Messages in this thread | | | Date | Fri, 14 Mar 2008 09:00:49 -0700 | From | Arjan van de Ven <> | Subject | Re: 2.6.22.6 - Discrepancy between running and on-disk kernels |
| |
On Fri, 14 Mar 2008 10:51:43 -0400 Yan <rottled@gmail.com> wrote:
> Hello, > > I have been trying to compare the code from the on-disk compressed > kernel that was booted and the running kernel extracted > from /dev/kmem. I extracted the kernel's code from the disk image by > stripping the head.S and similar and gunzipping it, and extracted the > kernel from /dev/kmem by reading data between _text and _etext symbol > offsets. > > I then ran both through a disassembler and diff'ed the outputs. > Predictably, the disassembly was similar, but not identical. Some > instructions (e.g. bts) had a 'lock' prefix, where as others had a > 'nop' in its place. > > There were other differences with some instructions like mfence. > Everything else matched just fine, the differences were mostly in > memory-referencing instructions. > > My question is, what can be changing the kernel between being on > static storage and being loaded?
the kernel code is self-patching, it gets modified to match your system during boot time. So you cannot assume that the kernel on disk and the kernel in memory are identical. (Same goes for modules)
| |