Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
Homework Wet 1
Due date:
Thursday, 21.11.2013, 12:30 noon
Teaching assistant in charge:
Anastasia Braginsky
Important:
the Q&A for the exercise will take place at a public forum Piazza only.
Please note, the forum is a part of the exercise. Important clarifications/corrections will
also be published in the FAQ on the site. A number of guidelines to use the forum:

Read previous Q&A carefully before asking the question; repeated questions will
probably go without answers

Be polite, remember that course staff does this as a service for the students

You’re not allowed to post any kind of solution and/or source code in the forum
as a hint for other students; In case you feel that you have to discuss such a
matter, please come to the reception hour

When posting questions regarding hw1, put them in the hw1 folder
1. Introduction
Your mission in this assignment will be to add a new system calls to the interface of the
kernel, and to update some existing system calls. All this for the purpose explained
below. While doing so you will gain extra knowledge in compiling the kernel.
In this exercise, we will use VMware to simulate a virtual machine on which we will
compile and run our "modified" Linux. You will submit only changed source files of the
Linux kernel.
2. General Description
The developers of the security department of the Linux kernel decided it would be nice
if they could monitor files activity under the kernel. Your mission is to help them doing
so. They would like to have a possibility to know, which files were opened or closed by
any process or all of the processes together. In the following section you will find a
detailed description for what your mission is.
1
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
3. Detailed Description
You need to define new type called file_event:
enum
struct
event_type {OPEN_EVENT,
file_event {
enum event_type type;
char filename[256];
CLOSE_EVENT};
};
You can assume that the name of the file is bounded by 256 characters. If it is longer
use only lower 256 characters (those closer to extension).
You need to implement code wrappers and system calls with the following declarations.
For example: get_event_number is a code wrapper and sys_get_event_number is a
system call (see the slides for tutorial 2).
Code wrappers:
(system call #243)
int start_monitor(int pid)
Description: Starts recording the events of opening/closing the file for process pid. The
system is required to monitor up to 100 last events for each process. For example, if
there have been 110 events, than the first 10 events will be deleted.
The return values: On failure:
-1
On success: 0
On failure 'errno' should contain one of the following values:

'-ESRCH' (No such process): No such process exists.

'- EPERM' (Operation not permitted): the system already monitors the events
for this process.
int stop_monitor(int pid)
(system call #244)
Description: Stops recording the events of opening/closing the file for process pid.
The return values: On failure: -1.
On success: 0
On failure 'errno' should contain one of the following values:

'-ESRCH' (No such process): No such process exists.

'- EPERM' (Operation not permitted): the system doesn’t monitor the events
for this process.
2
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
int get_all_events_number()
(system call #245)
Description: Returns the total number of the events that captured (happened between
start_monitor to stop_monitor) in the system (for all the existing processes).
The return values: On failure: doesn’t fail.
On success: The number of events in the system files.
int get_events(int pid, int n, file_event events_array[])
(system call #246)
Description: Returns to the user n oldest events of the process pid. The events that
have been reported to the user are deleted from the system. For example, if a
process has done the following actions:

Open file aaa

Open file bbb

Open file ccc

Close file bbb

Close file aaa
The first call of system call get_events() with parameter 3 will return 3 events {(open,
aaa),(open, bbb),(open, ccc)} and the second call of of the system with parameter 3
will return only 2 events (close, bbb),(close, aaa)} (the order of the events is important
and should be preserved).
Parameters:
pid
– the process identification
n
– the number of events to read.
events_array – the array of events (of size at least n – should be allocated by
the user prior to the calling the system call). If the system call is successful the array
will hold the relevant events.
The return values: On failure: -1
On success: The number of events to read (Note: It may be less
then n)
On failure 'errno' should contain one of following values:

'-ESRCH' (No such process): No such process exists.

'-EFAULT' (Bad address): incorrect data address for data (the events_array
array can’t be written to (e.g. doesn’t belong to the calling process address
space)).

'-EINVAL' (Invalid argument):

n is negative or bigger than 100.

events_array is NULL.
3
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
The System calls:
 int sys_start_monitor(int pid)
(system call #243)
Return values:

On success: 0

'-ESRCH' (No such process): No such process exists.

'- EPERM' (Operation not permitted): the system already monitors the
events for this process.
 int sys_stop_monitor(int pid)
(system call #244)
Return values:

On success: 0

'-ESRCH' (No such process): No such process exists.

'- EPERM' (Operation not permitted): the system doesn’t monitor the
events for this process.
 int sys_get_all_events_number()
(system call #245)
Return values:

The number of events in the system files.
 int sys_get_events(int pid, int n, file_event events_array[])
(system call #246)
Return values:

On success: The number of events read '-ESRCH' (No such process):
No such process exists.

'-EFAULT' (Bad address): incorrect data address for data (the
events_array array can’t be written to (e.g. doesn’t belong to the
calling process address space)).

'-EINVAL' (Invalid argument): if n is negative or if events_array is
NULL.
4. New processes
When a parent process creates a new child process (using fork()), the files opened by
parent are still open for the child and there is a need for two close events to close this
file on both sides. Therefore you are requested to copy the events of the parent to the
4
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
new son. When the system call get_all_events_number() is called, it should get all
events in the counting. You should not distinguish between copied and real events.
For example, if a process has 3 events in the list and then it creates a son process,
there are 6 events in the system (for get_all_events_number) 3 for parent and 3 for
child.
When a process first created it does not monitor any operation. It starts to monitor
operations only when the start_monitor() system call is called.
Pay attention that in fork time only pointers are going to be copied as part of the fork()
itself. Then you are in charge to allocate and copy the data (if you need) from parent
to son.
5. Example Wrapper
Here is an example of the code wrapper for example_wrapper (see explanation
below). Follow this example to write the other code wrappers:
int example_wrapper(int *array, int count){
long __res;
__asm__ volatile (
"movl $245, %%eax;"
"movl %1, %%ebx;"
"movl %2, %%ecx;"
"int $0x80;"
"movl %%eax,%0"
: "=m" (__res)
: "m" ((long)array), "m" (count)
: "%eax","%ebx","%ecx"
);
if ((unsigned long)(__res) >= (unsigned long)(-125)) {
errno = -(__res);
__res = -1;
}
return (int)(__res);
}
Explanation of inline assembler:
1) movl $245, %%eax - copy system call number to register eax.
2) movl %1, %%ebx - copy first parameter (array) to register ebx.
3) movl %2, %%ecx - copy second parameter (size) to register ecx.
4) int $0x80 – system call invocation via interrupt 0x80.
5) movl %%eax,%0 – copy the value that was returned by the system call to
%0 (which is the first output operand).
6) : "=m" (__res) – output operand.
7) : "m" ((long)array), "m" (size) – input operands.
5
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
8) : %eax,%ebx,%ecx– list of clobbered registers. Inform gcc that we use
eax, ebx, ecx registers.
You should read the following document for information about the commands used in
the preceding code segment:
http://www.ibm.com/developerworks/linux/library/l-ia/index.html
The code wrappers will not be put as a part of the kernel, but in a separate .h file
(syscall_files.h). This file shouldn't be put inside the kernel, but as a separate file.
When you test your system calls you need to include this file in your user mode test
program. Also in order to add a new system_calls you will need to update
arch/i386/kernel/entry.S
Finally, the event definition that we gave you is for the user mode (it should be defined
in the syscall_files.h). In the kernel mode you can call it by any name you want (for
example FileEvent).
6. Notes and Tips

The monitor of operations should be only between the invoking of the system call
start_montior to the system call stop_monitor. However, pay attention that it is
legal to call start_monitor several times (with stop_monitor in between). For
example, the following scenario should record 1 event (close, aaa):
o Start_monitpr
o Stop_monitor
o Open aaa
o Start_monitor
o Close aaa
o Stop monitor

You are not allowed to use syscall functions to implement code wrappers, or to
write the code wrappers for your system calls using the macro _syscall1. You should
write the code wrappers according to the example of the code wrapper given
above.

You should use the function kmalloc in order to allocate a memory from the kernel
mode.You can test your program by open and closing a file in C. For example,
fopen and fclose will use the system call sys_open and sys_close respectively.

You should use the functions copy_from_user, copy_to_user, etc. in order to copy
data from user space to kernel space and vice versa.
6
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)

All your changes must be made in the kernel level.

Submit only modified files from the Linux kernel.

You should not print the code.

Start working on the assignment as soon as possible. The deadline is final, NO
postponements will be given, and high load on the VMWare machines, Moed B
exams, etc. will not be accepted as an excuse for late submissions.

'-ENOENT' stands for 'minus ENOENT'

task_struct definition can be found in sched.h

Don't forget to set initialize all your data structures.

Write your own tests. We will check your assignment also with our test program.

Linux is case-sensitive. entry.S means entry.S, not Entry.s, Entry.S or entry.s.

You can assume that the system is with a single CPU.

The function init_idle in the file sched.c is responsible to initialize the first process
(swapper). You cannot use the kmalloc() in the init_idle function (it will not work).
You need to use the static data. Suppose you have added a pointer int* pi to the
task struct and you need to allocate the array. The way to do it is:
1. In the sched.c file define:
static int intarray[100];
2. in the init_idle function add the following line:
idle->pi = intarray;
Pay attention that the idle process never ends, so you don't need to free this space
anyway. Also please pay attention that the usage of int* above is only an example.

You should release all the allocated memory for the process when it ends. Look on
the function do_exit.

You should use kmalloc and kfree in the kernel in order to allocate and release
memory. If kmalloc fails you should return ENOSPC. For the kmalloc function use
flag GFP_KERNEL for the memory for kernel use

Pay attention that you cannot add an array (100 events – which is 800 bytes) to the
task struct. However, you can add a pointer to the array (which is only 4 bytes).
7
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
7. What should you do?
─ Add the implementation of the new system calls and update the existing system
calls
─ You should update the system calls sys_open and sys_close in the file fs/open.c
─ You should update the system calls do_fork in the file kernel/fork.c
─ Updating more files is needed
─ Make any necessary changes in the kernel code so the new system call can be used
like any other existing Linux system call. Your changes can include modifying any .c,
.h or .S(assembly) file that you find necessary.
─ Recompile and run the new kernel like you did in the first assignment.
─ Boot with your new Linux, and try to compile and run some test programs to make
sure the new system call works as expected.
Did it all? Good work, Submit your assignment. 
8. Submission
The submission of this assignment has two parts:
1. An electronic submission – you should create a zip file (use zip only, not gzip, tar, rar,
7z or anything else) containing the following files:
a. A tarball named kernel.tar.gz containing all the files in the kernel that
you created or modified (including any source, assembly or makefile).
To create the tarball run (inside VMWare):
cd /usr/src/linux-2.4.18-14custom
tar -czf kernel.tar.gz <list of modified or added files>
For example, if the only files you changed are
arch/i386/kernel/entry.S and kernel/syscall_files.c you should run
(the second command should be on one line, it was split due to being too
long on paper):
cd /usr/src/linux-2.4.18-14custom
tar –czf kernel.tar.gz arch/i386/kernel/entry.S kernel/syscall_
files.c
Make sure you don't forget any file and that you use relative paths in the
tar command, i.e., use kernel/syscall_files.c and not /usr/src/linux-2.4.1814custom/kernel/ syscall_files.c
b. A file named submitters.txt which includes the ID, name and email of
the participating students. The following format should be used:
8
Operating Systems (234123) – Winter 2013/14
(Homework Wet 1)
Bill Gates bill@t2.technion.ac.il 123456789
Linus Torvalds linus@gmail.com 234567890
Steve Jobs jobs@os_is_best.com 345678901
c. A file named syscall_files.h that contains the implementation of your
wrapper functions and other declarations.
Important Note: Make the outlined zip structure exactly. In particular, the zip
should contain only the following files (no directories!): kernel.tar.gz,
submitters.txt and syscall_msgs.h. You can create the zip by running (inside
VMware):
zip final.zip kernel.tar.gz submitters.txt syscall_files.h
The zip should look as follows:
zipfile -+
|
+- kernel.tar.gz
|
+- submitters.txt
|
+- syscall_files.h
2. A printed submission. You should write a short (1 page) summary explaining what you
have done in this assignment, which changes to the kernel data structures you have
done and which functions have been modified and how. This need to be attached with
the relevant cover page (separate from the dry) and submitted to the course cell.
Best Wishes,
The course staff
9