From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 27224 invoked by alias); 10 Apr 2009 01:21:25 -0000 Received: (qmail 27212 invoked by uid 22791); 10 Apr 2009 01:21:24 -0000 X-SWARE-Spam-Status: No, hits=-1.8 required=5.0 tests=AWL,BAYES_00,HK_OBFDOM,J_CHICKENPOX_44,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: sourceware.org Received: from mx2.redhat.com (HELO mx2.redhat.com) (66.187.237.31) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Fri, 10 Apr 2009 01:21:16 +0000 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n3A1LEg5011628 for ; Thu, 9 Apr 2009 21:21:14 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n3A1LFi4004986 for ; Thu, 9 Apr 2009 21:21:15 -0400 Received: from host0.dyn.jankratochvil.net (sebastian-int.corp.redhat.com [172.16.52.221]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id n3A1LDRX032102 for ; Thu, 9 Apr 2009 21:21:13 -0400 Received: from host0.dyn.jankratochvil.net (localhost [127.0.0.1]) by host0.dyn.jankratochvil.net (8.14.3/8.14.3) with ESMTP id n3A1LBfp018553; Fri, 10 Apr 2009 03:21:11 +0200 Received: (from jkratoch@localhost) by host0.dyn.jankratochvil.net (8.14.3/8.14.2/Submit) id n3A1LApE018548; Fri, 10 Apr 2009 03:21:10 +0200 Date: Mon, 13 Apr 2009 03:11:00 -0000 From: Jan Kratochvil To: Shrinand Javadekar Cc: Michael Snyder , "gdb@sourceware.org" Subject: Re: Kernel symbol table Message-ID: <20090410012109.GA15126@host0.dyn.jankratochvil.net> References: <49DE4219.9020606@vmware.com> <49DE599B.8070702@vmware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) X-IsSubscribed: yes Mailing-List: contact gdb-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-owner@sourceware.org X-SW-Source: 2009-04/txt/msg00099.txt.bz2 On Thu, 09 Apr 2009 22:36:40 +0200, Shrinand Javadekar wrote: > If these are not loaded how can other (maybe even user written) > modules link to them? kernel uses /proc/kallsyms which are stored in ELF-incompatible kernel custom format. You can get stripped ELF vmlinux file from vmlinuz by: perl -e 'undef $/;$_=<>;print /(\x1f\x8b\x08.*$)/s;' vmlinux.bin And there you can see these symbols by: $ readelf -Wa vmlinux.bin Section Headers: [Nr] Name Type Address Off Size ES Flg Lk Inf Al [ 8] __ksymtab PROGBITS ffffffff81482660 682660 00bb10 00 A 0 0 16 [ 9] __ksymtab_gpl PROGBITS ffffffff8148e170 68e170 005420 00 A 0 0 16 [10] __ksymtab_unused PROGBITS ffffffff81493590 693590 000010 00 A 0 0 16 [11] __ksymtab_strings PROGBITS ffffffff814935a0 6935a0 01303a 00 A 0 0 1 $ objcopy -j __ksymtab -O binary vmlinux.bin vmlinux.bin-__ksymtab $ objcopy -j __ksymtab_strings -O binary vmlinux.bin vmlinux.bin-__ksymtab_strings You could write some script to extract this symbol information out of the custom kernel __ksymtab* format into some readable format. The better way would be to change Linux kernel to store its symbol information in ELF format (such as common `.symtab' sections). On Thu, 09 Apr 2009 20:59:54 +0200, Shrinand Javadekar wrote: > 1. When I haven't built the kernel myself, I don't have the vmlinux file. You should have debuginfo package for such kernel: $ rpm -qlv kernel-debuginfo-2.6.28-3.fc10.x86_64 | grep vmlinux -rwxr-xr-x 1 root root 86367610 Jan 13 17:07 /usr/lib/debug/lib/modules/2.6.28-3.fc10.x86_64/vmlinux > 2. When I am remotely connected to a machine, I don't really have the > vmlinux file with me. You can reassemble the kernel symbol table from __ksymtab* as listed above by some custom code. Or you can use the symbol table provided by the target kernel itself as /proc/kallsyms. You can also use System.map file which is usually more commonly available that the vmlinux file. For the latter two source files you can use: b=ffffffff81000000;sort ){($b,$s)=/^([0-9a-f]+) . (\S+)\s*$/s or next;next if $s{$s}++;$b=eval("0x$b-0x'$b'");next if $b<0 || $b>0x1000000 || $b{$b}++;printf "\t.org\t0x%x\n$s:\n",$b;}'|as -o /tmp/ker.o -;objcopy --adjust-vma=0x$b /tmp/ker.o $ gdb /tmp/ker.o /proc/kcore (gdb) disass printk Dump of assembler code for function printk: 0xffffffff8132df6f : push %rbp [...] 0xffffffff8132dfaf : nop End of assembler dump. (gdb) Generating the symbol file /tmp/ker.o has some drawbacks: * You cannot simply generate ABS symbols by `.equ' as GDB requires the symbol to be SEC_CODE, therefore .text section relative. * If you would generate such symbols by straight `.org' then: * gas crashes on 64-bit overflow on the 0xffffffff... addresses. * gas generates too big real zeroed .text section for the ker.o file. * There are both address and symbol duplicates one could resolve better. * 0xffffffff81000000 and 0x1000000 are x86_64 specific constants. Regards, Jan