[PATCH v5][makedumpfile 0/9] btf/kallsyms based makedumpfile extension for mm page filtering

[Tao Liu]

Hi Krister,

Thanks a lot for your suggestions and comments!

On Sat, May 30, 2026 at 9:11 AM Krister Johansen
<kjlx at templeofstupid.com> wrote:
>
> On Tue, Apr 14, 2026 at 10:26:47PM +1200, Tao Liu wrote:
> > A) This patchset will introduce the following features to makedumpfile:
> >
> >   1) Add .so extension support to makedumpfile
> >   2) Enable btf and kallsyms for symbol type and address resolving.
> >
> > B) The purpose of the features are:
> >
> >   1) Currently makedumpfile filters mm pages based on page flags, because flags
> >      can help to determine one page's usage. But this page-flag-checking method
> >      lacks of flexibility in certain cases, e.g. if we want to filter those mm
> >      pages occupied by GPU during vmcore dumping due to:
> >
> >      a) GPU may be taking a large memory and contains sensitive data;
> >      b) GPU mm pages have no relations to kernel crash and useless for vmcore
> >         analysis.
> >
> >      But there is no GPU mm page specific flags, and apparently we don't need
> >      to create one just for kdump use. A programmable filtering tool is more
> >      suitable for such cases. In addition, different GPU vendors may use
> >      different ways for mm pages allocating, programmable filtering is better
> >      than hard coding these GPU specific logics into makedumpfile in this case.
> >
> >   2) Currently makedumpfile already contains a programmable filtering tool, aka
> >      eppic script, which allows user to write customized code for data erasing.
> >      However it has the following drawbacks:
> >
> >      a) cannot do mm page filtering.
> >      b) need to access to debuginfo of both kernel and modules, which is not
> >         applicable in the 2nd kernel.
> >      c) eppic library has memory leaks which are not all resolved [1]. This
> >         is not acceptable in 2nd kernel.
> >
> >      makedumpfile need to resolve the dwarf data from debuginfo, to get symbols
> >      types and addresses. In recent kernel there are dwarf alternatives such
> >      as btf/kallsyms which can be used for this purpose. And btf/kallsyms info
> >      are already packed within vmcore, so we can use it directly.
> >
> >   With these, this patchset introduces makedumpfile extensions, which is based
> >   on btf/kallsyms symbol resolving, and is programmable for mm page filtering.
> >   The following section shows its usage and performance, please note the tests
> >   are performed in 1st kernel.
> >
> >   3) Compile and run makedumpfile extensions:
> >
> >   $ make LINKTYPE=dynamic USELZO=on USESNAPPY=on USEZSTD=on EXTENSION=on
> >   $ make extensions
>
> I love this idea.  Do you have time to take it further, and if not are
> you open to making the extension framework more modular so that we could
> add others in the future?

The purpose of extension is to make the framework modular. My original
thought is, we can implement several makedumpfile extensions, each
restricted to one specific function. Like one extension deals with AMD
gpu mm filtering only, one deals with Intel gpu only etc. For distros
we can ship all extensions along with makedumpfile once, but the
respective extensions will only take effect if the machine has AMD /
Intel gpu. This is the same case if you'd like to add other customized
functions while the makedumpfile core remains unchanged.

>
> Could the btf lookups be extended to cover the symbol lookups used by
> eppic and the erase filters so that the -x option is unnecessary for
> kernels that have BTF support?

Yes, from my view it is doable and not difficult to implement.

>
> The current extension implementation is focused just on skipping pages,
> but it would be great to be able to use this to erase data in structures
> like the config filters and eppic, but without having to provide a
> vmlinux at dump time.  What do you think about adding the ability to
> use the extensions to also erase parts of data structures, in addition
> to filtering whole pages?

That's the step 2 for the BTF/kallsyms work of makedumpfile, and I
have planed to work on this once the patchset(step 1) is accepted. The
reason for the task dividing is, the GPU mm page filtering is more
urgent than data erasing from my view. For data erasing, at least we
can do the erasing in 1st kernel with the help of dwarf, cumbersome
but working; For GPU mm filtering, as far as I know, there are no
handy tools in 2nd kernel.

I think erasing the data is doable upon the current page filtering code.

>
> Would you be willing to modify the extension registration options to
> allow an extension to specify what kind it is? That way, in the future

I'm not sure what you mean by "what kind". Do you mean an extension
needs to tell makedumpfile what purpose it is for when loading?

> we could register multiple different kinds without breaking existing
> ones.  One for filtering pages, one for erasing / modifying dump
> content, and others based upon whatever additional use cases develop.

That's the goal of extensions, each extension deals with its own
business. Could you point out the code that doesn't match the goal?
I'm happy to correct it in v6.

Thanks,
Tao Liu


>
> Thanks,
>
> -K
>