May 2015 - kernelnewbies@kernelnewbies.org - Kernelnewbies Mailing Lists

vulnerability use-after-free
by 慕冬亮 May 17, 2015

May 17, 2015

Use-after-free is a important vulnerability ! As far as we know , Linux kernel is mostly using C and there may exist this vulnerability! I think in the kernel there are much allocator and reallocator , how do the kernel manage these things? mudongliang

2 1

linux timer questions
by buyitian May 17, 2015

May 17, 2015

Dear Experts: I have some questions about the linux timers: Dear Experts: I have some questions about the linux timers: 1. If one linux platform does not enable CONFIG_HIGH_RES_TIMERS, it means the platform does not support high resulution timer, what is the side effect? Is there any exact examples that can let me know the necessary of hrtimer? For example, if hrtimer is not enabled in code, the video 1080P will not work? I need these kind of examples to judge whether to enable hrtimer. Dear Experts: I have some questions about the linux timers: 1. Suppose in one linux platform, the timer HW is far from CPU core, if CPU wants to access timer register, it needs to go through several bus(AXI, AHB, APB), finally the access arrives at timer register, in this example, if I enable CONFIG_TICK_ONESHOT, and if the HZ == 512, it means CPU core needs to call function set_next_event 512 times per second, and the access latency caused by HW design will be large, how to mitigate this? Dear Experts: I have some questions about the linux timers: 1. Suppose in one linux platform, the system counter HW is far from CPU core, if CPU wants to access system counter, it needs to go though several bus(AXI, AHB, APB), fianally the access arrives at counter register, as far as I know, kernel will call update_wall_time based on HZ, suppose HZ == 512, it means the update_wall_time will be called 512 times per second. And inside function update_wall_time, it will read system counter register. So the access latency caused by system counter HW design will be large, how to mitigate this? Thanks in advance.

1 0

x86 driver help: ever see DMA and MMIO operations NMI depending on which PCIe slot you're installed in?
by Jimmie Mayfield May 17, 2015

May 17, 2015

Hi all. We're in the midst of performing system compatibility tests with our device and I'm seeing some odd behavior when testing a Lenovo x3650 M4 and M5 machines. 1) On the x3650 M4 machine, an attempt to perform a TODEVICE DMA operation using consistent memory results in an NMI when the device attempts to fetch the memory. Here's the thing: this NMI only happens when the device is plugged into certain PCIe slots. Some slots appear to work fine. We obtained PCIe bus analyzer traces for the NMI scenario and sent to Lenovo for analysis. Their response was a rather terse "memory address is invalid". We later obtained an analyzer trace for a non-NMI scenario in a different slot and saw the very same bus address. So I'm very confused: is it possible for a bus address allocated via pci_alloc_consistent to be valid only for specific PCIe slots? Shouldn't the kernel be able to allocate valid memory since it's given the pci_dev * as an argument? 2) On the x3650 M5 machine, an attempt to perform MMIO operations results in an NMI. Again, only from certain slots. Some slots seem to work fine. Again, near as I can tell, the slots are physically the same -- same width, same power capabilities, etc. Again, we obtained PCIe bus analyzer traces for both the NMI and the non-NMI scenarios and compared. There's a lot of noise in the traces because the machine BIOS appears to poll the PCI registers repeatedly and frequently but once the driver enables the device, we don't see anything that stands out in one case or the other. In both traces, we see the device receive the MMIO read request and respond about a microsecond later. In the NMI trace, the NMI occurs after the device writes the MMIO response. So I'm scratching my head. Has anyone seen such slot-specific behavior? How does one account for this in a device driver?

1 0

initiating DMA and going to sleep while holding spinlock
by Chan Kim May 15, 2015

May 15, 2015

Hello, Ok,I know the thing in my email title should be avoided but I have this basic question (I'm still a newbie). I'm modifying smsc911x Ethernet driver so that writing to/readng from the FIFO can be done by our own DMA controller. Since FIFO should not be messed up, the original driver uses spinlock during the FIFO burst access. I wanted to do this FIFO access using DMA, so I changed some code of the FIFO access code to use DMA and inserted wait_event_interruptible to go to sleep (that's bad) and this caused BUG : scheduling while atomic. I could separate it before holding the spinlock to avoid this(DMA and PIO loop). But what if during the DMA, some other process tries to access FIFO? (other network processes can access the network anyway). How do people prevent this 'FIFO access by other process while in DMA' ? I have to sleep during DMA. Any standard method? Any help will be appreciated. Best regards, Chan Kim

1 0

a question about DMA (realtek ethernet chip driver)
by Chan Kim May 14, 2015

May 14, 2015

Hi, I need help in understanding realtek8139 ethernet chip driver. (it's about basic DMA operation) in http://lxr.free-electrons.com/source/drivers/net/ethernet/realtek/8139cp.c?… in cp_start_xmit which is linked to start_xmit of netdev_ops of teh net_device, I see the driver uses dma_map_single to convert the sk_buf's data address to dma_address_t. (physical address). I understand the sk_buf is coming from upper protocol layer. For an address range to be used as DMA address, it should be physical address and non-cacheable. Also, during the initialization(cp_init_hw function) dma_alloc_cohererent is called to allocate DMA buffer and this address is written in the driver data (ring_dma), and also this DMA buffer address is written to the chip. Is the data in sk_buf copied to the DMA ring somewhere? if it is, where in the code is it done? Is it always like this? (using cacheable memory for sk_buf for speed and copy the data to DMA area and let the I/O chip or DMA controller take the data using DMA). I'm just curious if we don't use non-cacheable memory (DMA buffer) for sk_buf. Thanks, Chan Kim

2 1

in realtek 8139cp driver code, where does the start_xmit function triggers the chip?
by Chan Kim May 14, 2015

May 14, 2015

Hello all, Hope somebody could give me an explanation to this. I was looking at http://lxr.free-electrons.com/source/drivers/net/ethernet/realtek/8139cp.c#… and found in cp_start_xmit(..) function, there are all descriptor parameter setting for the driver private data structure. Where exactly the code triggers the chip? regards, Chan Kim

2 1

GadgetFS newbie question
by Uchiyama, Toru May 12, 2015

May 12, 2015

Hello, I want to use GadgetFS on an embedded system. An example user mode driver is usb.c. I want to develop a example driver base. But, I was not able to find a description of the license from the source code. I want to know the license of usb.c (http://www.linux-usb.org/gadget/usb.c) Any advice would be greatly appreciated. Thanks! -- uchiyama

1 0

Problem building kernel 4.0 with gcc5 Werror
by Victor Rodriguez May 11, 2015

May 11, 2015

Hi everyone I am trying to build the kernel 4.0 with gcc 5 . But I found the following problem : builtin-report.c comparison of constant ‘-1’ with boolean expression is always false THe problem is that gcc5 has new warnings: A new command-line option -Wbool-compare has been added for the C and C++ compilers, which warns about boolean expressions compared with an integer value different from true/false. https://gcc.gnu.org/gcc-5/changes.html I was checking the Makefile of tools/perf/ anda aprently they became every warning into an error. Werror Now I wonder if someone is working on this changes so I can take their pathces. Do you know any easy way that GCC use to avoid this kind of problems All the help is more than welcome Regards Victor Rodriguez

2 1

Query on use of CC3000 and linux driver
by victorascroft＠gmail.com May 11, 2015

May 11, 2015

Hello, I am looking into use of CC3000 under Linux. http://www.ti.com/product/cc3000 I had a few questions in mind and doubts which I wanted to clear. CC3000 has an board TCP/IP stack. It has a SPI interface for communication. One way of course is to use this SPI interface using the spidev module while adhering to the laid out protocol for CC3000 and writing one's own application. However, is it possible to use the CC3000 perhaps like one would use a USB to WiFi device and a regular ethernet/WiFi connection? Basically, the WiFi connection being accessible like eth0 or wlp3s0 connection and all the regular functionalities one would expect of such a connection. Is there a driver available which provides such functionality? Another example would be how SDIO based wireless devices get used (of course though these SDIO devices do not have an embedded stack). Is something similar possible for the SPI interface based CC3000? The question arises from the fact that CC3000 has an board stack. Linux having its own TCP/IP stack, raises a point of contention of how Linux would control it. From what I understand, any device having an onboard stack TCP/IP or otherwise, for let's say bluetooth is not a correct use case with Linux and the functionality I am expecting (what I wrote above) is not possible to achieve, atleast not practically perhaps. Thanks & Regards, Victor.

1 0

About head of kernel linked list structure
by Huaicheng Li May 11, 2015

May 11, 2015

In my understanding, the head initialised using LIST_HEAD_INIT or defined by LIST_HEAD corresponds to no *real* data field. But it *does* have its own _next_ and _prev_ pointers. The _next_ pointer points to the first real node in the doubly linked list, and the _prev_ pointer points to the last real node. I'm wondering if the picture shown at the very bottom of http://kernelnewbies.org/FAQ/LinkedLists is wrong about this. Because I believe head's _prev_ should point to the last node, which is at the very right. And the last node's _next_ should point to the head. Just as shown like the red line. Am I right? -- Best Regards Huaicheng Li

4 6