I am looking to debug a closed-source kernel module. The kernel is extremely old, v2.6.32. It was not compiled with CONFIG_KPROBES=y
, but was compiled with CONFIG_KALLSYMS
. I am looking to insert printk
statements at the entrypoint of a specific function in the kernel module. The function takes in a struct as a parameter, and I want to print out particular portions of the struct.
I have come up with the following idea:
Since I don't have a lot of experience with kernel debugging, I wanted to know if there were any easier methods of doing what I want.
The idea you came up with sounds fine. It's basically what kprobes does under the hood. You will have to be careful but it's definitely doable.
Another option would be to compile the exact same kernel (extracting the config of the one you have, which I assume you do have since you are compiling other modules for it) and load the module there. This "debug" kernel could be enhanced with debugging or by changing the module loading code to hook things for you when it sees the module you want to debug.
Finally, you could try running the target kernel and module under QEMU, then debug it with GDB through QEMU debugging interface. If you manage to set it up, this is probably the most comfortable scenario.