Practical Kernel Debugging with Kprobes

Typical kernel debugging is done by adding printks to an existing kernel. Kprobes, however, let you add debug statements to your kernel without any recompilation of the kernel itself, assuming it was built with basic kprobes support. If you are a kernel hacker, rebuilding your kernel is no problem. It is a problem, however, if you are debugging some customer (or your grandmother's) system running a distro kernel.

Now that kprobes are part of mainline, debugging by sending a kprobes module is going to be a lot more common.

This tutorial will cover practical and interesting examples of using kprobes to debug kernels. Live examples on the presenter's laptop, and using suggestions from the audience, will be used to show how kprobes can be used in practice.

The focus of this tutorial will be using kprobes practically, not on kprobes internals or implementation.