Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
KSYMS(4)	       FreeBSD Kernel Interfaces Manual		      KSYMS(4)

     ksyms -- kernel symbol table interface

     device ksyms

     The /dev/ksyms character device provides a	read-only interface to a snap-
     shot of the kernel	symbol table.  The in-kernel symbol manager is
     designed to be able to handle many	types of symbols tables, however, only
     elf(5) symbol tables are supported	by this	device.	 The ELF format	image
     contains two sections: a symbol table and a corresponding string table.

	   Symbol Table
		   The SYMTAB section contains the symbol table	entries
		   present in the current running kernel, including the	symbol
		   table entries of any	loaded modules.	The symbols are
		   ordered by the kernel module	load time starting with	kernel
		   file	symbols	first, followed	by the first loaded module's
		   symbols and so on.

	   String Table
		   The STRTAB section contains the symbol name strings from
		   the kernel and any loaded modules that the symbol table
		   entries reference.

     Elf formated symbol table data read from the /dev/ksyms file represents
     the state of the kernel at	the time when the device is opened.  Since
     /dev/ksyms	has no text or data, most of the fields	are initialized	to
     NULL.  The	ksyms driver does not block the	loading	or unloading of	mod-
     ules into the kernel while	the /dev/ksyms file is open but	may contain
     stale data.

     The ioctl(2) command codes	below are defined in <sys/ksyms.h>.

     The (third) argument to the ioctl(2) should be a pointer to the type

	   KIOCGSIZE (size_t)
		   Returns the total size of the current symbol	table.	This
		   can be used when allocating a buffer	to make	a copy of the
		   kernel symbol table.

	   KIOCGADDR (void *)
		   Returns the address of the kernel symbol table mapped in
		   the process memory.


     An	open(2)	of /dev/ksyms will fail	if:

     [EBUSY]		The device is already open.  A process must close
			/dev/ksyms before it can be opened again.

     [ENOMEM]		There is a resource shortage in	the kernel.

     [ENXIO]		The driver was unsuccessful in creating	a snapshot of
			the kernel symbol table.  This may occur if the	kernel
			was in the process of loading or unloading a module.

     ioctl(2), nlist(3), elf(5), kldload(8)

     A ksyms device exists in many different operating systems.	 This imple-
     mentation is similar in function to the Solaris and NetBSD	ksyms driver.

     The ksyms driver first appeared in	FreeBSD	8.0 to support lockstat(1).

     Because files can be dynamically linked into the kernel at	any time the
     symbol information	can vary.  When	you open the /dev/ksyms	file, you have
     access to an ELF image which represents a snapshot	of the state of	the
     kernel symbol information at that instant in time.	Keeping	the device
     open does not block the loading or	unloading of kernel modules.  To get a
     new snapshot you must close and re-open the device.

     A process is only allowed to open the /dev/ksyms file once	at a time.
     The process must close the	/dev/ksyms before it is	allowed	to open	it

     The ksyms driver uses the calling process'	memory address space to	store
     the snapshot.  ioctl(2) can be used to get	the memory address where the
     symbol table is stored to save kernel memory.  mmap(2) may	also be	used
     but it will map it	to another address.

     The ksyms driver was written by Stacey Son	<>.

FreeBSD	11.1			 April 5, 2009			  FreeBSD 11.1


Want to link to this manual page? Use this URL:

home | help