kdump (Linux)

kdump is the Linux kernel's built-in crash dump mechanism. In the event of a kernel crash, kdump creates a memory image (also known as vmcore) that can be analyzed for the purposes of debugging and determining the cause of a crash. Dumped image of the main memory, exported as an Executable and Linkable Format (ELF) object, can be accessed either directly during the handling of a kernel crash (through /proc/vmcore), or it can be automatically saved to a locally accessible file system, to a raw device, or to a remote system accessible over the network.[1][2]

Internals

In a "dual kernel" layout, kdump uses kexec to boot another kernel and obtain a memory dump.[3]:10

To preserve system consistency in the event of a kernel crash, kdump employs the approach of booting another kernel (known as the dump-capture kernel) for the purposes of accessing and saving a memory dump. That way, the system boots into a clean and reliable environment instead of relying on an already crashed kernel, which could cause various issues such as corruption of file systems while writing a memory dump file. To implement this "dual kernel" layout, kdump uses kexec for booting into the dump-capture kernel immediately after the kernel crash, using kexec's ability to boot "over" the currently running kernel while skipping the bootloader and hardware initialization by the system's firmware (BIOS or UEFI). A dump-capture kernel can be either a Linux kernel image built specifically for that purpose, or the primary kernel image can be reused on architectures that support relocatable kernels.[1][4][3][5]:5–6

The content of the main memory is preserved while booting into and running the dump-capture kernel by reserving a small amount of the main memory (RAM) in advance, into which the dump-capture kernel is preloaded so none of the RAM used by the primary kernel is overwritten while a kernel crash is handled. This reserved amount of RAM is used solely by the dump-capture kernel, and it is otherwise unused during normal system operation. Some architectures, including x86 and ppc64, require a small fixed-position portion of RAM to boot a kernel regardless of where it is loaded; in this case, kexec creates a copy of that portion of RAM so it is also accessible to the dump-capture kernel. Size and optional position of the reserved portion of RAM are specified through the kernel boot parameter crashkernel; after the primary kernel boots, a dump-capture kernel image and its associated initrd image are preloaded using the kexec command-line utility.[1][4][3]

In addition to the functionality that is part of the Linux kernel, additional userspace utilities (including the kexec utility mentioned above) support the kdump mechanism.[1][4] Beside the official utilities, which are provided in form of a patch to kexec's suite of userspace utilities, some Linux distributions provide additional utilities that simplify the configuration of kdump's operation, including the setup of automated saving of memory dump files.[6][7][8] Created memory dump files can be analyzed using the GNU Debugger (gdb), or by using Red Hat's dedicated crash utility.[9][10]

History

kdump functionality, together with kexec, was merged into the Linux kernel mainline in kernel version 2.6.13, which was released on August 29, 2005.[11]

See also

References

  1. ↑ 1.0 1.1 1.2 1.3 Jonathan Corbet (October 27, 2004). "Crash dumps with kexec". LWN.net. Retrieved August 9, 2014.
  2. ↑ "13.2 About Kdump (Chapter 13: Support Diagnostic Tools)". Oracle Corporation. 2012. Retrieved August 9, 2014.
  3. ↑ 3.0 3.1 3.2 Vivek Goyal; Eric W. Biederman; Hariprasad Nellitheertha (June 14, 2006). "Kdump: A Kexec-based Kernel Crash Dumping Mechanism" (PDF). lse.sourceforge.net. Retrieved August 9, 2014.
  4. ↑ 4.0 4.1 4.2 "Linux kernel documentation: Documentation/kdump/kdump.txt". kernel.org. August 12, 2013. Retrieved August 9, 2014.
  5. ↑ Takashi Iwai (July 26, 2006). "Debugging using Kdump" (PDF). SUSE. Retrieved August 9, 2014.
  6. ↑ "29.2.2. Using the Kernel Dump Configuration Utility (Red Hat Enterprise Linux 6 Deployment Guide)". Red Hat. Retrieved August 9, 2014.
  7. ↑ "kexec and kdump: Basic kdump Configuration (System Analysis and Tuning Guide)". SUSE. April 25, 2014. Retrieved August 9, 2014.
  8. ↑ "How to use kdump to debug kernel crashes". Fedora. April 9, 2014. Retrieved August 9, 2014.
  9. ↑ David Anderson (August 27, 2010). "White Paper: Red Hat Crash Utility". Red Hat. Retrieved August 9, 2014.
  10. ↑ "kexec and kdump: Analyzing the Crash Dump (System Analysis and Tuning Guide)". SUSE. April 25, 2014. Retrieved August 9, 2014.
  11. ↑ "Linux kernel 2.6.13". kernelnewbies.org. August 29, 2005. Retrieved August 9, 2014.

External links

Wikimedia Commons has media related to Linux kernel.