RE: Linux Kernel Crash Dump implementation

Comments in-line below.
 
Jeff Haran
Brocade Communications Systems

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Hanson,
Jonathan M
Sent: Wednesday, March 03, 2004 8:48 AM
To: [email protected]
Subject: [lkcd-general] Linux Kernel Crash Dump implementation



            I'm looking to implement through a kernel module something
very similar to how the Linux Kernel Crash Dump works. I'm writing to
this list in hopes of getting an idea of where to begin looking through
the kernel patches for LKCD to see how it's implemented.

            What I want to do is to have my kernel module intercept an
int 3 instruction like a debugger does (I already have this part
working), it will then dump out to a file the contents of memory by
physical address, and then it will write to another file the x86 CPU
architecture state (general-purpose registers, MSRs, floating-point
registers, MMX and XMM registers, etc.). The idea is to be able to take
the memory image and the architecture state and recreate the system's
state to be able to resume from after the int 3 instruction was
received.

            Are there some high-level design documents for LKCD that go
into how it handles these kinds of things? If not, can a developer on
the list point me in the right direction as to where to begin looking in
the patch in order to accomplish what I'm trying to do? 
[Jeff Haran] At least in the version of LKCD that I am using,
linux/drivers/dump/dump_base.c contains a large comment block that
describes the history of LKCD and also describes the layout of the dump
file that is created. If you are trying to understand how it works, this
is probably the best place to start. dump_base.c also contains the
"heart" of the dump implementation, so reading that code is a good
education exercise.

 This is my first attempt at writing a kernel module and I am by far not
a kernel internals expert so that's why I'm seeking a little guidance. I
would appreciate any help offered no matter how small.
[Jeff Haran] Here at Brocade we modified the LKCD driver such that it
builds as a loadable module. This was not difficult. If all you are
trying to do is hook an interrupt, rather than trying to hook the
panic() and die() functions in the kernel as the stock LKCD patch does,
then I think there would be nothing preventing you from implementing the
whole thing as a loadable module. The hard part, IMHO, is going to be
taking the dump file and "recreate the system's state to be able to
resume from after the int 3 instruction was received". There is nothing
in LKCD to do that. Typically, one takes the dump file and feeds it to a
dump analysis tool like lcrash or crash. Since you are operating on an
x86 platform, I would think either of these tools will work for you. It
gets fishy when you are attempting to find working analysis tools for
other processors.

 

            I'm also looking at Software Suspend and someone on that
list suggested that I also check here.

            Thank you very much for you time.

 

 

Jon M. Hanson

Senior Software Engineer

Office: +1-480-552-0519

Mobile: +1-602-330-4768 / [email protected]

My current location:
http://www.findu.com/cgi-bin/find-us.cgi?call=N7ZVJ-1

Work weblog: http://jmhanson-linux.ch.intel.com:8668

Public key: http://jmhanson-linux.ch.intel.com/jon_hanson_public_key.asc

Public key fingerprint: 3049 D9DF 35A5 5AF3 3883 077A 19F6 5784 5B01
B65E

 

/* The green code always compiles. */