book

Linux Kernel Programming

by Kaiwan N. Billimoria

March 2021

Beginner to intermediate

754 pages

17h 1m

English

Packt Publishing

Read now

Unlock full access

Linux Kernel Programming
About the authorAbout the reviewers
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchReviews
Technical requirementsRunning Linux as a guest VMInstalling a 64-bit Linux guestTurn on your x86 system's virtualization extension support Allocate sufficient space to the diskInstall the Oracle VirtualBox Guest AdditionsExperimenting with the Raspberry PiSetting up the software – distribution and packagesInstalling software packagesInstalling the Oracle VirtualBox guest additionsInstalling required software packagesInstalling a cross toolchain and QEMUInstalling a cross compilerImportant installation notesAdditional useful projectsUsing the Linux man pagesThe tldr variantLocating and using the Linux kernel documentationGenerating the kernel documentation from sourceStatic analysis tools for the Linux kernelLinux Trace Toolkit next generationThe procmap utilitySimple Embedded ARM Linux System FOSS projectModern tracing and performance analysis with [e]BPFThe LDV - Linux Driver Verification - projectSummaryQuestionsFurther reading
Technical requirements Preliminaries for the kernel buildKernel release nomenclatureKernel development workflow – the basicsTypes of kernel source treesSteps to build the kernel from sourceStep 1 – obtaining a Linux kernel source treeDownloading a specific kernel treeCloning a Git treeStep 2 – extracting the kernel source treeA brief tour of the kernel source treeStep 3 – configuring the Linux kernelUnderstanding the kbuild build systemArriving at a default configurationObtaining a good starting point for kernel configurationKernel config for typical embedded Linux systemsKernel config using distribution config as a starting pointTuned kernel config via the localmodconfig approachGetting started with the localmodconfig approachTuning our kernel configuration via the make menuconfig UISample usage of the make menuconfig UIMore on kbuildLooking up the differences in configurationCustomizing the kernel menu – adding our own menu itemThe Kconfig* filesCreating a new menu item in the Kconfig fileA few details on the Kconfig languageSummaryQuestionsFurther reading
Technical requirementsStep 4 – building the kernel image and modulesStep 5 – installing the kernel modulesLocating the kernel modules within the kernel sourceGetting the kernel modules installedStep 6 – generating the initramfs image and bootloader setupGenerating the initramfs image on Fedora 30 and aboveGenerating the initramfs image – under the hoodUnderstanding the initramfs frameworkWhy the initramfs framework?Understanding the basics of the boot process on the x86More on the initramfs frameworkStep 7 – customizing the GRUB bootloaderCustomizing GRUB – the basicsSelecting the default kernel to boot intoBooting our VM via the GNU GRUB bootloaderExperimenting with the GRUB promptVerifying our new kernel's configurationKernel build for the Raspberry PiStep 1 – cloning the kernel source treeStep 2 – installing a cross-toolchainFirst method – package install via aptSecond method – installation via the source repoStep 3 – configuring and building the kernelMiscellaneous tips on the kernel buildMinimum version requirementsBuilding a kernel for another siteWatching the kernel build runA shortcut shell syntax to the build procedure Dealing with compiler switch issuesDealing with missing OpenSSL development headersSummaryQuestionsFurther reading
Technical requirementsUnderstanding kernel architecture – part 1User space and kernel spaceLibrary and system call APIsKernel space componentsExploring LKMsThe LKM frameworkKernel modules within the kernel source treeWriting our very first kernel moduleIntroducing our Hello, world LKM C codeBreaking it downKernel headersModule macrosEntry and exit pointsReturn valuesThe 0/-E return conventionThe ERR_PTR and PTR_ERR macrosThe __init and __exit keywordsCommon operations on kernel modulesBuilding the kernel moduleRunning the kernel moduleA quick first look at the kernel printk()Listing the live kernel modulesUnloading the module from kernel memoryOur lkm convenience scriptUnderstanding kernel logging and printkUsing the kernel memory ring bufferKernel logging and systemd's journalctlUsing printk log levelsThe pr_ convenience macrosWiring to the consoleWriting output to the Raspberry Pi consoleEnabling the pr_debug() kernel messagesRate limiting the printk instancesGenerating kernel messages from the user spaceStandardizing printk output via the pr_fmt macroPortability and the printk format specifiersUnderstanding the basics of a kernel module MakefileSummary QuestionsFurther reading

Technical requirementsA "better" Makefile template for your kernel modulesConfiguring a "debug" kernelCross-compiling a kernel moduleSetting up the system for cross-compilationAttempt 1 – setting the "special" environment variablesAttempt 2 – pointing the Makefile to the correct kernel source tree for the targetAttempt 3 – cross-compiling our kernel moduleAttempt 4 – cross-compiling our kernel moduleGathering minimal system informationBeing a bit more security-awareLicensing kernel modulesEmulating "library-like" features for kernel modulesPerforming library emulation via multiple source filesUnderstanding function and variable scope in a kernel moduleUnderstanding module stackingTrying out module stackingPassing parameters to a kernel moduleDeclaring and using module parametersGetting/setting module parameters after insertionModule parameter data types and validationValidating kernel module parametersOverriding the module parameter's nameHardware-related kernel parametersFloating point not allowed in the kernelAuto-loading modules on system bootModule auto-loading – additional detailsKernel modules and security – an overviewProc filesystem tunables affecting the system logThe cryptographic signing of kernel modulesDisabling kernel modules altogetherCoding style guidelines for kernel developersContributing to the mainline kernelGetting started with contributing to the kernelSummaryQuestionsFurther reading
Technical requirementsUnderstanding process and interrupt contextsUnderstanding the basics of the process VASOrganizing processes, threads, and their stacks – user and kernel spaceUser space organizationKernel space organizationSummarizing the current situationViewing the user and kernel stacksTraditional approach to viewing the stacksViewing the kernel space stack of a given thread or processViewing the user space stack of a given thread or process[e]BPF – the modern approach to viewing both stacksThe 10,000-foot view of the process VASUnderstanding and accessing the kernel task structureLooking into the task structureAccessing the task structure with currentDetermining the contextWorking with the task structure via currentBuilt-in kernel helper methods and optimizationsTrying out the kernel module to print process context infoSeeing that the Linux OS is monolithicCoding for security with printkIterating over the kernel's task listsIterating over the task list I – displaying all processesIterating over the task list II – displaying all threadsDifferentiating between the process and thread – the TGID and the PIDIterating over the task list III – the codeSummaryQuestionsFurther reading
Technical requirementsUnderstanding the VM splitLooking under the hood – the Hello, world C programGoing beyond the printf() APIVM split on 64-bit Linux systemsVirtual addressing and address translationThe process VAS – the full viewExamining the process VASExamining the user VAS in detailDirectly viewing the process memory map using procfsInterpreting the /proc/PID/maps outputThe vsyscall pageFrontends to view the process memory mapThe procmap process VAS visualization utilityUnderstanding VMA basicsExamining the kernel segmentHigh memory on 32-bit systemsWriting a kernel module to show information about the kernel segmentViewing the kernel segment on a Raspberry Pi via dmesgMacros and variables describing the kernel segment layoutTrying it out – viewing kernel segment detailsThe kernel VAS via procmapTrying it out – the user segmentThe null trap pageViewing kernel documentation on the memory layoutRandomizing the memory layout – KASLRUser-mode ASLRKASLRQuerying/setting KASLR status with a scriptPhysical memoryPhysical RAM organizationNodesZonesDirect-mapped RAM and address translationSummaryQuestionsFurther reading
Technical requirementsIntroducing kernel memory allocatorsUnderstanding and using the kernel page allocator (or BSA)The fundamental workings of the page allocatorFreelist organizationThe workings of the page allocatorWorking through a few scenariosThe simplest caseA more complex caseThe downfall casePage allocator internals – a few more detailsLearning how to use the page allocator APIsDealing with the GFP flagsFreeing pages with the page allocatorWriting a kernel module to demo using the page allocator APIsDeploying our lowlevel_mem_lkm kernel moduleThe page allocator and internal fragmentationThe exact page allocator APIsThe GFP flags – digging deeperNever sleep in interrupt or atomic contextsUnderstanding and using the kernel slab allocatorThe object caching ideaLearning how to use the slab allocator APIsAllocating slab memoryFreeing slab memoryData structures – a few design tipsThe actual slab caches in use for kmallocWriting a kernel module to use the basic slab APIsSize limitations of the kmalloc APITesting the limits – memory allocation with a single callChecking via the /proc/buddyinfo pseudo-fileSlab allocator – a few additional detailsUsing the kernel's resource-managed memory allocation APIsAdditional slab helper APIsControl groups and memoryCaveats when using the slab allocatorBackground details and conclusionsTesting slab allocation with ksize() – case 1Testing slab allocation with ksize() – case 2Interpreting the output from case 2Graphing itSlab layer implementations within the kernelSummaryQuestionsFurther reading
Technical requirementsCreating a custom slab cacheCreating and using a custom slab cache within a kernel moduleCreating a custom slab cacheUsing the new slab cache's memoryDestroying the custom cacheCustom slab – a demo kernel moduleUnderstanding slab shrinkersThe slab allocator – pros and cons – a summationDebugging at the slab layerDebugging through slab poisoningTrying it out – triggering a UAF bugSLUB debug options at boot and runtimeUnderstanding and using the kernel vmalloc() APILearning to use the vmalloc family of APIsA brief note on memory allocations and demand pagingFriends of vmalloc()Specifying the memory protectionsTesting it – a quick Proof of ConceptWhy make memory read-only?The kmalloc() and vmalloc() APIs – a quick comparisonMemory allocation in the kernel – which APIs to use whenVisualizing the kernel memory allocation API setSelecting an appropriate API for kernel memory allocationA word on DMA and CMAStayin' alive – the OOM killerReclaiming memory – a kernel housekeeping task and OOMDeliberately invoking the OOM killerInvoking the OOM killer via Magic SysRqInvoking the OOM killer with a crazy allocator programUnderstanding the rationale behind the OOM killerCase 1 – vm.overcommit set to 2, overcommit turned offCase 2 – vm.overcommit set to 0, overcommit on, the defaultDemand paging and OOMUnderstanding the OOM scoreSummaryQuestionsFurther reading
Technical requirementsLearning about the CPU scheduling internals – part 1 – essential backgroundWhat is the KSE on Linux?The POSIX scheduling policiesVisualizing the flowUsing perf to visualize the flowVisualizing the flow via alternate (CLI) approachesLearning about the CPU scheduling internals – part 2Understanding modular scheduling classesAsking the scheduling classA word on CFS and the vruntime valueThreads – which scheduling policy and priorityLearning about the CPU scheduling internals – part 3Who runs the scheduler code?When does the scheduler run?The timer interrupt partThe process context partPreemptible kernelCPU scheduler entry pointsThe context switchSummaryQuestionsFurther reading
Technical requirementsVisualizing the flow with LTTng and trace-cmdVisualization with LTTng and Trace CompassRecording a kernel tracing session with LTTngReporting with a GUI – Trace CompassVisualizing with trace-cmdRecording a sample session with trace-cmd recordReporting and interpretation with trace-cmd report (CLI)Reporting and interpretation with a GUI frontendUnderstanding, querying, and setting the CPU affinity maskQuerying and setting a thread's CPU affinity maskUsing taskset(1) to perform CPU affinitySetting the CPU affinity mask on a kernel threadQuerying and setting a thread’s scheduling policy and priorityWithin the kernel – on a kernel threadCPU bandwidth control with cgroupsLooking up cgroups v2 on a Linux systemTrying it out – a cgroups v2 CPU controllerConverting mainline Linux into an RTOSBuilding RTL for the mainline 5.x kernel (on x86_64)Obtaining the RTL patchesApplying the RTL patchConfiguring and building the RTL kernelMainline and RTL – technical differences summarizedLatency and its measurementMeasuring scheduling latency with cyclictestGetting and applying the RTL patchsetInstalling cyclictest (and other required packages) on the deviceRunning the test casesViewing the resultsMeasuring scheduler latency via modern BPF toolsSummaryQuestionsFurther reading
Critical sections, exclusive execution, and atomicityWhat is a critical section?A classic case – the global i ++Concepts – the lockA summary of key pointsConcurrency concerns within the Linux kernelMulticore SMP systems and data racesPreemptible kernels, blocking I/O, and data racesHardware interrupts and data racesLocking guidelines and deadlocksMutex or spinlock? Which to use whenDetermining which lock to use – in theoryDetermining which lock to use – in practiceUsing the mutex lockInitializing the mutex lockCorrectly using the mutex lockMutex lock and unlock APIs and their usageMutex lock – via [un]interruptible sleep?Mutex locking – an example driverThe mutex lock – a few remaining pointsMutex lock API variantsThe mutex trylock variantThe mutex interruptible and killable variantsThe mutex io variantThe semaphore and the mutexPriority inversion and the RT-mutexInternal designUsing the spinlockSpinlock – simple usageSpinlock – an example driverTest – sleep in an atomic contextTesting on a 5.4 debug kernelTesting on a 5.4 non-debug distro kernelLocking and interruptsUsing spinlocks – a quick summarySummaryQuestionsFurther reading
Using the atomic_t and refcount_t interfacesThe newer refcount_t versus older atomic_t interfacesThe simpler atomic_t and refcount_t interfacesExamples of using refcount_t within the kernel code base64-bit atomic integer operatorsUsing the RMW atomic operatorsRMW atomic operations – operating on device registersUsing the RMW bitwise operatorsUsing bitwise atomic operators – an exampleEfficiently searching a bitmaskUsing the reader-writer spinlockReader-writer spinlock interfacesA word of cautionThe reader-writer semaphoreCache effects and false sharingLock-free programming with per-CPU variablesPer-CPU variablesWorking with per-CPUAllocating, initialization, and freeing per-CPU variablesPerforming I/O (reads and writes) on per-CPU variablesPer-CPU – an example kernel modulePer-CPU usage within the kernelLock debugging within the kernelConfiguring a debug kernel for lock debuggingThe lock validator lockdep – catching locking issues earlyExamples – catching deadlock bugs with lockdepExample 1 – catching a self deadlock bug with lockdepFixing itExample 2 – catching an AB-BA deadlock with lockdeplockdep – annotations and issueslockdep annotationslockdep issuesLock statisticsViewing lock statsMemory barriers – an introductionAn example of using memory barriers in a device driverSummaryQuestionsFurther reading
Why subscribe?
Leave a review - let other readers know what you think

Content preview from Linux Kernel Programming

Section 2: Understanding and Working with the Kernel

A key reason why many struggle with kernel development is a lack of understanding of its internals. Here, some essentials of kernel architecture, memory management, and scheduling are covered.

This section comprises the following chapters: