thehardwarestore.ai

The Linux Kernel Module Programming Guide (LKMPG) is a comprehensive, community-maintained guide to writing Linux kernel modules. It consists of a LaTeX book and a large collection of example kernel modules that demonstrate a wide range of kernel APIs and programming patterns, including character devices, the /proc filesystem, sysfs, debugfs, system call interception, synchronization primitives (mutex, spinlock, rwlock, RCU), interrupt handling, timers, workqueues, block devices, network drivers, DMA, device tree, GPIO, and more. The repository also includes a QEMU-based development environment (devtools) that automates building a minimal kernel and initramfs, allowing developers to compile and test modules inside a virtual machine without affecting their host system. The code is well-structured, follows kernel coding conventions, and includes proper error handling and cleanup. Many examples include version guards for compatibility across different kernel versions (5.10 through 6.17+). The devtools scripts are robust, with caching, idempotency, and prebuilt binary support to speed up setup. The CI pipeline builds the book, compiles all examples, runs static analysis (cppcheck, sparse, gcc, smatch), and tests module loading/unloading in both bare-metal and QEMU environments. While primarily educational, the example modules are self-contained and can serve as templates for real kernel module development. The devtools provide a reproducible environment for kernel module testing, which is valuable for developers working on out-of-tree modules. The repository is actively maintained and targets recent Linux 5.x and 6.x kernels.

simplefs is a Linux kernel module that implements a simple extent-based filesystem for educational use, accompanied by a userspace mkfs.simplefs formatter. The kernel component registers a VFS filesystem type and implements superblock, inode, file, and directory operations. The on-disk layout is a fixed 4 KiB block format: superblock, inode store, inode free bitmap, block free bitmap, and data blocks. Inodes are 72 bytes and point to an extent-index block; regular files use extents of up to 8 contiguous blocks (maximum file size around 10.65 MiB), while directories use a hashed ring of extents to support up to 40,920 entries. Functionally, the filesystem supports create, lookup, unlink, rename, hard links, symbolic links, mkdir, rmdir, and read/write. File I/O is implemented through both traditional VFS page-cache helpers and simpler direct buffer-head read/write paths, making the code a useful teaching reference for how Linux VFS callbacks and buffer management interact. External journaling is supported via the kernel's jbd2 subsystem, mounted with a journal_path or journal_dev option, though only extent metadata is journaled and the journal size is currently hardcoded. Entry points are module_init/module_exit in fs.c, the mount path through simplefs_fill_super in super.c, and main() in mkfs.c. Dependencies are Linux kernel headers, jbd2, block-device APIs, and a Linux or macOS host for mkfs. The repository includes shell-based integration tests that exercise maximum directory fill, large-file behavior, remount persistence, random create/delete, and free-block reclamation, plus CI jobs for formatting and macOS mkfs verification. The code maintains compatibility macros spanning Linux 5.10 through 7.3, reflecting active upkeep.

nettrace is a Linux network diagnostic tool based on eBPF that traces network packet lifecycle, performs fault diagnosis, and monitors network abnormalities. The architecture centers around a main CLI application (nettrace.c) that loads and attaches eBPF programs (primarily in src/progs/kprobe.c) to kernel functions and tracepoints. As packets traverse the network stack, eBPF programs capture event data sent to user space via perf buffers, where it's processed by analysis.c for diagnostic rule matching and formatted by output.c for display. Key features include basic packet tracing, diagnostic mode with automated problem identification, drop monitoring, socket tracking, and latency/RTT analysis. The tool relies on external dependencies like libbpf, libelf, and bpftool for eBPF program loading and compilation.

libbpf-rs is a Rust workspace providing safe, idiomatic bindings to the Linux libbpf C library for eBPF program development. It consists of two main crates: `libbpf-rs`, a high-level runtime library for loading, attaching, and managing eBPF programs and maps, and `libbpf-cargo`, a Cargo plugin that compiles eBPF C source files and generates Rust skeleton code with type-safe accessors and lifecycle management. The library supports a wide range of eBPF attachment types (kprobes, tracepoints, XDP, TC, netfilter, etc.), CO-RE (Compile-Once-Run-Everywhere) via BTF, and includes utilities like ring buffer and perf buffer helpers, a query interface for inspecting loaded kernel objects, and a linker for combining multiple BPF objects. Architecture is a workspace with library crates and numerous example applications (e.g., runqslower, tcp_ca, tproxy) demonstrating real-world usage. Entry points include `ObjectBuilder`, `SkeletonBuilder` (from libbpf-cargo), and generated skeleton APIs. The project relies on `libbpf-sys` for FFI, and examples use `clap` for CLI and `plain` for safe byte conversion. It is heavily tested with integration tests requiring root privileges.

KernelScript is a domain-specific language and compiler (OCaml) for developing eBPF-centric programs. The compiler translates a single `.ks` source file into multiple C outputs: idiomatic eBPF C code (for kernel execution via XDP, TC, kprobe, tracepoint, perf_event, struct_ops), userspace loader C code (managing maps, ring buffers, tail calls, and program lifetime), and optionally kernel module C code (for `@kfunc` functions). The compiler pipeline includes lexing, parsing, symbol table construction, type checking (including context-specific rules for eBPF program types), IR generation with control-flow and data-flow analysis, loop analysis (bound detection, bpf_loop optimization), tail-call detection and automatic progarry management, map assignment optimization, safety checking (null pointer, bounds, overflow), and multi-program optimization (map type changes, batching). It also supports BTF introspection for kernel type and kfunc extraction, a Python bridge, and a compile-time evaluator. The architecture is modular with pluggable context code generators per program type. The project includes an extensive test suite covering the full pipeline from parse to C output and specific features like perf_event attach, ring buffer dispatch, struct_ops, and multi-program scenario.

bees (Best-Effort Extent-Same) is a specialized C++ application designed for userspace deduplication on the Btrfs filesystem. It operates as both a CLI tool and a systemd daemon (beesd), scanning filesystem extents to identify duplicate blocks and reclaim space using Btrfs-specific ioctls like BTRFS_IOC_FILE_EXTENT_SAME. The architecture is modular, separating low-level kernel interaction (lib/fs.cc), hash table management (src/bees-hash.cc), and task scheduling (include/crucible/task.h). It prioritizes memory efficiency and incremental scanning to minimize downtime on large filesystems. The system relies heavily on Linux kernel internals, specifically Btrfs tree structures and extent metadata. It implements a custom memory-mapped hash table (BeesHashTable) to persist fingerprint data across restarts, allowing incremental deduplication without rescanning the entire filesystem. Concurrency is managed via a custom TaskMaster that adjusts worker thread counts based on system load, preventing I/O saturation during deduplication operations. While the code demonstrates high craftsmanship in system programming, it carries significant technical debt risks due to its tight coupling with volatile kernel APIs. The project maintains a robust test suite for its utility libraries but relies on integration testing for the core deduplication logic. It is a mature tool for Btrfs administrators but requires careful maintenance as kernel internals evolve.

The numactl repository provides a set of userspace tools and a shared library (libnuma) for controlling Non-Uniform Memory Access (NUMA) memory allocation and CPU binding policies on Linux systems. The core tool, `numactl`, allows launching processes with specified memory placement policies (interleave, bind, preferred, local, weighted interleave) and CPU affinity. The library `libnuma` exposes a C API for applications to set these policies programmatically, interacting with the Linux kernel via system calls (mbind, set_mempolicy, etc.) and reading topology information from sysfs. Additional utilities include `numastat` for per-node memory statistics display, `memhog` for memory allocation testing, `migratepages` for manual page migration, and `numademo` for benchmarking NUMA performance characteristics. The codebase is written in C with autotools build system, maintains API/ABI compatibility through symbol versioning, and includes regression tests and fuzzing harnesses. It is the de facto standard library for NUMA policy management on Linux.

This repository is a comprehensive, in-progress book titled 'Linux insides' that explains Linux kernel internals through detailed, code-driven tutorials. It is not a traditional software application but a documentation project with supporting scripts for building, validating, and exporting the book. The content covers boot process, initialization, interrupts, system calls, memory management, synchronization, timers, cgroups, and more, with extensive references to actual kernel source code. The project includes a Makefile, Dockerfile, and CI/CD workflows for automated checks and ebook generation. While the primary deliverable is educational material, the repository contains reusable scripts for code snippet validation and LaTeX PDF generation that can be extracted for other documentation projects.

This repository contains a proof-of-concept exploit for two Linux kernel vulnerabilities (CVE-2026-43284 and CVE-2026-43500), collectively called 'Dirty Frag'. The exploit chains an xfrm-ESP page-cache write vulnerability (requires user namespace creation) with an RxRPC page-cache write vulnerability (does not require namespace creation) to achieve root privilege escalation on major Linux distributions. The single C source file (exp.c) implements both exploit paths and a fallback chain: it first attempts to overwrite /usr/bin/su with a minimal root-shell ELF using the ESP variant, and if that fails (e.g., due to AppArmor blocking user namespaces), it falls back to patching /etc/passwd's root entry to have an empty password field via the RxRPC variant, then spawns a root shell via su. The code demonstrates advanced kernel exploitation techniques including splice-based page cache injection, in-place crypto manipulation, and user-space porting of kernel crypto primitives (fcrypt). It is not a reusable library or framework but a targeted exploit PoC.

Open CAS Linux is a production-grade block-layer cache acceleration solution for Linux. It consists of a kernel module (`cas_cache`) implementing caching logic on top of the OCF (Open Cache Framework), a block device module (`cas_bd`), and a user-space management CLI (`casadm`). The system accelerates block I/O by caching hot data on fast storage (e.g., NVMe/Optane) while using slower backing storage, with support for multiple cache modes, cleaning policies, I/O classes, and statistics reporting. Management is performed via ioctls through `/dev/cas_ctrl` and netlink-based communication, with a comprehensive CLI (`casadm`) for cache/core lifecycle operations and statistics output in text, CSV, and raw CSV formats.

This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.

This repository contains a Linux kernel driver for managing battery health features on Acer laptops via the WMI (Windows Management Interface) interface. The driver enables control of two key battery functions: a health mode that limits charge to 80% to prolong battery lifespan, and a calibration mode that performs a full charge-discharge cycle for accurate capacity reporting. It also provides battery temperature readings. Implemented as a single kernel module (acer-wmi-battery.c), it interacts with the laptop's firmware through WMI methods to query and set battery parameters, exposing these controls via sysfs attributes under /sys/bus/wmi/drivers/acer-wmi-battery/. The driver follows standard Linux kernel module practices, including proper error handling, version-dependent includes for compatibility, and sysfs attribute creation for user-space interaction. It includes reusable WMI helper functions that encapsulate the boilerplate for WMI method calls, buffer handling, and response validation. The project is actively maintained with recent commits, supports multiple Acer laptop models as documented in MODELS.md, and is licensed under GPL-2.0.

Honey Potion is a compiler framework that translates a subset of the Elixir programming language into eBPF (extended Berkeley Packet Filter) programs, targeting both tracepoints and XDP. The system works as an Elixir library (published on Hex as `honey`) where users write eBPF logic in Elixir using macros like `@sec`, `defmap`, and `fuel`. At compile time, `__before_compile__` triggers a pipeline: static analysis, optimization (constant propagation, dead code elimination, type propagation), AST-to-C translation, boilerplate generation, and C compilation via `make`/`clang`/`llc`/`bpftool`. The generated C code includes a custom runtime with heap, tuple pool, and string pool implemented using BPF maps to overcome eBPF's stack and memory constraints. The repository includes 20+ example programs (system monitors, packet filters, data structure demos) and a comprehensive benchmark suite comparing hand-written C eBPF programs to Honey-generated ones, supporting a published research paper. Although classified as an application (a compiler library), the project has strong research characteristics with reproducible artifact scripts, optimizer variants, and performance comparisons.

MiCode/Xiaomi_Kernel_OpenSource is Xiaomi's official GPL compliance release mechanism for Linux kernel sources powering its Android devices. The default branch (named 'README') contains no application or library code whatsoever -- only a single Markdown file that serves as a structured index mapping ~200 device codenames (e.g., dada-v-oss for Xiaomi 15, alioth-r-oss for Mi 10S) to git branches. Each branch holds the actual Linux kernel source tree for a specific device/Android-version combination, based on Qualcomm CodeAurora (LA.UM/LA.VENDOR) or MediaTek (alps-*) vendor base tags identified in the table. There are no APIs, executables, build scripts, or tests in this branch; the repository's real product is the branch-per-device collection of GPL-required kernel sources. Architecturally this is a source distribution index rather than software. Its value is as reference data: developers building custom ROMs, security researchers auditing device kernels, and compliance tooling all use the README to locate the correct branch for a given device. The catalog is actively maintained -- entries for Android W devices (Xiaomi 17 series, Redmi K90, Xiaomi Pad 8) and a recent commit dated 2026-10-12 indicate ongoing releases -- and the table format is consistent enough to be machine-parsed. However, it exhibits manual-maintenance defects: several links point to differently-named branches (diting-s-oss -> bsp-diting-s-oss, corot-s-oss -> corot-t-oss, goku-u-oss -> goku-u-oss-test), some rows contain stray whitespace, and a few devices appear with overlapping/duplicated entries. The repository is not reusable as a software component, but it is a uniquely comprehensive authoritative mapping of Xiaomi devices to their kernel sources.