linux-kernel - [PATCH 2/2] scripts/gdb/symbols: make lx-symbols skip the s390 decompressor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250625154220.75300-3-iii@linux.ibm.com>
Date: Wed, 25 Jun 2025 17:36:52 +0200
From: Ilya Leoshkevich <iii@...ux.ibm.com>
To: Jan Kiszka <jan.kiszka@...mens.com>, Kieran Bingham <kbingham@...nel.org>
Cc: linux-kernel@...r.kernel.org, Heiko Carstens <hca@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Ilya Leoshkevich <iii@...ux.ibm.com>
Subject: [PATCH 2/2] scripts/gdb/symbols: make lx-symbols skip the s390 decompressor

When one starts QEMU with the -S flag and attaches GDB, the kernel is
not yet loaded, and the current instruction is an entry point to the
decompressor. In case the intention is to debug the early kernel boot,
and not the decompressor, e.g., put a breakpoint on some kernel
function and see all the invocations, one has to skip the decompressor.

There are many ways to do this, and so far people wrote private scripts
or memorized certain command sequences.

Make it work out of the box like this:

    $ gdb -ex 'target remote :6812' -ex 'source vmlinux-gdb.py' vmlinux
    Remote debugging using :6812
    0x0000000000010000 in ?? ()
    (gdb) lx-symbols
    loading vmlinux
    (gdb) x/i $pc
    => 0x3ffe0100000 <startup_continue>:    lghi    %r2,0

Implement this by reading the address of the jump_to_kernel() function
from the lowcore, and step until DAT is turned on.

Signed-off-by: Ilya Leoshkevich <iii@...ux.ibm.com>
---
 scripts/gdb/linux/symbols.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
index 2332bd8eddf1..6edb99221675 100644
--- a/scripts/gdb/linux/symbols.py
+++ b/scripts/gdb/linux/symbols.py
@@ -84,6 +84,30 @@ def get_kerneloffset():
     return None
 
 
+def is_in_s390_decompressor():
+    # DAT is always off in decompressor. Use this as an indicator.
+    # Note that in the kernel, DAT can be off during kexec() or restart.
+    # Accept this imprecision in order to avoid complicating things.
+    # It is unlikely that someone will run lx-symbols at these points.
+    pswm = int(gdb.parse_and_eval("$pswm"))
+    return (pswm & 0x0400000000000000) == 0
+
+
+def skip_decompressor():
+    if utils.is_target_arch("s390"):
+        if is_in_s390_decompressor():
+            # The address of the jump_to_kernel function is statically placed
+            # into svc_old_psw.addr (see ipl_data.c); read it from there. DAT
+            # is off, so we do not need to care about lowcore relocation.
+            svc_old_pswa = 0x148
+            jump_to_kernel = int(gdb.parse_and_eval("*(unsigned long long *)" +
+                                                    hex(svc_old_pswa)))
+            gdb.execute("tbreak *" + hex(jump_to_kernel))
+            gdb.execute("continue")
+            while is_in_s390_decompressor():
+                gdb.execute("stepi")
+
+
 class LxSymbols(gdb.Command):
     """(Re-)load symbols of Linux kernel and currently loaded modules.
 
@@ -204,6 +228,8 @@ lx-symbols command."""
             saved_state['breakpoint'].enabled = saved_state['enabled']
 
     def invoke(self, arg, from_tty):
+        skip_decompressor()
+
         self.module_paths = [os.path.abspath(os.path.expanduser(p))
                              for p in arg.split()]
         self.module_paths.append(os.getcwd())
-- 
2.49.0