admin-guide/kdump/kdump.rst

2 Documentation for Kdump - The kexec-based Crash Dumping Solution
11 Kdump uses kexec to quickly boot to a dump-capture kernel whenever a
12 dump of the system kernel's memory needs to be taken (for example, when
13 the system panics). The system kernel's memory image is preserved across
14 the reboot and is accessible to the dump-capture kernel.
23 When the system kernel boots, it reserves a small section of memory for
24 the dump-capture kernel. This ensures that ongoing Direct Memory Access
25 (DMA) from the system kernel does not corrupt the dump-capture kernel.
26 The kexec -p command loads the dump-capture kernel into this reserved
30 regardless of where the kernel loads. For simpler handling, the whole
31 low 1M is reserved to avoid any later kernel or device driver writing
33 by kdump kernel without extra handling.
36 regardless of where the kernel is loaded and to support 64K page size
40 with the region [0, crashkernel region size] and then the kdump kernel
41 runs in [0, crashkernel region size]. Therefore no relocatable kernel is
44 All of the necessary information about the system kernel's core image is
45 encoded in the ELF format, and stored in a reserved area of memory
47 passed to the dump-capture kernel through the elfcorehdr= boot
51 With the dump-capture kernel, you can access the memory image through
52 /proc/vmcore. This exports the dump as an ELF-format file that you can
55 options, e.g with '-d 31' it will only write out kernel data. Further,
63 Install kexec-tools
64 -------------------
68 2) Download the kexec-tools user-space package from the following URL:
70 http://kernel.org/pub/linux/utils/kernel/kexec/kexec-tools.tar.gz
74 The latest kexec-tools git tree is available at:
76 - git://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
77 - http://www.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
80 http://www.kernel.org/git/?p=utils/kernel/kexec/kexec-tools.git
82 More information about kexec-tools can be found at
87 	tar xvpzf kexec-tools.tar.gz
89 4) Change to the kexec-tools directory, as follows::
91 	cd kexec-tools-VERSION
106 Build the system and dump-capture kernels
107 -----------------------------------------
110 1) Build a separate custom dump-capture kernel for capturing the
111    kernel core dump.
113 2) Or use the system kernel binary itself as dump-capture kernel and there is
114    no need to build a separate dump-capture kernel. This is possible
115    only with the architectures which support a relocatable kernel. As
117    relocatable kernel.
119 Building a relocatable kernel is advantageous from the point of view that
120 one does not have to build a second kernel for capturing the dump. But
121 at the same time one might want to build a custom dump capture kernel
125 dump-capture kernels for enabling kdump support.
127 System kernel config options
128 ----------------------------
130 1) Enable "kexec system call" or "kexec file based system call" in
143 2) Enable "sysfs file system support" in "Filesystem" -> "Pseudo
148    Note that "sysfs file system support" might not appear in the "Pseudo
149    filesystems" menu if "Configure standard kernel features (expert users)"
150    is not enabled in "General Setup." In this case, check the .config file
155 3) Enable "Compile the kernel with debug info" in "Kernel hacking."::
159    This causes the kernel to be built with debug symbols. The dump
160    analysis tools require a vmlinux with debug symbols in order to read
163 Dump-capture kernel config options (Arch Independent)
164 -----------------------------------------------------
166 1) Enable "kernel crash dumps" support under "Processor type and
171 2) Enable "/proc/vmcore support" under "Filesystems" -> "Pseudo filesystems"::
177 Dump-capture kernel config options (Arch Dependent, i386 and x86_64)
178 --------------------------------------------------------------------
189 2) With CONFIG_SMP=y, usually nr_cpus=1 need specified on the kernel
190    command line when loading the dump-capture kernel because one
191    CPU is enough for kdump kernel to dump vmcore on most of systems.
194    in kdump kernel. In this case, "disable_cpu_apicid=" is needed to
195    tell kdump kernel which cpu is 1st kernel's BSP. Please refer to
196    admin-guide/kernel-parameters.txt for more details.
200 3) A relocatable kernel is suggested to be built by default. If not yet,
201    enable "Build a relocatable kernel" support under "Processor type and
206 4) Use a suitable value for "Physical address where the kernel is
208    "kernel crash dumps" is enabled. A suitable value depends upon
209    whether kernel is relocatable or not.
211    If you are using a relocatable kernel use CONFIG_PHYSICAL_START=0x100000
212    This will compile the kernel for physical address 1MB, but given the fact
213    kernel is relocatable, it can be run from any physical address hence
214    kexec boot loader will load it in memory region reserved for dump-capture
215    kernel.
218    second kernel using boot parameter "crashkernel=Y@X". Here X is
219    start of memory region reserved for dump-capture kernel.
223 5) Make and install the kernel and its modules. DO NOT add this kernel
226 Dump-capture kernel config options (Arch Dependent, ppc64)
227 ----------------------------------------------------------
229 1) Enable "Build a kdump crash kernel" support under "Kernel" options::
233 2)   Enable "Build a relocatable kernel" support::
237    Make and install the kernel and its modules.
239 Dump-capture kernel config options (Arch Dependent, ia64)
240 ----------------------------------------------------------
242 - No specific options are required to create a dump-capture kernel
243   for ia64, other than those specified in the arch independent section
244   above. This means that it is possible to use the system kernel
245   as a dump-capture kernel if desired.
248   kernel at runtime. This is done by specifying the base address as 0,
257 Dump-capture kernel config options (Arch Dependent, arm)
258 ----------------------------------------------------------
260 -   To use a relocatable kernel,
265 Dump-capture kernel config options (Arch Dependent, arm64)
266 ----------------------------------------------------------
268 - Please note that kvm of the dump-capture kernel will not be enabled
269   on non-VHE systems even if it is configured. This is because the CPU
276    Here 'size' specifies how much memory to reserve for the dump-capture kernel
278    "crashkernel=64M@16M" tells the system kernel to reserve 64 MB of memory
279    starting at physical address 0x01000000 (16MB) for the dump-capture kernel.
282    kernel at run time. This is done by specifying the base address as 0,
292    kernel will be aligned to a value (which is Arch dependent), so if the
300    on the value of System RAM -- that's mostly for distributors that pre-setup
301    the kernel command line to avoid a unbootable system after some memory has
307        range=start-[end]
311        crashkernel=512M-2G:64M,2G-:128M
327    When crashkernel=X,high is passed, kernel could allocate physical memory
328    region above 4G, low memory under 4G is needed in this case. There are
331       1) Kernel will allocate at least 256M memory below 4G automatically
338 Boot into System Kernel
339 -----------------------
343 2) Boot the system kernel with the boot parameter "crashkernel=Y@X".
346    start address 'X' is not necessary, kernel will search a suitable
353    dump-capture kernel config option notes above.
357    on the memory consumption of the kdump system. In general this is not
361    kernel will automatically locate the crash kernel image within the
365    the kernel, X if explicitly specified, must be aligned to 2MiB (0x200000).
367 Load the Dump-capture Kernel
370 After booting to the system kernel, dump-capture kernel needs to be
375 of dump-capture kernel. Following is the summary.
379 	- Use bzImage/vmlinuz if kernel is relocatable.
380 	- Use vmlinux if kernel is not relocatable.
384 	- Use vmlinux
388 	- Use vmlinux or vmlinuz.gz
392 	- Use image or bzImage
396 	- Use zImage
400 	- Use vmlinux or Image
403 to load dump-capture kernel::
405    kexec -p <dump-capture-kernel-vmlinux-image> \
406    --initrd=<initrd-for-dump-capture-kernel> --args-linux \
407    --append="root=<root-dev> <arch-specific-options>"
410 to load dump-capture kernel::
412    kexec -p <dump-capture-kernel-bzImage> \
413    --initrd=<initrd-for-dump-capture-kernel> \
414    --append="root=<root-dev> <arch-specific-options>"
417 to load dump-capture kernel::
419    kexec --type zImage -p <dump-capture-kernel-bzImage> \
420    --initrd=<initrd-for-dump-capture-kernel> \
421    --dtb=<dtb-for-dump-capture-kernel> \
422    --append="root=<root-dev> <arch-specific-options>"
425 to load dump-capture kernel::
427    kexec -p <dump-capture-kernel-Image> \
428    --initrd=<initrd-for-dump-capture-kernel> \
429    --append="root=<root-dev> <arch-specific-options>"
431 Please note, that --args-linux does not need to be specified for ia64.
432 It is planned to make this a no-op on that architecture, but for now
436 loading dump-capture kernel.
458 Notes on loading the dump-capture kernel:
460 * By default, the ELF headers are stored in ELF64 format to support
463   So, on non-PAE systems, ELF32 is always used.
465   The --elf32-core-headers option can be used to force the generation of ELF32
467   with ELF64 headers on 32-bit systems.
470   due to shared interrupts in the dump-capture kernel.
472 * You must specify <root-dev> in the format corresponding to the root
473   device name in the output of mount command.
475 * Boot parameter "1" boots the dump-capture kernel into single-user
478 * We generally don't have to bring up a SMP kernel just to capture the
479   dump. Hence generally it is useful either to build a UP dump-capture
480   kernel or specify maxcpus=1 option while loading dump-capture kernel.
484 * You should enable multi-cpu support in dump-capture kernel if you intend
485   to use multi-thread programs with it, such as parallel dump feature of
486   makedumpfile. Otherwise, the multi-thread program may have a great
487   performance degradation. To enable multi-cpu support, you should bring up an
488   SMP dump-capture kernel and specify maxcpus/nr_cpus, disable_cpu_apicid=[X]
492   the elfcorehdr= kernel parameter, it is used by the kdump kernel as it
493   is done on all other architectures. If no elfcorehdr= kernel parameter is
494   specified, the s390x kdump kernel dynamically creates the header. The
498 * For s390x systems with many attached devices the "cio_ignore" kernel
499   parameter should be used for the kdump kernel in order to prevent allocation
500   of kernel memory for devices that are not relevant for kdump. The same
501   applies to systems that use SCSI/FCP devices. In that case the
505 Kernel Panic
508 After successfully loading the dump-capture kernel as previously
509 described, the system will reboot into the dump-capture kernel if a
510 system crash is triggered.  Trigger points are located in panic(),
511 die(), die_nmi() and in the sysrq handler (ALT-SysRq-c).
516 will boot into the dump-capture kernel ( die_nmi() ).
520 the system will boot into the dump-capture kernel.
522 On powerpc systems when a soft-reset is generated, die() is called by all cpus
523 and the system will boot into the dump-capture kernel.
525 For testing purposes, you can trigger a crash by using "ALT-SysRq-c",
526 "echo c > /proc/sysrq-trigger" or write a module to force the panic.
531 After the dump-capture kernel is booted, write out the dump file with
534    cp /proc/vmcore <dump-file>
538    scp /proc/vmcore remote_username@remote_ip:<dump-file>
543    makedumpfile -l --message-level 1 -d 31 /proc/vmcore <dump-file>
548 Before analyzing the dump image, you should reboot into a stable kernel.
551 /proc/vmcore. Use the debug vmlinux built with -g and run the following
554    gdb vmlinux <dump-file>
559 Note: GDB cannot analyze core files generated in ELF64 format for x86.
561 ELF32-format headers using the --elf32-core-headers kernel option on the
562 dump kernel.
564 You can also use the Crash utility to analyze dump files in Kdump
567    https://github.com/crash-utility/crash
570    https://crash-utility.github.io/
575 The kernel parameter, panic_on_warn, calls panic() in all WARN() paths.  This
576 will cause a kdump to occur at the panic() call.  In cases where a user wants
577 to specify this during runtime, /proc/sys/kernel/panic_on_warn can be set to 1
583 The kernel parameter panic_on_taint facilitates a conditional call to panic()
584 from within add_taint() whenever the value set in this bitmask matches with the
586 This will cause a kdump to occur at the add_taint()->panic() call.
591 - kexec@lists.infradead.org