[Crash-utility] How to read from a vmcore dump ala /dev/kmem

[Dave Anderson]

----- "John Groves" <John at groves.net> wrote:

> I'm debugging a new driver module using kdump and crash, which is
> great. However, I need to extract a large binary trace buffer for
> analysis by a project-specific program. The buffer contains trace
> entries, most of which contain pointers to strings and other stuff
> outside the trace buffer. So my trace analyzer needs to get the big
> buffer, and than read other virtual addresses referenced by the big
> buffer.
> 
> On live kernels, my trace module facilitates grabbing the necessary
> memory via ioctls in my trace module (In 2.4 I used /dev/kmem, but
> that stopped working in early 2.6, and I don't know the current state
> since the current approach works fine). I need a way to do the same
> thing from a vmcore file.
> 
> Clearly the answer is in the crash program source code, but I'm
> wondering if there is a "libcrash" or "libvmcore" or some such that
> might save me some time in that area.

It's not clear to me exactly what you are looking for, but it
sounds like you want to extract a buffer of memory from a vmcore
and store it in some external file -- and then based upon its
contents, make several more secondary reads of the vmcore?

There's no specific command that does that, i.e, that reads a chunk
of memory and then store it in a file as is.  That actually sounds
like a reasonable option to the "rd" command, i.e., instead of 
formatting/dumping the memory, have it output it the data directly
to a file, or stdout, or whatever.  

In any case, you could fairly easily hack up the cmd_test() function
in test.c to use the readmem() function to read the buffer of data from
the vmcore into a local buffer, and then open and write it out to a
file.  Then you'd have to parse the stored buffer, come up with a
secondary list of memory locations to read, and do the same thing
again?  

Dave