SonarQube / SonarCloud for kernel module static analysis

SonarCloud (online version of SonarQube) can be used for static code analysis of C code of kernel modules. It also has a nice and simple integration with GitHub and Travis CI, although there are some known issues . I have successfully used it with my FL2000 DRM dongle driver pet project, some interesting results:

• In order to get it working with Travis on Ubuntu 18.04 had to use "proposed" repository with 5.3 GCP kernel headers
• Issue with incorrect interceptor library filename can be solved as I described in a comment to SonarQube issue on community forum
• Analysis gave me some recommendations around MISRA compliance, cool!
• Plenty of "smells" are useless, of course, but still worth to review

Now need to implement synthetic DRM tests on Travis, user mode Linux maybe, or qemu / virtme, but how to collect coverage?

Automate DKMS modules signing in Linux

Some time ago I have managed to sign DKMS Nvidia modules with generated keys and upload those to UEFI. Of course, I had to sign modules every time they've been rebuilt, i.e. when kernel or nvidia driver gets updated. So after few kernel updates I have decided to automate the task via postinst.d hook.

#!/bin/sh

DKMS_DIR=/lib/modules/$1/updates/dkms
KEYS_DIR=/opt/sign
SIGN_CMD=/usr/src/linux-headers-$1/scripts/sign-file

for file in $DKMS_DIR/*.ko
do
    $SIGN_CMD sha256 $KEYS_DIR/MOK.priv $KEYS_DIR/MOK.der "$file" > /dev/null 2>&1
done

exit 0

Not quite sure but looks it will get executed also on kernel uninstall :) Now, need to address Nvidia packages updates.

Module signing in Linux

Got xUbuntu 16.04 installed alongside with Windows 10 on UEFI with Secure Boot enabled and had to get 3rd party GPU drivers running so found this nice answer here.

---

Since kernel version 4.4.0-20, it was enforced that unsigned kernel modules will not be allowed to run with Secure Boot enabled. If you'd want to keep Secure Boot and also run these modules, then the next logical step is to sign those modules.

So let's try it.

1. Create signing keys
   openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=descriptive name/"
2. Sign the module
   sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der /path/to/module
3. Register the keys to Secure Boot
   sudo mokutil --import MOK.der
   Supply a password for later use after reboot
4. Reboot and follow instructions to Enroll MOK (Machine Owner Key). Here's a sample with pictures. The system will reboot one more time.

Please let me know if your modules would run this way on Ubuntu 16.04 (on kernel 4.4.0-21, I believe).

Resources: Detailed website article for Fedora and Ubuntu implementation of module signing.

One addition for the security-conscious: the private key MOK.priv generated by openssl -nodes as above is not protected by a password. Thus in principle, a rogue program could use it to sign a compromised module or even taint the bootloader, as your signing key now sits in hardware storage as a trusted key. A more secure solution is to omit the -nodes option. In step 1 openssl will then ask for a password to protect the private key. Before step 2, when signing, set the KBUILD_SIGN_PIN environment variable to the password you specified in step 1.

Sparse is dead?

Just noticed that Linux kenel sparse tool is not maintained well anymore. It has two repositories actually:

• on kernel.org http://git.kernel.org/?p=devel/sparse/sparse.git
• and on github.com https://github.com/chrisforbes/sparse

but unfortunately both are not seem to be supported anymore. In order to make my small program work with cgcc I had to apply few patches fixing GCC incompatibilities, but reviewing sparse code further I see lots of other issues; there are lots of fixing patches hanging in the internet, too. It's pity but this nice tool seem to be dead.

Update: sparse cannot even handle arrays of boolean, what a shame...

Eclipse + kernel

Indexing in Eclipse is finally working correctly.
http://wiki.eclipse.org/HowTo_use_the_CDT_to_navigate_Linux_kernel_source

kernel development using Eclipse (OMAP4 pandaboard + 2.6.35 + Android)

Working with kernel sources

Just found out that guys in my team are using all different editors for kernel code debugging - and all not very effective enough... Of course the best solution IMHO is till gvim + ctags, but if you wish something more fancy :) you can go with Eclipse - so I've tried to set it up on my fresh Ubuntu 11.04 x64

1. Download and install toolchain
For the reasons unknown I have decided to use Linaro toolchain for my games. According to Linaro HOWTO this is as simple as entering one command for natty:
  sudo apt-get install gcc-arm-linux-gnueabi
of course, I have all my Ubuntu build tools preinstalled.


2. Download the kernel sources
Since I am going to use OMAP4 pandaboard with 2.6.35 kernel on Android - I am following instructions on OMAPpedia wiki to pull the kernel:

  git clone git://git.omapzoom.org/kernel/omap.git kernel
  git checkout -b p-android-omap-2.6.35_local remotes/origin/p-android-omap-2.6.35

Before building the kernel with latest Linaro toolchain I need to apply a patch that resolves binutils architecture issues with 2.6.35 kernel.


diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 884eb1f..6854066 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -30,8 +30,10 @@ obj-$(CONFIG_HOTPLUG_CPU) += omap-hotplug.o
  obj-$(CONFIG_ARCH_OMAP4) += omap44xx-smc.o omap4-common.o \
                              omap4-wakeupgen.o

-AFLAGS_omap44xx-smc.o :=-Wa,-march=armv7-a
-
+plus_sec := $(call as-instr,.arch_extension sec,+sec)
+AFLAGS_omap-headsmp.o :=-Wa,-march=armv7-a$(plus_sec)
+AFLAGS_omap44xx-smc.o :=-Wa,-march=armv7-a$(plus_sec)
+
 # Functions loaded to SRAM
 obj-$(CONFIG_ARCH_OMAP2420) += sram242x.o
 obj-$(CONFIG_ARCH_OMAP2430) += sram243x.o
@@ -69,6 +71,7 @@ obj-$(CONFIG_OMAP_SMARTREFLEX_CLASS1P5) += smartreflex-class1p5.o

 AFLAGS_sleep24xx.o :=-Wa,-march=armv6
 AFLAGS_sleep34xx.o :=-Wa,-march=armv7-a
+AFLAGS_sleep44xx.o :=-Wa,-march=armv7-a$(plus_sec)

 ifeq ($(CONFIG_PM_VERBOSE),y)
 CFLAGS_pm_bus.o += -DDEBUG
diff --git a/security/smc/omap4/Makefile b/security/smc/omap4/Makefile
index af345a1..af545a2 100644
--- a/security/smc/omap4/Makefile
+++ b/security/smc/omap4/Makefile
@@ -38,4 +38,7 @@ tf_driver-objs += tf_comm_mshield.o
 tf_driver-objs += tf_device_mshield.o
 tf_driver-objs += bridge_pub2sec.o

+plus_sec := $(call as-instr,.arch_extension sec,+sec)
+AFLAGS_bridge_pub2sec.o :=-Wa,-march=armv7-a$(plus_sec)
+
 obj-$(CONFIG_SECURITY_MIDDLEWARE_COMPONENT) += tf_driver.o

This was already fixed on the latest kernels, refer to this thread for details. If you are using CodeSourcery toolchain referred in OMAPpedia wiki - you don't need it.
Compile the kernel with pandaboard defconfig (as per latest available L27.12.1-P2 release notes) with modified toolchain


  make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- distclean
  make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- android_4430_defconfig
  make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- uImage

Later we will need to follow full instructions - patches, folders, environment variables, but to start working with kernel this should be pretty enough.

3. Download and install Eclipse
I prefer not to use one that is supplied with Ubuntu so I am just downloading Eclipse IDE for C/C++ Linux Developers 64-bit  from eclipse.org. Prefer to keep it in the opt folder usually...

  cd /opt
  sudo mkdir eclipse
  sudo chmod a+rwx eclipse
  tar -xvzf ~/Downloads/eclipse-linuxtools-indigo-incubation-linux-gtk-x86_64.tar.gz 

There is an ugly bug in the latest eclipse when it crashes during index rebuilding so I had to use a workaround offered by Marc-Andre Laperle with adding
  -XX:-UseCompressedOops
to eclipse.ini file. Probably I will also need to increase the maximum memory usage limitations later.

4. Configuring Eclipse to work with Linux kernel
Some time ago I used to use one python script to generate kernel symbols for the .project file, but today I have found a very nice article on how to correctly index kernel with Eclipse on the eclipse.org wiki. My customizations:

• Step 14: since we are doing cross compilation, I need to add custom build variables in the corresponding menu of the C/C++ Build options. Add ARCH with value arm and CROSS_COMPILE with value arm-linux-gnueabi- to all configurations. Maybe I will need to add some compiler options later here, but for now it is quite enough
• Step 15: use arm-linux-gnueabi-gcc for compiler command
• Step 25: here I have arch/arm/include, also I had to add arch/arm/plat-omap/include and arch/arm/mach-omap2/include
• Step 33: here I have everything except arch/arm
• Additionally in C/C++ Build options I am setting Build target in the Behavior tab to uImage and Build command in the Builder Settings tab to make ARCH=${ARCH} CROSS_COMPILE=${CROSS_COMPILE}
• In the end you will need to clean and rebuild from Eclipse to get the list of issues 

Your Eclipse is ready to work with OMAP4 2.6.35 Android kernel code. Enjoy...