----- "John Groves" <John@xxxxxxxxxx> wrote: > I'm debugging a new driver module using kdump and crash, which is > great. However, I need to extract a large binary trace buffer for > analysis by a project-specific program. The buffer contains trace > entries, most of which contain pointers to strings and other stuff > outside the trace buffer. So my trace analyzer needs to get the big > buffer, and than read other virtual addresses referenced by the big > buffer. > > On live kernels, my trace module facilitates grabbing the necessary > memory via ioctls in my trace module (In 2.4 I used /dev/kmem, but > that stopped working in early 2.6, and I don't know the current state > since the current approach works fine). I need a way to do the same > thing from a vmcore file. > > Clearly the answer is in the crash program source code, but I'm > wondering if there is a "libcrash" or "libvmcore" or some such that > might save me some time in that area. It's not clear to me exactly what you are looking for, but it sounds like you want to extract a buffer of memory from a vmcore and store it in some external file -- and then based upon its contents, make several more secondary reads of the vmcore? There's no specific command that does that, i.e, that reads a chunk of memory and then store it in a file as is. That actually sounds like a reasonable option to the "rd" command, i.e., instead of formatting/dumping the memory, have it output it the data directly to a file, or stdout, or whatever. In any case, you could fairly easily hack up the cmd_test() function in test.c to use the readmem() function to read the buffer of data from the vmcore into a local buffer, and then open and write it out to a file. Then you'd have to parse the stored buffer, come up with a secondary list of memory locations to read, and do the same thing again? Dave -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility
