[Crash-utility] crash: page excluded: kernel virtual address: ffffffff81e3da50 type: "page_offset_base"

[Cao jin]

On 11/23/2017 10:03 PM, Dave Anderson wrote:
>> Hi Dave,
>> Â  Because I didn't subscribe the list, so please CC me when reply:) My
>> colleague help to forward your reply to me, so I decide to reply
>> directly in order to keep this mail in the thread other than new a thread.
>>
>> On 11/23/2017 02:04 PM, Fei, Jie/费 杰 wrote:
>>>
>>>
>>>
>>> -------- Forwarded Message --------
>>> Subject: 	Re: [Crash-utility] crash: page excluded: kernel virtual
>>> address: ffffffff81e3da50 type: "page_offset_base"
>>> Date: 	Wed, 22 Nov 2017 09:35:40 -0500
>>> From: 	Dave Anderson <anderson at redhat.com>
>>> Reply-To: 	Discussion list for crash utility usage, maintenance and
>>> development <crash-utility at redhat.com>
>>> To: 	Discussion list for crash utility usage, maintenance and
>>> development <crash-utility at redhat.com>
>>>
>>>
>>>
>>> ----- Original Message -----
>>>> Hi,
>>>>
>>>> I am using the latest crash tool & kernel 4.14 compiled from source,
>>>> and
>>>> I got the following error message. As I searched, this is fixed in
>>>> crash
>>>> 7.2.0, but I still have it here. So, is anyone has a clue?
>>>
>>> It's always going to be a crap-shoot with very recent upstream kernels,
>>> but you haven't given enough information to determine what the issue is.
>>>
>>
>> Sorry, I am to new dump/crash area.
>>
>>> If the vmcore was created by "virsh dump", and the kernel has KASLR
>>> enabled,
>>> then it's just not supported at this time.  Otherwise, perhaps the
>>> output of
>>> "crash -d8" may yield some clues.
>>>
>>
>> I am using kdump to create the vmcore. Actually, I did solve this issue
>> by add "nokaslr" to kernel parameter when I used the built-in crash of
>> Fedora. But when turn to the compiled version of my own, that solution
>> don't work. here is the output of `crash -d8`:
>>
[snip]
> 
> OK, so you seem to be describing two issues:
> 
>  (1) With KASLR enabled, the vmcore cannot be read by either
>      Fedora's 7.2.0-1 or upstream 7.2.0++.
>  (2) With KASLR disabled, the vmcore can be read by Fedora's
>      7.2.0-1, but cannot be read by 7.2.0++,
> 

Yes, you give a good summary, but it is Fedora 26's 7.1.9.1(I did the
test in Fedora 26-4.13.10-200.fc26.x86_64 a weeks ago, now upgrade to
27, and the fedora crash version now is 7.1.9.3), not 7.2.0-1.

Now I have upgraded to Fedora 27, I have 2 kernels:
1. fedora kernel is 4.13.13-300.fc27.x86_64
2. kernel 4.14.0 compiled from source.

and 2 crash tool:
1. Fedora's 7.1.9.3
2. 7.2.0++ compiled from source

> When you run crash on the live system, what happens when:
> 
>  (1) KASLR is enabled, running Fedora's 7.2.0-1
>  (2) KASLR is enabled, running upstream 7.2.0++
>  (2) KASLR is disabled, running Fedora's 7.2.0-1
>  (3) KASLR is disabled, running upstream 7.2.0++
> 
> I don't see anything unusual in the output above, presuming the
> the phys_base of 0 is correct.  When you run crash on the live
> system, what is the output of "help -m | grep phys_base">


During my test recent days, I find some new interesting things:
sometimes the vmcore file is exceptional small, like about 500k, while
in normal condition, it is about 2G(machine has 4G memory). I confirmed
the following facts with tests:

  1. kernel 4.14.0: without nokaslr, vmcore's size looks ok, about 2G
  2. kernel 4.14.0: with nokaslr, vmcore's size looks wrong, about 500k

So I am not sure some of my previous tests are reliable.

I will do a new round test, and capture the -d8 out in both
condition(live system & dump file)

BTW, I think the fedora version crash tool should works well with fedora
kernel? But in my test, crash 7.1.9.3 & 4.13.13-300.fc27.x86_64, crash
report:

  crash: cannot resolve "init_level4_pgt"

which is said is solved in crash 7.2.0

> I need to compare the crash -d8 output above with the same
> crash -d8 output from the working session using the same
> KASLR disabled vmcore, showing at least up until the point that
> it does the readmem of "page_offset_base" above?
> 
> Also, if you can make the 2 vmcores available, please send me
> the details of how to download them in a private email to
> anderson at redhat.com or anderson at prospeed.net.  If you have
> modified/rebuilt the Fedora kernel, I would also need a copy
> of the vmlinux file as well.
> 

Thanks very much, Dave, I will give you feedback after I have done the
new round test.  If you have any suggestion for test, also please tell me:)

-- 
Sincerely,
Cao jin