Re: Crashes when reading physical memory
Re: Crashes when reading physical memory
- Subject: Re: Crashes when reading physical memory
- From: Terry Lambert <email@hidden>
- Date: Fri, 13 Mar 2009 14:10:30 -0700
On Mar 13, 2009, at 1:28 PM, Hajime Inoue wrote:
Thanks, M.M., Michael, Andreas, and Terry, for your thoughts.
It's clear that there are definite limitations in getting a physical
memory
dump using the same resources being dumped. However, for some
purposes
what's
available just by dumping memory to a file is "good enough".
So I used the function M.M. suggested and wrote a kext using the
ml_phys_read_*
functions. This works fine for ppc (I've tested on 10.3.9 and 10.5
with 0.5
and
1.5G of memory, respectively). But it fails after reading about 3.3
or 3.4
G
on my Intel 10.5 machine.
Does anyone know why this should be? One of my colleagues mentioned
that he
saw
something about problems reading memory simultaneously being used
for DMA.
Is
this a possibility?
It's more likely that reading the memory mapped into the PCI bus
memory map region is triggering devices that support memory mapped I/O
to do things nkown to their drivers. That's typically why memdump has
platform specific memory regions it likes to skip when doing dumping:
to avoid triggering the hardware to do things it shouldn't.
-- Terry
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden