Re: efi-pstore: Crash logs not written

[Kees Cook]

On Thu, Sep 12, 2019 at 02:51:53PM +0200, Paul Menzel wrote:
> On a Dell OptiPlex 5040 with Linux 5.3-rc8, Iâll try to get
> efi-pstore working.
> 
> ```
> $ lsmod | grep efi
> efi_pstore             16384  0
> pstore                 28672  1 efi_pstore
> efivarfs               16384  1
> $ dmesg | grep pstore
> [ 2569.826541] pstore: Using crash dump compression: deflate
> [ 2569.826542] pstore: Registered efi as persistent store backend
> ```
> 
> Triggering a crash with `echo c | sudo tee /proc/sysrq-trigger`,
> there is nothing in `/sys/fs/pstore` after the reboot.
> 
> Please note, that there is also a crash kernel configured, so
> there are actually to reboots, but that should not conflict,
> right?

As long as the crash kernel doesn't delete all the EFI stored variables,
I would expect them to survive.

> Hints on how to debug that would be appreciated. Please find the
> Linux messages attached.

Things seem correct, though I've only done EFI testing under QEMU...
do other things, like BUG (rather than a full panic()) get recorded?
(Maybe try with the lkdtm module?) There was another recent issue with
the "c" sysrq[1] but that seemed to be Xen-specific.

[1] https://lore.kernel.org/lkml/be41da82-3adc-4ab1-e4f9-5fdf11ac4b08@xxxxxxxxxx/

-- 
Kees Cook