Message 1 of 1
19 Nov 12 12:23
Join Date: 27 Jan 2007
Posts To This List: 123
I'm trying to use BugcheckDumpIoCallback to save system crash dumps from virtual
machine. I can successfully register callback and during bugcheck it's getting
All is fine for the first ~80 number of callbacks. After that my
BugcheckDumpIoCallback is still being called but KBUGCHECK_DUMP_IO::Buffer is
set to something that seems to be physical address rather than kernel mode VA
(which is the case for the first couple of dozens calls).
I've verified couple of those physical addresses and they seem to be valid. It
also looks like all physical memory ranges are covered.
I've got rid of all of my HV specific code (and only have debug print in the
callback) and run it on physical test system. This produces pretty much the same
results as on VM.
Both physical and virtual test systems are running Windows 7 SP1 x64.
Is it normal behaviour? Is there some hidden flag that says if
KBUGCHECK_DUMP_IO::Buffer is virtual or physical address?