Let's stop recording.
Okay. Good morning, everyone. I'm just getting started, I was gonna start with a with a poll here.
Let's just say I'm kind of curious where you all are.
There we go. Let's go to
see how people are doing here.
Yeah, except well the last question was extra credit.
So that's, that's why it's extra credit.
Okay.
Okay, give you all different minute to do things.
Meantime while you're finished up. So, um,
so I want to continue talking about today about kernel modules
modules.
Okay.
So let's see. Okay. And the pole there. So you all y'all can see that, okay a quarter of you have finished.
So, you know, so yeah.
After you're finished, then quarter view are still working on it, and you know it's hard, and still get started. Now, I've noticed that we've only got 70 people.
We got the only about 70 people here so a lot of people aren't showing up so I'm guessing Oh, this poll is not quite representative.
Anyway, let's get let's get started here So, uh, So the plan for the rest of the term.
If you look where we are right now.
Okay.
So we're now sitting here at lecture.
No word lecture 19 here. So, It seemed like since everyone seems to be behind judges the number of people have shown up.
Okay, so there, so I'm not going to have class on Thursday I'm going to go visit some family things on there so it's like it worked out for me I was, I had actually made provisions to teach but it seems like you guys see like us a break.
So, So we're in class there.
Then we have class of the week, two weeks. And then the final exam.
And so what the.
So in terms of things here we're still going to have the same tutorials I released tutorial eight yesterday and tutorial nine will come out there and assignment for is coming out.
I plan to, you know, get it by tomorrow it should be up.
And so, to find that for shouldn't be too bad it'll be mainly based on a site on tutorial seven eight tutorial nine.
You should do tutorial nine and there'll be a little bit of it but only a high level concepts in the thing but it's a useful exercise for you to understand things, basically, you'll actually get a more concrete sense of what the colonel does in terms
of page table management.
The due date for assignment three to midnight.
Yeah, exactly.
Yeah, exactly. Yeah, exactly. Yeah, I'm gonna, I have an extended right now to the. So yeah, it's not.
Yes, do I have to do the 28th, and actually its final acceptance is just before class on the 30th. So you have to have it in, by, by the next lecture about by the by November 30 because I'm going to visit by the next lecture, because I'm going to present
solutions then.
So,
is tutorial nine Mark tutorial nine is Mark like any other tutorial for participation.
So I was gonna ask if people are.
If people have it, so it looks like you missed some announcements on teams. I sent out a broadcast on Team saying like, it's extended. So yes, you should allow for notifications from the teams out because then I can tell you things.
Anyway, um, to see from forget.
So yes, so that's kind of the plan here.
Ah, I'm trying to remember where we, we talked about last time we talked about, Todd CPU.
Okay, so I have not actually gone through the code engine details, let me go through that, for a tutorial seven. Actually, I'm going to skip ahead before I do that, I'm going to talk about tutorial eight first because tutorial eight is actually.
So there's more to say about tutorial eight but I want to give you at least a little introduction to it.
And then we'll go back to drill seven, and we'll talk about kernel modules in more detail.
tutorial eight is all about.
So it's about the to producer consumer problem, classic problem currency.
It's probably one of the simpler ones, but it's not. I wouldn't say simplest I'm sure it was like simpler but it's one of the classic ones. It's important.
One of the reasons I like to cover it. Well first of all, concurrency is a huge topic.
Turns out the design of operating systems are
really look at how they're internally architected, it's really all about concurrency to the person consumer linked to economics, not really.
Although me. What's really about is.
So we think about producer consumer, you should think pipes.
Oh,
yeah. I think pipes by photos. Because, so if I do
you know if I do LS.
Bless.
So why SSH here.
So if I do.
So I do LS, and less.
ls is a producer, less as a consumer.
So, because this right now LS is producing so little. There isn't much you're going on but let's say I did.
So what's happening here if I cat slash Dev. Dev random.
Okay, so let's.
So let's gonna do this just to kind of see what's running here.
So now if I hit space here you'll see that, you know, less is showing up in the consumer here you know as you can see few, but if I stop, it's not doing much.
and notice the cat program, never appears.
So if we run.
So, so is the cat program runs inside less noon and and you know these. So when you do a vertical pipe.
You do this, what you're doing is the standard out recall the standard iOS, so
less.
So,
so what so when we don't see cat is the case of the cat pretty so much less has to consume all that the cat will start producing. Exactly. basically, there's, there's a buffer implicitly.
This is as part of the pipe. There is this buffer between them.
And.
so this is kind of a, so the producer consumer you can think as a model is really all about coordinating different rates of of activity, and that when you have a dependency of process be depends on process, a.
They have to coordinate their activity. And when a producer stuff.
It may produce at a rate faster than be, then we can consume it or vice versa. And so you have to have some coordination mechanism so that means is you have to you have to, you have a buffer between them to coordinate.
So, so.
ASCII art here.
So, so see this here the producer is so when the producer when the buffer is full, it's like, I can't help it anymore. There's nothing to do so I'm going to go sleep, and then wait for the consumer to wake it up to say hey, There's room now you can produce
some more. And similarly the consumer will sleep when the bumpers empty, and we'll wait for the producer to wake it up to say hey, there's something for you to do now.
So in the example Did you catch dev you random dev random is the cat Devereux you random is the producer know a god, this is so.
No, no, no, this is so.
So,
is it.
So, basically by having the producing consumer coordinate via this buffer and by sleeping and waking up each other. That makes sure that your that business entire process happens at the maximum rate possible by allowing for the maximum amount of concurrency
that we can have.
And, yeah, so you have to, so but.
So the buffer So note that what is so.
yeah.
When you call pipe.
I'm
gonna good yeah you need to call it using a struct where you call it here.
And you always call with the structure but the idea is that you have to file descriptors.
in the kernel, you have a buffer.
Because all we're doing is behind the file interface. And so, one, you have to file descriptors you can do a right to one of them and we do a right to one of them, it because you can read it from the other one, you know, and I don't.
Yeah, so.
So is it possible know the rates of which the producing console works though, the rates on.
So I'm in general.
Even only know the rates of producing and consuming empirically because I'm one of the fundamental rules of computer science is that you can't predict program behavior up any property of program behavior completely in advance.
Do you all know what that problems could known as not being able to characterize properties of a program in advance, at least not algorithmically
anyone.
Is it the halting problem.
It's the halting problem. Yes, that is the halting problem because any, any property of a computation of a property of a program can be reduced to, will that program.
Stop halter not on a given input.
So, this is why things like virus, you know, malware analyzers and compiler optimizations. I mean so many classes of things and run up against the halting problem because you can't know whether a program is going to have a property and not in general.
So, the producer consumer paradigm is all is really there because you can't know exactly what the relative rates are so let's coordinate these processes, so they can work together now.
You can adjust a week and then empirically like check it and go like, wow, the producer is always waiting on the consumer so maybe I should optimize the consumer or vice versa, that you know, you know he noticed that the consumers was waking the producer
and you can get noticed this you can notice how often is the producer sleeping or how often is the consumer sleeping in terms of in how this thing is built.
And ideally, neither of them ever sleep and stuff is just coordinating the buffer. That's when they're running at the same rate. So you can always find out which is the Slowpoke by noticing who's sleeping basically the one who's sleeping into slow one.
The other one is.
So there's two questions here.
Does the consumer have to read their entire buffer before the production right again or just nice mostly. So the trick is, is that the consumer.
slots.
There's many slots, the whole point is that you don't do the whole thing at once because if you did the whole thing at once, it would be slower.
Through our CRISPR or a threshold I'm not quite sure what you mean there own
which which consumes the most resources on that completely depends, It's there's no way. Yeah, so it's.
Yeah, ideally the buffer should never be full or empty so no one ever sleep so that way they're both running at the same time, in general, that will not happen because that means you have to have a producing consumer that run at the same rate.
And that typically doesn't happen you might want to have them close, but sometimes one of them is going to go fast the other and in fact, typically, for real world applications, which is faster will vary from time to time.
Sometimes appears to be faster sometimes the consumer will be faster and it will just, you know, do that so so yeah so so so I say circular array. It's a circle right because you started the because you're going in a circle always your be the buffer.
You know, it's like you have 10 spots. And so, you know, producers producers in 1234568 910. And then, and then goes around to one again to advisor, you know, it keeps it keeps going in a circle, and the ideally the producer is just going, producing continuously,
and the consumer is because by the time it gets to 10 it wants to get back to one and one should have been consumed by the consumer.
So, this.
So you can see this is a classic. This is a simple model of concurrency, this is something that happens in the real world lot. We have things like five I was having two programs running concurrently, maybe on a local machine or maybe over a network you
think of a producer consumer problem is something that you have, you know, two machines connected by some sort of socket connection sending data back and forth that can be modeled as a police consumer as well. But notice, Whatever the context.
You have to.
There's this coordination problem. And this coordination problem is non trivial.
And I will talk about this more later. but that's essentially what you're doing in this tutorial is running three implementations of the producer consumer problem.
3000 pc FIFO 3000 pc Rhonda go through thousand rendezvous timeout so 3000 pc FIFO, so all these programs do.
It's pretty simple.
doors closed.
It's a one way street. Yeah, exactly. Um, so now we've got this country thousand PC so we've got here.
So you can do a make here I got 3000 pc FIFO, so if you just run it, it tells you, and so you can tell it like 21 one.
So what's happening is the producer is reading random numbers and picking random words, and then the consumer is basically getting those words. So it's really a very trivial.
One
is the priests are always working with only one consumer vice versa know in general you can have multiple producers and multiple consumers.
The code implements only a single producer and single consumer.
An optional thing for you to try is trying to extend it to be multiple producer multiple consumers.
Yes, that is the NATO phonetic alphabet Yes.
Now, you'll notice right now at the top. So this tells you this matters how often the sleeps.
The person the consumer, but I can do 00 and now they won't sleep.
And so then you see they know do this.
Now the important thing to know is that all three programs should work the same in principle.
The first so here's the you know the word list here. So basically we pick a word we output a word Bq a word. Next word. So, you see, here's the producer here's the consumer, and you should notice that this actually isn't, you know, 3000 Producer consumer
FIFO is not very complicated. It's a couple of its in its 210 lines, but you look at it and you see there's, you know, a lot of its, it was will make a pipe, we create a child, the child process, you know the producer rights to, you know, you know, one
of them the consumer reads from the other.
And then that's it I guess it was consumer summer, I forget what the ordering matters. But, so, they both have these file descriptors to produce here ones in the producer ones the child, we make the pipe first then we fork.
So, you should play around to understand this the consumer. Basically, you know, get some next word and outputs the word and sleeps between them as necessary.
This one, you know picks a word and puts it, you know, in the buffer.
And then waits if necessary. So, two processes, communicating once picking words the other ones out putting the words.
They're the only interesting thing here is the production part.
How big is the buffer. So, notice that in a 3000 pc FIFO, we don't have that buffer right.
Yeah, the word list size the buffer is
shoe sizes 32 Yes.
So we have up to 32 words here and so here's the word word size.
That's word size where's the Q, what do I do Cliff qo right.
Actually I don't think I use the Q size in.
So no in. So there is the queue size thing in this program, but you sighs isn't used in this version of the program. Because, so.
So, the colonel.
The colonel buffer How big is it honestly, I don't know if this. So there's the only shared, you know.
me all you have is the pipe.
So 3000 pc rendezvous is
is more complicated.
And notice it is.
It's, you know almost 100 lines.
And the big thing here is, it makes a shared buffer.
And that is the shared resource. This is the buffer between the producer consumer, we use a special em map call to make it shared. And so what we're doing is we.
So, so, so basically the two processing of portion memory now.
Essentially what you should regard this tutorial is.
This is basically what it says in general.
3000. This is really why multi threaded programming is is not really much fun and is generally not worth the effort. I'm not saying it's never worth the effort I mean if you're making a very high performance bit of code, and you're trying to maximize
system resources, yes the maximum performance, you can get is by doing things multisport well
yeah I have never seen anything. It's just mostly fat now here's the funny thing here is if you look at and in fact, but this version of the program 3000 pc rendezvous.
I believe used to work.
it does it.
This is actually broken.
So, 3000 pc rendezvous can deadlock.
So, what do you what what do I mean by deadlock in a very specific sense I probably you probably know this general notion that song deadlocks it stops making progress, but given this description.
What would a deadlock look like.
It's a fundamental failure of coordination programs stuck sleeping Yes, exactly. So specifically, what deadlock look like in producer consumer is the producer is sleeping.
and the consumer is sleeping. If both the producer.
So, so how can this. So how can that happen when it really you know the way.
It's.
So, Bruce and consumer sleep at the same time we'll talk in more detail about what I'm about the conditions for deadlock. There's. So, I actually refer you guys the textbook for this tutorial.
And there's a lot of treatments, about this and there's classic things about deadlock. But the general thing to know about deadlock is in practice, how we solve deadlock is by having timeouts.
She has this.
Is there a deadlock example for pipe.
No, there is no deadlock. there is no dead locking in the pipe because it just can't happen because of how its structured, in principle, I mean, you could have a bug in the kernel with how the pipes implemented and that could cause a deadlock, but nothing
in user space can cause a deadlock. Because, at least with the way that you could make one with the structure that producer consumer one's reading ones writing it's very straightforward.
So,
yeah, I saw you cell phone so so exactly so that's the fun thing is I'm.
so it just basically if you run this on a multi core system. This will lock up that particular I'll show you.
So let's do so one thing when you're running this to be at maximum speed you should really write two.
So okay so that was that works there. Now, if I do.
Yeah stock.
But if I run.
Yeah.
So yeah so 3000 Ronnie woo timeout, who finishes the thousand rendezvous for larger numbers will deadlock
seem slower on play with it, but you should notice a difference in performance and actually in my with this particular program 3000 pc FIFO is actually the fastest
by a good bit.
So, uh, so yeah so it's this.
So in principle, 3000 pc FIFO, the FIFO based one should be faster, it should be the slower one, because it is requiring a system call to do every operation so this 3000 pc FIFO is doing a lot of system calls for the communication.
And you think that would be very slow because you have to all the system calls. And here we're doing things purely in user space.
But it turns out these, the things are running so fast and the coordination happens that basically this thing keeps walking up and pausing so often that this doesn't work.
I think that you can get faster performance by increasing the size of the buffer, the buffer right now and 3000 pc rendezvous is very small. If you increase the buffer size to something much larger, you should get comparable performance I think between
these two, but it doesn't get rid of the possibility of deadlock.
And that's why you have to have this thing so basically all that deadlock says is if neither the producer consumer have done anything for a while. They both kind of go like hey are you awake.
And then wake each other out.
If you have a bigger buffer you'll deadlock less often.
Yes.
So,
play with this, this will give you some intuitions I think about concurrency concurrency is a very big topic.
But what I really see this as is us the operating systems mechanisms, when you can, for coordinating things rather than implementing your own with shared memory.
It's not that you can't implement it was shared memory of some kind, either by doing some that multiple multi threaded process, or by you know having to process the share buffer, you certainly can do it.
But getting it to actually work well.
So easy, and unless you're sure you need that performance.
I wouldn't bother pipes work really well and there's other various IPC mechanisms and,
yeah, use those.
Let's go back to.
So, so, note that the.
And if you're in the class textbook, there's a nice thing about condition variables Semih fours.
So there's, I'm not going to go into it, it's good for you all to know, frankly, we have so much material to cover in this course we can't cover all the concurrency there even though it's really a central thing so like there's a concurrency bugs that
one tells you all the stuff so the whole concurrency chapters are really good to look at, but again that's not gonna be so much on the test.
I can't test you so much that I've got lots of other things to cover but usually the basic ideas.
What I am going to ask you more about
is this.
So, so at this point. So it was so if you haven't started playing with it so.
Note that you can make
you make name pipes.
So I don't know if I've actually shown the name.
Oh, the trace command was not working for you in this tutorial.
Could you, Jason, could you not run the trace command.
Like when you typed in trace.
Like you can't do man trace. You do.
I'm so like when you say it didn't work.
Oh, the specific trace command doesn't work. Okay. I thought I fixed that.
Okay so so the.
Which one is specifically didn't work, this one.
Okay, let me see.
This one I know worked.
I will check those.
I'll check those after tutorial and make sure that once they travel is is that stuff with trace keeps changing, I thought this one worked though.
I'll make sure that
you have to if you're if you're using the 2021 one, I can't. It can't be sure but anyway let's, let's go ahead and look at this code here and we can try playing with it so boy if I were first walk you through it before you do things I can get the command
working after class.
So we have these basic modules. And so, so what is.
What we're doing is we're inserting code into the Linux kernel.
So, you always do an ls mod.
You think Alice mom gets its info.
Flash proc. Can you insert code into the Mac OS and Windows kernels.
General.
Most device drivers on most operating systems, not all device drivers, some of them are run as processes, and just have an interface, but I would say many if not most, when you install a device driver, what you're actually doing is injecting code into
the Linux kernel.
So any sort of phone feature I mean the latest kernel has all kinds of features, all kinds of mechanisms and stuff. So, that stuff that isn't core to it is putting modeled in fact most of the core of a modern Linux kernel is in modules.
So, so potentially kernel modules could be quite dangerous to to you to us. Yes.
So code running in the kernel is strictly more powerful than any new.
Anything running in a process running his route has to ask the colonel still to do things. The colonel will generally say yes but it's asked you to ask it so it's not a root process can't do things like mess with internal Colonel data structures.
But a kernel module can do anything it wants with any data structure inside the colonel.
Yes, running t seven locally yeah running it in your local machine can. Yes, definitely.
Running into VM, either on OpenStack or locally, don't mess with your local Linux system, you could lose everything. If you mess things up enough I probably you're just going to crash things but,
Yeah, don't do that.
Ya know, Colonel and root are not the same thing remember.
running process can load kernel modules. So if it loads a kernel module, then it could mess with everything.
Okay, come on animals
can curl code in different languages, I'm
the colonel is.
basically see the latest kernel code is cc is really just. This is in one of the key use cases for see was really writing.
operating system kernels because C is essentially.
That's what he was intended to be was a portable assembler something that could give you the performance of assembly, but without dependencies on the particular, you know, CPU
core video camera.
So, is user mode in user space the same thing. Yes, user space.
So that's new space.
I think it's great for people to do things in rust, but the remains to see how much benefit they will get from doing things and rust, because it's not clear how much of the semantics of rust actually come into play because the whole point of doing things
in rust, is that the compiler can be sure that things are safe.
And if it's not safe it becomes a compile time error.
But kernel code does unsafe things all the time. And so, if you just have to mark bunches of your code in rust is unsafe. You could certainly do everything but then why didn't you just bother doing it and see, it's like you don't really have much of a
benefit the real winner of see of us, is if I can give you some additional safety benefit.
Um, I don't know, they're working on it, it'll be interesting to see what code they come out with.
Yeah,
question, Russ is a rough does a programming language, look up the rest language it's it's, um, rust actually came up for those of you that do know who developed rust first, who was who was the original post by grace it's become much bigger than that
The mentioned, it's Mozilla Mozilla is the organization that Mozilla came up with the one behind Ross because they wanted a better language and c++ for writing, Firefox.
I'm
learning C is good, a learning rust is also good you should never be afraid to new learn another programming language because there are so many programming languages and programs are good for different tasks, you should.
While you can't be good at every programming language, you should never be afraid to learn a new one, because they only teach you new things and then potentially will inform you when you write in other programming languages.
So anyway, but so what's the basic structure of a kernel module. What you do is you have to include some special declarations, some includes notice these includes, do not include.
So first off, you can't include any standard C library headers in C code that is in the Linux kernel. Because anyone know why.
So do modules need to include certain file operations kernel modules don't understand files here because.
Because.
for the basic thing is the kernel code can't make system calls directly.
This is the code that implements system calls, so it can't depend on.
And
so, basically, they all depend upon system calls so you can't use them
for.
So, the ways Pro has lots of things to help you out to help build things but its its own world because you can't use system calls.
talking directly, well it's not was not talking, it's, you can't do stagnancy there's no system calls.
So,
and this is this is a minimal things you know it's all the include files, there's no standard see thing that's all Linux slash something, we have we have some declarations of like bit some metadata because module expect to have some metadata.
And then we define some functions and we have to always defined the module what starts the module and what exits the module.
So the colonel knows what function should be called, you know, for these things so you have to have this, these two things this is, this looks kind of weird.
These are special macros for doing things which are declared know which are in here, and then you have your code.
I don't even I don't get the thing that receives system calls can't make some calls.
Exactly. So.
can be producing, so it's a different idea, but, um, so does this help does this help you all understand what I'm talking about. No, it's,
it's using it can't implement the interface because I mean, you could try having it make a sizzle call but then you would have to literally the colonel would have to switch to user space, do the thing and make a kernel call and then go back in.
So, we haven't talked about how system calls work.
I will I will talk some about that to try to help build up your mental model, but I'm not going to test you on it specifically because it just starts getting very very complicated very very fast.
But you can see a basic kernel modules really simple. Here, it's just, this is something you know in it, and exit and it just prints these messages now know where are these messages going.
So, you also you can also see it using
system D has a way of getting it.
Well so system calls only happened from user space but similar things can happen the Chrome. Yes, they can. But you're going to use a different interface inside the colonel.
In fact, in the kernel.
The colonel you can make function calls to the code that does things but it's weird because that code assumes that students in for a process, but there's no process you're doing it for you have to kind of fake it and it gets all kind of weird and we,
it's, it's to the point that in the kernel, writing to a file is generally easiest to do by running a user space program, and having it right to the file, rather than doing it directly from kernel space.
It's just, yeah, it's bad.
Colonel header files implemented see. Yes, because it's also
girl head across it but so if I want to look at the messages on here.
Okay.
message.
So you can run D message and see the messages coming from there, but it's probably easier.
To do this, we can watch the messages there.
directories. So let's grab the kernel modules here.
Copy Link.
Make it.
So notice we did a print off here.
And we got a couple of messages here, and I'll explain these in a second here. And then pseudo
by Colonel so so here we got our messages here. Hello, goodbye are showing up the colonel log
know, you kind of logs ever go away.
They can get quite full.
Yes, they can
log files.
If you look at your log files they do get rotated. You'll notice that logs, there's automatic things where basically every.
So you'll notice here on this VM. So like, November 23 is here November 19 was an older version and then the older version was November 14 and then it basically older ones get compressed.
And then eventually they start getting deleted and this is sort of an automatic routine that happens.
Yeah, that they're also, I suggest just looking at var log, just looking at the colonel log for log Colonel on there it's updated their regular, but yeah, if this file gets too big.
What if, if the log gets too big, you can just delete this file and reboot.
Will the colonel ever force us to reboot the log file gets too big.
No, definitely won't, but it will fill up your disk.
And then you'll have to deal with all the problems of a full desk.
But so if it gets too big, you can just delete it, but you have to really go to space back because.
So here's a weird feature of the, of the Unix API with file opens, is that when you open a file.
I don't know if it's actually shown in the file system I haven't checked this but to me if I,
Yeah, no, it just shows it as one but technically in the kernel, an open file will have a reference count increment it for as long as it's open.
And because of that, it won't reclaim the I know, and thus the file, until the file is closed. So you either have to these ways just to reboot the system, or you could tell the logging program to close and reopen things actually sick hop I think there's
can also send that signal.
But, so messages are going to the colonel log. So that's how you can find out what's happening with your modules.
And if you get to where you can get delete them, but
what what's going on here with these messages.
I don't know what this is saying, where these messages.
This is stuff bait so it turns out the Linux kernel, more messages are coming.
This is what's so if you're looking. If you're looking for like you don't want to deal with all the stuff which you always do is
just what you do
for.
So, so if you do this, then all you would see is.
to the work.
That's fine.
Go.
Oh, Well that's, that's okay that's interesting.
Either watch it. Yeah, exactly.
So, this so that that will that will tell you it so what am I doing right here is I'm just grabbing for 3000 and make sure it's only log messages that are excellent to us, but there's some stuff going on here for
app armor in app armor is telling you about, you know, various things to your modules and stuff, but the the thing I wanted to point out here with these two messages, is just to point out that
module verification failed senior trainer required missing key missing.
sign to know for those of you who are trying to do this I want to try loading the modules on your desktop system.
It ain't so easy on a modern Linux system because most desktop systems including Ubuntu on my system. If I try loading a module on my system it will save that lockdown is enabled.
And because lockdown is able any module that isn't properly signed
won't work. Basically, I'll just say no, it's not signed, go away.
Basically this is the same thing as the code signing when you know downloads on Windows and saying is this from an authorized publisher or not exactly the same mechanism.
Just a different messages about it.
And the Linux kernel can be set to not allow unauthorized modules be loaded but the kernel in a way to allow it, or you can add notes, you can set up your own keys and you can sign it yourself and there's all kinds of ways you know to do that but it's
it's a pain, beyond the scope of this class, and we in fact don't need it, because we're running in a VM it can't have trusted boot running. And so it can't do the proper verification so up for the base of the lack of sync lockdown mode is enabled on
on the virtual machines. And so we can load any module, it will just whine about it.
So, BPF tools is observing the colonel lot
about, you
know a boon to on.
So let me, I'll just demonstrate what I mean. So if I take this.
So I'm going to log in. So here's my current system. This is my desktop.
Let me
copy link.
So, that's what you get.
And so, in fact what you get
here is like lockdown in smart unsigned module loading is restricted see man, Colonel lockdown. So if you get this message on your system.
It basically you won't get this message on the virtual machines in Melbourne running exactly the same version of Ubuntu on the VM, as I am here. It's just here.
I have locked down as enabled because I have secure boot enabled on my machine.
And it's not enabled on the VM.
So, you can do it.
So, yes, one two minds.
But only if lockdown. So, last thing is, where does he bps said in here it's this.
So, EBPF is kind of like kernel modules in that it allows you to insert code into the kernel, but it does so it will you through this verified.
no checks on regular kernel modules beyond code sign. You know, it's basically you load it you can do whatever you want. I mean,
there is some basic sanity check when you insert the code like this this is a kernel module I can't load this What are you talking about, but once you pass the basic sanity checking in the code signing the kernel module, you can just load it and do whatever
you want. EBPF, you can't you can't do in lots of things, so.
by default you asked me a chunk process.
So, EVPF code can see everything, because it's running in the kernel.
but p trace based programs.
Can't see so much because they're, you know,
they're running inside of the.
There's, there's making system calls to control into the process.
Gentlemen, you don't want to use p bass bass mechanisms.
Because they can mess with the program but he VPN, you can use all the time.
Because the kernel basically no one else's as aware of it at all.
So that kind of fills in a little bit. Now, in terms of what this kernel code is doing so, the ones module just doing the simple prints. These are
my say.
there's a print k function print from the kernel which is in general the way you write to the log.
You can either call pre k directly or you use a macro that turns out print Ks syntax is a little funny.
So it's kind of nice to use something
EBPF is not using kernel modules, it's a completely separate mechanism. It's a much newer mechanism for inserting code into the kernel it is injecting code.
But it's not by a module, its its its own thing and it's it's quite cool but it's very much newer than the classic kernel modules, it can't do everything that kernel module can, but.
Oh, VP of code is C code.
bebber is a beat. So, the doc bt code is for the BPF trace.
So me. So BPF trace few.
So if you look at BPF trace. I its options one of its options.
There's a tracing
process.
There's a way I think to have it actually output the.
Where's the.
I think there's a way to get it to output the binary code that it generates. I don't remember what it is. We have to say verbose verbose my, or debug might have to try it out by coach like assembly yeah so um.
So it's a byte code.
It's highly restricted but it's not really restricted by full verified by a virtual machine. And some people talk about the VP of virtual machine in terms of the model, but in terms of execution, it actually gets injected into the kernel itself, there
is various facilities that are there but it's doing okay we're out of time. So, anyway, so that is there like their own compiler Yep, there's its own compiler and everything.
There's an entire tool chain in fact we talked with the BCC tools. It's its own tool chain.