----- Original Message -----
The new version of makedumpfile 1.4.0 allows user to filter out
kernel data
(e.g. security keys, confidential/secret information etc.) from the vmcore.
The data to be filtered out is poisoned with character 'X' (0x58 in Hex).
The filtered ELF kdump now carries a new ELF note section "ERASEINFO" that
contains eraseinfo data. The filtered compressed kdump now contains new
members (offset_eraseinfo, size_eraseinfo) int the sub header with new header
version 5.
With the above change in place, there may be instances where the filtered
dumpfile may not be readable OR may not be helpful in analyzing the problem
using crash tool. Most of the time crash tool will be able to read/analyze
the dump unless someone scrubs out the data on which crash utility is
dependent on. Hence, This patch adds support into crash utility to detect the
above changes and show early warning message to the user about the fact that
he is dealing with filtered dumpfile.
This patch adds support for "help -n" output to display the filter data
strings that are appended to the dumpfile or stored in an ELF note.
Signed-off-by: Mahesh Salgaonkar <mahesh(a)linux.vnet.ibm.com>
Hi Mahesh,
This patch looks good -- I rewrote the warning message to look like this:
WARNING: /var/crash/2010-08-15-15:49/vmcore:
Kernel data has been erased from this dumpfile. This may cause
the crash session to fail entirely, cause commands to fail, or
result in unpredictable runtime behavior.
Queued for crash-5.1.8.
Thanks,
Dave