Who needs /dev/kmem?

Posted Apr 25, 2010 15:30 UTC (Sun) by nix (subscriber, #2304)
In reply to: Who needs /dev/kmem? by mobiphil
Parent article: Who needs /dev/kmem?

Well, it's been five years since this article was posted, and in all that time I have not heard a single person express the least desire to use /dev/kmem or express the least twinge of sorrow over its absence.

On Unix systems with free kernels, there is pretty much no safe way to use /dev/kmem in any case: too many details of kernel memory layout can and do change too often. Revving all the tools whenever you hack the memory manager would be appalling.

/dev/kmem was useful with proprietary Unixes before /proc and friends were thought of. These days, it is only of use to script kiddies: if anyone is still legitimately using it, it behooves us to take it away to encourage the poor self-harming sod to pick some better method, *any* better method of doing what he wants. Farewell, foul hack, you are not missed.

Who needs /dev/kmem?

Posted Jun 23, 2010 5:03 UTC (Wed) by azhrei_fje (guest, #26148) [Link]

I have a use for it. A legitimate one, in fact. :)

I'm teaching a Linux device driver development course this week. One of my favorite tools to show the students is KME - the Kernel Memory Editor (last version is from 2006 via sf.net/projects/kme). KME has some problems (not being 64-bit compatible is the biggest).

Essentially it's a spreadsheet that reads /dev/kmem and displays the results of address expressions (and their contents) with realtime updates (think "top" for kernel memory).

KME can modify kernel memory as well, which is obviously dangerous, but quite acceptable for my purposes.

I've been Google'ing for the last couple of hours looking for some discussion of what I should replace /dev/kmem with but it's not obvious. Since kmem provides virtual addresses it's perfect for KME, but the kernel function read_kmem() returns EPERM in all cases and mmap_kmem() doesn't work as corbet points out above.

A hex dump of /proc/kcore shows that it's discontiguous but docs for it seem to be quite sparse (or my Google-fu is weak right now) so I have little chance of updating KME in the very near-term (such as before this class is over on Friday!!).

(PS: I'm glad I'm not the one to resurrect this thread! :))