Re: [Qemu-devel] virsh dump (qemu guest memory dump?): KASLR enabled linux guest support

[Daniel P. Berrange]

On Wed, Nov 09, 2016 at 09:36:08AM -0500, Dave Anderson wrote:
> 
> 
> ----- Original Message -----
> > On 11/09/16 at 11:58am, Wen Congyang wrote:
> > > On 11/09/2016 11:17 AM, Dave Young wrote:
> > > > Drop qiaonuohan, seems the mail address is wrong..
> > > > 
> > > > On 11/09/16 at 11:01am, Dave Young wrote:
> > > >> Hi,
> > > >>
> > > >> Latest linux kernel enabled kaslr to randomiz phys/virt memory
> > > >> addresses, we had some effort to support kexec/kdump so that crash
> > > >> utility can still works in case crashed kernel has kaslr enabled.
> > > >>
> > > >> But according to Dave Anderson virsh dump does not work, quoted 
> > > >> messages
> > > >> from Dave below:
> > > >>
> > > >> """
> > > >> with virsh dump, there's no way of even knowing that KASLR
> > > >> has randomized the kernel __START_KERNEL_map region, because there is 
> > > >> no
> > > >> virtual address information -- e.g., like "SYMBOL(_stext)" in the kdump
> > > >> vmcoreinfo data to compare against the vmlinux file symbol value.
> > > >> Unless virsh dump can export some basic virtual memory data, which
> > > >> they say it can't, I don't see how KASLR can ever be supported.
> > > >> """
> > > >>
> > > >> I assume virsh dump is using qemu guest memory dump facility so it
> > > >> should be first addressed in qemu. Thus post this query to qemu devel
> > > >> list. If this is not correct please let me know.
> > > 
> > > IIRC, 'virsh dump --memory-only' uses dump-guest-memory, and 'virsh dump'
> > > uses migration to dump.
> > 
> > Do they need different fixes? Dave, I guess you mean --memory-only, but
> > could you clarify and confirm it?
> 
> As I understand it, the "--memory-only" option uses a new "dump-guest-memory"
> QEMU monitor command that creates an ELF kdump vmcore clone.

IIRC, the use of the traditional 'virsh dump' (which just splats out the
QEMU migration data stream) is no longer supported with crash and everyone
should be using the --memory-only flag to ensure the ELF format core.

IOW, I think we can just ignore the historical migration based dump and
focus exclusively on the dump-guest-memory based impl.


Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|