Linux源码剖析匿名共享内存shmem原理

如下问题如果都清楚了就不用看本文了：

1. shmem ram文件系统的初始化流程是怎样的

2. shmem思想上想复用基于文件的操作流程，实现上shmem也引入了一个文件，那么类似文件open会生成struct file，shmem的struct file怎么生成的

3. shmem的phsycial page是怎么创建的，page属性是如何的（迁移属性，_refcount，_mapcount等）。

4. shmem page怎样回收的

概述

进程间共享匿名内存有两种重要的方式，其一是mmap设置MAP_SHARED | PRIVATE创建的虚拟地址区域，这片区域fork执行之后，由父子进程共享。其二是主动调用shmget/shmat相关接口。此外android操作系统的ashmem匿名共享内存也是基于linux内核的shmem实现。本文我们将从源码角度剖析内核shmem的设计和实现原理。

shmem设计的基本思想

当vma中的页面对应磁盘文件时，系统在缺页的时候为了读取一页会调用vma_area_struct->a_ops中的fault函数（filemap_fault）。要把一个page写回磁盘设备使用inode->i_mapping->a_ops或者page->mapping->a_ops在address_space_operations找到相应的writepage函数。当进行普通文件操作，如mmap()，read()和write()时，系统会通过struct file *filp的file_operations指针f_op进行相应的函数调用。f_op在文件open时候从inode->i_fop设置：

fs/read_write.c: static int do_dentry_open

上面的流程很清晰，不过却无法处理匿名页的情况，因为匿名页没有对应一个文件，所以为复用上述清晰的逻辑Linux引入了基于RAM文件系统的文件，vma都由这个文件系统中的一个文件作为后援。

同时，shmem中的page也要考虑如何回收：即页面回收时会写入swap分区当中。
 

虚拟文件系统初始化

 linux系统启动的过程中会调用到shmem_init初始化虚拟文件系统，linux给shmem创建虚拟文件，必然就有文件对应的inode，shmem文件系统创建的inode附带shmem_inode_info结构，这个结构含有文件系统的私有信息，SHMEM_I()函数以inode为参数，返回shmem_inode_info，而shmem_init_inode_cache就是初始化shmem_inode_info的kmem_cache：

 shmem_inode_info定义在<linux/shmem_fs.h>：

 各个字段的含义：

lock : 数据结构并发访问保护的自旋锁。

flags: 相关标志，详见linux mm.h中的介绍。

alloced: shmem创建的pages的数量。

swapped: 当前inode有很多pages，其中写入swapcache交换缓存的page数量。

shrinklist: 与huge page相关，暂不分析。

swaplist: shmem_inode_info结构体通过该字段挂到shmem.c中shmem_swaplist双向链表中，这个挂接过程是在shmem_writepage中实现，后面源码会分析到。也就是说inode对应的page要写入swapcache的时候，就要将shmem_inode_info挂到shmem_swaplist。

注册文件系统

shmem函数指针结构体

shmem中定义了address_space_operations结构体shmem_aops和vm_operations_struct shmem_vm_ops，分别对应缺页处理和写页面到swapcache中，定义分别如下：

static const struct vm_operations_struct shmem_vm_ops = {
	.fault		= shmem_fault,
	.map_pages	= filemap_map_pages,
#ifdef CONFIG_NUMA
	.set_policy     = shmem_set_policy,
	.get_policy     = shmem_get_policy,
#endif
};

static const struct address_space_operations shmem_aops = {
	.writepage	= shmem_writepage,
	.set_page_dirty	= __set_page_dirty_no_writeback,
#ifdef CONFIG_TMPFS
	.write_begin	= shmem_write_begin,
	.write_end	= shmem_write_end,
#endif
#ifdef CONFIG_MIGRATION
	.migratepage	= migrate_page,
#endif
	.error_remove_page = generic_error_remove_page,
};

匿名VMA使用shmem_vm_ops作为vm_operations_struct，所以中断缺页时会调用shmem_fault分配物理page。

文件和索引节点操作需要两个数据结构file_operations和inode_operations，分别定义如下：

static const struct file_operations shmem_file_operations = {
	.mmap		= shmem_mmap,
	.get_unmapped_area = shmem_get_unmapped_area,
#ifdef CONFIG_TMPFS
	.llseek		= shmem_file_llseek,
	.read_iter	= shmem_file_read_iter,
	.write_iter	= generic_file_write_iter,
	.fsync		= noop_fsync,
	.splice_read	= generic_file_splice_read,
	.splice_write	= iter_file_splice_write,
	.fallocate	= shmem_fallocate,
#endif
};

static const struct inode_operations shmem_inode_operations = {
	.getattr	= shmem_getattr,
	.setattr	= shmem_setattr,
#ifdef CONFIG_TMPFS_XATTR
	.listxattr	= shmem_listxattr,
	.set_acl	= simple_set_acl,
#endif
};

用户态空间向shmem 内存中写入数据就可以调用shmem_file_operations的write_iter接口。

shmem虚拟文件系统创建文件（类似普通文件的open过程）

shmem设计仿照了普通文件的流程，创建普通文件的时候，内核态会初始化struct file结构体和文件相应的inode，shmem这里使用虚拟文件系统也是类似流程，本小节描述shmem对应的文件的创建流程，具体实现函数为：shmem_file_setup，该函数主要创建shmem的strcut file和inode结构体 。

static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name, loff_t size,
				       unsigned long flags, unsigned int i_flags)
{
	struct inode *inode;
	struct file *res;
    ...

	inode = shmem_get_inode(mnt->mnt_sb, NULL, S_IFREG | S_IRWXUGO, 0,
				flags);
	if (unlikely(!inode)) {
		shmem_unacct_size(flags, size);
		return ERR_PTR(-ENOSPC);
	}
	inode->i_flags |= i_flags;
	inode->i_size = size;
	clear_nlink(inode);	/* It is unlinked */
	res = ERR_PTR(ramfs_nommu_expand_for_mapping(inode, size));
	if (!IS_ERR(res))
        //新建file的f_op = shmem_file_operations
		res = alloc_file_pseudo(inode, mnt, name, O_RDWR,
				&shmem_file_operations);
	if (IS_ERR(res))
		iput(inode);
	return res;
}

shmem_get_inode创建inode；alloc_file_psedo创建file对象。

shmem_get_inode函数：

static struct inode *shmem_get_inode(struct super_block *sb, const struct inode *dir,
				     umode_t mode, dev_t dev, unsigned long flags)
{
	struct inode *inode;
	struct shmem_inode_info *info;
	struct shmem_sb_info *sbinfo = SHMEM_SB(sb);
	ino_t ino;

	if (shmem_reserve_inode(sb, &ino))
		return NULL;

	inode = new_inode(sb);
	if (inode) {
        ...
		switch (mode & S_IFMT) {
        ...
		case S_IFREG:
			inode->i_mapping->a_ops = &shmem_aops;
			inode->i_op = &shmem_inode_operations;
			inode->i_fop = &shmem_file_operations;
			mpol_shared_policy_init(&info->policy,
						 shmem_get_sbmpol(sbinfo));
			break;
        ...
		}

		lockdep_annotate_inode_mutex_key(inode);
	} else
		shmem_free_inode(sb);
	return inode;
}

shmem的物理page创建

发生缺页中断的时候，如果vma->vm_ops->fault存在，do_faul文件缺页处理函数中会调用该fault函数，具体可以参考Linux mmap系统调用视角看缺页中断_nginux的博客-CSDN博客​​​​​​

所以shmem的缺页中断会调用shmem_vm_ops 中的fault函数，即shmem_fault。核心函数是shmem_getpage_gfp：负责分配新页或者在swapcache或者swap分区中找到该页。

static vm_fault_t shmem_fault(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	struct inode *inode = file_inode(vma->vm_file);
	gfp_t gfp = mapping_gfp_mask(inode->i_mapping);
	enum sgp_type sgp;
	int err;
	vm_fault_t ret = VM_FAULT_LOCKED;
    ...
    处理与fallocate相关逻辑，暂不分析。
    ...
	sgp = SGP_CACHE;

	if ((vma->vm_flags & VM_NOHUGEPAGE) ||
	    test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags))
		sgp = SGP_NOHUGE;
	else if (vma->vm_flags & VM_HUGEPAGE)
		sgp = SGP_HUGE;

    //缺页分配phsical page的核心函数
	err = shmem_getpage_gfp(inode, vmf->pgoff, &vmf->page, sgp,
				  gfp, vma, vmf, &ret);
	if (err)
		return vmf_error(err);
	return ret;
}

shmem_getpage_gfp

/*
 * shmem_getpage_gfp - find page in cache, or get from swap, or allocate
 *
 * If we allocate a new one we do not mark it dirty. That's up to the
 * vm. If we swap it in we mark it dirty since we also free the swap
 * entry since a page cannot live in both the swap and page cache.
 *
 * vmf and fault_type are only supplied by shmem_fault:
 * otherwise they are NULL.
 */
static int shmem_getpage_gfp(struct inode *inode, pgoff_t index,
	struct page **pagep, enum sgp_type sgp, gfp_t gfp,
	struct vm_area_struct *vma, struct vm_fault *vmf,
			vm_fault_t *fault_type)
{
	struct address_space *mapping = inode->i_mapping;
	struct shmem_inode_info *info = SHMEM_I(inode);
    ...
    //先从mapping指向的缓存中查找，如果没有找到，尝试从swapcache和swap分区查找page
	page = find_lock_entry(mapping, index);
	if (xa_is_value(page)) {
		error = shmem_swapin_page(inode, index, &page,
					  sgp, gfp, vma, fault_type);
		if (error == -EEXIST)
			goto repeat;

		*pagep = page;
		return error;
	}

	if (page && sgp == SGP_WRITE)
		mark_page_accessed(page);

    ...

alloc_huge:
	page = shmem_alloc_and_acct_page(gfp, inode, index, true);
	if (IS_ERR(page)) {
alloc_nohuge:
        //最终调用alloc_page创建物理page，内部会调用__SetPageSwapBacked(page);
		page = shmem_alloc_and_acct_page(gfp, inode,
						 index, false);
	}
    ...
	if (sgp == SGP_WRITE)
		__SetPageReferenced(page);

    //将新建的page加入mapping对应的缓存空间，同时设置了page->mapping和page->index字段
	error = shmem_add_to_page_cache(page, mapping, hindex,
					NULL, gfp & GFP_RECLAIM_MASK,
					charge_mm);
	if (error)
		goto unacct;
    //page加入相应的lru链表，shmem是inactive anon lru链表。因为内核最终判定是加入哪个
    //lru是通过page_is_file_lru，该函数：!PageSwapBacked，如果满足即file lru，否则
    //anon lru。
	lru_cache_add(page);
	alloced = true;

    ...
}

 要点：

shmem_alloc_and_acct_page：最终调用alloc_page创建物理page，内部会调用__SetPageSwapBacked(page); 即shmem page是SwapBacked。

shmem_add_to_page_cache：将新建的page加入mapping对应的缓存空间，设置了page->mapping和page->index字段，同时增加了NR_FILE_PAGES和NR_SHMEM计数：

 lru_cache_add：page加入相应的lru链表，shmem是inactive anon lru链表。因为内核最终判定是加入哪个lru是通过page_is_file_lru，该函数：!PageSwapBacked，如果满足即file lru，否则 anon lru。

 shmem页面回写

shmem的物理page在内存紧张的时候会进行回收，由于不像file-back page可以写回磁盘，shmem的流程某些程度上类似anon page，会通过pageout换出到交换分区，其调用栈如下：

#0  shmem_writepage (page=0xffffea0000008000, wbc=0xffff888004857440) at mm/shmem.c:1371
#1  0xffffffff8135e671 in pageout (page=0xffffea0000008000, mapping=0xffff888000d78858) at mm/vmscan.c:830
#2  0xffffffff8134f168 in shrink_page_list (page_list=0xffff888004857850, pgdat=0xffff888007fda000, sc=0xffff888004857d90, ttu_flags=(unknown: 0), stat=0xffff888004857890, ignore_references=false)
    at mm/vmscan.c:1355
#3  0xffffffff81351477 in shrink_inactive_list (nr_to_scan=1, lruvec=0xffff888005c6a000, sc=0xffff888004857d90, lru=LRU_INACTIVE_ANON) at mm/vmscan.c:1962
#4  0xffffffff81352312 in shrink_list (lru=LRU_INACTIVE_ANON, nr_to_scan=1, lruvec=0xffff888005c6a000, sc=0xffff888004857d90) at mm/vmscan.c:2172
#5  0xffffffff81352c97 in shrink_lruvec (lruvec=0xffff888005c6a000, sc=0xffff888004857d90) at mm/vmscan.c:2467
#6  0xffffffff813533f1 in shrink_node_memcgs (pgdat=0xffff888007fda000, sc=0xffff888004857d90) at mm/vmscan.c:2655
#7  0xffffffff81353b0a in shrink_node (pgdat=0xffff888007fda000, sc=0xffff888004857d90) at mm/vmscan.c:2772
#8  0xffffffff81355cd8 in kswapd_shrink_node (pgdat=0xffff888007fda000, sc=0xffff888004857d90) at mm/vmscan.c:3514
#9  0xffffffff813561ac in balance_pgdat (pgdat=0xffff888007fda000, order=0, highest_zoneidx=0) at mm/vmscan.c:3672
#10 0xffffffff81356ae4 in kswapd (p=0xffff888007fda000) at mm/vmscan.c:3930
#11 0xffffffff811a2249 in kthread (_create=<optimized out>) at kernel/kthread.c:292

shmem_writepage在回收页面时将shmem写到swapcache当中：

/*
 * Move the page from the page cache to the swap cache.
 */
static int shmem_writepage(struct page *page, struct writeback_control *wbc)
{
	struct shmem_inode_info *info;
	struct address_space *mapping;
	struct inode *inode;
	swp_entry_t swap;
	pgoff_t index;

	VM_BUG_ON_PAGE(PageCompound(page), page);
	BUG_ON(!PageLocked(page));
	mapping = page->mapping;
	index = page->index;
	inode = mapping->host;
	info = SHMEM_I(inode);
	if (info->flags & VM_LOCKED)
		goto redirty;
	if (!total_swap_pages)
		goto redirty;

    ...
    //从swap分区中获取一个空闲槽位。
	swap = get_swap_page(page);
	if (!swap.val)
		goto redirty;

	/*
	 * Add inode to shmem_unuse()'s list of swapped-out inodes,
	 * if it's not already there.  Do it now before the page is
	 * moved to swap cache, when its pagelock no longer protects
	 * the inode from eviction.  But don't unlock the mutex until
	 * we've incremented swapped, because shmem_unuse_inode() will
	 * prune a !swapped inode from the swaplist under this mutex.
	 */
	mutex_lock(&shmem_swaplist_mutex);
    //将当前shmem_inode_info挂接到shmem_swaplist当中，shmem_swaplist
	if (list_empty(&info->swaplist))
		list_add(&info->swaplist, &shmem_swaplist);

    //将page添加到swapcache address_space当中
	if (add_to_swap_cache(page, swap,
			__GFP_HIGH | __GFP_NOMEMALLOC | __GFP_NOWARN,
			NULL) == 0) {
		spin_lock_irq(&info->lock);
		shmem_recalc_inode(inode);
		info->swapped++;
		spin_unlock_irq(&info->lock);

		swap_shmem_alloc(swap);
        //从page cache space中删除
		shmem_delete_from_page_cache(page, swp_to_radix_entry(swap));

		mutex_unlock(&shmem_swaplist_mutex);
		BUG_ON(page_mapped(page));
        //开始向交换分区写入，或者写入磁盘，或者zram压缩内存。
		swap_writepage(page, wbc);
		return 0;
	}

	...
	return 0;
}

注意：

• swap_writepage会调用set_page_writeback设置page状态为writeback，也就说page正在回写，这影响/proc/meminfo Writeback统计，也就说不管是匿名页写回交换分区（或者压缩zram），还是write系统调用page cache向磁盘文件回写，都将统计到NR_WRITEBACK中，影响proc/meminfo的Writeback字段统计。