Free kernel mode debuggers software for linux

Kernel Mode Linux project is a technology which enables us to execute user programs in kernel mode. In Kernel Mode Linux, user programs can be executed as user processes that have the privilege level of kernel mode.
The benefit of executing user programs in kernel mode is that the user programs can access a kernel address space directly. So, for example, user programs can invoke system calls very fast because it is unnecessary to switch between a kernel mode and a user mode by using costly software interruptions or context switches.
Unlike kernel modules, user programs are executed as ordinary processes (except for their privilege level), so scheduling and paging are performed as usual.
Although it seems dangerous to let user programs access a kernel directly, safety of the kernel can be ensured, for example, by static type checking, software fault isolation, and so forth.
For proof of concept, we are developing a system which is based on the combination of Kernel Mode Linux and Typed Assembly Language, TAL. (TAL can ensure safety of programs through its type checking and the type checking can be done at machine binary level.
Version restrictions:
- User processes executed in kernel mode should obey the following limitations. Otherwise, your system will be in an undefined state. In the worst-case scenario, your system will crash.
- On IA-32, programs executed in kernel mode shouldnt modify their CS, DS, FS and SS registers.
- On AMD64, programs executed in kernel mode shouldnt modify their CS register.
- In addition, on AMD64, IA-32 binaries cannot be executed in kernel mode.
Enhancements:
- This release has been merged with the 2.6.19 Linux kernel.

EDB (Evans Debugger) is a QT4 based binary mode debugger with the goal of having usability on par with OllyDbg.

EDB project uses a plugin architecture, so adding new features can be done with ease. The current release is for Linux, but future releases will target more platforms.

Packet Debugger presents a debugger-like UI for pcap packet capture files.

The Packet Debugger (pdb) allows users to work with packet streams as if they were working with a source code debugger.

Users can list, inspect, modify, and retransmit any packet from captured files, as well as work with live packet captures.

Kernel Mode Linux project is a technology which enables us to execute user programs in kernel mode. In Kernel Mode Linux, user programs can be executed as user processes that have the privilege level of kernel mode.
The benefit of executing user programs in kernel mode is that the user programs can access a kernel address space directly. So, for example, user programs can invoke system calls very fast because it is unnecessary to switch between a kernel mode and a user mode by using costly software interruptions or context switches. Unlike kernel modules, user programs are executed as ordinary processes (except for their privilege level), so scheduling and paging are performed as usual.
Although it seems dangerous to let user programs access a kernel directly, safety of the kernel can be ensured, for example, by static type checking, software fault isolation, and so forth. For proof of concept, we are developing a system which is based on the combination of Kernel Mode Linux and Typed Assembly Language, TAL.
Version restrictions:
- On IA-32, programs executed in kernel mode shouldnt modify their CS, DS, FS and SS registers.
- On AMD64, programs executed in kernel mode shouldnt modify their CS register.
Enhancements:
- This version was merged with the 2.4.35.1 Linux kernel.

gnome-kernel-manager is a tool for managing kernel modules and more.
gnome-kernel-manager is a gui for managing the kernel modules, .... Only Linux kernel is supported.
Main features:
- Shows the list of loaded modules.
- Shows the list of all installed modules.
- Shows information about modules.
- Supports (un)loading modules.

The Linux SMP kernel uses spinlocks to protect data structures from concurrent, potentially conflicting accesses. Linux Kernel Spinlock Metering is a kernel patch that allows you to build an i386, ia64, Alpha, Sparc64, or mips64 kernel that can perform simple "metering" (record-keeping) of spinlock usage. Also available is source for an associated new command, lockstat, that is used to instruct the kernel to turn this lock metering on or off, and to retrieve the metering data from the kernel and display it in a human-readable format.

Data displayed includes the number of lock attempts, per-spinlock per-caller, the number of those attempts that were immediately successful vs. those that required the attempting locker to wait for the current lock-holder to release; the mean and max hold-time, and the mean, max, and cumulative wait-time. Whenever possible, the locking caller and the spinlocks are identified by their symbolic names, not by their virtual addresses.

Various patch sets are available. Version 1.1.4 patches the 2.2.14 kernel and reflects a relatively old flavor of Lockmeter. Version 1.4.11 patches the 2.4.16, 2.4.17, 2.5.3, and 2.5.5 kernels, and the previous release v1.4.9 patches various other releases of the 2.4.x kernel. This version 1.4 supports i386, alpha, ia64, mips64, and sparc64. The most recent version 1.5 is available as a patch against the 2.4.18 and various 2.5.x kernels, and it additionally supports mips (32-bit mips). Each is approximately 22 KB in gziped size. (Patches against a few older kernel versions are also available in the old subdirectory.) After applying the appropriate patch, make oldconfig presents a new Kernel lock metering option in the Kernel hacking subsection -- although only if CONFIG_SMP (Symmetric multi-processing support) has been enabled. The spinlock metering code is compiled into the kernel only when this new option is turned on.

Compiling the spinlock metering code into the kernel does not materially affect the kernel size because the additional code is roughly compensated for by the shrinking effect of the normally in-line locking routines now becoming procedure calls. A metering-capable kernel (i.e., with the patch applied, but data collection turned off) is negligibly slower than a non-metering-capable kernel, though a metering-capable kernel does slow when the metering data collection is turned on using the lockstat command (typically 8% for a systime==25% workload). Care has been taken to minimize performance degradation, and further improvements are in progress.

The lockstat command must also be downloaded, compiled, and installed. lockstat is a privileged command that requires root access. It reads and writes to the node /proc/lockmeter to control the kernels metering as follows:

lockstat on enables the kernels metering data collection,
lockstat options displays the collected data, and
lockstat off disables the metering data collection.

Run lockstat with no arguments to see a verbose description of the command arguments and options.

When metering is enabled, count and time data is collected in malloced arrays that are private to each CPU, thereby avoiding costly cacheblock coherency operations that would otherwise be required if all CPUs updated the same count and time fields. The lockstat command accumulates and sorts the per-cpu data at display time.

Lockmetering attempts to provide both "cause" and "effect" information about spinlock usage. The "hold time" metering exposes which spinlocks are being held and for how long, identified by where they are held inside the kernel. The "wait-time" metering exposes the effects of these hold-times when multiple CPUs concurrently contend for the same lock.

Kernel Configuration Comparison (kccmp) provides a GUI for comparing two Linux kernel ".config" files.
It shows configuration variables with different values in a tabular format. It also shows configuration variables found in only one of the input configuration files.
Building:
kccmp by default requires Qt 3.x. However, by changing one line in kccmp.pro you can build against Qt 4.x. Note that the Qt 4.x build requilres libboost_regex as well.
The standard build is as easy as:
example:
% qmake
% make
Usage
% kccmp /path/to/first/.config path/to/second/.config
example:
% kccmp /usr/src/linux/.config /usr/src/linux/.config.old
Enhancements:
- This release was ported to Qt 3.x.
- The requirement for libboost_regex was removed.
- Building with either Qt 4.x or Qt 3.x is now supported.

KernelKit is a Knoppix GNU/Linux derivative targetting the development of Linux kernel and drivers, as well as Free Sofware embedded systems. It is currently being used in our Embedded Linux Training sessions.
Differences with standard Knoppix GNU/Linux:
- Removed applications not related to Linux kernel, drivers and embedded systems: games, office applications...
- Added tools and libraries for kernel and software development, in particular cross-compiling toolchains for many different architectures
Usefulness
- Embedded Linux trainings: provide all the needed tools in a tested configuration. No need to install a GNU/Linux distribution. No need to check installed package versions prerequisites.
- Embedded Linux demonstration: helps to discover, try and demonstrate useful tools in this technical area.
- Kernel, driver and embedded application development: toolkit to get the job done quickly and efficiently. Useful for support people away from their regular desktop, or for people who are not allowed to install software by themselves.
Cross-compiling toolchains
- uClibc toolchains: cross-compiling toolchains for the following architectures: arm, i386, ppc, m68k, mips, mipsel
Development
- ccache: a C/C++ compiler cache. Can save a lot of time when you compile the kernel over and over again.
- doxygen: a documentation system.
- SCons: a Software construction tool. A strong alternative to autoconf / automake / make.
- Splint: static C code checker.
Cross-compiling toolchains
- uClibc toolchains: cross-compiling toolchains for the following architectures: arm, i386, ppc, m68k, mips, mipsel
Kernel development
- git: the new kernel source management system.
- cogito: a git front-end.
Emulation
- QEMU: a cpu and system emulator for several platforms. Great to experiment with i386 or ppc embedded systems.
- SkyEye. An emulator for several popular ARM boards.
Performance analysis
- Linux Trace Toolkit": user space tools for analyzing system performance. Note that you can only analyse results so far, and not produce data, as the current KernelKit kernel doesnt have support yet for LTT.
- Valgrind: memory debugger and performance analysis tool for x86 Linux.
Lightweight applications for embedded systems
- Dillo: a very light and fast web browser.
- e3: a microscopic editor supporting several interface types (vi, emacs...).
Unix learning help
- fish: the Friendly Interactive SHell makes it much easier to use the Unix command line. The best way to start for beginners (Caution:: strangely broken in the latest KernelKit release)
- vimtutor: part of the vim package. Very nice way to learn vi in 30 minutes!
Misc
- gkermit: a serial communication utility.
- Psyco: a kind of Just In Time compiler for Python. Useful for running the BitBake / OpenEmbedded tool faster.
- xvncviewer: a VNC client. Sometimes useful to display target graphics on the host system.
Enhancements:
- This release adds the texinfo 4.8.dfsg.1-4 package (needed to run buildroot).