Re: [Crash-utility] xendump image with full-vitualized domain

Kazuo Moriwaka wrote: > Hi, > > I tried to analise full-virtualized domain's dump image with crash. > It abortes with following message. > > $ crash System.map-2.6.8-2-386 vmlinux-2.6.8-2-386 2006-1110-1141.38-guest2.4.core > (snip) > crash: cannot determine vcpu_guest_context.ctrlreg offset > > Full-virtualized domain's kernel doeesn't have any information about > xen-hypervisor, it also doesn't have struct vcpu_guest_context. > I'll put kernels and xendump core files at following for reference. > > http://people.valinux.co.jp/~moriwaka/domUcore/ > host.tar.gz - xen hypervisor and dom0 kernel(for amd64) > full-virtualized-guest.tar.gz - domU kernel(for i386) and dump image > taken by 'xm dump-core' command. > > any ideas? No surprise here -- there's absolutely no crash utility support for xendumps of fully-virtualized kernels. Much of the information that crash uses to find its way around a xendump currently depends upon information *inside* the para-virtualized kernel. In your attempt above, it needs data structure information for the vcpu_guest_context structure, in order to get a cr3 value -- which it uses to find the phys_to_machine_mapping[] array built into the kernel.

But obviously there is no phys_to_machine_mapping[] array in fully-virtualized kernels, so no pseudo-to-physical address translations can be made.

I'm not sure what the best solution is for fully-virtualized kernels. Perhaps what is needed is yet another tool that takes a xendump of a fully-virtualized kernel, and turns it into a recognizable vmcore? Whatever it is, an alternative manner of translating the "physical" addresses in the fully-virtualized kernel (which become pseudo-physical addresses in the xen environment) and find them in the xendump.