1. 思考
多个进程可以加载相同的共享链接库，比如C语言的运行库，加载运行库采用内存映射文件的方式，可以延迟对于文件内容的读入操作。
共享链接库文件，是一个elf格式的库文件，里面会包含多个不同的section，比如text/data/bss section。
不同的section的访问方式和权限都有差别，比如text section可能一般要求“只读、可以执行”的权限，而data/bss section最起码要在“可读、可写”的权限。
那么，这种不同权限的section在内存映射时，是怎样区分对待，映射到不同的内存区域中的呢？
Linux下的共享链接库可以通过dlopen函数来加载，该函数会负责将一个共享链接库的不同的section以不同的方式映射到进程的地址空间中，
1: daniel@ubuntu:/proc$ cat /proc/self/maps
2: 00262000-00280000 r-xp 00000000 08:01 525208 /lib/i386-linux-gnu/ld-2.13.so
3: 00280000-00281000 r--p 0001d000 08:01 525208 /lib/i386-linux-gnu/ld-2.13.so
4: 00281000-00282000 rw-p 0001e000 08:01 525208 /lib/i386-linux-gnu/ld-2.13.so
5:
6:
7:
8: 00458000-0045b000 rw-p 00000000 00:00 0
9: 009b8000-009b9000 r-xp 00000000 00:00 0 [vdso]
10: 08048000-08051000 r-xp 00000000 08:01 1310739 /bin/cat
11: 08051000-08052000 r--p 00008000 08:01 1310739 /bin/cat
12: 08052000-08053000 rw-p 00009000 08:01 1310739 /bin/cat
13: 08fad000-08fce000 rw-p 00000000 00:00 0 [heap]
14: b7516000-b7517000 r--p 0043a000 08:01 3021821 /usr/lib/locale/locale-archive
15: b7517000-b7557000 r--p 002bd000 08:01 3021821 /usr/lib/locale/locale-archive
16: b7557000-b7757000 r--p 00000000 08:01 3021821 /usr/lib/locale/locale-archive
17: b7757000-b7758000 rw-p 00000000 00:00 0
18: b7768000-b776a000 rw-p 00000000 00:00 0
19: bf9e6000-bfa07000 rw-p 00000000 00:00 0 [stack]
库文件/lib/i386-linux-gnu/libc-2.13.so被映射到了三个内存区域，如果想了解各个字段都代表什么意思，可以到内核源码中去查看一个/proc/[pid]/maps是怎么打印出来的。
1: static const struct seq_operations proc_pid_maps_op = {
2: .start = m_start,
3: .next = m_next,
4: .stop = m_stop,
5: .show = show_map
6: };
1: static int show_map(struct seq_file *m, void *v)
2: {
3: struct vm_area_struct *vma = v;
4: struct proc_maps_private *priv = m->private;
5: struct task_struct *task = priv->task;
6:
7: show_map_vma(m, vma);
8:
9: if (m->count < m->size) /* vma is copied successfully */
10: m->version = (vma != get_gate_vma(task->mm))
11: ? vma->vm_start : 0;
12: return 0;
13: }
1: static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
2: {
3: struct mm_struct *mm = vma->vm_mm;
4: struct file *file = vma->vm_file;
5: vm_flags_t flags = vma->vm_flags;
6: unsigned long ino = 0;
7: unsigned long long pgoff = 0;
8: unsigned long start, end;
9: dev_t dev = 0;
10: int len;
11:
12: if (file) {
13: struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
14: dev = inode->i_sb->s_dev;
15: ino = inode->i_ino;
16: pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
17: }
18:
19: /* We don't show the stack guard page in /proc/maps */
20: start = vma->vm_start;
21: if (stack_guard_page_start(vma, start))
22: start += PAGE_SIZE;
23: end = vma->vm_end;
24: if (stack_guard_page_end(vma, end))
25: end -= PAGE_SIZE;
26:
27: seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
28: start,
29: end,
30: flags & VM_READ ? 'r' : '-',
31: flags & VM_WRITE ? 'w' : '-',
32: flags & VM_EXEC ? 'x' : '-',
33: flags & VM_MAYSHARE ? 's' : 'p',
34: pgoff,
35: MAJOR(dev), MINOR(dev), ino, &len);
36:
37: /*
38: * Print the dentry name for named mappings, and a
39: * special [heap] marker for the heap:
40: */
41: if (file) {
42: pad_len_spaces(m, len);
43: seq_path(m, &file->f_path, "\n");
44: } else {
45: const char *name = arch_vma_name(vma);
46: if (!name) {
47: if (mm) {
48: if (vma->vm_start <= mm->brk &&
49: vma->vm_end >= mm->start_brk) {
50: name = "[heap]";
51: } else if (vma->vm_start <= mm->start_stack &&
52: vma->vm_end >= mm->start_stack) {
53: name = "[stack]";
54: }
55: } else {
56: name = "[vdso]";
57: }
58: }
59: if (name) {
60: pad_len_spaces(m, len);
61: seq_puts(m, name);
62: }
63: }
64: seq_putc(m, '\n');
65: }
seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
start,
end,
flags & VM_READ ? 'r' : '-',
flags & VM_WRITE ? 'w' : '-',
flags & VM_EXEC ? 'x' : '-',
flags & VM_MAYSHARE ? 's' : 'p',
pgoff,
MAJOR(dev), MINOR(dev), ino, &len);
即[vma的起始地址]-[vma的结束地址] [读][写][执行][共享/私有] [在文件中的偏移] [主设备号]:[次设备号] [inode序号] [长度]
对于最后一个字段
const char *name = arch_vma_name(vma);
if (!name) {
if (mm) {
if (vma->vm_start <= mm->brk &&
vma->vm_end >= mm->start_brk) {
name = "[heap]";
} else if (vma->vm_start <= mm->start_stack &&
vma->vm_end >= mm->start_stack) {
name = "[stack]";
}
} else {
name = "[vdso]";
}
}
if (name) {
pad_len_spaces(m, len);
seq_puts(m, name);
}
什么是[vdso]呢？
可以将vdso看成一个shared objdect file（这个文件实际上不存在）,内核将其映射到某个地址空间，被所有程序所共享。（我觉得这里用到了一个技术：多个虚拟页面映射到同一个物理页面。即内核把vdso映射到某个物理页面上，然后所有程序都会有一个页表项指向它，以此来共享，这样每个程序的vdso地址就可以不相同了）
参考：http://www.cppblog.com/hex108/archive/2010/11/22/134313.html
vdso是将内核态的调用映射到用户态的地址空间中，使得调用开销更小，路径更好
参考：http://blog.csdn.net/wlp600/article/details/6886162
这是一个内存页，用于中转系统调用，以提高性能。有点类似于Xen中的hypercall页面。
我们看一下，被映射成三个区域的部分在文件中是分别是什么样的内容
1: daniel@ubuntu:/proc$ readelf -S /lib/i386-linux-gnu/libc-2.13.so
2: There are 35 section headers, starting at offset 0x178b50:
3:
4: Section Headers:
5: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al
6: [ 0] NULL 00000000 000000 000000 00 0 0 0
7: [ 1] .note.gnu.build-i NOTE 00000174 000174 000024 00 A 0 0 4
8: [ 2] .note.ABI-tag NOTE 00000198 000198 000020 00 A 0 0 4
9: [ 3] .gnu.hash GNU_HASH 000001b8 0001b8 003c38 04 A 4 0 4
10: [ 4] .dynsym DYNSYM 00003df0 003df0 009200 10 A 5 1 4
11: [ 5] .dynstr STRTAB 0000cff0 00cff0 005acd 00 A 0 0 1
12: [ 6] .gnu.version VERSYM 00012abe 012abe 001240 02 A 4 0 2
13: [ 7] .gnu.version_d VERDEF 00013d00 013d00 0003d8 00 A 5 28 4
14: [ 8] .gnu.version_r VERNEED 000140d8 0140d8 000040 00 A 5 1 4
15: [ 9] .rel.dyn REL 00014118 014118 002a10 08 A 4 0 4
16: [10] .rel.plt REL 00016b28 016b28 000038 08 A 4 11 4
17: [11] .plt PROGBITS 00016b60 016b60 000080 04 AX 0 0 16
18: [12] .text PROGBITS 00016be0 016be0 10cba4 00 AX 0 0 16
19: [13] __libc_freeres_fn PROGBITS 00123790 123790 000f17 00 AX 0 0 16
20: [14] __libc_thread_fre PROGBITS 001246b0 1246b0 000196 00 AX 0 0 16
21: [15] .rodata PROGBITS 00124860 124860 01dbc8 00 A 0 0 32
22: [16] .interp PROGBITS 00142428 142428 000013 00 A 0 0 1
23: [17] .eh_frame_hdr PROGBITS 0014243c 14243c 0073b4 00 A 0 0 4
24: [18] .eh_frame PROGBITS 001497f0 1497f0 028c74 00 A 0 0 4
25: [19] .gcc_except_table PROGBITS 00172464 172464 0005a8 00 A 0 0 1
26: [20] .hash HASH 00172a0c 172a0c 003484 04 A 4 0 4
27: [21] .tdata PROGBITS 001761e4 1761e4 000008 00 WAT 0 0 4
28: [22] .tbss NOBITS 001761ec 1761ec 000038 00 WAT 0 0 4
29: [23] .init_array INIT_ARRAY 001761ec 1761ec 00000c 00 WA 0 0 4
30: [24] __libc_subfreeres PROGBITS 001761f8 1761f8 000070 00 WA 0 0 4
31: [25] __libc_atexit PROGBITS 00176268 176268 000004 00 WA 0 0 4
32: [26] __libc_thread_sub PROGBITS 0017626c 17626c 00000c 00 WA 0 0 4
33: [27] .data.rel.ro PROGBITS 00176280 176280 001afc 00 WA 0 0 32
34: [28] .dynamic DYNAMIC 00177d7c 177d7c 0000f0 08 WA 5 0 4
35: [29] .got PROGBITS 00177e6c 177e6c 000174 04 WA 0 0 4
36: [30] .got.plt PROGBITS 00177ff4 177ff4 000028 04 WA 0 0 4
37: [31] .data PROGBITS 00178020 178020 00099c 00 WA 0 0 32
38: [32] .bss NOBITS 001789c0 1789bc 003058 00 WA 0 0 32
39: [33] .gnu_debuglink PROGBITS 00000000 1789bc 000014 00 0 0 1
40: [34] .shstrtab STRTAB 00000000 1789d0 00017e 00 0 0 1
41: Key to Flags:
42: W (write), A (alloc), X (execute), M (merge), S (strings)
43: I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
44: O (extra OS processing required) o (OS specific), p (processor specific)
第一个区域，r_xp，是“只读、执行、私有”区域，主要映射的是.text section, .rodata section;
第二个区域，r__p，是“只读、私有”区域，主要映射的是.tdata section, .tbss section;
第三个区域，rw_p，是“读写、私有”区域，主要映射的是.data section, .bss section;
因此，对于共享链接库以及可执行文件来说，内存映射实际上只是加载过程的一部分，一个文件可以映射到内存的几个区域。