unsigned long do_mmap(struct file *file, unsigned long addr,
 ? unsigned long len, unsigned long prot,
 ? unsigned long flags, vm_flags_t vm_flags,
 ? unsigned long pgoff, unsigned long *populate)
{
 struct mm_struct *mm = current->mm; ? ? ? ?//獲取該進(jìn)程的memory descriptor
 int pkey = 0;

 *populate = 0;
 //函數(shù)對傳入的參數(shù)進(jìn)行一系列檢查, 假如任一參數(shù)出錯，都會返回一個errno
 if (!len)
 ?return -EINVAL;

 /*
 ?* Does the application expect PROT_READ to imply PROT_EXEC?
 ?*
 ?* (the exception is when the underlying filesystem is noexec
 ?* ?mounted, in which case we dont add PROT_EXEC.)
 ?*/
 if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
 ?if (!(file && path_noexec(&file->f_path)))
 ? prot |= PROT_EXEC;
 //假如沒有設(shè)置MAP_FIXED標(biāo)志，且addr小于mmap_min_addr, 因為可以修改addr, 所以就需要將addr設(shè)為mmap_min_addr的頁對齊后的地址
 if (!(flags & MAP_FIXED))
 ?addr = round_hint_to_min(addr);

 /* Careful about overflows.. */
 len = PAGE_ALIGN(len); ? ? ? ? //進(jìn)行Page大小的對齊
 if (!len)
 ?return -ENOMEM;

 /* offset overflow? */
 if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
 ?return -EOVERFLOW;

 /* Too many mappings? */
 if (mm->map_count > sysctl_max_map_count) ? ?//判斷該進(jìn)程的地址空間的虛擬區(qū)間數(shù)量是否超過了限制
 ?return -ENOMEM;

 //get_unmapped_area從當(dāng)前進(jìn)程的用戶空間獲取一個未被映射區(qū)間的起始地址
 addr = get_unmapped_area(file, addr, len, pgoff, flags);
 if (offset_in_page(addr)) ? ? ? ?//檢查addr是否有效
 ?return addr;

 if (prot == PROT_EXEC) {
 ?pkey = execute_only_pkey(mm);
 ?if (pkey < 0)
 ? pkey = 0;
 }

 /* Do simple checking here so the lower-level routines won't have
 ?* to. we assume access permissions have been handled by the open
 ?* of the memory object, so we don't do any here.
 ?*/
 vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
 ? mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 //假如flags設(shè)置MAP_LOCKED，即類似于mlock()將申請的地址空間鎖定在內(nèi)存中, 檢查是否可以進(jìn)行l(wèi)ock
 if (flags & MAP_LOCKED)
 ?if (!can_do_mlock())
 ? return -EPERM;

 if (mlock_future_check(mm, vm_flags, len))
 ?return -EAGAIN;

 if (file) { ? ? ? ? ?// file指針不為nullptr, 即從文件到虛擬空間的映射
 ?struct inode *inode = file_inode(file); ? //獲取文件的inode

 ?switch (flags & MAP_TYPE) { ? ? ? //根據(jù)標(biāo)志指定的map種類，把為文件設(shè)置的訪問權(quán)考慮進(jìn)去
 ?case MAP_SHARED:
 ? if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
 ? ?return -EACCES;

 ? /*
 ? ?* Make sure we don't allow writing to an append-only
 ? ?* file..
 ? ?*/
 ? if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE))
 ? ?return -EACCES;

 ? /*
 ? ?* Make sure there are no mandatory locks on the file.
 ? ?*/
 ? if (locks_verify_locked(file))
 ? ?return -EAGAIN;

 ? vm_flags |= VM_SHARED | VM_MAYSHARE;
 ? if (!(file->f_mode & FMODE_WRITE))
 ? ?vm_flags &= ~(VM_MAYWRITE | VM_SHARED);

 ? /* fall through */
 ?case MAP_PRIVATE:
 ? if (!(file->f_mode & FMODE_READ))
 ? ?return -EACCES;
 ? if (path_noexec(&file->f_path)) {
 ? ?if (vm_flags & VM_EXEC)
 ? ? return -EPERM;
 ? ?vm_flags &= ~VM_MAYEXEC;
 ? }

 ? if (!file->f_op->mmap)
 ? ?return -ENODEV;
 ? if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
 ? ?return -EINVAL;
 ? break;

 ?default:
 ? return -EINVAL;
 ?}
 } else {
 ?switch (flags & MAP_TYPE) {
 ?case MAP_SHARED:
 ? if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
 ? ?return -EINVAL;
 ? /*
 ? ?* Ignore pgoff.
 ? ?*/
 ? pgoff = 0;
 ? vm_flags |= VM_SHARED | VM_MAYSHARE;
 ? break;
 ?case MAP_PRIVATE:
 ? /*
 ? ?* Set pgoff according to addr for anon_vma.
 ? ?*/
 ? pgoff = addr >> PAGE_SHIFT;
 ? break;
 ?default:
 ? return -EINVAL;
 ?}
 }

 /*
 ?* Set 'VM_NORESERVE' if we should not account for the
 ?* memory use of this mapping.
 ?*/
 if (flags & MAP_NORESERVE) {
 ?/* We honor MAP_NORESERVE if allowed to overcommit */
 ?if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
 ? vm_flags |= VM_NORESERVE;

 ?/* hugetlb applies strict overcommit unless MAP_NORESERVE */
 ?if (file && is_file_hugepages(file))
 ? vm_flags |= VM_NORESERVE;
 }
 //一頓檢查和配置，調(diào)用核心的代碼mmap_region
 addr = mmap_region(file, addr, len, vm_flags, pgoff);
 if (!IS_ERR_VALUE(addr) &&
 ? ? ((vm_flags & VM_LOCKED) ||
 ? ? ?(flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
 ?*populate = len;
 return addr;
}

unsigned long mmap_region(struct file *file, unsigned long addr,
 ?unsigned long len, vm_flags_t vm_flags, unsigned long pgoff)
{
 struct mm_struct *mm = current->mm; ? ? //獲取該進(jìn)程的memory descriptor
 struct vm_area_struct *vma, *prev;
 int error;
 struct rb_node **rb_link, *rb_parent;
 unsigned long charged = 0;

 /* 檢查申請的虛擬內(nèi)存空間是否超過了限制 */
 if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) {
 ?unsigned long nr_pages;

 ?/*
 ? * MAP_FIXED may remove pages of mappings that intersects with
 ? * requested mapping. Account for the pages it would unmap.
 ? */
 ?nr_pages = count_vma_pages_range(mm, addr, addr + len);

 ?if (!may_expand_vm(mm, vm_flags,
 ? ? (len >> PAGE_SHIFT) - nr_pages))
 ? return -ENOMEM;
 }

 /* 檢查[addr, addr+len)的區(qū)間是否存在映射空間，假如存在重合的映射空間需要munmap ?*/
 while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
 ? ? ? ? &rb_parent)) {
 ?if (do_munmap(mm, addr, len))
 ? return -ENOMEM;
 }

 /*
 ?* Private writable mapping: check memory availability
 ?*/
 if (accountable_mapping(file, vm_flags)) {
 ?charged = len >> PAGE_SHIFT;
 ?if (security_vm_enough_memory_mm(mm, charged))
 ? return -ENOMEM;
 ?vm_flags |= VM_ACCOUNT;
 }

 //檢查是否可以合并[addr, addr+len)區(qū)間內(nèi)的虛擬地址空間vma
 vma = vma_merge(mm, prev, addr, addr + len, vm_flags,
 ? NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX);
 if (vma) ? ? ? //假如合并成功，即使用合并后的vma, 并跳轉(zhuǎn)至out
 ?goto out;
 //如果不能和已有的虛擬內(nèi)存區(qū)域合并，通過Memory Descriptor來申請一個vma
 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 if (!vma) {
 ?error = -ENOMEM;
 ?goto unacct_error;
 }
 //初始化vma
 vma->vm_mm = mm;
 vma->vm_start = addr;
 vma->vm_end = addr + len;
 vma->vm_flags = vm_flags;
 vma->vm_page_prot = vm_get_page_prot(vm_flags);
 vma->vm_pgoff = pgoff;
 INIT_LIST_HEAD(&vma->anon_vma_chain);

 if (file) { //假如指定了文件映射 
 ?if (vm_flags & VM_DENYWRITE) { ? //映射的文件不允許寫入，調(diào)用deny_write_accsess(file)排斥常規(guī)的文件操作
 ? error = deny_write_access(file);
 ? if (error)
 ? ?goto free_vma;
 ?}
 ?if (vm_flags & VM_SHARED) { ? //映射的文件允許其他進(jìn)程可見, 標(biāo)記文件為可寫
 ? error = mapping_map_writable(file->f_mapping);
 ? if (error)
 ? ?goto allow_write_and_free_vma;
 ?}

 ?//遞增File的引用次數(shù)，返回File賦給vma
 ?vma->vm_file = get_file(file);
 ?error = file->f_op->mmap(file, vma); ?//調(diào)用文件系統(tǒng)指定的mmap函數(shù)
 ?if (error)
 ? goto unmap_and_free_vma;

 ?/* Can addr have changed??
 ? *
 ? * Answer: Yes, several device drivers can do it in their
 ? * ? ? ? ? f_op->mmap method. -DaveM
 ? * Bug: If addr is changed, prev, rb_link, rb_parent should
 ? * ? ? ?be updated for vma_link()
 ? */
 ?WARN_ON_ONCE(addr != vma->vm_start);

 ?addr = vma->vm_start;
 ?vm_flags = vma->vm_flags;
 } else if (vm_flags & VM_SHARED) {
 ?error = shmem_zero_setup(vma); ?//假如標(biāo)志為VM_SHARED，但沒有指定映射文件，需要調(diào)用shmem_zero_setup(),實際映射的文件是dev/zero
 ?if (error)
 ? goto free_vma;
 }
 //將申請的新vma加入mm中的vma鏈表
 vma_link(mm, vma, prev, rb_link, rb_parent);
 /* Once vma denies write, undo our temporary denial count */
 if (file) {
 ?if (vm_flags & VM_SHARED)
 ? mapping_unmap_writable(file->f_mapping);
 ?if (vm_flags & VM_DENYWRITE)
 ? allow_write_access(file);
 }
 file = vma->vm_file;
out:
 perf_event_mmap(vma);
 //更新進(jìn)程的虛擬地址空間mm
 vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT);
 if (vm_flags & VM_LOCKED) {
 ?if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
 ? ? vma == get_gate_vma(current->mm)))
 ? mm->locked_vm += (len >> PAGE_SHIFT);
 ?else
 ? vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
 }

 if (file)
 ?uprobe_mmap(vma);

 /*
 ?* New (or expanded) vma always get soft dirty status.
 ?* Otherwise user-space soft-dirty page tracker won't
 ?* be able to distinguish situation when vma area unmapped,
 ?* then new mapped in-place (which must be aimed as
 ?* a completely new data area).
 ?*/
 vma->vm_flags |= VM_SOFTDIRTY;

 vma_set_page_prot(vma);

 return addr;

unmap_and_free_vma:
 vma->vm_file = NULL;
 fput(file);

 /* Undo any partial mapping done by a device driver. */
 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
 charged = 0;
 if (vm_flags & VM_SHARED)
 ?mapping_unmap_writable(file->f_mapping);
allow_write_and_free_vma:
 if (vm_flags & VM_DENYWRITE)
 ?allow_write_access(file);
free_vma:
 kmem_cache_free(vm_area_cachep, vma);
unacct_error:
 if (charged)
 ?vm_unacct_memory(charged);
 return error;
}