Okay, So let's go ahead and start
Good morning. Everyone welcome to the last lecture so there's so quick administrative stuff.
So first out. Sorry about a 3 almost
So a 3, 8, 4 will
Yes, one question for everybody, the whole. So the whole point of how grading the
Why I ask you to upload everything in this tax file in a very specific form.
That you validate is because I run it through a program to split them up, so that the so that when you we do grading, we actually just see your student. number.
And the answers for one particular question, and we do that for a couple of reasons.
One is because it makes grading faster, and too, because it makes great and fair, because we can't see what else?
You know we can't you know like see your names like oh, you've done 5 for these, so Oh, my right, but also it makes it fast.
So that's Why, I do that so like all the questions are great, except for one question, So it's like 10, eleven's done like this.
Yeah, So so it's yes, that's their alright
Yeah, my next week. Yeah, I don't know if I have time for it. It's like my next week.
I'm actually traveling some so i'm I'm not playing on having a review session next week next week,
So. so basically. So next week i'm not playing on having a review session, my next week is is too crazy.
But i'm happy to I I will be on teams I will be answering questions, and if there's something that comes up you will like I can't explain it to you via typing in i'm happy to have
a little ad hoc i'll get in a call and just say, okay, let's talk for 5 min and answer things.
So please do let me know. but in terms of you know you have.
You have all the things you need. now for the final exam we'll we'll talk about the material, but again you know
What's on there it's the a* for Midterm same format,
I'm not going to if you look at the midterm.
I did not give large programming answers. This is not enough time for large program answers, so you should not have to do any sort of code diffs or anything.
You might have to put a few lines of code but that's it again.
I'm not expecting you to be on it's I mean you have you have more time, but again there's a lot more material.
So you're gonna need to spend your time on on things bully.
Let's go ahead and start talking about the answers to the midterm.
So let's not this from the front of a assignment for so first several questions are actually pretty straightforward.
So download, build, install the 3 c. 3,000 proc report module.
What is it for the chrome log so you should have seen this? So what's saying is, remember the whole painting thing because the module hasn't been signed yet? what's funny is if I try actually loading if
I try loading these modules on my desktop.
They will build fine, but I can't load them because they aren't signed. If I wanted to sign them I would need to re if I wanted to install them.
I would need to basically get the module signed.
And There are ways to register keys to have out of tree modules and stuff, and a bunch of has little infrastructure for it, and I haven't researched exactly how to do it.
It's just like, but it is possible to do that to you know to add extra module, and there's packages to do that.
But like those packages like virtual box, which will pile out of pre modules and insert them into the kernel.
But those module and so you look to see how how it does that, and I could get that.
But I I didn't want to cover that in this class but notice that on a regular list reading what you actually have to go through that.
Otherwise the Colonel will just say no, at least, if your machine is set up with secure boot.
Huh? Yeah, you only get the tainting message once when you first start up your thing.
So if you just said this part that's fine but you know.
So that yeah, So I I mean yeah, you don't have to that that's fine.
Because i'm you know but it's good to note that this happens the first time.
But 2. what you know when you run, Proc. report.
What is the teacher? What is it report? So what is this? says?
You know this is the process Id of the of the process that called it just gives the virtual one The physical experience of the buffer passed in for operating this.
Sorry this All i'm assuming is pretty straightforward run in one terminal.
What does Bpf trace script report Why are we getting this output?
So what's your seeing is is this you know and the reason why, you see, this is because we have we basically attach probes to each function in their when those functions are called, And we also have one on the return value.
Oh, of the second one
Nobel asked me, as well as asking the participant marks later.
So this is again I I think this is just looking through the code.
So i'm happy to answer questions about this to explain it, but I think this is pretty soon now.
If you run One difference to note is, if you ran cat instead of this, instead of just want to read returning 90, you would actually get 2 reads, because here we said count equals one, which means only one read system call is if we do
cad will read until the read Return 0. so it no no bytes.
So it's end of is at the end of file so that's it.
No that that'd be one difference
Some of you got 92
Oh, without the null fix. Yeah, if you're running the old code without the null fix.
Then: yeah, yeah.
Doesn't matter, I I think you should be fine either one without the fix.
I'll i'll fix this this one what you should have seen as it hangs when you run you know if you're reporting what it said that's actually fine but essentially you're rent the old code
didn't think about that. the previous version was removed yeah i'll check that.
Maybe maybe this is from an old version. No, I think I fix that.
Maybe it is 92 I i'll check my i'll check it in a little while.
If you run the command. this what happens? What should happen is you just see?
Oh, that's it you'll see a read now, if that I didn't actually require you to do this does the Bpf.
Trace It gives you a little bit of insight it doesn't give you that much.
This other stuff here on me doing s trace this is how you actually figure out more what's happening if you do? an s trace
You see that you could also do this with Bpf Trace and get your trigger very on system calls.
But here you see that it is doing an Lc. a couple of times, and Lc.
Isn't supported by it and so for some reason after doing all these seeks the read just hangs, and it doesn't even call our function.
I don't quite know why, but that's what happens a release happens. We need a control seat.
Yeah, what was the thing? So
Wait I I So, Sean, are you talking about? question? 4
Wait. Are you single? so sean you're staying on a question, for if you hit control, d it continues did not try that.
I will have to update my solutions. I didn't even think to try. that calls for me.
Why, is it it's waiting for an o a close
Yeah. Release call. Oh.
I'm not sure why you get the release and then open anyway.
Oh, release won't fall into your fi that makes sense can you do that? Yeah, Yeah, yeah, you get the release once you once you kill it.
But but yeah, but like I i'm not no it makes sense that the seeks don't work because we didn't implement a Sikh actually it's normal on some devices not to be able to seek so there's no
bill that? But why the read it? doesn't even call our function?
Why is the read hanging that's what I don't quite get
Oh, it works with an output file
Oh!
What? Okay.
Okay, I will Okay, that's interesting
So we what happens if you give it an output, Thornda, if you get it an output file, what does it output?
It should output nothing
If vision creates the file. Okay, but what's in the file. I remember doing this, and there was nothing in the file is if you go to
If you look at the code
Oh! see!
Okay.
I just wanna bring up the code here, so what I expect is for it to. Because if the offset is non-zero here, and just to work, meet, this function should just return that because of this if you've got an office of 0
it's just be there, but
The seek is should be causing problems because it's changing the offset and see Well, it will change it.
So there's nothing but
Oh, well, Lc. was also, as Lc. may have been called, but it should have been called with a seek of 0.
If you did a so if you did a seek of 0.
The big thing is that this offset can't be non-zero. if this offset is greater than 0, this function cancels out.
So if it's greater than 0 then you should see something happening.
So we may. We will do some experiments in a bit.
Let me finish going to solutions that Well, if I have time at the end up. We've covered everything I can do that. But that's cause that's kind of an interesting thing, but it's not actually that important yeah.
Right I i'm i'm seeing things here so hey?
So this is well, this seek is actually the one that matters because this is one on a 0, and 0 is the one that is running, loading the device.
These don't actually matter. But why? is it doing a Okay, now, this makes a little more sense on why it would block
But I'm very confused, because it's really doing a read of one which is standard out, which is the terminal.
So it makes sense. Now why control D. would continue there. But why is Dvd doing a read on the terminal with?
We told it to output to the terminal. Well, if I specify the out file, then it will do that.
But okay, that's just weird. Yeah, yeah reading from the standard output.
Yeah, like, why is it mean? Okay.
Okay, anyway. let's that that yeah well that's Dd I mean So that's that's dde doing weird things.
It's like, Why are you doing that? I think that might be a bug in Dd.
Honestly, that's just I think Yeah, I think that might be a bug in Dd.
Because I think it's like what or is it it's Yeah, but notice that actually, we got lots of evidence of what was happening.
We just had to interpret it
Yeah, i'll have to fix my solution. this actually isn't right? Because it's It's blocking on reading from the terminal, from not from the device that's why our code is now being called so, that makes sense.
Okay.
Okay, Okay, So was the purpose of line 1 27 a call to put user.
So these these are the ones that are actually more interesting.
And this one's a really and so just be clear what is line 127.
We're talking about this line right here so this well this line right here.
This purpose of this is the copy to user space. the buffer that we built up with this message here.
So this is in kernel space in the P. You know the page.
We allocated this copies. It to user space you don't do put user in just new message to buy you know.
Equal, you know. Message sub i equals sorry buff sub i equals message supply, and then generate.
You will get a very big kernel groups.
So this that that's what you should be seeing if you did that?
Did you all see the Colonel hoops here for question?
5,
Did any of you see the
Did any of you see the This is kernel oops for question.
5 you will understand this. I mean I I think this is we it's pretty straightforward Once you understand that the what this code is doing.
Is it's copying data from kernel space which is message to user space, which is this: This is a user space pointer.
You can't just write to it from kernel space, and all of the pointers you in accent currently are kernel pointers
You read the implementation of put user really? Yeah.
You and try the eraver because I didn't want to break the colonelized world.
What's the personal question I worded it is
I didn't ask you specifically to test it so if you didn't test it
But just in general not testing it is the wrong. approach you don't know anything until it's tested.
You may build a hypothesis you may think it's way.
Something is, But you don't know it unless you actually do it You know this, especially in any sort of large software system.
You have to do experiments to verify what you know even I mean.
I will come up with theories, and I think I know what it is.
But I still have to expect, because I get surprised this question here.
If I had not done the experiment, i'd done this I would have expected it just to return an empty file, and not for it to lock up.
That would have been my mental model of what should have happened.
Of course I didn't really count on dd being stupid weird like that.
So No, that's not I mean that's just bug it might be some weird feature, but i'll call it a bug
But the whole point you had a No but the whole point is, it's a Vm.
It's sacrificial. you can reboot it Yeah, The whole point was that you can easily reboot your Vm.
This is how you do kernel development, and you take risks and sometimes desk things.
Mess up what that doesn't mean you you you don't do the experiment?
Yeah.
Yeah, yeah, exactly. have a throwaway. yeah that that's what we do.
But again, if you just reboot it none of these things here, you're messing with the kernel with the stuff like you did something really stupid, It didn't corrupt any data.
I never. We should not have lost any data. You said it.
Maybe reboot the Vm.
So: So yeah, this is
Remake all your Co. from scratch every time. That just sounds painful.
Yeah. Okay, Okay. Okay. So So, anyway. So what 6? What is the purpose?
But like this line you couldn't figure out this line until you did the experiment?
Number Question 6, because this made no sense. and in fact, this actually caused, You know this caused me some issue here.
So what this is? Time is this line right here? What the heck is this put user doing so?
What you should have noticed when you took this away. was that
You know, you just basically get a Yeah, you just get yeah.
But if you are, you always get busy at a address, 0, and you also get an arrow of invalid page table entering.
So yep signify it's not mounted exactly so you need to actually make the mapping valid and put user make sure the mapping is valid.
So I mean, I kind of probably done a get user that way would have also done it.
But now I think about it, but you had to do something with it before it actually became valid.
Which kind of makes sense like, Why would the Colonel bother mapping something in, unless it was actually being accessed
So the question, Colonel, is with Gamma, So is there a way for someone to access?
Use space directly without causing a permission issue that's what put user did.
If you use, put user, it does it without any permission issues.
You can write over the entire address space.
Yeah, it's almost like initialize the mapping yeah, so
You Can't. Certainly you can change the you can definitely change the kernel to to make it to
If you want to get God mode in the kernel it, there's a lot of stuff in the kernel nowadays to make it so.
If you make simple errors in the kernel you you'll detect the year and older version of the list curve didn't do that so as much easier to program in kernel space than it used to be but all
the stuff can be bypassed. You can bypass all those checks.
You just have to go through a few extra steps. So yeah, And in fact, if you think if you learn about what a root kit is, so what a root kit is this when you modify the operating system.
So it lies to the regular user, so you could mock.
You can hack the operating system, change the kernel so that when you do Ps.
It doesn't list all the processes and it hides some prose, and so you can.
The attacker could have some processes that run all the time.
Maybe a crypto minor and you're trying to look for it, and you want to kill it.
But you can't see it because they've hidden it with some special kernel code that's you know.
That's a level of access you have if you start modifying the kernel.
Okay, so that will try the mapping so 7 what's the purpose of get 0 page to get free page it's talking about.
Get Where is it? Yeah. get 0 page and here this is a priority level like depending on the kind of kernel. The Gpu kernels finite system calls those on like if you're a device driver and you can't
fail. we need it really fast, and stuff then for priority.
Give me a page Now, pools of pages like, Okay, these are the hybrid or new requests.
This is just your malloc, but this is giving you only one size.
It's like a one page you're getting 4 K. on X.
86. How did you get that's it there are definitely ways to do more?
But if you can get away with just getting a page this is definitely the most efficient way of allocking memory inside the kernel, because, you know, Colonel does marry Manager went in single page.
And so there's that's the least amount of work if you have, you would never, if you say you get a page.
Huge pages are basically never for most pages. Huge pages are for special parts of the address space.
Like for mapping in a Gpu memory into there to say things most process.
Memory is never in huge pages, cause it makes everything way more complicated.
You get what known is memory, fragmentation.
So so for questions. 6. Why was the the page table entry invalid? the reason it was invalid is because there was a user space pointer that wasn't mapped in for kernel space because that
mapping is actually valid in for another process and the kernel doesn't need those when it's running. But it needs to get that mapped in. If we're if we accident that's what you know I put
user get user take care of manipulating all those mappings for you, you know it's it's all kind of so that mapping wasn't done yet until we did put user and then the main was loaded and then we
could look up the virtual physical memory.
Wait! wait! What? what's a null pointer I understand what no point you're talking about.
All 5 levels of of the virtual adjust were valid.
All of them were valid. Some of them were duplicated, so I think it only had 4 level page tables
I I I don't quite understand exactly so far So what I tried to do is that I use get user. And then I copy the the buffer from user space to a temporary a page that I
declared. and then, when I try to print out the value in that using a print print K. I get a a A. No.
So that's why I and that's Why, I know that the it's doesn't work because you got 0 because the the actual before you initialize it that's your company pointer is not pointing to
a valid. Oh, yeah, address you're saying the P. so are you talking about the pointer?
Which point are you talking about? Yeah, super buffer? So, but you, before that per user, if you get it, you get you try to get the value from that buffer, and then you put it in a variable within the kernel space and you print
out that content of that very character array you see snow the reason it's no is because they're giving you a 0 initialized buffer, and that is not the reason why why why is the cost in the physical address to be 0
because no no no no that's completely different you're saying you're talking about the contents of what it points to is 0.
That's right. and of course the contents will be 0 probably because they passed user space past you.
A buffer that was 0 initialized. Okay, and the the the Okay.
So So the reason here, then, is because that that's not the case, and then, as we talk about we're we're talking about the here when we get physical we're, we're talking about manipulating, the
address. you'll find the version the physical test that corresponds to the virtual address.
We're not looking at what's at that location we're not dereferencing it.
Okay, but then, handling the pointer we're not dereferencing it, and and then the cause I actually print out the content of this buffer the the contents of the buffer all
knows so, and I mean the address of this buffer and then it's a it's a before even before the put and use and after put user is the same. value.
So the address hasn't changed so that could use it that that initialize it like user, did not change the virtual address.
It changes the physical address. Okay, but what? Why would that change the physical?
Oh, You have a virtual address. in order for that virtual address to be resolved.
You have to have a corresponding page table entry that corresponds that page, that that buffer is referring to well, at least you know the address in that page.
It might be the start of the page right up but it's an address in a page in order to be able to access contents of that page.
You have to have a page table entry which maps it into your.
You know which, which basically says, Okay, this virtual address where you know what part of physical memories are referring to. when we we get enter this function.
The Colonel hasn't bothered, to get a valid page table entry for this for this virtual address in the Kernel address space cause. This was the and this might not need to be valid in the process addresses but
it's not allocated in the page table that the Kernel is using right now, and so since it's not allocated, there's nothing there. so you have to So by calling get me to put user is like say Oh, let me look
up what this should be, and fill in the page table cause basically there's 2. There's the page table for the process, and there's a page table.
The kernel is using currently, and it seems like what happens is that has to be copied over.
It's not using the user space address space because again. mostly the kernel is not interacting with user space.
It's just for very specific things. Now, the kernel can switch, whichever address space it's using.
It has various ways of doing that, but, like in the context of the system, call you just need a little bit of memory, and when you need it you just map it in as needed.
Thank you. No problem. So
Yeah, exactly. So this is just to. but anyway, but now now it's so.
So yeah, going on to get 0 paid what's happening here this is just again memory allocation.
This is how you do kernel application and if you don't allocate it.
Then you're gonna get you know members not initialized and if you don't have the free page.
Then you're going to have a memory leak which you can detect
I didn't. expect you to go into this much detail I try to give my answers a bit more detail, so you can learn what's going on.
Then 8 and 9 are the ones that i'm sure it took you all a bit longer, So pro the calling process.
So how I did it was is first I changed the declarations and proper port read, so that we have a parent pid, and we have 2 task drums pointers, and then I just aside this process and current and then
we luke through, and this Rc. you read Lock Rc.
Read, unlock. This is all the and and this is all what you need to do for accessing the
They assessing the task trucks safely. and I did.
And this is following the usage of Get ppid that's how I need to do this, and you know and so task taking our tgid Vnr. again.
This is how you get Yeah, i'll get pid does things.
This is how you have this process. Real parent. You got that from?
Get vpid what it did. so you So it did these things, and now we have the pair of things, and then we, you know, print this out Well, we add it to the string, and notice that we increment the string by
how long our messages, and then subtract this so we don't go past the end of the buffer.
The the number of characters left is less than that, and then we put it in there.
We just keep looping through this and then stopping when we get to pid one, because then we're at the top.
Alright yup yup that's right
Alright. Yep, with some
So what's the danger of using without our cu readlock?
It mostly will be fine if you don't the rc readlock, but some.
But sometimes you'll be accessing an invalid pointer, and you'll get a kernel loops.
The reason why is that this is a you literally this process you're accessing could be modified out from other you by by the kernel running on another core.
This Rc. readlock basically says nobody touch this while I touch the structure, while i'm dereferencing this pointer, you know.
Otherwise it will that's Why, we're doing that lock you could do. You cut me hmm argue I I think you could hold the lock while you do the whole dereferencing thing.
But you know that causes other kinds of problems so you know they?
It's the long You Hope the lock you eventually causes problems on the part of the Colonel, and the chances of you as you're walking up the tree that you know things are gonna happen like this is very unlikely because
the the parents and stuff are likely to stick around for much longer.
So for a Q. 8, is it 5? if we just reverse the current parent as a linked list with pid zero's best case.
If you did current parents you'll only get partial credits, because you should be using real parents, and the way you would know real parents is because you look at that, and you should have done something to make sure that no one changed did
things out from underneath you again by looking at the locking.
So you would have gotten this by reading the Kernel code that I told you to read.
If you just looked up parent i'm guessing you found that on the Internet, someone saying, How do you get it?
And that's from an older version of linux Kernel online.
It says those 2 are almost always the same. Yes, but but still you should be using real parents.
For qa, would you? You will pseudo code?
Would you have partial marks you'll probably get you'll probably get like at least maybe one
But definitely not full credit cause. part of this thing was trying to get this code to run, and making sure it worked.
If you call the different function that gave the pair pride either parent for the i'd be curious to know what function is. but that's I mean if you found another function that's potentially, fine.
Yeah, you found another helper function because there's all mean kernels got so many little helper functions. stuff.
Yeah. Exactly. Yeah. Yeah. multi-. This only apply real parent parent with the same business has only applied to multi-thrown. Yeah. But you should handle multi-threaded process properly
The losing marks for using parent even though so you lose marks using parent human, though it's the same as real parent.
I didn't specify the the parent I no I said following up the process tree, which is how get ppid works, You know.
How do you get the parent of a process you call get ppid So that's you know, and I think we'll try.
We don't think we'll do you won't lose all marks by any means.
But you're not going to get full marks was that alright.
So one of the things that programming the kernel is it's not the kernel is very much not something that you get something that just works it works for me.
So I So it's fine Colonel code you have to go like what is the right way of doing this?
And the reason you care about what the right way of doing it is, because if you do it a somewhat other way, it'll work most of the time.
But then it will error out in some in various circumstances.
So you really have to follow the patterns
Yeah, we haven't talked to anything about multi-threading.
No, I want't expect you to be sitting there with me but again, how to get ppid Do it
Oh, yeah, you you can't you can't say and there's lots of ways of coding this
That's part of the schedule yeah okay same from schedule.
Yeah, that there's definitely i'm not saying there's only one implementation at this.
But
Anyway. So that was that was 8 but but I I do care about you the way you should have coded.
This was by looking at how the Colonel does this, and not by searching the Internet for some reference of this is how you do it.
And that's. really what i'm gonna take marks up from you because you didn't like if you found it in the kernel code, and it did it.
The way you said it was doing it. Then finally, if you searched online. and someone said to do it that way no pretty much almost it your way. But I didn't use our cu de reference.
So so. So the Rcu D reference so the reason why that's important.
Again. This is why you look at, get ppid and say, look at a system call how it does it?
Because otherwise, you're just accessing the kernel data structures, and you don't know what the requirements are for accessing the kernel data structures.
You know this is not just some little C program you cooked up.
I mean, this is highly concurrent. All kinds of weird crap happens.
So
Is explained somewhere. the kernel code itself between the 2 i'm sure it is.
But the point was you didn't have to understand what was the right one.
I haven't even looked into what the dirty parent and real parent is, but it makes sense.
It's It's statue with multi threading It's just that when I looked at how get pp Id worked.
That's what it did so I know that's basically safe
I mean i'm not saying you can't use a online resources.
But the end of the day the truth is in the kernel account and the kernel code changes and sometimes online resources don't change.
So. and again, the reason why. this is because you know
No meal is there not a question of whether I know it's not about guessing that's not what i'm saying i'm guessing I'm saying is this is how this is how that code works.
Alright: Yeah, Okay, let's let's talk a question there yeah,
So what's the change? Your pro report so reports the address of all the intermediate lookups
First we change the declaration of The way I did it was I change the declaration here.
So it there was basically I used an address I mean an array I didn't bother with the struct.
I: just yeah was an array of things. and then I have a counter, and then we And then I basically add these, I basically add this into change Proc report.
Get physical i'm, adding these little things to add in the and this I do it after call, so as to save it.
And then in Proc Port real I can then you know that's the array I created.
I made it most 10 and then we hear, and then we have a loop, and then we go through, and we just keep, you know, doing the the transmission of the address.
Look at path so
This 10 wasn't really necessary I would just set me really you could do. This is just me being lazy just saying but as much that you could have a 10 level page table.
That's basically what i'm doing is you know
Have a long that is so
The way I did it was I I changed to get physical function return a shock full of all the addresses. Yup. that's definitely a good way of doing it.
Okay. but just as long as the struct is allocated is not allocated in proper report.
Get physical.
Right that yeah, it shouldn't be allocated there q* no loop for you.
Yeah, that's that's certainly true you can just do it in one that one thing could definitely that's perfectly fine
Yup. Yeah. And the reason you can tell these are virtual is actually very.
It's very interesting because look at this address it's really big, and, in fact, what the colonel does I think it sets the top bits all to one.
So so as to distinguish between kernel up kernel addresses and user space addresses.
I think so. Yeah, click user space normally has to ask me lower than this.
It doesn't give any virtual it doesn't get a virtual address, saying, process there in this range.
So by that way you could always know whether a pointer is to a kernel address or a user space address.
But the But, yeah, these are all virtual addresses because there's no way.
The system has that much physical memory.
Oh!
You're right, William, You're yeah you're definitely right these are okay.
I'm gonna update my solutions for that because you're right.
I I was wanting to put. So basically what I was looking for is I was looking for you just to output what the heck these things are.
That's your outputting. Well, that's a good point that what these are happen, but these are actually inside the the struck that has the actual make sense
Yeah, I mean, I mean this I was looking for if you're just looking at this.
You could have lots of reasons for saying, you know these are virtual. but if you but of course, if you actually dereferenced it and got the physical addresses, then that will be fine too.
It all depends on how you how you did it. So
So just so. So the crack so there's some things wanting to go back to question 8.
So my basic thing for Question 8 is, how did you know?
How did you do what you did that's my my big thing?
If you if you had a if you had some reason for doing it, that so that you we're looking at how the kernel solved this task then great.
If you just looked at the Struct and find the thing to de-ference.
I wouldn't necessarily take off a lot of credit.
But I think you'll lose at least half a point for that one half to you know 1 point of that because you can't do that.
You can't just take structures going. Oh, it looks like this. So I'm gonna use it. you've got to really look at the kernel code and see how it uses those data structures, because of course, any data structure you don't
really understand it until you understand how it's used by code, and you're in the middle of this giant program, with all these ways of doing things.
So i'm i'm interested in the process by which you came up with your answer.
Not necessarily the exact answer you've got
So yeah, I mean again I mean it's like a lot of things when you're programming in any sort of large system, you won't necessarily understand all the nuances.
Of why you do things they certain way, Because to understand the nuances of how you Why, you do things a certain way means you understand the entire program, and you don't.
So until you really know the code base, and you know why you can change things around you.
Do it the way others have done
The reason you chose parent is a dumbest wish to being pid one.
After the parent dies, we see, like a more accurate answer.
Actually know if it's that's wrong because when a the whole point is when the parent dies, it gets reparanted to in it.
That is standard. what can happen is, it gets recurrent to another program.
I was asking that. but the normal thing is for it to get repaired because it has to have a valid have to be in a valid tree.
So. yeah, well see again like these little things it's it's not easy.
I'm not saying it is easy and
Okay, i'm talking about ancestry in the pure data structure sets
But other other questions about assignment, for otherwise I wanna just talk about the final exam.
So
What what i'm saying is wrong if the real parent dies Then the signal gets sent to a to parent.
Is the kernel code definition of the struct are you saying it's in a comment in this in the struct comments.
Probably right but again, but that's
But where the single sent isn't it's it's saying that if it doesn't have that pro that thing filled in it'll go to the parent right but that's not what you
If you're trying to figure out the exact semantics of how these fields work. you're going down a very big rabbit hole. what i'm saying is i'll just i'll just show you Well, let's go
here.
So let's let's share
Okay, so let's so this so my idea was when you did this. You'd be following what I had shown you in the tutorials.
So I told you to to look at some of the stuff.
Is So if you go to kernel, you know, Cis, dot, c.
And we look for
So this is the definition of get ppid, which is the thing to access the parent.
You know what is what is the definition of what's seen
We'll find a man page all this is so yet ppid shall return the parent process.
Id of the calling process
That's what the get ppid system call does this is the implementation of the get ppid system.
Call. This is what it does. This is the field it uses
Yes, exactly. if you look at the task direct. definition. you will lose marks won't necessarily lose a lot of marks, but you will lose some marks, and the reason why?
Please, because you can't interpret and it's precisely because of this, because I look at I mean I looked at the task truck, and i've tried to terminate.
But you You don't know what those fields exactly mean you only know what those fields really mean by looking at how it's used.
That's how you know what they mean reading the data structure does not get you that looking at the code that uses the data structure does, and that's a very important distinction
That that's that's what i'm saying
Let's go, hey? moving on so given all this
So the question is, how will I test things from? how will I test the contract? A 4? Certainly.
I'm not gonna ask you to do the full you know be implemented stuff in the kernel, so I mean that's all gets way too detailed.
What am I looking for here
So one thing I can ask about is so for for one I can talk about tainting.
You know what's what's going with tainting I can talk about you because question went to the tank.
Also it's
So one's talking about you know tainting how modules a little remove what happens?
Good for question 2. I look at it and say, we run proxy. What does it report?
Give a sample output to
Virtual and physical addresses.
Yeah, What else is here?
Modules for 3 run, you know. Bpf Trace watch, you know.
Proc. report, and one troller run this, and what? what does Bpr.
Tricks for Scripture. So here
What vp of trace does
Sorry I have a cat messenger with my tables here Whoa!
That's not
You're just running around my messy office here i'm i'm gonna have to kick her out in a second.
So 3, you know, understanding what you know is probes
So all the stuff about Bpf Trace. I can ask about that like what this is happening.
I I probably will ask any more specific way, but
What's happening with 4 we've all got you know again.
We have more gd
I'm probably not gonna ask about 4 4 ends up being a bit confusing
What's the purpose of line 127
You just So if you have questions on things just go through teams, if it's a general question, post it to a channel, otherwise Pm.
Need, and I will respond. So hold on 1 s here.
Yes, hi! this is who's distracting me right now say hi to everyone.
The last last class. This is shift. Shift is being a little shifting.
Okay, we're going out now. say bye to everyone Okay, Okay, Say, Bob, Okay.
When she really wants to get my attention she'll start biting cables on my computer, and she knows i'll pay attention to her, anyway.
So 5 Oh, put user
That's 5 6
Was a personal 9 11.
So the general concepts here, like you know, Have you done that so definitely
The it's just what's an assignment one through 4.
Yeah, really you know I did so since I didn't put in the assignments.
It's not going to be there 7 what's the the call to get 0 page
8. Okay. So this one kind of
Okay, and
8. So this reports the address of all enemy lookups
So I think I might have one question walking I mean I can ask all kinds of hard questions in the page tables, but I don't think I've I want you to know the concept of a virtual versus physical address but once you
get in the details. I don't even missing all the details right so I'm not gonna test you on it.
But this is how I go through when i'm going to make up questions. I look at these things like what is this really asking me what's interesting about this, and i'm really looking for?
Not what's going to be too picky but what was really interesting about this
So like this is how I look at no this is just something, you know, like just looking at the kind of things i'll look at now.
I would. You know this is not exhaustive
Okay, so that's this makes sense questions about this
And then for
So tell me, what do you think? What should I ask about for question?
One.
I don't know if one's that interesting actually
I know I think one was really more to get you actually reading the script
What's my student number
Alright, concurrency is going to be on there except for the locking.
That was maybe in the last one what's the name of the file.
These are bad questions
Do you know what Rm. Rf. means?
I would say you should know that after looking at script here So 2 after 3,000 contained runs, you're put in a new shell where slash is now? the contents of 3,000 fs professor could I ask you
a question. Sure So in assignment 3 when we were running, and and we had to go over, you know, which is the the fastest.
So you know, when you looked at at that point when I ran, this was in actually one of the tutorials based on that where it was 3,000 fiveo and then we had 3,000 rendezvous, and so when
I ran them all initially, the the the 3,000 rendezvous came out to be faster at that time in a assumed it's maybe because rather than going 1 8 one out. it's sort of filling the
buffer. But then, in the last question of the tutorial, it had us sort of run them all and compare their speeds to. and in that 3,005, 4 was actually the fastest So even if why would that be the
case when you're not actually even filling the buffer, and you're just always going one in one out
So So the point of so what I wanted to show you is that just because you're doing shared memory and you're avoiding system calls doesn't mean what you're doing is necessarily fast and you'd say why is it
going through the kernel and doing you know the fifo so fast, because pipes and Linux have been heavily optimized.
There's all kinds of tricks that the kernel can use to make sure that you know what you're doing is super fast.
So it's that optimization, is what you're up against It's not that you can't do it potentially faster, just like going through user space, and and not doing that but it's not easy now is that also dependent
on the type of data that you're normally there's a huge amount of of dependencies.
I mean it's it's like how do you make sure you I mean the whole trick to make it concurrency fast is you have to make sure the locks are not going to be held very often.
You want to. I want everyone be able to run in parallel as much as possible and not have much contention.
How do you minimize contention that's way beyond the scope of this class?
And I would say i'm by no means I I know some basic tips, but i'm no means an expert, you know.
Concurrent, remember. So sort of phone up is that it's not trivial, but all it's very subtle.
Is that? why sort of sometimes, you know, when when used to say, Well, having so having more ram, makes things faster.
Is it because you have more storage, so less things, you know.
More stuff can be copied, and rather than waiting, to access the same data source, Well, more ram means that we any mass storage. even Ssds is slower than round. So that just gives you more space to work you don't have to be
going to the disk. you load It off i'm just gonna memory just work from that.
Okay, Thank you.
Yeah, the 2. Yeah, the tutorials are definitely harder than the assignments that was by design. and they all.
But that's also why they are great as a participation Mark, you get what you get out of the tutorial is what you put in.
It's very possible to get full marks in the tutorials, and for you not to put that much effort in.
But if you actually wanted to understand what was going on, yeah, you gotta put time in, and then, once you do that, you then go into the assignments and the assignments were a lot easier.
I will say if you found the tutorials easy, and you found that assignments hard.
You were doing the tutorials wrong, and I suggest you maybe go back and redo them potentially, and that couples before the task of that will probably help you find some of your gaps.
So so I say.
Have we able to sleep with the buffer fill okay that yeah that that's the other yup that'd be a concrete.
Yeah, that's for concurrency so I would like to ask more about concurrency. Hi! there's a little bit of concurrency technician assignment. forward with talking about how you with the get
ppid stuff, and there's a locking there I think I might ask some high level question about that?
Why would you? Why might you want you know? what could be a problem?
If you access the task struct without doing walking, what could happen?
What could happen is the task truck could be copied up.
Good could be moved later. that process died, you know. How do you know if that process died?
And then, all of a sudden, the data structure you were trying to access and that you're trying to performance is not a valid data structure anymore.
So it's not you shouldn't be talking a producer consumer is just one model of concurrency.
It's a common one. there's a pipes but by not meal.
You just say there's a r this potential for a race condition Yeah.
And literally, you could have you try acting a task Struct. and you get a Colonel Loop because that member has been deallocated.
So 2. What is it you put in the new shell we're slashing out can be conscious of us, and you can't look at anything else.
It exhale gets back to where you're after exiting we'll get you back to the container environment.
So here.
That 2 just like, Okay, this is gang you into the.
You know what that command is doing? 3. How does the output of Ps differ when running inside the container outside
So here, you know, pit space being unshared
You can go copy that that's not that what does 58?
What does it run?
So I wish you know change so there's a lot of things going on understanding this
So that's 5 was the largest file we can create
This file Holes Virtual Physical size of files
The final exam. is 2 and a half hours the so it's let's see now, 2 and a half hours is 1, 2150.
So almost like one and a half to 2 times the number of questions on the midterm.
Basically I haven't finished making it up yet so
So 7. How many files are I confined for the same Iode
Nobel. i'm not sure exactly I have to finish making them, and some will be multipart and stuff.
So I will post once the site you plan on you're gonna need to be writing, you know, doing stuff with the good students.
We'll probably finish the the final examiner an hour to an hour and a half.
Some really good folks might finish it in like 30, 40 min, but they are but the most of you.
My expecting will need most of the time
You are questions is not necessarily better. I would actually probably say more questions is probably better because they're probably smaller questions.
Each So 7 is what is it all you know?
Symbolic versus hard links.
8
Care! can I use
Account
Oh, crap! Oh, so I didn't realize that Okay, let me just finish this up here and then there's 10.
How can you access the main root file system inside the confined?
About what parts of the area. So Yeah. Oh.
Okay, I think that was 11 was
Okay, sorry about that guys that went over thank you all this is the material i'll post this i'll be online to answer questions about the final exam.
And and then we'll do interviews afterwards.
If you want to talk to me about it. and I will post that information so otherwise.
Thank you all, and good luck, with all your final exams and projects, and such, and maybe see you next semester.
Take care.