An introduction to the kdump/crash framework

When a userspace application (a process) crashes, it's often feasible to enable the kernel core dump feature; this allows the kernel to capture relevant segments (mappings) of the process virtual address space (VAS), and write them to a file that is traditionally named core. On Linux, the name – and indeed various features – are now settable (look up the man page on core(5) for details). How does this help? You can later examine and analyze the core dump using the GNU debugger (GDB) (the syntax is gdb -c core-dump-file original-binary-executable); it can help to find the root cause of the issue! This is called post-mortem analysis, as it's done upon the dead body of the process, which is the core dump image file.

That's great, but wouldn't it be useful to be able to do the same with the kernel? This is precisely what the kernel dump (kdump) infrastructure provides – the ability to collect and capture...