Description

drgn as a programmable debugger can be useful for kernel core analysis and may offer some advantages in some scenarios over crash, the standard tool used for this purpose.

Goals

  1. Familiarization with drgn and it's capabilities and limitations
  2. Investigate how it may be used to assist with kernel core analysis
  3. Investigate how it may be used to create analysis tools (i.e. analyzevmcore) which can be used by someone without core analysis knowledge which may help expedite issue resolution

Resources

drgn GitHub

drgn Docs

Looking for hackers with the skills:

Nothing? Add some keywords!

This project is part of:

Hack Week 24

Activity

  • about 2 months ago: dmdiss liked this project.
  • about 2 months ago: mwilck liked this project.
  • about 2 months ago: vliaskovitis liked this project.
  • 2 months ago: m.crivellari liked this project.
  • 2 months ago: tabraham1 started this project.
  • 2 months ago: tabraham1 originated this project.

  • Comments

    • tabraham1
      29 days ago by tabraham1 | Reply

      Some good progress on this project, but there is still much more work to be done

      bin/drgn-util -c vmcore -d vmlinux-4.12.14-122.201-default.debug
      vmcore
      vmlinux-4.12.14-122.201-default.debug
      dcrash> sys
      CPUS: 2
      DATE: Tue May 7 03:43:51 2024
      UPTIME: 11 days, 6:50:30
      LOAD AVERAGE: 278.00 277.96 277.51
      TASKS: 1116
      NODENAME: plfilsftp05
      RELEASE: 4.12.14-122.201-default
      VERSION: #1 SMP Tue Mar 12 13:01:34 UTC 2024 (b92bd5a)
      MACHINE: x86_64
      COMMAND: swapper/0

      dcrash> ps -S
      S 792
      D 278
      Z 46

      dcrash> checks
      Panic was triggered by sysrq
      High Load Average (139 tasks per CPU) detected
      Hung task count: 278
      Waiting tasks
      COUNT COMM
      161 python.original
      42 mkdir
      35 mktemp
      9 dsa.Scheduler0
      8 ds
      am
      4 pool-dsam
      4 pool
      2 ds
      nuagent
      1 vmtoolsd
      1 sssdbe
      1 pgrep
      1 snmpd
      1 dsa-connect
      1 khugepaged
      1 kworker/1:1
      1 dsp.am.service
      1 ntpd
      1 dsp.response.se
      1 rs:main Q:Reg
      1 sssd
      nss
      1 systemd

    • tabraham1
      29 days ago by tabraham1 | Reply

      dcrash> bt
      PID: 0 CPU: 0 COMM: "swapper/0"
      #0 at 0xffffffffa14fac62 (sysrqhandlecrash+0x12/0x1f) in sysrqhandlecrash at ../drivers/tty/sysrq.c:146
      [Exception RIP: sysrqhandlecrash+0x12/0x1f]
      PC: 0xffffffffa14fac62
      SP: 0xffff8bcd74e03d30
      RAX: 0xffffffffa14fac50 RBX: 0xffffffffa2187e60 RCX: 0x83f
      RDX: 0x1 RSI: 0xf6 RDI: 0x63
      RBP: 0x63 R08: 0x0 R09: 0x544
      R10: 0x1 R11: 0xaaaaaa R12: 0x1
      R13: 0x1 R14: 0xffffffffa2187ac0 R15: 0xffff8bcd6bdb7898
      #1 at 0xffffffffa14fb3b2 (handlesysrq+0xf2/0x143) in _handlesysrq at ../drivers/tty/sysrq.c:559
      #2 at 0xffffffffa14fb7ab (sysrq
      filter+0x36b/0x3a2) in sysrqhandlekeypress at ../drivers/tty/sysrq.c:821 (inlined)
      #3 at 0xffffffffa14fb7ab (sysrqfilter+0x36b/0x3a2) in sysrqfilter at ../drivers/tty/sysrq.c:883
      #4 at 0xffffffffa158e57b (inputtohandler+0x4b/0xf8) in inputtohandler at ../drivers/input/input.c:105
      #5 at 0xffffffffa1590462 (inputpassvalues.part.7+0x112/0x11d) in inputpassvalues at ../drivers/input/input.c:148
      #6 at 0xffffffffa159177e (inputhandleevent+0x13e/0x5d9) in inputpassvalues at ../drivers/input/input.c:400 (inlined)
      #7 at 0xffffffffa159177e (inputhandleevent+0x13e/0x5d9) in inputhandleevent at ../drivers/input/input.c:401
      #8 at 0xffffffffa1591c75 (inputevent+0x55/0x75) in inputevent at ../drivers/input/input.c:436
      #9 at 0xffffffffa1597dc6 (atkbdinterrupt+0x5d6/0x69e) in inputsync at ../include/linux/input.h:414 (inlined)
      #10 at 0xffffffffa1597dc6 (atkbdinterrupt+0x5d6/0x69e) in atkbdinterrupt at ../drivers/input/keyboard/atkbd.c:512
      #11 at 0xffffffffa158b9f7 (seriointerrupt+0x47/0x87) in seriointerrupt at ../drivers/input/serio/serio.c:1014
      #12 at 0xffffffffa158cb10 (i8042interrupt+0x1e0/0x392) in i8042interrupt at ../drivers/input/serio/i8042.c:590
      #13 at 0xffffffffa10f7770 (
      handleirqeventpercpu+0x40/0x19a) in _handleirqeventpercpu at ../kernel/irq/handle.c:145
      #14 at 0xffffffffa10f78f0 (handle
      irqeventpercpu+0x20/0x4e) in handleirqeventpercpu at ../kernel/irq/handle.c:185
      #15 at 0xffffffffa10f7956 (handle
      irqevent+0x36/0x57) in handleirqevent at ../kernel/irq/handle.c:202
      #16 at 0xffffffffa10fae6e (handle
      edgeirq+0x8e/0x149) in handleedgeirq at ../kernel/irq/chip.c:713
      #17 at 0xffffffffa1033fec (handle
      irq+0x1c/0x2d) in generichandleirqdesc at ../include/linux/irqdesc.h:150 (inlined)
      #18 at 0xffffffffa1033fec (handle
      irq+0x1c/0x2d) in handleirq at ../arch/x86/kernel/irq64.c:85
      #19 at 0xffffffffa1803883 (doIRQ+0x43/0xd8) in doIRQ at ../arch/x86/kernel/irq.c:248
      #20 at 0xffffffffa1800a48 (commoninterrupt+0xc8/0x1c2) at ../arch/x86/entry/entry64.S:582

    Similar Projects

    This project is one of its kind!