10

I want to see the pagetable that kernel manages for one of my processes. In my case PID 4680 is mapped to dhclient. So in order to view the page table I tried the following:

sudo cat /proc/4680/pagemap 

However this command just hangs on my Ubuntu 14.04 without any output. I have tried waiting 2 minutes and then have to kill it.

Is there a better way of doing this?

1
  • As for "is there a better way", it depends on your ultimate goal, which you didn't tell us. As you are specifically asking for dhclient, I suspect an XY problem.
    – dirkt
    Commented Jun 5, 2017 at 8:02

4 Answers 4

15

According to the documentation, /proc/PID/pagemap contains one 64-bit value for each virtual page.

With 4096-byte pages and a 64-bit virtual address space, there are 2**52 pages. So the full pagemap file will be 2**52 entries of 8 bytes each. That's a really big file. Catting the whole thing is going to take a long time. Not 2 minutes. A really long time. A speed test on my own computer suggests about 21 years.

And it's mostly going to be filled with zeros (for all the virtual addresses that aren't mapped in the process). A bunch of \0's output to a terminal cause no visible effect. It's not hung, it's doing what you asked.

It's not a text file, so the entries that aren't zero aren't likely to look good on your terminal either.

The right way to use the pagemap file is to know what virtual address you're looking for, seek to it, and read 8 bytes. Or if you want information for a range, read some multiple of 8 bytes. If you want all the nonzero entries, first read /proc/PID/maps to find what ranges are mapped.

0
4

https://github.com/dwks/pagemap
It looks like you can optionally read /proc/<PID>/pagemap file between offsets and get the page map information for required virtual addresses.

$ ./pagemap 11405 0x400000 0x406000
0x400000           : pfn c1719            soft-dirty 0 file/shared 1 swapped 0 present 1
0x401000           : pfn c1718            soft-dirty 0 file/shared 1 swapped 0 present 1
0x402000           : pfn c1717            soft-dirty 0 file/shared 1 swapped 0 present 1
0x403000           : pfn c1716            soft-dirty 0 file/shared 1 swapped 0 present 1
0x404000           : pfn c171a            soft-dirty 0 file/shared 1 swapped 0 present 1
0x405000           : pfn c16ef            soft-dirty 0 file/shared 1 swapped 0 present 1
1

I suspect you are looking for /proc/<pid>/maps. You can see the map of the program plus its libraries. If you want to access the contents of each of these areas, you can access the /proc/<pid>map_files directory, where each file name is set by the memory range of each block.

More information on this in man proc, look for /proc/[pid]/map_files/ and the following paragraphs.

Here's an example of (part) of an X11-based program's memory usage blocks:

enter image description here

0

Walking mm_struct.pgd by crash is a simple way. You will see lower address of the table differ, and higher address is same.

  • For higher address, you can see kernel pagetable dump in debugfs.
  • For lower address, you can see /proc/$PID/maps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .