Dynamic Kernel Debugging of Signals

In this lesson, you will learn how to use live patching to inject custom logic directly into the kernel's signal delivery routines to debug how processes receive interrupts.

The Concept: Dynamic Injection

Usually, when a process receives a signal, the kernel handles the delivery through a series of internal functions like do_signal. Debugging this via traditional logging is often noisy or impossible if the race condition is subtle. With live patching (specifically using the kpatch or livepatch infrastructure), we can redirect the kernel's execution flow to our own code at runtime without rebooting the system.

Instead of inserting print statements into the source code and recompiling, we define a "patch module" that replaces a specific kernel function with our instrumented version. This allows us to inspect the siginfo_t structure or the process's signal mask in real-time as the kernel decides whether to deliver a signal.

Practical Implementation

Imagine you want to trace why a specific process is ignoring a SIGUSR1. You can create a patch that wraps the standard signal handler:

// Simplified logic for a live patch
static void patched_do_signal(struct ksignal *ksig, struct pt_regs *regs) {
    // Our custom debug logic: print the signal number before the original routine
    printk(KERN_INFO "Signal intercepted! Number: %d\n", ksig->info.si_signo);
    
    // Call the original function to maintain system stability
    orig_do_signal(ksig, regs);
}

When this module is loaded, the kernel's ftrace-based infrastructure redirects calls from the original do_signal to your patched_do_signal. This provides a surgical view into the kernel's decision-making process for signaling.

Why use this for signals?

Because signal handling happens deep within the kernel, standard tools like ptrace or seccomp are often blind to the internal delivery state. Live patching allows you to observe the kernel's internal state exactly when it evaluates process signal masks or pending bitfields, effectively turning the live kernel into a controllable laboratory.

Key Takeaway: Dynamic kernel patching allows you to transparently intercept and instrument signal delivery routines in real-time, providing deep visibility into how the kernel manages process communication without needing to restart the system.