<Linux内核源码>内存管理模型

题外语：本人对linux内核的了解尚浅，如果有差池欢迎指正，也欢迎提问交流！

首先要理解一下每一个进程是如何维护自己独立的寻址空间的，我的电脑里呢是8G内存空间。了解过的朋友应该都知道这是虚拟内存技术解决的这个问题，然而再linux中具体是怎样的模型解决的操作系统的这个设计需求的呢，让我们从linux源码的片段开始看吧！（以下内核源码均来自fedora21 64位系统的fc-3.19.3版本内核）

<include/linux/mm_type.h>中对于物理页面的定义struct page，也就是我们常说的页表，关于这里的结构体的每个变量/位的操作函数大部分在<include/linux/mm.h>中。

 struct page {
     /* First double word block */
     unsigned long flags;        /* Atomic flags, some possibly
                      * updated asynchronously */
     union {
         struct address_space *mapping;    /* If low bit clear, points to
                          * inode address_space, or NULL.
                          * If page mapped as anonymous
                          * memory, low bit is set, and
                          * it points to anon_vma object:
                          * see PAGE_MAPPING_ANON below.
                          */
         void *s_mem;            /* slab first object */
     };

     /* Second double word */
     struct {
         union {
             pgoff_t index;        /* Our offset within mapping. */
             void *freelist;        /* sl[aou]b first free object */
             bool pfmemalloc;    /* If set by the page allocator,
                          * ALLOC_NO_WATERMARKS was set
                          * and the low watermark was not
                          * met implying that the system
                          * is under some pressure. The
                          * caller should try ensure
                          * this page is only used to
                          * free other pages.
                          */
         };

         union {
 #if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
     defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
             /* Used for cmpxchg_double in slub */
             unsigned long counters;
 #else
             /*
              * Keep _count separate from slub cmpxchg_double data.
              * As the rest of the double word is protected by
              * slab_lock but _count is not.
              */
             unsigned counters;
 #endif

             struct {

                 union {
                     /*
                      * Count of ptes mapped in
                      * mms, to show when page is
                      * mapped & limit reverse map
                      * searches.
                      *
                      * Used also for tail pages
                      * refcounting instead of
                      * _count. Tail pages cannot
                      * be mapped and keeping the
                      * tail page _count zero at
                      * all times guarantees
                      * get_page_unless_zero() will
                      * never succeed on tail
                      * pages.
                      */
                     atomic_t _mapcount;

                     struct { /* SLUB */
                         unsigned inuse:;
                         unsigned objects:;
                         unsigned frozen:;
                     };
                     int units;    /* SLOB */
                 };
                 atomic_t _count;        /* Usage count, see below. */
             };
             unsigned int active;    /* SLAB */
         };
     };

     /* Third double word block */
     union {
         struct list_head lru;    /* Pageout list, eg. active_list
                      * protected by zone->lru_lock !
                      * Can be used as a generic list
                      * by the page owner.
                      */
         struct {        /* slub per cpu partial pages */
             struct page *next;    /* Next partial slab */
 #ifdef CONFIG_64BIT
             int pages;    /* Nr of partial slabs left */
             int pobjects;    /* Approximate # of objects */
 #else
             short int pages;
             short int pobjects;
 #endif
         };

         struct slab *slab_page; /* slab fields */
         struct rcu_head rcu_head;    /* Used by SLAB
                          * when destroying via RCU
                          */
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
         pgtable_t pmd_huge_pte; /* protected by page->ptl */
 #endif
     };

     /* Remainder is not double word aligned */
     union {
         unsigned long private;        /* Mapping-private opaque data:
                           * usually used for buffer_heads
                          * if PagePrivate set; used for
                          * swp_entry_t if PageSwapCache;
                          * indicates order in the buddy
                          * system if PG_buddy is set.
                          */
 #if USE_SPLIT_PTE_PTLOCKS
 #if ALLOC_SPLIT_PTLOCKS
         spinlock_t *ptl;
 #else
         spinlock_t ptl;
 #endif
 #endif
         struct kmem_cache *slab_cache;    /* SL[AU]B: Pointer to slab */
         struct page *first_page;    /* Compound tail pages */
     };

 #ifdef CONFIG_MEMCG
     struct mem_cgroup *mem_cgroup;
 #endif

     /*
      * On machines where all RAM is mapped into kernel address space,
      * we can simply calculate the virtual address. On machines with
      * highmem some memory is mapped into kernel virtual memory
      * dynamically, so we need a place to store that address.
      * Note that this field could be 16 bits on x86 ... ;)
      *
      * Architectures with slow multiplication can define
      * WANT_PAGE_VIRTUAL in asm/page.h
      */
 #if defined(WANT_PAGE_VIRTUAL)
     void *virtual;            /* Kernel virtual address (NULL if
                        not kmapped, ie. highmem) */
 #endif /* WANT_PAGE_VIRTUAL */

 #ifdef CONFIG_KMEMCHECK
     /*
      * kmemcheck wants to track the status of each byte in a page; this
      * is a pointer to such a status block. NULL if not tracked.
      */
     void *shadow;
 #endif

 #ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
     int _last_cpupid;
 #endif
 }

在整个struct page的定义里面的注释对每个位都作了详尽的解释，但我还是觉得有几个重要的定义要重复一下：

（1）void*virtual:页的虚拟地址（由于在64位系统之中C语言里的void*指针的长度最长为64bit，寻址空间是2^64大远远超出了当前主流微机的硬件内存RAM的大小（8GB，16GB左右）这也就给虚拟空间寻址，交换技术提供了可能性）对virtual中的虚拟地址进行映射需要通过四级页表来进行。

（2）pgoff_t index:这个变量和freelist被定义在同一个union中，index变量被内存管理子系统中的多个模块使用，比如高速缓存。

（3）unsigned long flags:flag变量很少有设成long的可见里面的信息量比较大，这里是用来存放页的状态，比如锁/未锁，换出（虚拟内存用），激活等等。

再继续说内存管理机制之前，有一点非常重要，就是linux中关于进程和内存之间的对应关系。

linux中的每一个进程维护一个PCB，而这个PCB就是/include/linux/sched.h中定义的task_struct，在这个结构体的定义之中有定义变量：

struct mm_struct *mm, *active_mm;

这也就是进程和内存管理的桥梁之一，也是由此可见进程和内存块/页之间的关系是一对多的（考虑进程共享的内存的话是多对多），进程在装入内存的时候，操作系统的工作的实质是将task_struct中的相关的内存数据映射到部分映射到物理内存之中，而对于并没有映射的页就采取交换技术来解决。和windows系统中的程序装入过程相比较，windows中的程序装入过程都是靠loader完成的，loader的工作就是针对PE格式的可执行文件通过二进制的分析（比如IDT，IAT等等）进行装入，很多情况下一个进程都会被装入到同一个虚拟地址之中0x40000000（90%都是装入这里）。而linux之中，我们的进程是根据调度算法来安排其在虚拟地址之中的分布情况，buddy算法可以将进程的使用的页尽可能整齐地装入（其实这里我有些不是很清楚的地方，linux如果这么动态分配内存那么该如何处理一些动态加载的库的问题，像windows中的dll文件都是通过计算偏移来重定位，而linux会怎么做呢？）进程在已经装入物理内存的页的基础之上开始执行指令，跳转到并未被装入物理内存的页的虚拟地址的时候，会触发一个缺页中断，缺页中断触发页的交换的过程，从而帮助程序继续执行，这也就是虚拟内存的过程。

 struct task_struct {
     volatile long state;    /* -1 unrunnable, 0 runnable, >0 stopped */
     void *stack;
     atomic_t usage;
     unsigned int flags;    /* per process flags, defined below */
     unsigned int ptrace;

 #ifdef CONFIG_SMP
     struct llist_node wake_entry;
     int on_cpu;
     struct task_struct *last_wakee;
     unsigned long wakee_flips;
     unsigned long wakee_flip_decay_ts;

     int wake_cpu;
 #endif
     int on_rq;

     int prio, static_prio, normal_prio;
     unsigned int rt_priority;
     const struct sched_class *sched_class;
     struct sched_entity se;
     struct sched_rt_entity rt;
 #ifdef CONFIG_CGROUP_SCHED
     struct task_group *sched_task_group;
 #endif
     struct sched_dl_entity dl;

 #ifdef CONFIG_PREEMPT_NOTIFIERS
     /* list of struct preempt_notifier: */
     struct hlist_head preempt_notifiers;
 #endif

 #ifdef CONFIG_BLK_DEV_IO_TRACE
     unsigned int btrace_seq;
 #endif

     unsigned int policy;
     int nr_cpus_allowed;
     cpumask_t cpus_allowed;

 #ifdef CONFIG_PREEMPT_RCU
     int rcu_read_lock_nesting;
     union rcu_special rcu_read_unlock_special;
     struct list_head rcu_node_entry;
 #endif /* #ifdef CONFIG_PREEMPT_RCU */
 #ifdef CONFIG_PREEMPT_RCU
     struct rcu_node *rcu_blocked_node;
 #endif /* #ifdef CONFIG_PREEMPT_RCU */
 #ifdef CONFIG_TASKS_RCU
     unsigned long rcu_tasks_nvcsw;
     bool rcu_tasks_holdout;
     struct list_head rcu_tasks_holdout_list;
     int rcu_tasks_idle_cpu;
 #endif /* #ifdef CONFIG_TASKS_RCU */

 #if defined(CONFIG_SCHEDSTATS) || defined(CONFIG_TASK_DELAY_ACCT)
     struct sched_info sched_info;
 #endif

     struct list_head tasks;
 #ifdef CONFIG_SMP
     struct plist_node pushable_tasks;
     struct rb_node pushable_dl_tasks;
 #endif

     struct mm_struct *mm, *active_mm;
 #ifdef CONFIG_COMPAT_BRK
     unsigned brk_randomized:;
 #endif
     /* per-thread vma caching */
     u32 vmacache_seqnum;
     struct vm_area_struct *vmacache[VMACACHE_SIZE];
 #if defined(SPLIT_RSS_COUNTING)
     struct task_rss_stat    rss_stat;
 #endif
 /* task state */
     int exit_state;
     int exit_code, exit_signal;
     int pdeath_signal;  /*  The signal sent when the parent dies  */
     unsigned int jobctl;    /* JOBCTL_*, siglock protected */

     /* Used for emulating ABI behavior of previous Linux versions */
     unsigned int personality;

     unsigned in_execve:;    /* Tell the LSMs that the process is doing an
                  * execve */
     unsigned in_iowait:;

     /* Revert to default priority/policy when forking */
     unsigned sched_reset_on_fork:;
     unsigned sched_contributes_to_load:;

 #ifdef CONFIG_MEMCG_KMEM
     unsigned memcg_kmem_skip_account:;
 #endif

     unsigned long atomic_flags; /* Flags needing atomic access. */

     pid_t pid;
     pid_t tgid;

 #ifdef CONFIG_CC_STACKPROTECTOR
     /* Canary value for the -fstack-protector gcc feature */
     unsigned long stack_canary;
 #endif
     /*
      * pointers to (original) parent process, youngest child, younger sibling,
      * older sibling, respectively.  (p->father can be replaced with
      * p->real_parent->pid)
      */
     struct task_struct __rcu *real_parent; /* real parent process */
     struct task_struct __rcu *parent; /* recipient of SIGCHLD, wait4() reports */
     /*
      * children/sibling forms the list of my natural children
      */
     struct list_head children;    /* list of my children */
     struct list_head sibling;    /* linkage in my parent's children list */
     struct task_struct *group_leader;    /* threadgroup leader */

     /*
      * ptraced is the list of tasks this task is using ptrace on.
      * This includes both natural children and PTRACE_ATTACH targets.
      * p->ptrace_entry is p's link on the p->parent->ptraced list.
      */
     struct list_head ptraced;
     struct list_head ptrace_entry;

     /* PID/PID hash table linkage. */
     struct pid_link pids[PIDTYPE_MAX];
     struct list_head thread_group;
     struct list_head thread_node;

     struct completion *vfork_done;        /* for vfork() */
     int __user *set_child_tid;        /* CLONE_CHILD_SETTID */
     int __user *clear_child_tid;        /* CLONE_CHILD_CLEARTID */

     cputime_t utime, stime, utimescaled, stimescaled;
     cputime_t gtime;
 #ifndef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
     struct cputime prev_cputime;
 #endif
 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
     seqlock_t vtime_seqlock;
     unsigned long long vtime_snap;
     enum {
         VTIME_SLEEPING = ,
         VTIME_USER,
         VTIME_SYS,
     } vtime_snap_whence;
 #endif
     unsigned long nvcsw, nivcsw; /* context switch counts */
     u64 start_time;        /* monotonic time in nsec */
     u64 real_start_time;    /* boot based time in nsec */
 /* mm fault and swap info: this can arguably be seen as either mm-specific or thread-specific */
     unsigned long min_flt, maj_flt;

     struct task_cputime cputime_expires;
     struct list_head cpu_timers[];

 /* process credentials */
     const struct cred __rcu *real_cred; /* objective and real subjective task
                      * credentials (COW) */
     const struct cred __rcu *cred;    /* effective (overridable) subjective task
                      * credentials (COW) */
     char comm[TASK_COMM_LEN]; /* executable name excluding path
                      - access with [gs]et_task_comm (which lock
                        it with task_lock())
                      - initialized normally by setup_new_exec */
 /* file system info */
     int link_count, total_link_count;
 #ifdef CONFIG_SYSVIPC
 /* ipc stuff */
     struct sysv_sem sysvsem;
     struct sysv_shm sysvshm;
 #endif
 #ifdef CONFIG_DETECT_HUNG_TASK
 /* hung task detection */
     unsigned long last_switch_count;
 #endif
 /* CPU-specific state of this task */
     struct thread_struct thread;
 /* filesystem information */
     struct fs_struct *fs;
 /* open file information */
     struct files_struct *files;
 /* namespaces */
     struct nsproxy *nsproxy;
 /* signal handlers */
     struct signal_struct *signal;
     struct sighand_struct *sighand;

     sigset_t blocked, real_blocked;
     sigset_t saved_sigmask;    /* restored if set_restore_sigmask() was used */
     struct sigpending pending;

     unsigned long sas_ss_sp;
     size_t sas_ss_size;
     int (*notifier)(void *priv);
     void *notifier_data;
     sigset_t *notifier_mask;
     struct callback_head *task_works;

     struct audit_context *audit_context;
 #ifdef CONFIG_AUDITSYSCALL
     kuid_t loginuid;
     unsigned int sessionid;
 #endif
     struct seccomp seccomp;

 /* Thread group tracking */
        u32 parent_exec_id;
        u32 self_exec_id;
 /* Protection of (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed,
  * mempolicy */
     spinlock_t alloc_lock;

     /* Protection of the PI data structures: */
     raw_spinlock_t pi_lock;

 #ifdef CONFIG_RT_MUTEXES
     /* PI waiters blocked on a rt_mutex held by this task */
     struct rb_root pi_waiters;
     struct rb_node *pi_waiters_leftmost;
     /* Deadlock detection and priority inheritance handling */
     struct rt_mutex_waiter *pi_blocked_on;
 #endif

 #ifdef CONFIG_DEBUG_MUTEXES
     /* mutex deadlock detection */
     struct mutex_waiter *blocked_on;
 #endif
 #ifdef CONFIG_TRACE_IRQFLAGS
     unsigned int irq_events;
     unsigned long hardirq_enable_ip;
     unsigned long hardirq_disable_ip;
     unsigned int hardirq_enable_event;
     unsigned int hardirq_disable_event;
     int hardirqs_enabled;
     int hardirq_context;
     unsigned long softirq_disable_ip;
     unsigned long softirq_enable_ip;
     unsigned int softirq_disable_event;
     unsigned int softirq_enable_event;
     int softirqs_enabled;
     int softirq_context;
 #endif
 #ifdef CONFIG_LOCKDEP
 # define MAX_LOCK_DEPTH 48UL
     u64 curr_chain_key;
     int lockdep_depth;
     unsigned int lockdep_recursion;
     struct held_lock held_locks[MAX_LOCK_DEPTH];
     gfp_t lockdep_reclaim_gfp;
 #endif

 /* journalling filesystem info */
     void *journal_info;

 /* stacked block device info */
     struct bio_list *bio_list;

 #ifdef CONFIG_BLOCK
 /* stack plugging */
     struct blk_plug *plug;
 #endif

 /* VM state */
     struct reclaim_state *reclaim_state;

     struct backing_dev_info *backing_dev_info;

     struct io_context *io_context;

     unsigned long ptrace_message;
     siginfo_t *last_siginfo; /* For ptrace use.  */
     struct task_io_accounting ioac;
 #if defined(CONFIG_TASK_XACCT)
     u64 acct_rss_mem1;    /* accumulated rss usage */
     u64 acct_vm_mem1;    /* accumulated virtual memory usage */
     cputime_t acct_timexpd;    /* stime + utime since last update */
 #endif
 #ifdef CONFIG_CPUSETS
     nodemask_t mems_allowed;    /* Protected by alloc_lock */
     seqcount_t mems_allowed_seq;    /* Seqence no to catch updates */
     int cpuset_mem_spread_rotor;
     int cpuset_slab_spread_rotor;
 #endif
 #ifdef CONFIG_CGROUPS
     /* Control Group info protected by css_set_lock */
     struct css_set __rcu *cgroups;
     /* cg_list protected by css_set_lock and tsk->alloc_lock */
     struct list_head cg_list;
 #endif
 #ifdef CONFIG_FUTEX
     struct robust_list_head __user *robust_list;
 #ifdef CONFIG_COMPAT
     struct compat_robust_list_head __user *compat_robust_list;
 #endif
     struct list_head pi_state_list;
     struct futex_pi_state *pi_state_cache;
 #endif
 #ifdef CONFIG_PERF_EVENTS
     struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts];
     struct mutex perf_event_mutex;
     struct list_head perf_event_list;
 #endif
 #ifdef CONFIG_DEBUG_PREEMPT
     unsigned long preempt_disable_ip;
 #endif
 #ifdef CONFIG_NUMA
     struct mempolicy *mempolicy;    /* Protected by alloc_lock */
     short il_next;
     short pref_node_fork;
 #endif
 #ifdef CONFIG_NUMA_BALANCING
     int numa_scan_seq;
     unsigned int numa_scan_period;
     unsigned int numa_scan_period_max;
     int numa_preferred_nid;
     unsigned long numa_migrate_retry;
     u64 node_stamp;            /* migration stamp  */
     u64 last_task_numa_placement;
     u64 last_sum_exec_runtime;
     struct callback_head numa_work;

     struct list_head numa_entry;
     struct numa_group *numa_group;

     /*
      * numa_faults is an array split into four regions:
      * faults_memory, faults_cpu, faults_memory_buffer, faults_cpu_buffer
      * in this precise order.
      *
      * faults_memory: Exponential decaying average of faults on a per-node
      * basis. Scheduling placement decisions are made based on these
      * counts. The values remain static for the duration of a PTE scan.
      * faults_cpu: Track the nodes the process was running on when a NUMA
      * hinting fault was incurred.
      * faults_memory_buffer and faults_cpu_buffer: Record faults per node
      * during the current scan window. When the scan completes, the counts
      * in faults_memory and faults_cpu decay and these values are copied.
      */
     unsigned long *numa_faults;
     unsigned long total_numa_faults;

     /*
      * numa_faults_locality tracks if faults recorded during the last
      * scan window were remote/local. The task scan period is adapted
      * based on the locality of the faults with different weights
      * depending on whether they were shared or private faults
      */
     unsigned long numa_faults_locality[];

     unsigned long numa_pages_migrated;
 #endif /* CONFIG_NUMA_BALANCING */

     struct rcu_head rcu;

     /*
      * cache last used pipe for splice
      */
     struct pipe_inode_info *splice_pipe;

     struct page_frag task_frag;

 #ifdef    CONFIG_TASK_DELAY_ACCT
     struct task_delay_info *delays;
 #endif
 #ifdef CONFIG_FAULT_INJECTION
     int make_it_fail;
 #endif
     /*
      * when (nr_dirtied >= nr_dirtied_pause), it's time to call
      * balance_dirty_pages() for some dirty throttling pause
      */
     int nr_dirtied;
     int nr_dirtied_pause;
     unsigned long dirty_paused_when; /* start of a write-and-pause period */

 #ifdef CONFIG_LATENCYTOP
     int latency_record_count;
     struct latency_record latency_record[LT_SAVECOUNT];
 #endif
     /*
      * time slack values; these are used to round up poll() and
      * select() etc timeout values. These are in nanoseconds.
      */
     unsigned long timer_slack_ns;
     unsigned long default_timer_slack_ns;

 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
     /* Index of current stored address in ret_stack */
     int curr_ret_stack;
     /* Stack of return addresses for return function tracing */
     struct ftrace_ret_stack    *ret_stack;
     /* time stamp for last schedule */
     unsigned long long ftrace_timestamp;
     /*
      * Number of functions that haven't been traced
      * because of depth overrun.
      */
     atomic_t trace_overrun;
     /* Pause for the tracing */
     atomic_t tracing_graph_pause;
 #endif
 #ifdef CONFIG_TRACING
     /* state flags for use by tracers */
     unsigned long trace;
     /* bitmask and counter of trace recursion */
     unsigned long trace_recursion;
 #endif /* CONFIG_TRACING */
 #ifdef CONFIG_MEMCG
     struct memcg_oom_info {
         struct mem_cgroup *memcg;
         gfp_t gfp_mask;
         int order;
         unsigned int may_oom:;
     } memcg_oom;
 #endif
 #ifdef CONFIG_UPROBES
     struct uprobe_task *utask;
 #endif
 #if defined(CONFIG_BCACHE) || defined(CONFIG_BCACHE_MODULE)
     unsigned int    sequential_io;
     unsigned int    sequential_io_avg;
 #endif
 #ifdef CONFIG_DEBUG_ATOMIC_SLEEP
     unsigned long    task_state_change;
 #endif
 };

愚蠢的问题1：

MMU是由硬件实现的专门为解决虚拟地址和物理地址映射问题而设计的部件，那么为什么要在linux的源代码中体现呢？为什么在要在软件中再描述一次呢？

虚拟地址到物理地址的映射，（目前而讲）需要4级页表索引的访问来完成。在mm_struct结构体中的定义之中有一个pdg_t类型的指针名叫pgd（PageGlobalDirectory），由此出发继续向下级访问有pud（PageUpperDirectory）pmd（PageMiddleDirectory）pte（PageTableEntry），最后一级是具体的页表很遗憾的是，我暂时没有在3.19内核的源码中找到关于pte_t的定义，但是根据书籍上的描述应该是一个指向struct page数组的指针。

于是我们可以这样总结，程序在执行的过程会有大量的跳转的过程，而每次的跳转需要一个操作数即地址，这个地址是一个虚拟地址，然后根据该虚拟地址进行MMU的操作，过程中得到一个页表，首先根据页表判断该页是否已经存在于物理内存中，如果不是的话则进行一次交换的操作，上文已经阐述过该过程，页交换完成之后，寻址过程就得以继续进行了，此时使用相同的虚拟地址访问到的是另一个物理页面，即交换进入的物理页面。

愚蠢的问题2：

虚拟内存的机制像是把物理内存和外部存储容量共同地址编码，这个共同的编码就是虚拟地址，所谓“编码”过程不一定是顺序一对一的，但是虚拟地址和页表的索引之间一定是个满射关系。

这是我最初对于虚拟内存机制的理解，表面看起来没有什么问题，可还是当考虑每个进程的寻址空间独立性的时候就会发现问题，相同的地址在两个进程中映射外部地址应该可以是不相同的，可是一旦将他们看作共同地址编码，就不会有相同的逻辑地址映射到不同的物理地址这回事了。

其实答案很简单一句话：每个进程维护一个页表 !

最后一张大图概括一下上文