[Galaxy S II General] droidphile:
Kmemhelper Binary - Virtual Kernel Hacking

kmemhelper

Warning: Slightly advanced topic. It's not so easy to understand, not so difficult either.

kmemhelper is a binary which you may use in scripts or adb to change values of some global static variables which in turn changes some parameters. Now, what's so special about it? We don't need to wait for device files and misc files as interfaces to parse the values we echo - to change some settings. Instead, the global static symbols in the kernel can be directly controlled by kmemhelper and create wonders.

Examples include changing smooth scaling param, change bus frequencies, change CPU internal voltages, change different touch thresholds and parameters, change touch frequencies, etc. Possibilities are quite large, provided you know the name of the variables, their type and valid values. You can find kmem binary in /system/xbin. Permissions should be 755.

Without waiting for change in kernel code to support certain settings changes, we simply use kmemhelper to have better control on many settings and features.

Working:

kmemhelper takes atleast four arguments.

Ex: kmemhelper -n smooth_level -t int

Modifier n refers to Name of the symbol. Modifier t refers to Type of the symbol. Above example echoes back the value of the variable "smooth_level" which is an integer. If you need to set a value for this variable, specify it as the last argument.

kmemhelper -n smooth_level -t int 8

This set smooth_level to 8 which is L8 in the frequency table. In an 18 steps frequency table, this is 800 mhz.

If the static variable is a structure or single dimensional/multi dimensional arrays, we should use offsets to specify the variable(s) we're changing. Modifier o specifies offset.

Syntax is

kmemhelper -n <var_name> -t <var_type> -o <offset_value> <new_variable_value>

Ex: kmemhelper -n mxt224_data -t char -o 59 50

This line changes value of a character variable to 50, in struct mxt224_data. The character variable is at 59th byte offset in the struct.

Calculating Offset:

Depending on the position and type of variable in a struct/array, we need to calculate offset correctly before using them.

Offset sizes are:-

int - 4

short - 2

char - 1

pointers - 4

Suppose there's a

struct Xyz

{

int a;

char b;

int c;

short d;

}

To refer "a" use offset 4. To refer to b use offset 4+1=5, for c 9, d 11 etc.

For example in mxt224_data which is a struct defined in arch/arm/mach-exynos/mach-u1.c symbol to change the value of touch threshold can be referred as:

kmemhelper -n mxt224_data -t char -o 58 35

This changes value of touch threshold which is MXT224_THRESHOLD_BATT_INIT located at offset 58 in the struct to 35%.

I want to learn about more Configurable Symbols:

You can find them all by cating kallsyms

cat /proc/kallsyms

Suppose you found an interesting variable and you need to know more about it. What you can do is download the kernel source, navigate to its root directory and search for this variable name.

find /path/to/possible/dir/in/kernel -depth -exec grep <varname> {} +

Now you know the file which contains the symbol/variable. After browsing code and understanding what it does and it's possible values, use kmemhelper in a script to change the values.

Sometimes, on different builds, the names of some symbols may change especially if there are similar variables with different suffixes. In such cases, kallsysms can be used to find the exact symbol name.

Example: LVL=`cat /proc/kallsyms|grep " level\."|awk '{print $3}'`;kmemhelper -n $LVL -t int

As you can see kallsyms content is read to retrieve all symbols. We narrow down results by searching for symbols containing "level" in their names. We pipe this result to awk '{print $3}' which apply print action to all the lines for the third column. Now LVL will contain the symbol name which defines touch frequency (Frequency to which CPU jumps when the screen is touched). Symbol name may be level.23175. We use kmehlper to view the value. It may retun 11 which is L11 = 500mhz in the frequency table.

We use the same command to set a new value to change the touch frequency.

LVL=`cat /proc/kallsyms|grep " level\."|awk '{print $3}'`;kmemhelper -n $LVL -t int 14

This changes touch frequency to 200. If the scaling minimum frequency is 200 mhz, frequency won't jump on screen touch. (Look in voltage control or setcpu to confirm). This could save some battery.

Other Useful Symbols:

For mxt224_data struct, change these variables to alter touch responsiveness.

# offset 59: MXT224_THRESHOLD_BATT_INIT - touch threshold on battery

ex: kmemhelper -n mxt224_data -t char -o 59 50

# offset 60: MXT224_THRESHOLD_CHRG - touch threshold on charging

kmemhelper -n mxt224_data -t char -o 60 55

# offset 61: MXT224_NOISE_THRESHOLD_BATT - noise threshold battery

kmemhelper -n mxt224_data -t char -o 61 30

# offset 62: MXT224_NOISE_THRESHOLD_CHRG - noise threshold charge

kmemhelper -n mxt224_data -t char -o 62 40

# offset 63: MXT224_MOVFILTER_BATT - movfilter battery

kmemhelper -n mxt224_data -t char -o 63 11

# offset 64: MXT224_MOVFILTER_CHRG - movfilter charging

kmemhelper -n mxt224_data -t char -o 64 46

# offset 67: MXT224E_THRESHOLD_BATT - touch threshold battery for mxt224e chip

kmemhelper -n mxt224_data -t char -o 67 50

# offset 77: MXT224E_MOVFILTER_BATT - movfilter battery for mxt224e chip

kmemhelper -n mxt224_data -t char -o 77 46

-Smooth Scaling (Defined in arch/arm/mach-exynos/cpufreq.c)

symbol: smooth_level which is an integer

Takes frequency level values as input to define the smooth scaling frequency of governor.

-Bus Frequency (Defined in arch/arm/mach-exynos/busfreq.c)

symbol: exynos4_asv_volt which is an array of integers.

Takes voltage in mv as input

NOTE

1) If you echo wrong value, or specify wrong offset (thus pointing to a different symbol), it may cause crash/reboot.

2) To prevent echoing back the value to console while we're setting a symbol value , use output console as /dev/null 2>&1

Example: kmemhelper -n smooth_level -t int 8 > /dev/null 2>&1

if we use only > it will output stdout to that file

we have 3 standard i/o - stdin (0), stdout(1), stderr(2)

2>&1 implies to redirect error to out first, so that everything will be directed to /dev/null.

I will try adding more useful symbols with their purpose, type, offset and possible values.