1:28 p.m.
On Thu, Oct 13, 2005 at 01:36:45PM -0400, Dave Anderson wrote:
Neil Horman wrote:
> On Thu, Oct 13, 2005 at 01:07:41PM -0400, Dave Anderson wrote:
> > Neil Horman wrote:
> >
> > > Hey all-
> > > If I have a RHEL4 crash dump taken from an AMD x86_64 machine,
should I
> > > be able to examine that vmcore using crash-4.0.1 on a RHEL4 box running on
EM64T
> > > hardware? I would have assumed that I would be able to, but I keep
getting file
> > > format errors when trying to read the core.
> > > Neil
> > >
> >
> > Yes, it should. What's the output look like?
> >
> Here it is. About the only things that stand out to is that the PARTIAL_DUMP
> flag is set in the ELF header. I wouldn't think a partial dump would have
> produced this error message however, since the ELF and program headers are all
> still in tact.
> Neil
>
> crash 4.0-2.6
> Copyright (C) 2002, 2003, 2004, 2005 Red Hat, Inc.
> Copyright (C) 2004, 2005 IBM Corporation
> Copyright (C) 1999-2005 Hewlett-Packard Co
> Copyright (C) 1999, 2002 Silicon Graphics, Inc.
> Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
> This program is free software, covered by the GNU General Public License,
> and you are welcome to change it and/or distribute copies of it under
> certain conditions. Enter "help copying" to see the conditions.
> This program has absolutely no warranty. Enter "help warranty" for
details.
>
> vmcore_data:
> flags: 19 (NETDUMP_LOCAL|NETDUMP_ELF64|PARTIAL_DUMP)
> ndfd: 3
> ofp: 3a20c2d8c0
> header_size: 4096
> num_pt_load_segments: 2
> pt_load_segment[0]:
> file_offset: 1000
> phys_start: 0
> phys_end: e0000000
> pt_load_segment[1]:
> file_offset: e0001000
> phys_start: 100000000
> phys_end: 120000000
> elf_header: 901c70
> elf32: 0
> notes32: 0
> load32: 0
> elf64: 901c70
> notes64: 901cb0
> load64: 901ce8
> nt_prstatus: 901d58
> nt_prpsinfo: 901eb8
> nt_taskstruct: 901f50
> task_struct: 10041f697f0
> page_size: 4096
> switch_stack: 0
> num_prstatus_notes: 1
> nt_prstatus_percpu: 0000000000901d58
>
> Elf64_Ehdr:
> e_ident: \177ELF
> e_ident[EI_CLASS]: 2 (ELFCLASS64)
> e_ident[EI_DATA]: 1 (ELFDATA2LSB)
> e_ident[EI_VERSION]: 1 (EV_CURRENT)
> e_ident[EI_OSABI]: 0 (ELFOSABI_SYSV)
> e_ident[EI_ABIVERSION]: 0
> e_type: 4 (ET_CORE)
> e_machine: 62 (EM_X86_64)
> e_version: 1 (EV_CURRENT)
> e_entry: 0
> e_phoff: 40
> e_shoff: 0
> e_flags: 0
> e_ehsize: 40
> e_phentsize: 38
> e_phnum: 3
> e_shentsize: 0
> e_shnum: 0
> e_shstrndx: 0
> Elf64_Phdr:
> p_type: 4 (PT_NOTE)
> p_offset: 232 (e8)
> p_vaddr: 0
> p_paddr: 0
> p_filesz: 556 (22c)
> p_memsz: 0 (0)
> p_flags: 0 ()
> p_align: 0
> Elf64_Phdr:
> p_type: 1 (PT_LOAD)
> p_offset: 4096 (1000)
> p_vaddr: 10000000000
> p_paddr: 0
> p_filesz: 3758096384 (e0000000)
> p_memsz: 3758096384 (e0000000)
> p_flags: 7 (PF_X|PF_W|PF_R)
> p_align: 4096
> Elf64_Phdr:
> p_type: 1 (PT_LOAD)
> p_offset: 3758100480 (e0001000)
> p_vaddr: 10100000000
> p_paddr: 100000000
> p_filesz: 536870912 (20000000)
> p_memsz: 536870912 (20000000)
> p_flags: 7 (PF_X|PF_W|PF_R)
> p_align: 4096
> Elf64_Nhdr:
> n_namesz: 4 ("CORE")
> n_descsz: 336
> n_type: 1 (NT_PRSTATUS)
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000003 0000007fbffffad0
> 000001011fada244 0000000000000004
> 00000000000001c7 000001011fada240
> 0000000000000246 0000007fbffff201
> 0000007fbffff760 0000007fbffff508
> 000001011fada370 0000007fbffff201
> 0000000000000004 0000010111a49ef8
> 000001011fada244 ffffffffffffffff
> ffffffff80177cf8 0000000000000010
> 0000000000010202 0000010111a49ea0
> 0000000000000018 0000002a9589fb00
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> Elf64_Nhdr:
> n_namesz: 4 ("CORE")
> n_descsz: 136
> n_type: 3 (NT_PRPSINFO)
> 0000000000005200 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0078756e696c6d76
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000
> 0000000000000000
> Elf64_Nhdr:
> n_namesz: 4 ("CORE")
> n_descsz: 16
> n_type: 4 (NT_TASKSTRUCT)
> 0000010041f697f0 0000000000000000
> Elf64_Nhdr:
> n_namesz: 4 ("CORE")
> n_descsz: 4
> n_type: 70000001 (NT_DISKDUMP)
> 00000001
> crash: /boot/vmlinuz-2.6.9-22.ELsmp: not a supported file format
>
> Usage:
> crash [-h [opt]][-v][-s][-i file][-d num] [-S] [mapfile] [namelist] [dumpfile]
>
> Enter "crash -h" for details.
/boot/vmlinuz-2.6.9-22.ELsmp?
Use the vmlinux file (with an 'x').
Dave
Gaaaghhhhh! I'm a moron! But I'm going to blame tab completion on my
screw up.
Thanks, and sorry for the spam. :)
Neil
--
/***************************************************
*Neil Horman
*Software Engineer
*Red Hat, Inc.
*nhorman(a)redhat.com
*gpg keyid: 1024D / 0x92A74FA1
*http://pgp.mit.edu
***************************************************/