System. Map

Information about the system. Map File seems to be lacking. In fact, it is not mysterious at all, and it is not as important as it looks. However, the lack of necessary documentation makes it mysterious. It is like an earlobe, which we all have, but we don't know what to do. This page is used to illustrate this problem.

Note that I am not 100% correct. For example, a system may not support the/proc file system, but most systems certainly do. Here I assume that you are "with the big stream" and have a typical configuration system.

Some explanations about Kernel errors (Oops) come from Alessandro Rubini's book "Linux device drivers", where I learned most about Kernel programming.

What is a symbol (symbols )?

In programming, a symbol is a program creation block: it is a variable name or function name. Just like your own program, it should not be surprising that the kernel has various symbols. Of course, the difference is that the kernel is a very complex code block and contains many and many global symbols.

What is the kernel symbol table?

The kernel does not use a symbolic name. It uses variables or functions through the address (pointer) of variables or functions, rather than using size_t bytesread. The kernel prefers to use (for example) c0343f20 to reference this variable.

On the other hand, people do not like names like c0343f20. We like to use a representation like size_t bytesread. Generally, this does not cause any problems. The kernel is mainly written in C language. Therefore, during programming, the compiler/Connection Program allows us to use the symbol name and make the kernel express the address at runtime. So everyone is satisfied.

However, there is a situation where we need to know the address of a symbol (or the symbol corresponding to an address ). This is done through the symbol table, which is similar to the situation where GDB can give the function name (or the address of a function name) from an address. A symbol table is a list of all symbols and their corresponding addresses. Here is an example of a symbol table:

C03441a0 B dmi_broken
C03441a4 B is_sony_vaio_laptop
C03441c0 B dmi_ident
C0344200 B pci_bios_present
C0344204 B pirq_table
C0344208 B pirq_router
C034420c B pirq_router_dev
C0344220 B ascii_buffer
C0344224 B ascii_buf_bytes

You can see that the variable named dmi_broken is located at the kernel address c03441a0.

What is a system. map file?

Two files are used as symbol tables:

1. /Proc/ksyms

2. System. Map

Here, you can now know what the system. Map File is.

Each time you compile a new kernel, the address of each symbol name changes.

/Proc/ksyms is a "proc file" created at kernel startup. In fact, it is not a real file; it is just a simple representation of the kernel data, showing like a disk file. If you don't believe me, try to find the file size of/proc/ksyms. Therefore, for the currently running kernel, it is always correct ..

However, system. Map is a real file on the file system. When you compile a new kernel, the symbolic information in your original system. MAP is incorrect. Each time the kernel is compiled, a new system. Map File is generated, and the original file must be replaced with this file.

What is a Oops?

What are the most common errors in self-developed programs? It is a segment error (segfault), signal 11.

What are the most common bugs in Linux kernel? It is also a segment error. In addition, as you might imagine, segment errors are very complicated and serious. When the kernel references an Invalid Pointer, it is not called a segment error -- it is called "oops ". An oops indicates that there is a bug in the kernel, and it should always be reported and corrected.

Note that an oops is not the same as a segment error. Your program cannot be recovered from a segment error. When an oops occurs, it does not mean that the kernel is definitely unstable. The Linux kernel is very robust. One oops may only kill the current process and keep the remaining kernel in a good and stable State.

An oops is not a kernel endless loop (panic ). After the kernel calls the panic () function, the kernel cannot continue to run. At this time, the system is paused and must be restarted. If the key part of the system is damaged, A oops is alsoPossibleThis will cause the kernel to enter the endless loop (panic ). For example, the oops in the device driver will hardly lead to an endless loop of the system.

When an oops occurs, the system displays information about debugging problems, such as the content in all CPU registers and the location of the page Descriptor Table, in particular, the EIP (command pointer) content is printed as follows:

EIP: 0010: [<00000000>]
Call trace: []

What is the relationship between an oops and the system. map file?

I think you will also think that the EIP and call trace do not provide much information, but it is important that this information is not enough for Kernel developers. Because a symbol does not have a fixed address, c010b860 can point to any place.

To help us use oops vague output, Linux uses a background program called klogd (kernel log Background Program). klogd intercepts the kernel Oops and uses syslogd to record it, and convert some information like c010b860 into information that we can recognize and use. In other words, klogd is a kernel message recorder (logger) that can be used for name-to-address resolution. Once klogd starts to convert the kernel message, it uses the recorder at hand to record the message of the entire system, usually using the syslogd recorder.

To perform name-Address Resolution, the klogd must use the system. Map File. I think you now know the relationship between Oops and system. Map.

In-depth description:In fact, klogd performs two types of address resolution activities.

• Static conversion: The system. map file is used.

• Dynamic conversion. This method is used to load modules without using system. Map. Therefore, it has nothing to do with this discussion, but I still briefly describe it.

Dynamic conversion of klogd

Suppose you have loaded a kernel module that generates oops. Therefore, a oops message is generated, and klogd intercepts it and finds that the oops occurs at d00cf810. Because the address belongs to the dynamic loading module, there is no corresponding entry in the system. Map File. Klogd will be searched for and will not be obtained, so it is determined that a loadable module produces oops. In this case, klogd queries the kernel for the symbols output by the loaded module. Even if the compiler of this module does not output its symbols, klogd will at least know which module generates oops, which is better than a oops.

Other software will use system. Map, which will be described later.

Where should system. Map be located?

System. map should be located where the software that uses it can find, that is, where klogd will look for it. When the system is started, if the location of system. map is not given by klogd in the form of a parameter, klogd searches for system. Map in three places. In sequence:

1. /Boot/system. Map

2. /System. Map

3. /Usr/src/Linux/system. Map

System. MAP also contains version information, and klogd can intelligently search for correct map files. For example, assume that you are running kernel 2.4.18 and the corresponding map file is located in/boot/system. Map. Now you compile a new kernel 2.5.1 In the/usr/src/Linux directory. During compilation, the file/usr/src/Linux/system. map will be created. When you start the new kernel, klogd will first query/boot/system. map to check whether it is the correct map file to start the kernel, and then query/usr/src/Linux/system. map to determine the fileYesStart the correct map file in the kernel and start to read the symbolic information.

Notes:

• In a version of the 2.5.x series kernel, the Linux kernel starts to untar into Linux-version, not just Linux (please raise your hand to vote-how many people have been waiting for this ?). I don't know if klogd has been changed to search in/usr/src/Linux-version/system. Map. Todo: view the klogd source code.

• This is not fully described in the online manual. Please refer to: # strace-F/sbin/klogd | grep 'System. map'
  31208 open ("/boot/system. Map-2.4.18", o_rdonly | o_largefile) = 2
  

  Obviously, not only does klogd search for the correct map file in the three search directories, but klogd also knows that the search name is "system. map "added"-kernel version ", such as system. map-2.4.18. this is an undisclosed feature of klogd.

Some drivers will use system. Map to parse the symbols (because they are connected to the kernel header rather than the glibc library). Without the system. map file, they will not work correctly. This is the same as a module that does not get loaded due to kernel version mismatch. Module loading is related to the kernel version, but it is irrelevant to the compiled kernel even if the symbol table of the kernel of the same version changes.

Who else uses system. Map?

Do not think that the system. Map File is only useful for the kernel oops. Although the kernel itself does not actually use system. Map, other programs, such as klogd, lsof, Satan # strace lsof 2> & 1 1>/dev/null | grep System
Readlink ("/proc/22711/FD/4", "/boot/system. Map-2.4.18", 4095) = 23
PS, Satan # strace PS 2> & 1 1>/dev/null | grep System
Open ("/boot/system. Map-2.4.18", o_rdonly | o_nonblock | o_noctty) = 6
And many other software, such as dosemu, must have a correct system. Map File.

If I don't have a good system. Map, what will happen?

Suppose you have multiple kernels on the same machine. Each kernel requires an independent system. Map File! If the started kernel does not have the corresponding system. map file, you will see this information regularly:

System. map does not match actual kernel (system. map does not match the actual kernel)

It is not a fatal error, but it will be annoying whenever you execute PS ax. Some software, such as dosemu, may not work normally. Finally, when a kernel oops occurs, the output of klogd or ksymoops may be unreliable.

How can I remedy the above situation?

You can place all your system. Map Files in the directory/boot and rename them using the kernel version number. Assume that you have the following kernels:

• /Boot/vmlinuz-2.2.14

• /Boot/vmlinuz-2.2.13

You only need to rename the map file for each kernel version and put it under/boot, for example:

/Boot/system. Map-2.2.14
/Boot/system. Map-2.2.13 what if you have two copies of the same kernel? For example:

• /Boot/vmlinuz-2.2.14

• /Boot/vmlinuz-2.2.14.nosound

The best solution is that all software can find the following files:

/Boot/system. Map-2.2.14
/Boot/system. map-2.2.14.nosound

But to be honest, I don't know if this is the best case. I have seen the search for "system. Map-kernelversion", but what about the search for "system. map-kernelversion.othertext? I don't know. What I can do at this point is to take advantage of the fact that/usr/src/Linux is the search path of the Standard map file, so your map file will be placed in:

• /Boot/system. Map-2.2.14

• /Usr/src/Linux/system. Map (for nosound Version)

You can also use a symbolic connection:

System. Map-2.2.14
System. map-2.2.14.sound
System. Map-> system. map-2.2.14.sound