linux-kernel - Re: [patch 1/2] kdump: Initialize vmcoreinfo note at startup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1316161277.3507.8.camel@br98xy6r>
Date:	Fri, 16 Sep 2011 10:21:17 +0200
From:	Michael Holzheu <holzheu@...ux.vnet.ibm.com>
To:	Vivek Goyal <vgoyal@...hat.com>
Cc:	ebiederm@...ssion.com, mahesh@...ux.vnet.ibm.com,
	schwidefsky@...ibm.com, heiko.carstens@...ibm.com,
	kexec@...ts.infradead.org, linux-kernel@...r.kernel.org,
	linux-s390@...r.kernel.org
Subject: Re: [patch 1/2] kdump: Initialize vmcoreinfo note at startup

Hello Vivek,

On Thu, 2011-09-15 at 14:46 -0400, Vivek Goyal wrote:
> On Fri, Sep 09, 2011 at 12:27:00PM +0200, Michael Holzheu wrote:
> > From: Michael Holzheu <holzheu@...ux.vnet.ibm.com>
> > 
> > Currently the vmcoreinfo note is only initialized in case of kdump. On s390
> > it is possible to create kernel dumps with other dump mechanisms than kdump
> > (e.g. via hypervisor dump or stand-alone dump tools).
> 
> Both of these will be invoked through panic notifiers because kdump kernel
> is not loaded?

This is only one possibility. The other is that they are invoked
manually or by hypervisor watchdog without any Linux kernel involvement.

> 
> >For those dumps it
> > would also be desirable to include the vmcoreinfo data.
> 
> Curious that how these two dump schemes make use vmcoreinfo data?

We have a tool named zgetdump. With this tool it is possible to convert
dump formats on the fly using fuse. E.g. you can mount a s390
stand-alone dump as ELF dump. When this is done, the tool finds the
vmcoreinfo in the stand-alone dump via our well known ABI defined
address and it creates the respective VMCOREINFO ELF note in the output
ELF dump. This then can be used e.g. by makedumpfile for dump filtering.
No more need for a vmlinux file with debug information.

So this will look like the following:

# zgetdump --mount standalone.dump -f elf /mnt
# ls /mnt
# dump.elf
# readelf -n /mnt/dump.elf
# ...
  VMCOREINFO		0x00000474	Unknown note type: (0x00000000)
# makedumpfile -c -d 31 /mnt/dump.elf dump.kdump

> 
> > To accomplish this,
> > with this patch the vmcoreinfo ELF note is always initialized, not only in
> > case of a (kdump) crash. On s390 we will add an ABI defined pointer at
> > a well known address to vmcoreinfo so that dump analysis tools are able to
> > find this information.
> 
> Instead of this, why don't you initialize the notes in your arch specific
> call. IOW, why don't you give a call to crash_save_vmcoreinfo() in stand
> alone dump path to prepare the note and then continue with stand alone
> dump.

We can't do that because stand-alone and hypervisor dump can be
triggered completely without Linux. So no Linux kernel function can/will
be called.

Michael

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/