admin-guide/kdump/kdump.rst

2 Documentation for Kdump - The kexec-based Crash Dumping Solution
11 Kdump uses kexec to quickly boot to a dump-capture kernel whenever a
12 dump of the system kernel's memory needs to be taken (for example, when
13 the system panics). The system kernel's memory image is preserved across
14 the reboot and is accessible to the dump-capture kernel.
23 When the system kernel boots, it reserves a small section of memory for
24 the dump-capture kernel. This ensures that ongoing Direct Memory Access
25 (DMA) from the system kernel does not corrupt the dump-capture kernel.
26 The kexec -p command loads the dump-capture kernel into this reserved
30 regardless of where the kernel loads. For simpler handling, the whole
31 low 1M is reserved to avoid any later kernel or device driver writing
33 by kdump kernel without extra handling.
36 regardless of where the kernel is loaded and to support 64K page size
40 with the region [0, crashkernel region size] and then the kdump kernel
41 runs in [0, crashkernel region size]. Therefore no relocatable kernel is
44 All of the necessary information about the system kernel's core image is
45 encoded in the ELF format, and stored in a reserved area of memory
47 passed to the dump-capture kernel through the elfcorehdr= boot
51 With the dump-capture kernel, you can access the memory image through
52 /proc/vmcore. This exports the dump as an ELF-format file that you can
55 options, e.g with '-d 31' it will only write out kernel data. Further,
63 Install kexec-tools
64 -------------------
68 2) Download the kexec-tools user-space package from the following URL:
70 http://kernel.org/pub/linux/utils/kernel/kexec/kexec-tools.tar.gz
74 The latest kexec-tools git tree is available at:
76 - git://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
77 - http://www.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
80 http://www.kernel.org/git/?p=utils/kernel/kexec/kexec-tools.git
82 More information about kexec-tools can be found at
87 	tar xvpzf kexec-tools.tar.gz
89 4) Change to the kexec-tools directory, as follows::
91 	cd kexec-tools-VERSION
106 Build the system and dump-capture kernels
107 -----------------------------------------
110 1) Build a separate custom dump-capture kernel for capturing the
111    kernel core dump.
113 2) Or use the system kernel binary itself as dump-capture kernel and there is
114    no need to build a separate dump-capture kernel. This is possible
115    only with the architectures which support a relocatable kernel. As
117    relocatable kernel.
119 Building a relocatable kernel is advantageous from the point of view that
120 one does not have to build a second kernel for capturing the dump. But
121 at the same time one might want to build a custom dump capture kernel
125 dump-capture kernels for enabling kdump support.
127 System kernel config options
128 ----------------------------
130 1) Enable "kexec system call" or "kexec file based system call" in
139 2) Enable "sysfs file system support" in "Filesystem" -> "Pseudo
144    Note that "sysfs file system support" might not appear in the "Pseudo
145    filesystems" menu if "Configure standard kernel features (expert users)"
146    is not enabled in "General Setup." In this case, check the .config file
151 3) Enable "Compile the kernel with debug info" in "Kernel hacking."::
155    This causes the kernel to be built with debug symbols. The dump
156    analysis tools require a vmlinux with debug symbols in order to read
159 Dump-capture kernel config options (Arch Independent)
160 -----------------------------------------------------
162 1) Enable "kernel crash dumps" support under "Processor type and
171 2) Enable "/proc/vmcore support" under "Filesystems" -> "Pseudo filesystems"::
177 Dump-capture kernel config options (Arch Dependent, i386 and x86_64)
178 --------------------------------------------------------------------
189 2) With CONFIG_SMP=y, usually nr_cpus=1 need specified on the kernel
190    command line when loading the dump-capture kernel because one
191    CPU is enough for kdump kernel to dump vmcore on most of systems.
194    in kdump kernel.
198 3) A relocatable kernel is suggested to be built by default. If not yet,
199    enable "Build a relocatable kernel" support under "Processor type and
204 4) Use a suitable value for "Physical address where the kernel is
206    "kernel crash dumps" is enabled. A suitable value depends upon
207    whether kernel is relocatable or not.
209    If you are using a relocatable kernel use CONFIG_PHYSICAL_START=0x100000
210    This will compile the kernel for physical address 1MB, but given the fact
211    kernel is relocatable, it can be run from any physical address hence
212    kexec boot loader will load it in memory region reserved for dump-capture
213    kernel.
216    second kernel using boot parameter "crashkernel=Y@X". Here X is
217    start of memory region reserved for dump-capture kernel.
221 5) Make and install the kernel and its modules. DO NOT add this kernel
224 Dump-capture kernel config options (Arch Dependent, ppc64)
225 ----------------------------------------------------------
227 1) Enable "Build a kdump crash kernel" support under "Kernel" options::
231 2)   Enable "Build a relocatable kernel" support::
235    Make and install the kernel and its modules.
237 Dump-capture kernel config options (Arch Dependent, arm)
238 ----------------------------------------------------------
240 -   To use a relocatable kernel,
245 Dump-capture kernel config options (Arch Dependent, arm64)
246 ----------------------------------------------------------
248 - Please note that kvm of the dump-capture kernel will not be enabled
249   on non-VHE systems even if it is configured. This is because the CPU
256    Here 'size' specifies how much memory to reserve for the dump-capture kernel
258    "crashkernel=64M@16M" tells the system kernel to reserve 64 MB of memory
259    starting at physical address 0x01000000 (16MB) for the dump-capture kernel.
262    kernel at run time. This is done by specifying the base address as 0,
272    kernel will be aligned to a value (which is Arch dependent), so if the
280    on the value of System RAM -- that's mostly for distributors that pre-setup
281    the kernel command line to avoid a unbootable system after some memory has
287        range=start-[end]
291        crashkernel=512M-2G:64M,2G-:128M
307    When crashkernel=X,high is passed, kernel could allocate physical memory
308    region above 4G, low memory under 4G is needed in this case. There are
311       1) Kernel will allocate at least 256M memory below 4G automatically
318 Boot into System Kernel
319 -----------------------
323 2) Boot the system kernel with the boot parameter "crashkernel=Y@X".
326    start address 'X' is not necessary, kernel will search a suitable
332    on the memory consumption of the kdump system. In general this is not
336    kernel will automatically locate the crash kernel image within the
340    the kernel, X if explicitly specified, must be aligned to 2MiB (0x200000).
342 Load the Dump-capture Kernel
345 After booting to the system kernel, dump-capture kernel needs to be
350 of dump-capture kernel. Following is the summary.
354 	- Use bzImage/vmlinuz if kernel is relocatable.
355 	- Use vmlinux if kernel is not relocatable.
359 	- Use vmlinux
363 	- Use image or bzImage
367 	- Use zImage
371 	- Use vmlinux or Image
374 to load dump-capture kernel::
376    kexec -p <dump-capture-kernel-vmlinux-image> \
377    --initrd=<initrd-for-dump-capture-kernel> --args-linux \
378    --append="root=<root-dev> <arch-specific-options>"
381 to load dump-capture kernel::
383    kexec -p <dump-capture-kernel-bzImage> \
384    --initrd=<initrd-for-dump-capture-kernel> \
385    --append="root=<root-dev> <arch-specific-options>"
388 to load dump-capture kernel::
390    kexec --type zImage -p <dump-capture-kernel-bzImage> \
391    --initrd=<initrd-for-dump-capture-kernel> \
392    --dtb=<dtb-for-dump-capture-kernel> \
393    --append="root=<root-dev> <arch-specific-options>"
396 to load dump-capture kernel::
398    kexec -p <dump-capture-kernel-Image> \
399    --initrd=<initrd-for-dump-capture-kernel> \
400    --append="root=<root-dev> <arch-specific-options>"
403 loading dump-capture kernel.
425 Notes on loading the dump-capture kernel:
427 * By default, the ELF headers are stored in ELF64 format to support
430   So, on non-PAE systems, ELF32 is always used.
432   The --elf32-core-headers option can be used to force the generation of ELF32
434   with ELF64 headers on 32-bit systems.
437   due to shared interrupts in the dump-capture kernel.
439 * You must specify <root-dev> in the format corresponding to the root
440   device name in the output of mount command.
442 * Boot parameter "1" boots the dump-capture kernel into single-user
445 * We generally don't have to bring up a SMP kernel just to capture the
446   dump. Hence generally it is useful either to build a UP dump-capture
447   kernel or specify maxcpus=1 option while loading dump-capture kernel.
451 * You should enable multi-cpu support in dump-capture kernel if you intend
452   to use multi-thread programs with it, such as parallel dump feature of
453   makedumpfile. Otherwise, the multi-thread program may have a great
454   performance degradation. To enable multi-cpu support, you should bring up an
455   SMP dump-capture kernel and specify maxcpus/nr_cpus options while loading it.
458   the elfcorehdr= kernel parameter, it is used by the kdump kernel as it
459   is done on all other architectures. If no elfcorehdr= kernel parameter is
460   specified, the s390x kdump kernel dynamically creates the header. The
464 * For s390x systems with many attached devices the "cio_ignore" kernel
465   parameter should be used for the kdump kernel in order to prevent allocation
466   of kernel memory for devices that are not relevant for kdump. The same
467   applies to systems that use SCSI/FCP devices. In that case the
471 Kernel Panic
474 After successfully loading the dump-capture kernel as previously
475 described, the system will reboot into the dump-capture kernel if a
476 system crash is triggered.  Trigger points are located in panic(),
477 die(), die_nmi() and in the sysrq handler (ALT-SysRq-c).
482 will boot into the dump-capture kernel ( die_nmi() ).
486 the system will boot into the dump-capture kernel.
488 On powerpc systems when a soft-reset is generated, die() is called by all cpus
489 and the system will boot into the dump-capture kernel.
491 For testing purposes, you can trigger a crash by using "ALT-SysRq-c",
492 "echo c > /proc/sysrq-trigger" or write a module to force the panic.
497 After the dump-capture kernel is booted, write out the dump file with
500    cp /proc/vmcore <dump-file>
504    scp /proc/vmcore remote_username@remote_ip:<dump-file>
509    makedumpfile -l --message-level 1 -d 31 /proc/vmcore <dump-file>
514 Before analyzing the dump image, you should reboot into a stable kernel.
517 /proc/vmcore. Use the debug vmlinux built with -g and run the following
520    gdb vmlinux <dump-file>
525 Note: GDB cannot analyze core files generated in ELF64 format for x86.
527 ELF32-format headers using the --elf32-core-headers kernel option on the
528 dump kernel.
530 You can also use the Crash utility to analyze dump files in Kdump
533    https://github.com/crash-utility/crash
536    https://crash-utility.github.io/
541 The kernel parameter, panic_on_warn, calls panic() in all WARN() paths.  This
542 will cause a kdump to occur at the panic() call.  In cases where a user wants
543 to specify this during runtime, /proc/sys/kernel/panic_on_warn can be set to 1
549 The kernel parameter panic_on_taint facilitates a conditional call to panic()
550 from within add_taint() whenever the value set in this bitmask matches with the
552 This will cause a kdump to occur at the add_taint()->panic() call.
557 - kexec@lists.infradead.org