Re: Linux Kernel Crash Dump implementation

On Wed, 3 Mar 2004 09:47:38 -0700
"Hanson, Jonathan M" <[email protected]> wrote:

>             I'm looking to implement through a kernel module something
> very similar to how the Linux Kernel Crash Dump works. I'm writing to
> this list in hopes of getting an idea of where to begin looking through
> the kernel patches for LKCD to see how it's implemented.
> 
>             What I want to do is to have my kernel module intercept an
> int 3 instruction like a debugger does (I already have this part
> working), it will then dump out to a file the contents of memory by
> physical address, and then it will write to another file the x86 CPU
> architecture state (general-purpose registers, MSRs, floating-point
> registers, MMX and XMM registers, etc.). The idea is to be able to take
> the memory image and the architecture state and recreate the system's
> state to be able to resume from after the int 3 instruction was
> received.
> 
>             Are there some high-level design documents for LKCD that go
> into how it handles these kinds of things? If not, can a developer on
> the list point me in the right direction as to where to begin looking in
> the patch in order to accomplish what I'm trying to do? This is my first
> attempt at writing a kernel module and I am by far not a kernel
> internals expert so that's why I'm seeking a little guidance. I would
> appreciate any help offered no matter how small.
> 
>             I'm also looking at Software Suspend and someone on that
> list suggested that I also check here.
> 
>             Thank you very much for you time.

The IBM kprobe patch did basically that, it had a hook to catch int3.
You can't do it completely from a module; you need to have hooks in the base kernel.


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click