- kernelnewbies@kernelnewbies.org - Kernelnewbies Mailing Lists

boot time variable
by Tobin C. Harding Oct. 10, 2017

Oct. 10, 2017

Hi, I would like to create a boot time variable i.e a variable that is set once at boot time. Variable does not need to be globally accessible. (actually I am using two variables). Could any one point me to examples of this already intree please? I have tried the following but it has a race condition on the zero check and assignment of randval/oddval. /* Maps a pointer to a unique identifier. */ static char *ptr_to_id(char *buf, char *end, void *ptr, struct printf_spec spec) { long hashval; static long randval = 0; static long oddval = 0; if (oddval == 0 && randval == 0) { randval = get_random_long(); oddval = get_random_odd_long(); } hashval = ptr_obfuscate((unsigned long)ptr, randval, oddval); spec.base = 16; return number(buf, end, hashval, spec); } And the compiler doesn't like static long randval = get_random_long(); static long oddval = get_random_odd_long(); I thought of wrapping oddval/randval in a struct and protecting it with a lock but I don't know how/where to initialize the lock in a race free manner? Any tips or pointers please? thanks, Tobin.

3 3

Hook Functions - Dynamic Instrumentation and Monitoring
by Milad Kahsari Oct. 10, 2017

Oct. 10, 2017

Hi guys. I want to write a code (or library) which it used AFL and QEMU in order to monitor functions which called by an executable. I have worked with AFL for binary instrumentation and fuzzing. Also, I could find out multiple vulnerabilities in third-party libraries but I can't realize how is it possible I do the task - hooking functions and monitoring the behavior of a program with AFL and Qemu. Any ideas?

1 0

Xilinx clock wizard driver
by Merin Santhosh Oct. 10, 2017

Oct. 10, 2017

Hi All, I'm Merin, I'm a masters student at the University of Florida. I was doing through the Linux Kernel, hoping to contribute to something of relevance. Since I have a background in systems, I was hoping to get started with the Xilinx clocking wizard(link) <https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git/tree/dri…> . I wanted to know how is it that the modified driver is tested once coded. Can someone explain to me how this is done? Thanks, Merin Merin Santhosh +1 (352) 214-3796

3 5

help in the MM Area of the Linux Kernel
by Damian Tometzki Oct. 10, 2017

Oct. 10, 2017

Hello all, i'am intrested in helping and Bug Fixing in the mm area of the linux kernel. For driver development is it clear check in the staging area the TODO's. And what is the process for other areas of the kernel for example mm (Memory management X86) ? In advance many thanks Damian

5 8

Where does kernel stores it's registers while performing a context switch?
by Ketan Singh Oct. 7, 2017

Oct. 7, 2017

I want to know where the kernel stores it's registers while performing a context switch on x86 architecture. In ARM I can see struct cpu_context_save in arch/arm/include/asm/thread_info.h but what about x86/x86_64?

2 1

OOM while increasing RAM to 4GB on DRA7x TI platform.
by priyaranjan Oct. 6, 2017

Oct. 6, 2017

Hello All, I'm having issues on DRA7x based Android system where migrating from a 2GB RAM configuration to 4GB RAM has forced us to enable LPAE. In the LPAE configuration, OOM killer causes issues as the system becomes heavily loaded, but this issue does not occur on our more stable 2GB / non-lpae baseline. >From what I understand, this is happening because we run out of low memory. LPAE does place a marginally higher demand on lowmem in terms of page tables, kernel size, etc. But still not sure of an exact root cause. Tuning/reducing vmalloc in the kernel command line seems to improve the situation, but at the expense of introducing binder issues (since binder uses vmalloc extensively). Can anyone help me regarding this? See below example log. Software details - 4.4 kernel + Android 6.0 / marshmallow based on 6AM1.3 Texas Instrument release. [ 0.000000] CPU: ARMv7 Processor [412fc0f2] revision 2 (ARMv7), cr=30c5387d [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache [ 0.000000] Machine model: TI DRA742 [ 0.000000] Reserved memory: created CMA memory pool at 0x0000000095800000, size 56 MiB [ 0.000000] Reserved memory: initialized node ipu2_cma@95800000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x0000000099000000, size 64 MiB [ 0.000000] Reserved memory: initialized node dsp1_cma@99000000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x000000009d000000, size 32 MiB [ 0.000000] Reserved memory: initialized node ipu1_cma@9d000000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x000000009f000000, size 16 MiB [ 0.000000] Reserved memory: initialized node dsp2_cma@9f000000, compatible id shared-dma-pool [ 0.000000] cma: Reserved 24 MiB at 0x00000000fd800000 [ 0.000000] Forcing write-allocate cache policy for SMP [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] OMAP4: Map 0x000000027fd00000 to fe600000 for dram barrier [ 0.000000] On node 0 totalpages: 1042176 [ 0.000000] free_area_init_node: node 0, pgdat c0e855c0, node_mem_map ee39e000 [ 0.000000] DMA zone: 1608 pages used for memmap [ 0.000000] DMA zone: 0 pages reserved [ 0.000000] DMA zone: 204800 pages, LIFO batch:31 [ 0.000000] HighMem zone: 837376 pages, LIFO batch:31 [ 0.000000] DRA752 ES2.0 [ 0.000000] PERCPU: Embedded 13 pages/cpu @ee320000 s22592 r8192 d22464 u53248 [ 0.000000] pcpu-alloc: s22592 r8192 d22464 u53248 alloc=13*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 1040568 ... [ 0.000000] Memory: 3818136K/4168704K available (6701K kernel code, 577K rwdata, 1724K rodata, 2048K init, 381K bss, 153960K reserved, 196608K cma-reserved, 3324928K highmem) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xf2800000 - 0xff800000 ( 208 MB) [ 0.000000] lowmem : 0xc0000000 - 0xf2400000 ( 804 MB) [ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) [ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB) [ 0.000000] .text : 0xc0008000 - 0xc088b4e0 (8718 kB) [ 0.000000] .init : 0xc0c00000 - 0xc0e00000 (2048 kB) [ 0.000000] .data : 0xc0e00000 - 0xc0e90624 ( 578 kB) [ 0.000000] .bss : 0xc0e92000 - 0xc0ef160c ( 382 kB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 .... [ 66.801410] logd.writer invoked oom-killer: gfp_mask=0x24000d0, order=0, oom_score_adj=-1000 [ 66.805748] CPU: 0 PID: 113 Comm: logd.writer Tainted: G W O 4.4.45+ #12 [ 66.809599] Hardware name: Generic DRA74X (Flattened Device Tree) [ 66.812681] [<c020fe8c>] (unwind_backtrace) from [<c020bd34>] (show_stack+0x20/0x24) [ 66.816580] [<c020bd34>] (show_stack) from [<c04bb334>] (dump_stack+0xb8/0xe4) [ 66.820217] [<c04bb334>] (dump_stack) from [<c03395a4>] (dump_header+0x5c/0x16c) [ 66.823940] [<c03395a4>] (dump_header) from [<c02f00d0>] (oom_kill_process+0x318/0x460) [ 66.827967] [<c02f00d0>] (oom_kill_process) from [<c02f0594>] (out_of_memory+0x304/0x350) [ 66.832082] [<c02f0594>] (out_of_memory) from [<c02f55f0>] (__alloc_pages_nodemask+0x874/0x998) [ 66.836459] [<c02f55f0>] (__alloc_pages_nodemask) from [<c02f5734>] (__get_free_pages+0x20/0x3c) [ 66.840878] [<c02f5734>] (__get_free_pages) from [<c0392170>] (proc_pid_cmdline_read+0xa4/0x5a8) [ 66.845296] [<c0392170>] (proc_pid_cmdline_read) from [<c033be54>] (__vfs_read+0x34/0xe0) [ 66.849408] [<c033be54>] (__vfs_read) from [<c033c69c>] (vfs_read+0x8c/0x118) [ 66.852997] [<c033c69c>] (vfs_read) from [<c033cfa0>] (SyS_read+0x4c/0xa0) [ 66.856456] [<c033cfa0>] (SyS_read) from [<c0207e00>] (ret_fast_syscall+0x0/0x1c) [ 66.860655] Mem-Info: [ 66.861896] active_anon:233918 inactive_anon:25216 isolated_anon:0 [ 66.861896] active_file:20206 inactive_file:111218 isolated_file:0 [ 66.861896] unevictable:0 dirty:0 writeback:0 unstable:0 [ 66.861896] slab_reclaimable:3063 slab_unreclaimable:6164 [ 66.861896] mapped:157484 shmem:25476 pagetables:7490 bounce:23 [ 66.861896] free:496396 free_pcp:435 free_cma:15302 [ 66.880653] DMA free:42104kB min:2808kB low:7408kB high:8112kB active_anon:86236kB inactive_anon:99528kB active_file:144kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):68kB present:819200kB managed:668108kB mlocked:0kB dirty:0kB writeback:0kB mapped:252512kB shmem:99576kB slab_reclaimable:12252kB slab_unreclaimable:24656kB kernel_stack:10856kB pagetables:3404kB unstable:0kB bounce:92kB free_pcp:1284kB local_pcp:628kB free_cma:38780kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 66.904623] lowmem_reserve[]: 0 0 6494 6494 [ 66.907897] HighMem free:1943088kB min:512kB low:23580kB high:27100kB active_anon:849436kB inactive_anon:1440kB active_file:80784kB inactive_file:444956kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3349504kB managed:3349504kB mlocked:0kB dirty:0kB writeback:0kB mapped:377572kB shmem:2480kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:26556kB unstable:0kB bounce:0kB free_pcp:352kB local_pcp:224kB free_cma:22428kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 66.933683] lowmem_reserve[]: 0 0 0 0 [ 66.936089] DMA: 679*4kB (UMEC) 234*8kB (UMEC) 100*16kB (UMC) 27*32kB (MC) 12*64kB (C) 4*128kB (C) 4*256kB (C) 0*512kB 0*1024kB 0*2048kB 8*4096kB (C) = 42124kB [ 66.944113] HighMem: 8685*4kB (MC) 4196*8kB (MC) 2162*16kB (UMC) 1244*32kB (UMC) 679*64kB (MC) 187*128kB (MC) 63*256kB (UMC) 25*512kB (M) 20*1024kB (UMC) 6*2048kB (M) 408*4096kB (MC) = 1942964kB [ 66.954296] 157051 total pagecache pages [ 66.956536] 0 pages in swap cache [ 66.958342] Swap cache stats: add 0, delete 0, find 0/0 [ 66.961208] Free swap = 0kB [ 66.962769] Total swap = 0kB [ 66.965069] 1042176 pages RAM [ 66.967429] 837376 pages HighMem/MovableOnly [ 66.969836] 37773 pages reserved [ 66.971648] 49152 pages cma reserved Regards, Priyaranjan

2 1

Syscall hijacking x64- unable to handle kernel paging request at ffffffff91000018
by Wiktoria Lewicka Oct. 5, 2017

Oct. 5, 2017

I write kernel module which replace syscall and have a problem. Module can't be loaded because is some problem in memory. I tried fix it for 3 hours, but it still not work. This code is working, when I choose memory closer sys_call_table (eg. int3 adress from /proc/kallsyms), but it isn't always works. Problem is usually, when function which search syscall table points to adress which end is 18 (eg ffffffff91000018, ffffffff81000018). Why its not work? I know, I shouldn't do this, but I would like to fix this code for experience in kernel memory. Code: #include <linux/kernel.h> #include <linux/module.h> #include <linux/syscalls.h> #include <linux/list.h> #include <linux/unistd.h> #include <linux/kobject.h> #include <linux/init.h> /* start of 64-bit kernel space is 0xffffffff80000000 */ #define END_MEM 0xffffffffffffffff /* end of 64-bit kernel */ #define START_MEM 0xffffffff81000000 unsigned long long **syscall_tab; asmlinkage long (*orig_mkdir)(const char __user *pathname, umode_t mode); asmlinkage long my_mkdir(const char __user *pathname, umode_t mode) { long ret; ret = orig_mkdir(pathname, mode); printk("Creating dir: %s", pathname); return ret; } static void hide(void) { list_del(&THIS_MODULE->list); kobject_del(&THIS_MODULE->mkobj.kobj); } static unsigned long long **find(void) { unsigned long long **sctable; unsigned long long i = START_MEM; while (i < END_MEM) { sctable = (unsigned long long **) i; if ( sctable[__NR_close] == (unsigned long long *) sys_close) { printk("syscall_tab %lx", syscall_tab); return &sctable[0]; } i += sizeof(void *); } return NULL; } static int __init init(void) { write_cr0(read_cr0() & (~0x10000)); if(!(syscall_tab = find())) { return 0; } orig_mkdir = (void *) syscall_tab[__NR_mkdir]; printk("write_cr0"); syscall_tab[__NR_mkdir] = (unsigned long long*) my_mkdir; printk("po podmiance"); write_cr0(read_cr0() | (~0x10000)); return 0; } static void __exit exitt(void) { write_cr0(read_cr0() & (~0x10000)); syscall_tab[__NR_mkdir] = (unsigned long long*) orig_mkdir; write_cr0(read_cr0() | (~0x10000)); } module_init(init); module_exit(exitt); MODULE_LICENSE("GPL"); *************************************************************************** Error: ******************** [ 299.273838] BUG: unable to handle kernel paging request at ffffffff91000018 [ 299.273856] IP: init+0x23/0x1000 [hijack1] [ 299.273860] PGD b6a0c067 [ 299.273861] P4D b6a0c067 [ 299.273863] PUD b6a0d063 [ 299.273866] PMD 0 [ 299.273872] Oops: 0000 [#1] PREEMPT SMP [ 299.273877] Modules linked in: hijack1(O+) fuse rfcomm bnep nls_iso8859_1 nls_cp437 vfat fat intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc aesni_intel joydev ppdev hp_wmi mousedev iTCO_wdt aes_x86_64 sparse_keymap iTCO_vendor_support mei_wdt crypto_simd psmouse glue_helper pcspkr evdev input_leds cryptd mac_hid intel_cstate intel_rapl_perf uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core btusb btrtl btbcm btintel bluetooth cdc_ether ecdh_generic usbnet videodev uas media mii hid_generic nouveau mxm_wmi ttm arc4 drm_kms_helper iwldvm drm syscopyarea sysfillrect mac80211 sysimgblt iwlwifi fb_sys_fops parport_pc parport snd_hda_codec_hdmi i2c_algo_bit snd_hda_codec_idt cfg80211 [ 299.273953] rfkill snd_hda_codec_generic hp_accel thermal lis3lv02d wmi input_polldev tpm_infineon video ac battery button snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm shpchp snd_timer e1000e snd ptp soundcore tpm_tis mei_me mei pps_core lpc_ich tpm_tis_core tpm sch_fq_codel vboxnetflt(O) vboxnetadp(O) pci_stub vboxpci(O) vboxdrv(O) sg ip_tables x_tables ext4 crc16 jbd2 fscrypto mbcache sr_mod sd_mod cdrom usb_storage usbhid hid serio_raw atkbd libps2 ahci libahci libata scsi_mod xhci_pci xhci_hcd ehci_pci sdhci_pci ehci_hcd sdhci firewire_ohci led_class firewire_core mmc_core crc_itu_t usbcore usb_common i8042 serio [ 299.274005] CPU: 2 PID: 3384 Comm: insmod Tainted: G O 4.12.4-1-ARCH #1 [ 299.274009] Hardware name: Hewlett-Packard HP EliteBook 8560w/1631, BIOS 68SVD Ver. F.60 03/12/2015 [ 299.274014] task: ffff90127cc0c740 task.stack: ffffb72907298000 [ 299.274019] RIP: 0010:init+0x23/0x1000 [hijack1] [ 299.274023] RSP: 0018:ffffb7290729bc88 EFLAGS: 00010206 [ 299.274027] RAX: 0000000080040033 RBX: ffffffff91000000 RCX: 0000000000000000 [ 299.274031] RDX: 00000000004bec82 RSI: 00000000004bec82 RDI: 0000000080040033 [ 299.274036] RBP: ffffb7290729bc90 R08: ffff901339003980 R09: ffffffffa018970a [ 299.274040] R10: ffffe481c211ebc0 R11: 0000000000000000 R12: ffffffffc0030000 [ 299.274044] R13: ffff9012377965e0 R14: ffffffffc0a81050 R15: ffff90132e0eca80 [ 299.274049] FS: 00007f9a842a4b80(0000) GS:ffff90133dc80000(0000) knlGS:0000000000000000 [ 299.274053] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080040033 [ 299.274057] CR2: ffffffff91000018 CR3: 000000007cdb9000 CR4: 00000000000406e0 [ 299.274061] Call Trace: [ 299.274068] do_one_initcall+0x50/0x190 [ 299.274073] ? do_init_module+0x27/0x1e6 [ 299.274077] do_init_module+0x5f/0x1e6 [ 299.274082] load_module+0x2610/0x2ab0 [ 299.274087] ? vfs_read+0x115/0x130 [ 299.274091] SYSC_finit_module+0xf6/0x110 [ 299.274095] ? SYSC_finit_module+0xf6/0x110 [ 299.274100] SyS_finit_module+0xe/0x10 [ 299.274105] entry_SYSCALL_64_fastpath+0x1a/0xa5 [ 299.274109] RIP: 0033:0x7f9a839b3bb9 [ 299.274111] RSP: 002b:00007ffd2386ee28 EFLAGS: 00000206 ORIG_RAX: 0000000000000139 [ 299.274120] RAX: ffffffffffffffda RBX: 00007f9a83c74aa0 RCX: 00007f9a839b3bb9 [ 299.274124] RDX: 0000000000000000 RSI: 000000000041aada RDI: 0000000000000003 [ 299.274128] RBP: 00007f9a83c74af8 R08: 0000000000000000 R09: 00007f9a83c76e40 [ 299.274132] R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000001020 [ 299.274136] R13: 0000000000001018 R14: 00007f9a83c74af8 R15: 0000000000000001 [ 299.274141] Code: <48> 81 7b 18 40 a8 21 a0 75 2d 48 8b 35 14 13 a5 00 48 c7 c7 35 00 [ 299.276347] RIP: init+0x23/0x1000 [hijack1] RSP: ffffb7290729bc88 [ 299.277333] CR2: ffffffff91000018 [ 299.283408] ---[ end trace 63ac9e1e3a0e12c3 ]---

3 2

How many max kernel timers can run concurrently?
by Swapnil N Oct. 3, 2017

Oct. 3, 2017

Hi All, I am trying to implement a timer based stats notification for running UDP streams. Mostly a timer per UDP session will send UDP statistics to userspace via netlink. I would like to know, 1. How many max number of kernel timers I can run simultaneously? I've max 40K UDP sessions. 2. Will there be any performance impact when max number of timers are ticking? -- ~ Swapnil

2 1

Re: How to verify linux-next
by Pintu Kumar Oct. 1, 2017

Oct. 1, 2017

On Sun, Oct 1, 2017 at 10:33 PM, Mike Galbraith <efault(a)gmx.de> wrote: > On Sun, 2017-10-01 at 09:48 -0700, Randy Dunlap wrote: >> On 10/01/17 09:44, Damian Tometzki wrote: >> >> > i resolved the issue with: >> > sudo /etc/init.d/apparmor stop >> >> or boot with: apparmor=0 > > or systemctl mask apparmor Ok, thanks everyone for your quick help. Stopping apparmor really helped to restore the connection. Mr. Tso, thanks for your help too for QEMU. After finishing my patch next I will looking into QEMU issues as per your suggestions.

1 0

Re: How to verify linux-next
by Pintu Kumar Oct. 1, 2017

Oct. 1, 2017

On Fri, Sep 29, 2017 at 6:44 PM, Damian Tometzki <damian.tometzki(a)icloud.com> wrote: > Hello, > > Ubuntu 16.04 with current linux-next Kernel workson virtualbox 5.1.28 > > Host: Windows 10 > Guest: Ubuntu 16.04 > > Best regards > Damian > > > Am Freitag, den 29.09.2017, 08:41 -0400 schrieb > valdis.kletnieks(a)vt.edu: >> On Fri, 29 Sep 2017 16:08:07 +0530, Pintu Kumar said: >> >> > >> > I have a general question. >> > How do we normally verify linux-next tree? >> The same exact way you "verify" any other Linux kernel, for whatever >> definition of "verify" you plan to use. >> >> > >> > 1) For Oracle virtual box 5.1.26 with ubuntu-32 bit, the linux-next >> > kernel is not booting. >> Does an Ubuntu kernel boot correctly under VirtualBox? If not, fix >> that issue first. Also, "is not booting" isn't detailed enough for >> anybody >> to make even a guess as to what's wrong. >> >> Also, note that 5.1.28 is out. Ok, I just updated to 5.1.28. And my Ubuntu version is already 16.04. Let me try again if it works. Thanks all for your reply. BTW, I am more interested in my another query about QEMU arm. This will be much quicker and easy for me. But the problem is I wanted to use multiple ssh shell on qemu. Also I needed a pre-built rootfs image for qemu-arm, cortex-a9 versatilepb machine. It should have networking and ssh built-in so that I can connect to it using PUTTY client. Note that I could able to build my own minimal busybox and boot qemu using linux-next (non graphical mode). But I could able to get only one shell. I need to test some client/server problem, so I need multiple shell. I am not able to configure net/ssh on this qemu system. So, I have 2 things to ask: 1) If you have pointers on how to setup ssh/net connection on QEMU with busybox, do let me know. 2) Let, please point me to a pre-built qemu-arm busy box image with full features. Thanks, Pintu

7 12