In a Linux machine with kernel debug packages installed, I could see that two copies of kernel modules are there in two locations as mentioned below:
/lib/modules/<$KERNELVERSION>/kernel/
/usr/lib/debug/lib/modules/<$KERNELVERSION>/kernel/
I do have a doubt that which module will be executed and what is the need for two modules.
/lib/modules/<$KERNELVERSION>/kernel/
- modules, that will be loaded with kernel ( they are without debug symbols )Example:
ll /lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
-rw-r--r-- 1 root root 1883966 Apr 24 2018 /lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
/usr/lib/debug/lib/modules/<$KERNELVERSION>/kernel/
- modules with debug symbolsExample:
ll /usr/lib/debug/lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
-rw-r--r-- 1 root root 40247182 Apr 24 2018 /usr/lib/debug/lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
As you can see, it's 1.8Mb vs 40Mb. If you compare outputs of readelf -S <module>
, then you will notice additional sections like debug_aranges
, debug_info
, debug_ranges
, etc. in debug module