10

I've been wandering around for quite a while now, reading questions almost daily and answering interesting ones. In this time, I've seen a fair amount of users asking help about calling functions that are not exported by the kernel from a kernel module.

Here are some examples:

I think a canonical Q&A for such questions would be useful, however none of the above qualify IMHO, because they are (1) often limited to a specific problem, and (2) even when they are not, while some of the provided answers are good, they all suggest different solutions, so there's bits and pieces scattered around, but no real "complete" answer.

I'd be willing to sit down and write a self-answered Q&A post explaining all possible approaches under different scenarios, but I thought I'd ask here first.

Is there any good Q&A that I missed to be used as canonical for this? Or should I actually post one and then start using that?


For reference, here is a draft of what I think a good canonical question for this could look like:

I am developing a Linux kernel module which would need to rely on some kernel function (or global symbol) that is not exported by the kernel for modules to use (i.e. there is no EXPORT_SYMBOL() for it).

Indeed, if I try to compile my module, I get an error that looks like this:

$ make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
make[1]: Entering directory '/usr/src/linux-headers-5.10.0-14-amd64'
  CC [M]  /home/user/mymodule/mymodule.c
  MODPOST /home/user/mymodule/Module.symvers
ERROR: modpost: "some_function" [/home/user/mymodule/mymodule.ko] undefined!
...

Would it be possible to call such a function anyway? If so, how?

I understand that I should not rely on unexported functions in my module, but I am certainly not going to submit a patch to get my module included in the kernel source. I am writing a module for educational purposes, and not for production use.

What are my options?

2
  • 1
    Why not make one, write it in the tag and reference it, it will get noticed save as bookmark and then used as dupe marker
    – nbk
    Jun 15, 2022 at 14:30
  • 2
    @nbk yeah that's more or less what I was thinking. Jun 15, 2022 at 14:45

1 Answer 1

7

The tag "linux-kernel" is among my watched tags too, and I am perfectly aware about the problem with using non-exported symbols.

The third question seems to be good base for being canonical.

Its current content is short and isn't polluted with unneeded details. While the part about "recent kernels" is important for the question, it can be easy edited out from the title and moved into the question's body.

The question has your answer with several solutions.

The question has even the other's answer, which looks like a possible solution too (while I heard about kprobes a lot, I am not an expert with them). Yes, that solution is quite complex, but the problem itself has no simple solution. (Except: "stop using functions which are not intended to be used outside the kernel").

... write a self-answered Q&A post explaining all possible approaches under different scenarios

While I am agree about needing of single question on this problem, I don't think it needs a single answer. E.g. canonical question for undefined reference error has many answers written by different authors.

5
  • 1
    It's true, the question you link seems ok, but it talks about a particular symbol. Are you suggesting to change its title (and maybe the body a little bit) in order to make it the canonical question for this? It also only covers "recent kernels that do not support kallsyms_lookup_name". I was trying to find (or write) a canonical Q&A that at least covered both cases (pre/post kallsyms_* functions being unexported). Jun 15, 2022 at 19:38
  • Yes, sys_call_table can be edited out from the question's title too. Noting it in the question's body provides a non-desired detail (the problem about syscall hooking is even more controversial than using non-exported symbols), but otherwise even the original question doesn't look like about syscall hooking only.
    – Tsyvarev
    Jun 15, 2022 at 19:49
  • Hmm, do you really want to cover kallsyms_* approaches too? I understand that there are many distros (even production ones) which use older kernels, but writing a new answer for that case doesn't look very useful. In any case, even if the question is stated about kernels with non-exported kallsyms functionality, nothing prevents to write an answer which uses that functionality. Some people could downvote that answer as "not corresponded to the question", but I don't find such downvotes as very important.
    – Tsyvarev
    Jun 15, 2022 at 20:02
  • Well I guess that mentioning the kallsyms_* approach in my existing answer with a link to another decent answer on the topic wouldn't hurt. I agree that we don't really need a new answer covering that. Jun 15, 2022 at 20:22
  • I went ahead and modified the title of the question as you suggest, also adding more information to my already existing answer. Seems like a decent canonical question for future questions about this. The question title is a bit long, but seems ok to me, feel free to improve it if you wish. Jun 15, 2022 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .