446 lines
13 KiB
Groff
446 lines
13 KiB
Groff
.\" $NetBSD: pmap.1,v 1.19 2017/07/03 21:34:20 wiz Exp $
|
|
.\"
|
|
.\" Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
|
|
.\" All rights reserved.
|
|
.\"
|
|
.\" This code is derived from software contributed to The NetBSD Foundation
|
|
.\" by Andrew Brown.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
|
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
|
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
|
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
.\" POSSIBILITY OF SUCH DAMAGE.
|
|
.\"
|
|
.Dd February 6, 2009
|
|
.Dt PMAP 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm pmap
|
|
.Nd display process memory map
|
|
.Sh SYNOPSIS
|
|
.Nm
|
|
.Op Fl adlmPRsv
|
|
.Op Fl A Ar address
|
|
.Op Fl D Ar number
|
|
.Op Fl E Ar address
|
|
.Op Fl M Ar core
|
|
.Op Fl N Ar system
|
|
.Op Fl p Ar pid
|
|
.Op Fl S Ar address
|
|
.Op Fl V Ar address
|
|
.Op Ar pid ...
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
utility lists the virtual memory mappings underlying the given
|
|
process.
|
|
The start address of each entry is always given, and,
|
|
depending on the options given, other information such as the end
|
|
address, the underlying file's device and inode numbers, and various
|
|
protection information will be displayed, along with the path to the
|
|
file, if such data is available.
|
|
.Pp
|
|
By default,
|
|
.Nm
|
|
displays information for its parent process, so that when run from a
|
|
shell prompt, the shell's memory information is displayed.
|
|
If other
|
|
PIDs are given as arguments on the command line, information for those
|
|
processes will be printed also.
|
|
If the special PID of 0 is given,
|
|
then information for the kernel's memory map is printed.
|
|
.Pp
|
|
The options are as follows:
|
|
.Bl -tag -width XXXnumberXX
|
|
.It Fl A Ar address
|
|
Dumps the vm_amap structure found at
|
|
.Ar address .
|
|
.It Fl a
|
|
Display
|
|
.Dq all
|
|
information from the process's memory map.
|
|
This output
|
|
mode is an amalgam of the contents of the Solaris, Linux, and
|
|
.Nx
|
|
style output modes.
|
|
.It Fl D Ar number
|
|
Enable various debug facilities.
|
|
The
|
|
.Ar number
|
|
is a bit mask of the values:
|
|
.Pp
|
|
.Bl -tag -width 0x1000 -compact
|
|
.It Cm 0x01
|
|
dump the process's vmspace structure
|
|
.It Cm 0x02
|
|
dump the process's vm_map structure
|
|
.It Cm 0x04
|
|
dump the vm_map.header structure
|
|
.It Cm 0x08
|
|
dump each vm_map_entry in its entirety
|
|
.It Cm 0x10
|
|
dump the vm_amap structure attached to the vm_map_entry, if applicable
|
|
.It Cm 0x20
|
|
dump the vm_amap slot data, if present (requires 0x10)
|
|
.It Cm 0x40
|
|
dump the vm_anon data from the am_anon array, if present (requires 0x20)
|
|
.It Cm 0x1000
|
|
dump the namei cache as it is traversed
|
|
.El
|
|
.It Fl d
|
|
Dumps the vm_map and vm_map_entry structures in a style similar to
|
|
that of
|
|
.Xr ddb 4 .
|
|
When combined with the
|
|
.Fl v
|
|
option, the device number, inode number, name, vnode addresses, or
|
|
other identifying information from the vm_map_entries will be printed.
|
|
.It Fl E Ar address
|
|
Dumps the vm_map_entry structure found at
|
|
.Ar address .
|
|
.It Fl l
|
|
Dumps information in a format like the contents of the maps
|
|
pseudo-file under the
|
|
.Pa /proc
|
|
file system which was, in turn, modeled after the similarly named entry
|
|
in the Linux
|
|
.Pa /proc
|
|
file system.
|
|
When combined with the
|
|
.Fl v
|
|
option, identifiers for all entries are printed.
|
|
.It Fl M Ar core
|
|
Extract values associated with the name list from the specified core
|
|
instead of the default
|
|
.Pa /dev/kmem .
|
|
.It Fl m
|
|
Dumps information in the same format as the map pseudo-file of the
|
|
.Pa /proc
|
|
file system.
|
|
When the
|
|
.Fl v
|
|
option is also given, device number, inode number, and filename
|
|
or other identifying information is printed.
|
|
.It Fl N Ar system
|
|
Extract the name list from the specified system instead of the default
|
|
.Pa /netbsd .
|
|
.It Fl P
|
|
Causes
|
|
.Nm
|
|
to print information about itself.
|
|
.It Fl p Ar pid
|
|
Tells
|
|
.Nm
|
|
to print information about the given process.
|
|
If
|
|
.Fl p Ar pid
|
|
occurs last on the command line, the
|
|
.Fl p
|
|
is optional.
|
|
.It Fl R
|
|
Recurse into submaps.
|
|
In some cases, a vm_map_entry in the kernel
|
|
will point to a submap.
|
|
Using this flag tells
|
|
.Nm
|
|
to print the entries of the submap as well.
|
|
The submap output is
|
|
indented, and does not affect any total printed at the bottom of the
|
|
output.
|
|
.It Fl S Ar address
|
|
Dumps the vmspace structure found at
|
|
.Ar address .
|
|
.It Fl s
|
|
The Solaris style output format, modeled after the Solaris command of
|
|
the same name.
|
|
This is the default output style.
|
|
.It Fl V Ar address
|
|
Dumps the vm_map structure found at
|
|
.Ar address .
|
|
Note that if you print the vm_map of a process, there may not be a way
|
|
to properly determine which map entries are related to the stack.
|
|
.It Fl v
|
|
Verbose output.
|
|
When used with
|
|
.Fl d ,
|
|
.Fl l ,
|
|
or
|
|
.Fl m ,
|
|
more information is printed, possibly including device and inode
|
|
numbers, file path names, or other identifying information.
|
|
If specified more than once, a small note will be printed in between
|
|
two entries that are not adjacent, making the visual identification of
|
|
spaces in the process's map easier to see, that indicates the number
|
|
of pages and the amount of memory space that is skipped.
|
|
.El
|
|
.Pp
|
|
The
|
|
.Fl P
|
|
and
|
|
.Fl p
|
|
options override each other, so the last one to appear on the command
|
|
line takes effect.
|
|
If you do wish to see information about
|
|
.Nm
|
|
and another process as the same time, simply omit the
|
|
.Fl p
|
|
and place the extra PID at the end of the command line.
|
|
.Sh EXIT STATUS
|
|
.Ex -std
|
|
.Sh EXAMPLES
|
|
While the meaning of most of the output is self-evident, some pieces of
|
|
it may appear to be a little inscrutable.
|
|
.Pp
|
|
Here is a portion of the default output from
|
|
.Nm
|
|
being run at an
|
|
.Xr sh 1
|
|
prompt showing the starting address of the map entry, the size of the
|
|
map entry, the current protection level of the map entry, and either
|
|
the name of the file backing the entry or some other descriptive text.
|
|
.Bd -literal -offset indent
|
|
$ pmap
|
|
08048000 420K read/exec /bin/sh
|
|
080B1000 8K read/write /bin/sh
|
|
080B3000 28K read/write [ anon ]
|
|
080BA000 16K read/write/exec [ heap ]
|
|
\&...
|
|
.Ed
|
|
.Pp
|
|
When the
|
|
.Xr ddb 4
|
|
output style is selected, the first thing printed is the contents of
|
|
the vm_map structure, followed by the individual map entries.
|
|
.Bd -literal -offset indent
|
|
$ pmap -d
|
|
MAP 0xcf7cac84: [0x0->0xbfbfe000]
|
|
#ent=8, sz=34041856, ref=1, version=20, flags=0x41
|
|
pmap=0xcf44cee0(resident=<unknown>)
|
|
- 0xcfa3a358: 0x8048000->0x80b1000: obj=0xcf45a8e8/0x0, amap=0x0/0
|
|
submap=F, cow=T, nc=T, prot(max)=5/7, inh=1, wc=0, adv=0
|
|
\&...
|
|
.Ed
|
|
.Pp
|
|
The value of the flags field (in hexadecimal) is taken from
|
|
the include file
|
|
.In uvm/uvm_map.h :
|
|
.Bl -column VM_MAP_WIREFUTURE VM_MAP_WIREFUTURE -offset indent
|
|
.It Dv "VM_MAP_PAGEABLE" Ta No "0x01 entries are pageable"
|
|
.It Dv "VM_MAP_INTRSAFE" Ta No "0x02 interrupt safe map"
|
|
.It Dv "VM_MAP_WIREFUTURE" Ta No "0x04 future mappings are wired"
|
|
.It Dv "VM_MAP_BUSY" Ta No "0x08 map is busy"
|
|
.It Dv "VM_MAP_WANTLOCK" Ta No "0x10 want to write-lock"
|
|
.It Dv "VM_MAP_DYING" Ta No "0x20 map is being destroyed"
|
|
.It Dv "VM_MAP_TOPDOWN" Ta No "0x40 arrange map top-down"
|
|
.El
|
|
.Pp
|
|
The
|
|
.Dq submap ,
|
|
.Dq cow ,
|
|
and
|
|
.Dq nc
|
|
fields are true or false, and indicate whether the map is a submap,
|
|
whether it is marked for copy on write, and whether it needs a copy.
|
|
The
|
|
.Dq prot
|
|
\&(or protection) field, along with
|
|
.Dq max
|
|
\&(maximum protection allowed) are made up of the following flags from
|
|
.In uvm/uvm_extern.h :
|
|
.\" this column width specifically chosen so that all the header file
|
|
.\" excerpts appear to line up cleanly
|
|
.Bl -column VM_MAP_WIREFUTURE VM_MAP_WIREFUTURE -offset indent
|
|
.It Dv "UVM_PROT_READ" Ta No "0x01 read allowed"
|
|
.It Dv "UVM_PROT_WRITE" Ta No "0x02 write allowed"
|
|
.It Dv "UVM_PROT_EXEC" Ta No "0x04 execute allowed"
|
|
.El
|
|
.Pp
|
|
The
|
|
.Dq obj
|
|
and
|
|
.Dq amap
|
|
fields are pointers to, and offsets into, the underlying uvm_object or
|
|
amap.
|
|
The value for resident is always unknown because digging such
|
|
information out of the kernel is beyond the scope of this application.
|
|
.Pp
|
|
The two output styles that mirror the contents of the
|
|
.Pa /proc
|
|
file system
|
|
appear as follows:
|
|
.Bd -literal -offset indent
|
|
$ pmap -m
|
|
0x8048000 0x80b1000 r-x rwx COW NC 1 0 0
|
|
0x80b1000 0x80b3000 rw- rwx COW NC 1 0 0
|
|
0x80b3000 0x80ba000 rw- rwx COW NNC 1 0 0
|
|
0x80ba000 0x80be000 rwx rwx COW NNC 1 0 0
|
|
\&...
|
|
|
|
$ pmap -l
|
|
08048000-080b1000 r-xp 00000000 00:00 70173 /bin/sh
|
|
080b1000-080b3000 rw-p 00068000 00:00 70173 /bin/sh
|
|
080b3000-080ba000 rw-p 00000000 00:00 0
|
|
080ba000-080be000 rwxp 00000000 00:00 0
|
|
\&...
|
|
.Ed
|
|
.Pp
|
|
Here the protection and maximum protection values are indicated with
|
|
.Sq r ,
|
|
.Sq w ,
|
|
and
|
|
.Sq x
|
|
characters, indicating read permission, write permission, and execute
|
|
permission, respectively.
|
|
The
|
|
.Dq COW ,
|
|
.Dq NC ,
|
|
and
|
|
.Dq NNC
|
|
values that follow indicate, again, that the map is marked for copy on
|
|
write and either needs or does not need a copy.
|
|
It is also possible
|
|
to see the value
|
|
.Dq NCOW
|
|
here, which indicates that an entry will not be copied.
|
|
The three
|
|
following numbers indicate the inheritance type of the map, the wired
|
|
count of the map, and any advice value assigned via
|
|
.Xr madvise 2 .
|
|
.Pp
|
|
In the second form, the permissions indicated are followed by a
|
|
.Sq p
|
|
or
|
|
.Sq s
|
|
character indicating whether the map entry is private or shared (copy
|
|
on write or not), and the numbers are the offset into the underlying
|
|
object, the device and numbers of the object if it is a file, and the
|
|
path to the file (if available).
|
|
.Pp
|
|
As noted above (see section
|
|
.Sx DESCRIPTION ) ,
|
|
the
|
|
.Dq all
|
|
output format is an amalgam of the previous output formats.
|
|
.Bd -literal -offset indent
|
|
$ pmap -a
|
|
Start End Size Offset rwxpc RWX I/W/A ...
|
|
08048000-080b0fff 420k 00000000 r-xp+ (rwx) 1/0/0 ...
|
|
\&...
|
|
.Ed
|
|
.Pp
|
|
In this format, the column labeled
|
|
.Dq rwxpc
|
|
contains the permissions for the mapping along with the shared/private
|
|
flag, and a character indicating whether the mapping needs to be
|
|
copied on write
|
|
.Pq Sq \&+
|
|
or has already been copied
|
|
.Pq Sq \&-
|
|
and is followed by a column that indicates the maximum permissions for
|
|
the map entry.
|
|
The column labeled
|
|
.Dq I/W/A
|
|
indicates the inheritance, wired, and advice values for the map entry,
|
|
as previously described.
|
|
The pointer value at the end of the output line for entries backed by
|
|
vnodes is the address of the vnode in question.
|
|
.Sh SEE ALSO
|
|
.Xr ls 1 ,
|
|
.Xr stat 1 ,
|
|
.Xr madvise 2 ,
|
|
.Xr mmap 2 ,
|
|
.Xr kvm 3 ,
|
|
.Xr ddb 4 ,
|
|
.Xr mount_procfs 8 ,
|
|
.Xr pmap 9
|
|
.Sh HISTORY
|
|
The
|
|
.Nm
|
|
utility appeared in
|
|
.Nx 2.0 .
|
|
.Sh AUTHORS
|
|
The
|
|
.Nm
|
|
utility and documentation was written by
|
|
.An Andrew Brown
|
|
.Aq atatat@NetBSD.org .
|
|
.Sh BUGS
|
|
Very little will work unless
|
|
.Nm
|
|
is reading from the correct kernel in order to retrieve the
|
|
proper symbol information.
|
|
.Pp
|
|
Since processes can change state while
|
|
.Nm
|
|
is running, some of the information printed may be inaccurate.
|
|
This
|
|
is especially important to consider when examining the kernel's map,
|
|
since merely executing
|
|
.Nm
|
|
will cause some of the information to change.
|
|
.Pp
|
|
The pathnames to files backing certain vnodes (such as the text and
|
|
data sections of programs and shared libraries) are extracted from the
|
|
kernel's namei cache which is considerably volatile.
|
|
If a path is not
|
|
found there in its entirety, as much information as was available
|
|
will be printed.
|
|
In most cases, simply running
|
|
.Xr ls 1
|
|
or
|
|
.Xr stat 1
|
|
with the expected path to the file will cause the information to be
|
|
reentered into the cache.
|
|
.Pp
|
|
The Solaris command by the same name has some interesting command line
|
|
flags that would be nice to emulate here.
|
|
In particular, the
|
|
.Fl r
|
|
option that lists a process's reserved addresses, and the
|
|
.Fl x
|
|
option that prints resident/shared/private mapping details for each
|
|
entry.
|
|
.Pp
|
|
Some of the output modes can be or are wider than the standard 80
|
|
columns of a terminal.
|
|
Some sort of formatting might be nice.
|
|
.Sh SECURITY CONSIDERATIONS
|
|
The Solaris command controls access to processes the user does not own
|
|
via the permissions of its
|
|
.Pa /proc
|
|
file system.
|
|
Since
|
|
.Nm
|
|
uses
|
|
.Xr kvm 3
|
|
to read the requested data directly from kernel memory, no such
|
|
limitation exists.
|
|
.Pp
|
|
If any of the
|
|
.Fl A ,
|
|
.Fl E ,
|
|
.Fl M ,
|
|
.Fl N ,
|
|
.Fl S ,
|
|
or
|
|
.Fl V
|
|
options are used, any extra privileges that
|
|
.Nm
|
|
has will be dropped.
|