HEV

GNOME: Enable Primary Selection Paste

Wed, 08 Apr 2026 00:00:00 +0000

Enable middle-click paste (primary selection) behavior in GNOME:

gsettings set org.gnome.desktop.interface gtk-enable-primary-paste true

Reference:

https://gitlab.gnome.org/GNOME/gsettings-desktop-schemas/-/merge_requests/119

Understanding Mapped DNS in HevSocks5Tunnel

Fri, 08 Aug 2025 00:00:00 +0000

HevSocks5Tunnel 是一个高性能、低开销的tun2socks开源实现，从2.13.0版本开始支持Mapped DNS功能。

项目地址: https://github.com/heiher/hev-socks5-tunnel

Mapped DNS

在使用基于Tun的透明代理工具时，Mapped DNS是一个相当有用的功能，用于解决应用程序无法直接传递域名信息给代理的问题。

传统的Tun模式下，应用程序通常只会看到IP地址，而非原始的域名。这会导致代理工具无法根据域名进行规则匹配、分流或访问控制。为了弥补这一缺陷，HevSocks5Tunnel提供了Mapped DNS功能，结合Fake IP机制来实现“IP 与域名的映射还原”。

Mapped DNS的工作机制如下：

当客户端应用程序发起域名解析请求时，Mapped DNS模块会返回一个“Fake IP”，而不是实际的目标服务器IP。
这些“Fake IP”来自一个预先定义的Fake IP地址段，这些地址在互联网上并没有对应的真实服务器，仅供代理内部使用。
后续，当客户端尝试连接这个Fake IP时，HevSocks5Tunnel会通过内部的映射表，将这个Fake IP还原为原始的域名，再通过SOCKS5代理进行转发。
这样，代理程序就能知道原始的域名，从而实现基于域名的分流、阻断、DNS劫持规避等功能。

How to Use

仅需两步即可启用Mapped DNS功能：

在HevSocks5Tunnel配置中启用Mapped DNS：

mapdns:
  # Mapped DNS address (Mapped DNS服务器地址)
  address: 198.18.0.2
  # Mapped DNS port (Mapped DNS服务器端口)
  port: 53
  # Mapped IP network base (Mapped DNS使用的Fake IP段超出地址)
  network: 240.0.0.0
  # Mapped IP network mask (Mapped DNS使用的Fake IP段的掩码地址，与起始地址共同决定了Fake IP段的地址容量)
  netmask: 240.0.0.0
  # Mapped DNS cache size (Mapped DNS内部映射缓存的容量)
  cache-size: 10000

在操作系统中默认使用Mapped DNS提供的DNS服务器地址（以Linux为例）：

编辑 /etc/resolv.conf，移除现有的nameserver，并增加：

Reserve Bad RAM to Improve System Reliability

Wed, 27 Nov 2024 00:00:00 +0000

When dealing with unstable systems, one often overlooked culprit is faulty RAM. Faulty memory can cause random crashes, corrupted files, and a myriad of hard-to -trace issues. While replacing bad RAM is the ideal solution, sometimes it’s not immediately possible. In such cases, you can identify the defective memory regions and prevent the operating system from using them by marking them as reserved or persistent memory. This guide explains how to achieve this using Memtest86+ and the Linux kernel’s memmap= parameter.

Docker inside systemd-nspawn container

Fri, 05 Apr 2024 00:00:00 +0000

Btrfs backing filesystem

In host

systemd-nspawn --system-call-filter='@keyring bpf' --network-bridge=br0 -b -D /path/to/container

In container

/etc/docker/daemon.json

{
  "storage-driver": "btrfs"
}

Any backing filesystem

In host

systemd-nspawn --system-call-filter='@keyring bpf' --bind=/dev/fuse --network-bridge=br0 -b -D /path/to/container

In container

pacman -S fuse-overlayfs

/etc/docker/daemon.json

{
  "storage-driver": "fuse-overlayfs"
}

The guideline to build UEFI firmware for Qemu of LoongArch

Fri, 29 Mar 2024 00:00:00 +0000

mkdir workspace; cd workspace

wget https://github.com/cross-tools/musl-cross/releases/latest/download/loongarch64-unknown-linux-musl.tar.xz
tar xf loongarch64-unknown-linux-musl.tar.xz

git clone --recursive https://github.com/tianocore/edk2.git

export PATH=${PWD}/loongarch64-unknown-linux-musl/bin:${PATH}
export PACKAGES_PATH=${PWD}/edk2
export GCC5_LOONGARCH64_PREFIX=loongarch64-unknown-linux-musl-

. edk2/edksetup.sh
make -C edk2/BaseTools
build -b RELEASE -t GCC5 -a LOONGARCH64  -p OvmfPkg/LoongArchVirt/LoongArchVirtQemu.dsc

# Firmware file path: Build/LoongArchVirtQemu/RELEASE_GCC5/FV/QEMU_EFI.fd

Cross-compile toolchains

Sun, 24 Mar 2024 00:00:00 +0000

cross-tools is a simple, lightweight project for making cross-compilation toolchain with {gnu, musl, mingw} libc.

GNU Cross

Project home

https://github.com/cross-tools/gnu-cross

Supported targets

Target	Kernel	Binutils	GCC	Glibc
aarch64-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
arm-unknown-linux-gnueabi	5.4.293	2.45	15.1.0	2.42
arm-unknown-linux-gnueabihf	5.4.293	2.45	15.1.0	2.42
armv7-unknown-linux-gnueabi	5.4.293	2.45	15.1.0	2.42
armv7-unknown-linux-gnueabihf	5.4.293	2.45	15.1.0	2.42
i586-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
i686-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
loongarch64-unknown-linux-gnu	5.19.16	2.45	15.1.0	2.42
m68k-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
microblazeel-xilinx-linux-gnu	5.4.293	2.45	15.1.0	2.42
microblaze-xilinx-linux-gnu	5.4.293	2.45	15.1.0	2.42
mipsel-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
mipsel-unknown-linux-gnusf	5.4.293	2.45	15.1.0	2.42
mips-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
mips-unknown-linux-gnusf	5.4.293	2.45	15.1.0	2.42
mips64el-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
mips64-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
powerpc-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
powerpc64-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
riscv32-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
riscv64-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42
s390x-ibm-linux-gnu	5.4.293	2.45	15.1.0	2.42
sh4-multilib-linux-gnu	5.4.293	2.45	15.1.0	2.42
x86_64-unknown-linux-gnu	5.4.293	2.45	15.1.0	2.42

Musl Cross

Project home

https://github.com/cross-tools/musl-cross

Add port mapping between host and virtual machine

Wed, 20 Mar 2024 00:00:00 +0000

Add a TCP port forwarded from host 2200 to guest 22:

virsh qemu-monitor-command Ubuntu --hmp --cmd "hostfwd_add tcp::2200-:22"

128GB(32GBx4) RAM on AMD Ryzen 7950x

Sat, 04 Nov 2023 00:00:00 +0000

Hardware

CPU: AMD Ryzen 7950x
Motherboard: Gigabyte B650 Gaming X 1.0
RAM:
- Slot 0: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2023-W29)
- Slot 1: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2022-W44)
- Slot 2: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2023-W29)
- Slot 3: 32GB DDR5-5200 XMP - Corsair CMK5X32G2B52C40A2 (2022-W44)

Software

BIOS: F9D (AMD AGESA 1.0.0.7c)

Maximum stable freq: 3600MT/s. Can not boot at 5200MT/s (XMP Enabled)
BIOS: F8 (AMD AGESA 1.0.0.6)

Cargo over Socks5 proxy

Tue, 27 Jun 2023 00:00:00 +0000

~/.cargo/config

[http]
proxy = "socks5h://localhost:1080"
[https]
proxy = "socks5h://localhost:1080"

Android VPN over Socks5 proxy

Wed, 15 Feb 2023 00:00:00 +0000

SocksTun是一个简单、轻量的Android VPN应用，它基于我之前开源的一个高性能、低开销的tun2socks项目实现，用于将手机端的TCP、UDP流量通过Socks5服务器转发。

特性支持

支持重定向 TCP 连接。
支持重定向 UDP 报文。(Fullcone NAT，UDP in UDP/TCP)
支持简单用户名/密码认证。
支持使用服务端DNS或指定DNS地址。
IPv4/IPv6双栈。
全局/按应用双重模式。

使用方法

服务端

HevSocks5Server服务端支持运行在Linux/BSD和macOS系统上，目前仅支持UDP in TCP。

git clone --recursive https://github.com/heiher/hev-socks5-server
cd hev-socks5-server
make

hev-socks5-server conf.yml

conf.yml:

main:
  workers: 4
  port: 1080
  listen-address: '::'

misc:
  limit-nofile: 65535

客户端

从项目发布页下载APK并安装。
打开应用，配置Socks5地址、端口和DNS地址。
保存配置后，点击启用开启VPN服务。

About

Thu, 09 Feb 2023 00:00:00 +0000

Welcome to HEV’s Blog!

Hello, I’m Hev! You might know me from my blog, where I share my thoughts, experiences, and projects related to technology, programming, and everything in between. I have a strong passion for creating lightweight, efficient, and open-source software solutions. Let me tell you a bit more about myself.

Who Am I?

I am a software developer and open-source enthusiast who enjoys tackling complex problems with simple, elegant solutions. Over the years, I’ve developed a range of projects, focusing primarily on network applications and system utilities. My GitHub repository is a testament to my journey, showcasing my dedication to creating tools that make life easier for developers and IT professionals.

Benchmarking of tun2socks on RK3399

Thu, 09 Feb 2023 00:00:00 +0000

在RK3399低性能设备上对比了几款开源的tun2socks实现的最大传输性能和对应的CPU资源消耗情况，软件配置与项目Benchmarks相同。硬件配置为

绑定在两个大核上运行
物理网卡限速为1Gbps

结论是只有HevSocks5Tunnel可以几乎跑满物理网卡的最大带宽，并且对应的CPU资源使用最少。那么，基于它实现的Android VPN应该具有相对较好的节能效果吧。

Speed

CPU Usage

Contact

Thu, 09 Feb 2023 00:00:00 +0000

E-mail: aUBoZXYuY2M=
GitLab: https://gitlab.com/hev
GitHub: https://github.com/heiher
PGP: 0xDE8BBEBCEBBBDB92(↷)

High-performance tun2socks

Thu, 09 Feb 2023 00:00:00 +0000

HevSocks5Tunnel 是一个高性能、低开销的tun2socks开源实现，采用C语言编写、基于知名的轻量级用户态网络协议栈LwIP以及协程化IO调度处理技术。当前支持 Linux、Android、FreeBSD、Windows、macOS和iOS系统。与其它开源的tun2socks实现比较，目前的结果是传输速度更快，同时CPU、内存资源使用也比较少，运行稳定、可靠。

项目地址: https://github.com/heiher/hev-socks5-tunnel

功能

IPv4/IPv6 双栈。
支持重定向 TCP 连接。
支持重定向 UDP 报文。(Fullcone NAT，UDP over TCP/UDP)

性能

详细信息

传输速率

CPU使用率

内存使用量

用法

Linux系统

配置运行

配置文件:

tunnel:
  name: tun0
  mtu: 9000
  multi-queue: true
  ipv4: '198.18.0.1'
  ipv6: 'fc00::1'

socks5:
   port: 1080         # socks5服务器端口
   address: 127.0.0.1 # socks5服务器地址

运行:

sudo hev-socks5-tunnel conf.yml

避免环路

避免环路的目的是防止配置在全局默认路由模式时，所有流量都进入虚拟网卡，这其中也包括了tun2socks程序自身访问Socks5服务器端的流量，从而造成环路死锁。最简单的避免方法是给Socks5服务端地址增加一个比默认路由更高优先的路由规则。

IPv4:

sudo ip route add SOCKS5-ADDRESS dev INTERNET-IFACE metric 10

IPv6:

sudo ip -6 route add SOCKS5-ADDRESS dev INTERNET-IFACE metric 10

策略路由

全局模式:

全局模式除了tun2socks程序访问Socks5服务器端的流量外，其余所有TCP、UDP流量都通过tun2socks程序创建的虚拟网卡，通过Socks5服务器端代理访问。

2023-: Pandora’s box is reopening

Sun, 01 Jan 2023 00:00:00 +0000

Run OpenWrt 22.03 in systemd-nspawn container

Thu, 08 Sep 2022 00:00:00 +0000

Issue

The dnsmasq can’t start to running.

Why? The ujail is enabled by default on OpenWrt 22.03, and no privilege to do some jail operation in systemd-nspawn container. e.g. mount /tmp/xxx to /dev/log

How to fix

Uninstall procd-ujail.

opkg remove procd-ujail

Stack clash style attacks

Fri, 27 May 2022 00:00:00 +0000

What is stack clash style attacks?

计算机上运行的程序都需要一块特殊的内存区域称为“栈”，栈空间通常是动态单向增长的，以Linux内核为例，操作系统为了防止栈空间过早分配产生的内存浪费，采用了栈延迟分配策略，按Page粒度逐步向低地址扩展增长。栈可用空间最低地址位置上有个特殊的页称为Stack Guard Page，当访问到达该页时，将触发严重错误，使程序终止执行。

攻击者故意分配较大的栈空间，但不触发访问，可有可能跳过对Stack Guard Page的访问，如果精心安排，或运气较好，就有可能将低地址方向的其它内存区域作为栈来使用，从而有机会突破栈不可执行保护。

How to prevent?

GCC编译器实现了stack clash protection功能，通过参数-fstack-clash-protection可启用。不是所有的目标架构都实现以支持该功能。

How it works?

GCC实现stack clash protection的方法是为每个函数生成一段代码，该代码执行在业务代码之前，按Page粒度逐个预访问函数framesize空间，达到一定能触发stack guard page访问的目的。

下面以一段MIPS架构汇编代码示例：

#include <stdio.h>

int
main (int argc, char *argv[])
{
    char buffer[1024 * 1024];

    printf ("%p", buffer);

    return 0;
}

00000001200008d0 <main>:
   1200008d0:   03a01825    move    v1,sp
   1200008d4:   3c0c0010    lui t0,0x10
   1200008d8:   006c602f    dsubu   t0,v1,t0
   1200008dc:   6463f000    daddiu  v1,v1,-4096
   1200008e0:   146cfffe    bne v1,t0,1200008dc <main+0xc>
   1200008e4:   fc600000    sd  zero,0(v1)
   1200008e8:   fd80fff0    sd  zero,-16(t0)

   1200008ec:   67bd8010    daddiu  sp,sp,-32752
   1200008f0:   3c03000f    lui v1,0xf
   1200008f4:   ffbc7fe0    sd  gp,32736(sp)
   1200008f8:   3c1c0002    lui gp,0x2
   1200008fc:   34638020    ori v1,v1,0x8020
   120000900:   0399e02d    daddu   gp,gp,t9
   120000904:   ffbf7fe8    sd  ra,32744(sp)
   120000908:   03a3e82f    dsubu   sp,sp,v1
   12000090c:   679c83d0    daddiu  gp,gp,-31792

main函数prolugue中按4096的步长逐个写入了0。

VirtManager access remote service

Tue, 24 May 2022 00:00:00 +0000

Network TSO/GSO

Tue, 17 May 2022 00:00:00 +0000

From: https://www.cnblogs.com/codestack/p/14890786.html

Irreducible loop

Fri, 29 Apr 2022 00:00:00 +0000

Control-flow graph

(a) an if-then-else
(b) a while loop
(c) a natural loop with two exits, e.g. while with an if…break in the middle; non-structured but reducible
(d) an irreducible CFG: a loop with two entry points, e.g. goto into a while or for loop

Java case

IrreducibleLoop.java

public class IrreducibleLoop {
    public static void test(int loop) {
    }
}

IrreducibleLoop.jasm

super public class IrreducibleLoop
    version 63:0
{
  public Method "<init>":"()V"
    stack 1 locals 1
  {
        aload_0;
        invokespecial    Method java/lang/Object."<init>":"()V";
        return;
  }
  public static Method test:"(I)V"
    stack 2 locals 2
  {
    L0: iconst_0;
        istore_1;
        iload_0;
        ifne    L2;
    L1: stack_frame_type append;
        locals_map int;
        iload_1;
        iload_0;
        if_icmpge    L3;
    L2: stack_frame_type same;
        goto    L1;
    L3: stack_frame_type chop1;
        return;
  }

} // end Class IrreducibleLoop

Main.java

OpenWrt: Set policy routing

Thu, 28 Apr 2022 00:00:00 +0000

function put_route() {
    ip route del default dev pppoe-wanct proto static table 100
    ip route add default dev pppoe-wanct proto static table 100
    ip rule del pref 32760
    ip rule add pref 32760 from ${1} lookup 100
}

put_route ${ip}

SSH: Use legacy SCP protocol

Thu, 28 Apr 2022 00:00:00 +0000

Issue

/usr/libexec/sftp-server: not found

Fix

-O      Use the legacy SCP protocol for file transfers instead of the SFTP
        protocol.  Forcing the use of the SCP protocol may be necessary for
        servers that do not implement SFTP, for backwards-compatibility for
        particular filename wildcard patterns and for expanding paths with
        a ‘~’ prefix for older SFTP servers.

ch341-uart converter now disconnected from ttyUSB0

Fri, 22 Apr 2022 00:00:00 +0000

Issue

usb 1-3.4: USB disconnect, device number 18
usb 1-3.1: new full-speed USB device number 19 using xhci_hcd
usb 1-3.1: New USB device found, idVendor=1a86, idProduct=7523, bcdDevice= 2.54
usb 1-3.1: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 1-3.1: Product: USB2.0-Ser!
ch341 1-3.1:1.0: ch341-uart converter detected
ch341-uart ttyUSB0: break control not supported, using simulated break
usb 1-3.1: ch341-uart converter now attached to ttyUSB0
usb 1-3.1: usbfs: interface 0 claimed by ch341 while 'brltty' sets config #1
ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0
ch341 1-3.1:1.0: device disconnected

Solution

sudo mv /usr/lib/udev/rules.d/90-brltty-device.rules /usr/lib/udev/rules.d/90-brltty-device.rules.disabled
sudo mv /usr/lib/udev/rules.d/90-brltty-uinput.rules /usr/lib/udev/rules.d/90-brltty-uinput.rules.disabled
sudo udevadm control --reload-rules

Block QUIC

Tue, 05 Apr 2022 00:00:00 +0000

nftables

udp dport { 80, 443 } reject with icmpx port-unreachable

iptables

-p udp --match multiport --dports 80,443 -j REJECT

MESI Protocol

Tue, 22 Mar 2022 00:00:00 +0000

Show-how

From: https://www.scss.tcd.ie/Jeremy.Jones/VivioJS/caches/MESI.htm

OpenJDK init/exit hooks

Tue, 22 Mar 2022 00:00:00 +0000

src/hotspot/share/runtime/init.cpp:

jint init_globals();
void exit_globals();

Enable JFR

Mon, 21 Mar 2022 00:00:00 +0000

-XX:StartFlightRecording=dumponexit=true,disk=false,filename=dump.jfr

Increase /tmp size for systemd container

Sun, 27 Feb 2022 00:00:00 +0000

systemd-nspawn --tmpfs=/tmp:nosuid,size=256M

faccessat2 workaround for old systemd

Wed, 23 Feb 2022 00:00:00 +0000

The faccessat2 system call is denied by old systemd container, this is a workaround to make it works again and without re-build from source code.

faccessat function is a known way to use the faccessat2 system call in glibc, editing libc.so binary to fallback to the user-space implementation.

00000000000de3e0 <faccessat>:
   .....
   de448:	7100989f 	cmp	w4, #0x26
   de44c:	540005e1 	b.ne	de508 <faccessat+0x128>
   .....

=>
   .....
   de448:	7100989f 	cmp	w4, #0x26
   de44c:	d503201f 	nop
   .....

Equivalent to the C source code:

Systemd network DHCP and Static at same time

Sun, 20 Feb 2022 00:00:00 +0000

/etc/systemd/network/eth0.network:

[Match]
Name=eth0

[Network]
DHCP=yes

[Address]
Address=104.21.64.95/32

[Address]
Address=2606:4700:3037::ac43::1/64

Linux socket bind IPv6 only

Sat, 19 Feb 2022 00:00:00 +0000

Socket options

IPv6 support some protocol-specific socket options that can be set with setsockopt and read with getsockopt. The socket option level for IPv6 is IPPROTO_IPV6. A boolean integer flag is zero with it is false, otherwise true.

IPV6_V6ONLY

If this flag is set to true (nonzero), then the socket is restricted to sending and receiving IPv6 packets only. In this case, an IPv4 and an IPv6 application can bind to a single port at the same time.

Float-point fused Multiply-Add AArch64 vs LoongArch64

Tue, 15 Feb 2022 00:00:00 +0000

AA64: fmadd  d, n, m, a: d = a + n * m
LA64: fmadd  d, j, k, a: d = a + j * k

AA64: fmsub  d, n, m, a: d = a + (-n) * m
                         d = a - n * m
                         d = - (n * m - a)
LA64: fnmsub d, j, k, a: d = - (j * k - a)
                         d = a - j * k
                         d = a + (-j) * k

AA64: fnmadd d, n, m, a: d = (-a) + (-n) * m
                         d = - (n * m + a)
LA64: fnmadd d, j, k, a: d = - (j * k + a)
                         d = (-a) + (-n * m)

AA64: fnmsub d, n, m, a: d = (-a) + n * m
                         d = n * m - a
LA64: fmsub  d, j, k, a: d = j * k - a
                         d = (-a) + j * k

IP addr-label persistent by systemd

Sun, 13 Feb 2022 00:00:00 +0000

This is an example shows how to make IP address label persistent by systemd-networkd.

/etc/systemd/network/eth0.network:

[Match]
Name=eth0

[Network]
Address=192.168.0.1/24
Gateway=192.168.0.254
DNS=192.168.0.254

[IPv6AddressLabel]
Label=100
Prefix=2409::/16

[IPv6AddressLabel]
Label=100
Prefix=2606::/16

It’s successful if you can see labels that you configured:

ip addrl

prefix ::1/128 label 0
prefix ::/96 label 3
prefix ::ffff:0.0.0.0/96 label 4
prefix 2001::/32 label 6
prefix 2001:10::/28 label 7
prefix 2606::/16 dev br0 label 100
prefix 2409::/16 dev br0 label 100
prefix 3ffe::/16 label 12
prefix 2002::/16 label 2
prefix fec0::/10 label 11
prefix fc00::/7 label 5
prefix ::/0 label 1

Hotspot stress diagnostic options

Thu, 25 Nov 2021 00:00:00 +0000

SafepointALot: Generate a lot of safepoints. This works with GuaranteedSafepointInterval.

HandshakeALot: Generate a lot of handshakes. This works with GuaranteedSafepointInterval.

DeoptimizeALot: Deoptimize at every exit from the runtime system.

ZombieALot: Create zombies (non-entrant) at exit from the runtime system.

WalkStackALot: Trace stack (no print) at every exit from the runtime system.

DeoptimizeObjectsALot: For testing purposes concurrent threads revert optimizations based on escape analysis at intervals given with DeoptimizeObjectsALotInterval=n. The thread count is given with DeoptimizeObjectsALotThreadCountSingle and DeoptimizeObjectsALotThreadCountAll.

dnsmasq can’t resolve domains that points to reserved addresses

Thu, 04 Nov 2021 00:00:00 +0000

The dnsmasq is enables rebind protection by default, this reject DNS records that contains reserved address (RFC1918).

Remove argument to disable it:

--stop-dns-rebind

OpenWrt

Luci:

Menu: Network->DHCP and DNS

Unchecked Rebind protection.

AArch64 calling convention

Mon, 25 Oct 2021 00:00:00 +0000

The 64-bit ARM (AArch64) calling convention allocates the 31 general-purpose registers as:[2]

x31 (SP): Stack pointer or a zero register, depending on context. x30 (LR): Procedure link register, used to return from subroutines. x29 (FP): Frame pointer. x19 to x29: Callee-saved. x18 (PR): Platform register. Used for some operating-system-specific special purpose, or an additional caller-saved register. x16 (IP0) and x17 (IP1): Intra-Procedure-call scratch registers. x9 to x15: Local variables, caller saved. x8 (XR): Indirect return value address. x0 to x7: Argument values passed to and results returned from a subroutine.

Dump rerun commands of jtreg

Wed, 20 Oct 2021 00:00:00 +0000

make test JTREG="VERBOSE=all" ...
make run-test JTREG="VERBOSE=all"

Decrease the tabs bar height in gnome terminal

Tue, 19 Oct 2021 00:00:00 +0000

~/.config/gtk-3.0/gtk.css:

/* Decrease the tabs bar height in gnome-terminal
 * See:
 * https://stackoverflow.com/questions/36869701/decrease-the-tabs-bar-height-in-gnome-terminal
 */

terminal-window notebook > header.top button {
  padding: 0 0 0 0;
  background-image: none;
  border: 0;
  margin-right: 10px;
}

terminal-window notebook > header.top > tabs > tab {
  margin: 0 0 0 0;
  padding: 0 0 0 0;
}

terminal-window notebook > header.top > tabs > tab label {
  padding: 0 0 0 0;
  margin: 0 0 0 0;
}

Before

After

From: https://stackoverflow.com/questions/36869701/decrease-the-tabs-bar-height-in-gnome-terminal

RK3399: Tune ethernet irq affinity

Wed, 29 Sep 2021 00:00:00 +0000

Handle interrupts of ethernet device on high performance cpus.

/etc/systemd/system/irq-eth0.service:

[Unit]
Description=IRQ SMP Affinity
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/bin/bash -c 'echo 4-5 > /proc/irq/31/smp_affinity_list'

[Install]
WantedBy=multi-user.target

OpenSSH 8.8 ssh-rsa

Tue, 28 Sep 2021 00:00:00 +0000

Unable to negotiate with 192.168.0.1 port 22: no matching host key type found. Their offer: ssh-rsa

Workaround:

Host 192.168.0.1
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

一语成谶

Mon, 20 Sep 2021 00:00:00 +0000

‘Across the Great Wall, we can reach every corner in the world’

关于AES加解密中CBC模式的IV初始化向量的安全性问题

Sun, 19 Sep 2021 00:00:00 +0000

前段时间，在研究HLS的AES加密，由于一个地方电视台的HLS流有AES加密，在查看了相关的加解密方案后发现使用的是简单的AES的CBC模式，在CBC的模式下，会设置一个IV，初始化向量。但是我在解密的时候，使用了一个由于理解错误而产生的一个错误IV居然也能解密视频并进行播放，于是就有了这篇张文章。

AES五种加密模式（CBC、ECB、CTR、OCF、CFB）

虽然有五种加密，但是常用的还是CBC，CBC的全称Cipher Block Chaining ，有点类似于区块链哈，我们先来看下加密方式

CBC加密

上面的图片从左往右看，初始化IV只有在第一个块加密的时候才会用到，而第N个块的加密IV则是用的N-1(N>1)个加密后的二进制数组。

CBC解密

CBC的解密则也是从左往右看，但是加密时IV在解密时候，只会用于对第一个块进行解密，其他块的解密则是使用上一块的加密二进制作为IV进行解密操作。

加密时，用iv和key去加密第一个块，然后用第一个块的加密数据作为下一个块的iv，依次迭代。解密时，用n-1个块的加密数据作为iv和key去解密第n个块（n>1），只有第一个块才会用加密时的iv去解密第一个块。按照这样的逻辑来看，那么如果解密时，使用了iv错误，出问题的数据应该只有第一个块。

通过上面的分析就能知道，加密的时候，iv会影响所有数据的加密结果，而解密时，iv只会影响第一个加密块的解密结果，其他块的解密可以直接通过分隔加密数据获取正确是N-1块的IV。

这也就印证了为什么ff能播放我用错误的iv解密出来的视频流数据，因为第一块的大小存储大概是id3 的数据，ff直接丢掉id3的数据，直接解码后面的视频数据，ff 应该是识别h264编码头开始解码视频。

那么从这点可以看出，在使用了key的情况下，IV对整个数据的保密性没有太大的作用。

再来说说我是怎么发现这个问题，因为错误的IV只会影响第一个块的数据，我在第一次尝试解密后，直接用ff进行播放，ff能够解码并且播放成功，但是相对于其他未加密的HLS流来说，播放我解密后的数据会有3-5s的延时，这让我很是头疼，后来我就通过ffplay -v trace 打印播放解密的日志，发现视频数据的id3信息丢失了，那么出问题出在第一个块。然后再次研究m3u8加解密IV的赋值方法，后发来经过多次试验，正确赋值IV，解密出来的数据能够及时播放。再后来，就出现了这篇文章的来由。

由此带来的延展，针对iv在CBC模式下的弱用，AES提供了更多的模式可供选择，详细的可以到wiki上了解。

From: https://www.jianshu.com/p/45848dd484a9

Creating swap files faster

Mon, 06 Sep 2021 00:00:00 +0000

sudo fallocate -l 100G /path/to/swap.img
sudo chmod 0600 /path/to/swap.img
sudo mkswap /path/to/swap.img

Netfilter hooks into Linux networking packet flows

Sat, 24 Jul 2021 00:00:00 +0000

Refer: https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks

Transparent proxy with nftables

Sat, 24 Jul 2021 00:00:00 +0000

This is an example of configuring transparent proxy(tproxy) with nftables. The tproxy application is hev-socks5-tproxy

Netfilter rules

DON’T FORGOT TO ADD UPSTREAM ADDRESS TO BYPASS IPSET!! Or use nftables skuid/skgid match to exclude proxy process.

table inet mangle {
    set byp4 {
        typeof ip daddr
        flags interval
        elements = { 0.0.0.0/8, 10.0.0.0/8,
                 127.0.0.0/8, 169.254.0.0/16,
                 172.16.0.0/12, 192.0.0.0/24,
                 192.0.2.0/24, 192.88.99.0/24,
                 192.168.0.0/16, 198.18.0.0/15,
                 198.51.100.0/24, 203.0.113.0/24,
                 224.0.0.0/4, 240.0.0.0-255.255.255.255 }
    }

    set byp6 {
        typeof ip6 daddr
        flags interval
        elements = { ::,
                 ::1,
                 ::ffff:0:0:0/96,
                 64:ff9b::/96,
                 100::/64,
                 2001::/32,
                 2001:20::/28,
                 2001:db8::/32,
                 2002::/16,
                 fc00::/7,
                 fe80::/10,
                 ff00::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff }
    }

    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        ip daddr @byp4 return
        ip6 daddr @byp6 return
        tcp dport { 0-65535 } tproxy to :1088 meta mark set 0x00000440 accept
        udp dport { 0-65535 } tproxy to :1088 meta mark set 0x00000440 accept
    }

    # Only for local mode
    chain output {
        type route hook output priority mangle; policy accept;
        ip daddr @byp4 return
        ip6 daddr @byp6 return
        tcp dport { 0-65535 } meta mark set 0x00000440
        udp dport { 0-65535 } meta mark set 0x00000440
    }
}

Routing rules

ip rule add fwmark 1088 table 100
ip route add local default dev lo table 100

ip -6 rule add fwmark 1088 table 100
ip -6 route add local default dev lo table 100

GNOME Terminal Bold Font

Fri, 26 Mar 2021 00:00:00 +0000

Enable bold font for GNOME Terminal:

0x01

# Get profile id
dconf dump /org/gnome/terminal/legacy/

# Set bold font
dconf write /org/gnome/terminal/legacy/profiles:/:b1dcc9dd-5262-4d8d-a863-c897e6d979b9/font "'Monospace Bold 14'"

0x02

Preferences->Profiles->->Colors: Select “Show bold text in bright colors”

Right Alt not working in GNOME3

Tue, 05 Jan 2021 00:00:00 +0000

Open Settings.
Click Keyboard Shortcuts.
Click Alternate Characters Key.
Select Right Supter.

The Linux Storage Stack Diagram

Mon, 14 Dec 2020 00:00:00 +0000

From: https://www.thomas-krenn.com/en/wiki/Linux_Storage_Stack_Diagram

Reserved IP addresses

Mon, 30 Nov 2020 00:00:00 +0000

IPv4

0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4

IPv6

::/128
::1/128
::ffff:0:0/96
::ffff:0:0:0/96
64:ff9b::/96
100::/64
2001::/32
2001:20::/28
2001:db8::/32
2002::/16
fc00::/7
fe80::/10
ff00::/8

Catch exception thrown from memory references

Fri, 30 Oct 2020 00:00:00 +0000

By default an exception can only occur during a function call or a throw. If we needs to catch excpetions thrown from trapping instructions, using the -fnon-call-exceptions.

Docs

-fnon-call-exceptions

Generate code that allows trapping instructions to throw exceptions. Note that this requires platform-specific runtime support that does not exist everywhere. Moreover, it only allows trapping instructions to throw exceptions, i.e. memory references or floating point instructions. It does not allow exceptions to be thrown from arbitrary signal handlers such as SIGALRM.

Load shared libraries with preferred base address

Mon, 21 Sep 2020 00:00:00 +0000

For performance, sometimes we need to adjust the address space layout. The following way allows the shared or executable object to be loaded with preferred base address.

When the dynamic link maps the shared object, the virtual address of segment(that in ELF program header) will be used as the mapping address hints.

Type 1

Link with text-segment starting address.

# Adjust base address to 0x10000 */
gcc -shared ... -Wl,-Ttext-segment=0x10000

Type 2

We can adjust the virtual address of loaded segment by linker scripts.

Allow perf in systemd-nspawn

Tue, 15 Sep 2020 00:00:00 +0000

systemd-nspawn --system-call-filter=perf_event_open

Auto-run program in GDB

Tue, 28 Jul 2020 00:00:00 +0000

~/.gdbinit:

add-auto-load-safe-path /

.gdbinit in project working directory:

set pagination off

set $_exitcode = -1
run
if $_exitcode != -1
	quit
end

mlock() returns EPERM in systemd-nspawn

Thu, 09 Jul 2020 00:00:00 +0000

Set caps:

systemd-nspawn --capability=CAP_IPC_LOCK

硬盘盒来电自动启动改造

Tue, 31 Mar 2020 00:00:00 +0000

市面上常见的硬盘盒或硬盘柜几乎都设计了电源按钮开关，并不是外部供电就自动开机的，这也是一种保护措施。但如果我们用这类产品连接家庭服务器或NAS的话，在意外停电恢复后，外置硬盘盒设备就不能访问了，需要手工按一下电源开关。那么，有没有方法可以使这类产品能自动开机呢？方法不仅有，还不止一种哦。

There should have been a video here but your browser does not seem to support it.

下面，我们以ORICO 9528系列硬盘柜为例，介绍几种方案，其中短接和电容两种方法为来电自动开机方式，而继电器和伺服电机两种方法则可由单片机或各种派来远程控制。

短接

顾名思义，就是将微动电源开关一直按压住，可以使用强力胶带或其它任意有效方法实现。

优势：1. 简单有效且无需拆机。
缺陷：1. 仅部分产品有效。 2. 长期短接是否有风险。 3. 来电不稳定期损坏硬盘。

电容

相对直接短接，还可以串接电容来替换微动开关，在来电时，电容充电此时相当于开关按下，当电容充满时，相当于开关释放。

优势：1. 适用于所有微动开关。2. 无长期短接的不确定风险。
缺陷：1. 需要拆机，影响保修。2. 来电不稳定期损坏硬盘。

继电器

使用程控继电器替换电源开关，在来电后主机启动完成的情况下，由程序控制硬盘柜启动。

优势：1. 适用于所有开关情况。2. 无长期短接的不确定风险。3. 无来电不稳定损坏硬盘。
缺陷：1. 需要拆机，影响保修。

伺服电机

在硬盘柜电源按钮外安装伺服电机，由程序控制电机转动，再由连接在电机转轴上的机械臂按压微动开关。

优势：1. 适用于所有开关情况。2. 无长期短接的不确定风险。3. 无来电不稳定损坏硬盘。4. 无需拆机，不影响保修。
缺陷：暂无。

综合来看，采用伺服电机方法即有安全保障，又无拆机风险，同时成本并不高，大概20元左右。

清单

MG90S型舵机 x 1。

母对公杜邦线 x 3。

3M VHB强力双面胶带 x 1 (搜索ETC专用类，这种双面胶有一定的厚度和弹性，在舵机旋臂按压时有缓冲空间)。

Nginx WebDAV Service

Mon, 23 Mar 2020 00:00:00 +0000

Installation

git clone --depth 1 https://github.com/heiher/nginx
cd nginx
git clone --depth 1 https://github.com/heiher/nginx-dav-ext-module

./auto/configure --prefix=/opt/nginx \
    --with-compat \
    --with-file-aio \
    --with-http_addition_module \
    --with-http_auth_request_module \
    --with-http_dav_module \
    --with-http_degradation_module \
    --with-http_flv_module \
    --with-http_geoip_module \
    --with-http_gunzip_module \
    --with-http_gzip_static_module \
    --with-http_mp4_module \
    --with-http_realip_module \
    --with-http_secure_link_module \
    --with-http_slice_module \
    --with-http_ssl_module \
    --with-http_stub_status_module \
    --with-http_sub_module \
    --with-http_v2_module \
    --with-pcre-jit \
    --with-threads \
    --add-module=nginx-dav-ext-module

make
sudo make install

Configuration

Main: /opt/nginx/conf/nginx.conf:

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    dav_ext_lock_zone zone=foo:10m;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   html;

            auth_basic Restricted;
            auth_basic_user_file htpasswd;

            dav_methods PUT DELETE MKCOL COPY MOVE;
            dav_ext_methods PROPFIND PROPPATCH OPTIONS LOCK UNLOCK;
            dav_ext_lock zone=foo;
            dav_access user:rw group:rw all:r;

            client_max_body_size 0;
            create_full_put_path on;
        }

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }

}

Auth: /opt/nginx/conf/htpasswd:

802.11Q VLAN packet processing

Tue, 25 Feb 2020 00:00:00 +0000

	Tagged packet		Untagged packet
	IN	OUT	IN	OUT
Tagged Port	Unmodified	Unmodified	Tag by PVID	Tag by PVID
Untagged Port	Drop	Untag	Tag by PVID	Unmodified

快速清除SSD数据

Mon, 16 Dec 2019 00:00:00 +0000

在Linux系统上，使用dd命令清除SSD存储数据比较慢，快速的方法是使用blkdiscard命令。

# Clear all data
sudo blkdiscard DEVICE

# Clear specific range
sudo blkdiscard -o OFFSET -l LENGTH DEVICE

Memory ordering in some architectures

Fri, 08 Nov 2019 00:00:00 +0000

From: https://en.wikipedia.org/wiki/Memory_ordering

Linux recovery移除签名校验

Wed, 26 Jun 2019 00:00:00 +0000

背景

某个设备配套的刷机程序是个Linux recovery kernel，刷机过程会先从U盘加载刷机脚本，仅在签名校验通过后才执行脚本。本文记录了分析和移除签名校验的方法。

分析

刷机程序是一个bzImage文件，从启动的输出来看，内部包含了一个initrd，在initrd中实现了读取U盘中的脚本和签名校验过程。

查看initrd内容

通过增加启动参数(cmdline）rdinit=/bin/sh，可以使Kernel启动后执行/bin/sh，而不是默认的/init程序，有了命令行接口后，就可以查看initrd的内容。

~ # busybox find /
/
/.ash_history
/init
/etc
/etc/shadow
/etc/passwd
/.gnupg
/.gnupg/trustdb.gpg
/.gnupg/secring.gpg
/.gnupg/pubring.gpg~
/.gnupg/pubring.gpg
/bin
/bin/kexec
/bin/gpg2
/bin/busybox
/bin/dd
/bin/umount
/bin/sleep
/bin/rmdir
/bin/rm
/bin/reboot
/bin/mount
/bin/mkdir
/bin/ls
/bin/cat
/bin/sh
/mnt
/sys
/proc
/dev
/dev/pts
/dev/loop0
/dev/tty0
/dev/console

# cat /init
...
gpg2 --ignore-time-conflict --ignore-valid-from --verify $FLASH_FILE_SIG $FLASH_FILE
if [ $? -eq 0 ]; then
    echo "PWR_LED 3" > /proc/BOARD_io
    /bin/busybox sh $FLASH_FILE
    if [ $? -eq 0 ]; then
        echo "PWR_LED 1" > /proc/BOARD_io
        echo "flash success..."
        echo "Please unplug USB drive and power cycle system"
    else
        echo "PWR_LED 4" > /proc/BOARD_io
        echo "flash failed..."
        echo "Please try again or try another board"
    fi
else
    echo "PWR_LED 4" > /proc/BOARD_io
    echo "flash failed..."
    echo "Script verify failed"
fi
...

从initrd的内容来看，由/init调用gpg2对U盘中的刷机脚本执行签名校验，只有公钥集成在initrd中，没有私钥。

How to find a deleted file in git commit history?

Mon, 18 Feb 2019 00:00:00 +0000

git log --all --full-history --

Run QEMU with hardware virtualization on macOS

Wed, 23 Jan 2019 00:00:00 +0000

在macOS上通过虚拟机运行其它操作系统，又不想用商业软件，那么开源的QEMU是一个比较好的选择。QEMU的功能支持还是比较全面的，除了功能以外，使用虚拟机软件的用户最关心的就是性能了，一个好消息是macOS 10.10+版本已经引人了硬件虚拟化支持框架，也就是Hypervisor.framework，另一个好消息是QEMU也已支持该框架，也就是hvf accelerator。

Requirements

macOS 10.10+
Macports

Issues

已经使用过的用户可能已经发现，QEMU使用hvf accelerator并开启多核是有问题的呀。的确，QEMU使用hvf accelerator以单核运行时没有问题，当使用-smp参数指定多核时，很大概率上虚拟机硬件初始化都完成不了就死机了。

不过，好消息是该问题也已经修复了，导致这个问题的原因是hvf accelerator代码设计没有考虑到虚拟机启动后所有hvf vcpu都在并行执行指令，其中包括硬件初始化的I/O模拟操作，多个CPU同时对同一硬件执行初始化显然是不行的。

Patch (已经合并上游社区)

Install QEMU

cd ~
git clone https://github.com/hevz/macports
sudo vim /opt/local/etc/macports/sources.conf

# Add local repositories
file:///Users/[YOUR USER NAME]/macports
rsync://rsync.macports.org/macports/release/tarballs/ports.tar [default]

cd ~/macports
portindex
sudo port install qemu

Run Arch Linux

下载Arch Linux安装ISO镜像。
创建一个虚拟机磁盘镜像。
开始安装新的系统。
启动安装后的系统。

mkdir ~/system/images
qemu-img create -f qcow2 ~/system/images/arch.qcow2 40G

qemu-system-x86_64 -no-user-config -nodefaults -show-cursor \
    -M pc-q35-3.1,accel=hvf,usb=off,vmport=off \
    -cpu host -smp 4,sockets=1,cores=2,threads=2 -m 4096 \
    -realtime mlock=off -rtc base=utc,driftfix=slew \
    -drive file=~/system/images/arch.qcow2,if=none,format=qcow2,id=disk0 \
    -device virtio-blk-pci,bus=pcie.0,addr=0x1,drive=disk0 \
    -netdev user,id=net0,hostfwd=tcp::2200-:22 \
    -device virtio-net-pci,netdev=net0,bus=pcie.0,addr=0x2 \
    -device virtio-keyboard-pci,bus=pcie.0,addr=0x3 \
    -device virtio-tablet-pci,bus=pcie.0,addr=0x4 \
    -device virtio-vga,bus=pcie.0,addr=0x5 \
    -cdrom ~/archlinux-2019.01.01-x86_64.iso -boot d

安装完成后，删除qemu-system-x86_64最后一行命令即可启动新系统。

Dump VDSO via GDB

Wed, 14 Nov 2018 00:00:00 +0000

gdb /bin/bash
(gdb) b main
(gdb) r
(gdb) info proc map
Mapped address spaces:
          Start Addr           End Addr       Size     Offset objfile
      ...
      0x7ffff7fd1000     0x7ffff7fd3000     0x2000        0x0 [vdso]
      ...
(gdb) dump binary memory /tmp/vdso.so 0x7ffff7fd1000 0x7ffff7fd3000
(gdb) quit
file /tmp/vdso.so
/tmp/vdso.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1a3fac101214fe3ecfb3788d4f8af3018f1f2667, stripped

Reordering on an Alpha processor

Wed, 07 Nov 2018 00:00:00 +0000

A very non-intuitive property of the Alpha processor is that it allows the following behavior:

Initially: p = & x, x = 1, y = 0

    Thread 1         Thread 2
--------------------------------
  y = 1         |
  memoryBarrier |    i = *p
  p = & y       |
--------------------------------
Can result in: i = 0

This behavior means that the reader needs to perform a memory barrier in lazy initialization idioms (e.g., Double-checked locking) and creates issues for synchronization-free immutable objects (e.g., ensuring. that other threads see the correct value for fields of a String object).

Linux simple source policy routing

Wed, 27 Jun 2018 00:00:00 +0000

Dual network connections

eth0

Address: 192.168.0.2
NetMask: 255.255.255.0
Gateway: 192.168.0.1

eth1

Address: 192.168.1.2
NetMask: 255.255.255.0
Gateway: 192.168.1.1

Routing policy

Transmit via eth0 when source address is 192.168.0.2
Transmit via eth1 when source address is 192.168.1.2

Commands

# eth0
ifconfig eth0 192.168.0.2/24 up
ip rule add from 192.168.0.2 table 251
ip route add default via 192.168.0.1 dev eth0 src 192.168.0.2 table 251

# eth1
ifconfig eth1 192.168.1.2/24 up
ip rule add from 192.168.1.2 table 252
ip route add default via 192.168.1.1 dev eth1 src 192.168.1.2 table 252

Alpha 通用64位立即数装载

Tue, 26 Jun 2018 00:00:00 +0000

Alpha 立即数装载方式

使用立即数装载指令
使用访存指令从内存装载

Alpha 立即数装载指令

lda

格式：lda ra, imm16(rb)
功能：val(ra) = val(rb) + sign_extend_to_64bit(imm16)

ldah

格式：ldah ra, imm16(rb)
功能：val(ra) = val(rb) + sign_extend_to_64bit(imm16 * 65536)

通用64位立即数装载代码生成

# li64.S
    .text

    .globl    li64
    .enty     li64
    .type     li64, @function
    .set      noreorder
    .set      nomacro
    .set      nomove
    .set      volatile
li64:
    ldah      v0, 0(zero) # highest
    lda       v0, 0(v0)   # higher
    sll       v0, 32, v0
    ldah      v0, 0(v0)   # high
    lda       v0, 0(v0)   # low

    ret       zero, (ra)
    .end      li64
    .size     li64, .-li64

unsigned long imm64;

if ((short) (imm64 >> 0) < 0)
    imm64 += 0x10000ul;
if ((short) (imm64 >> 16) < 0)
    imm64 += 0x100000000ul;
if ((short) (imm64 >> 32) < 0)
    imm64 += 0x1000000000000ul;

short highest = (short) (imm64 >> 48);
short higher = (short) (imm64 >> 32);
short highe = (short) (imm64 >> 16);
short low = (short) imm64;

用龙芯EJTAG硬件断点优化Linux ptrace watch性能

Wed, 28 Mar 2018 00:00:00 +0000

在MIPS标准的协处理器0（CP0）中定义一组硬件watchpoints接口，由于某些原因，龙芯3系列处理器并未实现，这就导致了在该架构Linux系统中用gdb watch只能使用软件断点，真心非常、非常慢。:(

好消息是龙芯3系列处理器是实现了MIPS EJTAG的，兼容2.61标准，那么能否利用MIPS EJTAG的硬件断点功能部件实现Linux ptrace的watchpoints功能呢？答案是肯定的。让我们一起看看具体的方法吧。

首先，我们需要更改BIOS中的异常处理函数，将EJTAG调试异常重新路由至Linux内核中处理，因为MIPS EJTAG异常处理程序的入口地址固定为0xbfc00480，在不能修改BIOS的情况下，可以使用龙芯L1X地址路由窗口将0x1fc00400/1K路由至RAM。

         /* Debug exception */
         .align  7           /* bfc00480 */
         .set    push
         .set    noreorder
         .set    arch=mips64r2
         dmtc0   k0, CP0_DESAVE
         mfc0    k0, CP0_DEBUG
         andi    k0, 0x2
         beqz    k0, 1f
          mfc0   k0, CP0_STATUS
         andi    k0, 0x18
         bnez    k0, 2f
          nop
 1:
         mfc0    k0, CP0_EBASE
         ins     k0, zero, 0, 12
         addiu   k0, 0x480
         jr      k0
          dmfc0  k0, CP0_DESAVE
 2:
         li      k0, 0xdeadbeef
         dmtc0   k0, CP0_DEPC
         dmfc0   k0, CP0_DESAVE
         sync
         deret
         .set    pop

这段处理程序实现了两个功能：

将来自用户态的sdbbp指令触发的异常路由至地址 0xdeadbeef。
将来自内核态的sdbbp指令触发的异常或是任意态的非sdbbp触发的异常路由至 ebase+0x480。

接着，我们还需要修改内核，实现下列功能：

实现 EJTAG watch 相关的 probe、install、read、clear 等操作，及合适的调试异常处理程序。
实现 Linux ptrace watch 接口与 EJTAG watch 的对接。

优化ibus-table性能

Sun, 23 Jul 2017 00:00:00 +0000

ibus-table 是 Python 语言实现的 ibus 输入法框架的码表引擎，ibus 的绝大多数形码输入法使用该引擎，如郑码、五笔等等。

使用过该引擎的用户或多或少有这样的感觉，就是反应慢，尤其在低性能的计算机上感觉格外明显。无需复杂的性能分析工具，仅用 top 命令就不难发现，用一个约有20万条记录的郑码码表，在连续输入中文时，ibus-table 进程的CPU使用率几乎100％，这还是在一个 i3 2.5GHz 的 PC 平台上。那么在一个更低性能的平台上，输入体验可以想象。

再通过 pref 工具跟踪可以发现，在连续输入时，大部分CPU使用主要来自于 sqlite 数据库查询操作和候选词排序。在阅读引擎代码后，我做了一个实验，在 tabsqlitedb.py 的 select_words 中删除掉 sqlite 查询与排序，返回静态记录。结果CPU使用率降低到了只有5％左右。

因此，给 select_words 加个缓存应该是个不错的选择，就用 HashMap 来实现这个缓存，按键输入作为 key，排序后的结果作为 value。结果很明显，连接输入中文时的进程CPU使用率从几乎100％下降到了10％。

已经合并至 1.9.18: https://github.com/kaio/ibus-table/releases/tag/1.9.18

RPi2远程控制PC电源开关

Fri, 22 Jan 2016 00:00:00 +0000

远程连接物理机调试、测试固件、内核级补丁时，因补丁功能异常导致死机是经常发生的，如果你有一个 Rpi，那就可以派上用场了，本文记录了使用 Rpi2 的 GPIO 远程控制 PC 电源开关的方法。

物理连接

rpi2 有数量众多的 pinout，将 rpi2 的 pin37(gpio26) 与 pc front panel 的 pwr_sw_p 连接，再将 rpi2 的 pin39(gnd) 与 pc front panel 的 pwr_sw_n 连接。如图：

软件控制

# 先将 gpio 26 export，这步不必每次都做，当 /sys/class/gpio/gpio26 目录不存在时执行。
echo 26 > /sys/class/gpio/export
cd /sys/class/gpio/gpio26
# 开机
echo out > direction; echo 0 > value; sleep 1; echo in > direction
# 关机
echo out > direction; echo 0 > value; sleep 5; echo in > direction

ArchLinux部署SSD缓存

Wed, 13 Jan 2016 00:00:00 +0000

在 Linux 系统上使用带宽更高、延迟更小的 SSD 作为 HDD 的缓存来打造软件实现的“混合硬盘”是一种容量和性能折中的方案。在 Linux 系统中使用高速外存作低速外存的缓存有两个成熟的方案：

lvmcache
bcache。

本文记录的是基于 lvmcache 在 Arch Linux 系统上的部署方法。

硬件情况

一块120GB容量的固态硬盘 (/dev/sda)。
一块1TB容量的机械硬盘 (/dev/sdb)。

分区规划

/dev/sda1     20GB     lvm
/dev/sda2     100GB    lvm
/dev/sdb      1TB      lvm

LVM 规划

VG (system) -> { PV (/dev/sda1) }
VG (data) -> { PV (/dev/sdb), PV (/dev/sda2) }

LV (system/arch) 19.9GB
LV (data/home) 917GB
LV (data/home_cache) 91GB

操作系统完全安装在 SSD 中， home 存放于 HDD 中，但使用 SSD 的剩余空间作为 cache。为什么不把所有数据存放于 HDD 中，仅用 SSD 作为 cache 呢？测试结果是当 cache 加入后就影响了系统的启动，所有只能应用于数据区。

System V AMD64 ABI calling conventions

Thu, 23 Jul 2015 00:00:00 +0000

The calling convention of the System V AMD64 ABI is followed on Solaris, Linux, FreeBSD, Mac OS X, and other UNIX-like or POSIX-compliant operating systems. The first six integer or pointer arguments are passed in registers RDI, RSI, RDX, RCX, R8, and R9, while XMM0, XMM1, XMM2, XMM3, XMM4, XMM5, XMM6 and XMM7 are used for floating point arguments. For system calls, R10 is used instead of RCX. As in the Microsoft x64 calling convention, additional arguments are passed on the stack and the return value is stored in RAX.

GCC dump preprocessor defines

Mon, 13 Jul 2015 00:00:00 +0000

gcc -dM -E - < /dev/null

Flow diagram of autoconf and automake

Tue, 30 Jun 2015 00:00:00 +0000

Change local symbol to global in ELF

Mon, 10 Mar 2014 00:00:00 +0000

objcopy --globalize-symbol=SYMBOL_NAME INPUT_FILE OUTPUT_FILE

Linux平台一种进程代码注入方法

Thu, 07 Jun 2012 00:00:00 +0000

用于在目标程序的 main 函数执行前完成一些操作 😉 特定情况下用来调试还是不错的。

源代码

/* fakemain.c
 * Heiher
 */

#include

#define __USE_GNU
#include

static void do_something(void)
{
	printf("Hello!\n");
}

int __libc_start_main(int (*main)(int, char **, char **),
			int argc, char **ubp_av, void (*init)(void),
			void (*fini)(void), void (*rtld_fini)(void),
			void (*stack_end))
{
	int (*__libc_start_main_real)(int (*main) (int, char **, char **),
				int argc, char **ubp_av, void (*init)(void),
				void (*fini)(void), void (*rtld_fini)(void),
				void (*stack_end));

	do_something();

	__libc_start_main_real = dlsym(RTLD_NEXT, "__libc_start_main");

	return __libc_start_main_real(main, argc, ubp_av, init, fini,
				rtld_fini, stack_end);
}

编译

gcc -o libfakemain.so -fPIC -shared fakemain.c -ldl

测试

LD_PRELOAD=./libfakemain.so ls

Hello!
fakemain.c  hotkey  hotkey.vala  libfakemain.so

Modifying initrd image

Sat, 07 May 2011 00:00:00 +0000

Extracting initrd image

mkdir initrd && cd initrd
gzip -dc initrd.cpio.gz | cpio -id

Creating initrd image

find . | cpio -H newc -o | gzip > ../initrd2.cpio.gz

IPtables数据包流程图

Fri, 14 Jan 2011 00:00:00 +0000

如何把普通文件链接到程序中？

Sat, 13 Jun 2009 00:00:00 +0000

Windows 系统编程中经常把资源（图标、图片、声音等等）链接到程序中，并在程序中访问。 Linux 系统里这种用法好像并不常见。下面我以一个实例来说明如题把普通文件“编译”成目标文件并链接到程序中，以及在程序中访问这些数据。

我们 Grance.jpg 链接到程序中，程序执行时把图片写出到 /tmp/temp.jpg

heihaier@heihaier:~/pic$ ls -l
total 324
-rw-r--r-- 1 heihaier heihaier 326342 2009-05-29 09:06 Grace.jpg

把图片“编译”成目标文件。

objcopy -I binary -O elf32-tradlittlemips -B mips Grace.jpg Grace.o

具体用法可以看 man objcopy。

查看符号信息。

heihaier@heihaier:~/pic$ nm Grace.o
0004fac6 D _binary_Grace_jpg_end
0004fac6 A _binary_Grace_jpg_size
00000000 D _binary_Grace_jpg_start

程序代码

/* test.c */
#include

int main(int argc, char * argv[])
{
    extern char _binary_Grace_jpg_size;
    extern char _binary_Grace_jpg_start;
    char * p = &_binary_Grace_jpg_start;

    FILE * f = fopen("/tmp/temp.jpg", "w+");
    if(f)
    {
        fwrite(p, sizeof(char), (size_t)&_binary_Grace_jpg_size, f);
        fclose(f);
    }
    return 0;
}

编译命令

gcc test.c Grace.o -o test

Welcome

Tue, 01 Jan 2008 00:00:00 +0000

Welcome to my space!