Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-20 Thread Rusty Russell
"Frank Ch. Eigler" writes: > Hi - > >> [...] >> -add_taint(TAINT_DIE); >> +add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); >> [...] > > If "UNRELIABLE" a good way to describe it - not DANGEROUS or > COUNTERPRODUCTIVE or something, then maybe lockdep *can* produce > reasonable results followi

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-20 Thread Rafael J. Wysocki
On Monday, January 21, 2013 10:30:22 AM Rusty Russell wrote: > Dave Jones writes: > > On Thu, Jan 17, 2013 at 11:27:27AM +1030, Rusty Russell wrote: > > > > > taint: add explicit flag to show whether lock dep is still OK. > > > > > > Fix up all callers as they were before, with make one chan

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-20 Thread Frank Ch. Eigler
Hi - > [...] > - add_taint(TAINT_DIE); > + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); > [...] If "UNRELIABLE" a good way to describe it - not DANGEROUS or COUNTERPRODUCTIVE or something, then maybe lockdep *can* produce reasonable results following such a taint. If the results are mer

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-17 Thread Dave Jones
On Thu, Jan 17, 2013 at 11:27:27AM +1030, Rusty Russell wrote: > taint: add explicit flag to show whether lock dep is still OK. > > Fix up all callers as they were before, with make one change: an > unsigned module taints the kernel, but doesn't turn off lockdep. > > Signed-off-by: Rusty

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-16 Thread Rusty Russell
Josh Boyer writes: >> diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c >> index 86e2f4a..7acca64 100644 >> --- a/drivers/iommu/dmar.c >> +++ b/drivers/iommu/dmar.c >> @@ -230,7 +230,7 @@ dmar_parse_one_rhsa(struct acpi_dmar_header *header) >> } >> } >> WARN_TAINT( >>

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-16 Thread Josh Boyer
On Wed, Jan 16, 2013 at 02:04:50PM +1030, Rusty Russell wrote: > Josh Boyer writes: > > With module signing enabled but not in enforcing mode, we don't consider > > unsigned modules to be an error. However, if we encounter an unsigned > > module we currently taint the module and kernel with TAINT

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-16 Thread Josh Boyer
On Wed, Jan 16, 2013 at 02:04:50PM +1030, Rusty Russell wrote: > Josh Boyer writes: > > With module signing enabled but not in enforcing mode, we don't consider > > unsigned modules to be an error. However, if we encounter an unsigned > > module we currently taint the module and kernel with TAINT

Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-15 Thread Rusty Russell
Josh Boyer writes: > With module signing enabled but not in enforcing mode, we don't consider > unsigned modules to be an error. However, if we encounter an unsigned > module we currently taint the module and kernel with TAINT_FORCED_MODULE. > That also disables lockdep within the kernel. How ab

[PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

2013-01-15 Thread Josh Boyer
With module signing enabled but not in enforcing mode, we don't consider unsigned modules to be an error. However, if we encounter an unsigned module we currently taint the module and kernel with TAINT_FORCED_MODULE. That also disables lockdep within the kernel. Given that we aren't in enforcing