how to inject memory bitflips for maximum damage?

how to inject memory bitflips for maximum damage?

[Benjamin C. Ling]

I'm hoping there's someone here who has some knowledge on linux's
placement of objects in memory, or can point me to the right direction.

We have FAUmachine (a linux-based fault-injection VM) installed and
running on our research cluster, and can inject memory-bitflips in our
processes running on top of FAUmachine.

My question is -- how do I find out where to inject the bitflip for
maximum damage (or even any damage at all).  I've done a bit of searching
on google but haven't come up with much.

If anyone has any insight on where linux holds its critical memory
structures, or where it places its running programs in physical memory,
could you please let me know?  

Thanks in advance!

Ben

Re: how to inject memory bitflips for maximum damage?

[Pavel Machek]

Hi!

> We have FAUmachine (a linux-based fault-injection VM) installed and
> running on our research cluster, and can inject memory-bitflips in our
> processes running on top of FAUmachine.
> 
> My question is -- how do I find out where to inject the bitflip for
> maximum damage (or even any damage at all).  I've done a bit of searching
> on google but haven't come up with much.
> 
> If anyone has any insight on where linux holds its critical memory
> structures, or where it places its running programs in physical memory,
> could you please let me know?  

Toggle some bit in kernel code... That should
kill it real soon. Look at System.map for some
good places. (do_irq?). Substract 0xC0000000 for
physical address.

BTW what is purpose of these experiments?

-- 
				Pavel
Written on sharp zaurus, because my Velo1 broke. If you have Velo you don't need...

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
Hi!

> We have FAUmachine (a linux-based fault-injection VM) installed and
> running on our research cluster, and can inject memory-bitflips in our
> processes running on top of FAUmachine.
> 
> My question is -- how do I find out where to inject the bitflip for
> maximum damage (or even any damage at all).  I've done a bit of searching
> on google but haven't come up with much.
> 
> If anyone has any insight on where linux holds its critical memory
> structures, or where it places its running programs in physical memory,
> could you please let me know?  

Toggle some bit in kernel code... That should
kill it real soon. Look at System.map for some
good places. (do_irq?). Substract 0xC0000000 for
physical address.

BTW what is purpose of these experiments?

-- 
				Pavel
Written on sharp zaurus, because my Velo1 broke. If you have Velo you don't need...