[Crash-utility] Query: EIP value in User mode exception frame

[Vivek Goyal]

Hi Dave,

Thanks a lot for creating this list. This is definitely going to help.

I got a query right away. This is regarding the EIP displayed in "bt". 
Have a look at following stack trace.

crash> bt
PID: 12632  TASK: ee01ea40  CPU: 3   COMMAND: "bash"
 #0 [d829df20] crash_kexec at c013a4da
 #1 [d829df28] __handle_sysrq at c0247e71
 #2 [d829df54] write_sysrq_trigger at c01916d4
 #3 [d829df6c] vfs_write at c015c7ca
 #4 [d829df90] sys_write at c015c88c
 #5 [d829dfb8] sysenter_entry at c0102da8
    EAX: 00000004  EBX: 00000001  ECX: b7f18000  EDX: 00000002
    DS:  007b      ESI: 00000002  ES:  007b      EDI: b7f18000
    SS:  007b      ESP: bfc1f334  EBP: bfc1f360
    CS:  0073      EIP: ffffe410  ERR: 00000004  EFLAGS: 00000246

Here EIP value is "ffffe410" which is definitely not a user space address.
I am getting this value in all the kdump images I have taken.

Is it due to the fact because we are entring using sysenter. If yes then
how to get right EIP value.

Thanks
Vivek