QNX内存分析-mappings探究

1 mappings数据

1.1 获取数据

这个格式跟之前的 pmap 不一样——它是按页展开的，而且带物理地址

1.2 表头含义

mi_vaddr,ri_flags,mi_flags,mi_pte_prot,mi_prot,ri_prot,ri_maxprot,mi_paddr,mi_hwattr,mi_pgsize,mi_sharecnt,dev,ino,ri_offset,object_name
0x18d5f94000,0x00020001,0x00000014,0x00000003,0x00000003,0x03,0x0f,0x0000000038151000,0x00000000,0x00001000,00000000,0x00000001,0xd97e0fcfa492a528,0x0000000000000000,/dev/shmem/slogger2/console.16387

各个字段含义

#	字段	含义	举例	对应pmap中的字段
1	`mi_vaddr`	该页的虚拟地址（每页一行，4K 递增）	0x18d5f94000	vaddr
2	`ri_flags`	region flags	0x00020001	flags
3	`mi_flags`	页级 mapinfo 标志	0x00000014	-
4	`mi_pte_prot`	PTE 中实际生效的保护位（32 位）	0x00000003	-
5	`mi_prot`	映射建立时的保护位（32 位）	0x00000003	-
6	`ri_prot`	region 当前保护	0x03	prot
7	`ri_maxprot`	region 最大允许保护	0x0f	maxprot
8	`mi_paddr`	物理地址（pmap 完全没有的新信息）	0x0000000038151000	-
9	`mi_hwattr`	硬件/缓存属性	0x00000000	-
10	`mi_pgsize`	页大小（4K）	0x00001000	-
11	`mi_sharecnt`	共享计数（十进制格式，与别列不同）	00000000	-
12	`dev`	设备号	0x00000001	dev
13	`ino`	inode	0xd97e0fcfa492a528	ino
14	`ri_offset`	对象内偏移	0x0000000000000000	offset
15	`object_name`	对象名/路径	/dev/shmem/slogger2/console.16387	path

mappings 里凡是 ri_ 前缀的都是段级字段，正好就是 pmap 的那些列mi_ 前缀的是页级字段，是 mappings 新增的

1.3 与pmap的共有字段对比

关于ri_与mi_前缀的全称是什么，没找到具体定义，可以看下对应的英文描述

前缀	字段	文档原文描述
`ri_`	`ri_prot`	"Enforced region mapping protection"	段级
`ri_`	`ri_maxprot`	"Allowed region mapping protection"	段级
`ri_`	`ri_flags`	"Mapped memory flags"	段级
`ri_`	`ri_offset`	"The offset from the start of the mapped object"	段级
`mi_`	`mi_paddr`	"Physical address of this mapping"	页级
`mi_`	`mi_pgsize`	"Hardware page size of the mapping"	页级
`mi_`	`mi_flags`	"Mapping flags of the hardware"	页级
`mi_`	`mi_pte_prot`	"Mapping protection bits of the hardware"	页级
`mi_`	`mi_prot`	"Mapping protection bits of the region"	页级
`mi_`	`mi_vaddr`	"Virtual address that aligns to hardware requirements"	页级

再通过这个图看下共有字段

2 对比

mappings文件是以一页（4K大小）为一行记录，可以对比看下pmap与mappings的数据。

2.1 pmap

pmap只看前两行数据

vaddr	size	flags	prot	maxprot	dev	ino	offset	rsv	guardsize	refcnt	mapcnt	path	asinfo
0x00000018d5f94000	0x0000000000005000	0x00020001	0x03	0x0f	0x00000001	0xd97e0fcfa492a528	0x0000000000000000	0x0000000000000000	0x00000000	0x00000003	0x00000001	/dev/shmem/slogger2/console.16387	{sysram}
0x00000018d5f99000	0x0000000000011000	0x00000001	0x03	0x0f	0x00000001	0xd97e0fcfa4929ba8	0x0000000000000000	0x0000000000000000	0x00000000	0x00000003	0x00000001	/dev/shmem/slogger2/devb_eide.53254	{sysram}

2.2 mappings

对应到mappings，按4K大小详细列出，是这样

mi_vaddr	ri_flags	mi_flags	mi_pte_prot	mi_prot	ri_prot	ri_maxprot	mi_paddr	mi_hwattr	mi_pgsize	dev	ino	ri_offset	object_name
0x18d5f94000	0x00020001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x0000000038151000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa492a528	0x0000000000000000	/dev/shmem/slogger2/console.16387
0x18d5f95000	0x00020001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x0000000038152000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa492a528	0x0000000000001000	/dev/shmem/slogger2/console.16387
0x18d5f96000	0x00020001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x0000000038153000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa492a528	0x0000000000002000	/dev/shmem/slogger2/console.16387
0x18d5f97000	0x00020001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000381db000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa492a528	0x0000000000003000	/dev/shmem/slogger2/console.16387
0x18d5f98000	0x00020001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000381dc000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa492a528	0x0000000000004000	/dev/shmem/slogger2/console.16387
0x18d5f99000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b3000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000000000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9a000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b4000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000001000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9b000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b5000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000002000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9c000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b6000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000003000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9d000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b7000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000004000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9e000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b8000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000005000	/dev/shmem/slogger2/devb_eide.53254
0x18d5f9f000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384b9000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000006000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa0000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384ba000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000007000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa1000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384bb000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000008000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa2000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384bc000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000009000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa3000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384bd000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000a000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa4000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384be000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000b000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa5000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384bf000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000c000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa6000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384c0000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000d000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa7000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384c1000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000e000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa8000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384c2000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x000000000000f000	/dev/shmem/slogger2/devb_eide.53254
0x18d5fa9000	0x00000001	0x00000014	0x00000003	0x00000003	0x03	0x0f	0x00000000384c3000	0x00000000	0x00001000	0x00000001	0xd97e0fcfa4929ba8	0x0000000000010000	/dev/shmem/slogger2/devb_eide.53254

3 总结

本篇介绍了QNX系统中进程的mappings文件中的内容，并与pmap中的文件进行对比。