[Bug 947816] New: Failed to load kdump on openSUSE Leap
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 Bug ID: 947816 Summary: Failed to load kdump on openSUSE Leap Classification: openSUSE Product: openSUSE Distribution Version: 42.1 Beta 1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers@forge.provo.novell.com Reporter: tiwai@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Loading kdump on openSUSE Leap beta1 failed. journal shows: kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 Takashi Iwai <tiwai@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jlee@suse.com, | |ptesarik@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c1 --- Comment #1 from Takashi Iwai <tiwai@suse.com> --- Installing FACTORY kernel-exec and kdump seems to make things working. So we need some updates in the user-space stack. I added openSUSE_Leap_42.1 repo to Kernel:kdump project now... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c2 Takashi Iwai <tiwai@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(ptesarik@suse.com | |) --- Comment #2 from Takashi Iwai <tiwai@suse.com> --- It seems that kdump package on Leap that is derived from SLE12-SP1 doesn't work. Petr, would you work on this? Or should we just copy FACTORY packages to Leap? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 Joey Lee <jlee@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kernel-maintainers@forge.pr |jlee@suse.com |ovo.novell.com | -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c3 --- Comment #3 from Joey Lee <jlee@suse.com> --- (In reply to Takashi Iwai from comment #0)
Loading kdump on openSUSE Leap beta1 failed.
journal shows:
kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service
openSUSE doesn't support kernel module verification, so kernel didn't embedded key. I think that's why the crash kernel binary doesn't pass the verification. I will set CONFIG_KEXEC_VERIFY_SIG=n then check the status of loading crash kernel by kexec. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c4 --- Comment #4 from Takashi Iwai <tiwai@suse.com> --- (In reply to Joey Lee from comment #3)
(In reply to Takashi Iwai from comment #0)
Loading kdump on openSUSE Leap beta1 failed.
journal shows:
kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service
openSUSE doesn't support kernel module verification, so kernel didn't embedded key. I think that's why the crash kernel binary doesn't pass the verification.
Thanks, this is what I expected from the journal message.
I will set CONFIG_KEXEC_VERIFY_SIG=n then check the status of loading crash kernel by kexec.
OK, that should work. But this made me wonder whether SLE12 kdump package would ever work with other kernels than SLE's standard one? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c5 --- Comment #5 from Joey Lee <jlee@suse.com> --- (In reply to Takashi Iwai from comment #4)
(In reply to Joey Lee from comment #3)
(In reply to Takashi Iwai from comment #0)
Loading kdump on openSUSE Leap beta1 failed.
journal shows:
kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service
openSUSE doesn't support kernel module verification, so kernel didn't embedded key. I think that's why the crash kernel binary doesn't pass the verification.
Thanks, this is what I expected from the journal message.
I just changed the CONFIG_KEXEC_VERIFY_SIG in config files of x86_64. Waiting merge to openSUSE-42.1 kernel.
I will set CONFIG_KEXEC_VERIFY_SIG=n then check the status of loading crash kernel by kexec.
OK, that should work. But this made me wonder whether SLE12 kdump package would ever work with other kernels than SLE's standard one?
hm... Currently the logic in kdump package is checking x86_64 architecture then direct call kexec_file_load() syscall.
From the viewpoint of security, kernel should blocks non-secure interfaces or enable the verification mechanism. I think kdump package should try 2 interfaces, kexec_load and kexec_file_load, even kernel may blocked them because security.
I will send patch to modify kdump logic. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c6 Takashi Iwai <tiwai@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ptesarik@suse.com | |) | --- Comment #6 from Takashi Iwai <tiwai@suse.com> --- (In reply to Joey Lee from comment #5)
(In reply to Takashi Iwai from comment #4)
(In reply to Joey Lee from comment #3)
(In reply to Takashi Iwai from comment #0)
Loading kdump on openSUSE Leap beta1 failed.
journal shows:
kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service
openSUSE doesn't support kernel module verification, so kernel didn't embedded key. I think that's why the crash kernel binary doesn't pass the verification.
Thanks, this is what I expected from the journal message.
I just changed the CONFIG_KEXEC_VERIFY_SIG in config files of x86_64. Waiting merge to openSUSE-42.1 kernel.
Now pulled, thanks. I guess we need to fix the same for stable and master, too?
I will set CONFIG_KEXEC_VERIFY_SIG=n then check the status of loading crash kernel by kexec.
OK, that should work. But this made me wonder whether SLE12 kdump package would ever work with other kernels than SLE's standard one?
hm... Currently the logic in kdump package is checking x86_64 architecture then direct call kexec_file_load() syscall.
From the viewpoint of security, kernel should blocks non-secure interfaces or enable the verification mechanism. I think kdump package should try 2 interfaces, kexec_load and kexec_file_load, even kernel may blocked them because security.
I will send patch to modify kdump logic.
It sounds good. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c7 --- Comment #7 from Joey Lee <jlee@suse.com> --- (In reply to Takashi Iwai from comment #6)
(In reply to Joey Lee from comment #5)
(In reply to Takashi Iwai from comment #4)
(In reply to Joey Lee from comment #3)
(In reply to Takashi Iwai from comment #0)
Loading kdump on openSUSE Leap beta1 failed.
journal shows:
kdump[7917]: Loaded kdump kernel: /sbin/kexec -p /boot/vmlinuz-4.1.6-10-desktop --append="quiet elevator=deadline sysrq=yes reset_devices acpi_no_memhotplug cgroup_disable=memory irqpoll nr_cpus=1 root=kdump disable_cpu_apicid=0 panic=1" --initrd=/boot/initrd-4.1.6-10-desktop-kdump -s, Result: kexec_file_load failed: Key was rejected by service load.sh[7861]: kexec_file_load failed: Key was rejected by service
openSUSE doesn't support kernel module verification, so kernel didn't embedded key. I think that's why the crash kernel binary doesn't pass the verification.
Thanks, this is what I expected from the journal message.
I just changed the CONFIG_KEXEC_VERIFY_SIG in config files of x86_64. Waiting merge to openSUSE-42.1 kernel.
Now pulled, thanks. I guess we need to fix the same for stable and master, too?
Thanks for your reminding, I just push changes to stable and master in my home branch.
I will set CONFIG_KEXEC_VERIFY_SIG=n then check the status of loading crash kernel by kexec.
OK, that should work. But this made me wonder whether SLE12 kdump package would ever work with other kernels than SLE's standard one?
hm... Currently the logic in kdump package is checking x86_64 architecture then direct call kexec_file_load() syscall.
From the viewpoint of security, kernel should blocks non-secure interfaces or enable the verification mechanism. I think kdump package should try 2 interfaces, kexec_load and kexec_file_load, even kernel may blocked them because security.
I will send patch to modify kdump logic.
It sounds good.
-- You are receiving this mail because: You are on the CC list for the bug.
From going through the history, it sounds like all activities are done here and
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c8 Dominique Leuenberger <dimstar@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar@opensuse.org --- Comment #8 from Dominique Leuenberger <dimstar@opensuse.org> --- that bug would be closeable? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c9 --- Comment #9 from Takashi Iwai <tiwai@suse.com> --- There are some other odd things that prevent kdump working. Someone needs to retest with the current state... This is one thing we might be able to cover via openQA, I think. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c10 --- Comment #10 from Petr Tesařík <ptesarik@suse.com> --- For one thing, many things have been fixed in kdump for SLE12 SP1. These should go into Leap; IMO there's little sense in re-discovering them on Leap right now. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c11 --- Comment #11 from Dominique Leuenberger <dimstar@opensuse.org> --- (In reply to Petr Tesařík from comment #10)
For one thing, many things have been fixed in kdump for SLE12 SP1. These should go into Leap; IMO there's little sense in re-discovering them on Leap right now.
osc rdiff openSUSE:Leap:42.1 kdump SUSE:SLE-12-SP1:GA => no diff latest entry in kdump.changes is from: ------------------------------------------------------------------- Mon Oct 12 09:08:57 UTC 2015 - ptesarik@suse.cz -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c12 --- Comment #12 from Joey Lee <jlee@suse.com> --- I didn't finish the work to modify kdump package to try 2 interfaces, kexec_load and kexec_file_load yet. But I think that should not block kexec_file_load interface used by kdump package because the CONFIG_KEXEC_VERIFY_SIG was turned off. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c14 --- Comment #14 from Joey Lee <jlee@suse.com> --- (In reply to Takashi Iwai from comment #13)
I confirmed that kdump worked on Leap RC1. So let's close this bug for now.
Joey, if you want to continue working on kexec_load stuff, please clone the bug for FACTORY.
I created a new bug boo#951144 reflect to kdump tool's change. Thanks -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 Ludwig Nussel <lnussel@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|Leap 42.1 Beta 1 |Leap 42.1 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c16 Mike Galbraith <mgalbraith@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- --- Comment #16 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Mike Galbraith from comment #15)
(In reply to Takashi Iwai from comment #13)
I confirmed that kdump worked on Leap RC1. So let's close this bug for now.
It must have been reborn, because when running an SLES kernel, kdump says key rejected by service in up to the minute leap here. Thanks to finding this bug, installing kdump from factory fixed me up.
And it is still broken: homer:/root # rpm -q kdump kdump-0.8.15-24.1.x86_64 homer:/root # systemctl status kdump kdump.service - Load kdump kernel on startup Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled) Active: active (exited) since Wed 2016-09-28 07:41:32 CEST; 9min ago Process: 4061 ExecStop=/lib/kdump/unload.sh (code=exited, status=0/SUCCESS) Process: 4066 ExecStart=/lib/kdump/load.sh (code=exited, status=0/SUCCESS) Main PID: 4066 (code=exited, status=0/SUCCESS) Sep 28 07:41:32 homer load.sh[4066]: kexec_file_load failed: Key was rejected by service Sep 28 07:41:32 homer systemd[1]: Started Load kdump kernel on startup. (/me builds factory kdump for leap-42.1) homer:/root # rpm -q kdump kdump-0.8.15-99.x86_64 homer:/root # systemctl status kdump kdump.service - Load kdump kernel on startup Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled) Active: active (exited) since Wed 2016-09-28 07:53:18 CEST; 53s ago Process: 12280 ExecStop=/etc/init.d/boot.kdump stop (code=exited, status=0/SUCCESS) Process: 12288 ExecStart=/etc/init.d/boot.kdump start (code=exited, status=0/SUCCESS) Main PID: 12288 (code=exited, status=0/SUCCESS) CGroup: /system.slice/kdump.service Sep 28 07:52:16 homer boot.kdump[12288]: Loading kdump Sep 28 07:53:18 homer boot.kdump[12288]: ..done Sep 28 07:53:18 homer systemd[1]: Started Load kdump kernel on startup. homer:/root # -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c17 --- Comment #17 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Mike Galbraith from comment #16)
(In reply to Mike Galbraith from comment #15)
(In reply to Takashi Iwai from comment #13)
I confirmed that kdump worked on Leap RC1. So let's close this bug for now.
It must have been reborn, because when running an SLES kernel, kdump says key rejected by service in up to the minute leap here. Thanks to finding this bug, installing kdump from factory fixed me up.
And it is still broken:
homer:/root # rpm -q kdump kdump-0.8.15-24.1.x86_64 homer:/root # systemctl status kdump kdump.service - Load kdump kernel on startup Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled) Active: active (exited) since Wed 2016-09-28 07:41:32 CEST; 9min ago Process: 4061 ExecStop=/lib/kdump/unload.sh (code=exited, status=0/SUCCESS) Process: 4066 ExecStart=/lib/kdump/load.sh (code=exited, status=0/SUCCESS) Main PID: 4066 (code=exited, status=0/SUCCESS)
Sep 28 07:41:32 homer load.sh[4066]: kexec_file_load failed: Key was rejected by service Sep 28 07:41:32 homer systemd[1]: Started Load kdump kernel on startup.
(/me builds factory kdump for leap-42.1)
homer:/root # rpm -q kdump kdump-0.8.15-99.x86_64 homer:/root # systemctl status kdump kdump.service - Load kdump kernel on startup Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled) Active: active (exited) since Wed 2016-09-28 07:53:18 CEST; 53s ago Process: 12280 ExecStop=/etc/init.d/boot.kdump stop (code=exited, status=0/SUCCESS) Process: 12288 ExecStart=/etc/init.d/boot.kdump start (code=exited, status=0/SUCCESS) Main PID: 12288 (code=exited, status=0/SUCCESS) CGroup: /system.slice/kdump.service
Sep 28 07:52:16 homer boot.kdump[12288]: Loading kdump Sep 28 07:53:18 homer boot.kdump[12288]: ..done Sep 28 07:53:18 homer systemd[1]: Started Load kdump kernel on startup. homer:/root #
And with this kdump version, kdump/crash works fine through 4.6 kernels, SLE, SLERT or homebrew. After that, makedumpfile ceases to function, and taking makedumpfile from factory helps not at all.. but at least things work properly until 4.7. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c18 Takashi Iwai <tiwai@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(jlee@suse.com) --- Comment #18 from Takashi Iwai <tiwai@suse.com> --- (In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump? The kdump included in Leap contains the patches verifying signature. Are you testing with your own build kernel or the official SLE kernel with the SUSE key signed? If you're using the self-made kernel, turning off CONFIG_KEXEC_VERIFY_SIG should make things working. Or use TW version kdump that has no signature check. The kdump really should be more robust in this regard. Joey, how is the status of bug 951144, to allow the old method as fallback? I guess this issue bytes many developers. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c19 --- Comment #19 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Takashi Iwai from comment #18)
(In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump?
If you mean 'factory', yes.
The kdump included in Leap contains the patches verifying signature. Are you testing with your own build kernel or the official SLE kernel with the SUSE key signed?
All kernels run here are locally built.
If you're using the self-made kernel, turning off CONFIG_KEXEC_VERIFY_SIG should make things working. Or use TW version kdump that has no signature check.
My local mainline/stable configs do not contain CONFIG_KEXEC_VERIFY_SIG, only SLE12/SLE12-RT kernels do. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c20 --- Comment #20 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Mike Galbraith from comment #19)
(In reply to Takashi Iwai from comment #18)
(In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump?
If you mean 'factory', yes.
The kdump included in Leap contains the patches verifying signature. Are you testing with your own build kernel or the official SLE kernel with the SUSE key signed?
All kernels run here are locally built.
If you're using the self-made kernel, turning off CONFIG_KEXEC_VERIFY_SIG should make things working. Or use TW version kdump that has no signature check.
My local mainline/stable configs do not contain CONFIG_KEXEC_VERIFY_SIG, only SLE12/SLE12-RT kernels do.
Perhaps relevant... /etc/sysconfig/kdump: KDUMP_KERNELVER="4.4.20-smp" That's a local config kernel. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c21 --- Comment #21 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Takashi Iwai from comment #18)
(In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump?
homer:/root # rpm -q kdump kdump-0.8.15-99.x86_64
BTW, it says .99 because when I build packages with osc, I use --release=99, and squirrel the resulting rpms away for possible reuse. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c22 --- Comment #22 from Takashi Iwai <tiwai@suse.com> --- (In reply to Mike Galbraith from comment #19)
(In reply to Takashi Iwai from comment #18)
(In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump?
If you mean 'factory', yes.
It's strange because the FACTORY / TW version doesn't invokes /lib/kdump/load.sh, but it invokes /etc/init.d/boot.kdump start, instead. I doubt you're using Leap or SLE version of kdump. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c23 --- Comment #23 from Mike Galbraith <mgalbraith@suse.com> --- (In reply to Takashi Iwai from comment #22)
(In reply to Mike Galbraith from comment #19)
(In reply to Takashi Iwai from comment #18)
(In reply to Mike Galbraith from comment #16)
(/me builds factory kdump for leap-42.1)
Are you sure that the result is from your TW version kdump?
If you mean 'factory', yes.
It's strange because the FACTORY / TW version doesn't invokes /lib/kdump/load.sh, but it invokes /etc/init.d/boot.kdump start, instead. I doubt you're using Leap or SLE version of kdump.
If copy/paste in comment 16 isn't good enough, how can I convince you? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c24 --- Comment #24 from Takashi Iwai <tiwai@suse.com> --- OK, after checking the comment 16, I see the point. Your TW version does work while Leap version doesn't? I was confused by mixed comments, sorry ;) Basically the situation of kdump itself is same as of the original bug report. We "fixed" it by disabling CONFIG_KEXEC_VERIFY_SIG for openSUSE kernels. So the question is whether you still get this particular error even with the local kernels without CONFIG_KEXEC_VERIFY_SIG. Please clarify it: whether the same error "kexec_file_load failed: Key was rejected by service" appears even for kernels without that kconfig. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c25 --- Comment #25 from Mike Galbraith <mgalbraith@suse.com> ---
So the question is whether you still get this particular error even with the local kernels without CONFIG_KEXEC_VERIFY_SIG. Please clarify it: whether the same error "kexec_file_load failed: Key was rejected by service" appears even for kernels without that kconfig.
Yeah, it's SLE/SLERT kernels, and my mainline/stable/tip -rt trees, which I also configure with an enterprise derived config. With maintenance lag time being what it is, if I want tools that can handle all of the kernels I work on, I'm gonna have to fix them up myself anyway, so it's not a big hairy deal, it just seems to that you should be able to use a stock suse workstation to work on any suse kernel, which you can't. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c26 --- Comment #26 from Takashi Iwai <tiwai@suse.com> --- OK, thanks for confirmation. Yes, it sucks, I fully agree. The workaround shouldn't be too hard, but it seems that upstream didn't like the ideal to fall back. Nevertheless, we may fix it inside kdump load.sh instead of kexec, too. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c27 --- Comment #27 from Joey Lee <jlee@suse.com> --- (In reply to Takashi Iwai from comment #26)
OK, thanks for confirmation. Yes, it sucks, I fully agree.
The workaround shouldn't be too hard, but it seems that upstream didn't like the ideal to fall back. Nevertheless, we may fix it inside kdump load.sh instead of kexec, too.
Yes, the kexec upstream doesn't not take my patch on boo#951144 to fallback to old kexec system call. As you said, the kdump script needs to implement the fallback. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c28 Joey Lee <jlee@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jlee@suse.com) | --- Comment #28 from Joey Lee <jlee@suse.com> --- (In reply to Joey Lee from comment #27)
(In reply to Takashi Iwai from comment #26)
OK, thanks for confirmation. Yes, it sucks, I fully agree.
The workaround shouldn't be too hard, but it seems that upstream didn't like the ideal to fall back. Nevertheless, we may fix it inside kdump load.sh instead of kexec, too.
Yes, the kexec upstream doesn't not take my patch on boo#951144 to fallback to old kexec system call. As you said, the kdump script needs to implement the fallback.
I simply traced the kdump code, my plan is to add the logic to init/rc.kdump.functions. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c29 --- Comment #29 from Joey Lee <jlee@suse.com> --- (In reply to Joey Lee from comment #28)
(In reply to Joey Lee from comment #27)
(In reply to Takashi Iwai from comment #26)
OK, thanks for confirmation. Yes, it sucks, I fully agree.
The workaround shouldn't be too hard, but it seems that upstream didn't like the ideal to fall back. Nevertheless, we may fix it inside kdump load.sh instead of kexec, too.
Yes, the kexec upstream doesn't not take my patch on boo#951144 to fallback to old kexec system call. As you said, the kdump script needs to implement the fallback.
I simply traced the kdump code, my plan is to add the logic to init/rc.kdump.functions.
hm... the kdump in openSUSE:Factory looks different with the kdump in openSUSE:42.1/42.2. As Taskshi mention, the init/load.sh should takes the logic to call kexec-file. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c30 Joey Lee <jlee@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(mgalbraith@suse.c | |om) --- Comment #30 from Joey Lee <jlee@suse.com> --- (In reply to Mike Galbraith from comment #25)
So the question is whether you still get this particular error even with the local kernels without CONFIG_KEXEC_VERIFY_SIG. Please clarify it: whether the same error "kexec_file_load failed: Key was rejected by service" appears even for kernels without that kconfig.
Yeah, it's SLE/SLERT kernels, and my mainline/stable/tip -rt trees, which I also configure with an enterprise derived config.
With maintenance lag time being what it is, if I want tools that can handle all of the kernels I work on, I'm gonna have to fix them up myself anyway, so it's not a big hairy deal, it just seems to that you should be able to use a stock suse workstation to work on any suse kernel, which you can't.
hm... I tried to build and install a self-signed SLE12-SP2 kernel on openSUSE 42.1. I found the result of loading kernel through kexec-file result that it doesn't like SLE12-SP2. On SLE12-SP2, the self-signed kernel works fine to load through kexec-file. But on openSUSE 42.1, it already returns "Key was rejected by service" then I found this log in dmesg: [ 3.392659] PKCS7: Sig 1: X.509 chain contains auth-skid nonmatch (1->1) The same kernel, the same signing process but it got different result on openSUSE with SLE12 SP2. I guess that it is about the pesign, mozilla-nss or openssl. Hi Mike, Did you see the same PKCS7 error message? If yes, then I prefer create another bug to reflect this situation. Thanks -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c31 --- Comment #31 from Mike Galbraith <mgalbraith@suse.com> ---
hm... I tried to build and install a self-signed SLE12-SP2 kernel on openSUSE 42.1. I found the result of loading kernel through kexec-file result that it doesn't like SLE12-SP2.
On SLE12-SP2, the self-signed kernel works fine to load through kexec-file. But on openSUSE 42.1, it already returns "Key was rejected by service" then I found this log in dmesg:
[ 3.392659] PKCS7: Sig 1: X.509 chain contains auth-skid nonmatch (1->1)
The same kernel, the same signing process but it got different result on openSUSE with SLE12 SP2. I guess that it is about the pesign, mozilla-nss or openssl.
Hi Mike,
Did you see the same PKCS7 error message?
No, that's not in the journal. (I whack it regularly though...) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c32 --- Comment #32 from Mike Galbraith <mgalbraith@suse.com> ---
(/me builds factory kdump for leap-42.1)
homer:/root # rpm -q kdump kdump-0.8.15-99.x86_64 ... And with this kdump version, kdump/crash works fine through 4.6 kernels, SLE, SLERT or homebrew. After that, makedumpfile ceases to function, and taking makedumpfile from factory helps not at all.. but at least things work properly until 4.7.
For the record, the reason I continued to have trouble dumping kernels > 4.6 was that I forgot to whack the existing kdump initrd after installing makedumpfile, so it would be rebuilt (install order matters). I took kexec-tools and crash as well on general principal, and put the lot into a local directory repository, and am green across the board.. at least until the merge window opens in a couple days ;-) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=947816 http://bugzilla.opensuse.org/show_bug.cgi?id=947816#c44 Matwey Kornilov <matwey.kornilov@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matwey.kornilov@gmail.com --- Comment #44 from Matwey Kornilov <matwey.kornilov@gmail.com> --- Currently, I see the same issue with 4.12.14-lp151.28.36-default -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com