Would someone be wiling to verify that I'm doing the right thing in the following?
I have a kernel crash dump from an x64 server with the following backtrace: > $C fffffe800017fc30 strcmp() fffffe800017fc90 vfs_setmntopt_nolock+0x147() fffffe800017fce0 vfs_parsemntopts+0x96() fffffe800017fe10 domount+0xc87() fffffe800017fe90 mount+0x105() fffffe800017fed0 syscall_ap+0x97() fffffe800017ff20 sys_syscall32+0xef() 00000000080b2b80 0xfe45a0cc() > What I'd like to do is print the contents of the vnode_t that is the third argument to domount(). domount() moves %rdx to %r15 (with no intervening overwrite), and vfs_parsemntopts() pushes %r15 onto the stack: > vfs_parsemntopts::dis vfs_parsemntopts: pushq %rbp vfs_parsemntopts+1: movq %rsp,%rbp vfs_parsemntopts+4: pushq %r15 [ ... ] I grab the value off the stack and print it as a vnode_t: > fffffe800017fce0-8/J 0xfffffe800017fcd8: ffffffff827afdc0 > ffffffff827afdc0::print -t vnode_t [ ... ] char *v_path = 0xffffffff97b11e70 "/netapp/some/filesystem" [ ... ] (Filesystem name changed to protect the innocent.) Given that I find something that looks like a vnode_t at that location, I'm inclined to think this is right, but given that I'm fumbling my way through this with the help of Frank Hoffman's book, I'm not willing to rule out the possibility that I've randomly hit a different vnode_t. Thanks, Chad
