----- "Darrin Thompson" <darrinth(a)gmail.com> wrote:
 On Wed, Nov 18, 2009 at 3:21 PM, Dave Anderson
<anderson(a)redhat.com>
 wrote:
 > Or for what it's worth, you can just read the data using the
 physical
 > address:
 >
 >  crash> rd -p 2b0000 10
 >            2b0000:  0100c70000080805 fff0db31fb000000  ............1...
 >            2b0010:  8b485500313e6b05 c931c03145302454  .k>1.UH.T$0E1.1.
 
 That's exactly what I'm looking for.
 
 When I'm looking at:
 
 kmem -p ffff810104ffd258
       PAGE        PHYSICAL      MAPPING       INDEX CNT FLAGS
 ffff810104ffd258 16da9d000                0        0  1 168100000000061
 
 How do I get the translation of the flags? I've seen something useful
 in vtop but I can never tell if it's giving me flags for the page
 struct at the pointer I give or the page struct that would have
 pointed the address I gave. 
The flags you see in the "vtop" output are PTE flags and not page flags.
For the page flags, you'll have to look at the kernel source code
in "include/linux/page-flags.h".  The usage of that bit-field changes
way too much for it to be hardwired into the crash utility. 
Dave