Re: Custom core file

[Nikolay Martyanov <nmartyanov@ptsecurity.com>]

On 09/28/2016 05:58 PM, Jan Kratochvil wrote:
> On Wed, 28 Sep 2016 15:31:12 +0200, Nikolay Martyanov wrote:
>> I have a self-written bare-metal hypervisor for x86 arch and I'd like to
>> perform postmortem debugging of it's core (not VM, hypervisor itself!).
>> So the idea is to save physical memory state and later use GDB to interpret
>> it.
> I still do not understand what is the goal.
>
> "not VM, hypervisor itself!" would say that running "/usr/bin/gcore "+getpid()
> on the hypervisor process would do the job.
Bare-metal hypervisor doesn't have a representation in process tree of 
any guest VM. I do not have running OS where I can do `/usr/bin/gcore`. 
It's Xen alike hypervisor =)
> But then "the idea is to save physical memory state" would suggest me you want
> to dump the guest VM - like what guest kdump does or what is in guest Linux
> kernel /proc/kcore (where it is without the physical memory).
>
>
> Jan
Idea is very similar to `kdump`, you are right. But instead of Linux 
kernel I have a hypervisor running on a bare-metal. So, in some point of 
view, I try to implement my own kdump. And it will dump not Linux kernel 
mem, but mem of hypervisor.