On Tue, Oct 8, 2013 at 5:05 PM, Adrian Hunter <adrian.hun...@intel.com> wrote: > On 08/10/13 10:41, Namhyung Kim wrote: >> On Mon, 7 Oct 2013 09:50:17 +0300, Adrian Hunter wrote: >>> kcore can be used to view the running kernel object code. >>> However, kcore changes as modules are loaded and unloaded, >>> and when the kernel decides to modify its own code. >>> Consequently it is useful to create a copy of kcore at a >>> particular time. Unlike vmlinux, kcore is not unique >>> for a given build-id. And in addition, the kallsyms >>> and modules files are also needed. The tool therefore >>> creates a directory: >>> >>> ~/.debug/[kernel.kcore]/<build-id>/<YYYYmmddHHMMSShh> >>> >>> which contains: kcore, kallsyms and modules. >> >> Hmm.. I think the problem is that the kallsyms and kcore also have >> module information and the build-id of kernel can identify the core >> kernel part only. So why not splitting modules from kcore and kallsyms? >> >> As the modules have their own build-id, we can extract module info from >> kcore and kallsyms and put them under ~/.debug/[module]/<build-id>. >> While at it, we can even synthesize symbol table and inject it into the >> module kcore and get rid of the module kallsyms file. >> >> This way, we can identify all binaries using build-id only, no? > > No. > > kcore doesn't just give the module object code - it gives it > linked in to the kernel. Unless you have the modules at the same > addresses the linking doesn't match what you traced.
Ah.. right. I missed that. Thanks, Namhyung -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
