[Crash-utility] EXT: Re: EXT: Re: crash start in CentOS 8

[Bhupesh Sharma]

Hello Kazu,

On Mon, Jun 15, 2020 at 8:38 PM HAGIO KAZUHITO(萩尾　一仁)
<k-hagio-ab at nec.com> wrote:
>
> -----Original Message-----
> > > [root at lxkmg-pag-ale test64]# /usr/bin/crash -d 15
> > > System.map-4.18.0-147.el8.x86_64 vmlinux.debuginfo vmcore
> ...
> > > <read_diskdump: addr: ffffffff82131200 paddr: 37b31200 cnt: 8>
> > > read_diskdump: PAGE_EXCLUDED: paddr/pfn: 37b31200/37b31
> > > crash: page excluded: kernel virtual address: ffffffff82131200  type: "page_offset_base"
> > > [root at lxkmg-pag-ale test64]#
> >
> > Hmmm, I think you should find better results with:
> >
> > $ crash vmlinux vmcore (On the machine used for post-processing)
> >
> > and
> >
> > $ crash vmlinux /proc/kcore (On the original crashing system)
> >
> > I think if that helps you reach the crash > prompt, we have a potential issue which needs to be looked-at.
> > Can you please try to run the same and let me know the outcome?
> >
> > Thanks,
> > Bhupesh
> >
> >
> > --
> > Crash-utility mailing list
> > Crash-utility at redhat.com
> > https://www.redhat.com/mailman/listinfo/crash-utility
> >
> > Hello,
> >
> > Running the above mentioned command on the server used to post process the crash shows a message indicating
> > a mismatch between the vmcore and kernel.debug binary.
> >
> > I will now first try to clarify this and come back later on if the issue is still there.
> >
> > Thanks for helping.
> > Best regards,
> > Patrick Agrain
> >
>
> Just FYI, with respect to the System.map file, the following Dave's post
> would be helpful:
> https://www.redhat.com/archives/crash-utility/2018-June/msg00002.html
>
> If you have the vmlinux corresponding to a running kernel, you don't need
> the System.map file.

Indeed, I remember discussing this with Dave A. some months back.
Infact with newer KASLR enabled kernels it makes little sense to use
System.map file as it contains the non-relocated symbol values that
were compiled into the vmlinux file - that's why I suggested just to
use to the vmlinux and vmcore file as an arguments while invoking the
crash tool to Patrick.

However, going back to the discussion I had with Dave A., I think the
main point of confusion was the 'crash_whitepaper' which is still
located at [1], and which provides the following example to invoke the
crash utility with the System.map file, vmlinux and vmcore
combination:

 Examples when running on a dumpfile:

      $ crash /boot/System.map vmlinux.dbg vmcore

I think while this was ok for older kernels which did not support
KASLR, for newer kernels this needs an update.
I am trying to see if I can modify the 'crash_whitepaper' and push the
same to github, so that users are not confused with the System.map
option.

What's your views on the same? Please let me know.

[1]. https://crash-utility.github.io/crash_whitepaper.html

Thanks,
Bhupesh