Hello,
I'm new to this group, and fairly new to linux, but have been doing crash
dump analysis under UNIX(tm) almost full time for the past 10 years.. I'm
quite happy to find that this effort is under way. I'll do what I can to
contribute to the effort. Now, a few questions that arose while reading
the FAQ.
The FAQ says that SCSI is required because no raw-io driver exists for IDE
and we don't want to use the buffer cache. I agree that we don't want to
go through the buffer cache... however.. It seems likely to me that the
existing swap IO does not use the buffer cache. Further, since we are using
a swap volume for the storage of the dump... couldn't we just hi-jack the
swap IO mechanisn? Isn't that doing direct IO to disk? Wouldn't that allow
dumps to ide ( or whatever )?
The FAQ warns that you need to recompile lcrash when you make changes to
the kernel. I'm not sure I understand why lcrash would have such
dependencies. Can't it get what information it needs from the kernel
elf/dwarf information? What is compiled into lcrash that would change with
kernel builds. Does this dependency imply that a remote system/user would
have to send in his/her lcrash along with the dump, for someone else
(kernel developer) to be able to 'read' the dump?
The FAQ says that all of memory is dumped, because there is no way to
distinguish what the memory is used for ( user/kernel/free/etc ). Again,
I'm new to linux, but in the UNIX(tm) world, the mmap[] datastructure
accounts for all physical memory, and records the current 'owner' or 'use'
of each page. Is there no equivalent data structure under linux? ( yeah,
I'll go read the source, slowly)
thanks for reading this far. I look forward to your response
- jim
|