Kdump Mechanism
Linux kernel problems are difficult to locate and rectify because they may cause the entire system to break down and cannot be reproduced. Also, due to the particularity of kernel debugging, common debugging methods such as printing, query, and step-by-step debugging are not suitable for locating kernel problems. Kernel crash dump mechanisms effectively collect onsite information when a problem occurs for subsequent analysis and are widely used to locate memory problems. Kernel crash dump mechanisms include LKCD, Diskdump, Netdump, Mkdump, and kdump. As a mainstream kernel crash dump mechanism, kdump is recommended for locating kernel problems in this document.
Kdump is accepted by the Arm kernel mainline in Linux 2.6.38. It is implemented through two kernels. In addition to the system kernel, kdump starts another capture kernel to capture system kernel information for dump. Figure 1 shows the process.
- The system kernel starts normally, including hardware self-check and bootloader loading, and reserves memory space for the capture kernel.
- Load the capture kernel to the reserved memory space.
- The system crashes, triggering panic, and the capture kernel starts up. (The capture kernel uses kexec to skip hardware self-check and quickly start up.)
- The capture kernel collects the system kernel information by using the /proc/vmcore memory image file.
- Compress the system kernel information to generate a dump file and write the file to a drive.