Re: [Crash-utility] PATCH 00/10] teach crash to work with "live" ramdump
On 04/25, Dave Anderson wrote:
As I see it, this facility is simply another LIVE_SYSTEM memory source,
of which there currently are /dev/mem, /proc/kcore and /dev/crash.
Yes, if we are talking about 09/10 and 10/10.
The
essential difference between them is the pc->readmem plugin:
The essential difference is that this source is remote. See another email.
The CRASHBUILTIN stuff and related stuff you ran into is only there
because
live system analysis typically does not require a crash command line option,
so crash has to figure what to do when a user just enters "crash".
Ah. Yes, the usage of CRASHBUILTIN is ugly, and I tried to document this.
We need the new (say) RAW_MEM_DUMP flag. We can't use RAMDUMP because it can
be set along with KDUMP.
And there is no room in pc->flags, so I decided to abuse CRASHBUILTIN for now.
Oleg.