> Might be something to do with different crashdump formats supported > by crash or perhaps some historic reason? Dave, any comments on this? > > Looking history for the kernel/kexec.c shows that crash_notes has > been there from the early days of the kexec code. > Just to elaborate a little bit: The crash_notes which end up in the ELF notes, e.g. when collecting the core dump through /proc/vmcore on x86, are just copies of the ones in kernel/kexec.c. They are located by /proc/vmcore using the ELF header that kexec-tools creates. kexec-tools figures out the addresses to the crash_notes by reading /sys/devices/system/cpu/cpu%d/crash_notes or an equivalent file. But why go though all that trouble if they are available within the dump anyway?