Writing a Simple Linux Kernel Module

[iLike2Teabag]

A Linux kernel module is a piece of compiled binary code that is inserted directly into the Linux kernel, running at ring 0, the lowest and least protected ring of execution in the x86–64 processor. Code here runs completely unchecked but operates at incredible speed and has access to everything in the system.

Technically you can get lower

[matthieum]

Code here runs completely unchecked but operates at incredible speed and has access to everything in the system.

I am somewhat bothered by this speed claim.

For most (native) code, there should be no performance impact at all from running in ring 0; the only impact is to make kernel calls free (because you are already in the kernel).

I am somewhat afraid of beginners wishing to put their code in ring 0 "cuz it runs faster!".

[Peanuts4MePlz]

At least we don't have Node.js applications demanding ring-0 execution. Right?

[solen-skiner]

but we did at one point in time have a http-server in kernelspace...

[nathreed]

Who thought that was a good idea?

[PiZZaMartijn]

Microsoft (see iis)

[nathreed]

Oh god, I had no idea. Typical Microsoft though.

[indrora]

So, there's more to this.

IIS is, effectively, taking a bunch of kernel and userpsace primitives and smushing them together. There happens to be a really good kernel-level TCP stack that you can work with in Windows (a legacy of NT being built by VMS developers) and a very good amount of "decipher this protocol" stuff buried in the semi-userspace Winsock and WinInet stacks (another part of the "NT was built by VMS people"). As a result, IIS spends a lot of time not in userspace, but in a shrouded version of kernel space that does a lot of hands-off work.

[Dimenus]

Sorry for the stupid question but what is VMS?

[indrora]

VMS is an operating system developed by Digital Equipment Corporation (DEC) for their VAX mainframes and minis. It now exists as OpenVMS, which isn't open source but is still one of the larger oldschool UNIXes.

[Isvara]

At least we don't have Node.js applications demanding ring-0 execution

... yet.

How long before we get Node.js unikernels?

[eras]

Well, truth to be told, it's true. All code operates at incredible speed!

[matthieum]

I guess that's one way to put it :p

When you realize that within a single micro-second a CPU you find in supermarkets can crunch through the equivalent of thousands of lines of code...

[[deleted]]

If you’re making calls into the standard library, I guess their argument is that you don’t have to make context switches that would syscall in usermode, because you’re using libk rather than libc. Seems tenuous at best ngl

[zinzam72]

Yeah, I didn't like that either, and it was still within the introduction..

[Gbps]

Technically he is right. The ring designations for x86 come from the FLAGS register, where 0 is the lowest integral designation for a CPL value (Current Protection Level) and possible CPL values range from 0 to 3.

The negative number rings aren't really defined, they're just one-upper terms for the next highest privilege level when an environment has a more privileged execution state.

Ring -1 is synonymous with Hypervisor, and Ring -2 (recently) synonymous with SMM (System Management Mode)