Subject: Re: sparse, kernel-only crashdumps
To: None <tls@rek.tjls.com>
From: Jason Thorpe <thorpej@shagadelic.org>
List: tech-kern
Date: 10/07/2004 11:26:23
--Apple-Mail-36-754783068
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; format=flowed


On Oct 7, 2004, at 10:09 AM, Thor Lancelot Simon wrote:

> Wouldn't an MD hook called after all the managed pages are dumped
> account for this?  I suppose this might require writing a directory
> of which pages are dumped where in the dump partition out last of all,
> but that seems likely to be required anyway.

"Maybe."  It needs to be part-MD, part-MI.  That is, MD code needs to 
be able to call MI code to do this (see "pool allocator").

Note you also need to dump the kernel image itself, since it contains 
stuff in the .data and .bss segments relevant to a crash dump.

> The kcore format is currently broken on 32-bit ports anyhow so I do not
> think we should be averse to tinkering with it to make David's task
> easier while still meeting your desired constraint.

Actually, the kcore format is just plain broken.  It bothers me that we 
require arch-specific code in a library to even be able to read it 
(libkvm).  Cross-debugging of kernel crash dumps is a very worthy goal 
to strive for.

To that end, I think we could actually leverage ELF for this.  ELF 
P-section headers have "vaddr" and "paddr" fields.  We could use this 
to completely describe all of the kernaddr->physical mappings, dumping 
one P-section for each extent of memory that is both physically and 
virtually contiguous.

This could be done totally from within MD code; in the case of i386, 
just traverse the page tables.  In the case of Alpha, dump the kernel 
image, call the pool hook (plus whatever other memory allocation stuff 
the pmap uses, etc.), and then dump the page tables.

Obviously, you would have to make 2 passes over everything: once to 
write the P-section headers, once to write the actual P-sections.  But 
crash dumps don't have to be high performance :-)

Just a quick note -- on platforms that use 32-bit vaddr_t but 64-bit 
paddr_t (some MIPS platforms, for example), we'd probably have to use 
ELF64 for those crash dumps.

         -- Jason R. Thorpe <thorpej@shagadelic.org>


--Apple-Mail-36-754783068
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQFBZYpPOpVKkaBm8XkRAm52AJ9ULlYKbV7O0IJKCVXEtvPaHWrqdQCgguxG
lFlwhhfCkS5dhonvD++LYBs=
=RiWz
-----END PGP SIGNATURE-----

--Apple-Mail-36-754783068--