news
Kernel Space: Sockets, eBPF, and Linux 6.11 On The ESP32-S
-
Yuval Hanoch Hirschenbein Sadde ☛ How can you not be romantic about UNIX domain sockets?
Earlier this summer, I gave a technical iOS talk at the DEFCON 34 convention (search up “Rage Against the Sandbox”) and my demo crashed on stage right at startup. I played it off cool and just re-launched the demo and it all worked pretty nicely.
Honestly, I was so nervous about a 1-day LPE exploit (DarkSword) with 36% success rate I was about to show, that the crash didn’t even bother me. But it was Vegas, so I figured “what the hell” and beat the house with a success on first try on stage (not counting the initial crash as it’s not related to the exploit).
Coming back home, I began finalizing the project before releasing its code publicly and it made me want to dig deeper into the crash issue.
-
Nathan Naveen ☛ Dropping eBPF CPU Cost by About 90% With Memoization (Not AI Gen)
My brother and I spent a lot of time designing our eBPF security agent to be really fast from the ground up, but recently we discovered we could make it much faster using memoization!
A couple of weeks ago, I profiled the eBPF code and found that the most expensive part of the protection isn’t actually enforcing a policy (allow/deny), but figuring out which policy applies to a given file open.
Our policies are path based, so our eBPF leverages an LSM hook that triggers on file open. We then reconstruct the path, walk up parent dentries, and check whether the file or any ancestor directory has a matching policy. While this works, it isn’t performant, and we end up repeating much of the work for files we have already seen (for example, database accesses that repeatedly reaccess file paths).
So, we cache which policy applies for each inode. This dropped our kernel CPU cost by about 90%.
-
Hackaday ☛ Running Linux 6.11 On The ESP32-S3 With A Few Tweaks
With the Xtensa Lx7 twin CPU cores in the ESP32-S3 running at a relatively zippy 240 MHz and accompanying PSRAM of up to 16 MB, you might find yourself wondering whether it could run Linux. As [Paulneja] demonstrates with Linux kernel 6.11, the answer is a ‘yes’, though with the usual caveats.
What complicates matters with the ESP32-S3 is that it lacks certain amenities that spoiled OSes like Linux have come to take for granted, such as a Memory Management Unit (MMU). To deal with this, the NOMMU Linux configuration was used, along with a custom fork() implementation. Although the previous 0.7 version sort-of worked, the current 0.8 release is the first that manages to actually boot reliably and has a usable amount of RAM available after boot.