https://huweicai.com/tags/ebpf/ Recent content in ebpf on Anonymous' Blog Hugo -- gohugo.io zn-Hans Tue, 17 Jan 2023 00:00:00 +0800 https://huweicai.com/kernel-debug-tips_en/ Tue, 17 Jan 2023 00:00:00 +0800 https://huweicai.com/kernel-debug-tips_en/ Kernel Kernel undertakes the core Operating System job, which is the foundation of the current software ecosystem. So, knowing more about how the kernel works will contribute to the construction of our user mode system. The best method to learn software code is debugging while watching, software = code + data, know more about the runtime data while learning code can help us understand it better. However the Kernel is not a normal software system, we can’t add breakpoint and debug it through IDE debug button like other normal software, though we can implement it by kgdb + QEMU, it’ still too heavy, and not available for online systems. This article shares two lightweight kernel debugging tips, helps us observing it runtime status rapidly. Kernel Module Usally, our codes are runing in user mode. In Linux operating systems, the instruction of user mode program will run in level Ring 3 , they do not have the permission to acces the data in level Ring 0 high memory address space, which means that they can’t snoop the data inside Kernel. In that case, why not try to run our code inside the Kernel? It’s possible to edit the source code of kernel, adding log to print the information we concerned, but it’s a long tedious step. https://huweicai.com/kernel-debug-tips/ Sun, 13 Mar 2022 00:00:00 +0800 https://huweicai.com/kernel-debug-tips/ Kernel 内核承担了核心的操作系统工作，是当今软件生态的基石，因此了解内核是如何工作的能极大的帮助我们更好地构建用户态系统。 学习软件源代码最好的方式就是边看边 DEBUG，软件 = 代码 + 数据，看代码的同时了解其运行时数据能让我们更好的理解整体逻辑。 但内核毕竟不是普通的软件系统，并不是简单的在 IDE 里面一点就能断点调试的，虽然也可以通过 kgdb + qemu 实现在 IDE 中的断点调式，不过这样实在是太重了，而且也不能分析正在运行中的线上