Understanding Kdump (How to make crashnote)

crashnote contains register status when crash happens. In kernel, this data is stored “note_buf_t __percpu *crash_notes”.

include/linux/kexec.h

typedef u32 note_buf_t[KEXEC_NOTE_BYTES/4];

crashnote is also one part of /proc/vmcore. At first, crashnotes[] address, got by reading sys/devices/system/cpu/cpu0/crash_notes, is stored as one program header, which could be got from “elfcorehdr”. Making crash_notes is done by crash_save_cpu().

crash_kexec->machine_crash_shutdown->crash_save_cpu:

1206 void crash_save_cpu(struct pt_regs *regs, int cpu)

1207 {

1208         struct elf_prstatus prstatus;

1209         u32 *buf;

1210

1211         if ((cpu < 0) || (cpu >= nr_cpu_ids))

1212                 return;

1213

1214         /* Using ELF notes here is opportunistic.

1215          * I need a well defined structure format

1216          * for the data I pass, and I need tags

1217          * on the data to indicate what information I have

1218          * squirrelled away.  ELF notes happen to provide

1219          * all of that, so there is no need to invent something new.

1220          */

1221         buf = (u32*)per_cpu_ptr(crash_notes, cpu);

1222         if (!buf)

1223                 return;

1224         memset(&prstatus, 0, sizeof(prstatus));

1225         prstatus.pr_pid = current->pid;

1226         elf_core_copy_kernel_regs(&prstatus.pr_reg, regs);

1227         buf = append_elf_note(buf, KEXEC_CORE_NOTE_NAME, NT_PRSTATUS,

1228                               &prstatus, sizeof(prstatus));

1229         final_note(buf);

1230 }

The final layout illustrate below.