On Thu, Sep 30, 2021 at 06:19:55PM +0100, Nick Alcock wrote: > On 30 Sep 2021, Kees Cook said: > > On Wed, Sep 29, 2021 at 10:51:47PM +0100, Nick Alcock wrote: > >> It would be useful if there were a mapping between kernel symbol and module > >> name that only changed when the kernel source code is changed. This mapping > >> should not change simply because a module becomes built into the kernel. > >> > >> It might also be useful if there were reliable symbol size information to > >> determine whether an address is within a symbol or outside it, especially > >> given that there could be huge gaps between symbols. > >> [...] > > [...] > > It would be useful, sure, but is there something that does, in fact, > > need this, or would like this if it were available? Since this provides > > a userspace API, what would be consuming that API? For example, when > > Syscall User Dispatch was added, it was clear it was for Wine[1]. > > We have a long-term consumer in DTrace (e.g. > <https://github.com/oracle/dtrace-utils/blob/dev/libdtrace/dt_module.c#L1323>). > (But since we control this consumer we are quite happy to change the > format of kallmodsyms, integrate it with kallsyms so that kallsyms just > provides the same information if the file format break were acceptable, > or whatever you think most sensible. We just want this information > somehow. :) e.g. the code there doesn't yet handle the > symbol-in-multiple-modules case: I'll have to add that.) Ah-ha, excellent. That works for me. :) (If there is a v5, maybe add a note about DTrace to help show the specific need.) Thanks! -Kees -- Kees Cook
