crash (8.0.5-1) unstable; urgency=medium * New upstream * ceacceef7d13 crash-8.0.4 -> crash-8.0.5 * eedf12d47584 gdb: fix "p" command to print module variables correctly * 7d4daf0c0354 x86_64: Fix "bt" command to handle IRQ exception frames properly * ced754d3f8ce Fix segmentation fault in value_search_module_6_4() * ce47cb8dabb5 x86_64: Fix for "bt" command incorrectly printing "bogus exception frame" warning * 5b24e363a898 get vmalloc start address from vmcoreinfo * 18bf18cf2e6b arm64: Add support for vmemmap symbol in vmcoreinfo * 3f205d1d4af5 LoongArch64: Fixed link errors when build on LOONGARCH64 machine * cc3049044a72 gdb-10.2.patch: Fix duplicated code by re-applying patch * 5977936c0a91 Add "log -c" option to display printk caller id * 3d60d9d40457 Fix "mount" command failure on Linux 6.8-rc1 and later * e924f6d8a1d2 LoongArch64: Add LoongArch64 architecture support information * c3939d2e1930 LoongArch64: Add "--kaslr" command line option support * 0f34aa46cae9 LoongArch64: Add 'irq' command support * be214379cdb9 LoongArch64: Add 'help -r' command support * ab4c69f992ad LoongArch64: Add 'help -m/M' command support * 87f031ada9df LoongArch64: Add 'bt' command support * 756158045183 LoongArch64: Add 'mach' command support * 7b8db357511c LoongArch64: Add 'pte' command support * 89ae0e226fa9 LoongArch64: Make the crash tool successfully enter the crash command line * 35a2472e7a30 Add LoongArch64 framework code support * 28891d112754 symbols: skip the module if the given address is not within its address range * aed1b7d3a064 x86_64: Fix "bt" command not printing stack trace enough * a69496279133 RISCV64: Add per-cpu overflow stacks support * 12fbed3280a1 RISCV64: Add per-cpu IRQ stacks support * d86dc6901ce7 RISCV64: Add support for 'bt -e' option * edb2bd52885c arm64: support HW Tag-Based KASAN (MTE) mode * 53d2577cef98 x86_64: check bt->bptr before calculate framesize * 38435c3acec0 help.c: Remove "kmem -l" help messages * 19d3c56c9fca arm64: rewrite the arm64_get_vmcoreinfo_ul to arm64_get_vmcoreinfo * 9b69093e623f RISCV64: Fix 'bt' output when no ra on the stack top * 5187a0320cc5 RISCV64: Dump NT_PRSTATUS in 'help -n' * d0164e7e480a s390x: uncouple physical and virtual memory spaces * 4c78eb4a9199 s390x: fix virtual vs physical address confusion * 2e513114e7d7 Fix identity_map_base value dump on S390 * c15da0752629 use NR_SWAPCACHE when nr_swapper_spaces isn't available * 0c5ef6a4a3a2 symbols: skip load .init.* sections if module was successfully initialized * f2ee6fa6c841 symbols: expand all kernel module symtable if not all expanded previously * 582febffa8b3 zram: Fixes for lookup_swap_cache() * d65e5d3eae0d Fix typos in offset_table and missing "help -o" items * 38acd02c7fc0 Fix "rd" command for zram data display in Linux 6.2 and later * 61c8fdb1d7f7 Mark start of 8.0.5 development phase with version 8.0.4++ -- Troy Heber Tue, 30 Apr 2024 15:04:19 -0600 crash (8.0.4-1) unstable; urgency=medium * New upstream (Closes: #1057009) * a6832f608cb5 crash-8.0.3 -> crash-8.0.4 * 262b1c71b485 Fix printing incorrect panic string issue * 55a43bcefa20 Fix compilation error and warning with gcc-4.8.5 * fc6ed525407f gdb: Verify COFF symbol stringtab offset * a8e5e4cbae54 gdb: Avoid buffer overflow in ada_decode * 0172e35083b5 Fix "rd" command to display data on zram on Linux 5.17 and later * ac097d6cb157 diskdump: add hook for additional checks on prstatus notes validity * 5e758aaa0fd8 Make "clear" external command runnable without "!" and alias-able * 578fc08b8255 memory_driver: Support overriding kernel directory * 1cfd513ea9c8 memory_driver: Use designated initializer for 'crash_dev' * 3c44056efef2 memory_driver: Ensure PWD points to the current directory * c9a732d0f6ab arm64: Fix "vtop" command to display swap information on Linux 5.19 and later * a9291fc1bf61 ppc64: do page traversal if vmemmap_list not populated * 27f3ccd6c296 In verify_version() don't require specific syment type values for linux_banner symbol to get its address * 3253e5ac87c6 Fix "ps/vm" commands to display the memory usage for exiting tasks * 1aa93cd33fa1 RISCV64: Add KASLR support * f774fe0f59b4 deduplicate kernel_version open-coded parser * eeaed479a438 Fix "kmem -s|-S" not working properly when CONFIG_SLAB_FREELIST_HARDENED is enabled * bc145861bfeb Revert "Fix "kmem -s|-S" not working properly on RHEL8.6 and later" * ff963b795b3f RISCV64: Use va_kernel_pa_offset in VTOP() * 69f38d777450 Fix "ps/vm" commands to display correct memory usage * 558aecc98987 Fix "foreach" command with "DE" state to display only expected tasks * c74f375e0ef7 Fix get_linux_banner_from_vmlinux() for vmlinux without ".rodata" symbol * aa5763800d61 Fix warning about kernel version inconsistency during crash startup * f0b59524624b Fix segmentation fault by "tree -s" option with Maple Tree * 38d35bd1423c Fix "irq [-a|-s]" options on Linux 6.5-rc1 and later * d17d51a92a3a Exclude zero entries from do_maple_tree() return value * b76e116c50ff vmware: Improve output when we fail to read vmware 'vmsn' file * 6d0be1316aa3 Fix "irq -a" option on Linux 6.0 and later * 4ee56105881d Fix compilation error due to new strlcpy function that glibc added * 88580068b7dd Fix failure of gathering task table on Linux 6.5-rc1 and later * 7750e61fdb2a Support module memory layout change on Linux 6.4 * 8b24b2025fb4 ppc64: Remove redundant PTE checks * 6c8cd9b5dcf4 arm64: Fix again segfault in arm64_is_kernel_exception_frame() when corrupt stack pointer address is given * 91a76958e4a8 Revert "Fix segfault in arm64_is_kernel_exception_frame() when corrupt stack pointer address is given" * ec1e61b33a70 Fix invalid structure size error during crash startup on ppc64 * 77d8621876c1 x86_64: Fix "bt" command printing stale entries on Linux 6.4 and later * 8527bbff71cb Output prompt when stdin is not a TTY * 9868ebc8e648 Fix segfault in arm64_is_kernel_exception_frame() when corrupt stack pointer address is given * db8c030857b4 diskdump/netdump: fix segmentation fault caused by failure of stopping CPUs * a0eceb041dfa arm64/x86_64: Enhance "vtop" command to show zero_pfn information * 342cf340ed03 Fix "kmem -v" option displaying no regions on Linux 6.3 and later * 58c1816521c2 Fix failure of "dev -d|-D" options on Linux 6.4 and later kernels * 040a56e9f9d0 Fix kernel version macros for revision numbers over 255 * 2505a65ff547 Mark start of 8.0.4 development phase with version 8.0.3++ -- Troy Heber Mon, 27 Nov 2023 14:43:03 -0700 crash (8.0.3+ds1-3) unstable; urgency=medium * New upload to resolve missing gdb -- Troy Heber Thu, 02 Nov 2023 14:23:03 -0600 crash (8.0.3-2) unstable; urgency=medium * Fix to include gdb -- Troy Heber Mon, 30 Oct 2023 09:12:36 -0600 crash (8.0.3-1) unstable; urgency=medium * New upstream (Closes: #1054805) * https://github.com/crash-utility/crash/compare/8.0.2...8.0.3 -- Troy Heber Sat, 28 Oct 2023 12:21:36 -0600 crash (8.0.2-1) unstable; urgency=medium * New upstream * commit f1cd581d1c4afa5b8ffdfaa6a3ea9f545fe4ec91 * Author: Kazuhito Hagio * Date: Wed Nov 16 13:13:39 2022 +0900 * * crash-8.0.1 -> crash-8.0.2 * * Signed-off-by: Kazuhito Hagio * * commit a158590f475c8d6d504b0c5e28b3cd91cfd47877 * Author: Lianbo Jiang * Date: Wed Nov 9 14:21:57 2022 +0800 * * Fix for "ps/vm" commands to display correct %MEM and RSS values * * The ps/vm commands may print the bogus value of the %MEM and RSS, the * reason is that the counter of rss stat is updated in asynchronous manner * and may become negative, when the SPLIT_RSS_COUNTING is enabled in * kernel. * * As a result, crash will read it from memory and convert from negative to * unsigned long integer, eventually it overflows and gets a big integer. * For example: * * crash> ps 1393 * PID PPID CPU TASK ST %MEM VSZ RSS COMM * 1393 1 24 ffff9584bb542100 RU 541298032135.9 4132 18014398509481908 enlinuxpc64 * ^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^ * * This is unexpected, crash needs to correct its value for this case. * * Signed-off-by: Lianbo Jiang * * commit 21139d9456ee41ffc8cec804dc530d6934ddac89 * Author: Matias Ezequiel Vara Larsen * Date: Mon Oct 24 11:35:29 2022 +0200 * * Fix segmentation fault in page_flags_init_from_pageflag_names() * * When read_string() fails in page_flags_init_from_pageflag_names(), * error() dereferences the name variable to print the string that the * variable points to. However, name points to a string that is not in * crash's memory-space thus triggering a segmentation fault. * * This patch replaces "%s" in the error message with "%lx" so the address * is printed instead. Also replaces "%ld" for mask with "%lx". * * [ kh: changed the conversion specifiers and commit message ] * * Signed-off-by: Matias Ezequiel Vara Larsen * Signed-off-by: Kazuhito Hagio * * commit 487551488b15fcd135b29990593699a121730219 * Author: Lianbo Jiang * Date: Tue Oct 4 18:57:11 2022 +0800 * * ppc64: still allow oneto move on if the emergency stacks info fails to * initialize * * Currently crash will fail and then exit, if the initialization of * the emergency stacks information fails. In real customer environments, * sometimes, a vmcore may be partially damaged, although such vmcores * are rare. For example: * * # ./crash ../3.10.0-1127.18.2.el7.ppc64le/vmcore * ../3.10.0-1127.18.2.el7.ppc64le/vmlinux -s * crash: invalid kernel virtual address: 38 type: * "paca->emergency_sp" * # * * Lets try to keep loading vmcore if such issues happen, so call * the readmem() with the RETURN_ON_ERROR instead of FAULT_ON_ERROR, * which allows the crash move on. * * Reported-by: Dave Wysochanski * Signed-off-by: Lianbo Jiang * * commit 3b5e3e1583a1f596360c04e8a322e30cf88f27ab * Author: Tao Liu * Date: Mon Sep 19 17:49:23 2022 +0800 * * Let "kmem" print task context with physical address * * Patch [1] enables "kmem" to print task context if the given virtual * address is a vmalloced stack. * * This patch lets "kmem" print task context also when the given address * is a physical address. * * Before: * crash> kmem 1883700e28 * VMAP_AREA VM_STRUCT ADDRESS RANGE SIZE * ffff94eb9102c640 ffff94eb9102b140 ffffb7efce9b8000 - ffffb7efce9bd000 20480 * * PAGE PHYSICAL MAPPING INDEX CNT FLAGS * ffffdd28220dc000 1883700000 0 0 1 50000000000000 * * After: * crash> kmem 1883700e28 * PID: 847 * COMMAND: "khungtaskd" * TASK: ffff94f8038f4000 [THREAD_INFO: ffff94f8038f4000] * CPU: 72 * STATE: TASK_RUNNING (PANIC) * * VMAP_AREA VM_STRUCT ADDRESS RANGE SIZE * ffff94eb9102c640 ffff94eb9102b140 ffffb7efce9b8000 - ffffb7efce9bd000 20480 * * PAGE PHYSICAL MAPPING INDEX CNT FLAGS * ffffdd28220dc000 1883700000 0 0 1 50000000000000 * * [1]: https://listman.redhat.com/archives/crash-utility/2022-September/010115.html * * [ kh: squashed the 4/4 patch into 3/4 ] * * Signed-off-by: Tao Liu * Signed-off-by: Kazuhito Hagio * * commit 60cb8650a0126abda661c44d198ebde514eca3e2 * Author: Tao Liu * Date: Mon Sep 19 17:49:22 2022 +0800 * * Fix page offset issue when converting physical to virtual address * * When trying to convert a physical address to its virtual * address in dump_vmap_area() and dump_vmlist(), the vi->retval * is added by 2 values: the page aligned address "pcheck" * and page offset address "PAGEOFFSET(paddr)". * * However "paddr" is given by "pcheck", is also page aligned, * so "PAGEOFFSET(paddr)" is always 0. * * In this patch, we will use PAGEOFFSET(vi->spec_addr) to give the * page offset, vi->spec_addr is the physical address we'd like * to convert, which contains the correct page offset. * * Signed-off-by: Tao Liu * * commit ad1397a73594d65aaad9d0b9a94a1dd75d8c61dd * Author: Tao Liu * Date: Mon Sep 19 17:49:21 2022 +0800 * * Fix "kmem" failing to print task context when address is vmalloced stack * * When kernel enabled CONFIG_VMAP_STACK, stack can be allocated to * vmalloced area. Currently crash didn't handle the case, as a result, * "kmem" will not print the task context as expected. This patch fix the * bug by checking if the address is a vmalloced stack first. * * Before: * crash> kmem ffffb7efce9bbe28 * VMAP_AREA VM_STRUCT ADDRESS RANGE SIZE * ffff94eb9102c640 ffff94eb9102b140 ffffb7efce9b8000 - ffffb7efce9bd000 20480 * * PAGE PHYSICAL MAPPING INDEX CNT FLAGS * ffffdd28220dc000 1883700000 0 0 1 50000000000000 * * After: * crash> kmem ffffb7efce9bbe28 * PID: 847 * COMMAND: "khungtaskd" * TASK: ffff94f8038f4000 [THREAD_INFO: ffff94f8038f4000] * CPU: 72 * STATE: TASK_RUNNING (PANIC) * * VMAP_AREA VM_STRUCT ADDRESS RANGE SIZE * ffff94eb9102c640 ffff94eb9102b140 ffffb7efce9b8000 - ffffb7efce9bd000 20480 * * PAGE PHYSICAL MAPPING INDEX CNT FLAGS * ffffdd28220dc000 1883700000 0 0 1 50000000000000 * * Signed-off-by: Tao Liu * * commit 4ea3a806d11f000f2eb1ddc72c2b7a543e319f64 * Author: Lianbo Jiang * Date: Fri Sep 16 14:00:01 2022 +0800 * * Fix for the invalid linux_banner pointer issue * * Currently, crash may fail with the following error: * * # ./crash -s vmlinux vmcore * WARNING: invalid linux_banner pointer: 65762078756e694c * crash: vmlinux and vmcore do not match! * * The reason is that the type of the symbol in the data segment may be * defined as 'D' or 'd'. The crash only handled the type 'D', but it * didn't deal with the type 'd'. For example: * * # nm vmlinux | grep linux_banner * ffffffff827cfa80 d linux_banner * * It has been observed that a vmlinux compiled by clang has this type. * Let's add the type 'd' recognition to solve such issue. * * Signed-off-by: Lianbo Jiang * * commit bdbf5887d6259ea3108d4fa674f3794adad54d52 * Author: Kazuhito Hagio * Date: Thu Sep 1 13:42:28 2022 +0900 * * Fix gcc-11 compiler warnings on gdb-10.2/gdb/symtab.c * * Without the patch, the following gcc-11 compiler warnings are emitted * for gdb-10.2/gdb/symtab.c: * * symtab.c: In function 'void gdb_get_datatype(gnu_request*)': * symtab.c:7131:31: warning: ISO C++17 does not allow 'register' storage class specifier [-Wregister] * 7131 | register struct type *type; * | ^~~~ * symtab.c:7132:31: warning: ISO C++17 does not allow 'register' storage class specifier [-Wregister] * 7132 | register struct type *typedef_type; * | ^~~~~~~~~~~~ * ... * * Usually we don't fix compiler warnings for gdb, but these are emitted * even by "make clean ; make warn", which doesn't recompile the whole * gdb, so it would be better to fix. * * Signed-off-by: Kazuhito Hagio * * commit 51acac75cdb20caab30a85ebfec5906efe034477 * Author: Kazuhito Hagio * Date: Thu Sep 1 14:03:09 2022 +0900 * * Fix gcc-12 compiler warnings on lkcd_*.c * * Without the patch, the following gcc-12 compiler warnings are emitted * for lkcd_*.c: * * lkcd_v1.c: In function 'dump_lkcd_environment_v1': * lkcd_v1.c:252:20: warning: the comparison will always evaluate as 'true' for the address of 'dh_panic_string' will never be NULL [-Waddress] * 252 | dh && dh->dh_panic_string && * | ^~ * In file included from lkcd_v1.c:21: * lkcd_vmdump_v1.h:108:30: note: 'dh_panic_string' declared here * 108 | char dh_panic_string[DUMP_PANIC_LEN]; * | ^~~~~~~~~~~~~~~ * ... * * Reported-by: Lianbo Jiang * Signed-off-by: Kazuhito Hagio * * commit 5b9d3e98cda9d99f3277aabec30d076e62cc5e71 * Author: Chunguang.Xu * Date: Thu Aug 25 12:07:20 2022 +0800 * * Add debian/ubuntu vmlinux location to default search dirs * * Now crash cannot find debian/ubuntu kernel vmlinux, we need to * explicitly specify the path to vmlinux. Try to add the debian * vmlinux location to default search directories. * * Signed-off-by: Chunguang Xu * * commit 3ed9ec5c8d09cffac9772abbf54214125ade9127 * Author: Tao Liu * Date: Wed Aug 31 11:54:15 2022 +0800 * * x86_64: Correct the identifier when locating the call instruction * * The previous implementation to locate the call instruction is * to strstr "call", then check whether the previous char is ' ' * or '\t'. The implementation is problematic. For example it * cannot resolve the following disassembly string: * * "0xffffffffc0995378 :\tcall 0xffffffff8ecfa4c0 \n" * * strstr will locate the "_call" and char check fails, * as a result, extract_hex fails to get the calling address. * * NOTE: the issue is more likely to be reproduced when patch[1] applied. * Because without patch[1], the disassembly string will be as follows, * so the issue is no longer reproducible. * * "0xffffffffc0995378:\tcall 0xffffffff8ecfa4c0 \n" * * Before the patch: * crash> bt 1472 * PID: 1472 TASK: ffff8c121fa72f70 CPU: 18 COMMAND: "nfsv4.1-svc" * #0 [ffff8c16231a3db8] __schedule at ffffffff8ecf9ef3 * #1 [ffff8c16231a3e40] schedule at ffffffff8ecfa4e9 * * After the patch: * crash> bt 1472 * PID: 1472 TASK: ffff8c121fa72f70 CPU: 18 COMMAND: "nfsv4.1-svc" * #0 [ffff8c16231a3db8] __schedule at ffffffff8ecf9ef3 * #1 [ffff8c16231a3e40] schedule at ffffffff8ecfa4e9 * #2 [ffff8c16231a3e50] nfs41_callback_svc at ffffffffc099537d [nfsv4] * #3 [ffff8c16231a3ec8] kthread at ffffffff8e6b966f * #4 [ffff8c16231a3f50] ret_from_fork at ffffffff8ed07898 * * This patch fix the issue by strstr "\tcall" and " call", to * locate the correct call instruction. * * [1]: https://listman.redhat.com/archives/crash-utility/2022-August/010085.html * * Signed-off-by: Tao Liu * * commit 2145b2bb79c59aa25c5155a8f9851554d1813fb9 * Author: Tao Liu * Date: Wed Aug 31 11:54:13 2022 +0800 * * Let gdb get kernel module symbols info from crash * * Gdb will try to resolve an address to its corresponding symbol name * such as when printing a structure. It works fine for kernel symbols, * because gdb can find them through vmlinux. However as for kernel * modules symbols, crash resolves them by dig into "struct module", * which gdb don't know. As a result, gdb fails to translate a kernel * module address to its symbol name without "mod -s|-S" options. For * example we can reproduce the issue as follows. * * crash> timer * .... * 4331308176 336 ffff94ea24240860 ffffffffc03762c0 * .... * crash> sym 0xffffffffc03762c0 * ffffffffc03762c0 (t) estimation_timer [ip_vs] * * Before patch: * crash> timer_list ffff94ea24240860 * struct timer_list { * .... * function = 0xffffffffc03762c0, * .... * } * * After patch: * crash> timer_list ffff94ea24240860 * struct timer_list { * .... * function = 0xffffffffc03762c0 , * .... * } * * In this patch, we add an interface for gdb, when gdb trying to build * kernel module's address symbolic, the info can be get from crash. * * Signed-off-by: Tao Liu * * commit 9cbfea67eb4f094d47cd841b73ddbbdbe6b58696 * Author: Tao Liu * Date: Thu Aug 25 14:39:44 2022 +0800 * * Fix "task -R" by adding end identifier for union in task_struct * * Previously, the start and end identifiers for union are " {\n" and * " }, \n". However the end identifier is not always as expected. * " },\n" can also be the end identifier with gdb-10.2. As a result, * variable "randomized" is in incorrect state after union, and fails to * identify the later struct members. For example, we can reproduce the * issue as follows: * * crash> task * PID: 847 TASK: ffff94f8038f4000 CPU: 72 COMMAND: "khungtaskd" * struct task_struct { * thread_info = { * flags = 2148024320, * status = 0, * preempt_lazy_count = 0 * }, * { * * }, * ... * wake_entry = { * next = 0x0 * }, * ... * * Before patch: * * crash> task -R wake_entry * PID: 847 TASK: ffff94f8038f4000 CPU: 72 COMMAND: "khungtaskd" * * After patch: * * crash> task -R wake_entry * PID: 847 TASK: ffff94f8038f4000 CPU: 72 COMMAND: "khungtaskd" * wake_entry = { * next = 0x0 * }, * * Signed-off-by: Tao Liu * * commit f02c8e87fccb1a92fbc025883bc69b6467a4e6c8 * Author: Huang Shijie * Date: Mon Aug 22 09:29:32 2022 +0000 * * arm64: use TCR_EL1_T1SZ to get the correct info if vabits_actual is * missing * * After kernel commit 0d9b1ffefabe ("arm64: mm: make vabits_actual a build * time constant if possible"), the vabits_actual is not compiled to kernel * symbols when "VA_BITS > 48" is false. * * So the crash will not find the vabits_actual symbol, and it will fail * in the end like this: * * # ./crash * ... * WARNING: VA_BITS: calculated: 46 vmcoreinfo: 48 * crash: invalid kernel virtual address: ffff88177ffff000 type: "pud page" * * This patch introduces the arm64_set_va_bits_by_tcr(), and if crash * cannot find vabits_actual symbol, it will use the TCR_EL1_T1SZ * register to get the correct VA_BITS_ACTUAL/VA_BITS/VA_START. * * Tested this patch with: * 1.) the live mode with /proc/kcore * 2.) the kdump file with /proc/vmcore. * * Signed-off-by: Huang Shijie * * commit 4c85e982d25a259f81b5e8c230a67d40d4527ddf * Author: Lianbo Jiang * Date: Wed Aug 24 10:19:20 2022 +0800 * * gdb: fix for assigning NULL to std::string * * When trying to load a module with "mod -s" without its separated debug * info file installed, the crash utility will abort as below: * * crash> mod -s kpatch_test kpatch_test.ko * ... * terminate called after throwing an instance of 'std::logic_error' * what(): basic_string::_M_construct null not valid * Aborted (core dumped) * * Let's return the std::string() instead of std::string(NULL) when a * string is null, because the check_specified_kernel_debug_file() may * return NULL. * * Signed-off-by: Lianbo Jiang * * commit c2743ad474529951ace2b8ec712bf373f3a07d4c * Author: Kazuhito Hagio * Date: Mon Aug 22 11:59:46 2022 +0900 * * Makefile: Fix unnecessary re-patching with coreutils-9.0 * * "sum" command in coreutils-9.0 (e.g. Fedora 36) started to output a file * name. As a result, "make" always detects a change of gdb-10.2.patch * wrongly and re-applies it unnecessarily. * * Use standard input to fix it and "md5sum" to improve detection. * * Signed-off-by: Kazuhito Hagio * * commit 763e221388219b07bd949a9ba48768856908ec6d * Author: Lianbo Jiang * Date: Thu Jul 28 15:11:20 2022 +0800 * * x86_64: Fix for AMD SME issue * * Kernel commit changes(see [1]/[2]) may cause the failure of * crash-utility with the following error: * * #./crash /home/vmlinux /home/vmcore * ... * For help, type "help". * Type "apropos word" to search for commands related to "word"... * * crash: seek error: physical address: 8000760a14000 type: "p4d page" * * Let's get the "NUMBER(sme_mask)" from vmcoreinfo, and try to remove * the C-bit from the page table entries, the intention is to get the * true physical address. * * Related kernel commits: * [1] aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()") * [2] e7d445ab26db ("x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c") * * Signed-off-by: Lianbo Jiang * * commit f37df7df8a50519d80f04fb48499287892021575 * Author: Kazuhito Hagio * Date: Fri Jul 22 13:44:50 2022 +0900 * * Fix gcc-11 compiler warning on kvmdump.c * * Without the patch, the following gcc-11 compiler warning is emitted for * kvmdump.c: * * In function 'write_mapfile_registers', * inlined from 'write_mapfile_trailer' at kvmdump.c:947:3, * inlined from 'kvmdump_init' at kvmdump.c:145:4: * kvmdump.c:972:13: warning: 'write' reading 8 bytes from a region of size 4 [-Wstringop-overread] * 972 | if (write(kvm->mapfd, &kvm->cpu_devices, sizeof(uint64_t)) != sizeof(uint64_t)) * | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * In file included from kvmdump.c:19: * kvmdump.c: In function 'kvmdump_init': * kvmdump.h:67:18: note: source object 'cpu_devices' of size 4 * 67 | uint32_t cpu_devices; * | ^~~~~~~~~~~ * In file included from defs.h:26, * from kvmdump.c:18: * /usr/include/unistd.h:378:16: note: in a call to function 'write' declared with attribute 'access (read_only, 2, 3)' * 378 | extern ssize_t write (int __fd, const void *__buf, size_t __n) __wur * | ^~~~~ * * Signed-off-by: Kazuhito Hagio * * commit 7591e3c07cef4900f6b0ca797270cb7527fb4e29 * Author: Kazuhito Hagio * Date: Fri Jul 22 13:44:50 2022 +0900 * * Fix gcc-11 compiler warning on makedumpfile.c * * Without the patch, the following gcc-11 compiler warning is emitted for * makedumpfile.c: * * In function 'flattened_format_get_osrelease', * inlined from 'check_flattened_format' at makedumpfile.c:236:3: * makedumpfile.c:392:9: warning: 'fclose' called on pointer returned from a mismatched allocation function [-Wmismatched-dealloc] * 392 | fclose(pipe); * | ^~~~~~~~~~~~ * makedumpfile.c: In function 'check_flattened_format': * makedumpfile.c:380:21: note: returned from 'popen' * 380 | if ((pipe = popen(buf, "r")) == NULL) * | ^~~~~~~~~~~~~~~ * * Signed-off-by: Kazuhito Hagio * * commit b9c0ed124e422b7e0b1526afa3a691ad0579607b * Author: Kazuhito Hagio * Date: Fri Jul 22 13:44:50 2022 +0900 * * Fix gcc-11 compiler warning on symbols.c * * Without the patch, the following gcc-11 compiler warning is emitted for * symbols.c: * * symbols.c: In function 'cmd_p': * symbols.c:7412:38: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] * 7412 | *(cpuspec-1) = ':'; * | ~~~~~~~~~~~~~^~~~~ * * Signed-off-by: Kazuhito Hagio * * commit f374aca364b7e8809f122678aefed1010e3c94bd * Author: Kazuhito Hagio * Date: Fri Jul 22 13:44:50 2022 +0900 * * Fix gcc-11 compiler warnings on filesys.c * * Without the patch, the following gcc-11 compiler warnings are emitted * for filesys.c: * * filesys.c: In function 'mount_point': * filesys.c:718:17: warning: 'pclose' called on pointer returned from a mismatched allocation function [-Wmismatched-dealloc] * 718 | pclose(mp); * | ^~~~~~~~~~ * filesys.c:709:27: note: returned from 'fopen' * 709 | if ((mp = fopen(mntfile, "r")) == NULL) * | ^~~~~~~~~~~~~~~~~~~ * filesys.c:738:17: warning: 'pclose' called on pointer returned from a mismatched allocation function [-Wmismatched-dealloc] * 738 | pclose(mp); * | ^~~~~~~~~~ * filesys.c:723:27: note: returned from 'fopen' * 723 | if ((mp = fopen(mntfile, "r")) == NULL) * | ^~~~~~~~~~~~~~~~~~~ * * Signed-off-by: Kazuhito Hagio * * commit 6722ea102264b54529afc19d347a3a7473670fdd * Author: Qianli Zhao * Date: Mon Jul 4 16:40:01 2022 +0800 * * arm64: Fix for st->_stext_vmlinux not initialized when set VA_BITS_ACTUAL * * Setting st->_stext_vmlinux to UNINITIALIZED to search for "_stext" * from the vmlinux. In the scenario where kaslr is disabled and * without vmcoreinfo, crash will get the wrong MODULES/VMALLOC ranges * and cause a failure in parsing a raw RAM dumpfile. * * Signed-off-by: Qianli Zhao * * commit 93b880217de239268315be942c10dfce5649db8b * Author: Hari Bathini * Date: Mon Jul 4 10:55:46 2022 +0530 * * ppc64: use a variable for machdep->machspec * * machdpep->machspec is referred to multiple times. The compiler would * likely optimize this but nonetheless, use a variable to optimize in * coding and also improve readability. No functional change. * * Signed-off-by: Hari Bathini * * commit 4dc2f1c32d1c99586e67032c9cd62c5c4334049c * Author: Hari Bathini * Date: Mon Jul 4 10:55:45 2022 +0530 * * ppc64: print emergency stacks info with 'mach' command * * Print top address of emergency stacks with 'mach' command. * * Signed-off-by: Hari Bathini * * commit cdd57e8b16aba2f5714673368d6dbc7565d59841 * Author: Hari Bathini * Date: Mon Jul 4 10:55:44 2022 +0530 * * ppc64: handle backtrace when CPU is in an emergency stack * * A CPU could be in an emergency stack when it is running in real mode * or any special scenario like TM bad thing. Also, there are dedicated * emergency stacks for machine check and system reset interrupt. Right * now, no backtrace is provided if a CPU is in any of these stacks. * This change ensures backtrace is processed appropriately even when * a CPU is in any one of these emergency stacks. Also, if stack info * cannot be found, print that message always instead of only when * verbose logs are enabled. * * Related kernel commits: * 729b0f715371 ("powerpc/book3s: Introduce exclusive emergency stack for machine check exception.") * b1ee8a3de579 ("powerpc/64s: Dedicated system reset interrupt stack") * * Signed-off-by: Hari Bathini * * commit 4d1b968abb286ea39ea080ae073b0e2b5bfe6c4e * Author: Hari Bathini * Date: Mon Jul 4 10:55:43 2022 +0530 * * ppc64: rename ppc64_paca_init to ppc64_paca_percpu_offset_init * * ppc64_paca_init() function is specifically used to initialize percpu * data_offset for kernels older than v2.6.36. So, the name is slightly * misleading. Rename it to ppc64_paca_percpu_offset_init to reflect its * purpose. * * Signed-off-by: Hari Bathini * * commit 3ee5956721d9a67fe8d4c6d5022aa022c5f9a11c * Author: Hari Bathini * Date: Mon Jul 4 10:55:42 2022 +0530 * * ppc64: dynamically allocate h/w interrupt stack * * Only older kernel (v2.4) used h/w interrupt stack to store frames when * CPU received IPI. Memory used for this in 'struct machine_specific' is * useless for later kernels. For the sake of backward compatibility keep * h/w interrupt stack but dynamically allocate memory for it and save * some bytes from being wasted. * * Signed-off-by: Hari Bathini * * commit c67ce5bbb8e37d28f1c26b239b203a6561f574c1 * Author: Hari Bathini * Date: Mon Jul 4 10:55:41 2022 +0530 * * ppc64: fix bt for '-S' case * * Passing '-S' option to 'bt' command was intended to specify the stack * pointer manually. But get_stack_frame() handling on ppc64 is ignoring * this option altogether. Fix it. * * Signed-off-by: Hari Bathini * * commit d8869b08548362345fc34e4cf17a1eac9bddec6b * Author: Kazuhito Hagio * Date: Wed Jun 22 08:32:59 2022 +0900 * * Extend field length of task attributes * * Nowadays, some machines have many CPU cores and memory, and some * distributions have a larger kernel.pid_max parameter, e.g. 7 digits. * This impairs the readability of a few commands, especially "ps" and * "ps -l|-m" options. * * Let's extend the field length of the task attributes, PID, CPU, VSZ, * and RSS to improve the readability. * * Without the patch: * crash> ps * PID PPID CPU TASK ST %MEM VSZ RSS COMM * ... * 2802197 2699997 2 ffff916f63c40000 IN 0.0 307212 10688 timer * 2802277 1 0 ffff9161a25bb080 IN 0.0 169040 2744 gpg-agent * 2806711 3167854 10 ffff9167fc498000 IN 0.0 127208 6508 su * 2806719 2806711 1 ffff91633c3a48c0 IN 0.0 29452 6416 bash * 2988346 1 5 ffff916f7c629840 IN 2.8 9342476 1917384 qemu-kvm * * With the patch: * crash> ps * PID PPID CPU TASK ST %MEM VSZ RSS COMM * ... * 2802197 2699997 2 ffff916f63c40000 IN 0.0 307212 10688 timer * 2802277 1 0 ffff9161a25bb080 IN 0.0 169040 2744 gpg-agent * 2806711 3167854 10 ffff9167fc498000 IN 0.0 127208 6508 su * 2806719 2806711 1 ffff91633c3a48c0 IN 0.0 29452 6416 bash * 2988346 1 5 ffff916f7c629840 IN 2.8 9342476 1917384 qemu-kvm * * Signed-off-by: Kazuhito Hagio * * commit 85f39061390f095e73d9037f015cec077441eb13 * Author: Kazuhito Hagio * Date: Wed Jun 15 10:50:13 2022 +0900 * * Fix for "dev" command on Linux 5.11 and later * * The following kernel commits eventually removed the bdev_map array in * Linux v5.11 kernel: * * e418de3abcda ("block: switch gendisk lookup to a simple xarray") * 22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get") * * Without the patch, the "dev" command fails to dump block device data * with the following error: * * crash> dev * ... * dev: blkdevs or all_bdevs: symbols do not exist * * To get block device's gendisk, search blockdev_superblock.s_inodes * instead of bdev_map. * * Signed-off-by: Kazuhito Hagio * * commit b8f2ae6b494d706b1e4855b439c4930a6a6a2f5c * Author: Kazuhito Hagio * Date: Fri Jun 10 16:00:14 2022 +0900 * * sbitmapq: Limit kernels without sbitmap again * * commit 364b2e413c69 ("sbitmapq: remove struct and member validation * in sbitmapq_init()") allowed the use of the "sbitmapq" command * unconditionally. Without the patch, the command fails with the * following error on kernels without sbitmap: * * crash> sbitmapq ffff88015796e550 * * sbitmapq: invalid structure member offset: sbitmap_queue_sb * FILE: sbitmap.c LINE: 385 FUNCTION: sbitmap_queue_context_load() * * Now the command supports Linux 4.9 and later kernels since it was * abstracted out, so it can be limited by the non-existence of the * sbitmap structure. * * Signed-off-by: Kazuhito Hagio * * commit 6bc3b74c6e2b0aaebe1bc164594e53b010efef56 * Author: Kazuhito Hagio * Date: Fri Jun 10 15:52:34 2022 +0900 * * sbitmapq: Fix for kernels without struct wait_queue_head * * The current struct wait_queue_head was renamed by kernel commit * 9d9d676f595b ("sched/wait: Standardize internal naming of wait-queue heads") * at Linux 4.13. Without the patch, on earlier kernels the "sbitmapq" * command fails with the following error: * * crash> sbitmapq ffff8801790b3b50 * depth = 128 * busy = 0 * bits_per_word = 32 * ... * sbitmapq: invalid structure member offset: wait_queue_head_head * FILE: sbitmap.c LINE: 344 FUNCTION: sbitmap_queue_show() * * Signed-off-by: Kazuhito Hagio * * commit c07068266b41450ca6821ee0a1a3adf34206015f * Author: Kazuhito Hagio * Date: Fri Jun 10 15:21:53 2022 +0900 * * Make "dev -d|-D" options parse sbitmap on Linux 4.18 and later * * There have been a few reports that the "dev -d|-D" options displayed * incorrect I/O stats due to racy blk_mq_ctx.rq_* counters. To fix it, * make the options parse sbitmap to count I/O stats on Linux 4.18 and * later kernels, which include RHEL8 ones. * * To do this, adjust to the blk_mq_tags structure of Linux 5.10 through * 5.15 kernels, which contain kernel commit 222a5ae03cdd ("blk-mq: Use * pointers for blk_mq_tags bitmap tags") and do not contain ae0f1a732f4a * ("blk-mq: Stop using pointers for blk_mq_tags bitmap tags"). * * Signed-off-by: Kazuhito Hagio * * commit 12fe6c7cdd768f87ce6e903a2bbfb0c0591585c5 * Author: Kazuhito Hagio * Date: Fri Jun 10 11:49:47 2022 +0900 * * sbitmapq: Fix for sbitmap_queue without min_shallow_depth member * * The sbitmap_queue.min_shallow_depth member was added by kernel commit * a327553965de ("sbitmap: fix missed wakeups caused by sbitmap_queue_get_shallow()") * at Linux 4.18. Without the patch, on earlier kernels the "sbitmapq" * command fails with the following error: * * crash> sbitmapq ffff89bb7638ee50 * * sbitmapq: invalid structure member offset: sbitmap_queue_min_shallow_depth * FILE: sbitmap.c LINE: 398 FUNCTION: sbitmap_queue_context_load() * * Signed-off-by: Kazuhito Hagio * * commit 0d3e86fee5eead93b521a0e20a0e099ede4ab72b * Author: Kazuhito Hagio * Date: Fri Jun 10 11:49:47 2022 +0900 * * sbitmapq: Fix for sbitmap_word without cleared member * * The sbitmap_word.cleared member was added by kernel commit ea86ea2cdced * ("sbitmap: ammortize cost of clearing bits") at Linux 5.0. Without the * patch, on earlier kernels the "sbitmapq" command fails with the * following error: * * crash> sbitmapq ffff8f1a3611cf10 * * sbitmapq: invalid structure member offset: sbitmap_word_cleared * FILE: sbitmap.c LINE: 92 FUNCTION: __sbitmap_weight() * * Signed-off-by: Kazuhito Hagio * * commit 9ce31a14d1083cbb2beb4a8e6eb7b88234b79a99 * Author: Kazuhito Hagio * Date: Fri Jun 10 11:49:47 2022 +0900 * * sbitmapq: Fix for sbitmap_queue without ws_active member * * The sbitmap_queue.ws_active member was added by kernel commit 5d2ee7122c73 * ("sbitmap: optimize wakeup check") at Linux 5.0. Without the patch, on * earlier kernels the "sbitmapq" command fails with the following error: * * crash> sbitmapq ffff8f1a3611cf10 * * sbitmapq: invalid structure member offset: sbitmap_queue_ws_active * FILE: sbitmap.c LINE: 393 FUNCTION: sbitmap_queue_context_load() * * Signed-off-by: Kazuhito Hagio * * commit c672d7a4c290712b32c54329cbdc1e74d122e813 * Author: Lianbo Jiang * Date: Mon Jun 6 19:09:16 2022 +0800 * * Doc: update man page for the "bpf" and "sbitmapq" commands * * The information of the "bpf" and "sbitmapq" commands is missing in the man * page of the crash utility. Let's add it to the man page. * * Signed-off-by: Lianbo Jiang * * commit 68ce0b9a35d77d767872dd1a729c50e4695a30a8 * Author: Lianbo Jiang * Date: Thu Jun 2 20:12:56 2022 +0800 * * Fix for "dev -d|-D" options to support blk-mq change on Linux v5.18-rc1 * * Kernel commit 4e5cc99e1e48 ("blk-mq: manage hctx map via xarray") removed * the "queue_hw_ctx" member from struct request_queue at Linux v5.18-rc1, * and replaced it with a struct xarray "hctx_table". Without the patch, the * "dev -d|-D" options will print an error: * * crash> dev -d * MAJOR GENDISK NAME REQUEST_QUEUE TOTAL READ WRITE * * dev: invalid structure member offset: request_queue_queue_hw_ctx * * With the patch: * crash> dev -d * MAJOR GENDISK NAME REQUEST_QUEUE TOTAL READ WRITE * 8 ffff8e99d0a1ae00 sda ffff8e9c14c59980 10 6 4 * * Signed-off-by: Lianbo Jiang * * commit 7095c8fd029e3a33117e3b67de73f504686ebfe2 * Author: Lianbo Jiang * Date: Thu Jun 2 20:12:55 2022 +0800 * * Enhance "dev -d|-D" options to support blk-mq sbitmap * * Since Linux 5.16-rc1, which kernel commit 9a14d6ce4135 ("block: remove * debugfs blk_mq_ctx dispatched/merged/completed attributes") removed the * members from struct blk_mq_ctx, crash has not displayed disk I/O statistics * for multiqueue (blk-mq) devices. * * Let's parse the sbitmap in blk-mq layer to support it. * * Signed-off-by: Lianbo Jiang * Signed-off-by: Kazuhito Hagio * * commit dda5b2d02b8d8de1264f84b6267582aa7a1e5a57 * Author: Kazuhito Hagio * Date: Tue May 31 17:12:16 2022 +0900 * * gdb: print details of unnamed struct and union * * Currently gdb's "ptype" command does not print the details of unnamed * structure and union deeper than second level in a structure, it prints * only "{...}" instead. And crash's "struct" and similar commands also * inherit this behavior, so we cannot get the full information of them. * * To print the details of them, change the show variable when it is an * unnamed one like crash-7.x. * * Without the patch: * crash> struct -o page * struct page { * [0] unsigned long flags; * union { * struct {...}; * struct {...}; * ... * * With the patch: * crash> struct -o page * struct page { * [0] unsigned long flags; * union { * struct { * [8] struct list_head lru; * [24] struct address_space *mapping; * [32] unsigned long index; * [40] unsigned long private; * }; * struct { * [8] dma_addr_t dma_addr; * }; * ... * * Signed-off-by: Kazuhito Hagio * * commit 0f162febebc4d11a165dd40cee00f3b0ba691a52 * Author: Qi Zheng * Date: Tue May 24 20:25:54 2022 +0800 * * bt: arm64: add support for 'bt -n idle' * * The '-n idle' option of bt command can help us filter the * stack of the idle process when debugging the dumpfiles * captured by kdump. * * This patch supports this feature on ARM64. * * Signed-off-by: Qi Zheng * * commit 6833262bf87177d8affe4f91b2e7d2c76ecdf636 * Author: Qi Zheng * Date: Tue May 24 20:25:53 2022 +0800 * * bt: x86_64: filter out idle task stack * * When we use crash to troubleshoot softlockup and other problems, * we often use the 'bt -a' command to print the stacks of running * processes on all CPUs. But now some servers have hundreds of CPUs * (such as AMD machines), which causes the 'bt -a' command to output * a lot of process stacks. And many of these stacks are the stacks * of the idle process, which are not needed by us. * * Therefore, in order to reduce this part of the interference information, * this patch adds the -n option to the bt command. When we specify * '-n idle' (meaning no idle), the stack of the idle process will be * filtered out, thus speeding up our troubleshooting. * * And the option works only for crash dumps captured by kdump. * * The command output is as follows: * crash> bt -a -n idle * [...] * PID: 0 TASK: ffff889ff8c34380 CPU: 8 COMMAND: "swapper/8" * * PID: 0 TASK: ffff889ff8c32d00 CPU: 9 COMMAND: "swapper/9" * * PID: 0 TASK: ffff889ff8c31680 CPU: 10 COMMAND: "swapper/10" * * PID: 0 TASK: ffff889ff8c35a00 CPU: 11 COMMAND: "swapper/11" * * PID: 0 TASK: ffff889ff8c3c380 CPU: 12 COMMAND: "swapper/12" * * PID: 150773 TASK: ffff889fe85a1680 CPU: 13 COMMAND: "bash" * #0 [ffffc9000d35bcd0] machine_kexec at ffffffff8105a407 * #1 [ffffc9000d35bd28] __crash_kexec at ffffffff8113033d * #2 [ffffc9000d35bdf0] panic at ffffffff81081930 * #3 [ffffc9000d35be70] sysrq_handle_crash at ffffffff814e38d1 * #4 [ffffc9000d35be78] __handle_sysrq.cold.12 at ffffffff814e4175 * #5 [ffffc9000d35bea8] write_sysrq_trigger at ffffffff814e404b * #6 [ffffc9000d35beb8] proc_reg_write at ffffffff81330d86 * #7 [ffffc9000d35bed0] vfs_write at ffffffff812a72d5 * #8 [ffffc9000d35bf00] ksys_write at ffffffff812a7579 * #9 [ffffc9000d35bf38] do_syscall_64 at ffffffff81004259 * RIP: 00007fa7abcdc274 RSP: 00007fffa731f678 RFLAGS: 00000246 * RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fa7abcdc274 * RDX: 0000000000000002 RSI: 0000563ca51ee6d0 RDI: 0000000000000001 * RBP: 0000563ca51ee6d0 R8: 000000000000000a R9: 00007fa7abd6be80 * R10: 000000000000000a R11: 0000000000000246 R12: 00007fa7abdad760 * R13: 0000000000000002 R14: 00007fa7abda8760 R15: 0000000000000002 * ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b * [...] * * Signed-off-by: Qi Zheng * Acked-by: Kazuhito Hagio * Acked-by: Lianbo Jiang * * commit 9705669a49c341402efd8528e8fe809379dd798d * Author: Kazuhito Hagio * Date: Mon May 23 14:48:50 2022 +0900 * * Makefile: add missing crash_target.o to be cleaned * * Signed-off-by: Kazuhito Hagio * * commit 3750803f6ae5f5ad071f86ca916dbbb17b7a83a5 * Author: Lianbo Jiang * Date: Mon May 23 18:04:16 2022 +0800 * * sbitmapq: fix invalid offset for "sbitmap_word_depth" on Linux v5.18-rc1 * * Kernel commit 3301bc53358a ("lib/sbitmap: kill 'depth' from * sbitmap_word") removed the depth member from struct sbitmap_word. * Without the patch, the sbitmapq will fail: * * crash> sbitmapq 0xffff8e99d0dc8010 * * sbitmapq: invalid structure member offset: sbitmap_word_depth * FILE: sbitmap.c LINE: 84 FUNCTION: __sbitmap_weight() * * Signed-off-by: Lianbo Jiang * * commit 530fe6ad7e4d7ff6254596c1219d25ed929e3867 * Author: Lianbo Jiang * Date: Mon May 23 18:04:15 2022 +0800 * * sbitmapq: fix invalid offset for "sbitmap_queue_round_robin" on Linux * v5.13-rc1 * * Kernel commit efe1f3a1d583 ("scsi: sbitmap: Maintain allocation * round_robin in sbitmap") moved the round_robin member from struct * sbitmap_queue to struct sbitmap. Without the patch, the sbitmapq * will fail: * * crash> sbitmapq 0xffff8e99d0dc8010 * * sbitmapq: invalid structure member offset: sbitmap_queue_round_robin * FILE: sbitmap.c LINE: 378 FUNCTION: * sbitmap_queue_context_load() * * Signed-off-by: Lianbo Jiang * * commit a295cb40cd5d24fb5995cc78d29c5def3843d285 * Author: Lianbo Jiang * Date: Mon May 23 18:04:14 2022 +0800 * * sbitmapq: fix invalid offset for "sbitmap_queue_alloc_hint" on Linux v5.13-rc1 * * Kernel commit c548e62bcf6a ("scsi: sbitmap: Move allocation hint * into sbitmap") moved the alloc_hint member from struct sbitmap_queue * to struct sbitmap. Without the patch, the sbitmapq will fail: * * crash> sbitmapq 0xffff8e99d0dc8010 * * sbitmapq: invalid structure member offset: sbitmap_queue_alloc_hint * FILE: sbitmap.c LINE: 365 FUNCTION: sbitmap_queue_context_load() * * Signed-off-by: Lianbo Jiang * * commit 364b2e413c69daf189d2bc0238e3ba9b0dcbd937 * Author: Lianbo Jiang * Date: Mon May 23 18:04:13 2022 +0800 * * sbitmapq: remove struct and member validation in sbitmapq_init() * * Let's remove the struct and member validation from sbitmapq_init(), which * will help the crash to display the actual error when the sbitmapq fails. * * Without the patch: * crash> sbitmapq ffff8e99d0dc8010 * sbitmapq: command not supported or applicable on this architecture or kernel * * With the patch: * crash> sbitmapq ffff8e99d0dc8010 * * sbitmapq: invalid structure member offset: sbitmap_queue_alloc_hint * FILE: sbitmap.c LINE: 365 FUNCTION: sbitmap_queue_context_load() * * Signed-off-by: Lianbo Jiang * * commit ae52398a13fa9a238279114ed671c7c514c154ee * Author: Sourabh Jain * Date: Mon May 9 12:49:56 2022 +0530 * * ppc64: update the NR_CPUS to 8192 * * Since the kernel commit 2d8ae638bb86 ("powerpc: Make the NR_CPUS max 8192") * the NR_CPUS on Linux kernel ranges from 1-8192. So let's match NR_CPUS with * the max NR_CPUS count on the Linux kernel. * * Signed-off-by: Sourabh Jain * * commit 0ca55e460757172879ebc06c1a18c97163711dab * Author: Kazuhito Hagio * Date: Tue May 10 10:27:44 2022 +0900 * * Mark start of 8.0.2 development phase with version 8.0.1++ * * Signed-off-by: Kazuhito Hagio * -- Troy Heber Thu, 17 Nov 2022 11:27:25 -0700 crash (8.0.1-1) UNRELEASED; urgency=medium * commit 2d193468e5fe7ee1c6be4c73083cc5ef8d922b74 * Author: Kazuhito Hagio * Date: Tue Apr 26 10:56:43 2022 +0900 * * crash-8.0.0 -> crash-8.0.1 * * Signed-off-by: Kazuhito Hagio * * commit b811a045ec994ead31b0535db221d6e89596fc99 * Author: Huang Shijie * Date: Wed Mar 30 19:03:23 2022 +0000 * * diskdump: Optimize the boot time * * 1.) The vmcore file maybe very big. * * For example, I have a vmcore file which is over 23G, * and the panic kernel had 767.6G memory, * its max_sect_len is 4468736. * * Current code costs too much time to do the following loop: * .............................................. * for (i = 1; i < max_sect_len + 1; i++) { * dd->valid_pages[i] = dd->valid_pages[i - 1]; * for (j = 0; j < BITMAP_SECT_LEN; j++, pfn++) * if (page_is_dumpable(pfn)) * dd->valid_pages[i]++; * .............................................. * * For my case, it costs about 56 seconds to finish the * big loop. * * This patch moves the hweightXX macros to defs.h, * and uses hweight64 to optimize the loop. * * For my vmcore, the loop only costs about one second now. * * 2.) Tests result: * # cat ./commands.txt * quit * * Before: * * #echo 3 > /proc/sys/vm/drop_caches; * #time ./crash -i ./commands.txt /root/t/vmlinux /root/t/vmcore > /dev/null 2>&1 * ............................ * real 1m54.259s * user 1m12.494s * sys 0m3.857s * ............................ * * After this patch: * * #echo 3 > /proc/sys/vm/drop_caches; * #time ./crash -i ./commands.txt /root/t/vmlinux /root/t/vmcore > /dev/null 2>&1 * ............................ * real 0m55.217s * user 0m15.114s * sys 0m3.560s * ............................ * * Signed-off-by: Huang Shijie * * commit a3344239743bdf1c72aae0fd05903e2654dee268 * Author: Huang Shijie * Date: Mon Apr 4 17:47:53 2022 +0000 * * diskdump: use mmap/madvise to improve the start-up * * Sometimes, the size of bitmap in vmcore can be very large, such as over * 256M. This patch uses mmap/madvise to improve the performance of reading * bitmap in the non-FLAT_FORMAT code path. * * Without the patch: * #echo 3 > /proc/sys/vm/drop_caches; * #time ./crash -i ./commands.txt /root/t/vmlinux /root/t/vmcore > /dev/null 2>&1 * ............................ * real 0m55.217s * user 0m15.114s * sys 0m3.560s * ............................ * * With the patch: * #echo 3 > /proc/sys/vm/drop_caches; * #time ./crash -i ./commands.txt /root/t/vmlinux /root/t/vmcore > /dev/null 2>&1 * ............................ * real 0m44.097s * user 0m19.031s * sys 0m1.620s * ............................ * * Note: * Test files: * vmlinux: 272M * vmcore : 23G (bitmap_len: 4575985664) * #cat ./commands.txt * quit * * Signed-off-by: Huang Shijie * * commit 87369080a480202c430ca823f83aa89c217fdc8f * Author: Rongwei Wang * Date: Wed Apr 6 22:38:40 2022 +0800 * * arm64: handle 1GB block for VM_L4_4K * * When arm64 is configured with PAGE_SIZE=4k and 4 level * translation, the pagetable of all pages may be created with * block mapping or contiguous mapping as much as possible, likes * disable CONFIG_RODATA_FULL_DEFAULT_ENABLED. But now, vtop * command can not handle 1GB block (PUD mapping) well, and just * shows a seek error: * * crash> vtop ffff00184a800000 * VIRTUAL PHYSICAL * ffff00184a800000 188a800000 * * PAGE DIRECTORY: ffff8000110aa000 * PGD: ffff8000110aa000 => 203fff9003 * PUD: ffff001fffff9308 => 68001880000705 * PMD: ffff0018400002a0 => ffff8000103b4fd0 * vtop: seek error: kernel virtual address: ffff7fffd03b4000 type: "page table" * * This patch fixes it, and shows as following: * * crash> vtop ffff00184a800000 * VIRTUAL PHYSICAL * ffff00184a800000 188a800000 * * PAGE DIRECTORY: ffff8000110aa000 * PGD: ffff8000110aa000 => 203fff9003 * PUD: ffff001fffff9308 => 68001880000705 * PAGE: 1880000000 (1GB) * * PTE PHYSICAL FLAGS * 68001880000705 1880000000 (VALID|SHARED|AF|PXN|UXN) * * PAGE PHYSICAL MAPPING INDEX CNT FLAGS * fffffe00610a0000 188a800000 0 0 0 77fffe0000000000 * * Acked-by: Kazuhito Hagio * Signed-off-by: Rongwei Wang * * commit b89f9ccf511a6e3db17f44a815e415664937d7e6 * Author: xiaer1921 * Date: Thu Apr 7 15:05:17 2022 +0800 * * Fix for "kmem -s|-S" on Linux 5.17+ with CONFIG_SLAB * * Since the following kernel commits split slab info from struct page * into struct slab, crash cannot get several slab related offsets from * struct page. * * d122019bf061 ("mm: Split slab into its own type") * 401fb12c68c2 ("mm: Differentiate struct slab fields by sl*b implementations") * 07f910f9b729 ("mm: Remove slab from struct page") * * Without the patch, "kmem -s|-S" options cannot work correctly on kernels * configured with CONFIG_SLAB with the following error: * * crash> kmem -s * kmem: invalid structure member offset: page_active * FILE: memory.c LINE: 12225 FUNCTION: verify_slab_overload_page() * * Resolves: https://github.com/crash-utility/crash/issues/115 * Signed-off-by: xiaer1921 * Signed-off-by: Kazuhito Hagio * * commit 8d49ad66625081dfdaf82374b5201c3a0da30e70 * Author: Lianbo Jiang * Date: Mon Mar 28 18:54:29 2022 +0800 * * Fix the failure of resolving ".rodata" on s390x * * The commit broke crash-utility on s390x and got the * following error: * * crash: cannot resolve ".rodata" * * The reason is that all symbols containing a "." may be filtered out * on s390x. To prevent the current failure, do not filter out the * symbol ".rodata" on s390x. * * In addition, a simple way is to check whether the symbol ".rodata" * exists before calculating the value of a symbol, just to be on the * safe side. * * Fixes: cd8954023bd4 ("kernel: fix start-up time degradation caused by * strings command") * Reported-by: Alexander Egorenkov * Signed-off-by: Lianbo Jiang * * commit cd8954023bd474521a9d45e2b09a7bce4174f52f * Author: HATAYAMA Daisuke * Date: Wed Mar 23 08:09:49 2022 +0000 * * kernel: fix start-up time degradation caused by strings command * * verify_namelist() uses strings command and scans full part of vmlinux * file to find linux_banner string. However, vmlinux file is quite large * these days, reaching over 500MB. As a result, this degradates start-up * time of crash command 10 or more seconds. (Of course, this depends on * machines you use for investigation, but I guess typically we cannot * use such powerful machines to investigate crash dump...) * * To resolve this issue, let's use bfd library and read linux_banner * string in vmlinux file directly. * * A simple benchmark shows the following result: * * Without the fix: * * # cat ./commands.txt * quit * # time ./crash -i ./commands.txt \ * /usr/lib/debug/lib/modules/5.16.15-201.fc35.x86_64/vmlinux \ * /var/crash/*/vmcore >/dev/null 2>&1 * * real 0m20.251s * user 0m19.022s * sys 0m1.054s * * With the fix: * * # time ./crash -i ./commands.txt \ * /usr/lib/debug/lib/modules/5.16.15-201.fc35.x86_64/vmlinux \ * /var/crash/*/vmcore >/dev/null 2>&1 * * real 0m6.528s * user 0m6.143s * sys 0m0.431s * * Note that this commit keeps the original logic that uses strings * command for backward compatibility for in case. * * Signed-off-by: HATAYAMA Daisuke * * commit 8827424f2b05587b8aaaeb7aae0ce8bcc017999f * Author: Huang Shijie * Date: Wed Mar 23 18:25:48 2022 +0000 * * arm64: fix the seek error of "pud page" for live debugging * * Crash reported an error on kernel v5.7 when live debugging with the * command "crash vmlinux /proc/kcore": * * "crash: seek error: kernel virtual address: ffff75e9fffff000 type: "pud page"" * * The reason is that the PTOV() and arm64_vtop_4level_4k() do not work * as expected due to incorrect physvirt_offset. * * To fix the above issue, need to read out the virtual address of * "physvirt_offset" from the "/proc/kallsyms", and update the * ms->phys_offset which is initialized with a wrong value in kernel * version [5.4, 5.10). * * Signed-off-by: Huang Shijie * * commit 49df472da92be8056200c28f5b7ce82eeb7ab103 * Author: Huang Shijie * Date: Sat Mar 19 08:44:08 2022 +0000 * * arm64: fix the wrong vmemmap_end * * The VMEMMAP_END did not exist before the kernel v5.7, but for now, the * value of vmemmap_end may be set to -1(0xffffffffffffffffUL). * * According to the arch/arm64/mm/dump.c (before kernel v5.7): * .................................................. * { VMEMMAP_START + VMEMMAP_SIZE, "vmemmap end" } * .................................................. * * The vmemmap_end should always be: * vmemmap_end = vmemmap_vaddr + vmemmap_size; * * This patch fixes the above issue. * * Fixes: e397e1bef22a ("arm64: update the modules/vmalloc/vmemmap ranges") * Signed-off-by: Huang Shijie * * commit 01689f3ee22b7006e68afd0a45437846a45f79b1 * Author: Huang Shijie * Date: Mon Mar 14 15:13:38 2022 +0000 * * arm64: use the vmcore info to get module/vmalloc/vmemmap ranges * * Since the kernel commit <2369f171d5c5> ("arm64: crash_core: Export * MODULES, VMALLOC, and VMEMMAP ranges"), crash can obtain the range * of module/vmalloc/vmemmap from the vmcore info, and no need to * calculate them manually. * * This patch adds a new hook arm64_get_range_v5_18 which could parse * out all the module/vmalloc/vmemmap ranges from the vmcore info. * * Signed-off-by: Huang Shijie * * commit e397e1bef22afb2ed6108cf9405cefa40975f6ef * Author: Huang Shijie * Date: Fri Mar 11 13:00:59 2022 +0000 * * arm64: update the modules/vmalloc/vmemmap ranges * * Currently, the crash is implemented for arm64 based on kernel v4.20(and * earlier), and so far the kernel has evolved to v5.17-rc4. But the ranges * of MODULE/VMALLOC/VMEMMAP have not been updated since kernel v4.20. * * Without the patch: * crash> help -m * ... * vmalloc_start_addr: ffff800048000000 * vmalloc_end: fffffdffbffeffff * modules_vaddr: ffff800040000000 * modules_end: ffff800047ffffff * vmemmap_vaddr: fffffdffffe00000 * vmemmap_end: ffffffffffffffff * ... * * With the patch: * crash> help -m * ... * vmalloc_start_addr: ffff800010000000 * vmalloc_end: fffffdffbffeffff * modules_vaddr: ffff800008000000 * modules_end: ffff80000fffffff * vmemmap_vaddr: fffffdffffe00000 * vmemmap_end: ffffffffffffffff * ... * * Link: https://listman.redhat.com/archives/crash-utility/2022-March/009625.html * Signed-off-by: Huang Shijie * * commit 4cf262e2374bcc181dc696180e33c61962f29f24 * Author: Sergey Samoylenko * Date: Tue Mar 8 23:27:10 2022 +0300 * * sbitmap.c: use readmem more carefully * * Signed-off-by: Sergey Samoylenko * * commit 7c7a4eddb4d7570dd70467b43ef3eef469ab048f * Author: Sergey Samoylenko * Date: Tue Mar 8 23:27:09 2022 +0300 * * Fix memory leak in __sbitmap_for_each_set function * * Signed-off-by: Sergey Samoylenko * * commit a92ff262d43d3be046db90a482d8d835278c8a8f * Author: Kazuhito Hagio * Date: Tue Mar 1 17:18:24 2022 +0900 * * help.c: Fix a missing new line in "sbitmapq" help page * * Signed-off-by: Kazuhito Hagio * * commit e3bdc32aab5d8fe09b679cf394da8ba8826e207f * Author: Pingfan Liu * Date: Thu Feb 24 11:52:12 2022 +0800 * * arm64: deduce the start address of kernel code, based on kernel version * * After kernel commit e2a073dde921 ("arm64: omit [_text, _stext) from * permanent kernel mapping"), the range [_text, _stext] is reclaimed. But * the current crash code still assumes kernel starting from "_text". * * This change only affects the vmalloced area on arm64 and may result a * false in arm64_IS_VMALLOC_ADDR(). * * Since vmcore has no extra information about this trival change, it can * only be deduced from kernel version, which means ms->kimage_text can not * be correctly initialized until kernel_init() finishes. Here on arm64, it * can be done at the point machdep_init(POST_GDB). This is fine * since there is no access to vmalloced area at this stage. * * Signed-off-by: Pingfan Liu * * commit 8f19ddea508632e1241120b1807ad6f41f114e0d * Author: Huang Shijie * Date: Thu Feb 24 10:23:56 2022 +0000 * * Makefile: Change the behavior of target "cscope" * * Make the "make cscope" only generate cscope index, not call the cscope. * * Also fix a typo: * cscope_out --> cscope.out * * Acked-by: Kazuhito Hagio * Signed-off-by: Huang Shijie * * commit c1f45f89dcc2f0e5d0d2128f646807125794f833 * Author: Lianbo Jiang * Date: Wed Feb 23 16:00:12 2022 +0800 * * Fix sys command to display its help information correctly * * Sometimes, the sys command may be misused, but it doesn't display * the expected help information, for example: * * Without the patch: * crash> sys kmem * NAME * kmem - kernel memory * SYNOPSIS * kmem [-f|-F|-c|-C|-i|-v|-V|-n|-z|-o|-h] [-p | -m member[,member]] * [[-s|-S|-S=cpu[s]|-r] [slab] [-I slab[,slab]]] [-g [flags]] [[-P] address]] * ... * crash> sys abc * crash> * * With the patch: * crash> sys kmem * Usage: * sys [-c [name|number]] [-t] [-i] config * Enter "help sys" for details. * crash> sys abc * Usage: * sys [-c [name|number]] [-t] [-i] config * Enter "help sys" for details. * * Signed-off-by: Lianbo Jiang * * commit 0260367da785667818d84d6cbf3aefe86a518dbb * Author: Tao Liu * Date: Tue Feb 22 10:32:15 2022 +0800 * * Makefile: crash multi-target and multithread compile support * * This patch will support making crash as follows: * $ make -j8 warn lzo * * Without this patch, the "make -j jobs warn lzo" will output the * following error during crash build: * ... * mv: cannot stat 'Makefile.new': No such file or directory * Makefile: cannot create new Makefile * please copy Makefile.new to Makefile * make: *** [Makefile:321: lzo] Error 1 * make: *** Waiting for unfinished jobs.... * TARGET: X86_64 * CRASH: 8.0.0++ * GDB: 10.2 * ... * * Signed-off-by: Tao Liu * * commit b1fb3cdd87fc23f23d6811fdeb9915523e530b33 * Author: Tao Liu * Date: Wed Feb 16 17:51:53 2022 +0800 * * x86_64_init: Refresh vmalloc region addresses in POST_RELOC instead of POST_GDB phase * * Previously for x86_64, when memory is randomized, the region addresses * such as vmalloc_start_addr/vmemmap_vaddr/modules_vaddr are firstly set * to a default value before POST_RELOC phase, then get refreshed with the * actual value in POST_GDB phase. * * However for crash mininal mode, POST_GDB phase is not called, which * leaving the region addresses unrefreshed and incorrect. As a consequence, * the x86_64_IS_VMALLOC_ADDR check will give a faulty result when * value_search tries to search a symbol by address. * * For example, in crash minimal mode we can observe the following issue: * * crash> dis -f panic * dis: cannot resolve address: ffffffffb20e0d30 * * crash> sym panic * ffffffffb20e0d30 (T) panic /usr/src/debug/kernel-4.18.0-290/linux-4.18.0-290/kernel/panic.c: 168 * crash> sym ffffffffb20e0d30 * symbol not found: ffffffffb20e0d30 * * In this patch, we will move the code which update the region addresses into * POST_RELOC phase, so in mininal mode the regions can get the correct * addresses. * * Signed-off-by: Tao Liu * * commit fb64fdd11d15d2049a3facaddaaf32ff3b29e41c * Author: Sergey Samoylenko * Date: Mon Feb 14 12:18:49 2022 +0300 * * sbitmapq: add '-p' option * * The -p option says, an associated with sbitmap_queue array contains * the pointers on a structure. This allows the sbitmapq command works * correctly with the array of pointers attached to the sbitmap_queue. * * Signed-off-by: Sergey Samoylenko * * commit ac86cc3558f8128dc0a32aad9d26db66cfc949b8 * Author: Sergey Samoylenko * Date: Mon Feb 14 12:18:48 2022 +0300 * * Introduce sbitmapq command * * Patch adds new 'sbitmapq' command. This command dumps * the contents of the sbitmap_queue structure and the used * bits in the bitmap. Also, it shows the dump of a structure * array associated with the sbitmap_queue. * * Signed-off-by: Sergey Samoylenko * * commit 6ecb8a23ca294de5ef92726c782f4c92fcb39d92 * Author: Huang Shijie * Date: Fri Feb 11 09:46:42 2022 +0000 * * arm64: Use CONFIG_ARM64_VA_BITS to initialize VA_BITS_ACTUAL * * We can get VA_BITS_ACTUAL from CONFIG_ARM64_VA_BITS by guess. * * Without this patch, we may need to use "--machdep vabits_actual=48" to * set the VA_BITS_ACTUAL. * * Signed-off-by: Huang Shijie * * commit 3ed30b51284b6ef6b116262d19a3dca205563061 * Author: Shogo Matsumoto * Date: Fri Jan 28 04:22:07 2022 +0000 * * log: support "log -t|-m" option for output of printk safe buffers * * Suppress the output of safe buffer name with the "log -t" option and * display the message log level with "log -m" option. * * Signed-off-by: Shogo Matsumoto * Signed-off-by: Kazuhito Hagio * * commit b0d447d78b5a24d248359f6285e275ef776f0a34 * Author: Shogo Matsumoto * Date: Fri Jan 28 04:17:41 2022 +0000 * * log: introduce "log -s" option to display printk safe buffers * * Introduce a new "log -s" option, which outputs unflushed logs in the * printk safe buffers (safe_print_seq and nmi_print_seq) as follows: * * crash> log -s * PRINTK_SAFE_SEQ_BUF: nmi_print_seq * CPU: 0 ADDR: ffff8ca4fbc19ce0 LEN: 150 MESSAGE_LOST: 0 * Uhhuh. NMI received for unknown reason 20 on CPU 0. * Do you have a strange power saving mode enabled? * Dazed and confused, but trying to continue * ... * * The buffers are displayed for each CPU. For an empty buffer, * '(empty)' will be printed. * * Also append those to the bottom of "log" command output so as not to * overlook them like this: * * crash> log * ... * [nmi_print_seq] Uhhuh. NMI received for unknown reason 30 on CPU 0.", * [nmi_print_seq] Do you have a strange power saving mode enabled?", * [nmi_print_seq] Dazed and confused, but trying to continue", * * Note that the safe buffer (struct printk_safe_seq_buf) was introduced * at kernel-4.11 (Merge commit 7d91de74436a69c2b78a7a72f1e7f97f8b4396fa) * and removed at kernel-5.15 (93d102f094be9beab28e5afb656c188b16a3793b). * * Link: https://listman.redhat.com/archives/crash-utility/2022-January/msg00052.html * Signed-off-by: Shogo Matsumoto * Signed-off-by: Kazuhito Hagio * * commit def34f57e81a2efa865de5eb218818ebff142614 * Author: Kazuhito Hagio * Date: Wed Feb 16 11:33:15 2022 +0900 * * Makefile: Fix build failure with "make -j jobs" option * * The "make -j jobs" option sometimes fails with an error like this: * * $ make clean ; make -j $(nproc) warn * ... * ar: creating crashlib.a * CXXLD gdb * /usr/bin/ld: ../../crashlib.a(main.o): in function `dump_build_data': * /home/crash/main.c:1829: undefined reference to `build_command' * /usr/bin/ld: /home/crash/main.c:1830: undefined reference to `build_data' * collect2: error: ld returned 1 exit status * make[4]: *** [Makefile:1872: gdb] Error 1 * make[3]: *** [Makefile:10072: all-gdb] Error 2 * make[2]: *** [Makefile:860: all] Error 2 * crash build failed * * This is because build_data.c is compiled by two jobs and they write to * build_data.o simultaneously and break it. Remove one of them. * * Signed-off-by: Kazuhito Hagio * Signed-off-by: Lianbo Jiang * * commit 74ac929712416705a758f14a3506991bbfdc869c * Author: Sven Schnelle * Date: Mon Dec 20 14:16:50 2021 +0100 * * Support for multiple jobs to build crash * * This patch saves compilation time for crash build, which did the * following things: * * [1] add --no-print-directory to MAKEFLAGS right in the beginning * to avoid repeating it in all make calls. * [2] use "make -C" instead of "cd x; make" * [3] replace make by $(MAKE) * * Link: https://listman.redhat.com/archives/crash-utility/2021-December/msg00049.html * Link: https://listman.redhat.com/archives/crash-utility/2021-December/msg00048.html * Link: https://listman.redhat.com/archives/crash-utility/2021-December/msg00047.html * Signed-off-by: Sven Schnelle * Signed-off-by: Lianbo Jiang * * commit 0a4434f4cb0760d77900af9603e847da4e7afd0f * Author: Lianbo Jiang * Date: Mon Feb 14 17:07:38 2022 +0800 * * Doc: update man page for the option "--src directory" * * The "--src directory" option information is missing from the man page of * crash utility. Originally it was added by commit 9254c7f206d5 ("Added a * new "--src "...), let's sync this option information to the * man page. * * Signed-off-by: Lianbo Jiang * * commit 1ecb3513093ef4e40fdd27da479bc8ef844df3eb * Author: Lianbo Jiang * Date: Mon Feb 14 16:59:10 2022 +0800 * * Fix for "bpf -m|-M" options to appropriately display MEMLOCK and UID * * Kernel commit 80ee81e0403c ("bpf: Eliminate rlimit-based memory * accounting infra for bpf maps") removed the struct bpf_map_memory * member from struct bpf_map at Linux 5.11. Without the patch, the * "bpf -m|-M" options will print "(unknown)" for MEMLOCK and UID: * * crash> bpf -m 1 * ID BPF_MAP BPF_MAP_TYPE MAP_FLAGS * 1 ffff96ba41804400 ARRAY 00000000 * KEY_SIZE: 4 VALUE_SIZE: 8 MAX_ENTRIES: 64 MEMLOCK: (unknown) * NAME: "dist" UID: (unknown) * * Signed-off-by: Lianbo Jiang * Signed-off-by: Kazuhito Hagio * * commit 5f390ed811b00753ce7d5ceec5717280df16fd28 * Author: Kazuhito Hagio * Date: Wed Feb 2 02:14:56 2022 +0000 * * Fix for "kmem -s|-S" and "bt -F[F]" on Linux 5.17-rc1 * * Since the following kernel commits split slab info from struct page * into struct slab, crash cannot get several slab related offsets from * struct page. * * d122019bf061 ("mm: Split slab into its own type") * 07f910f9b729 ("mm: Remove slab from struct page") * * Without the patch, "kmem -s|-S" and "bt -F[F]" options cannot work * correctly with the following errors: * * crash> kmem -s kmem_cache * CACHE OBJSIZE ALLOCATED TOTAL SLABS SSIZE NAME * kmem: page_to_nid: invalid page: ffff9454afc35020 * kmem: kmem_cache: cannot gather relevant slab data * ffff945140042000 216 ? ? ? 8k kmem_cache * * crash> bt -F * ... * bt: invalid structure member offset: page_slab * FILE: memory.c LINE: 9477 FUNCTION: vaddr_to_kmem_cache() * * Signed-by: Kazuhito Hagio * * commit dd35cf6fc5463ff31206fbb27238b4c3802c063d * Author: Kazuhito Hagio * Date: Wed Jan 26 06:07:00 2022 +0000 * * arm64: Fix segfault by "bt" command with offline cpus * * Currently on arm64, NT_PRSTATUS notes in dumpfile are not mapped to * online cpus and machine_specific->panic_task_regs correctly. As a * result, the "bt" command can cause a segmentation fault. * * crash> bt -c 0 * PID: 0 TASK: ffff8000117fa240 CPU: 0 COMMAND: "swapper/0" * Segmentation fault (core dumped) * * To fix this, * 1) make map_cpus_to_prstatus_kdump_cmprs() map the notes to * dd->nt_prstatus_percpu also on arm64, and * 2) move arm64_get_crash_notes() to machdep_init(POST_INIT) in order * to apply the mapping to machine_specific->panic_task_regs. * * Resolves: https://github.com/crash-utility/crash/issues/105 * Reported-by: xuchunmei000 * Signed-off-by: Kazuhito Hagio * Tested-by: David Wysochanski * * commit e389667cf62ef5db82f9796cdbc0134ec38612dc * Author: Tao Liu * Date: Fri Jan 21 13:43:09 2022 +0800 * * Improve the ps performance for vmcores with large number of threads * * Previously, the ps command will iterate over all threads which * have the same tgid, to accumulate their rss value, in order to * get a thread/process's final rss value as part of the final output. * * For non-live systems, the rss accumulation values are identical for * threads which have the same tgid, so there is no need to do the * iteration and accumulation repeatly, thus a lot of readmem calls are * skipped. Otherwise it will be the performance bottleneck if the * vmcores have a large number of threads. * * In this patch, the rss accumulation value will be stored in a cache, * next time a thread with the same tgid will take it directly without * the iteration. * * For example, we can monitor the performance issue when a vmcore has * ~65k processes, most of which are threads for several specific * processes. Without the patch, it will take ~7h for ps command * to finish. With the patch, ps command will finish in 1min. * * Signed-off-by: Tao Liu * * commit ce92e458506aec5bc5516a771e26b0f907ce0db4 * Author: Lianbo Jiang * Date: Wed Jan 26 20:32:35 2022 +0800 * * GDB: fix completion related libstdc++ assert * * Currently crash built with some specific flags (-D_GLIBCXX_ASSERTIONS * and etc.) may abort and print the following error when running the gdb * list command or tab-completion of symbols. For example: * * crash> l panic * /usr/include/c++/11/string_view:234: ... * Aborted (core dumped) * * crash> p "TAB completion" * crash> p /usr/include/c++/11/string_view:234: ... * Aborted (core dumped) * * When the name string is null (the length of name is zero), there are * multiple places where array access is out of bounds in the gdb/ada-lang.c * (see ada_fold_name() and ada_lookup_name_info()). * * The patch backports these gdb patches: * 6a780b676637 ("Fix completion related libstdc++ assert when using -D_GLIBCXX_DEBUG") * 2ccee230f830 ("Fix off-by-one error in ada_fold_name") * * Signed-off-by: Lianbo Jiang * Signed-off-by: Kazuhito Hagio * * commit 2ebd8c5ecf1f077975b82325a38dd777b594d0a9 * Author: Kazuhito Hagio * Date: Wed Jan 19 16:24:49 2022 +0900 * * Remove ptype command from "ps -t" option to reduce memory and time * * With some vmlinux e.g. RHEL9 ones, the first execution of the gdb ptype * command heavily consumes memory and time. The "ps -t" option uses it in * start_time_timespec(), and it can be replaced with the crash macros. * * This can reduce about 1.4 GB memory and 6 seconds time comsumption in * the following test: * * $ echo "ps -t" | time crash vmlinux vmcore * * Without the patch: * 11.60user 0.43system 0:11.94elapsed 100%CPU (0avgtext+0avgdata 1837964maxresident)k * 0inputs+400outputs (0major+413636minor)pagefaults 0swaps * * With the patch: * 5.40user 0.16system 0:05.46elapsed 101%CPU (0avgtext+0avgdata 417896maxresident)k * 0inputs+384outputs (0major+41528minor)pagefaults 0swaps * * Although the ptype command and similar ones cannot be fully removed, * but removing some of them will make the use of crash safer, especially * for an automatic crash reporter. * * Signed-off-by: Kazuhito Hagio * * commit d16dc6fff0260ec26002046fae4aeb546d6b9a0e * Author: Lianbo Jiang * Date: Mon Jan 17 15:14:00 2022 +0800 * * Move the initialization of "boot_date" to task_init() * * The "boot_date" is initialized conditionally in the cmd_log(), which may * display incorrect "boot_date" value with the following command before * running the "log -T" command: * * crash> help -k | grep date * date: Wed Dec 22 13:39:29 IST 2021 * boot_date: Thu Jan 1 05:30:00 IST 1970 * ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * The calculation of "boot_date" depends on the HZ value, and the HZ will * be calculated in task_init() at the latest, so let's move it here. * * Signed-off-by: Lianbo Jiang * * commit 14f8c460473c8613553b5defd174ca2af812ddcb * Author: Alexander Egorenkov * Date: Mon Dec 6 16:04:19 2021 +0100 * * memory: Handle struct slab changes on Linux 5.17-rc1 and later * * Since kernel commit d122019bf061 ("mm: Split slab into its own type"), * the struct slab is used for both SLAB and SLUB. Therefore, don't depend * on the non-presence of the struct slab to decide whether SLAB implementation * should be chosen and use the member variable "cpu_slab" of the struct * kmem_cache instead, it should be present only in SLUB. * * Without the patch, crash fails to start with the error message: * * crash: invalid structure member offset: kmem_cache_s_num * FILE: memory.c LINE: 9619 FUNCTION: kmem_cache_init() * * Signed-off-by: Alexander Egorenkov * * commit b9dc76e232e0226a14ae3089e3be5c915f2bb981 * Author: Lianbo Jiang * Date: Mon Jan 10 17:25:06 2022 +0800 * * Fix for HZ calculation on Linux 5.14 and later * * Kernel commit 3e9a99eba058 ("block/mq-deadline: Rename dd_init_queue() * and dd_exit_queue()") renamed dd_init_queue to dd_init_sched. Without * the patch, the 'help -m' may print incorrect hz value as follows: * * crash> help -m | grep hz * hz: 1000 <---The correct hz value on ppc64le machine is 100. * ^^^^ * * Fixes: b93027ce5c75 ("Add alternate HZ calculation using write_expire") * Signed-off-by: Lianbo Jiang * * commit 0d3d80b47d69c5d303b48c0463a026e60633cae2 * Author: Lianbo Jiang * Date: Thu Jan 6 12:01:17 2022 +0800 * * Fix for "bt -v" option to display the stack-end address correctly * * The "bt -v" command prints incorrect stack-end address when the * "CONFIG_THREAD_INFO_IN_TASK=y" is enabled in kernel, the "bt -v" * command output shows that the value stored at 0xffff8dee0312c198 * is 0xffffffffc076400a, however, the value stored actually at * 0xffff8dee0312c198 is NULL(0x0000000000000000), the stack-end * address is incorrect. * * Without the patch: * crash> bt -v * PID: 28642 TASK: ffff8dee0312c180 CPU: 0 COMMAND: "insmod" * possible stack overflow: ffff8dee0312c198: ffffffffc076400a != STACK_END_MAGIC * ^^^^^^^^^^^^^^^^ * * crash> rd 0xffff8dee0312c198 * ffff8dee0312c198: 0000000000000000 ........ * ^^^^^^^^^^^^^^^^ * * With the patch: * crash> bt -v * PID: 28642 TASK: ffff8dee0312c180 CPU: 0 COMMAND: "insmod" * possible stack overflow: ffff991340bc0000: ffffffffc076400a != STACK_END_MAGIC * * crash> rd 0xffff991340bc0000 * ffff991340bc0000: ffffffffc076400a .@v..... * * Signed-off-by: Lianbo Jiang * * commit 70a27ae9f2b45d6dba56ee4240b6adf79c544ee1 * Author: Lianbo Jiang * Date: Thu Jan 6 22:34:26 2022 +0800 * * Fix for "timer -r" option to display all the per-CPU clocks * * Currently, the hrtimer_max_clock_bases is hard-coded to 3, which * makes that crash only prints three clocks, and the rest of clocks * are not displayed. * * Without the patch: * crash> timer -r -C 11 * CPU: 11 HRTIMER_CPU_BASE: ffff9a775f95ee00 * CLOCK: 0 HRTIMER_CLOCK_BASE: ffff9a775f95ee80 [ktime_get] * (empty) * * CLOCK: 1 HRTIMER_CLOCK_BASE: ffff9a775f95ef00 [ktime_get_real] * (empty) * * CLOCK: 2 HRTIMER_CLOCK_BASE: ffff9a775f95ef80 [ktime_get_boottime] * (empty) * * With the patch: * crash> timer -r -C 11 * CPU: 11 HRTIMER_CPU_BASE: ffff9a775f95ee00 * CLOCK: 0 HRTIMER_CLOCK_BASE: ffff9a775f95ee80 [ktime_get] * (empty) * * CLOCK: 1 HRTIMER_CLOCK_BASE: ffff9a775f95ef00 [ktime_get_real] * (empty) * * CLOCK: 2 HRTIMER_CLOCK_BASE: ffff9a775f95ef80 [ktime_get_boottime] * (empty) * ... * CLOCK: 7 HRTIMER_CLOCK_BASE: ffff9a775f95f200 [ktime_get_clocktai] * (empty) * * Signed-off-by: Lianbo Jiang * * commit 98b417fc63467339b919ef6d322c1893d6d55f86 * Author: Lianbo Jiang * Date: Fri Dec 24 18:56:35 2021 +0800 * * Handle blk_mq_ctx member changes for kernels 5.16-rc1 and later * * Kernel commit 9a14d6ce4135 ("block: remove debugfs blk_mq_ctx * dispatched/merged/completed attributes") removed the member * rq_dispatched and rq_completed from struct blk_mq_ctx. Without * the patch, "dev -d|-D" options will fail with the following error: * * crash> dev -d * MAJOR GENDISK NAME REQUEST_QUEUE TOTAL ASYNC SYNC * * dev: invalid structure member offset: blk_mq_ctx_rq_dispatched * FILE: dev.c LINE: 4229 FUNCTION: get_one_mctx_diskio() * * Signed-off-by: Lianbo Jiang * Signed-off-by: Kazuhito Hagio * * commit 7eba220e1a7d443cad6716dd83d4953ffd62d566 * Author: Qi Zheng * Date: Tue Dec 21 15:40:31 2021 +0800 * * Fix pvops Xen detection for arm machine * * Since the xen_start_info on the arm/arm64 platform points to a static * variable '_xen_start_info'(see its definition as below), which makes * that the address of xen_start_info will never be null. * * arch/arm/xen/enlighten.c:40:static struct start_info _xen_start_info; * arch/arm/xen/enlighten.c:41:struct start_info *xen_start_info = &_xen_start_info; * arch/arm/xen/enlighten.c:42:EXPORT_SYMBOL(xen_start_info); * * As a result, the is_pvops_xen() in commit 4badc6229c69 ("Fix pvops * Xen detection for kernels >= v4.20") always returns TRUE because it * can always read out the non-null address of xen_start_info, finally * the following error will be reported on arm/arm64 platform(non-Xen * environment) because p2m_mid_missing and xen_p2m_addr are not defined: * * crash: cannot resolve "p2m_top" * * For the arm/arm64 platform, fix it by using xen_vcpu_info instead of * xen_start_info to detect Xen dumps. * * In addition, also explicitly narrow the scope of the xen_start_info * check to x86 with the machine_type(), there is no need to check it on * other architectures. * * Fixes: 4badc6229c69 ("Fix pvops Xen detection for kernels >= v4.20") * Signed-off-by: Qi Zheng * Acked-by: Kazuhito Hagio * * commit 6968345893178d2750b8872055498d2a6010a861 * Author: HATAYAMA Daisuke * Date: Wed Dec 8 12:07:34 2021 +0000 * * defs.h: fix breakage of compatibility of struct symbol_table_data for extension modules * * Commit <2fab8fbc0c4f> ("symbols: Implement install and remove operations * for mod_symname_hash") added new member variable mod_symname_hash in the * middle of struct symbol_table_date, which breaks compatibility of struct * symbol_table_data for extension modules. As the result, crash trace command * results in segmentation fault. * * Fixes: 2fab8fbc0c4f ("symbols: Implement install and remove operations for mod_symname_hash") * Signed-off-by: HATAYAMA Daisuke * * commit c477b04aee34d4f4784c326ed715e91b2c43eb3e * Author: HATAYAMA Daisuke * Date: Thu Dec 9 01:05:07 2021 +0000 * * defs.h: fix breakage of compatibility of struct machdep_table for extension modules * * Commit <2f967fb5ebd7> ("crash_taget: fetch_registers support") added new * member get_cpu_reg in the middle of struct machdep_table, which breaks * compatibility of struct machdep_table for extension modules. As the result, * crash gcore command results in unexpected behavior, furthermore may cause * segmentation fault. * * Fixes: 2f967fb5ebd7 ("crash_taget: fetch_registers support") * Signed-off-by: HATAYAMA Daisuke * * commit 995db8ab88916b6397676b67be98c0a4f82cca49 * Author: Hong YANG * Date: Mon Nov 15 15:41:01 2021 +0800 * * arm64: Support overflow stack panic * * Kernel commit <872d8327ce89> ("arm64: add VMAP_STACK overflow detection") * has supported the overflow stack exception handling. Without the patch, the * "bt" command will make crash generate a core dump because of segmentation * fault. With the patch, the "bt" command can display the overflow stack. * * Before: * crash> bt * PID: 3607 TASK: ffffffcbf9a4da00 CPU: 2 COMMAND: "sh" * Segmentation fault (core dumped) * * After: * crash> bt * PID: 3607 TASK: ffffffcbf9a4da00 CPU: 2 COMMAND: "sh" * #0 [ffffffccbfd85f50] __delay at ffffff8008ceded8 * ... * #5 [ffffffccbfd85fd0] emergency_restart at ffffff80080d49fc * #6 [ffffffccbfd86140] panic at ffffff80080af4c0 * #7 [ffffffccbfd86150] nmi_panic at ffffff80080af150 * #8 [ffffffccbfd86190] handle_bad_stack at ffffff800808b0b8 * #9 [ffffffccbfd862d0] __bad_stack at ffffff800808285c * PC: ffffff8008082e80 [el1_sync] * LR: ffffff8000d6c214 [stack_overflow_demo+84] * SP: ffffff1a79930070 PSTATE: 204003c5 * X29: ffffff8011b03d00 X28: ffffffcbf9a4da00 X27: ffffff8008e02000 * X26: 0000000000000040 X25: 0000000000000124 X24: ffffffcbf9a4da00 * X23: 0000007daec2e288 X22: ffffffcbfe03b800 X21: 0000007daec2e288 * X20: 0000000000000002 X19: 0000000000000002 X18: 0000000000000002 * X17: 00000000000003e7 X16: 0000000000000000 X15: 0000000000000000 * X14: ffffffcc17facb00 X13: ffffffccb4c25c00 X12: 0000000000000000 * X11: ffffffcc17fad660 X10: 0000000000000af0 X9: 0000000000000000 * X8: ffffff1a799334f0 X7: 0000000000000000 X6: 000000000000003f * X5: 0000000000000040 X4: 0000000000000010 X3: 00000065981d07f0 * X2: 00000065981d07f0 X1: 0000000000000000 X0: ffffff1a799334f0 * * Signed-off-by: Hong YANG * * commit d9b11ddd19e98424b54bef4260b9d780f869b504 * Author: Lianbo Jiang * Date: Wed Dec 1 17:36:20 2021 +0800 * * Mark start of 8.0.1 development phase with version 8.0.0++ * * Signed-off-by: Lianbo Jiang -- Troy Heber Thu, 17 Nov 2022 10:27:25 -0700 crash (8.0.0-1) unstable; urgency=medium * New upstream (Closes: #950544) * Add lintian override for zlib in embedded gdb * * commit ec568e2ea515b66343d3488d5d4b9a625d55b7ae * Author: Kazuhito Hagio * Date: Wed Nov 24 13:32:49 2021 +0900 * * crash-7.3.0 -> crash-8.0.0 * * Signed-off-by: Kazuhito Hagio * * commit 6bc104059b124ecac5c8244f84aae6d7cfdfe97c * Author: Kazuhito Hagio * Date: Tue Nov 16 02:42:23 2021 +0000 * * log: add warning to help text to inform the inaccuracy of -T option * * The timestamps of the "log -T" option are inaccurate because they are * from local_clock(), which returns the raw counter in the local CPU and * it's different from the elapsed wall time. * * The dmesg command, which the "log -T" option imitates, has a similar * behavior in nature and a warning in its help text. Let's add a warning * also to the crash's help text to inform the inaccuracy for now. * * Reported-by: Martin Moore * Signed-off-by: Kazuhito Hagio * * commit b0dd73d2368275e101688b2aca0bc297fd1ba300 * Author: Aaron Tomlin * Date: Mon Nov 1 11:39:34 2021 +0000 * * kernel: show that the kernel is tainted at init-time * * Explicitly indicate to the user that the Linux kernel is tainted * at init-time or when the 'sys' command is used. * * Signed-off-by: Aaron Tomlin * * commit 64f48ee6719632895cd8a0922e84a4626e3790d8 * Author: Aaron Tomlin * Date: Mon Nov 1 11:39:33 2021 +0000 * * kernel: Introduce is_kernel_tainted() * * Provide a quick way to test if the given Linux kernel is "tainted". * Support for Linux-2.6.12 and above, to date. * * Signed-off-by: Aaron Tomlin * * commit bfa596f40650e5a061b15d41b0a5b108610b11e9 * Author: Aaron Tomlin * Date: Mon Nov 1 11:39:32 2021 +0000 * * kernel: consolidate show_kernel_taints() * * No functional change. * * Signed-off-by: Aaron Tomlin * * commit 8246dce99dd23457e8c7a3fe9609c706694d1959 * Author: Kazuhito Hagio * Date: Thu Nov 11 15:20:52 2021 +0900 * * arm64: Update SECTION_SIZE_BITS for kernels >= 5.12 * * Update the default SECTION_SIZE_BITS value for arm64 Linux 5.12 * and later kernels that contain kernel commit f0b13ee23241 * ("arm64/sparsemem: reduce SECTION_SIZE_BITS"). * * Reported-by: Ankur Bansal * Signed-off-by: Kazuhito Hagio * * commit 01d20ca1861ffaf449c1c60aa0536e9f42200ad3 * Author: Philipp Rudo * Date: Tue Nov 9 14:52:22 2021 +0100 * * Fix live debugging with lockdown=integrity * * With kernel lockdown the access to kernel interfaces that allow one to * extract confidential information (lockdown=confidentiality) or modify a * running kernel (lockdown=integrity) can be restricted. Two of the * interfaces that can be restricted are /dev/mem (integrity & * confidentiality) and /proc/kcore (confidentiality). With * lockdown=integrity this leads to a situation where /dev/mem exists but * is not readable while /proc/kcore exists and is readable. This breaks * crash's live debugging when it is invoked without argument, i.e. * * $ crash * [...] * crash: /dev/mem: Operation not permitted * * while passing /proc/kcore as image succeeds. The reason for this is * that crash always picks /dev/mem as source when it exits but doesn't * check if it is readable. Fix this by only selecting /dev/mem when it * is readable. * * Signed-off-by: Philipp Rudo * * commit 68870c83d299603c07785e3530e33c13045c87ef * Author: Alexander Egorenkov * Date: Wed Oct 13 10:56:39 2021 +0200 * * Handle task_struct cpu member changes for kernels >= 5.16-rc1 * * Kernel commit bcf9033e5449bdcaa9bed46467a7141a8049dadb * ("sched: move CPU field back into thread_info if THREAD_INFO_IN_TASK=y") * moved the member cpu of task_struct back into thread_info. * Without the patch, crash fails with the following error message * during session initialization: * * crash: invalid structure member offset: task_struct_cpu * FILE: task.c LINE: 2904 FUNCTION: add_context() * * Signed-off-by: Alexander Egorenkov * Signed-off-by: Kazuhito Hagio * * commit c180a63f2cb370da6097ad97eb07333c07aa988b * Author: Kazuhito Hagio * Date: Mon Oct 25 16:53:26 2021 +0900 * * arm64: Use VA_BITS for page_offset calculation * * Commit 167d37e347fe ("arm64: assign page_offset with VA_BITS kernel * configuration value") changed the page_offset calculation from * using VA_BITS_ACTUAL to CONFIG_ARM64_VA_BITS. This caused an error * for ramdumps without vmcoreinfo like this: * * crash: vmlinux and /var/tmp/ramdump_elf_XUtCMT do not match! * * Set the vmcoreinfo value to VA_BITS if available, and use VA_BITS * for page_offset calculation instead. * * Also remove ARM64_FLIP_PAGE_OFFSET_ACTUAL because it's not used * actually. * * Reported-by: Ankur Bansal * Signed-off-by: Kazuhito Hagio * * commit 5c04a6f3f923af7c50f0d853477044802b3fa6ec * Author: Tao Liu * Date: Sat Oct 16 13:21:17 2021 +0800 * * symbols: Add mod_symname_hash table dump to help -s * * Previously, help -s only print out the dump status of symname_hash * table. Since we have mod_symname_hash table introduced, let's print * out mod_symname_hash in help -s as well. * * Signed-off-by: Tao Liu * * commit df0049d12b2ced1b6ff7350ee3c0ca28c3f7cd52 * Author: Tao Liu * Date: Sat Oct 16 13:21:16 2021 +0800 * * symbols: Refactor SYMNAME_HASH_INDEX macro to be a function * * SYMNAME_HASH_INDEX is used as the index of symname hash table. It will * be out of range if SYMNAME_HASH_INDEX is negative. This patch avoids * the risk by changing the marco into a function, and casting and * calculating the numbers as unsigned. * * Suggested-by: Lianbo Jiang * Suggested-by: Philipp Rudo * Signed-off-by: Tao Liu * * commit 1e23335dab6bf9f6219a23bf0be4ad9f433f4f43 * Author: Tao Liu * Date: Sat Oct 16 13:21:15 2021 +0800 * * symbols: Sync module symbols into mod_symtable whenever module symbols * change * * Signed-off-by: Tao Liu * Reviewed-by: Philipp Rudo * * commit f3bee9375ed32b85e7f81a5e46a0040620553ae0 * Author: Tao Liu * Date: Sat Oct 16 13:21:14 2021 +0800 * * symbols: Intergrate symbol_exists() with mod_symname_hash search * * This patch introduces mod_symname_hash search to symbol_exists() * to improve its performance. And code refactoring for * kernel_symbol_exists(). * * Signed-off-by: Tao Liu * Reviewed-by: Philipp Rudo * * commit 340c6ad1a0a7ce76eb5d9397833bfc6a049e2b3b * Author: Tao Liu * Date: Sat Oct 16 13:21:13 2021 +0800 * * symbols: Extend symname_hash_search() with hash table select * * Previously symname_hash_search() can only search symbols from kernel's * symname_hash. This patch add hash table pointer as parameter for * symname_hash_search(). Thus symname_hash_search() can be used both for * symname_hash and mod_symname_hash searching. * * Signed-off-by: Tao Liu * * commit 214f9bf3727c3350401b3f4b4389258c24486e06 * Author: Tao Liu * Date: Sat Oct 16 13:21:12 2021 +0800 * * symbols: Integrate symbol_search() with mod_symname_hash search * * This patch introduces mod_symname_hash search to symbol_search(), * to get a better searching performance. * * Signed-off-by: Tao Liu * Reviewed-by: Philipp Rudo * * commit 2fab8fbc0c4f1c4cbe889de4cead5f7457a19f77 * Author: Tao Liu * Date: Sat Oct 16 13:21:11 2021 +0800 * * symbols: Implement install and remove operations for mod_symname_hash * * Currently the sequence for symbol_search to search a symbol is: 1) * kernel symname hash table, 2) iterate all kernel symbols, 3) iterate * all kernel modules and their symbols. In the worst case, if a * non-exist symbol been searched, all 3 stages will be went through. The * time consuming status for each stage is like: * * stage 1 stage 2 stage 3 * 0.007000(ms) 0.593000(ms) 2.421000(ms) * * stage 3 takes too much time when comparing to stage 1. This patch * series introduces a symname hash table for kernel modules, to improve * the performance of symbol searching. * * Functions symbol_search() and symbol_exists() are fundamental and * widely used by other crash functions, thus the benefit of performance * improvement can get accumulated. For example, "ps -m" and "irq" * commands, which call the functions many times, will become faster with * the patch series. * * This patch indroduces mod_symname_hash, and its install/remove * operations. Since symbol_search() has to return the lowest address * symbol and symbol_search_next() returns the next lowest symbol, thus * the installation should be sorted ascendingly. * * In mod_symname_hash_install_range() scenario, spn are already arranged * ascendingly, so for mod_symname_hash_install(): * * Install spn previous to sp: * * If sp is the start of bucket, or * 1) spn->value is smaller than sp->value. * * Install spn next to sp: * * 1) sp->name_hash_next is NULL, or * 2) sp->name_hash_next->value is larger than spn->value * * spn->value is the kernel address of the symbol and will not change. * So we use it mainly to determine the sequence. When spn->value equals * sp->value, they must be symbols within a kernel module. * * Signed-off-by: Tao Liu * * commit f7e3b2d9b753793e230a5242974a111cdf139e49 * Author: Kazuhito Hagio * Date: Thu Sep 30 11:04:31 2021 +0900 * * .gitignore: add gdb-10.2 directory * * Signed-off-by: Kazuhito Hagio * * commit 05a3a328fcd8920e49926b6d1c9c81ce0b6acbca * Author: Kazuhito Hagio * Date: Thu Sep 9 15:23:27 2021 +0900 * * Remove text value cache code * * The text value cache was implemented for analysis of remote dumpfiles * using the deprecated "crash daemon" running on the remote host. On * updating GDB to 10.2, a regression occurred when we tried to fix a * "help -x" command problem, and there was no performance degradation * even without the text cache, so let's drop this functionality. * * Signed-off-by: Kazuhito Hagio * * commit c1e256249426dd59ceea99038451a39e98a26790 * Author: Kazuhito Hagio * Date: Thu Aug 19 10:52:58 2021 +0900 * * Fix tab completion issues * * 1. The maximum number of tab completion candidates is limited to 200 * by default. Set it unlimited. * * 2. The output of tab completion is not wrapped with the screen width. * Get and use it when tab completion is invoked. * * Signed-off-by: Kazuhito Hagio * * commit 5c2d8d2d9da6423eec076fd51049d7b4677b61c6 * Author: Tao Liu * Date: Tue Aug 17 16:21:43 2021 +0800 * * Set gdb max-value-size to be unlimited * * gdb-10.2 uses max-value-size as the maximum size in bytes that the * contents of a object may allocate. The default value of max-value-size * is 64K. However, it could be not enough for allocating an object which * requires larger space, and failed at the startup of crash. * * In gdb-7.6, there is no max-value-size check and works fine. So in * this patch, let's just set max-value-size to be unlimited. * * Signed-off-by: Tao Liu * * commit b8e1f2735b8dd1303aeb2affa309a2a409a82d38 * Author: Tao Liu * Date: Mon Jul 26 09:58:54 2021 +0800 * * Add kernel version dependent check for getting length of log_end * * For kernels(>=2.4.9.11 [1] && <3.5 [2]), log_end was involved in the * kernel sources. * For kernels(>=2.6.25 [3]), log_end was defined as: * static unsigned log_end; * For kernels(<2.6.25), log_end was defined as: * static unsigned long log_end; * * Previously, the length of log_end is determined by get_symbol_length, * but it can be a regression when the returned length is 0 for some * cases and value unchecked: * * crash> help -t * ... * help: invalid size request: 0 type: "log_end" * * To solve the above issue, let's add a kernel version dependent check * to get its value appropriately when the length of the 'log_end' * returns a value of zero. * * [1]: https://elixir.bootlin.com/linux/2.4.9.11/source/kernel/printk.c#L74 * [2]: https://elixir.bootlin.com/linux/v3.5/source/kernel/printk.c * [3]: https://elixir.bootlin.com/linux/v2.6.25/source/kernel/printk.c#L104 * * Signed-off-by: Tao Liu * * commit 51f21b0d1c91a4ae02ebf0d8c81460ec8b6c1283 * Author: Tao Liu * Date: Thu Jul 15 17:34:29 2021 +0800 * * x86_64_irq_eframe_link_init: Fix wrong instruction searching range * calculation * * In function x86_64_irq_eframe_link_init, instruction "push xxx" is * searched in addresses range from "common_interrupt" to the next nearby * symbol, in order to calculate the value of irq_eframe_link. The * searching distance is given by max_instructions, which is calculated * by end ranging address minus start ranging address. Then crash asks * gdb to disassemble max_instructions quantity of instructions. * * Taking max_instructions as the quantity of disassemble instructions is * inappropriate, because most x86_64 instructions have a length longer * than 1, as a consequence, much more than the actual needed * instructions get disassembled. * * In gdb-7.6 crash, the extra instructions are skipped by * "if (!strstr(buf, sp->name))", which breaks if one instruction doesn't * belongs to a symbol: * * 0xffffffff8005d5b4 : cld * 0xffffffff8005d5b5 : sub $0x48,%rsp * ... * 0xffffffff8005d61e : leaveq * 0xffffffff8005d61f : mov %gs:0x10,%rcx * <--- searching stops here * ... * * In gdb-10.2 crash, "exit_intr" doesn't show, however it really exist. * As a result, searching for "push xxx" will go to a wrong place. * * 0xffffffff8005d5b4 : cld * 0xffffffff8005d5b5 : sub $0x48,%rsp * ... * 0xffffffff8005d61e : leave * 0xffffffff8005d61f : mov %gs:0x10,%rcx * <--- searching continues * ... * * (gdb) p exit_intr * $1 = {} 0xffffffff8005d61f * * (gdb) info symbol exit_intr * common_interrupt + 107 in section .text * * The previous way to determine start and end searching range is not * stable, otherwise we may encounter regression that cmd "bt" prints * wrong IRQ stack. This patch fix the bug by removing max_instructions * calculation, and directly ask gdb to disassemble addresses range from * "common_interrupt" to the next nearby symbol. * * Signed-off-by: Tao Liu * * commit fce91bec5bef534e52f3261cc289a21a2cdb5fe3 * Author: Tao Liu * Date: Sun Jul 11 22:30:22 2021 +0800 * * Fix the failure of reporting vmcore and vmlinux do not match for * kernels(<2.6.11) * * There is a regression issue for kernels(<2.6.11) as below: * * $ crash 2.6.9-68.9/vmcore 2.6.9-68.9/vmlinux.gz * ... * GNU gdb (GDB) 10.2 * ... * crash: /var/tmp/vmlinux.gz_GLsAvX and 2.6.9-68.9/vmcore do not match! * * The reason is that it needs to read out the address of linux banner * with readmem() first, and then the read_string() will be able to read * the data from linux banner. So, for the kernels(<2.6.11) case, lets * still invoke get_symbol_data() to accomplish this. See the changes: * [1] https://elixir.bootlin.com/linux/v2.6.10/source/init/version.c#L38 * [2] https://elixir.bootlin.com/linux/v2.6.11/source/init/version.c#L38 * * Signed-off-by: Tao Liu * Signed-off-by: Lianbo Jiang * * commit 8d6f677e54a2474b3da19402e29278b62603d71d * Author: Alexey Makhalov * Date: Thu Jul 8 16:14:02 2021 -0700 * * Do not adjust addr by relocate offset(KASLR) * * GBD symbol resolution already considers relocation (KASLR) offset. * So, there is no needs to adjust the function address before calling * GDB. * * It fixes file name and line number output for 'dis -l' and 'sys -c' * commands. * * Signed-off-by: Alexey Makhalov * Signed-off-by: Tao Liu * * commit 6c5f0c6ff5d158f2ef4fa997a052b0643d0c25ee * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:36 2021 -0700 * * vmware_guestdump: add debugging of the init function * * Dump memory and registers state after parsing. * * Signed-off-by: Alexey Makhalov * * commit 96716862765f73676bfdb2d19fc5872364d21b73 * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:35 2021 -0700 * * vmware backend: honor silence flag * * Do not print any boot messages in silence (-s) mode. * * Signed-off-by: Alexey Makhalov * * commit e832e0eb5bd8d97dfa9f4bd0e22fbfad849c11df * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:34 2021 -0700 * * Allow 'gdb disassemble' command for relocated kernel * * As new gdb is able to handle it properly. * * Signed-off-by: Alexey Makhalov * * commit 2f967fb5ebd737ce5eadba462df35935122e8865 * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:33 2021 -0700 * * crash_taget: fetch_registers support * * Provides API for crash_target to fetch registers of given * CPU. It will allow gdb to perform such commands as "bt", * "frame", "info locals". * * Highlevel API is crash_get_cpu_reg (). It calls machine * (architecture) specific function: machdep->get_cpu_reg(). * Input arguments such as register number and register size * come from gdb arch information. So, get_cpu_regs() * implementations in crash must understand it. * * Signed-off-by: Alexey Makhalov * * commit 0b85218983ffcf939a638f1133871079c5615a46 * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:30 2021 -0700 * * Fix reduced output of `bt` command * * gdb-10 produces reduced output of `bt` command. * * Changed disassembler output is the reason of missing frames * in backtrace. Call instruction mnemonic for x86_64 was changed * from "callq" to "call" in gdb-10. * * Fixing the issue by adding a search for "call" word in disassembler * parser. * * Signed-off-by: Alexey Makhalov * Reported-by: Kazuhito Hagio * * commit 36e9d8673e9205f4ea4daad61c199597920c93df * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:27 2021 -0700 * * "whatis -m": fix duplications in the output * * "whatis -m" output started to generate duplicated results after GDB * update: * * crash> whatis -m mm_struct * SIZE TYPE * 16 tlb_state * ... * 256 linux_binprm * 2752 rq * 2752 rq <<-- duplicated * 2752 rq * 2752 rq * 2752 rq * 4048 task_struct * * It was caused by incorrect string comparisons. * Use strcmp for full string comparison instead of just string pointers * comparison. * * Signed-off-by: Alexey Makhalov * Reported-by: Kazuhito Hagio * * commit 163abcbbabdf8207c11ee93b1c909d85ecbcbf1f * Author: Alexey Makhalov * Date: Fri Mar 19 21:07:26 2021 -0700 * * crash_get_nr_cpus: get nr_cpus from the dumps * * Most of the dumps have information about real number of CPUS. * Use that to instantiate GDB's target inferior threads. * * Signed-off-by: Alexey Makhalov * * commit 9fab193edb34ddf30282b5ac137f7d8078198938 * Author: Alexey Makhalov * Date: Tue Aug 17 17:14:59 2021 +0800 * * Update to gdb-10.2 * * Main changes: * [1] update gdb-7.6.patch to gdb-10.2.patch, and keep all functionality * and good compatibility * [2] remove unneeded patches(gdb-7.6-proc_service.h.patch and * gdb-7.6-ppc64le-support.patch) * [3] to make the c++ compiler happy, add the extern "C" to eliminate * compilation issues, also add CXXFLAGS=-m32 to generate proper * 32bit object files * [4] the parameter types of some functions are changed, eg, the set of * prettyprint variables * [5] eliminate error_hook() and SJLJ while running in C++ code (after * gdb_command_funnel()) use try-catch mechanism instead * [6] request_types() is redone to do not call GNU_GET_NEXT_DATATYPE * multiple times but single usage of GNU_ITERATE_DATATYPES with proper * callback instead. Complete iteration happens on C++ side now. * [7] remove "struct global_iterator" from request structure, but add * several fields (including callback pointer) to be able to perform * iteration on C++ side * [8] type of "linux_banner" symbol is reported as 'D' by new gdb as its * section ".rodata" marked as writable in vmlinux * [9] BFD API has changed. * [10] the deprecated_command_loop_hook got deprecated. So, call crash * main_loop() directly from gdb captured_main() * [11] remove previously used hooks for that in target.c. Add * crash_target for gdb to provide target operations such as xfer_partial * to read and write crash dump memory. * * Signed-off-by: Alexey Makhalov * Signed-off-by: Lianbo Jiang * * commit 7f38d1baf794823355ee100b3a1914155d4190f2 * Author: Kazuhito Hagio * Date: Mon Sep 27 09:45:42 2021 +0900 * * diskdump: Add support for reading dumpfiles compressed by Zstandard * * Add support for reading dumpfiles compressed by Zstandard (zstd) * using makedumpfile. * * To build crash with zstd support, type "make zstd". * * Signed-off-by: Kazuhito Hagio * * commit cf0c8d10e1870d89b39f40382634db51aa8fcf2c * Author: Hari Bathini * Date: Fri Sep 3 17:33:42 2021 +0530 * * mod: fix module object file lookup * * On systems where vmlinux file is not under /usr/lib/debug/lib/modules * directory, 'mod -s|-S' command may fail to find the module's object * file with the below error: * * mod: cannot find or load object file for sd_mod module * * Fix it by trying all possible module object file extensions while * searching for the object file under /usr/lib/debug/lib/modules * directory. * * Signed-off-by: Naveen N. Rao * Signed-off-by: Hari Bathini * * commit 15765867c0f1d937db5ec06f51adb6bfd13354ea * Author: Ritesh Harjani * Date: Thu Aug 26 02:31:10 2021 +0530 * * ppc64: Add MMU type info in machdep command * * This adds MMU type info in "machdep" command. * * Signed-off-by: Ritesh Harjani * * commit 3db5fff2e9d7b8762d1bd46d8d2c47ba4c7e374f * Author: Ritesh Harjani * Date: Thu Aug 26 02:31:08 2021 +0530 * * .gitignore: Add cscope, ctags & compile_commands.json * * Add cscope, ctags & compile_commands.json in .gitignore file. * * Signed-off-by: Ritesh Harjani * * commit 4b34197508578bb43639e6d169fb91fb0489fa2b * Author: James Hsu * Date: Wed Aug 18 15:45:47 2021 +0800 * * arm64: Get CPU registers from ELF notes even without crash_notes symbol * * Currently arm64 crash retrieves the CPU registers from crash_notes symbol * or ELF notes only when the symbol exists, but there are dumpfiles which * have the registers in ELF notes without the symbol. * * With the patch, crash can retrieve the registers from ELF notes without * the crash_notes symbol. * * Signed-off-by: James Hsu * Signed-off-by: Kazuhito Hagio * * commit 44e5801d9016987b6b4ebd571bfde8ae3e75da7b * Author: Philipp Rudo * Date: Thu Aug 5 15:19:37 2021 +0200 * * x86_64: Fix check for __per_cpu_offset initialization * * Since at least kernel v2.6.30 the __per_cpu_offset gets initialized to * __per_cpu_load. So first check if the __per_cpu_offset was set to a * proper value before reading any per cpu variable to prevent potential * bugs. * * [ kh: added check for the existence of __per_cpu_load ] * * Signed-off-by: Philipp Rudo * Signed-off-by: Kazuhito Hagio * * commit 881f33d97cee9895796829d0cc969b51dd34d831 * Author: Roman Bolshakov * Date: Thu Jun 17 02:27:35 2021 +0300 * * diskdump: Introduce read_pd() * * Standalone function for reading of page descriptors is needed later for * of expected core size and detection of incomplete dumps. * * Signed-off-by: Roman Bolshakov * * commit 1425b0504b1e79d88a2d188d7e4c0e7fceba4501 * Author: Roman Bolshakov * Date: Thu Jun 17 02:27:34 2021 +0300 * * diskdump: Print total number of dumpable pages * * It's not clear how broken an incomplete dump from the existing debugging * prints. Aggregate number of valid pages helps to figure out approximate * size of the dump. Size of a complete dump is roughly: * * EXPECTED_CORE_SIZE = a few pages (kdump headers + bitmaps + descriptors) * (total_valid_pages * block_size) * compression rate * * An incomplete core would be significantly smaller than: * * total_valid_pages * block_size * * Signed-off-by: Roman Bolshakov * * commit 41cda195c6421fbde72ed67b32b8c1ab3eb0c56f * Author: Roman Bolshakov * Date: Thu Jun 17 02:27:33 2021 +0300 * * netdump: Permit --zero_excluded for incomplete ELF dumps * * DUMP_ELF_INCOMPLETE is set very late after ENOSPC error is hit by * makedumpfile. Any following error that prevents modification of ELF * header would result in effectively incomplete core that doesn't have the * flag. zero_excluded flag doesn't work for such kind of incomplete core. * * Signed-off-by: Roman Bolshakov * * commit 4631320e96f8a63c897fbbce4e87e3c47af40bc9 * Author: Roman Bolshakov * Date: Thu Jun 17 02:27:32 2021 +0300 * * diskdump: Fail readmem() early if dump is incomplete * * kdump format description [1] says: * * [...] zero page has its own offset not equal 0. So when reading page * from incomplete core, only the page lost by ENOSPACE errors has 0 in * its corresponding page descriptor's member offset. * * crash has special treatment for page descriptors with zero offset only * if DUMP_DH_COMPRESSED_INCOMPLETE is set in dump header. However, * makedumpfile places the flag after ENOSPC is hit and only if dump * header modification went without errors. * * In case if crashkernel environment was terminated early (e.g. by BMC) * or some other reason, DUMP_DH_COMPRESSED_INCOMPLETE won't be set on * the dump header. Then cache_page() would be performed on pages with * pd.offset == 0 and due to pd.size == 0 it'll skip read into * compressed_page and then non related pre-existing contents of * compressed_page will copied into page cache for the non-present page. * * Ultimately, it'll lead to a cryptic failure, like: * * crash: invalid kernel virtual address: 72288cacacf427f8 [...] * * The failure would be a bit cleaner if crash explicitly fails on the * page that is an outcome of incomplete dump: * * crash: page incomplete: kernel virtual address: c000003fff9d17e8 [...] * * Debugging level 8 would also produce exact offset from data_offset to * print descriptor value with ease: * * read_diskdump/cache_page: descriptor with zero offset found at * paddr/pfn/pos: 3fff9d0000/3fff9d/743dd * * That helps in inspecting broken descriptor with hexdump or similar * tools: * * hexdump -s (data_offset + pos * 0x18) -n 0x18 * * [1] https://github.com/makedumpfile/makedumpfile/ * blob/master/IMPLEMENTATION * * Signed-off-by: Roman Bolshakov * * commit 80334ed25820cc08d147de5da361f427885cdd9e * Author: Aaron Tomlin * Date: Tue Jul 13 14:24:49 2021 +0100 * * kmem: Add support to -S option to specify a range of CPU-specific slab * data * * With this patch, it is now possible for one to explicitly specify a * range of CPU-specific slab data to list. For example: * * Note: This is only applicable to a Linux kernel with Kconfig * CONFIG_SLUB enabled. The optional argument GNU extension * for getopt(3) is utilized; and, the CPU range must be * specified as expected * * crash> kmem -S=1,4 kmalloc-512 * CACHE OBJSIZE ALLOCATED TOTAL SLABS SSIZE NAME * ffff8d3f07c06c00 512 1916 3680 115 16k kmalloc-512 * CPU 1 KMEM_CACHE_CPU: * ffff8d461fa6f140 * CPU 1 SLAB: * SLAB MEMORY NODE TOTAL ALLOCATED FREE * fffff540df7c4000 ffff8d45df100000 0 32 8 24 * FREE / [ALLOCATED] * ffff8d45df100000 (cpu 1 cache) * [ffff8d45df100200] * ffff8d45df101000 (cpu 1 cache) * ...skipped ... * CPU 4 KMEM_CACHE_CPU: * ffff8d461fb2f140 * CPU 4 SLAB: * SLAB MEMORY NODE TOTAL ALLOCATED FREE * fffff540dfde3800 ffff8d45f78e0000 0 32 8 24 * FREE / [ALLOCATED] * [ffff8d45f78e0000] * ffff8d45f78e0200 (cpu 4 cache) * ffff8d45f78e0400 (cpu 4 cache) * ...skipped ... * * Signed-off-by: Aaron Tomlin * Signed-off-by: Kazuhito Hagio * * commit f53b73e8380bca054cebd2b61ff118c46609429b * Author: Pingfan Liu * Date: Fri Jul 2 10:14:24 2021 +0800 * * arm64: implement switchable PTOV()/VTOP() for kernels >= 5.10 * * Crash encounters a bug like the following: * ... * SECTION_SIZE_BITS: 30 * CONFIG_ARM64_VA_BITS: 52 * VA_BITS_ACTUAL: 48 * (calculated) VA_BITS: 48 * PAGE_OFFSET: ffff000000000000 * VA_START: ffff800000000000 * modules: ffff800008000000 - ffff80000fffffff * vmalloc: ffff800010000000 - ffffffdfdffeffff * kernel image: ffff800010000000 - ffff800012750000 * vmemmap: ffffffdfffe00000 - ffffffffffffffff * * * * read_netdump: addr: ffff800011c53bc8 paddr: eb453bc8 cnt: 4 * offset: 1c73bc8 * irq_stack_ptr: * type: 1, TYPE_CODE_PTR * target_typecode: 8, TYPE_CODE_INT * target_length: 8 * length: 8 * GNU_GET_DATATYPE[thread_union]: returned via gdb_error_hook * * * read_netdump: READ_ERROR: offset not found for paddr: * fff1000bf79c0050 * crash: read error: kernel virtual address: ffff000b779c0050 type: * "IRQ stack pointer" * ... * * Apparently, for a normal system, the 'paddr: fff1000bf79c0050' is * unreasonable. * * This bug connects with kernel commit 7bc1a0f9e176 ("arm64: mm: use * single quantity to represent the PA to VA translation"), which removed * physvirt_offset kernel variable and changed the PTOV()/VTOP() formulas. * * Implement switchable PTOV()/VTOP() to cope with different kernel * version. * * Signed-off-by: Pingfan Liu * * commit bf1379a8b6ff8d6a8fa12978f7194f15f85c4380 * Author: Pingfan Liu * Date: Fri Jul 2 10:14:23 2021 +0800 * * arm64: use dedicated bits to record the VA space layout changes * * arm64 memory layout experiences big changes due to the following kernel * commits in date descending order: * 5. 7bc1a0f9e176 arm64: mm: use single quantity to represent the PA * to VA translation * 4. b6d00d47e81a arm64: mm: Introduce 52-bit Kernel VAs * 3. 5383cc6efed1 arm64: mm: Introduce vabits_actual * 2. 14c127c957c1 arm64: mm: Flip kernel VA space * 1. f80fb3a3d508 arm64: add support for kernel ASLR * * For 1, crash has already used NEW_VMEMMAP to trace it. * For 2, crash lacks a flag to tag it and handle it differently. * For 3, two important kernel variables vabits_actual and physvirt_offset * are introduced. * For 4, since it comes immediately after 3, crash-utility does not need * to distinguish it. * For 5, kernel variable phyvirt_offset is removed * * These changes have effects on PTOV()/VTOP() formula. So introducing * two bits HAS_PHYSVIRT_OFFSET and FLIPPED_VM as hint to apply different * formula. * * Signed-off-by: Pingfan Liu * * commit 167d37e347fe35c6f7db826e8539e192c4375564 * Author: Pingfan Liu * Date: Fri Jul 2 10:14:22 2021 +0800 * * arm64: assign page_offset with VA_BITS kernel configuration value * * On RHEL9, crash hits a bug when executing "crash /proc/kcore": * seek error: kernel virtual address: ffff6a0f3fff0000 type: "pmd page" * * The kernel virtual address does not vary with vabits_actual, instead, * is determined by configuration value. But crash does not observe this * fact. * * Since vabits_actual related kernel commit is introduced after arm64 * mm layout flip commit, so changes are safe under the condition if * (ms->VA_BITS_ACTUAL), and keep the else branch untouched. * * Signed-off-by: Pingfan Liu * * commit 5719afc7a40868418405a87a2711088556e68a3b * Author: Pingfan Liu * Date: Fri Jul 2 10:14:21 2021 +0800 * * arm64: rename ARM64_PAGE_OFFSET_ACTUAL to ARM64_FLIP_PAGE_OFFSET_ACTUAL * * Reflect the flipped layout of kernel VA, which is introduced by * kernel commit 14c127c957c1 ("arm64: mm: Flip kernel VA space"). * * Signed-off-by: Pingfan Liu * * commit d6b4f36d6b22b70fb14e692f36d20910ef5563c1 * Author: Alexander Egorenkov * Date: Tue Jun 29 08:39:00 2021 +0200 * * Handle task_struct state member changes for kernels >= 5.14-rc1 * * Kernel commit 2f064a59a11ff9bc22e52e9678bc601404c7cb34 ("sched: Change * task_struct::state") renamed the member state of task_struct to __state * and its type changed from long to unsigned int. Without the patch, * crash fails to start up with the following error: * * crash: invalid structure member offset: task_struct_state * FILE: task.c LINE: 5929 FUNCTION: task_state() * * Signed-off-by: Alexander Egorenkov * * commit 4badc6229c69f5cd9da7eb7bdf400a53ec6db01a * Author: Petr Tesařík * Date: Fri Jun 25 17:21:18 2021 +0200 * * Fix pvops Xen detection for kernels >= v4.20 * * Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed * pv_init_ops, and later commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121 * removed the Xen-specific paravirt patch function. As a result, pvops Xen * dumps are no longer recognized as Xen dumps, and virtual-to-physical * translation fails. * * Use the value of xen_start_info to determine whether the kernel is * running in Xen PV mode. This pointer is set during the initialization of * a PV domain. Kudos to Juergen Gross, who suggested this check. * * Signed-off-by: Petr Tesarik * * commit eaf14f852ae79f7745934e213661f1c6abac711e * Author: Greg Edwards * Date: Wed Jun 23 13:50:47 2021 -0600 * * Fix 'waitq' command for Linux 4.13 and later kernels * * The wait queue structs and members were renamed in 4.13 in commits: * * ac6424b981bc ("sched/wait: Rename wait_queue_t => wait_queue_entry_t") * 9d9d676f595b ("sched/wait: Standardize internal naming of wait-queue * heads") * 2055da97389a ("sched/wait: Disambiguate wq_entry->task_list and * wq_head->task_list naming") * * Add support to the 'waitq' command for these more recent kernels. * * [ kh: suppressed compilation warnings ] * * Signed-off-by: Greg Edwards * Signed-off-by: Kazuhito Hagio * * commit f091b5e76d2d6e81b12cd40df7b5863c9e2efed1 * Author: Firo Yang * Date: Tue May 25 18:17:37 2021 +0800 * * list: add -O option for specifying head node offset * * The -O option is very useful to specify the embedded head node's * offset which is different to the offset of other nodes embedded, * e.g. dentry.d_subdirs (the head node) and dentry.d_child. * * [ kh: did some cosmetic adjustments ] * * Signed-off-by: Firo Yang * Signed-off-by: Kazuhito Hagio * * commit e61841a8b86ac551c314f74f4b82daae84f99700 * Author: Luc Chouinard * Date: Wed Jun 9 07:59:40 2021 -0400 * * extensions/eppic.mk: Enable use of alternate eppic branch * * Made significant changes and fixes to eppic. * Using options in the clone command break due to args parsing. * Use separate variable for clone options. * * Closes: https://github.com/crash-utility/crash/pull/86 * * commit c15a1e025e62134094ba0ac600263d75673d5a22 * Author: Youling Tang * Date: Fri Apr 23 15:42:11 2021 +0800 * * MIPS64: three fixes for MIPS64 kernels * * Three fixes for MIPS64 kernels: * (1) To support ramdumps, add the machine_type() check for MIPS64 in * ramdump_to_elf(). * (2) To fix a stuck issue when invoking crash with "-d1" or larger * debug value, add the machine_type() check to get the correct * dump NOTE offsets. * (3) Fix the reference file path to the definition of the pt_regs * structure, to which mips64_regster refers. * * [ kh: merged three patches into one ] * * Signed-off-by: Youling Tang * Signed-off-by: Kazuhito Hagio * * commit 859d1c0e8a6618634cbc1fe7ee2b082a6a3c99a1 * Author: Youling Tang * Date: Fri Apr 23 15:40:41 2021 +0800 * * MIPS32/64: Add 'irq' command support * * Add support for the 'irq' series of commands in the MIPS32/64 * architecture, except for the 'irq -d' command, others can be * used. Without the patch, the 'irq' command fails as follows: * * irq: cannot determine number of IRQs * * Signed-off-by: Youling Tang * * commit 704623dfde43da98ffb354b3d7f450cd012a8215 * Author: Youling Tang * Date: Thu Jun 3 16:07:41 2021 +0800 * * defs.h: Fix the value of TIF_SIGPENDING macro * * Correct the change of the value of TIF_SIGPENDING macro between * different kernel versions. * * TIF_SIGPENDING changes with the kernel version as follows: * ARM 2 -> 0 at v2.6.23 * MIPS 2 -> 1 at v2.6.23 * MIPS64 2 -> 1 at v2.6.23 * PPC 2 -> 1 at v2.6.23 * IA64 1 -> 0 at v2.6.23 * PPC64 2 -> 1 at v2.6.23 * S390 2 -> 1 at v3.16 * S390X 2 -> 1 at v3.16 * * Signed-off-by: Youling Tang * * commit ec44b902d3467e7b86ee39e2d7d472b9cb202148 * Author: Kazuhito Hagio * Date: Mon May 31 14:08:28 2021 +0900 * * memory: Fix for "kmem -n" option to display NID correctly * * The nid member of struct memory_block is a 4-byte integer, but read * and printed as a 8-byte integer on 64-bit machines. Without the * patch, the option displays wrong NIDs. * * crash> kmem -n * ... * MEM_BLOCK ... NODE STATE START_SECTION_NO * ffff9edeff2b9400 ... 14195095130662240256 ONLINE 0 * ffff9edeff2bb400 ... 14195094718345379840 ONLINE 32 * * The issue seems to appear on Linux 5.12 and later kernels that contain * commit e9a2e48e8704c ("drivers/base/memory: don't store phys_device * in memory blocks"), which changed the arrangement of the members of * struct memory_block. * * Signed-off-by: Kazuhito Hagio * * commit 0b5435e10161345cf713ed447a155a611a1b408b * Author: Kazuhito Hagio * Date: Wed May 26 17:33:13 2021 +0900 * * memory: Add support for SECTION_TAINT_ZONE_DEVICE flag * * Fix for "kmem -n|-p" options on Linux 5.12-rc1 and later kernels * that contain commit 1f90a3477df3f ("mm: teach pfn_to_online_page() * about ZONE_DEVICE section collisions"). Without the patch, the * "kmem -n" option incorrectly shows mem_map addresses containing the * flag in bit 5 as part of the virtual address, and also the "kmem -p" * option shows page structures at wrong position. With the patch, * the "kmem -n" option displays the new "D" state flag. * * Signed-off-by: Kazuhito Hagio * * commit 647a5c33e1c94054d7b63168cd6c12901591cb77 * Author: Lianbo Jiang * Date: Thu May 27 18:02:11 2021 +0800 * * Fix for "kmem -s|-S" option on Linux 5.7 and later kernels * * Linux 5.7 and later kernels that contain kernel commit 1ad53d9fa3f6 * ("slub: improve bit diffusion for freelist ptr obfuscation") changed * the calculation formula in the freelist_ptr(), which added a swab() * call to mix bits a little more. When kernel is configured with the * "CONFIG_SLAB_FREELIST_HARDENED=y", without the patch, the "kmem -s|-S" * options display wrong statistics and state whether slab objects are * in use or free and can print the following errors: * * ... * * Signed-off-by: Lianbo Jiang * * commit a7ecf2467f953b632713f38ab8104596755bca8c * Author: John Donnelly * Date: Wed May 12 14:48:03 2021 -0700 * * arm64: Add lowercase tcr_el1_t1sz * * Commit 1c45cea "arm64: Change tcr_el1_t1sz variable name to * TCR_EL1_T1SZ", renamed the variable to upper case, but there are * kernels in existence that still have the lower case name, which * breaks crash backwards compatibility. * * Resolves: https://github.com/crash-utility/crash/pull/82 * Signed-off-by: John Donnelly * Signed-off-by: Kazuhito Hagio * * commit 1ee4c407d7874b8eef17e863671edc8ccfdd7c71 * Author: Kazuhito Hagio * Date: Tue May 18 10:18:10 2021 +0900 * * Mark start of 7.3.1 development phase with version 7.3.0++ * * Signed-off-by: Kazuhito Hagio * -- Troy Heber Wed, 02 Feb 2022 09:19:00 -0700 crash (7.3.0-1) experimental; urgency=medium * Add support for new lockless righbuffer that Linux 5.10 introduced. Without the two patches, crash fails during session initialization or "log" command fails with the error message: crash: cannot determine length of symbol: log_end * Add support for VC exception stack on x86_64 Linux 5.10 and later kernels that contain commit 02772fb9b68e ("x86/sev-es: Allocate and map an IST stack for #VC handler"). * Fix regression for raw RAM dumpfiles. Commit f42db6a33f0e ("Support core files with "unusual" layout") increased the minimal file size from MIN_NETDUMP_ELF_HEADER_SIZE to SAFE_NETDUMP_ELF_HEADER_SIZE which can lead to crash rejecting raw RAM dumpfiles. Without the patch, the crash fails to start a session with the error message: /var/tmp/ramdump_elf_XXXXXX: ELF header read: No such file or directory crash: malformed ELF file: /var/tmp/ramdump_elf_XXXXXX * Update mapping symbol filter in arm64_verify_symbol() to support the long form of mapping symbols, e.g. "$x.". Without the patch, the "dis" command cannot completely parse out the disassembly of a function that has mapping symbols in the long form and misses the tail part of the function. * Move extensins/Makefile's ping check to recipe script. Without this patch, in an environment where ping to github.com does not work, "make clean" at the top-level crash directory always takes about 10 seconds unnecessarily. * Fix for a segmentation fault when analyzing arm64 kernels that are configured with CONFIG_IKCONFIG and have a strange entry that does not contain the delimiter "=", such as "CONFIG_SECU+[some hex data]". Without the patch, in the add_ikconfig_entry() function, strtok_r() interprets it as consisting of a single token and the val variable is set to NULL, and then strdup() crashes. * Fix a couple of issues that were detected by valgrind. * Add ability to un-set scope. The ability can come in very useful when running automated pykdump scripts and needing scope to be cleared between script runs. * Fix "sys [-t]|mod -S" after "mod -t" when crash runs with -s option. Without the patch, the "sys [-t]" and "mod -S" options after "mod -t" option fail with the error message: sys: invalid structure member offset: tnt_false FILE: kernel.c LINE: 11203 FUNCTION: show_kernel_taints_v4_10() * Fix for "dev -d" option on Linux 5.11-rc1 and later kernels that contains commit 0d02129e76edf91cf04fabf1efbc3a9a1f1d729a ("block: merge struct block_device and struct hd_struct"). Without the patch, the option fails with the error message: dev: invalid structure member offset: hd_struct_dev * Fix for "kmem -v" option on Linux 5.11-rc1 and later kernels that contain commit 96e2db456135db0cf2476b6890f1e8b2fdcf21eb ("mm/vmalloc: rework the drain logic"). Without the patch, the option will display nothing or fail with the error message: kmem: invalid kernel virtual address:
type: "vmlist addr" * Add the base address of module to "mod" command output. Currently the command shows the address of the module struct, but it is inconvenient to know the address range of the module, so extend to show the base address. * Increase the value of __PHYSICAL_MASK_SHIFT_XEN to 52. The former value of __PHYSICAL_MASK_SHIFT_XEN in crash (40) is smaller than the kernel (52) since kernel commit 6f0e8bf167 (xen: support 52 bit physical addresses in pv guests). This can cause x86_64_pud_offset() to lose the most significant bits of pgd_pte, leading to a failed xen_m2p() translation, resulting in crash failing with an error message like this: crash: read error: physical address: ffffffffffffffff type: "pud page" * Change log level print in older kernels. In older kernels that have the variable-length-record log_buf, the log level and the log flags/facility are not separated. Since the log level is only the last three bits, and the flags/facility and level are separated in 5.10 and later kernels, only print those last three bits when using 'log -m'. * Reduce crash build log. The verbose output of tar command when extracting the GDB source files occupies more than the half of crash build log. It is not so helpful and makes the build log longer needlessly especially on CI build test without the patch. * Fix for "bt" command on Linux 5.12-rc1 and later x86_64 kernels that contain commit 951c2a51ae75 ("x86/irq/64: Adjust the per CPU irq stack pointer by 8"). Without the patch, the "bt" command and some of its options that read irq stack fail with the error message: bt: read of stack at
failed". * Add valgrind support for the crash's custom memory allocator. This helps detecting various memory errors on the crash's custom memory allocator. * Fix for a couple of invalid read/write issues detected by valgrind. * Fix "struct" command to print member array of list_heads correctly. Without the patch, due to the way that an array of list_head entries are printed, parsing of them fails and the command does not print anything: crash> struct blk_mq_ctx.rq_completed ffffc447ffc0f740 crash> * Do not pass through 'sy' command to GDB. The GDB 'symbol-file' command is prohibited in the crash utility, but an abbreviation of it, the 'sy' is not prohibited. This can discard symbol table from the current symbol file, and eventually caused the failure of crash utility after executing the 'sys' command as below: crash> sy Discard symbol table from `/path/to/vmlinux'? (y or n) Please answer y or n. Discard symbol table from `/path/to/vmlinux'? (y or n) No symbol file now. crash> sys double free or corruption (!prev) Aborted (core dumped) * Refine zram related code for crash gcore command to support it. * Fix for the failure of 'set scope' command. Without the patch, some commands such as 'sys' may cause subsequent 'set scope' commands to fail. * Fix for offset print for function pointers that return pointers. In the show_member_offset() function, when trying to handle function pointers, the case for "(*" is handled. However, if the function pointer returns a pointer or a pointer to a pointer, then the condition is unhandled. This results in the offset not being printed without the patch, for example: crash> struct -o offload_callbacks struct offload_callbacks { struct sk_buff *(*gso_segment)(struct sk_buff *, netdev_features_t); struct sk_buff **(*gro_receive)(struct sk_buff **, struct sk_buff *); [16] int (*gro_complete)(struct sk_buff *, int); } * Change functions within extensions/echo.c to be static and document the issue in code comments, for extensions developers who takes echo.c as reference, to avoid the issue that symbols in extension modules are overwritten by former loaded one if it's the same name. * Fix for 'bt' command and options on Linux 5.8-rc1 and later x86_64 kernels that contain merge commit 076f14be7fc9. The merged patches changed the name of exception functions that have been used by the crash utility to check the exception frame. Without the patch, the command and options cannot display it. * Fix for xen kernels that contain commit edcb5cf84f05 ("x86/paravirt/xen: Remove xen_patch()"). Without the patch, crash fails with an error message like this: crash: seek error: physical address: 83640e000 type: "pud page" * Remove extensions/trace.c file, as the extension module moved to the separate repository from the crash repository. * Fix for uvtop conversion on ARM with LPAE. Without the patch, arm_uvtop() calls arm_lpae_vtop() with the LPAE and it can use LPAE_VTOP() also for a user virtual address. As a result, commands that use uvtop conversion such as "ps -a", "gcore" fail as readmem() for a uvaddr returns a seek error: ps: cannot access user stack address:
* Handle 1GB block for VM_L3_4K on arm64 architecture. Without the patch, "vtop" command cannot display the block as a 1GB hugepage. * Implement initial support for the MIP64 architecture. * Fix for HZ calculation using cfq_slice_async on Linux 4.8 and later kernels that contain commit 9a7f38c42c2b ("cfq-iosched: Convert from jiffies to nanoseconds"). Without the patch, the HZ calculation results in a wrong and big value for machde->hz and crash can shows a wrong uptime and timestamps in "log -T". * Fix for HZ calculation on Linux 4.8 and later kernels that contain commit 9a7f38c42c2b ("cfq-iosched: Convert from jiffies to nanoseconds"). Without the patch, the HZ value can be set to a hardcorded wrong value. -- Troy Heber Wed, 07 Jul 2021 15:31:12 -0600 crash (7.2.9-2) unstable; urgency=medium * Backporting future patches to support printk in kernel 5.10+ based on: https://github.com/crash-utility/crash/compare/bf57c44...71e159c * Update to current debhelper 13. -- Troy Heber Tue, 08 Dec 2020 12:58:57 -0700 crash (7.2.9-1) unstable; urgency=medium * Patch from Sebastian Andrzej Siewior : The crash project moved recently to github. The attached patch updates the information within the package. It also adds a watch file which points to the latest release (closes: #976195) * Fix for an ARM64 gcc-10 compilation error. Without the patch, the build of the embedded gdb module fails with an error message that indicates "multiple definition of 'tdesc_aarch64'". * Fix for the "log" command. Without the patch, the command's output may be truncated, ending with the error message "log: invalid log_buf entry encountered". * Fix to allow the translation of ARM64 FIXMAP addresses located in the virtual memory region between the end of the vmalloc region and the beginning of the vmemmap region. Without the patch, reads of virtual addresses within that region are not recognized properly and will fail. * Introduction of a new "extend -s" option, which shows all available shared object extension modules that are located in the directories that are part of the normal search path that is used when a shared object is loaded without a fully-qualified pathname. * Fix for the "bpf -m|-M" options on Linux 5.3 and later kernels that contain commit 3539b96e041c06e4317082816d90ec09160aeb11, titled "bpf: group memory related fields in struct bpf_map_memory". Without the patch, the options prints "(unknown)" for MEMLOCK and UID. * Enhancement to the "bpf -p|-P" options to display the eBPF program name string. * Fix for reading compressed kdump dumpfiles from systems with physical memory located at extraordinarily high addresses. In a system with a physical address range from 0x602770ecf000 to 0x6027ffffffff, the crash utility fails during session initialization due to an integer overflow, ending with the error message "crash: vmlinux and vmcore do not match!". * Enhancement of the "struct -r" option to support the raw memory display of a single data structure member. Without the patch, the option only supported the raw display of a complete data structure. * Modify the display behavior of the "struct -r" option so as to scale the minimum display size from the size of a per-architecture long (32-bits or 64-bits) down to 8-bits, 16-bits or 32-bits when the requested size is equal to one of the smaller sizes. * Introduce a new ARM64 "--machdep vabits_actual=" command line option for Linux 5.4 and later dumpfiles, which require the kernel's dynamically-determined "vabits_actual" value for virtual address translation. Without the patch, the crash session fails during initialization with the error message "crash: cannot determine VA_BITS_ACTUAL". This option will become unnecessary when the proposed TCR_EL1.T1SZ vmcoreinfo entry is incorporated into the kernel. * Fix for "kmem -[sS]" options on Linux 4.14 and later kernels built with CONFIG_SLAB_FREELIST_HARDENED enabled. Without the patch, there will error messages of the type "kmem: slab:
invalid freepointer: " for caches created during SLUB bootstrap, as they are likely to have s->random == 0. * If readmem() receives a user-space address in a page that has been swapped to the zswap compressed swap cache, an attempt will be made to find and decompress the page. * Fix for the "mount -n [pid|task]" option when running on a live system. Without the patch, if the [pid|task] has been created since the last internal task table refresh, the command fails with the error message "mount: invalid task or pid value: ". * Introduction of the "log -T" option, which translates the leading timestamp value of each message into human readable format. * When kernels are built with LLVM, the names of many symbols may be appended with an ".llvm." string. As a result, commands such as "irq" fail with the error message irq: neither irq_desc, _irq_desc, irq_desc_ptrs or irq_desc_tree symbols exist". This patch adds the LLVM-generated string to the other strings that are stripped from symbols before they are stored. * Prepare for the introduction of ARM64 8.3 Pointer Authentication as in-kernel feature. The value of CONFIG_ARM64_KERNELPACMASK will be exported as a vmcoreinfo entry, and will be used with text return addresses on the kernel stack. * Several fixes for ARM64 kernels: (1) Linux kernel patch "arm64: mm: Introduce vabits_actual" introduced "physvirt_offset", which is not equal to (PHYS_OFFSET - PAGE_OFFSET) when KASLR is enabled. physvirt_offset is caculated in arch/arm64/mm/init.c before memstart_addr (PHYS_OFFSET) is randomized. Let arm64_VTOP() and arm64_PTOV() use physvirt_offset instead, whose default value is set to (phys_offset - page_offset) (2) For ARM64 RAM dumps without any vmcoreinfo and KASLRpassed as argument, " _stext_vmlinux" is not set. This causes incorrect calculation of vmalloc_start with VA_BITS_ACTUAL. (3) For ARM64 RAM dumps For ramdumps without vmcoreinfo, get CONFIG_ARM64_VA_BITS from in-kernel config. Without this, vmemmap size is calculated incorrectly. (4) Fix the vmemmap_start to match with what the kernel uses. * Replace people.redhat.com references with github equivalents. * Implement support for user-space zram reads on x86_64 for recent Fedora kernel version 5.6.7-200.fc31. The patch adds the following: (1) Redefine _PFN_BITS() macro to use MAX_POSSIBLE_PHYSMEM_BITS. (2) Fix to determine whether address_space.i_pages is a radix tree or an xarray. (3) Fix to not mistakenly select the "lzo" compressor when the kernel has used the default "lzo-rle" compressor. (4) Since zram may be provided as a kernel module, it would be necessary to load its debuginfo during the crash session; therefore perform the zram structure-size/member-offset initializations when first required instead of during session initialization. (5) Handle the zram_table_entry structure member name change from "value" to "flags". * Add support for 1GB huge pages to "vtop" command on x86_64. Without this patch, the command with a user virtual address corresponding to a 1GB huge page fails with the error message "vtop: seek error: physical address:
type: "page table". * Fix six spelling typos in help.c. * Change tcr_el1_t1sz vmcoreinfo entry name to TCR_EL1_T1SZ according to kernel commit bbdbc11804ff ("arm64/crash_core: Export TCR_EL1.T1SZ in vmcoreinfo"). * Fix for a failure of calculating kaslr_offset due to an sadump format restriction. Without the patch set, calculating kaslr_offset fails because it is based on the assumption that unused part of register values in the sadump format are always zero cleared. * Support for huge holes in vmem of VMware VMSS dumpfiles. Without the patch, if the hole is big enough, the multiplication by page size will truncate as it's operating on a uint32_t. * Beautify and extend debug log for VMware VMSS dumpfiles. Without the patch, the parser's debug log is missing a few line breaks as well as some crucial information, like control register dumps. * Support core files with unusual layout that the ELF program headers do not directly follow the ELF header, such as vmcores generated with 'vmss2core' tool. * Fix for the "log -T" option when crash is started with "--minimal" option. Without the patch, crash will spin at 100% and continuously crash at a divide by zero. Disallow the option in minimal mode. * Remove raw-view from s390bpf. With kernel commit ecb1ff6833c4 ("s390/debug: remove raw view"), the raw-view is no longer supported by s390 debug feature. Since there has never been a single user of the raw-view, remove it from crash as well. * Support s390 debug feature version 3, which was introduced by kernel commit 0990d836cecb ("s390/debug: debug feature version 3"). * Basic support for PaX's split module layout. PaX and grsecurity kernels split module memory into dedicated r/x and r/w mappings using '*_rw' and '*_rx' named member variables in 'struct module'. To add basic support for such kernels, detect the split layout by testing for the corresponding structure members and use these instead. * Fix for the "kmem -i" option on Linux 5.9-rc1 and later kernels that contain commit 1008fe6dc36d ("block: remove the all_bdevs list"). Without the patch, the option fails halfway with the error message 'kmem: cannot resolve: "all_bdevs"'. * Fix for the "irq -a" option on Linux 4.3 or later kernels that contain commit 9df872faa7e1 ("genirq: Move field 'affinity' from irq_data into irq_common_data"). Without the patch, the option cannot work with the message "irq: -a option not supported or applicable on this architecture or kernel". * Append time zone explicitly to each output of date and time like "DATE: Thu Nov 29 06:44:02 JST 2018". * Fixes for the "trace.so" extension module on Linux 5.6 and later kernels that contain commit: (1) 1c5eb4481e01 ("tracing: Rename trace_buffer to array_buffer") (2) 13292494379f ("tracing: Make struct ring_buffer less ambiguous") With the patch set, rename trace_buffer to array_buffer and ring_buffer to trace_buffer respectively. * Fix for the "help -D" option listing uninteresting register entries for SADUMP dumpfiles. * Fix for an initialization-time failure due to offset change of the name member of struct uts_namespace that might be introduced by linux-next commit 9a56493f6942 ("uts: Use generic ns_common::count"). * Add support for VMware guestdump (debug.guest) and vmem (debug.vmem) files. To use, the companion debug.vmem file must be present in the same directory as the debug.guest file. * Fix for the "extend" command on a PPC64 targeted x86_64 crash binary. Without the patch, the command on an x86_64 crash binary that can be used to analyze ppc64le dumpfiles fails with the error message "extend: : not an ELF format object". * Fix for a failure to match arm/aarch64 ELF format of xendump file. * Fix for the x86_64 "bt" command in cases where the pt_regs is not present in the stack. Without the patch, the command can be incomplete with the error message 'bt: seek error: kernel virtual address:
type: "pt_regs"'. * Fix for the crash.ko memory driver build with Linux 5.8 and later kernels that contain commit fe557319aa06 ("maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault"). Additionally, due to commit 0493cb086353 ("maccess: unexport probe_kernel_write()"), writing kernel memory is no longer possible from a module. Without this patch, build with the kernels fails with the error message "error: implicit declaration of function 'probe_kernel_write'". * Fix for the memory_driver/Makefile for Linux 5.4 and later kernels that contain commit 7e35b42591c0 ("kbuild: remove SUBDIRS support"). Without the patch, the "make" command in the memory_driver directory doesn't build crash memory driver module as expected. * Improvements of KASLR offset detection for QEMU, VMware VMSS and SADUMP dumpfiles: (1) Try all CPUs to provide CR3 and IDTR, because these registers on CPU0 can be not initialized or clobbered. (2) Support 5-level page table by using LA57 bit in CR4. (3) Get KASLR offset by walking page tree. * Fix for an initialization-time failure with QEMU dumpfiles with Linux 5.8 and later x86_64 kernels that contain commit 9d06c4027f21 ("x86/entry: Convert Divide Error to IDTENTRY"), renamed divide_error handler to asm_exc_divide_error. * Fix for several compiler warnings on 32-bit architectures when building with "make warn". Without the patch, gcc generates the message "warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'uint64_t' [-Wformat=]" and similar ones as a result of crash commit 3fedbee9bfbb ("vmware_guestdump: new input format"). * Speed up session initialization by avoiding unnecessary processing in the stkptr_to_task() function when sp is 0 on some architectures. Without the patch, as it runs through each task's stack to find whether the given address is in its range, on a system with about 1500 CPUs and 165k running tasks, it takes about a day to finish session initialization. With the patch applied, it only takes about 5-10 minutes. -- Troy Heber Thu, 03 Dec 2020 09:53:49 -0700 crash (7.2.8-1) unstable; urgency=medium * New upstream (Closes: #950544) * Fix for Linux 5.4-rc1 and later kernels that contain commit 688fcbfc06e4fdfbb7e1d5a942a1460fe6379d2d, titled "mm/vmalloc: modify struct vmap_area to reduce its size". Without the patch "kmem -v" will display nothing; other architectures that utilize the vmap_area_list to determine the base of mapped/vmalloc address space will fail. * Fix for Linux 5.4-rc1 and later kernels that contain commit/merge e0703556644a531e50b5dc61b9f6ea83af5f6604, titled "Merge tag 'modules- for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux which introduces symbol namespaces. Without the patch, and depending upon the architecture: (1) the kernel module symbol list will contain garbage entries (2) the session fails during session initialization with a dump of the internal buffer allocation stats followed by the message "crash: cannot allocate any more memory!" (3) the session fails during session initialization with a segmentation violation. * Fix for the "timer -r" option on Linux 5.4-rc1 and later kernels that contain commit 511885d7061eda3eb1faf3f57dcc936ff75863f1, titled "lib/timerqueue: Rely on rbtree semantics for next timer". Without the patch, the option fails with the following error "timer: invalid structure member offset: timerqueue_head_next". * Fix for a "[-Wstringop-truncation]" compiler warning emitted when symbols.c is built in a Fedora Rawhide environment with gcc-9.0.1 or later. * Fix for the "kmem -n" option on Linux-5.4-rc1 and later kernels that contain commit b6c88d3b9d38f9448e0fcf44847a075ea81d5ca2, titled "drivers/base/memory.c: don't store end_section_nr in memory blocks". Without the patch, the command option fails with the error message "kmem: invalid structure member offset: memory_block_end_section_nr". * Fix for Linux 4.19.5 and later 4.19-based x86_64 kernels which are NOT configured with CONFIG_RANDOMIZE_BASE and have backported kernel commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15, titled "x86/mm: Move LDT remap out of KASLR region on 5-level paging", which modified the 4-level and 5-level paging PAGE_OFFSET values. Without this patch, the crash session fails during initialization with the error message "crash: seek error: kernel virtual address:
type: "tss_struct ist array". * Additional fix for the "kmem -n" option on Linux-5.4-rc1 and later kernels that contain commit b6c88d3b9d38f9448e0fcf44847a075ea81d5ca2, titled "drivers/base/memory.c: don't store end_section_nr in memory blocks". The initial fix only addressed the x86_64 architecture; this incremental patch addresses the other architectures. * In the unlikely event that the panic task in a dumpfile cannot be determined by the normal means, scan the kernel log buffer for panic keywords, and if found, generate the panic task from the CPU number that is specified following the panic message. * Adjust a crash-7.1.8 patch for support of /proc/kcore as the live memory source in Linux 4.8 and later x86_64 kernels configured with CONFIG_RANDOMIZE_BASE, which randomizes the unity-mapping PAGE_OFFSET value. Since the problem only arises before the determination of the randomized PAGE_OFFSET value, restrict the patch such that it only takes effect during session initialization. * Add support for extended numbering support in ELF dumpfiles to handle more than PN_XNUM (0xffff) program headers. If the real number of program header table entries is equal to or greater than PN_XNUM, the e_phnum field of the ELF header is set to PN_XNUM, and the actual number is set in the sh_info field of the section header at index 0. * Fix for a "warning: large integer implicitly truncated to unsigned type [-Woverflow]" compiler message generated on 32-bit architectures as a result of the "Additional fix for the kmem -n option" patch above. * Add support for handling openSUSE vmlinux files which will be shipped in .xz compressed format. Without the patch, only gzip and bzip2 formats are supported. * Fix for the determination of the ARM64 page size on Linux 4.4 and earlier kernels that do not have vmcoreinfo data. Without the patch, the crash session fails during initialization with the error message "crash: "cannot determine page size". * Determine the ARM64 kernel's "vabits_actual" value by reading the new TCR_EL1.T1SZ vmcoreinfo entry. * Fix to determine the ARM64 kernel's "vabits_actual" value from the ELF header of a dumpfile created with the "snap.so" extension module. * Fix two typos in the examples section of the "help bt" display, which mistakenly show "bf -f" and "bf -FF" instead of "bt -f" and "bt -FF". * Similar to ARM64, the X86_64, PPC64 and S390x architectures will use the exported value of MAX_PHYSMEM_BITS from the vmcoreinfo data as the preferred method if it is available. * If an S390X kernel crashes before vmcoreinfo initialization, there is no way to extract the KASLR offset for such early dumps. In a new S390X kernel patch, the KASLR offset will be stored in the lowcore memory during early boot and then overwritten after vmcoreinfo is initialized. This patch allows crash to identify the KASLR offset that is stored in the lowcore memory. * Fix for a crash-7.2.7 regression that determined the value of the ARM64 kernel SECTION_SIZE_BITS by reading the in-kernel configuration data if there is no VMCOREINFO data available. In that case, without the patch, a double-free exception may occur. * Fix for segmentation violation if the gdb_readmem_callback() function gets called from other than a crash command, such as from an epython command from the mypkdump.so extension module. * Fix for the "dis -s" option when running against kernels that have been configured with CONFIG_RANDOMIZE_BASE=y (KASLR). Without the patch, the command option indicates that the FILE and LINE numbers are "(unknown)", and that "source code is not available". * Fix for newer Xen hypervisors, which fail during initialization with the error message "crash: cannot resolve init_tss". This is caused by a change in the Xen hypervisor with commit 78884406256, from 4.12.0-rc5-763-g7888440625. In that patch the tss_struct structure was renamed to tss64 and the tss_page structure was introduced, which contains a single tss64. Now tss information is accessible via the symbol "per_cpu__tss_page". * When accessing the ARM64 kernel's "crash_notes" array, continue to read the per-cpu NT_PRSTATUS note contents if an invalid note is encountered. Without the patch, if an invalid note is found, all other notes were ignored, and subsequent "bt" attempts on the active tasks would fail. * When accessing the 32-bit ARM kernel's "crash_notes" array, continue to read the per-cpu NT_PRSTATUS note contents if an invalid note is encountered. Without the patch, if an invalid note is found, all other notes were ignored, and subsequent "bt" attempts on the active tasks would fail. * Fix for the "log -a" option. The kernel's sk_buff.len field is a 32-bit unsigned int, but crash was reading its 32-bit value into a 64-bit unsigned long stack variable. All extra bits that pre-existed in the upper 32-bits of the stack variable were passed along as part of a buffer size request; if the upper 32-bit bits were non-zero, then the command would fail with a dump of the internal buffer allocation stats followed by the message "log: cannot allocate any more memory!". * When determining the ARM64 kernel's "vabits_actual" value by reading the new TCR_EL1.T1SZ vmcoreinfo entry, display its value during session initialization only when invoking crash with "-d1" or larger -d debug value. * Update copyright to 2020 in crash version output. * Fix for ARM64 when running against Linux 5.5-rc1 and later kernels that contain commit b6e43c0e3129ffe87e65c85f20fcbdf0eb86fba0, titled "arm64: remove __exception annotations". Without the patch, the ARM64 crash session fails during initialization with the error message "crash: cannot resolve __exception_text_start". * Fix for support of ELF format kdump vmcores from S390X KASLR kernels. Without the patch, the crash session fails during initialization with the error message "crash: vmlinux and vmcore do not match!". * Fix for support of S390X standalone dumpfiles and LKCD dumpfiles that were taken from S390X KASLR kernels. * Rework the previous patch for support of S390X standalone dumpfiles and LKCD dumpfiles that were taken from S390X KASLR kernels to avoid calling an s390x-specific function from generic code. * Fix for a gcc-10 compilation error. Without the patch, the build of the crash library fails with a stream of error messages indicating "multiple definition of 'diskdump_flags'" -- Troy Heber Tue, 11 Feb 2020 19:19:46 -0700 crash (7.2.7-1) UNRELEASED; urgency=medium * Document the "-N", "-g" and "-z" options in the "help" command's help page. * Fix for a crash-7.2.6 regression to the "p" command. Without the patch, a gdb pass-through command construct such as: p ((struct zone *)0xffff901e3ffda000)->min_slab_pages gets parsed incorrectly, and the "-" is mistaken for an argument option, and each of the subsequent characters are marked as an "invalid option". * Export the get_mount_list() and get_dump_level() functions in defs.h for use by extension modules. * Change the gating of a debug message in the do_xarray_dump_cb() function from CRASHDEBUG(0) to CRASHDEBUG(1). Without the patch, users of the XArray callback functionality may see messages of the sort "entry has XARRAY_TAG_MASK bits set: 239ab0024001" without setting a debug number. * Fix for Linux 5.2 and later x86_64 kernels that contain kernel commit e6401c13093173aad709a5c6de00cf8d692ee786, titled "x86/irq/64: Split the IRQ stack into its own". Without the patch, the per-cpu IRQ stack addresses cannot be determined, and as a result backtraces that utilize an IRQ stack will fail. * Fix to allow live system analysis of s390x kernels that have been configured with CONFIG_RANDOMIZE_BASE=y (KASLR). Without the patch, the "--kaslr=" command line option is required. * Fix for Linux 5.2 and later x86_64 kernels that contain kernel commit 019b17b3ffe48100e52f609ca1c6ed6e5a40cba1, titled "x86/exceptions: Add structs for exception stacks". Without the patch, the exception stack sizes cannot be determined, and as a result backtraces that initiate from an exception stack will fail with error messages indicating "bt: invalid kernel virtual address:
type: stack contents" and then "bt: read of stack at
failed". * Two fixes for the "sys -c" option, one that significantly shortens the time consumed by the option, and a second fix that addresses occasional situations where the file and line number data are not displayed. * Fix for a signed/unsigned comparison bug in vmcoreinfo_read_string() which could lead to a segmentation violation in the highly unlikely event of a zero length or severely truncated VMCOREINFO note. * Fix for the determination of the ARM64 "kimage_voffset" value in Linux 4.6 and later kernels if an ELF format dumpfile: (1) does not contain its value in a VMCOREINFO note, and (2) if the kernel image was loaded at a higher address than the system's physical base address. This may happen, for example, when analyzing a dynamically-created ramdump-to-ELF dumpfile. * Fix for Linux 4.16 and later ARM64 kernels that contain kernel commit fa2a8445b1d3810c52f2a6b3a006456bd1aacb7e, titled "arm64: allow ID map to be extended to 52 bits", and which have been configured with both CONFIG_DEVMEM=y and CONFIG_STRICT_DEVMEM=y. Without the patch, an inconsequential error message indicating "crash: read error: kernel virtual address:
type: idmap_ptrs_per_pgd" is displayed during initialization. * Introduction of a new "bt -p" option that generates a backtrace of the panic task, regardless of the current context. This option is only applicable when running against dumpfiles in which the panic task is known. * When the gdb-7.6.patch file is updated in an existing source tree, it gets re-applied during the next build using "patch -N --fuzz=0", which ignores patches that have already been applied. However, if a gdb file has been modified multiple times, the secondary patching may fail to recognize that a given patch has been previously applied, and will attempt to re-apply it. To prevent any uninintended consequences, the gdb-7.6.patch file will also act as a shell script invoked by the Makefile, which restores any selected gdb file to its original state prior to all secondary patch applications. * As an addendum to the previous patch for updating the gdb-7.6.patch in an existing pre-built source tree, when rebuilding for the ppc64 architecture, do not restore the selected gdb files. This is because the gdb-7.6-ppc64le-support.patch will have modified the selected files during the initial build. * Extend the "timer" command with a new "TTE" column that displays the remaining time in jiffies until the expiration of a timer entry, and where a negative value displays the number of jiffies that have elapsed since a timer has expired. * Fix for a "warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]" compiler message generated by the previous "timer" patch when compiling kernel.c on 32-bit architectures. * Fix to the x86_64 "--machdep phys_base=" command line option to allow the use of a negative decimal number as the value. Without the patch, only the hexadecimal representation of the value would be accepted. * Introduction of a new "rd -R" option, which will display memory in reverse order. Memory will be displayed up to and including the address argument, which requires that the count argument be greater than 1 in order to display memory before the specified address. * Add support for the "count" argument to be used in conjunction with the "dis -r" and "dis -f" reverse/forward modes of operation. In reverse mode, the specified "count" number of instructions leading up to and including the target address will be displayed. In forward mode, the display will be limited to "count" instructions. Without the patch, using a count argument in either mode generates a "count argument ignored" message, and the command proceeds as if it had not been entered. * Fix a memory leak in the previous "dis" commit. * Implemented a new "error" environment variable that sets the destination of error messages. It can be set to either: "default": error messages are always displayed on the console; if the output of a command is piped to an external command or redirected to a file, the error messages are also sent to the pipe or file. "redirect": if the output of a command is piped to an external command or redirected to a file, error messages are only sent to the pipe or file; otherwise they are displayed on the console. "filename": error messages are only sent to the specified filename; they are not displayed on the console and are not sent to a pipe or file. * Fix for the "kmem -n" option on Linux 5.3-rc1 and later kernels that contain commit 326e1b8f83a4318b09033ef754f40c785aed5e68, titled "mm/sparsemem: introduce a SECTION_IS_EARLY flag". Without the patch, mem_map addresses containing the flag in bit 3 incorrectly show it as part of the virtual address; with the patch, the option displays the new "E" state flag. * Fix for the "timer" command in RHEL7.6 and later RHEL7 kernels. Without the patch, the command emits extra faulty timer entries because the tvec_root.vec[] and tvec.vec[] arrays are tracked using hlist_head structures where list_head structures should be used. * crash-7.2.4 commit 6596f1121b added a "list -B" option to allow more efficient enumeration of longer lists. There is a small bug with this option where it may incorrectly flag a loop length of "0" on list of length 1, indicating "list: loop detected, loop length: 0". Since it is impossible to have a loop of length 0, the erroneous message can be prevented by ensuring the list count is non-zero. * Create the specified installation directory if it does not exist. Without the patch, the Makefile's "make install" target will fail if the INSTALLDIR and/or DESTDIR macros resolve to a non-existent directory. * Fix for the internal caching of the kernel's mem_map array of page structures. Without the patch, in rare circumstances, commands such as "kmem -p" may erroneously receive zero-filled page structures. * Fix to prevent a potential segmentation violation when accessing the compressed configuration data contained in kernels that are configured with CONFIG_IKCONFIG. * Determine the ARM64 SECTION_SIZE_BITS value using the following order of precedence: (1) from the VMCOREINFO data if it exists (2) from the in-kernel configuration data if it exists (3) the default value -- Troy Heber Tue, 11 Feb 2020 19:19:28 -0700 crash (7.2.6-1) unstable; urgency=medium * Two fixes for the Xen hypervisor; the first fixes a bug seen with Xen 4.11.0 during initialization, which fails with the error message "crash: invalid kernel virtual address:
type: fill_pcpu_struct", followed by "WARNING: cannot fill pcpu_struct" and "crash: cannot read cpu_info". The second fix prevents a segmentation violation associated with a crash-7.1.1 commit that addressed the Xen 4.5.0 hypervisor symbol name change from "dom0" to "hardware_domain". * Fix for Linux 4.20 and later x86_64 kernels which are NOT configured with CONFIG_RANDOMIZE_BASE. Linux 4.20 introduced kernel commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15, titled "x86/mm: Move LDT remap out of KASLR region on 5-level paging", which modified the 4-level and 5-level paging PAGE_OFFSET values. Without this patch, the crash session fails during initialization with the error message "crash: read error: kernel virtual address:
type: tss_struct ist array". For kernels prior to Linux 4.20.0 which have backports of the kernel commit, the kernel's PAGE_OFFSET value must be manually specified via the command line option "--machdep page_offset=ffff888000000000" for kernels with 4-level page tables, or "--machdep page_offset=ff11000000000000" for kernels with 5-level paging. (or alternatively the shorter version "-m page_offset=
" may be used). The command line option requirement * Fix for the "p" command if the expression contains more than one opening parenthesis character and a minus/dash sign. Without the patch, the minus/dash sign will get dropped from the command prior to it being passed on to gdb for evaluation, and the command will fail with the message "p: gdb request failed: ", where the string will not * Fix for the internal parse_line() utility function to account for embedded sets of parentheses, which may be used for expressions that are passed to gdb by the "p" command. Without the patch, expressions containing embedded sets of parentheses are broken up into multiple argument tokens instead of just one. The previous commit has been reverted by this one. * First phase of support for ARM64 kernels that are configured with CONFIG_ARM64_USER_VA_BITS_52, which causes the PTRS_PER_PGD count to increase from 64 to 1024. Without the patch, "WARNING: cannot access vmalloc'd module memory" will be displayed during session initialization, and the translation of any mapped kernel virtual address that requires a page table walk will fail, leading to a myriad of other errors. * Support for configurable CONFIG_ARM64_PA_BITS values introduced in kernel commit 982aa7c5f0861bf56b2412ca341a13f44c238ba4, titled "arm64: add kconfig symbol to configure physical address size". Without the patch, it is impossible to determine the value of CONFIG_ARM64_PA_BITS is, and will require a new MAX_PHYSMEM_BITS vmcoreinfo entry to be exported. This * For live system analysis where there is no vmcoreinfo ELF note attached to /proc/kcore, or for dumpfile analysis where there is no vmcoreinfo ELF note attached to the dumpfile, this patch sets the internal pc->read_vmcoreinfo() function to a new plugin function that reads the data directly from the live kernel or dumpfile. Because the function is set much later during initialization than if the ELF note is attached to /proc/kcore or the dumpfile, it may not be available during very early * Fix for Linux 4.14.84 and later 4.14-based x86_64 kernels which are NOT configured with CONFIG_RANDOMIZE_BASE and have backported kernel commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15, titled "x86/mm: Move LDT remap out of KASLR region on 5-level paging", which modified the 4-level and 5-level paging PAGE_OFFSET values. Without this patch, the crash session fails during initialization with the error message "crash: read error: kernel virtual address:
type: tss_struct ist array". * Fix for determining the x86_64 "phys_base" value in dumpfiles created by the KVM "virsh dump" facility if the kernel is KASLR-enabled and does not have the phys_base value stored in vmcoreinfo data. Without the patch, the message "WARNING: cannot determine physical base address: defaulting to 0" is displayed, and the crash session fails to initialize. * 32-bit ARM kernels built with the Thumb-2 instruction set utilize the R7 register instead of FP for unwinding stacks using the DWARF unwinder. On those kernels, without the patch, the "bt" command only shows the task * Fix for the "kmem -z" option on Linux 5.0 and later kernels that contain commit a921444382b49cc7fdeca3fba3e278bc09484a27, titled "mm: move zone watermark accesses behind an accessor". Without the patch, the command fails with the error message "kmem: invalid (optional) structure member offsets: zone_pages_min or zone_struct_pages_min". * Fix for the "kmem -i" option on Linux 5.0 and later kernels that contain commit ca79b0c211af63fa3276f0e3fd7dd9ada2439839 titled "mm: convert totalram_pages and totalhigh_pages variables to atomic". Without the patch, the command prints some incorrect values, and besides does not print high/low memory information on kernels which are configured with * Fix for the display of kernel module symbol types by the "sym" command in Linux 5.0 and later kernels if the module debuginfo data has not been loaded into the crash session. The st_info member of the Elf32_Sym or Elf64_Sym structures has changed so as to not contain ASCII symbol type characters, and as a result the "sym" command will show unprintable data as the symbol type. With the patch, only text types ("t" or "T") will be * First phase of support of the upcoming ARM64 kernel memory map changes to support 52-bit kernel virtual addressing, which allows the configuration of CONFIG_ARM64_VA_BITS to be 52, but where the actual number of VA bits may be downgraded during boot depending upon the hardware capability. This phase is only applicable for live system analysis. * Fix for the "dis " option with kernel module text symbols on Linux 5.0 and later kernels. Without the patch, the disassembly may stop prematurely or extend into the next function because the st_size member of the Elf32_Sym or Elf64_Sym text symbol structures can no longer be used as * Commit dd12805ed1db7 in the linux-next kernel repository, titled "XArray: Remove radix tree compatibility", changes the definition of "radix_tree_root" back to be a struct. However, the content of the new structure differs from the original structure, so without the patch, current linux-next kernels fail during initialization with the error message "radix trees do not exist or have changed their format". Because the new "radix_tree_root" and "xarray" structures have nearly the same layout, the existing functionality for XArrays can be reused. * Fixes for the "trace.so" extension module: (1) The reader_page can be empty if it was never read, do not record it if it is empty. Better yet, do not record any page that is empty. The struct buffer_page "real_end" is not available in older kernels, so it needs to be tested if it exists before we can use it. (2) In newer kernels, the sp->type of kernel module symbols does not contain the symbol type character unless the module's debuginfo data has been loaded into the crash session. Writing a garbage type to the kallsyms file for trace-cmd to read causes it to crash, so just always write an 'm'. (3) Add the "trace dump -t " option * Fix to find the kernel configuration data in Linux 5.1 kernels containing commit 13610aa908dcfce77135bb799c0a10d0172da6ba, titled "kernel/configs: use .incbin directive to embed config_data.gz". Without the patch, new kernels configured with CONFIG_IKCONFIG_PROC will display "WARNING: could not find MAGIC_START!" during session initialization, and also when * Fix for the PPC64 "bt" command running against kernels that are configured with CONFIG_THREAD_INFO_IN_TASK. Without the patch, the "bt" command fails with the message "bt: invalid/stale stack pointer for this task: * Fix for the "files -d " option if the dentry.d_inode pointer is NULL. Without the patch, the command output does not display the * When the is_s390_dump() function is called to determine whether a file is an s390 dumpfile, it currently presumes that the fopen() call always works, and then tries to read it with using a NULL file pointer. Change it to verify that the fopen() was successful, and if not, print an error message as is done with the other dumpfile type verifier functions. * Implement support for ARM64 kernels that are configured with: CONFIG_ARM64_PA_BITS=52 CONFIG_ARM64_64K_PAGES CONFIG_PGTABLE_LEVELS=3 and that run on a host containing physical memory that utilizes any bit in the uppermost 4 bits of the 52-bit physical address range. * Extension of the "snap.so" extension module to pass a second architecture-specific value in the ELF header; its initial use is for support of the upcoming ARM64 52-bit kernel virtual address space by * Apply initial changes to support kernel address space layout randomization (KASLR) for s390X. This is the minimal patch-set required to process s390x dumps for the kernels configured with CONFIG_RANDOMIZE_BASE, and to accept the "--kaslr" command line option. Only dumpfiles whose headers * Fix for the "dev -[dD]" options on Linux 5.1-rc1 and later kernels that contain commit 570d0200123fb4f809aa2f6226e93a458d664d70, titled "driver core: move device->knode_class to device_private". Without the patch, the command options fail with the error message "dev: invalid structure member * Linux 4.18 kernels introduced a new CONFIG_PROC_VMCORE_DEVICE_DUMP configuration in commit 2724273e8fd00b512596a77ee063f49b25f36507, titled "vmcore: add API to collect hardware dump in second kernel", in which device drivers may collect a device specific snapshot of the hardware/firmware state of their underlying devices, and export the data as a kdump ELF note with type NT_VMCOREDD. This patch recognizes the new ELF note(s) in both ELF and compressed kdump vmcore dumpfiles. The "help -[nD]" option shows basic information about each note, and two new "dev" command options have been introduced. The "dev -V" option displays an indexed list of each note, showing the device name, the dumpfile offset, and the size of each note. The "dev -v index [file]" option either dumps the contents of a note to the display screen in a human-readable format, or copies the note data directly to a specified file. * If the kernel's "vmap_area_list" doubly-linked list is corrupt such that it does not link back to the global list_head, commands that require information regarding the range of virtually-mapped kernel addresses will display a generic list-handling error message such as "kmem: invalid list entry: 0", and the command will typically fail to fully complete. However, without the patch, there will also be "WARNING: malloc/free mismatch (29/30)" messages that get displayed after every subsequent command. This patch prevents the mismatch messages, and also adds an additional error message indicating "WARNING: invalid/corrupt vmap_area_list" to further clarify the generic list-handling error * Fix for the "dev" help page to remove the unused -r option letter. * If a duplicate list entry is encountered when using the "list -B" Brent algorithm, change the list loop length value from hexadecimal to decimal. * Update the README file to indicate the capability of building an x86_64 crash binary with "make target=PPC64", which can be used to analyze * Fix for hybrid kernels that have backported support for the Xarray facility while allowing subsystems to continue to use radix trees. Without the patch, the crash session fails during initialization with the message "crash: xarray facility does not exist or has changed its format". -- Troy Heber Mon, 15 Jul 2019 08:20:49 -0600 crash (7.2.5-1) unstable; urgency=medium * New upstream (Closes: #919291) * Resurrection of the "dev -p" option for displaying PCI device data on Linux 2.6.26 and later kernels. The option was deprecated as of Linux 2.6.26, and without the patch, the option would indicate "dev: -p option not supported or applicable on this architecture or kernel" when running against the newer kernel versions. PCI Bus information will also be displayed with this patch. * With Linux 4.19-rc1 commit 7d4340bb92a9df78e6e28152f3dd89d9bd82146b, titled "powerpc/mm: Increase MAX_PHYSMEM_BITS to 128TB with SPARSEMEM_VMEMMAP config", the PPC64 MAX_PHYSMEM_BITS value has been bumped up to 47. The appropriate update has been made in this patch. * Fix to allow piping command output to a shell script beginning with a shebang (#!) character sequence if the script pathname is specified with a preceding "./" or "/". Without the patch, the piped command fails with the message "crash: pipe operation failed". * Fix for the PPC64 "bt" command to recognize when a thread is running in OPAL firmware. Without the patch, the "bt" command indicates : Invalid Stack Pointer " * As an addendum to the "dev -p" patch above, add the new structure member offsets for display by the "help -o" option. * Enhancement to the "kmem -n" option to dump memory block information if the kernel supports it. In addition, the memory section data block has a new "STATE" column added to it. * Addendum to the previous "kmem -n" patch to fix a FTBFS issue. Without the patch, certain architectures fail to compile with the error "memory.c:17315:16: error: ‘PAGE_SHIFT’ undeclared (first use in this function)" * Fix the calculation of the vmalloc memory region size to account for Linux 4.17 commit a7412546d8cb5ad578805060b4006f2a021b5868, titled "x86/mm: Adjust vmalloc base and size at boot-time", which increases the region's size from 32TB to 1280TB when 5-level pagetables are enabled. Also presume that virtual addresses above the end of the vmalloc space up to the beginning of vmemmap space are translatable via 5-level page tables. Without the patch, mapped virtual addresses may fail translation in whatever command accesses them, with errors indicating "seek error: kernel virtual address: type: " * Address several Coverity Scan "RESOURCE_LEAK" issues in the following top-level source files: cmdline.c, kvmdump.c, lkcd_v8.c, xendump.c, symbols.c, unwind_x86_32_64.c, va_server.c and va_server_v1.c. * Modify the x86_64 "bt" behavior when a legitimate exception RIP value cannot be referenced symbolically, such as when the exception occurs while running in seccomp BPF filter code. Without the patch, the exception frame register dump is preceded by "[exception RIP: unknown or invalid address]", and then followed by "bt: WARNING: possibly bogus exception frame". With the patch applied, the translation of the exception RIP will show "[exception RIP: no symbolic reference]", and there will be no warning message. * Account for the /proc/kcore VMCOREINFO PT_NOTE in Linux 4.19 and later kernels having commit 23c85094fe1895caefdd19ef624ee687ec5f4507, titled "proc/kcore: add vmcoreinfo note to /proc/kcore". The PT_NOTE information is stored during session initialization for later display by "help -[n|D]"; a subsequent commit will make it available for use by the crash utility's internal pc->read_vmcoreinfo() function. * Second phase of support for the VMCOREINFO PT_NOTE added to the ELF header of /proc/kcore in Linux 4.19 and later kernels. This patch introduces support for live session /proc/kcore VMCOREINFO access by the crash utility's internal pc->read_vmcoreinfo() function. New usage include the initialization of the x86_64 phys_base value, and the arm64 phys_offset, page size, and VA bits count. * Fix for Linux 4.20-rc1 and later kernels that contain kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062, titled "x86/paravirt: Use a single ops structure". Without the patch, the kernel may be misidentified as an ARCH_XEN kernel, with the most noticeable result being the inability to read vmemmap'd page structures. * Implemented the functionality for a new MEMBER_TYPE_NAME() macro, which will return a pointer to the type name string of a structure member. It is being put in place for the support of Linux 4.20 radix tree to xarray replacements, where structure member types may be changed from radix_tree_root structures to xarray structures. * First phase of support for the XArray facility. The added support is similar to that of radix trees, but introduces completely separate functions, structures and #defines. None of the applicable radix tree users in the crash utility have been switched over, so this phase does not introduce any functional changes. * Second phase of support for the XArray facility, which handles the switch-over of PID handling from a radix tree to an XArray in Linux 4.20 and later kernels. Without the patch, the crash session fails during session initialization with the message "crash: radix trees do not exist or have changed their format". * Third phase of support for the XArray facility, which consolidates the radix_tree_pair and xarray_pair structures into a unified list_pair structure that is used by both facilities, and fixes the "bpf" command. Without the patch, the command fails on Linux 4.20 or later kernels with the error message "bpf: radix trees do not exist or have changed their format". * Added support for usage of the XArray facility by the "files -p" option. Without the patch, the command fails on Linux 4.20 and later kernels with the error message "files: radix trees do not exist or have changed their format". * Added support for usage of the XArray facility by the "irq" command. Without the patch, the command fails on Linux 4.20 and later kernels with the error message "irq: radix trees do not exist or have changed their format". * Added support for usage of the XArray facility by the "ipcs" command. Without the patch, the command may fail on Linux 4.20 and later kernels with the error message "irq: radix trees do not exist or have changed their format". * Added a new "tree -t xarray" option to display of the contents of an XArray in Linux 4.20 and later kernels. The implementation is similar to that of radix tree displays, but in addition, the "-p" option will also display the index value of each entry in a radix tree or XArray. * Fix for the "files -p " option on a file with a large number of pages. Without the patch, the command attempts to read radix tree node slot entries that are RADIX_TREE_EXCEPTIONAL_ENTRY types instead of page pointers, and as a result may fail with a dump of the internal buffer allocation stats followed by the message "files: cannot allocate any more memory!". * Fix for the "ps -s" option on ARM64 if the number of tasks exceeds 2000. Without the patch, the command ultimately fails with a dump of the internal buffer allocation stats, followed by the message "ps: cannot allocate any more memory!". * With Linux 4.20-rc1 commit 4ffe713b7587b14695c9bec26a000fc88ef54895, titled "powerpc/mm: Increase the max addressable memory to 2PB", the PPC64 MAX_PHYSMEM_BITS value has been bumped up to 51 for CONFIG_SPARSEMEM_VMEMMAP and CONFIG_SPARSEMEM_EXTREME. The appropriate update has been made in this patch. * Implemented a new plugin function for the readline library's tab completion feature. Without the patch, the use of the default plugin from the embedded gdb module has been seen to cause segmentation violations or other fatal malloc/free/corruption assertions. The new plugin takes gdb out of the picture entirely, and also restricts the matching options to just symbol names, so as not to clutter the results with irrelevant filenames. * The RHEL8 kernel will contain a backport of the Linux 4.19 kernel commit 7d4340bb92a9df78e6e28152f3dd89d9bd82146b, titled "powerpc/mm: Increase MAX_PHYSMEM_BITS to 128TB with SPARSEMEM_VMEMMAP config". As a result, the use of the THIS_KERNEL_VERSION() macro by the crash utility does not suffice for determining the MAX_PHYSMEM_BITS value for PPC64. The appropriate update has been made in this patch. * Fix for an initialization-time session failure when all three of the following conditions exist: (1) invoking the session with "crash -d2" or larger debug number (2) running against a Linux 3.3 or later kernel (3) using a post-7.2.4 crash utility that has the new "kmem -n" support above for the display of memory blocks Without the patch, the crash session fails with the error message "crash: invalid structure member offset: device_kobj". * Fix for an initialization-time segmentation violation when invoking crash-7.2.4 or later with "crash -d2" or larger debug number. * Add a write operation handler to the sample /dev/crash memory driver that enables writing to kernel memory via the "wr" command. * Prevent a SIGSEGV if a user attempts to input a command line that exceeds the maximum length of 1500 bytes. The patch displays an error message and ignores the command line. * Fix for the "dev -[dD]" options in kernels containing Linux 5.0-rc1 commit 7ff4f8035695984c513598e2d49c8277d5d234ca, titled "block: remove dead queue members", in which the number of I/Os issued to a disk driver are no longer stored in the request_queue structure. Without the patch, the options indicate "dev: -d option not supported or applicable on this architecture or kernel". With the patch, the "DRV" column is not shown. * A crash-7.1.1 commit added support for Linux version 5.x. To prevent surprise failures due to unexpected kernel version bumps in the future, support has been added for version 6, keeping it one step ahead. * Fix for a gcc-9 compilation error that occurs if an inline asm statement clobbers the stack pointer. Without the patch, x86 and x86_64 builds will fail to compile gdb-7.6/gdb/common/linux-ptrace.c, generating an error that indicates "error: Stack Pointer register clobbered by '%rsp' in 'asm'". -- Troy Heber Tue, 29 Jan 2019 08:55:24 -0700 crash (7.2.3+real-2) unstable; urgency=medium * Patch from Helmut Grohne to support non-glibc libcs (Closes: #910235) -- Troy Heber Thu, 11 Oct 2018 09:47:22 -0600 crash (7.2.3+real-1) unstable; urgency=medium * Revert wget addition and re-include embedded gdb (Closes: #901863) -- Troy Heber Fri, 22 Jun 2018 15:39:16 -0600 crash (7.2.3-2) unstable; urgency=medium * Add wget as a builddep -- Troy Heber Tue, 22 May 2018 09:16:03 -0600 crash (7.2.3-1) unstable; urgency=medium * Fix for a crash-7.2.2 regression that may cause the "mount" command to generate a segmentation violation. The bug is dependent upon the compiler version used to build the crash utility, where a buffer overrun is not seen with more recent versions of gcc, which hide the bug due to a different stack layout of a function's local variables. * Fix for a second crash-7.2.2 buffer overrun regression that may cause the "rd -S" option to generate a segmentation violation if a displayed memory location contains a slab object address. * Fix for a third, highly unlikely, crash-7.2.2 buffer overrun regression, that could potentially occur during session initialization. -- Troy Heber Mon, 21 May 2018 14:01:30 -0600 crash (7.2.2-1) UNRELEASED; urgency=medium * Fix to support Linux 4.16-rc1 and later ARM64 kernels, which fail during session initialization with the error message "crash: cannot determine page size". The failure to determine the page size is due to the combination of the following kernel commits: - Linux 4.6 commit 6ad1fe5d9077a1ab40bf74b61994d2e770b00b14 arm64: avoid R_AARCH64_ABS64 relocations for Image header fields - Linux 4.10 commit 4b65a5db362783ab4b04ca1c1d2ad70ed9b0ba2a arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1 - Linux 4.16 commit 1e1b8c04fa3451e2b7190930adae43c95f0fae31 arm64: entry: Move the trampoline to be before PAN * Fix the search for the booted kernel on a live system to prevent selecting the unusable "vmlinux.o" file found in private build directories. Without the patch, the non-executable vmlinux.o file may be selected, and the resulting fatal error message indicates a somewhat misleading "crash: cannot resolve _stext". * Implemented a new "ps -A" option that restricts the task output to just the active tasks on each cpu. * As the first step in optimizing the is_page_ptr() function, save the maximum SPARSEMEM section number during initialization, and use it as the topmost delimeter in subsequent mem_section searches. Also allow for per-architecture machdep->is_page_ptr() plugin functions. * Implemented the x86_64 machdep->is_page_ptr() plugin function. If the kernel is configured with CONFIG_SPARSEMEM_VMEMMAP, the plugin function optimizes the mem_section search, reducing the computation effort and time consumed by commands that repeatedly call the is_page_ptr() function on large-memory systems. * Fixes for 32-bit X86 "bt" command on kernels that have been compiled with retpoline gcc support. Without the patch, backtraces may fail with the error message "bt: cannot resolve stack trace", followed by the text symbols found on the stack and possible exception frames. * Fix the "help foreach" argument list to include the new "gleader" task qualifier option that was added in version 7.1.2. * VMware VMSS dumpfiles contain the state of each vCPU at the time when the VM was suspended. This patch enables crash to read the relevant registers from each vCPU state for use as the starting hooks by the "bt" command. Also, support for "help -[D|n]" to display dumpfile contents, and "help -r" to display vCPU register sets has been implemented. This is also the first step towards implementing automatic KASLR offset calculations for VMSS dumpfiles. * Commit 45b74b89530d611b3fa95a1041e158fbb865fa84 added support for calculating phys_base and the mapped kernel offset for KASLR-enabled kernels on SADUMP dumpfiles by using a technique developed by Takao Indoh. Originally, the patchset included support for kdumps, but this was dropped in v2, as it was deemed unnecessary due to the upstream implementation of the "vmcoreinfo device" in QEMU. However, there are still several reasons for which the vmcoreinfo device may not be present at the time when a memory dump is taken from a VM, ranging from a host running older QEMU/libvirt versions, to misconfigured VMs or environments running Hypervisors that doesn't support this device. This patchset generalizes the KASLR-related functions from sadump.c and moves them to kaslr_helper.c, and makes kdump analysis fall back to KASLR offset calculation if vmcoreinfo data is missing. * Fix for the "bt" command on 4.16 and later kernels size in which the "thread_union" data structure is not contained in the vmlinux file's debuginfo data. Without the patch, the kernel stack size is not calculated correctly, and defaults to 8K. As a result "bt" fails with the message "bt: invalid RSP:
bt->stackbase/stacktop:
/
cpu: ". * Fix for the x86_64 "bt" command for kernels that are configured with CONFIG_FRAME_POINTER. Without the patch, the per-text-return-address framesize cache may contain invalid entries for functions that have an "and $0xfffffffffffffff0,%rsp" instruction in their prologue, which aligns the stack on a 16-byte boundary; therefore any cached framesize for a text-return-address in such a function may be incorrect depending upon the alignment of the stack address of a calling function. If an invalid cached framesize is utilized by "bt", the backtrace may skip over several frames, or may display one or more invalid (stale) frames. The patch introduces a new cache that contains functions for which framesize values should not be cached. * Speed up the "bt" command by avoiding the text value cache that was put in place many years ago when the crash utility supported the analysis of remote dumpfiles using the deprecated "crash daemon" running on the remote host. The performance improvement will be most noticable when running the first instance of "foreach bt", where there would often be a "hitch" when it was determining the framesize of kernel module text return addresses. * Optimization of the crash startup time and "ps" command processing time when analyzing dumpfiles/systems with extremely large task counts. For example, running with a dumpfile containing over a million tasks, startup time and "ps" processing time was reduced from 90 minutes to less then 40 seconds. * Speed up the "ps -r" option by stashing the length of the task_struct.rlim or signal_struct.rlim array in the internal array_table[]. Without the patch, the length of the array is determined by a call to the embedded gdb module for each task, and as a result, the command takes a minute or more per 1000 tasks. With the patch applied, it only takes about 0.5 seconds per 1000 tasks. * Added a new "tree -l" option for the rbtree display, which dumps the tree sorted in linear order, starting with the leftmost node and progressing to the right. Also, if a corrupted rb_node pointer is encountered, do not fail immediately, but rather display the rb_node address and the corrupt pointer and continue. * Display a fatal error message if the "tree -l" option is attempted with radix trees. Without the patch, the option would be silently ignored. * Introduction of a new "bpf" command that displays information about loaded eBFP (extended Berkeley Packet Filter) programs and maps. Because of its upstream fluidity, the capabilities of this command will be an ongoing task. In its initial form, the command displays the addresses, basic information, and key data structures of eBPF programs and maps. It also translates the bytecode, and disassembles the jited code, of loaded eBPF programs. * Fixes to address several gcc-8.0.1 compiler warnings that are generated when building with "make warn". The warnings are all false alarm messages of type [-Wformat-overflow=], [-Wformat-truncation=] and [-Wstringop-truncation]; the affected files are extensions.c, task.c, kernel.c, memory.c, remote.c, symbols.c, filesys.c and xen_hyper.c. * Fix for the "ps -a" option for a user task that has utilized "prctl(PR_SET_MM, ...)" to self-modify its memory map such that the stack locations of its command line arguments and environment variables such are not contiguous. Without the patch, the command may fail with a dump of the crash utility's internal buffer usage statistics followed by "ps: cannot allocate any more memory!". * Fix for a compilation error on ARM64. Without the patch, the compilation of the new bpf.c file fails with the error message "bpf.c:881:18: error: conflicting types for 'u64'" * Fix for an s390x session initialization-time warning that indicates "WARNING: cannot determine MAX_PHYSMEM_BITS" on Linux 4.15 and later kernels containing commit 83e3c48729d9ebb7af5a31a504f3fd6aff0348c4, which changed the data type of "mem_section" from an array to a pointer. Without the patch, the s390x manner of determining MAX_PHYSMEM_BITS fails because it presumes that "mem_section" is an array, and as a result, displays the warning message. * Fix for the determination of the ARM64 phys_offset value when running live against /proc/kcore. Without the patch, the message "WARNING: cannot access vmalloc'd module memory" may be displayed during session initialization, and vmalloc/module memory will be unaccessible. (It should be noted that at the time of this patch, the upstream version of /proc/kcore does not work correctly for ARM64, because PT_LOAD segments for unity-mapped blocks of physical are not generated.) * For live system analysis, if both "/dev/mem" and the "/dev/crash" memory driver do not exist, try to use "/proc/kcore". Without the patch, the session fails immediately with the error message "crash: /dev/mem: No such file or directory". * Fix, and an update, for the "ipcs" command. The fix addresses an error where IPCS entries are not displayed because of a faulty read of the "deleted" member of the embedded "kern_ipc_perm" data structure. The "deleted" member was being read as a 4-byte integer, but since it is declared as a "bool" type, only the lowest byte gets set to 1 or 0. Since the structure is not zeroed-out when allocated, stale data may be left in the upper 3 bytes, and the IPCS entry gets rejected. The update is required for Linux 4.11 and greater kernels, which reimplemented the IDR facility to use radix trees in kernel commit 0a835c4f090af2c76fc2932c539c3b32fd21fbbb, titled "Reimplement IDR and IDA using the radix tree". Without the patch, if any IPCS entry exists, the command would fail with the message "ipcs: invalid structure member offset: idr_top" * Second stage of the new "bpf" command. This patch adds additional per-program and per-map data for the "bpf -p ID" and "bpf -m ID" options, containing data items shown by the "bpftool prog list" and "bpftool map list" options; new "bpf -P" and "bpf -M" options have been added that dump the extra data for all loaded programs or tasks. * Fix for a compilation error of the new "bpf.c" file when building on older host systems where CLOCK_BOOTTIME does not exist. * Fix for infrequent failures of the x86 "bt" command to handle cases where a user space task with "resume_userspace" or "entry_INT80_32" at the top of the stack, or which was interrupted by the crash NMI while handling a timer interrupt. Without the patch, the backtrace would be proceeded with the error message "bt: cannot resolve stack trace", and then dump the text symbols found on the stack and all possible exception frames. * Trivial formatting fix to "bpf" help page. * Fix the "bpf" command display on Linux 4.17-rc1 and later kernels, which contain two new program types, BPF_PROG_TYPE_RAW_TRACEPOINT and BPF_PROG_TYPE_CGROUP_SOCK_ADDR. Without the patch, the dynamic header string created for bpf programs overran into the bpf map header, creating one long combined header string. * Updates for the presumption that system call names begin with "sys_". In Linux 4.17, x86_64 system calls may begin with "__x64_sys", where, for example, "sys_read" has been replaced by "__x64_sys_read". -- Troy Heber Mon, 21 May 2018 13:59:41 -0600 crash (7.2.1-2) unstable; urgency=medium * Do not git clone eppic extension. (Closes: #898707), from Thadeu Lima de Souza Cascardo * Remove generated files: CFLAGS.extra LDFLAGS.extra extensions/defs.h, from Thadeu Lima de Souza Cascardo -- Troy Heber Mon, 21 May 2018 08:18:43 -0600 crash (7.2.1-1) unstable; urgency=medium * New upstream (closes: #890394) * Fix for the "runq" command on Linux 4.14 and later kernels that contain commit cd9e61ed1eebbcd5dfad59475d41ec58d9b64b6a, titled "rbtree: cache leftmost node internally". Without the patch, the command fails with the error message "runq: invalid structure member offset: cfs_rq_rb_leftmost". * Fix to prevent a useless message during session inialization. Without the patch, if the highest possible node bit in the node_states[N_ONLINE] multi-word bitmask is set, then a message such as "crash: next_online_node: 256 is too large!" will be displayed. * Additional fixes for the ARM64 "bt" command for Linux 4.14 kernels. The patch corrects the contents of in-kernel exception frame register dumps, and properly transitions the backtrace from the IRQ stack to the process stack. * Implemented a new "search -T" option, which is identical to the "search -t" option, except that the search is restricted to the kernel stacks of active tasks. * Removal of the ARM64 "bt -o" option for Linux 4.14 and later kernels, along with several cleanups/readability improvements. * Fix for support of KASLR enabled kernels captured by the SADUMP dumpfile facility. SADUMP dumpfile headers do not contain phys_base or VMCOREINFO notes, so without this patch, the crash session fails during initialization with the message "crash: seek error: kernel virtual address:
type: "page_offset_base". This patch calculates the phys_base value and the KASLR offset using the IDTR and CR3 registers from the dumpfile header. * Implemented a new "ps -y policy" option to filter the task display by scheduling policy. Applicable to both standalone ps invocation as well as via foreach. * Fix for the "kmem -[sS]" options on Linux 4.14 and later kernels that contain commit 2482ddec670fb83717d129012bc558777cb159f7, titled "mm: add SLUB free list pointer obfuscation". Without the patch, there will numerous error messages of the type "kmem: slab:
invalid freepointer: " if the kernel is configured with CONFIG_SLAB_FREELIST_HARDENED. * Fix for the validation of the bits located in the least significant bits of mem_section.section_mem_map pointers. Without the patch, the validation functions always returned valid, due to a coding error found by clang. However, it was never really a problem because it is extremely unlikely that an existing mem_section would ever be invalid. * Fix for the x86_64 kernel virtual address to physical address translation mechanism. Without the patch, when verifying that the PAGE_PRESENT bit is set in the top-level page table, it would always test positively, and the translation would continue parsing the remainder of the page tables. This would virtually never be a problem in practice because if the top-level page table entry existed, its PAGE_PRESENT bit would be set. * Removed a check for a negative block_size value which is always a non-negative unsigned value in the SADUMP header parsing function. * Removed a check for an impossible negative value when calculating the beginning address when applying the context value specified by the "search -x " option. * Implemented a new "timer -C " option that restricts the timer or hrtimer output to the timer queue data associated with one or more cpus. For multiple cpus, the cpu-specifier uses the standard comma or dash separated list format. * Fix for a "ps -l" regression introduced by the new "ps -y" option introduced above. Without the patch, the -l option generates a segmentation violation if not accompanied by a -C cpu specifier option. * Fix for the "kmem -i" and "kmem -V" options in Linux 4.8 and later kernels containing commit 75ef7184053989118d3814c558a9af62e7376a58, titled "mm, vmstat: add infrastructure for per-node vmstats". Without the patch, the CACHED line of "kmem -i" shows 0, and the VM_STAT section of "kmem -V" is missing entirely. * Fix for Linux 4.11 and later kernels that contain kernel commit 4b3ef9daa4fc0bba742a79faecb17fdaaead083b, titled "mm/swap: split swap cache into 64MB trunks". Without the patch, the CACHED line of "kmem -i" may show nonsensical data. * Implemented a new "dev -D" option that is the same as "dev -d", but filters out the display of disks that have no I/O in progress. * If a line number request for a module text address initially fails, force the embedded gdb module to complete its two-stage strategy used for reading debuginfo symbol tables from module object files, and then retry the line number extraction. This automatically does what the "mod -r" or "crash --readnow" options accomplish. * Update for support of Linux 4.12 and later PPC64 kernels where the hash page table geometry accommodates a larger virtual address range. Without the patch, the virtual-to-physical translation of user space virtual addresses by "vm -p", "vtop", and "rd -u" may generate an invalid translation or otherwise fail. * Implemented a new "runq -T" option that displays the time lag of each CPU relative to the most recent runqueue timestamp. * Fix to support Linux 4.15 and later kernels that contain kernel commit e8cfbc245e24887e3c30235f71e9e9405e0cfc39, titled "pid: remove pidhash". The kernel's traditional usage of a pid_hash[] array to store PIDs has been replaced by an IDR radix tree, requiring a new crash plug-in function to gather the system's task set. Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve init_task_union". * Fix for the "net" command when the network device listing has an unusually large number of IP addresses. In that case, without the patch, the command may generate a segmentation violation. * Fix for Linux 4.15 and later kernels that are configured with CONFIG_SPARSEMEM_EXTREME, and that contain kernel commit 83e3c48729d9ebb7af5a31a504f3fd6aff0348c4, titled "mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y". Without the patch, kernels configured with SPARSEMEM_EXTREME have changed the data type of "mem_section" from an array to a pointer, leading to errors in commands such as "kmem -p", "kmem -n", "kmem -s", and any other command that translates a physical address to its page struct address. * With the latest PPC64 NMI IPI changes, crash_ipi_callback is found multiple times on the stack of active non-panic tasks. Ensure that the symbol reference relates to an actual backtrace stack frame. * Update the starting virtual address of vmalloc space for kernels configured with CONFIG_X86_5LEVEL. * Update the X86_64 VSYSCALL_END address to reflect that it only contains 1 page. * Prevent the X86_64 FILL_PML() macro from updating the internal machdep->machspec->last_pml4_read address every time a vmalloc'd kernel virtual address is translated. * Fix for the "bt" command in x86_64 kernels that contain, or have backports of, kernel commit 4950d6d48a0c43cc61d0bbb76fb10e0214b79c66, titled "x86/dumpstack: Remove 64-byte gap at end of irq stack". Without the patch, backtraces fail to transition from the IRQ stack back to the process stack, showing an error message such as "bt: cannot transition exception stack to IRQ stack to current process stack". * Initial pass for support of kernel page table isolation. The x86_64 "bt" command may indicate "bt: cannot transition from exception stack to current process stack" if the crash callback NMI occurred while an active task was running on the new entry trampoline stack. This has only been tested on the RHEL7 backport of the upstream patch because as of this commit, crash does not run on 4.15-rc kernels. Further changes may be required for upstream kernels, and distributions that implement the kernel changes differently than upstream. * Fix for the "bt" command and the "ps -s" option for zombie tasks whose kernel stacks have been freed/detached. Without the patch, the "bt" command indicates "bt: invalid kernel virtual address: 0 type: stack contents" and "bt: read of stack at 0 failed"; it will be changed to display "(no stack)". The "ps -s" option would fail prematurely upon reaching such a task, indicating "ps: invalid kernel virtual address: 0 type: stack contents" and "ps: read of stack at 0 failed". * Fix for running on live systems on 4.15-rc2 and later kernels that are configured with CONFIG_RANDOMIZE_BASE and contain kernel commit 668533dc0764b30c9dd2baf3ca800156f688326b, titled "kallsyms: take advantage of the new '%px' format". Without the patch, a live crash session does not show the "WARNING: kernel relocated ..." message expected with KASLR, and then displays the message "crash: cannot set context for pid: " prior to generating a SIGSEGV. * Fix for 4.15-rc5 and later x86_64 kernels that contain kernel commit c482feefe1aeb150156248ba0fd3e029bc886605, titled "x86/entry/64: Make cpu_entry_area.tss read-only". Without the patch, the addresses and sizes of the x86_64 exception stacks cannot be determined; therefore if a backtrace starts on one of the exception stacks, then the "bt" command will fail. * Additional fix for support of KASLR enabled kernels captured by the SADUMP dumpfile facility, where this patch fixes a problem when Page Table Isolation(PTI) is enabled. When PTI is enabled, bit 12 of CR3 register is used to split user space and kernel space. Also bit 11:0 is used for Process Context IDentifiers(PCID). To open an SADUMP dumpfile, the value of CR3 is used to calculate KASLR offset and phys_base; this patch masks the CR3 register value correctly for a PTI enabled kernel. * Second phase of future support for x86_64 5-level page tables. This patch is a cleanup/collaboration of the original logic used by the various vtop functions, where several new common functions have been added for extracting page table entries from PGD, P4D, PUD, PMD and PTE pages. The usage of the former PML4 and UPML pages have been replaced with the use of the common PGD page, and use the PUD page in 4-level page table translation. Support for 5-level page tables has been incorporated into the the existing x86_64_kvtop() and x86_64_uvtop_level4() functions. Backwards compatibility for older legacy kernels has been maintained. The third phase of support will automatically detect whether the kernel proper, and whether an individual user task, is utilizing 5-level page tables. This patch enables support for kernel-only 5-level page tables by entering the command line option "--machdep vm=5level". * Xen commit 615588563e99a23aaf37037c3fee0c413b051f4d (Xen 4.0.0.) extended the direct mapping to 5 TB. This area was previously reserved for future use, so it is OK to simply change the upper bound unconditionally. * Add a new "foreach gleader" qualifier option, restricting the output to user-space tasks that are thread group leaders. * Since Xen commit 666aca08175b ("sched: use the auto-generated list of schedulers") crash cannot open Xen vmcores because the "schedulers" symbol no longer exists. Xen 4.7 implemented schedulers as its own section in "xen/arch/x86/xen.lds.S", delimited by the two symbols "__start_schedulers_array" and "__end_schedulers_array". Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve schedulers" * Fix the sample crash.ko memory driver to prevent an s390X kernel addressing exception. Legitimate pages of RAM that successfully pass the page_is_ram() and pfn_valid() verifier functions may not be provided by the s390x hypervisor, and the memcpy() from the non-existent memory to the bounce buffer panics the kernel. The patch replaces the the memcpy() call with probe_kernel_read(). * Fix for the ARM64 "bt" command running against Linux 4.14 and later kernels. Without the patch, the backtraces of the active tasks in a kdump-generated dumpfile are truncated. Without the patch, the panic task will just show the "crash_kexec" frame and the kernel-entry user-space exception frame; the non-panic tasks will show their backtraces starting from the stackframe addresses captured in the per-cpu NT_PRSTATUS notes, and will not display the exception frame generated by the NMI callback, nor any stackframes on the IRQ stack. * Fix for the ARM64 "bt" command in kernels that contain commit 30d88c0e3ace625a92eead9ca0ad94093a8f59fe, titled "arm64: entry: Apply BP hardening for suspicious interrupts from EL0". Without the patch, there may be invalid kernel kernel exception frames displayed on an active task's kernel stack, often below a stackframe of the "do_el0_ia_bp_hardening" function; the address translation of the PC and LR values in the the bogus exception frame will display "[unknown or invalid address]". -- Troy Heber Fri, 16 Feb 2018 10:47:33 -0700 crash (7.2.0-1) unstable; urgency=medium * New upstream (closes: #884464) * Fix for the "snap.so" extension module to pass the KASLR relocation offset value in the ELF header for x86_64 kernels that are compiled with CONFIG_RANDOMIZE_BASE. Without the patch, it is necessary to use the "--kaslr=" command line option, or the session fails with the message "WARNING: cannot read linux_banner string", followed by "crash: vmlinux and vmcore do not match!". * The native gdb "disassemble" command fails if the kernel has been compiled with CONFIG_RANDOMIZE_BASE because the embedded gdb module still operates under the assumption that the (non-relocated) text locations in the vmlinux file are correct. The error message that is issued is somewhat confusing, indicating "No function contains specified address". This patch simply clarifies the error message to indicate "crash: the gdb "disassemble" command is prohibited because the kernel text was relocated by KASLR; use the crash "dis" command instead." * Fix for the "mach -m" command in Linux 4.9 and later kernels that contain commit 475339684ef19e46f4702e2d185a869a5c454688, titled "x86/e820: Prepare e280 code for switch to dynamic storage", in which the "e820" symbol was changed from a static e820map structure to a pointer to an e820map structure. Without the patch, the command either displays just the header, or the header with several nonsensical entries. * Fix for Linux 4.10 and later kdump dumpfiles, or kernels that have backported commit 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe, titled "kexec: export the value of phys_base instead of symbol address". Without the patch, if the x86_64 "phys_base" value in the VMCOREINFO note is a negative decimal number, the crash session fails during session intialization with a "page excluded" or "seek error" when reading "page_offset_base". * Fix for the PPC64 "pte" command. Without the patch, if the target PTE references a present page, the physical address is incorrect. * Fix for a 32-bit MIPS compilation error if glibc-2.25 or later has been installed on the host build machine. Without the patch, the build fails with the error message "mips-linux-nat.c:157:1: error: conflicting types for 'ps_get_thread_area'". * Fix for the validity check of S390X virtual addresses for 5-level page tables where user space memory is mapped above 8 Petabytes. Without the patch, "rd -u" fails and indicates "invalid user virtual address", and "vtop -u" indicates that the address is "(not mapped)". * Crash 7.1.5 commit c3413456599161cabc4e910a0ae91dfe5eec3c21 (xen: Add support for dom0 with Linux kernel 3.19 and newer) from Daniel Kiper implemented support for Xen dom0 vmcores after Linux 3.19 kernel commit 054954eb051f35e74b75a566a96fe756015352c8 (xen: switch to linear virtual mapped sparse p2m list). This patch can be deemed subsequent to Daniel's patch, and implements support Xen PV domU dumpfiles for Linux 3.19 and later kernels. * Fix for the "dis" command to detect duplicate symbols in the case of a "symbol+offset" argument where the duplicates are not contiguous in the symbol list. Without the patch, the first of multiple symbol instances is used in the address evaluation. With the patch, the command will fail with the error message "dis: : duplicate text symbols found:", followed by a list of the duplicate symbols, and their file and line numbers if available. * Enhancement to the error reporting mechanism for the "kmem -[sS]" options. When a fatal error is encountered while gathering basic CONFIG_SLUB statistics, it is possible that the slab cache name is not displayed in the error message, and the line containing the slab cache name, address, etc., is not displayed at all. With this patch, an extra error message indicating "kmem: : cannot gather relevant slab data" will be displayed under the fatal error message; and under that, the CACHE address, cache NAME, OBJSIZE, and SSIZE columns will be displayed, but with "?" under the ALLOCATED, TOTAL, and SLABS columns. * Fix to prevent the "tree -t radix" option from failing when it encounters duplicate entries in a radix_tree_node[slots] array. Without the patch, if a duplicate slot entry is found, the command fails with the message "tree: duplicate tree entry: radix_tree_node: slots[]: \n". (The error can be prevented if the command is preceded by "set hash off".) However, certain radix trees contain duplicate entries by design, such as the "pgmap_radix" radix tree, in which a radix_tree_node may contain multiple instances of the same page_map structure. With the patch, checks will only be made for duplicate radix_tree_node structures. * First phase of future support for x86_64 5-level page tables. New sets of virtual memory offsets have been #define'd and helper macros and placeholder functions for the p4d page tables have been added. The only functional changes with this patchset are dynamically-set PGDIR_SHIFT and PHYSICAL_MASK_SHIFT values that are based upon the kernel configuration. * Fix for a build failure. Without the patch, if the build is done by a user whose username cannot be determined from the user ID number, the build fails immediately with a segmentation fault. * Fix for Linux 4.13-rc0 commit 7fd8329ba502ef76dd91db561c7aed696b2c7720 "x86/boot/64: Rename init_level4_pgt and early_level4_pgt". Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve "init_level4_pgt". * The internal "build_data" string contains the compile-time date, the user id of the builder, and the build machine hostname, and is viewable by the "crash --buildinfo" command line option or by the "help -B" option during runtime. This patch replaces that string data with "reproducible build" if the SOURCE_DATE_EPOCH environment variable contains a value string when the crash binary is compiled. * Fix for Linux 4.13-rc1 commit 2d070eab2e8270c8a84d480bb91e4f739315f03d "mm: consider zone which is not fully populated to have holes". Without the patch, SPARSEMEM page struct addresses are incorrectly calculated because a new section state, and an associated flag bit, has been added to the low bits of the mem_section.section_mem_map address; the extra bit is erroneously passed back as part of the section_mem_map and resultant page struct address, leading to errors in commands such as "kmem -p", "kmem -s", "kmem -n", and any other command that translates a physical address to its page struct address. * Enhancement to the S390X "vtop" command to display page table walk information, adding output showing the following page table contents: "Region-First-Table Entry" (RFTE) "Region-Second-Table Entry" (RSTE) "Region-Third-Table Entry" (RTTE) "Segment Table Entry" (STE) "Page Table Entry" (PTE) "Read address of page" (PAGE) Depending on the size of the address space, the page tables can start at different levels. For example: crash> vtop 3ff8000c000 VIRTUAL PHYSICAL 3ff8000c000 2e3832000 PAGE DIRECTORY: 0000000000aaa000 RTTE: 0000000000aadff8 => 00000002e3c00007 STE: 00000002e3c00000 => 00000002e3df7000 PTE: 00000002e3df7060 => 00000002e383203d PAGE: 00000002e3832000 PAGE PHYSICAL MAPPING INDEX CNT FLAGS 3d10b8e0c80 2e3832000 0 0 1 7fffc0000000000 * Fix the s390dbf time stamps for S390X kernel versions 4.11 and 4.14. With kernel commit ea417aa8a38bc7db ("s390/debug: make debug event time stamps relative to the boot TOD clock") for s390dbf time is stored relative to the kernel boot time. In order to still show absolute time since 1970 we have to detect those kernels and re-add the boot time before printing the records. We can use the tod_to_timeval() symbol to check for those kernels because the patch has removed the symbol. With kernel commit 6e2ef5e4f6cc5734 ("s390/time: add support for the TOD clock epoch extension") the symbol name for storing the boot time has changed from "sched_clock_base_cc" to "tod_clock_base". This commit is currently on the s390 features branch and will be integrated in Linux 4.14. * Further enhancement to the S390X "vtop" command to translate the binary values of the hardware flags for region, segment and page table entries. For example: crash> vtop -u 0x60000000000000 VIRTUAL PHYSICAL 60000000000000 5b50a000 PAGE DIRECTORY: 000000005cea0000 RFTE: 000000005cea0018 => 000000006612400f (flags = 00f) flags in binary : P=0; TF=00; I=0; TT=11; TL=11 RSTE: 0000000066124000 => 000000005d91800b (flags = 00b) flags in binary : P=0; TF=00; I=0; TT=10; TL=11 RTTE: 000000005d918000 => 000000006615c007 (flags = 007) flags in binary : FC=0; P=0; TF=00; I=0; CR=0; TT=01; TL=11 STE: 000000006615c000 => 000000005ce48800 (flags = 800) flags in binary : FC=0; P=0; I=0; CS=0; TT=00 PTE: 000000005ce48800 => 000000005b50a03f (flags = 03f) flags in binary : I=0; P=0 PAGE: 000000005b50a000 or for large pages: crash> vtop -k 0x3d100000000 VIRTUAL PHYSICAL 3d100000000 77c00000 PAGE DIRECTORY: 0000000001210000 RTTE: 0000000001213d10 => 0000000077dc4007 (flags = 007) flags in binary : FC=0; P=0; TF=00; I=0; CR=0; TT=01; TL=11 STE: 0000000077dc4000 => 0000000077c03403 (flags = 03403) flags in binary : AV=0, ACC=0011; F=0; FC=1; P=0; I=0; CS=0; TT=00 * PPC64 kernel commit 2f18d533757da3899f4bedab0b2c051b080079dc lowered the max real address to 53 bits. Without this patch, the warning message "WARNING: cannot access vmalloc'd module memory" appears during initialization, and any command that attempts to read a vmalloc'd kernel virtual address will fail and display "read error" messages. * Display the KASLR relocation value warning message whenever it is in use. Without the patch, the message may not get displayed if the --kaslr option is used, or if the dumpfile is a vmcore generated by the current snap.so extension module, which now exports the relocation value in the header. * Fix to prevent an initialization-time failure when running a live session on a host system that does not have a "/usr/src" directory. Without the patch, the session fails with the message "*** Error in 'crash': free(): invalid pointer:
***". (Lei Chen) * Fix for the ARM64 "bt" command's display of the user mode exception frame at the top of the stack in Linux 4.7 and later kernels. Without the patch, the contents of the user mode exception frame are invalid due to the miscalculation of the starting address of the pt_regs structure on the kernel stack. * Integrated support for usage of the Linux 4.14 ORC unwinder by the x86_64 "bt" command. Kernels configured with CONFIG_ORC_UNWINDER contain .orc_unwind and .orc_unwind_ip sections that can be queried to determine the stack frame size of any text address within a kernel function. For kernels not configured with CONFIG_FRAME_POINTER, the crash utility does frame size calculation by disassembling a function from its beginning to the specified text address, counting the push, pop, and add/sub rsp instructions, accounting for retq instructions that occur in the middle of a function. With this patch, access to the new ORC sections has been plugged into the existing frame size calculator, resulting in a more efficient and accurate manner of determining frame sizes, and as a result, more accurate backtraces. * Fix for the ARM64 "bt" command when run against Linux 4.14-rc1. Without the patch, a message indicating "crash: builtin stackframe.sp offset incorrect!" is issued during session initialization, and the "bt" command fails with the error message "bt: invalid structure member offset: task_struct_thread_context_sp". * For for the "task -R " option on Linux 4.13 and later kernels where the task_struct contains a "randomized_struct_fields_start" to "randomized_struct_fields_end" section. Without the patch, a member argument that is inside the randomized section is not found. * Fix for the "snap.so" extension module to pass the value of the ARM64 "kimage_voffset" value in the ELF header. Without the patch, it is necessary to use the "--machdep kvimage_offset=" command line option, or the session fails with the message "crash: vmlinux and vmcore do not match!". -- Troy Heber Sun, 17 Dec 2017 08:25:06 -0700 crash (7.1.9-1) unstable; urgency=medium * Patch from Balint Reczey : Build crash on all Linux architectures (Closes: #763856, #757450) * Patch from Balint Reczey : Continuous integration tests can fail due to missing packages for the running kernel and missing *-updates packages (Closes: #869367) * Fixes to address three gcc-7.0.1 compiler warnings that are generated when building with "make warn". The warning types are "[-Wnonnull]" in filesys.c, and "[-Wformat-overflow=]" in kernel.c and cmdline.c. * Fix for the PPC64 "mach -o" option to update the OPAL console buffer size from 256K to 1MB, based upon the latest skiboot firmware source. * Fix for the "mod -[sS]" option to prevent the erroneous reassignment of one or more symbol values of a kernel module. Without the patch, when loading a kernel module, a message may indicate "mod: : last symbol: is not _MODULE_END_?" may be displayed, and one or more symbols may be reassigned an incorrect symbol value. If none of the erroneous symbol value reassignments are beyond the end of the module's address space, then there will be no message. * Linux 4.10 commit 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe finally exports the x86_64 "phys_base" value in the VMCOREINFO note, so utilize it whenever it exists. * Implemented a new "log -a" option that dumps the audit logs remaining in kernel audit buffers that have not been copied out to the user-space audit daemon. * Fix for the "kmem
" option and the "search" command in x86_64 kernels that contain, or have backports of, kernel commit 7c1da8d0d046174a4188b5729d7579abf3d29427, titled "crypto: sha - SHA1 transform x86_64 AVX2", which introduced an "_end" text symbol. Without the patch, if a base kernel symbol address that is larger than the "_end" text symbol is passed to "kmem
", its symbol/filename information will not be displayed. Also, when the "search" command scans the __START_KERNEL_map region that contains kernel text and static data, the search will be truncated to stop at the "_end" text symbol address. * Enhancement for the determination of the ARM64 "kimage_voffset" value in Linux 4.6 and later kernels if an ELF format dumpfile does not contain its value in a VMCOREINFO note, or when running against live systems using /dev/mem, /proc/kcore, or an older version of /dev/crash. * Optimization of the "kmem -f
" and "kmem " options to significantly reduce the amount of time to complete the buddy allocator free-list scan for the target address. On very large memory systems, the patch may reduce the time spent by several orders of magnitude. * Fix for a compilation error if glibc-2.25 or later has been installed on the host build machine. Without the patch, the build fails with the error message "amd64-linux-nat.c:496:1: error: conflicting types for 'ps_get_thread_area'". * Fix for the "list -[hH]" options if a list_head.next pointer is encountered that contains an invalid NULL pointer. Without the patch, the "list -[hH]" options would complete/continue as if the NULL were a legitimate end-of-list indicator, and no error would be reported. * Provide basic Huge Page usage as part of "kmem -i" output, showing the total amount of memory allocated for huge pages, and the amount of the total that is free. * Fix for the determination of the x86_64 "phys_base" value when it is not passed in the VMCOREINFO data of ELF vmcores. Without the patch, it is possible that the base address of the vmalloc region is unknown and initialized to an incorrect default address during the very early stages of initialization, which causes the parsing of the PT_LOAD segments for the START_KERNEL_map region to fail. * Fix for the "dis" command to detect duplicate symbols in the case of a "symbol+offset" argument where the duplicates are contiguous in the symbol list. In addition, reject "symbol+offset" arguments if the resultant address goes beyond the end of the function. * Fix for the "set scope" option if the kernel was configured with CONFIG_RANDOMIZE_BASE. Without the patch, the command fails with the message "set: gdb cannot find text block for address: ". This also affects extension modules that call gdb_set_crash_scope() when running with KASLR kernels. * Fix for the extensions/trace.c extension module to account for Linux 4.7 kernel commit 9b94a8fba501f38368aef6ac1b30e7335252a220, which changed the ring_buffer_per_cpu.nr_pages member from an int to a long. Without the patch, the trace.so extension module fails to load on big-endian machines, indicating "extend: Num of pages is less than 0". * Fix for the extensions/trace.c extension module when running on the ppc64 architecture. Without the patch, the trace.so extension module fails to load, indicating "extend: invalid text address: ring_buffer_read". On the ppc64 architecture, the text symbol is ".ring_buffer_read". * Fix for the ARM64 "bt" command. Without the patch, the backtrace of a non-panicking active task generates a segmentation violation when analyzing Android 4.4-based dumpfiles. -- Troy Heber Wed, 26 Jul 2017 12:37:08 -0600 crash (7.1.8-2) unstable; urgency=medium * Enable lzo and snappy compression (Closes: #860319) -- Troy Heber Mon, 17 Apr 2017 19:25:16 -0600 crash (7.1.8-1) unstable; urgency=medium * New upstream 7.1.8 (Closes: #851882) * Accepted patch from Chris J Arges to fix autopkgtest failures (Closes: #788239) * Builds with gcc 7 (Closes: #853357) * Fix for Linux 4.6 commit b03a017bebc403d40aa53a092e79b3020786537d, which introduced the new slab management type OBJFREELIST_SLAB. In this mode, the freelist can be an object, and if the slab is full, there is no freelist. On the next free, an object is recycled to be used as the freelist but not cleaned-up. This patch will go through only known freed objects, and will prevent "kmem -S" errors that indicate "invalid/corrupt freelist entry" on kernels configured with CONFIG_SLAB. * Fix for the initialization-time loading of kernel module symbols if the kernel crashed while running a module's initcall. Without the patch, the crash session fails during initialation with a message similar to "crash: store_module_symbols_v2: total: 7 mcnt: 8". * Fix for a segmentation violation during session inialization when running against a 32-bit MIPS ELF kdump or compressed kdump if a per-cpu NT_PRSTATUS note cannot be gathered from the dumpfile header. Without the the patch, a segmentation violation occurs after the message "WARNING: cannot find NT_PRSTATUS note for cpu: " is displayed. * The 32-bit MIPS PGD_ORDER() macro expects __PGD_ORDER to be signed, which it isn't now since the internal machdep->pagesize is unsigned. Without this patch, module loading fails during initialization on a kernel that has a page size of 16KB, with messages that indicate "please wait... (gathering module symbol data)" followed by "crash: invalid size request: 0 type: pgd page". * For ARM64 dumpfiles with VMCOREINFO, verify the new "VA_BITS" number against the calculated number. * Fix for the ARM64 "bt" command in Linux 4.10 and later kernels that are configured with CONFIG_THREAD_INFO_IN_TASK. Without the patch, the "bt" command will fail for active tasks in dumpfiles that were generated by the kdump facility. * Fix for Linux 4.10 commit 7fd8329ba502ef76dd91db561c7aed696b2c7720 "taint/module: Clean up global and module taint flags handling". Without the patch, when running against Linux 4.10-rc1 and later kernels, the crash utility fails during session initialization with the message "crash: invalid structure size: tnt". * Fix for support of /proc/kcore as the live memory source in Linux 4.8 and later x86_64 kernels configured with CONFIG_RANDOMIZE_BASE, which randomizes the unity-mapping PAGE_OFFSET value. Without the patch, the crash session fails during session initialization with the error message "crash: seek error: kernel virtual address:
type: page_offset_base". * Update to the module taint flags handling patch above to account for the change in size of the module.taints flag from an int to a long, while allowing for a kernel backport that keeps it as an int. * Prepare for the kernel's "taint_flag.true" and "taint_flag.false" member names to be changed to "c_true" and "c_false", which fixes build problems when an out-of-tree module defines "true" or "false". * Prevent the livepatch taint flag check during the system banner display from generating a fatal session-killing error if relevant kernel symbol names or data structures change in the future (again). * Fix for the PPC64 "bt" command for non-panicking active tasks in FADUMP-generated dumpfiles (Firmware Assisted Dump facility). Without the patch, backtraces of those tasks may be of the form "#0 [c0000000700b3a90] (null) at c0000000700b3b50 (unreliable)". This patch uses and displays the ptregs register set saved in the dumpfile header for the non-panicking active tasks. * Fix for a possible segmentation violation when analyzing Linux 4.6 and earlier x86_64 kernels configured with CONFIG_RANDOMIZE_BASE. A segmentation violation may occur during session initialization, just after the patching of the gdb minimal_symbol values message, depending upon the value of KERNEL_IMAGE_SIZE, which was variable in the earlier KASLR kernels. This patch sets the KERNEL_IMAGE_SIZE default value to 1GB for those earlier kernels, and also adds a new "--machdep kernel_image_size=" option that can be used to override the default KERNEL_IMAGE_SIZE value if necessary. * Fix the bracketing of the x86_64 FILL_PML4() macro. * Fix for the "tree -t radix", "irq", and "files -p" command options in Linux 4.6 and later kernels due to upstream changes in the radix tree facility. Without the patch, the commands will fail with the message "radix trees do not exist or have changed their format". * Fix for the "trace.c" extension module. The kernel buffer referenced by "max_tr_ring_buffer" is not available in all configurations of the kernel so the unitialized max_tr_ring_buffer variable should not be used. A similar check existed previously before the recent rework of the trace extension module to support multiple buffers. * Clarification in the display of CONFIG_SLUB object addresses that are displayed by the "kmem" command when SLAB_RED_ZONE has been enabled. By default, CONFIG_SLUB object addresses that are displayed by the "kmem" command will point to the SLAB_RED_ZONE padding inserted at the beginning of the object. As an alternative, a new "redzone" environment variable has been addedd that can be toggled on or off. If "set redzone off" is entered, the object addresses will point to the address that gets returned to the allocator. * Fix for the "CURRENT" value displayed by the "timer -r" command. Without the patch, if the target machine has been up for a long enough time, an arithmetic overflow will occur and the time value displayed will be incorrect. * Fix for 32-bit X86 kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, an invalid kernel PAGE_OFFSET value is calculated and as a result the session fails during session initialization just after the patching of the gdb minimal_symbol values message, showing the warning message "WARNING: cannot read linux_banner string", followed by "crash: /vmlinux and /dev/crash do not match!". This patch also adds a new "--machdep page_offset=" option that can be used if the CONFIG_PAGE_OFFSET value is not the default address of 0xc0000000. * Introduction of a new PPC64-only "mach -o" option that dumps the OPAL "Open Power Abstraction Layer" console buffer. * Fix for the "bt" command on Linux 4.9 and later 32-bit X86 kernels containing kernel commit 0100301bfdf56a2a370c7157b5ab0fbf9313e1cd, subject "sched/x86: Rewrite the switch_to() code". Without the patch, backtraces for inactive (sleeping) tasks fail with the message "bt: invalid structure member offset: task_struct_thread_eip". * Fix for a "[-Wmisleading-indentation]" compiler warning and the associated bug that is generated by lkcd_x86_trace.c when building 32-bit X86 with "make warn" with gcc-6.3.1. * Fix for an invalid "bt" warning on a 32-bit X86 idle/swapper task. Without the patch, the backtrace displays the "cannot resolve stack trace" warning, dumps the backtrace, and then the text symbols: crash> bt PID: 0 TASK: f0962180 CPU: 6 COMMAND: "swapper/6" bt: cannot resolve stack trace: #0 [f095ff1c] __schedule at c0b6ef8d #1 [f095ff58] schedule at c0b6f4a9 #2 [f095ff64] schedule_preempt_disabled at c0b6f728 #3 [f095ff6c] cpu_startup_entry at c04b0310 #4 [f095ff94] start_secondary at c04468c0 bt: text symbols on stack: [f095ff1c] __schedule at c0b6ef8d [f095ff58] schedule at c0b6f4ae [f095ff64] schedule_preempt_disabled at c0b6f72d [f095ff6c] cpu_startup_entry at c04b0315 [f095ff94] start_secondary at c04468c5 crash> The backtrace shown is actually correct. * Another fix for a similar "bt: cannot resolve stack trace" warning on a 32-bit X86 idle/swapper task, but when running on cpu 0. * Remove two one-time warning messages that are displayed when running the "bt" command on Linux 4.2 and later 32-bit X86 kernels. Without the patch, the first "bt" command that is executed will be preceded by "bt: WARNING: "system_call" symbol does not exist", followed by "bt: WARNING: neither "ret_from_sys_call" nor "syscall_badsys" symbols exist". * Fix for Linux 3.15 and later 32-bit X86 kernels containing kernel commit 198d208df4371734ac4728f69cb585c284d20a15, titled "x86: Keep thread_info on thread stack in x86_32". Without the patch, incorrect addresses of each per-cpu hardirq_stack and softirq_stack were saved for usage by the "bt" command. * Additional fix for Linux 3.15 and later 32-bit X86 kernels containing kernel commit 198d208df4371734ac4728f69cb585c284d20a15, titled "x86: Keep thread_info on thread stack in x86_32". The patch fixes the stack transition symbol from "handle_IRQ" to "handle_irq" for usage by the "bt" command. * Fix for 32-bit X86 kernels to determine the active task in a dumpfile in the situation where the task was running on its soft IRQ stack, took a hard IRQ, and then the system crashed while it was running on its hard IRQ stack. * Allow the "--kaslr=" and/or "--kaslr=auto" command line options to be used with the 32-bit X86 architecture. * Removed -Werror from the bfd and opcode library builds. -- Troy Heber Fri, 24 Feb 2017 10:41:52 -0700 crash (7.1.7-1) unstable; urgency=medium * New upstream 7.1.7 (Closes: #843731): * Remove -pie compile option (Closes: #844831) * Set the default 32-bit MIPS HZ value to 100 if the in-kernel config data is unavailable, and have the "mach" command display the value. * Enable SPARSEMEM support on 32-bit MIPS by setting SECTION_SIZE_BITS and MAX_PHYSMEM_BITS. * Fix for Linux 4.9-rc1 commits 15f4eae70d365bba26854c90b6002aaabb18c8aa and c65eacbe290b8141554c71b2c94489e73ade8c8d, which have introduced a new CONFIG_THREAD_INFO_IN_TASK configuration. This configuration moves each task's thread_info structure from the base of its kernel stack into its task_struct. Without the patch, the crash session fails during initialization with the error "crash: invalid structure member offset: thread_info_cpu". * Fixes for the gathering of the active task registers from 32-bit MIPS dumpfiles: (1) If ELF notes are not available, read them from the kernel's crash_notes. (2) If an online CPUs did not save its ELF notes, then adjust the mapping of each ELF note to its CPU accordingly. * Add support for "help -r" on 32-bit MIPS to display the registers for each CPU from a dumpfile. * Fix for Linux 4.9-rc1 commit 0100301bfdf56a2a370c7157b5ab0fbf9313e1cd, which rewrote the x86_64 switch_to() code by embedding the call to __switch_to() inside a new __switch_to_asm() assembly code ENTRY() function. Without the patch, the message "crash: cannot determine thread return address" gets displayed during initialization, and the "bt" command shows frame #0 starting at "schedule" instead of "__schedule". * When each x86_64 per-cpu cpu_tss.x86_tss.ist[] array member (or in older kernels, each per-cpu init_tss.x86_hw_tss.ist[] array member), is compared with its associated per-cpu orig_ist.ist[] array member, ensure that both exception stack pointers have been initialized (non-NULL) before printing a WARNING message if they don't match. * Fix for a possible segmentation violation when analyzing Linux 4.7 x86_64 kernels that are configured with CONFIG_RANDOMIZE_BASE. Depending upon the randomized starting address of the kernel text and static data, a segmentation violation may occur during session initialization, just after the patching of the gdb minimal_symbol values message. * Restore the x86_64 "dis" command's symbolic translation of jump or call target addresses if the kernel was configured with CONFIG_RANDOMIZE_BASE. * Fix for the 32-bit MIPS "bt" command to prevent an empty display (task header only) for an active task if the epc register in its exception frame contains 00000000. * Fix for support of Linux 4.7 and later x86_64 ELF kdump vmcores from kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, the crash session may fail during initialization with the message "crash: vmlinux and vmcore do not match!". * Fix for the x86_64 "mach" command display of the vmemmap base address in Linux 4.9 and later kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, the command shows a value of ffffea0000000000 next to "KERNEL VMEMMAP BASE". * Since the Linux 3.10 release, the kernel has offered the ability to create multiple independent ftrace buffers. At present, however, the "trace.c" extension module is only able to extract the primary buffer. This patch refactors the trace.c extension module so that the global instance is passed around as a parameter rather than accessing it directly, and then locates all of the available instances and extracts the data from each of them. * Fix for the s390x "bt" command for active tasks. Since the commit above in this crash-7.1.7 release that added support for the new CONFIG_THREAD_INFO_IN_TASK configuration, the backtrace of active tasks can be incomplete. * In collaboration with an update to the /dev/crash kernel driver, fix for Linux 4.6 commit a7f8de168ace487fa7b88cb154e413cf40e87fc6, which allows the ARM64 kernel image to be loaded anywhere in physical memory. Without the patch, attempting to run live on an ARM64 Linux 4.6 and later kernel may display the warning message "WARNING: cannot read linux_banner string", and then fails with the message "crash: vmlinux and /dev/crash do not match!". Version 1.3 of the crash driver is required, which introduces a new ioctl command that retrieves the ARM64-only "kimage_voffset" value that is required for virtual-to-physical address translation. * Update of the sample memory_driver/crash.c /dev/crash kernel driver to version 1.3, which adds support for Linux 4.6 and later ARM64 kernels, kernels configured with CONFIG_HARDENED_USERCOPY, and S390X kernels use xlate_dev_mem_ptr() and unxlate_dev_mem_ptr() instead of kmap() and kunmap(). -- Troy Heber Fri, 02 Dec 2016 11:57:29 -0700 crash (7.1.6-1) unstable; urgency=medium * New upstream 7.1.5 (Closes: #843731): * Introduction of support for "live" ramdump files, such as those that are specified by the QEMU mem-path argument of a memory-backend-file object. This allows the running of a live crash session against a QEMU guest from the host machine. In this example, the /tmp/MEM file on a QEMU host represents the guest's physical memory: $ qemu-kvm ...other-options... \ -object memory-backend-file,id=MEM,size=128m,mem-path=/tmp/MEM,share=on \ -numa node,memdev=MEM -m 128 and a live session run can be run against the guest kernel like so: $ crash live:/tmp/MEM@0 By prepending the ramdump image name with "live:", the crash session will act as if it were running a normal live session. * Fix for the support of ELF vmcores created by the KVM "virsh dump --memory-only" facility if the guest kernel was not configured with CONFIG_KEXEC, or CONFIG_KEXEC_CORE in Linux 4.3 and later kernels. Without the patch, the crash session fails during initialization with the message "crash: cannot resolve kexec_crash_image". * Added support for x86_64 ramdump files. Without the patch, the crash session fails immediately with the message "ramdump: unsupported machine type: X86_64". * Fix for a "[-Werror=misleading-indentation]" compiler warning that is generated by gdb-7.6/bfd/elf64-s390.c when building S390X in a Fedora Rawhide environment with gcc-6.0.0 * Recognize and parse the new QEMU_VM_CONFIGURATION and QEMU_VM_FOOTER sections used for live migration of KVM guests, which are seen in the "kvmdump" format generated if "virsh dump" is used without the "--memory-only" option. * Fix for Linux commit edf14cdbf9a0e5ab52698ca66d07a76ade0d5c46, which has appended a NULL entry as the final member of the pageflag_names[] array. Without the patch, a message that indicates "crash: failed to read pageflag_names entry" is displayed during session initialization in Linux 4.6 kernels. * Fix for Linux commit 0139aa7b7fa12ceef095d99dc36606a5b10ab83a, which renamed the page._count member to page._refcount. Without the patch, certain "kmem" commands fail with the "kmem: invalid structure member offset: page_count". * Fix for an ARM64 crash-7.1.5 "bt" regression for a task that has called panic(). Without the patch, the backtrace may fail with a message such as "bt: WARNING: corrupt prstatus? pstate=0x20000000, but no user frame found" followed by "bt: WARNING: cannot determine starting stack frame for task
". The pstate register warning will still be displayed (as it is essentially a kdump bug), but the backtrace will proceed normally. * Fix for the ARM64 "bt" command in Linux 4.5 and later kernels which use per-cpu IRQ stacks. Without the patch, if an active non-crashing task was running in user space when it received the shutdown IPI from the crashing task, the "-- ---" transition marker from the IRQ stack to the process stack is not displayed, and a message indicating "bt: WARNING: arm64_unwind_frame: on IRQ stack: oriq_sp:
fp: 0 (?)" gets displayed. * Fix for the ARM64 "bt" command in Linux 4.5 and later kernels which are not configured with CONFIG_FUNCTION_GRAPH_TRACER. Without the patch, backtraces that originate from a per-cpu IRQ stack will dump an invalid exception frame before transitioning to the process stack. * Introduction of ARM64 support for 4K pages with 4-level page tables and 48 VA bits. * Implemented support for the redesigned ARM64 kernel virtual memory layout and associated KASLR support that was introduced in Linux 4.6. The kernel text and static data has been moved from unity-mapped memory into the vmalloc region, and its start address can be randomized if CONFIG_RANDOMIZE_BASE is configured. Related support is being put into the kernel's kdump code, the kexec-tools package, and makedumpfile(8); with that in place, the analysis of Linux 4.6 ARM64 dumpfiles with or without KASLR enabled should work normally by entering "crash vmlinux vmcore". On live systems, Linux 4.6 ARM64 kernels will only work automatically if CONFIG_RANDOMIZE_BASE is not configured. Unfortunately, if CONFIG_RANDOMIZE_BASE is configured on a live system, two --machdep command line arguments are required, at least for the time being. The arguments are: --machdep phys_offset= --machdep kimage_voffset= Without the patch, any attempt to analyze a Linux 4.6 ARM64 kernel fails during initialization with a stream of "read error" messages followed by "crash: vmlinux and vmcore do not match!". * Linux 3.15 and later kernels configured with CONFIG_RANDOMIZE_BASE could be identified because of the "randomize_modules" kernel symbol, and if it existed, the "--kaslr=" and/or "--kaslr=auto" options were unnecessary. Since the "randomize_modules" symbol was removed in Linux 4.1, this patch has replaced the KASLR identifier with the "module_load_offset" symbol, which was also introduced in Linux 3.15, but still remains. * Improvement of the ARM64 "bt -f" display such that in most cases, each stack frame level delimiter will be set to the stack address location containing the old FP and old LR pair. * Fix for the introduction of ARM64 support for 64K pages with 3-level page tables in crash-7.1.5, which fails to translate user space virtual addresses. Without the patch, "vtop " fails to translate all user-space addresses, and any command that needs to either translate or read user-space memory, such as "vm -p", "ps -a", and "rd -u" will fail. * Enhancement of the error message generated by the "tree -t radix" option when a duplicate entry is encountered. Without the patch, the error message shows the address of the radix_tree_node that contains the duplicate entry, for example, "tree: duplicate tree entry: ". It has been changed to also display the radix_tree_node.slots[] array index and the duplicate entry value, for example, "tree: duplicate tree entry: radix_tree_node: slots[]: ". * Introduction of a new "bt -v" option that checks the kernel stack of all tasks for evidence of stack overflows. It does so by verifying the thread_info.task address, ensuring the thread_info.cpu value is a valid cpu number, and checking the end of the stack for the STACK_END_MAGIC value. * Fix to recognize a kernel thread that has user space virtual memory attached to it. While kernel threads typically do not have an mm_struct referencing a user-space virtual address space, they can either temporarily reference one for a user-space copy operation, or in the case of KVM "vhost" kernel threads, keep a reference to the user space of the "quem-kvm" task that created them. Without the patch, they will be mistaken for user tasks; the "bt" command will display an invalid kernel-entry exception frame that indicates "[exception RIP: unknown or invalid address]", the "ps" command will not enclose the command name with brackets, and the "ps -[uk]" and "foreach [user|kernel]" options will show the kernel thread as a user task. * Fix for the "bt -[eE]" options on ARM64 to recognize kernel exception frames in VHE enabled systems, in which the kernel runs in EL2. * Fix for the extensions/trace.c extension module to account for the Linux 4.7 kernel commit dcb0b5575d24 that changed the bit index for the TRACE_EVENT_FL_TRACEPOINT flag. Without the patch, the "extend" command fails to load the trace.so module, with the error message "extend: /path/to/crash/extensions/trace.so: no commands registered: shared object unloaded". The patch reads the flag's enum value dynamically instead of using a hard-coded value. * Incorporated Takahiro Akashi's alternative backtrace method as a "bt" option, which can be accessed using "bt -o", and where "bt -O" will toggle the original and optional methods as the default. The original backtrace method has adopted two changes/features from the optional method: (1) ORIG_X0 and SYSCALLNO registers are not displayed in kernel exception frames. (2) stackframe entry text locations are modified to be the PC address of the branch instruction instead of the subsequent "return" PC address contained in the stackframe link register. Accordingly, these are the essential differences between the original and optional methods: (1) optional: the backtrace will start with the IPI exception frame located on the process stack. (2) original: the starting point of backtraces for the active, non-crashing, tasks, will continue to have crash_save_cpu() on the IRQ stack as the starting point. (3) optional: the exception entry stackframe adjusted to be located farther down in the IRQ stack. (4) optional: bt -f does not display IRQ stack memory above the adjusted exception entry stackframe. (5) optional: may display "(Next exception frame might be wrong)". * Fix for the failure of the "sym " option in the extremely unlikely case where the symbol's name string is composed entirely of hexadecimal characters. For example, without the patch, "sym e820" fails with the error message "sym: invalid address: e820". * Fix for the failure of the "dis " option in the extremely unlikely case where the symbol's name string is composed entirely of hexadecimal characters. For example, without the patch, "dis f" fails with the error message "dis: WARNING: f: no associated kernel symbol found" followed by "0xf: Cannot access memory at address 0xf". * Fix for the X86_64 "bt -R " option if the only reference to the kernel text symbol in a backtrace is contained within the "[exception RIP: ]" line of an exception frame dump. Without the patch, the reference will only be picked up if the exception RIP's hexadecimal address value is used. * Fix for the ARM64 "bt -R " option if the only reference to the kernel text symbol in a backtrace is contained within the "[PC:
[]" line of an exception frame dump. Without the patch, the reference will only be picked up if the PC's hexadecimal address value is used. * Fix for the gathering of module symbol name strings during session initialization. In the unlikely case where the ordering of module symbol name strings does not match the order of the kernel_symbol structures, a faulty module symbol list entry may be created that contains a bogus name string. * Fix the PERCENTAGE of total output of the "kmem -i" SWAP USED line when the system has no swap pages at all. Without the patch, both the PAGES and TOTAL columns show values of zero, but it confusingly shows "100% of TOTAL SWAP", which upon first glance may seem to indicate potential memory pressure. * Enhancement to determine structure member data if the member is contained within an anonymous structure or union. Without the patch, it is necessary to parse the output of a discrete gdb "printf" command to determine the offset of such a structure member. * Speed up session initialization by attempting MEMBER_OFFSET_INIT() before falling back to ANON_MEMBER_OFFSET_INIT() in several known cases of structure members that are contained within anonymous structures. * Implemented new "list -S" and "tree -S" options that are similar to each command's -s option, but instead of parsing gdb output, member values are read directly from memory, so the command is much faster for 1-, 2-, 4-, and 8-byte members. * Fix to recognize and support x86_64 Linux 4.8-rc1 and later kernels that are configured with CONFIG_RANDOMIZE_MEMORY, which randomizes the base addresses of the kernel's unity-map address (PAGE_OFFSET), and the vmalloc region. Without the patch, the crash utility fails with a segmentation violation during session initialization on a live system, or will generate a number of WARNING messages followed by the fatal error message "crash: vmlinux and do not match!" with dumpfiles. * Fix for Linux 4.1 commit d0a0de21f82bbc1737ea3c831f018d0c2bc6b9c2, which renamed the x86_64 "init_tss" per-cpu variable to "cpu_tss". Without the patch, the addresses of the 4 per-cpu exception stacks cannot be determined, which causes backtraces that originate on any of the per-cpu DOUBLEFAULT, NMI, DEBUG, or MCE stacks to be truncated. * With the introduction of radix MMU in Power ISA 3.0, there are changes in kernel page table management accommodating it. This patch series makes appropriate changes here to work for such kernels. Also, this series fixes a few bugs along the way: ppc64: fix vtop page translation for 4K pages ppc64: Use kernel terminology for each level in 4-level page table ppc64/book3s: address changes in kernel v4.5 ppc64/book3s: address change in page flags for PowerISA v3.0 ppc64: use physical addresses and unfold pud for 64K page size ppc64/book3s: support big endian Linux page tables The patches are needed for Linux v4.5 and later kernels on all ppc64 hardware. * Fix for Linux 4.8-rc1 commit 500462a9de657f86edaa102f8ab6bff7f7e43fc2, in which Thomas Gleixner redesigned the kernel timer mechanism to switch to a non-cascading wheel. Without the patch, the "timer" command fails with the message "timer: zero-size memory allocation! (called from
)" * Support for PPC64/BOOK3S virtual address translation for radix MMU. As both radix and hash MMU are supported in a single kernel on Power ISA 3.0 based server processors, identify the current MMU type and set page table index values accordingly. Also, in Linux 4.7 and later kernels, PPC64/BOOK3S uses the same masked bit values in page table entries for 4K and 64K page sizes. * Change the RESIZEBUF() macro so that it will accept buffer pointers that are not declared as "char *" types. Change two prior direct callers of resizebuf() to use RESIZEBUF(), and fix two prior users of RESIZEBUF() to correctly calculate the need to resize their buffers. * Fix for the "trace.so" extension module to properly recognize Linux 3.15 and later kernels. In crash-7.1.6, the MEMBER_OFFSET() macro has been improved so that it is able to recognize members of embedded anonymous structures. However, the module's manner of recognizing Linux 3.15 and later kernels depended upon MEMBER_OFFSET() failing to handle anonymous members, and therefore the improvement prevented the module from successfully loading. * If a "struct" command address argument is expressed using the per-cpu "symbol:cpuspec" format, and the symbol is a pointer type, i.e., not the address of the structure, display a WARNING message. * Exclude ARM64 kernel module linker mapping symbols like "$d" and "$x" as is done with 32-bit ARM. Without the patch, a crash session may fail during the "gathering module symbol data" stage with a message similar to "crash: store_module_symbols_v2: total: 15 mcnt: 16". * Enhancement to the ARM64 "dis" command when the kernel has enabled KASLR. When KASLR is enabled on ARM64, a function call between a module and the base kernel code will be done via a veneer (PLT) if the displacement is more than +/-128MB. As a result, disassembled code will show a branch to the in-module veneer location instead of the in-kernel target location. To avoid confusion, the output of the "dis" command will translate the veneer location to the target location preceded by "plt:", for example, "". * Improvement of the "dev -d" option to display I/O statics for disks whose device driver uses the blk-mq interface. Currently "dev -d" always displays 0 in all fields for the blk-mq disk because blk-mq does not increment/decrement request_list.count[2] on I/O creation and I/O completion. The following values are used in blk-mq in such situations: - I/O creation: blk_mq_ctx.rq_dispatched[2] - I/O completion: blk_mq_ctx.rq_completed[2] So, we can get the counter of in-progress I/Os as follows: in progress I/Os == rq_dispatched - rq_completed This patch displays the result of above calculation for the disk. It determines whether the device driver uses blk-mq if the request_queue.mq_ops is not NULL. The "DRV" field is displayed as "N/A(MQ)" if the value for in-flight in the device driver does not exist for blk-mq. -- Troy Heber Wed, 16 Nov 2016 12:10:40 -0700 crash (7.1.5-4) unstable; urgency=medium * Fix FTBFS due compiler warnings in elf64-s390.c -- Troy Heber Wed, 05 Oct 2016 07:47:33 -0600 crash (7.1.5-3) unstable; urgency=medium * Update to packages-arch-specific to enable arm64 -- Troy Heber Mon, 03 Oct 2016 13:23:51 -0600 crash (7.1.5-2) unstable; urgency=medium * Forgot to close bug in the last upload (Closes: #811604) -- Troy Heber Tue, 06 Sep 2016 15:20:09 -0600 crash (7.1.5-1) unstable; urgency=medium * New upstream 7.1.5 (Closes: #817798): * Fix for the handling of Xen DomU ELF dumpfiles to prevent the pre-gathering of p2m frames during session initialization, which is unnecessary since ELF files contain the mapping information in their ".xen_p2m" section. Without the patch, it is possible that the crash session may be unnecessarily aborted if the p2m frame-gathering fails, for example, if the CR3 value in the header is invalid. * Fix for the translation of X86_64 virtual addresses in the vsyscall region between 0xffffffffff600000 and 0xffffffffffe00000. Without the patch, the reading of addresses in that region returns invalid data; in addition, the "vtop" command for an address in that region shows an invalid physical address under the "PHYSICAL" column. * Make the "zero excluded" mode default behavior when analyzing SADUMP dumpfiles because some Fujitsu troubleshooting software assumes the behavior. Also, fix the "set -v" option to show the "zero_excluded" internal variable as "on" if it has been set when analyzing SADUMP dumpfiles. * Fix for the "bt" command to properly pull the stack and frame pointer registers from the NT_PRSTATUS notes of 32-bit tasks running in user-mode on ARM64. Without the patch, the "bt" command utilizes ptregs->sp and ptregs->regs[29] for 32-bit tasks instead of the architecturally-mapped ptregs->regs[13] and ptregs->regs[11], which yields unpredictable/invalid results, and possibly a segmentation violation. * Fix for the "ps -t" option in 3.17 and later kernels that contain commit ccbf62d8a284cf181ac28c8e8407dd077d90dd4b, which changed the task_struct.start_time member from a struct timespec to a u64. Without the patch, the "RUN TIME" value is nonsensical. * Fix for the changes made to the kernel module structure introduced by this kernel commit for Linux 4.5 and later kernels: commit 7523e4dc5057e157212b4741abd6256e03404cf1 module: use a structure to encapsulate layout. Without the patch, the crash session fails during initialization with the error message: "crash: invalid structure member offset: module_core_size". * The crash utility has not supported Xen dom0 and domU dumpfiles since this Linux 3.19 commit: commit 054954eb051f35e74b75a566a96fe756015352c8 xen: switch to linear virtual mapped sparse p2m list This patch resurrects support for dom0 dumpfiles only. Without the patch, the crash session fails during session initialization with the message "crash: cannot resolve p2m_top". * Fix for the replacements made to the kernel's cpu_possible_mask, cpu_online_mask, cpu_present_mask and cpu_active_mask symbols in this kernel commit for Linux 4.5 and later kernels: commit 5aec01b834fd6f8ca49d1aeede665b950d0c148e kernel/cpu.c: eliminate cpu_*_mask Without the patch, behavior is architecture-specific, dependent upon whether the cpu mask values are used to calculate the number of cpus. For example, ARM64 crash sessions fail during session initialization with the error message "crash: zero-size memory allocation! (called from
)", whereas X86_64 sessions come up normally, but invalid cpu mask values of zero are stored internally. * Fixes for "[-Werror=misleading-indentation]" compiler warnings that are generated by the following files, when building X86_64 in a Fedora Rawhide environment with gcc-6.0.0: gdb-7.6/bfd/coff-i386.c gdb-7.6/bfd/coff-x86_64.c kernel.c x86_64.c lkcd_common.c Without the patch, the warnings in the bfd library files are treated as errors, and abort the build. The three instances in the top-level crash source code directory are non-fatal. There are several other gdb-specific instances that are non-fatal and are not addressed. * Fix for a "[-Werror=shift-negative-value]" compiler warning that is generated by "gdb-7.6/opcodes/arm-dis.c" when building crash with "make target=ARM64" on an x86_64 host with gcc-6.0.0. Without the patch, the warning is treated as an error and the build is aborted. * Fix for a series of "[-Werror=shift-negative-value]" compiler warnings that are generated by "gdb-7.6/bfd/elf64-ppc.c" and "gdb-7.6/opcodes/ppc-opc.c" when building with "make target=PPC64" on an x86_64 host with gcc-6.0.0. Without the patch, the warnings are treated as errors and the build is aborted. * Fix for a "[-Werror=unused-const-variable]" compiler warning that is generated by "gdb-7.6/opcodes/mips-dis.c" when building with "make target=MIPS" on an x86_64 host with gcc-6.0.0. Without the patch, the warning is treated as an error and the build is aborted. * Configure the embedded gdb module with "--disable-sim" in order to bypass the unnecessary build of the libsim.a library. * Implement support for per-cpu IRQ stacks on the ARM64 architecture, which were introduced in Linux 4.5 by this commit: commit 132cd887b5c54758d04bf25c52fa48f45e843a30 arm64: Modify stack trace and dump for use with irq_stack Without the patch, if an active task was operating on its per-cpu IRQ stack on dumpfiles generated by kdump, its backtrace would start at the exception frame that was laid down on the process stack. This patch also adds support for "bt -E" to search IRQ stacks for exception frames, and the "mach" command displays the addresses of each per-cpu IRQ stack. * Fixes for "[-Werror=misleading-indentation]" compiler warnings that are generated by the following files, when building X86_64 in a Fedora Rawhide environment with gcc-6.0.0: gdb-7.6/gdb/ada-lang.c gdb-7.6/gdb/linux-record.c gdb-7.6/gdb/inflow.c gdb-7.6/gdb/printcmd.c gdb-7.6/gdb/c-typeprint.c Without the patch, warnings in the gdb-7.6/gdb directory are not treated as errors, and are non-fatal to the build. * Further fix for the symbol name changes made to the kernel's cpu_online_mask, cpu_possible_mask, cpu_present_mask and cpu_active_mask symbols in Linux 4.5 and later kernels for when the crash session is brought up with "crash -d". Without the patch, the cpus found in each mask are displayed like this example: cpu_possible_(null): cpus: 0 1 2 3 4 5 6 7 cpu_present_(null): cpus: 0 1 cpu_online_(null): cpus: 0 1 cpu_active_(null): cpus: 0 1 The "(null)" string segments above should read "mask". * Fix for the changes made to the kernel module structure introduced by this kernel commit for Linux 4.5 and later kernels: commit 8244062ef1e54502ef55f54cced659913f244c3e modules: fix longstanding /proc/kallsyms vs module insertion race. Without the patch, the crash session fails during initialization with the error message: "crash: invalid structure member offset: module_num_symtab". * Fix for the "dis " option if the function or address is the highest text symbol value in a kernel module. Without the patch, the disassembly may continue past the end of the function, or may show nothing at all. The patch utilizes in-kernel kallsyms symbol size information instead of disassembling until reaching the address of the next symbol in the module. * Fix for the "irq -s" option in Linux 4.2 and later kernels. Without the patch, the irq_chip.name string (e.g. "IO-APIC", "PCI-MSI", etc.) is missing from the display. * Improvement of the accuracy of the allocated objects count for each kmem_cache shown by "kmem -s" in kernels configured with CONFIG_SLUB. Without the patch, the values under the ALLOCATED column may be too large because cached per-cpu objects are counted as allocated. * Fixes to address two gcc-4.1.2 compiler warnings introduced by the previous patch: memory.c: In function ‘count_cpu_partial’: memory.c:17958: warning: comparison is always false due to limited range of data type memory.c: In function ‘count_partial’: memory.c:18729: warning: comparison is always false due to limited range of data type * Introduction of the "whatis -r" and "whatis -m" options. The -r option searches for data structures of a specified size or within a range of specified sizes. The -m option searches for data structures that contain a member of a given type. If a structure contains another structure, the members of the embedded structure will also be subject to the search. The type string may be a substring of the data type name. The output displays the size and name of the data structure. * Apply a fuzz factor of zero to the re-application of a modified version of the gdb-7.6.patch in a pre-existing build directory. Without the patch, it is possible that a previously-applied patch could be applied a second time without the fuzz restriction. * Include sys/macros.h explicitly in filesys.c for the definitions of major(), minor() and makedev(). These functions are defined in the sys/sysmacros.h header, not sys/types.h. Linux C libraries are updating to drop the implicit include, so we need to include it explicitly. * Fix for "kmem -[sS]" options for kernels configured with CONFIG_SLUB. Without the patch, the count displayed in the ALLOCATED column may be too large, and the "kmem -S" display of allocated/free status of individual objects may be incorrect. * Fix for "kmem -[sS]" options for kernels configured with CONFIG_SLUB. Without the patch, if a freelist pointer is corrupt, the address of the slab page being referenced may not be displayed by the error message, showing something like: "kmem: kmalloc-32: slab: 0 invalid freepointer: 6e652f323a302d74". * Fix for the "vm -p" option on kernels that are not configured with CONFIG_SWAP. Without the patch, the command may fail prematurely with the message "nr_swapfiles doesn't exist in this kernel". * Introduction of ARM64 support for 64K pages with 3-level page tables and 48 VA bits. Until now, support has only existed for 64K pages with 2-level page tables, and 4K pages with 3-level page tables. * Fix for the "vm -p" and "vtop " commands if a user page is swapped out. Without the patch, the "/dev" component of the swap file pathname may be missing from its display. * Fix for the x86_64 "vm -p" command to properly emulate the kernel's pte_present() function, which checks for either _PAGE_PRESENT or _PAGE_PROTNONE to be set. Without the patch, user pages whose PTE does not have _PAGE_PRESENT bit set are misconstrued as SWAP pages with an "(unknown swap location") along with a bogus OFFSET value. * When reading a task's task_struct.flags field, check for its size, which was changed from an unsigned long to an unsigned int. * Introduction of support for the 64-bit SPARC V9 architecture. This version supports running against a live kernel. Compressed kdump support is also here, but the crash dump support for the kernel, kexec-tools, and makedumpfile is still pending. Initial work was done by Karl Volz with help from Bob Picco. * Account for the Linux 3.17 increase of the ARM64 MAX_PHYSMEM_BITS definition from 40 to 48. -- Troy Heber Sat, 30 Apr 2016 07:54:33 -0600 crash (7.1.4-1) unstable; urgency=medium * New upstream version 7.1.4, upstream changelog follows: * Fix for the ARM64 "vtop" command when translating kernel virtual addresses within a 2MB or 512MB huge page in which the PGD or PMD contains software-defined PTE bits. Without the patch, the "PAGE:" address value will show the software-defined bits, the command will not display the related page structure translation, and will end with the message "WARNING: sparsemem: invalid section number: ". * Fix for the X86_64 "bt" command in Linux 4.2 and later kernels that are configured with both CONFIG_HAVE_COPY_THREAD_TLS and CONFIG_FRAME_POINTER. Without the patch, the fact that the kernel was compiled with framepointers is not recognized, which may result in backtraces containing stale frame references. * Fix for the "dis" command to support three new x86 instruction extensions that have been added to the Intel instruction set for hardware platforms that support them. The newly-added instructions "clflushopt", "clwb", and "pcommit" prepend 0x66 as a prefix byte to the "clflush", "xsaveopt" and "sfence" instructions respectively. Without the patch: "clflushopt" is disassembled as: "data16" followed by "clflush" "clwb" is disassembled as: "data16" followed by "xsaveopt" "pcommit" is disassembled as: "data16" followed by "sfence" The "clflushopt" instruction was introduced in Linux 3.15 in the clflushopt() function. The "clwb" and "pcommit" instructions were introduced in Linux 4.1 in the clwb() and pcommit_sfence() functions. * Fix for the extensions/trace.c extension module for Linux 4.2 and later kernels. Without the patch, the module fails to load, with the message "failed to init the offset, struct:ftrace_event_call, member:list". * For many years, Xen Dom0 dumps could only be saved in ELF format. Since makedumpfile commit 349a0ed1, it is now possible to save Xen dumps in compressed kdump format. This patch set adds support for these files. Two new files, xen_dom0.c and xen_dom0.h, have been added to provide the common functionality required by both ELF and compressed kdump formats. * Since Linux v4.1, specifically, "MIPS: Rearrange PTE bits into fixed positions.", commit be0c37c985eddc46d0d67543898c086f60460e2e, the MIPS PTE bits are at fixed locations. Since they are macros in the kernel, this patch adds an explicit kernel version check in order to determine and set their values. * Display a machine-type mismatch warning if a little-endian PPC64 compressed kdump created by makedumpfile(8) is used as an argument with a non-PPC64 crash utility binary. Without the patch, the dumpfile is accepted, and the session subsequently fails with a message indicating that that the vmlinux and dumpfile do not match. * Fix for bitmap-handling in SADUMP dumpfiles, which associate each bit in a bitmap with a physical page in the reverse order that is used in kdump-compressed format. The bug had not been detected for a long time because bitmaps in SADUMP formats consist mostly of 0x00 and 0xff excluding a very limited amount of memory space for firmware. * Fix for the behavior of the --zero_excluded option when used with SADUMP dumpfiles. Without the patch, the behavior of --zero_excluded option is the opposite to what is expected: reads of filtered pages return successfully with zero-filled memory, while reads of filtered filtered pages fail when --zero_excluded option has been specified. * Fix for the "kmem -i" command in Linux 2.6.27 and later kernels to prevent the possibility that an arbitrary address may be accessed when calculating the number of total huge pages. Without the patch, the command's "COMMIT LIMIT" and "COMMITTED" values may be invalid. * Added recognition of the new DUMP_DH_EXCLUDED_VMEMMAP flag in the header of compressed kdumps, which is set by the new -e option to the makedumpfile(8) facility. The -e option excludes kernel pages that contain nothing but kernel page structures for pages that are not being included in the dump. If the bit is set in the dumpfile, the crash utility will issue a warning that the dumpfile is known to be incomplete during initialization, just prior to the system banner display. * Fix for the handling of compound pages in Linux 4.4 and later kernels, which contain this kernel commit: commit 1d798ca3f16437c71ff63e36597ff07f9c12e4d6 mm: make compound_head() robust The commit above removes the PG_tail and PG_compound page.flags bits and the page.first_page member, and introduces a page.compound_head member, which is a pointer to the head page and whose bit 0 acts as the tail flag. Without the patch, a SLAB or SLUB warning message that indicates "cannot determine how compound pages are linked" is displayed during initialization, and any command that tracks compound pages will be affected. * Fix for the handling of dynamically-sized task_struct structures in Linux 4.2 and later kernels, which contain these commits: commit 5aaeb5c01c5b6c0be7b7aadbf3ace9f3a4458c3d x86/fpu, sched: Introduce CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT and use it on x86 commit 0c8c0f03e3a292e031596484275c14cf39c0ab7a x86/fpu, sched: Dynamically allocate 'struct fpu' Without the patch, when running on a filtered kdump dumpfile, it is possible that error messages like this will be seen when gathering the tasks running on a system: "crash: page excluded: kernel virtual address: type: "fill_task_struct". * Fix for the "kmem -s
" command in Linux 3.13 and later kernels configured with CONFIG_SLAB. Without the patch, if the address argument is contained within an object in a tail page of a multi-page slab, the command fails with the message "kmem: address is not allocated in slab subsystem:
". Furthermore, in Linux 4.4 and later kernels configured with CONFIG_SLAB, addresses that are contained within an object in a tail page of a multi-page slab will not be marked by their slab cache name by the "rd -S" and "bt -F" commands. * Fix for a segmentation violation when attempting to run live on a a system without the crash.ko memory driver, and whose kernel was configured with CONFIG_STRICT_DEVMEM. Without the patch, if any -d is entered on the command line, the crash session fails during initialization. * Update for the determination of the ARM64 page size for kernels containing this Linux 4.4 commit: commit 9d372c9fab34cd8803141871195141995f85c7f7 arm64: Add page size to the kernel image header Without the patch, the kernel page size is calculated by looking at the size of the "swapper_pg_dir" page directory. With this update, the page size can be determined by checking a flag built into the kernel image header, available in the "_kernel_flags_le" absolute symbol. * Fix for the handling of ARM and ARM64 QEMU-generated ELF dumpfiles and compressed kdump clones. The patch utilizes the NT_PRSTATUS notes in the dumpfile headers instead of reading them from the kernel's "crash_notes", which are not initialized when QEMU generates a dumpfile. Without the patch, these warning messages are displayed during session initialization: WARNING: invalid note (n_type != NT_PRSTATUS) WARNING: cannot retrieve registers for active tasks and running "bt" on an active task causes a segmentation violation. * Update to the previous QEMU-specific patch to handle kdump dumpfiles which have offline cpus, and therefore will not contain associated NT_PRSTATUS notes in the dumpfile header. Without the patch, if there are any offline cpus, a segmentation violation is generated during session initialization. * The s390 stand-alone dump tools may write the kernel memory directly to a block device. When running the crash utility against such a block device, a misleading warning message such as this is displayed: WARNING: /dev/sda1: may be truncated or incomplete PT_LOAD p_offset: 16384 p_filesz: 5497558138880 bytes required: 5497558155264 dumpfile size: 0 With the patch, the warning message above will be replaced by a note using this format: NOTE: /dev/sda1: No dump complete check for block devices * Map CTRL-l to clear the screen while in vi insertion mode. Without the patch, it displays "^L". * Introduced a general-purpose handler to register data structures that the kernel has dynamically downsized from the size indicated by the debuginfo data. At this time, only "kmem_cache" and "task_struct" structures that have been downsized are registered, but others may be added in the future. If a downsized data structure is passed to gdb for display, gdb will request a read of the "full" data structure, which may flow into a memory region that was either filtered by makedumpfile(8), or perhaps into non-existent memory, thereby killing the generating command immediately due to a partial read. With this patch, commands such as "struct" and "task" that reference downsized data structures will have their reads flagged to return successfully if partial read error occurs. * Fix for Linux 3.18 and later 32-bit ARM kernels that are configured with CONFIG_SLAB which contain percpu array_cache structures that were allocated with vmalloc(). Without the patch, during session initialization there will be error messages that indicate "crash: kmem_cache: : invalid array_cache pointer: ", and during runtime, the "kmem -[sS]" commands will show kmem_cache lines that marked as "[INVALID/CORRUPTED]". * Added a new "list -l " option that can only be used in conjunction with "-s", and requires that the "start" address is the address of a list_head, or other similar list linkage structure whose first member points to the next linkage structure. The "-l " argument is the offset of the embedded list linkage structure in the specified "-s" data structure; it can be either a number of bytes or expressed in "struct.member" format. * Enhanced the debug-only display of the first kernel data items read during session initialization. This includes the system's cpu maps, xtime, and utsname data. These require at least "-d1" as a command line option value, and are primarily useful as an aide for debugging suspect dumpfiles that fail during session initialization. * Added "print_array" as a new internal variable that may be turned on/off with the "set" command. When set to "on", gdb's printing of arrays will be set to "pretty", so that the display of each array element will consume one line. * Introduction of the "sys -i" option, which displays the kernel's DMI identification string data if available. * Fix for "crash --osrelease" on Xen kernels that have both VMCOREINFO and VMCOREINFO_XEN ELF notes. Without the patch, the command returns "(unknown)". -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.3-1) UNRELEASED; urgency=medium * New upstream version 7.1.3, upstream changelog follows: * Fix for the "crash --osrelease" option for flattened format dumpfiles in the unlikely event that the dumpfile header does not contain the VMCOREINFO note section from the original ELF /proc/vmcore. Without the patch, the command displays nothing instead of showing "unknown". * Fix for the "kmem -s
", "bt -F[F]", and "rd -S[S]" options in kernels configured with CONFIG_SLUB. Without the patch, if a referenced slab object address comes from a slab cache that utilizes a multiple-page slab, and the object is located within a tail page of that slab cache, it will not be recognized as a slab object. The "bt -F[F]" and "rd -S[S]" options will just show the object address, and the "kmem -s
" object will indicate "kmem: address is not allocated in slab subsystem:
". This bug is a regression that was introduced in crash-7.1.0 by commit 8b2cb365d7fb139e77cedd80d4061332099ed382, which addressed a bug where stale slab object addresses were incorrectly being recognized as valid slab objects. * Fix for a segmentation violation generated by the ARM64 "bt -[f|F]" options when analyzing the active tasks in vmcores generated by the kdump facility. This bug is a regression that was introduced in crash-7.1.2 by commit 15a58e4070486efa2aa965bdd636626e62b65cc7, which was an enhancement of the ARM64 backtrace capability for active tasks in kdump vmcores. * Fix for the extensions/trace.c extension module to account for kernels that are not configured with CONFIG_TRACE_MAX_TRACER. Without the patch, the module fails to load with the error message "failed to init the offset, struct: trace_array, member: max_offset". * If a kdump dumpfile is marked as incomplete in its ELF or compressed kdump header, and the user has not used the --zero_excluded command line option, append a note to the incomplete dump WARNING message shown during invocation that suggests the use of --zero_excluded. * Fix for the RSS value displayed by the "ps" command in Linux 2.6.34 and later big-endian machines. Without the patch, a task's RSS value will be erroneously calculated by using twice its file pages instead of adding its file pages with its anonymous pages. * Do not search for a panic task in s390x dumpfiles that are marked as a "live dump" by the "zgetdump" facility. Without the patch, an exhaustive, unnecessary, search of all kernel stacks that looks for evidence of a system crash may find an invalid reference in a task's kernel stack due to the common zero-based user and kernel virtual address space ranges of the s390x, causing the task to be mistakenly set as the "PANIC" task. * Mark the "crash" task that generated a snapshot vmcore utilizing the "snap.so" extension module as "(ACTIVE)" in the STATE field of the initial system banner and the "set" command. Without the patch, the task's STATE field shows it as the "(PANIC)" task. * Second part of: Do not search for a panic task in s390x dumpfiles that are marked as a "live dump" by the "zgetdump" facility... The first part prevented a search of the active tasks; this part prevents the last-ditch search of all tasks. * When searching all kernel stacks for evidence of a panic task in "live" s390x dumpfiles created by the VMDUMP, stand-alone dump, or "virsh dump" facilities, none of which explicitly mark the dumpfile as a "live dump", run a standard "bt" backtrace on each kernel stack instead of the text-address-only "bt -t". Without the patch, an invalid text reference may be found in a task's kernel stack due to the common zero-based user and kernel virtual address space ranges of the s390x, causing the task to be mistakenly set as the "PANIC" task. * Introduction of the "dis -f
" option, which disassembles from the target address until the end of the function. * Fix for the ARM64 "dis" command to prevent branch target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the PPC64 "dis" command to prevent conditional branch target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the S390X "dis" command to prevent jump target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the "dis" command on architectures with variable-length instructions. Without the patch, "dis [-f] " may continue beyond the end of a function, disassembling the memory that is in between the target function and the next function. For kernel module functions, the module's debuginfo data must be loaded. * Minor cleanup and error handling fix-up for the "dis" command. Without the patch, if the target address of "dis -r" or "dis -f" is not an exact address of an instruction, "dis -r" will continue beyond the target address, and "dis -f" will show nothing. * Reduce the unnecessary error messages if a directory is used as a command line argument. Without the patch, six error messages are displayed: crash: unable to read dump file /tmp /tmp: ELF header read: Is a directory /tmp: ELF header read: Is a directory crash: /tmp: read: Is a directory read_maps: unable to read header from /tmp, errno = 1 crash: vmw: Failed to read '/tmp': [Error 21] Is a directory With the patch applied, the functions that generate those messages are not called; only the standard "not a supported file format", and "Usage" messages will be displayed. * If the method of determining how compound pages are linked cannot be accomplished due to page struct related changes in upstream kernels, issue a WARNING message during session initialization. * Fix for the "timer" command on Linux 4.2 and later kernels, which contain this kernel commit that modifies the tvec_root and tvec data structures: commit bc7a34b8b9ebfb0f4b8a35a72a0b134fd6c5ef50 timer: Use hlist for the timer wheel hash buckets Without the patch, the "timer" command will spew messages indicating "timer: invalid list entry: 0", followed by "timer: ignoring faulty timer list at index of timer array". * Introduction of the "dis -s
" option, which displays the filename and line number that is associated with the specified text location, followed by a source code listing if it is available on the host machine. The line associated with the text location will be marked with an asterisk; depending upon gdb's internal "listsize" variable, several lines will precede the marked location. If a "count" argument is entered, it specifies the number of source code lines to be displayed after the marked location; otherwise the remaining source code of the containing function will be displayed. * Added a new "--src " command line option for use by the "dis -s" option if the kernel source code is not located in the standard location that is compiled into the kernel's debuginfo data. The directory argument should point to the top-level directory of the kernel source tree. -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.2-1) UNRELEASED; urgency=medium * New upstream version 7.1.2, upstream changelog follows: * Enhancement of the ARM64 backtrace capability. Without the patch, backtraces of the active tasks start at the function that is saved in each per-cpu ELF note. With the patch, the backtrace will start at the "crash_kexec" function on the panicking cpu, and at the "crash_save_cpu" function on the other active cpus. By doing so, the backtrace will display the exception handling functions leading to crash_kexec() or crash_save_cpu(), as well as the exception frame register set as it was at the time of the fatal exception on the panic cpu, or when the shutdown IPI was received on the other cpus. * Enabled the "bt -R" option on the ARM64 architecture. Without the patch, the option fails with the message "bt: -R option not supported or applicable on this architecture or kernel". * Enabled the "crash --log vmcore" command line option on the ARM64 architecture. Without the patch, the option fails with the message "crash: crash --log not implemented on ARM64: TBD". * Fix for the S390X "bt" command when running against kernels that have Linux 4.0 commit 2f859d0dad818765117c1cecb24b3bc7f4592074, which removes the "async_stack" and "panic_stack" members from the "pcpu" structure. Without the patch, backtraces of active tasks that were executing I/O or machine check interrupts are not displayed, while other tasks may generate fatal readmem() errors of type "readmem_ul". * Fix to prevent an unnecessary/temporary GETBUF() memory allocation of 1 MB by the dump_mem_map() utility function when the kernel is configured with CONFIG_SPARSEMEM. * Speed up the "crash --osrelease" option when used with "flattened" format dumpfiles. Without the patch, the rearranged data array initialization is performed before the vmcoreinfo data in the header is read, which can take a significant amount of time with large dumpfiles. The patch simply looks for the appropriate vmcoreinfo data string near the beginning of the dumpfile. * Fix for the initialization-time sorting mechanism required for "flattened format" dumpfiles if the dumpfile is truncated/incomplete. Without the patch, the sorting function continues performing invalid reads beyond the of the dumpfile, which may lead to an infinite loop instead of a session-ending error message. In addition, since the sorting operation may take several minutes, a "please wait" message with an incrementing percentage-complete counter will be displayed. * Several fixes associated with the gathering and display of task state. Without the patch: (1) The "ps" command's ST column shows "??" for tasks in the TASK_WAKING state. (2) The "ps" command's ST column shows "??" for tasks in the TASK_PARKED state in Linux 3.14 and later kernels. (3) The STATE field of the initial system banner and the "set" command are incorrect if the task state has the TASK_WAKING, TASK_WAKEKILL modifier, or TASK_PARKED bits set in Linux 3.14 and later kernels. (4) The "foreach DE" task identifier fails if a task with a PID number of 0xDE (222) exists. (5) The "foreach" command's "SW", "PA", "TR" and "DE" task identifiers inadvertently select all tasks in kernel versions that do not have those states. (6) The "help -t" output would display incorrect values for the TASK_WAKEKILL, TASK_WAKING and TASK_PARKED states in Linux 3.14 and later kernels. Lastly, support for the TASK_NOLOAD modifier introduced in Linux 4.2 has been added to STATE field of the "set" command and the initial system banner. * Fix for the internal memory allocation functionality. Without the patch, in the unlikely event where the GETBUF() facility has to utilize malloc() to allocate a buffer, and CTRL-c is entered while that buffer is being zeroed out before being returned to the caller, it may result in a never-ending set of "malloc-free mismatch" error messages. * Fix for the PPC64 "bt" command for active non-panic tasks. Without the patch, the backtrace may fail immediately with the error message "bt: invalid kernel virtual address: f type: Regs NIP value". * Fix for the "bt" command on little-endian PPC64 machines for tasks that are blocked in __schedule(). Without the patch, there will be two "__switch_to" frames displayed before the normal "__schedule" frame that is used as the starting point for blocked tasks. * Fix for the PPC64 "bt" command to align its exception frame verifier function with the most recent version of the kernel's getvecname() function, which was updated in Linux 3.12. Without the patch, the "Hypervisor Decrementer", "Emulation Assist", "Hypervisor Doorbell", "Altivec Unavailable", "Instruction Breakpoint", "Denormalisation", "HMI" and "Altivec Assist" exception types are not recognized and their exception frames not displayed; the "Doorbell" exception type is marked as a "reserved" exception type, * Fix for the "timer" command when run on a kernel with a large number of cpus. Without the patch, the command may fail prematurely with a dump of the internal crash utility allocated buffer statistics followed by the message "timer: cannot allocate any more memory!", * Commit f95ecdc330a11d3701de859aab59a5ab5954aae6, which speeds up "crash --osrelease" for flattened format dumpfiles, inadvertently broke the option for ELF kdump and compressed kdump dumpfiles. * Implementation of two new "files" command options. The "files -c" option is context-sensitive, similar to the regular "files" command when used without an argument, but replaces the FILE and DENTRY columns with I_MAPPING and NRPAGES columns that reflect each open file's inode.i_mapping address_space structure address, and the address_space.nrpages count within it; this shows how many of each open file's pages are currently in the system's page cache. The "files -p " option takes the address of an inode, and dumps all of its pages that are currently in the system's page cache, borrowing the "kmem -p" page structure output. * Modified the qualification for the execution of the "runq -g" option. Without the patch, if the target kernel was not configured with both CONFIG_FAIR_GROUP_SCHED and CONFIG_RT_GROUP_SCHED, the command fails with the message "runq: -g option not supported or applicable on this architecture or kernel". With this patch, if the kernel was built with either CONFIG_FAIR_GROUP_SCHED or CONFIG_RT_GROUP_SCHED, the command will execute. * Fix for the error handling of the "foreach task -R struct.member" format if an invalid structure and/or member is used as an argument. Without the patch, the command will display the expected error indicating "task: invalid structure member reference", but then will be followed by a stream of "task: recursive temporary file usage" error messages. * Force the 32-bit MIPS extensions/eppic.so to be compiled with -m32. This is required when "make extensions" is executed after the top level crash binary has been built with "make TARGET=MIPS" on an x86_64 host. * If the starting hexadecimal address of a function is passed to the "dis" command without a count argument, disassemble the entire function -- similar to when a symbol name of a function is passed without a count argument. Without the patch, only one instruction is displayed. * Fix compiler warning generated by extensions/trace.c when compiled with gcc version 5. Without the patch, the message "warning: the use of 'mktemp' is dangerous, better use 'mkstemp'" is generated. * Update the extensions/eppic.mk file to clone the eppic source code from https://github.com/lucchouina/eppic.git. * Export the previously static symbol_name_count() function, which returns a count of symbols with the same name. Export a new is_symbol_text() function, which checks whether specified symbol entry is a type 't' or 'T'. * If a symbol or symbol+offset argument is passed to the "dis" command, and there are multiple text symbols with the same symbol name, then display a message indicating that there are "duplicate text symbols found", followed by a list of the symbols. Without the patch, the duplicate symbol with the lowest virtual address is used. -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.1-1) unstable; urgency=medium * Autopkgtest fix from Martin Pitt (Closes: #756969): - Drop sudo calls; they potentially hang forever asking for a password or might get denied, destroy the environment, and are not necessary as the test already has "needs-root". - Fix invalid indentation of here-doc - Suppress expected stderr output of apt-key (which causes a test failure) - Drop "set -x", as that causes stderr output and the called commands are already verbose enough. - Drop -security pocket for Ubuntu's ddebs.u.c., as that does not exist. * Fix for two minor issues with the "net" command. Without the patch, the "net -a" option appends its correct output with the command's "Usage:" message; and if either the "net -x" or "net -d" options are used without also specifying "-s" or "-S", the error message would indicate "net: illegal flag: 800000" or "net: illegal flag: 1000000" instead of showing the command's "Usage:" message. * If the kernel (live or dumpfile) has the TAINT_LIVEPATCH bit set, or if the Red Hat "kpatch" module is installed, the tag "[LIVEPATCH]" will be displayed next to the kernel name in the initial system banner and by the "sys" command. This new tag replaces the "[KPATCH]" tag that was introduced in crash-7.0.7. * Addressed three Coverity Scan complaints in vmware_vmss.c: 50:leaked_storage: Variable "fp" going out of scope leaks the storage it points to. 53:leaked_storage: Variable "fp" going out of scope leaks the storage it points to. 256:warning: Use of memory after it is freed * Remove the LKCD-only "propeller spinner" seen when a dumpfile read requires more than 2048 page header accesses. This was put in place because of the non-random-access design of LKCD dumpfiles. Without the patch, the spinner display is intermingled with command output, which complicates the parsing of the output. * Fix to support the Linux version increment from 3 to 4. Without the patch, both dumpfile and live sessions fail during initialization, issuing the message "WARNING: kernel version inconsistency between vmlinux and dumpfile" or "WARNING: kernel version inconsistency between vmlinux and live memory", followed by the nonsensical fatal error message "crash: incompatible arguments: vmlinux is not SMP -- vmcore is SMP" or "crash: incompatible arguments: vmlinux is not SMP -- live system is SMP". To prevent unexpected kernel version bumps in the future, support has been added for version 5. * Add support for more than 16TB of physical memory space in the SADUMP dumpfile format. Without the patch, there is a limitation caused by several 32-bit members of dump_header structure, in particular the max_mapnr member, which overflows if the dumpfile contains more than 16TB of physical memory space. The header_version member of the dump_header structure has been increased from 0 to 1 in this extended new format, and the new 64-bit members will be used. * Fix for command lines that are redirected to a pipe. Without the patch, if an external piped-to command contains a quoted string that includes a "|" character, the command fails with the message "crash: pipe operation failed". * Fix for insecure temporary file usage in _rl_tropen() as reported by readline library CVE-2014-2524. * When the gdb-.patch file has changed and a rebuild is done from within a previously-existing build tree, the "patch -N" option is used to ignore patches that have been previously applied; this patch also applies the "patch -r-" option to prevent unnecessary .rej files from being created. * Fix to account for Xen hypervisor's "domain" structure member name change from "is_paused_by_controller" to "controller_pause_count". Without the patch, in Xen 4.2.5 and later, the crash session fails during initialization with the error message 'crash: invalid structure member offset: domain_is_paused_by_controller". * During initialization, reject useless ARM64 "(A)" and "(a)" absolute symbols that are below the text region. Without the patch, several recently-introduced absolute symbols have been introduced into the kernel, which will be displayed by "sym -l" prior to the first kernel virtual address symbol, and will show up in command output where memory values are translated into kernel symbol references. * Fix for ARM64 kernels to account for changes in the virtual memory layout introduced in Linux 3.17. The vmalloc region end address, and the vmemmap start and end addresses are now calculated at kernel build time, because they depend upon the size of a struct page. Accordingly, the crash utility needs to calculate those three address values dynamically, after the embedded gdb module has initialized. Without the patch, reads of page structures return invalid data due to incorrect virtual-to-physical translations of memory in the vmemmap range. This in turn causes commands that require page structure contents to fail or show invalid data, such as "kmem -p", "kmem -[sS]", and the "kmem -[fF]" options. * Fix to support ELF vmcore dumpfiles whose PT_LOAD file offset values of their respective memory segments are not laid out sequentially from low to high in the dumpfile. This has only been seen in ELF dumpfiles created by VMware's "vmss2core -M" facility. Without the patch, the crash session may fail during initialization, either with the message "cannot malloc ELF header buffer", or "crash: : not a supported file format". * Enhancement to the support of VMware .vmss suspended state dumpfiles. There may be holes in the memory address saved for PCI, etc. In such cases, the memory dump is divided into regions. With this patch, up to 3 memory regions are supported. * Fortified the error handling of task gathering from the pid_hash[] chains during session initialization. If a chain has been corrupted, the patch prevents the sequence from entering an infinite loop, and the error messages associated with corrupt/invalid chains have been updated to report the pid_hash[] index number. * Implemented a new STRDUPBUF() utility that will duplicate an existing string into a buffer allocated with GETBUF(). As is the case with any buffer allocated with GETBUF(), it is only meant to exist during the life-span of the current command. If it is not explicitly freed via FREEBUF(), then it will be freed automatically prior to the next command. * Implemented a new fill_struct_member_data() function that gathers a bundle of data that describes a structure member. The function receives a pointer to a struct_member_data structure, in which the caller has initialized the "structure" and "member" name pointers: struct struct_member_data { char *structure; char *member; long type; long unsigned_type; long length; long offset; long bitpos; long bitsize; }; A gdb "printm" command is crafted using those two fields, and the output of the command is used to initialize the remaining six fields. Adapted from Qiao Nuohan's "pstruct" extension module. * Implemented a new "runq -c cpu(s)" option to display the run queue data of specified cpus. It can be used in conjunction with all runq command options. The cpus must be specified in a comma- and/or dash-separated list; for examples, "3", "1,8,9", "1-23", or "1,8-15". * Build extension modules that utilize the generic extensions/Makefile with -g. In addition, build the snap.c extension module with -g. * Several fixes, updates, and enhancements for 32-bit MIPS support: (1) The MIPS general purpose registers in the elf_gregset_t don't start at index 0 but at index 6. (2) Adjust for the kernel's pt_regs structure changes between kernel versions. For example, fields are inserted into the middle based on build time options, and the amount of padding at the head of the structure was changed relatively recently. To handle this, split the structure definition into two parts and get the offsets of these two parts dynamically. (3) Do not display each parsed kernel symbol during initialization when invoked with "crash -d8". (4) Add support for loading raw MIPS ramdump dumpfiles. (5) Add support for compressed kdump dumpfiles. * Fix for a typo in "help foreach", and a fix for a spelling error in "help input". * Fix for "and and" and "the the" typos in the README file. * Fix to address the Xen 4.5.0 hypervisor symbol name change from "dom0" to "hardware_domain". Without the patch, the crash session fails with the error message "crash: cannot resolve: dom0". * Fix for a regression in crash-7.1.0 that causes failures when the "crash -t" option is run on a live system, and when analyzing remote Linux kernels. Without the patch, "crash -t" on a live system fails with the message "crash: cannot open remote memory source: /dev/mem", and attempts to analyze a Linux kernel remotely just shows the kernel timestamp and exits immediately. * Speed up the session invocation time of "flattened" format dumpfiles created by the makedumpfile(8) facility. When sorting the blocks of memory by their intended ELF or compressed kdump file offsets, the patch replaces the bubble-sort method that is currently used with an insertion sort method. * Remove the non-existent "-L" option from the "ps" command's mutually- exclusive options error message. * Fix for the "irq", "mount", "kmem -p" and "kmem -v" commands when they are used in an input file. If more than one of any of those four commands are used in an input file, the output of the second and subsequent command instances will not display their respective command headers. * Implemented a new "kmem -m" option that is similar to "kmem -p", but it allows the user to specify the page struct members to be displayed. The option takes a comma-separated list of one or more page struct members, which will be displayed following the page structure address. The "flags" member will always be expressed in hexadecimal format, and the "_count" and "_mapcount" members will always be expressed in decimal format. Otherwise, all other members will be displayed in hexadecimal format unless the current output radix is 10 and the member is a signed/unsigned integer. Members that are data structures may be specified by the data structure's member name, or expanded to specify a member of that data structure. For example, "-m lru" refers to a list_head data structure, in which case both the list_head.next and list_head.prev pointer values will be displayed; if "-m lru.next" is specified, just the list_head.next value will be displayed. * Support enhancement for the 32-bit MIPS architecture that retrieves the per-cpu registers from the NT_PRSTATUS notes stored in the header of compressed kdump dumpfiles. * Fix to remove an invalid warning message on ARM64 if a crash session is invoked with the "-d" debug flag. Without the patch, the invalid message is "WARNING: SPARSEMEM_EX: questionable section values". * Remove the leftover ".constructor" build file in the extensions subdirectory when "make extensions" is complete, and update the top-level .gitignore file to ignore post-build extensions subdirectory files. * Fix for a segmentation violation generated by the "help -[n|D]" options on ARM64 compressed kdumps. * Additional output for the "help [-D|-n]" options on ARM64. For ELF kdump vmcores and compressed kdumps, the elf_prstatus structure in each NT_PRSTATUS note will be translated. * The "help -r" option has been extended to dump the ARM64 registers stored in each per-cpu NT_PRSTATUS note in compressed kdump and ELF kdump dumpfiles. * Fix for the ARM64 page size determination on Linux 4.1 and later kernels. Without the patch, the crash session fails during initialization with the message "crash: invalid/unsupported page size: 98304" on kernels with 64K pages. On kernels with 4K pages, the message is "crash: invalid/unsupported page size: 6144". In addition, the "-p " command line override option had no effect on ARM64; that has been fixed as well. * Fix for the DATE display in the initial system banner and by the "sys" command to account for the Linux 3.17 change that moved the "timekeeper" symbol and structure into a containing tk_core structure; the "shadow_timekeeper" timekeeper will be used as an alternative. Without the patch, the DATE shows something within a few hours of the Linux epoch, such as "Wed Dec 31 18:00:00 1969". * Fixes for the translation of ARM64 PTEs, as displayed by the "vm -p" and "vtop" commands. Without the patch, if "vm -p" references a swapped-out page on Linux 4.0 and later kernels, the SWAP location may indicate "(unknown swap location)", and will show an invalid OFFSET value; on Linux 3.13 and later kernels, running "vtop" on a user virtual address incorrectly translates the PTE contents of swapped out pages by showing a PHYSICAL address and FLAGS translation instead of the SWAP device and OFFSET. It is possible that there may be PTE bit translation errors on other kernel versions; the patch addresses the changes in ARM64 PTE bit definitions made in Linux 3.11, 3.13, and 4.0 kernels. * Enhanced the "struct.member" display capability of the "struct", "union", "task", "list" and "tree" commands. If a specified structure member contains an embedded structure, the output may be restricted to just the embedded structure by expressing the .member argument as "member.member". If a specified structure member is an array, the output may be restricted to a single array element by expressing the .member argument as "member[index]". Furthermore, these embedded member specifications may extend beyond one level deep, for example, by expressing the member argument as "member.member.member", or "member[index].member". * Fix for any command that passes strings to gdb for evaluation, where the string contains a parentheses-within-parentheses expression along with a ">" or ">>" operator inside the outermost set of parentheses. Without the patch, a command such as the following fails like so: crash> p ((1+1) >> 1) p: gdb request failed: p ((1+1) crash> * Fix for the handling of ARM64 kernel module per-cpu symbols. Without the patch, if the debuginfo data of an ARM64 kernel module that contains a per-cpu section is loaded by "mod -s " or "mod -S", commands such as "bt" or "sym" may incorrectly translate the module's virtual addresses to symbol names. * Fix to support the Linux version increment from 3 to 4. (Closes: #699367) Without the patch, both dumpfile and live sessions fail during initialization, issuing the message "WARNING: kernel version inconsistency between vmlinux and dumpfile" or "WARNING: kernel version inconsistency between vmlinux and live memory", followed by the nonsensical fatal error message "crash: incompatible arguments: vmlinux is not SMP -- vmcore is SMP" or "crash: incompatible arguments: vmlinux is not SMP -- live system is SMP" -- Troy Heber Wed, 27 May 2015 11:20:02 -0600 crash (7.1.0-1) UNRELEASED; urgency=medium * Support for "irq" and "irq -u" on the S390 and S390X architectures if they are running Linux 3.12 and later kernels. Older kernels without GENERIC_HARDIRQ support will fail with the error message "irq: cannot determine number of IRQs". * Fix for the handling of multiple ramdump images. Without the patch, entering more than one ramdump image on the command line may result in a segmentation violation. * Implemented the capability of building crash as an x86_64 binary for analyzing little-endian PPC64 dumpfiles on an x86_64 host, which can be done by entering "make target=PPC64". After the initial build is complete, subsequent builds can be done by entering "make" alone. * Fix for the "crash --log " option on both of the PPC64 architectures. Without the patch, the command fails with the message "crash: seek error: physical address:
type: log_buf pointer", followed by "crash: cannot read log_buf value". This bug was introduced in crash-7.0.0 by a patch that added support for the PPC64 BOOK3E processor family. * Fix for a misleading fatal error message if a 32-bit crash binary built on an X86_64 host with "make target=X86" or "make target=ARM" is used on a live X86_64 system without specifying a vmlinux namelist. Without the patch, the session fails with the message "crash: cannot find booted kernel -- please enter namelist argument". The error message will be "crash: compiled for the X86 architecture" or "crash: compiled for the ARM architecture". * Fix for finding the starting stack and instruction pointer hooks for the active tasks in x86_64 ELF or compressed dumpfiles created by the KVM "virsh dump --memory-only" facility. Without the patch, the backtraces of active tasks may show an invalid starting frame that indicates "__schedule". The fix displays the exception RIP and dumps the register contents that are stored in the dumpfile header. If the active task was operating in the kernel, the backtrace continues from there; if the task was operating in user-space, the backtrace is complete at that point. * Fix for the "waitq" command when it is passed the address of a wait_queue_head_t structure. Without the patch, if the entries on the list are dynamically-created __wait_queue structures on kernel stacks, the tasks owning the kernel stack are not displayed. * Implemented a new "net -n [pid|task]" option that displays the list of network devices with respect the network namespace of the current context, or that of a task specified by the optional "pid" or "task" argument. The former "net -n
" option that translates an IPv4 address expressed as a decimal or hexadecimal value into a standard numbers-and-dots notation has been changed to "net -N". * Fix for the kernel virtual address to symbol name translation for special text region delimiter symbols declared in vmlinux.lds.S with VMLINUX_SYMBOL(), such as __sched_text_start, __lock_text_start, __kprobes_text_start, __entry_text_start and __irqentry_text_start. Without the patch, if the addresses of those symbols are the same value as the first "real" symbol in those text regions, commands such as "dis" and "sym" may show the "_text_start" symbol name instead of the desired text symbol name. * Enhancement of the "kmem -i" option to display memory overcommit information, which will be appended to the traditional output of the command. For example: crash> kmem -i PAGES TOTAL PERCENTAGE TOTAL MEM 1965332 7.5 GB ---- FREE 78080 305 MB 3% of TOTAL MEM USED 1887252 7.2 GB 96% of TOTAL MEM SHARED 789954 3 GB 40% of TOTAL MEM BUFFERS 110606 432.1 MB 5% of TOTAL MEM CACHED 1212645 4.6 GB 61% of TOTAL MEM SLAB 146563 572.5 MB 7% of TOTAL MEM TOTAL SWAP 1970175 7.5 GB ---- SWAP USED 5 20 KB 0% of TOTAL SWAP SWAP FREE 1970170 7.5 GB 99% of TOTAL SWAP COMMIT LIMIT 2952841 11.3 GB ---- COMMITTED 1150595 4.4 GB 38% of TOTAL LIMIT The COMMIT LIMIT and COMMITTED information is similar to that displayed by the CommitLimit and Committed_AS lines in /proc/meminfo. * Fix for the "kmem [-s|-S]
" command, and the "rd -S[S]" and "bt -F[F]" options. Without the patch, if the page structure associated with a memory address still contains a (stale) pointer to the address of a kmem_cache structure, but whose page.flags does not have the PG_slab bit set, the address is incorrectly presumed to be contained within that slab cache. As as result, the "kmem" command may display one or more messages indicating a "bad inuse counter", a "bad next pointer" or a "bad s_mem pointer", followed by an "address not found in cache" error message. The "rd -S[S]" and "bt -F[F]" commands may mislabel memory locations as belonging to slab caches. * Added a new "vm -M " option. When a task is exiting, the mm_struct address pointer in its task_struct is NULL'd out, and as a result, the "vm" command looks like this: crash> vm PID: 4563 TASK: ffff88049863f500 CPU: 8 COMMAND: "postgres" MM PGD RSS TOTAL_VM 0 0 0k 0k However, the mm_struct address can be retrieved from the task's kernel stack and entered manually with this option, which allows the "vm" command to attempt to dump the virtual memory data of the task. It may, or may not, work, depending upon how far the virtual memory deconstruction has proceeded. This option only verifies that the address entered is from the "mm_struct" slab cache, and that its mm_struct.mm_count is non-zero. * Fix for the X86_64 "bt" and "mach" commands when running against kernels that have the following Linux 3.18 commit, which addresses CVE-2014-9322. The kernel patch removes the per-cpu exception stack used for handling stack segment faults: commit 6f442be2fb22be02cafa606f1769fa1e6f894441 x86_64, traps: Stop using IST for #SS Without this patch, backtraces that originate on any of the other 4 per-cpu exception stacks will be mis-labeled at the transition point back to the previous stack. For example, backtraces that that originate on the NMI stack will indicate that they are coming from the "DOUBLEFAULT" stack. The patch examines all idt_table entries during initialization, looking for gate descriptors that have non-zero index values, and when found, pulls out out the handler function address; from that information, the exception stack name string array is properly initialized rather than being hard-coded. This fix also properly labels the exception stack names on x86_64 CONFIG_PREEMPT_RT realtime kernels, which only utilize 3 exception stacks instead of the traditional 5 (now 4 with this kernel commit), instead of just showing "RT". Also, without the patch, the "mach" command will mis-label the stack names when it displays the base addresses of each per-cpu exception stack. * Additional output for the "help [-D|-n]" options on X86 and X86_64 architectures. For compressed kdumps, the elf_prstatus structure in each per-cpu NT_PRSTATUS note will be translated. For ELF kdumps, the elf_prstatus structure in each per-cpu NT_PRSTATUS note, and the QEMUCPUState structure in each per-cpu QEMU note, will be translated. * Implemented a new "bt -A" option for the S390X architecture, which adds support for displaying the new s390x vector registers. For ELF dumps, the registers are taken from the VX ELF notes; for s390 dumps. the registers are taken from memory. The option produces the same output as the -a option, but also displays the vector registers for all active tasks. * Fix for the 32-bit ARM virtual-to-physical address translation of unity-mapped kernel virtual addresses in kernels configured with CONFIG_ARM_LPAE if the system's phys_base exceeds 4GB. * Fix for the "help [-D|-n]" option on 32-bit X86 kernels that use the 64-bit ELF vmcore format generated by "virsh dump --memory-only". Without the patch, the QEMUCPUState structures in QEMU notes are not translated. * Additional output for the "help [-D|-n]" options on X86 and X86_64 architectures. For compressed kdumps generated by "virsh dump --memory-only", the QEMUCPUState structure in each per-cpu QEMU note will be translated, and the dumpfile offset address of each QEMU note will be displayed. * Introduction of support for the 32-bit MIPS architecture. This initial support is restricted to 32-bit MIPS kernels that are configured as little-endian. With respect to dumpfile types, only ELF vmcores are recognized. In addition to building crash as a 32-bit MIPS binary, it is also possible to build crash as an x86 binary on an x86 or x86_64 host so that crash analysis of MIPS dumpfiles can be performed on an x86 or x86_64 host. The x86 binary can be built by entering "make target=MIPS" for the initial build; subsequent builds with MIPS support can be accomplished by entering "make" alone. * Added support for big-endian 32-bit MIPS kernels. Only native MIPS crash binaries may be built with big-endian support; running the "make target=MIPS" build option on an x86 or x86_64 host creates x86 binaries with little-endian support only. * Update the "ps" help page to reflect that the "ps -l" option may be based upon the task_struct's sched_entity.last_arrival. Without the patch, it indicates that either the task_struct's last_run or timestamp value are used. * Fix for the "kmem -z" option output to change the zone structure's pages_scanned field from a signed to an unsigned long integer. * Fix for "kmem -z" option on Linux 2.6.30 and later kernels. Without the patch, the zone structure's all_unreclaimable and pages_scanned fields are not dumped. * Fix for the PPC64 "bt" command on both big-endian and little-endian architectures. Without the patch, backtraces of the active tasks may be "empty" on little-endian machines, or show a one-liner of the form: "#0 [c0000005f4db7a60] (null) at 501 (unreliable)" on big-endian machines. * Additional output for the "help [-D|-n]" options for the PPC64 architecture. For compressed kdump and ELF kdump dumpfiles, the elf_prstatus structure in each per-cpu NT_PRSTATUS note will be translated. * The "help -r" option has been extended to dump the PPC64 registers stored in each per-cpu NT_PRSTATUS note in compressed kdump and ELF kdump dumpfiles. * Prevent "help -r" and "help -[D|n]" from generating a segmentation violation when attempting to access non-existent NT_PRSTATUS notes for offline cpus in ELF or compressed kdumps. * Fix for the "kmem -V" option output to change the display of the vm_event_states fields from signed to unsigned long integers. * Fix to allow the "ps -G" qualifier to be used in conjunction with the "ps -p" option. Without the patch, "ps -G -p" fails with the error message "ps: do_list: hash queue is in use?" * Fix for the "runq" command on kernels that are configured with CONFIG_RT_GROUP_SCHED=n. Without the patch, real-time tasks queued on a per-cpu rt_rq.rt_prio_array will not be displayed under the "RT PRIO_ARRAY" header. * Fix for a regression introduced in crash-7.0.9 when running on a live 32-bit ARM machine. Without the patch, a segmentation violation is generated during session initialization. * Enhancement of the "PANIC:" message displayed by the initial system banner and by the "sys" command. Without the patch, many panic types are categorized under the same generic message of the form: PANIC: "Oops: 0000 [#1] SMP " (check log for details) or in other types of crashes, no message is displayed at all. With this patch, a more comprehensive search is made of the kernel log for a more informative panic message. * Add appropriate checks for the MIPS architecture to allow extension modules to be loaded with the "extend" command. * Update the extensions/trace.c extension module to account for the movement of the ftrace_event_call.name member into an anonymous union in Linux 3.15, commit de7b2973903c6cc50b31ee5682a69b2219b9919d. * Added support for VMware .vmss suspended state files as dumpfiles. Similar to all other supported dumpfile types, it is invoked as: $ crash vmlinux .vmss A ".vmss" file created by the VMware vSphere ESX hypervisor contains a header and the full memory image. A ".vmss" file created by the VMware Workstation facility only contains the header, and must be accompanied by a companion ".vmem" memory image that is located in the same directory as the ".vmss" file. -- Troy Heber Wed, 27 May 2015 11:20:02 -0600 crash (7.0.9-1) UNRELEASED; urgency=medium * Fix the CPU timer and clock comparator output for the "bt -a" command on S390X machines. The output of CPU timer and clock comparator has always been incorrect because: - We added S390X_WORD_SIZE (8) instead of 4 to get the second word - We did not left shift the clock comparator by 8 The fix gets the complete 64 bit values and by shifting the clock comparator correctly. * Add "/lib/modules//build" to the list of directories that are searched for the currently-running kernel on live systems. This will automatically locate the vmlinux namelist for kernels that were locally installed with "make modules_install install". * Addressed 3 Coverity Scan issues: (1) task.c: initialize the "curr" and "curr_my_q" variables in the dump_tasks_in_task_group_cfs_rq() function. (2) ramdump.c: make the "rd" and "len" return values from read() and write() calls in write_elf() to be ssize_t types. (3) cmdline.c: make the parsed PATH string buffer equal to the size of the PATH string + 1 to prevent a possible buffer overflow when a command line starts with a "!". * Fix for the one-time (dumpfile), or as-required (live system), gathering of tasks from the kernel pid_hash[] in 2.6.24 and later kernels. Without the patch, if an entry in a pid_hash[] chain is not related to the "init_pid_ns" pid_namespace structure, any remaining entries in the hlist chain are skipped. * Update the "extensions/snap.mk" file to allow the "snap.so" extension module to be built outside of a crash source tree on a ppc64le PPC64 little-endian host. Without the patch, "make -f snap.mk" would fail to compile, indicating "gcc: error: macro name missing after '-D'" * Improve the method for determining whether a 32-bit ARM vmlinux is an LPAE enabled kernel by first checking whether CONFIG_ARM_LPAE exists in the vmcoreinfo data, and if it does not, by then checking whether the next higher symbol above "swapper_pg_dir" is 0x5000 bytes higher in value. * Fix "defs.h" for building extension modules outside of the crash utility source tree on PPC and PPC64 machines. Without the patch, both PPC and PPC64 will get #define'd if the extension module build procedure does not #define one or the other, which in turn causes multiple conflicting declarations. * Fix for the "ps" command performance degradation patch the was introduced in crash-7.0.8. Without this patch, it is possible that the "ps" command may fail prematurely with the error message "ps: bsearch for tgid failed: task:
tgid: " when running on a live system or against a "live" dumpfile. * Set the 32-bit ARM HZ value to a default value of 100 if the kernel was not configured with CONFIG_IKCONFIG. Without the patch, the initial system banner and the "sys" command show "UPTIME: (cannot calculate: unknown HZ value)", the "ps -t" option shows "RUN TIME: (cannot calculate: unknown HZ value)", and the "timer -r" option kills the crash session with a floating point exception. * Fix the error message displayed if the vmlinux or vmcore file is not the same endian as the crash utility binary. Without the patch the filename is shown with the incorrect/opposite endian type. * Update the "ps" command's "ST" task state display to recognize the TASK_PARKED state in Linux 3.9 and later kernels. Without the patch, the command's "ST" column entry for parked tasks shows "??". The state column will now show "PA", and the foreach command will accept "PA" as a "state" argument. * Fortify the protection against the use of an invalid/corrupted CONFIG_SLAB kmem_cache per-cpu array_cache.limit value during session initialization. In a recently seen vmcore, several of the array_cache.limit values were corrupted such that they were stored as negative values, which in turn caused the "kmem -[sS]" options to fail immediately with a dump of the internal memory buffer allocation statistics and the error message "kmem: cannot allocate any more memory!". * Implement a new "offline" internal crash variable that can be set to either "show" (the default) or "hide". When set to "hide", certain command output associated with offline cpus will be hidden from view, and the output will indicate that the cpu is "[OFFLINE]". The new variable can be set during invocation on the crash command line via the option "--offline [show|hide]". During runtime, or in a .crashrc or other crash input file, the variable can be set by entering "set offline [show|hide]". The commands or options that are affected when the variable is set to "hide" are as follows: o On X86_64 machines, the "bt -E" option will not search exception stacks associated with offline cpus. o On X86_64 machines, the "mach" command will append "[OFFLINE]" to the addresses of IRQ and exception stacks associated with offline cpus. o On X86_64 machines, the "mach -c" command will not display the cpuinfo_x86 data structure associated with offline cpus. o The "help -r" option has been fixed so as to not attempt to display register sets of offline cpus from ELF kdump vmcores, compressed kdump vmcores, and ELF kdump clones created by "virsh dump --memory-only". o The "bt -c" option will not accept an offline cpu number. o The "set -c" option will not accept an offline cpu number. o The "irq -s" option will not display statistics associated with offline cpus. o The "timer" command will not display hrtimer data associated with offline cpus. o The "timer -r" option will not display hrtimer data associated with offline cpus. o The "ptov" command will append "[OFFLINE]" when translating a per-cpu address offset to a virtal address of an offline cpu. o The "kmem -o" option will append "[OFFLINE]" to the base per-cpu virtual address of an offline cpu. o The "kmem -S" option in CONFIG_SLUB kernels will not display per-cpu data associated with offline cpus. o When a per-cpu address reference is passed to the "struct" command, the data structure will not be displayed for offline cpus. o When a per-cpu symbol and cpu reference is passed to the "p" command, the data will not be displayed for offline cpus. o When the "ps -[l|m]" option is passed the optional "-C [cpus]" option, the tasks queued on offline cpus are not shown. o The "runq" command and the "runq [-t/-m/-g/-d]" options will not display runqueue data for offline cpus. o The "ps" command will replace the ">" active task indicator to a "-" for offline cpus. The initial system information banner and the "sys" command will display the total number of cpus as before, but will append the count of offline cpus. Lastly, a fix has been made for the initialization time determination of the maximum number of per-cpu objects queued in a CONFIG_SLAB kmem_cache so as to continue checking all cpus higher than the first offline cpu. These changes in behavior are not dependent upon the setting of the crash "offline" variable. * Adjustment to the "offline" patch-set to make the initial system banner, the "sys" command, and the X86_64 "mach" command, to only show the "OFFLINE" cpu count if there are actually offline cpus. * Make the "bt -E" option conform to a "-c cpu(s)" specification when the the two options are used together. Without the patch, "bt -E" ignores a cpu specifier. * Fix for the determination of the cpu count on 32-bit ARM machines. Without the patch, if certain patterns of cpus are offline, the count may be too small, causing cpu-dependent commands to not recognize online cpus. * Fix for a missing exception frame dump by the X86_64 "bt" command when an IRQ is received while a task is running on its per-cpu interrupt stack with interrupts enabled. * Fix for the determination of the cpu count on ARM64 machines. Without the patch, if certain patterns of cpus are offline, the count may be too small, causing cpu-dependent commands to not recognize online cpus. * Fix for a possible SIGSEGV generated during session initialization while "please wait... (determining panic task)" is being displayed. This was caused by a patch introduced in crash-7.0.8, and can only happen when analyzing dumpfiles whose header does not contain the requisite information to determine the panic task and the active tasks do not have any crash-related traces in their kernel stacks. It should be noted that the SIGSEGV can be avoided by entering "--no_panic" on the crash command line. * Fix for a SIGSEGV generated by the "bt -a" or "help -r" commands if the NT_PRSTATUS notes in a compressed kdump are invalid/corrupt. If all cpus are online but the dumpfile initialization that cycles through the NT_PRSTATUS notes does not find exactly one note per cpu, then the register contents in those notes should not be used. * Fix for data access from "split" compressed kdump dumpfiles. Without the patch, if a dumpfile read targets physical memory in the first memory page stored in the second or later sequential split dumpfile, incorrect data will be returned. * Correction of the copyright and authorship of ramdump.c. * Added recognition of the new DUMP_DH_COMPRESSED_INCOMPLETE flag in the header of compressed kdumps, and the new DUMP_ELF_INCOMPLETE flag in the header of ELF kdumps. If the makedumpfile(8) facility fails to complete the creation of compressed or ELF kdump vmcore files due to ENOSPC or other error, it will mark the vmcore as incomplete. If either flag is set, the crash utility will issue a warning that the dumpfile is known to be incomplete during initialization, just prior to the system banner display. When reads are attempted on missing data, a read error will be returned. As an alternative, zero-filled data will be returned if the "--zero_excluded" command line flag is used, or the "zero_excluded" runtime variable is set to "on". In either case, the read errors or zero-filled memory may cause the crash session to fail entirely, cause commands to fail, or may result in other unpredictable runtime behavior. * If a kernel has been configured with CONFIG_DEBUG_INFO_REDUCED, then the crash utility will fail to initialize, typically with a message indicating "no debugging data available". However, it has been reported (on a 32-bit ARM system) that the initialization sequence continued on beyond that message point, and the session failed later on with the message "neither runqueue nor rq structures exist". As an aid to understanding why the session failed, if the target kernel is configured with CONFIG_IKCONFIG, and CONFIG_DEBUG_INFO_REDUCED has been set to "y", a relevant warning message will be displayed. * Implemented support for this Linux 3.18 commit for kernels that are configured with CONFIG_SLAB: commit bf0dea23a9c094ae869a88bb694fbe966671bf6d mm/slab: use percpu allocator for cpu cache The commit above redesigned the kmem_cache.array_cache[] from a hardwired array to a per-cpu pointer referencing external array_cache structures. Without the patch, the crash session would fail during initialization with the message "crash: cannot resolve cache_cache". Note that it could be worked around by using the "--no_kmem_cache" command line option, with a resulting loss of functionality for commands requiring slab-related data. * Implemented a new "sys -t" option that displays kernel taint information. If the "tainted_mask" symbol exists, the option will show its hexadecimal value and translate each bit set to the symbolic letter of the taint type. On kernels prior to 2.6.28 which had the "tainted" symbol, only its hexadecimal value is shown. The relevant kernel sources should be consulted for the meaning of the letter(s) or hexadecimal bit value(s). * Cosmetic fix for the "help -[n|D]" translation of the bitmap contents of the kdump_sub_header.dump_level flag in compressed kdump dumpfiles. * Fix for the support of compressed kdump clones created with the KVM "virsh dump --memory-only --format " command, where the compression-type is either "kdump-zlib", "kdump-lzo" or "kdump-snappy". Without the patch, if an x86_64 guest kernel was loaded with a non-zero "phys_base", the "--machdep phys_base=" command line option was required as a workaround or the crash session would fail with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". -- Troy Heber Mon, 27 Apr 2015 08:28:11 -0600 crash (7.0.8-1) unstable; urgency=medium * Fix for the handling of 32-bit ELF xendump dumpfiles if the guest was configured with more than 4GB of memory. Without the patch, the crash session may fail during initialization with the error message "crash: vmlinux and do not match!". * Fix for file-handling errors when a compressed vmlinux.debug file is followed by a vmlinux file on the crash command line. When the crash session ends, two errors will occur: (1) the vmlinux file will be deleted (2) the temporary uncompressed version of the vmlinux.debug file will remain in /var/tmp This problem also occurs in the highly unlikely case where a compressed vmlinux file is followed by a vmlinux.debug file on the command line, and the uncompressed temporary version of the vmlinux file is larger than the vmlinux.debug file. In that case: (1) the vmlinux.debug file will be deleted (2) the temporary uncompressed version of the vmlinux file will remain in /var/tmp * Fix for the "search -t" option if the system has 2064 or more tasks. Without the patch, the command fails with a dump of the crash utility memory allocation statistics, ending with "search: cannot allocate any more memory!". * Fix for the "mod -S" command to find the debuginfo data for Red Hat "kpatch" modules. Without the patch, the command would display "mod: cannot find or load object file for module". * Deprecated the "mount -f" option for Linux 3.13 and later kernels containing commit eee5cc2702929fd41cce28058dc6d6717f723f87, which removed the super_block.s_files list_head member and the open files list that it contained. Without the patch, the command option fails with the error message "mount: invalid structure member offset: super_block_s_files" * If a compressed kdump is damaged/truncated such that the bitmap data in the dumpfile header is not contained within the file, attempts to analyze it with a vmlinux file, or using the "crash --osrelease" or "crash --log" options with just the vmcore, will result in the crash utility spinning forever, endlessly performing reads of 0 bytes from the file without recognizing the EOF condition. * Fix for an ARM64 compilation failure of the embedded gdb file "aarch-linux-nat.c" in the Fedora fc21 rawhide environment, which uses glibc-headers-2.19.90-24.fc21. * Document the reason behind the deprecation of the "mount -f" option for Linux 3.13 and later kernels if the option is attempted, and in the "help mount" output, similar to the deprecated "mount -d" option. * During initialization, reject useless ARM64 "(A)" absolute symbols that begin with "__crc_". Without the patch, several thousand of them may be displayed by "sym -l" prior to the first kernel virtual address symbol. * When running against an ARM64 dumpfile created with the "snap.so" extension module, do not attempt to read the crash_notes. Since the dumpfile was taken while running on a live system, the crash_notes, if configured into the kernel, would not contain valid data. Without the patch, the message "WARNING: could not retrieve crash_notes" is displayed during session initialization. * Determine the various ARM64 kernel virtual address ranges using the kernel's VA_BITS value. It currently is hardwired in the kernel to one of two values depending upon whether 4K or 64K pages are configured. However, there are plans to support 16K paqes, to make VA_BITS a configurable value, and to make the number of page-table levels configurable. Towards that end, the crash utility has been changed to determine the VA_BITS value based upon known kernel virtual addresses, and to then calculate the relevant kernel virtual address ranges on that value instead of hardwiring them based upon the page size. * Enhancement to the "kmem -S" option for Linux 3.2 and later kernels configured with CONFIG_SLUB to display the address of each per-cpu kmem_cache_cpu address and the contents of its per-cpu partial list. * If an ARM or ARM64 dumpfile does not contain the register sets of the active tasks in the kernel's per-cpu crash_notes, there is an initialization-time warning message indicating "could not retrieve crash_notes". It has been changed to a more meaningful warning message indicating "cannot retrieve registers for active tasks". * Implement support for ARM and ARM64 raw RAM dumpfiles. One or more "ramdump" files may be entered on the crash command line in an ordered pair format consisting of the RAM dump filename and the starting physical address expressed in hexadecimal, connected with an ampersand: $ crash vmlinux ramdump@address [ramdump@address] A temporary ELF header will be created in /var/tmp, and the combination of the header and the ramdump file(s) will be handled like a normal ELF vmcore. The ELF header will only exist during the crash session. If desired, an optional "-o " may be entered to create a permanent ELF vmcore file from the ramdump file(s). * Fix for the "help -[nD]" ELF header translation to recognize the EM_ARM and EM_AARCH values as "e_machine" types, and ELFOSABI_LINUX as an "e_ident[EI_OSABI]" type. Without the patch, the e_machine translation would show "40 (unsupported)" for 32-bit ARM, or "183 (unsupported)" on ARM64; and the ELFOSABI_LINUX type would be translated as "3 (?)". * Re-run a command in the history list by entering an "!" followed by the number identifying the command. However, unlike the similar "r" pseudo-command, if the number is a command name in the user's PATH, maintain the current behavior and execute that command. * Fix to recognize that the live system "crash.ko" memory driver may be compressed and named "crash.ko.xz". Without the patch, the driver is not recognized and loaded, and as a result the /dev/mem driver and/or /proc/kcore will be tried as the live memory source. * On a live system during session initialization, delay the first read error message (typically when reading the "cpu_possible_mask") until it is confirmed that all of the following are true: (1) /dev/crash does not exist, and (2) /dev/mem is restricted via CONFIG_STRICT_DEVMEM, and (3) /proc/kcore cannot be read/accessed. The "kernel may be configured with CONFIG_STRICT_DEVMEM" and the "trying /proc/kcore as an alternative" messages will still be displayed when appropriate. The read error message be displayed only if all three live memory read options fail. * Fortify the validity verification of the data structures traversed by the "kmem [-sS]" options for kernels configured with CONFIG_SLUB. Without the patch, the contents of several structure members are not validated, and may generate bogus or never-ending output, typically seen when running the commands on a "live dump" where the dumpfile was taken while the kernel was still running. The patch aborts the relevant parts of per-kmem_cache output when invalid data is encountered or if an object list contains duplicate entries, and error messages have been enhanced to more accurately describe the issues encountered. * Implement support for the ppc64le PPC64 little-endian architecture. Since this required a large number of patches to be applied to architecture-neutral files in the gdb-7.6 tree, the changes are only applied if the host build system is a ppc64le. * Fix for SMP active task register-gathering from "kvmdump" dumpfiles that were created with a cpu version id of 12 or greater that contain additional XSAVE related fields in their cpu device headers. Without the patch, active tasks running on cpus above 0 may have truncated backtraces. * Maintain backwards-compatibility for "kvmdump" dumpfiles that were created by older development versions of KVM tools in which the cpu version id was 12, but the cpu device headers did not contain the additional XSAVE related fields. * Address a "ps" command performance degradation that was introduced by a crash-7.0.4 patch which added per-thread task_struct.rss_stat page counts to the task's mm_struct.rss_stat page counts in order to show an accurate/synchronized RSS value. Without the patch, the "ps" command performance would degrade as the number of tasks increased, most notably when there were thousands of tasks. -- Troy Heber Wed, 17 Sep 2014 08:30:13 -0600 crash (7.0.7-1) unstable; urgency=low * Export the static ELF and compressed kdump vmcoreinfo_read_string() functions from netdump.c and kdump.c via a new read_vmcoreinfo() method in the global program_context structure. The function get_log_from_vmcoreinfo() will access vmcoreinfo data via the new pointer instead of requiring its callers to pass pointers to their dumpfile-specific function. * Linux 3.15 and later kernels configured with CONFIG_RANDOMIZE_BASE can be now be readily identified because of new kernel symbols that have been added. For those kernels, the new "--kaslr=" and/or "--kaslr=auto" options are not necessary for ELF or compressed kdump vmcores, or for live systems that have /proc/kallsyms showing the relocated symbol values. A new KASLR initialization function called kaslr_init() is now called by symtab_init() prior to the initial symbol-sorting operation. If kaslr_init() determines that KASLR may be in effect, it will trigger a search for the relevant vmlinux symbols during the sorting operation, which in turn will cause the relocation value to be automatically calculated. * Implemented a new "bt -c cpu(s)" option to display the backtrace of the active task on one or more cpus. The cpus must be specified in a comma- and/or dash-separated list; for examples ""3", "1,8,9", "1-23", or "1,8,9-14". Similar to "bt -a", the option is only applicable with crash dumps. * Fix for Linux 3.11 and later ARM kernels, in which all non-panicking cpus offline themselves during a kdump procedure. This causes an invalid cpu count determination during crash session initialization from an ARM vmcore. The patch utilizes the cpu count found in the cpu_active_map if it is greater than the count in the cpu_online_map. In addition, the maximum NR_CPUS value for the ARM architecture has been raised from 4 to 32. * Fix for the X86_64 "bt" command on Linux 3.3 and later kernels to properly display exception frame register contents on NMI stacks. Kernel commit 3f3c8b8c4b2a34776c3470142a7c8baafcda6eb0 added 12 more values to the NMI exception stack to handle nested NMIs caused by page faults or breakpoints that could occur while handling an NMI exception. * Kernel commit 28696f434fef0efa97534b59986ad33b9c4df7f8 changed the stack layout again, swapping the location of the "saved" and "copied" registers. This can be detected automatically, because the "copied" registers contain either a copy of the "saved" registers, or point to "repeat_nmi". So, if "repeat_nmi" is found as the return address, assume that this is the old layout, and adjust the stack pointer again. Without the patch, incorrect register values are displayed in the exception frame dump in the NMI stack backtrace. * Fix for the built-in "g" alias, which apparently has not worked correctly since crash-5.1.4. Without the patch, if the "g" alias and the first argument are separated by one space, then the first first character of that argument would get stripped prior to being passed to the embedded gdb module. * Removed the BASELEVEL_REVISION string from defs.h, which serves no purpose since the deprecation of the remote daemon, and typically has been out of sync with the crash version. * Fix for the "p", "irq", "struct", "union" and "*" commands if a cpu specification contains an invalid cpu number. Without the patch, a segmentation violation may be generated. * Implemented a new capability for the "ptov" command that takes a per-cpu offset and cpu specification argument and translates it into the kernel virtual addresses for the cpus specified. * Implemented a new "ps -m" option that is a similar, complementary option to "ps -l", but which translates the task timestamp value from a decimal or hexadecimal nanoseconds value into a more human-readable string consisting of the number of days, hours, minutes, seconds and milliseconds that have elapsed since the task started executing on a cpu. More accurately described, it is the time difference between the timestamp copied from the per-cpu runqueue clock when the task last started executing compared to the most current value of the per-cpu runqueue clock. * In addition, a new "ps -C " option has been added that can only be used with "ps -l" and "ps -m", which sorts the global task list into per-cpu blocks; the cpu-specifier uses the standard comma or dash separated list, expressed as "-C 1,3,5", "-C 1-3", "-C 1,3,5-7,10", or "-Call" or "-Ca" for all cpus. * Implemented a new "runq -m" option that is a simliar, complementary option to "runq -t", but which displays the amount of time that the active task on each cpu has been running, expressed in a format consisting of days, hours, minutes, seconds and milliseconds. * Implemented a new "kmem -h" option that displays the address of each hugepage hstate array entry, its hugepage size, its free and total counts, and name string. * Implemented a new "ps -S" option that displays a summary consisting of the number of tasks in a task state. * Fix for the "arguments-input-file" feature to protect against a called command modifying an argument string. For example, the "struct" command modifies "-l struct_name.member" argument strings, and so without the patch, all iterative calls after the first one will fail. * Fix failure to build from source when compiling the crash utility with gcc-4.9 (closes: #746835) * Fix for displaying enum values that are greater than 32-bits in size. Without the patch, the upper 32-bits are clipped off and displayed as integer-sized value. * If the kernel (live or dumpfile) has the "kpatch" module installed, the tag "[KPATCH]" will be displayed next to the kernel name in the initial system banner and by the "sys" command. * Fix for the "DEBUG KERNEL:" display in the initial system banner and by the "sys" command when using a System.map file with a Linux 3.0 and later debug kernel. Without the patch, the kernel version is not displayed in parentheses following the debug kernel name. * If the gdb-.patch file has changed and a rebuild is being done from within a previously-existing build tree, "patch -N" the gdb sources, and start the rebuild from the gdb- directory instead of the gdb-/gdb directory. * Fix to prevent a possible segmentation violation generated by the "runq -g" command when run on a very active live system due to an active task on a cpu exiting while the command is running. * Fix for the "runq -g" command on Linux 3.15 and later kernels, where the cgroup_name() function now utilizes kernfs_name(). Without the patch, the command fails with the error message "runq: invalid structure member offset: cgroup_dentry". * Fix for the "extend" command when running with an x86_64 crash binary that was built with "make target=ARM64" in order to analyze ARM64 dumpfiles on an x86_64 host. Without the patch, if the extend command is used with an extension module built in the same manner, it fails with the message "extend: .so: not an ELF format object file". * Introduce support for 32-bit ARM kernels that are configured with CONFIG_ARM_LPAE. The patch implements the virtual-to-physical address translation of 64-bit PTEs used by ARM LPAE kernels. -- Troy Heber Mon, 16 Jun 2014 10:24:39 -0600 crash (7.0.6-1) unstable; urgency=low * Fix for custom X86_64 kernels that change the declaration of the context_switch() function so that it is not an inline function. Without the patch, the message "crash: cannot determine thread return address" is displayed during invocation, and backtraces of blocked tasks may have missing or invalid frames. * Fix to prevent a possible invocation-time error on Linux 3.7 and later kernels configured with CONFIG_SLAB, running against vmcore files filtered with the makedumpfile(8) facility. Without the patch, the message "crash: page excluded: kernel virtual address:
type: kmem_cache buffer" is immediately followed by the message "crash: unable to initialize kmem slab cache subsystem". Because of a kernel data structure name change from "cache_cache" to "kmem_cache_boot", the crash utility failed to properly downsize the stored size of the kernel's kmem_cache data structure from the size indicated by the vmlinux debuginfo data. This in turn could lead to reading beyond the end of a kmem_cache data structure into a page of memory that had been excluded from the vmcore. The fix was also applied to kernels configured with CONFIG_SLUB. * Added a new "--kaslr " command line option for X86_64 kernels that are configured with CONFIG_RANDOMIZE_BASE. The offset value must be equal to the difference between the symbol values compiled into the vmlinux file and their relocated KASLR values. * Added a new "--kaslr=auto" command line option for X86_64 kernels that that are configured with CONFIG_RANDOMIZE_BASE. When set to "auto", the KASLR relocation value will be determined automatically by comparing the "_stext" symbol value compiled into the vmlinux file with the _stext symbol value stored in kdump vmcoreinfo data; on live systems the comparison will be made with the "_stext" symbol value that is found in /proc/kallsyms. * Enable kernel text line number capability for the "dis -l", "bt -l", "sys -c", and "sym" commands for kernels that are configured with CONFIG_RANDOMIZE_BASE. * Fix for the "crash --log vmcore" command to account for the kernel data structure and VMCOREINFO string name changes from "log" to "printk_log" in Linux 3.11-rc4 and later kernels. Without the patch, the command fails with the error message "crash: VMCOREINFO: no log buffer data". * Adjustment to the internal symbol-handling to prevent the usage of kernel system call alias/wrapper names, for examples, "SyS_read" and "compat_SyS_futex" instead of "sys_read" and "compat_sys_futex". Without the patch, commands such as "dis", "sym
", and "sys -c" display the alias/wrapper name instead of the real system call name in Linux 3.10 and later kernels. * Increase the internal hash queue head count from 128 to 32768. The hash queue is used for gathering and verifying lists, and the original count of 128 may be overwhelmed if a list is extremely large. For example, on a 256GB system with 192GB of free pages, the "kmem -f" command takes hours to complete; with this patch, the time is reduced to a few minutes. In addition, a new command line option "--hash " has been added to allow a user to override the default hash queue head count of 32768. * Fix for the "kmem -F" display and the "kmem -f
" or "kmem
" options. Without the patch, "kmem -F" does not display the first page in a list of free page blocks on its own line, but rather at the end of the previous line that shows the area number, block size, and free_area struct address that the page is linked to. Due to this error, both "kmem -f
" and "kmem -f address>" would not find the associated page or page block if it happened to be the first page or page block in the list. * Created a new feature for the internal do_list() function if it is necessary to immediately perform a function for each entry in a list while the list is being traversed. A callback function, and an option callback data pointer, can be registered in the list_data structure. The address of each entry in the list along with the optional callback data pointer will be passed to the callback function. If desired, the callback function may also dictate that do_list() should stop the list traversal and return immediately to its caller. * Made the "kmem -f
" and "kmem
" options more efficient by using the new do_list() callback function feature above as well as restricting the search to only the NUMA node that contains the address. * If the first assembly language instruction in an X86_64 function is "nopl 0x0(%rax,%rax,1)" or "data32 data32 data32 xchg %ax,%ax", which are generated when the ftrace facility is configured, the X86_64 "dis" command will append "[FTRACE NOP]" to the line. * Correction for the "crash -h" and crash.8 man page documentation of the "--machdep phys_base=" command line option. In both places the parameter mistakenly indicated "physbase". * If a host build system does not have /usr/bin/wget installed, and the crash package is built from a directory that was git-cloned from github.com/crash-utility/crash.git, the error message has been clarified to indicate "/usr/bin/wget is required to download gdb-7.6.tar.gz". Without the patch, the message indicates "tar (child): gdb-7.6.tar.gz: Cannot open: No such file or directory". * Updated the ARM64 implementation to support Linux 3.13 and later kernels that expand to a 42-bit address space when 64K pages are configured. This is also the first crash version that has been tested on a live ARM64 system with 4K pages, where it cleanly make it to the "crash>" prompt. However, it should be noted that some commands (most notably "bt") still do not work as of yet. * Document the "--machdep phys_offset=" command line option for the ARM64 architecture in the crash.8 man page and the "crash -h" output. * Fix for KVM dumpfiles created with "virsh dump --memory-only" if an X86_64 kernel was loaded with a non-zero "phys_base". Without the patch, the crash session fails with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". * Initial working implementation of the basic ARM64 "bt" command, with several command options still under development. In-kernel exception frames are only dumped if the exception handler function is contained within the symbol boundaries from "__exception_text_start" to "__exception_text_end"; when ARM64 kdump is eventually implemented, further exception-related work will be resumed. * Cleaned up the exception frame displays of 64-bit in-kernel and both 32-bit and 64-bit user-mode exceptions. * Implemented support for the ARM64 "bt -e" option. * Implemented support for the ARM64 "bt -l" option. * Update for the X86_64 "bt -l" option such that it also displays the available file and line number information for functions indicated as the "exception RIP" in kernel exception frames. The line number information will follow the exception frame register dump. * Fix for the ARM64 virtual-to-physical translation of vmemmap page structure addresses for kernels configured with 4K pages. Without the patch, any command that required the contents of a page structure would fail with a readmem error. * Added support for the ARM64 architecture in the extensions/snap.c extension module. Also fixed the progress percentage display to correct for systems which have non-zero starting physical addresses. * Implemented support for the ARM64 "bt -f" and "bt -F[F]" options. * Increase the ARM64 PTRS_PER_PGD_L2_64K from 1024 to 9182 to account for the Linux 3.13 increase of the ARM64 virtual address space size from 39 to 42 bits when 64K pages are configured. Without the patch, the warning message "WARNING: cannot access vmalloc'd module memory" is displayed during session initialization. * Fix for the "vm -p" option on ARM64 so that file-backed pages are properly translated to the filename and offset. Without the patch, file-backed pages are erroneously shown as being backed on a swap device. * Increment maximum ARM64 physical address from 40 to 48 bits to match upstream kernel commit 87366d8cf7b3f6dc34633938aa8766e5a390ce33. * Fix for a segmentation violation generated by the "crash -g vmlinux" command on ARM64. * Fix for the ARM64 "vtop
" command on kernels configured with 64K pages if the address argument is located in the kernel logical memory map region, which uses 512MB hugepage mappings. Without the patch, the verbose page table walk mistakenly continues to the PTE level. * Fix for ARM64 /proc/kcore support. Without the patch, the crash session fails with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". At this point in time, the kernel requires a patch to the ARM64 kern_addr_valid() function to properly allow memory to be read from the kernel logical memory map region. -- Troy Heber Thu, 05 Jun 2014 09:26:32 -0600 crash (7.0.5-1) unstable; urgency=low * New upstream version 7.0.5 * Fix for the "runq -g" option for kernels that are configured with CONFIG_FAIR_GROUP_SCHED, but not CONFIG_CFS_BANDWIDTH. Without the patch, the command fails with the message "runq: invalid structure member offset: cfs_rq_throttled". * Add support for Xen PVH guest types introduced in Xen 4.4. Without the patch, running against a Xen 4.4 hypervisor binary would fail during session initialization with the error message "crash: invalid structure member offset: domain_is_hvm". In addition, the PVH guest type is being registered internally as an HVM guest type, the debug "help -X ofs" command's display of the domain_domain_flags offset has been fixed to show it in decimal, and the setting of the internal dc->domain_flags has been fixed to contain all flags set, not just the first one found. * Fix for the "kmem -S" command on Linux 3.1 and later kernels that are configured with CONFIG_SLUB. Because the the page structure's inuse and objects fields used by SLUB were changed from discrete u16 types to bit-fields within an unsigned int, the display of per-node partial slab statistics are incorrect. Without the patch, the TOTAL and ALLOCATED values are incorrectly shown as equal values, and therefore the FREE value is always zero. * Fix for the "kmem -S" command for kernels that are configured with CONFIG_SLUB. Eash per-cpu slab object dump may show incorrect ALLOCATED and FREE values; and as seen on Linux 3.5 and later kernels, the TOTAL value and the number of individual objects dumped may also be incorrect (too small). * When executing the commands from an input file specified by the "-i " command line option, or when accepting input from a file as a set of commands or as a set of command arguments using the "<" redirection character, unconditionally cease the operation if CTRL-c is entered. Without the patch, depending upon the command that was running when the SIGINT was received, the operation may continue uninterruptibly until the file contents are consumed. * Enhanced the "bt -F" option such that if "-F" is entered twice, and if the stack frame contents reference a slab cache object, both the slab cache name and the stack contents will be displayed within brackets. * Enhanced the "rd -S" option such that if "-S" is entered twice, and if the memory contents reference a slab cache object, both the slab cache name and the memory contents will be displayed within brackets. * Fix for the X86_64 "bt" command to prevent an unwarranted message indicating "WARNING: possibly bogus exception frame" generated from a blocked kernel thread that was in the process of exec'ing a user process via the call_usermodehelper() facility. * Fix for the X86_64 "bt" command to more correctly determine the function frame that called into an interrupted function. Without the patch, the first frame just above an IRQ exception frame register dump may show an invalid/stale function. * Fix for the X86_64 "bt" command if a page fault exception was generated by the invalid contents of the RIP register. Without the patch, the exception frame register dump is not displayed above the "page_fault" stack frame; and in a related issue, the "bt -e" option will not find and display the exception frame. * When invoking a crash session with a compressed vmlinux file, make the same host-machine/vmlinux endian verification that is done with uncompressed vmlinx files. * Reduce the number of CTRL-c entries required to unconditionally terminate any manually-entered command from three to one. * Fix for the X86_64 "bt" command if an async page fault exception occurred in a KVM guest running a Linux 2.6.38 or later kernel. Without the patch, the exception frame register dump is not displayed above the "async_page_fault" stack frame. -- Troy Heber Mon, 14 Apr 2014 14:59:30 -0600 crash (7.0.3-3) unstable; urgency=low * Add autopkgtest and try to keep the Debian and Ubuntu crash packages in sync (closes: #721095) -- Troy Heber Thu, 07 Nov 2013 08:14:34 -0700 crash (7.0.3-2) unstable; urgency=low * Fix from Louis Bouchard to resolve FTBS on i386 -- Troy Heber Wed, 06 Nov 2013 09:41:06 -0700 crash (7.0.3-1) unstable; urgency=low * Fix for the ARM architecture if the backtrace unwind information cannot be gathered during session initialization. Without the patch, the two unwind-related warning messages indicating "WARNING: UNWIND: failed to gather unwind_table list" and "WARNING: UNWIND: failed to initialize module unwind tables" are followed by the fatal error message "crash: cannot hash task_struct entries". * Fix for the "help -[Dn]" dumpfile information display of the GUID EFI table in the header of SADUMP dumpfiles. Without the patch, only 33 of the 36 bytes in the table are translated. * Fix for the determination of the kernel NR_CPUS configurable for Linux 3.8 and later kernels that are configured with CONFIG_SLAB. Without the patch, the kernel's compiled-in NR_CPUS value was incorrectly calculated to be the sum of the kernel's NR_CPUS and MAX_NUMNODES configurables. * In the next release of makedumpfile, the status field of the dumpfile header of compressed kdumps will show the compression type that was utilized. The "help -[Dn]" output has been updated to display that information. * For kernels configured with CONFIG_SLAB in which an array_cache pointer referenced by a kmem_cache structure is invalid, the individual cache(s) will be marked as invalid. During session initialization, the message "crash: kmem_cache: : invalid array_cache pointer" will be displayed, and during runtime, attempts to access the cache(s) will result in a message indicating that the cache is "[INVALID/CORRPUTED]". Without the patch, the message "crash: unable to initialize kmem slab cache subsystem" is displayed during session initialization, and run-time commands that attempt to access the kmem slab cache subsystem fail with the error message "kmem cache slab subsystem not available". * Fix for the "kmem -[sS] " option in Linux 3.6 and later kernels configured with CONFIG_SLAB. Without the patch, the command fails with the message "kmem: address is not allocated in slab subsystem: . This also causes the "kmem " command to (quietly) fail to determine that the address is a slab object. * Fix for the "bt" command if a kernel __init text address is encountered. Without the patch, and depending upon the reallocation of the __init text memory, a bogus framesize may be calculated, or more likely, in a compressed kdump, a warning message indicating "bt: page excluded: kernel virtual address:
type: gdb_readmem_callback" will be displayed following the frame data. * Update for determining whether an S390X PTE contains a swap entry in Linux 3.12 and later kernels. * Resurrected the translation and display of the page.flags bits by the "kmem -p" command on Linux 2.6.26 and later kernels whose vmlinux debuginfo data contains either the "pageflags" enumerator or the "pageflag_names" array of trace_print_flags structures. If they are not available, just the page.flags value is printed in hexadecimal, as has been done since Linux 2.4.9. * Fix for the "bt" command when used with vmcore files that were created with the recently-introduced "virsh dump --memory-only", which dumps KVM guests into an ELF vmcore similar to those created by the kdump facility. Without the patch, a faulty backtrace for the panic task may be generated due to the use of incorrect starting RSP/RIP registers; this happens because (unlike kdump) the non-panicking cpus are offlined prior to the dumpfile being created, which in turn leads to the use of the wrong NT_PRSTATUS note. * Fix for the CPU number display on systems with 255 or more cpus during the initial banner, by the "set" command, the "ps" command, and by all commands that display the per-task header consisting of the task address, pid, cpu and command name. Without the patch, for cpu 255, the "sys" command displays "NO_PROC_ID", and the other commands would show a "-" for the cpu number; for cpu numbers greater than 255, garbage values would be displayed in the cpu number field. * Implemented support for compressed kdump header version 6, in which makedumpfile(8) adds new fields in the kdump_sub_header to support large memory systems with pfn values that are larger than 32-bits. Without the patch, if the system contains physical memory located in high memory such that its maximum pfn value is overflows the 32-bit "max_mapnr" field in the header, the crash session will fail with the error message "crash: vmlinux and vmcore do not match!". * Fix for the "net -s" command on Linux 3.8 and later kernels. Without the patch, the command fails with the message "net: invalid structure member offset: inet_opt_daddr". * Fix a build failure in a native ARM64 environment due to obsolete LKCD dumpfile headers. * Implementation of a new "per-cpu object" as an argument format that can be passed to the "p", "struct", "union" or "*" commands. The format is expressed as either : or as :, where the per-cpu symbol or per-cpu offset must precede a colon, and where the follows the colon. Without the patch, per-cpu symbols are only accepted by the "p" command, and the data type and the resolved kernel virtual address for each per-cpu instance are displayed shown. With this patch, a colon and a cpu-specifier may be appended to the symbol name, and the the contents of the symbol on each cpu that is specified will be displayed by the "p" command. For the "struct/union/*" commands, an argument may be specified using either a per-cpu offset value or per-cpu symbol name followed by a colon and cpu-specifier, and the contents of each structure/union on each specified cpu will be displayed. Fixed several minor flaws that were detected by a Coverity Scan. -- Troy Heber Wed, 30 Oct 2013 16:12:40 -0600 crash (7.0.2-1) unstable; urgency=low * Added "bison" to the BuildRequires line of the crash.spec file. Without the patch, the build of the embedded gdb-7.6 module will fail unless either /usr/bin/bison or /usr/bin/yacc are available. The failure will result in a stream of error messages from different files that indicate: multiple definition of 'main' undefined reference to 'c_parse_escape' undefined reference to 'ada_parse' undefined reference to 'ada_error' undefined reference to 'c_parse' undefined reference to 'c_error' undefined reference to 'cp_demangled_name_to_comp' undefined reference to 'cp_demangled_name_parse_free' undefined reference to 'cp_comp_to_string' undefined reference to 'cp_new_demangle_parse_info' and the build fails like so: collect2: ld returned 1 exit status make[4]: *** [gdb] Error 1 crash build failed If building with rpmbuild, the new BuildRequires "bison" entry will prevent the build from initiating unless the bison package has been installed. If building with the tar.gz file, the build attempt will proceed and fail unless either the bison or byacc (Berkeley Yacc) package is installed. * Fix the S390X initialization sequence on kernels that are configured with CONFIG_STRICT_DEVMEM to automatically try /proc/kcore if: (1) the /dev/crash driver is not available, and (2) the initial /dev/mem access fails. Without the patch, if /dev/mem is selected as the memory source and it is restricted, the crash session will fail during initialization with the error message "crash: read error: kernel virtual address:
type: cpu_possible_mask". * When checking whether a argument on the crash command line is a dumpfile that may be in makedumpfile's "flattened" format, do not bother checking character device files. * Fix for the PPC64 virtual-to-physical virtual address translation mechanism for vmalloc and user-space virtual addresses on Linux 3.10 and later kernels. Without the patch, the message "WARNING: cannot access vmalloc'd module memory" is displayed during initialization, and during the crash session, if a command attempts to translate or read a vmalloc or user-space virtual address, it will fail. * Clean up all files that emit "warning: format not a string literal and no format arguments" when compiled with -Wformat-security warning option. All instances of fprintf, sprintf and snprintf using the format "fprintf(fp, buf)" are replaced with "fprintf(fp, "%s", buf)". Also, the -Wformat-security warning option has been added to the option list used when compiling with "make warn". * Fix a build failure when compiling with very old gcc-3.4.6 version on a 2.6.9-based RHEL4 IA64 host. The bfd library in gdb-7.6 is compiled with the -Werror option, and it fails with the message "elflink.c:4733: warning: 'idx' might be used uninitialized in this function". * Fix a build failure when compiling with very old gcc-3.4.6 version on a 2.6.9-based RHEL4 S390 or S390X hosts. The embedded gdb-7.6 fails to compile with the error message "s390-nat.c:364: error: storage size of 'iov' isn't known". * Fix to properly store two-digit kernel version numbers. (closes: #717036) * Fix to provide hugepage address translation for the "vtop" command on the PPC64 architecture. * Fix for the "log" command to account for the kernel data structure name change from "log" to "printk_log" in Linux 3.11-rc4 and later kernels. Without the patch, the message "WARNING: log buf data structure(s) have changed" will be displayed during initialization and by the "log" command. * Fix to add a linefeed after the description of the "kmem -I" option in the "help kmem" output, which was recently added in crash-7.0.0. * Document the "-s" command line option in the "crash -h|--help" output and in the crash.8 man page to also indicate that runtime command scrolling is turned off by default. * Fix for the "irq -d" option on 2.6.25 and later X86_64 kernels to display the Intel interrupt descriptor table contents. Without the patch, those kernel versions would display "irq: -d option not supported or applicable on this architecture or kernel". * Fix for the "kmem -[sS]" options on Linux 3.11-rc1 and later kernels that are configured with CONFIG_SLAB. Without the patch, the command fails with the error message "kmem: invalid structure member offset: * Fix for the "kmem
" and the "bt -F" options on Linux 3.8 and later kernels that are configured with CONFIG_SLUB. Without the patch, the command would fail with the error message "kmem: invalid structure member offset: page_slab". * Fix misspellings in the "bt" and "search" help page output. * Fix for the determination of the base of the kernel's unity-mapped virtual address region on recent ARM kernels whose "_stext" variable address has changed from 0xc0008000 to 0xc0100000. Without the patch, the crash session fails during invocation with the error message "crash: vmlinux and vmcore do not match!". * When printing data structures, prevent the embedded gdb from symbolically translating pointers that are not kernel virtual addresses. Kernel or module symbols that are not virtual addresses can be mistaken for virtual addresses, leading to NULL pointers being invalidly translated into a symbol name from the vmlinux or module object file. For example, in X86_64 kernels, NULL pointers are translated into the symbol "irq_stack_union", whose value is not a virtual address, but rather a per-cpu offset value of 0. * Fix for the "kmem -s
" or "kmem
" options on Linux 3.11 and later kernels configured with CONFIG_SLAB. Without the patch, both commands fail with the error message "kmem: cannot resolve cache_cache". * Fix to prevent the "bt" command from generating a segmentation violation in a case where the per-cpu "current_task" variable and the runqueue's "curr" variable did not agree, and the panic task had overflowed its kernel stack. This led to the selection of the a starting RSP address which belonged to the other task; without the patch, the command generated a segmentation violation after printing the first frame of the backtrace. -- Troy Heber Wed, 16 Oct 2013 10:26:33 -0600 crash (7.0.1-3) unstable; urgency=low * Updated format-strings patch to cover additional architectures * Requested update to packages-arch-specific to enable s390x and armel (#717283) -- Troy Heber Tue, 16 Jul 2013 07:00:41 -0600 crash (7.0.1-2) unstable; urgency=low * Missed updating the Architecture line in the -1 upload, armel (closes: #656132) * Move defs.h to /usr/include/crash (closes: #702513) * Patch from Stefan Bader to add a format string to all *printf calls -- Troy Heber Thu, 11 Jul 2013 08:51:32 -0600 crash (7.0.1-1) unstable; urgency=low * Enable armel (closes: #656132) * Enable s390x (closes: #710675) * Include the crash/defs.h header (closes: #702513) * Sync with the Ubuntu crash package, build crash extensions, SPU has been dropped (closes: #584119), lpia has been dropped (closes: #504522). * Fix the -I include path sequence in the extensions/eppic.mk file to prevent a series of "redefined" and "redeclaration" warnings when compiling the EPPIC extension module. * Address two compile-time warnings generated as a result of the gdb*7.6.patch. Without the patch, there are "warning: no previous prototype" warnings for gdb_main_entry() and replace_ui_file_FILE(). * Implemented a new "mod -t" option that walks through the installed modules and checks for non*zero values in each module's "taints" bitmask, and translates the bits into symbolic letters if possible, or shows the hexadecimal value of the bitmask if not. In older kernels, the "license_gplok" field is checked, and if non*zero, its value is displayed in hexadecimal. Lastly, if the "gpgsig_ok" member exists and is zero, a "(U)" notation will also be displayed. * Fixed compiler warnings generated by extensions/trace.c when compiled with *DFORTIFY_SOURCE=2. Without the patch, the messages "warning: ignoring return value of 'mktemp', declared with attribute warn_unused_result", "warning: ignoring return value of 'fwrite', declared with attribute warn_unused_result", and "warning: 'trace_dat' may be used uninitialized in this function" are generated. * Laid down the basic infrastructure for the ARM64 backtrace facility using the kernel's arm64 unwind facility as a basis. Compile*tested only. * Implemented the ARM64 virtual-to-physical kernel and user address translation functions, supporting both 2*level page tables with 64K pages, and 3*level page tables with 4K pages. Also added the associated PTE translator function. Compile*tested only. * Implemented the capability of building crash as an x86_64 binary for analyzing ARM64 dumpfiles on an x86_64 host, which can be done by entering "make target=ARM64". After the initial build is complete, subsequent builds can be done by entering "make" alone. * Added "aarch64" to the ExclusiveArch: line in the crash.spec file. * Fix for the S390X "bt" command for Linux 3.10 and later kernels. Without the patch, the starting stack location of the per*cpu async and panic stacks of active tasks would be incorrectly determined. -- Troy Heber Tue, 18 Jun 2013 13:38:49 -0600 crash (7.0.0-1) unstable; urgency=low * Updated the embedded gdb version to FSF gdb-7.6, which was officially released by the Free Software Foundation on http://www.gnu.org on 4/26/13. The primary motivation for upgrading from gdb-7.3.1 is for future ARM64 support, but there are also issues with respect to kernels built with gcc-4.8.0. The relevant pieces of gdb-7.3.1.patch were forward-ported to the gdb-7.6.patch, and the GDB_7_6 #define has been applied in the top-level sources where appropriate. * Continued incremental steps for support of the ARM64 architecture. * Fix for the "struct name.member
" option if the "member" name is also coincidentally a member of an embedded structure that is located before the targeted member. Without the patch, the value of the embedded structure's member is displayed instead of the targeted member. * Expose a heretofore unadvertised "kmem -[sS] -I slab[,slab]" option that specifies one or more slab cache names in a comma-separated list that the "kmem -[sS]" option should ignore. This can be helpful in cases where a corrupted slab cache may never complete, or in very large memory systems where one or more caches take an inordinate amount of time to complete. * Fix for the "kmem -i" option on Linux 3.9 and later kernels. Without the patch, the "TOTAL SWAP", "SWAP USED" and "SWAP FREE" lines are not displayed because the kernel's former "swapper_space" singular address_space structure has has been changed into a "swapper_spaces" array of address_space structures, with one for each swap partition. * Support for the PPC64 BOOK3E processor family, whose virtual memory layout and PTE format are significantly different. Without the patch, the crash session fails to initialize properly. (ataufer@us.ibm.com) * Fix for the PPC64 "sys", "mach" and initial system banner display of of the processor speed in more recent kernels. Without the patch, the "MACHINE" line in the initial banner and in the "sys" command display may show "MACHINE: ppc64 (unknown Mhz)", and the "mach" command may show "PROCESSOR SPEED: (unknown)". (anderson@redhat.com, ataufer@us.ibm.com) * Since the libgdb.a file no longer exists in gdb-7.6, the Makefile does not check for it as a determining factor for whether a build has succeeded. * gdb-7.6 requires that the bfd library's "config.h" file be #include'd before the "bfd.h" file by the top-level symbols.c file. * gdb-7.6 has replaced/moved the gnu_debuglink_crc32() utility function to bfd_calc_gnu_debuglink_crc32(); the call in symbols.c has been configured based upon the gdb version. * gdb-7.6 has reworked its do_cleanups() functionality, which requires the gdb_error_hook() function to pass all_cleanups() as an argument. * gdb-7.6 causes the anon_member_offset() function to fail due to a change in the output string; the function has been changed to work with both old and new gdb versions. * gdb-7.6 required changes to vm_stat_init() and vm_event_state_init() functions because enum lists get displayed differently on the S390X and PPC64 architectures, which in turn caused failures of "kmem -i", "kmem -z" and "kmem -V" on those two machine types. * Adjusted the alignment of the "kmem -V" and "kmem -z" display of the items in the vm_stat[] array based upon the longest enumerator name string. * Adjusted the alignment of the "kmem -V" display of the cumulative totals of the per-cpu "vm_event_states" items based upon the longest enumerator name string. * Modified the top-level Makefile such that if the tar.gz file of the configured gdb version does not exist in the build directory, try to wget the file from http://ftp.gnu.org/gnu/gdb. This is normally not necessary because the most recent gdb tar.gz file is bundled with the the crash utility tar.gz and src.rpm files. However, it will allow the use of the gdb-less crash.tar.gz file created via "make tar" to be copied to another location, or perhaps copied to a git tree, and then built without containing the the gdb tar.gz file. * Fix for the s390x.c file to handle a gcc-4.8.0 compiler warning when building crash with "make warn", or compiler failures when building with "make Warn" on an S390x machine. Without the patch, gcc-4.8.0 generates the message "error: variable ‘psw_addr’ set but not used [-Werror=unused-but-set-variable]". * Fixes for the s390dbf.c file to handle gcc-4.8.0 compiler warnings when building crash with "make warn", or compiler failures when building with "make Warn" on an S390X machine. Without the patch, gcc-4.8.0 generates three "error: variable ‘’ set but not used [-Werror=unused-but-set-variable]" messages. * Fix for an X86_64 warning message that gets displayed during session initialization when running against Linux 3.9 kernels that were compiled with gcc-4.8.0. Without the patch, the warning message "crash: cannot determine thread return address" is displayed prior to the system information. * Fix for lack of kernel text line number information by the "dis -l" and "sym " options on Linux 3.9 kernels that were compiled with gcc-4.8.0. Without the patch, the line number information for kernel text symbols of type "(T)" may not be able to be determined and displayed. -- Troy Heber Mon, 13 May 2013 11:59:26 -0600 crash (6.1.6-1) unstable; urgency=low * New upstream version 6.1.6 * Fix for a crash-6.1.5 regression that causes the "mount" command to fail on kernel versions prior to Linux 3.3. Without the patch, the command fails with the message "mount: invalid structure member offset: mount_mnt_devname". -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.5-1) UNRELEASED; urgency=low * New upstream version 6.1.6 * Fix for the ARM "irq" command. Without the patch, on 2.6.34 and later kernels configured with CONFIG_SPARSE_IRQ, the command fails with the error message "irq: cannot determine number of IRQs". * Fix for a segmentation violation generated during invocation while parsing a makedumpfile-created "flat-format" vmcore-incomplete file. Without the patch, the crash session would display the error message "crash: unable to seek dump file vmcore-incomplete", followed by a segmentation violation. * Fix for a segmentation violation generated by the "kmem -s" option when encountering a corrupted array_cache structure that contains a bogus "avail" count that is greater than the maximum legitimate limit value. Without the patch, the "kmem -s" command would print a warning message regarding the invalid array_cache, complete the command normally, and then generate a segmentation violation when freeing buffers used by the command. * Update to the "kmem -s" function to include the errors found in slab structures to the display of total errors found when the command completes. Without the patch, invalid list_head pointers, bad inuse counters, and bad s_mem pointers were not added to the total number of errors found. * Fix for "crash --osrelease " and "crash --log " when run on an ARM compressed kdump with a crash binary that was built with "make target=ARM" on an x86 or x86_64 host. Without the patch, if the compressed kdump header version is 4 or 5, "crash --osrelease" fails with the error message "crash: compressed kdump: cannot lseek dump vmcoreinfo" followed by "unknown", and "crash --log" fails with the error message "crash: : no VMCOREINFO section". * Enhancement to the "swap" command to display the swap_info_struct address of each configured swap device. The output has been changed to display the address in the first column, and the variable-length device name has been moved to the last column. * Fix for the "kmem -[sS]" options on kernels that configured with both CONFIG_SLUB and CONFIG_NODES_SHIFT, and that are running on hardware that generates NUMA nodes that contain no memory. Without the patch, both command options fail immediately with the message "kmem: invalid kernel virtual address: 8 type: kmem_cache_node nr_partial". * Increment the PPC64 NR_CPUS maximum value from 1024 to 2048. * Strip the ".isra." and ".part." appendages to cloned text symbol names, which seem to have been introduced by gcc-4.6.0. To keep them intact, a "--no_strip" command line option has been added. * Patch to the internal gdb_get_datatype() function to return the typecode and length of integer variables. * Fix for the "dev -d" option on Linux 3.6 and later kernels. Without the patch the option fails with the message "dev: invalid structure member offset: request_queue_rq". * Export the red/black tree utility functions rb_first(), rb_parent(), rb_right(), rb_left(), rp_next() and rb_last(). Without the patch, they are statically declared and only used by the "runq" command. * Implemented a new "timer -r" option that displays the hrtimer queues, supporting all versions from Linux 2.6.16 to the present. * Fix for "kmem -s" on Linux 3.8 and later kernels that are configured with CONFIG_SLAB. The kmem_cache.array[] length has been extended to store the nodelist pointers, so the original method to determine the per-cpu array limit can go out-of-range. Without the patch, during session initialization there may be a message that indicates "crash: invalid kernel virtual address:
type: array cache limit", followed by "crash: unable to initialize kmem slab cache subsystem"; if those messages do get shown, then "kmem -s" will subsequently fail during runtime with the message "kmem: kmem cache slab subsystem not available". * Two Xen hypervisor fixes: (1) Fix console buffer content length calculation: Function displaying console buffer always assumes its content length equal to console buffer size. This is not true and sometimes it sends garbage to the screen. This patch fixes this issue. (2) Improve calculation of beginning of virtual address space: Xen changeset 26447 (x86: re-introduce map_domain_page() et al) once again altered virtual address space. The current algorithm calculating its start could not cope with that change. New version establishes this value on the base of image start address and is more generic. * Fix for the ARM "vtop" command when run on a module address. Without the patch, the command fails with error message "vtop: ambiguous address: (requires -u or -k)". * Add the "--active" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Add the "--buildinfo" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Remove the unadvertised and unnecessary "--data_debug" command line option, given that it is the default setting. * Remove the unadvertised and obsolete "--no_namelist_gzip" command line option. * Add the "-g [namelist]" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Remove the unadvertised and never-implemented "--shadow_page_tables" command line option. * Fix for the ARM "vtop" command when run on a user virtual address of the panic task. Prior to Linux 3.3, the panic task's pgd gets overwritten with a pgd that identity-maps the whole address space, and therefore crash loses the capability of translating any user virtual address into its original physical address. * Fix to prevent the ARM linker mapping symbols "$d" and "$a" from being added to the list of symbols from kernel modules. Without the patch, the two symbols would only be rejected from the base kernel's symbol list, but would be added to the symbol list of individual kernel modules. * Fix for the X86_64 "bt" command to recognize that the kernel was built with CONFIG_FRAME_POINTER on Linux 3.7 and later kernels that are configured with CONFIG_FUNCTION_TRACER. In those kernels, the special 4-byte NOP instruction that can be overwritten during runtime for dynamic ftracing has been moved to the very beginning of each function, before the function preamble. Without the patch, the test that checks the function preamble to determine whether CONFIG_FRAME_POINTER was configured would fail, which could potentially lead to less reliable backtraces. -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.4-1) UNRELEASED; urgency=low * New upstream version 6.1.4 * Fix for a crash-6.1.3 regression with respect to the loading of extension modules. Because of the change that replaced the obsolete _init() and _fini() functions with constructor and destructor functions, extension modules may fail to load when the extension modules are built with older compiler/linkers. The problem is due to the continued usage of the -nostartfiles compiler option regardless whether the extension module has replaced its _init() function with a constructor function; with older compiler/linkers, the module may fail to load. The fix predetermines whether an extension module still uses _init() or if it has been updated to use a constructor function, and will use the -nostartfiles option only on older "legacy" modules. * Implemented a new "list -r" option that can be used with lists that are linked with list_head structures. When invoked, the command will traverse the linked list in the reverse order by using the "prev" pointer instead of "next". * Fix for the "swap" command's FILENAME display. In some kernels between 2.6.32 and 2.6.38 the swap partition's pathname may not show the "/dev" filename component. * Fix for the "swap" command's PCT display, which will display a a negative percentage value if more than 5368709 swap pages are in use. -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.3-1) unstable; urgency=low * New upstream version 6.1.3 * Implemented a new "crash --log dumpfile" option which dumps the kernel log buffer and exits. A kernel namelist is not required, but the dumpfile must contain the VMCOREINFO data from the ELF header of the original /proc/vmcore file that was created by the kexec/kdump facility. Accordingly, this option supports kdump ELF vmcores and compressed kdump vmcores created by the makedumpfile facility, including those that are in makedumpfile's intermediary "vmcore.flat" format. * Fixes for the ppc64.c file to handle gcc-4.7.2 compiler warnings when building crash with "make warn", or compiler failures when building with "make Warn" on a PPC64 machine. Without the patch, gcc-4.7.2 generates three "error: variable ‘’ set but not used [-Werror=unused-but-set-variable]" messages. * Update the PPC64 architecure's internal storage of the kernel's MAX_PHYSMEM_BITS value for Linux 3.7 and later kernels, which changed from 44 to 46 to for 64TB support. Without the patch, there is no known issue, but the stored value should be correct. * Fix for the "mount" command's header display to indicate "MOUNT" instead of "VFSMOUNT" on Linux 3.3 and later kernels because the the first column contains a mount structure address instead of a vfsmount structure address. For those later kernels, it is permissable to enter either the mount structure address, or the address of the vfsmount structure that is embedded within it, as an optional argument. The output has also been tightened up so that the DIRNAME field is not shifted to the right based upon the DEVNAME field length. * Fix for the "mount " search option on 2.6.32 and later kernels. Without the patch, it is possible that multiple filesystems will be displayed. * Update to the "mount" help page to indicate that a dentry address may be used as a search option. * Fix for the "ps -l [pid|task|command]" option to display the specified tasks sorted with the most recently-run task (the largest last_run/timestamp) shown first, as is done with the "ps -l" option with no arguments. Without the patch, the timestamp data gets displayed in the order of the "[pid|task|command]" arguments. * Added the "ps" command to the set of supported "foreach" commands, serving as an alternative manner of passing task-identifying arguments to the "ps" command. For example, a command such as "foreach RU ps" can be accomplished without having to pipe normal "ps" output to "grep RU". All "ps" options are supported from the "foreach" framework. * Fix for the "ps -G" restrictor option such that it also takes affect if the -p, -c, -l, -a, -r or -g options are used. Without the patch, thread group filtering would only take effect when the default "ps" command is used without any of the options above. * Fortify the internal hq_open() function to return FALSE if it is already open, and have restore_sanity() and restore_ifile_sanity() call hq_close() unconditionally. * Added the "extend" command to the set of built-in commands that support minimal mode. A new MINIMAL flag has been created for extension modules to set in their command_table_entry.flags field(s) to signal that a command supports minimal mode. If the crash session has been invoked with --minimal, then the "extend" command will require that the module registers at least one command that has the MINIMAL bit set. * Prevent the "__crc_*" symbols from being added to the the ARM kernel symbol list. * Prevent the "PRRR" and "NMRR" absolute symbols from being added to the ARM kernel symbol list. Without the patch, it allows an invalid set of addresses to pass the check in the in_ksymbol_range() function. * Fix for the ppc.c file to handle a gcc-4.7.2 compiler warning when building crash with "make warn", or compiler failures when building with "make Warn" on a PPC machine. Without the patch, gcc-4.7.2 generates the message "error: variable ‘dm’ set but not used [-Werror=unused-but-set-variable]". * Workaround for the "crash --osrelease dumpfile" option to be able to work with malformed ARM compressed kdump headers. ARM compressed kdumps that indicate header version 3 may contain a malformed kdump_sub_header structure with offset_vmcoreinfo and size_vmcoreinfo fields offset by 4 bytes, and the actual vmcoreinfo data is not preceded by its ELF note header and its "VMCOREINFO" string. This workaround finds the vmcoreinfo data and patches the stored header's offset_vmcoreinfo and size_vmcoreinfo values. Without the patch, the "--osrelease dumpfile" command line option fails with the message "crash: compressed kdump: cannot lseek dump vmcoreinfo", followed by "unknown". * Fix for the "help -n" option on 32-bit compressed kdumps. Without the patch, the offset_vmcoreinfo, offset_eraseinfo, and offset_note fields of the kdump_sub_header have their upper 32-bits clipped off when displayed. However, it should be harmless since the offset values point into the first few pages of the dumpfile. * Update of the extensions/echo.c extension module example, and the "extend" help page, to utilize a constructor function to call the register_extension() function. The _init() and _fini() functions have been designated as obsolete for usage by dlopen() and dlclose(). The echo.c example module has been modified to contain echo_init() and echo_fini() functions marked as __attribute__((constructor)) and __attribute__((destructor)) respectively. * Updated extensions/dminfo.c, extensions/snap.c and extensions/trace.c to replace their _init() and _fini() functions with constructor and destructor functions. * Fix for the "bt" command on the PPC64 architecture when running on Linux 3.7 kernel threads. Without the patch, some kernel threads may fail to terminate on the final ".ret_from_kernel_thread" frame, repeating that frame endlessly, because the stack linkage pointer points back to itself instead of being NULL. -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.2-1) UNRELEASED; urgency=low * New upstream version 6.1.2 * Enhancement of the "task" command to display both the task_struct and the thread_info structures of a task. The -R option accepts members of either/both structure types. * Fix for the X86_64 "search" and "rd" commands due to this commit: http://git.kernel.org/linus/027ef6c87853b0a9df53175063028edb4950d476 Upon any attempt to read a page within the RAM region reserved for AMD GART on a live system, the Linux 3.7rc1 commit above causes causes /dev/mem, /proc/kcore and the /dev/crash drivers to spin forever, leading to a kernel soft lockup. The RAM pages reserved for GART consist of 2MB large pages whose _PAGE_PRESENT bits are turned off. Prior to the above commit, a read() attempt on GART RAM would cause an unresolvable page fault, and would harmlessly return an EFAULT. The commit above has changed pmd_large() function such that it now returns TRUE if only _PAGE_PSE bit is set in the PTE, whereas before it required both _PAGE_PSE and _PAGE_PRESENT. So instead of just failing the read() system call with an EFAULT, the page fault handling code now considers it a spurious TLB fault, and the instruction is retried indefinitely. The crash utility patch stores the GART physical memory range, and disallows any attempts to read from it. * If an EPPIC_GIT_URL environment variable is defined, then the URL that it points to is used as an alternative to the code.google.com git source repository for the eppic.so extension module. However, the alternative site is only accessed if code.google.com can first be pinged; this patch removes that restriction. * Fix for the "files" command PATH display on kernels configured with CONFIG_DEVTMPFS, when the vfsmount pointer in an file structure's "f_path" member does not point to the root vfsmount required for reconstructing the full file pathname. Without the patch, open files in /dev directory may be truncated and not show the "/dev" filename component. * Enhancement to the "kmem -v" option on 2.6.28 and later kernels that utilize the "vmap_area_list" list of mapped kernel virtual memory regions, replacing the usage of the to-be-obsoleted "vmlist" list. In those kernels, the output of the command will also show each vmap_area structure address, in addition to its vm_struct address, memory range, and size. * Update to the exported do_rbtree() and do_rdtree() functions such that they will return the number of items found in the targeted tree, similar in nature to the do_list() function. The two functions have also been fixed such that the VERBOSE flag is actually recognized, so that external callers are able to gather the entries in a tree without having them displayed. The calls to either function may be enclosed with hq_open() and hq_close() so the that tree entries may be subsequently gathered by retrieve_list() into a supplied buffer, as well as to recognize a corrupted list with duplicate entries. * Fix for the "extend -u" option to prevent the usage of a member of a free()'d extension_table structure. No command failure occurs, but rather an inadvertent coding error. * Fix to allow error() to be called during an open_tmpfile() sequence prior to close_tmpfile() being called. There are no crash functions that call error() during an open_tmpfile() sequence, but there's no reason why it cannot be done. Without the patch, the error message gets displayed on stdout (as expected), but the error message will also overwrite/corrupt the tmpfile() data while it is being parsed. * Fix to properly determine whether X86_64 kernels were configured with CONFIG_FRAME_POINTER, due to this ftrace-related commit: http://git.kernel.org/linus/d57c5d51a30152f3175d2344cb6395f08bf8ee0c Without the patch, the crash utility fails to determine whether the kernel was built with CONFIG_FRAME_POINTER, and therefore the "bt" command cannot take advantage of it for more reliable backtraces. * Fix to properly determine whether 2.6.31 and earlier X86_64 kernels were configured with CONFIG_FRAME_POINTER. Without the patch, the crash utility may fail to determine whether the kernel was built with CONFIG_FRAME_POINTER. In those kernel versions -- which may be dependent upon the compiler version used -- one of the sample functions tested may have their "push %rbp, mov %rsp,%rbp" function preamble separated by other instruction(s), resulting in a false negative that precludes the "bt" command from taking advantage of framepointers. * Fix for the file and line-number string that is displayed by the "sym " option. Without the patch, the "/usr/src/" part of the string is stripped, and the filename string itself could have two corrupted characters in the pathname, for example, showing "k3.nel-3.6.fc17" instead of "kernel-3.6.fc17". This is dependent upon the compiler version, or perhaps the string library that is linked into the crash binary, because it only has been seen on crash binaries built with gcc-4.7. The fix now displays the full pathname, no longer dropping the "/usr/src" from beginning. * Restricted the X86_64 "line_number_hook" to kernels earlier than 2.6.24, i.e., kernels prior to the x86/x86_64 merge. Without the patch, the manufactured filename information for assembly-language files was incorrect for 2.6.24 and later kernels. Also, the kernel debuginfo data now has file/line-number data for assembly-language files as well, obviating the need for the hook. * Fix for the extensions/trace.c extension module to prevent a double free exception that would occur if a calloc() call fails during module initialization. * Fix for the "p -u" option if a 32-bit kernel symbol is incorrectly passed as an argument. Without the patch, the command fails, but the next command requiring the services of the embedded gdb module will generate an error message of the sort "*** glibc detected *** crash: free(): invalid pointer:
***", or "*** glibc detected *** crash: munmap_chunk(): invalid pointer:
***", followed by a backtrace, and an abort of the crash session. * Fix for the embedded gdb module to correctly handle kernel modules whose ELF header contains "__ksymtab" and "__ksymtab_gpl" sections with non-zero nonsensical "Address" values. * Without the patch, if one of the odd sections above is encountered, the "Offset" values of the remaining sections are not processed; and if the module's .data section is ignored, gdb incorrectly calculates the address of all symbols in the module's .data section, leading to incorrect output if, for example, data is printed with the gdb "p" command. This invalid ELF section format was introduced in Linux 3.0 by the kernel's "scripts/module-common.lds" file. * Fix for the "runq -g" option if the kernel contains more than 200 task groups. Without the patch, the command generates a segmentation violation. -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.1-1) UNRELEASED; urgency=low * New upstream version 6.1.1 * Fixes for the ARM "vtop" command display of kernel unity-mapped virtual addresses. Without the patch, the PGD, PMD values may be incorrect, and the PAGE value is always incorrectly calculated. * Fix for Linux 2.6.34 and later kernels that are configured with CONFIG_SLUB, but not configured with CONFIG_IKCONFIG, to be able to determine the kernel's CONFIG_NR_CPUS value. Without the patch, if the actual number of cpus is larger than the crash utility's per-architecture NR_CPUS maximum value, then the cpus beyond the NR_CPUS limit would not be accounted for. * Increment the X86_64 NR_CPUS maximum value from 4096 to 5120. * Try to determine whether the kernel is running as a virtual machine by using any available kernel-specific data or by dumpfile type. The results of the hypervisor type search will be stored in the internal kernel_table data structure, and if a hypervisor type can be determined, its name will be displayed by the "mach" command. The result of the hypervisor determination, successful or otherwise, may be viewed during session initialization if the -d command line option is invoked, or during runtime via the "help -k" option. Only applicable to the X86, X86_64 and IA64 architectures. * Allow the "ps command" and "foreach name" command options to contain more than the kernel's maximum of 15 characters that are stored in each task's task_struct.comm[] array. Without the patch, the two string arguments were required to be the possibly-truncated command name string in order to match. * Enhancement to the "ps" command to allow any of the "command" arguments to be POSIX extended regular expressions. The expression string must be encompassed by "'" characters, and will be matched against the names of all tasks. * Add support for 2GB pages in the S390X virtual-to-physical address translation function. Required for the new IBM zEC12 Mainframe. * Initial preparation for support of the ARM64 architecture. * Fix for the "log" command if a kernel message contains either a '\n' or a '\t'. Without the patch, the two characters are replaced with a '.', and the message continues. With the patch applied, the characters are printed, and if it is a '\n', spaces are inserted after the linefeed so that the subsequent characters in the message line up appropriately under the preceding line. * Fix for the "kmem -[sS]" options on kernels that configured with both CONFIG_SLUB and CONFIG_NODES_SHIFT, and that are running on hardware that generates NUMA node ids that are not numbered consecutively. Without the patch, both command options fail with the error message "kmem: invalid kernel virtual address: 8 type: kmem_cache_node nr_partial". * Fix for the "trace.so" extension module's "trace show" command. Without the patch, the output showing each trace point is shown with two hexadecimal virtual addresses instead of displaying them symbolically using the format " <-- ". * Fixes for handling incomplete/invalid ELF or compressed kdump vmcores whose per-cpu NT_PRSTATUS notes are missing. For example, this has been seen to happen when kexec/kdump incorrectly recognizes a Xen DomU kernel as a Xen Dom0 kernel. Without the patch, possible ramifications would be a NULL pointer dereference during session intialization when searching for the panic task, or during the "bt" command on an active task. * Implemented a new "runq -g" option that displays CFS runqueue tasks hierarchically by task_group. Tasks in throttled groups are also displayed. The "runq" command with no option will no longer display task_group data for the RT queue. * Patchset for Xen support up to version 4.2: * Fix for the S390X virtual-to-physical address translation to allow the HW Change-bit override bit (0x100) to be used in page table entries. * Fix for a rarely-seen circumstance in which a kdump ELF vmcore of a Xen dom0 kernel gets incorrectly identified as a old-style netdump ELF vmcore. This has only been seen after the original kdump ELF vmcore was transformed via "makedumpfile -d1". Without the patch, the crash session fails during initialization with the messages "crash: invalid size request: 0 type: xen kdump p2m mfn page", followed by "crash: cannot read xen kdump p2m mfn page". If run against the Xen hypervisor, the session fails during initialization with the error message "crash: read error: kernel virtual address:
type: crashing_cpu". -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.0-1) unstable; urgency=low * Fix for 32-bit SADUMP dumpfiles to correctly check whether a requested physical address is within the 0-640K backup region. Without the patch, requested physical addresses that are larger than 32-bits are truncated to 32-bit values, leading to unexpected results. * Added support for the ELF dumpfile type that is generated by the new "virsh dump --memory-only" option. The "--memory-only" option uses a new "dump-guest-memory" QEMU monitor command that creates an ELF kdump vmcore clone. The "virsh dump" command continues to borrow the "migrate" QEMU monitor command to create a file that is designed for guest migration, and not well-suited for a vmcore because it is not designed for random-access of physical memory. A new "help -r" option has been added to dump the registers that are stored in per-cpu "QEMU" ELF notes; those notes are used to distinguish this dumpfile type from regular kdump ELF vmcores. The patch also combines common functionality between the new format and the SADUMP format. * Fix for the "runq" command for kernels that have the CFS scheduler. Without the patch, a cpu's RT runqueue may incorrectly display "[no tasks queued]" when in fact there are tasks on its queue. * In the highly-unlikely event that a pre-Linux 3.5 kernel's log buffer cannot be read during initialization, display a message indicating "WARNING: cannot read log_buf contents", and just continue. Without the patch, a "readmem" error would be displayed and the crash session would be killed. * Updated the "net -a" option to support Linux 2.6.9 to 3.6.0. Without the patch, the option displayed "net: -a option not supported or applicable on this architecture or kernel". * Enhanced the "net -a" option to show the struct neighbour address associated with each line of output. * Fix for the "runq" command for kernels that are configured with CONFIG_RT_GROUP_SCHED. Without the patch, tasks contained within an RT group scheduling entity are not displayed. * Fix for "crash --version" or "crash -v" to prevent the sourcing of a .gdbinit file that is located in the current directory. * Preemptive fix to handle this patch to the x86 devmem_is_allowed() function that was posted on the Linux Kernel Mailing List here: https://lkml.org/lkml/2012/8/28/357 If the proposed kernel patch put into place, a failed attempt to use /dev/mem when the kernel is configured with CONFIG_STRICT_DEVMEM will not result in an automatic attempt to use /proc/kcore. With this crash utility patch, the automatic switch to /proc/kcore will be attempted regardless whether the kernel patch is accepted or not. * Patch for CVE-2012-3509: libiberty: objalloc_alloc integer overflows * Fix for Linux 3.0 and later kernels that have been configured with CONFIG_SLAB, and without CONFIG_NODES_SHIFT (or have set it to 0). Without the patch, the warning messages "crash: nr_node_ids: symbol does not exist" and "crash: unable to initialize kmem slab cache subsystem" are displayed during initialization, and the "kmem -[sS]" options fail with the message "kmem: kmem cache slab subsystem not available". * Allow the build procedure to use an alternate compiler by passing "make CC=" to the top-level Makefile. * Allow the user to append options to the "configure" script that is invoked by the initial embedded gdb build procedure. The additional options should be put in a file named "GDBFLAGS.extra" located in the top-level directory. * Change for the "ps" command if a task is stopped due to the task being traced by another task. Without the patch, the traced task is shown with the "ST" (stopped) status; with the patch it will be shown with a "TR" ncement of the "task" command to display both the task_struct and the thread_info structures of a task. The -R option accepts members of either/both structure types. * The "TR" state has been added to the "foreach" command's list of task state qualifiers. Without the patch, there is no way to filter out tasks that are stopped due to being traced by another task. * Fix for passing a a "gdb" command to a crash session via a pipe if there are any spaces preceding the "gdb" command name in the string. Without the patch, the command will fail with the error message "gdb: gdb request failed: ". * Preparation for the future S390/S390X structure name change from "_lowcore" to "lowcore". The patch checks which structure is defined and uses the correct name. * Replaced datatype_info() calls in do_radix_tree() and do_rdtree() with preferred MEMBER_SIZE() macro. -- Troy Heber Tue, 23 Oct 2012 09:48:28 -0600 crash (6.0.9-1) UNRELEASED; urgency=low * Fix for building on host machines that have glibc-2.15.90 installed, in which case the glibc header file /usr/include/bits/siginfo.h no longer declares a "struct siginfo", but only the "siginfo_t" typedef. Without the patch, the build of the embedded gdb module fails with the error message "linux-nat.h:63:18: error: field 'siginfo' has incomplete type". * Add support for reading compressed kdump dumpfiles that were compressed by the snappy compressor. This feature is disabled by default. To enable this feature, build the crash utility in the following manner: (1) Install the snappy libraries by using the host system's package manager or by directly downloading libraries from author's website. The packages required are: - snappy - snappy-devel The author's website is: http://code.google.com/p/snappy (2) Create a CFLAGS.extra file and an LDFLAGS.extra file in top-level crash sources directory: - enter -DSNAPPY in the CFLAGS.extra file - enter -lsnappy in the LDFLAGS.extra file. (3) Build crash with "make" as always. * Prevent the "ptov" command from returning an invalid virtual address on 32-bit architectures. Without the patch, the command may result in an invalid virtual address if the physical address entered cannot be accessed by a unity-mapped kernel virtual address. The patch verifies that the calculated virtual address can be translated back into the supplied physical address. * Fix to automatically try /proc/kcore as an alternative live memory source when the /dev/crash driver does not exist and /dev/mem is unusable because the kernel was configured with CONFIG_STRICT_DEVMEM. Without the patch, the automatic switch from /dev/mem to /proc/kcore is only attempted on the X86 and X86_64 architectures. * Added missing linefeeds to several error messages in makedumpfile.c. * Fix for a regression introduced by a crash-5.1.1 patch that reworked the handling of "set" commands that are put in .crashrc files, such that only certain command options would get resolved before the crash session is initialized. Without this patch, the "--less", "--more", "--no_scroll" and "--CRASHPAGER" crash command line options do not properly override conflicting "set scroll