linux-kernel - Re: remote debugging via FireWire * __fast_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 4 Dec 2007 08:39:38 +0100
From:	Andi Kleen <ak@...e.de>
To:	Bernhard Kaindl <bkaindl@...i.org>
Cc:	Stefan Richter <stefanr@...6.in-berlin.de>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Bernhard Kaindl <bk@...e.de>, linux-kernel@...r.kernel.org
Subject: Re: remote debugging via FireWire * __fast__ firedump!

On Tuesday 04 December 2007 04:45:22 am Bernhard Kaindl wrote:
>     I just wanted to let you know that I'll have picked up the early
> firewire patch again and cleaned it up very much so that it should
> be ready to submit it and but it on the patch-submission road.

Nice.

> I have just had the guts to explore __fast__ memory dumping over
> firewire for full-system dumps (reading quadlets is __painfully__
> show if you want to read 2GB of memory over the bus, you only get
> about some some kilobytes each second) using raw1394_start_read()
> to allow also block reads instead of just quatlet reads.

Unfortunately it won't work for >3GB or so AFAIK.

> The biggest block size that worked here was 2048 bytes, which was
> enough to get nearly 10MB/s of data transfer rate from the remote
> memory to disk. Dumping 2GB of remote memory was just a matter of
> about 3 few short minutes which quickly ran by.
>
> Afterwards, the victim was dead (I excluded the low MB of memory,
> so something else must have caused this), at least the start of

Did you run into the PCI memory hole below 4GB? 

I suppose the best way would be to require a System.map and
then read e820.nr_map/e820.map[] and only dump real memory.

-Andi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/