[PATCH] vmcore: report the release of the crashed kernel

[PATCH] vmcore: report the release of the crashed kernel

[Breno Leitao]

kdump runs in a very small environment and cut-down set of drivers, and
it can die before the dump lands: it runs out of memory, a device hangs
on reset, or a watchdog fires while the dump is still being written out.
This happens about a single high digit percentage on most of big scale
datacenters.

When that happens the only evidence left is what the capture kernel
printed to the console, and that does not say which kernel crashed.

A fleet typically pins one kdump image and boots it after crashes from
many different production kernels, and it is useful to understand what
are the combination of crashed kernel panic and succesful kdump
collection.

Whether the dump completes at all tends to depend on the kernel that
died: memory pinned, devices in flight, dump size.

The release is already recorded.  crash_save_vmcoreinfo_init() puts
OSRELEASE= in the VMCOREINFO note, and by the time vmcore_init() has run
parse_crash_elf_headers() that note sits in elfnotes_buf.  Walk the notes
for it and print:

  vmcore: dump is from kernel 7.3.0-rc3-next-20260917

Given this is cheap and useful, I think it is worth adding to vmcore, to
improve kdump monitoring.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 fs/proc/vmcore.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 44d15436439fd9..406898247d7af1 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -1709,6 +1709,24 @@ static void vmcore_free_device_dumps(void)
 #endif /* CONFIG_PROC_VMCORE_DEVICE_DUMP */
 }
 
+#define VMCOREINFO_OSRELEASE_KEY	"OSRELEASE="
+
+static void __init vmcore_report_crashed_release(void)
+{
+	const char *ver, *eol;
+
+	ver = strnstr(elfnotes_buf, VMCOREINFO_OSRELEASE_KEY, elfnotes_sz);
+	if (!ver)
+		return;
+
+	ver += sizeof(VMCOREINFO_OSRELEASE_KEY) - 1;
+	eol = memchr(ver, '\n', elfnotes_buf + elfnotes_sz - ver);
+	if (!eol)
+		return;
+
+	pr_notice("dump is from kernel %.*s\n", (int)(eol - ver), ver);
+}
+
 /* Init function for vmcore module. */
 static int __init vmcore_init(void)
 {
@@ -1733,6 +1751,8 @@ static int __init vmcore_init(void)
 	elfcorehdr_free(elfcorehdr_addr);
 	elfcorehdr_addr = ELFCORE_ADDR_ERR;
 
+	vmcore_report_crashed_release();
+
 	proc_vmcore = proc_create("vmcore", S_IRUSR, NULL, &vmcore_proc_ops);
 	if (proc_vmcore)
 		proc_vmcore->size = vmcore_size;

---
base-commit: 3f2425f5b5bbbdd991ca9cdfd5502e68d8895998
change-id: 20260918-kdump_print-861a49b856ca

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] vmcore: report the release of the crashed kernel

[sashiko-bot]

> kdump runs in a very small environment and cut-down set of drivers, and
> it can die before the dump lands: it runs out of memory, a device hangs
> on reset, or a watchdog fires while the dump is still being written out.
> This happens about a single high digit percentage on most of big scale
> datacenters.
> 
> When that happens the only evidence left is what the capture kernel
> printed to the console, and that does not say which kernel crashed.
> 
> A fleet typically pins one kdump image and boots it after crashes from
> many different production kernels, and it is useful to understand what
> are the combination of crashed kernel panic and succesful kdump
> collection.
> 
> Whether the dump completes at all tends to depend on the kernel that
> died: memory pinned, devices in flight, dump size.
> 
> The release is already recorded.  crash_save_vmcoreinfo_init() puts
> OSRELEASE= in the VMCOREINFO note, and by the time vmcore_init() has run
> parse_crash_elf_headers() that note sits in elfnotes_buf.  Walk the notes
> for it and print:
> 
>   vmcore: dump is from kernel 7.3.0-rc3-next-20260917
> 
> Given this is cheap and useful, I think it is worth adding to vmcore, to
> improve kdump monitoring.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921-kdump_print-v1-1-e445fec3177c@debian.org?part=1