6.19.9-1-cachyos (x86_64)

[qiufengyaya]

Loading tarball for memflow-dkms/0.2.1
Deprecated feature: CLEAN (/usr/src/memflow-dkms-0.2.1/dkms.conf)
Deprecated feature: REMAKE_INITRD (/usr/src/memflow-dkms-0.2.1/dkms.conf)
Creating symlink /var/lib/dkms/memflow-dkms/0.2.1/source -> /usr/src/memflow-dkms-0.2.1

Sign command: /usr/lib/modules/6.19.9-1-cachyos/build/scripts/sign-file
Signing key: /var/lib/dkms/mok.key
Public certificate (MOK): /var/lib/dkms/mok.pub

Building module(s)...(bad exit status: 2)
Failed command:
make -j16 KERNELRELEASE=6.19.9-1-cachyos KERNELDIR=/lib/modules/6.19.9-1-cachyos/build LLVM=1

Error! Bad return status for module build on kernel: 6.19.9-1-cachyos (x86_64)
Consult /var/lib/dkms/memflow-dkms/0.2.1/build/make.log for more information.

[qiufengyaya]

DKMS (dkms-3.3.0) make.log for memflow-dkms/0.2.1 for kernel 6.19.9-1-cachyos (x86_64)
Wednesday, March 25, 2026, 04:37:37 AM CST

Building module(s)

command: make -j16 KERNELRELEASE=6.19.9-1-cachyos KERNELDIR=/lib/modules/6.19.9-1-cachyos/build LLVM=1

cd memflow-kmod && make all
make[1]: Entering directory "/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod"
/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod
make -C /lib/modules/6.19.9-1-cachyos/build M=/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod src=/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod modules
make[2]: Entering directory "/usr/lib/modules/6.19.9-1-cachyos/build"
make[3]: Entering directory "/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod"
CC [M] main.o
CC [M] vmtools.o
vmtools.c:328:133: error: too many arguments to function call, expected 5, have 6
328 | return mm_get_unmapped_area(data->wrapped_task->mm, data->wrapped_vma->vm_file, addr, len, pgoff + data->wrapped_vma->vm_pgoff, flags);
| ~~~~~~~~~~~~~~~~~~~~ ^~~~~
/usr/lib/modules/6.19.9-1-cachyos/build/include/linux/sched/mm.h:192:15: note: 'mm_get_unmapped_area' declared here
192 | unsigned long mm_get_unmapped_area(struct file *filp, unsigned long addr,
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
193 | unsigned long len, unsigned long pgoff,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
194 | unsigned long flags);
| ~~~~~~~~~~~~~~~~~~~
1 error generated.
make[5]: *** [/usr/lib/modules/6.19.9-1-cachyos/build/scripts/Makefile.build:289: vmtools.o] Error 1
make[4]: *** [/usr/lib/modules/6.19.9-1-cachyos/build/Makefile:2070: .] Error 2
make[3]: *** [/usr/lib/modules/6.19.9-1-cachyos/build/Makefile:248: __sub-make] Error 2
make[3]: Leaving directory "/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod"
make[2]: *** [Makefile:248: __sub-make] Error 2
make[2]: Leaving directory "/usr/lib/modules/6.19.9-1-cachyos/build"
make[1]: *** [Makefile:17: all] Error 2
make[1]: Leaving directory "/var/lib/dkms/memflow-dkms/0.2.1/build/memflow-kmod"
make: *** [Makefile:2: all] Error 2

exit code: 2

[greyryan]

I can confirm this on newer 6.19 kernels as well.

Tested on:

• Arch Linux
• 6.19.12-arch1-1
• x86_64

This appears to be caused by the mm_get_unmapped_area() API change on newer kernels.
Current code in memflow-kmod/vmtools.c uses the older call form:

return mm_get_unmapped_area(data->wrapped_task->mm, data->wrapped_vma->vm_file, addr, len, pgoff + data->wrapped_vma->vm_pgoff, flags);

On my system, the kernel expects the newer 5-argument form, so I changed it to:

return mm_get_unmapped_area(data->wrapped_vma->vm_file, addr, len, pgoff + data->wrapped_vma->vm_pgoff, flags);

After that change, the module built successfully and memflow.ko was produced.
memflow workflow works well

[ko1N]

This was changed in 6.19. I made a PR to fix this properly. Would be great if you could give it a test so we can merge it in 👍

[greyryan]

I pulled PR #22 and tested it on my setup.

Tested revision:

• branch: pr-22
• commit: 8a117caef7b64bde75030e25025844ca8106112c
• kernel: 6.19.12-arch1-1

I was not fully sure what the intended validation procedure for this PR was, so I did a simple smoke test...

What I tested:

• Checked out the PR branch locally.
• Rebuilt memflow-kmod from the PR.
• Loaded the newly built memflow.ko manually.
• Ran a simple end-to-end smoke test through memflow using the kvm connector and the win32 OS plugin.

Build result:

• memflow-kmod built successfully on 6.19.12-arch1-1.

filename:       /home/ryan/xxx/third_party/memflow-kvm/memflow-kmod/memflow.ko
license:        GPL
author:         Heep
description:    memflow kernel module used to support KVM backend
srcversion:     1D791EF9B00DA52C1877674
depends:        kvm
name:           memflow
retpoline:      Y
vermagic:       6.19.12-arch1-1 SMP preempt mod_unload 

Smoke test result:

I used the memflow integration example as a basic runtime test:

sudo MEMFLOW_PLUGIN_PATH=/usr/lib/memflow target/release/examples/integration -vv -c kvm -o win32

Relevant output from the smoke test:

[ryan@ryan70x memflow]$ sudo MEMFLOW_PLUGIN_PATH=/usr/lib/memflow target/release/examples/integration -vv -c kvm -o win32
08:50:38 [WARN] "/usr/lib/memflow/libmemflow_win32.meta" not found, falling back via file creation date
08:50:38 [WARN] "/usr/lib/memflow/libmemflow_kvm.meta" not found, falling back via file creation date
08:50:38 [WARN] "/usr/lib/memflow/libmemflow_ffi.meta" not found, falling back via file creation date
08:50:38 [WARN] inventory: file is not a valid executable file (no plugin descriptor found in plugin file "/usr/lib/memflow/libmemflow_ffi.so")
08:50:38 [INFO] Found installed Connector Plugin: kvm 0.2.1 ("/usr/lib/memflow/libmemflow_kvm.so")
08:50:38 [INFO] Found installed Os Plugin: win32 0.2.1 ("/usr/lib/memflow/libmemflow_win32.so")
08:50:40 [INFO] mmapped 24 slots
08:50:40 [INFO] Inserting `CachedPhysicalMemory` middleware with size=0, validity_time=0, page_size=4096
08:50:40 [INFO] Building kernel of type memflow_win32::win32::kernel_builder::Win32KernelBuilder<memflow::plugins::connector::cglue_connectorinstance::cglue_internal::ConnectorInstance<'_, cglue::boxed::CBox<'_, cglue::trait_group::c_void>, cglue::arc::CArc<cglue::trait_group::c_void>>, memflow::plugins::connector::cglue_connectorinstance::cglue_internal::ConnectorInstance<'_, cglue::boxed::CBox<'_, cglue::trait_group::c_void>, cglue::arc::CArc<cglue::trait_group::c_void>>, memflow::mem::virt_translate::cache::CachedVirtualTranslate<memflow::mem::virt_translate::direct_translate::DirectTranslate, memflow::types::cache::timed_validator::TimedCacheValidator>>
08:50:40 [INFO] arch=X86(64, false) kernel_hint=fffff800ca6a5130 dtb=1ae000
08:50:40 [INFO] base=fffff800ca000000 size=21299200
08:50:40 [INFO] kernel_guid=Some(Win32Guid { file_name: "ntkrnlmp.pdb", guid: "04A313E5C86A0212FB000E449E728D8C1" })
08:50:40 [INFO] trying to find NtBuildNumber export
08:50:40 [INFO] NtBuildNumber found at 0xe0a6cc
08:50:40 [INFO] trying to find RtlGetVersion export
08:50:40 [INFO] RtlGetVersion found at 0xa012d0
08:50:40 [INFO] nt_build_number: 4026557940
08:50:40 [INFO] kernel version: 10.0.26100
08:50:40 [INFO] kernel_winver=Win32Version { nt_major_version: 10, nt_minor_version: 0, nt_build_number: 4026557940 }
08:50:40 [INFO] PsInitialSystemProcess found at 0xfffff800cafc5af0
08:50:40 [INFO] eprocess_base=ffffb6062a695040
08:50:40 [INFO] start_block.dtb=1ae000
08:50:40 [INFO] reading pdb from local cache: /root/.cache/memflow/ntkrnlmp.pdb/04A313E5C86A0212FB000E449E728D8C1
08:50:40 [INFO] updating connector mem_map=MemoryMapping: base=1000 size=9f000 real_base=1000
MemoryMapping: base=100000 size=712000 real_base=100000
MemoryMapping: base=813000 size=7dfb8000 real_base=813000
MemoryMapping: base=7e7da000 size=4da000 real_base=7e7da000
MemoryMapping: base=7ed75000 size=b78000 real_base=7ed75000
MemoryMapping: base=7fbff000 size=37d000 real_base=7fbff000
MemoryMapping: base=100000000 size=480000000 real_base=100000000
08:50:40 [INFO] updating sysproc_dtb=1ae000
Kernel info:
base: fffff800ca000000 ... ok
size: 1450000 ... ok

Kernel Physical Read: [232, 208, 183, 127, 0, 0, 0, 0, 156, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0]
Kernel Virtual Read: [77, 90, 144, 0, 3, 0, 0, 0, 4, 0, 0, 0, 255, 255, 0, 0, 184, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0]
kernel modules ... ok
ntoskrnl.exe ... ok
hal.dll ... ok

Process List:
lsass.exe ... ok

lsass.exe info:
pid: 1220 ... ok

[ko1N]

Looks good thanks! I wanted to see if it compiles on that kernel, as i'm on a slightly older one. The change is only relevant for 6.19! I'll merge it and re-release. Thanks!