NAME¶
ksyms —
kernel symbol table
interface
SYNOPSIS¶
device ksyms
DESCRIPTION¶
The
/dev/ksyms character device provides a read-only interface
to a snapshot of the kernel symbol table. The in-kernel symbol manager is
designed to be able to handle many types of symbols tables, however, only
elf(5) symbol tables are supported by this device. The ELF
format image contains two sections: a symbol table and a corresponding string
table.
Symbol
Table
- The SYMTAB section contains the symbol table entries
present in the current running kernel, including the symbol table entries
of any loaded modules. The symbols are ordered by the kernel module load
time starting with kernel file symbols first, followed by the first loaded
module's symbols and so on.
String
Table
- The STRTAB section contains the symbol name strings from
the kernel and any loaded modules that the symbol table entries
reference.
Elf formated symbol table data read from the
/dev/ksyms file
represents the state of the kernel at the time when the device is opened.
Since
/dev/ksyms has no text or data, most of the fields are
initialized to NULL. The
ksyms driver does not block the
loading or unloading of modules into the kernel while the
/dev/ksyms file is open but may contain stale data.
IOCTLS¶
The
ioctl(2) command codes below are defined in
⟨
sys/ksyms.h⟩.
The (third) argument to the
ioctl(2) should be a pointer to
the type indicated.
KIOCGSIZE
(size_t)
- Returns the total size of the current symbol table. This
can be used when allocating a buffer to make a copy of the kernel symbol
table.
KIOCGADDR
(void *)
- Returns the address of the kernel symbol table mapped in
the process memory.
FILES¶
- /dev/ksyms
-
ERRORS¶
An
open(2) of
/dev/ksyms will fail if:
- [
EBUSY
]
- The device is already open. A process must close
/dev/ksyms before it can be opened again.
- [
ENOMEM
]
- There is a resource shortage in the kernel.
- [
ENXIO
]
- The driver was unsuccessful in creating a snapshot of the
kernel symbol table. This may occur if the kernel was in the process of
loading or unloading a module.
SEE ALSO¶
ioctl(2),
nlist(3),
elf(5),
kldload(8)
HISTORY¶
A
ksyms device exists in many different operating systems.
This implementation is similar in function to the Solaris and NetBSD
ksyms driver.
The
ksyms driver first appeared in
FreeBSD
8.0 to support
lockstat(1).
BUGS¶
Because files can be dynamically linked into the kernel at any time the symbol
information can vary. When you open the
/dev/ksyms file, you
have access to an ELF image which represents a snapshot of the state of the
kernel symbol information at that instant in time. Keeping the device open
does not block the loading or unloading of kernel modules. To get a new
snapshot you must close and re-open the device.
A process is only allowed to open the
/dev/ksyms file once at
a time. The process must close the
/dev/ksyms before it is
allowed to open it again.
The
ksyms driver uses the calling process' memory address
space to store the snapshot.
ioctl(2) can be used to get the
memory address where the symbol table is stored to save kernel memory.
mmap(2) may also be used but it will map it to another
address.
AUTHORS¶
The
ksyms driver was written by
Stacey
Son ⟨sson@freebsd.org⟩.