||FreeBSD Library Functions Manual
kernel memory interface
Kernel Data Access Library (libkvm, -lkvm)
kvm library provides a uniform interface for
accessing kernel virtual memory images, including live systems and crash
dumps. Access to live systems is via
for some functions, and
other functions, while crash dumps can be examined via the core file generated
The interface behaves similarly in both cases. Memory can be read and written,
kernel symbol addresses can be looked up efficiently, and information about
user processes can be gathered.
The kvm interface was first introduced in SunOS. A considerable number of
programs have been developed that use this interface, making backward
compatibility highly desirable. In most respects, the Sun kvm interface is
consistent and clean. Accordingly, the generic portion of the interface (i.e.,
kvm_open() function is first called to
obtain a descriptor for all subsequent calls.
kvm_nlist()) has been incorporated into the
BSD interface. Indeed, many kvm applications (i.e.,
debuggers and statistical monitors) use only this subset of the interface.
The process interface was not kept. This is not a portability
issue since any code that manipulates processes is inherently machine
Finally, the Sun kvm error reporting semantics are poorly defined.
The library can be configured either to print errors to
stderr automatically, or to print no error messages
at all. In the latter case, the nature of the error cannot be determined. To
overcome this, the BSD interface includes a routine,
to return (not print out) the error message corresponding to the most recent
error condition on the given descriptor.
kvm library supports inspection of crash dumps from
non-native kernels. Only a limited subset of the kvm interface is supported
for these dumps. To inspect a crash dump of a non-native kernel, the caller
must provide a resolver function when opening a
kvm_open2(). In addition, the kvm
interface defines an integer type (kvaddr_t) that is
large enough to hold all valid addresses of all supported architectures. The
interface also defines a new namelist structure type (struct
kvm_nlist) for use with
kvm_nlist2(). To avoid
address truncation issues, the caller should use
in place of
kvm_read(), respectively. Finally, only a limited
subset of operations are supported for non-native crash dumps:
Visit the GSP FreeBSD Man Page Interface.
Output converted with ManDoc.