Skip to content

Support custom Linux kernel target for split/raw ramdump memory segments #618

Description

@miniLQ

Hi, thanks for maintaining drgn.

I am working on Android/Linux kernel ramdump analysis where the dump is not available as a single ELF vmcore. Instead, the platform provides a split/raw ramdump, usually several memory segment files plus physical base addresses, for example:

DDRCS0.BIN @ 0x80000000
DDRCS1.BIN @ 0x100000000
...

The normal drgn -c vmcore -s vmlinux flow works well for standard vmcore files, but it does not directly apply to this split dump format.

I noticed that drgn has APIs such as:

prog.add_memory_segment(..., physical=True)
prog.set_linux_kernel_custom(vmcoreinfo, is_live=False)

This looks like it may be possible to build a custom backend for split/raw ramdumps by registering each physical memory segment manually, then letting drgn perform Linux kernel virtual address translation using vmcoreinfo.

I would like to ask:

  1. Is this the intended API path for supporting split/raw kernel ramdumps?
  2. What is the minimal required vmcoreinfo content for arm64 Linux kernel virtual address translation?
  3. Is there any example or test case showing set_linux_kernel_custom() with manually added physical memory segments?
  4. Are there any known limitations compared with loading a standard ELF vmcore via -c?

A rough target use case would be:

from drgn import Program, Platform, Architecture

prog = Program(
    Platform(Architecture.AARCH64),
    vmcoreinfo=vmcoreinfo_text,
)

for segment in segments:
    prog.add_memory_segment(
        segment.phys_start,
        segment.size,
        segment.read_fn,
        physical=True,
    )

prog.set_linux_kernel_custom(vmcoreinfo_text, is_live=False)
prog.load_debug_info([vmlinux_path])

print(prog["init_task"].comm)

If this is expected to work, I would be happy to experiment and possibly contribute documentation or a small example for split/raw ramdump support.

Thanks!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions