Re: [Vol-users] Analyzing large KVM/libvrt dumps

Sébastien, For real hardware the physical memory map is programmed into the memory controller by the BIOS. It depends on the physical hardware, OEM design choices and BIOS manufacturer. The operating system also may (usually does) remove some pages from the physical memory map. The most notable example is so-called "unmanaged" memory on x86 Windows systems with more than 4 GiB of RAM. But virtually every PC has at least some reserved pages. With virtual environments it depends on how the emulated BIOS constructs the virtual memory map. Hyper-V has a lot of synthetic device drivers that do not require PCI physical address space. The reserved space just below 4 GiB is greatly reduced. Intel and AMD systems used to be fairly uniform in their memory map, but that is no longer the case. We are encountering an increasing number of systems that reclaim physical address space above 0xC0000000 or that have multiple small memory holes between 0xB0000000 and 0xC0000000. What is worse, in some cases the processor will generate a bugcheck if you try to read from these memory "holes." The long and the short of it is that physical memory acquisition is becoming increasingly complex. There is no simple one-size-fits-all solution. Regards, George. ______________________________**_________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilesystems.**com/mailman/listinfo/vol-users<http://lis…