On 2023/07/24 15:51, lijiang wrote: >>> I think you are fixing the fallback routine and that's good, but it's >>> better to fix get_linux_banner_from_vmlinux() first if possible. It's >> > > Thank you for the comments, Kazu. > > They are different issues. The fallback routine(strings) also needs to be > fixed, and the get_linux_banner_from_vmlinux() failure is another issue. Yes, will merge this later. > >> much faster. Isn't it possible? >>> > > > As I mentioned in patch log, the symbol ".rodata" was not found in some > vmlinux, and so far I haven't got any equivalent symbols to achieve the > purpose. > > crash> sym .rodata > symbol not found: .rodata > possible alternatives: > (none found) > crash> > > But the following change works well for this case: > > diff --git a/kernel.c b/kernel.c > index 546eed9..a4ce5bf 100644 > --- a/kernel.c > +++ b/kernel.c > @@ -11891,6 +11891,7 @@ check_vmcoreinfo(void) > static > int get_linux_banner_from_vmlinux(char *buf, size_t size) > { > +#if 0 > struct bfd_section *sect; > long offset; > > @@ -11917,4 +11918,10 @@ int get_linux_banner_from_vmlinux(char *buf, > size_t size) > return FALSE; > > return TRUE; > +#else > + if (!readmem(symbol_value("linux_banner"), KVADDR, buf, size, > "linux_banner", RETURN_ON_ERROR)) > + return FALSE; > + > + return TRUE; > +#endif > } > > How about reading out the linux_banner string to a buffer with readmem()? No, this is a version check for the namelist (vmlinux). > > >>> What do you see in "sections:" in "help -s"? And probably you can >>> determine the section where linux_banner is located, with the address of >>> linux_banner and KASLR offset. >>> >>> crash> help -s >>> ... >>> sections: >>> .text vma: ffffffff81000000 size: 14686984 >>> .rodata vma: ffffffff82000000 size: 5366231 >>> .pci_fixup vma: ffffffff8251e1e0 size: 14112 >>> ... >>> crash> sym linux_banner >>> ffffffffb5200a40 (D) linux_banner >>> crash> help -D | grep KERNELOFFSET >>> KERNELOFFSET=33200000 >>> >>> crash> eval ffffffffb5200a40 - 0x33200000 >>> hexadecimal: ffffffff82000a40 --> linux_banner is in ".rodata" >> >> If the vmlinux does not have only the ".rodata" symbol, is it possible >> to use "__start_rodata" symbol or something? i.e. is there no symbol >> that has the same address as .rodata section? >> >> > I tried the "__start_rodata" symbol, but it does not work. How did you try? There is no "__start_rodata" symbol? I mean something like this: --- a/kernel.c +++ b/kernel.c @@ -11893,8 +11893,13 @@ int get_linux_banner_from_vmlinux(char *buf, size_t size) { struct bfd_section *sect; long offset; + ulong start_rodata; - if (!kernel_symbol_exists(".rodata")) + if (kernel_symbol_exists(".rodata")) + start_rodata = symbol_value(".rodata"); + else if (kernel_symbol_exists("__start_rodata")) + start_rodata = symbol_value("__start_rodata"); + else return FALSE; sect = bfd_get_section_by_name(st->bfd, ".rodata"); @@ -11907,7 +11912,7 @@ int get_linux_banner_from_vmlinux(char *buf, size_t size) * value in vmlinux file, but relative offset to linux_banner * object in .rodata section is idential. */ - offset = symbol_value("linux_banner") - symbol_value(".rodata"); + offset = symbol_value("linux_banner") - start_rodata; if (!bfd_get_section_contents(st->bfd, sect, Thanks, Kazu -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://listman.redhat.com/mailman/listinfo/crash-utility Contribution Guidelines: https://github.com/crash-utility/crash/wiki