A patch series sent out today on the Linux kernel mailing list proposes "MEMINSPECT" as a new mechanism for helping with memory analysis.

Eugen Hristev of Linaro sent out the set of 26 patches proposing MEMINSPECT. Hristev describes the MEMINSPECT functionality as:

"meminspect is a mechanism which allows the kernel to mark specific memory areas for memory dumping or specific inspection, statistics, usage. Once regions are marked, meminspect keeps an internal list with the regions in a dedicated table.

Further, these regions can be accessed using specific API by any interested driver. Regions being marked beforehand, when the system is up and running, there is no need nor dependency on a panic handler, or a working kernel that can dump the debug information.

meminspect can be primarily used for debugging. The approach is feasible to work when pstore, kdump, or another mechanism do not. Pstore relies on persistent storage, a dedicated RAM area or flash, which has the disadvantage of having the memory reserved all the time, or another specific non volatile memory. Some devices cannot keep the RAM contents on reboot so ramoops does not work. Some devices do not allow kexec to run another kernel to debug the crashed one. For such devices, that have another mechanism to help debugging, like firmware, kmemdump is a viable solution.

meminspect can create a core image, similar with /proc/vmcore, with only the registered regions included. This can be loaded into crash tool/gdb and analyzed. This happens if CRASH_DUMP=y.

To have this working, specific information from the kernel is registered, and this is done at meminspect init time, no need for the meminspect users to do anything."

This builds on prior work that was submitted under a request for comments "RFC" flag. If this sort of material interests you, learn more about MEMINSPECT on the [1]LKML patch series .



[1] https://lore.kernel.org/lkml/20251119154427.1033475-1-eugen.hristev@linaro.org/T/#m1aaaea965c74ef96f2b594333fe33f25341e8fb3