Re: Troubles analyzing crash dumps from xl dump-core

[Roman Shaposhnik <roman@xxxxxxxxxx>]

On Fri, Jan 29, 2021 at 11:28 PM Jürgen Groß <jgross@xxxxxxxx> wrote:
>
> On 29.01.21 21:12, Roman Shaposhnik wrote:
> > Hi!
> >
> > I'm trying to see how much mileage I can get out of
> > crash(1) 7.2.8 (based on gdb 7.6) when it comes to
> > analyzing crash dumps taken via xl dump-core (this
> > is all on x86_64 with stock Xen v. 4.14).
> >
> > The good news is that the image actually does load
> > up but it throws the following WARNINGs in the process:
> >
> > WARNING: cannot access vmalloc'd module memory
> > crash: read error: kernel virtual address: ffffffff93613480  type:
> > "fill_task_struct"
> > WARNING: active task ffffffff93613480 on cpu 0 not found in PID hash
> > crash: read error: kernel virtual address: ffffffff93613480  type:
> > "fill_task_struct"
> > WARNING: cannot read log_buf contents
> >
> > And then the info that it gives me around basic things like
> > ps, mod, log, etc. is really super limited (and I am now suspecting
> > may even be wrong).
> >
> > Since I was primarily after dmesg/log initially, I tried:
> > crash> log
> > log: WARNING: cannot read log_buf contents
> >
> > Then I tried taking an xl dump-core from the domU that was still
> > very much alive and happy and got similar results -- so it clearly
> > doesn't seem to be related to the state domU is in.
> >
> > As matter of fact, I actually got to the desired dmesg output
> > by simply running strings(1) on the core file -- so the info is
> > definitely there -- but I guess some kind of index/reference maybe
> > broken.
> >
> > With all that in mind, if there's anyone on this ML who has recently
> > done Xen DomU crash dump analysis -- I would definitely appreciate
> > the pointers!
>
> For me it just works (openSUSE).

Can you please run:

crash --version and readelf -a XXXX (on the xl dump-core output)
and post the results?

also, what version of  Xen are you using?

> I tried a pv guest only with a 4.4 kernel, though.

I would really appreciate it if you could try it on HVM so that
I know whether it is an issue that only affects my setup or
other folks (especially after seeing answers to above).

Thanks,
Roman.