I’m trying to use BugcheckDumpIoCallback to save system crash dumps from virtual machine. I can successfully register callback and during bugcheck it’s getting called.
All is fine for the first ~80 number of callbacks. After that my BugcheckDumpIoCallback is still being called but KBUGCHECK_DUMP_IO::Buffer is set to something that seems to be physical address rather than kernel mode VA (which is the case for the first couple of dozens calls).
I’ve verified couple of those physical addresses and they seem to be valid. It also looks like all physical memory ranges are covered.
I’ve got rid of all of my HV specific code (and only have debug print in the callback) and run it on physical test system. This produces pretty much the same results as on VM.
Both physical and virtual test systems are running Windows 7 SP1 x64.
Is it normal behaviour? Is there some hidden flag that says if KBUGCHECK_DUMP_IO::Buffer is virtual or physical address?
Thanks
Kris