Expanded search capability for crash
 

This patch adds options to crash's search command that allow searches
for character strings (-c), unsigned hexadecimal integer values (-w),
and unsigned hexadecimal short values (-h). The integer and short
values are searched on integer and short alignments respectively.

Strings are searched across contiguous page boundaries, which can cause
possibly confusing behavior since contiguity is affected by the type of
search. For example, a page-crossing string found in a user virtual
address search might not be found in a kernel virtual address search if
the kernel pages mapped to the user address space are not contiguous.

The patch is for crash-5.1.2 and has been tested on an x86_64 system.


Some last minute caveats on with search due to the parser (worth putting
in help?):

All numbers are interpreted as hex numbers, regardless of starting
character.

Double quotes are magic to crash's parser, so strings of almost anything
can be enclosed in "", for example: "can't".

Single quotes mean nothing, so searching for 'dog' is the same as
searching for "'dog'".


Bob Montgomery
--
Crash-utility mailing list
Crash-utility@redhat.com
https://www.redhat.com/mailman/listinfo/crash-utility

Expanded search capability for crash
 

----- Original Message -----
> This patch adds options to crash's search command that allow searches
> for character strings (-c), unsigned hexadecimal integer values (-w),
> and unsigned hexadecimal short values (-h). The integer and short
> values are searched on integer and short alignments respectively.
>
> Strings are searched across contiguous page boundaries, which can cause
> possibly confusing behavior since contiguity is affected by the type of
> search. For example, a page-crossing string found in a user virtual
> address search might not be found in a kernel virtual address search if
> the kernel pages mapped to the user address space are not contiguous.
>
> The patch is for crash-5.1.2 and has been tested on an x86_64 system.

This looks good -- let me play around with it for a bit...

>
> Some last minute caveats on with search due to the parser (worth putting
> in help?):
>
> All numbers are interpreted as hex numbers, regardless of starting
> character.

That's always been in the help page:

crash> help search

NAME
search - search memory

SYNOPSIS
search [-s start | -[kKV] | -u | -p ] [-e end | -l length] [-m mask] value ...

... [ cut ] ...

-m mask Ignore the bits that are set in the hexadecimal mask value.
value Search for this hexadecimal value.

>
> Double quotes are magic to crash's parser, so strings of almost anything
> can be enclosed in "", for example: "can't".
>
> Single quotes mean nothing, so searching for 'dog' is the same as
> searching for "'dog'".

Yeah, I understand that encompassing double-quotes are not necessary
if the string has no spaces, but I think that the use of encompassing quotes
should be encouraged in the help page. Your example shows it, but the
the description of -c doesn't.

And thinking about it, it would be impossible (as-is) to search for a string
that has a double-quote character in it. Not sure whether it's worth
going down the road of trying to handle that.

Anyway, this looks good.

Thanks,
Dave

--
Crash-utility mailing list
Crash-utility@redhat.com
https://www.redhat.com/mailman/listinfo/crash-utility

Expanded search capability for crash
 

----- Original Message -----
> This patch adds options to crash's search command that allow searches
> for character strings (-c), unsigned hexadecimal integer values (-w),
> and unsigned hexadecimal short values (-h). The integer and short
> values are searched on integer and short alignments respectively.
>
> Strings are searched across contiguous page boundaries, which can cause
> possibly confusing behavior since contiguity is affected by the type of
> search. For example, a page-crossing string found in a user virtual
> address search might not be found in a kernel virtual address search if
> the kernel pages mapped to the user address space are not contiguous.
>
> The patch is for crash-5.1.2 and has been tested on an x86_64 system.
>
>
> Some last minute caveats on with search due to the parser (worth putting
> in help?):
>
> All numbers are interpreted as hex numbers, regardless of starting
> character.
>
> Double quotes are magic to crash's parser, so strings of almost anything
> can be enclosed in "", for example: "can't".
>
> Single quotes mean nothing, so searching for 'dog' is the same as
> searching for "'dog'".

Queued for crash-5.1.3 -- really nice addition, Bob.

Thanks,
Dave

--
Crash-utility mailing list
Crash-utility@redhat.com
https://www.redhat.com/mailman/listinfo/crash-utility