Search code examples
linuxdebugginglinux-kernelkernel-moduledebug-symbols

Why two kernel module copies are required in a linux kernel debug package installed system?


In a Linux machine with kernel debug packages installed, I could see that two copies of kernel modules are there in two locations as mentioned below:

  1. /lib/modules/<$KERNELVERSION>/kernel/
  2. /usr/lib/debug/lib/modules/<$KERNELVERSION>/kernel/

I do have a doubt that which module will be executed and what is the need for two modules.


Solution

    1. /lib/modules/<$KERNELVERSION>/kernel/ - modules, that will be loaded with kernel ( they are without debug symbols )

    Example:

    ll /lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
    -rw-r--r-- 1 root root 1883966 Apr 24 2018 /lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko

    1. /usr/lib/debug/lib/modules/<$KERNELVERSION>/kernel/ - modules with debug symbols

    Example:

    ll /usr/lib/debug/lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko
    -rw-r--r-- 1 root root 40247182 Apr 24 2018 /usr/lib/debug/lib/modules/4.15.0-20-generic/kernel/fs/xfs/xfs.ko

    As you can see, it's 1.8Mb vs 40Mb. If you compare outputs of readelf -S <module>, then you will notice additional sections like debug_aranges, debug_info, debug_ranges, etc. in debug module