1========== 2VMCOREINFO 3========== 4 5What is it? 6=========== 7 8VMCOREINFO is a special ELF note section. It contains various 9information from the kernel like structure size, page size, symbol 10values, field offsets, etc. These data are packed into an ELF note 11section and used by user-space tools like crash and makedumpfile to 12analyze a kernel's memory layout. 13 14Common variables 15================ 16 17init_uts_ns.name.release 18------------------------ 19 20The version of the Linux kernel. Used to find the corresponding source 21code from which the kernel has been built. For example, crash uses it to 22find the corresponding vmlinux in order to process vmcore. 23 24PAGE_SIZE 25--------- 26 27The size of a page. It is the smallest unit of data used by the memory 28management facilities. It is usually 4096 bytes of size and a page is 29aligned on 4096 bytes. Used for computing page addresses. 30 31init_uts_ns 32----------- 33 34The UTS namespace which is used to isolate two specific elements of the 35system that relate to the uname(2) system call. It is named after the 36data structure used to store information returned by the uname(2) system 37call. 38 39User-space tools can get the kernel name, host name, kernel release 40number, kernel version, architecture name and OS type from it. 41 42node_online_map 43--------------- 44 45An array node_states[N_ONLINE] which represents the set of online nodes 46in a system, one bit position per node number. Used to keep track of 47which nodes are in the system and online. 48 49swapper_pg_dir 50-------------- 51 52The global page directory pointer of the kernel. Used to translate 53virtual to physical addresses. 54 55_stext 56------ 57 58Defines the beginning of the text section. In general, _stext indicates 59the kernel start address. Used to convert a virtual address from the 60direct kernel map to a physical address. 61 62vmap_area_list 63-------------- 64 65Stores the virtual area list. makedumpfile gets the vmalloc start value 66from this variable and its value is necessary for vmalloc translation. 67 68mem_map 69------- 70 71Physical addresses are translated to struct pages by treating them as 72an index into the mem_map array. Right-shifting a physical address 73PAGE_SHIFT bits converts it into a page frame number which is an index 74into that mem_map array. 75 76Used to map an address to the corresponding struct page. 77 78contig_page_data 79---------------- 80 81Makedumpfile gets the pglist_data structure from this symbol, which is 82used to describe the memory layout. 83 84User-space tools use this to exclude free pages when dumping memory. 85 86mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map) 87-------------------------------------------------------------------------- 88 89The address of the mem_section array, its length, structure size, and 90the section_mem_map offset. 91 92It exists in the sparse memory mapping model, and it is also somewhat 93similar to the mem_map variable, both of them are used to translate an 94address. 95 96MAX_PHYSMEM_BITS 97---------------- 98 99Defines the maximum supported physical address space memory. 100 101page 102---- 103 104The size of a page structure. struct page is an important data structure 105and it is widely used to compute contiguous memory. 106 107pglist_data 108----------- 109 110The size of a pglist_data structure. This value is used to check if the 111pglist_data structure is valid. It is also used for checking the memory 112type. 113 114zone 115---- 116 117The size of a zone structure. This value is used to check if the zone 118structure has been found. It is also used for excluding free pages. 119 120free_area 121--------- 122 123The size of a free_area structure. It indicates whether the free_area 124structure is valid or not. Useful when excluding free pages. 125 126list_head 127--------- 128 129The size of a list_head structure. Used when iterating lists in a 130post-mortem analysis session. 131 132nodemask_t 133---------- 134 135The size of a nodemask_t type. Used to compute the number of online 136nodes. 137 138(page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head) 139------------------------------------------------------------------------------------------------- 140 141User-space tools compute their values based on the offset of these 142variables. The variables are used when excluding unnecessary pages. 143 144(pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id) 145----------------------------------------------------------------------------------------- 146 147On NUMA machines, each NUMA node has a pg_data_t to describe its memory 148layout. On UMA machines there is a single pglist_data which describes the 149whole memory. 150 151These values are used to check the memory type and to compute the 152virtual address for memory map. 153 154(zone, free_area|vm_stat|spanned_pages) 155--------------------------------------- 156 157Each node is divided into a number of blocks called zones which 158represent ranges within memory. A zone is described by a structure zone. 159 160User-space tools compute required values based on the offset of these 161variables. 162 163(free_area, free_list) 164---------------------- 165 166Offset of the free_list's member. This value is used to compute the number 167of free pages. 168 169Each zone has a free_area structure array called free_area[MAX_ORDER]. 170The free_list represents a linked list of free page blocks. 171 172(list_head, next|prev) 173---------------------- 174 175Offsets of the list_head's members. list_head is used to define a 176circular linked list. User-space tools need these in order to traverse 177lists. 178 179(vmap_area, va_start|list) 180-------------------------- 181 182Offsets of the vmap_area's members. They carry vmalloc-specific 183information. Makedumpfile gets the start address of the vmalloc region 184from this. 185 186(zone.free_area, MAX_ORDER) 187--------------------------- 188 189Free areas descriptor. User-space tools use this value to iterate the 190free_area ranges. MAX_ORDER is used by the zone buddy allocator. 191 192log_first_idx 193------------- 194 195Index of the first record stored in the buffer log_buf. Used by 196user-space tools to read the strings in the log_buf. 197 198log_buf 199------- 200 201Console output is written to the ring buffer log_buf at index 202log_first_idx. Used to get the kernel log. 203 204log_buf_len 205----------- 206 207log_buf's length. 208 209clear_idx 210--------- 211 212The index that the next printk() record to read after the last clear 213command. It indicates the first record after the last SYSLOG_ACTION 214_CLEAR, like issued by 'dmesg -c'. Used by user-space tools to dump 215the dmesg log. 216 217log_next_idx 218------------ 219 220The index of the next record to store in the buffer log_buf. Used to 221compute the index of the current buffer position. 222 223printk_log 224---------- 225 226The size of a structure printk_log. Used to compute the size of 227messages, and extract dmesg log. It encapsulates header information for 228log_buf, such as timestamp, syslog level, etc. 229 230(printk_log, ts_nsec|len|text_len|dict_len) 231------------------------------------------- 232 233It represents field offsets in struct printk_log. User space tools 234parse it and check whether the values of printk_log's members have been 235changed. 236 237(free_area.free_list, MIGRATE_TYPES) 238------------------------------------ 239 240The number of migrate types for pages. The free_list is described by the 241array. Used by tools to compute the number of free pages. 242 243NR_FREE_PAGES 244------------- 245 246On linux-2.6.21 or later, the number of free pages is in 247vm_stat[NR_FREE_PAGES]. Used to get the number of free pages. 248 249PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask 250------------------------------------------------------------------------------ 251 252Page attributes. These flags are used to filter various unnecessary for 253dumping pages. 254 255PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline) 256----------------------------------------------------------------------------- 257 258More page attributes. These flags are used to filter various unnecessary for 259dumping pages. 260 261 262HUGETLB_PAGE_DTOR 263----------------- 264 265The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile 266excludes these pages. 267 268x86_64 269====== 270 271phys_base 272--------- 273 274Used to convert the virtual address of an exported kernel symbol to its 275corresponding physical address. 276 277init_top_pgt 278------------ 279 280Used to walk through the whole page table and convert virtual addresses 281to physical addresses. The init_top_pgt is somewhat similar to 282swapper_pg_dir, but it is only used in x86_64. 283 284pgtable_l5_enabled 285------------------ 286 287User-space tools need to know whether the crash kernel was in 5-level 288paging mode. 289 290node_data 291--------- 292 293This is a struct pglist_data array and stores all NUMA nodes 294information. Makedumpfile gets the pglist_data structure from it. 295 296(node_data, MAX_NUMNODES) 297------------------------- 298 299The maximum number of nodes in system. 300 301KERNELOFFSET 302------------ 303 304The kernel randomization offset. Used to compute the page offset. If 305KASLR is disabled, this value is zero. 306 307KERNEL_IMAGE_SIZE 308----------------- 309 310Currently unused by Makedumpfile. Used to compute the module virtual 311address by Crash. 312 313sme_mask 314-------- 315 316AMD-specific with SME support: it indicates the secure memory encryption 317mask. Makedumpfile tools need to know whether the crash kernel was 318encrypted. If SME is enabled in the first kernel, the crash kernel's 319page table entries (pgd/pud/pmd/pte) contain the memory encryption 320mask. This is used to remove the SME mask and obtain the true physical 321address. 322 323Currently, sme_mask stores the value of the C-bit position. If needed, 324additional SME-relevant info can be placed in that variable. 325 326For example:: 327 328 [ misc ][ enc bit ][ other misc SME info ] 329 0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000 330 63 59 55 51 47 43 39 35 31 27 ... 3 331 332x86_32 333====== 334 335X86_PAE 336------- 337 338Denotes whether physical address extensions are enabled. It has the cost 339of a higher page table lookup overhead, and also consumes more page 340table space per process. Used to check whether PAE was enabled in the 341crash kernel when converting virtual addresses to physical addresses. 342 343ia64 344==== 345 346pgdat_list|(pgdat_list, MAX_NUMNODES) 347------------------------------------- 348 349pg_data_t array storing all NUMA nodes information. MAX_NUMNODES 350indicates the number of the nodes. 351 352node_memblk|(node_memblk, NR_NODE_MEMBLKS) 353------------------------------------------ 354 355List of node memory chunks. Filled when parsing the SRAT table to obtain 356information about memory nodes. NR_NODE_MEMBLKS indicates the number of 357node memory chunks. 358 359These values are used to compute the number of nodes the crashed kernel used. 360 361node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size) 362---------------------------------------------------------------- 363 364The size of a struct node_memblk_s and the offsets of the 365node_memblk_s's members. Used to compute the number of nodes. 366 367PGTABLE_3|PGTABLE_4 368------------------- 369 370User-space tools need to know whether the crash kernel was in 3-level or 3714-level paging mode. Used to distinguish the page table. 372 373ARM64 374===== 375 376VA_BITS 377------- 378 379The maximum number of bits for virtual addresses. Used to compute the 380virtual memory ranges. 381 382kimage_voffset 383-------------- 384 385The offset between the kernel virtual and physical mappings. Used to 386translate virtual to physical addresses. 387 388PHYS_OFFSET 389----------- 390 391Indicates the physical address of the start of memory. Similar to 392kimage_voffset, which is used to translate virtual to physical 393addresses. 394 395KERNELOFFSET 396------------ 397 398The kernel randomization offset. Used to compute the page offset. If 399KASLR is disabled, this value is zero. 400 401KERNELPACMASK 402------------- 403 404The mask to extract the Pointer Authentication Code from a kernel virtual 405address. 406 407TCR_EL1.T1SZ 408------------ 409 410Indicates the size offset of the memory region addressed by TTBR1_EL1. 411The region size is 2^(64-T1SZ) bytes. 412 413TTBR1_EL1 is the table base address register specified by ARMv8-A 414architecture which is used to lookup the page-tables for the Virtual 415addresses in the higher VA range (refer to ARMv8 ARM document for 416more details). 417 418arm 419=== 420 421ARM_LPAE 422-------- 423 424It indicates whether the crash kernel supports large physical address 425extensions. Used to translate virtual to physical addresses. 426 427s390 428==== 429 430lowcore_ptr 431----------- 432 433An array with a pointer to the lowcore of every CPU. Used to print the 434psw and all registers information. 435 436high_memory 437----------- 438 439Used to get the vmalloc_start address from the high_memory symbol. 440 441(lowcore_ptr, NR_CPUS) 442---------------------- 443 444The maximum number of CPUs. 445 446powerpc 447======= 448 449 450node_data|(node_data, MAX_NUMNODES) 451----------------------------------- 452 453See above. 454 455contig_page_data 456---------------- 457 458See above. 459 460vmemmap_list 461------------ 462 463The vmemmap_list maintains the entire vmemmap physical mapping. Used 464to get vmemmap list count and populated vmemmap regions info. If the 465vmemmap address translation information is stored in the crash kernel, 466it is used to translate vmemmap kernel virtual addresses. 467 468mmu_vmemmap_psize 469----------------- 470 471The size of a page. Used to translate virtual to physical addresses. 472 473mmu_psize_defs 474-------------- 475 476Page size definitions, i.e. 4k, 64k, or 16M. 477 478Used to make vtop translations. 479 480vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr) 481-------------------------------------------------------------------------------------------- 482 483The vmemmap virtual address space management does not have a traditional 484page table to track which virtual struct pages are backed by a physical 485mapping. The virtual to physical mappings are tracked in a simple linked 486list format. 487 488User-space tools need to know the offset of list, phys and virt_addr 489when computing the count of vmemmap regions. 490 491mmu_psize_def|(mmu_psize_def, shift) 492------------------------------------ 493 494The size of a struct mmu_psize_def and the offset of mmu_psize_def's 495member. 496 497Used in vtop translations. 498 499sh 500== 501 502node_data|(node_data, MAX_NUMNODES) 503----------------------------------- 504 505See above. 506 507X2TLB 508----- 509 510Indicates whether the crashed kernel enabled SH extended mode. 511