The really simplified answer is that the kernel runs in kernel space, and normal programs run in user space. User space is basically a form of sand-boxing — it restricts user programs so they can’t mess with memory (and other resources) owned by other programs or by the OS kernel. This limits (but usually doesn’t … Read more
A trap is an exception in a user process. It’s caused by division by zero or invalid memory access. It’s also the usual way to invoke a kernel routine (a system call) because those run with a higher priority than user code. Handling is synchronous (so the user code is suspended and continues afterwards). In … Read more
From the netfilter FAQ: The answer unfortunately is: No. Now you might think ‘but what about libiptc?’. As has been pointed out numerous times on the mailinglist(s), libiptc was NEVER meant to be used as a public interface. We don’t guarantee a stable interface, and it is planned to remove it in the next incarnation … Read more
This is a Designated Initializer, which is syntax added for C99. Relevant excerpt: In a structure initializer, specify the name of a field to initialize with ‘.fieldname =’ before the element value. For example, given the following structure, struct point { int x, y; }; the following initialization struct point p = { .y = … Read more
Sometimes printk may defer output (that is, message is stored in the internal buffer, but not in kernel log). To avoid such behavior, always add newline (\n) at the end of the string printed: printk(KERN_ALERT “%s\n” ,mystring);
From my research, it seems that those are the only three ways to handle this situation, and I’ve gotten each of them to work, so I think I’ll just pick my favorite out of those.
The kernel allocates PIDs in the range of (RESERVED_PIDS, PID_MAX_DEFAULT). It does so sequentially in each namespace (tasks in different namespaces can have the same IDs). In case the range is exhausted, pid assignment wraps around. Some relevant code: Inside alloc_pid(…) for (i = ns->level; i >= 0; i–) { nr = alloc_pidmap(tmp); if (nr … Read more
It allows tools like sparse to tell kernel developers that they’re possibly using an untrusted pointer (or a pointer that may be invalid in the current virtual address mapping) improperly.
At a high level, there are two separate mechanisms to understand. The first is the kernel entry/exit mechanism: this switches a single running thread from running usermode code to running kernel code in the context of that thread, and back again. The second is the context switch mechanism itself, which switches in kernel mode from … Read more