linux-kernel - Re: debugging live kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1367265674.18069.187@driftwood>
Date:	Mon, 29 Apr 2013 15:01:14 -0500
From:	Rob Landley <rob@...dley.net>
To:	lkml@...usoft.pl
Cc:	linux-kernel@...r.kernel.org
Subject: Re: debugging live kernel

On 04/29/2013 06:34:08 AM, lkml@...usoft.pl wrote:
> In case if my currently running kernel starts to do strange things  
> and I
> suspect it might have bug or was corrupted, what steps can be taken to
> check for more info, other then dmesg?

If you built it with kgdb, you can use that. If you have a jtag  
connected to the hardware, you can use that. If you built with kernel  
crash dumps, you can use that. If you kept the vmlinux file  
corresponding to your bzImage you can (VERY CAREFULLY) look at  
/dev/kmem with gdb (or use the corresponding system.map to decode  
addresses by hand; note this is horrible but possible)...

There's levels of difficulty here: "Kernel was hooked up to monitoring  
stuff before it went wrong" is the easy path. "Kept the box it came in"  
is the less easy path. "Flying blind on a rocketcycle" is not easy, and  
you pretty much have to have experience with the first two before you  
can even attempt the third. (And unless you're off in the enterprise  
space you generally go "Can I reproduce the issue? Let's reproduce it  
under a properly instrumented environment. If I _can't_ reproduce the  
issue then a reboot fixed it and we're good.)

Your problem description is way too vague to give specific advice  
about. "If I start to feel poorly, is there anything I can do to  
diagnose my illness?" Ummm... yes? (No, I'm not going to exchange a  
dozen emails with you to about it, and nothing here should be  
considered medical advice.)

Rob--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/