Chapter 3. General Usage

Table of Contents
Invoking Lcrash
User Interface

Invoking Lcrash

Three input files are needed for lcrash:

Currently lcrash uses positional arguments. To invoke lcrash you can use the following command line: lcrash symbol-table dump-file kern-types

Lcrash knows defaults for its arguments. They are given in table Table 3-1.

Table 3-1. Default values

ParameterDefault
symbol-table/boot/System.map
dump-file/dev/mem
kern-types/boot/Kerntypes

If you are happy with all default values you can call lcrash without any arguments - as shown in the following example.

Example 3-1. Starting Lcrash

bash# lcrash                 
map = /boot/System.map, vmdump = /dev/mem, outfile = stdout, kerntypes = /boot/Kerntypes

Please wait...
    Loading system map .................... Done.
    Loading type info (Kerntypes) ... Done.
    Loading ksyms from dump ...... Done.
>>
      

Lcrash only works correctly if symbol-table, kern-types and dump-file are from the same Kernel.

The System.map file is generated automatically when the Kernel is built. It contains symbol names of the Kernel and their corresponding Kernel addresses. Normally it is installed under /boot/System.map.

The file /dev/mem is used for analyzing the running Linux system. For parameter dump-file you can specify a file containing a dump that was generated with dump tools (see chapter \ref{chapter:DumpTools}).

The Kerntypes file is also generated in the Kernel build. But since Kerntypes is not in the standard Linux tree it is necessary to apply a specific "Kerntypes patch" before. The Kerntypes file is compiled with the -gstabs compile option which generates type information for all types defined in the Kerntypes source file. In the Kerntypes source file there are several includes for Kernel header files with important Kernel structures.

The mentioned "Kerntypes patch" and the s390 dump tools can be downloaded from http://oss.software.ibm.com/developerworks/opensource/linux390/exp_src.html

Notes

[1]

In fact lcrash uses only type information contained in the "stabs" format. Further debug information of this format is not used. For more information about the "stabs" format please refer to [stabs1997].