Re: [Crash-utility] kmap
----- "Darrin Thompson" <darrinth(a)gmail.com> wrote:
I'm finding a problem struct page in a kdump. I want to trace
down
what that page is referring to. For instance, if I could execute
kmap(page), and run rd the pointer returned, what would I find there?
I realize that this may not always be possible. What is the right way
to attempt it? This is x86_64 if it matters.
If it's an x86_64, then calling kmap(page) ends up doing this
on the page struct address:
__va(page_to_pfn(page) << PAGE_SHIFT);
So, I'm presuming that you know the page structure address, but you
want to know how to access the page data via its kmap'd virtual
address.
So for example, suppose I know that the page structure address
is ffff8100006ef680, then "kmem -p <page-address> shows the
physical address of the referenced page:
crash> kmem -p ffff8100006ef680
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffff8100006ef680 2b0000 0 0 1 400
crash>
For x86_64, then it's simply a matter of changing the physical
address into its unity-mapped kernel virtual address (i.e. as
returned by the __va() macro):
crash> ptov 2b0000
VIRTUAL PHYSICAL
ffff8100002b0000 2b0000
crash>
So kmap(0xffff8100006ef680) would return ffff8100002b0000, which
you can "rd":
crash> rd ffff8100002b0000 10
ffff8100002b0000: 0100c70000080805 fff0db31fb000000 ............1...
ffff8100002b0010: 8b485500313e6b05 c931c03145302454 .k>1.UH.T$0E1.1.
ffff8100002b0020: 03f8ba046a0c7a8b 8d4c2c24748b0000 .z.j.......t$,L.
ffff8100002b0030: f5e800000090248c fffffb37e9ffffe4 .$..........7...
ffff8100002b0040: 03398330244c8b48 798300000156860f H.L$0.9...V....y
crash>
Or for what it's worth, you can just read the data using the physical
address:
crash> rd -p 2b0000 10
2b0000: 0100c70000080805 fff0db31fb000000 ............1...
2b0010: 8b485500313e6b05 c931c03145302454 .k>1.UH.T$0E1.1.
2b0020: 03f8ba046a0c7a8b 8d4c2c24748b0000 .z.j.......t$,L.
2b0030: f5e800000090248c fffffb37e9ffffe4 .$..........7...
2b0040: 03398330244c8b48 798300000156860f H.L$0.9...V....y
crash>
I *think* that's what's your asking...
Dave