> >  Anders Magnusson <ragge@ludd.luth.se> wrote:
> >  > - /dev/ksyms, to be able to access an up-to-date symbol table. (as a side
> >  >   effect ps stopped to care about from which kernel the system was loaded :-)
> > 
> > This is pretty cool :-)
> 
> But how would you ps a crash dump?

Just a thaught, typing as it comes along (so don't expect a solid design
ready for implementation): the (uh! beware!) Win32 API has something similar,
but for completely different reasons. The "load an lkm" call is (UNICODE 
related details removed for brevity) LoadLibrary(char *path) and there is an
extended version LoadLibraryEx with an additional flag param
LOAD_LIBRARY_AS_DATAFILE. They use it for something completely unrelated, but
anyway: could the in-kernel loader load a crashdump, mangle its symbols into
another symbol set, and export this alternate set to ps? I.e. could a second
call "load lkm postmortem" be created without too much kernel bloat?


Martin