7

I'm trying to find the kernel address space where my loadable kernel module is relocated by insmod.

I came to know that by using the -m, -O switches while insmod'ing the module, we can only see the symbol table and the executable's sections' addresses from the view-point of the module and not their relocated addresses, as that process of relocation is carried out when we do an insmod.

Can anyone tell how to find the relocated address of a module in the kernel-memory i.e the address bound within the kernel where a loaded module resides?

Thanks!

P.S Please note that I'm using a Redhat 2.4 Linux kernel in which the /proc/modules listing doesn't show the virtual addresses of the loaded modules.

freax
  • 169
  • 1
  • 5
  • 12
  • Possible duplicate of [How to get the address of a kernel module that was inserted using insmod?](https://stackoverflow.com/questions/6384605/how-to-get-the-address-of-a-kernel-module-that-was-inserted-using-insmod) – Ciro Santilli OurBigBook.com Apr 16 '18 at 14:24

2 Answers2

12

Go to directory /sys/module/<module-name>/sections/.text - will show where the code is loaded /sys/module/<module-name>/sections/.data will show the data section and .bss for the bss section of the module.

Pang
  • 9,564
  • 146
  • 81
  • 122
Ulka Vaze
  • 196
  • 2
  • 5
    A quick tip: you require root to get the cat /sys/module/module-name-here/sections/.* stuff to work.. (else it just displays the value 0x0). – kaiwan Apr 03 '15 at 02:43
9

You can get the core section pointer(virtual address, not physical memory address, but it can be converted to physical address) and the footprint size of the module from /proc/modules file.

Such as part of the file on my Linux box:

autofs4 29253 3 - Live 0xf9014000
hidp 23105 2 - Live 0xf900d000
rfcomm 42457 0 - Live 0xf8f84000
tian_yufeng
  • 1,780
  • 10
  • 8
  • Hi @tian_yufeng, thanks! However I'm using a Redhat 2.4 Linux kernel in which the /proc/modules listing doesn't show the virtual address as edited in my question. Do you know how to get the kernel address of loaded modules in this 2.4 kernel? – freax Mar 21 '13 at 05:49
  • 2.4 kernel is a little out. I think codes changes needed to support the feature you want. Can you tell me the detail version of your kernel? So I can download one to have a check. – tian_yufeng Mar 21 '13 at 07:02
  • I'm using Redhat 2.4.20-24.7 kernel Have found the addresses of the modules using "__this_module.next" pointer which I believe are virtual. Can you tell me how to convert these virtual addresses into physical addresses? Thanks! – freax Mar 21 '13 at 07:48
  • I think in 2.4.20, the loadable modules are using VMALLOC memory. So you can try to use page_to_pfn(vmalloc_to_page(vmalloc_addr)) to convert the VMALLOC virtual address to physical page, then you can get the physical addresss. – tian_yufeng Mar 21 '13 at 08:28
  • Thanks for your suggestion. Will try that and get back to you! I wanted to ask you how to verify if this kernel uses VMALLOC for virtual memory allocation? Because I did a "man" vmalloc and vmalloc_to_page but couldn't find any man page telling their details – freax Mar 21 '13 at 09:36
  • Ah, I just browsed through the header includes and found vmalloc.h and vmalloc_to_page() was externally referenced by mm.h. Shall get into work now :) – freax Mar 21 '13 at 09:42
  • @tian_yufeng, 1. do you have a C code snippet to determine the physical location and footprint size? 2. is the memory contiguous loaded? – Ursa Major Dec 24 '13 at 02:20