From: Castor Fu <castor@3p...> - 2002-07-11 18:34:33
On Thu, 11 Jul 2002, Andreas Herrmann wrote:
> Michael and I tried again to read an i386 "legacy dump" and
> it works fine for us.
Thanks for looking into this.
> Can you tell me, what address the symbol high_memory has
> in the System.map of your dump?
> lcrash tries to read the value stored
> at high_memory.
40445d08 B high_memory
> The address to be accessed is rather high:
> (IMHO, the address is not contained in your dump
> or do you have a system with 2GB of mem?)
> hex: 0x80445d08
> decimal: 2151963912
> You could try to start lcrash with "-f" option.
> Possibly lcrash comes up. But only some commands
> are trustworthy then (e.g. "dump -p", "stat", "print",
> possibly "dis" are working but "module" and "task"
> won't work).
> Another point of failure is PAGE_OFFSET.
> It is defined fixed as 0xc0000000.
That's the cause. . . .PAGE_OFFSET in our system was moved down
> But if you are running a (2.2 ?) kernel with a different
> page offset lcrash will definitily fail.
> So we might think of another change of the dump_header_t
> or dump_header_asm_t to store the PAGE_OFFSET, too.
That might be best. One fallback would be to look for a well-known
pattern, e.g. the beginning of linux_banner, and find the best match.
I don't know how common it is to tweak PAGE_OFFSET, but I'd like
to be able to take an off-the-shelf 'lcrash' and use it on one
of our dumps.
Another thing which I noticed which we SHOULD be able to do automatically
is calculate the thread size. We can get this from the type information.
'crash' gets it from the size of the 'task_union' structure.
> The question is, whether we should support old
> dump formats at all. I think we should do so -- to a
> certain extent.
> For previous lkcd releases you should save the lcrash
> version with your dumps, because lcrash was build exactly
> for the kernel that you dumped. And we have a fixed
> lkcd/lcrash release that works fine for old dumps.
That's true. It's one of the reasons why lcrash gets saved
with the dump. Of course, part of the reason for working on lcrash
for me is usually to extract additional info from a dump that I get back
from the field.