Kazuo Moriwaka wrote:
 Hi,
 I tried to analise full-virtualized domain's dump image with crash.
 It abortes with following message.
 $ crash System.map-2.6.8-2-386 vmlinux-2.6.8-2-386 2006-1110-1141.38-guest2.4.core
 (snip)
 crash: cannot determine vcpu_guest_context.ctrlreg offset
 Full-virtualized domain's kernel doeesn't have any information about
 xen-hypervisor, it also doesn't have struct vcpu_guest_context.
 I'll put kernels and xendump core files at following for reference.
 
http://people.valinux.co.jp/~moriwaka/domUcore/
   host.tar.gz  - xen hypervisor and dom0 kernel(for amd64)
   full-virtualized-guest.tar.gz - domU kernel(for i386) and dump image
                                   taken by 'xm dump-core' command.
 any ideas? 
No surprise here -- there's absolutely no crash utility support for
xendumps of fully-virtualized kernels.
Much of the information that crash uses to find its way
around a xendump currently depends upon information
*inside* the para-virtualized kernel.  In your attempt above,
it needs data structure information for the vcpu_guest_context
structure, in order to get a cr3 value -- which it uses to find the
phys_to_machine_mapping[] array built into the kernel.
But obviously there is no phys_to_machine_mapping[]
array in fully-virtualized kernels, so no pseudo-to-physical
address translations can be made.
I'm not sure what the best solution is for fully-virtualized
kernels.
Perhaps what is needed is yet another tool that takes
a xendump of a fully-virtualized kernel, and turns it into
a recognizable vmcore?
Whatever it is, an alternative manner of translating the
"physical" addresses in the fully-virtualized kernel (which
become pseudo-physical addresses in the xen environment)
and find them in the xendump.
Dave