1.\" Copyright (c) 2008-2009 Stacey Son <sson@FreeBSD.org> 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" $FreeBSD$ 29.\" 30.Dd April 5, 2009 31.Dt KSYMS 4 32.Os 33.Sh NAME 34.Nm ksyms 35.Nd kernel symbol table interface 36.Sh SYNOPSIS 37.Cd "device ksyms" 38.Sh DESCRIPTION 39The 40.Pa /dev/ksyms 41character device provides a read-only interface to a snapshot of the kernel 42symbol table. The in-kernel symbol manager is designed to be able to handle 43many types of symbols tables, however, only 44.Xr elf 5 45symbol tables are supported by this device. The ELF format image contains two 46sections: a symbol table and a corresponding string table. 47.Bl -tag -width indent -offset indent 48.It Dv Symbol Table 49The SYMTAB section contains the symbol table entries present in the current 50running kernel, including the symbol table entries of any loaded modules. The 51symbols are ordered by the kernel module load time starting with kernel file 52symbols first, followed by the first loaded module's symbols and so on. 53.It Dv String Table 54The STRTAB section contains the symbol name strings from the kernel and any 55loaded modules that the symbol table entries reference. 56.El 57.Pp 58Elf formatted symbol table data read from the 59.Pa /dev/ksyms 60file represents the state of the kernel at the time when the device is opened. 61Since 62.Pa /dev/ksyms 63has no text or data, most of the fields are initialized to NULL. 64The 65.Nm 66driver does not block the loading or unloading of modules into the kernel 67while the 68.Pa /dev/ksyms 69file is open but may contain stale data. 70.Sh IOCTLS 71The 72.Xr ioctl 2 73command codes below are defined in 74.Aq Pa sys/ksyms.h . 75.Pp 76The (third) argument to the 77.Xr ioctl 2 78should be a pointer to the type indicated. 79.Bl -tag -width indent -offset indent 80.It Dv KIOCGSIZE (size_t) 81Returns the total size of the current symbol table. 82This can be used when allocating a buffer to make a copy of 83the kernel symbol table. 84.It Dv KIOCGADDR (void *) 85Returns the address of the kernel symbol table mapped in 86the process memory. 87.El 88.Sh FILES 89.Bl -tag -width /dev/ksymsX 90.It Pa /dev/ksyms 91.El 92.Sh ERRORS 93An 94.Xr open 2 95of 96.Pa /dev/ksyms 97will fail if: 98.Bl -tag -width Er 99.It Bq Er EBUSY 100The device is already open. A process must close 101.Pa /dev/ksyms 102before it can be opened again. 103.It Bq Er ENOMEM 104There is a resource shortage in the kernel. 105.It Bq Er ENXIO 106The driver was unsuccessful in creating a snapshot of the kernel symbol 107table. This may occur if the kernel was in the process of loading or 108unloading a module. 109.El 110.Sh SEE ALSO 111.Xr ioctl 2 , 112.Xr nlist 3 , 113.Xr elf 5 , 114.Xr kldload 8 115.Sh HISTORY 116A 117.Nm 118device exists in many different operating systems. 119This implementation is similar in function to the Solaris and NetBSD 120.Nm 121driver. 122.Pp 123The 124.Nm 125driver first appeared in 126.Fx 8.0 127to support 128.Xr lockstat 1 . 129.Sh AUTHORS 130The 131.Nm 132driver was written by 133.An Stacey Son Aq Mt sson@FreeBSD.org . 134.Sh BUGS 135Because files can be dynamically linked into the kernel at any time the symbol 136information can vary. When you open the 137.Pa /dev/ksyms 138file, you have access to an ELF image which represents a snapshot of the state of the kernel symbol information at that instant in time. Keeping the device open does not block the loading or unloading of kernel modules. To get a new snapshot you must close and re-open the device. 139.Pp 140A process is only allowed to open the 141.Pa /dev/ksyms 142file once at a time. The process must close the 143.Pa /dev/ksyms 144before it is allowed to open it again. 145.Pp 146The 147.Nm 148driver uses the calling process' memory address space to store the snapshot. 149.Xr ioctl 2 150can be used to get the memory address where the symbol table is stored to 151save kernel memory. 152.Xr mmap 2 153may also be used but it will map it to another address. 154