Bug 1398633
| Summary: | [RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev) | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ademar Reis <areis> | |
| Component: | qemu-kvm-rhev | Assignee: | Marc-Andre Lureau <marcandre.lureau> | |
| Status: | CLOSED ERRATA | QA Contact: | cliao <cliao> | |
| Severity: | high | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.3 | CC: | anderson, arozansk, berrange, bhe, chayang, cliao, coli, cye, drjones, hachen, herbert.xu, jinzhao, jpoimboe, juzhang, knoel, lersek, libvirt-maint, lmiksik, lwang, marcandre.lureau, michen, mrezanin, mtessun, ngu, pingl, pmatouse, rbalakri, ruyang, virt-bugs, yafu, yilzhang, yuhuang, zhguo | |
| Target Milestone: | rc | Keywords: | FutureFeature | |
| Target Release: | 7.5 | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | qemu-kvm-rhev-2.10.0-20.el7 | Doc Type: | Enhancement | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1395248 | |||
| : | 1411490 1493125 (view as bug list) | Environment: | ||
| Last Closed: | 2018-04-11 00:12:33 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1290840, 1424943, 1540836 | |||
| Bug Blocks: | 1288169, 1395248, 1411490, 1419537, 1469590, 1484340, 1493125, 1517775, 1519748, 1555268, 1555276, 1568461, 1568736 | |||
|
Description
Ademar Reis
2016-11-25 12:38:53 UTC
*** Bug 1447210 has been marked as a duplicate of this bug. *** Hi Nini, This may help you: https://lists.gnu.org/archive/html/qemu-devel/2017-09/msg02657.html. Thanks for Marc-Andre's point. BR/ Guo, Zhiyi (In reply to Guo, Zhiyi from comment #6) Zhiyi, Get it. Thanks for the info. *** Bug 1507740 has been marked as a duplicate of this bug. *** Fix included in qemu-kvm-rhev-2.10.0-10.el7
test result:
version:
host kernel: kernel-3.10.0-799.el7.x86_64
guest kernel: kernel-3.10.0-799.el7.x86_64
qemu: qemu-kvm-rhev-2.10.0-10.el7
step:
1.boot guest:
/usr/libexec/qemu-kvm \
-m 1024 \
-smp 1 \
-vnc :0 \
-name guest=test5-4,debug-threads=on \
-boot menu=on \
-device virtio-scsi-pci,bus=pci.0,addr=0x5,id=scsi0 \
-drive file=/home/image/rhel75-64-virtio-scsi.raw,format=raw,if=none,id=drive-scsi0-0-0-0 \
-device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1 \
-device virtio-net-pci,mac=9a:70:71:72:74:73,id=idIBZSw2,vectors=4,netdev=idHrhHM9,bus=pci.0,addr=06,bootindex=2 \
-netdev tap,id=idHrhHM9,vhost=on \
-device vmcoreinfo \
-monitor stdio -qmp tcp:0:4444,server
2.
#{ "execute": "qmp_capabilities" }
{"return": {}}
{"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": "file:/home/dump.normal"}}
{"timestamp": {"seconds": 1512108151, "microseconds": 843955}, "event": "STOP"}
{"timestamp": {"seconds": 1512108152, "microseconds": 651379}, "event": "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": "completed", "completed": 1090715648}}}
{"timestamp": {"seconds": 1512108152, "microseconds": 651782}, "event": "RESUME"}
{"return": {}}
#{"execute":"query-dump-guest-memory-capability"}
#{"return": {"formats": ["elf", "kdump-zlib", "kdump-lzo", "kdump-snappy"]}}
{"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": "file:/home/dump.elf", "format": "elf"}}
{"timestamp": {"seconds": 1512108185, "microseconds": 241082}, "event": "STOP"}
{"timestamp": {"seconds": 1512108186, "microseconds": 92823}, "event": "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": "completed", "completed": 1090715648}}}
{"timestamp": {"seconds": 1512108186, "microseconds": 93191}, "event": "RESUME"}
{"return": {}}
#{"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": "file:/home/dump.zlib", "format": "kdump-zlib"}}
{"timestamp": {"seconds": 1512108229, "microseconds": 170590}, "event": "STOP"}
{"timestamp": {"seconds": 1512108245, "microseconds": 361914}, "event": "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": "completed", "completed": 1090715648}}}
{"timestamp": {"seconds": 1512108245, "microseconds": 362320}, "event": "RESUME"}
{"return": {}}
#{"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": "file:/home/dump.lzo", "format": "kdump-lzo"}}
{"timestamp": {"seconds": 1512108615, "microseconds": 399338}, "event": "STOP"}
{"timestamp": {"seconds": 1512108617, "microseconds": 648353}, "event": "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": "completed", "completed": 1090715648}}}
{"timestamp": {"seconds": 1512108617, "microseconds": 648749}, "event": "RESUME"}
{"return": {}}
3.result:
3.1 crash:
crash /usr/lib/debug/lib/modules/3.10.0-799.el7.x86_64/vmlinux dump.elf
crash 7.2.0-1.el7
Copyright (C) 2002-2017 Red Hat, Inc.
Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation
Copyright (C) 1999-2006 Hewlett-Packard Co
Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited
Copyright (C) 2006, 2007 VA Linux Systems Japan K.K.
Copyright (C) 2005, 2011 NEC Corporation
Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions. Enter "help copying" to see the conditions.
This program has absolutely no warranty. Enter "help warranty" for details.
WARNING: cannot determine physical base address: defaulting to 0
GNU gdb (GDB) 7.6
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu"...
WARNING: failed to init kexec backup region
WARNING: cannot read linux_banner string
crash: /usr/lib/debug/lib/modules/3.10.0-799.el7.x86_64/vmlinux and dump.elf do not match!
Usage:
crash [OPTION]... NAMELIST MEMORY-IMAGE[@ADDRESS] (dumpfile form)
crash [OPTION]... [NAMELIST] (live system form)
Enter "crash -h" for details.
3.2 gdb use dump-guest-memory.py
gdb /var/core.2043-0-0-11-1512111124-hp-z420-01.qe.lab.eng.nay.redhat.com-qemu-kvm
(gdb) source /usr/share/qemu-kvm/dump-guest-memory.py
(gdb) set height 0
(gdb) dump-guest-memory /home/vmcore1 X86_64
guest RAM blocks:
target_start target_end host_addr message count
---------------- ---------------- ---------------- ------- -----
0000000000000000 00000000000a0000 00007f04e5200000 added 1
00000000000a0000 00000000000b0000 00007f04e3c00000 added 2
00000000000c0000 00000000000ca000 00007f04e52c0000 added 3
00000000000ca000 00000000000cd000 00007f04e52ca000 joined 3
00000000000cd000 00000000000e8000 00007f04e52cd000 joined 3
00000000000e8000 00000000000f0000 00007f04e52e8000 joined 3
00000000000f0000 0000000000100000 00007f04e52f0000 joined 3
0000000000100000 0000000040000000 00007f04e5300000 joined 3
00000000fd000000 00000000fe000000 00007f04e3c00000 added 4
00000000fffc0000 0000000100000000 00007f04e5000000 added 5
Python Exception <class 'gdb.error'> No symbol "vmcoreinfo_find" in current context.:
Error occurred in Python command: No symbol "vmcoreinfo_find" in current context.
(gdb)
but crash can work when guest kernel add "nokaslr".
(In reply to cliao from comment #14) > test result: > > version: > host kernel: kernel-3.10.0-799.el7.x86_64 > guest kernel: kernel-3.10.0-799.el7.x86_64 > qemu: qemu-kvm-rhev-2.10.0-10.el7 > > step: > 1.boot guest: > /usr/libexec/qemu-kvm \ > -m 1024 \ > -smp 1 \ > -vnc :0 \ > -name guest=test5-4,debug-threads=on \ > -boot menu=on \ > -device virtio-scsi-pci,bus=pci.0,addr=0x5,id=scsi0 \ > -drive > file=/home/image/rhel75-64-virtio-scsi.raw,format=raw,if=none,id=drive-scsi0- > 0-0-0 \ > -device > scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0, > id=scsi0-0-0-0,bootindex=1 \ > -device > virtio-net-pci,mac=9a:70:71:72:74:73,id=idIBZSw2,vectors=4,netdev=idHrhHM9, > bus=pci.0,addr=06,bootindex=2 \ > -netdev tap,id=idHrhHM9,vhost=on \ > -device vmcoreinfo \ > -monitor stdio -qmp tcp:0:4444,server > > > 2. > #{ "execute": "qmp_capabilities" } > {"return": {}} > {"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": > "file:/home/dump.normal"}} > {"timestamp": {"seconds": 1512108151, "microseconds": 843955}, "event": > "STOP"} > {"timestamp": {"seconds": 1512108152, "microseconds": 651379}, "event": > "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": > "completed", "completed": 1090715648}}} > {"timestamp": {"seconds": 1512108152, "microseconds": 651782}, "event": > "RESUME"} > {"return": {}} > #{"execute":"query-dump-guest-memory-capability"} > #{"return": {"formats": ["elf", "kdump-zlib", "kdump-lzo", "kdump-snappy"]}} > {"execute": "dump-guest-memory", "arguments": { "paging": false, "protocol": > "file:/home/dump.elf", "format": "elf"}} > {"timestamp": {"seconds": 1512108185, "microseconds": 241082}, "event": > "STOP"} > {"timestamp": {"seconds": 1512108186, "microseconds": 92823}, "event": > "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": > "completed", "completed": 1090715648}}} > {"timestamp": {"seconds": 1512108186, "microseconds": 93191}, "event": > "RESUME"} > {"return": {}} > #{"execute": "dump-guest-memory", "arguments": { "paging": false, > "protocol": "file:/home/dump.zlib", "format": "kdump-zlib"}} > {"timestamp": {"seconds": 1512108229, "microseconds": 170590}, "event": > "STOP"} > {"timestamp": {"seconds": 1512108245, "microseconds": 361914}, "event": > "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": > "completed", "completed": 1090715648}}} > {"timestamp": {"seconds": 1512108245, "microseconds": 362320}, "event": > "RESUME"} > {"return": {}} > #{"execute": "dump-guest-memory", "arguments": { "paging": false, > "protocol": "file:/home/dump.lzo", "format": "kdump-lzo"}} > {"timestamp": {"seconds": 1512108615, "microseconds": 399338}, "event": > "STOP"} > {"timestamp": {"seconds": 1512108617, "microseconds": 648353}, "event": > "DUMP_COMPLETED", "data": {"result": {"total": 1090715648, "status": > "completed", "completed": 1090715648}}} > {"timestamp": {"seconds": 1512108617, "microseconds": 648749}, "event": > "RESUME"} > {"return": {}} > > 3.result: > 3.1 crash: > crash /usr/lib/debug/lib/modules/3.10.0-799.el7.x86_64/vmlinux dump.elf > > crash 7.2.0-1.el7 > Copyright (C) 2002-2017 Red Hat, Inc. > Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation > Copyright (C) 1999-2006 Hewlett-Packard Co > Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited > Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. > Copyright (C) 2005, 2011 NEC Corporation > Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. > Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. > This program is free software, covered by the GNU General Public License, > and you are welcome to change it and/or distribute copies of it under > certain conditions. Enter "help copying" to see the conditions. > This program has absolutely no warranty. Enter "help warranty" for details. > > WARNING: cannot determine physical base address: defaulting to 0 > > GNU gdb (GDB) 7.6 > Copyright (C) 2013 Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "x86_64-unknown-linux-gnu"... > > WARNING: failed to init kexec backup region > WARNING: cannot read linux_banner string > crash: /usr/lib/debug/lib/modules/3.10.0-799.el7.x86_64/vmlinux and dump.elf > do not match! This also depends on kernel support, bug 1493125. > > Usage: > > crash [OPTION]... NAMELIST MEMORY-IMAGE[@ADDRESS] (dumpfile form) > crash [OPTION]... [NAMELIST] (live system form) > > Enter "crash -h" for details. > > 3.2 gdb use dump-guest-memory.py > gdb > /var/core.2043-0-0-11-1512111124-hp-z420-01.qe.lab.eng.nay.redhat.com-qemu- > kvm > (gdb) source /usr/share/qemu-kvm/dump-guest-memory.py > (gdb) set height 0 > (gdb) dump-guest-memory /home/vmcore1 X86_64 > guest RAM blocks: > target_start target_end host_addr message count > ---------------- ---------------- ---------------- ------- ----- > 0000000000000000 00000000000a0000 00007f04e5200000 added 1 > 00000000000a0000 00000000000b0000 00007f04e3c00000 added 2 > 00000000000c0000 00000000000ca000 00007f04e52c0000 added 3 > 00000000000ca000 00000000000cd000 00007f04e52ca000 joined 3 > 00000000000cd000 00000000000e8000 00007f04e52cd000 joined 3 > 00000000000e8000 00000000000f0000 00007f04e52e8000 joined 3 > 00000000000f0000 0000000000100000 00007f04e52f0000 joined 3 > 0000000000100000 0000000040000000 00007f04e5300000 joined 3 > 00000000fd000000 00000000fe000000 00007f04e3c00000 added 4 > 00000000fffc0000 0000000100000000 00007f04e5000000 added 5 > Python Exception <class 'gdb.error'> No symbol "vmcoreinfo_find" in current > context.: > Error occurred in Python command: No symbol "vmcoreinfo_find" in current > context. > (gdb) > > Good catch, I sent a patch on qemu ML for that: [PATCH] dump-guest-memory.py: fix No symbol "vmcoreinfo_find" Fix included in qemu-kvm-rhev-2.10.0-12.el7 test result: host kernel: kernel-3.10.0-799.el7.x86_64 guest kernel: kernel-3.10.0-799.el7.x86_64 qemu: qemu-kvm-rhev-2.10.0-12.el7 steps: gdb use dump-guest-memory.py gdb core.14130-0-0-11-1513045734-hp-z220-01.qe.lab.eng.nay.redhat.com-qemu-kvm (gdb) source /usr/share/qemu-kvm/dump-guest-memory.py (gdb) set height 0 (gdb) dump-guest-memory /tmp/vmcore X86_64 guest RAM blocks: target_start target_end host_addr message count ---------------- ---------------- ---------------- ------- ----- 0000000000000000 00000000000a0000 00007f7935800000 added 1 00000000000a0000 00000000000b0000 00007f7934200000 added 2 00000000000c0000 00000000000ca000 00007f79358c0000 added 3 00000000000ca000 00000000000cd000 00007f79358ca000 joined 3 00000000000cd000 00000000000e8000 00007f79358cd000 joined 3 00000000000e8000 00000000000f0000 00007f79358e8000 joined 3 00000000000f0000 0000000000100000 00007f79358f0000 joined 3 0000000000100000 0000000080000000 00007f7935900000 joined 3 00000000fd000000 00000000fe000000 00007f7934200000 added 4 00000000fffc0000 0000000100000000 00007f7935600000 added 5 Python Exception <class 'gdb.error'> You can't do that without a process to debug.: Error occurred in Python command: You can't do that without a process to debug. (gdb) q hi Marcandre: I can not get the vmcore file when use dump-guest-memory.py. BTW, since kernel not support KASLR. If I will wait for kernel bug fix then verify qemu-kvm-rhev thanks, cliao sent: [PATCH] dump-guest-memory.py: fix "You can't do that without a process to debug" for upstream, we will need to backport it. Fix included in qemu-kvm-rhev-2.10.0-17.el7 Fix included in qemu-kvm-rhev-2.10.0-18.el7 gdb can use dump-guest-memory.py now. versions: qemu : qemu-kvm-rhev-2.10.0-18.el7 kernel: kernel-3.10.0-830.el7.x86_64 steps: 1.gdb core.20385 ...... (gdb) source /usr/share/qemu-kvm/dump-guest-memory.py (gdb) set height 0 (gdb) dump-guest-memory /home/vmcore X86_64 guest RAM blocks: target_start target_end host_addr message count ---------------- ---------------- ---------------- ------- ----- 0000000000000000 00000000000a0000 00007fa2b2a00000 added 1 00000000000a0000 00000000000b0000 00007fa2b1400000 added 2 00000000000c0000 00000000000ca000 00007fa2b2ac0000 added 3 00000000000ca000 00000000000cd000 00007fa2b2aca000 joined 3 00000000000cd000 00000000000e8000 00007fa2b2acd000 joined 3 00000000000e8000 00000000000f0000 00007fa2b2ae8000 joined 3 00000000000f0000 0000000000100000 00007fa2b2af0000 joined 3 0000000000100000 00000000c0000000 00007fa2b2b00000 joined 3 00000000fd000000 00000000fe000000 00007fa2b1400000 added 4 00000000fffc0000 0000000100000000 00007fa2b2800000 added 5 0000000100000000 0000000140000000 00007fa372a00000 added 6 dumping range at 00007fa2b2a00000 for length 00000000000a0000 dumping range at 00007fa2b1400000 for length 0000000000010000 dumping range at 00007fa2b2ac0000 for length 00000000bff40000 dumping range at 00007fa2b1400000 for length 0000000001000000 dumping range at 00007fa2b2800000 for length 0000000000040000 dumping range at 00007fa372a00000 for length 0000000040000000 (gdb) q Fix included in qemu-kvm-rhev-2.10.0-20.el7 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:1104 |