Three input files are needed for lcrash:
a map file providing the symbol table of the Kernel,
a dump file containing the image of a system's memory to be analyzed,
an object file in "stabs" debug format providing information of Kernel data types. [1]
Currently lcrash uses positional arguments. To invoke lcrash you can use the following command line: lcrash symbol-table dump-file kern-types
Lcrash knows defaults for its arguments. They are given in table Table 3-1.
Table 3-1. Default values
Parameter | Default |
---|---|
symbol-table | /boot/System.map |
dump-file | /dev/mem |
kern-types | /boot/Kerntypes |
If you are happy with all default values you can call lcrash without any arguments - as shown in the following example.
Example 3-1. Starting Lcrash
bash# lcrash map = /boot/System.map, vmdump = /dev/mem, outfile = stdout, kerntypes = /boot/Kerntypes Please wait... Loading system map .................... Done. Loading type info (Kerntypes) ... Done. Loading ksyms from dump ...... Done. >>
Lcrash only works correctly if symbol-table, kern-types and dump-file are from the same Kernel.
The System.map file is generated automatically when the Kernel is built. It contains symbol names of the Kernel and their corresponding Kernel addresses. Normally it is installed under /boot/System.map.
The file /dev/mem is used for analyzing the running Linux system. For parameter dump-file you can specify a file containing a dump that was generated with dump tools (see chapter \ref{chapter:DumpTools}).
The Kerntypes file is also generated in the Kernel build. But since Kerntypes is not in the standard Linux tree it is necessary to apply a specific "Kerntypes patch" before. The Kerntypes file is compiled with the -gstabs compile option which generates type information for all types defined in the Kerntypes source file. In the Kerntypes source file there are several includes for Kernel header files with important Kernel structures.
The mentioned "Kerntypes patch" and the s390 dump tools can be downloaded from http://oss.software.ibm.com/developerworks/opensource/linux390/exp_src.html
[1] | In fact lcrash uses only type information contained in the "stabs" format. Further debug information of this format is not used. For more information about the "stabs" format please refer to [stabs1997]. |