Re: [TECH TOPIC] Improving kernel security & integrity by generalizing ad-hoc safety mechanisms

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Sep 07, 2026 at 07:53:14PM +0300, igor.stoppa@gmail.com wrote:
> TL;DR: We (NVIDIA) want to explore the possibility of upstreaming
> mechanisms currently reserved for a safety-oriented fork of the
> kernel.
> Should there be a consensus that they can be valuable, we can plan for
> the work required for upstreaming, but first we would like to discuss
> the content, the expectations, and what it would entail to reach a
> mergeable status.
> 
> --------------------------
> 
> The long pitch:
> 
> Intro
> 
> In the field of Functional Safety, there is a strong demand for use of
> the Linux kernel as base operating system for safety applications.
> 
> Examples:
> Assisted/Autonomous driving, industrial/humanoid robots, medical
> equipment, aerospace.
> 
> Linux, though, was not designed for safety, and it cannot be used as-is.
> 
> While there are attempts at claiming safety compliance through
> process, these are insufficient for advanced safety applications.
> 
> The reason why said claims are insufficient is that on one hand the
> vanilla kernel would not survive negative testing (e.g. fault
> injection) and on the other hand a process-based approach would
> require demonstrable absence of safety-compromising bugs.
> 
> Which is more or less in the same ballpark as proving absence of bugs
> across the entire code base. Not very realistic.
> 
> At NVIDIA we are developing kernel extensions that support Linux-based
> safety through actual hardening mechanisms that can withstand that
> sort of validation based on simulation of faults.
> 
> --------------------------
> 
> References
> 
> Some of the problems addressed:
> 
> Linux Virtual Address Space Safety
> https://youtu.be/pe9OVjWdF-w
> 
> Identifying Safety Weaknesses and Fault Propagation in the Linux Kernel
> [https://www.youtube.com/watch?v=gW0W9YPnsjI]
> 
> 
> What we are working on:
> 
> NVIDIA Linux for Safety – A System-Level View
> https://www.youtube.com/watch?v=9GPQVu7KDTw
> 
> NVIDIA Approach for Achieving ASIL B Qualified Linux
> [https://www.youtube.com/watch?v=ueIPuhcyAUo]
> 
> --------------------------
> 
> Opportunity
> 
> While Safety was the primary goal for this exercise, it has become
> apparent that the very same mechanisms could be employed, with
> different policies, also for more traditional purposes, like integrity
> and security. This is something that could benefit a broader number of
> users than we had initially anticipated.
> 
> --------------------------
> 
> Question/Topic for discussion
> 
> Would the upstream community be interested in this sort of hardening?

Why not just submit your patches like other projects do to get review
that way?  If you don't have working patches, there's not much we can
really comment on, right?

And as you are working on this with the other ELISA people, why not work
with them to get the changes merged upstream?  Or is this separate from
that effort?

thanks,

greg k-h