| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Y5Ncaur0S4rEbath@alley>
Date: Fri, 9 Dec 2022 17:03:54 +0100
From: Petr Mladek <pmladek@...e.com>
To: "Guilherme G. Piccoli" <gpiccoli@...lia.com>
Cc: akpm@...ux-foundation.org, bhe@...hat.com,
kexec@...ts.infradead.org, linux-kernel@...r.kernel.org,
linux-hyperv@...r.kernel.org, netdev@...r.kernel.org,
x86@...nel.org, kernel-dev@...lia.com, kernel@...ccoli.net,
halves@...onical.com, fabiomirmar@...il.com,
alejandro.j.jimenez@...cle.com, andriy.shevchenko@...ux.intel.com,
arnd@...db.de, bp@...en8.de, corbet@....net,
d.hatayama@...fujitsu.com, dave.hansen@...ux.intel.com,
dyoung@...hat.com, feng.tang@...el.com, gregkh@...uxfoundation.org,
mikelley@...rosoft.com, hidehiro.kawai.ez@...achi.com,
jgross@...e.com, john.ogness@...utronix.de, keescook@...omium.org,
luto@...nel.org, mhiramat@...nel.org, mingo@...hat.com,
paulmck@...nel.org, peterz@...radead.org, rostedt@...dmis.org,
senozhatsky@...omium.org, stern@...land.harvard.edu,
tglx@...utronix.de, vgoyal@...hat.com, vkuznets@...hat.com,
will@...nel.org, xuqiang36@...wei.com, linux-edac@...r.kernel.org,
Tony Luck <tony.luck@...el.com>,
Dinh Nguyen <dinguyen@...nel.org>
Subject: Re: [PATCH V3 08/11] EDAC/altera: Skip the panic notifier if kdump
is loaded
On Fri 2022-08-19 19:17:28, Guilherme G. Piccoli wrote:
> The altera_edac panic notifier performs some data collection with
> regards errors detected; such code relies in the regmap layer to
> perform reads/writes, so the code is abstracted and there is some
> risk level to execute that, since the panic path runs in atomic
> context, with interrupts/preemption and secondary CPUs disabled.
>
> Users want the information collected in this panic notifier though,
> so in order to balance the risk/benefit, let's skip the altera panic
> notifier if kdump is loaded. While at it, remove a useless header
> and encompass a macro inside the sole ifdef block it is used.
>
> Cc: Borislav Petkov <bp@...en8.de>
> Cc: Petr Mladek <pmladek@...e.com>
> Cc: Tony Luck <tony.luck@...el.com>
> Acked-by: Dinh Nguyen <dinguyen@...nel.org>
> Signed-off-by: Guilherme G. Piccoli <gpiccoli@...lia.com>
>
> ---
>
> V3:
> - added the ack tag from Dinh - thanks!
> - had a good discussion with Boris about that in V2 [0],
> hopefully we can continue and reach a consensus in this V3.
> [0] https://lore.kernel.org/lkml/46137c67-25b4-6657-33b7-cffdc7afc0d7@igalia.com/
>
> V2:
> - new patch, based on the discussion in [1].
> [1] https://lore.kernel.org/lkml/62a63fc2-346f-f375-043a-fa21385279df@igalia.com/
>
>
> drivers/edac/altera_edac.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
> index e7e8e624a436..741fe5539154 100644
> --- a/drivers/edac/altera_edac.c
> +++ b/drivers/edac/altera_edac.c
> @@ -16,7 +16,6 @@
> #include <linux/kernel.h>
> #include <linux/mfd/altera-sysmgr.h>
> #include <linux/mfd/syscon.h>
> -#include <linux/notifier.h>
> #include <linux/of_address.h>
> #include <linux/of_irq.h>
> #include <linux/of_platform.h>
> @@ -24,6 +23,7 @@
> #include <linux/platform_device.h>
> #include <linux/regmap.h>
> #include <linux/types.h>
> +#include <linux/kexec.h>
> #include <linux/uaccess.h>
>
> #include "altera_edac.h"
> @@ -2063,22 +2063,30 @@ static const struct irq_domain_ops a10_eccmgr_ic_ops = {
> };
>
> /************** Stratix 10 EDAC Double Bit Error Handler ************/
> -#define to_a10edac(p, m) container_of(p, struct altr_arria10_edac, m)
> -
> #ifdef CONFIG_64BIT
> /* panic routine issues reboot on non-zero panic_timeout */
> extern int panic_timeout;
>
> +#define to_a10edac(p, m) container_of(p, struct altr_arria10_edac, m)
> +
> /*
> * The double bit error is handled through SError which is fatal. This is
> * called as a panic notifier to printout ECC error info as part of the panic.
> + *
> + * Notice that if kdump is set, we take the risk avoidance approach and
> + * skip the notifier, given that users are expected to have access to a
> + * full vmcore.
> */
> static int s10_edac_dberr_handler(struct notifier_block *this,
> unsigned long event, void *ptr)
> {
> - struct altr_arria10_edac *edac = to_a10edac(this, panic_notifier);
> + struct altr_arria10_edac *edac;
> int err_addr, dberror;
>
> + if (kexec_crash_loaded())
> + return NOTIFY_DONE;
I have read the discussion about v2 [1] and this looks like a bad
approach from my POV.
My understanding is that the information provided by this notifier
could not be found in the crashdump. It means that people really
want to run this before crashdump in principle.
Of course, there is the question how much safe this code is. I mean
if the panic() code path might get blocked here.
I see two possibilities.
The best solution would be if we know that this is "always" safe or if
it can be done a safe way. Then we could keep it as it is or implement
the safe way.
Alternative solution would be to create a kernel parameter that
would enable/disable this particular report when kdump is enabled.
The question would be the default. It would depend on how risky
the code is and how useful the information is.
[1] https://lore.kernel.org/r/20220719195325.402745-11-gpiccoli@igalia.com
> + edac = to_a10edac(this, panic_notifier);
> regmap_read(edac->ecc_mgr_map, S10_SYSMGR_ECC_INTSTAT_DERR_OFST,
> &dberror);
> regmap_write(edac->ecc_mgr_map, S10_SYSMGR_UE_VAL_OFST, dberror);
Best Regards,
Petr
Powered by blists - more mailing lists