[lldb-dev] Adding support for FreeBSD kernel coredumps (and live memory lookup)

[Michał Górny via lldb-dev]

On Thu, 2021-12-02 at 09:40 +0000, David Spickett wrote:
> Can you give an example workflow of how these core files are used by a
> developer? For some background.

Right now, the idea is that when the kernel crashes, the developer can
take the vmcore file use LLDB to look the kernel state up.  Initially,
this means reading the "raw" memory, i.e. looking up basic symbol values
but eventually (like kGDB) we'd like to add basic support for looking up
kernel thread states.

> Most of my experience is in userspace, the corefile is "offline" debug
> and then you have "live" debug of the running process. Is that the
> same here or do we have a mix since you can access some of the live
> memory after the core has been dumped?

It's roughly the same, i.e. you either use a crash dump (i.e. saved
kernel state) or you use /dev/mem to read memory from the running
kernel.

> I'm wondering if a FreeBSD Kernel plugin would support these corefiles
> and/or live debug, or if they are just two halves of the same
> solution. Basically, would you end up with a FreeBSDKernelCoreDump and
> a FreeBSDKernelLive plugin?

I think one plugin is the correct approach here.  Firstly, because
the interface for reading memory is abstracted out to a single library
and the API is the same for both cases.  Secondly, because the actual
interpreting logic would also be shared.

-- 
Best regards,
Michał Górny