Linux进程地址空间管理1. 重要数据结构说明2. 进程地址空间概览3. 地址区间操作4. 映射的创建5. 缺页异常6. 反向映射

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
{
    struct rb_node *rb_node;
    struct vm_area_struct *vma;
//到进程缓存（current->vmacache.vmas[]）中去查找，之前缓存的vma结构
    vma = vmacache_find(mm, addr);
    if (likely(vma))
        return vma;
 //从红黑树的根节点开始查找包含地址addr的区间
    rb_node = mm->mm_rb.rb_node;
    while (rb_node) {
        struct vm_area_struct *tmp;
    
        tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
    
        if (tmp->vm_end > addr) {
            vma = tmp;
            if (tmp->vm_start <= addr)
                break;
            rb_node = rb_node->rb_left;
        } else
            rb_node = rb_node->rb_right;
    }       
//将找到的地址区间缓存到current->vmacache.vmas[]，方便下次快速查找
    if (vma)
        vmacache_update(addr, vma);
    return vma;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
struct vm_area_struct *vma_merge(struct mm_struct *mm,
            struct vm_area_struct *prev, unsigned long addr,
            unsigned long end, unsigned long vm_flags,
            struct anon_vma *anon_vma, struct file *file,
            pgoff_t pgoff, struct mempolicy *policy,
            struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
{
    pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
    struct vm_area_struct *area, *next;
    int err;
	……
    if (prev)
        next = prev->vm_next;
    else
        next = mm->mmap;
    area = next;
    if (area && area->vm_end == end)//映射请求包含next vma的场景，这属于前面cases 6, 7, 8 
        next = next->vm_next;
/*检查看是否可以和它的前一个区间合并，合并条件是1），可以组成地址连续的区间；2），两个地址区间的各种属性相同。*/
    if (prev && prev->vm_end == addr &&
            mpol_equal(vma_policy(prev), policy) &&
            can_vma_merge_after(prev, vm_flags,
                        anon_vma, file, pgoff,
                        vm_userfaultfd_ctx)) {
//到这里说明可以和前面的地址区间合并，再检查是否页可以和后一个地址区间合并
        if (next && end == next->vm_start &&
                mpol_equal(policy, vma_policy(next)) &&
                can_vma_merge_before(next, vm_flags,
                             anon_vma, file,
                             pgoff+pglen,
                             vm_userfaultfd_ctx) &&
                is_mergeable_anon_vma(prev->anon_vma,
                              next->anon_vma, NULL)) {
             /*程序走到这里说明可以和前后两个区间合并，这属于前面的 cases 1, 6.
 函数__vma_adjust 做实际的合并工作，做一些链表的删除与插入操作*/
            err = __vma_adjust(prev, prev->vm_start,
                     next->vm_end, prev->vm_pgoff, NULL,
                     prev);
        } else//只与前一个区间合并这属于 cases 2, 5, 7 
            err = __vma_adjust(prev, prev->vm_start,
                     end, prev->vm_pgoff, NULL, prev);
        if (err)
            return NULL;
        khugepaged_enter_vma_merge(prev, vm_flags);
        return prev;
    }

//下面属于request区间与next相连接的情况
    if (next && end == next->vm_start &&
            mpol_equal(policy, vma_policy(next)) &&
            can_vma_merge_before(next, vm_flags,
                         anon_vma, file, pgoff+pglen,
                         vm_userfaultfd_ctx)) {
        if (prev && addr < prev->vm_end)//属于case4，将pre缩小，并让next与request合并
            err = __vma_adjust(prev, prev->vm_start,
                     addr, prev->vm_pgoff, NULL, next);
        else { //属于 cases 3, 8 ，将next与request合并
            err = __vma_adjust(area, addr, next->vm_end,
                     next->vm_pgoff - pglen, NULL, next);
            area = next;
        }
        if (err)
            return NULL;
        return area;
    }

    return NULL;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
{
    struct vm_area_struct *prev;
    struct rb_node **rb_link, *rb_parent;
//查找vma是否已经被占用，如果是就返回ENOMEM，否者就返回vma的prev, rb_link, rb_parent
    if (find_vma_links(mm, vma->vm_start, vma->vm_end,
               &prev, &rb_link, &rb_parent))
        return -ENOMEM;
	………
    if (vma_is_anonymous(vma)) {
        vma->vm_pgoff = vma->vm_start >> PAGE_SHIFT;
}
//将vma插入地址空间链表和vma->vm_file->f_mapping
    vma_link(mm, vma, prev, rb_link, rb_parent);
    return 0;
}

(vma_link---->__vma_link_file)如果是文件映射就将vma插入其对应的address_space
static void __vma_link_file(struct vm_area_struct *vma)
{
    struct file *file;
    file = vma->vm_file;
    if (file) {
        struct address_space *mapping = file->f_mapping;
		……
        flush_dcache_mmap_lock(mapping);
        vma_interval_tree_insert(vma, &mapping->i_mmap);
        flush_dcache_mmap_unlock(mapping);
    }
}

1
2
3
4
5
6
7
8
static void
__vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
    struct vm_area_struct *prev, struct rb_node **rb_link,
    struct rb_node *rb_parent)
{
    __vma_link_list(mm, vma, prev, rb_parent);
    __vma_link_rb(mm, vma, rb_link, rb_parent);
}

1
2
3
4
5
6
7
8
9
10
11
unsigned long get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
        unsigned long pgoff, unsigned long flags)
{
    unsigned long (*get_area)(struct file *, unsigned long,
                  unsigned long, unsigned long, unsigned long);
	……
    get_area = current->mm->get_unmapped_area;
	……
    addr = get_area(file, addr, len, pgoff, flags); //查找空闲区间的主要工作由get_area来实现
	……
}

1
2
3
4
5
6
7
8
9
10
11
12
void arch_pick_mmap_layout(struct mm_struct *mm)
{
    unsigned long random_factor = 0UL;
	……
    if (mmap_is_legacy()) {
        mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
        mm->get_unmapped_area = arch_get_unmapped_area; //用于获取地址空间中一个空闲区间
    } else {
        mm->mmap_base = mmap_base(random_factor);
        mm->get_unmapped_area = arch_get_unmapped_area_topdown;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
unsigned long unmapped_area(struct vm_unmapped_area_info *info)
{
    struct mm_struct *mm = current->mm;
    struct vm_area_struct *vma;
    unsigned long length, low_limit, high_limit, gap_start, gap_end;
        
    /************对齐和一些边界检查*******************/
    
    //如果红黑树中最大的间隙也没有请求的length大，就从highest位置查找
    vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
    if (vma->rb_subtree_gap < length)
        goto check_highest;
    /*这里说明有足够大的间隙可以容纳length大小的请求，查看红黑数中vma左侧是否由可容纳length大小的请求*/
    while (true) {
        gap_end = vm_start_gap(vma);
        if (gap_end >= low_limit && vma->vm_rb.rb_left) {
            struct vm_area_struct *left =
                rb_entry(vma->vm_rb.rb_left,
                     struct vm_area_struct, vm_rb);
            if (left->rb_subtree_gap >= length) {
                vma = left;
                continue;
            }
        } 

        gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
check_current:
		……
    //查看红黑数中vma右侧是否由可容纳length大小的请求
        if (vma->vm_rb.rb_right) {
            struct vm_area_struct *right =
                rb_entry(vma->vm_rb.rb_right,
                     struct vm_area_struct, vm_rb);
            if (right->rb_subtree_gap >= length) {
                vma = right;
                continue;
            }
        }
//从红黑树vma的上级查找可容纳length大小的请求
        while (true) {
            struct rb_node *prev = &vma->vm_rb;
            if (!rb_parent(prev))
                goto check_highest;
            vma = rb_entry(rb_parent(prev),
                       struct vm_area_struct, vm_rb);
            if (prev == vma->vm_rb.rb_left) {
                gap_start = vm_end_gap(vma->vm_prev);
                gap_end = vm_start_gap(vma);
                goto check_current;
            }
        }
    }

check_highest: //如果前面的查找都没有找到就从地址空间的highest位置查找
    gap_start = mm->highest_vm_end;
    gap_end = ULONG_MAX;  /* Only for VM_BUG_ON below */
    if (gap_start > high_limit)
        return -ENOMEM;

found:
    if (gap_start < info->low_limit)
        gap_start = info->low_limit;

    gap_start += (info->align_offset - gap_start) & info->align_mask;
    return gap_start;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
unsigned long mmap_region(struct file *file, unsigned long addr,
        unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
        struct list_head *uf)
{
    struct mm_struct *mm = current->mm;
    struct vm_area_struct *vma, *prev;
    int error;
    struct rb_node **rb_link, *rb_parent;
    unsigned long charged = 0;
	…………
//查找addr到addr + len区间中重合的映射并解除这些映射，并且返回请求区间的prev和rb_parent
    while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
                  &rb_parent)) {
        if (do_munmap(mm, addr, len, uf))
            return -ENOMEM;
    }
//尝试将addr到addr + len这段区间合并到现有的映射中去
    vma = vma_merge(mm, prev, addr, addr + len, vm_flags,
            NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX);
    if (vma)
        goto out;
//如果没有可以合并的区间就创建一个独立的区间
    vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
    if (!vma) {
        error = -ENOMEM;
        goto unacct_error;
    }
//vma的初始化
    vma->vm_mm = mm;
    vma->vm_start = addr;
    vma->vm_end = addr + len;
    vma->vm_flags = vm_flags;
    vma->vm_page_prot = vm_get_page_prot(vm_flags);
    vma->vm_pgoff = pgoff;
    INIT_LIST_HEAD(&vma->anon_vma_chain);

    if (file) {
		……
        vma->vm_file = get_file(file);
/*如果是文件映射就调用对应的file->f_op->mmap(file, vma)，mmap特定于文件系统，如果是ext2，主要做的事就是vma->vm_ops = &generic_file_vm_ops;*/
        error = call_mmap(file, vma); 
        if (error)
            goto unmap_and_free_vma;

        addr = vma->vm_start;
        vm_flags = vma->vm_flags;
    } else if (vm_flags & VM_SHARED) {
        error = shmem_zero_setup(vma); //如果是共享映射就打开dev/zero作为vma->vm_file
        if (error)
            goto free_vma;
}
/*将vma添加到相关链表中：mm ->mmap，红黑树mm ->mm_rb，和address space vma->vm_file->f_mapping*/
    vma_link(mm, vma, prev, rb_link, rb_parent);
    file = vma->vm_file;
out:
	……
    vma->vm_flags |= VM_SOFTDIRTY;

    vma_set_page_prot(vma);

    return addr;
	……
    return error;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
int do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
          struct list_head *uf)
{   
    unsigned long end;
    struct vm_area_struct *vma, *prev, *last;
    //查找start所在的vma
    vma = find_vma(mm, start);
    if (!vma)
        return 0;
    prev = vma->vm_prev;
    
    end = start + len;
    if (vma->vm_start >= end)
        return 0;
//如果start在vma中间就将vma在start处拆分，保留vma->vm_start到start区间，剩余被删除
    if (start > vma->vm_start) {
        int error;

        error = __split_vma(mm, vma, start, 0);
        if (error)
            return error;
        prev = vma;
    }
//查找start+len，所在的vma
last = find_vma(mm, end);
//如果start+len在vma中间就在start+len处拆分vma，将start+len到last->vm_end保留其余释放
    if (last && end > last->vm_start) { 
        int error = __split_vma(mm, last, end, 1);
        if (error)
            return error;
    }
    vma = prev ? prev->vm_next : mm->mmap;
//从mm ->mmap，红黑树mm ->mm_rb中删除
detach_vmas_to_be_unmapped(mm, vma, prev, end);
//释放页表中映射
    unmap_region(mm, vma, prev, start, end);
//从vma->vm_file->f_mapping中删除
    remove_vma_list(mm, vma);

    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SYSCALL_DEFINE1(brk, unsigned long, brk)
{
    unsigned long retval;
    unsigned long newbrk, oldbrk;
    struct mm_struct *mm = current->mm;
    struct vm_area_struct *next;
    unsigned long min_brk;
    bool populate;
    LIST_HEAD(uf);

    min_brk = mm->start_brk; //获取堆的最低位置
    if (brk < min_brk)
        goto out;

    newbrk = PAGE_ALIGN(brk);
    oldbrk = PAGE_ALIGN(mm->brk);
		……
// mm->brk是堆的当前位置，如果brk小于当前位置说明要释放堆的部分空间
    if (brk <= mm->brk) {
        if (!do_munmap(mm, newbrk, oldbrk-newbrk, &uf)) //释放掉部分堆空间
            goto set_brk;
        goto out;
    }
/*查找进程地址空间中堆所对应的vma的next，如果vma到next中间没有足够的空间就返回，堆是一个连续的虚拟地址区间，区间顶点由mm->brk来指定。*/
    next = find_vma(mm, oldbrk);
    if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
        goto out;
//为堆空间分配地址区间，具体后面讲解
    if (do_brk(oldbrk, newbrk-oldbrk, &uf) < 0)
        goto out;

set_brk:
    mm->brk = brk; //更新堆的增长点
    populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0;
    if (populate) //如果设置了populate，就为新增地址区间分配物理内存
        mm_populate(oldbrk, newbrk - oldbrk);
    return brk;

out:
    retval = mm->brk;
    up_write(&mm->mmap_sem);
    return retval;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags, struct list_head *uf)
{
    struct mm_struct *mm = current->mm;
    struct vm_area_struct *vma, *prev;
    unsigned long len;
    struct rb_node **rb_link, *rb_parent;
    pgoff_t pgoff = addr >> PAGE_SHIFT;
    int error;
//检查addr到addr+len区间是不是空闲
    error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
    if (offset_in_page(error))
        return error;
//查找vma是否已经被其他区间覆盖，如果是就将其释放掉，并且返回vma的prev, rb_link, rb_parent
    while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
                  &rb_parent)) {
        if (do_munmap(mm, addr, len, uf))
            return -ENOMEM;
    }
//尝试与其他vma合并，如果不是进程创建阶段都会合并成功，因为堆只有一个vma。
    vma = vma_merge(mm, prev, addr, addr + len, flags,
            NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX);
    if (vma)
        goto out;
//为堆创建vma
    vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
    if (!vma) {
        vm_unacct_memory(len >> PAGE_SHIFT);
        return -ENOMEM;
    }

    INIT_LIST_HEAD(&vma->anon_vma_chain);
    vma->vm_mm = mm;
    vma->vm_start = addr;
    vma->vm_end = addr + len;
    vma->vm_pgoff = pgoff;
    vma->vm_flags = flags;
    vma->vm_page_prot = vm_get_page_prot(flags);
    vma_link(mm, vma, prev, rb_link, rb_parent);
out:
    perf_event_mmap(vma);
    mm->total_vm += len >> PAGE_SHIFT;
    mm->data_vm += len >> PAGE_SHIFT;
    if (flags & VM_LOCKED)
        mm->locked_vm += (len >> PAGE_SHIFT);
    vma->vm_flags |= VM_SOFTDIRTY;
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
        unsigned int flags)
{
    struct vm_fault vmf = { //暂存异常过程中的信息
        .vma = vma,
        .address = address & PAGE_MASK,
        .flags = flags,
        .pgoff = linear_page_index(vma, address),
        .gfp_mask = __get_fault_gfp_mask(vma),
    };
    struct mm_struct *mm = vma->vm_mm;
    pgd_t *pgd;
    p4d_t *p4d;
    int ret;

    pgd = pgd_offset(mm, address); //获取pgd
    p4d = p4d_alloc(mm, pgd, address); //我们只考虑三级页表的情况，这里的p4d就是pgd
    if (!p4d) 
        return VM_FAULT_OOM;

    vmf.pud = pud_alloc(mm, p4d, address); //在三级页表的系统中pud就是pgd
    if (!vmf.pud)
        return VM_FAULT_OOM;
    ......
    vmf.pmd = pmd_alloc(mm, vmf.pud, address); //如果pmd在pud中不存在就分配一个，并且写到pud中
    if (!vmf.pmd)
        return VM_FAULT_OOM;
......
//前面都是为了构建页表路径，函数handle_pte_fault完成page fault的主要工作
    return handle_pte_fault(&vmf);
}

static int handle_pte_fault(struct vm_fault *vmf)
{
    pte_t entry;

    if (unlikely(pmd_none(*vmf->pmd))) {
        vmf->pte = NULL;
    } else {
        if (pmd_devmap_trans_unstable(vmf->pmd))
            return 0;
        vmf->pte = pte_offset_map(vmf->pmd, vmf->address); //获取pte在pmd中的entry地址
        vmf->orig_pte = *vmf->pte; //获取pte本身的地址，这可能为NULL
    }

    if (!vmf->pte) { // vmf->pte为NULL表明没有对应的物理页
        if (vma_is_anonymous(vmf->vma))
//如果是匿名映射就调用函数do_anonymous_page分配匿名页，匿名映射后面细讲
            return do_anonymous_page(vmf);
        else//如果是文件映射，就走这里
            return do_fault(vmf);
    }
/*程序走到这里说明pte是存在的，下面就是处理这种pte存在却仍然触发异常的情况的*/
if (!pte_present(vmf->orig_pte)) 
/*如果页被交换出去了，就调用函数do_swap_page将页从交换缓存或者交换分区中取出来，页的交换后面有专门的文章讲解，这里就不细讲了*/
        return do_swap_page(vmf);
//如果pte是invalid的，这里使其重新valid
    if (pte_protnone(vmf->orig_pte) && vma_is_accessible(vmf->vma))
        return do_numa_page(vmf);
//下面处理的就是pte只读的，但是有写访问，触发异常的情况
    vmf->ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd);
    spin_lock(vmf->ptl);
    entry = vmf->orig_pte;
    if (unlikely(!pte_same(*vmf->pte, entry)))
        goto unlock;
    if (vmf->flags & FAULT_FLAG_WRITE) {
        if (!pte_write(entry))
            return do_wp_page(vmf);
        entry = pte_mkdirty(entry);
    }
    entry = pte_mkyoung(entry);
    if (ptep_set_access_flags(vmf->vma, vmf->address, vmf->pte, entry,
                vmf->flags & FAULT_FLAG_WRITE)) {
        update_mmu_cache(vmf->vma, vmf->address, vmf->pte);
    } else {
        if (vmf->flags & FAULT_FLAG_WRITE)
            flush_tlb_fix_spurious_fault(vmf->vma, vmf->address);
    }
unlock:
    pte_unmap_unlock(vmf->pte, vmf->ptl);
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
static int do_anonymous_page(struct vm_fault *vmf)
{
    struct vm_area_struct *vma = vmf->vma;
    struct mem_cgroup *memcg;
    struct page *page;
    pte_t entry;

//分配pte页表，并且写到pmd对应entry
    if (pte_alloc(vma->vm_mm, vmf->pmd, vmf->address))
        return VM_FAULT_OOM;

//如果是读触发的缺页异常就将0页写到pte中
    if (!(vmf->flags & FAULT_FLAG_WRITE) &&
            !mm_forbids_zeropage(vma->vm_mm)) {
        entry = pte_mkspecial(pfn_pte(my_zero_pfn(vmf->address),
                        vma->vm_page_prot));
        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                vmf->address, &vmf->ptl);
        if (!pte_none(*vmf->pte))
            goto unlock;
        /* Deliver the page fault to userland, check inside PT lock */
        if (userfaultfd_missing(vma)) {
            pte_unmap_unlock(vmf->pte, vmf->ptl);
            return handle_userfault(vmf, VM_UFFD_MISSING);
        }
        goto setpte;
    }
    
//准备匿名映射自有的相关结构，anon_vma和anon_vma_chain，用于反向映射，后面细讲
    if (unlikely(anon_vma_prepare(vma)))
        goto oom;
//分配一个物理页
    page = alloc_zeroed_user_highpage_movable(vma, vmf->address);
    if (!page)
        goto oom;
    //标识页是更新了的
    __SetPageUptodate(page);
//更具page物理地址和prot创建pte
    entry = mk_pte(page, vma->vm_page_prot);
    if (vma->vm_flags & VM_WRITE)
        entry = pte_mkwrite(pte_mkdirty(entry));
//锁定页表，避免被其他地方修改
    vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,
            &vmf->ptl);
//将页到添加反向映射，后面细讲
    page_add_new_anon_rmap(page, vma, vmf->address, false);
//锁定页并且添加到unevictable_list中
    lru_cache_add_active_or_unevictable(page, vma);
setpte:
    set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);
	………
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
static int do_fault(struct vm_fault *vmf)
{
    struct vm_area_struct *vma = vmf->vma;
    int ret;

    if (!vma->vm_ops->fault)
        ret = VM_FAULT_SIGBUS;
    else if (!(vmf->flags & FAULT_FLAG_WRITE))
        ret = do_read_fault(vmf); //读触发的异常
    else if (!(vma->vm_flags & VM_SHARED))
        ret = do_cow_fault(vmf);//写时复制触发异常
    else
        ret = do_shared_fault(vmf); //写异常和访问共享页触发异常
	…….
    return ret;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
static int __add_to_page_cache_locked(struct page *page,
                      struct address_space *mapping,
                      pgoff_t offset, gfp_t gfp_mask,
                      void **shadowp)
{   
    ......
    get_page(page);
    page->mapping = mapping; //设置address_space到page->mapping
    page->index = offset;

    spin_lock_irq(&mapping->tree_lock);
    error = page_cache_tree_insert(mapping, page, shadowp); //将页插入到页缓存中
    ......
    return error;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
int __anon_vma_prepare(struct vm_area_struct *vma)
{   
    struct mm_struct *mm = vma->vm_mm;
    struct anon_vma *anon_vma, *allocated;
    struct anon_vma_chain *avc;
    //分配avc用于链接vma和anon_vma
    avc = anon_vma_chain_alloc(GFP_KERNEL);
    if (!avc)
        goto out_enomem;
    //每个vma都有一个其对应的anon_vma，这里先尝试与相邻的anon_vma合并，如果不成功就分配
    anon_vma = find_mergeable_anon_vma(vma);
    allocated = NULL;
    if (!anon_vma) {
        anon_vma = anon_vma_alloc();
        if (unlikely(!anon_vma))
            goto out_enomem_free_avc;
        allocated = anon_vma;
    }
    
    if (likely(!vma->anon_vma)) {
        vma->anon_vma = anon_vma;
//让avc连接vma和anon_vma，并且将avc加入到其对应的anon_vma红黑树中
        anon_vma_chain_link(vma, avc, anon_vma); 
        anon_vma->degree++;
        allocated = NULL;
        avc = NULL;
    }
}

1
2
3
4
5
6
7
8
9
static void anon_vma_chain_link(struct vm_area_struct *vma,
                struct anon_vma_chain *avc,
                struct anon_vma *anon_vma)
{   
    avc->vma = vma;
    avc->anon_vma = anon_vma;
    list_add(&avc->same_vma, &vma->anon_vma_chain); //avc添加到vma->anon_vma_chain
    anon_vma_interval_tree_insert(avc, &anon_vma->rb_root);//将avc加入到其对应的anon_vma红黑树中
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
static void __page_set_anon_rmap(struct page *page,
    struct vm_area_struct *vma, unsigned long address, int exclusive)
{       
    struct anon_vma *anon_vma = vma->anon_vma; 
    
    if (PageAnon(page))
        return;
    if (!exclusive)//如果页不是当前进程独享的，也即共享页，就用根anon_vma而不用当前区间anon_vma
        anon_vma = anon_vma->root;
    //让page->mapping指向anon_vma，并用最低位表示为匿名映射
    anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
    page->mapping = (struct address_space *) anon_vma;
    page->index = linear_page_index(vma, address);
}