do_mmap解读

最新推荐文章于 2024-03-19 19:21:45 发布

转载最新推荐文章于 2024-03-19 19:21:45 发布 · 398 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/long123king/p/3527330.html

本文深入探讨Linux的mmap函数工作原理，包括文件映射、匿名映射、共享和私有映射的区别，以及映射过程中的权限检查、地址随机化等关键步骤。详细分析了mmap函数内部实现，如地址选择、文件读取和页故障处理。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

 
unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, 
            unsigned long len, unsigned long prot, 
            unsigned long flags, unsigned long pgoff) 
{ 
    struct mm_struct * mm = current->mm; 
    struct inode *inode; 
    vm_flags_t vm_flags; 
    int error; 
    unsigned long reqprot = prot; 
   
    /* 
     * Does the application expect PROT_READ to imply PROT_EXEC? 
     * 
     * (the exception is when the underlying filesystem is noexec 
     *  mounted, in which case we dont add PROT_EXEC.) 
     */ 
    if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC)) 
        if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC))) 
            prot |= PROT_EXEC; 
   
    if (!len) 
        return -EINVAL; 
   
    if (!(flags & MAP_FIXED)) 
        addr = round_hint_to_min(addr); 
  

1. personality

Linux has the concept of personality of an executable (since 1.1.20). The purpose is to make the Linux environment more similar to some other environment, like BSD or SCO or Solaris or older Linux, so that foreign or old binaries have better chances of working without modification.

http://blog.chinaunix.net/uid-20357359-id-1963659.html

2. 如果调用都没有要求MAP_FIXED，即可以由内核来决定将文件映射到哪个内存地址上。

addr = round_hint_to_min(addr);

根据函数的名字，可以猜到它的意图是“随机化地设置映射文件的开始地址”，以防止恶意程序对代码位置的猜测和利用。

 
/* 
 * If a hint addr is less than mmap_min_addr change hint to be as 
 * low as possible but still greater than mmap_min_addr 
 */ 
static inline unsigned long round_hint_to_min(unsigned long hint) 
{ 
    hint &= PAGE_MASK; 
    if (((void *)hint != NULL) && 
        (hint < mmap_min_addr)) 
        return PAGE_ALIGN(mmap_min_addr); 
    return hint; 
} 
  

不过好像没有做什么？

映射的几种类型

 
if (file) { 
        switch (flags & MAP_TYPE) { 
        case MAP_SHARED: 
            if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE)) 
                return -EACCES; 
   
            /* 
             * Make sure we don't allow writing to an append-only 
             * file.. 
             */ 
            if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE)) 
                return -EACCES; 
   
            /* 
             * Make sure there are no mandatory locks on the file. 
             */ 
            if (locks_verify_locked(inode)) 
                return -EAGAIN; 
   
            vm_flags |= VM_SHARED | VM_MAYSHARE; 
            if (!(file->f_mode & FMODE_WRITE)) 
                vm_flags &= ~(VM_MAYWRITE | VM_SHARED); 
   
            /* fall through */ 
        case MAP_PRIVATE: 
            if (!(file->f_mode & FMODE_READ)) 
                return -EACCES; 
            if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) { 
                if (vm_flags & VM_EXEC) 
                    return -EPERM; 
                vm_flags &= ~VM_MAYEXEC; 
            } 
   
            if (!file->f_op || !file->f_op->mmap) 
                return -ENODEV; 
            break; 
   
        default: 
            return -EINVAL; 
        } 
    } else { 
        switch (flags & MAP_TYPE) { 
        case MAP_SHARED: 
            /* 
             * Ignore pgoff. 
             */ 
            pgoff = 0; 
            vm_flags |= VM_SHARED | VM_MAYSHARE; 
            break; 
        case MAP_PRIVATE: 
            /* 
             * Set pgoff according to addr for anon_vma. 
             */ 
            pgoff = addr >> PAGE_SHIFT; 
            break; 
        default: 
            return -EINVAL; 
        } 
    } 
  

	有后备文件	无后备文件
共享映射	共享文件映射	共享匿名映射
私有映射	私有文件映射	私有匿名映射

 
unsigned long mmap_region(struct file *file, unsigned long addr, 
              unsigned long len, unsigned long flags, 
              vm_flags_t vm_flags, unsigned long pgoff) 
{ 
****** 
if (file) { 
        error = -EINVAL; 
        if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP)) 
            goto free_vma; 
        if (vm_flags & VM_DENYWRITE) { 
            error = deny_write_access(file); 
            if (error) 
                goto free_vma; 
            correct_wcount = 1; 
        } 
        vma->vm_file = file; 
        get_file(file); 
        error = file->f_op->mmap(file, vma); 
        if (error) 
            goto unmap_and_free_vma; 
        if (vm_flags & VM_EXECUTABLE) 
            added_exe_file_vma(mm); 
   
        /* Can addr have changed?? 
         * 
         * Answer: Yes, several device drivers can do it in their 
         *         f_op->mmap method. -DaveM 
         */ 
        addr = vma->vm_start; 
        pgoff = vma->vm_pgoff; 
        vm_flags = vma->vm_flags; 
    } else if (vm_flags & VM_SHARED) { 
        error = shmem_zero_setup(vma); 
        if (error) 
            goto free_vma; 
    } 
   
****** 
} 
  

调用file->f_op->mmap(file,vma)

对于不同类型的文件系统或者是设备驱动，都定义了各自的mmap函数，我们看一下典型的ext2文件系统：

 
/* 
 * We have mostly NULL's here: the current defaults are ok for 
 * the ext2 filesystem. 
 */ 
const struct file_operations ext2_file_operations = { 
    .llseek        = generic_file_llseek, 
    .read        = do_sync_read, 
    .write        = do_sync_write, 
    .aio_read    = generic_file_aio_read, 
    .aio_write    = generic_file_aio_write, 
    .unlocked_ioctl = ext2_ioctl, 
#ifdef CONFIG_COMPAT 
    .compat_ioctl    = ext2_compat_ioctl, 
#endif 
    .mmap        = generic_file_mmap, 
    .open        = dquot_file_open, 
    .release    = ext2_release_file, 
    .fsync        = ext2_fsync, 
    .splice_read    = generic_file_splice_read, 
    .splice_write    = generic_file_splice_write, 
}; 
  

 
   
/* This is used for a general mmap of a disk file */ 
   
int generic_file_mmap(struct file * file, struct vm_area_struct * vma) 
{ 
    struct address_space *mapping = file->f_mapping; 
   
    if (!mapping->a_ops->readpage) 
        return -ENOEXEC; 
    file_accessed(file); 
    vma->vm_ops = &generic_file_vm_ops; 
    vma->vm_flags |= VM_CAN_NONLINEAR; 
    return 0; 
} 
  

file_accessed更新时间戳.

 
const struct vm_operations_struct generic_file_vm_ops = { 
    .fault        = filemap_fault, 
}; 
  

 
/** 
 * filemap_fault - read in file data for page fault handling 
 * @vma:    vma in which the fault was taken 
 * @vmf:    struct vm_fault containing details of the fault 
 * 
 * filemap_fault() is invoked via the vma operations vector for a 
 * mapped memory region to read in file data during a page fault. 
 * 
 * The goto's are kind of ugly, but this streamlines the normal case of having 
 * it in the page cache, and handles the special cases reasonably without 
 * having a lot of duplicated code. 
 */ 
int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 
{ 
    int error; 
    struct file *file = vma->vm_file; 
    struct address_space *mapping = file->f_mapping; 
    struct file_ra_state *ra = &file->f_ra; 
    struct inode *inode = mapping->host; 
    pgoff_t offset = vmf->pgoff; 
    struct page *page; 
    pgoff_t size; 
    int ret = 0; 
   
    size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT; 
    if (offset >= size) 
        return VM_FAULT_SIGBUS; 
   
    /* 
     * Do we have something in the page cache already? 
     */ 
    page = find_get_page(mapping, offset); 
    if (likely(page)) { 
        /* 
         * We found the page, so try async readahead before 
         * waiting for the lock. 
         */ 
        do_async_mmap_readahead(vma, ra, file, page, offset); 
    } else { 
        /* No page in the page cache at all */ 
        do_sync_mmap_readahead(vma, ra, file, offset); 
        count_vm_event(PGMAJFAULT); 
        mem_cgroup_count_vm_event(vma->vm_mm, PGMAJFAULT); 
        ret = VM_FAULT_MAJOR; 
retry_find: 
        page = find_get_page(mapping, offset); 
        if (!page) 
            goto no_cached_page; 
    } 
   
    if (!lock_page_or_retry(page, vma->vm_mm, vmf->flags)) { 
        page_cache_release(page); 
        return ret | VM_FAULT_RETRY; 
    } 
   
    /* Did it get truncated? */ 
    if (unlikely(page->mapping != mapping)) { 
        unlock_page(page); 
        put_page(page); 
        goto retry_find; 
    } 
    VM_BUG_ON(page->index != offset); 
   
    /* 
     * We have a locked page in the page cache, now we need to check 
     * that it's up-to-date. If not, it is going to be due to an error. 
     */ 
    if (unlikely(!PageUptodate(page))) 
        goto page_not_uptodate; 
   
    /* 
     * Found the page and have a reference on it. 
     * We must recheck i_size under page lock. 
     */ 
    size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT; 
    if (unlikely(offset >= size)) { 
        unlock_page(page); 
        page_cache_release(page); 
        return VM_FAULT_SIGBUS; 
    } 
   
    vmf->page = page; 
    return ret | VM_FAULT_LOCKED; 
   
no_cached_page: 
    /* 
     * We're only likely to ever get here if MADV_RANDOM is in 
     * effect. 
     */ 
    error = page_cache_read(file, offset); 
   
    /* 
     * The page we want has now been added to the page cache. 
     * In the unlikely event that someone removed it in the 
     * meantime, we'll just come back here and read it again. 
     */ 
    if (error >= 0) 
        goto retry_find; 
   
    /* 
     * An error return from page_cache_read can result if the 
     * system is low on memory, or a problem occurs while trying 
     * to schedule I/O. 
     */ 
    if (error == -ENOMEM) 
        return VM_FAULT_OOM; 
    return VM_FAULT_SIGBUS; 
   
page_not_uptodate: 
    /* 
     * Umm, take care of errors if the page isn't up-to-date. 
     * Try to re-read it _once_. We do this synchronously, 
     * because there really aren't any performance issues here 
     * and we need to check for errors. 
     */ 
    ClearPageError(page); 
    error = mapping->a_ops->readpage(file, page); 
    if (!error) { 
        wait_on_page_locked(page); 
        if (!PageUptodate(page)) 
            error = -EIO; 
    } 
    page_cache_release(page); 
   
    if (!error || error == AOP_TRUNCATED_PAGE) 
        goto retry_find; 
   
    /* Things didn't work out. Return zero to tell the mm layer so. */ 
    shrink_readahead_size_eio(file, ra); 
    return VM_FAULT_SIGBUS; 
} 
EXPORT_SYMBOL(filemap_fault); 
  

函数filemap_fault是文件映射的精华，代表着当进程读取映射的地址范围中的某个地址时，如果发生缺页异常，就由该函数负责从文件中读取真实的内容。

如果请求的页不在address_space->page_tree中，那么需要重新从文件中读取：

 
/** 
 * page_cache_read - adds requested page to the page cache if not already there 
 * @file:    file to read 
 * @offset:    page index 
 * 
 * This adds the requested page to the page cache if it isn't already there, 
 * and schedules an I/O to read in its contents from disk. 
 */ 
static int page_cache_read(struct file *file, pgoff_t offset) 
{ 
    struct address_space *mapping = file->f_mapping; 
    struct page *page;  
    int ret; 
   
    do { 
        page = page_cache_alloc_cold(mapping); 
        if (!page) 
            return -ENOMEM; 
   
        ret = add_to_page_cache_lru(page, mapping, offset, GFP_KERNEL); 
        if (ret == 0) 
            ret = mapping->a_ops->readpage(file, page); 
        else if (ret == -EEXIST) 
            ret = 0; /* losing race to add is OK */ 
   
        page_cache_release(page); 
   
    } while (ret == AOP_TRUNCATED_PAGE); 
         
    return ret; 
} 
  

因为每个inode都只有一个address_space结构体成员，所以所有映射到该inode的内存页面都被维护在page_tree中，这样就可以保证多个进程之间的共享文件机制了，实际上是共享了这些页面。

但是，对于每个进程都采用私有映射的文件，是怎么处理的呢？

私有映射的文件，会采用写时复制的机制，这也就是为什么说

MAP_PRIVATE

用于创建一个与数据源分离的私有映射，对区域的写入操作不影响数据源文件中的内容

也保证了多个进程对文件的操作上互相独立。

可以预见，是没有办法让两个进程同时以写方式，独立地打开同一个文件的内存映射，否则会产生不一致现象。

对于采用共享方式映射的VMA，如果没有后备文件，就采用共享内存的方式映射：

 
/** 
 * shmem_zero_setup - setup a shared anonymous mapping 
 * @vma: the vma to be mmapped is prepared by do_mmap_pgoff 
 */ 
int shmem_zero_setup(struct vm_area_struct *vma) 
{ 
    struct file *file; 
    loff_t size = vma->vm_end - vma->vm_start; 
   
    file = shmem_file_setup("dev/zero", size, vma->vm_flags); 
    if (IS_ERR(file)) 
        return PTR_ERR(file); 
   
    if (vma->vm_file) 
        fput(vma->vm_file); 
    vma->vm_file = file; 
    vma->vm_ops = &shmem_vm_ops; 
    vma->vm_flags |= VM_CAN_NONLINEAR; 
    return 0; 
} 
  

其实是使用设备文件dev/zero来初始化这片内存区域。

 
static const struct vm_operations_struct shmem_vm_ops = { 
    .fault        = shmem_fault, 
#ifdef CONFIG_NUMA 
    .set_policy     = shmem_set_policy, 
    .get_policy     = shmem_get_policy, 
#endif 
}; 
  

并且采用 shmem_fault来处理缺页异常

 
static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 
{ 
    struct inode *inode = vma->vm_file->f_path.dentry->d_inode; 
    int error; 
    int ret; 
   
    if (((loff_t)vmf->pgoff << PAGE_CACHE_SHIFT) >= i_size_read(inode)) 
        return VM_FAULT_SIGBUS; 
   
    error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret); 
    if (error) 
        return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS); 
    if (ret & VM_FAULT_MAJOR) { 
        count_vm_event(PGMAJFAULT); 
        mem_cgroup_count_vm_event(vma->vm_mm, PGMAJFAULT); 
    } 
    return ret | VM_FAULT_LOCKED; 
} 
  

转载于:https://www.cnblogs.com/long123king/p/3527330.html