In message <pan.2004.10.07.08.45.42.597759@st.mff.cuni.cz>, Pavel Cahyna writes
:
>On Thu, 07 Oct 2004 06:39:11 +0000, David Young wrote:
>
>> It looks to me like it isn't too hard to make a sparse crashdump on x86
>> that contains only the pages that are mapped into kernel virtual memory,
>> the page directory and page table pages (PDP and PTPs).  Does a crashdump
>> require any other pages?  I have a need for compact crashdumps, so I am
>> going to work on this over the weekend.
>
>That would be great, thanks. BTW why does the crashdump contain the
>physical memory instead of kernel virtual memory (/dev/kmem)? Is the
>memory not mapped to kernel actually useful for something?
>

At a guess, someone felt that when a system has just crashed it would 
be unwise to rely on any more data from it than absolutely necessary.  
What if the mapping tables were (part of?) the cause of the crash?

		--Steve Bellovin, http://www.research.att.com/~smb