linux-kernel - Re: [RFC][PATCH v2] Controlling kexec behaviour when hardware error happened.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 10 Feb 2011 10:14:08 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	Hidetoshi Seto <seto.hidetoshi@...fujitsu.com>
Cc:	Seiji Aguchi <seiji.aguchi@....com>,
	"hpa@...or.com" <hpa@...or.com>,
	"andi@...stfloor.org" <andi@...stfloor.org>,
	"ebiederm@...ssion.com" <ebiederm@...ssion.com>,
	"gregkh@...e.de" <gregkh@...e.de>,
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	"x86@...nel.org" <x86@...nel.org>,
	"dle-develop@...ts.sourceforge.net" 
	<dle-develop@...ts.sourceforge.net>,
	"amwang@...hat.com" <amwang@...hat.com>,
	Satoru Moriya <satoru.moriya@....com>
Subject: Re: [RFC][PATCH v2] Controlling kexec behaviour when hardware
 error happened.

On Thu, Feb 10, 2011 at 05:36:58PM +0900, Hidetoshi Seto wrote:
> (2011/02/10 1:35), Seiji Aguchi wrote:

[..]

> > diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
> > index d916183..e76b47b 100644
> > --- a/arch/x86/kernel/cpu/mcheck/mce.c
> > +++ b/arch/x86/kernel/cpu/mcheck/mce.c
> > @@ -944,6 +944,8 @@ void do_machine_check(struct pt_regs *regs, long error_code)
> >  
> >  	percpu_inc(mce_exception_count);
> >  
> > +	hwerr_flag = 1;
> > +
> >  	if (notify_die(DIE_NMI, "machine check", regs, error_code,
> >  			   18, SIGKILL) == NOTIFY_STOP)
> >  		goto out;
> 
> Now x86 supports some recoverable machine check, so setting
> flag here will prevent running kexec on systems that have
> encountered such recoverable machine check and recovered.
> 
> I think mce_panic() is proper place to set this flag "hwerr_flag".

I agree, in that case it is unsafe to run kexec only after the error
cannot be recovered by software.

Also, hwerr_flag is really a bad naming choice, how about
"hwerr_unrecoverable" or "hw_compromised" or "recovery_futile" or
"hw_incurable" or simply say what happened: "pcc" = processor context
corrupt (and a reliable restarting might not be possible). This could be
used by others too, besides kexec.

[..]

> > diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 0207c2f..0178f47 100644
> > --- a/mm/memory-failure.c
> > +++ b/mm/memory-failure.c
> > @@ -994,6 +994,8 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
> >  	int res;
> >  	unsigned int nr_pages;
> >  
> > +	hwerr_flag = 1;
> > +
> >  	if (!sysctl_memory_failure_recovery)
> >  		panic("Memory failure from trap %d on page %lx", trapno, pfn);
> >  
> 
> For similar reason, setting flag here is not good for
> systems working after isolating some poisoned memory page.
> 
> Why not:
>  if (!sysctl_memory_failure_recovery) {
>  	hwerr_flag = 1;
>  	panic("Memory failure from trap %d on page %lx", trapno, pfn);
>  }

Why do we need that in memory-failure.c at all? I mean, when we consume
the UC, we'll end up in mce_panic() anyway.

-- 
Regards/Gruss,
    Boris.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/