KVM(3)

💅 KVM(3) — kernel memory interface

okay bestie, so this is the kvm page from the Library Functions Manual, and honestly? it's giving "backstage pass to the kernel" ✨

---

🫶 LIBRARY

Kernel Data Access Library — that's libkvm, and you link it with -lkvm. 🎀

---

🌸 DESCRIPTION

The kvm library hands you one uniform, consistent interface for peeking at kernel virtual memory images — and that includes both live systems and crash dumps. no cap, it does both the same way 💖

So like, how do you actually get in?

• live systems → via sysctl(3) for some functions, and via mem(4) and kmem(4) for other functions
• crash dumps → you can examine those via the core file that savecore(8) generates

and the whole point is that the interface behaves similarly in both cases. genuinely iconic design choice.

What can you actually do with it? 👑

• read memory ✅
• write memory ✅
• look up kernel symbol addresses efficiently ✅
• gather information about user processes ✅

⭐ tiny but important detail: you call kvm_open() first, bestie. that gives you the descriptor you need for literally every subsequent call. no descriptor, no vibes.

---

🌈 COMPATIBILITY

storytime 🧚 the kvm interface was first introduced in SunOS. and because a considerable number of programs have been written against it, backward compatibility is highkey highly desirable. the way that people depend on this stuff… 😭

In most respects, the Sun kvm interface is consistent and clean — ate, no notes. So the generic portion of the interface got incorporated into the BSD interface, and that generic portion is:

• kvm_open()
• kvm_close()
• kvm_read()
• kvm_write()
• kvm_nlist()

and honestly? many kvm applications (think debuggers and statistical monitors) use only this subset. so if you learn these five, you're already kind of the main character 💅

---

The process interface was not kept. and before you come for it — this is not a portability issue. any code that manipulates processes is inherently machine dependent. that's just facts. 🙈

---

Finally, the Sun kvm error reporting semantics are poorly defined 💀 and the original setup had exactly two moods:

1. print errors to stderr automatically, or
2. print no error messages at all — in which case the nature of the error cannot be determined 😭

to overcome this (because leaving you with mystery errors is not it), the BSD interface includes a routine, kvm_geterr(3), that returns — not prints out — the error message corresponding to the most recent error condition on the given descriptor. obsessed. 🫶

---

🦋 CROSS DEBUGGING

okay this part is genuinely cool: the kvm library supports inspection of crash dumps from non-native kernels. 👑

💀 caution bestie: only a limited subset of the kvm interface is supported for these dumps. don't come in expecting the whole menu.

To inspect a crash dump of a non-native kernel, the caller must provide a resolver function when opening a descriptor via kvm_open2(). that's not optional, that's the entry fee.

Also, the interface defines:

• an integer type — kvaddr_t — that's large enough to hold all valid addresses of all supported architectures ✨
• a new namelist structure type — struct kvm_nlist — for use with kvm_nlist2()

And to avoid address truncation issues (we don't do truncation in this house), the caller should use kvm_nlist2() and kvm_read2() in place of kvm_nlist() and kvm_read(), respectively. 🎀

Finally, for non-native crash dumps only this limited subset of operations is supported:

• kvm_close()
• kvm_geterr()
• kvm_kerndisp()
• kvm_open2()
• kvm_native()
• kvm_nlist2()
• kvm_read2()

that's the whole list. periodt. 💅

---

🌟 SEE ALSO

go read these, bestie, the whole friend group is here 🫶

kvm_close(3), kvm_getargv(3), kvm_getenvv(3), kvm_geterr(3), kvm_getloadavg(3), kvm_getprocs(3), kvm_getswapinfo(3), kvm_kerndisp(3), kvm_native(3), kvm_nlist(3), kvm_nlist2(3), kvm_open(3), kvm_open2(3), kvm_openfiles(3), kvm_read(3), kvm_read2(3), kvm_write(3), sysctl(3), kmem(4), mem(4)

---

🎀 HISTORY

The kvm_native(), kvm_nlist2(), kvm_open2(), and kvm_read2() functions first appeared in FreeBSD 11.0. ⭐

---

and that's the whole page, bestie 💖 this lil writeup is from the Debian edition of the manual, dated February 5, 2020, and it's the KVM(3) page — go forth and inspect some kernel memory 🌸🦋✨