Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!uakari.primate.wisc.edu!aplcen!boingo.med.jhu.edu!haven.umd.edu!socrates.umd.edu!berry
From: berry@socrates.umd.edu (Joseph Berry     )
Newsgroups: comp.unix.aix
Subject: Re: Question abt /etc/crash & proc struct
Keywords: crash kernel proc kmem
Message-ID: <1991Jun21.220703.29985@socrates.umd.edu>
Date: 21 Jun 91 22:07:03 GMT
References: <1991Jun19.151832.17038@socrates.umd.edu> <8633@awdprime.UUCP> <1991Jun21.151601.29883@batcomputer.tn.cornell.edu>
Organization: University of Maryland, University College
Lines: 20

Melinda and everyone else...

I got a very nice answer from an IBM software representative in Munich that
understood and told me the solution to my problem.  On other UNIXs, accessing
any area in the kernel can be done by simply doing an lseek followed by a
read of the structure of interest.  I had the address of the PROC structure
from the nlist procedure (indirect, of course).  That address was BIG.  Lseek
failed, /etc/crash failed (when using 'od' as opposed to the formatted
proc output).  

I finally found the answer both by Werner's assistance and by use of 
infoexplorer (although the function I wanted wasn't exactly documented 
as it should have been).  The key was use of procedure 'readx'.  Lseek cannot
access an address that is in the address space above 2 gigabytes; my pointer
was out there.  For that, you must use readx.  Something to remember when
you find yourself needing direct access of that table <GRIN>.  THanks to
everyone for their suggestions.

Joe Berry