进程，可执行文件和内存的关系

假设我们有如下程序：

#include <stdio.h>

int bss;
int data = 10;

void f(unsigned long *a)
{
        *a = 1;
}

int main(int argc, char*argv[])
{
        int stack;
        void *heap;
        printf("bss: %p\n", &bss);
        printf("data: %p\n", &data);
        printf("f: %p\n", f);
        printf("stack: %p\n", &stack);
        heap = malloc(10);
        printf("heap: %p\n", heap);

        sleep(10000);

        return 0;
}

输出如下：

# ./test
bss: 0x60103c
data: 0x601034
f: 0x400567
stack: 0x7ffc2946b944
heap: 0x8f7670

# objdump -h test
 12 .text         00000202  0000000000400490  0000000000400490  00000490  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 22 .data         00000008  0000000000601030  0000000000601030  00001030  2**2
                  CONTENTS, ALLOC, LOAD, DATA
 23 .bss          00000008  0000000000601038  0000000000601038  00001038  2**2
                  ALLOC

crash> ps | grep test
  10296  10585  10  ffff880715539d00  IN   0.0    4476   1564  test
crash> task_struct.mm ffff880715539d00
    mm = 0xffff88072b3903c0
crash> mm_struct.mmap 0xffff88072b3903c0
  mmap = 0xffff8807154a0000
crash> list vm_area_struct.vm_next 0xffff8807154a0000 -s vm_area_struct.vm_start,vm_file                                            ffff8807154a0000
  vm_start = 0x400000
  vm_file = 0xffff88078396eb00
ffff8807154a1590
  vm_start = 0x600000
  vm_file = 0xffff88078396eb00
ffff8807154a08a0
  vm_start = 0x601000
  vm_file = 0xffff88078396eb00
ffff8807154a0cf0
  vm_start = 0x8f7000
  vm_file = 0x0
ffff8807154a1648
  vm_start = 0x7f942c678000
  vm_file = 0xffff88078396fa00
ffff8807154a0fd0
  vm_start = 0x7f942c853000
  vm_file = 0xffff88078396fa00
ffff8807154a11f8
  vm_start = 0x7f942ca53000
  vm_file = 0xffff88078396fa00
ffff8807154a0450
  vm_start = 0x7f942ca57000
  vm_file = 0xffff88078396fa00
ffff8807154a0228
  vm_start = 0x7f942ca59000
  vm_file = 0x0
ffff8807154a17b8
  vm_start = 0x7f942ca5d000
  vm_file = 0xffff88078396f000
ffff8807154a00b8
  vm_start = 0x7f942cc60000
  vm_file = 0x0
ffff8807154a1a98
  vm_start = 0x7f942cc82000
  vm_file = 0x0
ffff8807154a1140
  vm_start = 0x7f942cc84000
  vm_file = 0xffff88078396f000
ffff8807154a0da8
  vm_start = 0x7f942cc85000
  vm_file = 0xffff88078396f000
ffff8807154a0b80
  vm_start = 0x7f942cc86000
  vm_file = 0x0
ffff8807154a0ac8
  vm_start = 0x7ffc2944d000
  vm_file = 0x0
  vm_start = 0x7ffc2949d000
  vm_file = 0x0
ffff8807154a0c38
  vm_start = 0x7ffc294a0000
  vm_file = 0x0
crash> file 0xffff88078396eb00
struct file {
  f_u = {
    fu_llist = {
      next = 0x0
    },
    fu_rcuhead = {
      next = 0x0,
      func = 0x0
    }
  },
  f_path = {
    mnt = 0xffff8807c8eb8020,
    dentry = 0xffff8803c66118c0
  },
  f_inode = 0xffff88034e86aa98,
crash> inode.i_mapping 0xffff88034e86aa98
  i_mapping = 0xffff88034e86ac10
crash> address_space 0xffff88034e86ac10 -o
struct address_space {
  [ffff88034e86ac10] struct inode *host;
  [ffff88034e86ac18] struct radix_tree_root page_tree;
  [ffff88034e86ac28] spinlock_t tree_lock;
  [ffff88034e86ac2c] atomic_t i_mmap_writable;
  [ffff88034e86ac30] struct rb_root i_mmap;
  [ffff88034e86ac38] struct rw_semaphore i_mmap_rwsem;
  [ffff88034e86ac60] unsigned long nrpages;
  [ffff88034e86ac68] unsigned long nrexceptional;
  [ffff88034e86ac70] unsigned long writeback_index;
  [ffff88034e86ac78] const struct address_space_operations *a_ops;
  [ffff88034e86ac80] unsigned long flags;
  [ffff88034e86ac88] spinlock_t private_lock;
  [ffff88034e86ac8c] gfp_t gfp_mask;
  [ffff88034e86ac90] struct list_head private_list;
  [ffff88034e86aca0] void *private_data;
  [ffff88034e86aca8] errseq_t wb_err;
}
SIZE: 0xa0
crash> tree -t ra ffff88034e86ac18
ffffea001c506380
ffffea001c506340
ffffea000d685f80
crash> tree -t ra ffff88034e86ac18 -s page.mapping
ffffea001c506380
    mapping = 0xffff88034e86ac10
ffffea001c506340
    mapping = 0xffff88034e86ac10
ffffea000d685f80
    mapping = 0xffff88034e86ac10

系统调用do_execve通过do_mmap把可执行文件的各个section放到进程的某个线性地址中（vm_area_struct）。可执行文件8.1K，正好占用了三个内存页。这些内存页通过IDR存在address_space中。

# cat /proc/31845/maps
00400000-00401000 r-xp 00000000 fd:00 2200014                            /root/test/test
00600000-00601000 r--p 00000000 fd:00 2200014                            /root/test/test
00601000-00602000 rw-p 00001000 fd:00 2200014                            /root/test/test
00930000-00951000 rw-p 00000000 00:00 0                                  [heap]
7f8ec0fbd000-7f8ec1198000 r-xp 00000000 fd:00 134321644                  /usr/lib64/libc-2.26.so
7f8ec1198000-7f8ec1398000 ---p 001db000 fd:00 134321644                  /usr/lib64/libc-2.26.so
7f8ec1398000-7f8ec139c000 r--p 001db000 fd:00 134321644                  /usr/lib64/libc-2.26.so
7f8ec139c000-7f8ec139e000 rw-p 001df000 fd:00 134321644                  /usr/lib64/libc-2.26.so
7f8ec139e000-7f8ec13a2000 rw-p 00000000 00:00 0
7f8ec13a2000-7f8ec13ca000 r-xp 00000000 fd:00 134320668                  /usr/lib64/ld-2.26.so
7f8ec15a5000-7f8ec15a8000 rw-p 00000000 00:00 0
7f8ec15c7000-7f8ec15c9000 rw-p 00000000 00:00 0
7f8ec15c9000-7f8ec15ca000 r--p 00027000 fd:00 134320668                  /usr/lib64/ld-2.26.so
7f8ec15ca000-7f8ec15cb000 rw-p 00028000 fd:00 134320668                  /usr/lib64/ld-2.26.so
7f8ec15cb000-7f8ec15cc000 rw-p 00000000 00:00 0
7ffe1ee63000-7ffe1ee84000 rw-p 00000000 00:00 0                          [stack]
7ffe1ef5a000-7ffe1ef5d000 r--p 00000000 00:00 0                          [vvar]
7ffe1ef5d000-7ffe1ef5f000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]