1==========
2VMCOREINFO
3==========
4
5What is it?
6===========
7
8VMCOREINFO is a special ELF note section. It contains various
9information from the kernel like structure size, page size, symbol
10values, field offsets, etc. These data are packed into an ELF note
11section and used by user-space tools like crash and makedumpfile to
12analyze a kernel's memory layout.
13
14Common variables
15================
16
17init_uts_ns.name.release
18------------------------
19
20The version of the Linux kernel. Used to find the corresponding source
21code from which the kernel has been built. For example, crash uses it to
22find the corresponding vmlinux in order to process vmcore.
23
24PAGE_SIZE
25---------
26
27The size of a page. It is the smallest unit of data used by the memory
28management facilities. It is usually 4096 bytes of size and a page is
29aligned on 4096 bytes. Used for computing page addresses.
30
31init_uts_ns
32-----------
33
34The UTS namespace which is used to isolate two specific elements of the
35system that relate to the uname(2) system call. It is named after the
36data structure used to store information returned by the uname(2) system
37call.
38
39User-space tools can get the kernel name, host name, kernel release
40number, kernel version, architecture name and OS type from it.
41
42(uts_namespace, name)
43---------------------
44
45Offset of the name's member. Crash Utility and Makedumpfile get
46the start address of the init_uts_ns.name from this.
47
48node_online_map
49---------------
50
51An array node_states[N_ONLINE] which represents the set of online nodes
52in a system, one bit position per node number. Used to keep track of
53which nodes are in the system and online.
54
55swapper_pg_dir
56--------------
57
58The global page directory pointer of the kernel. Used to translate
59virtual to physical addresses.
60
61_stext
62------
63
64Defines the beginning of the text section. In general, _stext indicates
65the kernel start address. Used to convert a virtual address from the
66direct kernel map to a physical address.
67
68vmap_area_list
69--------------
70
71Stores the virtual area list. makedumpfile gets the vmalloc start value
72from this variable and its value is necessary for vmalloc translation.
73
74mem_map
75-------
76
77Physical addresses are translated to struct pages by treating them as
78an index into the mem_map array. Right-shifting a physical address
79PAGE_SHIFT bits converts it into a page frame number which is an index
80into that mem_map array.
81
82Used to map an address to the corresponding struct page.
83
84contig_page_data
85----------------
86
87Makedumpfile gets the pglist_data structure from this symbol, which is
88used to describe the memory layout.
89
90User-space tools use this to exclude free pages when dumping memory.
91
92mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map)
93--------------------------------------------------------------------------
94
95The address of the mem_section array, its length, structure size, and
96the section_mem_map offset.
97
98It exists in the sparse memory mapping model, and it is also somewhat
99similar to the mem_map variable, both of them are used to translate an
100address.
101
102MAX_PHYSMEM_BITS
103----------------
104
105Defines the maximum supported physical address space memory.
106
107page
108----
109
110The size of a page structure. struct page is an important data structure
111and it is widely used to compute contiguous memory.
112
113pglist_data
114-----------
115
116The size of a pglist_data structure. This value is used to check if the
117pglist_data structure is valid. It is also used for checking the memory
118type.
119
120zone
121----
122
123The size of a zone structure. This value is used to check if the zone
124structure has been found. It is also used for excluding free pages.
125
126free_area
127---------
128
129The size of a free_area structure. It indicates whether the free_area
130structure is valid or not. Useful when excluding free pages.
131
132list_head
133---------
134
135The size of a list_head structure. Used when iterating lists in a
136post-mortem analysis session.
137
138nodemask_t
139----------
140
141The size of a nodemask_t type. Used to compute the number of online
142nodes.
143
144(page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head)
145-------------------------------------------------------------------------------------------------
146
147User-space tools compute their values based on the offset of these
148variables. The variables are used when excluding unnecessary pages.
149
150(pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id)
151-----------------------------------------------------------------------------------------
152
153On NUMA machines, each NUMA node has a pg_data_t to describe its memory
154layout. On UMA machines there is a single pglist_data which describes the
155whole memory.
156
157These values are used to check the memory type and to compute the
158virtual address for memory map.
159
160(zone, free_area|vm_stat|spanned_pages)
161---------------------------------------
162
163Each node is divided into a number of blocks called zones which
164represent ranges within memory. A zone is described by a structure zone.
165
166User-space tools compute required values based on the offset of these
167variables.
168
169(free_area, free_list)
170----------------------
171
172Offset of the free_list's member. This value is used to compute the number
173of free pages.
174
175Each zone has a free_area structure array called free_area[MAX_ORDER + 1].
176The free_list represents a linked list of free page blocks.
177
178(list_head, next|prev)
179----------------------
180
181Offsets of the list_head's members. list_head is used to define a
182circular linked list. User-space tools need these in order to traverse
183lists.
184
185(vmap_area, va_start|list)
186--------------------------
187
188Offsets of the vmap_area's members. They carry vmalloc-specific
189information. Makedumpfile gets the start address of the vmalloc region
190from this.
191
192(zone.free_area, MAX_ORDER + 1)
193-------------------------------
194
195Free areas descriptor. User-space tools use this value to iterate the
196free_area ranges. MAX_ORDER is used by the zone buddy allocator.
197
198prb
199---
200
201A pointer to the printk ringbuffer (struct printk_ringbuffer). This
202may be pointing to the static boot ringbuffer or the dynamically
203allocated ringbuffer, depending on when the core dump occurred.
204Used by user-space tools to read the active kernel log buffer.
205
206printk_rb_static
207----------------
208
209A pointer to the static boot printk ringbuffer. If @prb has a
210different value, this is useful for viewing the initial boot messages,
211which may have been overwritten in the dynamically allocated
212ringbuffer.
213
214clear_seq
215---------
216
217The sequence number of the printk() record after the last clear
218command. It indicates the first record after the last
219SYSLOG_ACTION_CLEAR, like issued by 'dmesg -c'. Used by user-space
220tools to dump a subset of the dmesg log.
221
222printk_ringbuffer
223-----------------
224
225The size of a printk_ringbuffer structure. This structure contains all
226information required for accessing the various components of the
227kernel log buffer.
228
229(printk_ringbuffer, desc_ring|text_data_ring|dict_data_ring|fail)
230-----------------------------------------------------------------
231
232Offsets for the various components of the printk ringbuffer. Used by
233user-space tools to view the kernel log buffer without requiring the
234declaration of the structure.
235
236prb_desc_ring
237-------------
238
239The size of the prb_desc_ring structure. This structure contains
240information about the set of record descriptors.
241
242(prb_desc_ring, count_bits|descs|head_id|tail_id)
243-------------------------------------------------
244
245Offsets for the fields describing the set of record descriptors. Used
246by user-space tools to be able to traverse the descriptors without
247requiring the declaration of the structure.
248
249prb_desc
250--------
251
252The size of the prb_desc structure. This structure contains
253information about a single record descriptor.
254
255(prb_desc, info|state_var|text_blk_lpos|dict_blk_lpos)
256------------------------------------------------------
257
258Offsets for the fields describing a record descriptors. Used by
259user-space tools to be able to read descriptors without requiring
260the declaration of the structure.
261
262prb_data_blk_lpos
263-----------------
264
265The size of the prb_data_blk_lpos structure. This structure contains
266information about where the text or dictionary data (data block) is
267located within the respective data ring.
268
269(prb_data_blk_lpos, begin|next)
270-------------------------------
271
272Offsets for the fields describing the location of a data block. Used
273by user-space tools to be able to locate data blocks without
274requiring the declaration of the structure.
275
276printk_info
277-----------
278
279The size of the printk_info structure. This structure contains all
280the meta-data for a record.
281
282(printk_info, seq|ts_nsec|text_len|dict_len|caller_id)
283------------------------------------------------------
284
285Offsets for the fields providing the meta-data for a record. Used by
286user-space tools to be able to read the information without requiring
287the declaration of the structure.
288
289prb_data_ring
290-------------
291
292The size of the prb_data_ring structure. This structure contains
293information about a set of data blocks.
294
295(prb_data_ring, size_bits|data|head_lpos|tail_lpos)
296---------------------------------------------------
297
298Offsets for the fields describing a set of data blocks. Used by
299user-space tools to be able to access the data blocks without
300requiring the declaration of the structure.
301
302atomic_long_t
303-------------
304
305The size of the atomic_long_t structure. Used by user-space tools to
306be able to copy the full structure, regardless of its
307architecture-specific implementation.
308
309(atomic_long_t, counter)
310------------------------
311
312Offset for the long value of an atomic_long_t variable. Used by
313user-space tools to access the long value without requiring the
314architecture-specific declaration.
315
316(free_area.free_list, MIGRATE_TYPES)
317------------------------------------
318
319The number of migrate types for pages. The free_list is described by the
320array. Used by tools to compute the number of free pages.
321
322NR_FREE_PAGES
323-------------
324
325On linux-2.6.21 or later, the number of free pages is in
326vm_stat[NR_FREE_PAGES]. Used to get the number of free pages.
327
328PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask
329------------------------------------------------------------------------------
330
331Page attributes. These flags are used to filter various unnecessary for
332dumping pages.
333
334PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline)
335-----------------------------------------------------------------------------
336
337More page attributes. These flags are used to filter various unnecessary for
338dumping pages.
339
340
341HUGETLB_PAGE_DTOR
342-----------------
343
344The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile
345excludes these pages.
346
347x86_64
348======
349
350phys_base
351---------
352
353Used to convert the virtual address of an exported kernel symbol to its
354corresponding physical address.
355
356init_top_pgt
357------------
358
359Used to walk through the whole page table and convert virtual addresses
360to physical addresses. The init_top_pgt is somewhat similar to
361swapper_pg_dir, but it is only used in x86_64.
362
363pgtable_l5_enabled
364------------------
365
366User-space tools need to know whether the crash kernel was in 5-level
367paging mode.
368
369node_data
370---------
371
372This is a struct pglist_data array and stores all NUMA nodes
373information. Makedumpfile gets the pglist_data structure from it.
374
375(node_data, MAX_NUMNODES)
376-------------------------
377
378The maximum number of nodes in system.
379
380KERNELOFFSET
381------------
382
383The kernel randomization offset. Used to compute the page offset. If
384KASLR is disabled, this value is zero.
385
386KERNEL_IMAGE_SIZE
387-----------------
388
389Currently unused by Makedumpfile. Used to compute the module virtual
390address by Crash.
391
392sme_mask
393--------
394
395AMD-specific with SME support: it indicates the secure memory encryption
396mask. Makedumpfile tools need to know whether the crash kernel was
397encrypted. If SME is enabled in the first kernel, the crash kernel's
398page table entries (pgd/pud/pmd/pte) contain the memory encryption
399mask. This is used to remove the SME mask and obtain the true physical
400address.
401
402Currently, sme_mask stores the value of the C-bit position. If needed,
403additional SME-relevant info can be placed in that variable.
404
405For example::
406
407  [ misc	        ][ enc bit  ][ other misc SME info       ]
408  0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000
409  63   59   55   51   47   43   39   35   31   27   ... 3
410
411x86_32
412======
413
414X86_PAE
415-------
416
417Denotes whether physical address extensions are enabled. It has the cost
418of a higher page table lookup overhead, and also consumes more page
419table space per process. Used to check whether PAE was enabled in the
420crash kernel when converting virtual addresses to physical addresses.
421
422ia64
423====
424
425pgdat_list|(pgdat_list, MAX_NUMNODES)
426-------------------------------------
427
428pg_data_t array storing all NUMA nodes information. MAX_NUMNODES
429indicates the number of the nodes.
430
431node_memblk|(node_memblk, NR_NODE_MEMBLKS)
432------------------------------------------
433
434List of node memory chunks. Filled when parsing the SRAT table to obtain
435information about memory nodes. NR_NODE_MEMBLKS indicates the number of
436node memory chunks.
437
438These values are used to compute the number of nodes the crashed kernel used.
439
440node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size)
441----------------------------------------------------------------
442
443The size of a struct node_memblk_s and the offsets of the
444node_memblk_s's members. Used to compute the number of nodes.
445
446PGTABLE_3|PGTABLE_4
447-------------------
448
449User-space tools need to know whether the crash kernel was in 3-level or
4504-level paging mode. Used to distinguish the page table.
451
452ARM64
453=====
454
455VA_BITS
456-------
457
458The maximum number of bits for virtual addresses. Used to compute the
459virtual memory ranges.
460
461kimage_voffset
462--------------
463
464The offset between the kernel virtual and physical mappings. Used to
465translate virtual to physical addresses.
466
467PHYS_OFFSET
468-----------
469
470Indicates the physical address of the start of memory. Similar to
471kimage_voffset, which is used to translate virtual to physical
472addresses.
473
474KERNELOFFSET
475------------
476
477The kernel randomization offset. Used to compute the page offset. If
478KASLR is disabled, this value is zero.
479
480KERNELPACMASK
481-------------
482
483The mask to extract the Pointer Authentication Code from a kernel virtual
484address.
485
486TCR_EL1.T1SZ
487------------
488
489Indicates the size offset of the memory region addressed by TTBR1_EL1.
490The region size is 2^(64-T1SZ) bytes.
491
492TTBR1_EL1 is the table base address register specified by ARMv8-A
493architecture which is used to lookup the page-tables for the Virtual
494addresses in the higher VA range (refer to ARMv8 ARM document for
495more details).
496
497MODULES_VADDR|MODULES_END|VMALLOC_START|VMALLOC_END|VMEMMAP_START|VMEMMAP_END
498-----------------------------------------------------------------------------
499
500Used to get the correct ranges:
501	MODULES_VADDR ~ MODULES_END-1 : Kernel module space.
502	VMALLOC_START ~ VMALLOC_END-1 : vmalloc() / ioremap() space.
503	VMEMMAP_START ~ VMEMMAP_END-1 : vmemmap region, used for struct page array.
504
505arm
506===
507
508ARM_LPAE
509--------
510
511It indicates whether the crash kernel supports large physical address
512extensions. Used to translate virtual to physical addresses.
513
514s390
515====
516
517lowcore_ptr
518-----------
519
520An array with a pointer to the lowcore of every CPU. Used to print the
521psw and all registers information.
522
523high_memory
524-----------
525
526Used to get the vmalloc_start address from the high_memory symbol.
527
528(lowcore_ptr, NR_CPUS)
529----------------------
530
531The maximum number of CPUs.
532
533powerpc
534=======
535
536
537node_data|(node_data, MAX_NUMNODES)
538-----------------------------------
539
540See above.
541
542contig_page_data
543----------------
544
545See above.
546
547vmemmap_list
548------------
549
550The vmemmap_list maintains the entire vmemmap physical mapping. Used
551to get vmemmap list count and populated vmemmap regions info. If the
552vmemmap address translation information is stored in the crash kernel,
553it is used to translate vmemmap kernel virtual addresses.
554
555mmu_vmemmap_psize
556-----------------
557
558The size of a page. Used to translate virtual to physical addresses.
559
560mmu_psize_defs
561--------------
562
563Page size definitions, i.e. 4k, 64k, or 16M.
564
565Used to make vtop translations.
566
567vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr)
568--------------------------------------------------------------------------------------------
569
570The vmemmap virtual address space management does not have a traditional
571page table to track which virtual struct pages are backed by a physical
572mapping. The virtual to physical mappings are tracked in a simple linked
573list format.
574
575User-space tools need to know the offset of list, phys and virt_addr
576when computing the count of vmemmap regions.
577
578mmu_psize_def|(mmu_psize_def, shift)
579------------------------------------
580
581The size of a struct mmu_psize_def and the offset of mmu_psize_def's
582member.
583
584Used in vtop translations.
585
586sh
587==
588
589node_data|(node_data, MAX_NUMNODES)
590-----------------------------------
591
592See above.
593
594X2TLB
595-----
596
597Indicates whether the crashed kernel enabled SH extended mode.
598
599RISCV64
600=======
601
602VA_BITS
603-------
604
605The maximum number of bits for virtual addresses. Used to compute the
606virtual memory ranges.
607
608PAGE_OFFSET
609-----------
610
611Indicates the virtual kernel start address of the direct-mapped RAM region.
612
613phys_ram_base
614-------------
615
616Indicates the start physical RAM address.
617
618MODULES_VADDR|MODULES_END|VMALLOC_START|VMALLOC_END|VMEMMAP_START|VMEMMAP_END|KERNEL_LINK_ADDR
619----------------------------------------------------------------------------------------------
620
621Used to get the correct ranges:
622
623  * MODULES_VADDR ~ MODULES_END : Kernel module space.
624  * VMALLOC_START ~ VMALLOC_END : vmalloc() / ioremap() space.
625  * VMEMMAP_START ~ VMEMMAP_END : vmemmap space, used for struct page array.
626  * KERNEL_LINK_ADDR : start address of Kernel link and BPF
627