This is the mail archive of the systemtap@sourceware.org mailing list for the systemtap project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: function symbols before module base address


The kernel abuses its ELF symbol table for a few extra purposes.  In these
cases, the symbol value is storing a constant, not an actual address in the
kernel.  (Some of these cases are the vDSO uses, where the meaning of the
constant in question happens to be a user-space address.  But that is just
incidental, and really none of these are "addresses" in the sense that we
mean in libdwfl.)

For example, there are all the __crc_* symbols, where the symbol's value is
actually a CRC32 of something, not anything like an address at all.  Others
are sizes, etc.  The vDSO uses are the ones that look the most like they
might be actual addresses (but aren't); these vary among kernel versions
and machines.  Some are called __kernel_* in older kernels.  In recent
kernels, they are all VDSO* names on x86.  (I'm not sure whether any other
arch's vDSO implementations use symbols like these.)

These cases are all SHN_ABS.  They are probably also all STT_NOTYPE.
Possibly you could use that filter to ignore them.  It's not really
guaranteed in any kosher way that some SHN_ABS, STT_NOTYPE symbols won't
ever be an actual address symbol.  

You can look at:

	eu-readelf -s /usr/lib/debug/lib/modules/`uname -r`/vmlinux |
	awk '$4 == "NOTYPE" && $7 == "ABS"'

to judge how many good/bad symbols you'd be weeding out that way.
For 2.6.27.12-170.2.5.fc10.x86_64, there are various section start/end
symbols (ones created by the vmlinux.lds linker script, and _edata et al)
as well as the bogons.

If you are deciding to omit these symbols because they aren't useful, then
some nasty heuristics on names or suchlike may be required.  If all you
mean to do is decide whether a value is probably absolute or is probably a
real address, then you can do something slightly less fragile (but still
slightly nasty).  e.g., if it's STT_NOTYPE and it's SHN_ABS and the address
does not fall inside the Dwfl_Module, then treat it as absolute.

If the only need for these symbols is to identify kernel-mode PC's with a
name, then you'd probably be fine just omitting all SHN_ABS symbols
altogether.  These are never the ones generated by the compiler or the
assembler based on a label in the code.


Thanks,
Roland


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]