动态映射高端内存页面,在32位系统中,物理内存分为低端内存(Low Memory,直接映射区)和高端内存(High Memory,动态映射区)。低端内存可通过固定偏移(PAGE_OFFSET)直接映射到内核虚拟地址空间,而高端内存(超出直接映射范围的物理内存)需通过 kmap动态分配虚拟地址并建立映射,供内核临时访问.kmap是Linux内核中用于将物理页面(尤其是高端内存页面)映射到内核虚拟地址空间的函数,使得内核能够通过虚拟地址直接访问物理内存。它是内核处理高端内存(High Memory)动态映射的核心机制之一,主要用于32位系统(虚拟地址空间有限),64位系统因地址空间充足,通常无需高端内存映射,kmap行为会更简化。1、关键数据结构mm/highmem.c /* * Describes one page-virtual association */ struct page_address_map { struct page *page; void *virtual; struct list_head list; /*挂接到page_address_slot-lh上*/ }; 每个page占用一个,512*4k2MPKMAP区刚好2M大小pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) static struct page_address_map page_address_maps[LAST_PKMAP]/*512*/; /* * Hash table bucket */ static struct page_address_slot { struct list_head lh; /* List of page_address_maps */ spinlock_t lock; /* Protect this buckets list */ } ____cacheline_aligned_in_smp page_address_htable[1PA_HASH_ORDER/*17,128*/]; arch/arm/include/asm/highmem.h 若页面属于高端内存(物理地址high_memory),kmap通过PKMAP区域(永久内核映射区)动态分配虚拟地址并建立映射 /* pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)*/ #define PKMAP_BASE (PAGE_OFFSET - PMD_SIZE) /*0xc0000000-0x2000000xbfe00000*/ /*2M/4K 512*/ #define LAST_PKMAP PTRS_PER_PTE /*512*/ #define LAST_PKMAP_MASK (LAST_PKMAP - 1) #define PKMAP_NR(virt) (((virt) - PKMAP_BASE) PAGE_SHIFT) #define PKMAP_ADDR(nr) (PKMAP_BASE ((nr) PAGE_SHIFT)) /*标记pkmap区中内个虚拟地址页面是否已经被映射*/ static int pkmap_count[LAST_PKMAP/*512*/]; static __cacheline_aligned_in_smp DEFINE_SPINLOCK(kmap_lock); 页表项 pte_t * pkmap_page_table; 高端内存提供的核心操作接口如下: #ifdef CONFIG_HIGHMEM void *kmap(struct page *page); void kunmap(struct page *page); void *kmap_atomic(struct page *page); void __kunmap_atomic(void *kvaddr); void *kmap_atomic_pfn(unsigned long pfn); struct page *kmap_atomic_to_page(const void *ptr); #endif2、kmap实现arch/arm/mm/highmem.c void *kmap(struct page *page) { might_sleep(); if (!PageHighMem(page)) /*非高端内存,线性映射区*/ return page_address(page); /*返回page对应虚拟地址*/ return kmap_high(page); } include/linux/page-flags.h #define PageHighMem(__p) is_highmem(page_zone(__p)) static inline int is_highmem(struct zone *zone) { #ifdef CONFIG_HIGHMEM int zone_off (char *)zone - (char *)zone-zone_pgdat-node_zones; return zone_off ZONE_HIGHMEM * sizeof(*zone) || (zone_off ZONE_MOVABLE * sizeof(*zone) zone_movable_is_highmem()); #else return 0; #endif } static inline struct zone *page_zone(const struct page *page) { return NODE_DATA(page_to_nid(page))-node_zones[page_zonenum(page)]; } page-flags的位分配由内核在编译时通过宏定义(如ZONES_SHIFT、NODES_SHIFT、SECTIONS_SHIFT等)确定, 不同架构/内核版本可能略有差异,但核心结构一致各个部分在page-flags内部偏移量计算 static inline int page_to_nid(const struct page *page) { return (page-flags NODES_PGSHIFT) NODES_MASK; } static inline enum zone_type page_zonenum(const struct page *page) { return (page-flags ZONES_PGSHIFT) ZONES_MASK; } 通过计算page所在的zone来判断page是在低端还是高端内存。 /** * page_address - get the mapped virtual address of a page * page: struct page to get the virtual address of * * Returns the pages virtual address. */ void *page_address(const struct page *page) { unsigned long flags; void *ret; struct page_address_slot *pas; if (!PageHighMem(page)) /*低端内存地址*/ return lowmem_page_address(page); /*page在page_address_htable[]中对应的slot槽位*/ pas page_slot(page); ret NULL; spin_lock_irqsave(pas-lock, flags); if (!list_empty(pas-lh)) { /*非空*/ struct page_address_map *pam; /*遍历返回地址*/ list_for_each_entry(pam, pas-lh, list) { if (pam-page page) { ret pam-virtual; goto done; } } } done: spin_unlock_irqrestore(pas-lock, flags); return ret; } hash计算,将冲突的地址挂接到槽位对应链表lh上 static struct page_address_slot *page_slot(const struct page *page) { return page_address_htable[hash_ptr(page, PA_HASH_ORDER/*7*/)/*hash值*/]; } static inline unsigned long hash_ptr(const void *ptr, unsigned int bits) { return hash_long((unsigned long)ptr, bits); } #define hash_long(val, bits) hash_32(val, bits) static inline u32 hash_32(u32 val, unsigned int bits) { /* On some cpus multiply is faster, on others gcc will do shifts */ u32 hash val * GOLDEN_RATIO_PRIME_32; /*对val取黄金比列值*/ /* High bits are more random, so use them. */ return hash (32 - bits); /*进行移位操作,保留高位bits*/ } /** * kmap_high - map a highmem page into memory * page: struct page to map * * Returns the pages virtual memory address. * * We cannot call this from interrupts, as it may block. */ void *kmap_high(struct page *page) { unsigned long vaddr; /* * For highmem pages, we cant trust virtual until * after we have the lock. */ lock_kmap(); vaddr (unsigned long)page_address(page); if (!vaddr) /*未被映射*/ vaddr map_new_virtual(page); /*从FKMAP中找到一个可用虚拟地址,并设置pte*/ pkmap_count[PKMAP_NR(vaddr)]; /*pkmap_count[] 为2*/ BUG_ON(pkmap_count[PKMAP_NR(vaddr)] 2); unlock_kmap(); return (void*) vaddr; } static inline unsigned long map_new_virtual(struct page *page) { unsigned long vaddr; int count; unsigned int last_pkmap_nr; unsigned int color get_pkmap_color(page); start: count get_pkmap_entries_count(color); printk(-----%s,color:%d \n,__func__,color); /* Find an empty entry */ for (;;) { last_pkmap_nr get_next_pkmap_nr(color); if (no_more_pkmaps(last_pkmap_nr, color)) { /*清除无效地址*/ flush_all_zero_pkmaps(); count get_pkmap_entries_count(color); } if (!pkmap_count[last_pkmap_nr]) /*可以使用*/ break; /* Found a usable entry */ if (--count) continue; /* count0, fkmap中无可用地址空间等待其他人释放空间出来 将任务进行休眠,存在其他任务释放高端内存时会将该任务唤醒 */ /* * Sleep for somebody else to unmap their entries */ { DECLARE_WAITQUEUE(wait, current); wait_queue_head_t *pkmap_map_wait get_pkmap_wait_queue_head(color); __set_current_state(TASK_UNINTERRUPTIBLE); /*不可中断休眠*/ add_wait_queue(pkmap_map_wait, wait); unlock_kmap(); schedule(); remove_wait_queue(pkmap_map_wait, wait); lock_kmap(); /* Somebody else might have mapped it while we slept */ if (page_address(page)) return (unsigned long)page_address(page); /* Re-start */ goto start; } } /*找到可以使用的虚拟地址*/ vaddr PKMAP_ADDR(last_pkmap_nr); /*虚拟地址*/ set_pte_at(init_mm, vaddr, (pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot)); pkmap_count[last_pkmap_nr] 1; /*1*/ set_page_address(page, (void *)vaddr); return vaddr; } static inline int get_pkmap_entries_count(unsigned int color) { return LAST_PKMAP; } /* * Get next index for mapping inside PKMAP region for page with given color. */ static inline unsigned int get_next_pkmap_nr(unsigned int color) { static unsigned int last_pkmap_nr; /*静态变量*/ last_pkmap_nr (last_pkmap_nr 1) LAST_PKMAP_MASK; return last_pkmap_nr; } static inline int no_more_pkmaps(unsigned int pkmap_nr, unsigned int color) { return pkmap_nr 0; /*溢出*/ } static void flush_all_zero_pkmaps(void) { int i; int need_flush 0; flush_cache_kmaps(); /*清cache*/ for (i 0; i LAST_PKMAP/*512*/; i) { struct page *page; /* * zero means we dont have anything to do, * 1 means that it is still in use. Only * a count of 1 means that it is free but * needs to be unmapped */ /* 计数为0意味着我们无需执行任何操作 大于1意味着它仍在使用中 只有计数为1时,才意味着它是空闲的,但需要被解除映射 */ if (pkmap_count[i] ! 1) continue; pkmap_count[i] 0; /* sanity check */ BUG_ON(pte_none(pkmap_page_table[i])); /* * Dont need an atomic fetch-and-clear op here; * no-one has the page mapped, and cannot get at * its virtual address (and hence PTE) without first * getting the kmap_lock (which is held here). * So no dangers, even with speculative execution. */ /*解除映射*/ page pte_page(pkmap_page_table[i]); pte_clear(init_mm, PKMAP_ADDR(i), pkmap_page_table[i]); set_page_address(page, NULL); need_flush 1; } if (need_flush) flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP)); } #define PKMAP_NR(virt) (((virt) - PKMAP_BASE) PAGE_SHIFT) #define PKMAP_ADDR(nr) (PKMAP_BASE ((nr) PAGE_SHIFT)) /** * set_page_address - set a pages virtual address * page: struct page to set * virtual: virtual address to use */ void set_page_address(struct page *page, void *virtual) { unsigned long flags; struct page_address_slot *pas; struct page_address_map *pam; BUG_ON(!PageHighMem(page)); pas page_slot(page); /*槽位号*/ if (virtual) { /* Add */ pam page_address_maps[PKMAP_NR((unsigned long)virtual)]; pam-page page; pam-virtual virtual; spin_lock_irqsave(pas-lock, flags); list_add_tail(pam-list, pas-lh); /*将pam加入到pas-list中*/ spin_unlock_irqrestore(pas-lock, flags); } else { /* Remove */ spin_lock_irqsave(pas-lock, flags); list_for_each_entry(pam, pas-lh, list) { if (pam-page page) { list_del(pam-list); /*将pam从pas-list中删除*/ spin_unlock_irqrestore(pas-lock, flags); goto done; } } spin_unlock_irqrestore(pas-lock, flags); } done: return; }若页面属于高端内存(物理地址high_memory),kmap通过PKMAP区域(永久内核映射区)动态分配虚拟地址并建立映射:PKMAP区域:内核虚拟地址空间中预留的固定区域。映射过程检查页面是否已通过PKMAP映射:内核维护pkmap_count数组(跟踪每个PKMAP槽位的引用计数)和pkmap_page_table(页表项)若未映射,从PKMAP区域分配一个空闲虚拟地址槽位,更新页表建立物理页框与虚拟地址的映射若PKMAP区域已满(所有槽位被占用),kmap会阻塞当前进程,等待其他映射释放槽位(通过 schedule()主动让出 CPU)3、kunmap实现void kunmap(struct page *page) { BUG_ON(in_interrupt()); if (!PageHighMem(page)) /*非高端内存直接返回*/ return; kunmap_high(page); } /** * kunmap_high - unmap a highmem page into memory * page: struct page to unmap * * If ARCH_NEEDS_KMAP_HIGH_GET is not defined then this may be called * only from user context. */ void kunmap_high(struct page *page) { unsigned long vaddr; unsigned long nr; unsigned long flags; int need_wakeup; unsigned int color get_pkmap_color(page); wait_queue_head_t *pkmap_map_wait; lock_kmap_any(flags); /*虚拟地址*/ vaddr (unsigned long)page_address(page); BUG_ON(!vaddr); nr PKMAP_NR(vaddr); /* * A count must never go down to zero * without a TLB flush! */ need_wakeup 0; switch (--pkmap_count[nr]) { /*设置为1,由flush_all_zero_pkmaps来进行回收处理*/ case 0: BUG(); case 1: /* * Avoid an unnecessary wake_up() function call. * The common case is pkmap_count[] 1, but * no waiters. * The tasks queued in the wait-queue are guarded * by both the lock in the wait-queue-head and by * the kmap_lock. As the kmap_lock is held here, * no need for the wait-queue-heads lock. Simply * test if the queue is empty. */ /*存在释放时就将因为fkmap无可用虚拟地址而休眠的任务唤醒*/ pkmap_map_wait get_pkmap_wait_queue_head(color); need_wakeup waitqueue_active(pkmap_map_wait); } unlock_kmap_any(flags); /* do wake-up, if needed, race-free outside of the spin lock */ if (need_wakeup) wake_up(pkmap_map_wait); /*唤醒任务*/ }注意事项:必须配对使用kunmap:映射后需显式解除,否则会导致虚拟地址槽位泄漏(PKMAP区域耗尽后后续映射失败)写后标记脏页:若修改了文件映射的页面(如vma-vm_file非空),需调用set_page_dirty(page)或set_page_dirty_lock(page)标记脏页,确保数据回写磁盘避免长期映射:kmap映射的地址应尽快释放,尤其在高并发场景下,减少PKMAP区域竞争