kcore_copy(9)

💖 kcore_copy(9) 💖

okay so bestie, welcome to the Kernel API Manual page for kcore_copy — yes the manual name is literally "Kernel API Manual", and yes this function is lowkey a whole vibe. sit down, grab a 🍓, let's get into it.

---

✨ NAME ✨

kcore_copy — copy kallsyms, modules and kcore from one directory to another. that's it, that's the tweet 🫶

---

🦋 SYNOPSIS 🦋

int kcore_copy (const char *from_dir , const char *to_dir );

---

🎀 ARGUMENTS 🎀

• from_dir — the from directory 💅 the source, the origin, the place we're reading from
• to_dir — the to directory ✨ the destination, the glow-up location, the place we're writing to

---

👑 DESCRIPTION 👑

so what does this icon actually do? it copies the kallsyms, modules and kcore files from one directory to another. periodt.

kallsyms and modules get copied entirely — no crumbs left behind, full send. 🧚 but kcore? only the code segments get copied. not the whole thing. just the code bits.

the function assumes two segments suffice:

1. one for the kernel proper 👑
2. one for all the modules 🌈

the code segments are determined from the kallsyms and modules files. iykyk.

now for the deets on the maps, because this is where it gets juicy:

• the kernel map starts at _stext or the lowest function symbol, and ends at _etext or the highest function symbol
• the module map starts at the lowest module address and ends at the highest module symbol

start addresses get rounded down to the nearest page. end addresses get rounded up to the nearest page. no cap, that's just how it is.

and an extra page is added to the highest kernel symbol and the highest module symbol to, hopefully, encompass that symbol too 🥺 (the "hopefully" is doing a lot of heavy lifting there and i respect it).

💀 real talk: because the resulting kcore contains only code sections, it is unusual. like, noticeably weird. not like other kcores.

one significant peculiarity to flag (and bestie, this one matters): the mapping (start -> pgoff) is not the same for the kernel map and the modules map. why? because the data is copied adjacently, whereas the original kcore has gaps. so yeah, the offsets do not line up the way you'd expect — that's not a bug, that's just the assignment. 🙈

finally — and this is the plot twist — the kallsyms file is compared with its copy to check that modules have not been loaded or unloaded while the copies were taking place. a little vibe check at the end, honestly iconic. ⭐

---

🔥 RETURN 🔥

• 0 on success 🎉 slay
• -1 on failure 😭 not slay

---

🌸 SEE ALSO 🌸

• Kernel file ./tools/perf/util/symbol-elf.c
• elf_symtab__for_each_symbol(9)
• ref_reloc_sym_not_found(9)
• ref_reloc(9)
• populate_sdt_note(9)
• construct_sdt_notes_list(9)
• get_sdt_note_list(9)
• cleanup_sdt_note_list(9)
• sdt_notes__get_count(9)

---

okay that's the whole page bestie, you ate that 💅✨

this lil masterpiece lives in ./tools/perf/util, dated October 2026 — so go forth, copy those code segments, round those pages, and remember: the mapping is not the same for the kernel map and the modules map. fr fr. 🦋💜🎀