Programming Project 2 Linux Kernel Hacking CS3013 Operating

Programming Project #2 Linux Kernel Hacking CS-3013, Operating Systems C-Term 2008 Due Thursday, January 31, 2008, @ 6: 00 PM CS-502 Fall 2007 Project #2, Linux Kernel Modifications 1

Objective • To learn how to work with an operating system kernel • To understand some of the constraints and techniques of programming in a kernel (versus user space) CS-502 Fall 2007 Project #2, Linux Kernel Modifications 2

Method • To add a new system call to the Linux kernel • To get useful information from the data structures of a Linux kernel CS-502 Fall 2007 Project #2, Linux Kernel Modifications 3

Background – User vs. Kernel mode • Hardware provides two modes – Indicated by bit in PSW • Allows OS to protect itself & system components against – Faulty and malicious processes • Some instructions designated as privileged – Only executable in kernel mode • System call, all traps, & interrupts change mode from user to kernel – return from system call resets mode to user CS-502 Fall 2007 Project #2, Linux Kernel Modifications 4

Transition from User to Kernel Mode • Note: each different system call has its own number or other identity. • Kernel trap handler uses syscall number to index into table of syscall routines CS-502 Fall 2007 Project #2, Linux Kernel Modifications 5

Inside Kernel, the OS can … • Read and modify data structures not in user address space • Control devices and hardware settings forbidden to user processes • Invoke operating system functions not available to user processes • … CS-502 Fall 2007 Project #2, Linux Kernel Modifications 6

Accessing the Kernel via System Call • Normally embedded within a library routine • User API never makes system calls directly • System call mechanism is machine specific • Different CPU architectures make system calls in different ways • System call numbers different for various architectures • Even for same operating system & version! • E. g. , poll system call is #167 on Power. PC but #168 on Intel 386 platforms (in SUSE Linux 9. 3) CS-502 Fall 2007 Project #2, Linux Kernel Modifications 7

Accessing Kernel via Library interface CS-502 Fall 2007 Project #2, Linux Kernel Modifications 8

Accessing Kernel via Library interface CS-502 Fall 2007 Project #2, Linux Kernel Modifications 9

In this project, we will … • Add a new system call to the Linux kernel – It does nothing except announce its presence • Add a second system call to provide information about the calling process – Some of which is not readily available via existing system calls • Follow Linux naming & numbering conventions CS-502 Fall 2007 Project #2, Linux Kernel Modifications 10

In this project, we won’t … • … bother to make a library to encapsulate our systems calls • … try to support them on all machine architectures CS-502 Fall 2007 Project #2, Linux Kernel Modifications 11

Part 1: Adding a System Call • See Silbershatz, pp 74 -78 • Similar problem statement • Many details are different (due to version of Linux) • Many how-to details in Robert Love, ch. 5 • System Calls • Clone a new kernel tree as in Project 0 • cp –al /usr/src/linux-2. 6. 22. 13 -0. 3 kernel. Src • Remember to build to a destination – e. g. ~/kernel. Dst CS-502 Fall 2007 Project #2, Linux Kernel Modifications 12

Linux Conventions (all versions) • If your library routine is alarm, … • … then the corresponding system call is sys_alarm • … and the corresponding function prototype for its kernel implementation is asmlinkage unsigned long sys_alarm (unsigned int seconds) • Note that asmlinkage is a compiler directive that tells gcc how to compile calls to the function sys_alarm within the kernel CS-502 Fall 2007 Project #2, Linux Kernel Modifications 13

Linux Conventions (continued) • To invoke alarm system call from a library routine in user space, use macro _syscall 1(unsigned long, alarm, unsigned int seconds) • _syscalln has n+2 arguments • Return type • Name of actual system call (in user space) • Arguments to system call function • This macro defines the function unsigned long alarm(unsigned int seconds) CS-502 Fall 2007 Project #2, Linux Kernel Modifications 14

Linux Conventions (continued) • To invoke alarm system call from a library routine in user space, use macro _syscall 1(unsigned long, alarm, unsigned int seconds) • _syscalln has n+2 arguments • Return type • Name of actual system call (in user space) • Arguments to system call function • This macro defines the function unsigned long alarm(unsigned int seconds) CS-502 Fall 2007 Project #2, Linux Kernel Modifications 15

Linux Conventions (modified) • _syscalln • xxx is deprecated • Instead, use • syscall(call. Number, …), where … are the arguments to the system call. • Example, for alarm system call, write long alarm (unsigned int seconds) { return (long) syscall(__NR_alarm, seconds); }; CS-502 Fall 2007 Project #2, Linux Kernel Modifications 16

Hello, World! • Our first system call will be helloworld • No arguments • Return long CS-502 Fall 2007 Project #2, Linux Kernel Modifications 17

helloworld System Call • /* This is the text of the helloworld system call implementation */ asmlinkage long sys_helloworld(void) { printk(KERN_EMERG “Hello, world!n”); return 0; } • Add to the file kernel. Src/kernel/sys. c CS-502 Fall 2007 Project #2, Linux Kernel Modifications 18

helloworld System Call • /* This is the text of the helloworld system call */ asmlinkage long sys_helloworld(void) { printk(KERN_EMERG “Hello, world!n”); return 0; No } te : N oc om m ah • Add to the file er kernel. Src/kernel/sys. c CS-502 Fall 2007 Project #2, Linux Kernel Modifications 19 e!

printk(), the Kernel Debug Print Tool • Very robust • • May be called from (almost) anywhere in kernel Same calling convention as printf() Writes to system log Output survives crashes (almost all of the time) • To read output, see • /var/log/messages — Circular log, newest messages at end • Use /bin/dmesg or cat /proc/kmsg to read • Needs root privileges to read • See Linux Kernel Development, 2 nd edition, by Robert Love, Chapter 18. CS-502 Fall 2007 Project #2, Linux Kernel Modifications 20

helloworld System Call • /* This is the text of the helloworld system call implementation */ asmlinkage long sys_helloworld(void) { printk(KERN_EMERG “Hello, world!n”); return 0; } • Add to the file kernel. Src/kernel/sys. c CS-502 Fall 2007 Project #2, Linux Kernel Modifications 21

Registering your System Call • include/asm-i 386/unistd. h – Add entry for your call number – Increment total number of calls • arch/i 386/kernel/syscall_table. S – Lists entry points for system calls – Must be kept in numerical order! – Number must correspond to entry in unistd. h • Rebuild and install your kernel CS-502 Fall 2007 Project #2, Linux Kernel Modifications 22

Note #1 • On i 386 architecture, the syscall table has moved since • Robert Love’s book • CS-502 last fall • It used to be in – arch/i 386/kernel/entry. S • But now it is in – arch/i 386/kernel/syscall_table. S – … which is included by entry. S CS-502 Fall 2007 Project #2, Linux Kernel Modifications 23

Note #2 • The x 86_64 architecture does it differently – Everything is in include/asm-x 86_64/unistd. h – Add to the list #define 251 /*next number in list*/ __SYSCALL(__NR_helloworld, sys_helloworld) • No need to edit entry. S CS-502 Fall 2007 Project #2, Linux Kernel Modifications 24

Note #3 • Remember: – to edit a source file foo. h in your kernel tree – Move it to foo. h~ – Make changes and save to foo. h CS-502 Fall 2007 Project #2, Linux Kernel Modifications 25

Testing your System Call • #include <linux/errno. h> <sys/syscall. h> <linux/unistd. h> <stdio. h> #define __NR_helloworld 288 whatever you set it in unistd. h */ /* or long helloworld(void) { return (long) syscall(__NR_helloworld); }; main () { printf(“The return code from the helloworld system call is %dn”, helloworld()); } • Check log for the printk() message! CS-502 Fall 2007 Project #2, Linux Kernel Modifications 26

Creating a Patch File • One level above kernel source tree, do diff –ur. N /usr/src/linux-2. 6. 22. 13 -0. 3 kernel. Src > patch 1 • To recreate your directory from patch – cp –al /usr/src/linux-2. 6. 22. 13 -0. 3 new. Src – cd new. Src – patch –p 1 < patch 1 • Do not prefix name of kernel. Src directory or use fully qualified name – E. g, ~/kernel. Src, . /kernel. Src CS-502 Fall 2007 Project #2, Linux Kernel Modifications 27

Submission – Part 1 • Patch 1 • Test program • Makefile and write-up will be combined with part 2 • Via web-based turnin – http: //turnin. cs. wpi. edu: 8088/servlets/turnin. ss CS-502 Fall 2007 Project #2, Linux Kernel Modifications 28

End of Part 1 Questions? CS-502 Fall 2007 Project #2, Linux Kernel Modifications 29

Part 2: Get Process Information • Modify your kernel of Part 1 to add another system call to get information about process • Please leave helloworld system call in place! • System call is – long getprinfo(struct prinfo *info) – info is pointer to caller area to store results – Returns zero if successful, error code if not • See handout for definition of struct CS-502 Fall 2007 Project #2, Linux Kernel Modifications 30 prinfo

Information needed for prinfo • See task_struct in include/linux/sched. h • See getuid and getpid for examples of simple system calls • See include/asm/current. h to find current process information • Use copy_to_user to safely copy data from kernel to user space (next slide) • Return EFAULT error code if info argument is not valid pointer in user space CS-502 Fall 2007 Project #2, Linux Kernel Modifications 31

copy_to_user and copy_from_user • Functions to safely copy data to/from user space • Check validity of pointer arguments for your • Return zero if successful, number of bytes that fail if there is a problem • Immune to page faults, pre-emption, null pointers, other errors, etc. CS-502 Fall 2007 Project #2, Linux Kernel Modifications 32

Implementing getprinfo System Call • Add after helloworld system call from Part 1 • Create and implement in – kernel/prinfo. c, with Makefile edits • Register in unistd. h in syscall_table. S • Use printk() to print debugging statements to system log – For your debugging convenience CS-502 Fall 2007 Project #2, Linux Kernel Modifications 33

Testing getprinfo • Write test program in user space • Must have own user space version of prinfo. h • Run multiple times from same shell, different processes • Note differences in results • Compare with what you can find about processes from ps command from Project 1 program. CS-502 Fall 2007 Project #2, Linux Kernel Modifications 34

Submission – Part 2 • Patch 2 – Difference between original source tree and Part 2 kernel. • User-space test program – Include file(s) – Test program itself – Makefile for both Part 1 and Part 2 • Short writeup with results of both parts • Submit using web-based turnin program – http: //turnin. cs. wpi. edu: 8088/servlets/turnin. ss CS-502 Fall 2007 Project #2, Linux Kernel Modifications 35

Warning! • Check your patch files before submitting • Should be a few kilobytes • Every line added by patch file should be something you wrote • Be sure no junk is lying around in your source tree • E. g. , “~” files, old files, build files • If your patch file is 100 s of kilobytes or megabytes, it is wrong! • Graders will refuse to grade your project! CS-502 Fall 2007 Project #2, Linux Kernel Modifications 36

Submission (continued) • Put your name on all documents and at top of every edited file! CS-502 Fall 2007 Project #2, Linux Kernel Modifications 37

Due Date • Project due on Thursday, January 31, at 6: 00 PM • Pace yourself: – – Part 1 should be very quick – Part 2 may take you all week • Report to instructor or TAs any difficulties CS-502 Fall 2007 Project #2, Linux Kernel Modifications 38

Questions? CS-502 Fall 2007 Project #2, Linux Kernel Modifications 39