Model checking the BPF verifier by shunghsiyu

Project Description

BPF verifier plays a crucial role in securing the system (though less so now that unprivileged BPF is disabled by default in both upstream and SLES), and bugs in the verifier has lead to privilege escalation vulnerabilities in the past (e.g. CVE-2021-3490).

One way to check whether the verifer has bugs to use model checking (a formal verification technique), in other words, build a abstract model of how the verifier operates, and then see if certain condition can occur (e.g. incorrect calculation during value tracking of registers) by giving both the model and condition to a solver.

For the solver I will be using the Z3 SMT solver to do the checking since it provide a Python binding that's relatively easy to use.

Goal for this Hackweek

Learn how to use the Z3 Python binding (i.e. Z3Py) to build a model of (part of) the BPF verifier, probably the part that's related to value tracking using tristate numbers (aka tnum), and then check that the algorithm work as intended.

Resources

• Formal Methods for the Informal Engineer: Tutorial #1 - The Z3 Theorem Prover and its accompanying notebook is a great introduction into Z3
  • Has a section specifically on model checking
• Software Verification and Analysis Using Z3 a great example of using Z3 for model checking
• Sound, Precise, and Fast Abstract Interpretation with Tristate Numbers - existing work that use formal verification to prove that the multiplication helper used for value tracking work as intended
• [PATCH v5 net-next 00/12] bpf: rewrite value tracking in verifier - initial patch set that adds tristate number to the verifier

---

Officially Become a Kernel Hacker! by m.crivellari

Description

My studies as well my spare time are dedicated to the Linux Kernel. Currently I'm focusing on interrupts on x86_64, but my interests are not restricted to one specific topic, for now.

I also "played" a little bit with kernel modules (ie lantern, a toy packet analyzer) and I've added a new syscall in order read from a task A, the memory of a task B.

Maybe this will be a good chance to...

Goals

• create my first kernel patch

Resources

• https://www.kernel.org/doc/html/latest/process/submitting-patches.html
• https://git-send-email.io/ (mentioned also in the kernel doc)
• https://javiercarrascocruz.github.io/kernel-contributor-1

Achivements

• found while working on a bug, this is the 1st patch: cifs: avoid deadlocks while updating iface [✅ has been merged]

---

Improve various phones kernel mainline support (Qualcomm, Exynos, MediaTek) by pvorel

Similar to previous hackweeks ( https://hackweek.opensuse.org/projects/improve-qualcomm-soc-msm8994-slash-msm8992-kernel-mainline-support, https://hackweek.opensuse.org/projects/test-mainline-kernel-on-an-older-qualcomm-soc-msm89xx-explore-mainline-kernel-qualcomm-mainlining) try to improve kernel mainline support of various phones.

---

Contributing to Linux Kernel security by pperego

Description

A couple of weeks ago, I found this blog post by Gustavo Silva, a Linux Kernel contributor.

I always strived to start again into hacking the Linux Kernel, so I asked Coverity scan dashboard access and I want to contribute to Linux Kernel by fixing some minor issues.

I want also to create a Linux Kernel fuzzing lab using qemu and syzkaller

Goals

1. Fix at least 2 security bugs
2. Create the fuzzing lab and having it running

The story so far

• Day 1: setting up a virtual machine for kernel development using Tumbleweed. Reading a lot of documentation, taking confidence with Coverity dashboard and with procedures to submit a kernel patch
• Day 2: I read really a lot of documentation and I triaged some findings on Coverity SAST dashboard. I have to confirm that SAST tool are great false positives generator, even for low hanging fruits.
• Day 3: Working on trivial changes after I read this blog post: https://www.toblux.com/posts/2024/02/linux-kernel-patches.html. I have to take confidence with the patch preparation and submit process yet.
  • First trivial patch sent: using strtruefalse() macro instead of hard-coded strings in a staging driver for a lcd display
  • Fix for a dereference before null check issue discovered by Coverity (CID 1601566) https://scan7.scan.coverity.com/#/project-view/52110/11354?selectedIssue=1601566
• Day 4: Triaging more issues found by Coverity.
  • The patch for CID 1601566 was refused. The check against the NULL pointer was pointless so I prepared a version 2 of the patch removing the check.
  • Fixed another dereference before NULL check in iwlmvmparsewowlaninfo_notif() routine (CID 1601547). This one was already submitted by another kernel hacker :(
• Day 5: Wrapping up. I had to do some minor rework on patch for CID 1601566. I found a stalker bothering me in private emails and people I interacted with me, advised he is a well known bothering person. Markus Elfring for the record.

• Wrapping up: being back doing kernel hacking is amazing and I don't want to stop it. My battery pack is completely drained but changing the scope gave me a great twist and I really want to feel this energy not doing a single task for months.

  I failed in setting up a fuzzing lab but I was too optimistic for the patch submission process.

The patches

1

---

Create DRM drivers for VESA and EFI framebuffers by tdz

Description

We already have simpledrm for firmware framebuffers. But the driver is originally for ARM boards, not PCs. It is already overloaded with code to support both use cases. At the same time it is missing possible features for VESA and EFI, such as palette modes or EDID support. We should have DRM drivers for VESA and EFI interfaces. The infrastructure exists already and initial drivers can be forked from simpledrm.

Goals

• Initially, a bare driver for VESA or EFI should be created. It can take functionality from simpledrm.
• Then we can begin to add additional features. The boot loader can provide EDID data. With VGA hardware, VESA can support paletted modes or color management. Example code exists in vesafb.

---

Build a split keyboard from scratch by mpagot

Description

I'm getting older... this summer I experienced an annoying and persistent tingling in one hand and arm. That was the initial motivation to get more interested in ergonomic work gadgets, and from that to split keyboards. And that was the entrance in a rabbit hole.

Which keyboard I like to create:

• Split keyboard for ergonomic (I'm not primary interested in having it portable)
• I have big hands: I like it to fit as much as possible my hands measures
• Columnar stagger keys position
• Not too few keys (at the moment I'm at 24 + 24)
• One row thumb cluster
• No wireless, not to have batteries and for security reason
• CherryMX, or generally speaking no low profile/corne choc
• Hot swap Socket switches

Goals

• Create PCB design for a split keyboard
• Get it produced
• Mount it
• Evaluate FWs

Resources

• Main project repo: Zenga
• ZKM config for a hand wired 4 keys something: nne
• Blog posts opensuse.hackweek.2024

Progress

Day1

Get the existing Ergogen project working on my TW machine Get Kicad as flatpack Go back to the https://flatfootfox.com/ergogen-part3-pcbs/ Join the #ergogen Discord channel and ask for help about the nets

Day2

Redesign the keyboard matrix on Inkscape Implement it in the Ergogen YAML format Create a Kicad PCB file Start routing it Iterate over the matrix arrangement to try to implement it like 2 layer board and ideally with not vias Get some Kicad tutorials

Day3

Get my hand dirty building a 2x2 key matrix --> welcome to nne Look at ZKM and how to configure it --> https://github.com/michelepagot/zmk-config-nne Get the FW built by github, try to flash it: get matrix scan pulse but no keys to the PC Get in contact with ceoloide, an Ergogen maintainer, about net issue.

---

SUSE Prague claw machine by anstalker

Project Description

The idea is to build a claw machine similar to e.g. this one:

Why? Well, it could be a lot of fun!

But also it's a great way to dispense SUSE and openSUSE merch like little Geekos at events like conferences, career fairs and open house events.

Goal for this Hackweek

Build an arcade claw machine.

Resources

In French, an article about why you always lose in claw machine games:

We're looking for handy/crafty people in the Prague office:

• woodworking XP or equipment
• arduino/raspi embedded programming knowledge
• Anthony can find a budget for going to GM and buying servos and such ;)

---

Capyboard, ESP32 Development Board for Education by emiler

Description

Capyboard is an ESP32 development board built to accept individual custom-made modules. The board is created primarily for use in education, where you want to focus on embedded programming instead of spending time with connecting cables and parts on a breadboard, as you would with Arduino and other such devices. The board is not limited only to education and it can be used to build, for instance, a very powerful internal meteo-station and so on.

I already have one initial prototype ready and tested. The next iteration addresses several issues the first prototype had. I am planning on finishing up the mainboard and one of the modules this week.

This project is also a part of my master's thesis.

Goals

• Finish testing of a new prototype
• Publish source files
• Documentation completion
• Finish writing thesis

Resources

• github.com/realcharmer/capyboard
• github.com/realcharmer/capyboard-starter
• github.com/realcharmer/capyboard-docs
• docs.capyboard.dev

---

Framework laptop integration by nkrapp

Project Description

Although openSUSE does run on the Framework laptops out-of-the-box, there is still room to improve the experience. The ultimate goal is to get openSUSE on the list of community supported distros

Goal for this Hackweek

The goal this year is to at least package all of the soft- and firmware for accessories like the embedded controller, Framework 16 inputmodule and other tools. I already made some progress by packaging the inputmodule control software, but the firmware is still missing

Resources

As I only have a Framework laptop 16 and not a 13 I'm looking for people with hardware that can help me test

Progress:

Update 1:

The project lives under my home for now until I can get an independent project on OBS: Framework Laptop project

Also, the first package is already done, it's the cli for the led-matrix spacer module on the Framework Laptop 16. I am also testing this myself, but any feedback or questions are welcome.

You can test the package on the Framework 16 by adding this repo and installing the package inputmodule-control

Update 2:

I finished packaging the python cli/gui for the inputmodule. It is using a bit of a hack because one of the dependencies (PySimpleGUI) recently switched to a noncommercial license so I cannot ship it. But now you can actually play the games on the led-matrix (the rust package doesn't include controls for the games). I'm also working on the Framework system tools now, which should be more interesting for Framework 13 users.

You can test the package on the Framework 16 by installing python311-framework16_inputmodule and then running "ledmatrixctl" from the command line.

Update 3:

I packaged the framework_tool, a general application for interacting with the system. You can find it some detailed information what it can do here. On my system everything related to the embedded controller functionality doesn't work though, so some help testing and debugging would be appreciated.

Update 4:

Today I finished the qmk interface, which gives you a cli (and gui) to configure your Framework 16 keyboard. Sadly the Python gui is broken upstream, but I added the qmk_hid package with the cli and from my testing it works well.

Final Update:

All the interesting programs are now done, I decided to exclude the firmware for now since upstream also recommends using fwupd to update it. I will hack on more things related to the Framework Laptops in the future so if there are any ideas to improve the experience (or any bugs to report) feel free to message me about it.

As a final summary/help for everyone using a Framework Laptop who wants to use this software:

The source code for all packages can be found in repositories in the Framework organization on Github

All software can be installed from this repo (Tumbleweed)

The available packages are:

• framework-inputmodule-control (FW16) - play with the inputmodules on your Framework 16 (b1-display, led-matrix, c1-minimal)

• python-framework16_inputmodule (FW16) - same as inputmodule-control but is needed if you want to play and crontrol the built-in games in the led-matrix (call with ledmatrixctl or ledmatrixgui)

• framework_tool (FW13 and FW 16) - use to see and configure general things on your framework system. Commands using the embedded controller might not work, it looks like there are some problems with the kernel module used by the EC. Fixing this is out of scope for this hackweek but I am working on it

• qmk_hid (FW16) - a cli to configure the FW16 qmk keyboard. Sadly the gui for this is broken upstream so only the cli is usable for now

---