Description
drgn as a programmable debugger can be useful for kernel core analysis and may offer some advantages in some scenarios over crash, the standard tool used for this purpose.
Goals
- Familiarization with drgn and it's capabilities and limitations
- Investigate how it may be used to assist with kernel core analysis
- Investigate how it may be used to create analysis tools (i.e. analyzevmcore) which can be used by someone without core analysis knowledge which may help expedite issue resolution
Resources
Looking for hackers with the skills:
Nothing? Add some keywords!
This project is part of:
Hack Week 24
Activity
Comments
-
29 days ago by tabraham1 | Reply
Some good progress on this project, but there is still much more work to be done
bin/drgn-util -c vmcore -d vmlinux-4.12.14-122.201-default.debug
vmcore
vmlinux-4.12.14-122.201-default.debug
dcrash> sys
CPUS: 2
DATE: Tue May 7 03:43:51 2024
UPTIME: 11 days, 6:50:30
LOAD AVERAGE: 278.00 277.96 277.51
TASKS: 1116
NODENAME: plfilsftp05
RELEASE: 4.12.14-122.201-default
VERSION: #1 SMP Tue Mar 12 13:01:34 UTC 2024 (b92bd5a)
MACHINE: x86_64
COMMAND: swapper/0dcrash> ps -S
S 792
D 278
Z 46dcrash> checks
Panic was triggered by sysrq
High Load Average (139 tasks per CPU) detected
Hung task count: 278
Waiting tasks
COUNT COMM
161 python.original
42 mkdir
35 mktemp
9 dsa.Scheduler0
8 dsam
4 pool-dsam
4 pool
2 dsnuagent
1 vmtoolsd
1 sssdbe
1 pgrep
1 snmpd
1 dsa-connect
1 khugepaged
1 kworker/1:1
1 dsp.am.service
1 ntpd
1 dsp.response.se
1 rs:main Q:Reg
1 sssdnss
1 systemd -
29 days ago by tabraham1 | Reply
dcrash> bt
PID: 0 CPU: 0 COMM: "swapper/0"
#0 at 0xffffffffa14fac62 (sysrqhandlecrash+0x12/0x1f) in sysrqhandlecrash at ../drivers/tty/sysrq.c:146
[Exception RIP: sysrqhandlecrash+0x12/0x1f]
PC: 0xffffffffa14fac62
SP: 0xffff8bcd74e03d30
RAX: 0xffffffffa14fac50 RBX: 0xffffffffa2187e60 RCX: 0x83f
RDX: 0x1 RSI: 0xf6 RDI: 0x63
RBP: 0x63 R08: 0x0 R09: 0x544
R10: 0x1 R11: 0xaaaaaa R12: 0x1
R13: 0x1 R14: 0xffffffffa2187ac0 R15: 0xffff8bcd6bdb7898
#1 at 0xffffffffa14fb3b2 (handlesysrq+0xf2/0x143) in _handlesysrq at ../drivers/tty/sysrq.c:559
#2 at 0xffffffffa14fb7ab (sysrqfilter+0x36b/0x3a2) in sysrqhandlekeypress at ../drivers/tty/sysrq.c:821 (inlined)
#3 at 0xffffffffa14fb7ab (sysrqfilter+0x36b/0x3a2) in sysrqfilter at ../drivers/tty/sysrq.c:883
#4 at 0xffffffffa158e57b (inputtohandler+0x4b/0xf8) in inputtohandler at ../drivers/input/input.c:105
#5 at 0xffffffffa1590462 (inputpassvalues.part.7+0x112/0x11d) in inputpassvalues at ../drivers/input/input.c:148
#6 at 0xffffffffa159177e (inputhandleevent+0x13e/0x5d9) in inputpassvalues at ../drivers/input/input.c:400 (inlined)
#7 at 0xffffffffa159177e (inputhandleevent+0x13e/0x5d9) in inputhandleevent at ../drivers/input/input.c:401
#8 at 0xffffffffa1591c75 (inputevent+0x55/0x75) in inputevent at ../drivers/input/input.c:436
#9 at 0xffffffffa1597dc6 (atkbdinterrupt+0x5d6/0x69e) in inputsync at ../include/linux/input.h:414 (inlined)
#10 at 0xffffffffa1597dc6 (atkbdinterrupt+0x5d6/0x69e) in atkbdinterrupt at ../drivers/input/keyboard/atkbd.c:512
#11 at 0xffffffffa158b9f7 (seriointerrupt+0x47/0x87) in seriointerrupt at ../drivers/input/serio/serio.c:1014
#12 at 0xffffffffa158cb10 (i8042interrupt+0x1e0/0x392) in i8042interrupt at ../drivers/input/serio/i8042.c:590
#13 at 0xffffffffa10f7770 (handleirqeventpercpu+0x40/0x19a) in _handleirqeventpercpu at ../kernel/irq/handle.c:145
#14 at 0xffffffffa10f78f0 (handleirqeventpercpu+0x20/0x4e) in handleirqeventpercpu at ../kernel/irq/handle.c:185
#15 at 0xffffffffa10f7956 (handleirqevent+0x36/0x57) in handleirqevent at ../kernel/irq/handle.c:202
#16 at 0xffffffffa10fae6e (handleedgeirq+0x8e/0x149) in handleedgeirq at ../kernel/irq/chip.c:713
#17 at 0xffffffffa1033fec (handleirq+0x1c/0x2d) in generichandleirqdesc at ../include/linux/irqdesc.h:150 (inlined)
#18 at 0xffffffffa1033fec (handleirq+0x1c/0x2d) in handleirq at ../arch/x86/kernel/irq64.c:85
#19 at 0xffffffffa1803883 (doIRQ+0x43/0xd8) in doIRQ at ../arch/x86/kernel/irq.c:248
#20 at 0xffffffffa1800a48 (commoninterrupt+0xc8/0x1c2) at ../arch/x86/entry/entry64.S:582
Similar Projects
This project is one of its kind!