标签：#linux

You don't need a cloud server to start learning Linux administration. A few days ago, I came across a LinkedIn post by Luiz Fernando dos Santos about turning an old Android phone into a Linux server using Termux. Reading his post made me wonder: Do I really need to pay for a VPS just to learn Linux and server administration? The answer, at least for now, seems to be no. Inspired by his idea, I decided to build my own learning environment using nothing but an Android phone and Termux. This article is the beginning of a series where I'll document everything I learn along the way. Inspiration Before getting started, I'd like to give credit to Luiz Fernando dos Santos, whose LinkedIn post inspired this project. His idea of using an old Android phone as a Linux server showed me that I didn't need to rent a VPS to start learning Linux administration. You can check out his original post here: 🔗 https://www.linkedin.com/pulse/transformando-um-android-antigo-em-servidor-luiz-fernando-dos-santos-gu1if/ First Steps I had already been using Termux for quite some time, so the first thing I did was update all the installed packages. apt update apt upgrade -y After that, I installed OpenSSH. pkg install openssh Before moving on, I wanted to understand what SSH actually is instead of just following commands from a tutorial. SSH (Secure Shell) is a protocol that allows you to securely connect to another computer or server through an encrypted connection. It's one of the most common ways to remotely access Linux servers. After installing it, I found the Termux username, configured a password and started the SSH server. Then I tried connecting from my computer... And it worked! It may sound like a simple thing, but seeing my computer remotely access the Linux environment running on my phone was surprisingly satisfying. Improving the Authentication After getting the basic connection working, I started researching how authentication by SSH keys works. I learned that instead of typing a

Un análisis técnico basado en BorgBackup para entornos Debian/Ubuntu Autor: Arcadio Ortega Reinoso Versión del sistema: 2.1.0 Fecha: Julio 2026 Plataforma objetivo: Debian 11+ / Ubuntu 22.04+ (x86_64) Puedes encontrarlo en: BorgShield Fortalezas Diferenciales Valor Diferencial Claro: La inclusión de 23 tipos de metadatos (repositorios git, dconf, claves GPG, snaps, flatpaks, etc.) resuelve el problema de tener los archivos pero no saber cómo reconstruir el entorno. No es solo "tus datos están a salvo", es "sabemos exactamente qué tenías y cómo volver a dejarlo igual". Restauración Semántica: test-restore va más allá de borg check . Mientras que otras herramientas solo verifican checksums (integridad técnica), nosotros verificamos si los datos son realmente legibles y útiles (integridad semántica): ¿el SQL de las BBDD se puede leer? ¿los paquetes están en formato válido? ¿las rutas esenciales existen? ¿los gzips no están corruptos? Asistente Guiado: restore-full y restore-dry-run forman un sistema de dos velocidades: simular antes de ejecutar, y guiar paso a paso durante la ejecución real. Esto reduce significativamente el "pánico" durante un desastre real, guiando incluso en la reinstalación de paquetes y fuentes APT. Resumen Este documento presenta el diseño, la implementación y la evaluación de backup.sh , un sistema de backup para Linux orientado a disco externo local. El sistema se basa en BorgBackup como motor de almacenamiento deduplicado, cifrado y comprimido. Se analizan las alternativas existentes (rsync, rsnapshot, restic), se justifican las decisiones de diseño y se presentan proyecciones de rendimiento basadas en métricas obtenidas de un sistema real con ~360 GB de datos, ~3200 paquetes instalados y ~460 paquetes instalados manualmente. Los resultados muestran que BorgBackup reduce el espacio de almacenamiento del backup completo a ~160 GB (55% de compresión con deduplicación), los backups incrementales se completan en 3-8 minutos, y el sistema permite r

Data preservation layouts are no longer just an exercise in handling routine disk failures; they are a direct line of defense in an active cyber-warfare environment. Far too many system administrators blindly default to writing simple, unencrypted shell scripts tied to legacy system utilities. Operating obsolete data-mirroring procedures introduces severe vulnerabilities to enterprise architectures. Traditional file sync tools completely lack client-side encryption barriers, leaving raw production data completely exposed to third-party infrastructure hosts. Furthermore, standard backup approaches consume vast amounts of unnecessary bandwidth by redundantly transferring identical files over and over again. Restic completely destroys this insecure paradigm. Written from the ground up in Go, Restic enforces client-side AES-256-CTR cryptographic encryption by default, ensuring no plain-text data ever traverses the network interface. Leveraging advanced content-defined chunking algorithms, it performs lightning-fast block-level deduplication to compress your overall storage footprint to a minimum. Phase 1: The Backup Orchestration Myth Understanding the architectural superiority of a native Go-compiled, client-side encrypted backup engine is critical before designing your disaster recovery pipeline: Architectural Metric Legacy Sync Tools BorgBackup Platform Modern Restic Engine Native Cloud S3 Support Requires Rclone Mounts Requires Third-Party Proxy Layers Native Compiled Support Default Cryptography None (Plain-Text Transmissions) Client-Side AES-256 AES-256-CTR Client-Side Data Deduplication File-Level Verification Only Content-Defined Block Level Content-Defined Block Level Cross-Platform Portability Variable Compatibility Strictly UNIX/Linux Constrained Single Static Go Binary Phase 2: The Append-Only Lock Paradox (IAM Fix) The most dangerous operational vulnerability found in generic Linux documentation involves key privileges. Amateurs store fully unconstrained ad

Ethereal Bytecode for the Network: Unlocking XDP's Magic! Hey there, fellow tech enthusiasts! Ever felt like the traditional networking stack in your Linux kernel was a bit… sluggish? Like it was taking the scenic route when you needed it to be a supersonic jet? Well, let me introduce you to a superhero that swoops in and turbocharges your network packet processing: eBPF, specifically in the context of XDP (eXpress Data Path). Forget the days of wrestling with complex kernel modules or praying for better hardware offload. eBPF and XDP offer a revolutionary, in-kernel, safe, and incredibly efficient way to program packet processing at the very edge of your network interface. Think of it as giving your network card a tiny, super-smart brain, capable of making lightning-fast decisions before the packet even bothers the main kernel stack. Pretty cool, right? So, buckle up as we dive deep into the wonderful world of XDP and eBPF, demystifying its power and showing you why it's becoming the darling of modern networking. 1. The "What's the Big Deal?" Section: Introduction to XDP & eBPF Imagine a bustling highway (your network). Traditional networking is like having every car stop at a toll booth, get inspected, and then directed by a central traffic controller. This works, but it can get congested. XDP, on the other hand, is like having intelligent on-ramps where some cars can be instantly identified, rerouted, or even rejected before they even hit the main highway. eBPF (extended Berkeley Packet Filter) is the technology that makes this possible. It's a powerful, sandboxed virtual machine that runs within the Linux kernel. Unlike traditional kernel modules, which can potentially crash your entire system if written incorrectly, eBPF programs are rigorously verified by the kernel for safety and correctness before they are allowed to execute. This means you get the power of kernel-level access without the existential dread of a kernel panic. XDP (eXpress Data Path) leverages

The wrong way to install Docker on Ubuntu is the one that looks easiest: sudo apt install docker.io . That package exists, it installs, and it runs a container. It is also whatever version happened to be frozen into the archive when 26.04 was cut, it lags the real releases by months, and it ships without the Compose and Buildx plugins you will want by the end of the week. Use Docker's own apt repository instead, and this is the post I keep open so I do not re-derive the repo setup from memory each time. This is short on purpose. The steps are the official ones, and the only place worth slowing down is step 5, where adding yourself to the docker group quietly hands out root. That tradeoff is the part most guides skip, and it is the one thing here actually worth reading twice. TL;DR Remove any distro docker.io / containerd packages, add Docker's GPG key and the deb822 .sources repo, then sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin . Verify with sudo docker run hello-world . Add yourself to the docker group to drop the sudo (it is root-equivalent, more below). Prerequisites Ubuntu 26.04 (Resolute Raccoon), server or desktop, on amd64 or arm64 . A user with sudo. If you are still on root, create a sudo user first . Outbound HTTPS to download.docker.com . 1. Remove the distro Docker packages first Ubuntu ships its own docker.io , docker-compose , and containerd packages, and any of them will fight the official ones over the same files and the same containerd socket. Clear them out before you add Docker's repo. This is safe on a fresh box because there is nothing to lose yet; on a box that already ran the distro Docker, it removes the packages but leaves your images and volumes in /var/lib/docker alone. sudo apt remove $( dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc podman-docker containerd runc | cut -f1 ) The dpkg --get-selections wrapper is just so the command does not error out on pac

I’m 14 and I got tired of spending hours (sometimes days) setting up new machines. Different distros, different package managers, fragile shell scripts, no rollback. So I built Nexus — a cross-platform environment provisioning engine. One command turns a fresh OS into a fully productive development machine. The Problem Setting up a dev machine is painful: Hundreds of Linux distros with different package managers (apt, pacman, dnf, apk). Shell scripts break easily with no rollback or state management. Tools like Ansible are overkill for laptops. Docker doesn’t configure your host. Dotfile managers don’t install dependencies. Result: Developers lose dozens of hours per year on setup issues. What Nexus Does One static Go binary. Detects your OS, chooses the right package manager, applies declarative YAML profiles, and handles everything with security gates and rollback. No scripts. No manual steps. Works on Linux and Windows (with WSL2 support). Standout Features Cross-distro support — apt, pacman, dnf, apk behind one interface. 7-step orchestrator with rollback — PreFlight → Refresh → Execute → Verify → Audit. Failed foundation packages trigger full rollback. Security gate (SanitizeAndExecute) — Allowlist, metacharacter rejection, timeouts. No raw shell execution. 10 built-in profiles — Go dev, Rust dev, Frontend, Data Science, Ethical Hacking, etc. WSL2 setup in ~60 seconds on Windows. Dotfiles + age-encrypted vault + Distrobox containers . Community profile registry . Optional Tauri GUI dashboard. Architecture Nexus is organized in bounded contexts: BRAIN — Cobra CLI + core engine (Go) DNA — YAML profiles with JSON Schema + struct validation + SHA256 integrity BRIDGE — WSL2 handling (cross-compiled) CONTAINER — Distrobox management VAULT — age encryption REGISTRY — Community profiles Every command goes through a strict security gate. State is crash-safe with atomic writes and append-only logs. Quick Start # Install go install github.com/Sumama-Jameel/nexus-engine/cm

Some commands you can walk back. Terminating an EC2 instance is not one of them. Day 14 paired a recoverable problem, a web server knocked over by a rogue process, with an unrecoverable one, deleting a server on purpose, and the contrast is the whole lesson. One Linux task, one AWS task. Track down the process blocking Apache and restore the service, then terminate an EC2 instance and confirm it is gone. The tasks come from the KodeKloud Engineer platform. httpd: diagnose in order, then restore When httpd will not start, resist the urge to guess. Work in order. Start with what the service itself reports: # What does httpd think is wrong systemctl status httpd systemctl start httpd The status output usually names the problem, and a failed bind on the port is the classic one. Before assuming a rogue process, check that httpd's own config is sane, because a wrong port or hostname produces the same "won't start" symptom: # Check the configured listen port and server name grep -i listen /etc/httpd/conf/httpd.conf vi /etc/httpd/conf/httpd.conf # Fix the ServerName directive if it is wrong: ServerName hostname:<port> If the config is fine and the port is genuinely taken, then you go hunting for the process holding it: # Find the PID on the conflicting port sudo su - yum install -y net-tools netstat -tulpn # Clear it, then bring httpd back kill -9 <PID> systemctl enable httpd systemctl start httpd systemctl status httpd kill -9 is SIGKILL, the instant, no-cleanup kill. It is the right tool when a process is wedged and ignoring a polite request, but as a default habit, it is worth trying a plain kill first. The order that matters here is diagnostic: config before process, gentle signal before forceful one. Rushing to kill -9 at the first sign of trouble is how you mask the real cause instead of fixing it. Terminating EC2: the command with no undo Day 9 was about protecting an instance from termination. Day 14 is the other side of that lever, actually terminating one, on purp

Introduction Linux is the backbone of modern infrastructure. From cloud servers and firewalls to SIEM platforms and security tools, Linux runs silently behind most enterprise environments. For a Security Operations Center (SOC) analyst, understanding Linux is not optional — it is a core skill. One of the most critical security mechanisms in Linux is its file permission and ownership model. Attackers abuse permissions to execute malware, hide persistence, escalate privileges, and erase evidence. SOC analysts rely on permission analysis to detect anomalies, investigate incidents, and build accurate timelines. Become a Medium member This article covers Linux File Permissions and Ownership in deep detail from a SOC analyst’s perspective. It is designed to take you from absolute beginner to security-aware professional, with real-world examples, attack scenarios, and investigation insights. Why Linux File Permissions Matter in SOC In SOC operations, analysts constantly deal with: Authentication logs System logs Application logs Scripts and binaries Configuration files Evidence files during incident response Every one of these objects is protected by Linux permissions. From a SOC perspective: Incorrect permissions = security risk Permission changes = potential indicator of compromise Executable permissions = possible malware Ownership changes = possible log tampering Understanding permissions allows SOC analysts to: Detect unauthorized access Identify privilege escalation Spot malware execution Preserve forensic evidence Reconstruct attacker activity Understanding Linux File Permission Basics Linux follows a Discretionary Access Control (DAC) model. This means: The owner of a file controls who can access it Permissions define what actions are allowed Every file and directory in Linux has: A type Permissions An owner (user) A group These attributes decide: Who can read the file Who can modify it Who can execute it Viewing Permissions Using ls -l The most common command to i

By default, whenever you request a machine learning model, the underlying architecture saves gigabytes of tensor data into a hidden directory located directly inside your home folder ( ~/.cache/huggingface ). Because standard bare metal and virtual cloud configurations typically isolate the root operating system on a smaller, highly optimized boot drive, pouring 140GB+ of raw weights into the home folder guarantees absolute storage exhaustion. Here is the engineering blueprint to fix it cleanly on Linux. The Cache Location Trajectory When attempting to solve this problem, avoid outdated tutorials recommending deprecated parameters like TRANSFORMERS_CACHE . Environment Route Support Status Architecture Impact HF_HOME Active Master Route Safely redirects all models, datasets, and core assets globally. TRANSFORMERS_CACHE Deprecated Warning Fails to capture datasets and will be removed in version 5.0. HUGGINGFACE_HUB_CACHE Deprecated Warning Legacy routing path that creates unnecessary diagnostic warnings. 🛑 The Symlink Security Risk Creating symbolic links (symlinks) to trick the OS into routing files elsewhere is a common anti-pattern. Mapping these links improperly or running your workflow with elevated rights introduces privilege escalation vulnerabilities, compromising container and host security. Step 1: The Permanent Environment Override To change your Hugging Face cache directory on Linux permanently, target an expansive secondary storage array instead by appending a direct master route into your user profile configuration: # Create a dedicated folder inside your secondary storage array sudo mkdir -p /mnt/massive_drive/ai_model_cache sudo chown -R $USER : $USER /mnt/massive_drive/ai_model_cache # Append the master environment variable to your bash profile echo 'export HF_HOME="/mnt/massive_drive/ai_model_cache"' >> ~/.bashrc source ~/.bashrc Step 2: The Python Import Order Mandate If you declare your custom storage location programmatically inside an application

I have been working on building a private, secure network accessible from anywhere. The goal was to connect my mobile phone and my local development laptop using a WireGuard VPN , hosting the central gateway on a free-tier Google Cloud Platform (GCP) e2-micro instance. I wanted to access my self-hosted services, specifically my Docker-hosted Open WebUI , running on my local home Wi-Fi connected laptop, directly from my phone using mobile data. It sounded straightforward. But if you read my other from scratch journeys, you might have already guessed, it was not. The Setup My architectural plan was a simple hub-and-spoke topology: The Hub: GCP VM ( 10.66.66.1 ) with IPv4 forwarding enabled. Spoke 1 (My Phone): 10.66.66.2 Spoke 2 (My Laptop): 10.66.66.3 I wrote my server configurations, enabled IP forwarding ( net.ipv4.ip_forward=1 ), wrote the iptables rules to allow forwarding between peers, and started the interfaces. Then came the moment of truth. I tried to bring up the tunnel. Absolute silence. No packet moving from anywhere. Hurdle 1: The Classic Cloud NAT Trap (Internal vs. Public IP) Before I could even worry about routing packets between my phone and laptop, I couldn't even get them to handshake with the GCP server. Like many of us do when working inside a VM, I had run ip addr on the GCP instance to grab its IP address for my client configurations. I set up the WireGuard peers to point to this IP. Nothing connected. The Culprit: GCP (and AWS) operates on a 1:1 NAT mapping. The virtual network interface inside your VM only sees and binds to a private, internal cloud IP (e.g., 10.128.0.x ). The public IP assigned to your instance lives outside the VM at the VPC gateway level. By putting the internal IP into my client configs, my phone and laptop were trying to connect to a private address that didn't exist on their local networks. The Fix: I had to swap the internal IP in the client configurations with the GCP Ephemeral/Static External IP . Once the handshake

Creator says he will "very loudly ignore" those arguing for a ban on AI tools.

If you have ever built an autonomous mobile robot, you have likely run into the dreaded "Shuffled USB Port" problem. You boot up your robot, fire up your ROS 2 launch files, and... crash. Your LiDAR driver is trying to parse data from your IMU, and your IMU node is screaming about invalid serial frames. Because Linux assigns virtual serial paths like /dev/ttyUSB0 and /dev/ttyUSB1 based purely on which device initialized milliseconds faster, relying on default OS paths is a recipe for system instability. When you are scaling up to dozens of Jetson Orin nodes —each equipped with an RPLIDAR C1 and a Yahboom 10-axis IMU —manually hardcoding paths or writing rigid scripts on every individual machine isn't viable. Here is how production-grade robotics fleets handle plug-and-play USB binding dynamically using configuration-driven udev rules. The Core Concept: Vendor ID vs. Physical Port vs. Serials Linux's udev (device manager) allows us to dynamically create stable symbolic links (symlinks) like /dev/rplidar and /dev/imu when hardware is plugged in. How we identify those devices determines our fleet's flexibility: USB Serials: Unique to each individual chip. Highly secure, but requires registering every single replacement sensor in your codebase. Physical USB Ports ( KERNELS ): Tied to a physical slot on the carrier board. Great if you have identical sensors, but forces technicians to plug cables into highly specific, undocumented ports. Vendor ID (VID) & Product ID (PID): Identifies the USB-to-serial converter chip on the sensor board. Because the RPLIDAR C1 uses a Silicon Labs CP210x chip ( 10c4:ea60 ) and the Yahboom IMU uses a QinHeng CH340 chip ( 1a86:7523 ), they use completely distinct silicon. This means we can map them dynamically and reliably using just their VID/PID —allowing field technicians to plug them into any USB port on the Jetson without breaking the system. Step 1: The Configuration-Driven File ( devices.conf ) Hardcoding vendor rules inside shell scri

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Downloading an installer and immediately executing it as root collapses three operational decisions into one command: Which artifact? -> Did these bytes arrive intact? -> Should this host execute them? Separate those decisions and the install becomes reviewable, reproducible, and recoverable. A concrete source-review boundary At commit c58bcd4 , the MonkeyCode runner installation template selects x86_64 or aarch64 , checks AVX on x86, requires root, and downloads an architecture-specific installer before executing it. The reviewed template uses curl -4sSLk , so certificate verification is disabled by -k . It also downloads an unversioned path. I could not find a pinned version, digest, or signature check in that template. That is a statement about controls visible in one pinned file—not a claim that the release service is compromised or that no external release control exists. Put a manifest before execution For each release artifact, publish immutable metadata through a separately protected release process: { "version" : "1.2.3" , "architecture" : "x86_64" , "file" : "runner-installer-1.2.3-x86_64" , "sha256" : "<64 lowercase hex characters>" , "size" : 18439210 , "rollback" : { "previous_version" : "1.2.2" , "artifact" : "runner-installer-1.2.2-x86_64" } } SHA-256 detects bytes that differ from the manifest. It does not prove who authored the manifest. Serve the manifest over validated TLS, pin it through deployment configuration, or sign it and verify the signature with a trusted offline public key. Verify as an unprivileged staging step The companion verify-installer.mjs checks filename, exact size, digest, version, architecture, and rollback metadata: node verify-installer.mjs release-manifest.json fixture-installer.sh node test-verifier.mjs Expected output uses the fixture's actual digest: PASS 1.2.3-fixture sha256=<digest> PASS verified fixture; rejected tampered artifact before execution The negative test appends a line to the artifact and requires both size

Native XDP and generic SKB-mode XDP are not the same thing in practice. The same BPF program can pass the verifier and still behave differently depending on which mode the kernel uses, this could be a different verdict, different frame bytes, or different metadata. This post ships three things: an open differential test harness, a fixed eleven-packet corpus, and a simple way to classify the differences it finds. A tagged release lets anyone reproduce the virtio/veth baseline on Linux 6.8. The operational risk is straightforward. A firewall or rate-limiter validated only under native XDP can fall back to generic mode on an unsupported driver, a veth port, or after a reload. You keep the same bytecode, but behaviour can change, often without a clear error line. What this release includes: A harness loop: corpus → inject on the RX path → native vs generic sweep → xdpdump capture → compare.py manifest, comparing both the captured frame bytes and the XDP verdict ( PASS / DROP / TX / REDIRECT ). A deterministic corpus with eleven embedded test IDs ( 0xA001 – 0xA005 , 0xA007 – 0xA00C ; 0xA006 is intentionally omitted as a reserved gap in the generator). An operational divergence taxonomy (Class A / B / C). A virtio/veth smoke gate on Linux 6.8; now gating on frame bytes and verdict agreement that shows the full path is reproducible end to end. Scope for this post: native vs generic XDP on the virtio_vm profile only (five BPF programs, pinned manifests). This is part 1 of 2; it establishes the harness and an instrument-validity baseline; a follow-up post covers bare-metal divergence results. Physical NIC results are not part of this baseline. Ordinary conformance checks stop at “did the program load?” Differential testing asks a sharper question: given identical input packets, do the backends produce the same observable outcome at the hook? Background: native vs generic XDP Both modes load the same BPF object. They diverge at the hook point and in how the packet is represen

Developers flagged a freshly filed, reproducible issue that should make anyone running background agents pause: Claude Code's background Opus subagents intermittently stall on their first turn and, instead of producing useful work, emit system-prompt fragments — including text shaped like authorization data — as their only output. It's labeled a security issue, it has a reproduction, and it's open. That's enough to treat it as a real, if intermittent, class of failure. Here's the mental model that matters: a subagent is not a trusted subprocess. It's an autonomous loop with access to a context window, a toolset, and — too often — the same credentials as its parent. When that loop stalls and dumps its prompt instead of its result, anything that was in context is now in output. Authorization-shaped text leaking is the canary: if the prompt carried a token, a session string, or an internal endpoint, that's what surfaces. The fix is structural, not reactive. Three rules: 1. Scope credentials per subagent, not per session. A background agent that only needs to read a repo shouldn't hold deploy keys. Hand it the narrowest token that completes its task and revoke it when the task ends. If the tooling can't scope credentials, that's a gap to close before you scale subagents. 2. Treat subagent output as untrusted. Anything a subagent returns — including error text, logs, and especially "stalled" dumps — should be parsed and sanitized before it touches shared state. Don't pipe raw subagent output into a context that feeds other agents or into any log that leaves your machine. 3. Separate the system prompt from the working context. The leak happened because authorization-shaped content sat in the same window the subagent could echo. Keep credentials and internal routing data out of the prompt that a stalled loop might surface. Put them in a side channel the model can call, not text it can print. The deeper lesson is about failure modes, not one bug. Most agent setups assume th

The feed showed a new entrant worth watching: Tencent has launched Hy3, a coding-focused AI model, with input tokens priced at $0.14 per million. For developers who live in the terminal running coding agents, that price point lands well below the per-token rates most frontier models charge, and it puts a major lab's coding model into the "cheap enough to leave running" category. What makes this interesting isn't just the number — it's the positioning. Hy3 is being pitched specifically as a coding AI, not a general chatbot, which suggests vendors are starting to carve out developer-facing models with their own pricing tiers rather than forcing coders to pay general-purpose rates. Developers spotted the launch in the daily AI news roundup and immediately started comparing it against the cost of running their existing agents. The catch, as always, is what the headline price doesn't tell you: output token cost, context-window limits, and how the model actually performs on real repository tasks all remain open questions. A low input price is meaningless if output is expensive or if the model needs five retries to get a diff right. Still, a credible cheap coding model from a major player is exactly the kind of pressure that nudges the whole category toward per-token transparency. If nothing else, it gives every other vendor a new number to justify theirs against.

Notes from bringing up a PCIe WiFi module on i.MX8MQ; symptoms and how to diagnose them. Phy link never came up — what does this mean? This message is typically seen in dmesg as shown below. [ 3.828121] imx6q-pcie 33800000.pcie: iATU: unroll T, 4 ob, 4 ib, align 64K, limit 4G [ 4.807241] imx6q-pcie 33c00000.pcie: Phy link never came up [ 4.841482] imx6q-pcie 33800000.pcie: Phy link never came up [ 5.821279] imx6q-pcie 33c00000.pcie: Phy link never came up [ 5.830481] imx6q-pcie 33c00000.pcie: PCI host bridge to bus 0001:00 [ 5.854997] imx6q-pcie 33800000.pcie: Phy link never came up [ 5.862205] imx6q-pcie 33800000.pcie: PCI host bridge to bus 0000:00 It means one of the following The PCIe peripheral is not powered up. PCIe reset is not deasserted, so the chip is in reset. This could be because the DTB is deasserting an incorrect GPIO. Reference clock is not enabled Using the incorrect PCIe controller in the device tree. As we can see that both the PCIe controllers can report this. So first determine which controller is the peripheral hooked to. More on this in the next section. Which PCIe controller is my device on? ( &pcie0 vs &pcie1 ) The rule here is to match by address and not by label/name. If the schematic calls out controllers as PCIE1 and PCIE2, and the device tree lists pcie0 and pcie1, understand the mapping. The DTS label is arbitrary - match by register base ( @address in the node name), which is the same in the DTS reg and the reference memory map. For definitive addresses look in the .dtsi , as sometimes the manuals are misleading. Given below is a mapping table for i.MX8MQ DTS. | ADDRESS (in .dtsi) | Silicon (RM) Label &pcie0 | 0x33800000 | PCIe1 &pcie1 | 0x33c00000 | PCIe2 The addresses are listed in the chip’s memory layout are from processor reference manual. Below is snapshot from the i.MX8MQ reference manual, where the layout for the core A-53 is listed. Start Address | End Address | Size | Description 3381_0000 | 3381_3FFF | 4MB | PCIe-2 << inco

I got tired of SSHing into the box every time I shipped something, just to watch the logs come up. So I wanted a page in the admin panel where the lines scroll past as they happen, no dashboard, no Grafana, just the raw tail. The surprising part was how little I had to build for it, most of the pieces were already sitting on the server waiting for me to connect them. Here's the whole idea. The app writes JSON to stdout, systemd grabs that stdout and drops every line into the journal, and journalctl can follow the journal and hand the lines back live. All three of those already exist on an Ubuntu box. So the "live log viewer" is really just me spawning journalctl on the server and piping its output to the browser over an EventSource , which is a lot less code than it sounds like. journald is boring and well understood. SSE is boring and well understood (it's been in browsers since about 2011). Nobody gets excited about either one on its own. But snap the two together and you get a real-time log tail with no agent, no log shipper, no vendor, and nothing new to keep alive. Two defaults meeting each other and pretending to be a feature. Systemd thing People have opinions about systemd. Some of them are that you should avoid every part of it that you can, run your own supervisor, ship logs somewhere with your own daemon, and treat journald as a thing to route around. That's a fine hobby if you have the time for it. I don't. The box boots, systemd starts my unit, and when the unit writes to stdout the line ends up in the journal without me configuring anything. Being a purist here costs real hours and buys me a philosophy. Being pragmatic costs nothing and buys me a log tail. So this is the pragmatic path. If you're on a distro where journald is the default (Ubuntu, Debian, Fedora, most of them now) the setup below is basically free. Getting logs into the journal Here is the part most people overcomplicate. You do not "set up journald". You do not open a socket to it or p

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. You've been using the terminal for months/ years. Maybe you cd into a folder, ls around, run your script, and call it a day. That's fine. That's like knowing how to boil water and calling yourself a chef. But the terminal has layers . It's basically an onion that occasionally makes you cry, usually around 12 AM when a script fails silently and you have no idea why. So grab your coffee and let's talk about the command line tricks that actually make your life better. Not the "did you know ls -la shows hidden files" tier tips. Your Terminal Has A Memory. Use It. Most devs mash the up arrow like it's 2007 and they're trying to beat a Flash game. Stop that. Press ctrl-r instead. It searches your command history live. Type a few letters, it finds the last matching command. Press ctrl-r again to cycle back further. Found it? Hit Enter to run it, or the right arrow to drop it into your prompt so you can edit it first. ctrl-r ( reverse-i-search ) ` docker run ` : docker run -it --rm -v $( pwd ) :/app node:20 bash Pair this with ctrl-w (delete last word) and ctrl-u (nuke the line back to the cursor) and you'll start editing commands like you're speedrunning a text adventure. And if you're the type who types a whole essay of a command and then realizes you forgot something at the start, ctrl-a jumps to the beginning of the line and ctrl-e jumps to the end. No more holding the left arrow key like it owes you money. Pro tip: if you're a TUI fan and ctrl-r's default search feels a bit flat, check out McFly xargs Is The Friend Who Actually Shows Up Pipes ( | ) are great. They pass output from one command into another. But sometimes you don't want to pass output as input , you want to pass it as arguments . That's where xargs comes in, and once you get it,