July 2018 - kernelnewbies@kernelnewbies.org - Kernelnewbies Mailing Lists

Re: Question about memcpy
by Alex Arvelaez July 7, 2018

July 7, 2018

On Jul 7, 2018 7:37 AM, bing zhu <zhubohong12(a)gmail.com> wrote: > > Dear Sir/Ma'am > Thank you for your time ,i'm a student new to linux kernel. > I have a question about memcpy,i noticed that memcpy is faster in kernel than in user space > for example : > in a module helloworld , i use memcpy to copy a 4096B to a block of memory for like 10000 times > and in user space i do the same thing,I noticed that kernel is faster than user , > is it possible that in kernel when i insmod hello it can not be scheduled but in user space it will so kernel is faster? This makes sense, less context switches. > is there a possible way that a user task can run a block of code that uninterruptable? No switch ,no schedule ? I don't think this is possible, Linux is a preemptive kernel. > Thank you !

1 0

How to change page permission from inside the kernel?
by Ahmed Soliman July 7, 2018

July 7, 2018

I have a memory page allocated with mmap() from user space, This address is passed to some kernel module (kvm_intel to be specific) and i want to know how can I change the page permission from inside there My goal is to achieve something like this mprotect(mem, PAGE_SIZE, PROT_READ) except for mprotect can't be called from the kernel, and I couldn't find the right way to do it.

4 6

Fwd: How to change page permission from inside the kernel?
by Ahmed Soliman July 7, 2018

July 7, 2018

---------- Forwarded message ---------- From: Ahmed Soliman <ahmedsoliman0x666(a)gmail.com> Date: 6 July 2018 at 23:56 Subject: Re: How to change page permission from inside the kernel? To: Valdis Kletnieks <valdis.kletnieks(a)vt.edu> >> Implementing some kernel protection against subset of rootkits that >> manipulates kernel static data (memory pages as well as their >> mappings) by having them enforced by hypervisor which is KVM in our > > Can you give an actual example of a case where *all* of the following are true? > I think there is a little bit confusion between the current R/O protection and what are we doing. so I will need to make some distinctions than I will answer all the questions. First here is a bunch of accronyms that I will use for convenience (pulled out KVM mmu.txt) pfn host page frame number hpa host physical address hva host virtual address gfn guest frame number gpa guest physical address gva guest virtual address To aviod confusion I will refer to the thing we are doing as ROE (read only enforcement) and it is alittle bit different from typical R/O protection in 2 aspects: - R/O is enforced by hardware but ROE is enforced by Hypervisor(still using Hardware protection but with hypervisor on top of it) - R/O can be enabled and disabled by the kernel at its own will but ROE can be enabled by the guest kernel and once enabled the hypervisor will make sure it never gets disabled again, so if even if the kernel decided to modify a paged that has ROE, it can't without a reboot. Here is a very simple description of how ROE is supposed to works (I am missing out some tiny details like remapping pages): The kernel passes a gva of a page to its hypervisor. The hypervisor converts gva to hva then places R/O on that page note that is 2 levels of paging we have the host page table with the appropriate R/O protection (including guest's own ROE requests) and the guest page table its own R/O protections that the guest can modify. There is another part that isn't designed yet to handle DMAs and registers with static content > 1) It's a page that's safe to make R/O out from under the code that uses that page. Yes because the guest kernel and hypervisor will coordinate together which pages of the _guest kernel_ memory should have this protections. of course the userspace process running the hypervisor (let it be qemu or any other software) do own the page and can do whatever it wishes with it. > 2) It's a kernel static data that's R/W (Hint: stuff known to be R/O is already set to R/O > at boot or module load time, so if it's R/W it probably *needs* to be that...) I think this question is from the confusion between R/W and ROE what we are simply going to do is that have every R/O page that will never be R/W again to also be ROE if the kernel is compiled with the right options (we will add that too) to be a kvm guest. > 3) the rootkit *is* able to screw with kernel pages, but somehow *is not* able to > disable your protection (remember, all it takes is one NOP or BRANCH opcode in > the right place). I can't think of a way to do it. having a rootkit being able to manipulate kernel pages can only be done though one of these ways none of which is considered a real threat (except for the DMA part thats why we are stil learning about current DMA memory protections and limitations): - VMM escape where it can then modify the paging protections in the host allocated memory that was assigned to the guest. - Screwing the page table itself which is not static data. but parts of the details I am missing is that hypervisor will keep track of all guest page number, guest frame number of all ROE protected pages and make sure that it is never the wrong mapping when updating the TLB. - DMA and we are planning to do similar protection for DMA memory but still design in progress. other than these described above, I can't think of a way to manipulate a ROE protected page without a reboot.

2 3

Leaving I/O pressure with memory!? How to do it?
by Daniel. July 6, 2018

July 6, 2018

Hi everybody! This is a long doubt mine. And usually I want to apply this to testing machines that would not be a problem if crashed or destroyed at all. For the cases where I don't really care about the risks. In another words, not production at all. Sometime we have a machine that we work on and that is really really slow when doing I/O. I know that kernel will use memory to avoid doing I/O, and that it would be a kind of conservative in avoiding keep to much data on volatile memory susceptible to being lost on power failure. My question is, how to do the opposite, and avoid I/O as much as possible, doesn't matter the risks? I'm using a virtual machine to test some ansible playbooks, the machine is just a testing environment so it will be created again and again and again. (And again). The playbook generates a lot of I/O, from yum installs, and another commands that inspect ISO images to create repositories, ... it doesn't matter, the problem is that it is really slow and that it doesn't contains any important data. What can I do to avoid I/O (by using memory) as much as possible? And how can I measure if it worked? What I'm doing is keeping vm.dirty_background_ratio to the default (10) and setting vm.dirty_ratio to 90. From what I could grasp the first controls when the kernel thread will be scheduled to flush data to disk, and the second when the kernel will block I/O entirely. By the way, this is where the I/O wait from `top` comes from? Anyway. The idea is that the flushing thread enters as soon as possible and that the blocking happens as late as possible so that I leave disks working but avoid I/O blocking. How can I measure I/O blocking? Is there any counter for that so I can measure its frequency and compare before and after messing up with dirty_ratio? Regards, -- “If you're going to try, go all the way. Otherwise, don't even start. ..." Charles Bukowski

2 4

(no subject)
by inventsekar July 6, 2018

July 6, 2018

Dear All,.... so I was reading on Quora.... https://www.quora.com/What-are-some-features-that-Linus-Torvalds-dismissed-… Signing Linux kernel with Microsoft secure boot keys for UEFI. That was suggested by RedHat developers and Linus flipped them off in his character... I went to that link and read two three times, but I could not understand. Could you explain this above issue, on a newbies perspective. Best regards, sekar

1 0

Re: Question about watchdog
by valdis.kletnieks＠vt.edu July 3, 2018

July 3, 2018

On Tue, 03 Jul 2018 10:28:48 +0800, you said: > yes ! but there are days when people have to do a real-time work with no > delay in kernel space ,i think i can feed the dog > a percpu variable "nmi_touch" looks suspiciousï¼thanksï¼ 1) The Linux kernel community convention is t use 'reply all' so that a copy goes back to the list, so that all may read, learn, and comment... 2) If you're hanging a CPU with something for long enough to trigger a watchdog event, you've *already* *broken* real-time processing on that CPU. Read that second sentence again, and repeat until it sinks in. If the watchdog is firing for a CPU because you've been running a tight loop on it for *that* long, *that CPU is by definition not able to do realtime in a Linux context*.

1 0

finding the blueZ version in the downloaded kernel
by Raul Piper July 1, 2018

July 1, 2018

Hello, I have been searching a lot inside the kernel sources but I am not able to find which BlueZ version is used by the kernel sources. On . pre-compiled kernel i can get the version using the bluetoothd -v but how can i coem to know the version being used in the linux kernel for the BlueZ (bluetooth stuck) kindly assist. thnx in advance Rp

1 0