[Qemu-devel] windows crash dump header. was: Re: [Question] dump memory when host pci device is used by guest

[Alon Levy]

On Mon, Oct 10, 2011 at 01:09:17PM +0200, Paolo Bonzini wrote:
> On 10/10/2011 01:04 PM, Daniel P. Berrange wrote:
> >On Mon, Oct 10, 2011 at 12:48:52PM +0200, Paolo Bonzini wrote:
> >>>  On 10/10/2011 12:21 PM, Alon Levy wrote:
> >>>>>  >>    A core file would be that format - for direct gdb processing. No
> >>>>>  >>    proprietary re-inventions please.
> >>>>  >
> >>>>  >Just a note: A core file to windows core dump file would be nice for
> >>>>  >windows guest crashes.
> >>>
> >>>  That requires cooperation from a kernel driver in the Windows guest.
> >>>  The driver must call KeInitializeCrashDumpHeader and write somewhere
> >>>  the physical address of the buffer.
> >That won't be suitable for 'virsh dump' then, because we need this to
> >work when the guest OS is in a crashed/non-responsive state, and so
> >we cna't rely on talking to it.
> 
> Note that the guest can generate the buffer before it crashes.
> 

Thanks. The contents seem to be undocumented (stubbed in reactos).
I did find a link to a tool made for Xen, but it mentions being broken
with Windows 2003 (where KeInitializeCrashDumpHeader was introduced).
 http://www.osronline.com/showThread.CFM?link=203490


> Paolo
>