KSYMS(4)

📦
version 15.1 · 3 versions
, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

✨ KSYMS(4) ✨

okay so bestie, listen up — this is the manual page for ksyms, which is a kernel symbol table interface, and honestly it's giving "behind-the-scenes magic" energy and I'm obsessed 💅✨

🌸 SYNOPSIS 🌸

device ksyms

literally that's it, that's the whole vibe. slay.

💖 DESCRIPTION 💖

okay so the /dev/ksyms character device is like, a read-only window into a snapshot of the kernel symbol table. the in-kernel symbol manager is designed to be able to handle many types of symbol tables, but ngl, only elf(5) symbol tables are supported by this device. the ELF format image contains two sections: a symbol table and a corresponding string table. iconic behavior honestly 🦋

🎀 Symbol Table 🎀

the SYMTAB section contains the symbol table entries present in the current running kernel, including the symbol table entries of any loaded modules. the symbols are ordered by the kernel module load time starting with kernel file symbols first, followed by the first loaded module's symbols and so on. it's giving "chronological order realness" and I respect it 💜

🌈 String Table 🌈

the STRTAB section contains the symbol name strings from the kernel and any loaded modules that the symbol table entries reference. periodt. that's its whole job and it does it flawlessly ✨

Elf formatted symbol table data read from the /dev/ksyms file represents the state of the kernel at the time when the device is opened. since /dev/ksyms has no text or data, most of the fields are initialized to NULL. the ksyms driver does not block the loading or unloading of modules into the kernel while the /dev/ksyms file is open but may contain stale data. so like, it's a snapshot, not a live feed — important distinction bestie 🫶

🧚 FILES 🧚

  • /dev/ksyms

that's the one and only file involved. she's a solo act and she's thriving 👑

💀 ERRORS 💀

okay so an open(2) of /dev/ksyms will fail if:

  • [EBUSY] — the device is already open. a process must close /dev/ksyms before it can be opened again. no double-dipping, bestie 😭
  • [ENOMEM] — there is a resource shortage in the kernel. the kernel is going through it rn, give it a sec 💀
  • [ENXIO] — the driver was unsuccessful in creating a snapshot of the kernel symbol table. this may occur if the kernel was in the process of loading or unloading a module. like when you try to take a selfie mid-blink, the timing was just off 🙈

🌟 SEE ALSO 🌟

go read those too, iykyk 📚✨

🔥 HISTORY 🔥

a ksyms device exists in many different operating systems. this implementation is similar in function to the Solaris and NetBSD ksyms driver. so like, it's got lore and it's got range 🌍💅

the ksyms driver first appeared in FreeBSD 8.0 to support lockstat(1). a legend was born and we're all just living in her shadow 👑

🫶 AUTHORS 🫶

the ksyms driver was written by Stacey Son <sson@FreeBSD.org>. thank you for your service, king/queen/royalty 🎀✨

😭 BUGS 😭

okay so because files can be dynamically linked into the kernel at any time, the symbol information can vary. when you open the /dev/ksyms file, you have access to an ELF image which represents a snapshot of the state of the kernel symbol information at that instant in time. keeping the device open does not block the loading or unloading of kernel modules. to get a new snapshot you must close and re-open the device. so like, it's not a live stream, it's a screenshot, and if you want a new one you gotta refresh manually. no cap 🧚

a process is only allowed to open the /dev/ksyms file once at a time. the process must close the /dev/ksyms before it is allowed to open it again. one at a time bestie, we're not savages 💀

🌸💖✨ and that's the whole manual page, no crumbs left! this page was brought to you by Debian, dated August 2, 2017 — a classic, an icon, a moment in time. mwah! 💋🌈

📦 where this page comes from