volatility
volatility copied to clipboard
Plan to add NUMA support?
Hi,
I am trying to analyze a Linux 2.6.28 memory dump. The kernel is built with CONFIG_DISCONTIGMEM=y. I get this error while trying to use "linux_find_file" plugin - "phys_addr_of_page: Unable to determine physical address of page. NUMA is not supported at this time."
From the source code, currently only FLATMEM and SPARSEMEM memory models are supported. Is there any plan to support DISCONTIGMEM in near future? If not, any other options/tools to analyze this memory dump?
Thanks
Hey @JohCn,
Is this a distro provided kernel? If so can you send the uname -a output and the profile you are using?
Hi @atcuno,
This is a custom kernel. Basically, I am trying to analyze the memory dump from a gadget that runs a custom Linux 2.6.28 kernel on ARM. The device does not support 'uname' command. Here is the output from /proc/version -
Linux version 2.6.28 (gcc version 4.4.0 20100318 (Faraday C/C++ Compiler with Linux-3.3 Headers Release 20121022) ) #1 PREEMPT Tue Feb 21 20:04:05 CST 2017
Volatility profile attached. Linux-2-6-28.zip
Regards
Hi @atcuno,
I would appreciate it if you could let me know if you are planning to add support for DISCONTIGMEM.
Regards, Nikshep