[PATCH v5][makedumpfile 0/9] btf/kallsyms based makedumpfile extension for mm page filtering

[Krister Johansen]

On Tue, Apr 14, 2026 at 10:26:47PM +1200, Tao Liu wrote:
> A) This patchset will introduce the following features to makedumpfile:
> 
>   1) Add .so extension support to makedumpfile
>   2) Enable btf and kallsyms for symbol type and address resolving.
> 
> B) The purpose of the features are:
> 
>   1) Currently makedumpfile filters mm pages based on page flags, because flags
>      can help to determine one page's usage. But this page-flag-checking method
>      lacks of flexibility in certain cases, e.g. if we want to filter those mm
>      pages occupied by GPU during vmcore dumping due to:
> 
>      a) GPU may be taking a large memory and contains sensitive data;
>      b) GPU mm pages have no relations to kernel crash and useless for vmcore
>         analysis.
> 
>      But there is no GPU mm page specific flags, and apparently we don't need
>      to create one just for kdump use. A programmable filtering tool is more
>      suitable for such cases. In addition, different GPU vendors may use
>      different ways for mm pages allocating, programmable filtering is better
>      than hard coding these GPU specific logics into makedumpfile in this case.
> 
>   2) Currently makedumpfile already contains a programmable filtering tool, aka
>      eppic script, which allows user to write customized code for data erasing.
>      However it has the following drawbacks:
> 
>      a) cannot do mm page filtering.
>      b) need to access to debuginfo of both kernel and modules, which is not
>         applicable in the 2nd kernel.
>      c) eppic library has memory leaks which are not all resolved [1]. This
>         is not acceptable in 2nd kernel.
> 
>      makedumpfile need to resolve the dwarf data from debuginfo, to get symbols
>      types and addresses. In recent kernel there are dwarf alternatives such
>      as btf/kallsyms which can be used for this purpose. And btf/kallsyms info
>      are already packed within vmcore, so we can use it directly.
> 
>   With these, this patchset introduces makedumpfile extensions, which is based
>   on btf/kallsyms symbol resolving, and is programmable for mm page filtering.
>   The following section shows its usage and performance, please note the tests
>   are performed in 1st kernel.
> 
>   3) Compile and run makedumpfile extensions:
> 
>   $ make LINKTYPE=dynamic USELZO=on USESNAPPY=on USEZSTD=on EXTENSION=on
>   $ make extensions

I love this idea.  Do you have time to take it further, and if not are
you open to making the extension framework more modular so that we could
add others in the future?

Could the btf lookups be extended to cover the symbol lookups used by
eppic and the erase filters so that the -x option is unnecessary for
kernels that have BTF support?

The current extension implementation is focused just on skipping pages,
but it would be great to be able to use this to erase data in structures
like the config filters and eppic, but without having to provide a
vmlinux at dump time.  What do you think about adding the ability to
use the extensions to also erase parts of data structures, in addition
to filtering whole pages?

Would you be willing to modify the extension registration options to
allow an extension to specify what kind it is? That way, in the future
we could register multiple different kinds without breaking existing
ones.  One for filtering pages, one for erasing / modifying dump
content, and others based upon whatever additional use cases develop.

Thanks,

-K