Re: [Crash-utility] How to read from a vmcore dump ala /dev/kmem
----- "John Groves" <John(a)groves.net> wrote:
I'm debugging a new driver module using kdump and crash, which
is
great. However, I need to extract a large binary trace buffer for
analysis by a project-specific program. The buffer contains trace
entries, most of which contain pointers to strings and other stuff
outside the trace buffer. So my trace analyzer needs to get the big
buffer, and than read other virtual addresses referenced by the big
buffer.
On live kernels, my trace module facilitates grabbing the necessary
memory via ioctls in my trace module (In 2.4 I used /dev/kmem, but
that stopped working in early 2.6, and I don't know the current state
since the current approach works fine). I need a way to do the same
thing from a vmcore file.
Clearly the answer is in the crash program source code, but I'm
wondering if there is a "libcrash" or "libvmcore" or some such that
might save me some time in that area.
It's not clear to me exactly what you are looking for, but it
sounds like you want to extract a buffer of memory from a vmcore
and store it in some external file -- and then based upon its
contents, make several more secondary reads of the vmcore?
There's no specific command that does that, i.e, that reads a chunk
of memory and then store it in a file as is. That actually sounds
like a reasonable option to the "rd" command, i.e., instead of
formatting/dumping the memory, have it output it the data directly
to a file, or stdout, or whatever.
In any case, you could fairly easily hack up the cmd_test() function
in test.c to use the readmem() function to read the buffer of data from
the vmcore into a local buffer, and then open and write it out to a
file. Then you'd have to parse the stored buffer, come up with a
secondary list of memory locations to read, and do the same thing
again?
Dave