----- Original Message ----- > Dave, > > One question. > ... > > On arm64, when KASLR is enabled, a function call between a module and > the kernel will be done via a veneer (PLT) if the displacement is more > than +/-128MB. So disassembled code looks a bit useless: > > ===8<=== > crash> mod -S > MODULE NAME SIZE OBJECT FILE > ffff04d78f4b8000 testmod 16384 /opt/buildroot/15.11_64/root/kexec/testmod.ko > crash> bt > PID: 1102 TASK: ffffb4da8e910000 CPU: 0 COMMAND: "insmod" > #0 [ffffb4da8e9afa30] __crash_kexec at ffff0e0045020a54 > #1 [ffffb4da8e9afb90] panic at ffff0e004505523c > #2 [ffffb4da8e9afc50] testmod_init at ffff04d78f4b6014 [testmod] > #3 [ffffb4da8e9afb40] do_one_initcall at ffff0e0044f7333c > --- <Exception in user> --- > PC: 0000000a LR: 00000000 SP: ffff04d78f4b6000 PSTATE: 7669726420656c75 > X12: ffffb4da8e9ac000 X11: ffff04d78f4b6018 X10: ffffb4da8e9afc50 X9: 20676e6973756143 > X8: 00000000 X7: ffff0e0045e5ce00 X6: ffff0e0045e5c000 X5: 600001c5 > X4: ffff0e0045020a58 X3: ffffb4da8e9afa30 X2: ffff0e004502098c X1: ffffb4da8e9afa30 > X0: 00000124 > crash> dis testmod_init > 0xffff04d78f4b6000 <init_module>: stp x29, x30, [sp,#-16]! > 0xffff04d78f4b6004 <testmod_init+4>: mov x29, sp > 0xffff04d78f4b6008 <testmod_init+8>: ldr x0, 0xffff04d78f4b6018 > 0xffff04d78f4b600c <testmod_init+12>: bl 0xffff04d78f4b6090 > 0xffff04d78f4b6010 <testmod_init+16>: ldr x0, 0xffff04d78f4b6020 > 0xffff04d78f4b6014 <testmod_init+20>: bl 0xffff04d78f4b6080 > > => branch to a veneer > crash> dis 0xffff04d78f4b6080 4 > > 0xffff04d78f4b6080 <testmod_exit+88>: mov x16, #0xffffffffffff5120 // #-44768 > 0xffff04d78f4b6084 <testmod_exit+92>: movk x16, #0x4505, lsl #16 > 0xffff04d78f4b6088 <testmod_exit+96>: movk x16, #0xe00, lsl #32 > 0xffff04d78f4b608c <testmod_exit+100>: br x16 > > => branch to 0xffff0e0045055120 > (= panic()) > ===>8=== > > Is there any method to resolve such kind of indirect addressing > to a symbolic name at dis command? > (It may be difficult to discriminate PLT from normal branches, though). Maybe something could be kludged up by the machdep->dis_filter() call? In arm64_dis_filter(), whenever there is a "bl <address>" instruction, the 12 bytes at the PLT target address could be read, parsed, and the real target address reconstructed. If the reconstructed address resolves to a kernel text address, it could be appended to the line. Dave > Thanks, > -Takahiro AKASHI > -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility
