1========== 2VMCOREINFO 3========== 4 5What is it? 6=========== 7 8VMCOREINFO is a special ELF note section. It contains various 9information from the kernel like structure size, page size, symbol 10values, field offsets, etc. These data are packed into an ELF note 11section and used by user-space tools like crash and makedumpfile to 12analyze a kernel's memory layout. 13 14Common variables 15================ 16 17init_uts_ns.name.release 18------------------------ 19 20The version of the Linux kernel. Used to find the corresponding source 21code from which the kernel has been built. For example, crash uses it to 22find the corresponding vmlinux in order to process vmcore. 23 24PAGE_SIZE 25--------- 26 27The size of a page. It is the smallest unit of data used by the memory 28management facilities. It is usually 4096 bytes of size and a page is 29aligned on 4096 bytes. Used for computing page addresses. 30 31init_uts_ns 32----------- 33 34The UTS namespace which is used to isolate two specific elements of the 35system that relate to the uname(2) system call. It is named after the 36data structure used to store information returned by the uname(2) system 37call. 38 39User-space tools can get the kernel name, host name, kernel release 40number, kernel version, architecture name and OS type from it. 41 42node_online_map 43--------------- 44 45An array node_states[N_ONLINE] which represents the set of online nodes 46in a system, one bit position per node number. Used to keep track of 47which nodes are in the system and online. 48 49swapper_pg_dir 50-------------- 51 52The global page directory pointer of the kernel. Used to translate 53virtual to physical addresses. 54 55_stext 56------ 57 58Defines the beginning of the text section. In general, _stext indicates 59the kernel start address. Used to convert a virtual address from the 60direct kernel map to a physical address. 61 62vmap_area_list 63-------------- 64 65Stores the virtual area list. makedumpfile gets the vmalloc start value 66from this variable and its value is necessary for vmalloc translation. 67 68mem_map 69------- 70 71Physical addresses are translated to struct pages by treating them as 72an index into the mem_map array. Right-shifting a physical address 73PAGE_SHIFT bits converts it into a page frame number which is an index 74into that mem_map array. 75 76Used to map an address to the corresponding struct page. 77 78contig_page_data 79---------------- 80 81Makedumpfile gets the pglist_data structure from this symbol, which is 82used to describe the memory layout. 83 84User-space tools use this to exclude free pages when dumping memory. 85 86mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map) 87-------------------------------------------------------------------------- 88 89The address of the mem_section array, its length, structure size, and 90the section_mem_map offset. 91 92It exists in the sparse memory mapping model, and it is also somewhat 93similar to the mem_map variable, both of them are used to translate an 94address. 95 96MAX_PHYSMEM_BITS 97---------------- 98 99Defines the maximum supported physical address space memory. 100 101page 102---- 103 104The size of a page structure. struct page is an important data structure 105and it is widely used to compute contiguous memory. 106 107pglist_data 108----------- 109 110The size of a pglist_data structure. This value is used to check if the 111pglist_data structure is valid. It is also used for checking the memory 112type. 113 114zone 115---- 116 117The size of a zone structure. This value is used to check if the zone 118structure has been found. It is also used for excluding free pages. 119 120free_area 121--------- 122 123The size of a free_area structure. It indicates whether the free_area 124structure is valid or not. Useful when excluding free pages. 125 126list_head 127--------- 128 129The size of a list_head structure. Used when iterating lists in a 130post-mortem analysis session. 131 132nodemask_t 133---------- 134 135The size of a nodemask_t type. Used to compute the number of online 136nodes. 137 138(page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head) 139------------------------------------------------------------------------------------------------- 140 141User-space tools compute their values based on the offset of these 142variables. The variables are used when excluding unnecessary pages. 143 144(pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id) 145----------------------------------------------------------------------------------------- 146 147On NUMA machines, each NUMA node has a pg_data_t to describe its memory 148layout. On UMA machines there is a single pglist_data which describes the 149whole memory. 150 151These values are used to check the memory type and to compute the 152virtual address for memory map. 153 154(zone, free_area|vm_stat|spanned_pages) 155--------------------------------------- 156 157Each node is divided into a number of blocks called zones which 158represent ranges within memory. A zone is described by a structure zone. 159 160User-space tools compute required values based on the offset of these 161variables. 162 163(free_area, free_list) 164---------------------- 165 166Offset of the free_list's member. This value is used to compute the number 167of free pages. 168 169Each zone has a free_area structure array called free_area[MAX_ORDER]. 170The free_list represents a linked list of free page blocks. 171 172(list_head, next|prev) 173---------------------- 174 175Offsets of the list_head's members. list_head is used to define a 176circular linked list. User-space tools need these in order to traverse 177lists. 178 179(vmap_area, va_start|list) 180-------------------------- 181 182Offsets of the vmap_area's members. They carry vmalloc-specific 183information. Makedumpfile gets the start address of the vmalloc region 184from this. 185 186(zone.free_area, MAX_ORDER) 187--------------------------- 188 189Free areas descriptor. User-space tools use this value to iterate the 190free_area ranges. MAX_ORDER is used by the zone buddy allocator. 191 192prb 193--- 194 195A pointer to the printk ringbuffer (struct printk_ringbuffer). This 196may be pointing to the static boot ringbuffer or the dynamically 197allocated ringbuffer, depending on when the the core dump occurred. 198Used by user-space tools to read the active kernel log buffer. 199 200printk_rb_static 201---------------- 202 203A pointer to the static boot printk ringbuffer. If @prb has a 204different value, this is useful for viewing the initial boot messages, 205which may have been overwritten in the dynamically allocated 206ringbuffer. 207 208clear_seq 209--------- 210 211The sequence number of the printk() record after the last clear 212command. It indicates the first record after the last 213SYSLOG_ACTION_CLEAR, like issued by 'dmesg -c'. Used by user-space 214tools to dump a subset of the dmesg log. 215 216printk_ringbuffer 217----------------- 218 219The size of a printk_ringbuffer structure. This structure contains all 220information required for accessing the various components of the 221kernel log buffer. 222 223(printk_ringbuffer, desc_ring|text_data_ring|dict_data_ring|fail) 224----------------------------------------------------------------- 225 226Offsets for the various components of the printk ringbuffer. Used by 227user-space tools to view the kernel log buffer without requiring the 228declaration of the structure. 229 230prb_desc_ring 231------------- 232 233The size of the prb_desc_ring structure. This structure contains 234information about the set of record descriptors. 235 236(prb_desc_ring, count_bits|descs|head_id|tail_id) 237------------------------------------------------- 238 239Offsets for the fields describing the set of record descriptors. Used 240by user-space tools to be able to traverse the descriptors without 241requiring the declaration of the structure. 242 243prb_desc 244-------- 245 246The size of the prb_desc structure. This structure contains 247information about a single record descriptor. 248 249(prb_desc, info|state_var|text_blk_lpos|dict_blk_lpos) 250------------------------------------------------------ 251 252Offsets for the fields describing a record descriptors. Used by 253user-space tools to be able to read descriptors without requiring 254the declaration of the structure. 255 256prb_data_blk_lpos 257----------------- 258 259The size of the prb_data_blk_lpos structure. This structure contains 260information about where the text or dictionary data (data block) is 261located within the respective data ring. 262 263(prb_data_blk_lpos, begin|next) 264------------------------------- 265 266Offsets for the fields describing the location of a data block. Used 267by user-space tools to be able to locate data blocks without 268requiring the declaration of the structure. 269 270printk_info 271----------- 272 273The size of the printk_info structure. This structure contains all 274the meta-data for a record. 275 276(printk_info, seq|ts_nsec|text_len|dict_len|caller_id) 277------------------------------------------------------ 278 279Offsets for the fields providing the meta-data for a record. Used by 280user-space tools to be able to read the information without requiring 281the declaration of the structure. 282 283prb_data_ring 284------------- 285 286The size of the prb_data_ring structure. This structure contains 287information about a set of data blocks. 288 289(prb_data_ring, size_bits|data|head_lpos|tail_lpos) 290--------------------------------------------------- 291 292Offsets for the fields describing a set of data blocks. Used by 293user-space tools to be able to access the data blocks without 294requiring the declaration of the structure. 295 296atomic_long_t 297------------- 298 299The size of the atomic_long_t structure. Used by user-space tools to 300be able to copy the full structure, regardless of its 301architecture-specific implementation. 302 303(atomic_long_t, counter) 304------------------------ 305 306Offset for the long value of an atomic_long_t variable. Used by 307user-space tools to access the long value without requiring the 308architecture-specific declaration. 309 310(free_area.free_list, MIGRATE_TYPES) 311------------------------------------ 312 313The number of migrate types for pages. The free_list is described by the 314array. Used by tools to compute the number of free pages. 315 316NR_FREE_PAGES 317------------- 318 319On linux-2.6.21 or later, the number of free pages is in 320vm_stat[NR_FREE_PAGES]. Used to get the number of free pages. 321 322PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask 323------------------------------------------------------------------------------ 324 325Page attributes. These flags are used to filter various unnecessary for 326dumping pages. 327 328PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline) 329----------------------------------------------------------------------------- 330 331More page attributes. These flags are used to filter various unnecessary for 332dumping pages. 333 334 335HUGETLB_PAGE_DTOR 336----------------- 337 338The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile 339excludes these pages. 340 341x86_64 342====== 343 344phys_base 345--------- 346 347Used to convert the virtual address of an exported kernel symbol to its 348corresponding physical address. 349 350init_top_pgt 351------------ 352 353Used to walk through the whole page table and convert virtual addresses 354to physical addresses. The init_top_pgt is somewhat similar to 355swapper_pg_dir, but it is only used in x86_64. 356 357pgtable_l5_enabled 358------------------ 359 360User-space tools need to know whether the crash kernel was in 5-level 361paging mode. 362 363node_data 364--------- 365 366This is a struct pglist_data array and stores all NUMA nodes 367information. Makedumpfile gets the pglist_data structure from it. 368 369(node_data, MAX_NUMNODES) 370------------------------- 371 372The maximum number of nodes in system. 373 374KERNELOFFSET 375------------ 376 377The kernel randomization offset. Used to compute the page offset. If 378KASLR is disabled, this value is zero. 379 380KERNEL_IMAGE_SIZE 381----------------- 382 383Currently unused by Makedumpfile. Used to compute the module virtual 384address by Crash. 385 386sme_mask 387-------- 388 389AMD-specific with SME support: it indicates the secure memory encryption 390mask. Makedumpfile tools need to know whether the crash kernel was 391encrypted. If SME is enabled in the first kernel, the crash kernel's 392page table entries (pgd/pud/pmd/pte) contain the memory encryption 393mask. This is used to remove the SME mask and obtain the true physical 394address. 395 396Currently, sme_mask stores the value of the C-bit position. If needed, 397additional SME-relevant info can be placed in that variable. 398 399For example:: 400 401 [ misc ][ enc bit ][ other misc SME info ] 402 0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000 403 63 59 55 51 47 43 39 35 31 27 ... 3 404 405x86_32 406====== 407 408X86_PAE 409------- 410 411Denotes whether physical address extensions are enabled. It has the cost 412of a higher page table lookup overhead, and also consumes more page 413table space per process. Used to check whether PAE was enabled in the 414crash kernel when converting virtual addresses to physical addresses. 415 416ia64 417==== 418 419pgdat_list|(pgdat_list, MAX_NUMNODES) 420------------------------------------- 421 422pg_data_t array storing all NUMA nodes information. MAX_NUMNODES 423indicates the number of the nodes. 424 425node_memblk|(node_memblk, NR_NODE_MEMBLKS) 426------------------------------------------ 427 428List of node memory chunks. Filled when parsing the SRAT table to obtain 429information about memory nodes. NR_NODE_MEMBLKS indicates the number of 430node memory chunks. 431 432These values are used to compute the number of nodes the crashed kernel used. 433 434node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size) 435---------------------------------------------------------------- 436 437The size of a struct node_memblk_s and the offsets of the 438node_memblk_s's members. Used to compute the number of nodes. 439 440PGTABLE_3|PGTABLE_4 441------------------- 442 443User-space tools need to know whether the crash kernel was in 3-level or 4444-level paging mode. Used to distinguish the page table. 445 446ARM64 447===== 448 449VA_BITS 450------- 451 452The maximum number of bits for virtual addresses. Used to compute the 453virtual memory ranges. 454 455kimage_voffset 456-------------- 457 458The offset between the kernel virtual and physical mappings. Used to 459translate virtual to physical addresses. 460 461PHYS_OFFSET 462----------- 463 464Indicates the physical address of the start of memory. Similar to 465kimage_voffset, which is used to translate virtual to physical 466addresses. 467 468KERNELOFFSET 469------------ 470 471The kernel randomization offset. Used to compute the page offset. If 472KASLR is disabled, this value is zero. 473 474KERNELPACMASK 475------------- 476 477The mask to extract the Pointer Authentication Code from a kernel virtual 478address. 479 480TCR_EL1.T1SZ 481------------ 482 483Indicates the size offset of the memory region addressed by TTBR1_EL1. 484The region size is 2^(64-T1SZ) bytes. 485 486TTBR1_EL1 is the table base address register specified by ARMv8-A 487architecture which is used to lookup the page-tables for the Virtual 488addresses in the higher VA range (refer to ARMv8 ARM document for 489more details). 490 491arm 492=== 493 494ARM_LPAE 495-------- 496 497It indicates whether the crash kernel supports large physical address 498extensions. Used to translate virtual to physical addresses. 499 500s390 501==== 502 503lowcore_ptr 504----------- 505 506An array with a pointer to the lowcore of every CPU. Used to print the 507psw and all registers information. 508 509high_memory 510----------- 511 512Used to get the vmalloc_start address from the high_memory symbol. 513 514(lowcore_ptr, NR_CPUS) 515---------------------- 516 517The maximum number of CPUs. 518 519powerpc 520======= 521 522 523node_data|(node_data, MAX_NUMNODES) 524----------------------------------- 525 526See above. 527 528contig_page_data 529---------------- 530 531See above. 532 533vmemmap_list 534------------ 535 536The vmemmap_list maintains the entire vmemmap physical mapping. Used 537to get vmemmap list count and populated vmemmap regions info. If the 538vmemmap address translation information is stored in the crash kernel, 539it is used to translate vmemmap kernel virtual addresses. 540 541mmu_vmemmap_psize 542----------------- 543 544The size of a page. Used to translate virtual to physical addresses. 545 546mmu_psize_defs 547-------------- 548 549Page size definitions, i.e. 4k, 64k, or 16M. 550 551Used to make vtop translations. 552 553vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr) 554-------------------------------------------------------------------------------------------- 555 556The vmemmap virtual address space management does not have a traditional 557page table to track which virtual struct pages are backed by a physical 558mapping. The virtual to physical mappings are tracked in a simple linked 559list format. 560 561User-space tools need to know the offset of list, phys and virt_addr 562when computing the count of vmemmap regions. 563 564mmu_psize_def|(mmu_psize_def, shift) 565------------------------------------ 566 567The size of a struct mmu_psize_def and the offset of mmu_psize_def's 568member. 569 570Used in vtop translations. 571 572sh 573== 574 575node_data|(node_data, MAX_NUMNODES) 576----------------------------------- 577 578See above. 579 580X2TLB 581----- 582 583Indicates whether the crashed kernel enabled SH extended mode. 584