Linked by Thom Holwerda on Sat 14th Jul 2007 19:38 UTC, submitted by mark
Thread beginning with comment 255497
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.




Member since:
2005-07-08
You're correct.
Any code running on bare metal in kernel mode has the potential to barf all over memory until it barfs all over itself. Only hardware virtualization can contain the damage. But this is an unlikely scenario. The most common cause of data corruption is that the code that's supposed to be playing with the data does something wrong. The odds of the capture kernel getting trashed are slim because nothing in the production kernel is supposed to be playing with its data.
So, there is no design that guarantees that we will always be able to dump a crashed host kernel. But we can dramatically increase our chances by using a separate capture kernel, and nothing in a virtual machine can negatively impact the hypervisor's ability to dump it. The hypervisor could crash on its own, of course, but not because the virtual machine crashed.