linux-kernel - RE: pstore/ramoops - why only collect a partial dmesg?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Jan 2022 23:31:32 +0000
From:   "Luck, Tony" <tony.luck@...el.com>
To:     "Guilherme G. Piccoli" <gpiccoli@...lia.com>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "anton@...msg.org" <anton@...msg.org>,
        "ccross@...roid.com" <ccross@...roid.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Linux-Fsdevel <linux-fsdevel@...r.kernel.org>,
        "Guilherme G. Piccoli" <kernel@...ccoli.net>
Subject: RE: pstore/ramoops - why only collect a partial dmesg?

> Hi Anton / Colin / Kees / Tony, I'd like to understand the rationale
> behind a ramoops behavior, appreciate in advance any information/advice!
>
> I've noticed that while using ramoops as a backend for pstore, only the
> first "record_size" bytes of dmesg is collected/saved in sysfs on panic.
> It is the "Part 1" of dmesg - seems this is on purpose [0], so I'm
> curious on why can't we save the full dmesg split in multi-part files,
> like efi-pstore for example?
>
> If that's an interesting idea, I'm willing to try implementing that in
> case there are no available patches for it already (maybe somebody
> worked on it for their own usage). My idea would be to have a tuning to
> enable or disable such new behavior, and we could have files like
> "dmesg-ramoops-0.partX" as the partitions of the full "dmesg-ramoops-0".

Guilherme,

The efi (and erst) backends for pstore have severe limitations on the size
of objects that can store (just a few Kbytes) so pstore breaks the dmesg
data into pieces.

I'm not super-familiar with how ramoops behaves, but maybe it allows setting
a much larger "record_size" ... so this split isn't needed?

-Tony