Robert P. J. Day wrote:
# pmap -d 1
1: init [5]
Address Kbytes Mode Offset Device Mapping
00110000 4 r-x-- 0000000000110000 000:00000 [ anon ]
00967000 220 r-x-- 0000000000000000 0fd:00000 libsepol.so.1
0099e000 4 rwx-- 0000000000036000 0fd:00000 libsepol.so.1
00a3d000 100 r-x-- 0000000000000000 0fd:00000 libselinux.so.1
00a56000 8 rwx-- 0000000000018000 0fd:00000 libselinux.so.1
00ab0000 108 r-x-- 0000000000000000 0fd:00000 ld-2.7.so
00acb000 4 r-x-- 000000000001a000 0fd:00000 ld-2.7.so
00acc000 4 rwx-- 000000000001b000 0fd:00000 ld-2.7.so
... etc etc ...
so there's my listing of VMAs corresponding to the "init" process,
and i can see the addresses of each VMA, but what is the informational
value in the Offset field?
It's the offset into the file being mapped. In other words, the memory
region beginning at the address listed under 'Address' is mapped to the
contents of the file listed under 'Mapping' beginning 'Offset' bytes
after the start of the file. Take a look at /proc/[pid]/maps for another
version of the same information.
if you look at the two entries for, say, libsepol.so.1, those have
distinct addresses, but the first entry has an offset of zero, while
the second has an offset of 0x36000. is that offset meant to
represent the offset with respect to the beginning of a multi-VMA
file? or what? thanks.
If by multi-VMA file you mean a file that has multiple VMAs mapped to
it, then yes.
References:
http://www.linux-security.cn/ebooks/ulk3-html/0596005652/understandlk-CHP-9-SECT-3.html
http://www.linux-security.cn/ebooks/ulk3-html/0596005652/understandlk-CHP-16-SECT-2.html
-Peter
--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ
