[Crash-utility] [PATCH] Expand search for banner string to get phys_base

[Dave Anderson]

----- Original Message -----
> Hi Dave,
> 
> When tring to debug a kernel core file generated from Debian 9.2 + 4.9 kernel
> with base address randomized (this core is create for a qemu vm), it gives
> the error as:
> 
> WARNING: cannot determine physical base address: defaulting to 0
> 
> GNU gdb (GDB) 7.6
> Copyright (C) 2013 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law. Type "show copying"
> and "show warranty" for details.
> This GDB was configured as "x86_64-unknown-linux-gnu"...
> 
> WARNING: failed to init kexec backup region
> WARNING: cannot read linux_banner string
> 
> Taking a look at the code around x86_64_virt_phys_base(), it determines
> phys_base by searching around machdep->machspec->phys_base(in my case it's
> 0) +/-16MB for banner string at banner string offset (get from symbol).
> However, with base address randomized, the real physical address could be
> far from 0 (or virtual address 0xffffffff80000000). Therefore, -16MB/+16MB
> is not enough especially for machine with large ram . I increased it to
> 0xFFFFF00000 for my 256g core file and it works.
> 
> - for (phys = (ulong)(-MEGABYTES(16)); phys != MEGABYTES(16+1);
> + for (phys = (ulong)(-MEGABYTES(32)); phys != 0xFFFFF00000;
> phys += MEGABYTES(1)) {
> if (readmem(linux_banner_phys + phys, PHYSADDR, buf,
> strlen("Linux version"), "linux_banner search",
> QUIET|RETURN_ON_ERROR) && STRNEQ(buf, "Linux version")) {
> if (CRASHDEBUG(1))
> fprintf(fp,
> "virtual dump phys_base: %lx %s\n", phys,
> machdep->machspec->phys_base != phys ?
> "override" : "");
> machdep->machspec->phys_base = phys;
> return TRUE;
> }
> }
> 
> Please feel free to let me know if you need sample dumps to verify. Thx.
> 
> Regards,
> Ran

Hello Ran,

The patch is fine, especially given that the x86_64_virt_phys_base() is 
a last-ditch effort to determine phys_base.  Queued for crash-7.2.6:

  https://github.com/crash-utility/crash/commit/5aa3c1da3e22037aeeca8d745cec1481137c79fe

Thanks,
  Dave