Skip to content

KFunc crash_kexec


Crash the kernel at a specific point in the code.


void crash_kexec(struct pt_regs *regs)


This kfunc is destructive to the system. For example such a call can result in system rebooting or panicking. Due to this additional restrictions apply to these calls. At the moment they only require CAP_SYS_BOOT capability, but more can be added later.


eBPF is often used for kernel debugging, and one of the widely used and powerful debugging techniques is post-mortem debugging with a full memory dump.

This kfunc allows to trigger a kernel panic at a specific point in the kernels execution, this allows for the inspection of the memory dump at the exact point a program detected a certain condition.

Program types

The following program types can make use of this kfunc:


Docs could be improved

This part of the docs is incomplete, contributions are very welcome