1========== 2VMCOREINFO 3========== 4 5What is it? 6=========== 7 8VMCOREINFO is a special ELF note section. It contains various 9information from the kernel like structure size, page size, symbol 10values, field offsets, etc. These data are packed into an ELF note 11section and used by user-space tools like crash and makedumpfile to 12analyze a kernel's memory layout. 13 14Common variables 15================ 16 17init_uts_ns.name.release 18------------------------ 19 20The version of the Linux kernel. Used to find the corresponding source 21code from which the kernel has been built. For example, crash uses it to 22find the corresponding vmlinux in order to process vmcore. 23 24PAGE_SIZE 25--------- 26 27The size of a page. It is the smallest unit of data used by the memory 28management facilities. It is usually 4096 bytes of size and a page is 29aligned on 4096 bytes. Used for computing page addresses. 30 31init_uts_ns 32----------- 33 34The UTS namespace which is used to isolate two specific elements of the 35system that relate to the uname(2) system call. It is named after the 36data structure used to store information returned by the uname(2) system 37call. 38 39User-space tools can get the kernel name, host name, kernel release 40number, kernel version, architecture name and OS type from it. 41 42node_online_map 43--------------- 44 45An array node_states[N_ONLINE] which represents the set of online nodes 46in a system, one bit position per node number. Used to keep track of 47which nodes are in the system and online. 48 49swapper_pg_dir 50-------------- 51 52The global page directory pointer of the kernel. Used to translate 53virtual to physical addresses. 54 55_stext 56------ 57 58Defines the beginning of the text section. In general, _stext indicates 59the kernel start address. Used to convert a virtual address from the 60direct kernel map to a physical address. 61 62vmap_area_list 63-------------- 64 65Stores the virtual area list. makedumpfile gets the vmalloc start value 66from this variable and its value is necessary for vmalloc translation. 67 68mem_map 69------- 70 71Physical addresses are translated to struct pages by treating them as 72an index into the mem_map array. Right-shifting a physical address 73PAGE_SHIFT bits converts it into a page frame number which is an index 74into that mem_map array. 75 76Used to map an address to the corresponding struct page. 77 78contig_page_data 79---------------- 80 81Makedumpfile gets the pglist_data structure from this symbol, which is 82used to describe the memory layout. 83 84User-space tools use this to exclude free pages when dumping memory. 85 86mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map) 87-------------------------------------------------------------------------- 88 89The address of the mem_section array, its length, structure size, and 90the section_mem_map offset. 91 92It exists in the sparse memory mapping model, and it is also somewhat 93similar to the mem_map variable, both of them are used to translate an 94address. 95 96page 97---- 98 99The size of a page structure. struct page is an important data structure 100and it is widely used to compute contiguous memory. 101 102pglist_data 103----------- 104 105The size of a pglist_data structure. This value is used to check if the 106pglist_data structure is valid. It is also used for checking the memory 107type. 108 109zone 110---- 111 112The size of a zone structure. This value is used to check if the zone 113structure has been found. It is also used for excluding free pages. 114 115free_area 116--------- 117 118The size of a free_area structure. It indicates whether the free_area 119structure is valid or not. Useful when excluding free pages. 120 121list_head 122--------- 123 124The size of a list_head structure. Used when iterating lists in a 125post-mortem analysis session. 126 127nodemask_t 128---------- 129 130The size of a nodemask_t type. Used to compute the number of online 131nodes. 132 133(page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head) 134------------------------------------------------------------------------------------------------- 135 136User-space tools compute their values based on the offset of these 137variables. The variables are used when excluding unnecessary pages. 138 139(pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id) 140----------------------------------------------------------------------------------------- 141 142On NUMA machines, each NUMA node has a pg_data_t to describe its memory 143layout. On UMA machines there is a single pglist_data which describes the 144whole memory. 145 146These values are used to check the memory type and to compute the 147virtual address for memory map. 148 149(zone, free_area|vm_stat|spanned_pages) 150--------------------------------------- 151 152Each node is divided into a number of blocks called zones which 153represent ranges within memory. A zone is described by a structure zone. 154 155User-space tools compute required values based on the offset of these 156variables. 157 158(free_area, free_list) 159---------------------- 160 161Offset of the free_list's member. This value is used to compute the number 162of free pages. 163 164Each zone has a free_area structure array called free_area[MAX_ORDER]. 165The free_list represents a linked list of free page blocks. 166 167(list_head, next|prev) 168---------------------- 169 170Offsets of the list_head's members. list_head is used to define a 171circular linked list. User-space tools need these in order to traverse 172lists. 173 174(vmap_area, va_start|list) 175-------------------------- 176 177Offsets of the vmap_area's members. They carry vmalloc-specific 178information. Makedumpfile gets the start address of the vmalloc region 179from this. 180 181(zone.free_area, MAX_ORDER) 182--------------------------- 183 184Free areas descriptor. User-space tools use this value to iterate the 185free_area ranges. MAX_ORDER is used by the zone buddy allocator. 186 187log_first_idx 188------------- 189 190Index of the first record stored in the buffer log_buf. Used by 191user-space tools to read the strings in the log_buf. 192 193log_buf 194------- 195 196Console output is written to the ring buffer log_buf at index 197log_first_idx. Used to get the kernel log. 198 199log_buf_len 200----------- 201 202log_buf's length. 203 204clear_idx 205--------- 206 207The index that the next printk() record to read after the last clear 208command. It indicates the first record after the last SYSLOG_ACTION 209_CLEAR, like issued by 'dmesg -c'. Used by user-space tools to dump 210the dmesg log. 211 212log_next_idx 213------------ 214 215The index of the next record to store in the buffer log_buf. Used to 216compute the index of the current buffer position. 217 218printk_log 219---------- 220 221The size of a structure printk_log. Used to compute the size of 222messages, and extract dmesg log. It encapsulates header information for 223log_buf, such as timestamp, syslog level, etc. 224 225(printk_log, ts_nsec|len|text_len|dict_len) 226------------------------------------------- 227 228It represents field offsets in struct printk_log. User space tools 229parse it and check whether the values of printk_log's members have been 230changed. 231 232(free_area.free_list, MIGRATE_TYPES) 233------------------------------------ 234 235The number of migrate types for pages. The free_list is described by the 236array. Used by tools to compute the number of free pages. 237 238NR_FREE_PAGES 239------------- 240 241On linux-2.6.21 or later, the number of free pages is in 242vm_stat[NR_FREE_PAGES]. Used to get the number of free pages. 243 244PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask 245------------------------------------------------------------------------------ 246 247Page attributes. These flags are used to filter various unnecessary for 248dumping pages. 249 250PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline) 251----------------------------------------------------------------------------- 252 253More page attributes. These flags are used to filter various unnecessary for 254dumping pages. 255 256 257HUGETLB_PAGE_DTOR 258----------------- 259 260The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile 261excludes these pages. 262 263x86_64 264====== 265 266phys_base 267--------- 268 269Used to convert the virtual address of an exported kernel symbol to its 270corresponding physical address. 271 272init_top_pgt 273------------ 274 275Used to walk through the whole page table and convert virtual addresses 276to physical addresses. The init_top_pgt is somewhat similar to 277swapper_pg_dir, but it is only used in x86_64. 278 279pgtable_l5_enabled 280------------------ 281 282User-space tools need to know whether the crash kernel was in 5-level 283paging mode. 284 285node_data 286--------- 287 288This is a struct pglist_data array and stores all NUMA nodes 289information. Makedumpfile gets the pglist_data structure from it. 290 291(node_data, MAX_NUMNODES) 292------------------------- 293 294The maximum number of nodes in system. 295 296KERNELOFFSET 297------------ 298 299The kernel randomization offset. Used to compute the page offset. If 300KASLR is disabled, this value is zero. 301 302KERNEL_IMAGE_SIZE 303----------------- 304 305Currently unused by Makedumpfile. Used to compute the module virtual 306address by Crash. 307 308sme_mask 309-------- 310 311AMD-specific with SME support: it indicates the secure memory encryption 312mask. Makedumpfile tools need to know whether the crash kernel was 313encrypted. If SME is enabled in the first kernel, the crash kernel's 314page table entries (pgd/pud/pmd/pte) contain the memory encryption 315mask. This is used to remove the SME mask and obtain the true physical 316address. 317 318Currently, sme_mask stores the value of the C-bit position. If needed, 319additional SME-relevant info can be placed in that variable. 320 321For example:: 322 323 [ misc ][ enc bit ][ other misc SME info ] 324 0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000 325 63 59 55 51 47 43 39 35 31 27 ... 3 326 327x86_32 328====== 329 330X86_PAE 331------- 332 333Denotes whether physical address extensions are enabled. It has the cost 334of a higher page table lookup overhead, and also consumes more page 335table space per process. Used to check whether PAE was enabled in the 336crash kernel when converting virtual addresses to physical addresses. 337 338ia64 339==== 340 341pgdat_list|(pgdat_list, MAX_NUMNODES) 342------------------------------------- 343 344pg_data_t array storing all NUMA nodes information. MAX_NUMNODES 345indicates the number of the nodes. 346 347node_memblk|(node_memblk, NR_NODE_MEMBLKS) 348------------------------------------------ 349 350List of node memory chunks. Filled when parsing the SRAT table to obtain 351information about memory nodes. NR_NODE_MEMBLKS indicates the number of 352node memory chunks. 353 354These values are used to compute the number of nodes the crashed kernel used. 355 356node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size) 357---------------------------------------------------------------- 358 359The size of a struct node_memblk_s and the offsets of the 360node_memblk_s's members. Used to compute the number of nodes. 361 362PGTABLE_3|PGTABLE_4 363------------------- 364 365User-space tools need to know whether the crash kernel was in 3-level or 3664-level paging mode. Used to distinguish the page table. 367 368ARM64 369===== 370 371VA_BITS 372------- 373 374The maximum number of bits for virtual addresses. Used to compute the 375virtual memory ranges. 376 377kimage_voffset 378-------------- 379 380The offset between the kernel virtual and physical mappings. Used to 381translate virtual to physical addresses. 382 383PHYS_OFFSET 384----------- 385 386Indicates the physical address of the start of memory. Similar to 387kimage_voffset, which is used to translate virtual to physical 388addresses. 389 390KERNELOFFSET 391------------ 392 393The kernel randomization offset. Used to compute the page offset. If 394KASLR is disabled, this value is zero. 395 396arm 397=== 398 399ARM_LPAE 400-------- 401 402It indicates whether the crash kernel supports large physical address 403extensions. Used to translate virtual to physical addresses. 404 405s390 406==== 407 408lowcore_ptr 409----------- 410 411An array with a pointer to the lowcore of every CPU. Used to print the 412psw and all registers information. 413 414high_memory 415----------- 416 417Used to get the vmalloc_start address from the high_memory symbol. 418 419(lowcore_ptr, NR_CPUS) 420---------------------- 421 422The maximum number of CPUs. 423 424powerpc 425======= 426 427 428node_data|(node_data, MAX_NUMNODES) 429----------------------------------- 430 431See above. 432 433contig_page_data 434---------------- 435 436See above. 437 438vmemmap_list 439------------ 440 441The vmemmap_list maintains the entire vmemmap physical mapping. Used 442to get vmemmap list count and populated vmemmap regions info. If the 443vmemmap address translation information is stored in the crash kernel, 444it is used to translate vmemmap kernel virtual addresses. 445 446mmu_vmemmap_psize 447----------------- 448 449The size of a page. Used to translate virtual to physical addresses. 450 451mmu_psize_defs 452-------------- 453 454Page size definitions, i.e. 4k, 64k, or 16M. 455 456Used to make vtop translations. 457 458vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr) 459-------------------------------------------------------------------------------------------- 460 461The vmemmap virtual address space management does not have a traditional 462page table to track which virtual struct pages are backed by a physical 463mapping. The virtual to physical mappings are tracked in a simple linked 464list format. 465 466User-space tools need to know the offset of list, phys and virt_addr 467when computing the count of vmemmap regions. 468 469mmu_psize_def|(mmu_psize_def, shift) 470------------------------------------ 471 472The size of a struct mmu_psize_def and the offset of mmu_psize_def's 473member. 474 475Used in vtop translations. 476 477sh 478== 479 480node_data|(node_data, MAX_NUMNODES) 481----------------------------------- 482 483See above. 484 485X2TLB 486----- 487 488Indicates whether the crashed kernel enabled SH extended mode. 489