• State
  • Locked Locked
  • Replies 3 replies
  • Subscribers 98 subscribers
  • Views 1155 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

am3352: checksum (md5) of kernel text section

Rafal BARANSKI
Prodigy 110 points

Other Parts Discussed in Thread: AM3352

Hello,

I use Linux Kernel 4.1.18 (from TI SDK) on the am3352 board (embedded system).

I would like to count from the driver the md5 sum of Kernel's text section(s) and then verify with the value pre-calculated on host machine during system image creation.

On my currect build I have memory layout with ".text : 0xc0008000 - 0xc0673004 (6573 kB)". Based on this I try to count md5 of this area in the driver.

But, count value depends on:

1) system start. Mainly , value counted on host side is different then counted by driver: I see some changes in text area e.g. 0x813483e2 -> 0xc03483e2 (looks like addresses translations)

2) external application execution. Mainly ,after ntpd start, some words in ip area are changed e.g. in .text area of secure_tcpv6_sequence_number() or inet_ehashfn(). It looks like __force and __read_mostly attributes change (always 0xe1a00000 -> 0xea000004) some data.

Any suggestions, how should I count checksum of kernel in runtime? It should be verified with value created on host during system image creation.

Thanks in advance

  • 0
    TI__Guru 65405 points
    Hi Rafal,

    There is no trivial decision for your issue but you can mask changed bytes or use some kind of communication between the board and host PC to transmit changed bytes.

    BR
    Tsvetolin Shulev
  • 0 in reply to Cvetolin Shulev-XID
    Prodigy 110 points

    Tsvetolin Shulev,

    Thanks for issue investigation.

    Regarding to my results, it is not easy to add mask feature for changed bytes (or other option) because of large scale of changes between host's vmlinux and target's site (.text dump in range 0x8000 .. 0x66b003).
    With 'cmp' tool usage, I have more than 650 changed bytes (see attached diff.bin with - 1st column: address of changed byte, 2nd column: byte from dumped area, last column :value from vmlinux)
    Also, You can find result of diff tool output (based on 'xxd' output on vmlinux and dumped area file), mainly diff.hex file with corresponding differences with view of hex-line values.

    Any other suggestions?

    Thanks in advance

    ---

    1667.diff_bin&hex.zip

  • 0
    TI__Guru*** 125430 points

    Rafal BARANSKI said:
    2) external application execution. Mainly ,after ntpd start, some words in ip area are changed e.g. in .text area of secure_tcpv6_sequence_number() or inet_ehashfn(). It looks like __force and __read_mostly attributes change (always 0xe1a00000 -> 0xea000004) some data.

    Just a quick thought here... Based on your description it sounds like there is data embedded inside the .text section.  Did I understand that correctly?  If so, I think first and foremost there should be some adjustments to the underlying code itself to remove that data from .text and put it into an appropriate data section.

    In other words, I don't think your tool can account for these changes.  More likely there need to be some adjustments to "offending" portions of code such that the .text section is kept free of data.