I am new to kernel module development. So I started with simple hello world kernel module I am using "The Linux Kernel Module Programming Guide" book for the reference (it is addressing to kernel 2.6). I installed kernel-devel and kenel headers with yum. I am using fedora 17. I found that a symlink

/lib/modules/3.3.4-5.fc17.x86_64/build -> /usr/src/kernels/3.3.4-5.fc17.x86_64

Now, I have one hello-1.c (the simple kernel module and a Makefile in my working directory) The Makefile is:

obj-m += hello-1.o
all:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

when in $make i get error:

make -C /lib/modules/3.3.4-5.fc17.x86_64/build M=/root/kerneldev modules
make: *** /lib/modules/3.3.4-5.fc17.x86_64/build: No such file or directory.  Stop.
make: *** [all] Error 2

I make same program on Centos-5.x it run successfully , because the /lib/modules/3.3.4-5.fc17.x86_64/build was containing the actual module (not a symlink). What should be problem ? why such difference?

I'm trying to completely eliminate timer interrupts on a set of cores on a quiet machine. These are the only interrupts regularly processed by these cores. I've isolcpu'd them, and built a kernel with CONFIG_NO_HZ_FULL, and indeed now they only receive timer interrupts around once a second. Is it possible to remove this residual 1Hz timer interrupt?

This kernel doc suggests that an occasional tick was necessary at some point:

Some process-handling operations still require the occasional scheduling-clock tick. These operations include calculating CPU load, maintaining sched average, computing CFS entity vruntime, computing avenrun, and carrying out load balancing. They are currently accommodated by scheduling-clock tick every second or so. On-going work will eliminate the need even for these infrequent scheduling-clock ticks.

And this kernel patch, "Remove the 1 Hz tick code," suggests that it was removed in a later version of the kernel:

Now that the 1Hz tick is offloaded to workqueues, we can safely remove the residual code that used to handle it locally.

I've built the 5.3.0 kernel hoping that this residual tick would be removed, but it's still present.

Are there additional boot parameters I need to set? Is the residual timer tick really removed in the latest versions of the kernel? (this question has some relevant information)

See https://elixir.bootlin.com/linux/v5.0.21/source/arch/x86/entry/entry_64.S#L168.

1. Why does RAX have to change?
2. Why is -ENOSYS chosen?

Copied from the above link:

ENTRY(entry_SYSCALL_64)
    UNWIND_HINT_EMPTY
    /*
     * Interrupts are off on entry.
     * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
     * it is too small to ever cause noticeable irq latency.
     */

    swapgs
    /* tss.sp2 is scratch space. */
    movq    %rsp, PER_CPU_VAR(cpu_tss_rw + TSS_sp2)
    SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
    movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp

    /* Construct struct pt_regs on stack */
    pushq   $__USER_DS              /* pt_regs->ss */
    pushq   PER_CPU_VAR(cpu_tss_rw + TSS_sp2)   /* pt_regs->sp */
    pushq   %r11                    /* pt_regs->flags */
    pushq   $__USER_CS              /* pt_regs->cs */
    pushq   %rcx                    /* pt_regs->ip */
GLOBAL(entry_SYSCALL_64_after_hwframe)
    pushq   %rax                    /* pt_regs->orig_ax */

    PUSH_AND_CLEAR_REGS rax=$-ENOSYS

    TRACE_IRQS_OFF
...

I am a beginner to the Linux Kernel and I am trying to learn how Linux schedules processes.

I have read some books on the Linux Kernel and gone through the links from IBM http://www.ibm.com/developerworks/linux/library/l-cfs/ and all, but I am still left with some doubts.

1. How does the scheduler schedule all of the tasks within the sysctl_sched_latency time?
2. When a process wakes up what actually is done in the place_entity function?
3. When a process wakes up why is the vruntime adjusted by subtracting from sched_latency? Can't that lead to processes in the run queue with large differences in the vruntime value?

I am interested in flushing cache (L1, L2, and L3) only for a region of address space, for example all cache entries from address A to address B. Is there a mechanism to do so in Linux, either from user or kernel space?

I have two Linux kernel modules (*.ko files). They have circular dependencies like this:

mod1.ko uses functions exported by mod2.ko
mod2.ko uses functions exported by mod1.ko

I can't merge the modules into single module. How do i write the modules such that I can insert mod1 first and then mod2 without any error.

TL;DR : Using Linux kernel real time with NO_HZ_FULL I need to isolate a process in order to have deterministic results but /proc/interrupts tell me there is still local timer interrupts (among other). How to disable it?

Long version :

I want to make sure my program is not being interrupt so I try to use a real time Linux kernel. I'm using the real time version of arch Linux (linux-rt on AUR) and I modified the configuration of the kernel to selection the following options :

CONFIG_NO_HZ_FULL=y
CONFIG_NO_HZ_FULL_ALL=y
CONFIG_RCU_NOCB_CPU=y
CONFIG_RCU_NOCB_CPU_ALL=y

then I reboot my computer to boot on this real time kernel with the folowing options:

nmi_watchdog=0
rcu_nocbs=1
nohz_full=1
isolcpus=1

I also disable the following option in the BIOS :

C state
intel speed step
turbo mode
VTx
VTd
hyperthreading

My CPU (i7-6700 3.40GHz) has 4 cores (8 logical CPU with hyperthreading technology) I can see CPU0, CPU1, CPU2, CPU3 in /proc/interrupts file.

CPU1 is isolated by isolcpus kernel parameter and I want to disable the local timer interrupts on this CPU. I though real-time kernel with CONFIG_NO_HZ_FULL and CPU isolation (isolcpus) was enough to do it and I try to check by running theses command :

cat /proc/interrupts | grep LOC > ~/tmp/log/overload_cpu1
taskset -c 1 ./overload
cat /proc/interrupts | grep LOC >> ~/tmp/log/overload_cpu1

where the overload process is:

***overload.c:***
int main()
{
  for(int i=0;i<100;++i)
    for(int j=0;j<100000000;++j);
}

The file overload_cpu1 contains the result:

LOC:     234328        488      12091      11299   Local timer interrupts
LOC:     239072        651      12215      11323   Local timer interrupts

meanings 651-488 = 163 interrupts from local timer and not 0...

For comparison I do the same experiment but I change the core where my process overload run (I keep watching interrupts on CPU1):

taskset -c 0 :   8 interrupts
taskset -c 1 : 163 interrupts
taskset -c 2 :   7 interrupts
taskset -c 3 :   8 interrupts

One of my question is why there is no 0 interrupts ? why the number of interrupts is bigger when my process run on CPU1 ? (I mean I though NO_HZ_FULL will prevent interrupt if my process was alone : "The CONFIG_NO_HZ_FULL=y Kconfig option causes the kernel to avoid sending scheduling-clock interrupts to CPUs with a single runnable task"(https://www.kernel.org/doc/Documentation/timers/NO_HZ.txt)

Maybe an explaination is there is other process running on CPU1. I checked by using ps command :

CLS CPUID RTPRIO PRI  NI CMD                           PID
TS      1      -  19   0 [cpuhp/1]                      18
FF      1     99 139   - [migration/1]                  20
TS      1      -  19   0 [rcuc/1]                       21
FF      1      1  41   - [ktimersoftd/1]                22
TS      1      -  19   0 [ksoftirqd/1]                  23
TS      1      -  19   0 [kworker/1:0]                  24
TS      1      -  39 -20 [kworker/1:0H]                 25
FF      1      1  41   - [posixcputmr/1]                28
TS      1      -  19   0 [kworker/1:1]                 247
TS      1      -  39 -20 [kworker/1:1H]                501

As you can see, there is threads on the CPU1. Is that possible to disable these processes ? I guess it is because if it is not the case, NO_HZ_FULL will never work right ?

Tasks with class TS doesn't disturb me because they didn't have priority among SCHED_FIFO and I can set this policy to my program. Same things for tasks with class FF and priority less than 99.

However, you can see migration/1 that is in SCHED_FIFO and priority 99. Maybe these process can causes interrupts when they run . This explain the few interrupts when my process in on CPU0, CPU2 and CPU3 (respectively 8,7 and 8 interrupts) but it also mean these processes are not running very often and then doesn't explain why there is many interrupts when my process run on CPU1 (163 interrupts).

I also do the same experiment but with the SCHED_FIFO of my overload process and I get:

taskset -c 0 : 1
taskset -c 1 : 4063
taskset -c 2 : 1
taskset -c 3 : 0

In this configuration there is more interrupts in the case my process use SCHED_FIFO policy on CPU1 and less on other CPU. do you know why ?

I've got two kernel modules built, one of which is a net_device. My net_device module A depends on module B which provide some extra control mechanism to export device info.

I want module B to be able to call the "xmit" function which is in module A. As a result, module B will become dependent on module A if I simple export symbol from A. This, obviously, creates a "deadlock" dependency situation.

Does anyone have experience resolving this? How can I properly export the "xmit" function in A and let B use it?

I'm trying to rebuild Linux Kernel for Sony XZ phone. There is error occurring in compile process with the message bellow and I haven't found solution to solve yet. Can anybody help me ?

arch/arm64/Makefile:83: *** CROSS_COMPILE_ARM32 not defined or empty, the compat vDSO will not be built.  Stop.

Thanks, Hung

I rely on Uprobes for the dynamic instrumentation of a shared library. While everything I need is working perfectly on x86 systems, unexpected errors appear when working with the Linux v4.14.x kernel on a 32.bit ARM platform: the Odroid XU4 board. I am currently using the kernel provided by the board manufacturer (Hardkernel).

Essentially, all Systemtap probes with the following format fail:

process(<PATH_TO_EXECUTABLE_OR_SHARED_LIB>).mark(<MARKER_NAME>)
process(<PATH_TO_EXECUTABLE_OR_SHARED_LIB).function(<FUNCTION_NAME>)

Example for the example_openmp_stap executable:

$ stap -e 'probe process("./example_openmp_stap").function("main") { printf("Hey\n")}' -c ./example_openmp_stap
WARNING: probe process("/tmp/example_openmp_stap").function("main") at inode-offset 165296:00000789 registration error (rc -22)
WARNING: task_finder mmap inode-uprobes callback for task 4989 failed: -22
...

By contrast, some features of the process probe "family" do work:

$ stap -e 'probe process("/tmp/example_openmp_stap").begin { printf("Program launched\n")}' -c ./example_openmp_stap
Program launched

Apparently, the kernel function uprobe_register() --defined at kernel/events/uprobes.c-- is the one that fails (it returns -EINVAL). Note that the kernel has been apparently compiled with all the necessary symbols:

CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_UPROBES=y
CONFIG_UPROBE_EVENTS=y

I compiled and install SystemTap from its GIT repository (latest version):

$ stap --version
Systemtap translator/driver (version 4.3/0.170, commit release-4.2-41-g0e1d5b7eb397 + changes)
Copyright (C) 2005-2019 Red Hat, Inc. and others
This is free software; see the source for copying conditions.
tested kernel versions: 2.6.32 ... 5.4-rc6
enabled features: AVAHI BPF LIBSQLITE3 NLS NSS

Any information which sheds light on how to fix this will be greatly appreciated!

PS.: Note that this does not work either with 4.9.x or 3.10.x kernels.

I distribute a statically linked binary version of my application on linux. However, on systems with the 2.4 kernel, I get a segfault on startup, and the message: "FATAL: kernel too old."

How can I easily get a version up and running with a 2.4 kernel? Some of the libraries I need aren't even available on old linux distributions circa 2003. Is there an apt-get install or something that will allow me to easily target older kernels?

I have a LKM named RtmNetlinkLKM.c and compiles and run fine. The moment i update its makefile to compile with other src files, it starts giving warning `WARNING: modpost: missing MODULE_LICENSE()

The following MODULE_LICENSE("GPL"); is already present in kernel module file.

Previous Makefile, module compiles fine

obj-m += RtmNetlinkLKM.o
all:
    make -C /lib/modules/`uname -r`/build M=$(PWD) modules
clean:
    make -C /lib/modules/`uname -r`/build M=$(PWD) clean

updated Makefile, module now compiles with a warning

obj-m += RtmNetlinkLKM.o
RtmNetlinkLKM-objs += rt_kern.o gluethread/glthread.o << Added two more sources
all:
    make -C /lib/modules/`uname -r`/build M=$(PWD) modules
clean:
    make -C /lib/modules/`uname -r`/build M=$(PWD) clean
    rm -f rt_kern.o
    rm -f gluethread/glthread.o

When compiled using second makefile, it gives stated warning. When i add MODULE_LICENSE("GPL") in gluethread/glthread.c , warning goes away. I dont understand, why do i need to add "GPL" license in glthread.c when it is not a module but contain functions to be used by module (It is a linked list mini-library). Why dont it complain with other src file rt_kern.c in a similar way. I had never made any changes in original module file RtmNetlink.c though out this process.

According to the list of API changes in the 2.6 kernel series on LWN the .owner field of struct proc_dir_entry was removed in the 2.6.30 Kernel.

So here's a couple of questions:

1. Was it really ever necessary or useful to set this field?
2. Has the field just been moved somewhere else, or permanently deleted?

I ask the first question because while the LKMPG set's this field in many of it's examples, procfs_example.c from the Kernel Documentation never does.

I am trying to compile linux kernel 3.4.0 on Ubuntu 16.04, but I am getting an error:

In file included from kernel/fork.c:79:0:
include/trace/events/sched.h:249:2: error: #error "Unsupported NR_CPUS for lb tracepoint."
 #error "Unsupported NR_CPUS for lb tracepoint."
  ^
scripts/Makefile.build:307: recipe for target 'kernel/fork.o' failed

Any help is appreciated!

I've searched through a lot of resources, but found nothing concrete on the matter:

I know that with some linux systems, a fork() syscall works with copy-on-write; that is, the parent and the child share the same address space, but PTE is now marked read-only, to be used later of COW. when either tries to access a page, a PAGE_FAULT occur and the page is copied to another place, where it can be modified.

However, I cannot understand how the OS reaches the shared PTEs to mark them as "read". I have hypothesized that when a fork() syscall occurs, the OS preforms a "page walk" on the parent's page table and marks them as read-only - but I find no confirmation for this, or any information regarding the process.

Does anyone know how the pages come to be marked as read only? Will appreciate any help. Thanks!

ERROR adding monitor mode interface in kali Linux

What should I do? I am a beginner. really I do not know what to do next.

root@kali:~# airmon-ng check

Found 2 processes that could cause trouble. Kill them using 'airmon-ng check kill' before putting the card in monitor mode, they will interfere by changing channels and sometimes putting the interface back in managed mode

PID Name
588 NetworkManager
701 wpa_supplicant

root@kali:~# airmon-ng

PHY Interface Driver Chipset

phy0 wlan0 rtl8821ce Realtek Semiconductor Co., Ltd. RTL8821CE 802.11ac PCIe Wireless Network Adapter

I need to enable x2apic on Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz, and I find x2apic was supported in cpuinfo:

But when kernel started, I find error message:

[ 0.138328] IRQ remapping doesn't support X2APIC mode, disable x2apic.

I have checked my kernel config:

CONFIG_X86_X2APIC=y

What can I do to fix this problem?

A performance issue is encountered for our software system after we upgraded the OS from Debian 6 to Debian 8.

From the top -H results, it looks like that all the threads using usleep(200) in system have some major CPU usage increasing, then we tested the listed sample program:

#include <unistd.h>

int main(int argc, char **argv) {
    while (true)
        usleep(200);
    return 0;
}

On an Intel i3 system (no GUI for OS is enabled, only command line), the program would cause a 1% CPU usage on Debian 6 while it would be 2.3% on Debian 8.

We've checked some suspicious kernel configuration and no useful clue have been found. Also, both OS have enabled high resolution timer.

Debian 8.2 (3.16.0-4):

CONFIG_RCU_FAST_NO_HZ=y
CONFIG_HZ=250
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_HPET=y
CONFIG_HPET_MMAP=y
CONFIG_HPET_MMAP_DEFAULT=y
CONFIG_HIGH_RES_TIMERS=y

Debian 6 (2.6.32-5):

CONFIG_NO_HZ=y
CONFIG_HZ=250
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_HPET=y
CONFIG_HPET_MMAP=y
CONFIG_HIGH_RES_TIMERS=y

We know that sub-millisecond sleep would cause some kind of cpu usage while we didn't expect the quite different cpu usage on different OS versions.

Any suggestion would be greatly appreciated.

I've been wondering how a screenshot is implemented in devices. Specifically, how are they implemented in high level functions. As an application developer, you may be given a high level function to call that will give you a screenshot in the form of a file or a 2D array or something like that. However, how are these high level functions implemented?

I'm guessing the information from a screenshot comes from the OS because the OS interacts with the hardware. My first guess was that somehow the OS provides some sort of syscall to do this, but I can't find anything about this online. I'm guessing most OS's implement support for screenshots in a similar way, but it would be helpful if anyone could also explain how a specific OS like Windows or Linux may implement this functionality for user applications.

I have a kernel driver with char device :

static const struct file_operations xxxxx_fops = {
    .owner = THIS_MODULE,
    .read = xxxxx_read,
};

In my userland code, I open the char device and use read call in a loop :

(...)
while (1)
{
    err = read (fd, &ctx->xxxx_queue[xxxxx_offset], XXXX_TOTAL);
    if (err != XXXX_TOTAL)
    {
        PRINT_WARN ("XXXX read byte : %d (errno : %d)", err, errno);
        continue;
    }
    (...)
}
(...)

Everything is running fine.

When I used suspend feature from the kernel by calling : echo mem > /sys/power/state, an issue occured on resume : XXXX read byte : -1 (errno : 3)

The read return -1 on kernel resume. Is there a way to avoid this ? I tried to looking for a suspend/resume callback to declare on struct file_operations but nothing. Do I have just to ignore -3 error fro ioctl ?