From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33738) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V9EgB-0004bp-Bb for qemu-devel@nongnu.org; Tue, 13 Aug 2013 09:30:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V9Eg5-00066z-BE for qemu-devel@nongnu.org; Tue, 13 Aug 2013 09:30:31 -0400 Received: from mail-wi0-x230.google.com ([2a00:1450:400c:c05::230]:42869) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V9Eg5-00066k-5R for qemu-devel@nongnu.org; Tue, 13 Aug 2013 09:30:25 -0400 Received: by mail-wi0-f176.google.com with SMTP id f14so620116wiw.3 for ; Tue, 13 Aug 2013 06:30:23 -0700 (PDT) MIME-Version: 1.0 Date: Tue, 13 Aug 2013 15:30:23 +0200 Message-ID: From: Juerg Haefliger Content-Type: text/plain; charset=ISO-8859-1 Subject: [Qemu-devel] QEMU savevm RAM page offsets List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Hi, I'm writing/extending a little tool (courtesy of Andrew @pikewerks) that dumps the RAM pages from a savevm file to a raw memory dump file so that it can be analysed using tools that require a raw dump as input. I can successfully locate and extract the pages and write them out to file. This seems to work for smaller VMs but when the memory size of a VM approaches 3.5 GB, things start to break, i.e., the analysis tool (volatility in this case) trips over the file. I believe this is because of PCI devices that are memory mapped below the 4GB memory mark which my tool doesn't account for at the moment. In other words, my tool puts all the pages in consecutive order without leaving 'holes' for the memory mapped devices. Question: is the information where the holes are and what the 'real' page offsets are in the savevm file or how could I gather that info? Any help is greatly appreciated. Thanks ...Juerg