linux-kernel - Re: [PATCH 0/2] Expose kallsyms data in vmcoreinfo note

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87bkuwry6o.fsf@oracle.com>
Date:   Mon, 13 Jun 2022 15:33:19 -0700
From:   Stephen Brennan <stephen.s.brennan@...cle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Baoquan He <bhe@...hat.com>, linux-kernel@...r.kernel.org,
        kexec@...ts.infradead.org,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Dave Young <dyoung@...hat.com>,
        Kees Cook <keescook@...omium.org>,
        Jiri Olsa <jolsa@...nel.org>,
        Stephen Boyd <swboyd@...omium.org>,
        Bixuan Cui <cuibixuan@...wei.com>,
        David Vernet <void@...ifault.com>,
        Vivek Goyal <vgoyal@...hat.com>,
        Sami Tolvanen <samitolvanen@...gle.com>
Subject: Re: [PATCH 0/2] Expose kallsyms data in vmcoreinfo note

Andrew Morton <akpm@...ux-foundation.org> writes:
> On Mon, 13 Jun 2022 14:59:44 -0700 Stephen Brennan <stephen.s.brennan@...cle.com> wrote:
>> >> Related discussion around the BTF side of this:
>> >> https://lore.kernel.org/bpf/586a6288-704a-f7a7-b256-e18a675927df@oracle.com/T/#u
>> >> 
>> >> Some work-in-progress branches using this feature:
>> >> https://github.com/brenns10/dwarves/tree/remove_percpu_restriction_1
>> >> https://github.com/brenns10/drgn/tree/kallsyms_plus_btf
>> >
>> > What's the story on using gdb with this?
>> 
>> There is no story with GDB as of yet. I was already familiar with the
>> code of drgn when I started down this path, so that's what I used. Drgn
>> happens to have a very extensible type system which made it quite simple
>> to do. I'd love to see support for doing this with GDB, and might look
>> into the feasibility of it, but it's not on my roadmap right now.
>
> Naive question - could some standalone tool take this kallsyms-based
> info, combine it with a core image and create a minimally-dwarfified
> file which any debugger can munch on?

I'm not too familiar with the guts of DWARF, so honestly my guess may
not be any better than yours.

One thing that strikes me is that DWARF is typically included in an ELF
section, whereas x86_64 kernels are typically a bzImage, so I'm not
entirely sure how you'd get back an ELF file suitable to stick the DWARF
into. And from there, I really have no guess about the DWARF.

I will say that Compact Type Format (CTF) [1] is rather similar to BTF
in scope, and it already has support in the GNU Binutils. I'd imagine
that there's much more of a fighting chance of converting BTF to CTF and
getting GDB to use that instead.

[1] https://lwn.net/Articles/795384/

Stephen