Linux Coredumps Via Sockets Can Be Much Smaller Now With Sparse Support

Added to the Linux kernel last year was Coredump support via Unix domain sockets as an alternative to the pipe-based Coredumps. With code now merged for Linux 7.4, the core dumps via sockets has the potential of being much smaller thanks to sparse support. In extreme cases they can be 1% of the size without sparse support.

Among the VFS pull requests merged now for Linux 7.4 is sparse coredump support over sockets as well as a new COREDUMP_MEMORY_TYPES ability for letting the server choose what memory to dump per request rather than relying on the static coredump filter.

With the sparse support, zeroed data when a mapping contains holes will no longer be transferred via the Coredump socket. This is a big efficiency improvement and avoids a lot of wasted work.

The sparse support patch series outlines the huge potential impact of this capability:

"Numbers from the selftest in patch 11, on a kernel built from this series:

- a process with 128 threads: 1740014 bytes on the socket for a coredump of 1075150848 bytes
- a 256MB mapping with one page touched: 170542 bytes on the socket for a coredump of 268890112 bytes
- the same 256MB mapping with COREDUMP_HEADER alone: 270993024 bytes on the socket, so the framing overhead itself is under one percent

The first one is the interesting case. Almost all of it is thread stacks. All stacks are 8MB reservations that are nearly all holes. And they are holes in the middle of the dump rather than at the end."

The sparse support via the socket protocol can be activated using COREDUMP_SPARSE. These Coredump improvements were merged via this pull request for Linux 7.4.