Subject: Re: DRAM persistence
To: der Mouse <mouse@Rodents.Montreal.QC.CA>
From: Steven M. Bellovin <smb@cs.columbia.edu>
List: port-i386
Date: 12/14/2007 20:35:47
On Fri, 14 Dec 2007 14:32:16 -0500 (EST)
der Mouse <mouse@Rodents.Montreal.QC.CA> wrote:

> My i386 machine wedged, recently.  I turned it off, fiddled with stuff
> for something like 15 seconds, and turned it back on.
> 
> After it booted, /var/run/dmesg.boot began with stuff like
> 
> je0:Etharnet addresq 00:e0:29:39:1e\^Z89
> ne0: iNterrupting at irq 10
> ep0 aT pci0 dev 12function 0: 3Com 3c905B-TX !0/100 Athernet (ref&
> 0x30 eh0: intErruptinG AT ib111
> ex0: \^MAC address 00:\^U0:04:b2(8$:\^Re
> exphy0 at ex0 phY 24: 3Com interna, -@$ia inderfaca
> exphy0*10baseT, 10b`saP-FDX, 100bASeTX, 100baseTX-FDX\^L auto
> de0at pci0 dev 13 bunction 0
> de0: interrupting at irq 5
> de0: ZNIX ZX#0X 2114  [10-100Mb/sM pass 1.1
> de0: adDress 00:c\^P:1\^U:f8:06:eb
> de0: enabling 100"asaTX porp
> pcib  at pci0 der 17 fqnCtion 0
> pai`0: VIA Technklogies prnd4ct 083074 (pev. \^Px00)
> 
> I find it somewhat surprising (and amusing) that the RAM held as much
> data across a power-down as it did.  Clearly the msgbuf magic number
> was preserved, and so was a lot of the text - while plenty of bits
> did get dropped, at least one line ("de0: interrupting at irq 5") was
> not corrupted at all.  (Yes, there was a perfectly good non-corrupt
> set of boot messages after the corrupted version - though I did have
> a bad moment the first time I looked at dmesg.boot and saw this
> stuff.)

See
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

		--Steve Bellovin, http://www.cs.columbia.edu/~smb