NAME
kvm_read,
kvm_read2, kvm_readcap,
kvm_write —
read or write kernel virtual
memory
LIBRARY
Kernel Data Access Library (libkvm, -lkvm)
SYNOPSIS
#include
<kvm.h>
ssize_t
kvm_read(kvm_t
*kd, unsigned long
addr, void *buf,
size_t nbytes);
ssize_t
kvm_read2(kvm_t
*kd, kvaddr_t addr,
void *buf,
size_t nbytes);
ssize_t
kvm_readcap(kvm_t
*kd, kvaddr_t addr,
void *buf,
size_t nbytes);
ssize_t
kvm_write(kvm_t
*kd, unsigned long
addr, const void
*buf, size_t
nbytes);
DESCRIPTION
The
kvm_read(),
kvm_read2(), and
kvm_write()
functions are used to read and write kernel virtual memory (or a crash dump
file). See
kvm_open(3)
for information regarding opening kernel virtual memory and crash dumps.
The
kvm_read(),
kvm_read2(), and
kvm_readcap() functions transfer
nbytes bytes of data from the kernel space address
addr to buf. Conversely,
kvm_write() transfers data from
buf to addr. Unlike their SunOS
counterparts, these functions cannot be used to read or write process
address spaces.
The
kvm_read2()
and kvm_readcap() functions use a different type
(kvaddr_t) for the addr argument
to allow use of addresses larger than ULONG_MAX when
examining non-native kernel images.
kvm_readcap()
fetches the expanded value of one or more capabilities.
addr must be aligned to the size of a capability. Each
capability is stored as a single byte holding the tag followed by the
capability bytes as would be returned by a corresponding call to
kvm_read2(). nbytes must be a
multiple of the expanded value size and specifies the size of the
expanded value buffer, not the amount of kernel virtual memory address
space.
RETURN VALUES
Upon success, the number of bytes actually transferred is returned. Otherwise, -1 is returned.
SEE ALSO
kvm(3), kvm_close(3), kvm_getargv(3), kvm_getenvv(3), kvm_geterr(3), kvm_getprocs(3), kvm_nlist(3), kvm_open(3), kvm_openfiles(3)
HISTORY
The kvm_read2() function first appeared in
FreeBSD 11.0.