linux-kernel - Re: snapshot of physical memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200607181919.k6IJJYfm032474@turing-police.cc.vt.edu>
Date:	Tue, 18 Jul 2006 15:19:34 -0400
From:	Valdis.Kletnieks@...edu
To:	Allison <fireflyblue@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: snapshot of physical memory

On Tue, 18 Jul 2006 12:16:16 EDT, Allison said:

> 2. How do I make sure that no updates take place in memory from the
> time I initiate the snapshot till it is done.

Hint: If you're running a program to dump memory, it's going to be calling
I/O drivers and so on - and all this activity has to modify at least *some*
memory (unless you're on an architecture with a *really* deep register stack ;)
You can't ensure that *no* updates take place.  At best, you can minimize
the number of pages touched.

For an example of the kind of hoops you need to jump through, I suggest a
careful reading of the 'suspend' and/or 'suspend2' source code - a large part
of that code is basically taking a snapshot of memory.

Also, you'll need to make sure that whatever software is running that
you're trying to snapshot is fairly tolerant of pauses - if you have a
disk that manages 20MBytes/second and you have 256M of memory, you're going
to be sitting there for 10 seconds. This can come as a surprise to programs
that were sleeping on a timer interrupt.. :)

Content of type "application/pgp-signature" skipped