Hi, thanks for maintaining drgn.
I am working on Android/Linux kernel ramdump analysis where the dump is not available as a single ELF vmcore. Instead, the platform provides a split/raw ramdump, usually several memory segment files plus physical base addresses, for example:
DDRCS0.BIN @ 0x80000000
DDRCS1.BIN @ 0x100000000
...
The normal drgn -c vmcore -s vmlinux flow works well for standard vmcore files, but it does not directly apply to this split dump format.
I noticed that drgn has APIs such as:
prog.add_memory_segment(..., physical=True)
prog.set_linux_kernel_custom(vmcoreinfo, is_live=False)
This looks like it may be possible to build a custom backend for split/raw ramdumps by registering each physical memory segment manually, then letting drgn perform Linux kernel virtual address translation using vmcoreinfo.
I would like to ask:
- Is this the intended API path for supporting split/raw kernel ramdumps?
- What is the minimal required vmcoreinfo content for arm64 Linux kernel virtual address translation?
- Is there any example or test case showing set_linux_kernel_custom() with manually added physical memory segments?
- Are there any known limitations compared with loading a standard ELF vmcore via -c?
A rough target use case would be:
from drgn import Program, Platform, Architecture
prog = Program(
Platform(Architecture.AARCH64),
vmcoreinfo=vmcoreinfo_text,
)
for segment in segments:
prog.add_memory_segment(
segment.phys_start,
segment.size,
segment.read_fn,
physical=True,
)
prog.set_linux_kernel_custom(vmcoreinfo_text, is_live=False)
prog.load_debug_info([vmlinux_path])
print(prog["init_task"].comm)
If this is expected to work, I would be happy to experiment and possibly contribute documentation or a small example for split/raw ramdump support.
Thanks!
Hi, thanks for maintaining drgn.
I am working on Android/Linux kernel ramdump analysis where the dump is not available as a single ELF vmcore. Instead, the platform provides a split/raw ramdump, usually several memory segment files plus physical base addresses, for example:
The normal drgn -c vmcore -s vmlinux flow works well for standard vmcore files, but it does not directly apply to this split dump format.
I noticed that drgn has APIs such as:
This looks like it may be possible to build a custom backend for split/raw ramdumps by registering each physical memory segment manually, then letting drgn perform Linux kernel virtual address translation using vmcoreinfo.
I would like to ask:
A rough target use case would be:
If this is expected to work, I would be happy to experiment and possibly contribute documentation or a small example for split/raw ramdump support.
Thanks!