kexec February 2020

kexec@lists.fedoraproject.org

5 participants
13 discussions

[PATCH] mkdumprd: allow spaces after 'path' config phrase when network dump
by Kazuhito Hagio 26 May '22

26 May '22

Without this patch, when there are two or more spaces after 'path' configuration phrase with ssh or nfs setting, SAVE_PATH is set to '/var/crash' in mkdumprd, and in most cases kdump service fails to start. ssh kdump(a)192.168.122.1 path /kdump ^^ This behavior would be too sensitive and different from the other configurations. With this patch, mkdumprd allows such spaces. Signed-off-by: Kazuhito Hagio <k-hagio(a)ab.jp.nec.com> --- mkdumprd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdumprd b/mkdumprd index a6f7fe8..aa0abfd 100644 --- a/mkdumprd +++ b/mkdumprd @@ -13,7 +13,7 @@ export IN_KDUMP=1 conf_file="/etc/kdump.conf" SSH_KEY_LOCATION="/root/.ssh/kdump_id_rsa" -SAVE_PATH=$(grep ^path $conf_file| cut -d' ' -f2) +SAVE_PATH=$(awk '/^path/ {print $2}' $conf_file) [ -z "$SAVE_PATH" ] && SAVE_PATH=$DEFAULT_PATH # strip the duplicated "/" SAVE_PATH=$(echo $SAVE_PATH | tr -s /) -- 2.18.0

4 3

[PATCH] kdumpctl: Export DUMP_TARGET
by Bhupesh Sharma 09 Mar '20

09 Mar '20

When building kdump initramfs for a SSH dump target, mkdumprd would check whether it has the write permission on the SSH Server's $DUMP_TARGET. However $DUMP_TARGET is missing in the actual error message when the user doesn't not have the write permission. For example: # kdumpctl restart kexec: unloaded kdump kernel Stopping kdump: [OK] Could not create temporary directory on :/home/bhsharma/test. Make sure user has write permission on destination mkdumprd: failed to make kdump initrd Starting kdump: [FAILED] This patch exports $DUMP_TARGET from kdumpctl to make sure that mkdumprd can use the same inside mkdir_save_path_ssh() function to fix the issue. Note that without this patch, $DUMP_TARGET is uninitialized in mkdumprd. Signed-off-by: Bhupesh Sharma <bhsharma(a)redhat.com> --- kdumpctl | 1 + 1 file changed, 1 insertion(+) diff --git a/kdumpctl b/kdumpctl index 88128a3e73d6..0d5760891069 100755 --- a/kdumpctl +++ b/kdumpctl @@ -720,6 +720,7 @@ check_ssh_config() ;; ssh) DUMP_TARGET=$config_val + export DUMP_TARGET ;; *) ;; -- 2.7.4

2 2

[PATCH 0/2] Check whether makedumpfile command-line is valid or not
by Kazuhito Hagio 04 Mar '20

04 Mar '20

Currently it's difficult to check whether a makedumpfile command-line is valid or not without a dump test. This is inefficient and if a wrong configuration is not tested, you will miss the vmcore when a panic occurs. In order to check it when generating initramfs, use makedumpfile --check-params option, which was recently added. With this patchset, kdumpctl can point out mistakes in core_collector option and fail. For example, if there is a practical mistake that dump_level is -1: # cat /etc/kdump.conf core_collector makedumpfile -l --message-level 1 -d -1 # kdumpctl start Detected change(s) in the following file(s): /etc/kdump.conf Rebuilding /boot/initramfs-5.4.19-200.fc31.x86_64kdump.img Dump_level(-1) is invalid. makedumpfile parameter check failed. mkdumprd: failed to make kdump initrd Starting kdump: [FAILED] Kazuhito Hagio (2): makedumpfile: Introduce --check-params option mkdumprd: Use makedumpfile --check-params option ...mpfile-Introduce-check-params-option.patch | 255 ++++++++++++++++++ kexec-tools.spec | 2 + mkdumprd | 24 +- 3 files changed, 275 insertions(+), 6 deletions(-) create mode 100644 kexec-tools-2.0.20-makedumpfile-Introduce-check-params-option.patch -- 2.24.1

2 3

[PATCH] kdump-lib.sh: Fix is_user_configured_dump_target()
by HAGIO KAZUHITO(萩尾　一仁) 24 Feb '20

24 Feb '20

Currently, is_user_configured_dump_target() doesn't work as expected due to lack of grep -E option. As a result, kdump service with a ssh dump configuration can unnecessarily fail to start due to the non-existence of a directory at where the path option specifies on the local system: kdumpctl[9760]: Rebuilding /boot/initramfs-5.4.19-200.fc31.x86_64kdump.img kdumpctl[9760]: Dump path /var/crash/ssh does not exist. kdumpctl[9760]: mkdumprd: failed to make kdump initrd kdumpctl[9760]: Starting kdump: [FAILED] Signed-off-by: Kazuhito Hagio <k-hagio-ab(a)nec.com> --- kdump-lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kdump-lib.sh b/kdump-lib.sh index 2428b5d..9c41439 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -117,7 +117,7 @@ to_dev_name() { is_user_configured_dump_target() { - grep -q "^ext[234]|^xfs|^btrfs|^minix|^raw|^nfs|^ssh" /etc/kdump.conf || is_mount_in_dracut_args; + grep -E -q "^ext[234]|^xfs|^btrfs|^minix|^raw|^nfs|^ssh" /etc/kdump.conf || is_mount_in_dracut_args; } get_user_configured_dump_disk() -- 2.24.1

1 0

Re: [PATCH] Several improvements to early-kdump-howto.txt
by lijiang 17 Feb '20

17 Feb '20

在 2020年02月18日 05:47, HAGIO KAZUHITO(萩尾　一仁) 写道: > Hi Lianbo, all, > > Early kdump is now supported in RHEL8 and general users can start to use > it, but I think the document still has some points that we can make better. > How about this patch? > Thanks for your improvement, Kazu. Looks better to me. Lianbo > Thanks, > Kazu > > From 095376482c6f970c4b66d65fd05f274036087826 Mon Sep 17 00:00:00 2001 > From: Kazuhito Hagio <k-hagio-ab(a)nec.com> > Date: Mon, 17 Feb 2020 14:22:28 -0500 > Subject: [PATCH] Several improvements to early-kdump-howto.txt > > Improves the early-kdump-howto.txt document in several points: > > (1) explain early kdump a little clearer in "Introduction" > (2) move the notes out to a new "Notes" section for readability and > add a note about need of reconfiguration after kernel update > (3) change journalctl -x option to -b option because -x is unnecessary > and -b will make it very faster if persistent journal is available > (4) shorten the example messages for readability > (5) add a note to "Limitation" about the earliness of early kdump > > Signed-off-by: Kazuhito Hagio <k-hagio-ab(a)nec.com> > --- > early-kdump-howto.txt | 67 +++++++++++++++++++++++++++---------------- > 1 file changed, 43 insertions(+), 24 deletions(-) > > diff --git a/early-kdump-howto.txt b/early-kdump-howto.txt > index c29557e19403..68b23c7d1f2d 100644 > --- a/early-kdump-howto.txt > +++ b/early-kdump-howto.txt > @@ -3,12 +3,17 @@ Early Kdump HOWTO > Introduction > ------------ > > -Kdump service starts too late, so early crashes will have no chance to get > -kdump kernel booting, this will cause crash information to be lost. It is > -necessary to add a dracut module in order to load crash kernel and initramfs > -as early as possible. You can provide "rd.earlykdump" in grub commandline > -to enable, then the early kdump will load those files like the normal kdump, > -which is disabled by default. > +Early kdump is a mechanism to make kdump operational earlier than normal kdump > +service. The kdump service starts early enough for general crash cases, but > +there are some cases where it has no chance to make kdump operational in boot > +sequence, such as detecting devices and starting early services. If you hit > +such a case, early kdump may allow you to get more information of it. > + > +Early kdump is implemented as a dracut module. It adds a kernel (vmlinuz) and > +initramfs for kdump to your system's initramfs in order to load them as early > +as possible. After that, if you provide "rd.earlykdump" in kernel command line, > +then in the initramfs, early kdump will load those files like the normal kdump > +service. This is disabled by default. > > For the normal kdump service, it can check whether the early kdump has loaded > the crash kernel and initramfs. It has no conflict with the early kdump. > @@ -20,7 +25,9 @@ We assume if you're reading this document, you should already have kexec-tools > installed. > > You can rebuild the initramfs with earlykdump support with below steps: > + > 1. start kdump service to make sure kdump initramfs is created. > + > # systemctl start kdump > > NOTE: If a crash occurs during boot process, early kdump captures a vmcore > @@ -34,6 +41,7 @@ You can rebuild the initramfs with earlykdump support with below steps: > For the failure_action, you can choose anything other than "reboot". > > 2. rebuild system initramfs with earlykdump support. > + > # dracut --force --add earlykdump > > NOTE: Recommend to backup the original system initramfs before performing > @@ -41,16 +49,6 @@ You can rebuild the initramfs with earlykdump support with below steps: > > 3. add rd.earlykdump in grub kernel command line. > > -Note: > -[1]. Early kdump initramfs size will be large because it includes vmlinuz and > -kdump initramfs. > - > -[2]. Early kdump inherits the settings of normal kdump, so any changes that > -caused normal kdump rebuilding also require rebuilding the system initramfs > -to make sure that the changes take effect for early kdump. Therefore, after > -the rebuilding of kdump initramfs is completed, provide a prompt message to > -tell the fact. > - > After making said changes, reboot your system to take effect. Of course, if you > want to disable early kdump, you can simply remove "rd.earlykdump" from kernel > boot parameters in grub, and reboot system like above. > @@ -58,19 +56,40 @@ boot parameters in grub, and reboot system like above. > Once the boot is completed, you can check the status of the early kdump support > on the command prompt: > > - # journalctl -x|grep early-kdump > + # journalctl -b | grep early-kdump > > Then, you will see some useful logs, for example: > > -1. if early kdump is successful. > -Mar 09 09:57:56 localhost.localdomain dracut-cmdline[190]: early-kdump is enabled. > -Mar 09 09:57:56 localhost.localdomain dracut-cmdline[190]: kexec: loaded early- > -kdump kernel > +- if early kdump is successful. > + > +Mar 09 09:57:56 localhost dracut-cmdline[190]: early-kdump is enabled. > +Mar 09 09:57:56 localhost dracut-cmdline[190]: kexec: loaded early-kdump kernel > > -2. if early kdump is disabled. > -Mar 09 10:02:47 localhost.localdomain dracut-cmdline[189]: early-kdump is disabled. > +- if early kdump is disabled. > + > +Mar 09 10:02:47 localhost dracut-cmdline[189]: early-kdump is disabled. > + > +Notes > +----- > + > +- The size of early kdump initramfs will be large because it includes vmlinuz > + and kdump initramfs. > + > +- Early kdump inherits the settings of normal kdump, so any changes that > + caused normal kdump rebuilding also require rebuilding the system initramfs > + to make sure that the changes take effect for early kdump. Therefore, after > + the rebuilding of kdump initramfs is completed, provide a prompt message to > + tell the fact. > + > +- If you install an updated kernel and reboot the system with it, the early > + kdump will be disabled by default. To enable it with the new kernel, you > + need to take the above steps again. > > Limitation > ---------- > > -At present, early kdump doesn't support fadump. > +- At present, early kdump doesn't support fadump. > + > +- Early kdump loads a crash kernel and initramfs at the beginning of the > + process in system's initramfs, so a crash at earlier than that (e.g. in > + kernel initialization) cannot be captured even with the early kdump. >

1 0

[PATCH] Several improvements to early-kdump-howto.txt
by HAGIO KAZUHITO(萩尾　一仁) 17 Feb '20

17 Feb '20

Hi Lianbo, all, Early kdump is now supported in RHEL8 and general users can start to use it, but I think the document still has some points that we can make better. How about this patch? Thanks, Kazu From 095376482c6f970c4b66d65fd05f274036087826 Mon Sep 17 00:00:00 2001 From: Kazuhito Hagio <k-hagio-ab(a)nec.com> Date: Mon, 17 Feb 2020 14:22:28 -0500 Subject: [PATCH] Several improvements to early-kdump-howto.txt Improves the early-kdump-howto.txt document in several points: (1) explain early kdump a little clearer in "Introduction" (2) move the notes out to a new "Notes" section for readability and add a note about need of reconfiguration after kernel update (3) change journalctl -x option to -b option because -x is unnecessary and -b will make it very faster if persistent journal is available (4) shorten the example messages for readability (5) add a note to "Limitation" about the earliness of early kdump Signed-off-by: Kazuhito Hagio <k-hagio-ab(a)nec.com> --- early-kdump-howto.txt | 67 +++++++++++++++++++++++++++---------------- 1 file changed, 43 insertions(+), 24 deletions(-) diff --git a/early-kdump-howto.txt b/early-kdump-howto.txt index c29557e19403..68b23c7d1f2d 100644 --- a/early-kdump-howto.txt +++ b/early-kdump-howto.txt @@ -3,12 +3,17 @@ Early Kdump HOWTO Introduction ------------ -Kdump service starts too late, so early crashes will have no chance to get -kdump kernel booting, this will cause crash information to be lost. It is -necessary to add a dracut module in order to load crash kernel and initramfs -as early as possible. You can provide "rd.earlykdump" in grub commandline -to enable, then the early kdump will load those files like the normal kdump, -which is disabled by default. +Early kdump is a mechanism to make kdump operational earlier than normal kdump +service. The kdump service starts early enough for general crash cases, but +there are some cases where it has no chance to make kdump operational in boot +sequence, such as detecting devices and starting early services. If you hit +such a case, early kdump may allow you to get more information of it. + +Early kdump is implemented as a dracut module. It adds a kernel (vmlinuz) and +initramfs for kdump to your system's initramfs in order to load them as early +as possible. After that, if you provide "rd.earlykdump" in kernel command line, +then in the initramfs, early kdump will load those files like the normal kdump +service. This is disabled by default. For the normal kdump service, it can check whether the early kdump has loaded the crash kernel and initramfs. It has no conflict with the early kdump. @@ -20,7 +25,9 @@ We assume if you're reading this document, you should already have kexec-tools installed. You can rebuild the initramfs with earlykdump support with below steps: + 1. start kdump service to make sure kdump initramfs is created. + # systemctl start kdump NOTE: If a crash occurs during boot process, early kdump captures a vmcore @@ -34,6 +41,7 @@ You can rebuild the initramfs with earlykdump support with below steps: For the failure_action, you can choose anything other than "reboot". 2. rebuild system initramfs with earlykdump support. + # dracut --force --add earlykdump NOTE: Recommend to backup the original system initramfs before performing @@ -41,16 +49,6 @@ You can rebuild the initramfs with earlykdump support with below steps: 3. add rd.earlykdump in grub kernel command line. -Note: -[1]. Early kdump initramfs size will be large because it includes vmlinuz and -kdump initramfs. - -[2]. Early kdump inherits the settings of normal kdump, so any changes that -caused normal kdump rebuilding also require rebuilding the system initramfs -to make sure that the changes take effect for early kdump. Therefore, after -the rebuilding of kdump initramfs is completed, provide a prompt message to -tell the fact. - After making said changes, reboot your system to take effect. Of course, if you want to disable early kdump, you can simply remove "rd.earlykdump" from kernel boot parameters in grub, and reboot system like above. @@ -58,19 +56,40 @@ boot parameters in grub, and reboot system like above. Once the boot is completed, you can check the status of the early kdump support on the command prompt: - # journalctl -x|grep early-kdump + # journalctl -b | grep early-kdump Then, you will see some useful logs, for example: -1. if early kdump is successful. -Mar 09 09:57:56 localhost.localdomain dracut-cmdline[190]: early-kdump is enabled. -Mar 09 09:57:56 localhost.localdomain dracut-cmdline[190]: kexec: loaded early- -kdump kernel +- if early kdump is successful. + +Mar 09 09:57:56 localhost dracut-cmdline[190]: early-kdump is enabled. +Mar 09 09:57:56 localhost dracut-cmdline[190]: kexec: loaded early-kdump kernel -2. if early kdump is disabled. -Mar 09 10:02:47 localhost.localdomain dracut-cmdline[189]: early-kdump is disabled. +- if early kdump is disabled. + +Mar 09 10:02:47 localhost dracut-cmdline[189]: early-kdump is disabled. + +Notes +----- + +- The size of early kdump initramfs will be large because it includes vmlinuz + and kdump initramfs. + +- Early kdump inherits the settings of normal kdump, so any changes that + caused normal kdump rebuilding also require rebuilding the system initramfs + to make sure that the changes take effect for early kdump. Therefore, after + the rebuilding of kdump initramfs is completed, provide a prompt message to + tell the fact. + +- If you install an updated kernel and reboot the system with it, the early + kdump will be disabled by default. To enable it with the new kernel, you + need to take the above steps again. Limitation ---------- -At present, early kdump doesn't support fadump. +- At present, early kdump doesn't support fadump. + +- Early kdump loads a crash kernel and initramfs at the beginning of the + process in system's initramfs, so a crash at earlier than that (e.g. in + kernel initialization) cannot be captured even with the early kdump. -- 2.18.1

1 0

Re: [PATCH v2] Add --force option to step 2 in early-kdump-howto.txt
by Kairui Song 13 Feb '20

13 Feb '20

On Thu, Feb 6, 2020 at 10:52 AM s.morishima(a)fujitsu.com <s.morishima(a)fujitsu.com> wrote: > > For step2 in early-kdump-howto.txt, --force option of dracut > is necessary to rebuild system initramfs. Without --force option, > executing step2 fails because system initramfs already exists. > > Signed-off-by: Shigeki Morishima <s.morishima(a)jp.fujitsu.com> > --- > early-kdump-howto.txt | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/early-kdump-howto.txt b/early-kdump-howto.txt > index b8cab6a..f4fae36 100644 > --- a/early-kdump-howto.txt > +++ b/early-kdump-howto.txt > @@ -34,14 +34,16 @@ You can rebuild the initramfs with earlykdump support with below steps: > For the failure_action, you can choose anything other than "reboot". > > 2. rebuild system initramfs with earlykdump support. > - # dracut --add earlykdump > + # dracut --force --add earlykdump > + > + NOTE: Recommend to backup the original system initramfs before performing > + this step to put it back if something happens during boot-up. > > 3. add rd.earlykdump in grub kernel command line. > > Note: > [1]. Early kdump initramfs size will be large because it includes vmlinuz and > -kdump initramfs. And for step 2 if you are sure to overwrite system initramfs > -you can backup the original initramfs and use "--force" option. > +kdump initramfs. > > [2]. Early kdump inherits the settings of normal kdump, so any changes that > caused normal kdump rebuilding also require rebuilding the system initramfs > -- > 1.8.3.1 > _______________________________________________ > kexec mailing list -- kexec(a)lists.fedoraproject.org > To unsubscribe send an email to kexec-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/kexec@lists.fedoraproject.org Thanks for the patch, looks good to me. Acked-by: Kairui Song <kasong(a)redhat.com> -- Best Regards, Kairui Song

1 0

Re: [PATCH] Fix typo in early-kdump-howto.txt
by Kairui Song 11 Feb '20

11 Feb '20

On Wed, Jan 29, 2020 at 9:21 AM s.morishima(a)fujitsu.com <s.morishima(a)fujitsu.com> wrote: > > Hello, > > I found typo in early-kdump-howto.txt, and fixed it. > > Signed-off-by: Shigeki Morishima <s.morishima(a)jp.fujitsu.com> > --- > early-kdump-howto.txt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/early-kdump-howto.txt b/early-kdump-howto.txt > index b8cab6a..89df4ef 100644 > --- a/early-kdump-howto.txt > +++ b/early-kdump-howto.txt > @@ -58,7 +58,7 @@ on the command prompt: > > # journalctl -x|grep early-kdump > > -Then, you will see some useful logs, for exapmle: > +Then, you will see some useful logs, for example: > > 1. if early kdump is successful. > Mar 09 09:57:56 localhost.localdomain dracut-cmdline[190]: early-kdump is enabled. > -- > > Best Regards, > Shigeki Morishima > > ---------------------------------------------------------------------- > 森島　茂貴(Morishima Shigeki) > 富士通ミッションクリティカルソフトウェア株式会社(MCS) > MC サービスソリューション統括部）ネットワークチーム > E-mail: s.morishima(a)fujitsu.com > Tel: 055-924-7280 (内線: 7260540352) > ---------------------------------------------------------------------- > _______________________________________________ > kexec mailing list -- kexec(a)lists.fedoraproject.org > To unsubscribe send an email to kexec-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/kexec@lists.fedoraproject.org Hi, thanks for the patch, it looks good. Acked-by: Kairui Song <kasong(a)redhat.com> -- Best Regards, Kairui Song

1 0

[PATCH v6] kdump-lib: switch to the kexec_file_load() syscall on x86_64 by default
by Lianbo Jiang 07 Feb '20

07 Feb '20

UEFI Secure boot is a signature verification mechanism, designed to prevent malicious code being loaded and executed at the early boot stage. This makes sure that code executed is trusted by firmware. Previously, with kexec_file_load() interface, kernel prevents unsigned kernel image from being loaded if secure boot is enabled. So kdump will detect whether secure boot is enabled firstly, then decide which interface is chosen to execute, kexec_load() or kexec_file_load(). Otherwise unsigned kernel loading will fail if secure boot enabled, and kexec_file_load() is entered. Now, the implementation of kexec_file_load() is adjusted in below commit. With this change, if CONFIG_KEXEC_SIG_FORCE is not set, unsigned kernel still has a chance to be allowed to load under some conditions. commit 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") And in the current Fedora, the CONFIG_KEXEC_SIG_FORCE is not set, only the CONFIG_KEXEC_SIG and CONFIG_BZIMAGE_VERIFY_SIG are set on x86_64 by default. It's time to spread kexec_file_load() onto all systems of x86_64, including Secure-boot platforms and legacy platforms. Please refer to the following form. .----------------------------------------------------------------------. | . | signed kernel | unsigned kernel | | . types |-----------------------|-----------------------| | . |Secure boot| Legacy |Secure boot| Legacy | | . |-----------|-----------|-----------|-----------| | options . | prev| now | prev| now | | | prev| now | | . |(file|(file|(only|(file| prev| now |(only|(file| | . |load)|load)|load)|load)| | |load)|load)| |----------------------|-----|-----|-----|-----|-----|-----|-----|-----| |KEXEC_SIG=y | | | | | | | | | |SIG_FORCE is not set |succ |succ |succ |succ | X | X |succ |succ | |BZIMAGE_VERIFY_SIG=y | | | | | | | | | |----------------------|-----|-----|-----|-----|-----|-----|-----|-----| |KEXEC_SIG=y | | | | | | | | | |SIG_FORCE is not set | | | | | | | | | |BZIMAGE_VERIFY_SIG is |fail |fail |succ |fail | X | X |succ |fail | |not set | | | | | | | | | |----------------------|-----|-----|-----|-----|-----|-----|-----|-----| |KEXEC_SIG=y | | | | | | | | | |SIG_FORCE=y |succ |succ |succ |fail | X | X |succ |fail | |BZIMAGE_VERIFY_SIG=y | | | | | | | | | |----------------------|-----|-----|-----|-----|-----|-----|-----|-----| |KEXEC_SIG=y | | | | | | | | | |SIG_FORCE=y | | | | | | | | | |BZIMAGE_VERIFY_SIG is |fail |fail |succ |fail | X | X |succ |fail | |not set | | | | | | | | | |----------------------|-----|-----|-----|-----|-----|-----|-----|-----| |KEXEC_SIG is not set | | | | | | | | | |SIG_FORCE is not set | | | | | | | | | |BZIMAGE_VERIFY_SIG is |fail |fail |succ |succ | X | X |succ |succ | |not set | | | | | | | | | ---------------------------------------------------------------------- Note: [1] The 'X' indicates that the 1st kernel(unsigned) can not boot when the Secure boot is enabled. Hence, in this patch, if on x86_64, let's use the kexec_file_load() only. See if anything wrong happened in this case, in Fedora firstly for the time being. Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com> --- Changes since v1: [1] Improve patch log. [2] Change the is_secure_boot_enforced() to use_kexec_file_load(). [3] Aamend the code comment. [4] Add the form for the kbuild options. Changes since v2: [1] Improve patch log. [2] Also rewrite the form for the kbuild options. Changes since v3: [1] Improve patch log. [2] Display an error message and ask user to try kexec_load() once the kexec_file_load() failed. Changes since v4: [1] Improve patch log. [2] Remove the unused is_secure_boot_enforced() from kdump-lib.sh. [3] Add a new option 'KDUMP_FILE_LOAD', which provides a chance for user to choose the kexec load or kexec file load. And use the kexec file load by default. Changes since v5: [1] Improve the code comment for the kdump.sysconfig.x86_64, also say that the "on" is the only valid value to enable the kexec file load, anything else is equal to the "off". dracut-early-kdump.sh | 5 +++-- kdump-lib.sh | 29 ----------------------------- kdump.sysconfig.x86_64 | 6 ++++++ kdumpctl | 13 +++++++------ 4 files changed, 16 insertions(+), 37 deletions(-) diff --git a/dracut-early-kdump.sh b/dracut-early-kdump.sh index 69a34eb996cd..6788a6b83431 100755 --- a/dracut-early-kdump.sh +++ b/dracut-early-kdump.sh @@ -2,6 +2,7 @@ KEXEC=/sbin/kexec standard_kexec_args="-p" +KDUMP_FILE_LOAD="" EARLY_KDUMP_INITRD="" EARLY_KDUMP_KERNEL="" @@ -43,8 +44,8 @@ early_kdump_load() EARLY_KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}") - if is_secure_boot_enforced; then - echo "Secure Boot is enabled. Using kexec file based syscall." + if [ "$KDUMP_FILE_LOAD" == "on" ]; then + echo "Using kexec file based syscall." EARLY_KEXEC_ARGS="$EARLY_KEXEC_ARGS -s" fi diff --git a/kdump-lib.sh b/kdump-lib.sh index f393c76b9cbb..a79c1a70cc07 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -589,35 +589,6 @@ need_64bit_headers() print (strtonum("0x" r[2]) > strtonum("0xffffffff")); }'` } -# Check if secure boot is being enforced. -# -# Per Peter Jones, we need check efivar SecureBoot-$(the UUID) and -# SetupMode-$(the UUID), they are both 5 bytes binary data. The first four -# bytes are the attributes associated with the variable and can safely be -# ignored, the last bytes are one-byte true-or-false variables. If SecureBoot -# is 1 and SetupMode is 0, then secure boot is being enforced. -# -# Assume efivars is mounted at /sys/firmware/efi/efivars. -is_secure_boot_enforced() -{ - local secure_boot_file setup_mode_file - local secure_boot_byte setup_mode_byte - - secure_boot_file=$(find /sys/firmware/efi/efivars -name SecureBoot-* 2>/dev/null) - setup_mode_file=$(find /sys/firmware/efi/efivars -name SetupMode-* 2>/dev/null) - - if [ -f "$secure_boot_file" ] && [ -f "$setup_mode_file" ]; then - secure_boot_byte=$(hexdump -v -e '/1 "%d\ "' $secure_boot_file|cut -d' ' -f 5) - setup_mode_byte=$(hexdump -v -e '/1 "%d\ "' $setup_mode_file|cut -d' ' -f 5) - - if [ "$secure_boot_byte" = "1" ] && [ "$setup_mode_byte" = "0" ]; then - return 0 - fi - fi - - return 1 -} - # # prepare_kexec_args <kexec args> # This function prepares kexec argument. diff --git a/kdump.sysconfig.x86_64 b/kdump.sysconfig.x86_64 index 09de2ebe798e..7894ccc840b2 100644 --- a/kdump.sysconfig.x86_64 +++ b/kdump.sysconfig.x86_64 @@ -38,3 +38,9 @@ KDUMP_IMG="vmlinuz" #What is the images extension. Relocatable kernels don't have one KDUMP_IMG_EXT="" + +# Using kexec file based syscall by default +# +# Here, the "on" is the only valid value to enable the kexec file load and +# anything else is equal to the "off"(disable). +KDUMP_FILE_LOAD="on" diff --git a/kdumpctl b/kdumpctl index 2d21a416deb1..97fe54110447 100755 --- a/kdumpctl +++ b/kdumpctl @@ -4,6 +4,7 @@ KEXEC=/sbin/kexec KDUMP_KERNELVER="" KDUMP_COMMANDLINE="" KEXEC_ARGS="" +KDUMP_FILE_LOAD="" KDUMP_CONFIG_FILE="/etc/kdump.conf" MKDUMPRD="/sbin/mkdumprd -f" DRACUT_MODULES_FILE="/usr/lib/dracut/modules.txt" @@ -678,11 +679,8 @@ load_kdump() KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}") KDUMP_COMMANDLINE=$(prepare_cmdline "${KDUMP_COMMANDLINE}" "${KDUMP_COMMANDLINE_REMOVE}" "${KDUMP_COMMANDLINE_APPEND}") - # For secureboot enabled machines, use new kexec file based syscall. - # Old syscall will always fail as it does not have capability to - # to kernel signature verification. - if is_secure_boot_enforced; then - echo "Secure Boot is enabled. Using kexec file based syscall." + if [ "$KDUMP_FILE_LOAD" == "on" ]; then + echo "Using kexec file based syscall." KEXEC_ARGS="$KEXEC_ARGS -s" fi @@ -694,6 +692,9 @@ load_kdump() return 0 else echo "kexec: failed to load kdump kernel" >&2 + if [ "$KDUMP_FILE_LOAD" == "on" ]; then + echo "kexec_file_load() failed, please try kexec_load()" >&2 + fi return 1 fi } @@ -1162,7 +1163,7 @@ stop_fadump() stop_kdump() { - if is_secure_boot_enforced; then + if [ "$KDUMP_FILE_LOAD" == "on" ]; then $KEXEC -s -p -u else $KEXEC -p -u -- 2.17.1

3 4

RE: [PATCH v2] Add --force option to step 2 in early-kdump-howto.txt
by HAGIO KAZUHITO(萩尾　一仁) 06 Feb '20

06 Feb '20

-----Original Message----- > For step2 in early-kdump-howto.txt, --force option of dracut > is necessary to rebuild system initramfs. Without --force option, > executing step2 fails because system initramfs already exists. > > Signed-off-by: Shigeki Morishima <s.morishima(a)jp.fujitsu.com> > --- > early-kdump-howto.txt | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/early-kdump-howto.txt b/early-kdump-howto.txt > index b8cab6a..f4fae36 100644 > --- a/early-kdump-howto.txt > +++ b/early-kdump-howto.txt > @@ -34,14 +34,16 @@ You can rebuild the initramfs with earlykdump support with below steps: > For the failure_action, you can choose anything other than "reboot". > > 2. rebuild system initramfs with earlykdump support. > - # dracut --add earlykdump > + # dracut --force --add earlykdump > + > + NOTE: Recommend to backup the original system initramfs before performing > + this step to put it back if something happens during boot-up. > > 3. add rd.earlykdump in grub kernel command line. > > Note: > [1]. Early kdump initramfs size will be large because it includes vmlinuz and > -kdump initramfs. And for step 2 if you are sure to overwrite system initramfs > -you can backup the original initramfs and use "--force" option. > +kdump initramfs. > > [2]. Early kdump inherits the settings of normal kdump, so any changes that > caused normal kdump rebuilding also require rebuilding the system initramfs > -- > 1.8.3.1 Thanks for the update. Looks good to me. Kazu

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

kexec February 2020