Linux Kernel Architecture

Mauerer runapp02.tex V2 - 09/04/2008 6:09pm Page 1171

Appendix B: Working with the Source Code

❑ Set breakpoints that halt the program when it reachesagivenpositioninthesourcecodeand

then enable the debugger.

❑ Set watchpoints that halt the program when a given condition is satisfied — for example, when

the value of a variable is set to a predefined value.

The specific kernel debugging options that are available depend on the method used.

The command syntax for performing these operations is simple to learn and remember because it is based

on C. It is excellently explained in theGDBdocumentation.

Like mostUnixtools,GDBis text-based. This has its benefits but also its downsides, particularly the fact

that it is not possible to visualize the relationship between data structures by means of graphical pointers.

Similarly, theGDBview on source text is not always ideal because only very short sections are displayed.

DDD—theData Display Debugger— was developed to rectify these deficiencies and is now included in

all popular distributions. As a graphical tool for X11, it remedies the known disadvantages ofGDB.DDDis

a user interface toGDBand therefore supports all features of thedebugger. Because it is possible to type

inGDBcommands directly, all options are available — not just those integrated into the graphical user

interface.

TheDDDpackage comes with a very good guide, so this appendix doesn’t explain how to use it, particu-

larly because the user interface is very intuitive.

B.5.2 Local Kernel

Theprocfilesystem includes a file namedkcorethat contains an image of the current state of the kernel

in ELF core format (see Appendix E). BecauseGDBcore files can be read and processed, they can be

used in conjunction with a kernel and its debug symbols to visualize data structures and read their

internal state. (GDB core files are typically used for postmortem analyses of userspace programs to find

out why they have crashed.)

DDDmust be invoked with the name of the kernel image (including the debug symbols) and of thekcore

file as parameters:

wolfgang@meitner>ddd /home/wolfgang/linux-2.6.24/vmlinux /proc/kcore

This must be done as root user or the access permission to/proc/kcoremust be changed to allow the

file to be read by the specific user. (There is a security risk if the access rights to/proc/kcoreare not

sufficiently restrictive because it enables the user to modify the kernel memory.)

Even though, for obvious reasons, no breakpoints orsimilar items can be set for the running kernel, the

DDDis ideally suited to examine the data structures of the system, as Figure B-8 shows.

The starting points for such an examination are instances of data structures that are defined as global

variables of the kernel. Enteringgraph display proc_rootinstructsDDDto display the instance of type

proc_dir_entrydeclared infs/proc_root.c. The other instances associated with the data structure by

means of pointers are opened by double-clicking.