How Are Ramdumps Generated on a System Crash?
In Our Project We Get Ramdumps from Other Teams Which Is Generated in Case of a System Crash and Need Further Investigation. I Am Working on an Utility Which...
In our project we get ramdumps from other teams which is generated in case of a system crash and need further investigation. I am working on an utility which keeps some board specific data in the ram , which can be later utilized for debugging purpose. In order to better understand the environment/process in which my utility will be used I am trying to figure this information out.
Till now I understand there will be watchdog running (software/hardware), which will get triggered when fed in a particular timeout duration. Once it is triggered it will perform the system reset through some System registers.
Now I am little fuzzy on when the ramdumps are generated , is it before/after reset, or it needs some other tool connected to the board through which ramdumps are captured.
I understand once the ramdumps are available we can run parsers to extract the useful information or can use it in debugger like gdb to further analyse the state leading to the crash.
1 Answer
There are plenty of tools to analyse the ramdump, in other words physical memory dump.
Just imagine after reset what is the condition of RAM. In general, you don't dump the memory after reset you do it before reset in-order to do the memory analysis.
In detail about the RAM-dump in Linux system
Is divided into three sections based on how ramdump is generated, transferred and stored.
- The Support in the kernel to enter into ramdump mode when kernel crashes or freezes.
- Support in boot-loader to detect ramdump, wait for a host tool to initiate ramdump and send the data to host.
- A host tool which can receive data from device and save it on host PC file system.
Later you need to have bootloader support as well, it makes the decision whether to enter into ramdump mode not boot Linux normally.
Ramdump generation during the crash
The kernel panic notifier registered from the ramdump driver will be called by kernel. Ramdump driver do,
- Invoke cache sycn api to make sure all the content the ram is coherent.(flush_cache_all(), outer_flush_all())
- save core registers to ram
- save MMU registers
- write MAGIC_CRASH to SRAM regiter. Then do a reboot. Now boot-loader finds the MAGIC_CRASH in SRAM register and goes to ramdump mode.
Very detailed information about Ramdump Linux inspection.
You can try something like this in fly
$ cat /proc/[your_pid]/maps and the use gdb to inspect
$ gdb --pid [your_pid]
Some tools that can help you.
Go through these lists you will find the information about (FATKit) Foresnic Analysis toolkit.Foriana, etc.
David Miller brings 15 years of experience in global economics, personal finance strategy, and market dynamics. He specializes in turning complex economic trends into actionable insights for everyday readers.
