linux-kernel - Re: kdump/kexec/crash on vmcore file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061013141446.GA27375@in.ibm.com>
Date:	Fri, 13 Oct 2006 10:14:46 -0400
From:	Vivek Goyal <vgoyal@...ibm.com>
To:	Steven Truong <midair77@...il.com>
Cc:	linux-kernel@...r.kernel.org, crash-utility@...hat.com,
	Dave Anderson <anderson@...hat.com>
Subject: Re: kdump/kexec/crash on vmcore file

On Thu, Oct 12, 2006 at 02:50:33PM -0700, Steven Truong wrote:
> Hi, all.  This is my first attempt to troubleshoot a kernel panic so I
> am quite newbie in this area. I have been able to obtain a kdump when
> my box had kernel panic.
> 
> I set up Kdump and Kexec and then the captured/crash kernel to boot
> into Level 1 and then copy /proc/vmcore file to the disk for later
> analysis.  However, after the server booted back to Level 3 and I
> utilized the crash command to analyzed the vmcore file.  I got error
> message:
> 
> ./crash /boot/vmlinux ../vmcore.test
> 
> 
> crash: read error: kernel virtual address: ffffffff8123d1e0  type:
> "kernel_config_data"
> WARNING: cannot read kernel_config_data
> crash: read error: kernel virtual address: ffffffff813b5180  type: "xtime"
> 

Hi Steven,

which vmlinux are you using for analysis? First kernel's vmlinux or
second kernel's vmlinux. You should be using first kernel's vmlinux.

crash is trying to read some symbols from the core file and crash thinks
that virtual address for kernel_config_data is ffffffff8123d1e0. I think
this is too high a address. I guess this will be the address if you
compile your kernel for physical address 16MB. So my first guess is that
you are using second kernel's vmlinux for analysis.

Which kernel version and kexec-tools version are you using?

I am also copying the mail to crash-utility mailing list where folks
keep a watch on crash related issues.

Thanks
Vivek
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/