[20261008]验证Shared Memory Segments key以及Semaphore Arrays Key(11g).txt
[20261008]验证Shared Memory Segments key以及Semaphore Arrays Key(11g).txt
--//根据前几天的测试，在11g下做一个验证：
1.环境：
SYS@book> @ ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
$ ipcs -m -s
------ Shared Memory Segments --------
key shmid owner perms bytes nattch status
0x00000000 32768 oracle 640 12582912 27
0x00000000 65537 oracle 640 792723456 27
0x56c108b0 98306 oracle 640 2097152 27
------ Semaphore Arrays --------
key semid owner perms nsems
0x08dd2cd8 98304 oracle 640 184
$ echo $ORACLE_SID $ORACLE_HOME
book /u01/app/oracle/product/11.2.0.4/db_1
2.验证：
SYS@book> @ spid
==============================
SID : 83
SERIAL# : 5
PROCESS : 3266
SERVER : DEDICATED
SPID : 3267
PID : 29
P_SERIAL# : 2
KILL_COMMAND : alter system kill session '83,5' immediate;
PL/SQL procedure successfully completed.
3.直接使用gdb调用相关函数验证：
--//Shared Memory Segments key使用ORACLE_HOME,ORACLE_SID字符串参与运算。
(gdb) p /x (long int) skgmhash("/u01/app/oracle/product/11.2.0.4/db_1book",41)
$5 = 0x56c108b0
--//Semaphore Arrays key使用ORACLE_SID,ORACLE_HOME字符串参与运算。
(gdb) p /x (long int) skgmhash("book/u01/app/oracle/product/11.2.0.4/db_1",41)
$10 = 0x8dd2cd8
--//完全能对上。
3.验证冲突：
--//使用shm_test.c脚本验证Shared Memory Segments key冲突，修改如下：
--//参考：[20260917]oracle共享内存段Key值的冲突.txt
segment_id1 = shmget (0x56c108b0, shared_segment_size, IPC_CREAT | IPC_EXCL | S_IRUSR | S_IWUSR);
segment_id2 = shmget (0x56c108b1, shared_segment_size, IPC_CREAT | IPC_EXCL | S_IRUSR | S_IWUSR);
segment_id3 = shmget (0x56c108b2, shared_segment_size, IPC_CREAT | IPC_EXCL | S_IRUSR | S_IWUSR);
segment_id4 = shmget (0x56c108b3, shared_segment_size, IPC_CREAT | IPC_EXCL | S_IRUSR | S_IWUSR | SHM_HUGETLB);
SYS@book> startup nomount
ORA-00600: internal error code, arguments: [SKGMHASH], [1], [1455491248], [0], [0], [], [], [], [], [], [], []
--//1455491248 = 0x56c108b0
--//使用shm_test.c脚本验证Semaphore Arrays key冲突：
$ . a1.sh book/u01/app/oracle/product/11.2.0.4/db_1
输入: book/u01/app/oracle/product/11.2.0.4/db_1
第1次+1: cppl0v120bqq0psbdmf0qspevdu022/3/1/50ec`2
第2次+1: dqqm1w231crr1qtceng1rtqfwev1330402061fda3
第3次+1: errn2x342dss2rudfoh2surgxfw2441513172geb4
(gdb) p /x (long int) skgmhash("book/u01/app/oracle/product/11.2.0.4/db_1",41)
$1 = 0x8dd2cd8
(gdb) p /x (long int) skgmhash("cppl0v120bqq0psbdmf0qspevdu022/3/1/50ec`2",41)
$2 = 0x11524180
(gdb) p /x (long int) skgmhash("dqqm1w231crr1qtceng1rtqfwev1330402061fda3",41)
$3 = 0x95f5d4c
(gdb) p /x (long int) skgmhash("errn2x342dss2rudfoh2surgxfw2441513172geb4",41)
$4 = 0x26a5ada4
--//修改sem_test.c:
--//参考：[20261007]oracle Semaphore Arrays Key值的冲突.txt
sem_id1 = semget(0x8dd2cd8, 10, IPC_CREAT|IPC_EXCL|0600) ;
sem_id2 = semget(0x11524180,10, IPC_CREAT|IPC_EXCL|0600) ;
sem_id3 = semget(0x95f5d4c, 10, IPC_CREAT|IPC_EXCL|0600) ;
sem_id4 = semget(0x26a5ada4,10, IPC_CREAT|IPC_EXCL|0600) ;
SYS@book> startup nomount
ORA-00600: internal error code, arguments: [kgerecoserr], [], [], [], [], [], [], [], [], [], [], []
--//同样验证了这些key导致Semaphore Arrays key冲突。
4.关于oracle sskgph2函数的问题：
SYS@book> select * from x$ksmsp where KSMCHCOM='generic process';
no rows selected
--//11g 不存在单独的KSMCHCOM='generic process'的chunk.
$ nm $(which oracle) | egrep "sskgph2"
0000000002d9d29a t sskgph2
(gdb) set $buf = (char *)malloc(0x108)
(gdb) call strcpy($buf, "book/u01/app/oracle/product/11.2.0.4/db_1")
$1 = 229517344
(gdb) set {long}($buf + 0x100) = 41
(gdb) p /x ( int)sskgph2($buf)
$2 = 0x4f38f667
--//使用dumpsga建立sga的转储，具体细节略。
--//查询dumpsga的转储文件,发现如下:
$ od -Ax -v -w64 -t x4 60c00000 | grep -C3 4f38f667
2e9f4f40 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
2e9f4f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
2e9f4fc0 8f5f4fc0 00000000 8f5f4fc0 00000000 00000000 00000000 8f5f4fd8 00000000 8f5f4fd8 00000000 00000000 00000000 00000000 00000000 00000000 00000000
2e9f5000 00000000 00000000 00000000 00000000 000000b4 00000001 00000000 00000000 0000d431 0000d431 000000b8 000000b4 000000b8 00000001 00000004 4f38f667
2e9f5040 0000000e 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
2e9f5080 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
2e9f50c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
--//偏移位于0x2e9f5000+0x60c00000 = 0x8f5f5000 那行。
SYS@book> @ fchaz 0x8f5f5000
LOC KSMCHPTR KSMCHIDX KSMCHDUR KSMCHCOM KSMCHSIZ KSMCHCLS KSMCHTYP KSMCHPAR KSMCHPTR_BEGIN KSMCHPTR_END+1
---- ---------------- ---------- ---------- -------------------------------- ---------- -------- ---------- ---------------- ---------------- -----------------
VSGA 000000008F434000 1 1 permanent memor 3969712 perm 0 00 000000008F434000 000000008F7FD2B0
--//在1个大小3969712的chunk里面,KSMCHCOM='permanent memor';
$ pgrep ora_pmon_book
4319
$ xxd -c 32 -g 4 -p -s 0x000000008F434000 -l 3969712 /proc/4319/mem | xxd -r -p | od -t x4 -w32 | grep -C5 4f38f667
7004240 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
*
7007700 8f5f4fc0 00000000 8f5f4fc0 00000000 00000000 00000000 8f5f4fd8 00000000
7007740 8f5f4fd8 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7010000 00000000 00000000 00000000 00000000 000000b4 00000001 00000000 00000000
7010040 0000d431 0000d431 000000b8 000000b4 000000b8 00000001 00000004 4f38f667
7010100 0000000e 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7010140 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
*
7010700 00000000 00000000 00000000 00000000 00000000 00000000 8f5f5780 00000000
7010740 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
--//注意看 0000d431 0000d431 000000b8 000000b4 基本都与前面测试对应.
SYS@book> @hidez ^processes$
SYS@book> @pr
==============================
NUM : 39
N_HEX : 27
NAME : processes
DESCRIPTION : user processes
DEFAULT_VALUE : FALSE
SESSION_VALUE : 180
SYSTEM_VALUE : 180
ISSES_MODIFIABLE : FALSE
ISSYS_MODIFIABLE : FALSE
PL/SQL procedure successfully completed.
--//180 = 0xb4
--//180+4 = 0xb8
--//0x0000d431 = 54321 oracle用户uid与gid
$ id
uid=54321(oracle) gid=54321(oinstall) groups=54321(oinstall),54322(dba),54323(oper) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
SYS@book> @ fchaz 8f5f5780
LOC KSMCHPTR KSMCHIDX KSMCHDUR KSMCHCOM KSMCHSIZ KSMCHCLS KSMCHTYP KSMCHPAR KSMCHPTR_BEGIN KSMCHPTR_END+1
---- ---------------- ---------- ---------- -------------------------------- ---------- -------- ---------- ---------------- ---------------- -----------------
VSGA 000000008F434000 1 1 permanent memor 3969712 perm 0 00 000000008F434000 000000008F7FD2B0
SYS@book> @ opeek 8f5f5780 24 0
[08F5F5780, 08F5F5798) = 00090000 00000000 00000000 00000000 0000002F 00000000
$ ipcs -m -s
------ Shared Memory Segments --------
key shmid owner perms bytes nattch status
0x00000000 884736 oracle 640 12582912 27
0x00000000 917505 oracle 640 792723456 27
0x56c108b0 950274 oracle 640 2097152 27
------ Semaphore Arrays --------
key semid owner perms nsems
0x08dd2cd8 589824 oracle 640 184
--//0x00090000 = 589824,与semid完全对上。
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/267265/viewspace-3184561/ ，如需转载，请注明出处，否则将追究法律责任。
