Moonshine implicit declarations for newer kernels.

[shiftre]

Hi all,

I've been playing with Moonshine recently on newer kernels, (4.19 LTS and 5.8 mainline), but it seems like implicit declaration feature that detects dependencies betewen calls is not available for those features. Walking over your paper I noticed that you are using the Smatch static analyzer in order to generate a json of dependencies for Moonshine's distiller, however the sources for your github repository do not contain the source for dependencies generator.

Can you share the source for your analyzer? I could generate the dependencies for newer kernels myself, this will cause Moonshine to work on newer kernels.

Hoping to hear from you.

Guy

[shankarapailoor]

Hi!

Here is our modified Smatch static analyzer with the implicit dependency checker: https://github.com/AndrewAday/smatch.

Apologies for any inconvenience.

[shiftre]

Hi @shankarapailoor

Thanks for the quick reply! I'll try building it tomorrow and let you know how it goes!

Thanks you very much

Guy

[LittleSec]

Hi, can you generate the dependencies for newer kernels yourself successfully? @shiftre

[shiftre]

Hi, @LittleSec The smatch version is too old to generate on modern version kernels, so nope.

cc @shankarapailoor

[LittleSec]

I try to run smatch in v4.19, it seems that there some problem in pl script, many err as follow:

DBD::SQLite::db do failed: near "security": syntax error at /path/to/smatch/smatch_scripts/../smatch_data/db/fill_db_sql.pl line 32, <WARNS> line 1042872.

by the way, my OS is ubuntu 18.04

[shiftre]

There are too many undefined cases for smatch to handle on newer kernels :[

[LittleSec]

@shiftre Today I find that in my environment, there are some nullptr dereference bugs in author's smatch repo. After fixing them(I fork author's repo, see commit 4c52550, I can run smatch in v4.x(eg. 4.13, 4.19).

By the way, it should use python2 not python3 when parse the kernel.implicit_dependencies, see commit 205ba95

[shankarapailoor]

Hi @LittleSec

I'm sorry but the original author of the implicit dependency tracker is not maintaining it and I don't have time right now to get things working again. My sincere apologies.

[Wayne-Bai]

There are too many undefined cases for smatch to handle on newer kernels :[

Hi @shiftre ,

I'm currently studying the Moonshine and I'm a little confused about some part. Do we have to generate new seed for the newer kernel version? And have you already generated the new seeds for the newer kernel? Hope I could get your help.

[shankarapailoor]

@shiftre @Wayne-Bai While the implicit dependency tracker was written in Smatch, a similar analysis could be easily written in LLVM. If we were to do reimplement Moonshine, the implicit dependency tracker would probably be written in LLVM, and a lot of the issues you are seeing would go away.

@Wayne-Bai technically you should recalculate the implicit dependencies with each version of the kernel. I suspect the seeds generated my Moonshine will be very similar across kernel versions.