[kwlug-disc] extracting vmlinux from vmlinuz, and debugging the running kernel

[Robert P. J. Day]

  here's a (sort of) philosophical question based on my plan to write
a number of my linux.com columns on kernel debugging (no big surprise
there):  is there much value in covering the limited amount of
debugging you can do if you can't configure, build and reboot under a
new kernel?

  that is, if you have the root password, of course you can examine
log files and even insert new modules to help with debugging but,
beyond that, it seems that any serious debugging is going to require
being able to boot to a new kernel of your configuration.

  one particular example i'm thinking of is being able to use "gdb"
from user space to examine kernel variables.  that's not hard but it
requires the raw ELF-format "vmlinux" image, not the final vmlinuz
form you typically find in /boot.  and while there are ways to extract
the original vmlinux image from the final vmlinuz image, they're not
pretty and, in the end, it seems like way too much work and grief just
to avoid building and booting under a new kernel.

  thoughts?  i suppose i could fill one column with just those
debugging strategies that can be done under the currently-running
kernel, but beyond that, i can't see how much further you can go
unless you can reboot.

rday
--

========================================================================
Robert P. J. Day                               Waterloo, Ontario, CANADA

        Linux Consulting, Training and Annoying Kernel Pedantry.

Web page:                                          http://crashcourse.ca
Twitter:                                       http://twitter.com/rpjday
"Kernel Newbie Corner" column @ linux.com:          http://cli.gs/WG6WYX
========================================================================