5

In the Linux kernel I want to probe the kernel function effective_prio(). It defined as static. When I go to search the symbol of it in the kallsyms I cannot find it. Does kallsyms have all the symbol of the kernel functions? If not, which symbols are not included?

red0ct
  • 4,840
  • 3
  • 17
  • 44
qyanqing
  • 313
  • 2
  • 5
  • 10
  • I think only exported symbols (those defined with `EXPORT_SYMBOL`, `EXPORT_SYMBOL_GPL`, etc.) are listed there. – eepp Nov 25 '13 at 15:45
  • 3
    No, kallsyms lists all functions, not only exported ones. Actually, it does not know about exported or not exported functions. It distinguishes global functions (marked with 'T' in `/proc/kallsyms`) and local (static) ones, marked with 't'. However, if a function is always inlined or even omitted due to some compiler optimization, perhaps it will not be present in kallsyms at all. – Eugene Nov 26 '13 at 08:00
  • Have you searched for an exact name? Because, due to some compiler optimizations, for example, the real name of the symbol may also become 'effective_prio.isra.8', or something like that. – Eugene Nov 26 '13 at 08:06
  • Thank you.But I hasnot seen any symbol like "effective_prio.isra.8".I tried with kernel 3.2 and 3.12.In the source code,You can find the function 'effective_prio' defined in the /kernel/sched.c file. – qyanqing Nov 26 '13 at 11:44
  • 2
    Yes, it is not listed in /proc/kallsyms in our ROSA linux system with kernel 3.10 too. AFAIK, it is used in only one place, in [set_user_nice() function](http://lxr.free-electrons.com/ident?v=3.10;i=set_user_nice) and it is static, so it is very likely that the compiler just inlined it into set_user_nice() and did not create an unneeded symbol for it at all. That would explain its absense in kallsyms. What to do next depends on what you are actually trying to accomplish. – Eugene Nov 26 '13 at 18:25

3 Answers3

5

There are two possibilities for a function not appearing in /proc/kallsyms:

  1. If the function is marked as static, and the compiler decides to inline the function (with or without the inline keyword)

  2. If a config option or another #define removes a function from being compiled, e.g.:

    #ifdef CONFIG_OPT
void foo(void) {
}
#endif

As far as I know, if a function does not appear in /proc/kallsyms, it is not possible to call or probe it from a module. However, /proc/kallsyms contains all functions of the kernel, not just the ones exported via EXPORT_SYMBOL/EXPORT_SYMBOL_GPL.

mdd
  • 685
  • 5
  • 11
1

CONFIG_KALLSYMS_ALL=y is also required to see non-static variables, e.g.:

grep sysctl_sched_nr_migrate /proc/kallsyms

which is defined as:

const_debug unsigned int sysctl_sched_nr_migrate = 32;
Ciro Santilli OurBigBook.com
  • 347,512
  • 102
  • 1,199
  • 985
-1

kallsyms only lists the symbols exported by EXPORT_SYMBOL and EXPORT_SYMBOL_GPL macros.

This is done for security. We don'T usually want modules to be able to access for example internal or security functions. Those just go against the idea of making kernel modules as safe as possible, but allowing them to do as much as it is possible.

Levente Kurusa
  • 1,858
  • 14
  • 18
  • 1
    Which commit hardened it so? At least up to kernel 3.10.x, it shows both exported and not exported functions. `/proc/kallsyms` may show 0 as the address of these functions for security reasons when viewed by a non-root user but at least all function names are listed. – Eugene Nov 26 '13 at 08:03
  • He cannot use nonexported symbols so it is kind of irrelevant. – Levente Kurusa Nov 26 '13 at 09:24
  • 3
    Yes, they cannot be used directly in a kernel module, etc. But still, one may need to place a Kprobe on these, for example, for tracing or debugging purposes and so on, so the information about non-exported symbols is sometimes needed. Actually, I did that for debugging. – Eugene Nov 26 '13 at 09:40
  • 1
    As @Eugene commented, this answer is incorrect. kallsysms lists **all** symbols of the kernel image, not just those that are exported. – mdd May 29 '15 at 17:35