0001 ==========
0002 VMCOREINFO
0003 ==========
0004
0005 What is it?
0006 ===========
0007
0008 VMCOREINFO is a special ELF note section. It contains various
0009 information from the kernel like structure size, page size, symbol
0010 values, field offsets, etc. These data are packed into an ELF note
0011 section and used by user-space tools like crash and makedumpfile to
0012 analyze a kernel's memory layout.
0013
0014 Common variables
0015 ================
0016
0017 init_uts_ns.name.release
0018 ------------------------
0019
0020 The version of the Linux kernel. Used to find the corresponding source
0021 code from which the kernel has been built. For example, crash uses it to
0022 find the corresponding vmlinux in order to process vmcore.
0023
0024 PAGE_SIZE
0025 ---------
0026
0027 The size of a page. It is the smallest unit of data used by the memory
0028 management facilities. It is usually 4096 bytes of size and a page is
0029 aligned on 4096 bytes. Used for computing page addresses.
0030
0031 init_uts_ns
0032 -----------
0033
0034 The UTS namespace which is used to isolate two specific elements of the
0035 system that relate to the uname(2) system call. It is named after the
0036 data structure used to store information returned by the uname(2) system
0037 call.
0038
0039 User-space tools can get the kernel name, host name, kernel release
0040 number, kernel version, architecture name and OS type from it.
0041
0042 (uts_namespace, name)
0043 ---------------------
0044
0045 Offset of the name's member. Crash Utility and Makedumpfile get
0046 the start address of the init_uts_ns.name from this.
0047
0048 node_online_map
0049 ---------------
0050
0051 An array node_states[N_ONLINE] which represents the set of online nodes
0052 in a system, one bit position per node number. Used to keep track of
0053 which nodes are in the system and online.
0054
0055 swapper_pg_dir
0056 --------------
0057
0058 The global page directory pointer of the kernel. Used to translate
0059 virtual to physical addresses.
0060
0061 _stext
0062 ------
0063
0064 Defines the beginning of the text section. In general, _stext indicates
0065 the kernel start address. Used to convert a virtual address from the
0066 direct kernel map to a physical address.
0067
0068 vmap_area_list
0069 --------------
0070
0071 Stores the virtual area list. makedumpfile gets the vmalloc start value
0072 from this variable and its value is necessary for vmalloc translation.
0073
0074 mem_map
0075 -------
0076
0077 Physical addresses are translated to struct pages by treating them as
0078 an index into the mem_map array. Right-shifting a physical address
0079 PAGE_SHIFT bits converts it into a page frame number which is an index
0080 into that mem_map array.
0081
0082 Used to map an address to the corresponding struct page.
0083
0084 contig_page_data
0085 ----------------
0086
0087 Makedumpfile gets the pglist_data structure from this symbol, which is
0088 used to describe the memory layout.
0089
0090 User-space tools use this to exclude free pages when dumping memory.
0091
0092 mem_section|(mem_section, NR_SECTION_ROOTS)|(mem_section, section_mem_map)
0093 --------------------------------------------------------------------------
0094
0095 The address of the mem_section array, its length, structure size, and
0096 the section_mem_map offset.
0097
0098 It exists in the sparse memory mapping model, and it is also somewhat
0099 similar to the mem_map variable, both of them are used to translate an
0100 address.
0101
0102 MAX_PHYSMEM_BITS
0103 ----------------
0104
0105 Defines the maximum supported physical address space memory.
0106
0107 page
0108 ----
0109
0110 The size of a page structure. struct page is an important data structure
0111 and it is widely used to compute contiguous memory.
0112
0113 pglist_data
0114 -----------
0115
0116 The size of a pglist_data structure. This value is used to check if the
0117 pglist_data structure is valid. It is also used for checking the memory
0118 type.
0119
0120 zone
0121 ----
0122
0123 The size of a zone structure. This value is used to check if the zone
0124 structure has been found. It is also used for excluding free pages.
0125
0126 free_area
0127 ---------
0128
0129 The size of a free_area structure. It indicates whether the free_area
0130 structure is valid or not. Useful when excluding free pages.
0131
0132 list_head
0133 ---------
0134
0135 The size of a list_head structure. Used when iterating lists in a
0136 post-mortem analysis session.
0137
0138 nodemask_t
0139 ----------
0140
0141 The size of a nodemask_t type. Used to compute the number of online
0142 nodes.
0143
0144 (page, flags|_refcount|mapping|lru|_mapcount|private|compound_dtor|compound_order|compound_head)
0145 -------------------------------------------------------------------------------------------------
0146
0147 User-space tools compute their values based on the offset of these
0148 variables. The variables are used when excluding unnecessary pages.
0149
0150 (pglist_data, node_zones|nr_zones|node_mem_map|node_start_pfn|node_spanned_pages|node_id)
0151 -----------------------------------------------------------------------------------------
0152
0153 On NUMA machines, each NUMA node has a pg_data_t to describe its memory
0154 layout. On UMA machines there is a single pglist_data which describes the
0155 whole memory.
0156
0157 These values are used to check the memory type and to compute the
0158 virtual address for memory map.
0159
0160 (zone, free_area|vm_stat|spanned_pages)
0161 ---------------------------------------
0162
0163 Each node is divided into a number of blocks called zones which
0164 represent ranges within memory. A zone is described by a structure zone.
0165
0166 User-space tools compute required values based on the offset of these
0167 variables.
0168
0169 (free_area, free_list)
0170 ----------------------
0171
0172 Offset of the free_list's member. This value is used to compute the number
0173 of free pages.
0174
0175 Each zone has a free_area structure array called free_area[MAX_ORDER].
0176 The free_list represents a linked list of free page blocks.
0177
0178 (list_head, next|prev)
0179 ----------------------
0180
0181 Offsets of the list_head's members. list_head is used to define a
0182 circular linked list. User-space tools need these in order to traverse
0183 lists.
0184
0185 (vmap_area, va_start|list)
0186 --------------------------
0187
0188 Offsets of the vmap_area's members. They carry vmalloc-specific
0189 information. Makedumpfile gets the start address of the vmalloc region
0190 from this.
0191
0192 (zone.free_area, MAX_ORDER)
0193 ---------------------------
0194
0195 Free areas descriptor. User-space tools use this value to iterate the
0196 free_area ranges. MAX_ORDER is used by the zone buddy allocator.
0197
0198 prb
0199 ---
0200
0201 A pointer to the printk ringbuffer (struct printk_ringbuffer). This
0202 may be pointing to the static boot ringbuffer or the dynamically
0203 allocated ringbuffer, depending on when the the core dump occurred.
0204 Used by user-space tools to read the active kernel log buffer.
0205
0206 printk_rb_static
0207 ----------------
0208
0209 A pointer to the static boot printk ringbuffer. If @prb has a
0210 different value, this is useful for viewing the initial boot messages,
0211 which may have been overwritten in the dynamically allocated
0212 ringbuffer.
0213
0214 clear_seq
0215 ---------
0216
0217 The sequence number of the printk() record after the last clear
0218 command. It indicates the first record after the last
0219 SYSLOG_ACTION_CLEAR, like issued by 'dmesg -c'. Used by user-space
0220 tools to dump a subset of the dmesg log.
0221
0222 printk_ringbuffer
0223 -----------------
0224
0225 The size of a printk_ringbuffer structure. This structure contains all
0226 information required for accessing the various components of the
0227 kernel log buffer.
0228
0229 (printk_ringbuffer, desc_ring|text_data_ring|dict_data_ring|fail)
0230 -----------------------------------------------------------------
0231
0232 Offsets for the various components of the printk ringbuffer. Used by
0233 user-space tools to view the kernel log buffer without requiring the
0234 declaration of the structure.
0235
0236 prb_desc_ring
0237 -------------
0238
0239 The size of the prb_desc_ring structure. This structure contains
0240 information about the set of record descriptors.
0241
0242 (prb_desc_ring, count_bits|descs|head_id|tail_id)
0243 -------------------------------------------------
0244
0245 Offsets for the fields describing the set of record descriptors. Used
0246 by user-space tools to be able to traverse the descriptors without
0247 requiring the declaration of the structure.
0248
0249 prb_desc
0250 --------
0251
0252 The size of the prb_desc structure. This structure contains
0253 information about a single record descriptor.
0254
0255 (prb_desc, info|state_var|text_blk_lpos|dict_blk_lpos)
0256 ------------------------------------------------------
0257
0258 Offsets for the fields describing a record descriptors. Used by
0259 user-space tools to be able to read descriptors without requiring
0260 the declaration of the structure.
0261
0262 prb_data_blk_lpos
0263 -----------------
0264
0265 The size of the prb_data_blk_lpos structure. This structure contains
0266 information about where the text or dictionary data (data block) is
0267 located within the respective data ring.
0268
0269 (prb_data_blk_lpos, begin|next)
0270 -------------------------------
0271
0272 Offsets for the fields describing the location of a data block. Used
0273 by user-space tools to be able to locate data blocks without
0274 requiring the declaration of the structure.
0275
0276 printk_info
0277 -----------
0278
0279 The size of the printk_info structure. This structure contains all
0280 the meta-data for a record.
0281
0282 (printk_info, seq|ts_nsec|text_len|dict_len|caller_id)
0283 ------------------------------------------------------
0284
0285 Offsets for the fields providing the meta-data for a record. Used by
0286 user-space tools to be able to read the information without requiring
0287 the declaration of the structure.
0288
0289 prb_data_ring
0290 -------------
0291
0292 The size of the prb_data_ring structure. This structure contains
0293 information about a set of data blocks.
0294
0295 (prb_data_ring, size_bits|data|head_lpos|tail_lpos)
0296 ---------------------------------------------------
0297
0298 Offsets for the fields describing a set of data blocks. Used by
0299 user-space tools to be able to access the data blocks without
0300 requiring the declaration of the structure.
0301
0302 atomic_long_t
0303 -------------
0304
0305 The size of the atomic_long_t structure. Used by user-space tools to
0306 be able to copy the full structure, regardless of its
0307 architecture-specific implementation.
0308
0309 (atomic_long_t, counter)
0310 ------------------------
0311
0312 Offset for the long value of an atomic_long_t variable. Used by
0313 user-space tools to access the long value without requiring the
0314 architecture-specific declaration.
0315
0316 (free_area.free_list, MIGRATE_TYPES)
0317 ------------------------------------
0318
0319 The number of migrate types for pages. The free_list is described by the
0320 array. Used by tools to compute the number of free pages.
0321
0322 NR_FREE_PAGES
0323 -------------
0324
0325 On linux-2.6.21 or later, the number of free pages is in
0326 vm_stat[NR_FREE_PAGES]. Used to get the number of free pages.
0327
0328 PG_lru|PG_private|PG_swapcache|PG_swapbacked|PG_slab|PG_hwpoision|PG_head_mask
0329 ------------------------------------------------------------------------------
0330
0331 Page attributes. These flags are used to filter various unnecessary for
0332 dumping pages.
0333
0334 PAGE_BUDDY_MAPCOUNT_VALUE(~PG_buddy)|PAGE_OFFLINE_MAPCOUNT_VALUE(~PG_offline)
0335 -----------------------------------------------------------------------------
0336
0337 More page attributes. These flags are used to filter various unnecessary for
0338 dumping pages.
0339
0340
0341 HUGETLB_PAGE_DTOR
0342 -----------------
0343
0344 The HUGETLB_PAGE_DTOR flag denotes hugetlbfs pages. Makedumpfile
0345 excludes these pages.
0346
0347 x86_64
0348 ======
0349
0350 phys_base
0351 ---------
0352
0353 Used to convert the virtual address of an exported kernel symbol to its
0354 corresponding physical address.
0355
0356 init_top_pgt
0357 ------------
0358
0359 Used to walk through the whole page table and convert virtual addresses
0360 to physical addresses. The init_top_pgt is somewhat similar to
0361 swapper_pg_dir, but it is only used in x86_64.
0362
0363 pgtable_l5_enabled
0364 ------------------
0365
0366 User-space tools need to know whether the crash kernel was in 5-level
0367 paging mode.
0368
0369 node_data
0370 ---------
0371
0372 This is a struct pglist_data array and stores all NUMA nodes
0373 information. Makedumpfile gets the pglist_data structure from it.
0374
0375 (node_data, MAX_NUMNODES)
0376 -------------------------
0377
0378 The maximum number of nodes in system.
0379
0380 KERNELOFFSET
0381 ------------
0382
0383 The kernel randomization offset. Used to compute the page offset. If
0384 KASLR is disabled, this value is zero.
0385
0386 KERNEL_IMAGE_SIZE
0387 -----------------
0388
0389 Currently unused by Makedumpfile. Used to compute the module virtual
0390 address by Crash.
0391
0392 sme_mask
0393 --------
0394
0395 AMD-specific with SME support: it indicates the secure memory encryption
0396 mask. Makedumpfile tools need to know whether the crash kernel was
0397 encrypted. If SME is enabled in the first kernel, the crash kernel's
0398 page table entries (pgd/pud/pmd/pte) contain the memory encryption
0399 mask. This is used to remove the SME mask and obtain the true physical
0400 address.
0401
0402 Currently, sme_mask stores the value of the C-bit position. If needed,
0403 additional SME-relevant info can be placed in that variable.
0404
0405 For example::
0406
0407 [ misc ][ enc bit ][ other misc SME info ]
0408 0000_0000_0000_0000_1000_0000_0000_0000_0000_0000_..._0000
0409 63 59 55 51 47 43 39 35 31 27 ... 3
0410
0411 x86_32
0412 ======
0413
0414 X86_PAE
0415 -------
0416
0417 Denotes whether physical address extensions are enabled. It has the cost
0418 of a higher page table lookup overhead, and also consumes more page
0419 table space per process. Used to check whether PAE was enabled in the
0420 crash kernel when converting virtual addresses to physical addresses.
0421
0422 ia64
0423 ====
0424
0425 pgdat_list|(pgdat_list, MAX_NUMNODES)
0426 -------------------------------------
0427
0428 pg_data_t array storing all NUMA nodes information. MAX_NUMNODES
0429 indicates the number of the nodes.
0430
0431 node_memblk|(node_memblk, NR_NODE_MEMBLKS)
0432 ------------------------------------------
0433
0434 List of node memory chunks. Filled when parsing the SRAT table to obtain
0435 information about memory nodes. NR_NODE_MEMBLKS indicates the number of
0436 node memory chunks.
0437
0438 These values are used to compute the number of nodes the crashed kernel used.
0439
0440 node_memblk_s|(node_memblk_s, start_paddr)|(node_memblk_s, size)
0441 ----------------------------------------------------------------
0442
0443 The size of a struct node_memblk_s and the offsets of the
0444 node_memblk_s's members. Used to compute the number of nodes.
0445
0446 PGTABLE_3|PGTABLE_4
0447 -------------------
0448
0449 User-space tools need to know whether the crash kernel was in 3-level or
0450 4-level paging mode. Used to distinguish the page table.
0451
0452 ARM64
0453 =====
0454
0455 VA_BITS
0456 -------
0457
0458 The maximum number of bits for virtual addresses. Used to compute the
0459 virtual memory ranges.
0460
0461 kimage_voffset
0462 --------------
0463
0464 The offset between the kernel virtual and physical mappings. Used to
0465 translate virtual to physical addresses.
0466
0467 PHYS_OFFSET
0468 -----------
0469
0470 Indicates the physical address of the start of memory. Similar to
0471 kimage_voffset, which is used to translate virtual to physical
0472 addresses.
0473
0474 KERNELOFFSET
0475 ------------
0476
0477 The kernel randomization offset. Used to compute the page offset. If
0478 KASLR is disabled, this value is zero.
0479
0480 KERNELPACMASK
0481 -------------
0482
0483 The mask to extract the Pointer Authentication Code from a kernel virtual
0484 address.
0485
0486 TCR_EL1.T1SZ
0487 ------------
0488
0489 Indicates the size offset of the memory region addressed by TTBR1_EL1.
0490 The region size is 2^(64-T1SZ) bytes.
0491
0492 TTBR1_EL1 is the table base address register specified by ARMv8-A
0493 architecture which is used to lookup the page-tables for the Virtual
0494 addresses in the higher VA range (refer to ARMv8 ARM document for
0495 more details).
0496
0497 MODULES_VADDR|MODULES_END|VMALLOC_START|VMALLOC_END|VMEMMAP_START|VMEMMAP_END
0498 -----------------------------------------------------------------------------
0499
0500 Used to get the correct ranges:
0501 MODULES_VADDR ~ MODULES_END-1 : Kernel module space.
0502 VMALLOC_START ~ VMALLOC_END-1 : vmalloc() / ioremap() space.
0503 VMEMMAP_START ~ VMEMMAP_END-1 : vmemmap region, used for struct page array.
0504
0505 arm
0506 ===
0507
0508 ARM_LPAE
0509 --------
0510
0511 It indicates whether the crash kernel supports large physical address
0512 extensions. Used to translate virtual to physical addresses.
0513
0514 s390
0515 ====
0516
0517 lowcore_ptr
0518 -----------
0519
0520 An array with a pointer to the lowcore of every CPU. Used to print the
0521 psw and all registers information.
0522
0523 high_memory
0524 -----------
0525
0526 Used to get the vmalloc_start address from the high_memory symbol.
0527
0528 (lowcore_ptr, NR_CPUS)
0529 ----------------------
0530
0531 The maximum number of CPUs.
0532
0533 powerpc
0534 =======
0535
0536
0537 node_data|(node_data, MAX_NUMNODES)
0538 -----------------------------------
0539
0540 See above.
0541
0542 contig_page_data
0543 ----------------
0544
0545 See above.
0546
0547 vmemmap_list
0548 ------------
0549
0550 The vmemmap_list maintains the entire vmemmap physical mapping. Used
0551 to get vmemmap list count and populated vmemmap regions info. If the
0552 vmemmap address translation information is stored in the crash kernel,
0553 it is used to translate vmemmap kernel virtual addresses.
0554
0555 mmu_vmemmap_psize
0556 -----------------
0557
0558 The size of a page. Used to translate virtual to physical addresses.
0559
0560 mmu_psize_defs
0561 --------------
0562
0563 Page size definitions, i.e. 4k, 64k, or 16M.
0564
0565 Used to make vtop translations.
0566
0567 vmemmap_backing|(vmemmap_backing, list)|(vmemmap_backing, phys)|(vmemmap_backing, virt_addr)
0568 --------------------------------------------------------------------------------------------
0569
0570 The vmemmap virtual address space management does not have a traditional
0571 page table to track which virtual struct pages are backed by a physical
0572 mapping. The virtual to physical mappings are tracked in a simple linked
0573 list format.
0574
0575 User-space tools need to know the offset of list, phys and virt_addr
0576 when computing the count of vmemmap regions.
0577
0578 mmu_psize_def|(mmu_psize_def, shift)
0579 ------------------------------------
0580
0581 The size of a struct mmu_psize_def and the offset of mmu_psize_def's
0582 member.
0583
0584 Used in vtop translations.
0585
0586 sh
0587 ==
0588
0589 node_data|(node_data, MAX_NUMNODES)
0590 -----------------------------------
0591
0592 See above.
0593
0594 X2TLB
0595 -----
0596
0597 Indicates whether the crashed kernel enabled SH extended mode.
