linux-kernel - Re: [ANNOUNCE] Merkey's Kernel Debugger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44898.166.70.238.45.1218030342.squirrel@webmail.wolfmountaingroup.com>
Date:	Wed, 6 Aug 2008 07:45:42 -0600 (MDT)
From:	jmerkey@...fmountaingroup.com
To:	"Olivier Galibert" <galibert@...ox.com>,
	"Bill Davidsen" <davidsen@....com>, linux-kernel@...r.kernel.org,
	"Nick Piggin" <nickpiggin@...oo.com.au>,
	jmerkey@...fmountaingroup.com,
	"Geert Uytterhoeven" <geert@...ux-m68k.org>,
	"Stefan Richter" <stefanr@...6.in-berlin.de>,
	"Josh Boyer" <jwboyer@...il.com>
Subject: Re: [ANNOUNCE] Merkey's Kernel Debugger

> On Wed, Aug 06, 2008 at 09:11:47AM -0400, Bill Davidsen wrote:
>> I would suggest that if it meets coding standards and doesn't break
>> anything else it could be included in -mm (assume there's no objection
>> there) and let people beat on it there, with the assumption that unless
>> problems are found it will be promoted.
>
> It's a little too early for that.  Right now it's at the phase "how to
> make it better integrate with the kernel", with the use of existing
> hooks, adding the needed hooks to be more complete, working as a
> module, etc.  When that is done then the philosophical aspects can
> come into play, but it's not there yet.
>
>   OG.
>

I have removed the hooks into the /arch/x86 sections and converted the
debugger to use kprobes and notify_die as Andi suggested.  It also builds
and loads as a module.

One serious point has to do with NMI handling on SMP since the notify_die
handlers use this priorty calling mechanism.  I am still testing on SMP
but it seems to work -- I just am a little uncomfortable with trusting an
interface (notify_die) that can let someone come in and hook the NMI
handlers when I MUST BE ABLE TO NMI AND HALT non-focus processors first.

I am adding a special NMI state to the chain notifier to handle this case
where IT MUST BE CALLED FIRST and IT MUST BE THE ONLY EVENT CALLED.  I
used the DIE_KERNELDEBUG to hook the keyboard handler in
drivers/char/keyboard.c so we have the general hook into kprobes to handle
enter debugger events.

Jeff

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/