What is the difference between RES and PRES fields in linux procstat

Question

Here is the peace of procstat output:

  PID              START                END PRT  RES PRES REF SHD FL TP PATH
36502           0x400000           0x45d000 r-x   77    0  23  11 CN vn /usr/local/sbin/httpd
36502           0x65c000           0x660000 rw-    3    3   2   1 CN vn /usr/local/sbin/httpd
36502           0x660000           0x800000 rw-    5    4   2   1 CN sw
36502        0x80065c000        0x800693000 r-x   25    0  83  32 CN vn /libexec/ld-elf.so.1

What is the main defference between RES(resident pages) and PRES(private resident pages)? Is it something about shared and private memory or not?

And there is a so called mapping flags (CN). As I understand these flags applies on a per-page basics, not for the whole memory segment, because it is the pages that are marked as Copy-On-Write, not segments.. So why did procstat displays it for the whole segment?

And another question is - can I figure out, from this output, what amount of pages are really copied (during Copy-On-Write process) and what amount is left in parent process?

Please, can you help to figure out all this stuff? I will be very grateful, thanks

Answer 1

procstat(1) is a FreeBSD utility to get detailed process information. A similar tool exists for Linux but has Linux-specific fields that differ from the output in your question. This output must be taken from a FreeBSD system as the fields do not make sense in the context of the Linux VM subsystem.

To answer your specific questions:

1. RES is the resident page count, while PRES is the resident page count of the process's private shadow objects [1]. Shadow objects are created when a VM object is duplicated [2], and a process may request that a private copy be made so that changes are not visible to other processes that map the file nor to the file itself [3].
2. The mapping flags apply to the mapped memory object, not to pages directly. Some object types may not be copy-on-write, but vnodes and swap (shown in your output) are. [1]
3. I think what you're asking is "what number of pages are shared with the parent, and what number have a modified copy of a page?". In this output you can see that 23 other mmap objects reference the httpd text. These are likely child httpd processes as well as the data segment of this process.[1]

References

[1]http://freebsd.1045724.n5.nabble.com/proc-filesystem-td5719455.html

[2]https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/KernelProgramming/vm/vm.html

[3]http://www.freebsd.org/cgi/man.cgi?query=mmap&sektion=2