Magic System Request Keys in linux

What is the magic SysRq key?

It is a ‘magical’ key combo you can hit which the kernel will respond to regardless of whatever else it is doing, unless it is completely locked up.

How do I enable the magic SysRq key?

You need to say “yes” to ‘Magic SysRq key (CONFIG_MAGIC_SYSRQ)’ when configuring the kernel. When running a kernel with SysRq compiled in, /proc/sys/kernel/sysrq controls the functions allowed to be invoked via the SysRq key. The default value in this file is set by the CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE config symbol, which itself defaults to 1. Here is the list of possible values in /proc/sys/kernel/sysrq:

• 0 - disable sysrq completely
• 1 - enable all functions of sysrq
• >1 - bitmask of allowed sysrq functions (see below for detailed function description):

    2 =   0x2 - enable control of console logging level
    4 =   0x4 - enable control of keyboard (SAK, unraw)
    8 =   0x8 - enable debugging dumps of processes etc.
   16 =  0x10 - enable sync command
   32 =  0x20 - enable remount read-only
   64 =  0x40 - enable signalling of processes (term, kill, oom-kill)
  128 =  0x80 - allow reboot/poweroff
  256 = 0x100 - allow nicing of all RT tasks
  

You can set the value in the file by the following command:

echo "number" >/proc/sys/kernel/sysrq

The number may be written here either as decimal or as hexadecimal with the 0x prefix. CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE must always be written in hexadecimal.
Note that the value of /proc/sys/kernel/sysrq influences only the invocation via a keyboard. Invocation of any operation via /proc/sysrq-trigger is always allowed (by a user with admin privileges).

How do I use the magic SysRq key?

On x86 - You press the key combo ALT-SysRq-<command key>.

Note

Some keyboards may not have a key labeled ‘SysRq’. The ‘SysRq’ key is also known as the ‘Print Screen’ key. Also some keyboards cannot handle so many keys being pressed at the same time, so you might have better luck with press Alt, press SysRq, release SysRq, press <command key>, release everything.

On SPARC - You press ALT-STOP-<command key>, I believe.

On the serial console (PC style standard serial ports only)

You send a BREAK, then within 5 seconds a command key. Sending BREAK twice is interpreted as a normal BREAK.

On PowerPC

Press ALT - Print Screen (or F13) - <command key>, Print Screen (or F13) - <command key> may suffice.

On other

If you know of the key combos for other architectures, please let me know so I can add them to this section.

On all

write a character to /proc/sysrq-trigger. e.g.:

echo t > /proc/sysrq-trigger

What are the ‘command’ keys?

Command	Function
b	Will immediately reboot the system without syncing or unmounting your disks.
c	Will perform a system crash by a NULL pointer dereference. A crashdump will be taken if configured.
d	Shows all locks that are held.
e	Send a SIGTERM to all processes, except for init.
f	Will call the oom killer to kill a memory hog process, but do not panic if nothing can be killed.
g	Used by kgdb (kernel debugger)
h	Will display help (actually any other key than those listed here will display help. but h is easy to remember :-)
i	Send a SIGKILL to all processes, except for init.
j	Forcibly “Just thaw it” - filesystems frozen by the FIFREEZE ioctl.
k	Secure Access Key (SAK) Kills all programs on the current virtual console. NOTE: See important comments below in SAK section.
l	Shows a stack backtrace for all active CPUs.
m	Will dump current memory info to your console.
n	Used to make RT tasks nice-able
o	Will shut your system off (if configured and supported).
p	Will dump the current registers and flags to your console.
q	Will dump per CPU lists of all armed hrtimers (but NOT regular timer_list timers) and detailed information about all clockevent devices.
r	Turns off keyboard raw mode and sets it to XLATE.
s	Will attempt to sync all mounted filesystems.
t	Will dump a list of current tasks and their information to your console.
u	Will attempt to remount all mounted filesystems read-only.
v	Forcefully restores framebuffer console
v	Causes ETM buffer dump [ARM-specific]
w	Dumps tasks that are in uninterruptable (blocked) state.
x	Used by xmon interface on ppc/powerpc platforms. Show global PMU Registers on sparc64. Dump all TLB entries on MIPS.
y	Show global CPU Registers [SPARC-64 specific]
z	Dump the ftrace buffer
0-9	Sets the console log level, controlling which kernel messages will be printed to your console. (0, for example would make it so that only emergency messages like PANICs or OOPSes would make it to your console.)

Okay, so what can I use them for?

Well, unraw(r) is very handy when your X server or a svgalib program crashes.
sak(k) (Secure Access Key) is useful when you want to be sure there is no trojan program running at console which could grab your password when you would try to login. It will kill all programs on given console, thus letting you make sure that the login prompt you see is actually the one from init, not some trojan program.

Important

In its true form it is not a true SAK like the one in a c2 compliant system, and it should not be mistaken as such.

It seems others find it useful as (System Attention Key) which is useful when you want to exit a program that will not let you switch consoles. (For example, X or a svgalib program.)
reboot(b) is good when you’re unable to shut down. But you should also sync(s) and umount(u) first.
crash(c) can be used to manually trigger a crashdump when the system is hung. Note that this just triggers a crash if there is no dump mechanism available.
sync(s) is great when your system is locked up, it allows you to sync your disks and will certainly lessen the chance of data loss and fscking. Note that the sync hasn’t taken place until you see the “OK” and “Done” appear on the screen. (If the kernel is really in strife, you may not ever get the OK or Done message...)
umount(u) is basically useful in the same ways as sync(s). I generally sync(s), umount(u), then reboot(b) when my system locks. It’s saved me many a fsck. Again, the unmount (remount read-only) hasn’t taken place until you see the “OK” and “Done” message appear on the screen.
The loglevels 0-9 are useful when your console is being flooded with kernel messages you do not want to see. Selecting 0 will prevent all but the most urgent kernel messages from reaching your console. (They will still be logged if syslogd/klogd are alive, though.)
term(e) and kill(i) are useful if you have some sort of runaway process you are unable to kill any other way, especially if it’s spawning other processes.
“just thaw it(j)” is useful if your system becomes unresponsive due to a frozen (probably root) filesystem via the FIFREEZE ioctl.

Sometimes SysRq seems to get ‘stuck’ after using it, what can I do?

That happens to me, also. I’ve found that tapping shift, alt, and control on both sides of the keyboard, and hitting an invalid sysrq sequence again will fix the problem. (i.e., something like alt-sysrq-z). Switching to another virtual console (ALT+Fn) and then back again should also help.

I hit SysRq, but nothing seems to happen, what’s wrong?

There are some keyboards that produce a different keycode for SysRq than the pre-defined value of 99 (see KEY_SYSRQ in include/linux/input.h), or which don’t have a SysRq key at all. In these cases, run showkey -s to find an appropriate scancode sequence, and use setkeycodes <sequence> 99 to map this sequence to the usual SysRq code (e.g., setkeycodes e05b 99). It’s probably best to put this command in a boot script. Oh, and by the way, you exit showkey by not typing anything for ten seconds.

I want to add SysRQ key events to a module, how does it work?

In order to register a basic function with the table, you must first include the header include/linux/sysrq.h, this will define everything else you need. Next, you must create a sysrq_key_op struct, and populate it with A) the key handler function you will use, B) a help_msg string, that will print when SysRQ prints help, and C) an action_msg string, that will print right before your handler is called. Your handler must conform to the prototype in ‘sysrq.h’.
After the sysrq_key_op is created, you can call the kernel function register_sysrq_key(int key, struct sysrq_key_op *op_p); this will register the operation pointed to by op_p at table key ‘key’, if that slot in the table is blank. At module unload time, you must call the function unregister_sysrq_key(int key, struct sysrq_key_op *op_p), which will remove the key op pointed to by ‘op_p’ from the key ‘key’, if and only if it is currently registered in that slot. This is in case the slot has been overwritten since you registered it.
The Magic SysRQ system works by registering key operations against a key op lookup table, which is defined in ‘drivers/tty/sysrq.c’. This key table has a number of operations registered into it at compile time, but is mutable, and 2 functions are exported for interface to it:

register_sysrq_key and unregister_sysrq_key.

Of course, never ever leave an invalid pointer in the table. I.e., when your module that called register_sysrq_key() exits, it must call unregister_sysrq_key() to clean up the sysrq key table entry that it used. Null pointers in the table are always safe. :)
If for some reason you feel the need to call the handle_sysrq function from within a function called by handle_sysrq, you must be aware that you are in a lock (you are also in an interrupt handler, which means don’t sleep!), so you must call __handle_sysrq_nolock instead.

When I hit a SysRq key combination only the header appears on the console?

Sysrq output is subject to the same console loglevel control as all other console output. This means that if the kernel was booted ‘quiet’ as is common on distro kernels the output may not appear on the actual console, even though it will appear in the dmesg buffer, and be accessible via the dmesg command and to the consumers of /proc/kmsg. As a specific exception the header line from the sysrq command is passed to all console consumers as if the current loglevel was maximum. If only the header is emitted it is almost certain that the kernel loglevel is too low. Should you require the output on the console channel then you will need to temporarily up the console loglevel using alt-sysrq-8 or:

echo 8 > /proc/sysrq-trigger

Remember to return the loglevel to normal after triggering the sysrq command you are interested in.


Documentation for sysrq.c

What happens when a program is executed in Linux?

1. Shell forks and execs the new process. Shell waits for the completion of the process using wait4() unless forked process is a daemon (is a session leader and kills the parent and continues with the child after exec)
2. fork() actually creates clone of the shell process itself. This address space is overwritten by exec call.  Exec call starts off by reading the first few pages of the executable from the disk. This operation involves file system, block layer, page cache and the device driver (if backend is disk, then disk device driver).
3.  Kernel needs to be compiled with different binary file handlers. Some handlers present in Linux kernel are ELF, a.out, script  etc.  Header of the executable says what kind of executable it is.  If kernel is compiled with the right kind of binary format handler, then the read data is handed over to the handler.
4. For example, if handler is an ELF handler, then the header has the location of the text in the file. Few pages of the text are read from disk  (basically mmapped) along with all the directly linked libraries.  Now the process is ready to start as its text and required libraries are in memory. Rest of the text is read using demand paging when needed.

examples:

strace ./a.out
execve("./a.out", ["./a.out"], [/* 45 vars */]) = 0
brk(0)                                  = 0x1056000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4ce4a9000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=88130, ...}) = 0
mmap(NULL, 88130, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff4ce493000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P \2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1840928, ...}) = 0
mmap(NULL, 3949248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff4cdec4000
mprotect(0x7ff4ce07e000, 2097152, PROT_NONE) = 0
mmap(0x7ff4ce27e000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ba000) = 0x7ff4ce27e000
mmap(0x7ff4ce284000, 17088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff4ce284000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4ce492000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff4ce490000
arch_prctl(ARCH_SET_FS, 0x7ff4ce490740) = 0
mprotect(0x7ff4ce27e000, 16384, PROT_READ) = 0
mprotect(0x600000, 4096, PROT_READ)     = 0
mprotect(0x7ff4ce4ab000, 4096, PROT_READ) = 0
munmap(0x7ff4ce493000, 88130)           = 0
exit_group(4195565)                     = ?
+++ exited with 237 +++ 

Implementation of execve

•      The entry point of the system call is the architecture-dependent sys_execve function. This function quickly delegates its work to the system-independent do_execve routine.

•      int do_execve(char * filename, char __user *__user *argv, char __user *__user *envp,struct pt_regs * regs)

•      Filename

•      * argv  (ex: ls –l /usr/bin/)

•      *envp :environment of the program

•      The notation is slightly clumsy because argv and envp are arrays of pointers, and both the pointer to the array itself as well as all pointers in the array are located in the userspace portion of the virtual address space.

the code flow diagram for do_execve

•      bprm_init then handles several administrative tasks

–     mm_alloc generates a new instance of mm_struct to manage the process address space.

–     init_new_context is an architecture-specific function that initializes the instance.

–     __bprm_mm_init sets up an initial stack.

•      prepare_binprm is used to supply a number of parent process values (above all, the effective UID and GID)

•      search_binary_handler is used at the end of do_execve to find a suitable binary format for the particular file.

•      Binary format handler performs the following actions:

–     It releases all resources used by the old process.

–     It maps the application into virtual address space.

–     The instruction pointer of the process and some other architecture-specific registers are set so that the main function of the program is executed when the scheduler selects the process.

Interpreting Binary Formats

<binfmts.h>

struct linux_binfmt

struct linux_binfmt * next;

struct module *module;

int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);

int (*load_shlib)(struct file *);

int (*core_dump)(long signr, struct pt_regs * regs, struct file * file);

unsigned long min_coredump; /* minimal dump size */

};

1.       load_binary to load normal programs.

1.       load_shlib to load a shared library, that is, a dynamic library.

1.       core_dump to write a core dump if there is a program error.

Exiting Processes

•      Processes must terminate with the exit system call.

•      The entry point for this call is the sys_exit function that requires an error code as its parameter in order to exit the process.

•      Its implementation is not particularly interesting because it immediately delegates its work to do_exit.

call flow:

                                              do_execve()     //./fs/exec.c

                                                    |

                                    do_execve_common(filename, argv, envp, regs); 

                                                   |

                                                    --->file = open_exec(filename);

                                                    ---> sched_exec();

                                      bprm_mm_init(bprm) 

                                                 |

                                       bprm->mm = mm = mm_alloc();

                                                                         |

                                                                         --->alloctae_mm()

                                                                        ---->mm_init(mm,current)

                                                                                 |

                                                                                mm_alloc_pgd(mm)

                                                                                  |

                                                                                 --->pgd_alloc()

                                            |

                                   init_new_context(current, mm);  //Arch specific -->arch/arm/mm/context.c

                                            |

                                   __bprm_mm_init(bprm);

                                            |

                                           ---> insert_vm_struct(mm, vma)

                                     |

                                   prepare_binprm(bprm);

                   |

                  search_binary_handler(bprm,regs);     //./fs/exec.c

How to uses the INCBIN in ARM

The INCBIN directive includes a file within the file being assembled. The file is included as it is, without being assembled.

Syntax

INCBIN filename

where:

filename

is the name of the file to be included in the assembly.The assembler accepts pathnames in either UNIX or MS-DOS format.

Usage

You can use INCBIN to include executable files, literals, or any arbitrary data. The contents of the file are added to the current ELF section, byte for byte, without being interpreted in any way. Assembly continues at the line following the INCBIN directive.

By default the assembler searches the current place for included files. The current place is the directory where the calling file is located. Use the -i assembler command-line option to add directories to the search path. File names and directory names containing spaces must not be enclosed in double quotes ( " " ).

Example

        AREA    Example, CODE, READONLY
        INCBIN  file1.dat               ; includes file1 if it
                                        ; exists in the 
                                        ; current place.
        INCBIN  c:\project\file2.txt    ; includes file2