On 10/25/2011 03:18 PM, Dave Anderson wrote: > > > > Crash uses a heuristic based on the IDT base to identify the base from > > migrate-to-file output. It also needs CR3 in order to read from virtual > > address. > > Just to clarify -- the need for the IDT base and cr3 is *only* true for > KVM dumps using the "savevm" format. > > With ELF-format kdumps, the phys_base is simply determined from the PT_LOAD > segment that describes the kernel's __START_KERNEL_map region. I don't know > why that couldn't be done in this proposed case. > >
kvm has no idea where the kernel (if any) is running. The dump is taken without any guest cooperation. -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain.
