I am trying to add a syscall in a module. My rationale is:

1. This is for a research project, so the exact implementation does not matter.
2. Adding syscalls in the kernel-core takes a prohibitively long time to re-compile. I can suck up compiling once with an expanded syscall table, but not every time. Even with incremental compiling, linking and archiving the final binary takes a long time.
3. Since the project is timing sensitive, using kprobes to intercept the syscall handler would slow down the syscall handler.

I am still open to other means of adding a syscall, but for the above reasons, I think that writing to the sys_call_table in a module is the cleanest way to do what I am trying to do.

I've gotten the address of the syscall table from the System.map, disabled kaslr, and I am trying to clear the page protections, but some write-protection is still holding me back.

// following https://web.iiit.ac.in/~arjun.nath/random_notes/modifying_sys_call.html

// clear cr0 write protection
write_cr0 (read_cr0 () & (~ 0x10000));

// clear page write protection
sys_call_table_page = virt_to_page(&sys_call_table[__NR_execves]);
set_pages_rw(sys_call_table_page, 1);

// do write
sys_call_table[__NR_execves] = sys_execves;

However, I'm still getting a permission error, but I don't know the mechanism by which it is enforced:

[   11.145647] ------------[ cut here ]------------
[   11.148893] CR0 WP bit went missing!?
[   11.151539] WARNING: CPU: 0 PID: 749 at arch/x86/kernel/cpu/common.c:386 native_write_cr0+0x3e/0x70
...
Here was a call trace pointing to the write of sys_call_table
...
[   11.332825] ---[ end trace c20c95651874c08b ]---
[   11.336056] CPA  protect  Rodata RO: 0xffff888002804000 - 0xffff888002804fff PFN 2804 req 8000000000000063 prevent 0000000000000002
[   11.343934] CPA  protect  Rodata RO: 0xffffffff82804000 - 0xffffffff82804fff PFN 2804 req 8000000000000163 prevent 0000000000000002
[   11.351720] BUG: unable to handle page fault for address: ffffffff828040e0
[   11.356418] #PF: supervisor write access in kernel mode
[   11.359908] #PF: error_code(0x0003) - permissions violation
[   11.363665] PGD 3010067 P4D 3010067 PUD 3011063 PMD 31e29063 PTE 8000000002804161
[   11.368701] Oops: 0003 [#1] SMP KASAN PTI

full dmesg

Any guesses on how to disable it?

I am trying to demonstrate paging in Linux. I wrote a small program that maps a file to virtual memory with mmap(), waits for input, access the allocated memory, and waits for input again.

I check the process minor and major faults after mapping the file to memory and after accessing this memory.

I’ve expected to see a major fault, but I only see a minor fault. The number of major faults remains 0 until the program ends. This is very strange, because the kernel must perform an I/O in order to bring the content of the file to memory.

Can anyone explain this?

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <sys/mman.h>
#include <stdio.h>

int main (int argc, char *argv[]) {

  char *mblk;
  int fd, fsize, n;
  struct stat fs;

  fd = open ( argv[1], O_RDONLY );
  if ( fd == -1 ) {
    printf ( "Failed to open %s\n", argv[1] );
    return (-1);
  }

  fstat ( fd, &fs );
  fsize = fs.st_size;
  mblk = mmap ( NULL, fsize, PROT_READ, MAP_PRIVATE, fd, 0 );
  close ( fd );
  printf ( "\n %s is maped to virtual memory at %llx\n", argv[1], (unsigned long long) mblk );
  printf ( " Press Enter to continue\n");
  getchar ();
  n = (unsigned) *mblk;
  printf ( "%d\n", n);
  printf ( " %llx accessed\n", (unsigned long long) mblk );
  printf ( " Press any Enter exit\n");
  getchar ();
}

He is example of atomic_read implementation:

#define atomic_read(v) (*(volatile int *)&(v)->counter)                                  

Also, should we explicitly use memory barriers for atomic operations on arm?

Q: What is the use of linux,usable-memory-range property?

Background:

Recently I am analyzing how Linux kernel initializes memory. When I go to arm64_memblock_init function in arch/arm64/mm/init.c, I meet a function called fdt_enforce_memory_region().The function handles linux,usable-memory-range property of chosen node in device tree.

The function call chain is: arm64_memblock_init() -> fdt_enforce_memory_region() -> memblock_cap_memory_range().

void __init arm64_memblock_init(void)
{
    const s64 linear_region_size = BIT(vabits_actual - 1);

    /* Handle linux,usable-memory-range property */
    fdt_enforce_memory_region();
    ...
}
static void __init fdt_enforce_memory_region(void)
{
    struct memblock_region reg = {
        .size = 0,
    };

    of_scan_flat_dt(early_init_dt_scan_usablemem, &reg);

    if (reg.size)
        memblock_cap_memory_range(reg.base, reg.size);
}
void __init memblock_cap_memory_range(phys_addr_t base, phys_addr_t size)
{
    int start_rgn, end_rgn;
    int i, ret;

    if (!size)
        return;

    ret = memblock_isolate_range(&memblock.memory, base, size,
                        &start_rgn, &end_rgn);
    if (ret)
        return;
    /* codes below this line make me confused */
    /* remove all the MAP regions */
    for (i = memblock.memory.cnt - 1; i >= end_rgn; i--)  /*-- 1 --*/
        if (!memblock_is_nomap(&memblock.memory.regions[i]))
            memblock_remove_region(&memblock.memory, i);

    for (i = start_rgn - 1; i >= 0; i--)                 /*-- 2 --*/
        if (!memblock_is_nomap(&memblock.memory.regions[i]))
            memblock_remove_region(&memblock.memory, i);

    /* truncate the reserved regions */
    memblock_remove_range(&memblock.reserved, 0, base); /*-- 3 --*/
    memblock_remove_range(&memblock.reserved,          /*-- 4 --*/
            base + size, PHYS_ADDR_MAX);
}

After reading some patches and /Documentation/devicetree/bindings/chosen.txt,I have learned linux,usable-memory-range property is related with crash dump kernel. It should have some relationship with kdump. But why memblock_cap_memory_range() remove 'memory' and 'reserved' type memory which are marked above the function from 1 to 4, and it only reserves memory from [base, base + size]? I can't understand this.

But from some books, they say "linux,usable-memory-range" prop is the usable range of memory, and memblock_cap_memory_range() remove memory beyond this range. If this saying is true,I can understand this. However, as I show above, some patches and this article as well as /Documentation/devicetree/bindings/chosen.txt said the prop is related with kdump.

So, What is the use of linux,usable-memory-range property?

I am studying the code of MT9T031 sensor driver:

MT9T031 sensor driver

It's clear that it uses soc-camera subsytem, and we need to define platform data. The comment says:

The platform has to define struct i2c_board_info objects and link to them from struct soc_camera_host_desc

We can define i2c_board_info objects and register them with i2c_register_board_info API, or we can use device tree for the same purpose.

However what I don't get is where to define soc_camera_host_desc and how to link i2c_board_info, so the soc-camera subsystem become aware of our device.

Do you know how to do this?

I run command and found this kernel address is not mapped. Can anyone help me to understand what might be the reason for it?

#cat /sys/kernel/debug/kernel_page_tables

This address range is not mapped. 0xffffffc0db800000-0xffffffc0db825000 is not mapped.

Output of kernel_page_tables.
(initramfs) cat /sys/kernel/debug/kernel_page_tables
---[ vmalloc() Area ]---
0xffffff8000000000-0xffffff8000001000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000002000-0xffffff8000003000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000006000-0xffffff8000007000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff800000a000-0xffffff800000b000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000030000-0xffffff8000070000         256K     RW NX SHD AF    UXN MEM/BUFFERABLE
0xffffff8000072000-0xffffff8000073000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000074000-0xffffff8000075000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000076000-0xffffff8000077000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000078000-0xffffff8000079000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff800007a000-0xffffff800007b000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff800007c000-0xffffff800007d000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff800007e000-0xffffff800007f000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000080000-0xffffff8000085000          20K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000086000-0xffffff8000087000           4K     RW NX     AF    UXN DEVICE/nGnRE
0xffffff8000088000-0xffffff800008c000          16K     RW NX     AF    UXN DEVICE/
0xffffffbbfffce000-0xffffffbbfffd3000          20K     RW NX SHD AF    UXN MEM/NORMAL
0xffffffbbfffdf000-0xffffffbbfffe4000          20K     RW NX SHD AF    UXN MEM/NORMAL
....
---[ vmalloc() End ]---
0xffffffbc00000000-0xffffffbc0a000000         160M RW x  SHD AF    MEM/NORMAL
---[ Modules ]---
---[ Kernel Mapping ]---
0xffffffc000000000-0xffffffc000200000           2M RW NX SHD AF    MEM/NORMAL
0xffffffc000200000-0xffffffc000e00000          12M ro x  SHD AF    MEM/NORMAL
0xffffffc000e00000-0xffffffc001400000           6M ro NX SHD AF    MEM/NORMAL
0xffffffc001400000-0xffffffc001600000           2M ro x  SHD AF    MEM/NORMAL
0xffffffc001600000-0xffffffc003400000          30M RW NX SHD AF    MEM/NORMAL
0xffffffc003400000-0xffffffc005800000          36M     RW NX SHD AF    UXN MEM/NORMAL
0xffffffc005800000-0xffffffc006200000          10M RW NX SHD AF    MEM/NORMAL
0xffffffc006200000-0xffffffc006300000           1M     RW NX SHD AF    UXN MEM/NORMAL
0xffffffc00e700000-0xffffffc00e800000           1M     RW NX SHD AF    UXN MEM/NORMAL
0xffffffc00e800000-0xffffffc0db400000        3276M RW NX SHD AF    MEM/NORMAL
0xffffffc0db400000-0xffffffc0db800000           4M     RW NX SHD AF    UXN  MEM/NORMAL                                                                                   ------------- "148K is not mapped" ----------------------------------------
0xffffffc0db825000-0xffffffc0f8000000      466796K     RW NX SHD AF    UXN MEM/NORMAL

Thank you in advance.

I am trying to learn linux and kernel development.

I am able to build the module but am unable to load it.

HelloWorld.c

/*  
 *  hello-1.c - The simplest kernel module.
 */
#include <linux/module.h>   /* Needed by all modules */
#include <linux/kernel.h>   /* Needed for KERN_INFO */

int init_module(void)
{
    printk(KERN_INFO "Hello world 1.\n");

    /* 
     * A non 0 return means init_module failed; module can't be loaded. 
     */
    return 0;
}

void cleanup_module(void)
{
    printk(KERN_INFO "Goodbye world 1.\n");
}

And here is my make file:

KERNEL_SOURCE := /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)

obj-m += HelloWorld.o

all:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

while doing insmod for loading the module permission is getting denied. I tried even doing it with root and also with modprobe, but no use.

I also tried Link but issue still the same.

Hope i get some help. I am using ubuntu 18.04LTS.

I just built the linux kernel for CentOS using the instructions that can be found here: https://wiki.centos.org/HowTos/Custom_Kernel

Now, I made my changes and I would like to rebuild the kernel and test it with my changes. How do I do that but: 1. Without having to recompile everything. So, build process should reuse whatever object files generated by the first build that wont need to be modified. 2. Without having to build the other packages that are build with the kernel (e.g., debuginfo, tools, debug-devel, ...etc.).

Thanks.

Is there any tips or method to avoid kernel log drop or log buffer overrun ?

I have increased the log buffer size to maximum with below code change. I'm running in high end device only. But, still when when i want to get the complete log from my driver(which writes heavy logs), I see the printk logs are dropped sometimes. I use printk with KERN_INFO, gets enabled through dynamic debug(dprintk).

Change i do:

--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -55,7 +55,7 @@ void asmlinkage __attribute__((weak)) early_printk(const char *fmt, ...)
 {
 }

-#define __LOG_BUF_LEN  (1 << CONFIG_LOG_BUF_SHIFT)
+#define __LOG_BUF_LEN  (1 << 17)

Command i use to write into a file:

cat "/proc/kmsg">/sdcard/klog.txt

Only While debugging, I'm okay if the performance is degraded in my driver but, i don't want drop any logs. I understand we can't make work queues/threads to wait until printing completes. But, still is there any way to get guaranteed that, logs are not dropped.

In ubuntu iso how to uninstall or remove app from the device using terminal only, so any one send the command for remove application.

Background:

kernel version: v4.14.149

Show the code first:

void __init paging_init(void)
{
    phys_addr_t pgd_phys = early_pgtable_alloc(); /* My first question */
    /* pgd_set_fixmap(pgd_phys) maps FIX_PGD with pgd_phys */ 
    pgd_t *pgd = pgd_set_fixmap(pgd_phys); /* My second question */
    ...
}
static phys_addr_t __init early_pgtable_alloc(int shift)
{
    phys_addr_t phys;
    void *ptr;

    phys = memblock_phys_alloc(PAGE_SIZE, PAGE_SIZE);
    if (!phys)
        panic("Failed to allocate page table page\n");

    /*
     * The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE
     * slot will be free, so we can (ab)use the FIX_PTE slot to initialise
     * any level of table.
     */
    /* the comment above makes me confused */ 
    ptr = pte_set_fixmap(phys);

    memset(ptr, 0, PAGE_SIZE);

    /*
     * Implicit barriers also ensure the zeroed page is visible to the page
     * table walker
     */
    pte_clear_fixmap();

    return phys;
}

I know early_pgtable_alloc() function firstly allocates a block memory of size PAGE_SIZE using memblock_alloc, and then maps FIX_PTE to the allocated memory in order to clear the block memory, finally it clear the mapping of FIX_PTE and phys.

Q1: But why does early_pgtable_alloc() function use FIX_PTE to map? And the comment of the code says:

The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE slot will be free, so we can (ab)use the FIX_PTE slot to initialise any level of table.

Q2: In paging_init(), pgd_set_fixmap is called. But above, early_pgtable_alloc() says:

The FIX_{PGD,PUD,PMD} slots may be in active use. Is this not a conflict?

Thanks!

I would like to include a custom kernel module when composing an rpm-ostree server (based on centos atomic), however this only seems to work if I create an rpm containing the compiled kernel module in advance of composing the server. The rpm must contain the kernel module compiled against the kernel version that will be used in the subsequent compose server and therefore tricky to predict.

What is the correct method for including a kernel module when using rpm-ostree compose server?

I'm a college student studying OS.

I'm trying to add my own system call in Linux kernel, and something is going wrong.

My environment is stated below:

• Linux Kernel v.4.19.1
• 64-bit Ubuntu LTS 18.04.1 with Intel Core i5-4210M CPU on Oracle VirtualBox 5.2.18
• 64-bit Windows 10 Home 1803 as a host machine

Since I'm working on x86_64 machine, I started with arch/x86/entry/syscalls/syscall_64.tbl. In Linux kernel v.4.19.1, the last entry is

334     common     rseq             __x64_sys_rseq

so I added those three lines below it.

335     common     my_syscall_0     sys_my_syscall_0
336     common     my_syscall_1     sys_my_syscall_1
337     common     my_syscall_2     sys_my_syscall_2

Second, I added prototypes of functions in include/linux/syscalls.h.

asmlinkage int sys_my_syscall_0(void);
asmlinkage int sys_my_syscall_1(int);
asmlinkage int sys_my_syscall_2(int, int);

Third, I created a new file kernel/my_syscall.c and added implementations of functions.

asmlinkage int sys_my_syscall_0(void)
{
    printk("my_syscall_0\n");
    return 0;
}

asmlinkage int sys_my_syscall_1(int a)
{
    printk("my_syscall_1 : %d\n", a);
    return 0;
}

asmlinkage int sys_my_syscall_0(int a, int b)
{
    printk("my_syscall_2 : %d, %d\n", a, b);
    return b;
}

Then, I added my_syscall.o in kernel/Makefile to compile kernel/my_syscall.c as well.

obj-y = fork.o exec_domain.o panic.o \
        cpu.o exit.o softirq.o resource.o \
        sysctl.o sysctl_binary.o capability.o ptrace.o user.o \
        signal.o sys.o umh.o workqueue.o pid.o task_work.o \
        extable.o params.o \
        kthread.o sys_ni.o nsproxy.o \
        notifier.o ksysfs.o cred.o reboot.o \
        async.o range.o smpboot.o ucount.o \
        my_syscall.o

After compilation with make-kpkg and dpkg command, I made a test program.

#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
int main()
{
    printf("1 : %d\n", syscall(335));
    printf("2 : %d\n", syscall(336, 1));
    printf("3 : %d\n", syscall(337, 2, 3));
    return 0;
}

However, the result is weird. dmesg shows me some huge numbers that does not make sense at all.

# dmesg
...
my_syscall_0
my_syscall_1 : 1111490392
my_syscall_2 : 1111490392, 1111490392

It seems like it is changing every time I execute the program.

Obviously, there's some problem in passing parameters. However, strace command shows me that the values are passed well.

# strace ./syscall
...
syscall_0x14F(0x7ffd21866538, 0x7ffd21866548, ....) = 0
...
syscall_0x150(0x1, 0, 0, 0, 0x7f9e1562f3a0, ....) = 0
...
syscall_0x14F(0x2, 0x3, 0x7f9e1562f3a0, ....) = 0
....

Brief

1. I made simple system calls.

2. Passing parameter to them are not working as the way they should be.

3. Question : Is there any problem in steps above, in order to add new system call?

4. Question : Is there any issues that I should aware when passing parameters to system call?

Thank you in advance.

I need pwm-bl.ko kernel module for my Raspberry Pi, but it is not present in my /lib/modules directory. Sure, I can download kernel sources for my kernel version, select necessary modules to build, build and put it into this directory. But how to automate this process? I've found module-assistant utility, but it looks like a list of modules is very limited.

we are running recently we had a vulnerability scan , and the result we got "Port Listener Command Injection". can any one please help to identify the cause for this or any test case to test this vulnerability is false positive or not.

Apache is running in linux Kernel Version:Linux 3.10.0-1062.el7.x86_64

I am automating actions of ftrace in a c++ executable and am almost certain I had got this working in the past, but now am constantly having problems with it (possibly due to different behaviour on different kernel versions) and can't find any answer in the scattered documentation online. EDIT:I just remembered that what I had done previously was assigning to a variable in a kprobe & matching the variable in a kretprobe, from within a rootkit-style kernel-module which manually patched the syscall table - a solution which is overkill, inappropriate, & too dangerous for what I am doing now. I want to know what I'm doing wrong when filtering a raw_syscall by matching an arg against an integer. For readability I am just showing shellscript oneliner equivalents because they do functionally the same thing my code does. I would ideally like this to work on older linux kernels too (even early v3 if possible), and BTW that is one of the reasons why I am filtering on raw_syscalls instead of syscall wrapper-functions.

The format provided by the system I am presently testing on is shown below (note the args array):

% cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/format
name: sys_enter
ID: 17
format:
        field:unsigned short common_type;         offset:0;        size:2; signed:0;
        field:unsigned char common_flags;         offset:2;        size:1; signed:0;
        field:unsigned char common_preempt_count; offset:3;        size:1; signed:0;
        field:int common_pid;                     offset:4;        size:4; signed:1;

        field:long id;                            offset:8;        size:8; signed:1;
        field:unsigned long args[6];              offset:16;      size:48; signed:0;

print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5]

and the syntax without the args field works:

% echo 'id == 44 && common_pid == 2000' \
   > /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/filter
% echo $?
0

yet when I try the following (and many variations of the args syntax) it always throws a syntax error:

% echo 'id == 44 && common_pid == 2000 && args[5] == 0' \
   > /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/filter
-bash: echo: write error: Invalid argument
% cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/filter
id == 44 && common_pid == 2000 && args[5] == 0
^
parse_error: Field not found

What is the meaning of fields of the line that just add to the system call table Ex: 548 64 hello sys_hello

I want to use bpf to intercept/inject to some events but I couldn't find documentation for them, like in this:

//https://github.com/torvalds/linux/blob/master/include/trace/events/net.h#L143
DEFINE_EVENT(net_dev_template, net_dev_queue,

    TP_PROTO(struct sk_buff *skb),

    TP_ARGS(skb)
);

The event net_dev_queue is not described anywhere. Of course I can look in its format using cat /sys/kernel/debug/tracing/events/net/net_dev_queue/format

# cat /sys/kernel/debug/tracing/events/net/net_dev_queue/format
name: net_dev_queue
ID: 1355
format:
        field:unsigned short common_type;       offset:0;       size:2; signed:0;
        field:unsigned char common_flags;       offset:2;       size:1; signed:0;
        field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
        field:int common_pid;   offset:4;       size:4; signed:1;

        field:void * skbaddr;   offset:8;       size:8; signed:0;
        field:unsigned int len; offset:16;      size:4; signed:0;
        field:__data_loc char[] name;   offset:20;      size:4; signed:1;

print fmt: "dev=%s skbaddr=%p len=%u", __get_str(name), REC->skbaddr, REC->len

... but I need more information.

I found a link to the directory tree of the Android kernel source code: https://github.com/aosp-mirror/platform_system_core?files=1

And I had questions about this directory tree. • Is this the Android kernel source directory tree? If so, how can I find drivers and add them here?

My goal is to deal with the Linux and Android kernel. Everything is clear in the Linux kernel, the structure is clear, all directories speak for themselves: https://elixir.bootlin.com/linux/latest/source

I'm a college student studying OS.

I'm trying to add my own system call in Linux kernel, and I don't understand exactly how to add these parameters into my code. I want to write only one system call but this call should be inculude these parameters. Any idea ?

I'll call parameters like this.

./systeminfo.out                            > only CPU information
./systeminfo.out -all                       > CPU+system statistics
./systeminfo.out -p 1425                    > CPU+process detail
./systeminfo.out -all -p 1425               > CPU+sys.statistics+ps.detail

that is my code(for no parameters)

asmlinkage long sys_systeminfo(void)
{

FILE *fPointer;
char singleLine[255];
printk("CPU Information: \n");
if((fPointer=fopen("\\proc\\cpuinfo","r"))!=NULL)
{
int i = 0;  
    while(i<8){

    fgets(singleLine, 50,fPointer);
    puts(singleLine);
    i++;
    }

}
else{
    printk("file not found !");
}



fclose(fPointer);
return 0;
}

The sample output should be like that, if two parameters were used:

CPU Information:
vendor_id : xx
cpu family : xx
model : xx
model name : xx
Parameter#[process_id]-Process Information:
name: xx
state: xx
uid : xx
pid : xx
ppid : xx
arameter#all-System Statistics:
system was booted since : xx
system has been idle since : xx
the number of active tasks : xx
the total number of processes : xx

Thanks for all the answers.