- 2.11.0

This method requires only valid CR3. It walks through page tree starting from __START_KERNEL_map to get real _stext and its physical address. _stext_vmlinux has to be initialized. So, requesting it by "st->_stext_vmlinux = UNINITIALIZED;" for sadump and vmware backends. Other backends may use "--kaslr=auto" to get similar effect. Use this method as a default and IDTR base as a backup. Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com&gt; Acked-by: Lianbo Jiang <lijiang(a)redhat.com&gt; --- kaslr_helper.c | 155 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- symbols.c | 5 +- 2 files changed, 157 insertions(+), 3 deletions(-) diff --git a/kaslr_helper.c b/kaslr_helper.c index f9ed56b..5945a3d 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -379,6 +379,152 @@ verify_kaslr_offset(ulong kaslr_offset) } /* + * Find virtual (VA) and physical (PA) addresses of kernel start + * + * va: + * Actual address of the kernel start (_stext) placed + * randomly by kaslr feature. To be more accurate, + * VA = _stext(from vmlinux) + kaslr_offset + * + * pa: + * Physical address where the kerenel is placed. + * + * In nokaslr case, VA = _stext (from vmlinux) + * In kaslr case, virtual address of the kernel placement goes + * in this range: ffffffff80000000..ffffffff9fffffff, or + * __START_KERNEL_map..+512MB + * + * https://www.kernel.org/doc/Documentation/x86/x86_64/mm.txt + * + * Randomized VA will be the first valid page starting from + * ffffffff80000000 (__START_KERNEL_map). Page tree entry of + * this page will contain the PA of the kernel start. + */ +static int +find_kernel_start(uint64_t pgd, ulong *va, ulong *pa) +{ + int pgd_idx, p4d_idx, pud_idx, pmd_idx, pte_idx; + uint64_t pgd_pte = 0, pud_pte, pmd_pte, pte; + + pgd_idx = pgd_index(__START_KERNEL_map); + if (machdep->flags & VM_5LEVEL) + p4d_idx = p4d_index(__START_KERNEL_map); + pud_idx = pud_index(__START_KERNEL_map); + pmd_idx = pmd_index(__START_KERNEL_map); + pte_idx = pte_index(__START_KERNEL_map); + + /* If the VM is in 5-level page table */ + if (machdep->flags & VM_5LEVEL) + *va = ~((1UL << 57) - 1); + else + *va = ~__VIRTUAL_MASK; + + FILL_PGD(pgd & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pgd_idx < PTRS_PER_PGD; pgd_idx++) { + pgd_pte = ULONG(machdep->pgd + pgd_idx * sizeof(uint64_t)); + if (pgd_pte & _PAGE_PRESENT) + break; + p4d_idx = pud_idx = pmd_idx = pte_idx = 0; + } + if (pgd_idx == PTRS_PER_PGD) + return FALSE; + *va |= (ulong)pgd_idx << __PGDIR_SHIFT; + + if (machdep->flags & VM_5LEVEL) { + FILL_P4D(pgd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; p4d_idx < PTRS_PER_P4D; p4d_idx++) { + /* reuse pgd_pte */ + pgd_pte = ULONG(machdep->machspec->p4d + p4d_idx * sizeof(uint64_t)); + if (pgd_pte & _PAGE_PRESENT) + break; + pud_idx = pmd_idx = pte_idx = 0; + } + if (p4d_idx == PTRS_PER_P4D) + return FALSE; + *va |= (ulong)p4d_idx << P4D_SHIFT; + } + + FILL_PUD(pgd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pud_idx < PTRS_PER_PUD; pud_idx++) { + pud_pte = ULONG(machdep->pud + pud_idx * sizeof(uint64_t)); + if (pud_pte & _PAGE_PRESENT) + break; + pmd_idx = pte_idx = 0; + } + if (pud_idx == PTRS_PER_PUD) + return FALSE; + *va |= (ulong)pud_idx << PUD_SHIFT; + if (pud_pte & _PAGE_PSE) { + /* 1GB page */ + *pa = pud_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PMD(pud_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pmd_idx < PTRS_PER_PMD; pmd_idx++) { + pmd_pte = ULONG(machdep->pmd + pmd_idx * sizeof(uint64_t)); + if (pmd_pte & _PAGE_PRESENT) + break; + pte_idx = 0; + } + if (pmd_idx == PTRS_PER_PMD) + return FALSE; + *va |= pmd_idx << PMD_SHIFT; + if (pmd_pte & _PAGE_PSE) { + /* 2MB page */ + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; + } + + FILL_PTBL(pmd_pte & PHYSICAL_PAGE_MASK, PHYSADDR, PAGESIZE()); + for (; pte_idx < PTRS_PER_PTE; pte_idx++) { + pte = ULONG(machdep->ptbl + pte_idx * sizeof(uint64_t)); + if (pte & _PAGE_PRESENT) + break; + } + if (pte_idx == PTRS_PER_PTE) + return FALSE; + + *va |= pte_idx << PAGE_SHIFT; + *pa = pmd_pte & PHYSICAL_PAGE_MASK; + return TRUE; +} + +/* + * Page Tables based method to calculate kaslr_offset and phys_base. + * It uses VA and PA of kernel start. + * + * kaslr offset and phys_base are calculated as follows: + * + * kaslr_offset = VA - st->_stext_vmlinux + * phys_base = PA - (VA - __START_KERNEL_map) + */ +static int +calc_kaslr_offset_from_page_tables(uint64_t pgd, ulong *kaslr_offset, + ulong *phys_base) +{ + ulong va, pa; + + if (!st->_stext_vmlinux || st->_stext_vmlinux == UNINITIALIZED) { + fprintf(fp, "%s: st->_stext_vmlinux must be initialized\n", + __FUNCTION__); + return FALSE; + } + if (!find_kernel_start(pgd, &va, &pa)) + return FALSE; + + if (CRASHDEBUG(1)) { + fprintf(fp, "calc_kaslr_offset: _stext(vmlinux): %lx\n", st->_stext_vmlinux); + fprintf(fp, "calc_kaslr_offset: kernel start VA: %lx\n", va); + fprintf(fp, "calc_kaslr_offset: kernel start PA: %lx\n", pa); + } + + *kaslr_offset = va - st->_stext_vmlinux; + *phys_base = pa - (va - __START_KERNEL_map); + return TRUE; +} + +/* * IDT based method to calculate kaslr_offset and phys_base * * kaslr offset and phys_base are calculated as follows: @@ -534,8 +680,13 @@ calc_kaslr_offset(ulong *ko, ulong *pb) "pgd", RETURN_ON_ERROR)) continue; - if (!calc_kaslr_offset_from_idt(idtr, pgd, &kaslr_offset, &phys_base)) - continue; + if (!calc_kaslr_offset_from_page_tables(pgd, &kaslr_offset, + &phys_base)) { + if (!calc_kaslr_offset_from_idt(idtr, pgd, + &kaslr_offset, + &phys_base)) + continue; + } if (verify_kaslr_offset(kaslr_offset)) goto found; diff --git a/symbols.c b/symbols.c index 70b1455..08e9995 100644 --- a/symbols.c +++ b/symbols.c @@ -634,8 +634,11 @@ kaslr_init(void) } } - if (SADUMP_DUMPFILE() || VMSS_DUMPFILE()) + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) { + /* Need for kaslr_offset and phys_base */ kt->flags2 |= KASLR_CHECK; + st->_stext_vmlinux = UNINITIALIZED; + } } /* -- 2.11.0

在 2020年11月11日 13:17, HAGIO KAZUHITO(萩尾　一仁) 写道: Thank you for checking this error, Kazu. I did not make the test for this patch because it was marked as Verified as below: Patch #2: new patch. 5 level paging support. Verified. Seems that making the test myself is a good way to check for errors ASAP. Thanks. Lianbo