Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754052AbbK0IAL (ORCPT ); Fri, 27 Nov 2015 03:00:11 -0500 Received: from mail-wm0-f48.google.com ([74.125.82.48]:33826 "EHLO mail-wm0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752010AbbK0IAE (ORCPT ); Fri, 27 Nov 2015 03:00:04 -0500 Date: Fri, 27 Nov 2015 08:59:59 +0100 From: Ingo Molnar To: Andy Lutomirski , Linus Torvalds Cc: PaX Team , "kernel-hardening@lists.openwall.com" , Mathias Krause , "linux-kernel@vger.kernel.org" , Kees Cook , Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , x86-ml , Arnd Bergmann , Michael Ellerman , linux-arch , Emese Revfy Subject: Re: [kernel-hardening] [PATCH 0/2] introduce post-init read-only memory Message-ID: <20151127075959.GA24991@gmail.com> References: <1448401114-24650-1-git-send-email-keescook@chromium.org> <565595F5.32536.DB9FE75@pageexec.freemail.hu> <20151126085425.GA29848@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2274 Lines: 49 * Andy Lutomirski wrote: > > Can you see any fragility in such a technique? > > After Linus shot down my rdmsr/rwmsr decoding patch, good luck... I think that case was entirely different, but I've Cc:-ed Linus to shoot my idea down if it's crap. > More seriously, though, I think this is mostly just like any other in-kernel > fault. We failed, me might be under attack, let's oops. In the particular case > of suspend/resume, we could consider a debug flag to allow writes to these > variables during suspend/resume. In fact, that might even be a reasonable > default. We might want to allow writes during module unload as well. We are getting the _same_ information: we generate a reliable stack trace right there. We don't ignore anything. What my suggestion would do is to turn a 'sure system crasher' into a 'informational debug message'. On today's typical desktop systems I can tell you with 110% confidence that the vast majority of 'system crasher' oopses never reaches a kernel developer's attention, because the oops message is not propagated to the user, while the 'dump stack trace and try to continue' approach will result in proper bugzillas. And that's really an important distinction IMHO. Getting debug info out of the system is very important - and those who are paranoid can set a Kconfig value to crash their systems on any hint of a problem. > For everything else, we should probably focus more on getting OOPSes to display > reliably, which is supposed to work but, on my shiny new i915-based laptop, is > clearly not ready yet (I oopsed it yesterday due to my own bug and all I had to > show for it was a blinking capslock key, and yes, modesetting works). That's absolutely true as well but an independent issue: it does not invalidate my argument that is based on the status quo, which is that the vast majority panics/oopses, _especially_ during suspend/resume that was mentioned in this case, does not reach any kernel developer. Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/