admin-guide/kdump/kdump.rst

2 Documentation for Kdump - The kexec-based Crash Dumping Solution
11 Kdump uses kexec to quickly boot to a dump-capture kernel whenever a
12 dump of the system kernel's memory needs to be taken (for example, when
13 the system panics). The system kernel's memory image is preserved across
14 the reboot and is accessible to the dump-capture kernel.
23 When the system kernel boots, it reserves a small section of memory for
24 the dump-capture kernel. This ensures that ongoing Direct Memory Access
25 (DMA) from the system kernel does not corrupt the dump-capture kernel.
26 The kexec -p command loads the dump-capture kernel into this reserved
30 regardless of where the kernel loads. For simpler handling, the whole
31 low 1M is reserved to avoid any later kernel or device driver writing
33 by kdump kernel without extra handling.
36 regardless of where the kernel is loaded and to support 64K page size
40 with the region [0, crashkernel region size] and then the kdump kernel
41 runs in [0, crashkernel region size]. Therefore no relocatable kernel is
44 All of the necessary information about the system kernel's core image is
45 encoded in the ELF format, and stored in a reserved area of memory
47 passed to the dump-capture kernel through the elfcorehdr= boot
51 With the dump-capture kernel, you can access the memory image through
52 /proc/vmcore. This exports the dump as an ELF-format file that you can
55 options, e.g with '-d 31' it will only write out kernel data. Further,
63 Install kexec-tools
64 -------------------
68 2) Download the kexec-tools user-space package from the following URL:
70 http://kernel.org/pub/linux/utils/kernel/kexec/kexec-tools.tar.gz
74 The latest kexec-tools git tree is available at:
76 - git://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
77 - http://www.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
80 http://www.kernel.org/git/?p=utils/kernel/kexec/kexec-tools.git
82 More information about kexec-tools can be found at
87 	tar xvpzf kexec-tools.tar.gz
89 4) Change to the kexec-tools directory, as follows::
91 	cd kexec-tools-VERSION
106 Build the system and dump-capture kernels
107 -----------------------------------------
110 1) Build a separate custom dump-capture kernel for capturing the
111    kernel core dump.
113 2) Or use the system kernel binary itself as dump-capture kernel and there is
114    no need to build a separate dump-capture kernel. This is possible
115    only with the architectures which support a relocatable kernel. As
117    relocatable kernel.
119 Building a relocatable kernel is advantageous from the point of view that
120 one does not have to build a second kernel for capturing the dump. But
121 at the same time one might want to build a custom dump capture kernel
125 dump-capture kernels for enabling kdump support.
127 System kernel config options
128 ----------------------------
130 1) Enable "kexec system call" or "kexec file based system call" in
139 2) Enable "sysfs file system support" in "Filesystem" -> "Pseudo
144    Note that "sysfs file system support" might not appear in the "Pseudo
145    filesystems" menu if "Configure standard kernel features (expert users)"
146    is not enabled in "General Setup." In this case, check the .config file
151 3) Enable "Compile the kernel with debug info" in "Kernel hacking."::
155    This causes the kernel to be built with debug symbols. The dump
156    analysis tools require a vmlinux with debug symbols in order to read
159 Dump-capture kernel config options (Arch Independent)
160 -----------------------------------------------------
162 1) Enable "kernel crash dumps" support under "Processor type and
171 2) Enable "/proc/vmcore support" under "Filesystems" -> "Pseudo filesystems"::
177 Dump-capture kernel config options (Arch Dependent, i386 and x86_64)
178 --------------------------------------------------------------------
185 2) With CONFIG_SMP=y, usually nr_cpus=1 need specified on the kernel
186    command line when loading the dump-capture kernel because one
187    CPU is enough for kdump kernel to dump vmcore on most of systems.
190    in kdump kernel.
194 3) A relocatable kernel is suggested to be built by default. If not yet,
195    enable "Build a relocatable kernel" support under "Processor type and
200 4) Use a suitable value for "Physical address where the kernel is
202    "kernel crash dumps" is enabled. A suitable value depends upon
203    whether kernel is relocatable or not.
205    If you are using a relocatable kernel use CONFIG_PHYSICAL_START=0x100000
206    This will compile the kernel for physical address 1MB, but given the fact
207    kernel is relocatable, it can be run from any physical address hence
208    kexec boot loader will load it in memory region reserved for dump-capture
209    kernel.
212    second kernel using boot parameter "crashkernel=Y@X". Here X is
213    start of memory region reserved for dump-capture kernel.
217 5) Make and install the kernel and its modules. DO NOT add this kernel
220 Dump-capture kernel config options (Arch Dependent, ppc64)
221 ----------------------------------------------------------
223 1) Enable "Build a kdump crash kernel" support under "Kernel" options::
227 2)   Enable "Build a relocatable kernel" support::
231    Make and install the kernel and its modules.
233 Dump-capture kernel config options (Arch Dependent, arm)
234 ----------------------------------------------------------
236 -   To use a relocatable kernel,
241 Dump-capture kernel config options (Arch Dependent, arm64)
242 ----------------------------------------------------------
244 - Please note that kvm of the dump-capture kernel will not be enabled
245   on non-VHE systems even if it is configured. This is because the CPU
252    Here 'size' specifies how much memory to reserve for the dump-capture kernel
254    "crashkernel=64M@16M" tells the system kernel to reserve 64 MB of memory
255    starting at physical address 0x01000000 (16MB) for the dump-capture kernel.
258    kernel at run time. This is done by specifying the base address as 0,
268    kernel will be aligned to a value (which is Arch dependent), so if the
276    on the value of System RAM -- that's mostly for distributors that pre-setup
277    the kernel command line to avoid a unbootable system after some memory has
283        range=start-[end]
287        crashkernel=512M-2G:64M,2G-:128M
303    When crashkernel=X,high is passed, kernel could allocate physical memory
304    region above 4G, low memory under 4G is needed in this case. There are
307       1) Kernel will allocate at least 256M memory below 4G automatically
314 Boot into System Kernel
315 -----------------------
319 2) Boot the system kernel with the boot parameter "crashkernel=Y@X".
322    start address 'X' is not necessary, kernel will search a suitable
328    on the memory consumption of the kdump system. In general this is not
332    kernel will automatically locate the crash kernel image within the
336    the kernel, X if explicitly specified, must be aligned to 2MiB (0x200000).
338 Load the Dump-capture Kernel
341 After booting to the system kernel, dump-capture kernel needs to be
346 of dump-capture kernel. Following is the summary.
350 	- Use bzImage/vmlinuz if kernel is relocatable.
351 	- Use vmlinux if kernel is not relocatable.
355 	- Use vmlinux
359 	- Use image or bzImage
363 	- Use zImage
367 	- Use vmlinux or Image
370 to load dump-capture kernel::
372    kexec -p <dump-capture-kernel-vmlinux-image> \
373    --initrd=<initrd-for-dump-capture-kernel> --args-linux \
374    --append="root=<root-dev> <arch-specific-options>"
377 to load dump-capture kernel::
379    kexec -p <dump-capture-kernel-bzImage> \
380    --initrd=<initrd-for-dump-capture-kernel> \
381    --append="root=<root-dev> <arch-specific-options>"
384 to load dump-capture kernel::
386    kexec --type zImage -p <dump-capture-kernel-bzImage> \
387    --initrd=<initrd-for-dump-capture-kernel> \
388    --dtb=<dtb-for-dump-capture-kernel> \
389    --append="root=<root-dev> <arch-specific-options>"
392 to load dump-capture kernel::
394    kexec -p <dump-capture-kernel-Image> \
395    --initrd=<initrd-for-dump-capture-kernel> \
396    --append="root=<root-dev> <arch-specific-options>"
399 loading dump-capture kernel.
421 Notes on loading the dump-capture kernel:
423 * By default, the ELF headers are stored in ELF64 format to support
426   So, on non-PAE systems, ELF32 is always used.
428   The --elf32-core-headers option can be used to force the generation of ELF32
430   with ELF64 headers on 32-bit systems.
433   due to shared interrupts in the dump-capture kernel.
435 * You must specify <root-dev> in the format corresponding to the root
436   device name in the output of mount command.
438 * Boot parameter "1" boots the dump-capture kernel into single-user
441 * We generally don't have to bring up a SMP kernel just to capture the
442   dump. Hence generally it is useful either to build a UP dump-capture
443   kernel or specify maxcpus=1 option while loading dump-capture kernel.
447 * You should enable multi-cpu support in dump-capture kernel if you intend
448   to use multi-thread programs with it, such as parallel dump feature of
449   makedumpfile. Otherwise, the multi-thread program may have a great
450   performance degradation. To enable multi-cpu support, you should bring up an
451   SMP dump-capture kernel and specify maxcpus/nr_cpus options while loading it.
454   the elfcorehdr= kernel parameter, it is used by the kdump kernel as it
455   is done on all other architectures. If no elfcorehdr= kernel parameter is
456   specified, the s390x kdump kernel dynamically creates the header. The
460 * For s390x systems with many attached devices the "cio_ignore" kernel
461   parameter should be used for the kdump kernel in order to prevent allocation
462   of kernel memory for devices that are not relevant for kdump. The same
463   applies to systems that use SCSI/FCP devices. In that case the
467 Kernel Panic
470 After successfully loading the dump-capture kernel as previously
471 described, the system will reboot into the dump-capture kernel if a
472 system crash is triggered.  Trigger points are located in panic(),
473 die(), die_nmi() and in the sysrq handler (ALT-SysRq-c).
478 will boot into the dump-capture kernel ( die_nmi() ).
482 the system will boot into the dump-capture kernel.
484 On powerpc systems when a soft-reset is generated, die() is called by all cpus
485 and the system will boot into the dump-capture kernel.
487 For testing purposes, you can trigger a crash by using "ALT-SysRq-c",
488 "echo c > /proc/sysrq-trigger" or write a module to force the panic.
493 After the dump-capture kernel is booted, write out the dump file with
496    cp /proc/vmcore <dump-file>
500    scp /proc/vmcore remote_username@remote_ip:<dump-file>
505    makedumpfile -l --message-level 1 -d 31 /proc/vmcore <dump-file>
510 Before analyzing the dump image, you should reboot into a stable kernel.
513 /proc/vmcore. Use the debug vmlinux built with -g and run the following
516    gdb vmlinux <dump-file>
521 Note: GDB cannot analyze core files generated in ELF64 format for x86.
523 ELF32-format headers using the --elf32-core-headers kernel option on the
524 dump kernel.
526 You can also use the Crash utility to analyze dump files in Kdump
529    https://github.com/crash-utility/crash
532    https://crash-utility.github.io/
537 The kernel parameter, panic_on_warn, calls panic() in all WARN() paths.  This
538 will cause a kdump to occur at the panic() call.  In cases where a user wants
539 to specify this during runtime, /proc/sys/kernel/panic_on_warn can be set to 1
545 The kernel parameter panic_on_taint facilitates a conditional call to panic()
546 from within add_taint() whenever the value set in this bitmask matches with the
548 This will cause a kdump to occur at the add_taint()->panic() call.
553 - kexec@lists.infradead.org