KSYMS(4D) Devices KSYMS(4D)

NAME

ksyms - kernel symbols

SYNOPSIS

/dev/ksyms

DESCRIPTION

The file /dev/ksyms is a character special file that allows read-
only access to an ELF format image containing two sections: a symbol
table and a corresponding string table. The contents of the symbol
table reflect the symbol state of the currently running kernel. You
can determine the size of the image with the fstat() system call.
The recommended method for accessing the /dev/ksyms file is by using
the ELF access library. See elf(3ELF) for details. If you are not
familiar with ELF format, see a.out(5).


/dev/ksyms is an executable for the processor on which you are
accessing it. It contains ELF program headers which describe the
text and data segment(s) in kernel memory. Since /dev/ksyms has no
text or data, the fields specific to file attributes are initialized
to NULL. The remaining fields describe the text or data segment(s) in
kernel memory.

Symbol table
The SYMTAB section contains the symbol table entries
present in the currently running kernel. This section
is ordered as defined by the ELF definition with
locally-defined symbols first, followed by globally-
defined symbols. Within symbol type, the symbols are
ordered by kernel module load time. For example, the
kernel file symbols are first, followed by the first
module's symbols, and so on, ending with the symbols
from the last module loaded.

The section header index (st_shndx) field of each
symbol entry in the symbol table is set to SHN_ABS,
because any necessary symbol relocations are
performed by the kernel link editor at module load
time.


String table
The STRTAB section contains the symbol name strings
that the symbol table entries reference.

SEE ALSO

stat(2), elf(3ELF), kvm_open(3KVM), mem(4D), a.out(5), kernel(8)

WARNINGS

The kernel is dynamically configured. It loads kernel modules when
necessary. Because of this aspect of the system, the symbol
information present in the running system can vary from time to time,
as kernel modules are loaded and unloaded.


When you open the /dev/ksyms file, you have access to an ELF image
which represents a snapshot of the state of the kernel symbol
information at that instant in time. While the /dev/ksyms file
remains open, kernel module autounloading is disabled, so that you
are protected from the possibility of acquiring stale symbol data.
Note that new modules can still be loaded, however. If kernel modules
are loaded while you have the /dev/ksyms file open, the snapshot held
by you will not be updated. In order to have access to the symbol
information of the newly loaded modules, you must first close and
then reopen the /dev/ksyms file. Be aware that the size of the
/dev/ksyms file will have changed. You will need to use the fstat()
function (see stat(2)) to determine the new size of the file.


Avoid keeping the /dev/ksyms file open for extended periods of time,
either by using kvm_open(3KVM) of the default namelist file or with a
direct open. There are two reasons why you should not hold
/dev/ksyms open. First, the system's ability to dynamically configure
itself is partially disabled by the locking down of loaded modules.
Second, the snapshot of symbol information held by you will not
reflect the symbol information of modules loaded after your initial
open of /dev/ksyms.


Note that the ksyms driver is a loadable module, and that the kernel
driver modules are only loaded during an open system call. Thus it is
possible to run stat(2) on the /dev/ksyms file without causing the
ksyms driver to be loaded. In this case, the file size returned is
UNKNOWN_SIZE. A solution for this behavior is to first open the
/dev/ksyms file, causing the ksyms driver to be loaded (if
necessary). You can then use the file descriptor from this open in a
fstat() system call to get the file's size.

NOTES

The kernel virtual memory access library (libkvm) routines use
/dev/ksyms as the default namelist file. See kvm_open(3KVM) for
details.

December 11, 2000 KSYMS(4D)