[linux内存管理] 第040篇 文件映射与匿名映射

cat /proc/meminfo
MemTotal:        8175324 kB
MemFree:          142324 kB
Buffers:          125688 kB     # 缓冲区（文件页）
Cached:          4123456 kB     # 页面缓存（文件页）
SwapCached:        12456 kB     # 交换缓存（匿名页相关）
AnonPages:       2123456 kB     # 匿名页总量
Mapped:           856744 kB     # 文件映射页

[root@virt-machine mnt]#cat /proc/1/maps
00400000-00601000 r-xp 00000000 fe:00 15                                 /bin/busybox
00611000-00618000 r--p 00201000 fe:00 15                                 /bin/busybox
00618000-0061b000 rw-p 00208000 fe:00 15                                 /bin/busybox
0061b000-00622000 rw-p 00000000 00:00 0
26797000-267b9000 rw-p 00000000 00:00 0                                  [heap]   # 匿名页
7f86efa000-7f86efc000 r--p 00000000 00:00 0                              [vvar]
7f86efc000-7f86efd000 r-xp 00000000 00:00 0                              [vdso]
7fff210000-7fff231000 rw-p 00000000 00:00 0                              [stack]  # 匿名页

void *addr = mmap(NULL, size, PROT_READ|PROT_WRITE, 
                  MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);

// 1. malloc大内存分配
ptr = malloc(1*1024*1024);  // 1MB以上可能用私有匿名映射

// 2. 线程栈（pthread_create内部使用）
pthread_t thread;
pthread_create(&thread, NULL, func, NULL);

// 3. .bss段扩展
static char large_buffer[10*1024*1024];  // 大未初始化全局变量

void *addr = mmap(NULL, size, PROT_READ|PROT_WRITE,
                  MAP_SHARED|MAP_ANONYMOUS, -1, 0);

// 1. 父子进程间通信（fork后）
pid_t pid = fork();
if (pid == 0) {
    // 子进程能看到父进程在共享映射中的修改
} else {
    // 父进程
}

int fd = open("file.txt", O_RDONLY);
void *addr = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);

// 1. 动态库加载（最重要的应用！）
// ld.so加载libc.so时使用私有文件映射
$ ldd /bin/ls
    linux-vdso.so.1 (0x00007ffd45df0000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f8c1a200000)

// 2. 可执行文件代码段
// 所有.text段都是私有文件映射（可写时变成私有匿名）

// 3. 数据库的内存映射文件（只读查询）
void *db_data = mmap(NULL, db_size, PROT_READ, 
                     MAP_PRIVATE, db_fd, 0);

int fd = open("shared.data", O_RDWR|O_CREAT, 0644);
ftruncate(fd, size);
void *addr = mmap(NULL, size, PROT_READ|PROT_WRITE, 
                  MAP_SHARED, fd, 0);

// 1. 进程间通信（IPC）
// 进程A：
void *shm = mmap(NULL, SIZE, PROT_READ|PROT_WRITE, 
                 MAP_SHARED, fd, 0);
*(int*)shm = 42;  // 进程B能看到

// 2. 内存数据库（Redis的RDB/AOF）
// 将数据库文件映射到内存，修改自动同步

// 3. 零拷贝文件I/O
// 避免read/write的系统调用和缓冲区拷贝

#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <unistd.h>

int global_var;              // .bss段 → 私有匿名映射（初始时）
const int const_global = 42; // .rodata → 私有文件映射

int main() {
    int stack_var;           // 栈 → 私有匿名映射
    static int static_var;   // .bss → 私有匿名映射
    
    // 1. 堆内存（glibc管理）
    char *heap_mem = malloc(2*1024*1024);  // 可能使用私有匿名映射
    
    // 2. 私有文件映射
    int fd1 = open("/bin/ls", O_RDONLY);
    void *code_map = mmap(NULL, 4096, PROT_READ, 
                         MAP_PRIVATE, fd1, 0);
    
    // 3. 共享文件映射
    int fd2 = open("/tmp/shared", O_RDWR|O_CREAT, 0644);
    ftruncate(fd2, 4096);
    void *shared_map = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                           MAP_SHARED, fd2, 0);
    
    // 4. 共享匿名映射
    int memfd = memfd_create("anon_shm", 0);
    ftruncate(memfd, 4096);
    void *anon_shared = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                            MAP_SHARED, memfd, 0);
    
        // 访问映射区域，触发实际分配
    if (shared_map) {
        memset(shared_map, 'A', 4096);  // 写入共享文件映射
    }

    if (anon_shared) {
        memset(anon_shared, 'B', 4096); // 写入共享匿名映射
    }

    if (code_map) {
        char first_byte = *((char*)code_map); // 读取ls的代码
        printf("First byte of /bin/ls: 0x%02x\n", first_byte);
    }

    // 分配大量堆内存
    char *big_heap = malloc(2*1024*1024);  // 2MB
    if (big_heap) {
        memset(big_heap, 'C', 2*1024*1024);
    }

    while(1){
    
    };
    return 0;
}

ubuntu@sh-liuqiN:~$ pmap -x 45523
45523:   ./a.out
Address           Kbytes     RSS   Dirty Mode  Mapping
0000000000400000       4       4       0 r---- a.out
0000000000401000     604     604       0 r-x-- a.out
0000000000498000     164     160       0 r---- a.out
00000000004c1000      16      16       8 r---- a.out
00000000004c5000      12      12      12 rw--- a.out
00000000004c8000      20       8       8 rw---   [ anon ]
0000000008b58000     136       8       8 rw---   [ anon ]
0000741bbbc6f000    2052    2052    2052 rw---   [ anon ]
0000741bbbe70000       4       4       4 rw-s- memfd:anon_shm (deleted)
0000741bbbe71000       4       4       4 rw-s- shared
0000741bbbe72000       4       4       0 r---- ls
00007ffe5a28c000     132      12      12 rw---   [ stack ]
00007ffe5a374000      16       0       0 r----   [ anon ]
00007ffe5a378000       8       4       0 r-x--   [ anon ]
---------------- ------- ------- -------
total kB            3176    2892    2108

	if (!vmf->pte) {
		if (vma_is_anonymous(vmf->vma))
			return do_anonymous_page(vmf);  ///处理匿名映射
		else
			return do_fault(vmf);           ///文件映射
	}

/*
 * Empty_zero_page is a special page that is used for zero-initialized data
 * and COW.
 */
unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] __page_aligned_bss;
EXPORT_SYMBOL(empty_zero_page);

static vm_fault_t do_anonymous_page(struct vm_fault *vmf)
{
    //...    

    ///处理分配页面只读情况，系统返回零页
	/* Use the zero-page for reads */
	if (!(vmf->flags & FAULT_FLAG_WRITE) &&
			!mm_forbids_zeropage(vma->vm_mm)) {
		///my_zero_pfn获取零页的页帧号
		entry = pte_mkspecial(pfn_pte(my_zero_pfn(vmf->address),
						vma->vm_page_prot));

		///获取pte页表项，同时获取锁保护
		vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
				vmf->address, &vmf->ptl);
		if (!pte_none(*vmf->pte)) {
			update_mmu_tlb(vma, vmf->address, vmf->pte);
			goto unlock;
		}
		ret = check_stable_address_space(vma->vm_mm);
		if (ret)
			goto unlock;
		/* Deliver the page fault to userland, check inside PT lock */
		if (userfaultfd_missing(vma)) {
			pte_unmap_unlock(vmf->pte, vmf->ptl);
			return handle_userfault(vmf, VM_UFFD_MISSING);
		}
		goto setpte;  ///读情况处理完，跳转setpte
	}
    //...
setpte:
	set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);   ///填写页表项到硬件页表

	/* No need to invalidate - it was non-present before */
	update_mmu_cache(vma, vmf->address, vmf->pte);
unlock:
	pte_unmap_unlock(vmf->pte, vmf->ptl);
	return ret;
    //...
}

static inline pte_t pte_mkspecial(pte_t pte)
{
	return set_pte_bit(pte, __pgprot(PTE_SPECIAL));
}

// test_zero_page.c
#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>
#include <string.h>

int main() {
    printf("PID: %d\n", getpid());
    
    // 分配一页匿名内存
    void *addr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                     MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
    if (addr == MAP_FAILED) {
        perror("mmap failed");
        return 1;
    }
    
    printf("映射地址: %p\n", addr);
    
    // 阶段1：第一次读取（触发零页映射）
    printf("\n=== 第一次读取 ===\n");
    printf("读取前 - 按回车继续...");
    getchar();
    
    char value = *((char*)addr);  // 第一次读取
    printf("读取的值: %d (应为0)\n", value);
    
    printf("读取后 - 查看页表状态，按回车继续...");
    getchar();
    
    // 阶段2：第一次写入（触发COW分配新页）
    printf("\n=== 第一次写入 ===\n");
    *((char*)addr) = 'A';  // 第一次写入
    
    printf("写入后 - 查看物理页变化，按回车退出...");
    getchar();
    
    return 0;
}

虚拟地址: 0xf7cbd000

四级页表状态:
1. PGD (Page Global Directory): 已分配 ✓
2. PUD (Page Upper Directory):  已分配 ✓ (0xffffff800350c018)
3. PMD (Page Middle Directory): 已分配 ✓ (0xffffff80034abdf0)
4. PTE (Page Table Entry):      未分配 ✗ (0x0)

内存映射状态:
虚拟地址空间: 已预留 ✓ (VMA存在)
页表映射:     未建立 ✗ (PTE为空)
物理内存:     未分配 ✗ (page=0x0)

[root@virt-machine mnt]#./test_mmap
[  126.395667] [LIUQI][PageFault][do_anonymous_page] WRITE!
[  126.420632] [LIUQI][PageFault][do_wp_page] triger do_swap_page.
[  126.461501] [LIUQI][PageFault][do_anonymous_page] WRITE!
[  126.504871] [LIUQI][PageFault][do_anonymous_page] WRITE!
PID: 127
映射地址: 0xf7db6000

=== 第一次读取 ===
[  126.584772] [LIUQI][PageFault][do_anonymous_page] WRITE!
读取前 - 按回车继续...
[  126.633565] [LIUQI][PageFault][do_anonymous_page] WRITE!
读取的值: 0 (应为0)
读取后 - 查看页表状态，按回车继续...

///处理vma可写情况
	/* Allocate our own private page. */
	///为建立rmap做准备
	if (unlikely(anon_vma_prepare(vma)))
		goto oom;
	///分配一个可移动的匿名物理页面，优先使用高端内存(arm64不存在高端内存)
	page = alloc_zeroed_user_highpage_movable(vma, vmf->address);
	if (!page)
		goto oom;

	if (mem_cgroup_charge(page, vma->vm_mm, GFP_KERNEL))
		goto oom_free_page;
	cgroup_throttle_swaprate(page, GFP_KERNEL);

	/*
	 * The memory barrier inside __SetPageUptodate makes sure that
	 * preceding stores to the page contents become visible before
	 * the set_pte_at() write.
	 */
	__SetPageUptodate(page); ///添加内存屏障

	entry = mk_pte(page, vma->vm_page_prot);  ///创建一个pte页表项
	entry = pte_sw_mkyoung(entry);
	if (vma->vm_flags & VM_WRITE)
		entry = pte_mkwrite(pte_mkdirty(entry));  ///设置可写标记

	vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,  ///获取pte页表项，并获得自旋锁，保证不被锁和打断
			&vmf->ptl);
	if (!pte_none(*vmf->pte)) {
		update_mmu_cache(vma, vmf->address, vmf->pte);
		goto release;
	}

	ret = check_stable_address_space(vma->vm_mm);
	if (ret)
		goto release;

	/* Deliver the page fault to userland, check inside PT lock */
	if (userfaultfd_missing(vma)) {
		pte_unmap_unlock(vmf->pte, vmf->ptl);
		put_page(page);
		return handle_userfault(vmf, VM_UFFD_MISSING);
	}

	inc_mm_counter_fast(vma->vm_mm, MM_ANONPAGES);             ///增加进程匿名页计数
	page_add_new_anon_rmap(page, vma, vmf->address, false);    ///匿名页面添加到rmap系统
	lru_cache_add_inactive_or_unevictable(page, vma);          ///匿名页面添加到lru
setpte:
	set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);   ///填写页表项到硬件页表

	/* No need to invalidate - it was non-present before */
	update_mmu_cache(vma, vmf->address, vmf->pte);
unlock:
	pte_unmap_unlock(vmf->pte, vmf->ptl);
	return ret;
release:
	put_page(page);
	goto unlock;
oom_free_page:
	put_page(page);
oom:
	return VM_FAULT_OOM;
}

#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>
#include <string.h>

int main() {
    printf("PID: %d\n", getpid());

    // 分配一页匿名内存
    void *addr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                     MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
    if (addr == MAP_FAILED) {
        perror("mmap failed");
        return 1;
    }

    printf("映射地址: %p\n", addr);

    // 第一次写入（触发COW分配新页）
    printf("\n=== 第一次写入 ===\n");
    *((char*)addr) = 'A';  // 第一次写入

    printf("写入后 - 查看物理页变化，按回车退出...");
    getchar();

    return 0;
}

PID: 130
映射地址: 0xf7899000

=== 第一次写入 ===
[ 1127.043013] [LIUQI][PageFault][do_anonymous_page] WRITE!
[ 1127.125955] [LIUQI][PageFault][do_anonymous_page] WRITE!
写入后 - 查看物理页变化，按回车退出...
读取的值: A (应为A)
读取后 - 查看页表状态，按回车继续...

static vm_fault_t do_anonymous_page(struct vm_fault *vmf)
{

	/* File mapping without ->vm_ops ? */
	if (vma->vm_flags & VM_SHARED)
		return VM_FAULT_SIGBUS;
//...
}

unsigned long do_mmap(struct file *file, unsigned long addr,
			unsigned long len, unsigned long prot,
			unsigned long flags, unsigned long pgoff,
			unsigned long *populate, struct list_head *uf)
{
//...
		switch (flags & MAP_TYPE) {
		case MAP_SHARED:
			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
				return -EINVAL;
			/*
			 * Ignore pgoff.
			 */
			pgoff = 0;
             // 通过上层设置的MAP_SHARED标志，设置vm_flags为 VM_SHARED
			vm_flags |= VM_SHARED | VM_MAYSHARE;
			break;


         //...
	addr = mmap_region(file, addr, len, vm_flags, pgoff, uf); 

}

unsigned long mmap_region(struct file *file, unsigned long addr,
		unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
		struct list_head *uf)
{
    //...
	} else if (vm_flags & VM_SHARED) {
		error = shmem_zero_setup(vma);
		if (error)
			goto free_vma;

    //...

}

int shmem_zero_setup(struct vm_area_struct *vma)
{
	struct file *file;
	loff_t size = vma->vm_end - vma->vm_start;

	/*
	 * Cloning a new file under mmap_lock leads to a lock ordering conflict
	 * between XFS directory reading and selinux: since this file is only
	 * accessible to the user through its mapping, use S_PRIVATE flag to
	 * bypass file security, in the same way as shmem_kernel_file_setup().
	 */
    //  tmpfs（shmem）文件系统中创建一个匿名的、内存中的文件对象
	file = shmem_kernel_file_setup("dev/zero", size, vma->vm_flags);
	if (IS_ERR(file))
		return PTR_ERR(file);

	if (vma->vm_file)
		fput(vma->vm_file);
    // 将新创建的 shmem 文件与这个 VMA 进行强绑定
	vma->vm_file = file;
	vma->vm_ops = &shmem_vm_ops;

	return 0;
}

static const struct vm_operations_struct shmem_vm_ops = {
	.fault		= shmem_fault,
	.map_pages	= filemap_map_pages,
#ifdef CONFIG_NUMA
	.set_policy     = shmem_set_policy,
	.get_policy     = shmem_get_policy,
#endif
};

static vm_fault_t handle_pte_fault(struct vm_fault *vmf)
{
    //...
	if (!vmf->pte) {
		if (vma_is_anonymous(vmf->vma)) {
			return do_anonymous_page(vmf);
		}
		else {
			return do_fault(vmf);
		}
	}
    //...
}

static inline bool vma_is_anonymous(struct vm_area_struct *vma)
{
	return !vma->vm_ops;
}

unsigned long mmap_region(struct file *file, unsigned long addr,
		unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
		struct list_head *uf)
{
    //...
	vma = vm_area_alloc(mm);
	if (!vma) {
		error = -ENOMEM;
		goto unacct_error;
	}

	vma->vm_start = addr;
	vma->vm_end = end;
	vma->vm_flags = vm_flags;
	vma->vm_page_prot = vm_get_page_prot(vm_flags);
	vma->vm_pgoff = pgoff;
    // 只有当传入的 file 指针非空时（即文件映射）
	if (file) {
		if (vm_flags & VM_SHARED) {
			error = mapping_map_writable(file->f_mapping);
			if (error)
				goto free_vma;
		}
        // 绑定文件对象
		vma->vm_file = get_file(file);
        //调用文件系统驱动
		error = call_mmap(file, vma);
        //...
    }
    //...
}

static inline int call_mmap(struct file *file, struct vm_area_struct *vma)
{
	return file->f_op->mmap(file, vma);
}

// fs/ext4/file.c
const struct file_operations ext4_file_operations = {
	.llseek		= ext4_llseek,
	.read_iter	= ext4_file_read_iter,
	.write_iter	= ext4_file_write_iter,
	.iopoll		= iocb_bio_iopoll,
	.unlocked_ioctl = ext4_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl	= ext4_compat_ioctl,
#endif
	.mmap		= ext4_file_mmap,
	.mmap_supported_flags = MAP_SYNC,
	.open		= ext4_file_open,
	.release	= ext4_release_file,
	.fsync		= ext4_sync_file,
	.get_unmapped_area = thp_get_unmapped_area,
	.splice_read	= generic_file_splice_read,
	.splice_write	= iter_file_splice_write,
	.fallocate	= ext4_fallocate,
};

static int ext4_file_mmap(struct file *file, struct vm_area_struct *vma)
{
      ...........
        file_accessed(file);
        if (IS_DAX(file_inode(file))) {
                vma->vm_ops = &ext4_dax_vm_ops;
                vm_flags_set(vma, VM_HUGEPAGE);
        } else {
                vma->vm_ops = &ext4_file_vm_ops;
        }
        return 0;
}

// fs/erofs/data.c
int generic_file_mmap(struct file *file, struct vm_area_struct *vma)
{
	struct address_space *mapping = file->f_mapping;

	if (!mapping->a_ops->read_folio)
		return -ENOEXEC;
	file_accessed(file);
	vma->vm_ops = &generic_file_vm_ops;
	return 0;
}

const struct file_operations erofs_file_fops = {
	.llseek		= generic_file_llseek,
	.read_iter	= erofs_file_read_iter,
	.mmap		= erofs_file_mmap,
	.splice_read	= generic_file_splice_read,
};

// mm/memory.c
static vm_fault_t do_fault(struct vm_fault *vmf)
{
    struct vm_area_struct *vma = vmf->vma;
    vm_fault_t ret;

    // 判断是读异常还是写异常
    if ((vmf->flags & FAULT_FLAG_WRITE) && // 是写访问
        !(vma->vm_flags & VM_SHARED)) {    // 且是私有映射（MAP_PRIVATE）
        // 私有写：触发写时复制（COW）
        ret = do_cow_fault(vmf);
    } else if (!(vmf->flags & FAULT_FLAG_WRITE)) {
        // 读访问：分配页框，从文件读取数据
        ret = do_read_fault(vmf);
    } else {
        // 共享写：分配页框，从文件读取数据（后续多进程可写同一页）
        ret = do_shared_fault(vmf);
    }
    return ret;
}