1
.TH MAKEDUMPFILE.CONF 5 "12 September 2011" "makedumpfile v1.4.0" "Linux System Administrator's Manual"
3
makedumpfile.conf \- The filter configuration file for makedumpfile(8).
6
The makedumpfile.conf is a configuration file for makedumpfile tool.
7
makedumpfile.conf file contains the erase commands to filter out desired kernel
8
data from the vmcore while creating \fIDUMPFILE\fR using makedumpfile tool.
9
makedumpfile reads the filter config and builds the list of memory addresses
10
and its sizes after processing filter commands. The memory locations that
11
require to be filtered out are then poisoned with character \fIX\fR (58 in Hex).
14
The file consists of module sections that contains filter commands. A section
15
begins with the name of the section in square brackets and continues until the
19
"["<\fIModuleName\fR>"]"
21
<\fIFilterCommands\fR>
26
"[" is the character \fB[\fR
28
"]" is the character \fB]\fR
31
is either 'vmlinux' or name of a Linux kernel module.
33
<\fIFilterCommands\fR>
34
is a list of one or more filter commands as described in the section
35
\fBFILTER COMMANDS\fR of this manual page.
37
The section name indicates a kernel module name (including \fBvmlinux\fR) where
38
the symbols specified in subsequent erase commands belong to. The unnamed
39
section defaults to \fB[vmlinux]\fR section. However, a user can also explicitly
40
define \fB[vmlinux]\fR section. The sections help makedumpfile tool to select
41
appropriate kernel or module debuginfo file before processing the subsequent
42
erase commands. Before selecting appropriate debuginfo file, the module name
43
is validated against the loaded modules from the vmcore. If no match is found,
44
then the section is ignored and makedumpfile skips to the next module section.
45
If match is found, then makedumpfile will try to load the corresponding
46
module debuginfo file. If module debuginfo is not available then, makedumpfile
47
will skip the section with a warning message.
51
A filter command is either an erase command or a loop construct. Each erase
52
command and loop construct must start with a new line. Each filter command
53
describes data in the dump to be erased. Syntax:
56
<\fIEraseCommands\fR>|<\fILoopConstruct\fR>
62
Described in the subsection \fBerase command\fR of this manual page.
65
Described in the subsection \fBLoop construct\fR of this manual page.
68
Erase specified size of a kernel data referred by specified kernel/module
69
symbol or its member component. The erase command syntax is:
72
\fBerase\fR <\fISymbol\fR>[.\fImember\fR[...]] [\fBsize\fR
73
<\fISizeValue\fR>[K|M]]
75
\fBerase\fR <\fISymbol\fR>[.\fImember\fR[...]] [\fBsize\fR <\fISizeSymbol\fR>]
77
\fBerase\fR <\fISymbol\fR>[.\fImember\fR[...]] [\fBnullify\fR]
84
A kernel or module symbol (variable) name that is part of global symbols
88
A positive integer value as a size of the data in bytes to be erased. The
89
suffixes 'K' and 'M' can be used to specify kilobytes and Megabytes
90
respectively where, K means 1024 bytes and M means 1024 ^ 2 = 1048576 bytes.
91
The suffixes are not case sensitive.
94
A simple expression of the form <\fISymbol\fR>[.\fImember\fR[...]] that denotes
95
a symbol which contains a positive integer value as a size of the data in bytes
98
<\fISymbol\fR>[.\fImember\fR[...]]
99
A simple expression that results into either a global kernel symbol name or
100
its member components. The expression always uses '.' operator to specify
101
the \fImember\fR component of kernel symbol or its member irrespective of
102
whether it is of pointer type or not.
105
Member or component of member in <\fISymbol\fR>.
107
The \fBerase\fR command takes two arguments 1. kernel symbol name or its
108
member components and 2. size of the data referred by argument (1) OR
109
\fBnullify\fR keyword. The second argument \fBsize\fR OR \fBnullify\fR is
110
optional. The unit for size value is in \fBbytes\fR. If \fBsize\fR option is
111
not specified then the size of the first argument is determined according to
112
its data type using dwarf info from debuginfo file. In case of '\fBchar *\fR'
113
data type, the length of string pointed by '\fBchar *\fR' pointer is determined
114
with an upper limit of 1024. The \fBsize\fR can be specified in two forms 1.
115
a integer value as explained above (<\fISizeValue\fR>) and 2. a simple
116
expression in the form of <\fISymbol\fR>[.\fImember\fR[...]]] that results into
117
base type (integer) variable.
119
If the specified <\fISymbol\fR> is of type '\fBvoid *\fR', then user needs to
120
provide either \fBsize\fR or \fBnullify\fR option, otherwise the erase command
121
will not have any effect.
123
The \fBnullify\fR option only works if specified <\fISymbol\fR> is a pointer.
124
Instead of erasing data pointed by the specified pointer \fBnullify\fR erases
125
the pointer value and set it to '0' (NULL). Please note that by nullifying
126
the pointer values may affect the debug ability of created \fIDUMPFILE\fR.
127
Use the \fBnullify\fR option only when the size of data to be erased is not
128
known. \fBe.g.\fR data pointed by '\fBvoid *\fR'.
130
Let us look at the makedumpfile.conf file from the example below which was
131
configured to erase desired kernel data from the kernel module with name
132
\fBmymodule\fR. At line 1 and 3, the user has not specified size option while
133
erasing 'array_var' and 'mystruct1.name' symbols. Instead the user depends on
134
makedumpfile to automatically determine the sizes to be erased \fBi.e\fR
135
100 bytes for 'array_var' and 11 bytes for 'mystruct1.name'. At line 2,
136
while erasing the 'mystruct1.buffer' member the user has specified the size
137
value 25 against the actual size of 50. In this case the user specified
138
\fBsize\fR takes the precedence and makedumpfile erases only 25 bytes from
139
\'mystruct1.buffer'. At line 4, the size of the data pointed by \fBvoid *\fR
140
pointer 'mystruct1.addr' is unknown. Hence the \fBnullify\fR option has been
141
specified to reset the pointer value to NULL. At line 5, the
142
\'mystruct2.addr_size' is specified as \fBsize\fR argument to determine the
143
size of the data pointed by \fBvoid *\fR pointer 'mystruct2.addr'.
148
Assuming the following piece of code is from kernel module 'mymodule':
178
struct s2 *mystruct2;
187
s1.name = "Hello World";
194
\fBmakedumpfile.conf:\fR
200
erase mystruct1.buffer size 25
204
erase mystruct1.addr1 nullify
206
# Assuming addr2 points to 1024 bytes
208
erase mystruct1.addr2 size 1K
210
erase mystruct2.addr size mystruct2.addr_size
216
A Loop construct allows the user to traverse the linked list or array elements
217
and erase the data contents referred by each element.
220
\fBfor\fR <\fIid\fR> \fBin\fR {<\fIArrayVar\fR> |
222
<\fIStructVar\fR> \fBvia\fR <\fINextMember\fR> |
224
<\fIListHeadVar\fR> \fBwithin\fR
225
<\fIStructName\fR>\fB:\fR<\fIListHeadMember\fR>}
227
\fBerase\fR <\fIid\fR>[.\fIMemberExpression\fR]
228
[\fBsize\fR <\fISizeExpression\fR>|\fBnullify\fR]
230
[\fBerase\fR <\fIid\fR>...]
240
Arbitrary name used to temporarily point to elements of the list. This is
241
also called iteration variable.
244
A simple expression in the form of <\fISymbol\fR>[.\fImember\fR[...]] that
245
results into an array variable.
248
A simple expression in the form of <\fISymbol\fR>[.\fImember\fR[...]] that
249
results into a variable that points to a structure.
252
Member within <\fIStructVar\fR> that points to an object of same type that of
256
A simple expression in the form of <\fISymbol\fR>[.\fImember\fR[...]] that
257
results into a variable of type struct list_head.
260
Name of the structure type that can be traversed using HEAD variable
261
<\fIListHeadVar\fR> and contains a member named <\fIListHeadMember\fR>.
263
<\fIListHeadMember\fR>
264
Name of a member in <\fIStructName\fR>, of type struct list_head.
266
<\fIMemberExpression\fR>
267
A simple expression in the form of [.\fImember\fR[...]] to specify a member
268
or component of an element in <\fIArrayVar\fR>, <\fIStructVar\fR>
269
or <\fIStructName\fR>.
271
<\fISizeExpression\fR>
272
Size value in the form of <\fISizeValue\fR>, <\fIid\fR>[.\fIMemberExpression\fR]
273
or <\fISymbol\fR>[.\fImember\fR[...]].
275
The \fBfor\fR loop construct allows to iterate on list of elements in an array
276
or linked lists. Each element in the list is assigned to iteration variable
277
<\fIid\fR>. The type of the iteration variable is determined by that of the
278
list elements. The entry specified after '\fBin\fR' terminal is called LIST
279
entry. The LIST entry can be an array variable, structure variable/pointer or a
280
struct list_head type variable. The set of \fBerase\fR commands specified
281
between \fBfor\fR and \fBendfor\fR, will be executed for each element in the
284
If the LIST entry specified is an array variable, then the loop will be
285
executed for each array element. The size of the array will be determined by
286
using dwarf information.
288
If the LIST entry specified is a structure variable/pointer, then a traversal
289
member (<\fINextMember\fR>) must be specified using '\fBvia\fR' terminal. The
290
\fBfor\fR loop will continue until the value of traversal member is NULL or
291
matches with address of the first node <\fIStructVar\fR> if it is a circular
294
If the LIST entry is specified using a struct list_head type variable, then
295
\fBwithin\fR terminal must be used to specify the structure name
296
<\fIStructName\fR> that is surrounding to it along with the struct list_head
297
type member after '\fB:\fR' which is part of the linked list. In the erase
298
statement <\fIid\fR> then denotes the structure that the list_head is
299
contained in (ELEMENT_OF).
301
The below example illustrates how to use loop construct for traversing
302
Array, linked list via next member and list_head.
306
Assuming following piece of code is from kernel module 'mymodule':
313
struct list_head list;
328
static LIST_HEAD(s1_list_head);
330
struct s1 myarray[100];
343
s1_ptr = malloc(...);
349
list_add(&s1_ptr->list, &s1_list_head);
356
\fBmakedumpfile.conf:\fR
360
# erase private fields from list starting with mystruct1 connected via
364
for mys1 in mystruct1 via next
368
erase mys1.key size mys1.key_size
373
# erase private fields from list starting with list_head variable
377
for mys1 in s1_list_head.next within s1:list
381
erase mys1.key size mys1.key_size
386
# erase private fields from all elements of the array myarray:
392
erase mys1.key size mys1.key_size
398
In the above example, the first \fBfor\fR construct traverses the linked list
399
through a specified structure variable \fBmystruct1\fR of type \fBstruct s1\fR.
400
The linked list can be traversed using '\fBnext\fR' member of \fBmystruct1\fR.
401
Hence a \fBvia\fR terminal has been used to specify the traversal member
404
The second \fBfor\fR construct traverses the linked list through a specified
405
struct list_head variable \fBs1_list_head.next\fR. The global symbol
406
\fBs1_list_head\fR is a start address of the linked list and its \fBnext\fR
407
member points to the address of struct list_head type member '\fBlist\fR' from
408
\fBstruct s1\fR. Hence a \fBwithin\fR terminal is used to specify the structure
409
name '\fBs1\fR' that can be traversed using \fBs1_list_head.next\fR variable
410
along with the name of struct list_head type member '\fBlist\fR' which is part
411
of the linked list that starts from \fBs1_list_head\fR global symbol.
413
The third \fBfor\fR construct traverses the array elements specified through
414
a array variable \fBmyarray\fR.
added
removed
makedumpfile.conf.5
