KSYMS(4)

💖 KSYMS(4) — the kernel symbol table interface, bestie 💖

okay so real talk, this is the ksyms page from section 4 of the Kernel Interfaces Manual — that's the "kernel interfaces" girlies section, and honestly? she's giving quiet main character energy. let's get into it 🦋

---

✨ NAME ✨

ksyms — kernel symbol table interface 💅

---

🌸 SYNOPSIS 🌸

device ksyms

that's it. that's the whole vibe. one line. iconic. ✨

---

💖 DESCRIPTION 💖

so the /dev/ksyms character device is a read-only window into a snapshot of the kernel symbol table 🫶. the in-kernel symbol manager was built to be flexible enough to handle many types of symbol tables, but ngl, this device only supports elf(5) symbol tables — that's the only one invited to the party 💀. the ELF format image it hands you contains two sections: a symbol table and a corresponding string table.

🎀 Symbol Table

the SYMTAB section has all the symbol table entries that are live in the currently running kernel, plus the symbol table entries of any loaded modules ✨. the symbols are ordered by kernel module load time — kernel file symbols come first, then the first loaded module's symbols, and so on down the line. very "first come, first served" of them 🫶

🧚 String Table

the STRTAB section is where the symbol name strings live — from the kernel and from any loaded modules that the symbol table entries point at 🦋

---

Elf formatted symbol table data that you read from /dev/ksyms represents the state of the kernel at the time when the device is opened ⏰. since /dev/ksyms has no text or data, most of the fields are initialized to NULL — yeah, mostly vibes and NULLs in there 🙈. the ksyms driver does not block modules from being loaded or unloaded while /dev/ksyms is open, but that means it may contain stale data. so like… the tea might be a little old by the time you sip it 😭

---

🗂️ FILES 🗂️

• /dev/ksyms

---

💀 ERRORS 💀

an open(2) of /dev/ksyms will fail if:

• [EBUSY] — the device is already open. a process must close /dev/ksyms before it can be opened again. one at a time, bestie, it's a single-occupancy situation 💅
• [ENOMEM] — there's a resource shortage in the kernel. no memory, no entry, sorry queen 😭
• [ENXIO] — the driver was unsuccessful in creating a snapshot of the kernel symbol table. this may happen if the kernel was in the process of loading or unloading a module. bad timing fr fr 🙈

---

👀 SEE ALSO 👀

nlist(3), elf(5), kldload(8)

---

📜 HISTORY 📜

a ksyms device exists in many different operating systems — she's a well-traveled icon 🌈. this implementation is similar in function to the Solaris and NetBSD ksyms driver.

the ksyms driver first appeared in FreeBSD 8.0 to support lockstat(1) ⭐. a whole legend born to help out another tool, we love a supportive bestie 🫶

---

👑 AUTHORS 👑

the ksyms driver was written by Stacey Son <sson@FreeBSD.org>. thank you for your service, queen 💜

---

🐛 BUGS 🐛

because files can be dynamically linked into the kernel at any time, the symbol information can vary 😵💫. when you open the /dev/ksyms file, you get access to an ELF image that represents a snapshot of the state of the kernel symbol information at that instant in time. keeping the device open does not block the loading or unloading of kernel modules. so if you want a new snapshot, you must close and re-open the device. no cap. 🔥

a process is only allowed to open the /dev/ksyms file once at a time. the process must close the /dev/ksyms before it is allowed to open it again. one girl at a time, that's the rule 💅

---

🫶 reminder bestie: read-only, one-open-at-a-time, snapshot-only, and no module-blocking. everything else is just vibes. iykyk ✨

---

this page came from Debian, dated August 2, 2017 — mwah, thanks for the lore drop, sending love to whoever typed it all those years ago 💖🌈✨