Question

What is /proc/ksyms and /proc/kallsyms, and why is it mapped into a processes address space? What purpose does it serve? Is it used in context switching of the kernel during a system call?

Answer 1

The Solaris manpage for ksyms(7d) explains this. The data is informative-only, the kernel exposes its currently-used symbol table to kernel debuggers and/or the kernel module loader this way, through /dev/ksyms.

Linux does the same through /proc/kallsyms; /proc/ksyms – if present – is a “traditional” file presenting a subset of the same data (i.e. it’s deprecated).

The difference, as usual for Linux/Solaris, is that the Linux version presents text while the Solaris one is binary. You can run nm /dev/ksyms on the Solaris one to get the same type of output you get from cat /proc/kallsyms on Linux.