0

When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64:

00000000000228c0 D softnet_data
0000000000022a80 d rt_uncached_list
0000000000022ac0 d rt6_uncached_list
0000000000023000 d kvm_apic_eoi
0000000000023040 d steal_time
0000000000023080 d apf_reason
0000000000024000 D __per_cpu_end
0000000001000000 A phys_startup_64
ffffffff81000000 T _stext
ffffffff81000000 T _text
ffffffff81000000 T startup_64
ffffffff81000030 T secondary_startup_64
ffffffff810000e0 T verify_cpu
ffffffff810001e0 T start_cpu0
ffffffff810001f0 T __startup_64
ffffffff810003f0 T pvh_start_xen

I know that after __per_cpu_end there are some PCI devices and understand even root user wouldn't have full access due to security reasons, but what are there any switches or ways to recompile kernel to learn about this on live system, using live addresses and devices? What exacts kinds of memory ranges are reserved and for what particular reasons ?

1

Your System.map file contains virtual addresses of static symbols of the table. It is not a physical memory map of your system. The virtual memory space is not contiguous and can have large holes in it, the specific layout depends on choices made by the kernel developers. On x86_64 bit linux, negative addresses (i.e. those with the high bits set, such as 0xffffffff81000000) are reserved by the kernel for kernel mode. Check out the Linux x86 memory map for more information on how the kernel lays out its virtual memory space.

If you want more information on what's where in the kernel, the kernel exposes its symbol table to the root user if it's compiled with the KALLSYMS option in /proc/kallsyms. There's a detailed explanation of the difference between /proc/kallsyms and System.map in this question.

Finally, if you are interested in the physical memory map of the system, that is provided by the BIOS or UEFI to the system on boot. Your kernel logs this to the kernel message buffer (which you can query using dmesg) pretty early on in the boot:

[    0.000000] BIOS-provided physical RAM map:
[    0.000000]  BIOS-e820: 0000000000000000 - 0000000000098c00 (usable)
[    0.000000]  BIOS-e820: 0000000000098c00 - 00000000000a0000 (reserved)
[    0.000000]  BIOS-e820: 00000000000e6000 - 0000000000100000 (reserved)
[    0.000000]  BIOS-e820: 0000000000100000 - 00000000bfea0000 (usable)
[    0.000000]  BIOS-e820: 00000000bfeae000 - 00000000bfeb0000 type 9
[    0.000000]  BIOS-e820: 00000000bfeb0000 - 00000000bfec0000 (ACPI data)
[    0.000000]  BIOS-e820: 00000000bfec0000 - 00000000bfef0000 (ACPI NVS)
[    0.000000]  BIOS-e820: 00000000bfef0000 - 00000000c0000000 (reserved)
[    0.000000]  BIOS-e820: 00000000ffc00000 - 0000000100000000 (reserved)
[    0.000000]  BIOS-e820: 0000000100000000 - 0000000c40000000 (usable)

You can find this information at runtime in /sys/firmware/memmap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.