Re: [Qemu-devel] dump-guest-memory command?

[Laszlo Ersek <lersek@redhat.com>]

On 05/16/14 15:01, Jun Koi wrote:
> 
> 
> 
> On Fri, May 16, 2014 at 7:30 PM, Laszlo Ersek <lersek@redhat.com
> <mailto:lersek@redhat.com>> wrote:
> 
>     On 05/16/14 11:59, Jun Koi wrote:
> 
>     > - is it true that dump-guest-memory just write down physical memory
>     > page, and does not consider the virtual-memory concept?
> 
>     No, it isn't.
> 
>     Basically, "dump-guest-memory" supports two modes of operation, "paging
>     enabled" and "paging disabled".
> 
>     Many (most?) people dump for the "crash" utility, which is super smart,
>     and extra paging info is not needed. For "crash" we just dump the
>     guest-phys memory ranges the way the guest sees them, and that's it;
>     "crash" figures out everything from that.
> 
>     If you want to use "gdb" rather than "crash", or need the guest-virtual
>     addresses in the ELF vmcore for some other reason, then you should
>     invoke "dump-guest-memory" with paging enabled.
> 
>     Enter "help dump-guest-memory" at the qemu monitor prompt, and look for
>     the "-p" option.
> 
> 
> so i suppose this works for all kind of OS in guest VM, not only Linux
> guest?

far as I remember, it should; the virtual mappings "in effect" are
searched starting from cr3:

qmp_dump_guest_memory() [dump.c]
  dump_init()
    qemu_get_guest_memory_mapping() [memory_mapping.c]
      for (almost) all VCPUs:
        cpu_get_memory_mapping() [qom/cpu.c]
          x86_cpu_get_memory_mapping()
                                     [target-i386/arch_memory_mapping.c]
            check cr3, cr4; walk page tables etc

There are some caveats / limitations: search "qapi-schema.json" for the
string "dump-guest-memory", and read that section.

Laszlo