1========== 2VMCOREINFO 3========== 4 5What is it? 6=========== 7 8VMCOREINFO is a special ELF note section. It contains various 9information from the kernel like structure size, page size, symbol 10values, field offsets, etc. These data are packed into an ELF note 11section and used by user-space tools like crash and makedumpfile to 12analyze a kernel's memory layout. 13 14Common variables 15================ 16 17init_uts_ns.name.release 18------------------------ 19 20The version of the Linux kernel. Used to find the corresponding source 21code from which the kernel has been built. For example, crash uses it to 22find the corresponding vmlinux in order to process vmcore. 23 24PAGE_SIZE 25--------- 26 27The size of a page. It is the smallest unit of data used by the memory 28management facilities. It is usually 4096 bytes of size and a page is 29aligned on 4096 bytes. Used for computing page addresses. 30 31init_uts_ns 32----------- 33 34The UTS namespace which is used to isolate two specific elements of the 35system that relate to the uname(2) system call. It is named after the 36data structure used to store information returned by the uname(2) system 37call. 38 39User-space tools can get the kernel name, host name, kernel release 40number, kernel version, architecture name and OS type from it. 41 42(uts_namespace, name) 43--------------------- 44 45Offset of the name's member. Crash Utility and Makedumpfile get 46the start address of the init_uts_ns.name from this. 47 48node_online_map 49--------------- 50 51An array node_states[N_ONLINE] which represents the set of online nodes 52in a system, one bit position per node number. Used to keep track of 53which nodes are in the system and online. 54 55swapper_pg_dir 56-------------- 57 58The global page directory pointer of the kernel. Used to translate 59virtual to physical addresses. 60 61_stext 62------ 63 64Defines the beginning of the text section. In general, _stext indicates 65the kernel start address. Used to convert a virtual address from the 66direct kernel map to a physical address. 67 68vmap_area_list 69-------------- 70 71Stores the virtual area list. makedumpfile gets the vmalloc start value 72from this variable and its value is necessary for vmalloc translation. 73 74mem_map 75------- 76 77Physical addresses are translated to struct pages by treating them as 78an index into the mem_map array. Right-shifting a physical address 79PAGE_SHIFT bits converts it into a page frame number which is an index 80into that mem_map array. 81 82Used to map an address to the corresponding struct page. 83 84contig_page_data 85---------------- 86 87Makedumpfile gets the pglist_data structure from this symbol, which is 88used to describe the memory layout. 89 90User-space tools use this to exclude free pages when dumping memory. 91 92mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map) 93-------------------------------------------------------------------------- 94 95The address of the mem_section array, its length, structure size, and 96the section_mem_map offset. 97 98It exists in the sparse memory mapping model, and it is also somewhat 99similar to the mem_map variable, both of them are used to translate an 100address. 101 102MAX_PHYSMEM_BITS 103---------------- 104 105Defines the maximum supported physical address space memory. 106 107page 108---- 109 110The size of a page structure. struct page is an important data structure 111and it is widely used to compute contiguous memory. 112 113pglist_data 114----------- 115 116The size of a pglist_data structure. This value is used to check if the 117pglist_data structure is valid. It is also used for checking the memory 118type. 119 120zone 121---- 122 123The size of a zone structure. This value is used to check if the zone 124structure has been found. It is also used for excluding free pages. 125 126free_area 127--------- 128 129The size of a free_area structure. It indicates whether the free_area 130structure is valid or not. Useful when excluding free pages. 131 132list_head 133--------- 134 135The size of a list_head structure. Used when iterating lists in a 136post-mortem analysis session. 137 138nodemask_t 139---------- 140 141The size of a nodemask_t type. Used to compute the number of online 142nodes. 143 144(page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head) 145------------------------------------------------------------------------------------------------- 146 147User-space tools compute their values based on the offset of these 148variables. The variables are used when excluding unnecessary pages. 149 150(pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id) 151----------------------------------------------------------------------------------------- 152 153On NUMA machines, each NUMA node has a pg_data_t to describe its memory 154layout. On UMA machines there is a single pglist_data which describes the 155whole memory. 156 157These values are used to check the memory type and to compute the 158virtual address for memory map. 159 160(zone, free_area|vm_stat|spanned_pages) 161--------------------------------------- 162 163Each node is divided into a number of blocks called zones which 164represent ranges within memory. A zone is described by a structure zone. 165 166User-space tools compute required values based on the offset of these 167variables. 168 169(free_area, free_list) 170---------------------- 171 172Offset of the free_list's member. This value is used to compute the number 173of free pages. 174 175Each zone has a free_area structure array called free_area[MAX_ORDER]. 176The free_list represents a linked list of free page blocks. 177 178(list_head, next|prev) 179---------------------- 180 181Offsets of the list_head's members. list_head is used to define a 182circular linked list. User-space tools need these in order to traverse 183lists. 184 185(vmap_area, va_start|list) 186-------------------------- 187 188Offsets of the vmap_area's members. They carry vmalloc-specific 189information. Makedumpfile gets the start address of the vmalloc region 190from this. 191 192(zone.free_area, MAX_ORDER) 193--------------------------- 194 195Free areas descriptor. User-space tools use this value to iterate the 196free_area ranges. MAX_ORDER is used by the zone buddy allocator. 197 198prb 199--- 200 201A pointer to the printk ringbuffer (struct printk_ringbuffer). This 202may be pointing to the static boot ringbuffer or the dynamically 203allocated ringbuffer, depending on when the core dump occurred. 204Used by user-space tools to read the active kernel log buffer. 205 206printk_rb_static 207---------------- 208 209A pointer to the static boot printk ringbuffer. If @prb has a 210different value, this is useful for viewing the initial boot messages, 211which may have been overwritten in the dynamically allocated 212ringbuffer. 213 214clear_seq 215--------- 216 217The sequence number of the printk() record after the last clear 218command. It indicates the first record after the last 219SYSLOG_ACTION_CLEAR, like issued by 'dmesg -c'. Used by user-space 220tools to dump a subset of the dmesg log. 221 222printk_ringbuffer 223----------------- 224 225The size of a printk_ringbuffer structure. This structure contains all 226information required for accessing the various components of the 227kernel log buffer. 228 229(printk_ringbuffer, desc_ring|text_data_ring|dict_data_ring|fail) 230----------------------------------------------------------------- 231 232Offsets for the various components of the printk ringbuffer. Used by 233user-space tools to view the kernel log buffer without requiring the 234declaration of the structure. 235 236prb_desc_ring 237------------- 238 239The size of the prb_desc_ring structure. This structure contains 240information about the set of record descriptors. 241 242(prb_desc_ring, count_bits|descs|head_id|tail_id) 243------------------------------------------------- 244 245Offsets for the fields describing the set of record descriptors. Used 246by user-space tools to be able to traverse the descriptors without 247requiring the declaration of the structure. 248 249prb_desc 250-------- 251 252The size of the prb_desc structure. This structure contains 253information about a single record descriptor. 254 255(prb_desc, info|state_var|text_blk_lpos|dict_blk_lpos) 256------------------------------------------------------ 257 258Offsets for the fields describing a record descriptors. Used by 259user-space tools to be able to read descriptors without requiring 260the declaration of the structure. 261 262prb_data_blk_lpos 263----------------- 264 265The size of the prb_data_blk_lpos structure. This structure contains 266information about where the text or dictionary data (data block) is 267located within the respective data ring. 268 269(prb_data_blk_lpos, begin|next) 270------------------------------- 271 272Offsets for the fields describing the location of a data block. Used 273by user-space tools to be able to locate data blocks without 274requiring the declaration of the structure. 275 276printk_info 277----------- 278 279The size of the printk_info structure. This structure contains all 280the meta-data for a record. 281 282(printk_info, seq|ts_nsec|text_len|dict_len|caller_id) 283------------------------------------------------------ 284 285Offsets for the fields providing the meta-data for a record. Used by 286user-space tools to be able to read the information without requiring 287the declaration of the structure. 288 289prb_data_ring 290------------- 291 292The size of the prb_data_ring structure. This structure contains 293information about a set of data blocks. 294 295(prb_data_ring, size_bits|data|head_lpos|tail_lpos) 296--------------------------------------------------- 297 298Offsets for the fields describing a set of data blocks. Used by 299user-space tools to be able to access the data blocks without 300requiring the declaration of the structure. 301 302atomic_long_t 303------------- 304 305The size of the atomic_long_t structure. Used by user-space tools to 306be able to copy the full structure, regardless of its 307architecture-specific implementation. 308 309(atomic_long_t, counter) 310------------------------ 311 312Offset for the long value of an atomic_long_t variable. Used by 313user-space tools to access the long value without requiring the 314architecture-specific declaration. 315 316(free_area.free_list, MIGRATE_TYPES) 317------------------------------------ 318 319The number of migrate types for pages. The free_list is described by the 320array. Used by tools to compute the number of free pages. 321 322NR_FREE_PAGES 323------------- 324 325On linux-2.6.21 or later, the number of free pages is in 326vm_stat[NR_FREE_PAGES]. Used to get the number of free pages. 327 328PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask 329------------------------------------------------------------------------------ 330 331Page attributes. These flags are used to filter various unnecessary for 332dumping pages. 333 334PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline) 335----------------------------------------------------------------------------- 336 337More page attributes. These flags are used to filter various unnecessary for 338dumping pages. 339 340 341HUGETLB_PAGE_DTOR 342----------------- 343 344The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile 345excludes these pages. 346 347x86_64 348====== 349 350phys_base 351--------- 352 353Used to convert the virtual address of an exported kernel symbol to its 354corresponding physical address. 355 356init_top_pgt 357------------ 358 359Used to walk through the whole page table and convert virtual addresses 360to physical addresses. The init_top_pgt is somewhat similar to 361swapper_pg_dir, but it is only used in x86_64. 362 363pgtable_l5_enabled 364------------------ 365 366User-space tools need to know whether the crash kernel was in 5-level 367paging mode. 368 369node_data 370--------- 371 372This is a struct pglist_data array and stores all NUMA nodes 373information. Makedumpfile gets the pglist_data structure from it. 374 375(node_data, MAX_NUMNODES) 376------------------------- 377 378The maximum number of nodes in system. 379 380KERNELOFFSET 381------------ 382 383The kernel randomization offset. Used to compute the page offset. If 384KASLR is disabled, this value is zero. 385 386KERNEL_IMAGE_SIZE 387----------------- 388 389Currently unused by Makedumpfile. Used to compute the module virtual 390address by Crash. 391 392sme_mask 393-------- 394 395AMD-specific with SME support: it indicates the secure memory encryption 396mask. Makedumpfile tools need to know whether the crash kernel was 397encrypted. If SME is enabled in the first kernel, the crash kernel's 398page table entries (pgd/pud/pmd/pte) contain the memory encryption 399mask. This is used to remove the SME mask and obtain the true physical 400address. 401 402Currently, sme_mask stores the value of the C-bit position. If needed, 403additional SME-relevant info can be placed in that variable. 404 405For example:: 406 407 [ misc ][ enc bit ][ other misc SME info ] 408 0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000 409 63 59 55 51 47 43 39 35 31 27 ... 3 410 411x86_32 412====== 413 414X86_PAE 415------- 416 417Denotes whether physical address extensions are enabled. It has the cost 418of a higher page table lookup overhead, and also consumes more page 419table space per process. Used to check whether PAE was enabled in the 420crash kernel when converting virtual addresses to physical addresses. 421 422ia64 423==== 424 425pgdat_list|(pgdat_list, MAX_NUMNODES) 426------------------------------------- 427 428pg_data_t array storing all NUMA nodes information. MAX_NUMNODES 429indicates the number of the nodes. 430 431node_memblk|(node_memblk, NR_NODE_MEMBLKS) 432------------------------------------------ 433 434List of node memory chunks. Filled when parsing the SRAT table to obtain 435information about memory nodes. NR_NODE_MEMBLKS indicates the number of 436node memory chunks. 437 438These values are used to compute the number of nodes the crashed kernel used. 439 440node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size) 441---------------------------------------------------------------- 442 443The size of a struct node_memblk_s and the offsets of the 444node_memblk_s's members. Used to compute the number of nodes. 445 446PGTABLE_3|PGTABLE_4 447------------------- 448 449User-space tools need to know whether the crash kernel was in 3-level or 4504-level paging mode. Used to distinguish the page table. 451 452ARM64 453===== 454 455VA_BITS 456------- 457 458The maximum number of bits for virtual addresses. Used to compute the 459virtual memory ranges. 460 461kimage_voffset 462-------------- 463 464The offset between the kernel virtual and physical mappings. Used to 465translate virtual to physical addresses. 466 467PHYS_OFFSET 468----------- 469 470Indicates the physical address of the start of memory. Similar to 471kimage_voffset, which is used to translate virtual to physical 472addresses. 473 474KERNELOFFSET 475------------ 476 477The kernel randomization offset. Used to compute the page offset. If 478KASLR is disabled, this value is zero. 479 480KERNELPACMASK 481------------- 482 483The mask to extract the Pointer Authentication Code from a kernel virtual 484address. 485 486TCR_EL1.T1SZ 487------------ 488 489Indicates the size offset of the memory region addressed by TTBR1_EL1. 490The region size is 2^(64-T1SZ) bytes. 491 492TTBR1_EL1 is the table base address register specified by ARMv8-A 493architecture which is used to lookup the page-tables for the Virtual 494addresses in the higher VA range (refer to ARMv8 ARM document for 495more details). 496 497MODULES_VADDR|MODULES_END|VMALLOC_START|VMALLOC_END|VMEMMAP_START|VMEMMAP_END 498----------------------------------------------------------------------------- 499 500Used to get the correct ranges: 501 MODULES_VADDR ~ MODULES_END-1 : Kernel module space. 502 VMALLOC_START ~ VMALLOC_END-1 : vmalloc() / ioremap() space. 503 VMEMMAP_START ~ VMEMMAP_END-1 : vmemmap region, used for struct page array. 504 505arm 506=== 507 508ARM_LPAE 509-------- 510 511It indicates whether the crash kernel supports large physical address 512extensions. Used to translate virtual to physical addresses. 513 514s390 515==== 516 517lowcore_ptr 518----------- 519 520An array with a pointer to the lowcore of every CPU. Used to print the 521psw and all registers information. 522 523high_memory 524----------- 525 526Used to get the vmalloc_start address from the high_memory symbol. 527 528(lowcore_ptr, NR_CPUS) 529---------------------- 530 531The maximum number of CPUs. 532 533powerpc 534======= 535 536 537node_data|(node_data, MAX_NUMNODES) 538----------------------------------- 539 540See above. 541 542contig_page_data 543---------------- 544 545See above. 546 547vmemmap_list 548------------ 549 550The vmemmap_list maintains the entire vmemmap physical mapping. Used 551to get vmemmap list count and populated vmemmap regions info. If the 552vmemmap address translation information is stored in the crash kernel, 553it is used to translate vmemmap kernel virtual addresses. 554 555mmu_vmemmap_psize 556----------------- 557 558The size of a page. Used to translate virtual to physical addresses. 559 560mmu_psize_defs 561-------------- 562 563Page size definitions, i.e. 4k, 64k, or 16M. 564 565Used to make vtop translations. 566 567vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr) 568-------------------------------------------------------------------------------------------- 569 570The vmemmap virtual address space management does not have a traditional 571page table to track which virtual struct pages are backed by a physical 572mapping. The virtual to physical mappings are tracked in a simple linked 573list format. 574 575User-space tools need to know the offset of list, phys and virt_addr 576when computing the count of vmemmap regions. 577 578mmu_psize_def|(mmu_psize_def, shift) 579------------------------------------ 580 581The size of a struct mmu_psize_def and the offset of mmu_psize_def's 582member. 583 584Used in vtop translations. 585 586sh 587== 588 589node_data|(node_data, MAX_NUMNODES) 590----------------------------------- 591 592See above. 593 594X2TLB 595----- 596 597Indicates whether the crashed kernel enabled SH extended mode. 598 599RISCV64 600======= 601 602VA_BITS 603------- 604 605The maximum number of bits for virtual addresses. Used to compute the 606virtual memory ranges. 607 608PAGE_OFFSET 609----------- 610 611Indicates the virtual kernel start address of the direct-mapped RAM region. 612 613phys_ram_base 614------------- 615 616Indicates the start physical RAM address. 617 618MODULES_VADDR|MODULES_END|VMALLOC_START|VMALLOC_END|VMEMMAP_START|VMEMMAP_END|KERNEL_LINK_ADDR 619---------------------------------------------------------------------------------------------- 620 621Used to get the correct ranges: 622 623 * MODULES_VADDR ~ MODULES_END : Kernel module space. 624 * VMALLOC_START ~ VMALLOC_END : vmalloc() / ioremap() space. 625 * VMEMMAP_START ~ VMEMMAP_END : vmemmap space, used for struct page array. 626 * KERNEL_LINK_ADDR : start address of Kernel link and BPF 627