分析匿名页(anonymous_page)映射

DragonKingZhu

发布于 2020-04-30 18:15:55

1.5K0

发布于 2020-04-30 18:15:55

接着上一次malloc（探秘malloc是如何申请内存的）的dump信息继续分析。

-006|do_anonymous_page(inline)
    |  vma = 0xFFFFFFE314E27310
    |  tsk = 0xFFFFFFE300786640
    |  entry = (pte = 0x00E800026F281F53)
-006|handle_pte_fault(
    |    vmf = 0xFFFFFF80202A3BF0)
-007|handle_mm_fault(
    |    vma = 0xFFFFFFE314E27310,
    |    address = 0x00000076143BC000,
    |    flags = 0x55)
-008|do_page_fault(
    |    addr = 0x00000076143BC008,
    |    esr = 0x92000047,
    |    regs = 0xFFFFFF80202A3EC0)
    |  vma = 0xFFFFFFE314E27310
    |  mm_flags = 0x55
    |  vm_flags = 0x2
    |  major = 0x0
    |  tsk = 0xFFFFFFE300786640
    |  mm = 0xFFFFFFE2EBB33440
-009|test_ti_thread_flag(inline)
-009|do_translation_fault(
    |    addr = 0x00000076143BC008,
    |    esr = 0x92000047,
    |    regs = 0xFFFFFF80202A3EC0)
-010|do_mem_abort(
    |    addr = 0x00000076143BC008,
    |    esr = 0x92000047,
    |    regs = 0xFFFFFF80202A3EC0)
-011|el0_da(asm)
 -->|exception

现在来看下代码的流程

static vm_fault_t do_anonymous_page(struct vm_fault *vmf)
{
    struct vm_area_struct *vma = vmf->vma;
    struct mem_cgroup *memcg;
    struct page *page;
    vm_fault_t ret = 0;
    pte_t entry;
 
    /* File mapping without ->vm_ops ? */
    if (vmf->vma_flags & VM_SHARED)
        return VM_FAULT_SIGBUS;
 
 
    if (pte_alloc(vma->vm_mm, vmf->pmd, vmf->address))
        return VM_FAULT_OOM;

如果是共享的匿名映射，但是没有提供vma→vm_ops则返回VM_FAULT_SIGBUS错误
如果pte不存在，则分配pte。建立pmd和pte的关系

/* Use the zero-page for reads */
if (!(vmf->flags & FAULT_FLAG_WRITE) &&
        !mm_forbids_zeropage(vma->vm_mm)) {
    entry = pte_mkspecial(pfn_pte(my_zero_pfn(vmf->address),
                    vmf->vma_page_prot));
    if (!pte_map_lock(vmf))
        return VM_FAULT_RETRY;
    if (!pte_none(*vmf->pte))
        goto unlock;
    ret = check_stable_address_space(vma->vm_mm);
    if (ret)
        goto unlock;
    /*
     * Don't call the userfaultfd during the speculative path.
     * We already checked for the VMA to not be managed through
     * userfaultfd, but it may be set in our back once we have lock
     * the pte. In such a case we can ignore it this time.
     */
    if (vmf->flags & FAULT_FLAG_SPECULATIVE)
        goto setpte;
    /* Deliver the page fault to userland, check inside PT lock */
    if (userfaultfd_missing(vma)) {
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        return handle_userfault(vmf, VM_UFFD_MISSING);
    }
    goto setpte;
}

如果缺页不是写操作，不是写那就是读么。而且没有强制0页。翻译过来的意思就是：如果是读操作触发的缺页，则映射到一个头通用的零页。这样做是为了提供效率
调用pte_mkspecial生成一个特殊页表项，映射到专有的0页，一页大小

#define my_zero_pfn(addr)   page_to_pfn(ZERO_PAGE(addr))
/*
 * ZERO_PAGE is a global shared page that is always zero: used
 * for zero-mapped memory areas etc..
 */
extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
#define ZERO_PAGE(vaddr)    phys_to_page(__pa_symbol(empty_zero_page))

pte_map_lock ：根据pmd,address找到pte表对应的一个表项，并且lock住
pte_none(*vmf→pte)：如果页表项不为空。我们第一次访问，不可能有值的，所以可能别的进程在使用此物理地址，跳unlock

/* Allocate our own private page. */
if (unlikely(anon_vma_prepare(vma)))
    goto oom;
page = alloc_zeroed_user_highpage_movable(vma, vmf->address);
if (!page)
    goto oom;

分配一个匿名的anon_vma,如果已经存在则跳过
真正的分配一个物理地址，优先从highmem分配。

static inline struct page *
alloc_zeroed_user_highpage_movable(struct vm_area_struct *vma,
                    unsigned long vaddr)
{
#ifndef CONFIG_CMA
    return __alloc_zeroed_user_highpage(__GFP_MOVABLE, vma, vaddr);
#else
    return __alloc_zeroed_user_highpage(__GFP_MOVABLE|__GFP_CMA, vma,
                        vaddr);
#endif
}

如果没有定义CMA，则从高端内存的可移动区域分配
如果定义CMA，则从高端内存的可移动驱动或者CMA中分配物理内存

entry = mk_pte(page, vmf->vma_page_prot);
if (vmf->vma_flags & VM_WRITE)
    entry = pte_mkwrite(pte_mkdirty(entry));
 
if (!pte_map_lock(vmf)) {
    ret = VM_FAULT_RETRY;
    goto release;
}
if (!pte_none(*vmf->pte))
    goto unlock_and_release

和读操作的时候基本一样，只是读操作的时候设置的零页，而我们是分配的真正一个物理page
如果是写的操作，就需要给页表项设置脏页flag==PTE_DIRTY和write flag==PTE_WRITE

    inc_mm_counter_fast(vma->vm_mm, MM_ANONPAGES);
    __page_add_new_anon_rmap(page, vma, vmf->address, false);
    mem_cgroup_commit_charge(page, memcg, false, false);
    __lru_cache_add_active_or_unevictable(page, vmf->vma_flags);
setpte:
    set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);
 
    /* No need to invalidate - it was non-present before */
    update_mmu_cache(vma, vmf->address, vmf->pte);

增加mm_count的引用计数
设置反向映射
将此页添加到LRU链表中去，回收的时候使用
set_pte_at：设置页表项，pte里面的值就是entry
更新mmu的cache，在arm64中update_mmu_cache为空函数，具体操作时在set_pte_at操作的

/*
 * PTE bits configuration in the presence of hardware Dirty Bit Management
 * (PTE_WRITE == PTE_DBM):
 *
 * Dirty  Writable | PTE_RDONLY  PTE_WRITE  PTE_DIRTY (sw)
 *   0      0      |   1           0          0
 *   0      1      |   1           1          0
 *   1      0      |   1           0          1
 *   1      1      |   0           1          x
 *
 * When hardware DBM is not present, the sofware PTE_DIRTY bit is updated via
 * the page fault mechanism. Checking the dirty status of a pte becomes:
 *
 *   PTE_DIRTY || (PTE_WRITE && !PTE_RDONLY)
 */
static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                  pte_t *ptep, pte_t pte)
{
    pte_t old_pte;
 
    if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
        __sync_icache_dcache(pte);
 
    /*
     * If the existing pte is valid, check for potential race with
     * hardware updates of the pte (ptep_set_access_flags safely changes
     * valid ptes without going through an invalid entry).
     */
    old_pte = READ_ONCE(*ptep);
    if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
       (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
        VM_WARN_ONCE(!pte_young(pte),
                 "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
                 __func__, pte_val(old_pte), pte_val(pte));
        VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
                 "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
                 __func__, pte_val(old_pte), pte_val(pte));
    }
 
    set_pte(ptep, pte);
}