• Linux内核有什么之内存管理子系统有什么第五回 —— 小内存分配（3）

    接前一篇文章：Linux内核有什么之内存管理子系统有什么第四回 —— 小内存分配（2）

    本文内容参考：

    内存分配不再神秘：深入剖析malloc函数实现原理与机制

    系统调用与内存管理（sbrk、brk、mmap、munmap）

    Linux系统调用详解（实现机制分析）

    Linux操作系统学习笔记（十）内存管理之内存映射【转】

    《趣谈Linux操作系统 核心原理篇：第四部分 内存管理—— 刘超》

    特此致谢！

    二、小内存分配 —— brk与sbrk

    本回开始对于sys_brk函数的代码内容进行解析。

    1. brk源码解析

    为了方便理解和加深印象，再次贴出源码。brk系统调用实现的入口是sys_brk函数，其代码在内核源码目录下的mm/mmap.c中，代码如下：

    1. SYSCALL_DEFINE1(brk, unsigned long, brk)
    2. {
    3. 	unsigned long newbrk, oldbrk, origbrk;
    4. 	struct mm_struct *mm = current->mm;
    5. 	struct vm_area_struct *brkvma, *next = NULL;
    6. 	unsigned long min_brk;
    7. 	bool populate;
    8. 	bool downgraded = false;
    9. 	LIST_HEAD(uf);
    10. 	MA_STATE(mas, &mm->mm_mt, 0, 0);
    11.  
    12. 	if (mmap_write_lock_killable(mm))
    13. 		return -EINTR;
    14.  
    15. 	origbrk = mm->brk;
    16.  
    17. #ifdef CONFIG_COMPAT_BRK
    18. 	/*
    19. 	 * CONFIG_COMPAT_BRK can still be overridden by setting
    20. 	 * randomize_va_space to 2, which will still cause mm->start_brk
    21. 	 * to be arbitrarily shifted
    22. 	 */
    23. 	if (current->brk_randomized)
    24. 		min_brk = mm->start_brk;
    25. 	else
    26. 		min_brk = mm->end_data;
    27. #else
    28. 	min_brk = mm->start_brk;
    29. #endif
    30. 	if (brk < min_brk)
    31. 		goto out;
    32.  
    33. 	/*
    34. 	 * Check against rlimit here. If this check is done later after the test
    35. 	 * of oldbrk with newbrk then it can escape the test and let the data
    36. 	 * segment grow beyond its set limit the in case where the limit is
    37. 	 * not page aligned -Ram Gupta
    38. 	 */
    39. 	if (check_data_rlimit(rlimit(RLIMIT_DATA), brk, mm->start_brk,
    40. 			      mm->end_data, mm->start_data))
    41. 		goto out;
    42.  
    43. 	newbrk = PAGE_ALIGN(brk);
    44. 	oldbrk = PAGE_ALIGN(mm->brk);
    45. 	if (oldbrk == newbrk) {
    46. 		mm->brk = brk;
    47. 		goto success;
    48. 	}
    49.  
    50. 	/*
    51. 	 * Always allow shrinking brk.
    52. 	 * do_brk_munmap() may downgrade mmap_lock to read.
    53. 	 */
    54. 	if (brk <= mm->brk) {
    55. 		int ret;
    56.  
    57. 		/* Search one past newbrk */
    58. 		mas_set(&mas, newbrk);
    59. 		brkvma = mas_find(&mas, oldbrk);
    60. 		if (!brkvma || brkvma->vm_start >= oldbrk)
    61. 			goto out; /* mapping intersects with an existing non-brk vma. */
    62. 		/*
    63. 		 * mm->brk must be protected by write mmap_lock.
    64. 		 * do_brk_munmap() may downgrade the lock,  so update it
    65. 		 * before calling do_brk_munmap().
    66. 		 */
    67. 		mm->brk = brk;
    68. 		ret = do_brk_munmap(&mas, brkvma, newbrk, oldbrk, &uf);
    69. 		if (ret == 1)  {
    70. 			downgraded = true;
    71. 			goto success;
    72. 		} else if (!ret)
    73. 			goto success;
    74.  
    75. 		mm->brk = origbrk;
    76. 		goto out;
    77. 	}
    78.  
    79. 	if (check_brk_limits(oldbrk, newbrk - oldbrk))
    80. 		goto out;
    81.  
    82. 	/*
    83. 	 * Only check if the next VMA is within the stack_guard_gap of the
    84. 	 * expansion area
    85. 	 */
    86. 	mas_set(&mas, oldbrk);
    87. 	next = mas_find(&mas, newbrk - 1 + PAGE_SIZE + stack_guard_gap);
    88. 	if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
    89. 		goto out;
    90.  
    91. 	brkvma = mas_prev(&mas, mm->start_brk);
    92. 	/* Ok, looks good - let it rip. */
    93. 	if (do_brk_flags(&mas, brkvma, oldbrk, newbrk - oldbrk, 0) < 0)
    94. 		goto out;
    95.  
    96. 	mm->brk = brk;
    97.  
    98. success:
    99. 	populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0;
    100. 	if (downgraded)
    101. 		mmap_read_unlock(mm);
    102. 	else
    103. 		mmap_write_unlock(mm);
    104. 	userfaultfd_unmap_complete(mm, &uf);
    105. 	if (populate)
    106. 		mm_populate(oldbrk, newbrk - oldbrk);
    107. 	return brk;
    108.  
    109. out:
    110. 	mmap_write_unlock(mm);
    111. 	return origbrk;
    112. }

    代码中先来看第一个赋值语句，也是很核心的一句：

    struct mm_struct *mm = current->mm;

    struct mm_struct的定义在include/linux/mm_types.h中，代码如下：

    1. struct mm_struct {
    2. 	struct {
    3. 		struct maple_tree mm_mt;
    4. #ifdef CONFIG_MMU
    5. 		unsigned long (*get_unmapped_area) (struct file *filp,
    6. 				unsigned long addr, unsigned long len,
    7. 				unsigned long pgoff, unsigned long flags);
    8. #endif
    9. 		unsigned long mmap_base;	/* base of mmap area */
    10. 		unsigned long mmap_legacy_base;	/* base of mmap area in bottom-up allocations */
    11. #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
    12. 		/* Base addresses for compatible mmap() */
    13. 		unsigned long mmap_compat_base;
    14. 		unsigned long mmap_compat_legacy_base;
    15. #endif
    16. 		unsigned long task_size;	/* size of task vm space */
    17. 		pgd_t * pgd;
    18.  
    19. #ifdef CONFIG_MEMBARRIER
    20. 		/**
    21. 		 * @membarrier_state: Flags controlling membarrier behavior.
    22. 		 *
    23. 		 * This field is close to @pgd to hopefully fit in the same
    24. 		 * cache-line, which needs to be touched by switch_mm().
    25. 		 */
    26. 		atomic_t membarrier_state;
    27. #endif
    28.  
    29. 		/**
    30. 		 * @mm_users: The number of users including userspace.
    31. 		 *
    32. 		 * Use mmget()/mmget_not_zero()/mmput() to modify. When this
    33. 		 * drops to 0 (i.e. when the task exits and there are no other
    34. 		 * temporary reference holders), we also release a reference on
    35. 		 * @mm_count (which may then free the &struct mm_struct if
    36. 		 * @mm_count also drops to 0).
    37. 		 */
    38. 		atomic_t mm_users;
    39.  
    40. 		/**
    41. 		 * @mm_count: The number of references to &struct mm_struct
    42. 		 * (@mm_users count as 1).
    43. 		 *
    44. 		 * Use mmgrab()/mmdrop() to modify. When this drops to 0, the
    45. 		 * &struct mm_struct is freed.
    46. 		 */
    47. 		atomic_t mm_count;
    48.  
    49. #ifdef CONFIG_MMU
    50. 		atomic_long_t pgtables_bytes;	/* PTE page table pages */
    51. #endif
    52. 		int map_count;			/* number of VMAs */
    53.  
    54. 		spinlock_t page_table_lock; /* Protects page tables and some
    55. 					     * counters
    56. 					     */
    57. 		/*
    58. 		 * With some kernel config, the current mmap_lock's offset
    59. 		 * inside 'mm_struct' is at 0x120, which is very optimal, as
    60. 		 * its two hot fields 'count' and 'owner' sit in 2 different
    61. 		 * cachelines,  and when mmap_lock is highly contended, both
    62. 		 * of the 2 fields will be accessed frequently, current layout
    63. 		 * will help to reduce cache bouncing.
    64. 		 *
    65. 		 * So please be careful with adding new fields before
    66. 		 * mmap_lock, which can easily push the 2 fields into one
    67. 		 * cacheline.
    68. 		 */
    69. 		struct rw_semaphore mmap_lock;
    70.  
    71. 		struct list_head mmlist; /* List of maybe swapped mm's.	These
    72. 					  * are globally strung together off
    73. 					  * init_mm.mmlist, and are protected
    74. 					  * by mmlist_lock
    75. 					  */
    76.  
    77.  
    78. 		unsigned long hiwater_rss; /* High-watermark of RSS usage */
    79. 		unsigned long hiwater_vm;  /* High-water virtual memory usage */
    80.  
    81. 		unsigned long total_vm;	   /* Total pages mapped */
    82. 		unsigned long locked_vm;   /* Pages that have PG_mlocked set */
    83. 		atomic64_t    pinned_vm;   /* Refcount permanently increased */
    84. 		unsigned long data_vm;	   /* VM_WRITE & ~VM_SHARED & ~VM_STACK */
    85. 		unsigned long exec_vm;	   /* VM_EXEC & ~VM_WRITE & ~VM_STACK */
    86. 		unsigned long stack_vm;	   /* VM_STACK */
    87. 		unsigned long def_flags;
    88.  
    89. 		/**
    90. 		 * @write_protect_seq: Locked when any thread is write
    91. 		 * protecting pages mapped by this mm to enforce a later COW,
    92. 		 * for instance during page table copying for fork().
    93. 		 */
    94. 		seqcount_t write_protect_seq;
    95.  
    96. 		spinlock_t arg_lock; /* protect the below fields */
    97.  
    98. 		unsigned long start_code, end_code, start_data, end_data;
    99. 		unsigned long start_brk, brk, start_stack;
    100. 		unsigned long arg_start, arg_end, env_start, env_end;
    101.  
    102. 		unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
    103.  
    104. 		/*
    105. 		 * Special counters, in some configurations protected by the
    106. 		 * page_table_lock, in other configurations by being atomic.
    107. 		 */
    108. 		struct mm_rss_stat rss_stat;
    109.  
    110. 		struct linux_binfmt *binfmt;
    111.  
    112. 		/* Architecture-specific MM context */
    113. 		mm_context_t context;
    114.  
    115. 		unsigned long flags; /* Must use atomic bitops to access */
    116.  
    117. #ifdef CONFIG_AIO
    118. 		spinlock_t			ioctx_lock;
    119. 		struct kioctx_table __rcu	*ioctx_table;
    120. #endif
    121. #ifdef CONFIG_MEMCG
    122. 		/*
    123. 		 * "owner" points to a task that is regarded as the canonical
    124. 		 * user/owner of this mm. All of the following must be true in
    125. 		 * order for it to be changed:
    126. 		 *
    127. 		 * current == mm->owner
    128. 		 * current->mm != mm
    129. 		 * new_owner->mm == mm
    130. 		 * new_owner->alloc_lock is held
    131. 		 */
    132. 		struct task_struct __rcu *owner;
    133. #endif
    134. 		struct user_namespace *user_ns;
    135.  
    136. 		/* store ref to file /proc//exe symlink points to */
    137. 		struct file __rcu *exe_file;
    138. #ifdef CONFIG_MMU_NOTIFIER
    139. 		struct mmu_notifier_subscriptions *notifier_subscriptions;
    140. #endif
    141. #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
    142. 		pgtable_t pmd_huge_pte; /* protected by page_table_lock */
    143. #endif
    144. #ifdef CONFIG_NUMA_BALANCING
    145. 		/*
    146. 		 * numa_next_scan is the next time that PTEs will be remapped
    147. 		 * PROT_NONE to trigger NUMA hinting faults; such faults gather
    148. 		 * statistics and migrate pages to new nodes if necessary.
    149. 		 */
    150. 		unsigned long numa_next_scan;
    151.  
    152. 		/* Restart point for scanning and remapping PTEs. */
    153. 		unsigned long numa_scan_offset;
    154.  
    155. 		/* numa_scan_seq prevents two threads remapping PTEs. */
    156. 		int numa_scan_seq;
    157. #endif
    158. 		/*
    159. 		 * An operation with batched TLB flushing is going on. Anything
    160. 		 * that can move process memory needs to flush the TLB when
    161. 		 * moving a PROT_NONE mapped page.
    162. 		 */
    163. 		atomic_t tlb_flush_pending;
    164. #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
    165. 		/* See flush_tlb_batched_pending() */
    166. 		atomic_t tlb_flush_batched;
    167. #endif
    168. 		struct uprobes_state uprobes_state;
    169. #ifdef CONFIG_PREEMPT_RT
    170. 		struct rcu_head delayed_drop;
    171. #endif
    172. #ifdef CONFIG_HUGETLB_PAGE
    173. 		atomic_long_t hugetlb_usage;
    174. #endif
    175. 		struct work_struct async_put_work;
    176.  
    177. #ifdef CONFIG_IOMMU_SVA
    178. 		u32 pasid;
    179. #endif
    180. #ifdef CONFIG_KSM
    181. 		/*
    182. 		 * Represent how many pages of this process are involved in KSM
    183. 		 * merging.
    184. 		 */
    185. 		unsigned long ksm_merging_pages;
    186. 		/*
    187. 		 * Represent how many pages are checked for ksm merging
    188. 		 * including merged and not merged.
    189. 		 */
    190. 		unsigned long ksm_rmap_items;
    191. #endif
    192. #ifdef CONFIG_LRU_GEN
    193. 		struct {
    194. 			/* this mm_struct is on lru_gen_mm_list */
    195. 			struct list_head list;
    196. 			/*
    197. 			 * Set when switching to this mm_struct, as a hint of
    198. 			 * whether it has been used since the last time per-node
    199. 			 * page table walkers cleared the corresponding bits.
    200. 			 */
    201. 			unsigned long bitmap;
    202. #ifdef CONFIG_MEMCG
    203. 			/* points to the memcg of "owner" above */
    204. 			struct mem_cgroup *memcg;
    205. #endif
    206. 		} lru_gen;
    207. #endif /* CONFIG_LRU_GEN */
    208. 	} __randomize_layout;
    209.  
    210. 	/*
    211. 	 * The mm_cpumask needs to be at the end of mm_struct, because it
    212. 	 * is dynamically sized based on nr_cpu_ids.
    213. 	 */
    214. 	unsigned long cpu_bitmap[];
    215. };

    这个结构体笔者认为是Linux内存管理子系统最为核心的结构，它之于内存管理相当于struct task_struct之于进程管理。

    对于此核心结构体的详解将有专门的文章，此处只需要弄清楚current->mm的意义就可以了。Linux内核工程师、尤其是对于进程管理比较熟悉的人对于current绝对不会陌生，它是一个宏，简单地说就是通过它可以得到当前执行的任务（的指针）。current的类型为struct task_struct。该结构带么很长，在此不列出，只给出结构中mm成员的定义（include/linux/sched.h中），如下所示：

    1. struct task_struct {
    2.     ……
    3.     struct mm_struct		*mm;
    4.     ……
    5. };

    struct mm_struct *mm成员的意义是：进程空间描述结构指针。对于普通用户来说，mm字段指向其虚拟地址空间的用户空间部分；而对于内核线程来说，该指针为空。此处我们是从用户空间调用下来的，指向的是调用malloc()进程（准确地说是线程）的虚拟地址空间的用户空间部分。

    接下来，struct vm_area_struct的定义也是在include/linux/mm_types.h中，代码如下：

    1. /*
    2.  * This struct describes a virtual memory area. There is one of these
    3.  * per VM-area/task. A VM area is any part of the process virtual memory
    4.  * space that has a special rule for the page-fault handlers (ie a shared
    5.  * library, the executable area etc).
    6.  */
    7. struct vm_area_struct {
    8. 	/* The first cache line has the info for VMA tree walking. */
    9.  
    10. 	unsigned long vm_start;		/* Our start address within vm_mm. */
    11. 	unsigned long vm_end;		/* The first byte after our end address
    12. 					   within vm_mm. */
    13.  
    14. 	struct mm_struct *vm_mm;	/* The address space we belong to. */
    15.  
    16. 	/*
    17. 	 * Access permissions of this VMA.
    18. 	 * See vmf_insert_mixed_prot() for discussion.
    19. 	 */
    20. 	pgprot_t vm_page_prot;
    21. 	unsigned long vm_flags;		/* Flags, see mm.h. */
    22.  
    23. 	/*
    24. 	 * For areas with an address space and backing store,
    25. 	 * linkage into the address_space->i_mmap interval tree.
    26. 	 *
    27. 	 * For private anonymous mappings, a pointer to a null terminated string
    28. 	 * containing the name given to the vma, or NULL if unnamed.
    29. 	 */
    30.  
    31. 	union {
    32. 		struct {
    33. 			struct rb_node rb;
    34. 			unsigned long rb_subtree_last;
    35. 		} shared;
    36. 		/*
    37. 		 * Serialized by mmap_sem. Never use directly because it is
    38. 		 * valid only when vm_file is NULL. Use anon_vma_name instead.
    39. 		 */
    40. 		struct anon_vma_name *anon_name;
    41. 	};
    42.  
    43. 	/*
    44. 	 * A file's MAP_PRIVATE vma can be in both i_mmap tree and anon_vma
    45. 	 * list, after a COW of one of the file pages.	A MAP_SHARED vma
    46. 	 * can only be in the i_mmap tree.  An anonymous MAP_PRIVATE, stack
    47. 	 * or brk vma (with NULL file) can only be in an anon_vma list.
    48. 	 */
    49. 	struct list_head anon_vma_chain; /* Serialized by mmap_lock &
    50. 					  * page_table_lock */
    51. 	struct anon_vma *anon_vma;	/* Serialized by page_table_lock */
    52.  
    53. 	/* Function pointers to deal with this struct. */
    54. 	const struct vm_operations_struct *vm_ops;
    55.  
    56. 	/* Information about our backing store: */
    57. 	unsigned long vm_pgoff;		/* Offset (within vm_file) in PAGE_SIZE
    58. 					   units */
    59. 	struct file * vm_file;		/* File we map to (can be NULL). */
    60. 	void * vm_private_data;		/* was vm_pte (shared mem) */
    61.  
    62. #ifdef CONFIG_SWAP
    63. 	atomic_long_t swap_readahead_info;
    64. #endif
    65. #ifndef CONFIG_MMU
    66. 	struct vm_region *vm_region;	/* NOMMU mapping region */
    67. #endif
    68. #ifdef CONFIG_NUMA
    69. 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
    70. #endif
    71. 	struct vm_userfaultfd_ctx vm_userfaultfd_ctx;
    72. } __randomize_layout;

    根据函数说明，vm_area_struct结构描述了一个虚拟内存区域，每个VM区域/任务都有一个此结构。VM area（虚拟内存区域）是进程虚拟内存空间的任何部分，其具有用于页面错误异常处理（page-fault handlers）的特殊规则（即共享库、可执行区域等）。

    关于该结构及其成员的详细解析，请看下回。

  • 相关阅读:
    CSS基础笔记
    【C语言】万字详讲操作符
    dhrystone和coremark测试比较
    Java中ReentrantLock测试线程的安全
    偶数科技：基于OushuDB的新一代云原生湖仓一体为企业助力
    【操作系统】保姆级教程(VMware)Ubuntu+qemu+xv6安装调试
    vue pc商城---最终篇
    UGUI自动布局Layout
    Python数据分析--Numpy常用函数介绍(9)-- 与线性代数有关的模块linalg
    Linux之open/close/read/write/lseek记录
  • 原文地址：https://blog.csdn.net/phmatthaus/article/details/134318769