Jiri Wiesner Writing debugging modules
Channel: SUSE Labs
Date: 02/08/2023

There are situations where writing a debugging module may be the fastest and most reliable approach to getting debugging data from the
Linux kernel. It may happen that the system of interest cannot be rebooted because the issue being debugged would disappear. It may
also happen that a kernel core dump cannot be obtained. Sometimes, getting a kernel core dump does not make much sense because the
entities causing an issue may be long gone when a core dump is triggered. If the information provided by log, sysfs and proc files is not
sufficient, a tracing approach needs to be applied. There are various tools and frameworks available: ftrace, perf, BPF (bcc-tools,
bpftrace), SystemTap. If the lowest overhead is required, such as for debugging issues where tracing may change the outcome, writing a
debugging module is the best choice. With a debugging module, it is possible to attach handlers to Linux kernel tracepoints and create
kprobes and kretprobes. What the handler functions execute is up to the programmer and so is the synchronization of accesses to shared
data (if any are used). Proficiency is the main limiting factor of this approach. This talk will present the basics of writing a Linux kernel
module and using the kernel APIs for registering handlers for tracepoints and creating kprobes and kretprobes.