[Crash-utility] core file contents

[Dave Anderson]

----- "tom anderson" <xentoma at hotmail.com> wrote:

> I have two different core files generated from two different kernels.
> I noticed one contains all segments
> 
> crash> sym -m dpm_kstat
> ffffffffa00c4000 MODULE START: my_kstat
> ...
> ffffffffa00c5290 (t) kstat_numrange_create
> ffffffffa00c55a0 (r) __func__.41073
> ...
> ffffffffa00c5ddb (r) __kstrtab_kstat_numrange_iter_init
> ffffffffa00c5e60 (d) dprintflevel_kstat
> ...
> ffffffffa00c5f40 (d) __this_module
> ffffffffa00c61a0 (b) kstat_spinlock
> ...
> ffffffffa00c6e5e MODULE END: my_kstat
> 
> 
> 
> while the other contains only text segments. Is there some define in
> the kernel config or in core file generation which causes this?
> 
> 
> crash> sym -m dpm_kstat
> ffffffffa00b9000 MODULE START: dpm_kstat
> ffffffffa00b9000 (t) kstat_cmd_gettbl
> ffffffffa00b9930 (t) kstat_exit
> ffffffffa00b9930 (t) cleanup_module
> ffffffffa00b9a20 (t) kstat_init
> ffffffffa00b9a20 (t) init_module
> ffffffffa00b9bb0 (t) kstat_unregister_provider
> ffffffffa00b9c90 (t) kstat_register_provider
> ffffffffa00b9dc0 (t) kstat_numrange_dprintf
> ffffffffa00b9fa0 (t) kstat_numrange_match
> ffffffffa00b9fe0 (t) kstat_numrange_iter_init
> ffffffffa00ba060 (t) kstat_numrange_destroy
> ffffffffa00ba0a0 (t) kstat_numrange_addentry
> ffffffffa00ba1e0 (t) kstat_numrange_create
> ffffffffa00bb5af MODULE END: dpm_kstat

I'm not exactly sure.

Typically if you display the module contents by getting the module
address from the "mod" command output, and dump it like so:

  crash> module <address>

the "num_symtab" field will be roughly equal to the symbol count:

  crash> mod | grep ext4
  ffffffffa020e260  ext4                 353979  (not loaded)  [CONFIG_KALLSYMS]
  crash> module.num_symtab ffffffffa020e260
    num_symtab = 1080, 
  crash> sym -m ext4 | wc -l
  1081
  crash>

When you do the "mod" command on the two different kernels,
does it show "[CONFIG_KALLSYMS" on the end of each module's
line?  If not, that may have something to do with it.
  
And if you run the "mod" command to load the debuginfo
data of that module, it's possible that a subsequent
"sym -m <module>" command may show additional symbols.

Dave