Hi, I'm analyzing a dump file ("KDUMP" header) with crash 7.0.1 that seems to have some kernel pages missing: crash> struct foo ffff81101e19e000 struct foo struct: page excluded: kernel virtual address: ffff81101e19e000 type: "gdb_readmem_callback" Cannot access memory at address 0xffff81101e19e000 When I set debug to 1 it turns out that even crash's 'mount' command hits excluded pages: mount: page excluded: kernel virtual address: ffff81101d688000 type: "read_string characters" In order to understand this error better I took a look at diskdump.c:read_diskdump(): if (!page_is_dumpable(pfn)) { if ((dd->flags & (ZERO_EXCLUDED|ERROR_EXCLUDED)) == ERROR_EXCLUDED) { if (CRASHDEBUG(8)) fprintf(fp, "read_diskdump: PAGE_EXCLUDED: " "paddr/pfn: %llx/%lx\n", (ulonglong)paddr, pfn); return PAGE_EXCLUDED; } if (CRASHDEBUG(8)) fprintf(fp, "read_diskdump: zero-fill: " "paddr/pfn: %llx/%lx\n", (ulonglong)paddr, pfn); memset(bufptr, 0, cnt); return cnt; } Does this mean these kernel pages are *not* zero? Why would kernel pages containing structs (i.e. not page cache or userspace pages) be excluded from the dump file? (This may seem like a weird question but I did not generate the dump file myself so I can't easily try recreating it with different options.) Thanks, Stefan -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility