Google software engineer Pasha Tatashin has proposed Page Detective as a new kernel debugging tool that is able to provide greater insight around the usage and mapping of physical memory pages.

The initial Page Detective code has been posted in "Request For Comments" form and makes use of the Linux DebugFS interface for providing insight around virtual and physical addresses.

[1]

This insight provided by Page Detective can help developers and server administrators understand about memory page use by the system such as when dealing with memory issues, checksum failures during live migration, file-system journal failures, segmentation faults, and other possible cases of memory corruption.

"Page Detective is a kernel debugging tool designed to provide in-depth information about the usage and mapping of physical memory pages within the Linux kernel. By leveraging the debugfs interface, it enables administrators and developers to investigate the status and allocation of memory pages.

This tool is valuable for diagnosing memory-related issues such as checksum errors during live migration, filesystem journal failures, segmentation faults, and other forms of corruption."

The RFC patches for the Linux page detective were posted today on the [2]Linux kernel mailing list . Pasha further explains in that patch cover letter:

"Page Detective is a new kernel debugging tool that provides detailed information about the usage and mapping of physical memory pages.

It is often known that a particular page is corrupted, but it is hard to extract more information about such a page from live system. Examples are:

- Checksum failure during live migration

- Filesystem journal failure

- dump_page warnings on the console log

- Unexcpected segfaults

Page Detective helps to extract more information from the kernel, so it can be used by developers to root cause the associated problem.

It operates through the Linux debugfs interface, with two files: "virt" and "phys".

The "virt" file takes a virtual address and PID and outputs information about the corresponding page.

The "phys" file takes a physical address and outputs information about that page.

The output is presented via kernel log messages (can be accessed with dmesg), and includes information such as the page's reference count, mapping, flags, and memory cgroup. It also shows whether the page is mapped in the kernel page table, and if so, how many times."

It will be interesting to see where this Page Detective work leads and if it's of interest to other stakeholders in current form getting it into the mainline Linux kernel.



[1] https://www.phoronix.com/image-viewer.php?id=2024&image=grok_tux_detective_lrg

[2] https://lore.kernel.org/lkml/20241116175922.3265872-1-pasha.tatashin@soleen.com/