Re: [Crash-utility] [PATCH] Expanded search capability for crash
----- Original Message -----
This patch adds options to crash's search command that allow
searches
for character strings (-c), unsigned hexadecimal integer values (-w),
and unsigned hexadecimal short values (-h). The integer and short
values are searched on integer and short alignments respectively.
Strings are searched across contiguous page boundaries, which can cause
possibly confusing behavior since contiguity is affected by the type of
search. For example, a page-crossing string found in a user virtual
address search might not be found in a kernel virtual address search if
the kernel pages mapped to the user address space are not contiguous.
The patch is for crash-5.1.2 and has been tested on an x86_64 system.
This looks good -- let me play around with it for a bit...
Some last minute caveats on with search due to the parser (worth putting
in help?):
All numbers are interpreted as hex numbers, regardless of starting
character.
That's always been in the help page:
crash> help search
NAME
search - search memory
SYNOPSIS
search [-s start | -[kKV] | -u | -p ] [-e end | -l length] [-m mask] value ...
... [ cut ] ...
-m mask Ignore the bits that are set in the hexadecimal mask value.
value Search for this hexadecimal value.
Double quotes are magic to crash's parser, so strings of almost anything
can be enclosed in "", for example: "can't".
Single quotes mean nothing, so searching for 'dog' is the same as
searching for "'dog'".
Yeah, I understand that encompassing double-quotes are not necessary
if the string has no spaces, but I think that the use of encompassing quotes
should be encouraged in the help page. Your example shows it, but the
the description of -c doesn't.
And thinking about it, it would be impossible (as-is) to search for a string
that has a double-quote character in it. Not sure whether it's worth
going down the road of trying to handle that.
Anyway, this looks good.
Thanks,
Dave