libark

libark is a modern, secure, Swift-native foundational layer over Linux POSIX primitives.

While originally developed as the core runtime layer for ArkOS, libark is completely decoupled and designed to be used on any Linux distribution. It provides highly secure, object-oriented abstractions over low-level system calls, memory management, and file system interactions, without the burden of manual C interoperability.

Features

• Object-Oriented POSIX: Wraps file descriptors, paths, and directory operations in safe, RAII-compliant Swift types.
• Secure Syscall Boundary: Routes kernel interactions through strict, audited Syscall primitives.
• Terminal Capabilities: Built-in abstractions for TTY detection and window sizing.
• Advanced Formatting: Standardized formatters for human-readable byte sizes (SI and IEC), ISO 8601 timestamps, permissions, and classifications.
• Declarative Sorting: Powerful generic SortEngine for metadata sorting across multiple criteria.

I am not an expert in kernels or cybersecurity but I want to understand how spywares such has pegasus access camera, mails, ...

The first lesson that's taught in an operating system course is that kernel provides process isolation. i.e, process A can't have access to process B's memory. Access to hardwares and running privileged instructions are restricted to kernel-space programs only. The kernel runs in kernel-space and all the other user applications run in user-space. A user process trying to access any hardware without going through the kernel will be flagged and killed by the kernel. So, how did pegasus gain access to things like camera, ... without getting stopped by kernel?

Hi all!

Since Reverse Engineering community with AI is kinda growing and succeeds in a lot of fields, I am wondering, if we can let AI try to reverse engineer e.g. Macos / Windows Kernel and drivers, to get it easier to port functionality to Linux?

Is anyone aware of such ongoing projects (with AI)?

Would help to bring Linux to MacOS HW, or get better ARM support for Snapdragon chips under Linux.

U-Boot has a delay of zero seconds, I have tried to log in using obvious usernames and passwords but they don't work, I am on the system via UART and BP seems to have put on a custom boot up scripts the board was manufactured by IOTecha. Boot log is

[*] Opening /dev/ttyUSB0 at 115200 baud...

[*] Waiting for bootloader... Power on the charger NOW.

0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too[ 0.000000] VMMU: segment too big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (80000000) for index 0

[ big (8000] Li�] version 2.6.35-vcpustreamplug-1.1a-Ru-MBS-v2.2.1-0-g9b1ce305 (jenkins@lnx2.int.iotecha.com) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #1 Thu Nov 9 21:28:35 UTC 2023

[ 0.000000] CPU: vCPUv5 [14069260] revision 0 (ARMv5TEJ)

[ 0.000000] CPU: VIVT data cache, VIVT instruction cache

[ 0.000000] Machine: ST-STREAMPLUG

[ 0.000000] ATag virq 69, "timer_tick"

[ 0.000000] ATag microvisor_timer c8, 69, "timer_microvisor_timer"

[ 0.000000] ATag virq 6a, "ksp_signal"

[ 0.000000] ATag ksp_agent c9, 6a, "ksp_ksp_agent"

[ 0.000000] ATag ksp_shared_mem fd000000, 1300000, 100000, "shm_KSP_SHARED_MEMORY"

[ 0.000000] ATag Shared Buffer 40000000, 80000000, "pci_express1"

[ 0.000000] OKL4: vcpu_helper_page at 8480e000/01fff000

[ 0.000000] VMMU:paging_init: VMMU: Cache management handing is possibly not correct (SDK-1545).

[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 59944

[ 0.000000] Kernel command line: console=ttyAMA0,115200n8 ubi.mtd=1 root=ubi0_0 rootfstype=ubifs ro clcd=off sata=off pcie=off usb=on:host eth=on:secondary:1:a0:02:4a:e0:93:82 i2c=on ssp=on:25 uart1=on:primary uart2=on:primary can=off firda=off fsmc=on:nand0:initdone sport=off ts=off ark_gpio=on:111211 arm_gpio1=on arm_gpio2=on board=ac_main mtdparts=nand:48M@0M(rootfs_factory),144M@48M(rootfs),256M@192M(aux),16M@448M(config)

[ 0.000000] [M10]: parse_eth_options eth_clk_opt = 1

[ 0.000000] [M10]: parse_eth_options mac_addr[0] = a0:02:4a:e0:93:82

[ 0.000000] parse_ssp_options gpio_pin 25

[ 0.000000] [M10]: parse_fsmc_options fsmc_init_opt = 0

[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)

[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)

[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)

[ 0.000000] Memory: 236MB = 236MB total

[ 0.000000] Memory: 233216k/233216k available, 8448k reserved, 0K highmem

[ 0.000000] Virtual kernel memory layout:

[ 0.000000] vector : 0x01fff000 - 0x02000000 ( 4 kB)

[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)

[ 0.000000] DMA : 0xef600000 - 0xf0000000 ( 10 MB)

[ 0.000000] vmalloc : 0x93000000 - 0xe9e00000 (1390 MB)

[ 0.000000] lowmem : 0x84000000 - 0x92c00000 ( 236 MB)

[ 0.000000] modules : 0x83000000 - 0x84000000 ( 16 MB)

[ 0.000000] .init : 0x84000000 - 0x84028000 ( 160 kB)

[ 0.000000] .text : 0x84028000 - 0x845b5000 (5684 kB)

[ 0.000000] .data : 0x845d4000 - 0x8460f520 ( 238 kB)

[ 0.000000] Hierarchical RCU implementation.

[ 0.000000] Verbose stalled-CPUs detection is disabled.

[ 0.000000] NR_IRQS:122

[ 0.000000] Console: colour dummy device 80x30

[ 0.000000] Calibrating delay loop... 162.20 BogoMIPS (lpj=811008)

[ 0.220000] pid_max: default: 32768 minimum: 301

[ 0.220000] Mount-cache hash table entries: 512

[ 0.220000] CPU: Testing write buffer coherency: ok

[ 0.220000] VCPU support v1.0

[ 0.220000] devtmpfs: initialized

[ 0.220000] NET: Registered protocol family 16

[ 0.240000] padmux: dev name arm_gpio1

[ 0.240000] padmux: dev name arm_gpio2

[ 0.240000] padmux: dev name ark_gpio

[ 0.240000] padmux: dev name uart1

[ 0.250000] padmux: dev name uart2

[ 0.250000] padmux: dev name usb

[ 0.250000] padmux: dev name eth

[ 0.250000] padmux: dev name i2c

[ 0.250000] padmux: dev name ssp

[ 0.250000] padmux: dev name fsmc

[ 0.250000] [STreamPlugDBG]: phy input clock for eth is pll2

[ 0.250000] [STreamPlugDBG]: ark gpio group A muxed on GPIO_08

[ 0.250000] [STreamPlugDBG]: ark gpio group B muxed on GPIO_07

[ 0.250000] [STreamPlugDBG]: ark gpio group C muxed on GPIO_04

[ 0.250000] [STreamPlugDBG]: ark gpio group D muxed on GPIO_10

[ 0.250000] [STreamPlugDBG]: ark gpio group E muxed on GPIO_12

[ 0.250000] [STreamPlugDBG]: ark gpio group F muxed on GPIO_13

[ 0.250000] Serial: AMBA PL011 UART driver

[ 0.250000] uart1: ttyAMA0 at MMIO 0xd0000000 (irq = 26) is a AMBA/PL011

[ 0.260000] console [ttyAMA0] enabled

[ 0.270000] uart2: ttyAMA1 at MMIO 0xd0080000 (irq = 27) is a AMBA/PL011

[ 0.390000] bio: create slab <bio-0> at 0

[ 0.400000] SCSI subsystem initialized

[ 0.410000] usbcore: registered new interface driver usbfs

[ 0.420000] usbcore: registered new interface driver hub

[ 0.420000] usbcore: registered new device driver usb

[ 0.430000] Advanced Linux Sound Architecture Driver Version 1.0.23.

[ 0.440000] NET: Registered protocol family 23

[ 0.450000] Switching to clocksource microvisor timer

[ 0.460000] NET: Registered protocol family 2

[ 0.470000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)

[ 0.480000] TCP established hash table entries: 8192 (order: 4, 65536 bytes)

[ 0.480000] TCP bind hash table entries: 8192 (order: 3, 32768 bytes)

[ 0.490000] TCP: Hash tables configured (established 8192 bind 8192)

[ 0.500000] TCP reno registered

[ 0.500000] UDP hash table entries: 256 (order: 0, 4096 bytes)

[ 0.510000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

[ 0.510000] NET: Registered protocol family 1

[ 0.520000] RPC: Registered udp transport module.

[ 0.520000] RPC: Registered tcp transport module.

[ 0.530000] RPC: Registered tcp NFSv4.1 backchannel transport module.

[ 0.560000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.

[r] fuse init (API version 7.14)

[ 0.570000] msgmni has been set to 455

[ 0.590000] alg: No test for stdrng (krng)

[ 0.830000] io scheduler noop registered

[ 0.830000] io scheduler deadline registered

[ 0.840000] io scheduler cfq registered (default)

+rʚ] brd: module loaded

[ 0.940000] st: Version 20081215, fixed bufsize 32768, s/g segs 256

[ 0.950000] streamplug_smi_probe:start

[ 0.960000] smi smi: mtd .name=smi0 .size=1000000(16M)

[ 0.960000] smi smi: .erasesize = 0x10000(64K)

[ 0.970000] Creating 0 MTD partitions on "smi0":

[ 1.970000] smi_wait_tff timeout: status = 0

[ 1.970000] smi smi: smi controller is busy, timeout

[ 1.970000] smi smi: smi-nor1 not found

[ 1.980000] smi smi: bank setup failed

[ 2.980000] smi_wait_tff timeout: status = 0

[ 2.980000] smi smi: smi controller is busy, timeout

[ 2.980000] smi smi: smi-nor2 not found

[ 2.990000] smi smi: bank setup failed

[ 2.990000] streamplug_smi_probe:hand5

[ 3.000000] fsmc_nand_probe virq 115

[ 3.000000] fsmc_nand_probe virq 116

[ 3.000000] fsmc_nand_print_setup: pc = 0000220c

[ 3.010000] fsmc_nand_print_setup: comm = 01040600

[ 3.010000] fsmc_nand_print_setup: attrib = 01040600

[ 3.020000] fsmc_nand_print_setup: sts = 000001d7

[ 3.020000] ONFI flash detected

[ 3.030000] ONFI param page 0 valid

[ 3.030000] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xdc (Unknown NAND 512MiB 3,3V 8-bit)

[ 3.040000] 4 cmdlinepart partitions found on MTD device nand

[ 3.050000] Creating 4 MTD partitions on "nand":

[ 3.050000] 0x000000000000-0x000003000000 : "rootfs_factory"

[ 3.070000] 0x000003000000-0x00000c000000 : "rootfs"

[ 3.110000] 0x00000c000000-0x00001c000000 : "aux"

[ 3.180000] 0x00001c000000-0x00001d000000 : "config"

[ 3.190000] fsmc-nand fsmc-nand: FSMC NAND driver registration successful

[ 3.200000] ssp-pl022 ssp-pl022.0: ARM PL022 driver, device ID: 0x00241022

[ 3.210000] pl022: mapped registers from 0xd0100000 to 930f0000

[ 3.210000] ip101g:ѕ5

[ 3.220000] CAN device driver interface

[ 3.220000] STMMAC driver:

[ 3.220000] platform registration...

[ 3.230000] done!

[ 3.230000] DWMAC1000 - user ID: 0x10, Synopsys ID: 0x37

[ 3.240000] Enhanced descriptor structure

[ 3.240000] ACTPHYIF = 0000: GMII or MII

[ 3.250000] eth0 - (dev. name: stmmaceth - id: -1, IRQ #4

[ 3.250000] IO base addr: 0x93100000)

[ 3.310000] STMMAC MII Bus: probed

[ 3.320000] eth0: PHY ID 02430c54 at 0 IRQ -1 (0:00) active

[ 3.320000] eth0: PHY ID 00000000 at 1 IRQ 0 (0:01)

[ 3.330000] eth0: PHY ID 00000000 at 2 IRQ 0 (0:02)

[ 3.330000] eth0: PHY ID 00000000 at 3 IRQ 0 (0:03)

[ 3.340000] eth0: PHY ID 00000000 at 4 IRQ 0 (0:04)

[ 3.340000] eth0: PHY ID 00000000 at 5 IRQ 0 (0:05)

[ 3.350000] eth0: PHY ID 00000000 at 6 IRQ 0 (0:06)

[ 3.350000] eth0: PHY ID 00000000 at 7 IRQ 0 (0:07)

[ 3.360000] eth0: PHY ID 00000000 at 8 IRQ 0 (0:08)

[ 3.360000] eth0: PHY ID 00000000 at 9 IRQ 0 (0:09)

[ 3.370000] eth0: PHY ID 00000000 at 10 IRQ 0 (0:0a)

[ 3.370000] eth0: PHY ID 00000000 at 11 IRQ 0 (0:0b)

[ 3.380000] eth0: PHY ID 00000000 at 12 IRQ 0 (0:0c)

[ 3.380000] eth0: PHY ID 00000000 at 13 IRQ 0 (0:0d)

[ 3.390000] eth0: PHY ID 00000000 at 14 IRQ 0 (0:0e)

[ 3.390000] eth0: PHY ID 00000000 at 15 IRQ 0 (0:0f)

[ 3.400000] eth0: PHY ID 00000000 at 16 IRQ 0 (0:10)

[ 3.400000] eth0: PHY ID 00000000 at 17 IRQ 0 (0:11)

[ 3.410000] eth0: PHY ID 00000000 at 18 IRQ 0 (0:12)

[ 3.410000] eth0: PHY ID 00000000 at 19 IRQ 0 (0:13)

[ 3.420000] eth0: PHY ID 00000000 at 20 IRQ 0 (0:14)

[ 3.420000] eth0: PHY ID 00000000 at 21 IRQ 0 (0:15)

[ 3.430000] eth0: PHY ID 00000000 at 22 IRQ 0 (0:16)

[ 3.430000] eth0: PHY ID 00000000 at 23 IRQ 0 (0:17JC[ 3.440000] eth0: PHY ID 00000000 at 24 IRQ 0 (0:18)

[ 3.440000] eth0: PHY ID 00000000 at 25 IRQ 0 (0:19)

[ 3.450000] eth0: PHY ID 00000000 at 26 IRQ 0 (0:1a)

[ 3.450000] eth0: PHY ID 00000000 at 27 IRQ 0 (0:1b)

[ 3.460000] eth0: PHY ID 00000000 at 28 IRQ 0 (0:1c)

[ 3.460000] eth0: PHY ID 00000000 at 29 IRQ 0 (0:1d)

[ 3.470000] eth0: PHY ID 00000000 at 30 IRQ 0 (0:1e)

[ 3.470000] eth0: PHY ID 00000000 at 31 IRQ 0 (0:1f)

[ 3.480000] STMMAC_VIRT driver:

[ 3.480000] Claiming KSP shared mem...

[ 3.490000] done!

[ 3.490000] STMMAC_VIRT driver:

[ 3.490000] Claiming KSP agent...

[ 3.500000] done!

[ 3.500000] STMMAC_VIRT driver:

[ 3.500000] Addin ethernet device...

[ 3.510000] done!

[ 3.510000] eth1 - (dev. name: stmmacvirteth - id: -1, IRQ #119

[ 3.510000] IO base addr: 0x93200000)

[ 3.520000] PPP generic driver version 2.4.2

[ 3.530000] tun: Universal TUN/TAP device driver, 1.6

[ 3.530000] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com

[ 3.540000] usbcore: registered new interface driver asix

[ 3.550000] usbcore: registered new interface driver cdc_ether

[ 3.550000] usbcore: registered new interface driver smsc95xx

[ 3.560000] usbcore: registered new interface driver net1080

[ 3.570000] usbcore: registered new interface driver cdc_subset

[ 3.570000] usbcore: registered new interface driver zaurus

[ 3.580000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver

[ 3.590000] streamplug-ehci streamplug-ehci: STREAMPLUG EHCI

[ 3.590000] streamplug-ehci streamplug-ehci: new USB bus registered, assigned bus number 1

[ 3.630000] streamplug-ehci streamplug-ehci: irq 5, io mem 0xe1800000

[ 3.650000] streamplug-ehci streamplug-ehci: USB 0.0 started, EHCI 1.00

[ 3.650000] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002

[ 3.660000] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1

[ 3.670000] usb usb1: Product: STREAMPLUG EHCI

[ 3.670000] usb usb1: Manufacturer: Linux 2.6.35-vcpustreamplug-1.1a-Ru-MBS-v2.2.1-0-g9b1ce305 ehci_hcd

[ 3.680000] usb usb1: SerialNumber: streamplug-ehci

[ 3.690000] hub 1-0:1.0: USB hub found

[ 3.690000] hub 1-0:1.0: 1 port detected

[ 3.700000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver

[ 3.710000] streamplug-ohci streamplug-ohci.0: STREAMPLUG OHCI

[ 3.710000] streamplug-ohci streamplug-ohci.0: new USB bus registered, assigned bus number 2

[ 3.720000] streamplug-ohci streamplug-ohci.0: irq 5, io mem 0xe1900000

[ 3.790000] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001

[ 3.800000] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1

[ 3.800000] usb usb2: Product: STREAMPLUG OHCI

[ 3.810000] usb usb2: Manufacturer: Linux 2.6.35-vcpustreamplug-1.1a-Ru-MBS-v2.2.1-0-g9b1ce305 ohci_hcd

[ 3.820000] usb usb2: SerialNumber: streamplug-ohci.0

[ 3.830000] hub 2-0:1.0: USB hub found

[ 3.830000] hub 2-0:1.0: 1 port detected

[ 3.840000] usbcore: registered new interface driver cdc_acm

[ 3.840000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters

[ 3.850000] Initializing USB Mass Storage driver...

[ 3.860000] usbcore: registered new interface driver usb-storage

[ 3.860000] USB Mass Storage support registered.

[ 3.870000] usbcore: registered new interface driver usbserial

[ 3.880000] usbserial: USB Serial Driver core

[ 3.880000] USB Serial support registered for FTDI USB Serial Device

[ 3.890000] usbcore: registered new interface driver ftdi_sio

[ 3.900000] ftdi_sio: v1.6.0:USB FTDI Serial Converters Driver

[ 3.900000] USB Serial support registered for GSM modem (1-port)

[ 3.910000] usbcore: registered new interface driver option

[ 3.920000] option: v0.7.2:USB Driver for GSM modems

[ 3.920000] Loading designware_udc:

[ 3.930000] mice: PS/2 mouse device common for all mice

[ 3.930000] i2c /dev entries driver

[ 3.940000] reset_i2c_controller

[ 3.960000] i2c:switch_init_once. Number of GPIO 2

[ 3.970000] Linux video capture interface: v2.00

[ 3.980000] HM1355 driver loaded

[ 3.990000] sp805-wdt wdt: registration successful

[ 4.000000] dw_dmac: DesignWare DMA Controller, 8 channels

[ 4.010000] usbcore: registered new interface driver usbhid

[ 4.020000] usbhid: USB HID core driver

[ 4.020000] No device for DAI AKCODEC

[ 4.030000] ALSA device list:

[ 4.030000] No soundcards found.

[ 4.040000] nf_conntrack version 0.5.0 (3644 buckets, 14576 max)

[ 4.050000] ip_tables: (C) 2000-2006 Netfilter Core Team

[ 4.050000] TCP cubic registered

[ 4.060000] NET: Registered protocol family 10

[ 4.060000] ip6_tables: (C) 2000-2006 Netfilter Core Team

[ 4.070000] IPv6 over IPv4 tunneling driver

[ 4.080000] usb 1-1: new high speed USB device using streamplug-ehci and address 2

[ 4.080000] NET: Registered protocol family 17

[ 4.090000] Bridge firewalling registered

[ 4.090000] can: controller area network core (rev 20090105 abi 8)

[ 4.100000] NET: Registered protocol family 29

[ 4.110000] can: raw protocol (rev 20090105)

[ 4.110000] can: broadcast manager protocol (rev 20090105 t)

[ 4.120000] IrCOMM protocol (Dag Brattli)

[ 4.160000] 802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com

[ 4.170000] All bugs added by David S. Miller davem@redhat.com

[ 4.180000] UBI: attaching mtd1 to ubi0

[ 4.190000] UBI: physical eraseblock size: 131072 bytes (128 KiB)

[ 4.200000] UBI: logical eraseblock size: 126976 bytes

[ 4.200000] UBI: smallest flash I/O unit: 2048

[ 4.210000] UBI: data offset: 4096 (aligned 2048)

[ 4.250000] usb 1-1: New USB device found, idVendor=05e3, idProduct=0610

[ 4.250000] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0

[ 4.260000] usb 1-1: Product: USB2.0 Hub

[ 4.290000] hub 1-1:1.0: USB hub found

[ 4.290000] hub 1-1:1.0: 4 ports detected

[ 5.380000] UBI: max. sequence number: 1012

[ 5.410000] UBI: attached mtd1 to ubi0

[ 5.410000] UBI: MTD device name: "rootfs"

[ 5.420000] UBI: MTD device size: 144 MiB

[ 5.420000] UBI: number of good PEBs: 1151

[ 5.430000] UBI: number of bad PEBs: 1

[ 5.430000] UBI: number of corrupted PEBs: 0

[ 5.440000] UBI: max. allowed volumes: 128

[ 5.440000] UBI: wear-leveling threshold: 4096

[ 5.450000] UBI: number of internal volumes: 1

[ 5.450000] UBI: number of user volumes: 1

[ 5.450000] UBI: available PEBs: 0

[ 5.460000] UBI: total number of reserved PEBs: 1151

[ 5.460000] UBI: number of PEBs reserved for bad PEB handling: 55

[ 5.470000] UBI: max/mean erase counter: 3/1

[ 5.470000] UBI: image sequence number: 2140351432

[ 5.480000] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)

[ 5.540000] UBI: background thread "ubi_bgt0d" started, PID 641

^@^@^@^C [ 5.670000] UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode

[ 5.680000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 5.690000] UBIFS: FS size: 137261056 bytes (130 MiB, 1081 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)

[ 5.700000] UBIFS: reserved for root: 0 bytes (0 KiB)

[ 5.710000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 9EE334E5-9B30-419B-B739-7D81CB38A00C, small LPT model

[ 5.720000] VFS: Mounted root (ubifs filesystem) readonly on device 0:13.

[ 5.730000] devtmpfs: mounted

[ 5.730000] Freeing init memory: 160K

^C ^ ^C ^C ^ C ^ [REMOUNT] File /root/.first.boot is detected. Skip remount.

^C Using /dev/console tty...

Verifying /dev/ubi10_0 device is not mounted...

^C Executing cat /proc/mounts ...

rootfs / rootfs rw 0 0

ubi0_0 / ubifs ro,relatime 0 0

devtmpfs /dev devtmpfs rw,relatime,size=116608k,nr_inodes=29152,mode=755 0 0

proc /proc proc rw,relatime 0 0

devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0

tmpfs /tmp tmpfs rw,relatime 0 0

sysfs /sys sysfs rw,relatime 0 0

Device is not mounted

Looking for partition in /proc/mtd...

^ Executing cat /proc/mtd ...

dev: size erasesize name

mtd0: 03000000 00020000 "rootfs_factory"

mtd1: 09000000 00020000 "rootfs"

mtd2: 10000000 00020000 "aux"

mtd3: 01000000 00020000 "config"

Found /dev/mtd2

Checking UBIFS...

Attaching /dev/mtd2 to 10...

Executing ubiattach -p /dev/mtd2 -d 10 ...

[ 6.860000] UBI: attaching mtd2 to ubi10

[ 6.870000] UBI: physical eraseblock size: 131072 bytes (128 KiB)

[ 6.870000] UBI: logical eraseblock size: 126976 bytes

[ 6.880000] UBI: smallest flash I/O unit: 2048

[ 6.890000] UBI: VID header offset: 2048 (aligned 2048)

[ 6.890000] UBI: data offset: 4096

^C 5 C C C ^C ^C 5 ^C C ^C ^C ^C ^C ^C ^C ^C ^C [ 8.780000] UBI: max. sequence number: 10435134

[ 8.810000] UBI: attached mtd2 to ubi10

[ 8.820000] UBI: MTD device name: "aux"

[ 8.820000] UBI: MTD device size: 256 MiB

[ 8.830000] UBI: number of good PEBs: 2046

[ 8.830000] UBI: number of bad PEBs: 2

[ 8.840000] UBI: number of corrupted PEBs: 0

[ 8.840000] UBI: max. allowed volumes: 128

[ 8.840000] UBI: wear-leveling threshold: 4096

[ 8.850000] UBI: number of internal volumes: 1

[ 8.850000] UBI: number of user voյ: 1

[ 8.860000] UBI: available PEBs: 0

[ 8.860000] UBI: total number of reserved PEBs: 2046

[ 8.870000] UBI: number of PEBs reserved for bad PEB handling: 100

[ 8.870000] UBI: max/mean erase counter: 7257/5099

[ 8.880000] UBI: image sequence number: 412662062

^C [ 8.880000] UBI: background thread "ubi_bgt10d" started, PID 673

UBI device number 10, total 2046 LEBs (259792896 bytes, 247.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

Device attached

Trying to mount UBIFS...

Creating /var/aux mounting path...

Executing mkdir -p /var/aux ...

Mounting /dev/ubi10_0 to /var/aux...

Executing mount -t ubifs /dev/ubi10_0 /var/aux ...

[ 8.950000] UBIFS: background thread "ubifs_bgt10_0" started, PID 677

^C [ 9.020000] UBIFS: recovery needed

^C ^C ^C ^C

[*] Interrupt phase finished. Entering interactive mode.

[*] If you see a prompt (=> or login:), type your commands now.

[*] To exit, press Ctrl+A then Ctrl+X (in picocom/minicom) or Ctrl+C here.

[ 10.190000] UBIFS: recovery completed

[ 10.190000] UBIFS: mounted UBI device 10, volume 0, name "volume_name"

[ 10.200000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 10.210000] UBIFS: FS size: 244936704 bytes (233 MiB, 1929 LEBs), journal size 12316672 bytes (11 MiB, 97 LEBs)

[ 10.220000] UBIFS: reserved for root: 4952683 bytes (4836 KiB)

[ 10.230000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID D81B2F97-9C6A-437A-BEEB-8C3BAC104C1B, small LPT model

Volume mounted

Verifying FS is RW...

Trying to create /var/aux/test_file ...

echo 1 > /var/aux/test_file

Verifying /var/aux/test_file content...

echo 1 | diff /var/aux/test_file -

Trying to remove /var/aux/test_file ...

Executing rm -f /var/aux/test_file ...

Partition is heatlhy

UBIFS is mounted and healthy

Using /dev/console tty...

Verifying /dev/ubi11_0 device is not mounted...

Executing cat /proc/mounts ...

rootfs / rootfs rw 0 0

ubi0_0 / ubifs ro,relatime 0 0

devtmpfs /dev devtmpfs rw,relatime,size=116608k,nr_inodes=29152,mode=755 0 0

proc /proc proc rw,relatime 0 0

devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0

tmpfs /tmp tmpfs rw,relatime 0 0

sysfs /sys sysfs rw,relatime 0 0

/dev/ubi10_0 /var/aux ubifs rw,relatime 0 0

Device is not mounted

Looking for partition in /proc/mtd...

Executing cat /proc/mtd ...

dev: size erasesize name

mtd0: 03000000 00020000 "rootfs_factory"

mtd1: 09000000 00020000 "rootfs"

mtd2: 10000000 00020000 "aux"

mtd3: 01000000 00020000 "config"

Found /dev/mtd3

Checking UBIFS...

Attaching /dev/mtd3 to 11...

Executing ubiattach -p /dev/mtd3 -d 11 ...

[ 10.680000] UBI: attaching mtd3 to ubi11

[ 10.680000] UBI: physical eraseblock size: 131072 bytes (128 KiB)

[ 10.690000] UBI: logical eraseblock size: 126976 bytes

[ 10.690000] UBI: smallest flash I/O unit: 2048

[ 10.700000] UBI: VID header offset: 2048 (aligned 2048)

[ 10.700000] UBI: data offset: 4096

[ 10.840000] UBI: max. sequence number: 1943

[ 10.860000] UBI: attached mtd3 to ubi11

[ 10.860000] UBI: MTD device name: "config"

[ 10.870000] UBI: MTD device size: 16 MiB

[ 10.870000] UBI: number of good PEBs: 128

[ 10.880000] UBI: number of bad PEBs: 0

[ 10.880000] UBI: number of corrupted PEBs: 0

[ 10.890000] UBI: max. allowed volumes: 128

[ 10.890000] UBI: wear-leveling threshold: 4096

[ 10.900000] UBI: number of internal volumes: 1

[ 10.900000] UBI: number of user volumes: 1

[ 10.900000] UBI: available PEBs: 0

[ 10.910000] UBI: total number of reserved PEBs: 128

[ 10.910000] UBI: number of PEBs reserved for bad PEB handling: 5

[ 10.920000] UBI: max/mean erase counter: 30/16

[ 10.920000] UBI: image sequence number: 1799539602

[ 10.930000] UBI: background thread "ubi_bgt11d" started, PID 700

UBI device number 11, total 128 LEBs (16252928 bytes, 15.5 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

Device attached

Trying to mount UBIFS...

Creating /etc/iotecha/configs mounting path...

Executing mkdir -p /etc/iotecha/configs ...

Mounting /dev/ubi11_0 to /etc/iotecha/configs...

Executing mount -t ubifs /dev/ubi11_0 /etc/iotecha/configs ...

[ 11.000000] UBIFS: background thread "ubifs_bgt11_0" started, PID 704

[ 11.060000] UBIFS: recovery needed

[ 11.150000] UBIFS: recovery completed

[ 11.160000] UBIFS: mounted UBI device 11, volume 0, name "iotc-config"

[ 11.160000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 11.170000] UBIFS: FS size: 13840384 bytes (13 MiB, 109 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)

[ 11.180000] UBIFS: reserved for root: 653715 bytes (638 KiB)

[ 11.190000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 8CECDA61-A507-4250-B4F2-DE1F83ECFEDF, small LPT model

Volume mounted

Verifying FS is RW...

Trying to create /etc/iotecha/configs/test_file ...

echo 1 > /etc/iotecha/configs/test_file

Verifying /etc/iotecha/configs/test_file content...

echo 1 | diff /etc/iotecha/configs/test_file -

Trying to remove /etc/iotecha/configs/test_file ...

Executing rm -f /etc/iotecha/configs/test_file ...

Partition is heatlhy

UBIFS is mounted and healthy

[ 11.370000] UBIFS: background thread "ubifs_bgt0_0" started, PID 713

[ 11.410000] UBIFS: background thread "ubifs_bgt0_0" stops

[Thu Jan 1 00:00:11 UTC 1970] Cleanup not needed

[update info] checking updates (boot source: upgrade)...

Skipping wrong directory: /var/aux/updates/applied

Skipping directory without keys: /var/aux/updates/db

Skipping wrong directory: /var/aux/updates/factory

Skipping wrong directory: /var/aux/updates/failed

Skipping directory without keys: /var/aux/updates/sessions

Skipping wrong directory: /var/updates/*

Apply all config in /etc/sysctl.d

kernel.panic = 60

kernel.panic_on_oops = 1

fs.mqueue.msg_max = 20

sysctl: error: 'fs.mqueue.msgsize_default' is an unknown key

fs.mqueue.msgsize_max = 16384

net.ipv4.tcp_keepalive_time = 60

net.ipv4.tcp_keepalive_intvl = 60

net.ipv4.tcp_keepalive_probes = 1

Starting logging: OK

No kernel modules found for upgrade

No kernels found for upgrade

Starting mdev...

FIRMWARE_VERS: 6769742D34353337623234613531663920696F74635F6C325F70620000000000

FIRMWARE_CRC: 8E53

EVIC_VERS: 6769742D34353337623234613531663920696F74635F6C325F70620000000000

EVIC_CRC: 8E53

CRC fw.s19 and EVIC CRC are equal

VERSION fw.s19 and EVIC VERSION are equal

No flashing required

HMI firmware hmi_Release-Ru_783933b3ff48aa is up to date.

Resetting HMI:

Initializing AuthManagerApp properties...ALREADY INITIALIZED

Initializing ConfigManager properties...ALREADY INITIALIZED

Initializing EnergyManager properties...ALREADY INITIALIZED

Initializing NetworkBoss properties...ALREADY INITIALIZED

Initializing TokenManagerApp properties...ALREADY INITIALIZED

Initializing brpkg-lte-quectel properties...ALREADY INITIALIZED

Initializing brpkg-wifi-ap properties...ALREADY INITIALIZED

Initializing brpkg-wifi-ap properties...ALREADY INITIALIZED

Initializing hmi-boss properties...ALREADY INITIALIZED

Initializing ihal properties...ALREADY INITIALIZED

Initializing iotc-eebus-evcs properties...ALREADY INITIALIZED

Initializing iotc-fw-update properties...ALREADY INITIALIZED

Initializing iotc-system properties...ALREADY INITIALIZED

Initializing netlogger properties...ALREADY INITIALIZED

Initializing ChargerApp properties...ALREADY INITIALIZED

Initializing i2p2 properties...ALREADY INITIALIZED

I2P2 MQTT Client Id: bp-prod-IOT00141648D8FE4C01

Initializing iotc-meter-dispatcher properties...ALREADY INITIALIZED

Initializing iotc-meter-modbus-general properties...ALREADY INITIALIZED

Initializing sync-clock properties...ALREADY INITIALIZED

Initializing GridCodes properties...ALREADY INITIALIZED

^A[28] [error] ctk-merge-configs:iotc-keyctl is not present. Can not process signed archives

Initializing iotc-energy-manager-db-init properties...DONE

Initializing iotc-health-monitor properties...ALREADY INITIALIZED

Initializing iotc-racc-init-db properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

C�Initializing CustomUI properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

Initializing iotc-racc properties...ALREADY INITIALIZED

Initializing iotc-racc/users.d...ALREADY INITIALIZED

Initializing ocpp-cmd properties...ALREADY INITIALIZED

OCPP Link: wss://ws.pulsevision.bppulse.co.uk/chargepoint/ws/PH0009854

Load configuration from /etc/iotecha/configs/ocpp-cmd/ocpp-cmd.properties

iotc-logger:New Channels Setup: 1

Create databases for ocpp...

Database BootLayer is existed

Database Authorization is existed

Database SmartCharging is existed

Database ChargerController is existed

Database OfflineController is existed

Database Net is existed

Creating databases for ocpp is DONE

Initializing iotc-cert-mgr properties...ALREADY INITIALIZED

Initializing ocpp-cmd properties MasterAuthorizationKey...ALREADY INITIALIZED

[ 36.300000] UBI error: ubi_attach_mtd_dev: mtd0 is already attached to ubi20

Initializing iotc-system properties...ALREADY INITIALIZED

[36] [error] ctk-ubimount:mount: mounting /dev/ubi20_0 on /factory failed: Device or resource busy

[36] [error] ctk-ubimount:failed to mount ubifs

Factory partition mounted.

Cannot check tamper detection settings, disabling it

/etc/config_init.d/S44-ru-customization: line 1: can't create tempfile: Read-only file system

[ 36.940000] UBIFS: un-mount UBI device 20, volume 0

[ 37.010000] UBI: mtd0 is detached from ubi20

read-only file system detected...done

Root password is already changed, skip updating

Starting system message bus: done

Starting core dump init ... done.

Init hostname ... done.

root: Adding wfx kernel module

[ 38.290000] Loading modules backported from Linux version v3.14.22-0-gd7892a4

[ 38.290000] Backport generated by backports.git v3.14.22-1-0-g7793930

[ 38.700000] cfg80211: Calling CRDA to update world regulatory domain

[ 39.700000] cfg80211: World regulatory domain updated:

[ 39.710000] cfg80211: DFS Master region: unset

[ 39.710000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)

[ 39.720000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm)

[ 39.730000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm)

[ 39.740000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm)

[ 39.750000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm)

[ 39.750000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2000 mBm)

[ 39.760000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm)

[ 39.770000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm)

[ 39.780000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm)

[ 39.790000] cfg80211: Calling CRDA for country: GB

[ 39.960000] cfg80211: Regulatory domain changed to country: GB

[ 39.960000] cfg80211: DFS Master region: ETSI

[ 39.970000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)

[ 39.980000] cfg80211: (2402000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm)

[ 39.990000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm)

[ 39.990000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2000 mBm)

[ 40.000000] cfg80211: (5490000 KHz - 5710000 KHz @ 160000 KHz), (N/A, 2700 mBm)

[ 40.010000] cfg80211: (57000000 KHz - 66000000 KHz @ 2160000 KHz), (N/A, 4000 mBm)

[ 40.250000] wfx: Silicon Labs 2.12

[ 40.290000] wfx-spi spi0.0: error while requesting gpio wakeup

[ 40.950000] wfx-spi spi0.0: started firmware 3.13.0 "WF200_ASIC_WFM_(Jenkins)_FW3.13.0" (API: 3.8, keyset: C0, caps: 0x00000000)

[ 41.040000] wfx-spi spi0.0: MAC address 0: 2c:11:65:ad:db:d0

[ 41.050000] wfx-spi spi0.0: MAC address 1: 2c:11:65:ad:db:d1

root: wlan0 interface found

root: wfx module loaded successfully

modprobe: module ehci-hcd not found in modules.dep

Loading Quectel LTE USB modules...

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

ERROR: Failed to load LTE USB modules

Starting ConfigManager: done

Starting NetworkBoss: done

Enabling iptables rule: Rule 'default' applied successfully

OK

Starting network: udhcpc: started, v1.25.0

udhcpc: sending discover

udhcpc: sending discover

udhcpc: sending discover

udhcpc: no lease, forking to background

[ 89.690000] ADDRCONF(NETDEV_UP): wlan0: link is not ready

udhcpc: started, v1.25.0

udhcpc: sending discover

udhcpc: sending discover

udhcpc: sending discover

udhcpc: no lease, forking to background

OK

iotc-cert-mgr-init-csr: start

iotc-cert-mgr-init-csr: CSR exists

iotc-cert-mgr-init-csr: done

iotc-cert-mgr-update-common-names: start

iotc-cert-mgr-update-common-names: 0 candidate(s) found

iotc-cert-mgr-update-common-names: done

Starting Network Interface Plugging Daemon: eth0.

Starting sync clock ... started in background.

Error resolving pool.ntp.org: Name or service not known (-2)

1 Jan 00:01:53 ntpdate[1471]: Can't find host pool.ntp.org: Name or service not known (-2)

1 Jan 00:01:53 ntpdate[1471]: no servers can be used, exiting

Starting dropbear sshd: OK

Starting lighttpd: OK

Starting watchdog...

[REMOUNT] File /root/.first.boot is detected. Skip remount.

Starting dnsmasq: OK

[EVIC] Resetting 'Wait Cable Unplug'

ACK

Starting netlogger: done

Starting AuthManagerApp: done

Starting EnergyManager: done

Starting iotc-meter-dispatcher: done

Starting TokenManagerApp: done

Starting hmi-boss: done

Starting iotc-cert-mgr: done

Starting i2p2app: done

Starting ChargerApp: done

Starting iotc-meter-modbus-general: done

Starting cron ... done.

Starting iotc-eebus-evcs: done

Starting iotc-health-monitor: done

Starting iotc-racc: done

Starting ocpp-cmd: done

cat: can't open '/tmp/i2p2_components': No such file or directory

cat: can't open '/tmp/i2p2_components': No such file or directory

cat: can't open '/tmp/i2p2_components': No such file or directory

[ 206.320000] UBI warning: ubi_io_read: error -74 (ECC error) while reading 507 bytes from PEB 744:77792, read only 507 bytes, retry

cat: can't open '/tmp/i2p2_components': No such file or directory

^A

-----------------------------------components-----------------------------------

ST2100 devid = 00141648D8FE4C01

MainBoard Serial = <NONE>

HMIBoardCPU = <NONE>

SIM ICCID = <NONE>

Power Board CPU = <NONE>

CT ID = <NONE>

FAN self-test = failure

MAC-PLC-Internal = a0:02:4a:e0:93:80

MAC-PLC-Linux = a0:02:4a:e0:93:81

MAC-Ethernet = a0:02:4a:e0:93:82

--------------------------------------------------------------------------------

_____ _______ _

|_ _| |__ __| | |

| | ___ | | ___ ___| |__ __ _

| | / _ \| |/ _ \/ __| '_ \ / _` |

_| || (_) | | __/ (__| | | | (_| |

|________/|_|___|___|_| |_|__,_|

Last reboot completed at Thursday, 01 January 1970

Operating system release : Linux-2.6.35-vcpustreamplug-1.1a-Ru-MBS-v2.2.1-0-g9b1ce305

Machine Architecture: vcpuv5-el

Console: /dev/ttyAMA0

Welcome to bppulse-PH0009854

Default password has been changed

bppulse-PH0009854 login:

_____ _______ _

|_ _| |__ __| | |

| | ___ | | ___ ___| |__ __ _

| | / _ \| |/ _ \/ __| '_ \ / _` |

_| || (_) | | __/ (__| | | | (_| |

|________/|_|___|___|_| |_|__,_|

Last reboot completed at Thursday, 01 January 1970

Operating system release : Linux-2.6.35-vcpustreamplug-1.1a-Ru-MBS-v2.2.1-0-g9b1ce305

Machine Architecture: vcpuv5-el

Console: /dev/ttyAMA0

Welcome to bppulse-PH0009854

Default password has been changed

bppulse-PH0009854 login: ^A

Any help would be much appreciated. Thanks

Hey everyone,

I graduated last year with a Bachelor's degree in Computer Science, and my current job requires me to port Ghostlock (CVE-2026-43499) to multiple android devices.

Honestly, a lot of it currently goes over my head. I think I understand the basic concept of a use-after-free vulnerability, but I don't understand how it works at the kernel level or how the exploit code actually works.

I'm also struggling to get the exploit working on my target device. Since I don't fully understand the exploit's internals or how the kernel processes the operations involved, I'm having a hard time figuring out what needs to be changed to make it work.

Here's what I have so far:

- Kernel panic logs from my attempts to run the exploit.

- The compiled kernel source code for my target device.

- The ability to modify the kernel source code and flash a custom kernel onto the device.

The problem is that I don't really know where to start. The kernel panic logs are difficult to understand, the exploit's source code is confusing, and navigating the relevant kernel code is equally challenging.

My current plan is to:

1. Learn how to interpret the kernel panic logs.

2. Understand the exploit's source code and how its different parts work.

3. Trace the relevant operations through the kernel source code to understand what's happening internally.

4. Use that understanding to troubleshoot the exploit and figure out what needs to change for my target device.

I'm not sure if this is the right approach or if I'm missing some important prerequisites.

For context, I'm still relatively new to low-level kernel exploitation, so I'm trying to figure out the best way to approach this without blindly changing things until they work.

For those experienced with Linux kernel exploitation or porting Android kernel exploits, how would you approach this problem? Are there any resources or concepts I should focus on first?

Any advice would be greatly appreciated!

Hey every one this Kaif

I graduated this year and i am honestly bored using AI and developing. I want to try and check out kernel engineering, can any one mentor me .

Thank you for everyone

My colleagues tried building a prototype EDR driver (intercepting file I/O, process creation, and registry changes) entirely with AI tools.
**The surprise:** AI generated amazingly clean, 8-module, maintainable architecture with dynamic IOCTL handling and ring-buffer diagnostics.
**The reality check:** It also accidentally introduced major security flaws and BSOD triggers:
**Open Device Access:** Unprotected control device allowing unprivileged IOCTL execution.

**Missing I/O Paths:** Completely missed memory-mapped writes and Transactional NTFS.

**BSOD Traps:** Name queries on paging paths causing deadlocks, plus missing re-entry guards (recursive callback loops).

**Context Naivety:** Hardcoded trust for PID 4 and threadless IRPs.

**Lesson learned:** AI can generate gorgeous facade code, but kernel drivers require deep domain knowledge about race conditions, memory paths, and threat models that AI currently misses.
Let me know in the comments if you want a follow-up post with more details!

Author here. This started as an experiment: can I run a real Linux glibc userspace on a stock, non-rooted Android phone without proot or a chroot?

Short answer: yes, by own-loading the guest libc into the same process as the bionic host and doing the dynamic linking myself. The interesting bugs were IFUNC/IRELATIVE resolution, the fact that the guest glibc malloc and the host bionic malloc share one brk (fixed with a private arena), static TLS + the thread pointer switch point, and Android's seccomp profile killing clone3 / close_range with SIGSYS instead of ENOSYS.

It runs python3, uv, gcc (compiling and running C inside the guest), git, gh, fzf, Node, tmux, and an interactive zsh with a starship prompt. No root, no namespaces, no ptrace.

What I'd most like feedback on: I only have a couple of devices, so the bugs left are the ones that appear on other phones. There are issue templates for bug reports and for "it works" reports — even "this ran fine on my Pixel" is useful.

Happy to answer anything about the loader.

Minha kernel não tem GKI

Hi iam new in osdev and iam getting started iam trying to develop my proper operating system kernel from scratch but iam stuck in debugging my boot sector code with qemu and gdb can someone help ?

the problem that i encounter is that the boot sector goes from 16 bit mode to 32bit and when i try to see what each instruction do to memory it doesn't work well and the instructions doesn't get well recognized.

is there a technique i can use for this type of debugging.

here is my makefile :

BUILD_DIR = build

TARGET = $(BUILD_DIR)/MyOs

C_SOURCES = $(wildcard kernel/\*.c drivers/\*.c )

HEADERS = $(wildcard kernel/\*.h drivers/\*.h )

OBJ = ${C_SOURCES:.c=.o}

ENTRY_OBJ = kernel/entry.o

KERNEL_DEBUG_OBJ = build/kernel.elf

BOOT_DEBUG_OBJ = $(BUILD_DIR)/bootsector.elf

CFLAGS = -ffreestanding -g -mno-red-zone -mno-sse -mno-mmx \\

\-fno-pic -fno-pie -fno-stack-protector

QEMU = qemu-system-x86_64 -no-reboot -no-shutdown -d int,cpu_reset -D build/qemu.log

QEMU_DRIVE = -drive format=raw,file=$<,if=floppy

all: $(TARGET)

$(BUILD_DIR):

mkdir -p $@

run: $(TARGET)

$(QEMU) $(QEMU\\_DRIVE) &

\########################################################

\###################### IMAGE BUILD #####################

\########################################################

\# OS image build

$(TARGET) : $(BUILD_DIR)/bootsector.bin $(BUILD_DIR)/kernel.bin

cat $\\\^ > $@

\# bootsector build

$(BUILD_DIR)/bootsector.bin : boot/bootsector.asm build/kernel.bin | $(BUILD_DIR)

nasm -DSECTORS=$$(( ($$(wc -c < build/kernel.bin) + 511) / 512 )) $< -o $@

\# kernel build

$(BUILD_DIR)/kernel.bin: $(ENTRY_OBJ) $(OBJ) | $(BUILD_DIR)

ld -m elf\\_x86\\_64 -T linker.ld --oformat binary $\\\^ -o $@

\# object files creatde next of their source

%.o: %.c $(HEADERS)

gcc $(CFLAGS) -c $< -o $@

%.o: %.asm

nasm $< -f elf64 -g -o $@

\########################################################

\###################### DEBUG MODE ######################

\########################################################

$(KERNEL_DEBUG_OBJ): $(ENTRY_OBJ) $(OBJ) | $(BUILD_DIR)

ld -m elf\\_x86\\_64 --oformat elf64-x86-64 -o $@ -T linker.ld $\\\^

$(BOOT_DEBUG_OBJ): boot/bootsector.asm build/kernel.bin | $(BUILD_DIR)

nasm -f elf32 -g -F dwarf -DDEBUG \\\\

  \\-DSECTORS=$$(( ($$(wc -c < build/kernel.bin) + 511) / 512 )) $< -o $(BUILD\\_DIR)/bootsector.o

ld -m elf\\_i386 -Ttext 0x7c00 -o $@ $(BUILD\\_DIR)/bootsector.o

bdebug: QEMU = qemu-system-i386

bdebug: $(TARGET) $(BOOT_DEBUG_OBJ)

$(QEMU) -s -S $(QEMU\\_DRIVE) &

gdb -ex "set confirm off" \\\\

    \\-ex "set disassembly-flavor intel" \\\\

    \\-ex "target remote localhost:1234" \\\\

    \\-ex "set architecture i8086" \\\\

\-ex "symbol-file $(BOOT_DEBUG_OBJ)" \\

\-ex "hbreak _start"; \\

    \\-ex "continue"; \\\\

kill %1 2>/dev/null || pkill -f "$(QEMU)"

kdebug: $(TARGET) $(KERNEL_DEBUG_OBJ)

$(QEMU) -s -S $(QEMU\\_DRIVE) &

gdb -ex "set confirm off" \\\\

    \\-ex "set disassembly-flavor intel" \\\\

    \\-ex "target remote localhost:1234" \\\\

\-ex "add-symbol-file $(KERNEL_DEBUG_OBJ)" \\

\-ex "break main"; \\

    \\-ex "continue"; \\\\

kill %1 2>/dev/null || pkill -f "$(QEMU)"

\########################################################

\####################### CLEANING #######################

\########################################################

clean:

rm -rf $(BUILD\\_DIR) $(OBJ) $(ENTRY\\_OBJ)

Hi! I'd like to post my iOS 27 kernelcache reverse engineering research

(SEP dispatch map with 96 selectors, AMFI diff, Ghidra workflow) as a

text post with a link to the GitHub repo. It's a technical writeup, not

a blog or video series, and contains no new vulnerabilities. Per rule 2,

I'm checking with you first. Is this OK for r/kernel?

So I have been working in the industry for around 2 years now. 1.5 years as an embedded firmware engineer and half a year as an embedded linux engineer at the same company(startup). Lately I have been working a lot with BSP and device driver development. I have noticed that Canonical has a junior linux kernel developer position open and I wanted to know is it smart to get into this field as a linux device driver developer and also to go work for a company like Canonical.

https://github.com/carlosplanchon/rsyscall-ng

rsyscall-ng lets you control local or remote Linux processes from Python using syscall semantics directly: "clone", "execve", sockets, namespaces, file descriptors, memory, and more.

Instead of treating a remote machine as an RPC API or service, it treats it as Linux processes you can program almost as if they were local.

The original project had been dormant for several years and no longer worked cleanly with current Python/Trio, so I decided to bring it back, because I think the main idea was so cool.

It preserves the original Python API and history while modernizing it for current Python/Trio and replacing the native C side with a clean-room Rust implementation. Development of the modernization was heavily assisted by Claude Code, with compatibility validated through differential testing against the original implementation.

Hey everyone, especially kernel/OS developers,

I had a weird thought and I'm curious how you'd approach it from a systems perspective:

If we imagined the human brain as a kernel, and neurons, brain regions, memory, sensory systems, etc. as kernel subsystems, what kind of kernel architecture would make the most sense? hybrid kernel microkernel or monolithic or something else?

Traditional Python profilers work in userspace using sampling (py-spy, Pyroscope). They miss what happens at the kernel level. GIL contention, off-CPU waits, scheduler delays are all invisible to them.

I built a profiler using BCC that attaches eBPF uprobes to CPython's take_gil/drop_gil and gc_collect_main. It walks the Python frame chain directly from BPF to capture full Python stacks at the exact moment of GIL contention or GC pause. No sampling. Event-driven. Every event has exact timestamps.

It also uses finish_task_switch tracepoint for off-CPU analysis, combining kernel + userspace + Python stacks in a single event. Plus tcp_set_state kprobe for TCP handshake latency and retransmit tracking.

What we found in production: URL resolution was the biggest GIL holder, added caching, cut GIL wait by 80%. GC gen-2 was pausing 1.27s walking 1.5M objects, fixed with gc.freeze(), down to 88ms. Off-CPU stack traces revealed a Kafka push was blocking threads for 130ms per request, completely invisible in OpenTelemetry because the off-CPU time happens below the instrumentation layer. Found a stale nginx upstream IP causing 504s using TCP loss tracking.

The interesting technical challenge was walking CPython's PyFrameObject chain from inside BPF. I get the base address from /proc/<pid>/maps, then walk tstate -> cframe -> current_frame. Each frame points to a code object which has the filename and function name. I read this using bpf_probe_read_user, walking the linked list until NULL or max depth.

CPython 3.11 only. Struct offsets are hardcoded. BCC + Python. Apache 2.0.

GitHub: https://github.com/deepanshu406/python-ebpf-profiling

I ran a red team on a project of mine, Governance Kernel.

Governance Kernel is a deterministic governance layer

for AI agents. It sits beneath the agent and decides

permissions, trust levels, and resource bounds before

any action is executed.

Repo: https://github.com/mohamedaitzaouit84-hue/governance-kernel

Context on the project:

- V0.4: 54/54 adversarial prompts blocked, PRI = 1.0000

- V0.5: 5/5 gates

- V0.6: 5/5 gates

- V0.7: 19/19 gates

- 2 dependencies (cryptography, pyyaml)

- 3 environments verified (CI, Colab, Termux)

Now the red team.

I did a self red team first (V0.7.1): 20 attacks,

18 blocked, 2 documented. The report itself said:

"Self-red-team is NOT equivalent to external red

team. External red team remains the strongest

missing validation."

So I invited external review. Two AI systems

(Claude and Kimi) plus a manual verification pass

in Termux produced the following:

9 findings total.

CRITICAL (6):

- J-0.8.50 — audit chain can be rewritten by

recomputing hashes (hash chain, not signature

chain).

- J-0.8.51 — signed checkpoints can be re-signed

by the same attacker, because the signing key

is readable.

- J-0.8.52 — kill switch can be disabled by

deleting control/kill.flag.

- J-0.8.53 — identity/owner_key.priv is stored

unencrypted (0o600 only).

- J-0.8.57 — resource_governor.reset() runs

without authorization. Any process can erase

the resource state.

- J-0.8.58 — rotation_manifest.jsonl is unsigned.

PARTIAL (3):

- J-0.8.54 — bootstrap re-signs tampered policies

silently.

- J-0.8.55 — subjects.json is unsigned.

- J-0.8.56 — audit log tail can be truncated

without detection.

Root cause: the trust base is the file system.

Every guarantee the kernel makes on top of a

file that a same-user process can modify is

advisory.

I am posting this before fixing the findings.

The transparency is more valuable to me than

the appearance of safety.

The kernel itself (V0.5-V0.7) passed all its

gates. Nothing in the red team invalidated the

kernel loop, the agents, the consensus, or the

delegation mechanism. The findings are in the

layers around the kernel: the trust base, the

audit trail, the control plane, and the policy

distribution.

The fix plan is documented (FREEZE_v0.7.19),

about 6 working days of work.

Full report:

https://github.com/mohamedaitzaouit84-hue/governance-kernel/blob/main/docs/RED_TEAM_v0.7.18_AI_ASSISTED.md

Threat model:

https://github.com/mohamedaitzaouit84-hue/governance-kernel/blob/main/docs/SECURITY_MODEL.md

Fix plan:

https://github.com/mohamedaitzaouit84-hue/governance-kernel/blob/main/docs/FREEZE_v0.7.19.md

The protocol I followed for the red team is at:

https://github.com/mohamedaitzaouit84-hue/governance-kernel/blob/main/docs/RED_TEAM_PROTOCOL.md

If you see an attack I missed, I want to hear it.

I have no budget; recognition for valid findings

is academic (credit in JOURNEY.md, optional

co-authorship on a preprint), not financial.