[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] uniquely identifying KDUMP files that originate from QEMU
From: |
Laszlo Ersek |
Subject: |
[Qemu-devel] uniquely identifying KDUMP files that originate from QEMU |
Date: |
Tue, 11 Nov 2014 12:22:52 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 |
(Note: I'm not subscribed to either qemu-devel or the kexec list; please
keep me CC'd.)
QEMU is able to dump the guest's memory in KDUMP format (kdump-zlib,
kdump-lzo, kdump-snappy) with the "dump-guest-memory" QMP command.
The resultant vmcore is usually analyzed with the "crash" utility.
The original tool producing such files is kdump. Unlike the procedure
performed by QEMU, kdump runs from *within* the guest (under a kexec'd
kdump kernel), and has more information about the original guest kernel
state (which is being dumped) than QEMU. To QEMU, the guest kernel state
is opaque.
For this reason, the kdump preparation logic in QEMU hardcodes a number
of fields in the kdump header. The direct issue is the "phys_base"
field. Refer to dump.c, functions create_header32(), create_header64(),
and "include/sysemu/dump.h", macro PHYS_BASE (with the replacement text
"0").
http://git.qemu.org/?p=qemu.git;a=blob;f=dump.c;h=9c7dad8f865af3b778589dd0847e450ba9a75b9d;hb=HEAD
http://git.qemu.org/?p=qemu.git;a=blob;f=include/sysemu/dump.h;h=7e4ec5c7d96fb39c943d970d1683aa2dc171c933;hb=HEAD
This works in most cases, because the guest Linux kernel indeed tends to
be loaded at guest-phys address 0. However, when the guest Linux kernel
is booted on top of OVMF (which has a somewhat unusual UEFI memory map),
then the guest Linux kernel is loaded at 16MB, thereby getting out of
sync with the phys_base=0 setting visible in the KDUMP header.
This trips up the "crash" utility.
Dave worked around the issue in "crash" for ELF format dumps -- "crash"
can identify QEMU as the originator of the vmcore by finding the QEMU
notes in the ELF vmcore. If those are present, then "crash" employs a
heuristic, probing for a phys_base up to 32MB, in 1MB steps.
Alas, the QEMU notes are not present in the KDUMP-format vmcores that
QEMU produces (they cannot be), hence crash has no way to tell apart
such files from those generated by genuine kdump. As an end result,
"crash" cannot automatically find the phys_base of OVMF-based Linux vmcores.
Dave suggested that a new flag, or a special phys_base value (like ~0UL)
be introduced as a distinguishing mark for QEMU-produced kdumps.
Implementing this in QEMU wouldn't be hard. The big question is
compatibility -- whose analysis tools would be broken by a (phys_base ==
~0UL) setting, or by a new flag?
Note that this change would affect SeaBIOS-based vmcores too. QEMU can't
(and shouldn't) discriminate the vmcores it dumps based on guest
firmware. (If QEMU did that, then it might as well try to figure out the
real phys_base value, which is clearly out of scope for qemu. One of the
selling points of the paging=false dump is that it doesn't involve
parsing guest RAM.)
Thanks
Laszlo
- [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU,
Laszlo Ersek <=
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Peter Maydell, 2014/11/11
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Christopher Covington, 2014/11/11
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Petr Tesarik, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Christopher Covington, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Petr Tesarik, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Christopher Covington, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Petr Tesarik, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Laszlo Ersek, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Laszlo Ersek, 2014/11/12
- Re: [Qemu-devel] uniquely identifying KDUMP files that originate from QEMU, Christopher Covington, 2014/11/12