[Crash-utility] vmss.core and kernel dbgsym do not match!

[Dave Anderson]

----- Original Message -----
> Hi,
> 
> In reference to bug : https://bugzilla.redhat.com/show_bug.cgi?id=233151
> 
> I have the same problem trying to analyze a vmss.core file with kernel
> v4.4.0-36-generic (Ubuntu) :
> 
q
> crash: /usr/lib/debug/boot/ vmlinux-4.4.0-36-generic and /var/vmss_m.core do
> not match!
> 
> I also tried with the following (as recommended in the bug threads) without
> success :
> --machdep phys_base=0x200000

That was an old Xen RHEL5 kernel issue, so I don't know if that applies to 
your 4.4-based VMware vmss dumpfile (?).  Although I only have a 4 sample
vmss dumpfiles, one of does happen to be a RHEL5 kernel and it does require
--machdep phys_base=0x200000.

But it's certainly possible that could be the issue.  If you run the guest again 
and log into it, you could try running crash on the live system.  If it comes up OK,
run the "help -m" command and grep for "phys_base".  Then try that value as the 
--machdep phys_base= argument with the dumpfile.  

Worse case, you could try different phys_base values and basically fish for
the correct value.

> 
> 
> 
> I'm using the right -dbgsym for the right kernel as confirmed here :
> 
> 
> $ strings vmss_m.core | grep "Linux version"
> Linux version 4.4.0-36-generic (buildd at lgw01-20) (gcc version 4.8.4 (Ubuntu
> 4.8.4-2ubuntu1~14.04.3) ) #55~14.04.1-Ubuntu SMP Fri Aug 12 11:49:30 UTC
> 2016 (Ubuntu 4.4.0-36.55~14.04.1-generic 4.4.16)

What does "strings vmlinux-4.4.0-36-generic" show?  You'll need to verify that
the full string above is exactly the same.

> 
> 
> $ readelf -a vmss_m.core
> 
> Program Headers:
> Type Offset VirtAddr PhysAddr
> FileSiz MemSiz Flags Align
> NOTE 0x00000000000000e8 0x0000000000000000 0x0000000000000000
> 0x0000000000000218 0x0000000000000000 0
> LOAD 0x0000000080001000 0x00000000fff80000 0x00000000fff80000
> 0x0000000000080000 0x0000000000080000 RWE 1000
> LOAD 0x0000000000001000 0x0000000000000000 0x0000000000000000
> 0x0000000080000000 0x0000000080000000 RWE 1000
> 
> The VirtAddr and PhysAddr are just zero.

It's the PhysAddr that's the key to crash -- the header is showing that
the dumpfile contains 2GB (0x80000000) of physical memory starting at
physical address 0.

> 
> 
> I tried with the latest and greatest crash-utility from [
> https://github.com/crash-utility/crash.git ] using version 7.1.5++ but this
> has no effect, I still have the error :
> 
> crash: /usr/lib/debug/boot/ vmlinux-4.4.0-36-generic and /var/vmss_m.core do not match!
> 
> Any ideas ?
> 
> - Eric

If you show the output of "crash -d8 ..." it may yield some more clues.

Dave