diff --git a/index.html b/index.html index a294780..b4fff81 100644 --- a/index.html +++ b/index.html @@ -3668,14 +3668,14 @@ common situations without adding a lot of complexity.

0.12 Avoiding Collisions and Deadlocks

If processes running on different CPUs or in different threads try to access the same -memory then it’s possible that strange things can happen or your system can lock -up. To avoid this various types of mutual exclusion kernel functions are available. +memory, then it is possible that strange things can happen or your system can lock +up. To avoid this, various types of mutual exclusion kernel functions are available. These indicate if a section of code is "locked" or "unlocked" so that simultaneous -attempts to run it can’t happen. +attempts to run it can not happen.

0.12.1 Mutex

-

You can use kernel mutexes (mutual exclusions) in much the same manner that you -might deploy them in userland. This may be all that’s needed to avoid collisions in +

You can use kernel mutexes (mutual exclusions) in much the same manner that you +might deploy them in userland. This may be all that is needed to avoid collisions in most cases.

@@ -3720,19 +3720,19 @@ most cases. 39 40MODULE_DESCRIPTION("Mutex example"); 41MODULE_LICENSE("GPL"); -

+

0.12.2 Spinlocks

-

As the name suggests, spinlocks lock up the CPU that the code is running on, +

As the name suggests, spinlocks lock up the CPU that the code is running on, taking 100% of its resources. Because of this you should only use the spinlock mechanism around code which is likely to take no more than a few milliseconds to -run and so won’t noticably slow anything down from the user’s point of +run and so will not noticably slow anything down from the user’s point of view. -

The example here is "irq safe" in that if interrupts happen during the lock then -they won’t be forgotten and will activate when the unlock happens, using the flags +

The example here is "irq safe" in that if interrupts happen during the lock then +they will not be forgotten and will activate when the unlock happens, using the flags variable to retain their state.

@@ -3801,15 +3801,15 @@ variable to retain their state. 63 64MODULE_DESCRIPTION("Spinlock example"); 65MODULE_LICENSE("GPL"); -

+

0.12.3 Read and write locks

-

Read and write locks are specialised kinds of spinlocks so that you can exclusively +

Read and write locks are specialised kinds of spinlocks so that you can exclusively read from something or write to something. Like the earlier spinlocks example the one below shows an "irq safe" situation in which if other functions were triggered -from irqs which might also read and write to whatever you are concerned -with then they wouldn’t disrupt the logic. As before it’s a good idea to keep -anything done within the lock as short as possible so that it doesn’t hang up +from irqs which might also read and write to whatever you are concerned with +then they would not disrupt the logic. As before it is a good idea to keep +anything done within the lock as short as possible so that it does not hang up the system and cause users to start revolting against the tyranny of your module.

@@ -3869,17 +3869,17 @@ module. 53 54MODULE_DESCRIPTION("Read/Write locks example"); 55MODULE_LICENSE("GPL"); -

Of course if you know for sure that there are no functions triggered by irqs +

Of course, if you know for sure that there are no functions triggered by irqs which could possibly interfere with your logic then you can use the simpler read_lock(&myrwlock) and read_unlock(&myrwlock) or the corresponding write functions.

0.12.4 Atomic operations

-

If you’re doing simple arithmetic: adding, subtracting or bitwise operations then -there’s another way in the multi-CPU and multi-hyperthreaded world to stop other +

If you are doing simple arithmetic: adding, subtracting or bitwise operations then +there is another way in the multi-CPU and multi-hyperthreaded world to stop other parts of the system from messing with your mojo. By using atomic operations you can be confident that your addition, subtraction or bit flip did actually happen -and wasn’t overwritten by some other shenanigans. An example is shown +and was not overwritten by some other shenanigans. An example is shown below.

@@ -3960,21 +3960,21 @@ below. -

+

0.13 Replacing Print Macros

-

+

0.13.1 Replacement

-

In Section 1.2.1.2, I said that X and kernel module programming don’t mix. That’s +

In Section 1.2.1.2, I said that X and kernel module programming don’t mix. That’s true for developing kernel modules, but in actual use, you want to be able to send messages to whichever tty the command to load the module came from. -

"tty" is an abbreviation of teletype: originally a combination keyboard-printer +

"tty" is an abbreviation of teletype: originally a combination keyboard-printer used to communicate with a Unix system, and today an abstraction for the text stream used for a Unix program, whether it’s a physical terminal, an xterm on an X display, a network connection used with ssh, etc. -

The way this is done is by using current, a pointer to the currently running task, +

The way this is done is by using current, a pointer to the currently running task, to get the current task’s tty structure. Then, we look inside that tty structure to find a pointer to a string write function, which we use to write a string to the tty. @@ -4063,16 +4063,16 @@ tty. 81 82module_init(print_string_init); 83module_exit(print_string_exit); -

+

0.13.2 Flashing keyboard LEDs

-

In certain conditions, you may desire a simpler and more direct way to communicate +

In certain conditions, you may desire a simpler and more direct way to communicate to the external world. Flashing keyboard LEDs can be such a solution: It is an immediate way to attract attention or to display a status condition. Keyboard LEDs are present on every hardware, they are always visible, they do not need any setup, and their use is rather simple and non-intrusive, compared to writing to a tty or a file. -

The following source code illustrates a minimal kernel module which, when +

The following source code illustrates a minimal kernel module which, when loaded, starts blinking the keyboard LEDs until it is unloaded.

@@ -4169,7 +4169,7 @@ loaded, starts blinking the keyboard LEDs until it is unloaded. 91 92module_init(kbleds_init); 93module_exit(kbleds_cleanup); -

If none of the examples in this chapter fit your debugging needs there might yet +

If none of the examples in this chapter fit your debugging needs there might yet be some other tricks to try. Ever wondered what CONFIG_LL_DEBUG in make menuconfig is good for? If you activate that you get low level access to the serial port. While this might not sound very powerful by itself, you @@ -4182,22 +4182,22 @@ over a serial line. If you find yourself porting the kernel to some new and former unsupported architecture this is usually amongst the first things that should be implemented. Logging over a netconsole might also be worth a try. -

While you have seen lots of stuff that can be used to aid debugging here, there are +

While you have seen lots of stuff that can be used to aid debugging here, there are some things to be aware of. Debugging is almost always intrusive. Adding debug code can change the situation enough to make the bug seem to dissappear. Thus you should try to keep debug code to a minimum and make sure it does not show up in production code. -

+

0.14 Scheduling Tasks

-

There are two main ways of running tasks: tasklets and work queues. Tasklets are a +

There are two main ways of running tasks: tasklets and work queues. Tasklets are a quick and easy way of scheduling a single function to be run, for example when triggered from an interrupt, whereas work queues are more complicated but also better suited to running multiple things in a sequence. -

+

0.14.1 Tasklets

-

Here’s an example tasklet module. The tasklet_fn function runs for a few seconds +

Here’s an example tasklet module. The tasklet_fn function runs for a few seconds and in the mean time execution of the example_tasklet_init function continues to the exit point.

@@ -4239,7 +4239,7 @@ the exit point. 35 36MODULE_DESCRIPTION("Tasklet example"); 37MODULE_LICENSE("GPL"); -

So with this example loaded dmesg should show: +

So with this example loaded dmesg should show: @@ -4250,11 +4250,11 @@ Example tasklet starts Example tasklet init continues... Example tasklet ends -

-

+

+

0.14.2 Work queues

-

To add a task to the scheduler we can use a workqueue. The kernel then uses the +

To add a task to the scheduler we can use a workqueue. The kernel then uses the Completely Fair Scheduler (CFS) to execute work within the queue.

@@ -4289,18 +4289,18 @@ Completely Fair Scheduler (CFS) to execute work within the queue. 29 30MODULE_LICENSE("GPL"); 31MODULE_DESCRIPTION("Workqueue example"); -

+

0.15 Interrupt Handlers

-

+

0.15.1 Interrupt Handlers

-

Except for the last chapter, everything we did in the kernel so far we’ve done as a +

Except for the last chapter, everything we did in the kernel so far we’ve done as a response to a process asking for it, either by dealing with a special file, sending an ioctl(), or issuing a system call. But the job of the kernel isn’t just to respond to process requests. Another job, which is every bit as important, is to speak to the hardware connected to the machine. -

There are two types of interaction between the CPU and the rest of the +

There are two types of interaction between the CPU and the rest of the computer’s hardware. The first type is when the CPU gives orders to the hardware, the other is when the hardware needs to tell the CPU something. The second, called interrupts, is much harder to implement because it has to be dealt with when @@ -4310,14 +4310,14 @@ lost. -

Under Linux, hardware interrupts are called IRQ’s (Interrupt ReQuests). There +

Under Linux, hardware interrupts are called IRQ’s (Interrupt ReQuests). There are two types of IRQ’s, short and long. A short IRQ is one which is expected to take a very short period of time, during which the rest of the machine will be blocked and no other interrupts will be handled. A long IRQ is one which can take longer, and during which other interrupts may occur (but not interrupts from the same device). If at all possible, it’s better to declare an interrupt handler to be long. -

When the CPU receives an interrupt, it stops whatever it’s doing (unless it’s +

When the CPU receives an interrupt, it stops whatever it’s doing (unless it’s processing a more important interrupt, in which case it will deal with this one only when the more important one is done), saves certain parameters on the stack and calls the interrupt handler. This means that certain things @@ -4329,9 +4329,9 @@ the new information at a later time (this is called the "bottom half") and return. The kernel is then guaranteed to call the bottom half as soon as possible – and when it does, everything allowed in kernel modules will be allowed. -

The way to implement this is to call request_irq() to get your interrupt handler +

The way to implement this is to call request_irq() to get your interrupt handler called when the relevant IRQ is received. -

In practice IRQ handling can be a bit more complex. Hardware is often +

In practice IRQ handling can be a bit more complex. Hardware is often designed in a way that chains two interrupt controllers, so that all the IRQs from interrupt controller B are cascaded to a certain IRQ from interrupt controller A. Of course that requires that the kernel finds out which IRQ it @@ -4345,7 +4345,7 @@ another truckload of problems. It’s not enough to know if a certain IRQs has happend, it’s also important for what CPU(s) it was for. People still interested in more details, might want to do a web search for "APIC" now ;) -

This function receives the IRQ number, the name of the function, flags, a name +

This function receives the IRQ number, the name of the function, flags, a name for /proc/interrupts and a parameter to pass to the interrupt handler. Usually there is a certain number of IRQs available. How many IRQs there are is hardware-dependent. The flags can include SA_SHIRQ to indicate you’re willing to @@ -4356,16 +4356,16 @@ or if you’re both willing to share. -

+

0.15.2 Detecting button presses

-

Many popular single board computers, such as Raspberry Pis or Beagleboards, have +

Many popular single board computers, such as Raspberry Pis or Beagleboards, have a bunch of GPIO pins. Attaching buttons to those and then having a button press do something is a classic case in which you might need to use interrupts so that instead of having the CPU waste time and battery power polling for a change in input state it’s better for the input to trigger the CPU to then run a particular handling function. -

Here’s an example where buttons are connected to GPIO numbers 17 and 18 and +

Here’s an example where buttons are connected to GPIO numbers 17 and 18 and an LED is connected to GPIO 4. You can change those numbers to whatever is appropriate for your board.

@@ -4512,14 +4512,14 @@ appropriate for your board. 140 141MODULE_LICENSE("GPL"); 142MODULE_DESCRIPTION("Handle some GPIO interrupts"); -

+

0.15.3 Bottom Half

-

Suppose you want to do a bunch of stuff inside of an interrupt routine. A common +

Suppose you want to do a bunch of stuff inside of an interrupt routine. A common way to do that without rendering the interrupt unavailable for a significant duration is to combine it with a tasklet. This pushes the bulk of the work off into the scheduler. -

The example below modifies the previous example to also run an additional task +

The example below modifies the previous example to also run an additional task when an interrupt is triggered.

@@ -4679,10 +4679,10 @@ when an interrupt is triggered. 154 155MODULE_LICENSE("GPL"); 156MODULE_DESCRIPTION("Interrupt with top and bottom half"); -

+

0.16 Crypto

-

At the dawn of the internet everybody trusted everybody completely…but that didn’t +

At the dawn of the internet everybody trusted everybody completely…but that didn’t work out so well. When this guide was originally written it was a more innocent era in which almost nobody actually gave a damn about crypto - least of all kernel developers. That’s certainly no longer the case now. To handle crypto stuff the kernel @@ -4691,10 +4691,10 @@ favourite hash functions. -

+

0.16.1 Hash functions

-

Calculating and checking the hashes of things is a common operation. Here is a +

Calculating and checking the hashes of things is a common operation. Here is a demonstration of how to calculate a sha256 hash within a kernel module.

@@ -4760,21 +4760,21 @@ demonstration of how to calculate a sha256 hash within a kernel module. 60 61MODULE_DESCRIPTION("sha256 hash test"); 62MODULE_LICENSE("GPL"); -

Make and install the module: +

Make and install the module:

1make 
 2sudo insmod cryptosha256.ko 
 3dmesg
-

And you should see that the hash was calculated for the test string. -

Finally, remove the test module: +

And you should see that the hash was calculated for the test string. +

Finally, remove the test module:

1sudo rmmod cryptosha256
-

+

0.16.2 Symmetric key encryption

-

Here is an example of symmetrically encrypting a string using the AES algorithm +

Here is an example of symmetrically encrypting a string using the AES algorithm and a password.

@@ -4976,10 +4976,10 @@ and a password. 196 197MODULE_DESCRIPTION("Symmetric key encryption example"); 198MODULE_LICENSE("GPL"); -

+

0.17 Standardising the interfaces: The Device Model

-

Up to this point we’ve seen all kinds of modules doing all kinds of things, but there +

Up to this point we’ve seen all kinds of modules doing all kinds of things, but there was no consistency in their interfaces with the rest of the kernel. To impose some consistency such that there is at minimum a standardised way to start, suspend and resume a device a device model was added. An example is show below, and you can @@ -5089,19 +5089,19 @@ functions. -

+

0.18 Optimizations

-

+

0.18.1 Likely and Unlikely conditions

-

Sometimes you might want your code to run as quickly as possible, especially if +

Sometimes you might want your code to run as quickly as possible, especially if it’s handling an interrupt or doing something which might cause noticible latency. If your code contains boolean conditions and if you know that the conditions are almost always likely to evaluate as either true or false, then you can allow the compiler to optimise for this using the likely and unlikely macros. -

For example, when allocating memory you’re almost always expecting this to +

For example, when allocating memory you’re almost always expecting this to succeed.

@@ -5111,64 +5111,64 @@ succeed. 4  bio = NULL; 5  goto out; 6} -

When the unlikely macro is used the compiler alters its machine instruction +

When the unlikely macro is used the compiler alters its machine instruction output so that it continues along the false branch and only jumps if the condition is true. That avoids flushing the processor pipeline. The opposite happens if you use the likely macro.

0.19 Common Pitfalls

-

Before I send you on your way to go out into the world and write kernel modules, +

Before I send you on your way to go out into the world and write kernel modules, there are a few things I need to warn you about. If I fail to warn you and something bad happens, please report the problem to me for a full refund of the amount I was paid for your copy of the book. -

+

0.19.1 Using standard libraries

-

You can’t do that. In a kernel module you can only use kernel functions, which are +

You can’t do that. In a kernel module you can only use kernel functions, which are the functions you can see in /proc/kallsyms. -

+

0.19.2 Disabling interrupts

-

You might need to do this for a short time and that is OK, but if you don’t +

You might need to do this for a short time and that is OK, but if you don’t enable them afterwards, your system will be stuck and you’ll have to power it off. -

+

0.19.3 Sticking your head inside a large carnivore

-

I probably don’t have to warn you about this, but I figured I will anyway, just in +

I probably don’t have to warn you about this, but I figured I will anyway, just in case. -

+

0.20 Where To Go From Here?

-

I could easily have squeezed a few more chapters into this book. I could have added a +

I could easily have squeezed a few more chapters into this book. I could have added a chapter about creating new file systems, or about adding new protocol stacks (as if there’s a need for that – you’d have to dig underground to find a protocol stack not supported by Linux). I could have added explanations of the kernel mechanisms we haven’t touched upon, such as bootstrapping or the disk interface. -

However, I chose not to. My purpose in writing this book was to provide initiation +

However, I chose not to. My purpose in writing this book was to provide initiation into the mysteries of kernel module programming and to teach the common techniques for that purpose. For people seriously interested in kernel programming, I recommend kernelnewbies.org and the Documentation subdirectory within the kernel source code which isn’t always easy to understand but can be a starting point for further investigation. Also, as Linus said, the best way to learn the kernel is to read the source code yourself. -

If you’re interested in more examples of short kernel modules then searching on +

If you’re interested in more examples of short kernel modules then searching on sites such as Github and Gitlab is a good way to start, although there is a lot of duplication of older LKMPG examples which may not compile with newer kernel versions. You will also be able to find examples of the use of kernel modules to attack or compromise systems or exfiltrate data and those can be useful for thinking about how to defend systems and learning about existing security mechanisms within the kernel. -

I hope I have helped you in your quest to become a better programmer, or at +

I hope I have helped you in your quest to become a better programmer, or at least to have fun through technology. And, if you do write useful kernel modules, I hope you publish them under the GPL, so I can use them too. -

If you’d like to contribute to this guide or notice anything glaringly wrong, please +

If you’d like to contribute to this guide or notice anything glaringly wrong, please create an issue at https://github.com/sysprog21/lkmpg. -

Happy hacking. +

Happy hacking.

diff --git a/lkmpg.html b/lkmpg.html index a294780..b4fff81 100644 --- a/lkmpg.html +++ b/lkmpg.html @@ -3668,14 +3668,14 @@ common situations without adding a lot of complexity.

0.12 Avoiding Collisions and Deadlocks

If processes running on different CPUs or in different threads try to access the same -memory then it’s possible that strange things can happen or your system can lock -up. To avoid this various types of mutual exclusion kernel functions are available. +memory, then it is possible that strange things can happen or your system can lock +up. To avoid this, various types of mutual exclusion kernel functions are available. These indicate if a section of code is "locked" or "unlocked" so that simultaneous -attempts to run it can’t happen. +attempts to run it can not happen.

0.12.1 Mutex

-

You can use kernel mutexes (mutual exclusions) in much the same manner that you -might deploy them in userland. This may be all that’s needed to avoid collisions in +

You can use kernel mutexes (mutual exclusions) in much the same manner that you +might deploy them in userland. This may be all that is needed to avoid collisions in most cases.

@@ -3720,19 +3720,19 @@ most cases. 39 40MODULE_DESCRIPTION("Mutex example"); 41MODULE_LICENSE("GPL"); -

+

0.12.2 Spinlocks

-

As the name suggests, spinlocks lock up the CPU that the code is running on, +

As the name suggests, spinlocks lock up the CPU that the code is running on, taking 100% of its resources. Because of this you should only use the spinlock mechanism around code which is likely to take no more than a few milliseconds to -run and so won’t noticably slow anything down from the user’s point of +run and so will not noticably slow anything down from the user’s point of view. -

The example here is "irq safe" in that if interrupts happen during the lock then -they won’t be forgotten and will activate when the unlock happens, using the flags +

The example here is "irq safe" in that if interrupts happen during the lock then +they will not be forgotten and will activate when the unlock happens, using the flags variable to retain their state.

@@ -3801,15 +3801,15 @@ variable to retain their state. 63 64MODULE_DESCRIPTION("Spinlock example"); 65MODULE_LICENSE("GPL"); -

+

0.12.3 Read and write locks

-

Read and write locks are specialised kinds of spinlocks so that you can exclusively +

Read and write locks are specialised kinds of spinlocks so that you can exclusively read from something or write to something. Like the earlier spinlocks example the one below shows an "irq safe" situation in which if other functions were triggered -from irqs which might also read and write to whatever you are concerned -with then they wouldn’t disrupt the logic. As before it’s a good idea to keep -anything done within the lock as short as possible so that it doesn’t hang up +from irqs which might also read and write to whatever you are concerned with +then they would not disrupt the logic. As before it is a good idea to keep +anything done within the lock as short as possible so that it does not hang up the system and cause users to start revolting against the tyranny of your module.

@@ -3869,17 +3869,17 @@ module. 53 54MODULE_DESCRIPTION("Read/Write locks example"); 55MODULE_LICENSE("GPL"); -

Of course if you know for sure that there are no functions triggered by irqs +

Of course, if you know for sure that there are no functions triggered by irqs which could possibly interfere with your logic then you can use the simpler read_lock(&myrwlock) and read_unlock(&myrwlock) or the corresponding write functions.

0.12.4 Atomic operations

-

If you’re doing simple arithmetic: adding, subtracting or bitwise operations then -there’s another way in the multi-CPU and multi-hyperthreaded world to stop other +

If you are doing simple arithmetic: adding, subtracting or bitwise operations then +there is another way in the multi-CPU and multi-hyperthreaded world to stop other parts of the system from messing with your mojo. By using atomic operations you can be confident that your addition, subtraction or bit flip did actually happen -and wasn’t overwritten by some other shenanigans. An example is shown +and was not overwritten by some other shenanigans. An example is shown below.

@@ -3960,21 +3960,21 @@ below. -

+

0.13 Replacing Print Macros

-

+

0.13.1 Replacement

-

In Section 1.2.1.2, I said that X and kernel module programming don’t mix. That’s +

In Section 1.2.1.2, I said that X and kernel module programming don’t mix. That’s true for developing kernel modules, but in actual use, you want to be able to send messages to whichever tty the command to load the module came from. -

"tty" is an abbreviation of teletype: originally a combination keyboard-printer +

"tty" is an abbreviation of teletype: originally a combination keyboard-printer used to communicate with a Unix system, and today an abstraction for the text stream used for a Unix program, whether it’s a physical terminal, an xterm on an X display, a network connection used with ssh, etc. -

The way this is done is by using current, a pointer to the currently running task, +

The way this is done is by using current, a pointer to the currently running task, to get the current task’s tty structure. Then, we look inside that tty structure to find a pointer to a string write function, which we use to write a string to the tty. @@ -4063,16 +4063,16 @@ tty. 81 82module_init(print_string_init); 83module_exit(print_string_exit); -

+

0.13.2 Flashing keyboard LEDs

-

In certain conditions, you may desire a simpler and more direct way to communicate +

In certain conditions, you may desire a simpler and more direct way to communicate to the external world. Flashing keyboard LEDs can be such a solution: It is an immediate way to attract attention or to display a status condition. Keyboard LEDs are present on every hardware, they are always visible, they do not need any setup, and their use is rather simple and non-intrusive, compared to writing to a tty or a file. -

The following source code illustrates a minimal kernel module which, when +

The following source code illustrates a minimal kernel module which, when loaded, starts blinking the keyboard LEDs until it is unloaded.

@@ -4169,7 +4169,7 @@ loaded, starts blinking the keyboard LEDs until it is unloaded. 91 92module_init(kbleds_init); 93module_exit(kbleds_cleanup); -

If none of the examples in this chapter fit your debugging needs there might yet +

If none of the examples in this chapter fit your debugging needs there might yet be some other tricks to try. Ever wondered what CONFIG_LL_DEBUG in make menuconfig is good for? If you activate that you get low level access to the serial port. While this might not sound very powerful by itself, you @@ -4182,22 +4182,22 @@ over a serial line. If you find yourself porting the kernel to some new and former unsupported architecture this is usually amongst the first things that should be implemented. Logging over a netconsole might also be worth a try. -

While you have seen lots of stuff that can be used to aid debugging here, there are +

While you have seen lots of stuff that can be used to aid debugging here, there are some things to be aware of. Debugging is almost always intrusive. Adding debug code can change the situation enough to make the bug seem to dissappear. Thus you should try to keep debug code to a minimum and make sure it does not show up in production code. -

+

0.14 Scheduling Tasks

-

There are two main ways of running tasks: tasklets and work queues. Tasklets are a +

There are two main ways of running tasks: tasklets and work queues. Tasklets are a quick and easy way of scheduling a single function to be run, for example when triggered from an interrupt, whereas work queues are more complicated but also better suited to running multiple things in a sequence. -

+

0.14.1 Tasklets

-

Here’s an example tasklet module. The tasklet_fn function runs for a few seconds +

Here’s an example tasklet module. The tasklet_fn function runs for a few seconds and in the mean time execution of the example_tasklet_init function continues to the exit point.

@@ -4239,7 +4239,7 @@ the exit point. 35 36MODULE_DESCRIPTION("Tasklet example"); 37MODULE_LICENSE("GPL"); -

So with this example loaded dmesg should show: +

So with this example loaded dmesg should show: @@ -4250,11 +4250,11 @@ Example tasklet starts Example tasklet init continues... Example tasklet ends -

-

+

+

0.14.2 Work queues

-

To add a task to the scheduler we can use a workqueue. The kernel then uses the +

To add a task to the scheduler we can use a workqueue. The kernel then uses the Completely Fair Scheduler (CFS) to execute work within the queue.

@@ -4289,18 +4289,18 @@ Completely Fair Scheduler (CFS) to execute work within the queue. 29 30MODULE_LICENSE("GPL"); 31MODULE_DESCRIPTION("Workqueue example"); -

+

0.15 Interrupt Handlers

-

+

0.15.1 Interrupt Handlers

-

Except for the last chapter, everything we did in the kernel so far we’ve done as a +

Except for the last chapter, everything we did in the kernel so far we’ve done as a response to a process asking for it, either by dealing with a special file, sending an ioctl(), or issuing a system call. But the job of the kernel isn’t just to respond to process requests. Another job, which is every bit as important, is to speak to the hardware connected to the machine. -

There are two types of interaction between the CPU and the rest of the +

There are two types of interaction between the CPU and the rest of the computer’s hardware. The first type is when the CPU gives orders to the hardware, the other is when the hardware needs to tell the CPU something. The second, called interrupts, is much harder to implement because it has to be dealt with when @@ -4310,14 +4310,14 @@ lost. -

Under Linux, hardware interrupts are called IRQ’s (Interrupt ReQuests). There +

Under Linux, hardware interrupts are called IRQ’s (Interrupt ReQuests). There are two types of IRQ’s, short and long. A short IRQ is one which is expected to take a very short period of time, during which the rest of the machine will be blocked and no other interrupts will be handled. A long IRQ is one which can take longer, and during which other interrupts may occur (but not interrupts from the same device). If at all possible, it’s better to declare an interrupt handler to be long. -

When the CPU receives an interrupt, it stops whatever it’s doing (unless it’s +

When the CPU receives an interrupt, it stops whatever it’s doing (unless it’s processing a more important interrupt, in which case it will deal with this one only when the more important one is done), saves certain parameters on the stack and calls the interrupt handler. This means that certain things @@ -4329,9 +4329,9 @@ the new information at a later time (this is called the "bottom half") and return. The kernel is then guaranteed to call the bottom half as soon as possible – and when it does, everything allowed in kernel modules will be allowed. -

The way to implement this is to call request_irq() to get your interrupt handler +

The way to implement this is to call request_irq() to get your interrupt handler called when the relevant IRQ is received. -

In practice IRQ handling can be a bit more complex. Hardware is often +

In practice IRQ handling can be a bit more complex. Hardware is often designed in a way that chains two interrupt controllers, so that all the IRQs from interrupt controller B are cascaded to a certain IRQ from interrupt controller A. Of course that requires that the kernel finds out which IRQ it @@ -4345,7 +4345,7 @@ another truckload of problems. It’s not enough to know if a certain IRQs has happend, it’s also important for what CPU(s) it was for. People still interested in more details, might want to do a web search for "APIC" now ;) -

This function receives the IRQ number, the name of the function, flags, a name +

This function receives the IRQ number, the name of the function, flags, a name for /proc/interrupts and a parameter to pass to the interrupt handler. Usually there is a certain number of IRQs available. How many IRQs there are is hardware-dependent. The flags can include SA_SHIRQ to indicate you’re willing to @@ -4356,16 +4356,16 @@ or if you’re both willing to share. -

+

0.15.2 Detecting button presses

-

Many popular single board computers, such as Raspberry Pis or Beagleboards, have +

Many popular single board computers, such as Raspberry Pis or Beagleboards, have a bunch of GPIO pins. Attaching buttons to those and then having a button press do something is a classic case in which you might need to use interrupts so that instead of having the CPU waste time and battery power polling for a change in input state it’s better for the input to trigger the CPU to then run a particular handling function. -

Here’s an example where buttons are connected to GPIO numbers 17 and 18 and +

Here’s an example where buttons are connected to GPIO numbers 17 and 18 and an LED is connected to GPIO 4. You can change those numbers to whatever is appropriate for your board.

@@ -4512,14 +4512,14 @@ appropriate for your board. 140 141MODULE_LICENSE("GPL"); 142MODULE_DESCRIPTION("Handle some GPIO interrupts"); -

+

0.15.3 Bottom Half

-

Suppose you want to do a bunch of stuff inside of an interrupt routine. A common +

Suppose you want to do a bunch of stuff inside of an interrupt routine. A common way to do that without rendering the interrupt unavailable for a significant duration is to combine it with a tasklet. This pushes the bulk of the work off into the scheduler. -

The example below modifies the previous example to also run an additional task +

The example below modifies the previous example to also run an additional task when an interrupt is triggered.

@@ -4679,10 +4679,10 @@ when an interrupt is triggered. 154 155MODULE_LICENSE("GPL"); 156MODULE_DESCRIPTION("Interrupt with top and bottom half"); -

+

0.16 Crypto

-

At the dawn of the internet everybody trusted everybody completely…but that didn’t +

At the dawn of the internet everybody trusted everybody completely…but that didn’t work out so well. When this guide was originally written it was a more innocent era in which almost nobody actually gave a damn about crypto - least of all kernel developers. That’s certainly no longer the case now. To handle crypto stuff the kernel @@ -4691,10 +4691,10 @@ favourite hash functions. -

+

0.16.1 Hash functions

-

Calculating and checking the hashes of things is a common operation. Here is a +

Calculating and checking the hashes of things is a common operation. Here is a demonstration of how to calculate a sha256 hash within a kernel module.

@@ -4760,21 +4760,21 @@ demonstration of how to calculate a sha256 hash within a kernel module. 60 61MODULE_DESCRIPTION("sha256 hash test"); 62MODULE_LICENSE("GPL"); -

Make and install the module: +

Make and install the module:

1make 
 2sudo insmod cryptosha256.ko 
 3dmesg
-

And you should see that the hash was calculated for the test string. -

Finally, remove the test module: +

And you should see that the hash was calculated for the test string. +

Finally, remove the test module:

1sudo rmmod cryptosha256
-

+

0.16.2 Symmetric key encryption

-

Here is an example of symmetrically encrypting a string using the AES algorithm +

Here is an example of symmetrically encrypting a string using the AES algorithm and a password.

@@ -4976,10 +4976,10 @@ and a password. 196 197MODULE_DESCRIPTION("Symmetric key encryption example"); 198MODULE_LICENSE("GPL"); -

+

0.17 Standardising the interfaces: The Device Model

-

Up to this point we’ve seen all kinds of modules doing all kinds of things, but there +

Up to this point we’ve seen all kinds of modules doing all kinds of things, but there was no consistency in their interfaces with the rest of the kernel. To impose some consistency such that there is at minimum a standardised way to start, suspend and resume a device a device model was added. An example is show below, and you can @@ -5089,19 +5089,19 @@ functions. -

+

0.18 Optimizations

-

+

0.18.1 Likely and Unlikely conditions

-

Sometimes you might want your code to run as quickly as possible, especially if +

Sometimes you might want your code to run as quickly as possible, especially if it’s handling an interrupt or doing something which might cause noticible latency. If your code contains boolean conditions and if you know that the conditions are almost always likely to evaluate as either true or false, then you can allow the compiler to optimise for this using the likely and unlikely macros. -

For example, when allocating memory you’re almost always expecting this to +

For example, when allocating memory you’re almost always expecting this to succeed.

@@ -5111,64 +5111,64 @@ succeed. 4  bio = NULL; 5  goto out; 6} -

When the unlikely macro is used the compiler alters its machine instruction +

When the unlikely macro is used the compiler alters its machine instruction output so that it continues along the false branch and only jumps if the condition is true. That avoids flushing the processor pipeline. The opposite happens if you use the likely macro.

0.19 Common Pitfalls

-

Before I send you on your way to go out into the world and write kernel modules, +

Before I send you on your way to go out into the world and write kernel modules, there are a few things I need to warn you about. If I fail to warn you and something bad happens, please report the problem to me for a full refund of the amount I was paid for your copy of the book. -

+

0.19.1 Using standard libraries

-

You can’t do that. In a kernel module you can only use kernel functions, which are +

You can’t do that. In a kernel module you can only use kernel functions, which are the functions you can see in /proc/kallsyms. -

+

0.19.2 Disabling interrupts

-

You might need to do this for a short time and that is OK, but if you don’t +

You might need to do this for a short time and that is OK, but if you don’t enable them afterwards, your system will be stuck and you’ll have to power it off. -

+

0.19.3 Sticking your head inside a large carnivore

-

I probably don’t have to warn you about this, but I figured I will anyway, just in +

I probably don’t have to warn you about this, but I figured I will anyway, just in case. -

+

0.20 Where To Go From Here?

-

I could easily have squeezed a few more chapters into this book. I could have added a +

I could easily have squeezed a few more chapters into this book. I could have added a chapter about creating new file systems, or about adding new protocol stacks (as if there’s a need for that – you’d have to dig underground to find a protocol stack not supported by Linux). I could have added explanations of the kernel mechanisms we haven’t touched upon, such as bootstrapping or the disk interface. -

However, I chose not to. My purpose in writing this book was to provide initiation +

However, I chose not to. My purpose in writing this book was to provide initiation into the mysteries of kernel module programming and to teach the common techniques for that purpose. For people seriously interested in kernel programming, I recommend kernelnewbies.org and the Documentation subdirectory within the kernel source code which isn’t always easy to understand but can be a starting point for further investigation. Also, as Linus said, the best way to learn the kernel is to read the source code yourself. -

If you’re interested in more examples of short kernel modules then searching on +

If you’re interested in more examples of short kernel modules then searching on sites such as Github and Gitlab is a good way to start, although there is a lot of duplication of older LKMPG examples which may not compile with newer kernel versions. You will also be able to find examples of the use of kernel modules to attack or compromise systems or exfiltrate data and those can be useful for thinking about how to defend systems and learning about existing security mechanisms within the kernel. -

I hope I have helped you in your quest to become a better programmer, or at +

I hope I have helped you in your quest to become a better programmer, or at least to have fun through technology. And, if you do write useful kernel modules, I hope you publish them under the GPL, so I can use them too. -

If you’d like to contribute to this guide or notice anything glaringly wrong, please +

If you’d like to contribute to this guide or notice anything glaringly wrong, please create an issue at https://github.com/sysprog21/lkmpg. -

Happy hacking. +

Happy hacking.