----- Original Message ----- > Hi, > I'm analyzing a dump file ("KDUMP" header) with crash 7.0.1 that seems > to have some kernel pages missing: > > crash> struct foo ffff81101e19e000 > struct foo struct: page excluded: kernel virtual address: ffff81101e19e000 > type: "gdb_readmem_callback" > Cannot access memory at address 0xffff81101e19e000 > > When I set debug to 1 it turns out that even crash's 'mount' command > hits excluded pages: > mount: page excluded: kernel virtual address: ffff81101d688000 type: "read_string characters" > > In order to understand this error better I took a look at > diskdump.c:read_diskdump(): > > if (!page_is_dumpable(pfn)) { > if ((dd->flags & (ZERO_EXCLUDED|ERROR_EXCLUDED)) == > ERROR_EXCLUDED) { > if (CRASHDEBUG(8)) > fprintf(fp, "read_diskdump: PAGE_EXCLUDED: " > "paddr/pfn: %llx/%lx\n", > (ulonglong)paddr, pfn); > return PAGE_EXCLUDED; > } > if (CRASHDEBUG(8)) > fprintf(fp, "read_diskdump: zero-fill: " > "paddr/pfn: %llx/%lx\n", > (ulonglong)paddr, pfn); > memset(bufptr, 0, cnt); > return cnt; > } > > Does this mean these kernel pages are *not* zero? No, it means that if you invoke crash with the --zero_excluded flag, if an excluded page is encountered during runtime, it will return a zero-filled page instead of erroring out. > > Why would kernel pages containing structs (i.e. not page cache or > userspace pages) be excluded from the dump file? They wouldn't -- or better put -- shouldn't ever be excluded. > (This may seem like a weird question but I did not generate the dump > file myself so I can't easily try recreating it with different options.) > > Thanks, > Stefan The only explanation I can think of off the top of my head is if perhaps the page structures that makedumpfile parses were corrupted such that they were mistakenly presumed to be filter-worthy? Just a guess -- anybody else have any ideas of how it could happen? Dave -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility