Hi, I did some poking around with regards to accessing guest domain's cr3 from within the hypervisor (and thus a crash dump). I'm pretty sure that the following loop finds them all: void find_cr3(void) { struct domain *d; struct vcpu *v; /* Don't need to grab domlist_lock as we are the only thing running */ for_each_domain ( d ) for_each_vcpu ( d, v ) if ( !test_bit(_VCPUF_down, &v->vcpu_flags) ) printk("domain:%i vcpu:%u cr3:%08x\n", d->domain_id, v->vcpu_id, pagetable_get_pfn(v->arch.guest_table)); } I currently call that function in machine_crash_shutdown() just before calling crash_save_self(). That is after all but the crashing CPU have been shutdown, and just before the crashing CPU is saved and the crash kernel is run. It produces the following output on a 2 CPU system with 2 guest (and one privileged) domains. All domains have all CPUs, though its fairly easy to imagine what the output would look like if they didn't. (XEN) domain:0 vcpu:0 cr3:00027243 (XEN) domain:0 vcpu:1 cr3:0003e8a9 (XEN) domain:1 vcpu:0 cr3:00026e0b (XEN) domain:1 vcpu:1 cr3:0002080c (XEN) domain:2 vcpu:0 cr3:000297d4 (XEN) domain:2 vcpu:1 cr3:000297d0 The nice thing is that this code is really just a trivial walk of domain_list, a global symbol. Is it possible for you to just access that, or perhaps for me to just save it in a crash note somewhere? It would be nice not to have to save all of the cr3 values in crash notes as the number of them depends on the number of active domains (and online CPUs), which cannot be predicted at boot time. If you do need stuff saved in crash notes, I guess I could just chain it off the crash note for CPU0. Or if its just one pointer I could probably find free space in the existing crash note for CPU0 as I seem to recall that some fields (like say for instance the pid as the hypervisor doesn't have them) aren't used. -- Horms http://www.vergenet.net/~horms/