crash (7.2.8-1ubuntu0.18.04.2) bionic; urgency=medium * Fix cannot determine VA_BITS_ACTUAL (LP: #1919275): - d/p/0003-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch -- Ioanna Alifieraki Wed, 14 Apr 2021 18:41:40 +0300 crash (7.2.8-1ubuntu0.18.04.1) bionic; urgency=medium * Version bump from Focal, based on upstream release 7.2.8 (LP: #1865041): - Multiple fixes up to kernel 5.5-rc1 (e.g., fixes for kmem/timer/log commands, for kernels with symbol namespaces and with KASLR enabled). - Improve handling of /proc/kcore (live memory) for x86_64 kernels with CONFIG_RANDOMIZE_BASE enabled. - Fix ARM64 page size handling on kernel 4.4 and before. - Improve offset gathering and ELF support on KASLR kernels in S390X. - Support xz compressed vmlinux. - Fallback to log buffer parsing in case panic task can't be determined by normal means in the dumpfile. * Remaining changes: - Update the maintainer field for Ubuntu. - If the "live" autopkgtest fails with a recommendation to try /proc/kcore instead of the default, attempt that before failing the test. LP: #1858958. * Fix test, as if will return 0 when no cases were true. -- Guilherme G. Piccoli Thu, 27 Feb 2020 11:12:51 -0300 crash (7.2.1-1ubuntu2) bionic; urgency=medium * Add patch to fix ipcs command (LP: #1765660). * Add test for ipcs command. -- Thadeu Lima de Souza Cascardo Fri, 15 Feb 2019 06:58:17 -0200 crash (7.2.1-1) unstable; urgency=medium * New upstream (closes: #890394) * Fix for the "runq" command on Linux 4.14 and later kernels that contain commit cd9e61ed1eebbcd5dfad59475d41ec58d9b64b6a, titled "rbtree: cache leftmost node internally". Without the patch, the command fails with the error message "runq: invalid structure member offset: cfs_rq_rb_leftmost". * Fix to prevent a useless message during session inialization. Without the patch, if the highest possible node bit in the node_states[N_ONLINE] multi-word bitmask is set, then a message such as "crash: next_online_node: 256 is too large!" will be displayed. * Additional fixes for the ARM64 "bt" command for Linux 4.14 kernels. The patch corrects the contents of in-kernel exception frame register dumps, and properly transitions the backtrace from the IRQ stack to the process stack. * Implemented a new "search -T" option, which is identical to the "search -t" option, except that the search is restricted to the kernel stacks of active tasks. * Removal of the ARM64 "bt -o" option for Linux 4.14 and later kernels, along with several cleanups/readability improvements. * Fix for support of KASLR enabled kernels captured by the SADUMP dumpfile facility. SADUMP dumpfile headers do not contain phys_base or VMCOREINFO notes, so without this patch, the crash session fails during initialization with the message "crash: seek error: kernel virtual address:
type: "page_offset_base". This patch calculates the phys_base value and the KASLR offset using the IDTR and CR3 registers from the dumpfile header. * Implemented a new "ps -y policy" option to filter the task display by scheduling policy. Applicable to both standalone ps invocation as well as via foreach. * Fix for the "kmem -[sS]" options on Linux 4.14 and later kernels that contain commit 2482ddec670fb83717d129012bc558777cb159f7, titled "mm: add SLUB free list pointer obfuscation". Without the patch, there will numerous error messages of the type "kmem: slab:
invalid freepointer: " if the kernel is configured with CONFIG_SLAB_FREELIST_HARDENED. * Fix for the validation of the bits located in the least significant bits of mem_section.section_mem_map pointers. Without the patch, the validation functions always returned valid, due to a coding error found by clang. However, it was never really a problem because it is extremely unlikely that an existing mem_section would ever be invalid. * Fix for the x86_64 kernel virtual address to physical address translation mechanism. Without the patch, when verifying that the PAGE_PRESENT bit is set in the top-level page table, it would always test positively, and the translation would continue parsing the remainder of the page tables. This would virtually never be a problem in practice because if the top-level page table entry existed, its PAGE_PRESENT bit would be set. * Removed a check for a negative block_size value which is always a non-negative unsigned value in the SADUMP header parsing function. * Removed a check for an impossible negative value when calculating the beginning address when applying the context value specified by the "search -x " option. * Implemented a new "timer -C " option that restricts the timer or hrtimer output to the timer queue data associated with one or more cpus. For multiple cpus, the cpu-specifier uses the standard comma or dash separated list format. * Fix for a "ps -l" regression introduced by the new "ps -y" option introduced above. Without the patch, the -l option generates a segmentation violation if not accompanied by a -C cpu specifier option. * Fix for the "kmem -i" and "kmem -V" options in Linux 4.8 and later kernels containing commit 75ef7184053989118d3814c558a9af62e7376a58, titled "mm, vmstat: add infrastructure for per-node vmstats". Without the patch, the CACHED line of "kmem -i" shows 0, and the VM_STAT section of "kmem -V" is missing entirely. * Fix for Linux 4.11 and later kernels that contain kernel commit 4b3ef9daa4fc0bba742a79faecb17fdaaead083b, titled "mm/swap: split swap cache into 64MB trunks". Without the patch, the CACHED line of "kmem -i" may show nonsensical data. * Implemented a new "dev -D" option that is the same as "dev -d", but filters out the display of disks that have no I/O in progress. * If a line number request for a module text address initially fails, force the embedded gdb module to complete its two-stage strategy used for reading debuginfo symbol tables from module object files, and then retry the line number extraction. This automatically does what the "mod -r" or "crash --readnow" options accomplish. * Update for support of Linux 4.12 and later PPC64 kernels where the hash page table geometry accommodates a larger virtual address range. Without the patch, the virtual-to-physical translation of user space virtual addresses by "vm -p", "vtop", and "rd -u" may generate an invalid translation or otherwise fail. * Implemented a new "runq -T" option that displays the time lag of each CPU relative to the most recent runqueue timestamp. * Fix to support Linux 4.15 and later kernels that contain kernel commit e8cfbc245e24887e3c30235f71e9e9405e0cfc39, titled "pid: remove pidhash". The kernel's traditional usage of a pid_hash[] array to store PIDs has been replaced by an IDR radix tree, requiring a new crash plug-in function to gather the system's task set. Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve init_task_union". * Fix for the "net" command when the network device listing has an unusually large number of IP addresses. In that case, without the patch, the command may generate a segmentation violation. * Fix for Linux 4.15 and later kernels that are configured with CONFIG_SPARSEMEM_EXTREME, and that contain kernel commit 83e3c48729d9ebb7af5a31a504f3fd6aff0348c4, titled "mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y". Without the patch, kernels configured with SPARSEMEM_EXTREME have changed the data type of "mem_section" from an array to a pointer, leading to errors in commands such as "kmem -p", "kmem -n", "kmem -s", and any other command that translates a physical address to its page struct address. * With the latest PPC64 NMI IPI changes, crash_ipi_callback is found multiple times on the stack of active non-panic tasks. Ensure that the symbol reference relates to an actual backtrace stack frame. * Update the starting virtual address of vmalloc space for kernels configured with CONFIG_X86_5LEVEL. * Update the X86_64 VSYSCALL_END address to reflect that it only contains 1 page. * Prevent the X86_64 FILL_PML() macro from updating the internal machdep->machspec->last_pml4_read address every time a vmalloc'd kernel virtual address is translated. * Fix for the "bt" command in x86_64 kernels that contain, or have backports of, kernel commit 4950d6d48a0c43cc61d0bbb76fb10e0214b79c66, titled "x86/dumpstack: Remove 64-byte gap at end of irq stack". Without the patch, backtraces fail to transition from the IRQ stack back to the process stack, showing an error message such as "bt: cannot transition exception stack to IRQ stack to current process stack". * Initial pass for support of kernel page table isolation. The x86_64 "bt" command may indicate "bt: cannot transition from exception stack to current process stack" if the crash callback NMI occurred while an active task was running on the new entry trampoline stack. This has only been tested on the RHEL7 backport of the upstream patch because as of this commit, crash does not run on 4.15-rc kernels. Further changes may be required for upstream kernels, and distributions that implement the kernel changes differently than upstream. * Fix for the "bt" command and the "ps -s" option for zombie tasks whose kernel stacks have been freed/detached. Without the patch, the "bt" command indicates "bt: invalid kernel virtual address: 0 type: stack contents" and "bt: read of stack at 0 failed"; it will be changed to display "(no stack)". The "ps -s" option would fail prematurely upon reaching such a task, indicating "ps: invalid kernel virtual address: 0 type: stack contents" and "ps: read of stack at 0 failed". * Fix for running on live systems on 4.15-rc2 and later kernels that are configured with CONFIG_RANDOMIZE_BASE and contain kernel commit 668533dc0764b30c9dd2baf3ca800156f688326b, titled "kallsyms: take advantage of the new '%px' format". Without the patch, a live crash session does not show the "WARNING: kernel relocated ..." message expected with KASLR, and then displays the message "crash: cannot set context for pid: " prior to generating a SIGSEGV. * Fix for 4.15-rc5 and later x86_64 kernels that contain kernel commit c482feefe1aeb150156248ba0fd3e029bc886605, titled "x86/entry/64: Make cpu_entry_area.tss read-only". Without the patch, the addresses and sizes of the x86_64 exception stacks cannot be determined; therefore if a backtrace starts on one of the exception stacks, then the "bt" command will fail. * Additional fix for support of KASLR enabled kernels captured by the SADUMP dumpfile facility, where this patch fixes a problem when Page Table Isolation(PTI) is enabled. When PTI is enabled, bit 12 of CR3 register is used to split user space and kernel space. Also bit 11:0 is used for Process Context IDentifiers(PCID). To open an SADUMP dumpfile, the value of CR3 is used to calculate KASLR offset and phys_base; this patch masks the CR3 register value correctly for a PTI enabled kernel. * Second phase of future support for x86_64 5-level page tables. This patch is a cleanup/collaboration of the original logic used by the various vtop functions, where several new common functions have been added for extracting page table entries from PGD, P4D, PUD, PMD and PTE pages. The usage of the former PML4 and UPML pages have been replaced with the use of the common PGD page, and use the PUD page in 4-level page table translation. Support for 5-level page tables has been incorporated into the the existing x86_64_kvtop() and x86_64_uvtop_level4() functions. Backwards compatibility for older legacy kernels has been maintained. The third phase of support will automatically detect whether the kernel proper, and whether an individual user task, is utilizing 5-level page tables. This patch enables support for kernel-only 5-level page tables by entering the command line option "--machdep vm=5level". * Xen commit 615588563e99a23aaf37037c3fee0c413b051f4d (Xen 4.0.0.) extended the direct mapping to 5 TB. This area was previously reserved for future use, so it is OK to simply change the upper bound unconditionally. * Add a new "foreach gleader" qualifier option, restricting the output to user-space tasks that are thread group leaders. * Since Xen commit 666aca08175b ("sched: use the auto-generated list of schedulers") crash cannot open Xen vmcores because the "schedulers" symbol no longer exists. Xen 4.7 implemented schedulers as its own section in "xen/arch/x86/xen.lds.S", delimited by the two symbols "__start_schedulers_array" and "__end_schedulers_array". Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve schedulers" * Fix the sample crash.ko memory driver to prevent an s390X kernel addressing exception. Legitimate pages of RAM that successfully pass the page_is_ram() and pfn_valid() verifier functions may not be provided by the s390x hypervisor, and the memcpy() from the non-existent memory to the bounce buffer panics the kernel. The patch replaces the the memcpy() call with probe_kernel_read(). * Fix for the ARM64 "bt" command running against Linux 4.14 and later kernels. Without the patch, the backtraces of the active tasks in a kdump-generated dumpfile are truncated. Without the patch, the panic task will just show the "crash_kexec" frame and the kernel-entry user-space exception frame; the non-panic tasks will show their backtraces starting from the stackframe addresses captured in the per-cpu NT_PRSTATUS notes, and will not display the exception frame generated by the NMI callback, nor any stackframes on the IRQ stack. * Fix for the ARM64 "bt" command in kernels that contain commit 30d88c0e3ace625a92eead9ca0ad94093a8f59fe, titled "arm64: entry: Apply BP hardening for suspicious interrupts from EL0". Without the patch, there may be invalid kernel kernel exception frames displayed on an active task's kernel stack, often below a stackframe of the "do_el0_ia_bp_hardening" function; the address translation of the PC and LR values in the the bogus exception frame will display "[unknown or invalid address]". -- Troy Heber Fri, 16 Feb 2018 10:47:33 -0700 crash (7.2.0-1) unstable; urgency=medium * New upstream (closes: #884464) * Fix for the "snap.so" extension module to pass the KASLR relocation offset value in the ELF header for x86_64 kernels that are compiled with CONFIG_RANDOMIZE_BASE. Without the patch, it is necessary to use the "--kaslr=" command line option, or the session fails with the message "WARNING: cannot read linux_banner string", followed by "crash: vmlinux and vmcore do not match!". * The native gdb "disassemble" command fails if the kernel has been compiled with CONFIG_RANDOMIZE_BASE because the embedded gdb module still operates under the assumption that the (non-relocated) text locations in the vmlinux file are correct. The error message that is issued is somewhat confusing, indicating "No function contains specified address". This patch simply clarifies the error message to indicate "crash: the gdb "disassemble" command is prohibited because the kernel text was relocated by KASLR; use the crash "dis" command instead." * Fix for the "mach -m" command in Linux 4.9 and later kernels that contain commit 475339684ef19e46f4702e2d185a869a5c454688, titled "x86/e820: Prepare e280 code for switch to dynamic storage", in which the "e820" symbol was changed from a static e820map structure to a pointer to an e820map structure. Without the patch, the command either displays just the header, or the header with several nonsensical entries. * Fix for Linux 4.10 and later kdump dumpfiles, or kernels that have backported commit 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe, titled "kexec: export the value of phys_base instead of symbol address". Without the patch, if the x86_64 "phys_base" value in the VMCOREINFO note is a negative decimal number, the crash session fails during session intialization with a "page excluded" or "seek error" when reading "page_offset_base". * Fix for the PPC64 "pte" command. Without the patch, if the target PTE references a present page, the physical address is incorrect. * Fix for a 32-bit MIPS compilation error if glibc-2.25 or later has been installed on the host build machine. Without the patch, the build fails with the error message "mips-linux-nat.c:157:1: error: conflicting types for 'ps_get_thread_area'". * Fix for the validity check of S390X virtual addresses for 5-level page tables where user space memory is mapped above 8 Petabytes. Without the patch, "rd -u" fails and indicates "invalid user virtual address", and "vtop -u" indicates that the address is "(not mapped)". * Crash 7.1.5 commit c3413456599161cabc4e910a0ae91dfe5eec3c21 (xen: Add support for dom0 with Linux kernel 3.19 and newer) from Daniel Kiper implemented support for Xen dom0 vmcores after Linux 3.19 kernel commit 054954eb051f35e74b75a566a96fe756015352c8 (xen: switch to linear virtual mapped sparse p2m list). This patch can be deemed subsequent to Daniel's patch, and implements support Xen PV domU dumpfiles for Linux 3.19 and later kernels. * Fix for the "dis" command to detect duplicate symbols in the case of a "symbol+offset" argument where the duplicates are not contiguous in the symbol list. Without the patch, the first of multiple symbol instances is used in the address evaluation. With the patch, the command will fail with the error message "dis: : duplicate text symbols found:", followed by a list of the duplicate symbols, and their file and line numbers if available. * Enhancement to the error reporting mechanism for the "kmem -[sS]" options. When a fatal error is encountered while gathering basic CONFIG_SLUB statistics, it is possible that the slab cache name is not displayed in the error message, and the line containing the slab cache name, address, etc., is not displayed at all. With this patch, an extra error message indicating "kmem: : cannot gather relevant slab data" will be displayed under the fatal error message; and under that, the CACHE address, cache NAME, OBJSIZE, and SSIZE columns will be displayed, but with "?" under the ALLOCATED, TOTAL, and SLABS columns. * Fix to prevent the "tree -t radix" option from failing when it encounters duplicate entries in a radix_tree_node[slots] array. Without the patch, if a duplicate slot entry is found, the command fails with the message "tree: duplicate tree entry: radix_tree_node: slots[]: \n". (The error can be prevented if the command is preceded by "set hash off".) However, certain radix trees contain duplicate entries by design, such as the "pgmap_radix" radix tree, in which a radix_tree_node may contain multiple instances of the same page_map structure. With the patch, checks will only be made for duplicate radix_tree_node structures. * First phase of future support for x86_64 5-level page tables. New sets of virtual memory offsets have been #define'd and helper macros and placeholder functions for the p4d page tables have been added. The only functional changes with this patchset are dynamically-set PGDIR_SHIFT and PHYSICAL_MASK_SHIFT values that are based upon the kernel configuration. * Fix for a build failure. Without the patch, if the build is done by a user whose username cannot be determined from the user ID number, the build fails immediately with a segmentation fault. * Fix for Linux 4.13-rc0 commit 7fd8329ba502ef76dd91db561c7aed696b2c7720 "x86/boot/64: Rename init_level4_pgt and early_level4_pgt". Without the patch, the crash session fails during initialization with the error message "crash: cannot resolve "init_level4_pgt". * The internal "build_data" string contains the compile-time date, the user id of the builder, and the build machine hostname, and is viewable by the "crash --buildinfo" command line option or by the "help -B" option during runtime. This patch replaces that string data with "reproducible build" if the SOURCE_DATE_EPOCH environment variable contains a value string when the crash binary is compiled. * Fix for Linux 4.13-rc1 commit 2d070eab2e8270c8a84d480bb91e4f739315f03d "mm: consider zone which is not fully populated to have holes". Without the patch, SPARSEMEM page struct addresses are incorrectly calculated because a new section state, and an associated flag bit, has been added to the low bits of the mem_section.section_mem_map address; the extra bit is erroneously passed back as part of the section_mem_map and resultant page struct address, leading to errors in commands such as "kmem -p", "kmem -s", "kmem -n", and any other command that translates a physical address to its page struct address. * Enhancement to the S390X "vtop" command to display page table walk information, adding output showing the following page table contents: "Region-First-Table Entry" (RFTE) "Region-Second-Table Entry" (RSTE) "Region-Third-Table Entry" (RTTE) "Segment Table Entry" (STE) "Page Table Entry" (PTE) "Read address of page" (PAGE) Depending on the size of the address space, the page tables can start at different levels. For example: crash> vtop 3ff8000c000 VIRTUAL PHYSICAL 3ff8000c000 2e3832000 PAGE DIRECTORY: 0000000000aaa000 RTTE: 0000000000aadff8 => 00000002e3c00007 STE: 00000002e3c00000 => 00000002e3df7000 PTE: 00000002e3df7060 => 00000002e383203d PAGE: 00000002e3832000 PAGE PHYSICAL MAPPING INDEX CNT FLAGS 3d10b8e0c80 2e3832000 0 0 1 7fffc0000000000 * Fix the s390dbf time stamps for S390X kernel versions 4.11 and 4.14. With kernel commit ea417aa8a38bc7db ("s390/debug: make debug event time stamps relative to the boot TOD clock") for s390dbf time is stored relative to the kernel boot time. In order to still show absolute time since 1970 we have to detect those kernels and re-add the boot time before printing the records. We can use the tod_to_timeval() symbol to check for those kernels because the patch has removed the symbol. With kernel commit 6e2ef5e4f6cc5734 ("s390/time: add support for the TOD clock epoch extension") the symbol name for storing the boot time has changed from "sched_clock_base_cc" to "tod_clock_base". This commit is currently on the s390 features branch and will be integrated in Linux 4.14. * Further enhancement to the S390X "vtop" command to translate the binary values of the hardware flags for region, segment and page table entries. For example: crash> vtop -u 0x60000000000000 VIRTUAL PHYSICAL 60000000000000 5b50a000 PAGE DIRECTORY: 000000005cea0000 RFTE: 000000005cea0018 => 000000006612400f (flags = 00f) flags in binary : P=0; TF=00; I=0; TT=11; TL=11 RSTE: 0000000066124000 => 000000005d91800b (flags = 00b) flags in binary : P=0; TF=00; I=0; TT=10; TL=11 RTTE: 000000005d918000 => 000000006615c007 (flags = 007) flags in binary : FC=0; P=0; TF=00; I=0; CR=0; TT=01; TL=11 STE: 000000006615c000 => 000000005ce48800 (flags = 800) flags in binary : FC=0; P=0; I=0; CS=0; TT=00 PTE: 000000005ce48800 => 000000005b50a03f (flags = 03f) flags in binary : I=0; P=0 PAGE: 000000005b50a000 or for large pages: crash> vtop -k 0x3d100000000 VIRTUAL PHYSICAL 3d100000000 77c00000 PAGE DIRECTORY: 0000000001210000 RTTE: 0000000001213d10 => 0000000077dc4007 (flags = 007) flags in binary : FC=0; P=0; TF=00; I=0; CR=0; TT=01; TL=11 STE: 0000000077dc4000 => 0000000077c03403 (flags = 03403) flags in binary : AV=0, ACC=0011; F=0; FC=1; P=0; I=0; CS=0; TT=00 * PPC64 kernel commit 2f18d533757da3899f4bedab0b2c051b080079dc lowered the max real address to 53 bits. Without this patch, the warning message "WARNING: cannot access vmalloc'd module memory" appears during initialization, and any command that attempts to read a vmalloc'd kernel virtual address will fail and display "read error" messages. * Display the KASLR relocation value warning message whenever it is in use. Without the patch, the message may not get displayed if the --kaslr option is used, or if the dumpfile is a vmcore generated by the current snap.so extension module, which now exports the relocation value in the header. * Fix to prevent an initialization-time failure when running a live session on a host system that does not have a "/usr/src" directory. Without the patch, the session fails with the message "*** Error in 'crash': free(): invalid pointer:
***". (Lei Chen) * Fix for the ARM64 "bt" command's display of the user mode exception frame at the top of the stack in Linux 4.7 and later kernels. Without the patch, the contents of the user mode exception frame are invalid due to the miscalculation of the starting address of the pt_regs structure on the kernel stack. * Integrated support for usage of the Linux 4.14 ORC unwinder by the x86_64 "bt" command. Kernels configured with CONFIG_ORC_UNWINDER contain .orc_unwind and .orc_unwind_ip sections that can be queried to determine the stack frame size of any text address within a kernel function. For kernels not configured with CONFIG_FRAME_POINTER, the crash utility does frame size calculation by disassembling a function from its beginning to the specified text address, counting the push, pop, and add/sub rsp instructions, accounting for retq instructions that occur in the middle of a function. With this patch, access to the new ORC sections has been plugged into the existing frame size calculator, resulting in a more efficient and accurate manner of determining frame sizes, and as a result, more accurate backtraces. * Fix for the ARM64 "bt" command when run against Linux 4.14-rc1. Without the patch, a message indicating "crash: builtin stackframe.sp offset incorrect!" is issued during session initialization, and the "bt" command fails with the error message "bt: invalid structure member offset: task_struct_thread_context_sp". * For for the "task -R " option on Linux 4.13 and later kernels where the task_struct contains a "randomized_struct_fields_start" to "randomized_struct_fields_end" section. Without the patch, a member argument that is inside the randomized section is not found. * Fix for the "snap.so" extension module to pass the value of the ARM64 "kimage_voffset" value in the ELF header. Without the patch, it is necessary to use the "--machdep kvimage_offset=" command line option, or the session fails with the message "crash: vmlinux and vmcore do not match!". -- Troy Heber Sun, 17 Dec 2017 08:25:06 -0700 crash (7.1.9-1) unstable; urgency=medium * Patch from Balint Reczey : Build crash on all Linux architectures (Closes: #763856, #757450) * Patch from Balint Reczey : Continuous integration tests can fail due to missing packages for the running kernel and missing *-updates packages (Closes: #869367) * Fixes to address three gcc-7.0.1 compiler warnings that are generated when building with "make warn". The warning types are "[-Wnonnull]" in filesys.c, and "[-Wformat-overflow=]" in kernel.c and cmdline.c. * Fix for the PPC64 "mach -o" option to update the OPAL console buffer size from 256K to 1MB, based upon the latest skiboot firmware source. * Fix for the "mod -[sS]" option to prevent the erroneous reassignment of one or more symbol values of a kernel module. Without the patch, when loading a kernel module, a message may indicate "mod: : last symbol: is not _MODULE_END_?" may be displayed, and one or more symbols may be reassigned an incorrect symbol value. If none of the erroneous symbol value reassignments are beyond the end of the module's address space, then there will be no message. * Linux 4.10 commit 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe finally exports the x86_64 "phys_base" value in the VMCOREINFO note, so utilize it whenever it exists. * Implemented a new "log -a" option that dumps the audit logs remaining in kernel audit buffers that have not been copied out to the user-space audit daemon. * Fix for the "kmem
" option and the "search" command in x86_64 kernels that contain, or have backports of, kernel commit 7c1da8d0d046174a4188b5729d7579abf3d29427, titled "crypto: sha - SHA1 transform x86_64 AVX2", which introduced an "_end" text symbol. Without the patch, if a base kernel symbol address that is larger than the "_end" text symbol is passed to "kmem
", its symbol/filename information will not be displayed. Also, when the "search" command scans the __START_KERNEL_map region that contains kernel text and static data, the search will be truncated to stop at the "_end" text symbol address. * Enhancement for the determination of the ARM64 "kimage_voffset" value in Linux 4.6 and later kernels if an ELF format dumpfile does not contain its value in a VMCOREINFO note, or when running against live systems using /dev/mem, /proc/kcore, or an older version of /dev/crash. * Optimization of the "kmem -f
" and "kmem " options to significantly reduce the amount of time to complete the buddy allocator free-list scan for the target address. On very large memory systems, the patch may reduce the time spent by several orders of magnitude. * Fix for a compilation error if glibc-2.25 or later has been installed on the host build machine. Without the patch, the build fails with the error message "amd64-linux-nat.c:496:1: error: conflicting types for 'ps_get_thread_area'". * Fix for the "list -[hH]" options if a list_head.next pointer is encountered that contains an invalid NULL pointer. Without the patch, the "list -[hH]" options would complete/continue as if the NULL were a legitimate end-of-list indicator, and no error would be reported. * Provide basic Huge Page usage as part of "kmem -i" output, showing the total amount of memory allocated for huge pages, and the amount of the total that is free. * Fix for the determination of the x86_64 "phys_base" value when it is not passed in the VMCOREINFO data of ELF vmcores. Without the patch, it is possible that the base address of the vmalloc region is unknown and initialized to an incorrect default address during the very early stages of initialization, which causes the parsing of the PT_LOAD segments for the START_KERNEL_map region to fail. * Fix for the "dis" command to detect duplicate symbols in the case of a "symbol+offset" argument where the duplicates are contiguous in the symbol list. In addition, reject "symbol+offset" arguments if the resultant address goes beyond the end of the function. * Fix for the "set scope" option if the kernel was configured with CONFIG_RANDOMIZE_BASE. Without the patch, the command fails with the message "set: gdb cannot find text block for address: ". This also affects extension modules that call gdb_set_crash_scope() when running with KASLR kernels. * Fix for the extensions/trace.c extension module to account for Linux 4.7 kernel commit 9b94a8fba501f38368aef6ac1b30e7335252a220, which changed the ring_buffer_per_cpu.nr_pages member from an int to a long. Without the patch, the trace.so extension module fails to load on big-endian machines, indicating "extend: Num of pages is less than 0". * Fix for the extensions/trace.c extension module when running on the ppc64 architecture. Without the patch, the trace.so extension module fails to load, indicating "extend: invalid text address: ring_buffer_read". On the ppc64 architecture, the text symbol is ".ring_buffer_read". * Fix for the ARM64 "bt" command. Without the patch, the backtrace of a non-panicking active task generates a segmentation violation when analyzing Android 4.4-based dumpfiles. -- Troy Heber Wed, 26 Jul 2017 12:37:08 -0600 crash (7.1.8-2) unstable; urgency=medium * Enable lzo and snappy compression (Closes: #860319) -- Troy Heber Mon, 17 Apr 2017 19:25:16 -0600 crash (7.1.8-1) unstable; urgency=medium * New upstream 7.1.8 (Closes: #851882) * Accepted patch from Chris J Arges to fix autopkgtest failures (Closes: #788239) * Builds with gcc 7 (Closes: #853357) * Fix for Linux 4.6 commit b03a017bebc403d40aa53a092e79b3020786537d, which introduced the new slab management type OBJFREELIST_SLAB. In this mode, the freelist can be an object, and if the slab is full, there is no freelist. On the next free, an object is recycled to be used as the freelist but not cleaned-up. This patch will go through only known freed objects, and will prevent "kmem -S" errors that indicate "invalid/corrupt freelist entry" on kernels configured with CONFIG_SLAB. * Fix for the initialization-time loading of kernel module symbols if the kernel crashed while running a module's initcall. Without the patch, the crash session fails during initialation with a message similar to "crash: store_module_symbols_v2: total: 7 mcnt: 8". * Fix for a segmentation violation during session inialization when running against a 32-bit MIPS ELF kdump or compressed kdump if a per-cpu NT_PRSTATUS note cannot be gathered from the dumpfile header. Without the the patch, a segmentation violation occurs after the message "WARNING: cannot find NT_PRSTATUS note for cpu: " is displayed. * The 32-bit MIPS PGD_ORDER() macro expects __PGD_ORDER to be signed, which it isn't now since the internal machdep->pagesize is unsigned. Without this patch, module loading fails during initialization on a kernel that has a page size of 16KB, with messages that indicate "please wait... (gathering module symbol data)" followed by "crash: invalid size request: 0 type: pgd page". * For ARM64 dumpfiles with VMCOREINFO, verify the new "VA_BITS" number against the calculated number. * Fix for the ARM64 "bt" command in Linux 4.10 and later kernels that are configured with CONFIG_THREAD_INFO_IN_TASK. Without the patch, the "bt" command will fail for active tasks in dumpfiles that were generated by the kdump facility. * Fix for Linux 4.10 commit 7fd8329ba502ef76dd91db561c7aed696b2c7720 "taint/module: Clean up global and module taint flags handling". Without the patch, when running against Linux 4.10-rc1 and later kernels, the crash utility fails during session initialization with the message "crash: invalid structure size: tnt". * Fix for support of /proc/kcore as the live memory source in Linux 4.8 and later x86_64 kernels configured with CONFIG_RANDOMIZE_BASE, which randomizes the unity-mapping PAGE_OFFSET value. Without the patch, the crash session fails during session initialization with the error message "crash: seek error: kernel virtual address:
type: page_offset_base". * Update to the module taint flags handling patch above to account for the change in size of the module.taints flag from an int to a long, while allowing for a kernel backport that keeps it as an int. * Prepare for the kernel's "taint_flag.true" and "taint_flag.false" member names to be changed to "c_true" and "c_false", which fixes build problems when an out-of-tree module defines "true" or "false". * Prevent the livepatch taint flag check during the system banner display from generating a fatal session-killing error if relevant kernel symbol names or data structures change in the future (again). * Fix for the PPC64 "bt" command for non-panicking active tasks in FADUMP-generated dumpfiles (Firmware Assisted Dump facility). Without the patch, backtraces of those tasks may be of the form "#0 [c0000000700b3a90] (null) at c0000000700b3b50 (unreliable)". This patch uses and displays the ptregs register set saved in the dumpfile header for the non-panicking active tasks. * Fix for a possible segmentation violation when analyzing Linux 4.6 and earlier x86_64 kernels configured with CONFIG_RANDOMIZE_BASE. A segmentation violation may occur during session initialization, just after the patching of the gdb minimal_symbol values message, depending upon the value of KERNEL_IMAGE_SIZE, which was variable in the earlier KASLR kernels. This patch sets the KERNEL_IMAGE_SIZE default value to 1GB for those earlier kernels, and also adds a new "--machdep kernel_image_size=" option that can be used to override the default KERNEL_IMAGE_SIZE value if necessary. * Fix the bracketing of the x86_64 FILL_PML4() macro. * Fix for the "tree -t radix", "irq", and "files -p" command options in Linux 4.6 and later kernels due to upstream changes in the radix tree facility. Without the patch, the commands will fail with the message "radix trees do not exist or have changed their format". * Fix for the "trace.c" extension module. The kernel buffer referenced by "max_tr_ring_buffer" is not available in all configurations of the kernel so the unitialized max_tr_ring_buffer variable should not be used. A similar check existed previously before the recent rework of the trace extension module to support multiple buffers. * Clarification in the display of CONFIG_SLUB object addresses that are displayed by the "kmem" command when SLAB_RED_ZONE has been enabled. By default, CONFIG_SLUB object addresses that are displayed by the "kmem" command will point to the SLAB_RED_ZONE padding inserted at the beginning of the object. As an alternative, a new "redzone" environment variable has been addedd that can be toggled on or off. If "set redzone off" is entered, the object addresses will point to the address that gets returned to the allocator. * Fix for the "CURRENT" value displayed by the "timer -r" command. Without the patch, if the target machine has been up for a long enough time, an arithmetic overflow will occur and the time value displayed will be incorrect. * Fix for 32-bit X86 kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, an invalid kernel PAGE_OFFSET value is calculated and as a result the session fails during session initialization just after the patching of the gdb minimal_symbol values message, showing the warning message "WARNING: cannot read linux_banner string", followed by "crash: /vmlinux and /dev/crash do not match!". This patch also adds a new "--machdep page_offset=" option that can be used if the CONFIG_PAGE_OFFSET value is not the default address of 0xc0000000. * Introduction of a new PPC64-only "mach -o" option that dumps the OPAL "Open Power Abstraction Layer" console buffer. * Fix for the "bt" command on Linux 4.9 and later 32-bit X86 kernels containing kernel commit 0100301bfdf56a2a370c7157b5ab0fbf9313e1cd, subject "sched/x86: Rewrite the switch_to() code". Without the patch, backtraces for inactive (sleeping) tasks fail with the message "bt: invalid structure member offset: task_struct_thread_eip". * Fix for a "[-Wmisleading-indentation]" compiler warning and the associated bug that is generated by lkcd_x86_trace.c when building 32-bit X86 with "make warn" with gcc-6.3.1. * Fix for an invalid "bt" warning on a 32-bit X86 idle/swapper task. Without the patch, the backtrace displays the "cannot resolve stack trace" warning, dumps the backtrace, and then the text symbols: crash> bt PID: 0 TASK: f0962180 CPU: 6 COMMAND: "swapper/6" bt: cannot resolve stack trace: #0 [f095ff1c] __schedule at c0b6ef8d #1 [f095ff58] schedule at c0b6f4a9 #2 [f095ff64] schedule_preempt_disabled at c0b6f728 #3 [f095ff6c] cpu_startup_entry at c04b0310 #4 [f095ff94] start_secondary at c04468c0 bt: text symbols on stack: [f095ff1c] __schedule at c0b6ef8d [f095ff58] schedule at c0b6f4ae [f095ff64] schedule_preempt_disabled at c0b6f72d [f095ff6c] cpu_startup_entry at c04b0315 [f095ff94] start_secondary at c04468c5 crash> The backtrace shown is actually correct. * Another fix for a similar "bt: cannot resolve stack trace" warning on a 32-bit X86 idle/swapper task, but when running on cpu 0. * Remove two one-time warning messages that are displayed when running the "bt" command on Linux 4.2 and later 32-bit X86 kernels. Without the patch, the first "bt" command that is executed will be preceded by "bt: WARNING: "system_call" symbol does not exist", followed by "bt: WARNING: neither "ret_from_sys_call" nor "syscall_badsys" symbols exist". * Fix for Linux 3.15 and later 32-bit X86 kernels containing kernel commit 198d208df4371734ac4728f69cb585c284d20a15, titled "x86: Keep thread_info on thread stack in x86_32". Without the patch, incorrect addresses of each per-cpu hardirq_stack and softirq_stack were saved for usage by the "bt" command. * Additional fix for Linux 3.15 and later 32-bit X86 kernels containing kernel commit 198d208df4371734ac4728f69cb585c284d20a15, titled "x86: Keep thread_info on thread stack in x86_32". The patch fixes the stack transition symbol from "handle_IRQ" to "handle_irq" for usage by the "bt" command. * Fix for 32-bit X86 kernels to determine the active task in a dumpfile in the situation where the task was running on its soft IRQ stack, took a hard IRQ, and then the system crashed while it was running on its hard IRQ stack. * Allow the "--kaslr=" and/or "--kaslr=auto" command line options to be used with the 32-bit X86 architecture. * Removed -Werror from the bfd and opcode library builds. -- Troy Heber Fri, 24 Feb 2017 10:41:52 -0700 crash (7.1.7-1) unstable; urgency=medium * New upstream 7.1.7 (Closes: #843731): * Remove -pie compile option (Closes: #844831) * Set the default 32-bit MIPS HZ value to 100 if the in-kernel config data is unavailable, and have the "mach" command display the value. * Enable SPARSEMEM support on 32-bit MIPS by setting SECTION_SIZE_BITS and MAX_PHYSMEM_BITS. * Fix for Linux 4.9-rc1 commits 15f4eae70d365bba26854c90b6002aaabb18c8aa and c65eacbe290b8141554c71b2c94489e73ade8c8d, which have introduced a new CONFIG_THREAD_INFO_IN_TASK configuration. This configuration moves each task's thread_info structure from the base of its kernel stack into its task_struct. Without the patch, the crash session fails during initialization with the error "crash: invalid structure member offset: thread_info_cpu". * Fixes for the gathering of the active task registers from 32-bit MIPS dumpfiles: (1) If ELF notes are not available, read them from the kernel's crash_notes. (2) If an online CPUs did not save its ELF notes, then adjust the mapping of each ELF note to its CPU accordingly. * Add support for "help -r" on 32-bit MIPS to display the registers for each CPU from a dumpfile. * Fix for Linux 4.9-rc1 commit 0100301bfdf56a2a370c7157b5ab0fbf9313e1cd, which rewrote the x86_64 switch_to() code by embedding the call to __switch_to() inside a new __switch_to_asm() assembly code ENTRY() function. Without the patch, the message "crash: cannot determine thread return address" gets displayed during initialization, and the "bt" command shows frame #0 starting at "schedule" instead of "__schedule". * When each x86_64 per-cpu cpu_tss.x86_tss.ist[] array member (or in older kernels, each per-cpu init_tss.x86_hw_tss.ist[] array member), is compared with its associated per-cpu orig_ist.ist[] array member, ensure that both exception stack pointers have been initialized (non-NULL) before printing a WARNING message if they don't match. * Fix for a possible segmentation violation when analyzing Linux 4.7 x86_64 kernels that are configured with CONFIG_RANDOMIZE_BASE. Depending upon the randomized starting address of the kernel text and static data, a segmentation violation may occur during session initialization, just after the patching of the gdb minimal_symbol values message. * Restore the x86_64 "dis" command's symbolic translation of jump or call target addresses if the kernel was configured with CONFIG_RANDOMIZE_BASE. * Fix for the 32-bit MIPS "bt" command to prevent an empty display (task header only) for an active task if the epc register in its exception frame contains 00000000. * Fix for support of Linux 4.7 and later x86_64 ELF kdump vmcores from kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, the crash session may fail during initialization with the message "crash: vmlinux and vmcore do not match!". * Fix for the x86_64 "mach" command display of the vmemmap base address in Linux 4.9 and later kernels configured with CONFIG_RANDOMIZE_BASE. Without the patch, the command shows a value of ffffea0000000000 next to "KERNEL VMEMMAP BASE". * Since the Linux 3.10 release, the kernel has offered the ability to create multiple independent ftrace buffers. At present, however, the "trace.c" extension module is only able to extract the primary buffer. This patch refactors the trace.c extension module so that the global instance is passed around as a parameter rather than accessing it directly, and then locates all of the available instances and extracts the data from each of them. * Fix for the s390x "bt" command for active tasks. Since the commit above in this crash-7.1.7 release that added support for the new CONFIG_THREAD_INFO_IN_TASK configuration, the backtrace of active tasks can be incomplete. * In collaboration with an update to the /dev/crash kernel driver, fix for Linux 4.6 commit a7f8de168ace487fa7b88cb154e413cf40e87fc6, which allows the ARM64 kernel image to be loaded anywhere in physical memory. Without the patch, attempting to run live on an ARM64 Linux 4.6 and later kernel may display the warning message "WARNING: cannot read linux_banner string", and then fails with the message "crash: vmlinux and /dev/crash do not match!". Version 1.3 of the crash driver is required, which introduces a new ioctl command that retrieves the ARM64-only "kimage_voffset" value that is required for virtual-to-physical address translation. * Update of the sample memory_driver/crash.c /dev/crash kernel driver to version 1.3, which adds support for Linux 4.6 and later ARM64 kernels, kernels configured with CONFIG_HARDENED_USERCOPY, and S390X kernels use xlate_dev_mem_ptr() and unxlate_dev_mem_ptr() instead of kmap() and kunmap(). -- Troy Heber Fri, 02 Dec 2016 11:57:29 -0700 crash (7.1.6-1) unstable; urgency=medium * New upstream 7.1.5 (Closes: #843731): * Introduction of support for "live" ramdump files, such as those that are specified by the QEMU mem-path argument of a memory-backend-file object. This allows the running of a live crash session against a QEMU guest from the host machine. In this example, the /tmp/MEM file on a QEMU host represents the guest's physical memory: $ qemu-kvm ...other-options... \ -object memory-backend-file,id=MEM,size=128m,mem-path=/tmp/MEM,share=on \ -numa node,memdev=MEM -m 128 and a live session run can be run against the guest kernel like so: $ crash live:/tmp/MEM@0 By prepending the ramdump image name with "live:", the crash session will act as if it were running a normal live session. * Fix for the support of ELF vmcores created by the KVM "virsh dump --memory-only" facility if the guest kernel was not configured with CONFIG_KEXEC, or CONFIG_KEXEC_CORE in Linux 4.3 and later kernels. Without the patch, the crash session fails during initialization with the message "crash: cannot resolve kexec_crash_image". * Added support for x86_64 ramdump files. Without the patch, the crash session fails immediately with the message "ramdump: unsupported machine type: X86_64". * Fix for a "[-Werror=misleading-indentation]" compiler warning that is generated by gdb-7.6/bfd/elf64-s390.c when building S390X in a Fedora Rawhide environment with gcc-6.0.0 * Recognize and parse the new QEMU_VM_CONFIGURATION and QEMU_VM_FOOTER sections used for live migration of KVM guests, which are seen in the "kvmdump" format generated if "virsh dump" is used without the "--memory-only" option. * Fix for Linux commit edf14cdbf9a0e5ab52698ca66d07a76ade0d5c46, which has appended a NULL entry as the final member of the pageflag_names[] array. Without the patch, a message that indicates "crash: failed to read pageflag_names entry" is displayed during session initialization in Linux 4.6 kernels. * Fix for Linux commit 0139aa7b7fa12ceef095d99dc36606a5b10ab83a, which renamed the page._count member to page._refcount. Without the patch, certain "kmem" commands fail with the "kmem: invalid structure member offset: page_count". * Fix for an ARM64 crash-7.1.5 "bt" regression for a task that has called panic(). Without the patch, the backtrace may fail with a message such as "bt: WARNING: corrupt prstatus? pstate=0x20000000, but no user frame found" followed by "bt: WARNING: cannot determine starting stack frame for task
". The pstate register warning will still be displayed (as it is essentially a kdump bug), but the backtrace will proceed normally. * Fix for the ARM64 "bt" command in Linux 4.5 and later kernels which use per-cpu IRQ stacks. Without the patch, if an active non-crashing task was running in user space when it received the shutdown IPI from the crashing task, the "-- ---" transition marker from the IRQ stack to the process stack is not displayed, and a message indicating "bt: WARNING: arm64_unwind_frame: on IRQ stack: oriq_sp:
fp: 0 (?)" gets displayed. * Fix for the ARM64 "bt" command in Linux 4.5 and later kernels which are not configured with CONFIG_FUNCTION_GRAPH_TRACER. Without the patch, backtraces that originate from a per-cpu IRQ stack will dump an invalid exception frame before transitioning to the process stack. * Introduction of ARM64 support for 4K pages with 4-level page tables and 48 VA bits. * Implemented support for the redesigned ARM64 kernel virtual memory layout and associated KASLR support that was introduced in Linux 4.6. The kernel text and static data has been moved from unity-mapped memory into the vmalloc region, and its start address can be randomized if CONFIG_RANDOMIZE_BASE is configured. Related support is being put into the kernel's kdump code, the kexec-tools package, and makedumpfile(8); with that in place, the analysis of Linux 4.6 ARM64 dumpfiles with or without KASLR enabled should work normally by entering "crash vmlinux vmcore". On live systems, Linux 4.6 ARM64 kernels will only work automatically if CONFIG_RANDOMIZE_BASE is not configured. Unfortunately, if CONFIG_RANDOMIZE_BASE is configured on a live system, two --machdep command line arguments are required, at least for the time being. The arguments are: --machdep phys_offset= --machdep kimage_voffset= Without the patch, any attempt to analyze a Linux 4.6 ARM64 kernel fails during initialization with a stream of "read error" messages followed by "crash: vmlinux and vmcore do not match!". * Linux 3.15 and later kernels configured with CONFIG_RANDOMIZE_BASE could be identified because of the "randomize_modules" kernel symbol, and if it existed, the "--kaslr=" and/or "--kaslr=auto" options were unnecessary. Since the "randomize_modules" symbol was removed in Linux 4.1, this patch has replaced the KASLR identifier with the "module_load_offset" symbol, which was also introduced in Linux 3.15, but still remains. * Improvement of the ARM64 "bt -f" display such that in most cases, each stack frame level delimiter will be set to the stack address location containing the old FP and old LR pair. * Fix for the introduction of ARM64 support for 64K pages with 3-level page tables in crash-7.1.5, which fails to translate user space virtual addresses. Without the patch, "vtop " fails to translate all user-space addresses, and any command that needs to either translate or read user-space memory, such as "vm -p", "ps -a", and "rd -u" will fail. * Enhancement of the error message generated by the "tree -t radix" option when a duplicate entry is encountered. Without the patch, the error message shows the address of the radix_tree_node that contains the duplicate entry, for example, "tree: duplicate tree entry: ". It has been changed to also display the radix_tree_node.slots[] array index and the duplicate entry value, for example, "tree: duplicate tree entry: radix_tree_node: slots[]: ". * Introduction of a new "bt -v" option that checks the kernel stack of all tasks for evidence of stack overflows. It does so by verifying the thread_info.task address, ensuring the thread_info.cpu value is a valid cpu number, and checking the end of the stack for the STACK_END_MAGIC value. * Fix to recognize a kernel thread that has user space virtual memory attached to it. While kernel threads typically do not have an mm_struct referencing a user-space virtual address space, they can either temporarily reference one for a user-space copy operation, or in the case of KVM "vhost" kernel threads, keep a reference to the user space of the "quem-kvm" task that created them. Without the patch, they will be mistaken for user tasks; the "bt" command will display an invalid kernel-entry exception frame that indicates "[exception RIP: unknown or invalid address]", the "ps" command will not enclose the command name with brackets, and the "ps -[uk]" and "foreach [user|kernel]" options will show the kernel thread as a user task. * Fix for the "bt -[eE]" options on ARM64 to recognize kernel exception frames in VHE enabled systems, in which the kernel runs in EL2. * Fix for the extensions/trace.c extension module to account for the Linux 4.7 kernel commit dcb0b5575d24 that changed the bit index for the TRACE_EVENT_FL_TRACEPOINT flag. Without the patch, the "extend" command fails to load the trace.so module, with the error message "extend: /path/to/crash/extensions/trace.so: no commands registered: shared object unloaded". The patch reads the flag's enum value dynamically instead of using a hard-coded value. * Incorporated Takahiro Akashi's alternative backtrace method as a "bt" option, which can be accessed using "bt -o", and where "bt -O" will toggle the original and optional methods as the default. The original backtrace method has adopted two changes/features from the optional method: (1) ORIG_X0 and SYSCALLNO registers are not displayed in kernel exception frames. (2) stackframe entry text locations are modified to be the PC address of the branch instruction instead of the subsequent "return" PC address contained in the stackframe link register. Accordingly, these are the essential differences between the original and optional methods: (1) optional: the backtrace will start with the IPI exception frame located on the process stack. (2) original: the starting point of backtraces for the active, non-crashing, tasks, will continue to have crash_save_cpu() on the IRQ stack as the starting point. (3) optional: the exception entry stackframe adjusted to be located farther down in the IRQ stack. (4) optional: bt -f does not display IRQ stack memory above the adjusted exception entry stackframe. (5) optional: may display "(Next exception frame might be wrong)". * Fix for the failure of the "sym " option in the extremely unlikely case where the symbol's name string is composed entirely of hexadecimal characters. For example, without the patch, "sym e820" fails with the error message "sym: invalid address: e820". * Fix for the failure of the "dis " option in the extremely unlikely case where the symbol's name string is composed entirely of hexadecimal characters. For example, without the patch, "dis f" fails with the error message "dis: WARNING: f: no associated kernel symbol found" followed by "0xf: Cannot access memory at address 0xf". * Fix for the X86_64 "bt -R " option if the only reference to the kernel text symbol in a backtrace is contained within the "[exception RIP: ]" line of an exception frame dump. Without the patch, the reference will only be picked up if the exception RIP's hexadecimal address value is used. * Fix for the ARM64 "bt -R " option if the only reference to the kernel text symbol in a backtrace is contained within the "[PC:
[]" line of an exception frame dump. Without the patch, the reference will only be picked up if the PC's hexadecimal address value is used. * Fix for the gathering of module symbol name strings during session initialization. In the unlikely case where the ordering of module symbol name strings does not match the order of the kernel_symbol structures, a faulty module symbol list entry may be created that contains a bogus name string. * Fix the PERCENTAGE of total output of the "kmem -i" SWAP USED line when the system has no swap pages at all. Without the patch, both the PAGES and TOTAL columns show values of zero, but it confusingly shows "100% of TOTAL SWAP", which upon first glance may seem to indicate potential memory pressure. * Enhancement to determine structure member data if the member is contained within an anonymous structure or union. Without the patch, it is necessary to parse the output of a discrete gdb "printf" command to determine the offset of such a structure member. * Speed up session initialization by attempting MEMBER_OFFSET_INIT() before falling back to ANON_MEMBER_OFFSET_INIT() in several known cases of structure members that are contained within anonymous structures. * Implemented new "list -S" and "tree -S" options that are similar to each command's -s option, but instead of parsing gdb output, member values are read directly from memory, so the command is much faster for 1-, 2-, 4-, and 8-byte members. * Fix to recognize and support x86_64 Linux 4.8-rc1 and later kernels that are configured with CONFIG_RANDOMIZE_MEMORY, which randomizes the base addresses of the kernel's unity-map address (PAGE_OFFSET), and the vmalloc region. Without the patch, the crash utility fails with a segmentation violation during session initialization on a live system, or will generate a number of WARNING messages followed by the fatal error message "crash: vmlinux and do not match!" with dumpfiles. * Fix for Linux 4.1 commit d0a0de21f82bbc1737ea3c831f018d0c2bc6b9c2, which renamed the x86_64 "init_tss" per-cpu variable to "cpu_tss". Without the patch, the addresses of the 4 per-cpu exception stacks cannot be determined, which causes backtraces that originate on any of the per-cpu DOUBLEFAULT, NMI, DEBUG, or MCE stacks to be truncated. * With the introduction of radix MMU in Power ISA 3.0, there are changes in kernel page table management accommodating it. This patch series makes appropriate changes here to work for such kernels. Also, this series fixes a few bugs along the way: ppc64: fix vtop page translation for 4K pages ppc64: Use kernel terminology for each level in 4-level page table ppc64/book3s: address changes in kernel v4.5 ppc64/book3s: address change in page flags for PowerISA v3.0 ppc64: use physical addresses and unfold pud for 64K page size ppc64/book3s: support big endian Linux page tables The patches are needed for Linux v4.5 and later kernels on all ppc64 hardware. * Fix for Linux 4.8-rc1 commit 500462a9de657f86edaa102f8ab6bff7f7e43fc2, in which Thomas Gleixner redesigned the kernel timer mechanism to switch to a non-cascading wheel. Without the patch, the "timer" command fails with the message "timer: zero-size memory allocation! (called from
)" * Support for PPC64/BOOK3S virtual address translation for radix MMU. As both radix and hash MMU are supported in a single kernel on Power ISA 3.0 based server processors, identify the current MMU type and set page table index values accordingly. Also, in Linux 4.7 and later kernels, PPC64/BOOK3S uses the same masked bit values in page table entries for 4K and 64K page sizes. * Change the RESIZEBUF() macro so that it will accept buffer pointers that are not declared as "char *" types. Change two prior direct callers of resizebuf() to use RESIZEBUF(), and fix two prior users of RESIZEBUF() to correctly calculate the need to resize their buffers. * Fix for the "trace.so" extension module to properly recognize Linux 3.15 and later kernels. In crash-7.1.6, the MEMBER_OFFSET() macro has been improved so that it is able to recognize members of embedded anonymous structures. However, the module's manner of recognizing Linux 3.15 and later kernels depended upon MEMBER_OFFSET() failing to handle anonymous members, and therefore the improvement prevented the module from successfully loading. * If a "struct" command address argument is expressed using the per-cpu "symbol:cpuspec" format, and the symbol is a pointer type, i.e., not the address of the structure, display a WARNING message. * Exclude ARM64 kernel module linker mapping symbols like "$d" and "$x" as is done with 32-bit ARM. Without the patch, a crash session may fail during the "gathering module symbol data" stage with a message similar to "crash: store_module_symbols_v2: total: 15 mcnt: 16". * Enhancement to the ARM64 "dis" command when the kernel has enabled KASLR. When KASLR is enabled on ARM64, a function call between a module and the base kernel code will be done via a veneer (PLT) if the displacement is more than +/-128MB. As a result, disassembled code will show a branch to the in-module veneer location instead of the in-kernel target location. To avoid confusion, the output of the "dis" command will translate the veneer location to the target location preceded by "plt:", for example, "". * Improvement of the "dev -d" option to display I/O statics for disks whose device driver uses the blk-mq interface. Currently "dev -d" always displays 0 in all fields for the blk-mq disk because blk-mq does not increment/decrement request_list.count[2] on I/O creation and I/O completion. The following values are used in blk-mq in such situations: - I/O creation: blk_mq_ctx.rq_dispatched[2] - I/O completion: blk_mq_ctx.rq_completed[2] So, we can get the counter of in-progress I/Os as follows: in progress I/Os == rq_dispatched - rq_completed This patch displays the result of above calculation for the disk. It determines whether the device driver uses blk-mq if the request_queue.mq_ops is not NULL. The "DRV" field is displayed as "N/A(MQ)" if the value for in-flight in the device driver does not exist for blk-mq. -- Troy Heber Wed, 16 Nov 2016 12:10:40 -0700 crash (7.1.5-4) unstable; urgency=medium * Fix FTBFS due compiler warnings in elf64-s390.c -- Troy Heber Wed, 05 Oct 2016 07:47:33 -0600 crash (7.1.5-3) unstable; urgency=medium * Update to packages-arch-specific to enable arm64 -- Troy Heber Mon, 03 Oct 2016 13:23:51 -0600 crash (7.1.5-2) unstable; urgency=medium * Forgot to close bug in the last upload (Closes: #811604) -- Troy Heber Tue, 06 Sep 2016 15:20:09 -0600 crash (7.1.5-1) unstable; urgency=medium * New upstream 7.1.5 (Closes: #817798): * Fix for the handling of Xen DomU ELF dumpfiles to prevent the pre-gathering of p2m frames during session initialization, which is unnecessary since ELF files contain the mapping information in their ".xen_p2m" section. Without the patch, it is possible that the crash session may be unnecessarily aborted if the p2m frame-gathering fails, for example, if the CR3 value in the header is invalid. * Fix for the translation of X86_64 virtual addresses in the vsyscall region between 0xffffffffff600000 and 0xffffffffffe00000. Without the patch, the reading of addresses in that region returns invalid data; in addition, the "vtop" command for an address in that region shows an invalid physical address under the "PHYSICAL" column. * Make the "zero excluded" mode default behavior when analyzing SADUMP dumpfiles because some Fujitsu troubleshooting software assumes the behavior. Also, fix the "set -v" option to show the "zero_excluded" internal variable as "on" if it has been set when analyzing SADUMP dumpfiles. * Fix for the "bt" command to properly pull the stack and frame pointer registers from the NT_PRSTATUS notes of 32-bit tasks running in user-mode on ARM64. Without the patch, the "bt" command utilizes ptregs->sp and ptregs->regs[29] for 32-bit tasks instead of the architecturally-mapped ptregs->regs[13] and ptregs->regs[11], which yields unpredictable/invalid results, and possibly a segmentation violation. * Fix for the "ps -t" option in 3.17 and later kernels that contain commit ccbf62d8a284cf181ac28c8e8407dd077d90dd4b, which changed the task_struct.start_time member from a struct timespec to a u64. Without the patch, the "RUN TIME" value is nonsensical. * Fix for the changes made to the kernel module structure introduced by this kernel commit for Linux 4.5 and later kernels: commit 7523e4dc5057e157212b4741abd6256e03404cf1 module: use a structure to encapsulate layout. Without the patch, the crash session fails during initialization with the error message: "crash: invalid structure member offset: module_core_size". * The crash utility has not supported Xen dom0 and domU dumpfiles since this Linux 3.19 commit: commit 054954eb051f35e74b75a566a96fe756015352c8 xen: switch to linear virtual mapped sparse p2m list This patch resurrects support for dom0 dumpfiles only. Without the patch, the crash session fails during session initialization with the message "crash: cannot resolve p2m_top". * Fix for the replacements made to the kernel's cpu_possible_mask, cpu_online_mask, cpu_present_mask and cpu_active_mask symbols in this kernel commit for Linux 4.5 and later kernels: commit 5aec01b834fd6f8ca49d1aeede665b950d0c148e kernel/cpu.c: eliminate cpu_*_mask Without the patch, behavior is architecture-specific, dependent upon whether the cpu mask values are used to calculate the number of cpus. For example, ARM64 crash sessions fail during session initialization with the error message "crash: zero-size memory allocation! (called from
)", whereas X86_64 sessions come up normally, but invalid cpu mask values of zero are stored internally. * Fixes for "[-Werror=misleading-indentation]" compiler warnings that are generated by the following files, when building X86_64 in a Fedora Rawhide environment with gcc-6.0.0: gdb-7.6/bfd/coff-i386.c gdb-7.6/bfd/coff-x86_64.c kernel.c x86_64.c lkcd_common.c Without the patch, the warnings in the bfd library files are treated as errors, and abort the build. The three instances in the top-level crash source code directory are non-fatal. There are several other gdb-specific instances that are non-fatal and are not addressed. * Fix for a "[-Werror=shift-negative-value]" compiler warning that is generated by "gdb-7.6/opcodes/arm-dis.c" when building crash with "make target=ARM64" on an x86_64 host with gcc-6.0.0. Without the patch, the warning is treated as an error and the build is aborted. * Fix for a series of "[-Werror=shift-negative-value]" compiler warnings that are generated by "gdb-7.6/bfd/elf64-ppc.c" and "gdb-7.6/opcodes/ppc-opc.c" when building with "make target=PPC64" on an x86_64 host with gcc-6.0.0. Without the patch, the warnings are treated as errors and the build is aborted. * Fix for a "[-Werror=unused-const-variable]" compiler warning that is generated by "gdb-7.6/opcodes/mips-dis.c" when building with "make target=MIPS" on an x86_64 host with gcc-6.0.0. Without the patch, the warning is treated as an error and the build is aborted. * Configure the embedded gdb module with "--disable-sim" in order to bypass the unnecessary build of the libsim.a library. * Implement support for per-cpu IRQ stacks on the ARM64 architecture, which were introduced in Linux 4.5 by this commit: commit 132cd887b5c54758d04bf25c52fa48f45e843a30 arm64: Modify stack trace and dump for use with irq_stack Without the patch, if an active task was operating on its per-cpu IRQ stack on dumpfiles generated by kdump, its backtrace would start at the exception frame that was laid down on the process stack. This patch also adds support for "bt -E" to search IRQ stacks for exception frames, and the "mach" command displays the addresses of each per-cpu IRQ stack. * Fixes for "[-Werror=misleading-indentation]" compiler warnings that are generated by the following files, when building X86_64 in a Fedora Rawhide environment with gcc-6.0.0: gdb-7.6/gdb/ada-lang.c gdb-7.6/gdb/linux-record.c gdb-7.6/gdb/inflow.c gdb-7.6/gdb/printcmd.c gdb-7.6/gdb/c-typeprint.c Without the patch, warnings in the gdb-7.6/gdb directory are not treated as errors, and are non-fatal to the build. * Further fix for the symbol name changes made to the kernel's cpu_online_mask, cpu_possible_mask, cpu_present_mask and cpu_active_mask symbols in Linux 4.5 and later kernels for when the crash session is brought up with "crash -d". Without the patch, the cpus found in each mask are displayed like this example: cpu_possible_(null): cpus: 0 1 2 3 4 5 6 7 cpu_present_(null): cpus: 0 1 cpu_online_(null): cpus: 0 1 cpu_active_(null): cpus: 0 1 The "(null)" string segments above should read "mask". * Fix for the changes made to the kernel module structure introduced by this kernel commit for Linux 4.5 and later kernels: commit 8244062ef1e54502ef55f54cced659913f244c3e modules: fix longstanding /proc/kallsyms vs module insertion race. Without the patch, the crash session fails during initialization with the error message: "crash: invalid structure member offset: module_num_symtab". * Fix for the "dis " option if the function or address is the highest text symbol value in a kernel module. Without the patch, the disassembly may continue past the end of the function, or may show nothing at all. The patch utilizes in-kernel kallsyms symbol size information instead of disassembling until reaching the address of the next symbol in the module. * Fix for the "irq -s" option in Linux 4.2 and later kernels. Without the patch, the irq_chip.name string (e.g. "IO-APIC", "PCI-MSI", etc.) is missing from the display. * Improvement of the accuracy of the allocated objects count for each kmem_cache shown by "kmem -s" in kernels configured with CONFIG_SLUB. Without the patch, the values under the ALLOCATED column may be too large because cached per-cpu objects are counted as allocated. * Fixes to address two gcc-4.1.2 compiler warnings introduced by the previous patch: memory.c: In function ‘count_cpu_partial’: memory.c:17958: warning: comparison is always false due to limited range of data type memory.c: In function ‘count_partial’: memory.c:18729: warning: comparison is always false due to limited range of data type * Introduction of the "whatis -r" and "whatis -m" options. The -r option searches for data structures of a specified size or within a range of specified sizes. The -m option searches for data structures that contain a member of a given type. If a structure contains another structure, the members of the embedded structure will also be subject to the search. The type string may be a substring of the data type name. The output displays the size and name of the data structure. * Apply a fuzz factor of zero to the re-application of a modified version of the gdb-7.6.patch in a pre-existing build directory. Without the patch, it is possible that a previously-applied patch could be applied a second time without the fuzz restriction. * Include sys/macros.h explicitly in filesys.c for the definitions of major(), minor() and makedev(). These functions are defined in the sys/sysmacros.h header, not sys/types.h. Linux C libraries are updating to drop the implicit include, so we need to include it explicitly. * Fix for "kmem -[sS]" options for kernels configured with CONFIG_SLUB. Without the patch, the count displayed in the ALLOCATED column may be too large, and the "kmem -S" display of allocated/free status of individual objects may be incorrect. * Fix for "kmem -[sS]" options for kernels configured with CONFIG_SLUB. Without the patch, if a freelist pointer is corrupt, the address of the slab page being referenced may not be displayed by the error message, showing something like: "kmem: kmalloc-32: slab: 0 invalid freepointer: 6e652f323a302d74". * Fix for the "vm -p" option on kernels that are not configured with CONFIG_SWAP. Without the patch, the command may fail prematurely with the message "nr_swapfiles doesn't exist in this kernel". * Introduction of ARM64 support for 64K pages with 3-level page tables and 48 VA bits. Until now, support has only existed for 64K pages with 2-level page tables, and 4K pages with 3-level page tables. * Fix for the "vm -p" and "vtop " commands if a user page is swapped out. Without the patch, the "/dev" component of the swap file pathname may be missing from its display. * Fix for the x86_64 "vm -p" command to properly emulate the kernel's pte_present() function, which checks for either _PAGE_PRESENT or _PAGE_PROTNONE to be set. Without the patch, user pages whose PTE does not have _PAGE_PRESENT bit set are misconstrued as SWAP pages with an "(unknown swap location") along with a bogus OFFSET value. * When reading a task's task_struct.flags field, check for its size, which was changed from an unsigned long to an unsigned int. * Introduction of support for the 64-bit SPARC V9 architecture. This version supports running against a live kernel. Compressed kdump support is also here, but the crash dump support for the kernel, kexec-tools, and makedumpfile is still pending. Initial work was done by Karl Volz with help from Bob Picco. * Account for the Linux 3.17 increase of the ARM64 MAX_PHYSMEM_BITS definition from 40 to 48. -- Troy Heber Sat, 30 Apr 2016 07:54:33 -0600 crash (7.1.4-1) unstable; urgency=medium * New upstream version 7.1.4, upstream changelog follows: * Fix for the ARM64 "vtop" command when translating kernel virtual addresses within a 2MB or 512MB huge page in which the PGD or PMD contains software-defined PTE bits. Without the patch, the "PAGE:" address value will show the software-defined bits, the command will not display the related page structure translation, and will end with the message "WARNING: sparsemem: invalid section number: ". * Fix for the X86_64 "bt" command in Linux 4.2 and later kernels that are configured with both CONFIG_HAVE_COPY_THREAD_TLS and CONFIG_FRAME_POINTER. Without the patch, the fact that the kernel was compiled with framepointers is not recognized, which may result in backtraces containing stale frame references. * Fix for the "dis" command to support three new x86 instruction extensions that have been added to the Intel instruction set for hardware platforms that support them. The newly-added instructions "clflushopt", "clwb", and "pcommit" prepend 0x66 as a prefix byte to the "clflush", "xsaveopt" and "sfence" instructions respectively. Without the patch: "clflushopt" is disassembled as: "data16" followed by "clflush" "clwb" is disassembled as: "data16" followed by "xsaveopt" "pcommit" is disassembled as: "data16" followed by "sfence" The "clflushopt" instruction was introduced in Linux 3.15 in the clflushopt() function. The "clwb" and "pcommit" instructions were introduced in Linux 4.1 in the clwb() and pcommit_sfence() functions. * Fix for the extensions/trace.c extension module for Linux 4.2 and later kernels. Without the patch, the module fails to load, with the message "failed to init the offset, struct:ftrace_event_call, member:list". * For many years, Xen Dom0 dumps could only be saved in ELF format. Since makedumpfile commit 349a0ed1, it is now possible to save Xen dumps in compressed kdump format. This patch set adds support for these files. Two new files, xen_dom0.c and xen_dom0.h, have been added to provide the common functionality required by both ELF and compressed kdump formats. * Since Linux v4.1, specifically, "MIPS: Rearrange PTE bits into fixed positions.", commit be0c37c985eddc46d0d67543898c086f60460e2e, the MIPS PTE bits are at fixed locations. Since they are macros in the kernel, this patch adds an explicit kernel version check in order to determine and set their values. * Display a machine-type mismatch warning if a little-endian PPC64 compressed kdump created by makedumpfile(8) is used as an argument with a non-PPC64 crash utility binary. Without the patch, the dumpfile is accepted, and the session subsequently fails with a message indicating that that the vmlinux and dumpfile do not match. * Fix for bitmap-handling in SADUMP dumpfiles, which associate each bit in a bitmap with a physical page in the reverse order that is used in kdump-compressed format. The bug had not been detected for a long time because bitmaps in SADUMP formats consist mostly of 0x00 and 0xff excluding a very limited amount of memory space for firmware. * Fix for the behavior of the --zero_excluded option when used with SADUMP dumpfiles. Without the patch, the behavior of --zero_excluded option is the opposite to what is expected: reads of filtered pages return successfully with zero-filled memory, while reads of filtered filtered pages fail when --zero_excluded option has been specified. * Fix for the "kmem -i" command in Linux 2.6.27 and later kernels to prevent the possibility that an arbitrary address may be accessed when calculating the number of total huge pages. Without the patch, the command's "COMMIT LIMIT" and "COMMITTED" values may be invalid. * Added recognition of the new DUMP_DH_EXCLUDED_VMEMMAP flag in the header of compressed kdumps, which is set by the new -e option to the makedumpfile(8) facility. The -e option excludes kernel pages that contain nothing but kernel page structures for pages that are not being included in the dump. If the bit is set in the dumpfile, the crash utility will issue a warning that the dumpfile is known to be incomplete during initialization, just prior to the system banner display. * Fix for the handling of compound pages in Linux 4.4 and later kernels, which contain this kernel commit: commit 1d798ca3f16437c71ff63e36597ff07f9c12e4d6 mm: make compound_head() robust The commit above removes the PG_tail and PG_compound page.flags bits and the page.first_page member, and introduces a page.compound_head member, which is a pointer to the head page and whose bit 0 acts as the tail flag. Without the patch, a SLAB or SLUB warning message that indicates "cannot determine how compound pages are linked" is displayed during initialization, and any command that tracks compound pages will be affected. * Fix for the handling of dynamically-sized task_struct structures in Linux 4.2 and later kernels, which contain these commits: commit 5aaeb5c01c5b6c0be7b7aadbf3ace9f3a4458c3d x86/fpu, sched: Introduce CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT and use it on x86 commit 0c8c0f03e3a292e031596484275c14cf39c0ab7a x86/fpu, sched: Dynamically allocate 'struct fpu' Without the patch, when running on a filtered kdump dumpfile, it is possible that error messages like this will be seen when gathering the tasks running on a system: "crash: page excluded: kernel virtual address: type: "fill_task_struct". * Fix for the "kmem -s
" command in Linux 3.13 and later kernels configured with CONFIG_SLAB. Without the patch, if the address argument is contained within an object in a tail page of a multi-page slab, the command fails with the message "kmem: address is not allocated in slab subsystem:
". Furthermore, in Linux 4.4 and later kernels configured with CONFIG_SLAB, addresses that are contained within an object in a tail page of a multi-page slab will not be marked by their slab cache name by the "rd -S" and "bt -F" commands. * Fix for a segmentation violation when attempting to run live on a a system without the crash.ko memory driver, and whose kernel was configured with CONFIG_STRICT_DEVMEM. Without the patch, if any -d is entered on the command line, the crash session fails during initialization. * Update for the determination of the ARM64 page size for kernels containing this Linux 4.4 commit: commit 9d372c9fab34cd8803141871195141995f85c7f7 arm64: Add page size to the kernel image header Without the patch, the kernel page size is calculated by looking at the size of the "swapper_pg_dir" page directory. With this update, the page size can be determined by checking a flag built into the kernel image header, available in the "_kernel_flags_le" absolute symbol. * Fix for the handling of ARM and ARM64 QEMU-generated ELF dumpfiles and compressed kdump clones. The patch utilizes the NT_PRSTATUS notes in the dumpfile headers instead of reading them from the kernel's "crash_notes", which are not initialized when QEMU generates a dumpfile. Without the patch, these warning messages are displayed during session initialization: WARNING: invalid note (n_type != NT_PRSTATUS) WARNING: cannot retrieve registers for active tasks and running "bt" on an active task causes a segmentation violation. * Update to the previous QEMU-specific patch to handle kdump dumpfiles which have offline cpus, and therefore will not contain associated NT_PRSTATUS notes in the dumpfile header. Without the patch, if there are any offline cpus, a segmentation violation is generated during session initialization. * The s390 stand-alone dump tools may write the kernel memory directly to a block device. When running the crash utility against such a block device, a misleading warning message such as this is displayed: WARNING: /dev/sda1: may be truncated or incomplete PT_LOAD p_offset: 16384 p_filesz: 5497558138880 bytes required: 5497558155264 dumpfile size: 0 With the patch, the warning message above will be replaced by a note using this format: NOTE: /dev/sda1: No dump complete check for block devices * Map CTRL-l to clear the screen while in vi insertion mode. Without the patch, it displays "^L". * Introduced a general-purpose handler to register data structures that the kernel has dynamically downsized from the size indicated by the debuginfo data. At this time, only "kmem_cache" and "task_struct" structures that have been downsized are registered, but others may be added in the future. If a downsized data structure is passed to gdb for display, gdb will request a read of the "full" data structure, which may flow into a memory region that was either filtered by makedumpfile(8), or perhaps into non-existent memory, thereby killing the generating command immediately due to a partial read. With this patch, commands such as "struct" and "task" that reference downsized data structures will have their reads flagged to return successfully if partial read error occurs. * Fix for Linux 3.18 and later 32-bit ARM kernels that are configured with CONFIG_SLAB which contain percpu array_cache structures that were allocated with vmalloc(). Without the patch, during session initialization there will be error messages that indicate "crash: kmem_cache: : invalid array_cache pointer: ", and during runtime, the "kmem -[sS]" commands will show kmem_cache lines that marked as "[INVALID/CORRUPTED]". * Added a new "list -l " option that can only be used in conjunction with "-s", and requires that the "start" address is the address of a list_head, or other similar list linkage structure whose first member points to the next linkage structure. The "-l " argument is the offset of the embedded list linkage structure in the specified "-s" data structure; it can be either a number of bytes or expressed in "struct.member" format. * Enhanced the debug-only display of the first kernel data items read during session initialization. This includes the system's cpu maps, xtime, and utsname data. These require at least "-d1" as a command line option value, and are primarily useful as an aide for debugging suspect dumpfiles that fail during session initialization. * Added "print_array" as a new internal variable that may be turned on/off with the "set" command. When set to "on", gdb's printing of arrays will be set to "pretty", so that the display of each array element will consume one line. * Introduction of the "sys -i" option, which displays the kernel's DMI identification string data if available. * Fix for "crash --osrelease" on Xen kernels that have both VMCOREINFO and VMCOREINFO_XEN ELF notes. Without the patch, the command returns "(unknown)". -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.3-1) UNRELEASED; urgency=medium * New upstream version 7.1.3, upstream changelog follows: * Fix for the "crash --osrelease" option for flattened format dumpfiles in the unlikely event that the dumpfile header does not contain the VMCOREINFO note section from the original ELF /proc/vmcore. Without the patch, the command displays nothing instead of showing "unknown". * Fix for the "kmem -s
", "bt -F[F]", and "rd -S[S]" options in kernels configured with CONFIG_SLUB. Without the patch, if a referenced slab object address comes from a slab cache that utilizes a multiple-page slab, and the object is located within a tail page of that slab cache, it will not be recognized as a slab object. The "bt -F[F]" and "rd -S[S]" options will just show the object address, and the "kmem -s
" object will indicate "kmem: address is not allocated in slab subsystem:
". This bug is a regression that was introduced in crash-7.1.0 by commit 8b2cb365d7fb139e77cedd80d4061332099ed382, which addressed a bug where stale slab object addresses were incorrectly being recognized as valid slab objects. * Fix for a segmentation violation generated by the ARM64 "bt -[f|F]" options when analyzing the active tasks in vmcores generated by the kdump facility. This bug is a regression that was introduced in crash-7.1.2 by commit 15a58e4070486efa2aa965bdd636626e62b65cc7, which was an enhancement of the ARM64 backtrace capability for active tasks in kdump vmcores. * Fix for the extensions/trace.c extension module to account for kernels that are not configured with CONFIG_TRACE_MAX_TRACER. Without the patch, the module fails to load with the error message "failed to init the offset, struct: trace_array, member: max_offset". * If a kdump dumpfile is marked as incomplete in its ELF or compressed kdump header, and the user has not used the --zero_excluded command line option, append a note to the incomplete dump WARNING message shown during invocation that suggests the use of --zero_excluded. * Fix for the RSS value displayed by the "ps" command in Linux 2.6.34 and later big-endian machines. Without the patch, a task's RSS value will be erroneously calculated by using twice its file pages instead of adding its file pages with its anonymous pages. * Do not search for a panic task in s390x dumpfiles that are marked as a "live dump" by the "zgetdump" facility. Without the patch, an exhaustive, unnecessary, search of all kernel stacks that looks for evidence of a system crash may find an invalid reference in a task's kernel stack due to the common zero-based user and kernel virtual address space ranges of the s390x, causing the task to be mistakenly set as the "PANIC" task. * Mark the "crash" task that generated a snapshot vmcore utilizing the "snap.so" extension module as "(ACTIVE)" in the STATE field of the initial system banner and the "set" command. Without the patch, the task's STATE field shows it as the "(PANIC)" task. * Second part of: Do not search for a panic task in s390x dumpfiles that are marked as a "live dump" by the "zgetdump" facility... The first part prevented a search of the active tasks; this part prevents the last-ditch search of all tasks. * When searching all kernel stacks for evidence of a panic task in "live" s390x dumpfiles created by the VMDUMP, stand-alone dump, or "virsh dump" facilities, none of which explicitly mark the dumpfile as a "live dump", run a standard "bt" backtrace on each kernel stack instead of the text-address-only "bt -t". Without the patch, an invalid text reference may be found in a task's kernel stack due to the common zero-based user and kernel virtual address space ranges of the s390x, causing the task to be mistakenly set as the "PANIC" task. * Introduction of the "dis -f
" option, which disassembles from the target address until the end of the function. * Fix for the ARM64 "dis" command to prevent branch target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the PPC64 "dis" command to prevent conditional branch target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the S390X "dis" command to prevent jump target addresses from being displayed as kernel system call alias/wrapper names, for example, "SyS_read+" instead of "sys_read+". * Fix for the "dis" command on architectures with variable-length instructions. Without the patch, "dis [-f] " may continue beyond the end of a function, disassembling the memory that is in between the target function and the next function. For kernel module functions, the module's debuginfo data must be loaded. * Minor cleanup and error handling fix-up for the "dis" command. Without the patch, if the target address of "dis -r" or "dis -f" is not an exact address of an instruction, "dis -r" will continue beyond the target address, and "dis -f" will show nothing. * Reduce the unnecessary error messages if a directory is used as a command line argument. Without the patch, six error messages are displayed: crash: unable to read dump file /tmp /tmp: ELF header read: Is a directory /tmp: ELF header read: Is a directory crash: /tmp: read: Is a directory read_maps: unable to read header from /tmp, errno = 1 crash: vmw: Failed to read '/tmp': [Error 21] Is a directory With the patch applied, the functions that generate those messages are not called; only the standard "not a supported file format", and "Usage" messages will be displayed. * If the method of determining how compound pages are linked cannot be accomplished due to page struct related changes in upstream kernels, issue a WARNING message during session initialization. * Fix for the "timer" command on Linux 4.2 and later kernels, which contain this kernel commit that modifies the tvec_root and tvec data structures: commit bc7a34b8b9ebfb0f4b8a35a72a0b134fd6c5ef50 timer: Use hlist for the timer wheel hash buckets Without the patch, the "timer" command will spew messages indicating "timer: invalid list entry: 0", followed by "timer: ignoring faulty timer list at index of timer array". * Introduction of the "dis -s
" option, which displays the filename and line number that is associated with the specified text location, followed by a source code listing if it is available on the host machine. The line associated with the text location will be marked with an asterisk; depending upon gdb's internal "listsize" variable, several lines will precede the marked location. If a "count" argument is entered, it specifies the number of source code lines to be displayed after the marked location; otherwise the remaining source code of the containing function will be displayed. * Added a new "--src " command line option for use by the "dis -s" option if the kernel source code is not located in the standard location that is compiled into the kernel's debuginfo data. The directory argument should point to the top-level directory of the kernel source tree. -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.2-1) UNRELEASED; urgency=medium * New upstream version 7.1.2, upstream changelog follows: * Enhancement of the ARM64 backtrace capability. Without the patch, backtraces of the active tasks start at the function that is saved in each per-cpu ELF note. With the patch, the backtrace will start at the "crash_kexec" function on the panicking cpu, and at the "crash_save_cpu" function on the other active cpus. By doing so, the backtrace will display the exception handling functions leading to crash_kexec() or crash_save_cpu(), as well as the exception frame register set as it was at the time of the fatal exception on the panic cpu, or when the shutdown IPI was received on the other cpus. * Enabled the "bt -R" option on the ARM64 architecture. Without the patch, the option fails with the message "bt: -R option not supported or applicable on this architecture or kernel". * Enabled the "crash --log vmcore" command line option on the ARM64 architecture. Without the patch, the option fails with the message "crash: crash --log not implemented on ARM64: TBD". * Fix for the S390X "bt" command when running against kernels that have Linux 4.0 commit 2f859d0dad818765117c1cecb24b3bc7f4592074, which removes the "async_stack" and "panic_stack" members from the "pcpu" structure. Without the patch, backtraces of active tasks that were executing I/O or machine check interrupts are not displayed, while other tasks may generate fatal readmem() errors of type "readmem_ul". * Fix to prevent an unnecessary/temporary GETBUF() memory allocation of 1 MB by the dump_mem_map() utility function when the kernel is configured with CONFIG_SPARSEMEM. * Speed up the "crash --osrelease" option when used with "flattened" format dumpfiles. Without the patch, the rearranged data array initialization is performed before the vmcoreinfo data in the header is read, which can take a significant amount of time with large dumpfiles. The patch simply looks for the appropriate vmcoreinfo data string near the beginning of the dumpfile. * Fix for the initialization-time sorting mechanism required for "flattened format" dumpfiles if the dumpfile is truncated/incomplete. Without the patch, the sorting function continues performing invalid reads beyond the of the dumpfile, which may lead to an infinite loop instead of a session-ending error message. In addition, since the sorting operation may take several minutes, a "please wait" message with an incrementing percentage-complete counter will be displayed. * Several fixes associated with the gathering and display of task state. Without the patch: (1) The "ps" command's ST column shows "??" for tasks in the TASK_WAKING state. (2) The "ps" command's ST column shows "??" for tasks in the TASK_PARKED state in Linux 3.14 and later kernels. (3) The STATE field of the initial system banner and the "set" command are incorrect if the task state has the TASK_WAKING, TASK_WAKEKILL modifier, or TASK_PARKED bits set in Linux 3.14 and later kernels. (4) The "foreach DE" task identifier fails if a task with a PID number of 0xDE (222) exists. (5) The "foreach" command's "SW", "PA", "TR" and "DE" task identifiers inadvertently select all tasks in kernel versions that do not have those states. (6) The "help -t" output would display incorrect values for the TASK_WAKEKILL, TASK_WAKING and TASK_PARKED states in Linux 3.14 and later kernels. Lastly, support for the TASK_NOLOAD modifier introduced in Linux 4.2 has been added to STATE field of the "set" command and the initial system banner. * Fix for the internal memory allocation functionality. Without the patch, in the unlikely event where the GETBUF() facility has to utilize malloc() to allocate a buffer, and CTRL-c is entered while that buffer is being zeroed out before being returned to the caller, it may result in a never-ending set of "malloc-free mismatch" error messages. * Fix for the PPC64 "bt" command for active non-panic tasks. Without the patch, the backtrace may fail immediately with the error message "bt: invalid kernel virtual address: f type: Regs NIP value". * Fix for the "bt" command on little-endian PPC64 machines for tasks that are blocked in __schedule(). Without the patch, there will be two "__switch_to" frames displayed before the normal "__schedule" frame that is used as the starting point for blocked tasks. * Fix for the PPC64 "bt" command to align its exception frame verifier function with the most recent version of the kernel's getvecname() function, which was updated in Linux 3.12. Without the patch, the "Hypervisor Decrementer", "Emulation Assist", "Hypervisor Doorbell", "Altivec Unavailable", "Instruction Breakpoint", "Denormalisation", "HMI" and "Altivec Assist" exception types are not recognized and their exception frames not displayed; the "Doorbell" exception type is marked as a "reserved" exception type, * Fix for the "timer" command when run on a kernel with a large number of cpus. Without the patch, the command may fail prematurely with a dump of the internal crash utility allocated buffer statistics followed by the message "timer: cannot allocate any more memory!", * Commit f95ecdc330a11d3701de859aab59a5ab5954aae6, which speeds up "crash --osrelease" for flattened format dumpfiles, inadvertently broke the option for ELF kdump and compressed kdump dumpfiles. * Implementation of two new "files" command options. The "files -c" option is context-sensitive, similar to the regular "files" command when used without an argument, but replaces the FILE and DENTRY columns with I_MAPPING and NRPAGES columns that reflect each open file's inode.i_mapping address_space structure address, and the address_space.nrpages count within it; this shows how many of each open file's pages are currently in the system's page cache. The "files -p " option takes the address of an inode, and dumps all of its pages that are currently in the system's page cache, borrowing the "kmem -p" page structure output. * Modified the qualification for the execution of the "runq -g" option. Without the patch, if the target kernel was not configured with both CONFIG_FAIR_GROUP_SCHED and CONFIG_RT_GROUP_SCHED, the command fails with the message "runq: -g option not supported or applicable on this architecture or kernel". With this patch, if the kernel was built with either CONFIG_FAIR_GROUP_SCHED or CONFIG_RT_GROUP_SCHED, the command will execute. * Fix for the error handling of the "foreach task -R struct.member" format if an invalid structure and/or member is used as an argument. Without the patch, the command will display the expected error indicating "task: invalid structure member reference", but then will be followed by a stream of "task: recursive temporary file usage" error messages. * Force the 32-bit MIPS extensions/eppic.so to be compiled with -m32. This is required when "make extensions" is executed after the top level crash binary has been built with "make TARGET=MIPS" on an x86_64 host. * If the starting hexadecimal address of a function is passed to the "dis" command without a count argument, disassemble the entire function -- similar to when a symbol name of a function is passed without a count argument. Without the patch, only one instruction is displayed. * Fix compiler warning generated by extensions/trace.c when compiled with gcc version 5. Without the patch, the message "warning: the use of 'mktemp' is dangerous, better use 'mkstemp'" is generated. * Update the extensions/eppic.mk file to clone the eppic source code from https://github.com/lucchouina/eppic.git. * Export the previously static symbol_name_count() function, which returns a count of symbols with the same name. Export a new is_symbol_text() function, which checks whether specified symbol entry is a type 't' or 'T'. * If a symbol or symbol+offset argument is passed to the "dis" command, and there are multiple text symbols with the same symbol name, then display a message indicating that there are "duplicate text symbols found", followed by a list of the symbols. Without the patch, the duplicate symbol with the lowest virtual address is used. -- Troy Heber Fri, 15 Jan 2016 09:40:34 -0700 crash (7.1.1-1) unstable; urgency=medium * Autopkgtest fix from Martin Pitt (Closes: #756969): - Drop sudo calls; they potentially hang forever asking for a password or might get denied, destroy the environment, and are not necessary as the test already has "needs-root". - Fix invalid indentation of here-doc - Suppress expected stderr output of apt-key (which causes a test failure) - Drop "set -x", as that causes stderr output and the called commands are already verbose enough. - Drop -security pocket for Ubuntu's ddebs.u.c., as that does not exist. * Fix for two minor issues with the "net" command. Without the patch, the "net -a" option appends its correct output with the command's "Usage:" message; and if either the "net -x" or "net -d" options are used without also specifying "-s" or "-S", the error message would indicate "net: illegal flag: 800000" or "net: illegal flag: 1000000" instead of showing the command's "Usage:" message. * If the kernel (live or dumpfile) has the TAINT_LIVEPATCH bit set, or if the Red Hat "kpatch" module is installed, the tag "[LIVEPATCH]" will be displayed next to the kernel name in the initial system banner and by the "sys" command. This new tag replaces the "[KPATCH]" tag that was introduced in crash-7.0.7. * Addressed three Coverity Scan complaints in vmware_vmss.c: 50:leaked_storage: Variable "fp" going out of scope leaks the storage it points to. 53:leaked_storage: Variable "fp" going out of scope leaks the storage it points to. 256:warning: Use of memory after it is freed * Remove the LKCD-only "propeller spinner" seen when a dumpfile read requires more than 2048 page header accesses. This was put in place because of the non-random-access design of LKCD dumpfiles. Without the patch, the spinner display is intermingled with command output, which complicates the parsing of the output. * Fix to support the Linux version increment from 3 to 4. Without the patch, both dumpfile and live sessions fail during initialization, issuing the message "WARNING: kernel version inconsistency between vmlinux and dumpfile" or "WARNING: kernel version inconsistency between vmlinux and live memory", followed by the nonsensical fatal error message "crash: incompatible arguments: vmlinux is not SMP -- vmcore is SMP" or "crash: incompatible arguments: vmlinux is not SMP -- live system is SMP". To prevent unexpected kernel version bumps in the future, support has been added for version 5. * Add support for more than 16TB of physical memory space in the SADUMP dumpfile format. Without the patch, there is a limitation caused by several 32-bit members of dump_header structure, in particular the max_mapnr member, which overflows if the dumpfile contains more than 16TB of physical memory space. The header_version member of the dump_header structure has been increased from 0 to 1 in this extended new format, and the new 64-bit members will be used. * Fix for command lines that are redirected to a pipe. Without the patch, if an external piped-to command contains a quoted string that includes a "|" character, the command fails with the message "crash: pipe operation failed". * Fix for insecure temporary file usage in _rl_tropen() as reported by readline library CVE-2014-2524. * When the gdb-.patch file has changed and a rebuild is done from within a previously-existing build tree, the "patch -N" option is used to ignore patches that have been previously applied; this patch also applies the "patch -r-" option to prevent unnecessary .rej files from being created. * Fix to account for Xen hypervisor's "domain" structure member name change from "is_paused_by_controller" to "controller_pause_count". Without the patch, in Xen 4.2.5 and later, the crash session fails during initialization with the error message 'crash: invalid structure member offset: domain_is_paused_by_controller". * During initialization, reject useless ARM64 "(A)" and "(a)" absolute symbols that are below the text region. Without the patch, several recently-introduced absolute symbols have been introduced into the kernel, which will be displayed by "sym -l" prior to the first kernel virtual address symbol, and will show up in command output where memory values are translated into kernel symbol references. * Fix for ARM64 kernels to account for changes in the virtual memory layout introduced in Linux 3.17. The vmalloc region end address, and the vmemmap start and end addresses are now calculated at kernel build time, because they depend upon the size of a struct page. Accordingly, the crash utility needs to calculate those three address values dynamically, after the embedded gdb module has initialized. Without the patch, reads of page structures return invalid data due to incorrect virtual-to-physical translations of memory in the vmemmap range. This in turn causes commands that require page structure contents to fail or show invalid data, such as "kmem -p", "kmem -[sS]", and the "kmem -[fF]" options. * Fix to support ELF vmcore dumpfiles whose PT_LOAD file offset values of their respective memory segments are not laid out sequentially from low to high in the dumpfile. This has only been seen in ELF dumpfiles created by VMware's "vmss2core -M" facility. Without the patch, the crash session may fail during initialization, either with the message "cannot malloc ELF header buffer", or "crash: : not a supported file format". * Enhancement to the support of VMware .vmss suspended state dumpfiles. There may be holes in the memory address saved for PCI, etc. In such cases, the memory dump is divided into regions. With this patch, up to 3 memory regions are supported. * Fortified the error handling of task gathering from the pid_hash[] chains during session initialization. If a chain has been corrupted, the patch prevents the sequence from entering an infinite loop, and the error messages associated with corrupt/invalid chains have been updated to report the pid_hash[] index number. * Implemented a new STRDUPBUF() utility that will duplicate an existing string into a buffer allocated with GETBUF(). As is the case with any buffer allocated with GETBUF(), it is only meant to exist during the life-span of the current command. If it is not explicitly freed via FREEBUF(), then it will be freed automatically prior to the next command. * Implemented a new fill_struct_member_data() function that gathers a bundle of data that describes a structure member. The function receives a pointer to a struct_member_data structure, in which the caller has initialized the "structure" and "member" name pointers: struct struct_member_data { char *structure; char *member; long type; long unsigned_type; long length; long offset; long bitpos; long bitsize; }; A gdb "printm" command is crafted using those two fields, and the output of the command is used to initialize the remaining six fields. Adapted from Qiao Nuohan's "pstruct" extension module. * Implemented a new "runq -c cpu(s)" option to display the run queue data of specified cpus. It can be used in conjunction with all runq command options. The cpus must be specified in a comma- and/or dash-separated list; for examples, "3", "1,8,9", "1-23", or "1,8-15". * Build extension modules that utilize the generic extensions/Makefile with -g. In addition, build the snap.c extension module with -g. * Several fixes, updates, and enhancements for 32-bit MIPS support: (1) The MIPS general purpose registers in the elf_gregset_t don't start at index 0 but at index 6. (2) Adjust for the kernel's pt_regs structure changes between kernel versions. For example, fields are inserted into the middle based on build time options, and the amount of padding at the head of the structure was changed relatively recently. To handle this, split the structure definition into two parts and get the offsets of these two parts dynamically. (3) Do not display each parsed kernel symbol during initialization when invoked with "crash -d8". (4) Add support for loading raw MIPS ramdump dumpfiles. (5) Add support for compressed kdump dumpfiles. * Fix for a typo in "help foreach", and a fix for a spelling error in "help input". * Fix for "and and" and "the the" typos in the README file. * Fix to address the Xen 4.5.0 hypervisor symbol name change from "dom0" to "hardware_domain". Without the patch, the crash session fails with the error message "crash: cannot resolve: dom0". * Fix for a regression in crash-7.1.0 that causes failures when the "crash -t" option is run on a live system, and when analyzing remote Linux kernels. Without the patch, "crash -t" on a live system fails with the message "crash: cannot open remote memory source: /dev/mem", and attempts to analyze a Linux kernel remotely just shows the kernel timestamp and exits immediately. * Speed up the session invocation time of "flattened" format dumpfiles created by the makedumpfile(8) facility. When sorting the blocks of memory by their intended ELF or compressed kdump file offsets, the patch replaces the bubble-sort method that is currently used with an insertion sort method. * Remove the non-existent "-L" option from the "ps" command's mutually- exclusive options error message. * Fix for the "irq", "mount", "kmem -p" and "kmem -v" commands when they are used in an input file. If more than one of any of those four commands are used in an input file, the output of the second and subsequent command instances will not display their respective command headers. * Implemented a new "kmem -m" option that is similar to "kmem -p", but it allows the user to specify the page struct members to be displayed. The option takes a comma-separated list of one or more page struct members, which will be displayed following the page structure address. The "flags" member will always be expressed in hexadecimal format, and the "_count" and "_mapcount" members will always be expressed in decimal format. Otherwise, all other members will be displayed in hexadecimal format unless the current output radix is 10 and the member is a signed/unsigned integer. Members that are data structures may be specified by the data structure's member name, or expanded to specify a member of that data structure. For example, "-m lru" refers to a list_head data structure, in which case both the list_head.next and list_head.prev pointer values will be displayed; if "-m lru.next" is specified, just the list_head.next value will be displayed. * Support enhancement for the 32-bit MIPS architecture that retrieves the per-cpu registers from the NT_PRSTATUS notes stored in the header of compressed kdump dumpfiles. * Fix to remove an invalid warning message on ARM64 if a crash session is invoked with the "-d" debug flag. Without the patch, the invalid message is "WARNING: SPARSEMEM_EX: questionable section values". * Remove the leftover ".constructor" build file in the extensions subdirectory when "make extensions" is complete, and update the top-level .gitignore file to ignore post-build extensions subdirectory files. * Fix for a segmentation violation generated by the "help -[n|D]" options on ARM64 compressed kdumps. * Additional output for the "help [-D|-n]" options on ARM64. For ELF kdump vmcores and compressed kdumps, the elf_prstatus structure in each NT_PRSTATUS note will be translated. * The "help -r" option has been extended to dump the ARM64 registers stored in each per-cpu NT_PRSTATUS note in compressed kdump and ELF kdump dumpfiles. * Fix for the ARM64 page size determination on Linux 4.1 and later kernels. Without the patch, the crash session fails during initialization with the message "crash: invalid/unsupported page size: 98304" on kernels with 64K pages. On kernels with 4K pages, the message is "crash: invalid/unsupported page size: 6144". In addition, the "-p " command line override option had no effect on ARM64; that has been fixed as well. * Fix for the DATE display in the initial system banner and by the "sys" command to account for the Linux 3.17 change that moved the "timekeeper" symbol and structure into a containing tk_core structure; the "shadow_timekeeper" timekeeper will be used as an alternative. Without the patch, the DATE shows something within a few hours of the Linux epoch, such as "Wed Dec 31 18:00:00 1969". * Fixes for the translation of ARM64 PTEs, as displayed by the "vm -p" and "vtop" commands. Without the patch, if "vm -p" references a swapped-out page on Linux 4.0 and later kernels, the SWAP location may indicate "(unknown swap location)", and will show an invalid OFFSET value; on Linux 3.13 and later kernels, running "vtop" on a user virtual address incorrectly translates the PTE contents of swapped out pages by showing a PHYSICAL address and FLAGS translation instead of the SWAP device and OFFSET. It is possible that there may be PTE bit translation errors on other kernel versions; the patch addresses the changes in ARM64 PTE bit definitions made in Linux 3.11, 3.13, and 4.0 kernels. * Enhanced the "struct.member" display capability of the "struct", "union", "task", "list" and "tree" commands. If a specified structure member contains an embedded structure, the output may be restricted to just the embedded structure by expressing the .member argument as "member.member". If a specified structure member is an array, the output may be restricted to a single array element by expressing the .member argument as "member[index]". Furthermore, these embedded member specifications may extend beyond one level deep, for example, by expressing the member argument as "member.member.member", or "member[index].member". * Fix for any command that passes strings to gdb for evaluation, where the string contains a parentheses-within-parentheses expression along with a ">" or ">>" operator inside the outermost set of parentheses. Without the patch, a command such as the following fails like so: crash> p ((1+1) >> 1) p: gdb request failed: p ((1+1) crash> * Fix for the handling of ARM64 kernel module per-cpu symbols. Without the patch, if the debuginfo data of an ARM64 kernel module that contains a per-cpu section is loaded by "mod -s " or "mod -S", commands such as "bt" or "sym" may incorrectly translate the module's virtual addresses to symbol names. * Fix to support the Linux version increment from 3 to 4. (Closes: #699367) Without the patch, both dumpfile and live sessions fail during initialization, issuing the message "WARNING: kernel version inconsistency between vmlinux and dumpfile" or "WARNING: kernel version inconsistency between vmlinux and live memory", followed by the nonsensical fatal error message "crash: incompatible arguments: vmlinux is not SMP -- vmcore is SMP" or "crash: incompatible arguments: vmlinux is not SMP -- live system is SMP" -- Troy Heber Wed, 27 May 2015 11:20:02 -0600 crash (7.1.0-1) UNRELEASED; urgency=medium * Support for "irq" and "irq -u" on the S390 and S390X architectures if they are running Linux 3.12 and later kernels. Older kernels without GENERIC_HARDIRQ support will fail with the error message "irq: cannot determine number of IRQs". * Fix for the handling of multiple ramdump images. Without the patch, entering more than one ramdump image on the command line may result in a segmentation violation. * Implemented the capability of building crash as an x86_64 binary for analyzing little-endian PPC64 dumpfiles on an x86_64 host, which can be done by entering "make target=PPC64". After the initial build is complete, subsequent builds can be done by entering "make" alone. * Fix for the "crash --log " option on both of the PPC64 architectures. Without the patch, the command fails with the message "crash: seek error: physical address:
type: log_buf pointer", followed by "crash: cannot read log_buf value". This bug was introduced in crash-7.0.0 by a patch that added support for the PPC64 BOOK3E processor family. * Fix for a misleading fatal error message if a 32-bit crash binary built on an X86_64 host with "make target=X86" or "make target=ARM" is used on a live X86_64 system without specifying a vmlinux namelist. Without the patch, the session fails with the message "crash: cannot find booted kernel -- please enter namelist argument". The error message will be "crash: compiled for the X86 architecture" or "crash: compiled for the ARM architecture". * Fix for finding the starting stack and instruction pointer hooks for the active tasks in x86_64 ELF or compressed dumpfiles created by the KVM "virsh dump --memory-only" facility. Without the patch, the backtraces of active tasks may show an invalid starting frame that indicates "__schedule". The fix displays the exception RIP and dumps the register contents that are stored in the dumpfile header. If the active task was operating in the kernel, the backtrace continues from there; if the task was operating in user-space, the backtrace is complete at that point. * Fix for the "waitq" command when it is passed the address of a wait_queue_head_t structure. Without the patch, if the entries on the list are dynamically-created __wait_queue structures on kernel stacks, the tasks owning the kernel stack are not displayed. * Implemented a new "net -n [pid|task]" option that displays the list of network devices with respect the network namespace of the current context, or that of a task specified by the optional "pid" or "task" argument. The former "net -n
" option that translates an IPv4 address expressed as a decimal or hexadecimal value into a standard numbers-and-dots notation has been changed to "net -N". * Fix for the kernel virtual address to symbol name translation for special text region delimiter symbols declared in vmlinux.lds.S with VMLINUX_SYMBOL(), such as __sched_text_start, __lock_text_start, __kprobes_text_start, __entry_text_start and __irqentry_text_start. Without the patch, if the addresses of those symbols are the same value as the first "real" symbol in those text regions, commands such as "dis" and "sym" may show the "_text_start" symbol name instead of the desired text symbol name. * Enhancement of the "kmem -i" option to display memory overcommit information, which will be appended to the traditional output of the command. For example: crash> kmem -i PAGES TOTAL PERCENTAGE TOTAL MEM 1965332 7.5 GB ---- FREE 78080 305 MB 3% of TOTAL MEM USED 1887252 7.2 GB 96% of TOTAL MEM SHARED 789954 3 GB 40% of TOTAL MEM BUFFERS 110606 432.1 MB 5% of TOTAL MEM CACHED 1212645 4.6 GB 61% of TOTAL MEM SLAB 146563 572.5 MB 7% of TOTAL MEM TOTAL SWAP 1970175 7.5 GB ---- SWAP USED 5 20 KB 0% of TOTAL SWAP SWAP FREE 1970170 7.5 GB 99% of TOTAL SWAP COMMIT LIMIT 2952841 11.3 GB ---- COMMITTED 1150595 4.4 GB 38% of TOTAL LIMIT The COMMIT LIMIT and COMMITTED information is similar to that displayed by the CommitLimit and Committed_AS lines in /proc/meminfo. * Fix for the "kmem [-s|-S]
" command, and the "rd -S[S]" and "bt -F[F]" options. Without the patch, if the page structure associated with a memory address still contains a (stale) pointer to the address of a kmem_cache structure, but whose page.flags does not have the PG_slab bit set, the address is incorrectly presumed to be contained within that slab cache. As as result, the "kmem" command may display one or more messages indicating a "bad inuse counter", a "bad next pointer" or a "bad s_mem pointer", followed by an "address not found in cache" error message. The "rd -S[S]" and "bt -F[F]" commands may mislabel memory locations as belonging to slab caches. * Added a new "vm -M " option. When a task is exiting, the mm_struct address pointer in its task_struct is NULL'd out, and as a result, the "vm" command looks like this: crash> vm PID: 4563 TASK: ffff88049863f500 CPU: 8 COMMAND: "postgres" MM PGD RSS TOTAL_VM 0 0 0k 0k However, the mm_struct address can be retrieved from the task's kernel stack and entered manually with this option, which allows the "vm" command to attempt to dump the virtual memory data of the task. It may, or may not, work, depending upon how far the virtual memory deconstruction has proceeded. This option only verifies that the address entered is from the "mm_struct" slab cache, and that its mm_struct.mm_count is non-zero. * Fix for the X86_64 "bt" and "mach" commands when running against kernels that have the following Linux 3.18 commit, which addresses CVE-2014-9322. The kernel patch removes the per-cpu exception stack used for handling stack segment faults: commit 6f442be2fb22be02cafa606f1769fa1e6f894441 x86_64, traps: Stop using IST for #SS Without this patch, backtraces that originate on any of the other 4 per-cpu exception stacks will be mis-labeled at the transition point back to the previous stack. For example, backtraces that that originate on the NMI stack will indicate that they are coming from the "DOUBLEFAULT" stack. The patch examines all idt_table entries during initialization, looking for gate descriptors that have non-zero index values, and when found, pulls out out the handler function address; from that information, the exception stack name string array is properly initialized rather than being hard-coded. This fix also properly labels the exception stack names on x86_64 CONFIG_PREEMPT_RT realtime kernels, which only utilize 3 exception stacks instead of the traditional 5 (now 4 with this kernel commit), instead of just showing "RT". Also, without the patch, the "mach" command will mis-label the stack names when it displays the base addresses of each per-cpu exception stack. * Additional output for the "help [-D|-n]" options on X86 and X86_64 architectures. For compressed kdumps, the elf_prstatus structure in each per-cpu NT_PRSTATUS note will be translated. For ELF kdumps, the elf_prstatus structure in each per-cpu NT_PRSTATUS note, and the QEMUCPUState structure in each per-cpu QEMU note, will be translated. * Implemented a new "bt -A" option for the S390X architecture, which adds support for displaying the new s390x vector registers. For ELF dumps, the registers are taken from the VX ELF notes; for s390 dumps. the registers are taken from memory. The option produces the same output as the -a option, but also displays the vector registers for all active tasks. * Fix for the 32-bit ARM virtual-to-physical address translation of unity-mapped kernel virtual addresses in kernels configured with CONFIG_ARM_LPAE if the system's phys_base exceeds 4GB. * Fix for the "help [-D|-n]" option on 32-bit X86 kernels that use the 64-bit ELF vmcore format generated by "virsh dump --memory-only". Without the patch, the QEMUCPUState structures in QEMU notes are not translated. * Additional output for the "help [-D|-n]" options on X86 and X86_64 architectures. For compressed kdumps generated by "virsh dump --memory-only", the QEMUCPUState structure in each per-cpu QEMU note will be translated, and the dumpfile offset address of each QEMU note will be displayed. * Introduction of support for the 32-bit MIPS architecture. This initial support is restricted to 32-bit MIPS kernels that are configured as little-endian. With respect to dumpfile types, only ELF vmcores are recognized. In addition to building crash as a 32-bit MIPS binary, it is also possible to build crash as an x86 binary on an x86 or x86_64 host so that crash analysis of MIPS dumpfiles can be performed on an x86 or x86_64 host. The x86 binary can be built by entering "make target=MIPS" for the initial build; subsequent builds with MIPS support can be accomplished by entering "make" alone. * Added support for big-endian 32-bit MIPS kernels. Only native MIPS crash binaries may be built with big-endian support; running the "make target=MIPS" build option on an x86 or x86_64 host creates x86 binaries with little-endian support only. * Update the "ps" help page to reflect that the "ps -l" option may be based upon the task_struct's sched_entity.last_arrival. Without the patch, it indicates that either the task_struct's last_run or timestamp value are used. * Fix for the "kmem -z" option output to change the zone structure's pages_scanned field from a signed to an unsigned long integer. * Fix for "kmem -z" option on Linux 2.6.30 and later kernels. Without the patch, the zone structure's all_unreclaimable and pages_scanned fields are not dumped. * Fix for the PPC64 "bt" command on both big-endian and little-endian architectures. Without the patch, backtraces of the active tasks may be "empty" on little-endian machines, or show a one-liner of the form: "#0 [c0000005f4db7a60] (null) at 501 (unreliable)" on big-endian machines. * Additional output for the "help [-D|-n]" options for the PPC64 architecture. For compressed kdump and ELF kdump dumpfiles, the elf_prstatus structure in each per-cpu NT_PRSTATUS note will be translated. * The "help -r" option has been extended to dump the PPC64 registers stored in each per-cpu NT_PRSTATUS note in compressed kdump and ELF kdump dumpfiles. * Prevent "help -r" and "help -[D|n]" from generating a segmentation violation when attempting to access non-existent NT_PRSTATUS notes for offline cpus in ELF or compressed kdumps. * Fix for the "kmem -V" option output to change the display of the vm_event_states fields from signed to unsigned long integers. * Fix to allow the "ps -G" qualifier to be used in conjunction with the "ps -p" option. Without the patch, "ps -G -p" fails with the error message "ps: do_list: hash queue is in use?" * Fix for the "runq" command on kernels that are configured with CONFIG_RT_GROUP_SCHED=n. Without the patch, real-time tasks queued on a per-cpu rt_rq.rt_prio_array will not be displayed under the "RT PRIO_ARRAY" header. * Fix for a regression introduced in crash-7.0.9 when running on a live 32-bit ARM machine. Without the patch, a segmentation violation is generated during session initialization. * Enhancement of the "PANIC:" message displayed by the initial system banner and by the "sys" command. Without the patch, many panic types are categorized under the same generic message of the form: PANIC: "Oops: 0000 [#1] SMP " (check log for details) or in other types of crashes, no message is displayed at all. With this patch, a more comprehensive search is made of the kernel log for a more informative panic message. * Add appropriate checks for the MIPS architecture to allow extension modules to be loaded with the "extend" command. * Update the extensions/trace.c extension module to account for the movement of the ftrace_event_call.name member into an anonymous union in Linux 3.15, commit de7b2973903c6cc50b31ee5682a69b2219b9919d. * Added support for VMware .vmss suspended state files as dumpfiles. Similar to all other supported dumpfile types, it is invoked as: $ crash vmlinux .vmss A ".vmss" file created by the VMware vSphere ESX hypervisor contains a header and the full memory image. A ".vmss" file created by the VMware Workstation facility only contains the header, and must be accompanied by a companion ".vmem" memory image that is located in the same directory as the ".vmss" file. -- Troy Heber Wed, 27 May 2015 11:20:02 -0600 crash (7.0.9-1) UNRELEASED; urgency=medium * Fix the CPU timer and clock comparator output for the "bt -a" command on S390X machines. The output of CPU timer and clock comparator has always been incorrect because: - We added S390X_WORD_SIZE (8) instead of 4 to get the second word - We did not left shift the clock comparator by 8 The fix gets the complete 64 bit values and by shifting the clock comparator correctly. * Add "/lib/modules//build" to the list of directories that are searched for the currently-running kernel on live systems. This will automatically locate the vmlinux namelist for kernels that were locally installed with "make modules_install install". * Addressed 3 Coverity Scan issues: (1) task.c: initialize the "curr" and "curr_my_q" variables in the dump_tasks_in_task_group_cfs_rq() function. (2) ramdump.c: make the "rd" and "len" return values from read() and write() calls in write_elf() to be ssize_t types. (3) cmdline.c: make the parsed PATH string buffer equal to the size of the PATH string + 1 to prevent a possible buffer overflow when a command line starts with a "!". * Fix for the one-time (dumpfile), or as-required (live system), gathering of tasks from the kernel pid_hash[] in 2.6.24 and later kernels. Without the patch, if an entry in a pid_hash[] chain is not related to the "init_pid_ns" pid_namespace structure, any remaining entries in the hlist chain are skipped. * Update the "extensions/snap.mk" file to allow the "snap.so" extension module to be built outside of a crash source tree on a ppc64le PPC64 little-endian host. Without the patch, "make -f snap.mk" would fail to compile, indicating "gcc: error: macro name missing after '-D'" * Improve the method for determining whether a 32-bit ARM vmlinux is an LPAE enabled kernel by first checking whether CONFIG_ARM_LPAE exists in the vmcoreinfo data, and if it does not, by then checking whether the next higher symbol above "swapper_pg_dir" is 0x5000 bytes higher in value. * Fix "defs.h" for building extension modules outside of the crash utility source tree on PPC and PPC64 machines. Without the patch, both PPC and PPC64 will get #define'd if the extension module build procedure does not #define one or the other, which in turn causes multiple conflicting declarations. * Fix for the "ps" command performance degradation patch the was introduced in crash-7.0.8. Without this patch, it is possible that the "ps" command may fail prematurely with the error message "ps: bsearch for tgid failed: task:
tgid: " when running on a live system or against a "live" dumpfile. * Set the 32-bit ARM HZ value to a default value of 100 if the kernel was not configured with CONFIG_IKCONFIG. Without the patch, the initial system banner and the "sys" command show "UPTIME: (cannot calculate: unknown HZ value)", the "ps -t" option shows "RUN TIME: (cannot calculate: unknown HZ value)", and the "timer -r" option kills the crash session with a floating point exception. * Fix the error message displayed if the vmlinux or vmcore file is not the same endian as the crash utility binary. Without the patch the filename is shown with the incorrect/opposite endian type. * Update the "ps" command's "ST" task state display to recognize the TASK_PARKED state in Linux 3.9 and later kernels. Without the patch, the command's "ST" column entry for parked tasks shows "??". The state column will now show "PA", and the foreach command will accept "PA" as a "state" argument. * Fortify the protection against the use of an invalid/corrupted CONFIG_SLAB kmem_cache per-cpu array_cache.limit value during session initialization. In a recently seen vmcore, several of the array_cache.limit values were corrupted such that they were stored as negative values, which in turn caused the "kmem -[sS]" options to fail immediately with a dump of the internal memory buffer allocation statistics and the error message "kmem: cannot allocate any more memory!". * Implement a new "offline" internal crash variable that can be set to either "show" (the default) or "hide". When set to "hide", certain command output associated with offline cpus will be hidden from view, and the output will indicate that the cpu is "[OFFLINE]". The new variable can be set during invocation on the crash command line via the option "--offline [show|hide]". During runtime, or in a .crashrc or other crash input file, the variable can be set by entering "set offline [show|hide]". The commands or options that are affected when the variable is set to "hide" are as follows: o On X86_64 machines, the "bt -E" option will not search exception stacks associated with offline cpus. o On X86_64 machines, the "mach" command will append "[OFFLINE]" to the addresses of IRQ and exception stacks associated with offline cpus. o On X86_64 machines, the "mach -c" command will not display the cpuinfo_x86 data structure associated with offline cpus. o The "help -r" option has been fixed so as to not attempt to display register sets of offline cpus from ELF kdump vmcores, compressed kdump vmcores, and ELF kdump clones created by "virsh dump --memory-only". o The "bt -c" option will not accept an offline cpu number. o The "set -c" option will not accept an offline cpu number. o The "irq -s" option will not display statistics associated with offline cpus. o The "timer" command will not display hrtimer data associated with offline cpus. o The "timer -r" option will not display hrtimer data associated with offline cpus. o The "ptov" command will append "[OFFLINE]" when translating a per-cpu address offset to a virtal address of an offline cpu. o The "kmem -o" option will append "[OFFLINE]" to the base per-cpu virtual address of an offline cpu. o The "kmem -S" option in CONFIG_SLUB kernels will not display per-cpu data associated with offline cpus. o When a per-cpu address reference is passed to the "struct" command, the data structure will not be displayed for offline cpus. o When a per-cpu symbol and cpu reference is passed to the "p" command, the data will not be displayed for offline cpus. o When the "ps -[l|m]" option is passed the optional "-C [cpus]" option, the tasks queued on offline cpus are not shown. o The "runq" command and the "runq [-t/-m/-g/-d]" options will not display runqueue data for offline cpus. o The "ps" command will replace the ">" active task indicator to a "-" for offline cpus. The initial system information banner and the "sys" command will display the total number of cpus as before, but will append the count of offline cpus. Lastly, a fix has been made for the initialization time determination of the maximum number of per-cpu objects queued in a CONFIG_SLAB kmem_cache so as to continue checking all cpus higher than the first offline cpu. These changes in behavior are not dependent upon the setting of the crash "offline" variable. * Adjustment to the "offline" patch-set to make the initial system banner, the "sys" command, and the X86_64 "mach" command, to only show the "OFFLINE" cpu count if there are actually offline cpus. * Make the "bt -E" option conform to a "-c cpu(s)" specification when the the two options are used together. Without the patch, "bt -E" ignores a cpu specifier. * Fix for the determination of the cpu count on 32-bit ARM machines. Without the patch, if certain patterns of cpus are offline, the count may be too small, causing cpu-dependent commands to not recognize online cpus. * Fix for a missing exception frame dump by the X86_64 "bt" command when an IRQ is received while a task is running on its per-cpu interrupt stack with interrupts enabled. * Fix for the determination of the cpu count on ARM64 machines. Without the patch, if certain patterns of cpus are offline, the count may be too small, causing cpu-dependent commands to not recognize online cpus. * Fix for a possible SIGSEGV generated during session initialization while "please wait... (determining panic task)" is being displayed. This was caused by a patch introduced in crash-7.0.8, and can only happen when analyzing dumpfiles whose header does not contain the requisite information to determine the panic task and the active tasks do not have any crash-related traces in their kernel stacks. It should be noted that the SIGSEGV can be avoided by entering "--no_panic" on the crash command line. * Fix for a SIGSEGV generated by the "bt -a" or "help -r" commands if the NT_PRSTATUS notes in a compressed kdump are invalid/corrupt. If all cpus are online but the dumpfile initialization that cycles through the NT_PRSTATUS notes does not find exactly one note per cpu, then the register contents in those notes should not be used. * Fix for data access from "split" compressed kdump dumpfiles. Without the patch, if a dumpfile read targets physical memory in the first memory page stored in the second or later sequential split dumpfile, incorrect data will be returned. * Correction of the copyright and authorship of ramdump.c. * Added recognition of the new DUMP_DH_COMPRESSED_INCOMPLETE flag in the header of compressed kdumps, and the new DUMP_ELF_INCOMPLETE flag in the header of ELF kdumps. If the makedumpfile(8) facility fails to complete the creation of compressed or ELF kdump vmcore files due to ENOSPC or other error, it will mark the vmcore as incomplete. If either flag is set, the crash utility will issue a warning that the dumpfile is known to be incomplete during initialization, just prior to the system banner display. When reads are attempted on missing data, a read error will be returned. As an alternative, zero-filled data will be returned if the "--zero_excluded" command line flag is used, or the "zero_excluded" runtime variable is set to "on". In either case, the read errors or zero-filled memory may cause the crash session to fail entirely, cause commands to fail, or may result in other unpredictable runtime behavior. * If a kernel has been configured with CONFIG_DEBUG_INFO_REDUCED, then the crash utility will fail to initialize, typically with a message indicating "no debugging data available". However, it has been reported (on a 32-bit ARM system) that the initialization sequence continued on beyond that message point, and the session failed later on with the message "neither runqueue nor rq structures exist". As an aid to understanding why the session failed, if the target kernel is configured with CONFIG_IKCONFIG, and CONFIG_DEBUG_INFO_REDUCED has been set to "y", a relevant warning message will be displayed. * Implemented support for this Linux 3.18 commit for kernels that are configured with CONFIG_SLAB: commit bf0dea23a9c094ae869a88bb694fbe966671bf6d mm/slab: use percpu allocator for cpu cache The commit above redesigned the kmem_cache.array_cache[] from a hardwired array to a per-cpu pointer referencing external array_cache structures. Without the patch, the crash session would fail during initialization with the message "crash: cannot resolve cache_cache". Note that it could be worked around by using the "--no_kmem_cache" command line option, with a resulting loss of functionality for commands requiring slab-related data. * Implemented a new "sys -t" option that displays kernel taint information. If the "tainted_mask" symbol exists, the option will show its hexadecimal value and translate each bit set to the symbolic letter of the taint type. On kernels prior to 2.6.28 which had the "tainted" symbol, only its hexadecimal value is shown. The relevant kernel sources should be consulted for the meaning of the letter(s) or hexadecimal bit value(s). * Cosmetic fix for the "help -[n|D]" translation of the bitmap contents of the kdump_sub_header.dump_level flag in compressed kdump dumpfiles. * Fix for the support of compressed kdump clones created with the KVM "virsh dump --memory-only --format " command, where the compression-type is either "kdump-zlib", "kdump-lzo" or "kdump-snappy". Without the patch, if an x86_64 guest kernel was loaded with a non-zero "phys_base", the "--machdep phys_base=" command line option was required as a workaround or the crash session would fail with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". -- Troy Heber Mon, 27 Apr 2015 08:28:11 -0600 crash (7.0.8-1) unstable; urgency=medium * Fix for the handling of 32-bit ELF xendump dumpfiles if the guest was configured with more than 4GB of memory. Without the patch, the crash session may fail during initialization with the error message "crash: vmlinux and do not match!". * Fix for file-handling errors when a compressed vmlinux.debug file is followed by a vmlinux file on the crash command line. When the crash session ends, two errors will occur: (1) the vmlinux file will be deleted (2) the temporary uncompressed version of the vmlinux.debug file will remain in /var/tmp This problem also occurs in the highly unlikely case where a compressed vmlinux file is followed by a vmlinux.debug file on the command line, and the uncompressed temporary version of the vmlinux file is larger than the vmlinux.debug file. In that case: (1) the vmlinux.debug file will be deleted (2) the temporary uncompressed version of the vmlinux file will remain in /var/tmp * Fix for the "search -t" option if the system has 2064 or more tasks. Without the patch, the command fails with a dump of the crash utility memory allocation statistics, ending with "search: cannot allocate any more memory!". * Fix for the "mod -S" command to find the debuginfo data for Red Hat "kpatch" modules. Without the patch, the command would display "mod: cannot find or load object file for module". * Deprecated the "mount -f" option for Linux 3.13 and later kernels containing commit eee5cc2702929fd41cce28058dc6d6717f723f87, which removed the super_block.s_files list_head member and the open files list that it contained. Without the patch, the command option fails with the error message "mount: invalid structure member offset: super_block_s_files" * If a compressed kdump is damaged/truncated such that the bitmap data in the dumpfile header is not contained within the file, attempts to analyze it with a vmlinux file, or using the "crash --osrelease" or "crash --log" options with just the vmcore, will result in the crash utility spinning forever, endlessly performing reads of 0 bytes from the file without recognizing the EOF condition. * Fix for an ARM64 compilation failure of the embedded gdb file "aarch-linux-nat.c" in the Fedora fc21 rawhide environment, which uses glibc-headers-2.19.90-24.fc21. * Document the reason behind the deprecation of the "mount -f" option for Linux 3.13 and later kernels if the option is attempted, and in the "help mount" output, similar to the deprecated "mount -d" option. * During initialization, reject useless ARM64 "(A)" absolute symbols that begin with "__crc_". Without the patch, several thousand of them may be displayed by "sym -l" prior to the first kernel virtual address symbol. * When running against an ARM64 dumpfile created with the "snap.so" extension module, do not attempt to read the crash_notes. Since the dumpfile was taken while running on a live system, the crash_notes, if configured into the kernel, would not contain valid data. Without the patch, the message "WARNING: could not retrieve crash_notes" is displayed during session initialization. * Determine the various ARM64 kernel virtual address ranges using the kernel's VA_BITS value. It currently is hardwired in the kernel to one of two values depending upon whether 4K or 64K pages are configured. However, there are plans to support 16K paqes, to make VA_BITS a configurable value, and to make the number of page-table levels configurable. Towards that end, the crash utility has been changed to determine the VA_BITS value based upon known kernel virtual addresses, and to then calculate the relevant kernel virtual address ranges on that value instead of hardwiring them based upon the page size. * Enhancement to the "kmem -S" option for Linux 3.2 and later kernels configured with CONFIG_SLUB to display the address of each per-cpu kmem_cache_cpu address and the contents of its per-cpu partial list. * If an ARM or ARM64 dumpfile does not contain the register sets of the active tasks in the kernel's per-cpu crash_notes, there is an initialization-time warning message indicating "could not retrieve crash_notes". It has been changed to a more meaningful warning message indicating "cannot retrieve registers for active tasks". * Implement support for ARM and ARM64 raw RAM dumpfiles. One or more "ramdump" files may be entered on the crash command line in an ordered pair format consisting of the RAM dump filename and the starting physical address expressed in hexadecimal, connected with an ampersand: $ crash vmlinux ramdump@address [ramdump@address] A temporary ELF header will be created in /var/tmp, and the combination of the header and the ramdump file(s) will be handled like a normal ELF vmcore. The ELF header will only exist during the crash session. If desired, an optional "-o " may be entered to create a permanent ELF vmcore file from the ramdump file(s). * Fix for the "help -[nD]" ELF header translation to recognize the EM_ARM and EM_AARCH values as "e_machine" types, and ELFOSABI_LINUX as an "e_ident[EI_OSABI]" type. Without the patch, the e_machine translation would show "40 (unsupported)" for 32-bit ARM, or "183 (unsupported)" on ARM64; and the ELFOSABI_LINUX type would be translated as "3 (?)". * Re-run a command in the history list by entering an "!" followed by the number identifying the command. However, unlike the similar "r" pseudo-command, if the number is a command name in the user's PATH, maintain the current behavior and execute that command. * Fix to recognize that the live system "crash.ko" memory driver may be compressed and named "crash.ko.xz". Without the patch, the driver is not recognized and loaded, and as a result the /dev/mem driver and/or /proc/kcore will be tried as the live memory source. * On a live system during session initialization, delay the first read error message (typically when reading the "cpu_possible_mask") until it is confirmed that all of the following are true: (1) /dev/crash does not exist, and (2) /dev/mem is restricted via CONFIG_STRICT_DEVMEM, and (3) /proc/kcore cannot be read/accessed. The "kernel may be configured with CONFIG_STRICT_DEVMEM" and the "trying /proc/kcore as an alternative" messages will still be displayed when appropriate. The read error message be displayed only if all three live memory read options fail. * Fortify the validity verification of the data structures traversed by the "kmem [-sS]" options for kernels configured with CONFIG_SLUB. Without the patch, the contents of several structure members are not validated, and may generate bogus or never-ending output, typically seen when running the commands on a "live dump" where the dumpfile was taken while the kernel was still running. The patch aborts the relevant parts of per-kmem_cache output when invalid data is encountered or if an object list contains duplicate entries, and error messages have been enhanced to more accurately describe the issues encountered. * Implement support for the ppc64le PPC64 little-endian architecture. Since this required a large number of patches to be applied to architecture-neutral files in the gdb-7.6 tree, the changes are only applied if the host build system is a ppc64le. * Fix for SMP active task register-gathering from "kvmdump" dumpfiles that were created with a cpu version id of 12 or greater that contain additional XSAVE related fields in their cpu device headers. Without the patch, active tasks running on cpus above 0 may have truncated backtraces. * Maintain backwards-compatibility for "kvmdump" dumpfiles that were created by older development versions of KVM tools in which the cpu version id was 12, but the cpu device headers did not contain the additional XSAVE related fields. * Address a "ps" command performance degradation that was introduced by a crash-7.0.4 patch which added per-thread task_struct.rss_stat page counts to the task's mm_struct.rss_stat page counts in order to show an accurate/synchronized RSS value. Without the patch, the "ps" command performance would degrade as the number of tasks increased, most notably when there were thousands of tasks. -- Troy Heber Wed, 17 Sep 2014 08:30:13 -0600 crash (7.0.7-1) unstable; urgency=low * Export the static ELF and compressed kdump vmcoreinfo_read_string() functions from netdump.c and kdump.c via a new read_vmcoreinfo() method in the global program_context structure. The function get_log_from_vmcoreinfo() will access vmcoreinfo data via the new pointer instead of requiring its callers to pass pointers to their dumpfile-specific function. * Linux 3.15 and later kernels configured with CONFIG_RANDOMIZE_BASE can be now be readily identified because of new kernel symbols that have been added. For those kernels, the new "--kaslr=" and/or "--kaslr=auto" options are not necessary for ELF or compressed kdump vmcores, or for live systems that have /proc/kallsyms showing the relocated symbol values. A new KASLR initialization function called kaslr_init() is now called by symtab_init() prior to the initial symbol-sorting operation. If kaslr_init() determines that KASLR may be in effect, it will trigger a search for the relevant vmlinux symbols during the sorting operation, which in turn will cause the relocation value to be automatically calculated. * Implemented a new "bt -c cpu(s)" option to display the backtrace of the active task on one or more cpus. The cpus must be specified in a comma- and/or dash-separated list; for examples ""3", "1,8,9", "1-23", or "1,8,9-14". Similar to "bt -a", the option is only applicable with crash dumps. * Fix for Linux 3.11 and later ARM kernels, in which all non-panicking cpus offline themselves during a kdump procedure. This causes an invalid cpu count determination during crash session initialization from an ARM vmcore. The patch utilizes the cpu count found in the cpu_active_map if it is greater than the count in the cpu_online_map. In addition, the maximum NR_CPUS value for the ARM architecture has been raised from 4 to 32. * Fix for the X86_64 "bt" command on Linux 3.3 and later kernels to properly display exception frame register contents on NMI stacks. Kernel commit 3f3c8b8c4b2a34776c3470142a7c8baafcda6eb0 added 12 more values to the NMI exception stack to handle nested NMIs caused by page faults or breakpoints that could occur while handling an NMI exception. * Kernel commit 28696f434fef0efa97534b59986ad33b9c4df7f8 changed the stack layout again, swapping the location of the "saved" and "copied" registers. This can be detected automatically, because the "copied" registers contain either a copy of the "saved" registers, or point to "repeat_nmi". So, if "repeat_nmi" is found as the return address, assume that this is the old layout, and adjust the stack pointer again. Without the patch, incorrect register values are displayed in the exception frame dump in the NMI stack backtrace. * Fix for the built-in "g" alias, which apparently has not worked correctly since crash-5.1.4. Without the patch, if the "g" alias and the first argument are separated by one space, then the first first character of that argument would get stripped prior to being passed to the embedded gdb module. * Removed the BASELEVEL_REVISION string from defs.h, which serves no purpose since the deprecation of the remote daemon, and typically has been out of sync with the crash version. * Fix for the "p", "irq", "struct", "union" and "*" commands if a cpu specification contains an invalid cpu number. Without the patch, a segmentation violation may be generated. * Implemented a new capability for the "ptov" command that takes a per-cpu offset and cpu specification argument and translates it into the kernel virtual addresses for the cpus specified. * Implemented a new "ps -m" option that is a similar, complementary option to "ps -l", but which translates the task timestamp value from a decimal or hexadecimal nanoseconds value into a more human-readable string consisting of the number of days, hours, minutes, seconds and milliseconds that have elapsed since the task started executing on a cpu. More accurately described, it is the time difference between the timestamp copied from the per-cpu runqueue clock when the task last started executing compared to the most current value of the per-cpu runqueue clock. * In addition, a new "ps -C " option has been added that can only be used with "ps -l" and "ps -m", which sorts the global task list into per-cpu blocks; the cpu-specifier uses the standard comma or dash separated list, expressed as "-C 1,3,5", "-C 1-3", "-C 1,3,5-7,10", or "-Call" or "-Ca" for all cpus. * Implemented a new "runq -m" option that is a simliar, complementary option to "runq -t", but which displays the amount of time that the active task on each cpu has been running, expressed in a format consisting of days, hours, minutes, seconds and milliseconds. * Implemented a new "kmem -h" option that displays the address of each hugepage hstate array entry, its hugepage size, its free and total counts, and name string. * Implemented a new "ps -S" option that displays a summary consisting of the number of tasks in a task state. * Fix for the "arguments-input-file" feature to protect against a called command modifying an argument string. For example, the "struct" command modifies "-l struct_name.member" argument strings, and so without the patch, all iterative calls after the first one will fail. * Fix failure to build from source when compiling the crash utility with gcc-4.9 (closes: #746835) * Fix for displaying enum values that are greater than 32-bits in size. Without the patch, the upper 32-bits are clipped off and displayed as integer-sized value. * If the kernel (live or dumpfile) has the "kpatch" module installed, the tag "[KPATCH]" will be displayed next to the kernel name in the initial system banner and by the "sys" command. * Fix for the "DEBUG KERNEL:" display in the initial system banner and by the "sys" command when using a System.map file with a Linux 3.0 and later debug kernel. Without the patch, the kernel version is not displayed in parentheses following the debug kernel name. * If the gdb-.patch file has changed and a rebuild is being done from within a previously-existing build tree, "patch -N" the gdb sources, and start the rebuild from the gdb- directory instead of the gdb-/gdb directory. * Fix to prevent a possible segmentation violation generated by the "runq -g" command when run on a very active live system due to an active task on a cpu exiting while the command is running. * Fix for the "runq -g" command on Linux 3.15 and later kernels, where the cgroup_name() function now utilizes kernfs_name(). Without the patch, the command fails with the error message "runq: invalid structure member offset: cgroup_dentry". * Fix for the "extend" command when running with an x86_64 crash binary that was built with "make target=ARM64" in order to analyze ARM64 dumpfiles on an x86_64 host. Without the patch, if the extend command is used with an extension module built in the same manner, it fails with the message "extend: .so: not an ELF format object file". * Introduce support for 32-bit ARM kernels that are configured with CONFIG_ARM_LPAE. The patch implements the virtual-to-physical address translation of 64-bit PTEs used by ARM LPAE kernels. -- Troy Heber Mon, 16 Jun 2014 10:24:39 -0600 crash (7.0.6-1) unstable; urgency=low * Fix for custom X86_64 kernels that change the declaration of the context_switch() function so that it is not an inline function. Without the patch, the message "crash: cannot determine thread return address" is displayed during invocation, and backtraces of blocked tasks may have missing or invalid frames. * Fix to prevent a possible invocation-time error on Linux 3.7 and later kernels configured with CONFIG_SLAB, running against vmcore files filtered with the makedumpfile(8) facility. Without the patch, the message "crash: page excluded: kernel virtual address:
type: kmem_cache buffer" is immediately followed by the message "crash: unable to initialize kmem slab cache subsystem". Because of a kernel data structure name change from "cache_cache" to "kmem_cache_boot", the crash utility failed to properly downsize the stored size of the kernel's kmem_cache data structure from the size indicated by the vmlinux debuginfo data. This in turn could lead to reading beyond the end of a kmem_cache data structure into a page of memory that had been excluded from the vmcore. The fix was also applied to kernels configured with CONFIG_SLUB. * Added a new "--kaslr " command line option for X86_64 kernels that are configured with CONFIG_RANDOMIZE_BASE. The offset value must be equal to the difference between the symbol values compiled into the vmlinux file and their relocated KASLR values. * Added a new "--kaslr=auto" command line option for X86_64 kernels that that are configured with CONFIG_RANDOMIZE_BASE. When set to "auto", the KASLR relocation value will be determined automatically by comparing the "_stext" symbol value compiled into the vmlinux file with the _stext symbol value stored in kdump vmcoreinfo data; on live systems the comparison will be made with the "_stext" symbol value that is found in /proc/kallsyms. * Enable kernel text line number capability for the "dis -l", "bt -l", "sys -c", and "sym" commands for kernels that are configured with CONFIG_RANDOMIZE_BASE. * Fix for the "crash --log vmcore" command to account for the kernel data structure and VMCOREINFO string name changes from "log" to "printk_log" in Linux 3.11-rc4 and later kernels. Without the patch, the command fails with the error message "crash: VMCOREINFO: no log buffer data". * Adjustment to the internal symbol-handling to prevent the usage of kernel system call alias/wrapper names, for examples, "SyS_read" and "compat_SyS_futex" instead of "sys_read" and "compat_sys_futex". Without the patch, commands such as "dis", "sym
", and "sys -c" display the alias/wrapper name instead of the real system call name in Linux 3.10 and later kernels. * Increase the internal hash queue head count from 128 to 32768. The hash queue is used for gathering and verifying lists, and the original count of 128 may be overwhelmed if a list is extremely large. For example, on a 256GB system with 192GB of free pages, the "kmem -f" command takes hours to complete; with this patch, the time is reduced to a few minutes. In addition, a new command line option "--hash " has been added to allow a user to override the default hash queue head count of 32768. * Fix for the "kmem -F" display and the "kmem -f
" or "kmem
" options. Without the patch, "kmem -F" does not display the first page in a list of free page blocks on its own line, but rather at the end of the previous line that shows the area number, block size, and free_area struct address that the page is linked to. Due to this error, both "kmem -f
" and "kmem -f address>" would not find the associated page or page block if it happened to be the first page or page block in the list. * Created a new feature for the internal do_list() function if it is necessary to immediately perform a function for each entry in a list while the list is being traversed. A callback function, and an option callback data pointer, can be registered in the list_data structure. The address of each entry in the list along with the optional callback data pointer will be passed to the callback function. If desired, the callback function may also dictate that do_list() should stop the list traversal and return immediately to its caller. * Made the "kmem -f
" and "kmem
" options more efficient by using the new do_list() callback function feature above as well as restricting the search to only the NUMA node that contains the address. * If the first assembly language instruction in an X86_64 function is "nopl 0x0(%rax,%rax,1)" or "data32 data32 data32 xchg %ax,%ax", which are generated when the ftrace facility is configured, the X86_64 "dis" command will append "[FTRACE NOP]" to the line. * Correction for the "crash -h" and crash.8 man page documentation of the "--machdep phys_base=" command line option. In both places the parameter mistakenly indicated "physbase". * If a host build system does not have /usr/bin/wget installed, and the crash package is built from a directory that was git-cloned from github.com/crash-utility/crash.git, the error message has been clarified to indicate "/usr/bin/wget is required to download gdb-7.6.tar.gz". Without the patch, the message indicates "tar (child): gdb-7.6.tar.gz: Cannot open: No such file or directory". * Updated the ARM64 implementation to support Linux 3.13 and later kernels that expand to a 42-bit address space when 64K pages are configured. This is also the first crash version that has been tested on a live ARM64 system with 4K pages, where it cleanly make it to the "crash>" prompt. However, it should be noted that some commands (most notably "bt") still do not work as of yet. * Document the "--machdep phys_offset=" command line option for the ARM64 architecture in the crash.8 man page and the "crash -h" output. * Fix for KVM dumpfiles created with "virsh dump --memory-only" if an X86_64 kernel was loaded with a non-zero "phys_base". Without the patch, the crash session fails with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". * Initial working implementation of the basic ARM64 "bt" command, with several command options still under development. In-kernel exception frames are only dumped if the exception handler function is contained within the symbol boundaries from "__exception_text_start" to "__exception_text_end"; when ARM64 kdump is eventually implemented, further exception-related work will be resumed. * Cleaned up the exception frame displays of 64-bit in-kernel and both 32-bit and 64-bit user-mode exceptions. * Implemented support for the ARM64 "bt -e" option. * Implemented support for the ARM64 "bt -l" option. * Update for the X86_64 "bt -l" option such that it also displays the available file and line number information for functions indicated as the "exception RIP" in kernel exception frames. The line number information will follow the exception frame register dump. * Fix for the ARM64 virtual-to-physical translation of vmemmap page structure addresses for kernels configured with 4K pages. Without the patch, any command that required the contents of a page structure would fail with a readmem error. * Added support for the ARM64 architecture in the extensions/snap.c extension module. Also fixed the progress percentage display to correct for systems which have non-zero starting physical addresses. * Implemented support for the ARM64 "bt -f" and "bt -F[F]" options. * Increase the ARM64 PTRS_PER_PGD_L2_64K from 1024 to 9182 to account for the Linux 3.13 increase of the ARM64 virtual address space size from 39 to 42 bits when 64K pages are configured. Without the patch, the warning message "WARNING: cannot access vmalloc'd module memory" is displayed during session initialization. * Fix for the "vm -p" option on ARM64 so that file-backed pages are properly translated to the filename and offset. Without the patch, file-backed pages are erroneously shown as being backed on a swap device. * Increment maximum ARM64 physical address from 40 to 48 bits to match upstream kernel commit 87366d8cf7b3f6dc34633938aa8766e5a390ce33. * Fix for a segmentation violation generated by the "crash -g vmlinux" command on ARM64. * Fix for the ARM64 "vtop
" command on kernels configured with 64K pages if the address argument is located in the kernel logical memory map region, which uses 512MB hugepage mappings. Without the patch, the verbose page table walk mistakenly continues to the PTE level. * Fix for ARM64 /proc/kcore support. Without the patch, the crash session fails with the warning message "WARNING: cannot read linux_banner string" followed by the fatal error message "crash: vmlinux and do not match!". At this point in time, the kernel requires a patch to the ARM64 kern_addr_valid() function to properly allow memory to be read from the kernel logical memory map region. -- Troy Heber Thu, 05 Jun 2014 09:26:32 -0600 crash (7.0.5-1) unstable; urgency=low * New upstream version 7.0.5 * Fix for the "runq -g" option for kernels that are configured with CONFIG_FAIR_GROUP_SCHED, but not CONFIG_CFS_BANDWIDTH. Without the patch, the command fails with the message "runq: invalid structure member offset: cfs_rq_throttled". * Add support for Xen PVH guest types introduced in Xen 4.4. Without the patch, running against a Xen 4.4 hypervisor binary would fail during session initialization with the error message "crash: invalid structure member offset: domain_is_hvm". In addition, the PVH guest type is being registered internally as an HVM guest type, the debug "help -X ofs" command's display of the domain_domain_flags offset has been fixed to show it in decimal, and the setting of the internal dc->domain_flags has been fixed to contain all flags set, not just the first one found. * Fix for the "kmem -S" command on Linux 3.1 and later kernels that are configured with CONFIG_SLUB. Because the the page structure's inuse and objects fields used by SLUB were changed from discrete u16 types to bit-fields within an unsigned int, the display of per-node partial slab statistics are incorrect. Without the patch, the TOTAL and ALLOCATED values are incorrectly shown as equal values, and therefore the FREE value is always zero. * Fix for the "kmem -S" command for kernels that are configured with CONFIG_SLUB. Eash per-cpu slab object dump may show incorrect ALLOCATED and FREE values; and as seen on Linux 3.5 and later kernels, the TOTAL value and the number of individual objects dumped may also be incorrect (too small). * When executing the commands from an input file specified by the "-i " command line option, or when accepting input from a file as a set of commands or as a set of command arguments using the "<" redirection character, unconditionally cease the operation if CTRL-c is entered. Without the patch, depending upon the command that was running when the SIGINT was received, the operation may continue uninterruptibly until the file contents are consumed. * Enhanced the "bt -F" option such that if "-F" is entered twice, and if the stack frame contents reference a slab cache object, both the slab cache name and the stack contents will be displayed within brackets. * Enhanced the "rd -S" option such that if "-S" is entered twice, and if the memory contents reference a slab cache object, both the slab cache name and the memory contents will be displayed within brackets. * Fix for the X86_64 "bt" command to prevent an unwarranted message indicating "WARNING: possibly bogus exception frame" generated from a blocked kernel thread that was in the process of exec'ing a user process via the call_usermodehelper() facility. * Fix for the X86_64 "bt" command to more correctly determine the function frame that called into an interrupted function. Without the patch, the first frame just above an IRQ exception frame register dump may show an invalid/stale function. * Fix for the X86_64 "bt" command if a page fault exception was generated by the invalid contents of the RIP register. Without the patch, the exception frame register dump is not displayed above the "page_fault" stack frame; and in a related issue, the "bt -e" option will not find and display the exception frame. * When invoking a crash session with a compressed vmlinux file, make the same host-machine/vmlinux endian verification that is done with uncompressed vmlinx files. * Reduce the number of CTRL-c entries required to unconditionally terminate any manually-entered command from three to one. * Fix for the X86_64 "bt" command if an async page fault exception occurred in a KVM guest running a Linux 2.6.38 or later kernel. Without the patch, the exception frame register dump is not displayed above the "async_page_fault" stack frame. -- Troy Heber Mon, 14 Apr 2014 14:59:30 -0600 crash (7.0.3-3) unstable; urgency=low * Add autopkgtest and try to keep the Debian and Ubuntu crash packages in sync (closes: #721095) -- Troy Heber Thu, 07 Nov 2013 08:14:34 -0700 crash (7.0.3-2) unstable; urgency=low * Fix from Louis Bouchard to resolve FTBS on i386 -- Troy Heber Wed, 06 Nov 2013 09:41:06 -0700 crash (7.0.3-1) unstable; urgency=low * Fix for the ARM architecture if the backtrace unwind information cannot be gathered during session initialization. Without the patch, the two unwind-related warning messages indicating "WARNING: UNWIND: failed to gather unwind_table list" and "WARNING: UNWIND: failed to initialize module unwind tables" are followed by the fatal error message "crash: cannot hash task_struct entries". * Fix for the "help -[Dn]" dumpfile information display of the GUID EFI table in the header of SADUMP dumpfiles. Without the patch, only 33 of the 36 bytes in the table are translated. * Fix for the determination of the kernel NR_CPUS configurable for Linux 3.8 and later kernels that are configured with CONFIG_SLAB. Without the patch, the kernel's compiled-in NR_CPUS value was incorrectly calculated to be the sum of the kernel's NR_CPUS and MAX_NUMNODES configurables. * In the next release of makedumpfile, the status field of the dumpfile header of compressed kdumps will show the compression type that was utilized. The "help -[Dn]" output has been updated to display that information. * For kernels configured with CONFIG_SLAB in which an array_cache pointer referenced by a kmem_cache structure is invalid, the individual cache(s) will be marked as invalid. During session initialization, the message "crash: kmem_cache: : invalid array_cache pointer" will be displayed, and during runtime, attempts to access the cache(s) will result in a message indicating that the cache is "[INVALID/CORRPUTED]". Without the patch, the message "crash: unable to initialize kmem slab cache subsystem" is displayed during session initialization, and run-time commands that attempt to access the kmem slab cache subsystem fail with the error message "kmem cache slab subsystem not available". * Fix for the "kmem -[sS] " option in Linux 3.6 and later kernels configured with CONFIG_SLAB. Without the patch, the command fails with the message "kmem: address is not allocated in slab subsystem: . This also causes the "kmem " command to (quietly) fail to determine that the address is a slab object. * Fix for the "bt" command if a kernel __init text address is encountered. Without the patch, and depending upon the reallocation of the __init text memory, a bogus framesize may be calculated, or more likely, in a compressed kdump, a warning message indicating "bt: page excluded: kernel virtual address:
type: gdb_readmem_callback" will be displayed following the frame data. * Update for determining whether an S390X PTE contains a swap entry in Linux 3.12 and later kernels. * Resurrected the translation and display of the page.flags bits by the "kmem -p" command on Linux 2.6.26 and later kernels whose vmlinux debuginfo data contains either the "pageflags" enumerator or the "pageflag_names" array of trace_print_flags structures. If they are not available, just the page.flags value is printed in hexadecimal, as has been done since Linux 2.4.9. * Fix for the "bt" command when used with vmcore files that were created with the recently-introduced "virsh dump --memory-only", which dumps KVM guests into an ELF vmcore similar to those created by the kdump facility. Without the patch, a faulty backtrace for the panic task may be generated due to the use of incorrect starting RSP/RIP registers; this happens because (unlike kdump) the non-panicking cpus are offlined prior to the dumpfile being created, which in turn leads to the use of the wrong NT_PRSTATUS note. * Fix for the CPU number display on systems with 255 or more cpus during the initial banner, by the "set" command, the "ps" command, and by all commands that display the per-task header consisting of the task address, pid, cpu and command name. Without the patch, for cpu 255, the "sys" command displays "NO_PROC_ID", and the other commands would show a "-" for the cpu number; for cpu numbers greater than 255, garbage values would be displayed in the cpu number field. * Implemented support for compressed kdump header version 6, in which makedumpfile(8) adds new fields in the kdump_sub_header to support large memory systems with pfn values that are larger than 32-bits. Without the patch, if the system contains physical memory located in high memory such that its maximum pfn value is overflows the 32-bit "max_mapnr" field in the header, the crash session will fail with the error message "crash: vmlinux and vmcore do not match!". * Fix for the "net -s" command on Linux 3.8 and later kernels. Without the patch, the command fails with the message "net: invalid structure member offset: inet_opt_daddr". * Fix a build failure in a native ARM64 environment due to obsolete LKCD dumpfile headers. * Implementation of a new "per-cpu object" as an argument format that can be passed to the "p", "struct", "union" or "*" commands. The format is expressed as either : or as :, where the per-cpu symbol or per-cpu offset must precede a colon, and where the follows the colon. Without the patch, per-cpu symbols are only accepted by the "p" command, and the data type and the resolved kernel virtual address for each per-cpu instance are displayed shown. With this patch, a colon and a cpu-specifier may be appended to the symbol name, and the the contents of the symbol on each cpu that is specified will be displayed by the "p" command. For the "struct/union/*" commands, an argument may be specified using either a per-cpu offset value or per-cpu symbol name followed by a colon and cpu-specifier, and the contents of each structure/union on each specified cpu will be displayed. Fixed several minor flaws that were detected by a Coverity Scan. -- Troy Heber Wed, 30 Oct 2013 16:12:40 -0600 crash (7.0.2-1) unstable; urgency=low * Added "bison" to the BuildRequires line of the crash.spec file. Without the patch, the build of the embedded gdb-7.6 module will fail unless either /usr/bin/bison or /usr/bin/yacc are available. The failure will result in a stream of error messages from different files that indicate: multiple definition of 'main' undefined reference to 'c_parse_escape' undefined reference to 'ada_parse' undefined reference to 'ada_error' undefined reference to 'c_parse' undefined reference to 'c_error' undefined reference to 'cp_demangled_name_to_comp' undefined reference to 'cp_demangled_name_parse_free' undefined reference to 'cp_comp_to_string' undefined reference to 'cp_new_demangle_parse_info' and the build fails like so: collect2: ld returned 1 exit status make[4]: *** [gdb] Error 1 crash build failed If building with rpmbuild, the new BuildRequires "bison" entry will prevent the build from initiating unless the bison package has been installed. If building with the tar.gz file, the build attempt will proceed and fail unless either the bison or byacc (Berkeley Yacc) package is installed. * Fix the S390X initialization sequence on kernels that are configured with CONFIG_STRICT_DEVMEM to automatically try /proc/kcore if: (1) the /dev/crash driver is not available, and (2) the initial /dev/mem access fails. Without the patch, if /dev/mem is selected as the memory source and it is restricted, the crash session will fail during initialization with the error message "crash: read error: kernel virtual address:
type: cpu_possible_mask". * When checking whether a argument on the crash command line is a dumpfile that may be in makedumpfile's "flattened" format, do not bother checking character device files. * Fix for the PPC64 virtual-to-physical virtual address translation mechanism for vmalloc and user-space virtual addresses on Linux 3.10 and later kernels. Without the patch, the message "WARNING: cannot access vmalloc'd module memory" is displayed during initialization, and during the crash session, if a command attempts to translate or read a vmalloc or user-space virtual address, it will fail. * Clean up all files that emit "warning: format not a string literal and no format arguments" when compiled with -Wformat-security warning option. All instances of fprintf, sprintf and snprintf using the format "fprintf(fp, buf)" are replaced with "fprintf(fp, "%s", buf)". Also, the -Wformat-security warning option has been added to the option list used when compiling with "make warn". * Fix a build failure when compiling with very old gcc-3.4.6 version on a 2.6.9-based RHEL4 IA64 host. The bfd library in gdb-7.6 is compiled with the -Werror option, and it fails with the message "elflink.c:4733: warning: 'idx' might be used uninitialized in this function". * Fix a build failure when compiling with very old gcc-3.4.6 version on a 2.6.9-based RHEL4 S390 or S390X hosts. The embedded gdb-7.6 fails to compile with the error message "s390-nat.c:364: error: storage size of 'iov' isn't known". * Fix to properly store two-digit kernel version numbers. (closes: #717036) * Fix to provide hugepage address translation for the "vtop" command on the PPC64 architecture. * Fix for the "log" command to account for the kernel data structure name change from "log" to "printk_log" in Linux 3.11-rc4 and later kernels. Without the patch, the message "WARNING: log buf data structure(s) have changed" will be displayed during initialization and by the "log" command. * Fix to add a linefeed after the description of the "kmem -I" option in the "help kmem" output, which was recently added in crash-7.0.0. * Document the "-s" command line option in the "crash -h|--help" output and in the crash.8 man page to also indicate that runtime command scrolling is turned off by default. * Fix for the "irq -d" option on 2.6.25 and later X86_64 kernels to display the Intel interrupt descriptor table contents. Without the patch, those kernel versions would display "irq: -d option not supported or applicable on this architecture or kernel". * Fix for the "kmem -[sS]" options on Linux 3.11-rc1 and later kernels that are configured with CONFIG_SLAB. Without the patch, the command fails with the error message "kmem: invalid structure member offset: * Fix for the "kmem
" and the "bt -F" options on Linux 3.8 and later kernels that are configured with CONFIG_SLUB. Without the patch, the command would fail with the error message "kmem: invalid structure member offset: page_slab". * Fix misspellings in the "bt" and "search" help page output. * Fix for the determination of the base of the kernel's unity-mapped virtual address region on recent ARM kernels whose "_stext" variable address has changed from 0xc0008000 to 0xc0100000. Without the patch, the crash session fails during invocation with the error message "crash: vmlinux and vmcore do not match!". * When printing data structures, prevent the embedded gdb from symbolically translating pointers that are not kernel virtual addresses. Kernel or module symbols that are not virtual addresses can be mistaken for virtual addresses, leading to NULL pointers being invalidly translated into a symbol name from the vmlinux or module object file. For example, in X86_64 kernels, NULL pointers are translated into the symbol "irq_stack_union", whose value is not a virtual address, but rather a per-cpu offset value of 0. * Fix for the "kmem -s
" or "kmem
" options on Linux 3.11 and later kernels configured with CONFIG_SLAB. Without the patch, both commands fail with the error message "kmem: cannot resolve cache_cache". * Fix to prevent the "bt" command from generating a segmentation violation in a case where the per-cpu "current_task" variable and the runqueue's "curr" variable did not agree, and the panic task had overflowed its kernel stack. This led to the selection of the a starting RSP address which belonged to the other task; without the patch, the command generated a segmentation violation after printing the first frame of the backtrace. -- Troy Heber Wed, 16 Oct 2013 10:26:33 -0600 crash (7.0.1-3) unstable; urgency=low * Updated format-strings patch to cover additional architectures * Requested update to packages-arch-specific to enable s390x and armel (#717283) -- Troy Heber Tue, 16 Jul 2013 07:00:41 -0600 crash (7.0.1-2) unstable; urgency=low * Missed updating the Architecture line in the -1 upload, armel (closes: #656132) * Move defs.h to /usr/include/crash (closes: #702513) * Patch from Stefan Bader to add a format string to all *printf calls -- Troy Heber Thu, 11 Jul 2013 08:51:32 -0600 crash (7.0.1-1) unstable; urgency=low * Enable armel (closes: #656132) * Enable s390x (closes: #710675) * Include the crash/defs.h header (closes: #702513) * Sync with the Ubuntu crash package, build crash extensions, SPU has been dropped (closes: #584119), lpia has been dropped (closes: #504522). * Fix the -I include path sequence in the extensions/eppic.mk file to prevent a series of "redefined" and "redeclaration" warnings when compiling the EPPIC extension module. * Address two compile-time warnings generated as a result of the gdb*7.6.patch. Without the patch, there are "warning: no previous prototype" warnings for gdb_main_entry() and replace_ui_file_FILE(). * Implemented a new "mod -t" option that walks through the installed modules and checks for non*zero values in each module's "taints" bitmask, and translates the bits into symbolic letters if possible, or shows the hexadecimal value of the bitmask if not. In older kernels, the "license_gplok" field is checked, and if non*zero, its value is displayed in hexadecimal. Lastly, if the "gpgsig_ok" member exists and is zero, a "(U)" notation will also be displayed. * Fixed compiler warnings generated by extensions/trace.c when compiled with *DFORTIFY_SOURCE=2. Without the patch, the messages "warning: ignoring return value of 'mktemp', declared with attribute warn_unused_result", "warning: ignoring return value of 'fwrite', declared with attribute warn_unused_result", and "warning: 'trace_dat' may be used uninitialized in this function" are generated. * Laid down the basic infrastructure for the ARM64 backtrace facility using the kernel's arm64 unwind facility as a basis. Compile*tested only. * Implemented the ARM64 virtual-to-physical kernel and user address translation functions, supporting both 2*level page tables with 64K pages, and 3*level page tables with 4K pages. Also added the associated PTE translator function. Compile*tested only. * Implemented the capability of building crash as an x86_64 binary for analyzing ARM64 dumpfiles on an x86_64 host, which can be done by entering "make target=ARM64". After the initial build is complete, subsequent builds can be done by entering "make" alone. * Added "aarch64" to the ExclusiveArch: line in the crash.spec file. * Fix for the S390X "bt" command for Linux 3.10 and later kernels. Without the patch, the starting stack location of the per*cpu async and panic stacks of active tasks would be incorrectly determined. -- Troy Heber Tue, 18 Jun 2013 13:38:49 -0600 crash (7.0.0-1) unstable; urgency=low * Updated the embedded gdb version to FSF gdb-7.6, which was officially released by the Free Software Foundation on http://www.gnu.org on 4/26/13. The primary motivation for upgrading from gdb-7.3.1 is for future ARM64 support, but there are also issues with respect to kernels built with gcc-4.8.0. The relevant pieces of gdb-7.3.1.patch were forward-ported to the gdb-7.6.patch, and the GDB_7_6 #define has been applied in the top-level sources where appropriate. * Continued incremental steps for support of the ARM64 architecture. * Fix for the "struct name.member
" option if the "member" name is also coincidentally a member of an embedded structure that is located before the targeted member. Without the patch, the value of the embedded structure's member is displayed instead of the targeted member. * Expose a heretofore unadvertised "kmem -[sS] -I slab[,slab]" option that specifies one or more slab cache names in a comma-separated list that the "kmem -[sS]" option should ignore. This can be helpful in cases where a corrupted slab cache may never complete, or in very large memory systems where one or more caches take an inordinate amount of time to complete. * Fix for the "kmem -i" option on Linux 3.9 and later kernels. Without the patch, the "TOTAL SWAP", "SWAP USED" and "SWAP FREE" lines are not displayed because the kernel's former "swapper_space" singular address_space structure has has been changed into a "swapper_spaces" array of address_space structures, with one for each swap partition. * Support for the PPC64 BOOK3E processor family, whose virtual memory layout and PTE format are significantly different. Without the patch, the crash session fails to initialize properly. (ataufer@us.ibm.com) * Fix for the PPC64 "sys", "mach" and initial system banner display of of the processor speed in more recent kernels. Without the patch, the "MACHINE" line in the initial banner and in the "sys" command display may show "MACHINE: ppc64 (unknown Mhz)", and the "mach" command may show "PROCESSOR SPEED: (unknown)". (anderson@redhat.com, ataufer@us.ibm.com) * Since the libgdb.a file no longer exists in gdb-7.6, the Makefile does not check for it as a determining factor for whether a build has succeeded. * gdb-7.6 requires that the bfd library's "config.h" file be #include'd before the "bfd.h" file by the top-level symbols.c file. * gdb-7.6 has replaced/moved the gnu_debuglink_crc32() utility function to bfd_calc_gnu_debuglink_crc32(); the call in symbols.c has been configured based upon the gdb version. * gdb-7.6 has reworked its do_cleanups() functionality, which requires the gdb_error_hook() function to pass all_cleanups() as an argument. * gdb-7.6 causes the anon_member_offset() function to fail due to a change in the output string; the function has been changed to work with both old and new gdb versions. * gdb-7.6 required changes to vm_stat_init() and vm_event_state_init() functions because enum lists get displayed differently on the S390X and PPC64 architectures, which in turn caused failures of "kmem -i", "kmem -z" and "kmem -V" on those two machine types. * Adjusted the alignment of the "kmem -V" and "kmem -z" display of the items in the vm_stat[] array based upon the longest enumerator name string. * Adjusted the alignment of the "kmem -V" display of the cumulative totals of the per-cpu "vm_event_states" items based upon the longest enumerator name string. * Modified the top-level Makefile such that if the tar.gz file of the configured gdb version does not exist in the build directory, try to wget the file from http://ftp.gnu.org/gnu/gdb. This is normally not necessary because the most recent gdb tar.gz file is bundled with the the crash utility tar.gz and src.rpm files. However, it will allow the use of the gdb-less crash.tar.gz file created via "make tar" to be copied to another location, or perhaps copied to a git tree, and then built without containing the the gdb tar.gz file. * Fix for the s390x.c file to handle a gcc-4.8.0 compiler warning when building crash with "make warn", or compiler failures when building with "make Warn" on an S390x machine. Without the patch, gcc-4.8.0 generates the message "error: variable ‘psw_addr’ set but not used [-Werror=unused-but-set-variable]". * Fixes for the s390dbf.c file to handle gcc-4.8.0 compiler warnings when building crash with "make warn", or compiler failures when building with "make Warn" on an S390X machine. Without the patch, gcc-4.8.0 generates three "error: variable ‘’ set but not used [-Werror=unused-but-set-variable]" messages. * Fix for an X86_64 warning message that gets displayed during session initialization when running against Linux 3.9 kernels that were compiled with gcc-4.8.0. Without the patch, the warning message "crash: cannot determine thread return address" is displayed prior to the system information. * Fix for lack of kernel text line number information by the "dis -l" and "sym " options on Linux 3.9 kernels that were compiled with gcc-4.8.0. Without the patch, the line number information for kernel text symbols of type "(T)" may not be able to be determined and displayed. -- Troy Heber Mon, 13 May 2013 11:59:26 -0600 crash (6.1.6-1) unstable; urgency=low * New upstream version 6.1.6 * Fix for a crash-6.1.5 regression that causes the "mount" command to fail on kernel versions prior to Linux 3.3. Without the patch, the command fails with the message "mount: invalid structure member offset: mount_mnt_devname". -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.5-1) UNRELEASED; urgency=low * New upstream version 6.1.6 * Fix for the ARM "irq" command. Without the patch, on 2.6.34 and later kernels configured with CONFIG_SPARSE_IRQ, the command fails with the error message "irq: cannot determine number of IRQs". * Fix for a segmentation violation generated during invocation while parsing a makedumpfile-created "flat-format" vmcore-incomplete file. Without the patch, the crash session would display the error message "crash: unable to seek dump file vmcore-incomplete", followed by a segmentation violation. * Fix for a segmentation violation generated by the "kmem -s" option when encountering a corrupted array_cache structure that contains a bogus "avail" count that is greater than the maximum legitimate limit value. Without the patch, the "kmem -s" command would print a warning message regarding the invalid array_cache, complete the command normally, and then generate a segmentation violation when freeing buffers used by the command. * Update to the "kmem -s" function to include the errors found in slab structures to the display of total errors found when the command completes. Without the patch, invalid list_head pointers, bad inuse counters, and bad s_mem pointers were not added to the total number of errors found. * Fix for "crash --osrelease " and "crash --log " when run on an ARM compressed kdump with a crash binary that was built with "make target=ARM" on an x86 or x86_64 host. Without the patch, if the compressed kdump header version is 4 or 5, "crash --osrelease" fails with the error message "crash: compressed kdump: cannot lseek dump vmcoreinfo" followed by "unknown", and "crash --log" fails with the error message "crash: : no VMCOREINFO section". * Enhancement to the "swap" command to display the swap_info_struct address of each configured swap device. The output has been changed to display the address in the first column, and the variable-length device name has been moved to the last column. * Fix for the "kmem -[sS]" options on kernels that configured with both CONFIG_SLUB and CONFIG_NODES_SHIFT, and that are running on hardware that generates NUMA nodes that contain no memory. Without the patch, both command options fail immediately with the message "kmem: invalid kernel virtual address: 8 type: kmem_cache_node nr_partial". * Increment the PPC64 NR_CPUS maximum value from 1024 to 2048. * Strip the ".isra." and ".part." appendages to cloned text symbol names, which seem to have been introduced by gcc-4.6.0. To keep them intact, a "--no_strip" command line option has been added. * Patch to the internal gdb_get_datatype() function to return the typecode and length of integer variables. * Fix for the "dev -d" option on Linux 3.6 and later kernels. Without the patch the option fails with the message "dev: invalid structure member offset: request_queue_rq". * Export the red/black tree utility functions rb_first(), rb_parent(), rb_right(), rb_left(), rp_next() and rb_last(). Without the patch, they are statically declared and only used by the "runq" command. * Implemented a new "timer -r" option that displays the hrtimer queues, supporting all versions from Linux 2.6.16 to the present. * Fix for "kmem -s" on Linux 3.8 and later kernels that are configured with CONFIG_SLAB. The kmem_cache.array[] length has been extended to store the nodelist pointers, so the original method to determine the per-cpu array limit can go out-of-range. Without the patch, during session initialization there may be a message that indicates "crash: invalid kernel virtual address:
type: array cache limit", followed by "crash: unable to initialize kmem slab cache subsystem"; if those messages do get shown, then "kmem -s" will subsequently fail during runtime with the message "kmem: kmem cache slab subsystem not available". * Two Xen hypervisor fixes: (1) Fix console buffer content length calculation: Function displaying console buffer always assumes its content length equal to console buffer size. This is not true and sometimes it sends garbage to the screen. This patch fixes this issue. (2) Improve calculation of beginning of virtual address space: Xen changeset 26447 (x86: re-introduce map_domain_page() et al) once again altered virtual address space. The current algorithm calculating its start could not cope with that change. New version establishes this value on the base of image start address and is more generic. * Fix for the ARM "vtop" command when run on a module address. Without the patch, the command fails with error message "vtop: ambiguous address: (requires -u or -k)". * Add the "--active" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Add the "--buildinfo" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Remove the unadvertised and unnecessary "--data_debug" command line option, given that it is the default setting. * Remove the unadvertised and obsolete "--no_namelist_gzip" command line option. * Add the "-g [namelist]" command line option to the crash(8) man page and to the "crash [-h|--help]" output. * Remove the unadvertised and never-implemented "--shadow_page_tables" command line option. * Fix for the ARM "vtop" command when run on a user virtual address of the panic task. Prior to Linux 3.3, the panic task's pgd gets overwritten with a pgd that identity-maps the whole address space, and therefore crash loses the capability of translating any user virtual address into its original physical address. * Fix to prevent the ARM linker mapping symbols "$d" and "$a" from being added to the list of symbols from kernel modules. Without the patch, the two symbols would only be rejected from the base kernel's symbol list, but would be added to the symbol list of individual kernel modules. * Fix for the X86_64 "bt" command to recognize that the kernel was built with CONFIG_FRAME_POINTER on Linux 3.7 and later kernels that are configured with CONFIG_FUNCTION_TRACER. In those kernels, the special 4-byte NOP instruction that can be overwritten during runtime for dynamic ftracing has been moved to the very beginning of each function, before the function preamble. Without the patch, the test that checks the function preamble to determine whether CONFIG_FRAME_POINTER was configured would fail, which could potentially lead to less reliable backtraces. -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.4-1) UNRELEASED; urgency=low * New upstream version 6.1.4 * Fix for a crash-6.1.3 regression with respect to the loading of extension modules. Because of the change that replaced the obsolete _init() and _fini() functions with constructor and destructor functions, extension modules may fail to load when the extension modules are built with older compiler/linkers. The problem is due to the continued usage of the -nostartfiles compiler option regardless whether the extension module has replaced its _init() function with a constructor function; with older compiler/linkers, the module may fail to load. The fix predetermines whether an extension module still uses _init() or if it has been updated to use a constructor function, and will use the -nostartfiles option only on older "legacy" modules. * Implemented a new "list -r" option that can be used with lists that are linked with list_head structures. When invoked, the command will traverse the linked list in the reverse order by using the "prev" pointer instead of "next". * Fix for the "swap" command's FILENAME display. In some kernels between 2.6.32 and 2.6.38 the swap partition's pathname may not show the "/dev" filename component. * Fix for the "swap" command's PCT display, which will display a a negative percentage value if more than 5368709 swap pages are in use. -- Troy Heber Mon, 06 May 2013 11:20:38 -0600 crash (6.1.3-1) unstable; urgency=low * New upstream version 6.1.3 * Implemented a new "crash --log dumpfile" option which dumps the kernel log buffer and exits. A kernel namelist is not required, but the dumpfile must contain the VMCOREINFO data from the ELF header of the original /proc/vmcore file that was created by the kexec/kdump facility. Accordingly, this option supports kdump ELF vmcores and compressed kdump vmcores created by the makedumpfile facility, including those that are in makedumpfile's intermediary "vmcore.flat" format. * Fixes for the ppc64.c file to handle gcc-4.7.2 compiler warnings when building crash with "make warn", or compiler failures when building with "make Warn" on a PPC64 machine. Without the patch, gcc-4.7.2 generates three "error: variable ‘’ set but not used [-Werror=unused-but-set-variable]" messages. * Update the PPC64 architecure's internal storage of the kernel's MAX_PHYSMEM_BITS value for Linux 3.7 and later kernels, which changed from 44 to 46 to for 64TB support. Without the patch, there is no known issue, but the stored value should be correct. * Fix for the "mount" command's header display to indicate "MOUNT" instead of "VFSMOUNT" on Linux 3.3 and later kernels because the the first column contains a mount structure address instead of a vfsmount structure address. For those later kernels, it is permissable to enter either the mount structure address, or the address of the vfsmount structure that is embedded within it, as an optional argument. The output has also been tightened up so that the DIRNAME field is not shifted to the right based upon the DEVNAME field length. * Fix for the "mount " search option on 2.6.32 and later kernels. Without the patch, it is possible that multiple filesystems will be displayed. * Update to the "mount" help page to indicate that a dentry address may be used as a search option. * Fix for the "ps -l [pid|task|command]" option to display the specified tasks sorted with the most recently-run task (the largest last_run/timestamp) shown first, as is done with the "ps -l" option with no arguments. Without the patch, the timestamp data gets displayed in the order of the "[pid|task|command]" arguments. * Added the "ps" command to the set of supported "foreach" commands, serving as an alternative manner of passing task-identifying arguments to the "ps" command. For example, a command such as "foreach RU ps" can be accomplished without having to pipe normal "ps" output to "grep RU". All "ps" options are supported from the "foreach" framework. * Fix for the "ps -G" restrictor option such that it also takes affect if the -p, -c, -l, -a, -r or -g options are used. Without the patch, thread group filtering would only take effect when the default "ps" command is used without any of the options above. * Fortify the internal hq_open() function to return FALSE if it is already open, and have restore_sanity() and restore_ifile_sanity() call hq_close() unconditionally. * Added the "extend" command to the set of built-in commands that support minimal mode. A new MINIMAL flag has been created for extension modules to set in their command_table_entry.flags field(s) to signal that a command supports minimal mode. If the crash session has been invoked with --minimal, then the "extend" command will require that the module registers at least one command that has the MINIMAL bit set. * Prevent the "__crc_*" symbols from being added to the the ARM kernel symbol list. * Prevent the "PRRR" and "NMRR" absolute symbols from being added to the ARM kernel symbol list. Without the patch, it allows an invalid set of addresses to pass the check in the in_ksymbol_range() function. * Fix for the ppc.c file to handle a gcc-4.7.2 compiler warning when building crash with "make warn", or compiler failures when building with "make Warn" on a PPC machine. Without the patch, gcc-4.7.2 generates the message "error: variable ‘dm’ set but not used [-Werror=unused-but-set-variable]". * Workaround for the "crash --osrelease dumpfile" option to be able to work with malformed ARM compressed kdump headers. ARM compressed kdumps that indicate header version 3 may contain a malformed kdump_sub_header structure with offset_vmcoreinfo and size_vmcoreinfo fields offset by 4 bytes, and the actual vmcoreinfo data is not preceded by its ELF note header and its "VMCOREINFO" string. This workaround finds the vmcoreinfo data and patches the stored header's offset_vmcoreinfo and size_vmcoreinfo values. Without the patch, the "--osrelease dumpfile" command line option fails with the message "crash: compressed kdump: cannot lseek dump vmcoreinfo", followed by "unknown". * Fix for the "help -n" option on 32-bit compressed kdumps. Without the patch, the offset_vmcoreinfo, offset_eraseinfo, and offset_note fields of the kdump_sub_header have their upper 32-bits clipped off when displayed. However, it should be harmless since the offset values point into the first few pages of the dumpfile. * Update of the extensions/echo.c extension module example, and the "extend" help page, to utilize a constructor function to call the register_extension() function. The _init() and _fini() functions have been designated as obsolete for usage by dlopen() and dlclose(). The echo.c example module has been modified to contain echo_init() and echo_fini() functions marked as __attribute__((constructor)) and __attribute__((destructor)) respectively. * Updated extensions/dminfo.c, extensions/snap.c and extensions/trace.c to replace their _init() and _fini() functions with constructor and destructor functions. * Fix for the "bt" command on the PPC64 architecture when running on Linux 3.7 kernel threads. Without the patch, some kernel threads may fail to terminate on the final ".ret_from_kernel_thread" frame, repeating that frame endlessly, because the stack linkage pointer points back to itself instead of being NULL. -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.2-1) UNRELEASED; urgency=low * New upstream version 6.1.2 * Enhancement of the "task" command to display both the task_struct and the thread_info structures of a task. The -R option accepts members of either/both structure types. * Fix for the X86_64 "search" and "rd" commands due to this commit: http://git.kernel.org/linus/027ef6c87853b0a9df53175063028edb4950d476 Upon any attempt to read a page within the RAM region reserved for AMD GART on a live system, the Linux 3.7rc1 commit above causes causes /dev/mem, /proc/kcore and the /dev/crash drivers to spin forever, leading to a kernel soft lockup. The RAM pages reserved for GART consist of 2MB large pages whose _PAGE_PRESENT bits are turned off. Prior to the above commit, a read() attempt on GART RAM would cause an unresolvable page fault, and would harmlessly return an EFAULT. The commit above has changed pmd_large() function such that it now returns TRUE if only _PAGE_PSE bit is set in the PTE, whereas before it required both _PAGE_PSE and _PAGE_PRESENT. So instead of just failing the read() system call with an EFAULT, the page fault handling code now considers it a spurious TLB fault, and the instruction is retried indefinitely. The crash utility patch stores the GART physical memory range, and disallows any attempts to read from it. * If an EPPIC_GIT_URL environment variable is defined, then the URL that it points to is used as an alternative to the code.google.com git source repository for the eppic.so extension module. However, the alternative site is only accessed if code.google.com can first be pinged; this patch removes that restriction. * Fix for the "files" command PATH display on kernels configured with CONFIG_DEVTMPFS, when the vfsmount pointer in an file structure's "f_path" member does not point to the root vfsmount required for reconstructing the full file pathname. Without the patch, open files in /dev directory may be truncated and not show the "/dev" filename component. * Enhancement to the "kmem -v" option on 2.6.28 and later kernels that utilize the "vmap_area_list" list of mapped kernel virtual memory regions, replacing the usage of the to-be-obsoleted "vmlist" list. In those kernels, the output of the command will also show each vmap_area structure address, in addition to its vm_struct address, memory range, and size. * Update to the exported do_rbtree() and do_rdtree() functions such that they will return the number of items found in the targeted tree, similar in nature to the do_list() function. The two functions have also been fixed such that the VERBOSE flag is actually recognized, so that external callers are able to gather the entries in a tree without having them displayed. The calls to either function may be enclosed with hq_open() and hq_close() so the that tree entries may be subsequently gathered by retrieve_list() into a supplied buffer, as well as to recognize a corrupted list with duplicate entries. * Fix for the "extend -u" option to prevent the usage of a member of a free()'d extension_table structure. No command failure occurs, but rather an inadvertent coding error. * Fix to allow error() to be called during an open_tmpfile() sequence prior to close_tmpfile() being called. There are no crash functions that call error() during an open_tmpfile() sequence, but there's no reason why it cannot be done. Without the patch, the error message gets displayed on stdout (as expected), but the error message will also overwrite/corrupt the tmpfile() data while it is being parsed. * Fix to properly determine whether X86_64 kernels were configured with CONFIG_FRAME_POINTER, due to this ftrace-related commit: http://git.kernel.org/linus/d57c5d51a30152f3175d2344cb6395f08bf8ee0c Without the patch, the crash utility fails to determine whether the kernel was built with CONFIG_FRAME_POINTER, and therefore the "bt" command cannot take advantage of it for more reliable backtraces. * Fix to properly determine whether 2.6.31 and earlier X86_64 kernels were configured with CONFIG_FRAME_POINTER. Without the patch, the crash utility may fail to determine whether the kernel was built with CONFIG_FRAME_POINTER. In those kernel versions -- which may be dependent upon the compiler version used -- one of the sample functions tested may have their "push %rbp, mov %rsp,%rbp" function preamble separated by other instruction(s), resulting in a false negative that precludes the "bt" command from taking advantage of framepointers. * Fix for the file and line-number string that is displayed by the "sym " option. Without the patch, the "/usr/src/" part of the string is stripped, and the filename string itself could have two corrupted characters in the pathname, for example, showing "k3.nel-3.6.fc17" instead of "kernel-3.6.fc17". This is dependent upon the compiler version, or perhaps the string library that is linked into the crash binary, because it only has been seen on crash binaries built with gcc-4.7. The fix now displays the full pathname, no longer dropping the "/usr/src" from beginning. * Restricted the X86_64 "line_number_hook" to kernels earlier than 2.6.24, i.e., kernels prior to the x86/x86_64 merge. Without the patch, the manufactured filename information for assembly-language files was incorrect for 2.6.24 and later kernels. Also, the kernel debuginfo data now has file/line-number data for assembly-language files as well, obviating the need for the hook. * Fix for the extensions/trace.c extension module to prevent a double free exception that would occur if a calloc() call fails during module initialization. * Fix for the "p -u" option if a 32-bit kernel symbol is incorrectly passed as an argument. Without the patch, the command fails, but the next command requiring the services of the embedded gdb module will generate an error message of the sort "*** glibc detected *** crash: free(): invalid pointer:
***", or "*** glibc detected *** crash: munmap_chunk(): invalid pointer:
***", followed by a backtrace, and an abort of the crash session. * Fix for the embedded gdb module to correctly handle kernel modules whose ELF header contains "__ksymtab" and "__ksymtab_gpl" sections with non-zero nonsensical "Address" values. * Without the patch, if one of the odd sections above is encountered, the "Offset" values of the remaining sections are not processed; and if the module's .data section is ignored, gdb incorrectly calculates the address of all symbols in the module's .data section, leading to incorrect output if, for example, data is printed with the gdb "p" command. This invalid ELF section format was introduced in Linux 3.0 by the kernel's "scripts/module-common.lds" file. * Fix for the "runq -g" option if the kernel contains more than 200 task groups. Without the patch, the command generates a segmentation violation. -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.1-1) UNRELEASED; urgency=low * New upstream version 6.1.1 * Fixes for the ARM "vtop" command display of kernel unity-mapped virtual addresses. Without the patch, the PGD, PMD values may be incorrect, and the PAGE value is always incorrectly calculated. * Fix for Linux 2.6.34 and later kernels that are configured with CONFIG_SLUB, but not configured with CONFIG_IKCONFIG, to be able to determine the kernel's CONFIG_NR_CPUS value. Without the patch, if the actual number of cpus is larger than the crash utility's per-architecture NR_CPUS maximum value, then the cpus beyond the NR_CPUS limit would not be accounted for. * Increment the X86_64 NR_CPUS maximum value from 4096 to 5120. * Try to determine whether the kernel is running as a virtual machine by using any available kernel-specific data or by dumpfile type. The results of the hypervisor type search will be stored in the internal kernel_table data structure, and if a hypervisor type can be determined, its name will be displayed by the "mach" command. The result of the hypervisor determination, successful or otherwise, may be viewed during session initialization if the -d command line option is invoked, or during runtime via the "help -k" option. Only applicable to the X86, X86_64 and IA64 architectures. * Allow the "ps command" and "foreach name" command options to contain more than the kernel's maximum of 15 characters that are stored in each task's task_struct.comm[] array. Without the patch, the two string arguments were required to be the possibly-truncated command name string in order to match. * Enhancement to the "ps" command to allow any of the "command" arguments to be POSIX extended regular expressions. The expression string must be encompassed by "'" characters, and will be matched against the names of all tasks. * Add support for 2GB pages in the S390X virtual-to-physical address translation function. Required for the new IBM zEC12 Mainframe. * Initial preparation for support of the ARM64 architecture. * Fix for the "log" command if a kernel message contains either a '\n' or a '\t'. Without the patch, the two characters are replaced with a '.', and the message continues. With the patch applied, the characters are printed, and if it is a '\n', spaces are inserted after the linefeed so that the subsequent characters in the message line up appropriately under the preceding line. * Fix for the "kmem -[sS]" options on kernels that configured with both CONFIG_SLUB and CONFIG_NODES_SHIFT, and that are running on hardware that generates NUMA node ids that are not numbered consecutively. Without the patch, both command options fail with the error message "kmem: invalid kernel virtual address: 8 type: kmem_cache_node nr_partial". * Fix for the "trace.so" extension module's "trace show" command. Without the patch, the output showing each trace point is shown with two hexadecimal virtual addresses instead of displaying them symbolically using the format " <-- ". * Fixes for handling incomplete/invalid ELF or compressed kdump vmcores whose per-cpu NT_PRSTATUS notes are missing. For example, this has been seen to happen when kexec/kdump incorrectly recognizes a Xen DomU kernel as a Xen Dom0 kernel. Without the patch, possible ramifications would be a NULL pointer dereference during session intialization when searching for the panic task, or during the "bt" command on an active task. * Implemented a new "runq -g" option that displays CFS runqueue tasks hierarchically by task_group. Tasks in throttled groups are also displayed. The "runq" command with no option will no longer display task_group data for the RT queue. * Patchset for Xen support up to version 4.2: * Fix for the S390X virtual-to-physical address translation to allow the HW Change-bit override bit (0x100) to be used in page table entries. * Fix for a rarely-seen circumstance in which a kdump ELF vmcore of a Xen dom0 kernel gets incorrectly identified as a old-style netdump ELF vmcore. This has only been seen after the original kdump ELF vmcore was transformed via "makedumpfile -d1". Without the patch, the crash session fails during initialization with the messages "crash: invalid size request: 0 type: xen kdump p2m mfn page", followed by "crash: cannot read xen kdump p2m mfn page". If run against the Xen hypervisor, the session fails during initialization with the error message "crash: read error: kernel virtual address:
type: crashing_cpu". -- Troy Heber Wed, 13 Feb 2013 09:28:40 -0700 crash (6.1.0-1) unstable; urgency=low * Fix for 32-bit SADUMP dumpfiles to correctly check whether a requested physical address is within the 0-640K backup region. Without the patch, requested physical addresses that are larger than 32-bits are truncated to 32-bit values, leading to unexpected results. * Added support for the ELF dumpfile type that is generated by the new "virsh dump --memory-only" option. The "--memory-only" option uses a new "dump-guest-memory" QEMU monitor command that creates an ELF kdump vmcore clone. The "virsh dump" command continues to borrow the "migrate" QEMU monitor command to create a file that is designed for guest migration, and not well-suited for a vmcore because it is not designed for random-access of physical memory. A new "help -r" option has been added to dump the registers that are stored in per-cpu "QEMU" ELF notes; those notes are used to distinguish this dumpfile type from regular kdump ELF vmcores. The patch also combines common functionality between the new format and the SADUMP format. * Fix for the "runq" command for kernels that have the CFS scheduler. Without the patch, a cpu's RT runqueue may incorrectly display "[no tasks queued]" when in fact there are tasks on its queue. * In the highly-unlikely event that a pre-Linux 3.5 kernel's log buffer cannot be read during initialization, display a message indicating "WARNING: cannot read log_buf contents", and just continue. Without the patch, a "readmem" error would be displayed and the crash session would be killed. * Updated the "net -a" option to support Linux 2.6.9 to 3.6.0. Without the patch, the option displayed "net: -a option not supported or applicable on this architecture or kernel". * Enhanced the "net -a" option to show the struct neighbour address associated with each line of output. * Fix for the "runq" command for kernels that are configured with CONFIG_RT_GROUP_SCHED. Without the patch, tasks contained within an RT group scheduling entity are not displayed. * Fix for "crash --version" or "crash -v" to prevent the sourcing of a .gdbinit file that is located in the current directory. * Preemptive fix to handle this patch to the x86 devmem_is_allowed() function that was posted on the Linux Kernel Mailing List here: https://lkml.org/lkml/2012/8/28/357 If the proposed kernel patch put into place, a failed attempt to use /dev/mem when the kernel is configured with CONFIG_STRICT_DEVMEM will not result in an automatic attempt to use /proc/kcore. With this crash utility patch, the automatic switch to /proc/kcore will be attempted regardless whether the kernel patch is accepted or not. * Patch for CVE-2012-3509: libiberty: objalloc_alloc integer overflows * Fix for Linux 3.0 and later kernels that have been configured with CONFIG_SLAB, and without CONFIG_NODES_SHIFT (or have set it to 0). Without the patch, the warning messages "crash: nr_node_ids: symbol does not exist" and "crash: unable to initialize kmem slab cache subsystem" are displayed during initialization, and the "kmem -[sS]" options fail with the message "kmem: kmem cache slab subsystem not available". * Allow the build procedure to use an alternate compiler by passing "make CC=" to the top-level Makefile. * Allow the user to append options to the "configure" script that is invoked by the initial embedded gdb build procedure. The additional options should be put in a file named "GDBFLAGS.extra" located in the top-level directory. * Change for the "ps" command if a task is stopped due to the task being traced by another task. Without the patch, the traced task is shown with the "ST" (stopped) status; with the patch it will be shown with a "TR" ncement of the "task" command to display both the task_struct and the thread_info structures of a task. The -R option accepts members of either/both structure types. * The "TR" state has been added to the "foreach" command's list of task state qualifiers. Without the patch, there is no way to filter out tasks that are stopped due to being traced by another task. * Fix for passing a a "gdb" command to a crash session via a pipe if there are any spaces preceding the "gdb" command name in the string. Without the patch, the command will fail with the error message "gdb: gdb request failed: ". * Preparation for the future S390/S390X structure name change from "_lowcore" to "lowcore". The patch checks which structure is defined and uses the correct name. * Replaced datatype_info() calls in do_radix_tree() and do_rdtree() with preferred MEMBER_SIZE() macro. -- Troy Heber Tue, 23 Oct 2012 09:48:28 -0600 crash (6.0.9-1) UNRELEASED; urgency=low * Fix for building on host machines that have glibc-2.15.90 installed, in which case the glibc header file /usr/include/bits/siginfo.h no longer declares a "struct siginfo", but only the "siginfo_t" typedef. Without the patch, the build of the embedded gdb module fails with the error message "linux-nat.h:63:18: error: field 'siginfo' has incomplete type". * Add support for reading compressed kdump dumpfiles that were compressed by the snappy compressor. This feature is disabled by default. To enable this feature, build the crash utility in the following manner: (1) Install the snappy libraries by using the host system's package manager or by directly downloading libraries from author's website. The packages required are: - snappy - snappy-devel The author's website is: http://code.google.com/p/snappy (2) Create a CFLAGS.extra file and an LDFLAGS.extra file in top-level crash sources directory: - enter -DSNAPPY in the CFLAGS.extra file - enter -lsnappy in the LDFLAGS.extra file. (3) Build crash with "make" as always. * Prevent the "ptov" command from returning an invalid virtual address on 32-bit architectures. Without the patch, the command may result in an invalid virtual address if the physical address entered cannot be accessed by a unity-mapped kernel virtual address. The patch verifies that the calculated virtual address can be translated back into the supplied physical address. * Fix to automatically try /proc/kcore as an alternative live memory source when the /dev/crash driver does not exist and /dev/mem is unusable because the kernel was configured with CONFIG_STRICT_DEVMEM. Without the patch, the automatic switch from /dev/mem to /proc/kcore is only attempted on the X86 and X86_64 architectures. * Added missing linefeeds to several error messages in makedumpfile.c. * Fix for a regression introduced by a crash-5.1.1 patch that reworked the handling of "set" commands that are put in .crashrc files, such that only certain command options would get resolved before the crash session is initialized. Without this patch, the "--less", "--more", "--no_scroll" and "--CRASHPAGER" crash command line options do not properly override conflicting "set scroll