[Crash-utility] [PATCH] Expanded search capability for crash

[Dave Anderson]

----- Original Message -----
> This patch adds options to crash's search command that allow searches
> for character strings (-c), unsigned hexadecimal integer values (-w),
> and unsigned hexadecimal short values (-h). The integer and short
> values are searched on integer and short alignments respectively.
> 
> Strings are searched across contiguous page boundaries, which can cause
> possibly confusing behavior since contiguity is affected by the type of
> search. For example, a page-crossing string found in a user virtual
> address search might not be found in a kernel virtual address search if
> the kernel pages mapped to the user address space are not contiguous.
> 
> The patch is for crash-5.1.2 and has been tested on an x86_64 system.

This looks good -- let me play around with it for a bit...

> 
> Some last minute caveats on with search due to the parser (worth putting
> in help?):
> 
> All numbers are interpreted as hex numbers, regardless of starting
> character.

That's always been in the help page:

  crash> help search

  NAME
    search - search memory

  SYNOPSIS
    search [-s start | -[kKV] | -u | -p ] [-e end | -l length] [-m mask] value ...

  ... [ cut ] ...

      -m mask  Ignore the bits that are set in the hexadecimal mask value.
        value  Search for this hexadecimal value.

> 
> Double quotes are magic to crash's parser, so strings of almost anything
> can be enclosed in "", for example: "can't".
> 
> Single quotes mean nothing, so searching for 'dog' is the same as
> searching for "'dog'".

Yeah, I understand that encompassing double-quotes are not necessary
if the string has no spaces, but I think that the use of encompassing quotes
should be encouraged in the help page.  Your example shows it, but the
the description of -c doesn't.  

And thinking about it, it would be impossible (as-is) to search for a string
that has a double-quote character in it.  Not sure whether it's worth 
going down the road of trying to handle that. 

Anyway, this looks good.

Thanks,
  Dave