linux-kernel - Re: [QUESTION] Is there a better way to get ftrace dump on guest?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160628164634.GA4202@debian>
Date:	Tue, 28 Jun 2016 18:46:34 +0200
From:	Rabin Vincent <rabin@....in>
To:	Namhyung Kim <namhyung@...nel.org>
Cc:	kvm@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Minchan Kim <minchan@...nel.org>
Subject: Re: [QUESTION] Is there a better way to get ftrace dump on guest?

On Tue, Jun 28, 2016 at 03:33:18PM +0900, Namhyung Kim wrote:
> On Tue, Jun 28, 2016 at 3:25 PM, Namhyung Kim <namhyung@...nel.org> wrote:
> > I'm running some guest machines for kernel development.  For debugging
> > purpose, I use lots of trace_printk() since it's faster than normal
> > printk().  When kernel crash happens the trace buffer is printed on
> > console (I set ftrace_dump_on_oops) but it takes too much time.  I
> > don't want to reduce the size of ring buffer as I want to collect the
> > debug info as much as possible.  And I also want to see trace from all
> > cpu so 'ftrace_dump_on_oop = 2' is not an option.
> >
> > I know the kexec/kdump (and the crash tool) can dump and analyze the
> > trace buffer later.  But it's cumbersome to do it everytime and more
> > importantly, I don't want to spend the memory for the crashkernel.

Assuming you're using QEMU:

QEMU has a dump-guest-memory command which can be used to dump the
guest's entire memory to an ELF which can be loaded by the crash utility
to extract the trace buffer.  This doesn't require kexec/kdump or any
other support from the guest kernel.

It's apparently even possible to run QEMU with the guest memory in a
file and load that to crash directly, although this is not something
I've had a chance to try out myself:

https://github.com/crash-utility/crash/commit/89ed9d0a7f7da4578294a492c1ad857244ce7352