[Crash-utility] ARM64 (odroid-c2) crash fails to read live kernel

[Dave Anderson]

----- Original Message -----
> root at odroid64-pre:~/crash-7.1.4# ./crash /proc/kcore
> 
> crash 7.1.4
> Copyright (C) 2002-2015 Red Hat, Inc.
> Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation
> Copyright (C) 1999-2006 Hewlett-Packard Co
> Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited
> Copyright (C) 2006, 2007 VA Linux Systems Japan K.K.
> Copyright (C) 2005, 2011 NEC Corporation
> Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc.
> Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
> This program is free software, covered by the GNU General Public License,
> and you are welcome to change it and/or distribute copies of it under
> certain conditions. Enter "help copying" to see the conditions.
> This program has absolutely no warranty. Enter "help warranty" for details.
> 
> GNU gdb (GDB) 7.6
> Copyright (C) 2013 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later < http://gnu.org/licenses/gpl.html
> >
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law. Type "show copying"
> and "show warranty" for details.
> This GDB was configured as "aarch64-unknown-linux-gnu"...
> 
> crash: seek error: kernel virtual address: ffffffc000ffe000 type: "pmd page"

So if you did a "crash -d8", you would see that you got significantly
farther than you did with /dev/mem, and where I think from the seek error
type above, perhaps as far as getting into the module initialization phase. 
Although, if I run with -d8, I never see the "pmd page" type being read,
so I'm not sure where that's coming from.
 
Anyway, try -d8, and you should see legitimate stuff read from "linux_banner"
and the utsname structure, and you should see how far you got.  

You might even be able to get to a crash> prompt by running:

 $ crash /proc/kcore --no_modules

which would avoid doing any kind of PTE-requiring address translation.

In any case, there's something about the /dev/mem driver that I'm not aware
of.  I'm pretty sure that that when I did the initial arm64 port for crash,
that I *did* use /dev/mem at first, because Red Hat hadn't gotten around to
restricting it yet. 

Anyway, if you're at the module initialization stage, then the PTE
stuff comes into play.  Note that crash currently only supports ARM64
systems configured with 64k pages with 2-level PTEs  or 4k pages with 
3-level PTEs.  How is your system configured?

Dave