when we cat 'proc/kallsyms' or 'system.map' we get symbols like this
....
c033718c T nf_hook_slow
c04ca284 r __ksymtab_nf_hook_slow
c04ca28c r __ksymtab_nf_hooks
c04d24a0 r __kcrctab_nf_hook_slow
c04d24a4 r __kcrctab_nf_hooks
c04e9122 r __kstrtab_nf_hook_slow
c04e9179 r __kstrtab_nf_hooks
c054d854 D nf_hooks
c0571ca0 d nf_hook_mutex
....
what is the meaning of T, r, D, d stuffs?
I can find symbols in kernel source as EXPORT_SYMBOL(...)
but there are others prefixing with __ksymtab... or __kstrtab...
what are these?
Is is possible that there are symbols in System.map but excluded in /proc/kallsyms?
(assuming kernel is compiled properly)
I have netfilter enabled linux kernel but I cant find the symbol 'nf_hooks'
but there is '__ksymtab_nf_hook'. is there some way to get address of nf_hooks
using __ksymtab_nf_hook?
I see in my linux source code EXPORT_SYMBOL(nf_hook) but I cant find it if I
'cat /proc/kallsyms'. is there some typical reason for this?
thank you in advance.
The format is similar to that of the output of nm utility, see also this page.
To put it simple, 'T' usually denotes a global (non-static but not necessarily exported) function, 't' - a function local to the compilation unit (i.e. static), 'D' - global data, 'd' - data local to the compilation unit. 'R' and 'r' - same as 'D'/'d' but for read-only data.
These are the items from the special sections needed to export symbols so that the symbols could be used by kernel modules.
For each exported symbol, al least the following is defined by EXPORT_SYMBOL():
__kstrtab_<symbol_name> - name of the symbol as a string
__ksymtab_<symbol_name> - a structure with the information about the symbol: its address, address of __kstrtab_<symbol_name>, etc.
__kcrctab_<symbol_name> - address of the control sum (CRC) of the symbol - it is used, for example, to check if the kernel or a module provides an exactly the same symbol as needed by a given kernel module. If a module requires a symbol with a given name and CRC and the kernel provides a symbol with that name but a different CRC (e.g. if the module was compiled for a different kernel version), the module loader will refuse to load that kernel module (unless this check is disabled).
Take a look at the implementation of EXPORT_SYMBOL() macro in linux/export.h for details.
Not sure but I have not encountered a situation so far when a function ("text symbol") or a variable ("data symbol") was present in System.map but not shown in /proc/kallsyms if the kernel is compiled properly and with kallsyms fully enabled (CONFIG_KALLSYMS=y, CONFIG_KALLSYMS_ALL=y). If CONFIG_KALLSYMS_ALL=n, only the functions (to be exact, symbols from *.text sections) will be shown in /proc/kallsyms.
Depends on your kernel version. You can take a look at the definition of EXPORT_SYMBOL() for your kernel and find which type __ksymtab_<symbol_name> variables are. In the kernel 3.11, it is struct kernel_symbol defined in linux/export.h. Having the definition of that struct and its address, I suppose, you can get the address of the symbol: struct kernel_symbol::value. Haven't tried this myself though.
Note, however, that __ksymtab_nf_hook is for nf_hook but not for nf_hooks. The name must match. nf_hooks and nf_hook are different entities.
Hard to tell without seeing the code and the relevant part of /proc/kallsyms. Maybe it is #ifdef'ed out and not compiled at all, may be there is something else.
Besides, nf_hooks is a data item so it might not show up in /proc/kallsyms if CONFIG_KALLSYMS_ALL is 'n'.
Related
On a Linux 2.4.25 system I have two loadable kernel modules, com20020 and xsoe. These modules should be independent of each other, but /proc/modules has the lines
xsoe 4528 0 (unused)
com20020 10112 0 [xsoe]
- saying that xsoe is referring to com20020. Perhaps there is a programming error so that xsoe inadvertently uses a symbol from com20020. How can I find the cause of this dependency (preferably without unloading com20020)? (depmod -n offers no clue.)
I looked at /proc/ksyms for suspicious symbols in com20020 which might also appear in the source of xsoe; eventually I saw the line
d129e694 debug [com20020]
there. Both the sources of com20020 and xsoe had the definitions unsigned debug; MODULE_PARM(debug, "i"); and in the outputs of nm com20020.o and nm xsoe.o the symbol appeared as common:
00000004 C debug
The cure was to define the object debug to have internal linkage (storage-class
static).
The search for common symbols could be automated with a bash command like
join -j 3 <(nm com20020.o) <(nm xsoe.o)|grep C$
I compile twice the same .c and .h files and get object files with the same size but different md5sums.
Here is the only difference from objdump -d:
1) cpcidskephemerissegment.o: file format elf64-x86-64
Disassembly of section .text:
0000000000000000 <_ZN68_GLOBAL__N_sdk_segment_cpcidskephemerissegment.cpp_00000000_B8B9E66611MinFunctionEii>:
2) cpcidskephemerissegment.o: file format elf64-x86-64
Disassembly of section .text:
0000000000000000 <_ZN68_GLOBAL__N_sdk_segment_cpcidskephemerissegment.cpp_00000000_8B65537811MinFunctionEii>:
What can be the reason? Thanks!
I guess, the compiler didn't know how to name this namespace and used path to the source file plus some random number.
The compiler must guarantee that a symbol in unnamed namespace does not conflict with any other symbol in your program. By default this is achieved by taking full filename of the source, and appending a random hash value to it (it's legal to compile the same source twice (e.g. with different macros) and link the two objects into a single program, and the unnamed namespace symbols must still be distinct, so using just the source filename without the seed is not enough).
If you know that you are not linking the same source file more than once, and want to have a bit-identical object file on re-compile, the solution is to add -frandom-seed="abcd" to your compile line (replace "abcd" with anything you want; it's common to use the filename as the value of random seed). Documentation here.
The reasons can be many:
Using macros like __DATE__ and __TIME__
Embedding counters that are incremented for each build (the Linux kernel does this)
Timestamps (or similarly variable quantities) embedded in the .comments ELF section. One example of a compiler that does this is the xlC compiler on AIX.
Different names as a result of name mangling (e.g. C++)
Changes in environment variables which are affecting the build process.
Compiler bug(s) (however unlikely)
To produce bit identical builds, you can use GCC's -frandom-seed parameter. There were situations where it could break things before GCC 4.3, but GCC now turns functions defined in anonymous namespaces into static symbols. However, you will always be safe if you compile each file using a different value for -frandom-seed, the simplest way being to use
the filename itself as the seed.
Finally I've found the answer!
c++filt command gave the original name of the function:
{unnamed namespace}: MinFunction(int, int)
In the source was:
namespace
{
MinFunction(int a, int b) { ... }
}
I named the namespace and got stable checksum of object file!
As I guess, the compiler didn't know how to name this namespace and used path to the source file plus some random number.
I'm trying to export a per-cpu symbol "x86_cpu_to_logical_apicid" from kernel so that my kernel module can access it. In "arch/x86/kernel/apic/x2apic_cluster.c", I did
//static DEFINE_PER_CPU(u32, x86_cpu_to_logical_apicid);
DEFINE_PER_CPU(u32, x86_cpu_to_logical_apicid); //I remove static
EXPORT_PER_CPU_SYMBOL(x86_cpu_to_logical_apicid); // I add this
And after I recompile the kernel, the /proc/kallsyms shows
0000000000011fc0 V x86_cpu_to_logical_apicid
0000000000012288 V x86_cpu_to_node_map
ffffffff8187df50 r __ksymtab_x86_cpu_to_apicid
Then I try to access the "x86_cpu_to_logical_apicid" in my kernel module, by using
int apicid = per_cpu(x86_cpu_to_logical_apicid, 2)
However, when I loaded it, it fails to load it due to "Unknown symbol in module". The flag "V" means weak object, however I'm not sure whether this is the reason I fails to export the symbol. Can anyone give me some suggestions? Thank you!
I realize that the OP perhaps is not interested in the answer anymore, but today I had a similar issue, and I thought it might help others as well.
Before using an exported per_cpu variable in a module, you have to declare it first. For your case:
DECLARE_PER_CPU(u32, x86_cpu_to_logical_apicid);
Then you can use get_cpu_var and put_cpu_var to safely access the current processor's copy of the variable. You can read more here.
How are intermodule dependencies resolved when both modules are built outside of the kernel tree and modversioning is enabled?
Modversioning is used to ensure that binary loadable modules are compatible with the kernels they are loaded upon. It is enabled with .config option CONFIG_MODVERSIONS.
We have two dynamically loaded kernel modules, one of which uses an exported symbol from the other. Although the module with the dependence on the other is loaded after the other, insmod complains that it can not resolve a dependency.
[FWIW, these particular modules would serve no useful purpose in the open source world. The people who designed these modules like to keep them out of the kernel tree for their own SCM purposes. The solution of deploying these as a kernel patch will not work.]
This is what the kernel log shows.
<4>foomod: no symbol version for bar_api
<4>foomod: Unknown symbol bar_api
However, if I cat /proc/kallsyms, the bar_api is there and shown as exported.
Another developer here suggested that we use a .conf file to get invoked from the loadmodules script that ignores this error and forces a load, something like this.
install foomod { /sbin/modprobe --ignore-install --force-modversion foomod
$CMDLINE_OPTS; }
I think there has got to be a cleaner way to fix this.
I've tried modifying the Makefile to reference symvers of the module exporting the symbol. The module source for each are in peer directories. It does not seem to matter, but I could be doing this wrong.
KBUILD_EXTRA_SYMBOLS := ../barmod/Module.symvers
This is the content of Module.symvers:
0x00000000 bar_api bar_api barmod
The 0x00000000 is supposed to be valid with modversioning disabled. I think if I could use modprobe like this and see the exported function, then the modprobe would be successful. However, this would only work when modversions is disabled.
# modprobe --dump-modversions foomod.ko
0x00000000 bar_api
However, copying both drivers into the kernel tree and building from within it works. This is a partial listing of the symbols referenced with checksums.
# modprobe --dump-modversions foomod.ko
0x46085e4f add_timer
0x7d11c268 jiffies
0x6a9f26c9 init_timer_key
0x7ec9bfbc strncpy
0xe43dc92b misc_register
0x3302b500 copy_from_user
0x85f8a266 copy_to_user
0xc6538cfc bar_api
0xea147363 printk
: :
Way back around ~2002 having CONFIG_MODVERSIONS would have caused the build to append a checksum generated from genksyms to each exported kernel function. Symbols would look something like this: printk_R1b7d40. This is the last time I've had to deal with modversioning since all of my work since has been with open-source code, within the stock kernel code, or with modversioning disabled. However, today's builds use genksyms to create a checksum for each symbol that goes into a special section. This special section is checked for a checksum match.
There used to be a kernel macro called EXPORT_SYMBOL_NOVERS() that would have worked, but that has been deprecated.
The Linux kernel used is 2.6.32.
I've found these articles relevant and helpful, but inconclusive:
http://lxr.free-electrons.com/source/Documentation/kbuild/modules.txt
http://lwn.net/Articles/21393/
http://www.linuxchix.org/content/courses/kernel_hacking/lesson8
http://lwn.net/Kernel/LDD2/ch11.lwn
How do I cleanly export a function from a loadable module and allow it to be used by another, dependent loadable module when both are built outside of the Linux kernel?
I'm running a 3.4.7 kernel on my box and writing my own kernel modules, one of which should call functions in other modules.
I used EXPORT_SYMBOL to make the functions accessible to the other kernel modules. In my case, my module 'klm_sse' does this.
Now I load another module that uses the symbols exported by 'klm_sse', but when I load it, it complains:
[22892.216551] klm_<...>: Unknown symbol sys_srv_register_multiple (err 0)
Here is the output of 'cat /proc/kallsyms | grep klm_sse', where klm_sse is my module name.
ffffffffa013d170 r __ksymtab_sys_srv_register_multiple [klm_sse]
ffffffffa013d28b r __kstrtab_sys_srv_register_multiple [klm_sse]
ffffffffa012e9b0 t sys_srv_register_multiple [klm_sse]
From the 'man' pages I read that if an entry from /proc/kallsyms shows a lower case letter, here 'r' and 't', it means that the symbols are not globally exported.
How do I make my exports globally visible, so others can access it?
Is it a kernel compile option that is needed to fix this? Appreciate any inputs regarding this, I am literally banging my head on this for two days!
Thanks a million in advance