what is __ksymtab? in linux kernel -

when cat 'proc/kallsyms' or 'system.map' symbols this

.... c033718c t nf_hook_slow c04ca284 r __ksymtab_nf_hook_slow c04ca28c r __ksymtab_nf_hooks c04d24a0 r __kcrctab_nf_hook_slow c04d24a4 r __kcrctab_nf_hooks c04e9122 r __kstrtab_nf_hook_slow c04e9179 r __kstrtab_nf_hooks c054d854 d nf_hooks c0571ca0 d nf_hook_mutex .... 

1. what meaning of t, r, d, d stuffs?
2. i can find symbols in kernel source export_symbol(...) there others prefixing __ksymtab... or __kstrtab... these?
3. is possible there symbols in system.map excluded in /proc/kallsyms? (assuming kernel compiled properly)
4. i have netfilter enabled linux kernel cant find symbol 'nf_hooks' there '__ksymtab_nf_hook'. there way address of nf_hooks using __ksymtab_nf_hook?
5. i see in linux source code export_symbol(nf_hook) cant find if 'cat /proc/kallsyms'. there typical reason this?

thank in advance.

1. the format similar of output of nm utility, see this page.

   to put simple, 't' denotes global (non-static not exported) function, 't' - function local compilation unit (i.e. static), 'd' - global data, 'd' - data local compilation unit. 'r' , 'r' - same 'd'/'d' read-only data.

2. these items special sections needed export symbols symbols used kernel modules.

   for each exported symbol, al least following defined export_symbol():

   • __kstrtab_<symbol_name> - name of symbol string
   • __ksymtab_<symbol_name> - structure information symbol: address, address of __kstrtab_<symbol_name>, etc.
   • __kcrctab_<symbol_name> - address of control sum (crc) of symbol - used, example, check if kernel or module provides same symbol needed given kernel module. if module requires symbol given name , crc , kernel provides symbol name different crc (e.g. if module compiled different kernel version), module loader refuse load kernel module (unless check disabled).

   take @ implementation of export_symbol() macro in linux/export.h details.

3. not sure have not encountered situation far when function ("text symbol") or variable ("data symbol") present in system.map not shown in /proc/kallsyms if kernel compiled , kallsyms enabled (config_kallsyms=y, config_kallsyms_all=y). if config_kallsyms_all=n, functions (to exact, symbols *.text sections) shown in /proc/kallsyms.

4. depends on kernel version. can take @ definition of export_symbol() kernel , find type __ksymtab_<symbol_name> variables are. in kernel 3.11, struct kernel_symbol defined in linux/export.h. having definition of struct , address, suppose, can address of symbol: struct kernel_symbol::value. haven't tried myself though.

   note, however, __ksymtab_nf_hook nf_hook not nf_hooks. name must match. nf_hooks , nf_hook different entities.

5. hard tell without seeing code , relevant part of /proc/kallsyms. maybe #ifdef'ed out , not compiled @ all, may there else.

   besides, nf_hooks data item might not show in /proc/kallsyms if config_kallsyms_all 'n'.