On 10/08/2014 01:39 PM, Atsushi Kumagai wrote: >> Since the incomplete dumpfile generated by ENOSPC error can't be anylyzed >> by crash utility, but sometimes this file may contain important information >> and the panic problem won't be reproduced, then we came up with an idea to >> modify the exist data of the incomplete dumpfile to make it analyzable by >> crash utility. And each of those dumpfiles has a flag to indicate that it >> has been modified. As there are two formats of these dumpfiles, different >> methods and flags are needed to deal with each of them, >> >> elf: >> Modify the value of the PT_LOAD program header to reflect the actual size >> of the incomplete dumpfile. This method can't be used to modify the dumpfile >> written in flattened mode. This format use the "e_flags" of "elf header" >> to indicate that it has been modified. > > Is it necessary to change the PT_LOAD headers in makedumpfile ? > It sounds too much work for makedumpfile, I think it's better to > avoid such an irreversible and more than enough change in capturing > phase. Are there some reasons why you don't do the same thing on the > fly in crash ? > > OTOH, setting the incomplete flag is certainly makedumpfile's task > since crash can't detect ENOSPC. > > > Thanks > Atsushi Kumagai hello Actually, it just change the attribute:FileSiz of the PT_LOAD header having incomplete segment. The attribute shows the size of the segment in elf file. Because of that, crash can read the file correctly. And we haven't found it have anything to do with the original information so far,the information before makedumpfile. So, modifying header won't change too much data and won't lose any important information. However, though it can be done in crash, the process will be much more complicated. I think it's not worth to do this just for that useless data. If you think it is really needed, I will do that later. Thanks Zhou Wenjian
