The kernel is dynamically configured. It loads kernel modules when necessary.
Because of this aspect of the system, the symbol information present in the
running system can vary from time to time, as kernel modules are loaded and
unloaded.
When you open the /dev/ksyms file, you have access
to an ELF image which represents a snapshot
of the state of the kernel symbol information at that instant in time. While
the /dev/ksyms file remains open, kernel module autounloading
is disabled, so that you are protected from the possibility of acquiring stale
symbol data. Note that new modules can still be loaded, however. If kernel
modules are loaded while you have the /dev/ksyms file
open, the snapshot held by you will not be updated. In order to have access
to the symbol information of the newly loaded modules, you must first close
and then reopen the /dev/ksyms file. Be aware that the
size of the /dev/ksyms file will have changed. You will
need to use the fstat() function (see stat(2)) to determine the new size of the file.
Avoid keeping the /dev/ksyms file open for extended
periods of time, either by using kvm_open(3KVM)
of the default namelist file or with a direct open. There are two reasons
why you should not hold /dev/ksyms open. First, the system's
ability to dynamically configure itself is partially disabled by the locking
down of loaded modules. Second, the snapshot of symbol information held by
you will not reflect the symbol information of modules loaded after your initial
open of /dev/ksyms.
Note that the ksyms driver is a loadable module,
and that the kernel driver modules are only loaded during an open system call.
Thus it is possible to run stat(2)
on the /dev/ksyms file without causing the ksyms driver to be loaded. In this case, the file size returned
is UNKNOWN_SIZE. A solution for this behavior is to first
open the /dev/ksyms file, causing the ksyms
driver to be loaded (if necessary). You can then use the file descriptor from
this open in a fstat() system call to get the file's
size.
|