Bernhard Walle wrote: > Dave Anderson wrote: > > Actually this patch has just turned up different issues > that have to be handled, because the e_type and e_phnum > get deferred until after the e_machine and endianness > are checked. > > Among them the fact that an i386 xen guest core file > taken by an x86_64 host has the e_machine type set > to x86_64 (don't ask me why they did that...), and has > an e_phnum of 0. Anyway, that requires the e_phnum > to be checked *before* the machine type and endianness. > > And another, since the e_type doesn't get checked > until *after* the machine type and endianness, > it allows the vmlinux file (ET_EXEC) to get passed > through, which can generate a bogus error message > about the vmlinux file! > > And there's probably others... > > There was a method to my madness in the way it's written > now. I'm going to have to spend some more time with > this because I don't want to introduce false alarms > or print error messages that don't make any sense... *Arrrg*, sorry for not taking all this into account. I only tested with a few Kdump dumps from different architectures, but not with Xen dumps. You're right, and I'll send a new patch that tries to handle all this. But probably next year ...