Stepping through Linux kernel source code? Stepping through Linux kernel source code? unix unix

Stepping through Linux kernel source code?


You can build the kernel in the "User Mode Linux" architecture, and run it as a normal process within another (Linux) OS. (Hint: RTFM, "make ARCH=um" )

Then you can run it under the debugger, set breakpoints anywhere or anything, it is just as a normal userspace task.


http://www.amazon.com/Professional-Linux-Kernel-Architecture-Programmer/dp/0470343435/ref=sr_1_1?ie=UTF8&qid=1358373427&sr=8-1&keywords=professional+linux+kernel+architecture

I recommend this book over any other. This will explain pretty much how everything works and is still quite accurate.

The concepts are really what's important and this book will point you to the key functions inside the kernel so that you can get the details yourself. Simple things to read are some system calls, or just open up some core files and read through the functions and try and figure out what they do or just manually trace stuff.

If you want to single step a kernel you can use a virtualization software like QEMU and load up the kernel inside under debugging mode (QEMU has remote GDB support) and you can load the symbol table for the kernel kernel.syms (IIRC) into GDB and you can see exactly what is executing. This can be very slow though for the kernel running inside and is really only useful for debugging a development kernel but if you're willing to accept the slowdown then go for it.

As mentioned the best is to read the source, at least that's how I learned. Find the key functions for whatever functionality you want to see and it's not hard to step through the code and just see what happens (use something like TAGS or CSCOPE to make this easier).