Hello all, When analysing elf format core, if "help -D" is specified, crash will show dumpfile contents/statistics. But the output is hardly to read. So the patches is to make it human readable. When analysing kdump format core, if "help -D" is specified, crash won't show the note information. The patches add note information to the output. When analysing elf format core, if "help -D" is specified, the original output like this: : : Elf64_Nhdr: n_namesz: 5 ("CORE") n_descsz: 336 n_type: 1 (NT_PRSTATUS) 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000141d 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000000000286 ffffffff81b01a40 0000000000000000 ffff88003d86be18 0000000000000063 0000000000000000 0000000000000001 ffffffff81645da0 0000000000000000 0000000000000010 0000000000000000 0000000000000000 0000000000000000 0000000000000063 ffffffffffffffff ffffffff8134b6c6 0000000000000010 0000000000010096 ffff88003d86be18 0000000000000018 00007fc165c0b700 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : : It is hardly to get some useful information. The patch is to make it human readable. And the output changes to: : : Elf64_Nhdr: n_namesz: 5 ("CORE") n_descsz: 336 n_type: 1 (NT_PRSTATUS) si.signo: 0, si.code: 0, si.errno: 0, cursig:0 sigpend: 0 sighold: 0 pid: 5149, ppid: 0, pgrp: 0, sid:0 utime: 0.000000, stime: 0.000000, cutime: 0.000000, cstime: 0.000000 ORIG_RAX: -1, fpvalid: 0 R15 : 0x0000000000000004 R14 : 0x0000000000000286 R13 : 0xffffffff81b01a40 R12 : 0x0000000000000000 RBP : 0xffff88003d86be18 RBX : 0x0000000000000063 R11 : 0x0000000000000000 R10 : 0x0000000000000001 R9 : 0xffffffff81645da0 R8 : 0x0000000000000000 RAX : 0x0000000000000010 RCX : 0x0000000000000000 RDX : 0x0000000000000000 RSI : 0x0000000000000000 RDI : 0x0000000000000063 RIP : 0xffffffff8134b6c6 RFLAGS : 0x0000000000010096 RSP : 0xffff88003d86be18 FS_BASE: 0x00007fc165c0b700 GS_BASE : 0x0000000000000000 CS: 0x0010 SS: 0x0018 DS: 0x0000 ES: 0x0000 FS: 0x0000 GS: 0x0000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000141d 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0000000000000286 ffffffff81b01a40 0000000000000000 ffff88003d86be18 0000000000000063 0000000000000000 0000000000000001 ffffffff81645da0 0000000000000000 0000000000000010 0000000000000000 0000000000000000 0000000000000000 0000000000000063 ffffffffffffffff ffffffff8134b6c6 0000000000000010 0000000000010096 ffff88003d86be18 0000000000000018 00007fc165c0b700 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : : The patches support elf64, elf32, qemu64, qemu32 core format. The kdump format didn't show the note information originally when help -D. The patches add it. the original output: : : sub_header_kdump: 222aff0 phys_base: 0 dump_level: 0 (0x0) split: 0 start_pfn: (unused) end_pfn: (unused) offset_vmcoreinfo: 4556 (0x11cc) size_vmcoreinfo: 1440 (0x5a0) OSRELEASE=2.6.32-431.el6.x86_64 PAGESIZE=4096 SYMBOL(init_uts_ns)=ffffffff81a8e940 SYMBOL(node_online_map)=ffffffff81c08f40 : : LENGTH(node_data)=512 CRASHTIME=1417488164 offset_note: 4176 (0x1050) size_note: 1820 (0x71c) num_prstatus_notes: 1 notes_buf: 224c020 notes[0]: 224c020 NT_PRSTATUS_offset: 1050 offset_eraseinfo: 0 (0x0) size_eraseinfo: 0 (0x0) : : the changed output: : : sub_header_kdump: 2c75ff0 phys_base: 0 dump_level: 0 (0x0) split: 0 start_pfn: (unused) end_pfn: (unused) offset_vmcoreinfo: 4556 (0x11cc) size_vmcoreinfo: 1440 (0x5a0) OSRELEASE=2.6.32-431.el6.x86_64 PAGESIZE=4096 SYMBOL(init_uts_ns)=ffffffff81a8e940 SYMBOL(node_online_map)=ffffffff81c08f40 : : LENGTH(node_data)=512 CRASHTIME=1417488164 offset_note: 4176 (0x1050) size_note: 1820 (0x71c) num_prstatus_notes: 1 notes_buf: 2c97020 notes[0]: 2c97020 si.signo: 0, si.code: 0, si.errno: 0, cursig:0 sigpend: 0 sighold: 0 pid: 5149, ppid: 0, pgrp: 0, sid:0 utime: 0.000000, stime: 0.000000, cutime: 0.000000, cstime: 0.000000 ORIG_RAX: -1, fpvalid: 0 R15 : 0x0000000000000004 R14 : 0x0000000000000286 R13 : 0xffffffff81b01a40 R12 : 0x0000000000000000 RBP : 0xffff88003d86be18 RBX : 0x0000000000000063 R11 : 0x0000000000000000 R10 : 0x0000000000000001 R9 : 0xffffffff81645da0 R8 : 0x0000000000000000 RAX : 0x0000000000000010 RCX : 0x0000000000000000 RDX : 0x0000000000000000 RSI : 0x0000000000000000 RDI : 0x0000000000000063 RIP : 0xffffffff8134b6c6 RFLAGS : 0x0000000000010096 RSP : 0xffff88003d86be18 FS_BASE: 0x00007fc165c0b700 GS_BASE : 0x0000000000000000 CS: 0x0010 SS: 0x0018 DS: 0x0000 ES: 0x0000 FS: 0x0000 GS: 0x0000 NT_PRSTATUS_offset: 1050 offset_eraseinfo: 0 (0x0) size_eraseinfo: 0 (0x0) : : -- Thanks Zhou Wenjian
From f4bae0fec40bdb8b42d02ea91e3fba622c337b7e Mon Sep 17 00:00:00 2001 From: Zhou Wenjian <zhouwj-fnst@xxxxxxxxxxxxxx> Date: Wed, 10 Dec 2014 10:34:46 +0800 Subject: [PATCH 1/5] Make elf64 note human readable --- netdump.c | 97 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 97 insertions(+), 0 deletions(-) diff --git a/netdump.c b/netdump.c index 903faa0..c7e7ad5 100644 --- a/netdump.c +++ b/netdump.c @@ -45,6 +45,7 @@ static int proc_kcore_init_64(FILE *fp); static char *get_regs_from_note(char *, ulong *, ulong *); static void kdump_get_osrelease(void); static char *vmcoreinfo_read_string(const char *); +void display_note_elf64(void *note_ptr, char *buf); #define ELFSTORE 1 @@ -2279,6 +2280,12 @@ dump_Elf64_Nhdr(Elf64_Off offset, int store) iptr = (int *)uptr; netdump_print(" %08lx\n", *iptr); } else { + if (nd->ofp) { + char *l_buf = (char *)malloc(2 * BUFSIZE); + display_note_elf64(note,l_buf); + fprintf(fp, l_buf); + free(l_buf); + } for (i = lf = 0; i < note->n_descsz/sizeof(ulonglong); i++) { if (((i%2)==0)) { netdump_print("%s ", @@ -2543,6 +2550,96 @@ struct x86_64_user_regs_struct { unsigned long ds,es,fs,gs; }; +struct x86_64_prstatus { + int si_signo; + int si_code; + int si_errno; + short cursig; + unsigned long sigpend; + unsigned long sighold; + int pid; + int ppid; + int pgrp; + int sid; + struct timeval utime; + struct timeval stime; + struct timeval cutime; + struct timeval cstime; + struct x86_64_user_regs_struct regs; + int fpvalid; +}; + +void +display_prstatus_elf64(void *note_ptr, char *buf) +{ + struct x86_64_prstatus *pr; + Elf64_Nhdr *note; + + note = (Elf64_Nhdr *)note_ptr; + pr = (struct x86_64_prstatus *)( + (char *)note + sizeof(Elf64_Nhdr) + note->n_namesz); + pr = (struct x86_64_prstatus *)roundup((ulong)pr, 4); + sprintf(buf, + "\t\tsi.signo: %d, si.code: %d, si.errno: %d, cursig:%d\n" + "\t\tsigpend: %d\n" + "\t\tsighold: %d\n" + "\t\tpid: %d, ppid: %d, pgrp: %d, sid:%d\n" + "\t\tutime: %01d.%06d, stime: %01d.%06d, cutime: %01d.%06d, " + "cstime: %01d.%06d\n" + "\t\tORIG_RAX: %d, fpvalid: %d\n" + "\t\tR15 : 0x%016llx\tR14 : 0x%016llx\n" + "\t\tR13 : 0x%016llx\tR12 : 0x%016llx\n" + "\t\tRBP : 0x%016llx\tRBX : 0x%016llx\n" + "\t\tR11 : 0x%016llx\tR10 : 0x%016llx\n" + "\t\tR9 : 0x%016llx\tR8 : 0x%016llx\n" + "\t\tRAX : 0x%016llx\tRCX : 0x%016llx\n" + "\t\tRDX : 0x%016llx\tRSI : 0x%016llx\n" + "\t\tRDI : 0x%016llx\tRIP : 0x%016llx\n" + "\t\tRFLAGS : 0x%016llx\tRSP : 0x%016llx\n" + "\t\tFS_BASE: 0x%016llx\tGS_BASE : 0x%016llx\n" + "\t\tCS: 0x%04lx SS: 0x%04lx DS: 0x%04lx ES: 0x%04lx " + "FS: 0x%04lx GS: 0x%04lx\n", + pr->si_signo, pr->si_code, pr->si_errno, pr->cursig, + pr->sigpend, pr->sighold, + pr->pid, pr->ppid, pr->pgrp, pr->sid, + pr->utime.tv_sec, pr->utime.tv_usec, + pr->stime.tv_sec, pr->stime.tv_usec, + pr->cutime.tv_sec, pr->cutime.tv_usec, + pr->cstime.tv_sec, pr->cstime.tv_usec, + pr->regs.orig_rax, pr->fpvalid, + pr->regs.r15, pr->regs.r14, + pr->regs.r13, pr->regs.r12, + pr->regs.rbp, pr->regs.rbx, + pr->regs.r11, pr->regs.r10, + pr->regs.r9, pr->regs.r8, + pr->regs.rax, pr->regs.rcx, + pr->regs.rdx, pr->regs.rsi, + pr->regs.rdi, pr->regs.rip, + pr->regs.eflags, pr->regs.rsp, + pr->regs.fs_base, pr->regs.gs_base, + pr->regs.cs, pr->regs.ss, + pr->regs.ds, pr->regs.es, + pr->regs.fs, pr->regs.gs + ); +} + +void +display_note(void *note_ptr, char *buf, int descsz) +{ + if (descsz == (2 * sizeof(struct x86_64_prstatus))) + display_prstatus_elf64(note_ptr, buf); +} + +void +display_note_elf64(void *note_ptr, char *buf) +{ + Elf64_Nhdr *note; + + note = (Elf64_Nhdr *)note_ptr; + + display_note(note_ptr, buf, 2 * (note->n_descsz)); +} + void get_netdump_regs_x86_64(struct bt_info *bt, ulong *ripp, ulong *rspp) { -- 1.7.1
From f39bed4eabb29ea1ad2d14deb593655fe5988f2e Mon Sep 17 00:00:00 2001 From: Zhou Wenjian <zhouwj-fnst@xxxxxxxxxxxxxx> Date: Wed, 10 Dec 2014 10:35:45 +0800 Subject: [PATCH 2/5] Make elf32 note human readable --- netdump.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 89 insertions(+), 0 deletions(-) diff --git a/netdump.c b/netdump.c index c7e7ad5..e035d95 100644 --- a/netdump.c +++ b/netdump.c @@ -46,6 +46,7 @@ static char *get_regs_from_note(char *, ulong *, ulong *); static void kdump_get_osrelease(void); static char *vmcoreinfo_read_string(const char *); void display_note_elf64(void *note_ptr, char *buf); +void display_note_elf32(void *note_ptr, char *buf); #define ELFSTORE 1 @@ -1977,6 +1978,12 @@ dump_Elf32_Nhdr(Elf32_Off offset, int store) } lf = 0; } else { + if (nd->ofp) { + char *l_buf = (char *)malloc(2 * BUFSIZE); + display_note_elf32(note,l_buf); + fprintf(fp, l_buf); + free(l_buf); + } for (i = lf = 0; i < note->n_descsz/sizeof(ulong); i++) { if (((i%4)==0)) { netdump_print("%s ", @@ -2623,11 +2630,83 @@ display_prstatus_elf64(void *note_ptr, char *buf) ); } +struct x86_user_regs_struct { + unsigned long ebx,ecx,edx,esi,edi,ebp,eax; + unsigned long ds,es,fs,gs,orig_eax; + unsigned long eip,cs,eflags; + unsigned long esp,ss; +}; + +struct x86_prstatus { + int si_signo; + int si_code; + int si_errno; + short cursig; + unsigned long sigpend; + unsigned long sighold; + int pid; + int ppid; + int pgrp; + int sid; + struct timeval utime; + struct timeval stime; + struct timeval cutime; + struct timeval cstime; + struct x86_user_regs_struct regs; + int fpvalid; +}; + +void +display_prstatus_elf32(void *note_ptr, char *buf) +{ + struct x86_prstatus *pr; + Elf32_Nhdr *note; + + note = (Elf32_Nhdr *)note_ptr; + pr = (struct x86_prstatus *)( + (char *)note + sizeof(Elf32_Nhdr) + note->n_namesz); + pr = (struct x86_prstatus *)roundup((ulong)pr, 4); + + sprintf(buf, + "\t\tsi.signo: %d si.code: %d si.errno: %d cursig: %d\n" + "\t\tsigpend : %d\n" + "\t\tsighold : %d\n" + "\t\tpid: %d ppid: %d pgrp: %d sid: %d\n" + "\t\tutime: %01d.%06d, stime: %01d.%06d, cutime: %01d.%06d, " + "cstime: %01d.%06d\n" + "\t\torig_rax: %d, fpvalid: %d\n" + "\t\tEBX : 0x%08lx\tECX : 0x%08lx\n" + "\t\tEDX : 0x%08lx\tESI : 0x%08lx\n" + "\t\tEDI : 0x%08lx\tEBP : 0x%08lx\n" + "\t\tEAX : 0x%08lx\tEIP : 0x%08lx\n" + "\t\tEFLAGS : 0x%08lx\tESP : 0x%08lx\n" + "\t\tDS: 0x%04lx ES: 0x%04lx FS: 0x%04lx GS: 0x%04lx " + "CS: 0x%04lx SS: 0x%04lx\n", + pr->si_signo, pr->si_code, pr->si_errno, pr->cursig, + pr->sigpend, pr->sighold, + pr->pid, pr->ppid, pr->pgrp, pr->sid, + pr->utime.tv_sec, pr->utime.tv_usec, + pr->stime.tv_sec, pr->stime.tv_usec, + pr->cutime.tv_sec, pr->cutime.tv_usec, + pr->cstime.tv_sec, pr->cstime.tv_usec, + pr->regs.orig_eax, pr->fpvalid, + pr->regs.ebx, pr->regs.ecx, + pr->regs.edx, pr->regs.esi, + pr->regs.edi, pr->regs.ebp, + pr->regs.eax, pr->regs.eip, + pr->regs.eflags, pr->regs.esp, + pr->regs.ds, pr->regs.es, pr->regs.fs, + pr->regs.gs, pr->regs.cs, pr->regs.ss + ); +} + void display_note(void *note_ptr, char *buf, int descsz) { if (descsz == (2 * sizeof(struct x86_64_prstatus))) display_prstatus_elf64(note_ptr, buf); + else if (descsz == sizeof(struct x86_prstatus)) + display_prstatus_elf32(note_ptr, buf); } void @@ -2640,6 +2719,16 @@ display_note_elf64(void *note_ptr, char *buf) display_note(note_ptr, buf, 2 * (note->n_descsz)); } +void +display_note_elf32(void *note_ptr, char *buf) +{ + Elf32_Nhdr *note; + + note = (Elf32_Nhdr *)note_ptr; + + display_note(note_ptr, buf, note->n_descsz); +} + void get_netdump_regs_x86_64(struct bt_info *bt, ulong *ripp, ulong *rspp) { -- 1.7.1
From bedf6a267641e213c22491841c7893d5a661a777 Mon Sep 17 00:00:00 2001 From: Zhou Wenjian <zhouwj-fnst@xxxxxxxxxxxxxx> Date: Wed, 10 Dec 2014 09:37:41 +0800 Subject: [PATCH 3/5] Show kdump note information when help -D --- diskdump.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/diskdump.c b/diskdump.c index 3d33fdc..fe02d26 100644 --- a/diskdump.c +++ b/diskdump.c @@ -1736,10 +1736,20 @@ __diskdump_memory_dump(FILE *fp) dd->num_prstatus_notes); fprintf(fp, " notes_buf: %lx\n", (ulong)dd->notes_buf); + + char *l_buf = (char *)malloc(2 * BUFSIZE); for (i = 0; i < dd->num_prstatus_notes; i++) { fprintf(fp, " notes[%d]: %lx\n", i, (ulong)dd->nt_prstatus_percpu[i]); + + if (dd->machine_type == EM_386) + display_note_elf32(dd->nt_prstatus_percpu[i],l_buf); + else if (dd->machine_type == EM_X86_64) + display_note_elf64(dd->nt_prstatus_percpu[i],l_buf); + fprintf(fp,l_buf); + memset(l_buf, 0, 2 * BUFSIZE); } + free(l_buf); dump_nt_prstatus_offset(fp); } if (dh->header_version >= 5) { -- 1.7.1
From b4b8763f1ce92f70603f29f3fa120ff78ec15554 Mon Sep 17 00:00:00 2001 From: Zhou Wenjian <zhouwj-fnst@xxxxxxxxxxxxxx> Date: Wed, 10 Dec 2014 09:38:39 +0800 Subject: [PATCH 4/5] Make qemu64 note human readable --- netdump.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 73 insertions(+), 0 deletions(-) diff --git a/netdump.c b/netdump.c index e035d95..ac15125 100644 --- a/netdump.c +++ b/netdump.c @@ -2701,12 +2701,85 @@ display_prstatus_elf32(void *note_ptr, char *buf) } void +display_qemu_elf(QEMUCPUState *ptr, char *buf, int flags) +{ + int i, size, t=0; + QEMUCPUSegment *seg; + char *seg_names[] = {"CS", "DS", "ES", "FS", "GS", "SS", "LDT", "TR", + "GDT", "IDT"}; + + ptr = (QEMUCPUState *)roundup((ulong)ptr, 4); + seg = &(ptr->cs); + + size = sprintf(buf, + "\t\tversion: 0x%08lx\tsize: 0x%08lx\n" + "\t\tRAX: 0x%016llx\tRBX: 0x%016llx\n" + "\t\tRCX: 0x%016llx\tRDX: 0x%016llx\n" + "\t\tRSI: 0x%016llx\tRDI: 0x%016llx\n" + "\t\tRSP: 0x%016llx\tRBP: 0x%016llx\n", + ptr->version, ptr->size, + ptr->rax, ptr->rbx, ptr->rcx, + ptr->rdx, ptr->rsi, ptr->rdi, + ptr->rsp, ptr->rbp + ); + buf += size; + t+=size; + if (flags == KDUMP_ELF64) { + size = sprintf(buf, + "\t\tR8 : 0x%016llx\tR9 : 0x%016llx\n" + "\t\tR10: 0x%016llx\tR11: 0x%016llx\n" + "\t\tR12: 0x%016llx\tR13: 0x%016llx\n" + "\t\tR14: 0x%016llx\tR15: 0x%016llx\n", + ptr->r8, ptr->r9, ptr->r10, + ptr->r11, ptr->r12, ptr->r13, + ptr->r14, ptr->r15 + ); + buf += size; + } + + for(i = 0; i < sizeof(seg_names)/sizeof(seg_names[0]); i++) { + size = sprintf(buf, + "\t\t%s:\n" + "\t\tselector: 0x%08lx\tlimit: 0x%08lx\tflags: 0x%08lx\n" + "\t\tpad : 0x%08lx\tbase : 0x%016llx\n", + seg_names[i], + seg->selector, seg->limit, seg->flags, + seg->pad, seg->base + ); + buf += size; + seg++; + } + + sprintf(buf, + "\t\tcr[0]: %016llx\tcr[1]: %016llx\tcr[2]: %016llx\n" + "\t\tcr[3]: %016llx\tcr[4]: %016llx\n", + ptr->cr[0], ptr->cr[1], ptr->cr[2], + ptr->cr[3], ptr->cr[4] + ); +} + +void +display_qemu_elf64(void *note_ptr, char *buf) +{ + Elf64_Nhdr *note; + QEMUCPUState *ptr; + + note = (Elf64_Nhdr *)note_ptr; + ptr = (QEMUCPUState *)( + (char *)note + sizeof(Elf64_Nhdr) + note->n_namesz); + + display_qemu_elf(ptr, buf, KDUMP_ELF64); +} + +void display_note(void *note_ptr, char *buf, int descsz) { if (descsz == (2 * sizeof(struct x86_64_prstatus))) display_prstatus_elf64(note_ptr, buf); else if (descsz == sizeof(struct x86_prstatus)) display_prstatus_elf32(note_ptr, buf); + else if (descsz == (2 * sizeof(QEMUCPUState))) + display_qemu_elf64(note_ptr, buf); } void -- 1.7.1
From 8c1e25f7f8384f40ec4a24ad67f7e279f32f8b35 Mon Sep 17 00:00:00 2001 From: Zhou Wenjian <zhouwj-fnst@xxxxxxxxxxxxxx> Date: Wed, 10 Dec 2014 09:39:17 +0800 Subject: [PATCH 5/5] Make qemu32 note human readable --- netdump.c | 22 ++++++++++++++++++++++ 1 files changed, 22 insertions(+), 0 deletions(-) diff --git a/netdump.c b/netdump.c index ac15125..4c720f6 100644 --- a/netdump.c +++ b/netdump.c @@ -2263,6 +2263,13 @@ dump_Elf64_Nhdr(Elf64_Off offset, int store) } if (BITS32() && (xen_core || (note->n_type == NT_PRSTATUS))) { + if (!xen_core && nd->ofp) { + char *l_buf = (char *)malloc(2 * BUFSIZE); + display_note_elf64(note, l_buf); + fprintf(fp, l_buf); + free(l_buf); + } + iptr = (int *)uptr; for (i = lf = 0; i < note->n_descsz/sizeof(ulong); i++) { if (((i%4)==0)) { @@ -2772,6 +2779,19 @@ display_qemu_elf64(void *note_ptr, char *buf) } void +display_qemu_elf32(void *note_ptr, char *buf) +{ + Elf32_Nhdr *note; + QEMUCPUState *ptr; + + note = (Elf32_Nhdr *)note_ptr; + ptr = (QEMUCPUState *)( + (char *)note + sizeof(Elf32_Nhdr) + note->n_namesz); + + display_qemu_elf(ptr, buf, KDUMP_ELF32); +} + +void display_note(void *note_ptr, char *buf, int descsz) { if (descsz == (2 * sizeof(struct x86_64_prstatus))) @@ -2780,6 +2800,8 @@ display_note(void *note_ptr, char *buf, int descsz) display_prstatus_elf32(note_ptr, buf); else if (descsz == (2 * sizeof(QEMUCPUState))) display_qemu_elf64(note_ptr, buf); + else if (descsz == sizeof(QEMUCPUState)) + display_qemu_elf32(note_ptr, buf); } void -- 1.7.1
-- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility