Difference Between T and T in /Proc/Kallsyms

kernel symbol marked with T in /proc/kallsyms is not exported

Mark "T" in /proc/kallsyms means that symbol is globally visible, and can be used in other kernel's code (e.g. by drivers, compiled built-in).

But for being usable in kernel module's code, symbol is needed to be exported using EXPORT_SYMBOL or similar. List of exported symbols is maintained separately from list of all symbols in the kernel.

Exported symbols can be found in file /lib/modules/<kernel-version>/build/Module.symvers.

(this file should exist for possibility to build kernel modules against given kernel).

Why does my /proc/kallsyms file not contain all the symbols in System.map?

You don't have CONFIG_KALLSYMS_ALL set to y, therefore only text symbols are exported to /proc/kallsyms. Setting this to y and re-building the kernel (although not that simple to do) should solve the problem.

I don't know if this is because you have an old kernel or some distro that disables it in their build. You could also try upgrading to a newer kernel. In my Debian 9 Linux v4.9 it seems to be enabled.

What is the need of having both System.map file and /proc/kallsyms?

/proc/kallsyms have symbols of dynamically loaded modules as well static code and System.map is symbol tables of only static code.

You can not be really sure if System.map will be available on your system. When kernel and system.map mismatch you keep seeing System.map does not match actual kernel warning. So in that case/proc/kallsyms is the symbols of running kernel.

System.map isn't just useful for debugging kernel oopses. A few drivers need System.map to resolve symbols since they're linked against kernel headers instead of glibc). They won't work correctly without the System.map for the particular kernel currently running.

More info on http://dirac.org/linux/system.map/

---

Related Topics