diff --git a/guest/kdump/Android.bp b/guest/kdump/Android.bp
new file mode 100644
index 0000000..cd68539
--- /dev/null
+++ b/guest/kdump/Android.bp
@@ -0,0 +1,40 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "microdroid_kexec",
+    defaults: ["avf_build_flags_cc"],
+    stem: "kexec_load",
+    srcs: ["kexec.c"],
+    no_full_install: true,
+    static_executable: true, // required because this runs before linkerconfig
+    compile_multilib: "64",
+}
+
+cc_binary {
+    name: "microdroid_crashdump",
+    defaults: ["avf_build_flags_cc"],
+    stem: "crashdump",
+    srcs: ["crashdump.c"],
+    static_executable: true,
+    no_full_install: true,
+    compile_multilib: "64",
+    sanitize: {
+        hwaddress: false, // HWASAN setup fails when run as init process
+    },
+}
+
+android_filesystem {
+    name: "microdroid_crashdump_initrd",
+    multilib: {
+        lib64: {
+            deps: ["microdroid_crashdump"],
+        },
+    },
+    dirs: [
+        "dev",
+        "proc",
+    ],
+    type: "cpio",
+}
diff --git a/guest/kdump/crashdump.c b/guest/kdump/crashdump.c
new file mode 100644
index 0000000..8dc84e9
--- /dev/null
+++ b/guest/kdump/crashdump.c
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This program runs as init in the crash kernel.
+
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/reboot.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <termios.h>
+#include <unistd.h>
+
+#define DUMP_SOURCE "/proc/vmcore"
+#define DUMP_TARGET "/dev/hvc1" // See virtualizationserice/crosvm.rs
+#define BUF_SIZE 4096
+
+#define FAIL(format, ...)                                                \
+    {                                                                    \
+        fprintf(stderr, format ":%s\n", ##__VA_ARGS__, strerror(errno)); \
+        goto fail;                                                       \
+    }
+
+// Why declare? __reboot() is the Bionic's system call stub for the reboot syscall. It is
+// automatically generated (and is part of API), but Bionic doesn't export this in its headers.
+extern int __reboot(int, int, int, void*);
+
+int main() {
+    // Disable buffering for better display of the progress
+    if (setvbuf(stdout, NULL, _IONBF, 0) != 0) {
+        fprintf(stderr, "Failed to disable buffering for stdout: %s\n", strerror(errno));
+        // This isn't a critical error. Continue.
+    }
+
+    printf("Crashdump started\n");
+
+    if (mount("proc", "/proc", "proc", 0, NULL) == -1) {
+        FAIL("Failed to mount /proc");
+    }
+
+    if (mount("devtmpfs", "/dev", "devtmpfs", 0, NULL) == -1) {
+        FAIL("Failed to mount /dev");
+    }
+
+    int vmcore = open(DUMP_SOURCE, O_RDONLY);
+    if (vmcore == -1) {
+        FAIL("Failed to open %s", DUMP_SOURCE);
+    }
+
+    int dest = open(DUMP_TARGET, O_WRONLY);
+    if (dest == -1) {
+        FAIL("Failed to open %s", DUMP_TARGET);
+    }
+
+    // We need to turn the line discipline off, otherwise the virtio-console will automatically
+    // append more data than what we have written because some will be recognized as a control
+    // sequence.
+    struct termios term;
+    if (tcgetattr(dest, &term) != 0) {
+        FAIL("Failed to get termios for %s", DUMP_TARGET);
+    }
+
+    cfmakeraw(&term); // Always successful. Returns void.
+
+    if (tcsetattr(dest, TCSAFLUSH, &term) != 0) {
+        FAIL("Failed to set terminal to the raw mode for %s", DUMP_TARGET);
+    }
+
+    struct stat statbuf;
+    if (fstat(vmcore, &statbuf) == -1) {
+        FAIL("Failed to stat %s", DUMP_SOURCE);
+    }
+    printf("Size is %ld bytes\n", statbuf.st_size);
+
+    // sendfile(2) is faster, can't be used because /proc/vmcore doesn't support splice_read
+    size_t dumped = 0;
+    char buf[BUF_SIZE];
+    int progress = 0; // percentage
+
+    while (dumped < statbuf.st_size) {
+        ssize_t read_bytes = read(vmcore, buf, BUF_SIZE);
+        if (read_bytes == -1) {
+            FAIL("Failed to read from %s", DUMP_SOURCE);
+        }
+        ssize_t written_bytes = write(dest, buf, read_bytes);
+        if (written_bytes == -1) {
+            FAIL("Failed to write to %s", DUMP_TARGET);
+        }
+        dumped += written_bytes;
+        int new_progress = dumped * 100 / statbuf.st_size;
+        if (new_progress > progress) {
+            progress = new_progress;
+            printf(".");
+        }
+    }
+    printf("done\n");
+
+    __reboot(LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_RESTART2, "kernel panic");
+    // Never reach here
+
+fail:
+    printf("Crashdump failed\n");
+    return 1;
+}
diff --git a/guest/kdump/kernel/Android.bp b/guest/kdump/kernel/Android.bp
new file mode 100644
index 0000000..2bab6a8
--- /dev/null
+++ b/guest/kdump/kernel/Android.bp
@@ -0,0 +1,25 @@
+package {
+    default_applicable_licenses: ["microdroid_crashdump_kernel_license"],
+}
+
+license {
+    name: "microdroid_crashdump_kernel_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-GPL-2.0-only",
+    ],
+}
+
+prebuilt_etc {
+    name: "microdroid_crashdump_kernel",
+    compile_multilib: "64",
+    arch: {
+        arm64: {
+            src: "arm64/kernel-5.15",
+        },
+        x86_64: {
+            src: "x86_64/kernel-5.15",
+        },
+    },
+    no_full_install: true,
+}
diff --git a/guest/kdump/kernel/arm64/kernel-5.15 b/guest/kdump/kernel/arm64/kernel-5.15
new file mode 100644
index 0000000..28b0214
--- /dev/null
+++ b/guest/kdump/kernel/arm64/kernel-5.15
Binary files differ
diff --git a/guest/kdump/kernel/empty b/guest/kdump/kernel/empty
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/guest/kdump/kernel/empty
diff --git a/guest/kdump/kernel/x86_64/kernel-5.15 b/guest/kdump/kernel/x86_64/kernel-5.15
new file mode 100644
index 0000000..98088e9
--- /dev/null
+++ b/guest/kdump/kernel/x86_64/kernel-5.15
Binary files differ
diff --git a/guest/kdump/kexec.c b/guest/kdump/kexec.c
new file mode 100644
index 0000000..fcec996
--- /dev/null
+++ b/guest/kdump/kexec.c
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This program loads kernel and initrd which the system will boot into when
+// panic occurs.
+
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/kexec.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#if defined(__aarch64__)
+#define EARLYCON "earlycon=uart8250,mmio,0x3f8"
+#elif defined(__x86_64__)
+#define EARLYCON "earlycon=uart8250,io,0x3f8"
+#endif
+
+static const char *KERNEL = "/system/etc/microdroid_crashdump_kernel";
+static const char *INITRD = "/system/etc/microdroid_crashdump_initrd.img";
+static const char *CMDLINE = "1 panic=-1 rdinit=/bin/crashdump nr_cpus=1 reset_devices "
+                             "console=hvc0 " EARLYCON;
+
+static int open_checked(const char *path) {
+    int fd = open(path, O_RDONLY);
+    if (fd == -1) {
+        fprintf(stderr, "Failed to open %s: %s\n", path, strerror(errno));
+        exit(1);
+    }
+    return fd;
+}
+
+int main() {
+    unsigned long cmdline_len = strlen(CMDLINE) + 1; // include null terminator, otherwise EINVAL
+
+    if (syscall(SYS_kexec_file_load, open_checked(KERNEL), open_checked(INITRD), cmdline_len,
+                CMDLINE, KEXEC_FILE_ON_CRASH) == -1) {
+        fprintf(stderr, "Failed to load panic kernel: %s\n", strerror(errno));
+        if (errno == EADDRNOTAVAIL) {
+            struct stat st;
+            off_t kernel_size = 0;
+            off_t initrd_size = 0;
+
+            if (stat(KERNEL, &st) == 0) {
+                kernel_size = st.st_size;
+            }
+            if (stat(INITRD, &st) == 0) {
+                initrd_size = st.st_size;
+            }
+            fprintf(stderr, "Image size too big? %s:%ld bytes, %s:%ld bytes", KERNEL, kernel_size,
+                    INITRD, initrd_size);
+        }
+        return 1;
+    }
+    return 0;
+}