System. Map

Information about the system. Map File seems to be lacking. In fact, it is not mysterious at all, and it is not as important as it looks. However, the lack of necessary documentation makes it mysterious. It is like an earlobe, which we all have, but we don't know what to do. This page is used to illustrate this problem.

Note that I am not 100% correct. For example, a system may not support the/proc file system, but most systems certainly do. Here I assume that you are "with the big stream" and have a typical configuration system.

Some explanations about Kernel errors (Oops) come from Alessandro Rubini's book "Linux device drivers", where I learned most about Kernel programming.

What is a symbol (symbols )?

In programming, a symbol is a program creation block: it is a variable name or function name. Just like your own program, it should not be surprising that the kernel has various symbols. Of course, the difference is that the kernel is a very complex code block and contains many and many global symbols.

What is the kernel symbol table?

The kernel does not use a symbolic name. It uses variables or functions through the address (pointer) of variables or functions, rather than usingSize_t bytesread, The kernel prefers to use (for example)C0343f20To reference this variable.

On the other hand, people do not likeC0343f20Such a name. We like to use imagesSize_t bytesread. Generally, this does not cause any problems. The kernel is mainly written in C language. Therefore, during programming, the compiler/Connection Program allows us to use the symbol name and make the kernel express the address at runtime. So everyone is satisfied.

However, there is a situation where we need to know the address of a symbol (or the symbol corresponding to an address ). This is done through the symbol table, which is similar to the situation where GDB can give the function name (or the address of a function name) from an address. A symbol table is a list of all symbols and their corresponding addresses. Here is an example of a symbol table:

   c03441a0 B dmi_broken   c03441a4 B is_sony_vaio_laptop   c03441c0 b dmi_ident   c0344200 b pci_bios_present   c0344204 b pirq_table   c0344208 b pirq_router   c034420c b pirq_router_dev   c0344220 b ascii_buffer   c0344224 b ascii_buf_bytes

You can see that the name isDmi_brokenThe variable is located in the kernel addressC03441a0.

What is a system. map file?

Two files are used as symbol tables:

1. /Proc/ksyms
2. System. Map

Here, you can now know what the system. Map File is.

Each time you compile a new kernel, the address of each symbol name changes.

/Proc/ksymsIs a "proc file" and created at kernel startup. In fact, it is not a real file; it is just a simple representation of the kernel data, showing like a disk file. If you don't believe me, try to find out/Proc/ksyms. Therefore, for the currently running kernel, it is always correct ..

However, system. Map is a real file on the file system. When you compile a new kernel, the symbolic information in your original system. MAP is incorrect. Each time the kernel is compiled, a new system. Map File is generated, and the original file must be replaced with this file.

What is a Oops?

What are the most common errors in self-developed programs? It is a segment error (segfault), signal 11.

What are the most common bugs in Linux kernel? It is also a segment error. In addition, as you might imagine, the problem of incorrect segments is very complicated and serious. When the kernel references an Invalid Pointer, it is not called a segment error -- it is called "oops ". An oops indicates that there is a bug in the kernel, and it should always be reported and corrected.

Note that an oops is not the same as a segment error. Your program cannot be recovered from a segment error. When an oops occurs, it does not mean that the kernel is definitely unstable. The Linux kernel is very robust. One oops may only kill the current process and keep the remaining kernel in a good and stable State.

An oops is not a kernel endless loop (panic ). After the kernel calls the panic () function, the kernel cannot continue to run. At this time, the system is paused and must be restarted. If the key part of the system is damaged, A oops is alsoPossibleThis will cause the kernel to enter the endless loop (panic ). For example, the oops in the device driver will hardly lead to an endless loop of the system.

When an oops occurs, the system displays information about debugging problems, such as the content in all CPU registers and the location of the page Descriptor Table, in particular, the EIP (command pointer) content is printed as follows:

   EIP: 0010:[<00000000>]   Call Trace: [
  
   ]
  

What is the relationship between an oops and the system. map file?

I think you will also thinkEIPAndCall traceThere is not much information provided, but it is important that this information is not enough for Kernel developers. Because a symbol does not have a fixed address,C010b860It can point to any place.

To help us use oops vague output, Linux uses a background program called klogd (kernel log Background Program). klogd intercepts the kernel Oops and uses syslogd to record it, andC010b860To the information we can identify and use. In other words, klogd is a kernel message recorder (logger) that can be used for name-to-address resolution. Once klogd starts to convert the kernel message, it uses the recorder at hand to record the message of the entire system, usually using the syslogd recorder.

To perform name-Address Resolution, klogd needs to useSystem. MapFile. I think you now know thatSystem. Map.

In-depth description:In fact, klogd performs two types of address resolution activities.

• Static conversion: The system. map file is used.
• Dynamic conversion. This method is used to load modules. It is not used.System. MapSo it has nothing to do with this discussion, but I will give a brief description of it.

Dynamic conversion of klogd

Suppose you have loaded a kernel module that generates oops. Therefore, a oops message is generated, and klogd intercepts it and finds that this oops occurs inD00cf810. Because the address belongs to the dynamic loading moduleSystem. MapThere are no corresponding entries in the file. Klogd will be searched for and will not be obtained, so it is determined that a loadable module produces oops. In this case, klogd queries the kernel for the symbols output by the loaded module. Even if the compiler of this module does not output its symbols, klogd will at least know which module generates oops, which is better than a oops.

Other software will be used.System. Map, I will explain it later.

Where should system. Map be located?

System. map should be located where the software that uses it can find, that is, where klogd will look for it. When the system is started, if klogd does not provide a parameterSystem. MapThen, klogd will searchSystem. Map. In sequence:

1. /Boot/system. Map
2. /System. Map
3. /Usr/src/Linux/system. Map

System. MapIt also contains version information, and klogd can intelligently search for correct map files. For example, assume that you are running kernel 2.4.18 and the corresponding map file is located in/Boot/system. Map. Now you are in the directory/Usr/src/LinuxTo compile a new kernel 2.5.1. During compilation/Usr/src/Linux/system. MapIt will be created. When you start the new kernel, klogd first queries/Boot/system. MapCheck whether it is the correct map file for Kernel startup./Usr/src/Linux/system. Map, Determine the fileYesStart the correct map file in the kernel and start to read the symbolic information.

Notes:

• In a version of the 2.5.x series kernel, the Linux kernel starts to untar into Linux-Version, Not justLinux(Please raise your hand to vote-how many people have been waiting for this ?). I don't know if klogd has been changed/Usr/src/Linux-version/system. Map. Todo: view the klogd source code.
• This is not fully described in the online manual. Please refer:

     # strace -f /sbin/klogd | grep 'System.map'   31208 open("/boot/System.map-2.4.18", O_RDONLY|O_LARGEFILE) = 2

  Obviously, not only does klogd search for the correct map file in the three search directories, but klogd also knows that the search name is"System. Map"Houjia"-Kernel version", LikeSystem. Map-2.4.18. This is an undisclosed feature of klogd.

Some drivers will use system. Map to parse the symbols (because they are connected to the kernel header rather than the glibc library). Without the system. map file, they will not work correctly. This is the same as a module that does not get loaded due to kernel version mismatch. Module loading is related to the kernel version, but not to the compiled kernel that changes even the symbol table of the kernel of the same version.

Who else uses system. Map?

Do not think that the system. Map File is only useful for the kernel oops. Although the kernel itself does not actually use system. Map, other programs, such as klogd, lsof,

   satan# strace lsof 2>&1 1> /dev/null | grep System   readlink("/proc/22711/fd/4", "/boot/System.map-2.4.18", 4095) = 23

PS,

   satan# strace ps 2>&1 1> /dev/null | grep System   open("/boot/System.map-2.4.18", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 6

And many other software, such as dosemu, must have a correctSystem. MapFile.

If I don't have a good system. Map, what will happen?

Suppose you have multiple kernels on the same machine. Each kernel requires an independentSystem. MapFile! If no correspondingSystem. MapFile, you will regularly see the following information:

System. map does not match actual kernel (system. map does not match the actual kernel)

It is not a fatal error, but every time you executePS axWill be annoying. Some software, such as dosemu, may not work normally. Finally, when a kernel oops occurs, the output of klogd or ksymoops may be unreliable.

How can I remedy the above situation?

The method is to convert all yourSystem. MapPut the file in the directory/BootAnd use the kernel version number to rename them. Assume that you have the following kernels:

• /Boot/vmlinuz-2.2.14
• /Boot/vmlinuz-2.2.13

Then, you only need to rename the map file corresponding to each kernel version and put it in/BootFor example:

   /boot/System.map-2.2.14   /boot/System.map-2.2.13

What if you have two copies of the same kernel? For example:

• /Boot/vmlinuz-2.2.14
• /Boot/vmlinuz-2.2.14.nosound

The best solution is that all software can find the following files:

   /boot/System.map-2.2.14   /boot/System.map-2.2.14.nosound

But to be honest, I don't know if this is the best case. I have seen searching for "system. Map-kernelversion", but what about searching for "system. map-kernelversion.othertext? I don't know. What I can do at this point is to take advantage of the fact that:/Usr/src/LinuxIs the search path of the Standard map file, so your map file will be placed in:

• /Boot/system. Map-2.2.14
• /Usr/src/Linux/system. Map (for nosound Version)

You can also use a symbolic connection:

   System.map-2.2.14   System.map-2.2.14.sound   System.map -> System.map-2.2.14.sound