vlambda博客
学习文章列表

SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags, unsigned long, fd, unsigned long, off){ long error; error = -EINVAL; if (off & ~PAGE_MASK) //判断off是不是按页対齐的 goto out;
 error = sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);out: return error;}
SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags, unsigned long, fd, unsigned long, pgoff){ struct file *file = NULL; unsigned long retval = -EBADF;
 if (!(flags & MAP_ANONYMOUS)) {//有名文件映射 audit_mmap_fd(fd, flags); if (unlikely(flags & MAP_HUGETLB)) return -EINVAL; file = fget(fd);//根据fd得到对应file结构 if (!file) goto out; if (is_file_hugepages(file))//如果是hugetlbfs文件系统文件，将文件大小对齐到页面大小 len = ALIGN(len, huge_page_size(hstate_file(file))); } else if (flags & MAP_HUGETLB) { struct user_struct *user = NULL; struct hstate *hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & SHM_HUGE_MASK);
 if (!hs) return -EINVAL;
 len = ALIGN(len, huge_page_size(hs)); /* * VM_NORESERVE is used because the reservations will be * taken when vm_ops->mmap() is called * A dummy user value is used because we are not locking * memory so no accounting is necessary */ file = hugetlb_file_setup(HUGETLB_ANON_FILE, len, VM_NORESERVE, &user, HUGETLB_ANONHUGE_INODE, (flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK); if (IS_ERR(file)) return PTR_ERR(file); }
 flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
 retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff); if (file) fput(file);out: return retval;}

unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flag, unsigned long pgoff){ unsigned long ret; struct mm_struct *mm = current->mm; unsigned long populate;
 ret = security_mmap_file(file, prot, flag);//// security_开头的，都是security linux相关的，应该没有人的服务器会开这个，不用理会 if (!ret) { down_write(&mm->mmap_sem); ret = do_mmap_pgoff(file, addr, len, prot, flag, pgoff, &populate); up_write(&mm->mmap_sem); if (populate) mm_populate(ret, populate); } return ret;}
unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long pgoff, unsigned long *populate){ struct mm_struct * mm = current->mm; struct inode *inode; vm_flags_t vm_flags;
 *populate = 0;
 /* * Does the application expect PROT_READ to imply PROT_EXEC? * * (the exception is when the underlying filesystem is noexec * mounted, in which case we dont add PROT_EXEC.) */ //如果进程带有READ_IMPLIES_EXEC标记且文件系统是可执行的，则这段内存空间使用READ的属性会附带增加EXEC属性。 if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC)) if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC))) prot |= PROT_EXEC;
 if (!len) return -EINVAL;
 if (!(flags & MAP_FIXED))////如果不是使用固定地址，则使用addr向下对齐到页 addr = round_hint_to_min(addr);
 /* Careful about overflows.. */ len = PAGE_ALIGN(len); if (!len) return -ENOMEM;
 /* offset overflow? */ if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)////判断是否溢出了 return -EOVERFLOW;
 /* Too many mappings? */ if (mm->map_count > sysctl_max_map_count)//sysctl_max_map_count默认为22 return -ENOMEM;
 /* Obtain the address to map to. we verify (or select) it and ensure * that it represents a valid section of the address space. */ addr = get_unmapped_area(file, addr, len, pgoff, flags);//根据addr及len等，获取未映射的地址空间 if (addr & ~PAGE_MASK)//如果返回的地址不是按照page对齐的，可以直接返回了 return addr;
 /* Do simple checking here so the lower-level routines won't have * to. we assume access permissions have been handled by the open * of the memory object, so we don't do any here. */ vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) | mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 if (flags & MAP_LOCKED) if (!can_do_mlock()) return -EPERM;
 /* mlock MCL_FUTURE? */ if (vm_flags & VM_LOCKED) { unsigned long locked, lock_limit; locked = len >> PAGE_SHIFT; locked += mm->locked_vm; lock_limit = rlimit(RLIMIT_MEMLOCK); lock_limit >>= PAGE_SHIFT; if (locked > lock_limit && !capable(CAP_IPC_LOCK)) return -EAGAIN; }
 inode = file ? file_inode(file) : NULL;
 if (file) { switch (flags & MAP_TYPE) { case MAP_SHARED: if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE)) return -EACCES;
 /* * Make sure we don't allow writing to an append-only * file.. */ if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE)) return -EACCES;
 /* * Make sure there are no mandatory locks on the file. */ if (locks_verify_locked(inode)) return -EAGAIN;
 vm_flags |= VM_SHARED | VM_MAYSHARE; if (!(file->f_mode & FMODE_WRITE)) vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
 /* fall through */ case MAP_PRIVATE: if (!(file->f_mode & FMODE_READ)) return -EACCES; if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) { if (vm_flags & VM_EXEC) return -EPERM; vm_flags &= ~VM_MAYEXEC; }
 if (!file->f_op || !file->f_op->mmap) return -ENODEV; break;
 default: return -EINVAL; } } else { switch (flags & MAP_TYPE) { case MAP_SHARED: /* * Ignore pgoff. */ pgoff = 0; vm_flags |= VM_SHARED | VM_MAYSHARE; break; case MAP_PRIVATE: /* * Set pgoff according to addr for anon_vma. */ pgoff = addr >> PAGE_SHIFT; break; default: return -EINVAL; } } //从上面的代码可以看到，各种映射之间，主要是vm_flag之间的差别 /* * Set 'VM_NORESERVE' if we should not account for the * memory use of this mapping. */ if (flags & MAP_NORESERVE) { /* We honor MAP_NORESERVE if allowed to overcommit */ if (sysctl_overcommit_memory != OVERCOMMIT_NEVER) vm_flags |= VM_NORESERVE;
 /* hugetlb applies strict overcommit unless MAP_NORESERVE */ if (file && is_file_hugepages(file)) vm_flags |= VM_NORESERVE; } //开始映射 addr = mmap_region(file, addr, len, vm_flags, pgoff); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) *populate = len; return addr;}

/* * This function, called very early during the creation of a new * process VM image, sets up which VM layout function to use: */void arch_pick_mmap_layout(struct mm_struct *mm){ mm->mmap_legacy_base = mmap_legacy_base(); mm->mmap_base = mmap_base();
 if (mmap_is_legacy()) {//从低地址向高地址创建新的映射 mm->mmap_base = mm->mmap_legacy_base; mm->get_unmapped_area = arch_get_unmapped_area; mm->unmap_area = arch_unmap_area; } else {//从高地址向低地址创建新的映射 mm->get_unmapped_area = arch_get_unmapped_area_topdown; mm->unmap_area = arch_unmap_area_topdown; }}

unsigned longget_unmapped_area(struct file *file, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags){ unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 unsigned long error = arch_mmap_check(addr, len, flags); if (error) return error;
 /* Careful about overflows.. */ if (len > TASK_SIZE) return -ENOMEM;
 /* 根据线性地址区间是否应该用于文件内存映射或匿名内存映射 */ get_area = current->mm->get_unmapped_area; if (file && file->f_op && file->f_op->get_unmapped_area) get_area = file->f_op->get_unmapped_area; /*  * 当不是用于文件内存映射或是匿名内存映射， * 调用current->mm->get_unmapped_area.  * 即调用arch_get_unmapped_area或arch_get_unmapped_area_topdown */ addr = get_area(file, addr, len, pgoff, flags); if (IS_ERR_VALUE(addr)) return addr;
 if (addr > TASK_SIZE - len) return -ENOMEM; if (addr & ~PAGE_MASK)//如果返回的地址不是按照page对齐的，返回-EINVAL return -EINVAL;
 addr = arch_rebalance_pgtables(addr, len); error = security_mmap_addr(addr); return error ? error : addr;}

unsigned longarch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, const unsigned long len, const unsigned long pgoff, const unsigned long flags){ struct vm_area_struct *vma; struct mm_struct *mm = current->mm; unsigned long addr = addr0; struct vm_unmapped_area_info info;//struct vm_unmapped_area_info,这个数据结构用于管理分配内存请求
 /* requested length too big for entire address space */ if (len > TASK_SIZE) return -ENOMEM;  /* MAP_FIXED : 表示映射将在固定地址创建 */ if (flags & MAP_FIXED) return addr;
 /* for MAP_32BIT mappings we force the legacy mmap base */ if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) goto bottomup;
 /* requesting a specific address */ if (addr) { addr = PAGE_ALIGN(addr); /*  * find_vma 寻找第一个满足 addr < vm_area_struct->vm_end 的vma区 */  vma = find_vma(mm, addr); /* * 以下分别判断： * 1: 请求分配的长度是否小于进程虚拟地址空间大小 * 2: vma是否空 * 3: vma非空，新分配的虚拟地址空间，是否与相邻的vma重合 */ if (TASK_SIZE - len >= addr && (!vma || addr + len <= vma->vm_start)) return addr; }
 info.flags = VM_UNMAPPED_AREA_TOPDOWN;//默认从高地址到低地址的映射 info.length = len; info.low_limit = PAGE_SIZE;//低地址限制，分配的内存起始地址不能小于该值 info.high_limit = mm->mmap_base;//高地址限制，分配的内存结束地址不能大于或等于该值 info.align_mask = 0;//length对齐方式 info.align_offset = pgoff << PAGE_SHIFT;//offset对齐方式 if (filp) { info.align_mask = get_align_mask(); info.align_offset += get_align_bits(); } addr = vm_unmapped_area(&info); if (!(addr & ~PAGE_MASK))//如果返回的地址是按照page对齐的，则直接返回地址，否则按照传统布局重新获取未mmap区域 return addr; VM_BUG_ON(addr != -ENOMEM);
bottomup: /* * A failed mmap() very likely causes application failure, * so fall back to the bottom-up function here. This scenario * can happen with large stack limits and large mmap() * allocations. */ return arch_get_unmapped_area(filp, addr0, len, pgoff, flags);}
static inline unsigned longvm_unmapped_area(struct vm_unmapped_area_info *info){ if (!(info->flags & VM_UNMAPPED_AREA_TOPDOWN)) return unmapped_area(info); else return unmapped_area_topdown(info);//默认走这个分支}

unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info){ struct mm_struct *mm = current->mm; struct vm_area_struct *vma; unsigned long length, low_limit, high_limit, gap_start, gap_end;
 /* Adjust search length to account for worst case alignment overhead */ length = info->length + info->align_mask; if (length < info->length) return -ENOMEM;
 /* * Adjust search limits by the desired length. * See implementation comment at top of unmapped_area(). */ gap_end = info->high_limit; if (gap_end < length) return -ENOMEM; high_limit = gap_end - length;
 if (info->low_limit > high_limit) return -ENOMEM; low_limit = info->low_limit + length;
 /* Check highest gap, which does not precede any rbtree node */ gap_start = mm->highest_vm_end; if (gap_start <= high_limit) goto found_highest;
 /* Check if rbtree root looks promising */ if (RB_EMPTY_ROOT(&mm->mm_rb)) return -ENOMEM; /* 获取根节点的vma，并判断rb_subtree_gap是否满足分配需求， * 如果不满足需求则直接返回-ENOMEM； */ vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb); if (vma->rb_subtree_gap < length) return -ENOMEM;
 while (true) { /* Visit right subtree if it looks promising */ gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; if (gap_start <= high_limit && vma->vm_rb.rb_right) { struct vm_area_struct *right = rb_entry(vma->vm_rb.rb_right, struct vm_area_struct, vm_rb); if (right->rb_subtree_gap >= length) { vma = right; continue; } }
check_current: /* Check if current node has a suitable gap */ gap_end = vma->vm_start; if (gap_end < low_limit) return -ENOMEM; if (gap_start <= high_limit && gap_end - gap_start >= length) goto found;
 /* Visit left subtree if it looks promising */ if (vma->vm_rb.rb_left) { struct vm_area_struct *left = rb_entry(vma->vm_rb.rb_left, struct vm_area_struct, vm_rb); if (left->rb_subtree_gap >= length) { vma = left; continue; } }
 /* Go back up the rbtree to find next candidate node */ while (true) { struct rb_node *prev = &vma->vm_rb; if (!rb_parent(prev)) return -ENOMEM; vma = rb_entry(rb_parent(prev), struct vm_area_struct, vm_rb); if (prev == vma->vm_rb.rb_right) { gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; goto check_current; } } }
found: /* We found a suitable gap. Clip it with the original high_limit. */ if (gap_end > info->high_limit) gap_end = info->high_limit;
found_highest: /* Compute highest gap address at the desired alignment */ gap_end -= info->length; gap_end -= (gap_end - info->align_offset) & info->align_mask;
 VM_BUG_ON(gap_end < info->low_limit); VM_BUG_ON(gap_end < gap_start); return gap_end;}

unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff){ struct mm_struct *mm = current->mm; struct vm_area_struct *vma, *prev; int error; struct rb_node **rb_link, *rb_parent; unsigned long charged = 0;
 /* Check against address space limit. */ //检查mmap后会不会超内存限制 if (!may_expand_vm(mm, len >> PAGE_SHIFT)) { unsigned long nr_pages;
 /* * MAP_FIXED may remove pages of mappings that intersects with * requested mapping. Account for the pages it would unmap. */ if (!(vm_flags & MAP_FIXED)) return -ENOMEM;
 nr_pages = count_vma_pages_range(mm, addr, addr + len);
 if (!may_expand_vm(mm, (len >> PAGE_SHIFT) - nr_pages)) return -ENOMEM; }
 /* Clear old maps */ error = -ENOMEM;munmap_back: //有覆盖的先解映射了 if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) { if (do_munmap(mm, addr, len)) return -ENOMEM; goto munmap_back; }
 /* * Private writable mapping: check memory availability */ if (accountable_mapping(file, vm_flags)) { charged = len >> PAGE_SHIFT; if (security_vm_enough_memory_mm(mm, charged)) return -ENOMEM; vm_flags |= VM_ACCOUNT; }
 /* * Can we just expand an old mapping? */ //如果可以和已有的VMA进行合并，则直接使用该vma vma = vma_merge(mm, prev, addr, addr + len, vm_flags, NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX); if (vma) goto out;
 /* * Determine the object being mapped and call the appropriate * specific mapper. the address has already been validated, but * not unmapped, but the maps are removed from the list. */ //申请一个vma进行map vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); if (!vma) { error = -ENOMEM; goto unacct_error; }
 vma->vm_mm = mm; vma->vm_start = addr; vma->vm_end = addr + len; vma->vm_flags = vm_flags; vma->vm_page_prot = vm_get_page_prot(vm_flags); vma->vm_pgoff = pgoff; INIT_LIST_HEAD(&vma->anon_vma_chain);
 error = -EINVAL; /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
 if (file) { //文件映射 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP)) goto free_vma; if (vm_flags & VM_DENYWRITE) { error = deny_write_access(file); if (error) goto free_vma; } if (vm_flags & VM_SHARED) { error = mapping_map_writable(file->f_mapping); if (error) goto allow_write_and_free_vma; }
 /* ->mmap() can change vma->vm_file, but must guarantee that * vma_link() below can deny write-access if VM_DENYWRITE is set * and map writably if VM_SHARED is set. This usually means the * new file must not have been exposed to user-space, yet. */ vma->vm_file = get_file(file); error = file->f_op->mmap(file, vma);//调用文件系统提供的映射函数 if (error) goto unmap_and_free_vma;
 /* Can addr have changed?? * * Answer: Yes, several device drivers can do it in their * f_op->mmap method. -DaveM * Bug: If addr is changed, prev, rb_link, rb_parent should * be updated for vma_link() */ WARN_ON_ONCE(addr != vma->vm_start);
 //文件系统提供的mmap函数可能会修改映射的一些参数。 // 在这里需要在调用vma_link前回置 addr = vma->vm_start; pgoff = vma->vm_pgoff; vm_flags = vma->vm_flags; } else if (vm_flags & VM_SHARED) {//匿名共享映射 if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP))) goto free_vma; error = shmem_zero_setup(vma);//这里是映射到了/dev/zero这个文件，很巧妙，不需要提前将页面清0 if (error) goto free_vma; }
 //将vma链接回进程mm中 vma_link(mm, vma, prev, rb_link, rb_parent); /* Once vma denies write, undo our temporary denial count */ if (file) { if (vm_flags & VM_SHARED) mapping_unmap_writable(file->f_mapping); if (vm_flags & VM_DENYWRITE) allow_write_access(file); } file = vma->vm_file;out: //perf在这里安插了个event perf_event_mmap(vma);
 //进程内存状态统计，在开启了proc才会有 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT); if (vm_flags & VM_LOCKED) { if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm))) mm->locked_vm += (len >> PAGE_SHIFT); else vma->vm_flags &= ~VM_LOCKED; }
 if (file) uprobe_mmap(vma);
 /* * New (or expanded) vma always get soft dirty status. * Otherwise user-space soft-dirty page tracker won't * be able to distinguish situation when vma area unmapped, * then new mapped in-place (which must be aimed as * a completely new data area). */ vma->vm_flags |= VM_SOFTDIRTY;
 vma_set_page_prot(vma);
 return addr;
unmap_and_free_vma: vma->vm_file = NULL; fput(file);
 /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); charged = 0; if (vm_flags & VM_SHARED) mapping_unmap_writable(file->f_mapping);allow_write_and_free_vma: if (vm_flags & VM_DENYWRITE) allow_write_access(file);free_vma: kmem_cache_free(vm_area_cachep, vma);unacct_error: if (charged) vm_unacct_memory(charged);  return error;}
/** * shmem_zero_setup - setup a shared anonymous mapping * @vma: the vma to be mmapped is prepared by do_mmap_pgoff */int shmem_zero_setup(struct vm_area_struct *vma){ struct file *file; loff_t size = vma->vm_end - vma->vm_start;
 file = shmem_file_setup("dev/zero", size, vma->vm_flags); if (IS_ERR(file)) return PTR_ERR(file);
 if (vma->vm_file) fput(vma->vm_file); vma->vm_file = file; vma->vm_ops = &shmem_vm_ops; return 0;}