Re: [Crash-utility] [ANNOUNCE][RFC] gcore extension module: user-mode process core dump

gcore extension module provides a means to create ELF core dump for user-mode process that is contained within crash kernel dump. I design this to behave as kernel's ELF core dumper. For previous discussion, see: https://www.redhat.com/archives/crash-utility/2010-August/msg00001.html

Compared with the previous version, this release: - supports more kernel versions, and - collects register values more accurately (but still not perfect). Support Range ============= |----------------+----------------------------------------------| | ARCH | X86, X86_64 | |----------------+----------------------------------------------| | Kernel Version | RHEL4.8, RHEL5.5, RHEL6.0 and Vanilla 2.6.36 | |----------------+----------------------------------------------|

2080 1490 0 ffff880079ed2480 RU 7.6 289900 159684 crash

2080 1490 0 ffff880079ed2480 RU 7.6 289900 159684 crash

TODO ==== I have still remaining tasks to do: - Improvement on register collection for active tasks - Improvement on callee-saved register collection on x86_64 - Support core dump for tasks running in x86_32 compatibility mode Usage ===== 1) Expand source files under extensions directory. Arrange the attached source files as shown below: ./extensions/gcore.c ./extensions/gcore.mk ./extensions/libgcore/gcore_coredump.c ./extensions/libgcore/gcore_coredump_table.c ./extensions/libgcore/gcore_defs.h ./extensions/libgcore/gcore_dumpfilter.c ./extensions/libgcore/gcore_global_data.c ./extensions/libgcore/gcore_regset.c ./extensions/libgcore/gcore_verbose.c ./extensions/libgcore/gcore_x86.c 2) Type ``make extensions''; then, ``gcore.so'' is generated under extensions directory. 3) Type ``extend gcore.so'' to load gcore extension module. Look at help message for actual usage: I attach the help message at the end of this mail. 4) Type ``extend -u gcore.so'' to unload gcore extension module. Help Message ============ NAME gcore - gcore - retrieve a process image as a core dump SYNOPSIS gcore gcore [-v vlevel] [-f filter] [pid | taskp]* This command retrieves a process image as a core dump. DESCRIPTION -v Display verbose information according to vlevel: progress library error page fault --------------------------------------- 0 1 x 2 x 4 x (default) 7 x x x -f Specify kinds of memory to be written into core dumps according to the filter flag in bitwise: AP AS FP FS ELF HP HS ------------------------------ 0 1 x 2 x 4 x 8 x 16 x x 32 x 64 x 127 x x x x x x x AP Anonymous Private Memory AS Anonymous Shared Memory FP File-Backed Private Memory FS File-Backed Shared Memory ELF ELF header pages in file-backed private memory areas HP Hugetlb Private Memory HS Hugetlb Shared Memory If no pid or taskp is specified, gcore tries to retrieve the process image of the current task context. The file name of a generated core dump is core.<pid> where pid is PID of the specified process. For a multi-thread process, gcore generates a core dump containing information for all threads, which is similar to a behaviour of the ELF core dumper in Linux kernel. Notice the difference of PID on between crash and linux that ps command in crash utility displays LWP, while ps command in Linux thread group tid, precisely PID of the thread group leader. gcore provides core dump filtering facility to allow users to select what kinds of memory maps to be included in the resulting core dump. There are 7 kinds memory maps in total, and you can set it up with set command. For more detailed information, please see a help command message. EXAMPLES Specify the process you want to retrieve as a core dump. Here assume the process with PID 12345. crash> gcore 12345 Saved core.12345 crash> Next, specify by TASK. Here assume the process placing at the address f9d7000 with PID 32323. crash> gcore f9d78000 Saved core.32323 crash> If multiple arguments are given, gcore performs dumping process in the order the arguments are given. crash> gcore 5217 ffff880136d72040 23299 24459 ffff880136420040 Saved core.5217 Saved core.1130 Saved core.1130 Saved core.24459 Saved core.30102 crash> If no argument is given, gcore tries to retrieve the process of the current task context. crash> set PID: 54321 COMMAND: "bash" TASK: e0000040f80c0000 CPU: 0 STATE: TASK_INTERRUPTIBLE crash> gcore Saved core.54321 When a multi-thread process is specified, the generated core file name has the thread leader's PID; here it is assumed to be 12340. crash> gcore 12345 Saved core.12340 It is not allowed to specify two same options at the same time. crash> gcore -v 1 1234 -v 1 Usage: gcore gcore [-v vlevel] [-f filter] [pid | taskp]* gcore -d Enter "help gcore" for details. It is allowed to specify -v and -f options in a different order. crash> gcore -v 2 5201 -f 21 ffff880126ff9520 5205 Saved core.5174 Saved core.5217 Saved core.5167 crash> gcore 5201 ffff880126ff9520 -f 21 5205 -v 2 Saved core.5174 Saved core.5217 Saved core.5167 Signed-off-by: HATAYAMA Daisuke <d.hatayama(a)jp.fujitsu.com&gt; [Text File:gcore.c] [Text File:gcore.mk] [Text File:gcore_coredump.c] [Text File:gcore_coredump_table.c] [Text File:gcore_defs.h] [Text File:gcore_dumpfilter.c] [Text File:gcore_global_data.c] [Text File:gcore_regset.c] [Text File:gcore_verbose.c] [Text File:gcore_x86.c]