On Tue, 2004-10-26 at 18:08, Robert P. J. Day wrote: [snip] > but, once again, if the FS is mounted read only, how will that page > "eventually make it to disk", as you describe it? i guess, the way > i'm looking at it, the read-only mount setting should take precedence > over *all* operations and should be the ultimate authority, preventing > any writes to disk, no matter how corrupted the internal data > structures get. anyway, i guess that's just looking at things as if > it were a perfect world. I think it's basically just that once there is memory corruption in the kernel, all bets are off. And that goes for that probably not more than one bit, or maybe a byte that says 'read-only'. This is one of the reasons, I think, that Linus doesn't think putting kernel crash dump code in the kernel that dumps to disk. It could potentially scribble all over your disk. With proprietary hardware/software combos (e.g.: Solaris on UltraSparc), it makes a little more sense, since the vendor controls the whole stack from kernel down to the silicon. But on x86 where Linus and Linux distributors have little to no control over hardware, who knows what could happen. Hence, we have netdump, using a packet driver (even bypassing the higher level tcp/ip code I think). The point is, when the kernel is corrupt in anyway, anything can happen. Which is why a crash (panic) is probably your friend ;-). Apparently, at least at for a time, NTFS was particularly fragile in that area. (NTFS is not alone, however. I also had a read only UFS mount blow away my Solaris 2.5.1 install, once.) -- -Paul Iadonisi Senior System Administrator Red Hat Certified Engineer / Local Linux Lobbyist Ever see a penguin fly? -- Try Linux. GPL all the way: Sell services, don't lease secrets