chenhengqi

make menuconfig

Build initramfs

$ cp /etc/mkinitcpio.d/linux.preset /etc/mkinitcpio.d/${feature}.preset
# update ${feature}.preset
# set ALL_kver field to kernel version
# set default_image field to /path/to/${feature}.img

chenhengqi

Howto

setup

$ sudo fallocate -l 2G /swapfile
$ sudo chmod 600 /swapfile
$ sudo mkswap /swapfile
$ sudo swapon /swapfile

chenhengqi

Server side

install NFS server, prepare share directory:

$ sudo apt install nfs-kernel-server
$ sudo mkdir -p /tmp/mynfsdir
$ sudo chown nobody:nogroup /tmp/mynfsdir

edit /etc/exports, add the following line:

chenhengqi

Build a XFS image

$ dd if=/dev/zero of=myxfs.img bs=4k count=131072
$ mkfs.xfs myxfs.img

Setup loop device

chenhengqi

Syscall

Calling Convention

System call number and return value

Arch/ABI    Instruction           System  Ret  Ret  Error    Notes
                                    call #  val  val2
───────────────────────────────────────────────────────────────────

chenhengqi

Initialization

$ sudo apt update
$ sudo apt upgrade
$ sudo passwd

Shell

chenhengqi

Scripts

$ echo global > /sys/kernel/debug/tracing/trace_clock
$ echo 'p:kprobes/tcp_reset tcp_reset port=+12(%di):u16 dst=+0(%di):u32 state=+18(%di):u8' >> /sys/kernel/debug/tracing/kprobe_events
$ echo 1 > /sys/kernel/debug/tracing/events/kprobes/tcp_reset/enable
$ echo 'p:kprobes/tcp_retransmit tcp_retransmit_skb port=+12(%di):u16 dst=+0(%di):u32 state=+18(%di):u8' >> /sys/kernel/debug/tracing/kprobe_events
$ echo 1 > /sys/kernel/debug/tracing/events/kprobes/tcp_retransmit/enable

chenhengqi

bpf_helpers.h

bpf_trace_printk is defined in bpf_helpers.h which is not distributed with linux kernel. When compile BPF programs, you may occur following warning:

foo.c:4:5: warning: implicit declaration of function 'bpf_trace_printk' is invalid in C99 [-Wimplicit-function-declaration]
    bpf_trace_printk(msg, sizeof(msg));
    ^
1 warning generated.

chenhengqi

How

$ apt-get source linux

References

• https://askubuntu.com/questions/159833/how-do-i-get-the-kernel-source-code

chenhengqi

Usage

$ strace -p ${PID} -T -ttt -f 2> >(grep -v epoll_wait)

The above command is the same as:

$ strace -p ${PID} -T -ttt -f 2> /tmp/stderr.out