[Crash-utility] xendump image with full-vitualized domain

[Dave Anderson]

Kazuo Moriwaka wrote:

> Hi,
>
> I tried to analise full-virtualized domain's dump image with crash.
> It abortes with following message.
>
> $ crash System.map-2.6.8-2-386 vmlinux-2.6.8-2-386 2006-1110-1141.38-guest2.4.core
> (snip)
> crash: cannot determine vcpu_guest_context.ctrlreg offset
>
> Full-virtualized domain's kernel doeesn't have any information about
> xen-hypervisor, it also doesn't have struct vcpu_guest_context.
> I'll put kernels and xendump core files at following for reference.
>
> http://people.valinux.co.jp/~moriwaka/domUcore/
>   host.tar.gz  - xen hypervisor and dom0 kernel(for amd64)
>   full-virtualized-guest.tar.gz - domU kernel(for i386) and dump image
>                                   taken by 'xm dump-core' command.
>
> any ideas?

No surprise here -- there's absolutely no crash utility support for
xendumps of fully-virtualized kernels.

Much of the information that crash uses to find its way
around a xendump currently depends upon information
*inside* the para-virtualized kernel.  In your attempt above,
it needs data structure information for the vcpu_guest_context
structure, in order to get a cr3 value -- which it uses to find the
phys_to_machine_mapping[] array built into the kernel.

But obviously there is no phys_to_machine_mapping[]
array in fully-virtualized kernels, so no pseudo-to-physical
address translations can be made.

I'm not sure what the best solution is for fully-virtualized
kernels.

Perhaps what is needed is yet another tool that takes
a xendump of a fully-virtualized kernel, and turns it into
a recognizable vmcore?

Whatever it is, an alternative manner of translating the
"physical" addresses in the fully-virtualized kernel (which
become pseudo-physical addresses in the xen environment)
and find them in the xendump.

Dave