SlideShare a Scribd company logo
Anatomy of the Loadable
Kernel Module (LKM)
Adrian Huang
Agenda
• From ‘insmod’ command
• Call path for LKM’s init function
• ‘.gnu.linkonce.this_module’ section
• Deep Dive into call path
• modinfo
Note
• Kernel source: 5.10
• Mainly focus on the ‘init’ function call path
From `insmod` command
Hello World Kernel Module strace
finit_module() system call loads an ELF image into kernel space
From `insmod` command
Hello World Kernel Module strace
finit_module() system call loads an ELF image into kernel space
finit_module()
• Load an ELF image into kernel space
• Perform symbol relocations
• Initialize module parameters to values
• Run the module’s init function
Call path for LKM’s init function
finit_module
load_module
do_init_module
do_one_initcall(mod->init)
mod->init();
Analysis
• Key: mod->init()
• How to assign the address of mod->init()?
kernel_read_file_from_fd
elf_header_check
setup_load_info
blacklisted(info->name)?
cleanup & return
module_sig_check
Y
N
mod = layout_and_allocate(info, ..)
rewrite_section_headers
apply_relocations
‘.gnu.linkonce.this_module’ section (1/6)
‘.gnu.linkonce.this_module’ section (2/6)
‘.gnu.linkonce.this_module’ section (3/6)
‘.gnu.linkonce.this_module’ section (4/6)
User Space Tool – modpost: Generate a file ‘module_name.mod.c’ when
compiling your kernel module
‘.gnu.linkonce.this_module’ section - Where is
‘init_module()’ definition? (5/6)
Hello World Kernel Module module_init() macro
__init macro
‘.gnu.linkonce.this_module’ section (6/6)
Deep Dive into call path (1/7)
finit_module
load_module
do_init_module
do_one_initcall(mod->init)
mod->init();
kernel_read_file_from_fd
elf_header_check
setup_load_info
blacklisted(info->name)?
cleanup & return
module_sig_check
Y
N
mod = layout_and_allocate(info, ..)
rewrite_section_headers
apply_relocations
ELF Header
Section 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section n
Section Header 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section Header n
load_info
name
mod
hdr
len
sechdrs
secstrings
strtab
A (kernel addr)
A + e_shoff
finit_module
load_module
do_init_module
do_one_initcall(mod->init)
mod->init();
kernel_read_file_from_fd
elf_header_check
setup_load_info
blacklisted(info->name)?
cleanup & return
module_sig_check
Y
N
mod = layout_and_allocate(info, ..)
rewrite_section_headers
apply_relocations
ELF Header
Section 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section n
Section Header 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section Header n
load_info
name
mod
hdr
len
sechdrs
secstrings
strtab
A (kernel addr)
A + e_shoff
Deep Dive into call path (2/7)
finit_module
load_module
kernel_read_file_from_fd
elf_header_check
setup_load_info
blacklisted(info->name)?
cleanup & return
module_sig_check
Y
N
rewrite_section_headers
ELF Header
Section 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section n
Section Header 1
.init.text
.exit.text
.gnu.linkonce.this_module
…
Section Header n
load_info
name
mod
hdr
len
sechdrs
secstrings
strtab
A (kernel addr)
A + e_shoff
for (i = 1; i < info->hdr->e_shnum; i++)
Elf_Shdr *shdr = &info->sechdrs[i];
shdr->sh_addr = (size_t)info->hdr +
shdr->sh_offset;
Deep Dive into call path (3/7)
Update sh_addr (virtual address) of each section header table based on
address ‘A’
Update sh_addr (virtual address) of each section header table
based on core/init section memory allocation
module
…
init
core_layout
init_layout
exit
…
module_layout
base
size
text_size
ro_size
ro_after_init_size
.init.text
.symtab
.strtab
Init section memory allocation
0xffffffffc0819000
0xffffffffc081a000
0xffffffffc081a000
module_layout
base
size
text_size
ro_size
ro_after_init_size
Deep Dive into call path (4/7)
module
…
init
core_layout
init_layout
exit
…
module_layout
base
size
text_size
ro_size
ro_after_init_size
.symtab
.strtab
Init section memory allocation
0xffffffffc0819000
0xffffffffc081a000
0xffffffffc081a000
module_layout
base
size
text_size
ro_size
ro_after_init_size
init_module
.init.text
Deep Dive into call path (5/7)
module
…
init
core_layout
init_layout
exit
…
module_layout
base
size
text_size
ro_size
ro_after_init_size
.symtab
.strtab
Init section memory allocation
0xffffffffc0819000
0xffffffffc081a000
0xffffffffc081a000
module_layout
base
size
text_size
ro_size
ro_after_init_size
init_module
.init.text
Deep Dive into call path (6/7)
Deep Dive into call path (7/7)
finit_module
load_module
do_init_module
do_one_initcall(mod->init)
mod->init();
kernel_read_file_from_fd
elf_header_check
setup_load_info
blacklisted(info->name)?
cleanup & return
module_sig_check
Y
N
mod = layout_and_allocate(info, ..)
rewrite_section_headers
apply_relocations
free & cleanup init_layout
Free memory space of init_layout after calling mod->init()
modinfo
Key=Value format in .modinfo section

More Related Content

What's hot

Linux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKBLinux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKB
shimosawa
 
Physical Memory Models.pdf
Physical Memory Models.pdfPhysical Memory Models.pdf
Physical Memory Models.pdf
Adrian Huang
 
malloc & vmalloc in Linux
malloc & vmalloc in Linuxmalloc & vmalloc in Linux
malloc & vmalloc in Linux
Adrian Huang
 
Process Address Space: The way to create virtual address (page table) of user...
Process Address Space: The way to create virtual address (page table) of user...Process Address Space: The way to create virtual address (page table) of user...
Process Address Space: The way to create virtual address (page table) of user...
Adrian Huang
 
Linux Memory Management
Linux Memory ManagementLinux Memory Management
Linux Memory ManagementNi Zo-Ma
 
Reverse Mapping (rmap) in Linux Kernel
Reverse Mapping (rmap) in Linux KernelReverse Mapping (rmap) in Linux Kernel
Reverse Mapping (rmap) in Linux Kernel
Adrian Huang
 
spinlock.pdf
spinlock.pdfspinlock.pdf
spinlock.pdf
Adrian Huang
 
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven RostedtKernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
Anne Nicolas
 
Linux Kernel - Virtual File System
Linux Kernel - Virtual File SystemLinux Kernel - Virtual File System
Linux Kernel - Virtual File System
Adrian Huang
 
Linux Initialization Process (2)
Linux Initialization Process (2)Linux Initialization Process (2)
Linux Initialization Process (2)
shimosawa
 
semaphore & mutex.pdf
semaphore & mutex.pdfsemaphore & mutex.pdf
semaphore & mutex.pdf
Adrian Huang
 
Linux Performance Profiling and Monitoring
Linux Performance Profiling and MonitoringLinux Performance Profiling and Monitoring
Linux Performance Profiling and Monitoring
Georg Schönberger
 
Physical Memory Management.pdf
Physical Memory Management.pdfPhysical Memory Management.pdf
Physical Memory Management.pdf
Adrian Huang
 
Linux kernel debugging
Linux kernel debuggingLinux kernel debugging
Linux kernel debugging
libfetion
 
Linux Internals - Interview essentials 4.0
Linux Internals - Interview essentials 4.0Linux Internals - Interview essentials 4.0
Linux Internals - Interview essentials 4.0
Emertxe Information Technologies Pvt Ltd
 
Linux Initialization Process (1)
Linux Initialization Process (1)Linux Initialization Process (1)
Linux Initialization Process (1)
shimosawa
 
UM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of SoftwareUM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of Software
Brendan Gregg
 
Linux memory-management-kamal
Linux memory-management-kamalLinux memory-management-kamal
Linux memory-management-kamal
Kamal Maiti
 
Memory Management with Page Folios
Memory Management with Page FoliosMemory Management with Page Folios
Memory Management with Page Folios
Adrian Huang
 
Arm device tree and linux device drivers
Arm device tree and linux device driversArm device tree and linux device drivers
Arm device tree and linux device drivers
Houcheng Lin
 

What's hot (20)

Linux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKBLinux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKB
 
Physical Memory Models.pdf
Physical Memory Models.pdfPhysical Memory Models.pdf
Physical Memory Models.pdf
 
malloc & vmalloc in Linux
malloc & vmalloc in Linuxmalloc & vmalloc in Linux
malloc & vmalloc in Linux
 
Process Address Space: The way to create virtual address (page table) of user...
Process Address Space: The way to create virtual address (page table) of user...Process Address Space: The way to create virtual address (page table) of user...
Process Address Space: The way to create virtual address (page table) of user...
 
Linux Memory Management
Linux Memory ManagementLinux Memory Management
Linux Memory Management
 
Reverse Mapping (rmap) in Linux Kernel
Reverse Mapping (rmap) in Linux KernelReverse Mapping (rmap) in Linux Kernel
Reverse Mapping (rmap) in Linux Kernel
 
spinlock.pdf
spinlock.pdfspinlock.pdf
spinlock.pdf
 
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven RostedtKernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
Kernel Recipes 2017 - Understanding the Linux kernel via ftrace - Steven Rostedt
 
Linux Kernel - Virtual File System
Linux Kernel - Virtual File SystemLinux Kernel - Virtual File System
Linux Kernel - Virtual File System
 
Linux Initialization Process (2)
Linux Initialization Process (2)Linux Initialization Process (2)
Linux Initialization Process (2)
 
semaphore & mutex.pdf
semaphore & mutex.pdfsemaphore & mutex.pdf
semaphore & mutex.pdf
 
Linux Performance Profiling and Monitoring
Linux Performance Profiling and MonitoringLinux Performance Profiling and Monitoring
Linux Performance Profiling and Monitoring
 
Physical Memory Management.pdf
Physical Memory Management.pdfPhysical Memory Management.pdf
Physical Memory Management.pdf
 
Linux kernel debugging
Linux kernel debuggingLinux kernel debugging
Linux kernel debugging
 
Linux Internals - Interview essentials 4.0
Linux Internals - Interview essentials 4.0Linux Internals - Interview essentials 4.0
Linux Internals - Interview essentials 4.0
 
Linux Initialization Process (1)
Linux Initialization Process (1)Linux Initialization Process (1)
Linux Initialization Process (1)
 
UM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of SoftwareUM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of Software
 
Linux memory-management-kamal
Linux memory-management-kamalLinux memory-management-kamal
Linux memory-management-kamal
 
Memory Management with Page Folios
Memory Management with Page FoliosMemory Management with Page Folios
Memory Management with Page Folios
 
Arm device tree and linux device drivers
Arm device tree and linux device driversArm device tree and linux device drivers
Arm device tree and linux device drivers
 

Anatomy of the loadable kernel module (lkm)