[Crash-utility] Kernel pages reported as PAGE_EXCLUDED

[Dave Anderson]

----- Original Message -----
> Hi,
> I'm analyzing a dump file ("KDUMP" header) with crash 7.0.1 that seems
> to have some kernel pages missing:
> 
> crash> struct foo ffff81101e19e000
> struct foo struct: page excluded: kernel virtual address: ffff81101e19e000
> type: "gdb_readmem_callback"
> Cannot access memory at address 0xffff81101e19e000
> 
> When I set debug to 1 it turns out that even crash's 'mount' command
> hits excluded pages:
> mount: page excluded: kernel virtual address: ffff81101d688000  type: "read_string characters"
> 
> In order to understand this error better I took a look at
> diskdump.c:read_diskdump():
> 
>   if (!page_is_dumpable(pfn)) {
>           if ((dd->flags & (ZERO_EXCLUDED|ERROR_EXCLUDED)) ==
>               ERROR_EXCLUDED) {
>                   if (CRASHDEBUG(8))
>                           fprintf(fp, "read_diskdump: PAGE_EXCLUDED: "
>                               "paddr/pfn: %llx/%lx\n",
>                                   (ulonglong)paddr, pfn);
>                   return PAGE_EXCLUDED;
>           }
>           if (CRASHDEBUG(8))
>                   fprintf(fp, "read_diskdump: zero-fill: "
>                       "paddr/pfn: %llx/%lx\n",
>                           (ulonglong)paddr, pfn);
>           memset(bufptr, 0, cnt);
>           return cnt;
>   }
> 
> Does this mean these kernel pages are *not* zero?

No, it means that if you invoke crash with the --zero_excluded flag,
if an excluded page is encountered during runtime, it will return
a zero-filled page instead of erroring out.

> 
> Why would kernel pages containing structs (i.e. not page cache or
> userspace pages) be excluded from the dump file?

They wouldn't -- or better put -- shouldn't ever be excluded.
 
> (This may seem like a weird question but I did not generate the dump
> file myself so I can't easily try recreating it with different options.)
> 
> Thanks,
> Stefan

The only explanation I can think of off the top of my head is if perhaps
the page structures that makedumpfile parses were corrupted such that
they were mistakenly presumed to be filter-worthy?

Just a guess -- anybody else have any ideas of how it could happen?

Dave