284 lines · plain
1=============================2No-MMU memory mapping support3=============================4 5The kernel has limited support for memory mapping under no-MMU conditions, such6as are used in uClinux environments. From the userspace point of view, memory7mapping is made use of in conjunction with the mmap() system call, the shmat()8call and the execve() system call. From the kernel's point of view, execve()9mapping is actually performed by the binfmt drivers, which call back into the10mmap() routines to do the actual work.11 12Memory mapping behaviour also involves the way fork(), vfork(), clone() and13ptrace() work. Under uClinux there is no fork(), and clone() must be supplied14the CLONE_VM flag.15 16The behaviour is similar between the MMU and no-MMU cases, but not identical;17and it's also much more restricted in the latter case:18 19 (#) Anonymous mapping, MAP_PRIVATE20 21 In the MMU case: VM regions backed by arbitrary pages; copy-on-write22 across fork.23 24 In the no-MMU case: VM regions backed by arbitrary contiguous runs of25 pages.26 27 (#) Anonymous mapping, MAP_SHARED28 29 These behave very much like private mappings, except that they're30 shared across fork() or clone() without CLONE_VM in the MMU case. Since31 the no-MMU case doesn't support these, behaviour is identical to32 MAP_PRIVATE there.33 34 (#) File, MAP_PRIVATE, PROT_READ / PROT_EXEC, !PROT_WRITE35 36 In the MMU case: VM regions backed by pages read from file; changes to37 the underlying file are reflected in the mapping; copied across fork.38 39 In the no-MMU case:40 41 - If one exists, the kernel will re-use an existing mapping to the42 same segment of the same file if that has compatible permissions,43 even if this was created by another process.44 45 - If possible, the file mapping will be directly on the backing device46 if the backing device has the NOMMU_MAP_DIRECT capability and47 appropriate mapping protection capabilities. Ramfs, romfs, cramfs48 and mtd might all permit this.49 50 - If the backing device can't or won't permit direct sharing,51 but does have the NOMMU_MAP_COPY capability, then a copy of the52 appropriate bit of the file will be read into a contiguous bit of53 memory and any extraneous space beyond the EOF will be cleared54 55 - Writes to the file do not affect the mapping; writes to the mapping56 are visible in other processes (no MMU protection), but should not57 happen.58 59 (#) File, MAP_PRIVATE, PROT_READ / PROT_EXEC, PROT_WRITE60 61 In the MMU case: like the non-PROT_WRITE case, except that the pages in62 question get copied before the write actually happens. From that point63 on writes to the file underneath that page no longer get reflected into64 the mapping's backing pages. The page is then backed by swap instead.65 66 In the no-MMU case: works much like the non-PROT_WRITE case, except67 that a copy is always taken and never shared.68 69 (#) Regular file / blockdev, MAP_SHARED, PROT_READ / PROT_EXEC / PROT_WRITE70 71 In the MMU case: VM regions backed by pages read from file; changes to72 pages written back to file; writes to file reflected into pages backing73 mapping; shared across fork.74 75 In the no-MMU case: not supported.76 77 (#) Memory backed regular file, MAP_SHARED, PROT_READ / PROT_EXEC / PROT_WRITE78 79 In the MMU case: As for ordinary regular files.80 81 In the no-MMU case: The filesystem providing the memory-backed file82 (such as ramfs or tmpfs) may choose to honour an open, truncate, mmap83 sequence by providing a contiguous sequence of pages to map. In that84 case, a shared-writable memory mapping will be possible. It will work85 as for the MMU case. If the filesystem does not provide any such86 support, then the mapping request will be denied.87 88 (#) Memory backed blockdev, MAP_SHARED, PROT_READ / PROT_EXEC / PROT_WRITE89 90 In the MMU case: As for ordinary regular files.91 92 In the no-MMU case: As for memory backed regular files, but the93 blockdev must be able to provide a contiguous run of pages without94 truncate being called. The ramdisk driver could do this if it allocated95 all its memory as a contiguous array upfront.96 97 (#) Memory backed chardev, MAP_SHARED, PROT_READ / PROT_EXEC / PROT_WRITE98 99 In the MMU case: As for ordinary regular files.100 101 In the no-MMU case: The character device driver may choose to honour102 the mmap() by providing direct access to the underlying device if it103 provides memory or quasi-memory that can be accessed directly. Examples104 of such are frame buffers and flash devices. If the driver does not105 provide any such support, then the mapping request will be denied.106 107 108Further notes on no-MMU MMAP109============================110 111 (#) A request for a private mapping of a file may return a buffer that is not112 page-aligned. This is because XIP may take place, and the data may not be113 paged aligned in the backing store.114 115 (#) A request for an anonymous mapping will always be page aligned. If116 possible the size of the request should be a power of two otherwise some117 of the space may be wasted as the kernel must allocate a power-of-2118 granule but will only discard the excess if appropriately configured as119 this has an effect on fragmentation.120 121 (#) The memory allocated by a request for an anonymous mapping will normally122 be cleared by the kernel before being returned in accordance with the123 Linux man pages (ver 2.22 or later).124 125 In the MMU case this can be achieved with reasonable performance as126 regions are backed by virtual pages, with the contents only being mapped127 to cleared physical pages when a write happens on that specific page128 (prior to which, the pages are effectively mapped to the global zero page129 from which reads can take place). This spreads out the time it takes to130 initialize the contents of a page - depending on the write-usage of the131 mapping.132 133 In the no-MMU case, however, anonymous mappings are backed by physical134 pages, and the entire map is cleared at allocation time. This can cause135 significant delays during a userspace malloc() as the C library does an136 anonymous mapping and the kernel then does a memset for the entire map.137 138 However, for memory that isn't required to be precleared - such as that139 returned by malloc() - mmap() can take a MAP_UNINITIALIZED flag to140 indicate to the kernel that it shouldn't bother clearing the memory before141 returning it. Note that CONFIG_MMAP_ALLOW_UNINITIALIZED must be enabled142 to permit this, otherwise the flag will be ignored.143 144 uClibc uses this to speed up malloc(), and the ELF-FDPIC binfmt uses this145 to allocate the brk and stack region.146 147 (#) A list of all the private copy and anonymous mappings on the system is148 visible through /proc/maps in no-MMU mode.149 150 (#) A list of all the mappings in use by a process is visible through151 /proc/<pid>/maps in no-MMU mode.152 153 (#) Supplying MAP_FIXED or a requesting a particular mapping address will154 result in an error.155 156 (#) Files mapped privately usually have to have a read method provided by the157 driver or filesystem so that the contents can be read into the memory158 allocated if mmap() chooses not to map the backing device directly. An159 error will result if they don't. This is most likely to be encountered160 with character device files, pipes, fifos and sockets.161 162 163Interprocess shared memory164==========================165 166Both SYSV IPC SHM shared memory and POSIX shared memory is supported in NOMMU167mode. The former through the usual mechanism, the latter through files created168on ramfs or tmpfs mounts.169 170 171Futexes172=======173 174Futexes are supported in NOMMU mode if the arch supports them. An error will175be given if an address passed to the futex system call lies outside the176mappings made by a process or if the mapping in which the address lies does not177support futexes (such as an I/O chardev mapping).178 179 180No-MMU mremap181=============182 183The mremap() function is partially supported. It may change the size of a184mapping, and may move it [#]_ if MREMAP_MAYMOVE is specified and if the new size185of the mapping exceeds the size of the slab object currently occupied by the186memory to which the mapping refers, or if a smaller slab object could be used.187 188MREMAP_FIXED is not supported, though it is ignored if there's no change of189address and the object does not need to be moved.190 191Shared mappings may not be moved. Shareable mappings may not be moved either,192even if they are not currently shared.193 194The mremap() function must be given an exact match for base address and size of195a previously mapped object. It may not be used to create holes in existing196mappings, move parts of existing mappings or resize parts of mappings. It must197act on a complete mapping.198 199.. [#] Not currently supported.200 201 202Providing shareable character device support203============================================204 205To provide shareable character device support, a driver must provide a206file->f_op->get_unmapped_area() operation. The mmap() routines will call this207to get a proposed address for the mapping. This may return an error if it208doesn't wish to honour the mapping because it's too long, at a weird offset,209under some unsupported combination of flags or whatever.210 211The driver should also provide backing device information with capabilities set212to indicate the permitted types of mapping on such devices. The default is213assumed to be readable and writable, not executable, and only shareable214directly (can't be copied).215 216The file->f_op->mmap() operation will be called to actually inaugurate the217mapping. It can be rejected at that point. Returning the ENOSYS error will218cause the mapping to be copied instead if NOMMU_MAP_COPY is specified.219 220The vm_ops->close() routine will be invoked when the last mapping on a chardev221is removed. An existing mapping will be shared, partially or not, if possible222without notifying the driver.223 224It is permitted also for the file->f_op->get_unmapped_area() operation to225return -ENOSYS. This will be taken to mean that this operation just doesn't226want to handle it, despite the fact it's got an operation. For instance, it227might try directing the call to a secondary driver which turns out not to228implement it. Such is the case for the framebuffer driver which attempts to229direct the call to the device-specific driver. Under such circumstances, the230mapping request will be rejected if NOMMU_MAP_COPY is not specified, and a231copy mapped otherwise.232 233.. important::234 235 Some types of device may present a different appearance to anyone236 looking at them in certain modes. Flash chips can be like this; for237 instance if they're in programming or erase mode, you might see the238 status reflected in the mapping, instead of the data.239 240 In such a case, care must be taken lest userspace see a shared or a241 private mapping showing such information when the driver is busy242 controlling the device. Remember especially: private executable243 mappings may still be mapped directly off the device under some244 circumstances!245 246 247Providing shareable memory-backed file support248==============================================249 250Provision of shared mappings on memory backed files is similar to the provision251of support for shared mapped character devices. The main difference is that the252filesystem providing the service will probably allocate a contiguous collection253of pages and permit mappings to be made on that.254 255It is recommended that a truncate operation applied to such a file that256increases the file size, if that file is empty, be taken as a request to gather257enough pages to honour a mapping. This is required to support POSIX shared258memory.259 260Memory backed devices are indicated by the mapping's backing device info having261the memory_backed flag set.262 263 264Providing shareable block device support265========================================266 267Provision of shared mappings on block device files is exactly the same as for268character devices. If there isn't a real device underneath, then the driver269should allocate sufficient contiguous memory to honour any supported mapping.270 271 272Adjusting page trimming behaviour273=================================274 275NOMMU mmap automatically rounds up to the nearest power-of-2 number of pages276when performing an allocation. This can have adverse effects on memory277fragmentation, and as such, is left configurable. The default behaviour is to278aggressively trim allocations and discard any excess pages back in to the page279allocator. In order to retain finer-grained control over fragmentation, this280behaviour can either be disabled completely, or bumped up to a higher page281watermark where trimming begins.282 283Page trimming behaviour is configurable via the sysctl ``vm.nr_trim_pages``.284