Linux 内核之旅（二十一）：page cache

struct page *mem_map;  // 全局数组，指向 struct page结构体数组的指针

#if defined(CONFIG_FLATMEM)
#define __pfn_to_page(pfn) (mem_map + ((pfn)-ARCH_PFN_OFFSET))	//ARCH_PFN_OFFSET 是 PFN 的起始偏移量
#define __page_to_pfn(page) ((unsigned long)((page)-mem_map) + ARCH_PFN_OFFSET)
#endif

/*
__page_to_pfn(page)：
((unsigned long)((page) - mem_map) + ARCH_PFN_OFFSET)

(page) - mem_map：计算给定 struct page指针在数组中的索引位置
加上 ARCH_PFN_OFFSET：得到实际的物理页帧号（因为物理内存可能不是从0开始）

__pfn_to_page(pfn)：
(mem_map + ((pfn) - ARCH_PFN_OFFSET))
(pfn) - ARCH_PFN_OFFSET：从PFN中减去偏移得到数组索引
mem_map + index：通过数组索引找到对应的 struct page指针
*/

// 从 struct page 获取物理地址
struct page *page = .......;
unsigned long pfn = page_to_pfn(page);     // 1. 得到 PFN
phys_addr_t phys = pfn << PAGE_SHIFT;      // 2. PFN 转为物理地址
void *virt = phys_to_virt(phys);           // 3. 物理地址转虚拟地址

// 从虚拟内存地址转struct page
pfn = virt_to_pfn(virt);                   // 虚拟地址转 PFN
page = pfn_to_page(pfn);                   // PFN 转 struct page

#define set_pte_at(mm, addr, ptep, pte)	native_set_pte(ptep, pte)

static inline void native_set_pte(pte_t *ptep, pte_t pte)
{
    // ptep 是指向页表位置的内核虚拟地址指针，它是通过 handle_mm_fault 逐级找下去得到的，如 PGD -> PUD -> PMD，最终定位到那张包含 512 个项的 PTE 页表页面中的某一个具体位置
    // pte 是刚才构造出来的 64 位值
	// 细节：在 x86_64 上，直接对对齐的 64 位内存进行赋值是原子的。这保证了PTE变量的原子性
    *ptep = pte;
}

#define page_to_pfn(page) ((unsigned long)((page) - mem_map))

//https://elixir.bootlin.com/linux/v4.11.6/source/arch/x86/include/asm/pgtable.h#L699
#define mk_pte(page, pgprot)   pfn_pte(page_to_pfn(page), (pgprot))

//https://elixir.bootlin.com/linux/v4.11.6/source/arch/x86/include/asm/pgtable.h#L487
static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
{
	// 将 PFN 左移 12 位（因为一个页是 4096 字节，即 2^12）
    // 然后加上权限位（pgprot）
	// 左移 12 位是因为物理地址 = PFN * 4096
	return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) |
		     massage_pgprot(pgprot));
}


int alloc_set_pte(struct vm_fault *vmf, struct mem_cgroup *memcg,
		struct page *page)
{
	struct vm_area_struct *vma = vmf->vma;
	bool write = vmf->flags & FAULT_FLAG_WRITE;
	pte_t entry;
	......
	//生成 PTE 内容：使用 mk_pte(page, vma->vm_page_prot) 将物理页地址转换为页表项格式
	//mk_pte-->pfn_pte：生成64位pte格式

	// 核心操作1：生成 PTE 内容：提取 PFN 并加入 VMA 的权限标志
	entry = mk_pte(page, vma->vm_page_prot);
	
	/*
	下面这段代码有些意思：
	写时复制 (COW) 产生的匿名页 和 共享的文件页/只读页
	下面这段代码主要是权限位的设置：
	1.	此时生成的 PTE 是原始的，在 `handle_mm_fault` 结束前，内核会根据当前的异常类型（读还是写）修改标志位：
		-	pte_mkdirty(entry)：将第 6 位设为 1。告诉 CPU，这个内存页被写过了
		-	pte_mkwrite(entry)：将第 1 位设为 1。如果没设这一位，CPU 写入时会再次触发异常
		-	_PAGE_PRESENT：将第 0 位设为 1。这是最关键的，只有这一位是 1，MMU 才会认为这个映射是有效的
	*/

	//核心操作2：如果是写操作，标记为 Dirty 和 Write
	if (write)
		entry = maybe_mkwrite(pte_mkdirty(entry), vma);
	/* copy-on-write page */
	if (write && !(vma->vm_flags & VM_SHARED)) {
		//分支1：私有可写映射 （Private Writable Mapping）

		//因为这是 COW 出来的页，它已经脱离了原来的文件映射，变成了匿名页 (Anonymous Page)，所以增加进程的匿名页计数
		inc_mm_counter_fast(vma->vm_mm, MM_ANONPAGES);
		//为这个新生成的匿名页建立反向映射
		page_add_new_anon_rmap(page, vma, vmf->address, false);
		//将该页面的内存消耗计入当前进程所在的 cgroup
		mem_cgroup_commit_charge(page, memcg, false, false);
		//将该页加入 LRU 链表，以便内核进行内存回收管理
		lru_cache_add_active_or_unevictable(page, vma);
	} else {
		//分支2：共享映射 （Shared Mapping） 或者 只读映射 ）（Read-only Mapping）

		//增加进程的文件页 （File-backed Page） 计数
		inc_mm_counter_fast(vma->vm_mm, mm_counter_file(page));
		//建立文件页的反向映射
		page_add_file_rmap(page, false);
	}

	//核心操作3：将 entry 写入硬件页表
	//设置页表：调用 set_pte_at。这一步执行完，虚拟地址到物理地址的映射正式在硬件层面打通
	//真正将物理页的地址写入进程页表（PTE）的动作。从此以后，虚拟地址就指向了相应的物理地址
	set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);

	/* no need to invalidate: a not-present page won't be cached */

	// 核心操作4：设置MMU缓存
	update_mmu_cache(vma, vmf->address, vmf->pte);

	//set_pte_at && update_mmu_cache结束：CPU 重新执行指令
	return 0;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/fs.h#L554
struct inode {
	umode_t			i_mode;
	unsigned short		i_opflags;
	kuid_t			i_uid;
	kgid_t			i_gid;
	unsigned int		i_flags;
    ......
	const struct inode_operations	*i_op;
	struct super_block	*i_sb;
	struct address_space	*i_mapping;
    ......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/fs.h#L379
struct address_space {
	/* 拥有此空间的 inode */
	struct inode		*host;		/* owner: inode, block_device */
	/* 核心：存储所有 Page Cache 的基数树 */
	struct radix_tree_root	page_tree;	/* radix tree of all pages */
	/* 保护基数树的自旋锁 */
	spinlock_t		tree_lock;	/* and lock protecting it */
	atomic_t		i_mmap_writable;/* count VM_SHARED mappings */
	/* 所有的 mmap 映射 VMA 链表 */
	struct rb_root		i_mmap;		/* tree of private and shared mappings */
	struct rw_semaphore	i_mmap_rwsem;	/* protect tree, count, list */
	/* 缓存页的总数 */
	/* Protected by tree_lock together with the radix tree */
	unsigned long		nrpages;	/* number of total pages */
	/* number of shadow or DAX exceptional entries */
	unsigned long		nrexceptional;
	pgoff_t			writeback_index;/* writeback starts here */
	/* 方法集：readpage, writepage 等 */
	const struct address_space_operations *a_ops;	/* methods */
	unsigned long		flags;		/* error bits */
	spinlock_t		private_lock;	/* for use by the address_space */
	gfp_t			gfp_mask;	/* implicit gfp mask for allocations */
	struct list_head	private_list;	/* ditto */
	void			*private_data;	/* ditto */
} __attribute__((aligned(sizeof(long))));

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/mm_types.h#L40
struct page {
	/* First double word block */
	unsigned long flags;		/* Atomic flags, some possibly
					 * updated asynchronously */
	union {
		struct address_space *mapping;	/* If low bit clear, points to
						 * inode address_space, or NULL.
						 * If page mapped as anonymous
						 * memory, low bit is set, and
						 * it points to anon_vma object:
						 * see PAGE_MAPPING_ANON below.
						 */
		void *s_mem;			/* slab first object */
		atomic_t compound_mapcount;	/* first tail page */
		/* page_deferred_list().next	 -- second tail page */
	};

	/* Second double word */
	union {
		pgoff_t index;		/* Our offset within mapping. */
		void *freelist;		/* sl[aou]b first free object */
	};
    ......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/radix-tree.h#L93
struct radix_tree_node {
	unsigned char	shift;		/* Bits remaining in each slot */
	unsigned char	offset;		/* Slot offset in parent */
	unsigned char	count;		/* Total entry count */
	unsigned char	exceptional;	/* Exceptional entry count */
	struct radix_tree_node *parent;		/* Used when ascending tree */
	struct radix_tree_root *root;		/* The tree we belong to */
	union {
		struct list_head private_list;	/* For tree user */
		struct rcu_head	rcu_head;	/* Used when freeing node */
	};
	void __rcu	*slots[RADIX_TREE_MAP_SIZE];
	unsigned long	tags[RADIX_TREE_MAX_TAGS][RADIX_TREE_TAG_LONGS];
};

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/fs.h#L379
struct address_space {
	......
    struct inode        *host;      /* owner: inode, block_device */
    struct radix_tree_root  page_tree;  /* radix tree of all pages */
    atomic_t        i_mmap_writable;/* count VM_SHARED mappings */
	// 文件与 vma 反向映射的核心数据结构，i_mmap 也是一颗红黑树
    // 在所有进程的地址空间中，只要与该文件发生映射的 vma 均挂在 i_mmap 中
    struct rb_root      i_mmap;     /* tree of private and shared mappings */
	......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/mm_types.h#L40
struct page {
	/* First double word block */
	unsigned long flags;
	union {
		struct address_space *mapping;	/* If low bit clear, points to
						 * inode address_space, or NULL.
						 * If page mapped as anonymous
						 * memory, low bit is set, and
						 * it points to anon_vma object:
						 * see PAGE_MAPPING_ANON below.
						 */
		void *s_mem;			/* slab first object */
		atomic_t compound_mapcount;	/* first tail page */
		/* page_deferred_list().next	 -- second tail page */
	};

	/* Second double word */
	union {
		pgoff_t index;		/* Our offset within mapping. */
		void *freelist;		/* sl[aou]b first free object */
		/* page_deferred_list().prev	-- second tail page */
	};

	union {
		struct {
			union {
				atomic_t _mapcount;
				unsigned int active;		/* SLAB */
				struct {			/* SLUB */
					unsigned inuse:16;
					unsigned objects:15;
					unsigned frozen:1;
				};
				int units;			/* SLOB */
			};
			atomic_t _refcount;
		};
	};

	union {
		struct list_head lru;	/* Pageout list, eg. active_list
					 * protected by zone_lru_lock !
					 * Can be used as a generic list
					 * by the page owner.
					 */
		struct dev_pagemap *pgmap; /* ZONE_DEVICE pages are never on an
					    * lru or handled by a slab
					    * allocator, this points to the
					    * hosting device page map.
					    */
		struct {		/* slub per cpu partial pages */
			struct page *next;	/* Next partial slab */
		};

		struct rcu_head rcu_head;	/* Used by SLAB
						 * when destroying via RCU
						 */
		/* Tail pages of compound page */
		struct {
			unsigned long compound_head; /* If bit zero is set */

			/* First tail page only */
		}
	};
	......
}

struct page {
    union {
        struct address_space *mapping;  // 文件页：指向address_space
        //void *s_mem;
        void *anon_vma;                  // 匿名页：反向映射
    };
    pgoff_t index;  // 偏移量
    // ...
};

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/page-flags.h#L318
#define PAGE_MAPPING_ANON	0x1
#define PAGE_MAPPING_FLAGS	(PAGE_MAPPING_ANON | PAGE_MAPPING_MOVABLE)

// 判断是否为匿名页：检查 mapping 指针的最低位是否设置了 PAGE_MAPPING_ANON
static __always_inline int PageAnon(struct page *page)
{
	page = compound_head(page);
	return ((unsigned long)page->mapping & PAGE_MAPPING_ANON) != 0;
}

// 获取真正的 address_space 指针（对文件页有效）
//https://elixir.bootlin.com/linux/v4.11.6/source/mm/util.c#L394
struct address_space *page_mapping(struct page *page)
{
	struct address_space *mapping;
	......
	mapping = page->mapping;
	// 清除低位标志，得到真正的指针
	if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)
		return NULL;	// 匿名页返回 NULL
	return mapping;		// 文件页返回 address_space
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L747
int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
				pgoff_t offset, gfp_t gfp_mask)
{
	void *shadow = NULL;
	int ret;

	__SetPageLocked(page);
	ret = __add_to_page_cache_locked(page, mapping, offset,
					  gfp_mask, &shadow);
	if (unlikely(ret))
		__ClearPageLocked(page);
	else {
		// 将页面加入 LRU 链表，使其参与内存回收管理
		if (!(gfp_mask & __GFP_WRITE) && shadow)
			workingset_refault(page, shadow);
		lru_cache_add(page);
	}
	return ret;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L710
static int __add_to_page_cache_locked(struct page *page,
				      struct address_space *mapping,
				      pgoff_t offset, gfp_t gfp_mask,
				      void **shadowp)
{
	......
	page->mapping = mapping;	// 建立 page -> address_space 的反向关联
	page->index = offset;		// 记录文件内的页偏移

	// 将 page 插入 radix 树
	error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
	if (!error) {
		......
		error = page_cache_tree_insert(mapping, page, shadowp);
		......
		mapping->nrpages++;		// page cache 页面计数 +1
		......
	}
	return error;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/page-writeback.c#L2430
int set_page_dirty(struct page *page)
{
	struct address_space *mapping = page_mapping(page);

	if (likely(mapping)) {
		int (*spd)(struct page *) = mapping->a_ops->set_page_dirty;
		......
		// 文件系统提供的 set_page_dirty 实现
		// 对于 ext4，通常调用 __set_page_dirty_buffers
		return (*spd)(page);
	}
	// 匿名页走这里
	if (!PageDirty(page)) {
		SetPageDirty(page);
		return 1;
	}
	return 0;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/memory.c#L2941
static int do_anonymous_page(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	struct mem_cgroup *memcg;
	struct page *page;
	pte_t entry;
	......

	// 如果是读访问，映射到全局零页（节省内存）
	if (!(vmf->flags & FAULT_FLAG_WRITE) &&
			!mm_forbids_zeropage(vma->vm_mm)) {
		entry = pte_mkspecial(pfn_pte(my_zero_pfn(vmf->address),
						vma->vm_page_prot));
		......
		goto setpte;
	}

	// 写访问：分配一个新的物理页
	page = alloc_zeroed_user_highpage_movable(vma, vmf->address);
	......

	// 设置 PTE，标记为可写和脏
	entry = mk_pte(page, vma->vm_page_prot);
	if (vma->vm_flags & VM_WRITE)
		entry = pte_mkwrite(pte_mkdirty(entry));

	......
	// 建立匿名页的反向映射
	page_add_new_anon_rmap(page, vma, vmf->address, false);
	mem_cgroup_commit_charge(page, memcg, false, false);
	// 加入 LRU 链表
	lru_cache_add_active_or_unevictable(page, vma);
setpte:
	set_pte_at(vma->vm_mm, vmf->address, vmf->pte, entry);
	......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/rmap.h#L26
struct anon_vma {
	struct anon_vma *root;		// 指向根 anon_vma
	struct rw_semaphore rwsem;	// 保护链表的读写信号量
	atomic_t refcount;
	......
	struct rb_root rb_root;		// 红黑树根，存储所有关联的 anon_vma_chain
};

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/rmap.h#L74
struct anon_vma_chain {
	struct vm_area_struct *vma;	// 指向关联的 VMA
	struct anon_vma *anon_vma;	// 指向关联的 anon_vma
	struct list_head same_vma;	// 链入 vma->anon_vma_chain 链表
	struct rb_node rb;		// 挂入 anon_vma->rb_root 红黑树
	......
};

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/rmap.c#L1067
void page_add_new_anon_rmap(struct page *page,
	struct vm_area_struct *vma, unsigned long address, bool compound)
{
	......
	// 设置 page->mapping，低位置1表示匿名页
	__page_set_anon_rmap(page, vma, address, 1);
}

static void __page_set_anon_rmap(struct page *page,
	struct vm_area_struct *vma, unsigned long address, int exclusive)
{
	struct anon_vma *anon_vma = vma->anon_vma;
	......
	// 将 anon_vma 指针的低位设置 PAGE_MAPPING_ANON 标志
	anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
	page->mapping = (struct address_space *) anon_vma;
	page->index = linear_page_index(vma, address);
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/page-flags.h
// PG_swapbacked：该页可以被交换到swap空间
// 匿名页和shmem页会设置此标志

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/page-flags.h
// 判断是否为匿名页
static __always_inline int PageAnon(struct page *page)
{
	page = compound_head(page);
	return ((unsigned long)page->mapping & PAGE_MAPPING_ANON) != 0;
}

// 判断是否可被swap（匿名页和shmem页）
static __always_inline int PageSwapBacked(struct page *page)
{
	return test_bit(PG_swapbacked, &page->flags);
}

// page_mapping() 返回文件页的 address_space，匿名页返回 NULL
// 内核大量使用此函数来区分文件页和匿名页的处理路径

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/vmscan.c#L1064
static unsigned long shrink_page_list(struct list_head *page_list, ......)
{
	......
	while (!list_empty(page_list)) {
		struct page *page;
		......
		page = lru_to_page(page_list);
		......

		// 匿名页回收：需要先写入 swap
		if (PageAnon(page) && !PageSwapCache(page)) {
			if (!(sc->gfp_mask & __GFP_IO))
				goto keep_locked;
			// 为匿名页分配 swap slot 并加入 swap cache
			if (!add_to_swap(page, page_list))
				goto activate_locked;
			......
		}

		// 通用路径：解除所有进程对该页的映射
		if (page_mapped(page) && mapping) {
			// try_to_unmap 使用反向映射遍历所有 PTE
			// 文件页：通过 address_space->i_mmap
			// 匿名页：通过 anon_vma->rb_root
			switch (try_to_unmap(page,
				ttu_flags|TTU_BATCH_FLUSH)) {
			......
			}
		}

		// 文件页回收：如果是脏页，需要先回写到磁盘文件
		if (PageDirty(page)) {
			......
			// 调用文件系统的 writepage 回写
			switch (pageout(page, mapping, sc)) {
			......
			}
		}
		......
	}
}

struct page *mem_map;  // 全局数组，指向所有struct page

// 系统启动时，内核计算需要多少内存来存储struct page
unsigned long nr_pages = total_physical_pages;
size_t page_struct_size = sizeof(struct page) * nr_pages;

// 为struct page数组分配内存（在内核初始化阶段通过bootmem/memblock分配）
// 注意：这个内存本身也是物理内存，也需要用struct page描述！
//https://elixir.bootlin.com/linux/v4.11.6/source/mm/page_alloc.c#L6094
// alloc_node_mem_map 在 free_area_init_node 中被调用，为每个NUMA节点分配 mem_map

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L1176
// 在page cache中查找指定偏移的页面，找到则增加引用计数
struct page *find_get_page(struct address_space *mapping, pgoff_t offset)
{
	struct page *page = pagecache_get_page(mapping, offset, 0, 0);
	return page;
}

// 查找并锁定页面，常用于需要修改页面内容的场景
struct page *find_lock_page(struct address_space *mapping, pgoff_t offset)
{
	return pagecache_get_page(mapping, offset, FGP_LOCK, 0);
}

// 查找或创建页面：如果不存在则分配新页面并加入page cache
struct page *find_or_create_page(struct address_space *mapping,
		pgoff_t index, gfp_t gfp_mask)
{
	return pagecache_get_page(mapping, index,
					FGP_LOCK|FGP_ACCESSED|FGP_CREAT,
					gfp_mask);
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L1280
struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
	int fgp_flags, gfp_t gfp_mask)
{
	struct page *page;

repeat:
	// 在 radix 树中查找
	// https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L1169
	page = find_get_entry(mapping, offset);
	......
	if (!page && (fgp_flags & FGP_CREAT)) {
		// 页面不存在且指定了创建标志，分配新页面
		page = __page_cache_alloc(gfp_mask);
		......
		// 加入 page cache（radix 树）和 LRU 链表
		err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
		......
	}
	return page;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L218
void delete_from_page_cache(struct page *page)
{
	struct address_space *mapping = page_mapping(page);
	......
	spin_lock_irqsave(&mapping->tree_lock, flags);
	// 从 radix 树中删除
	__delete_from_page_cache(page, NULL);
	spin_unlock_irqrestore(&mapping->tree_lock, flags);
	......
	// 释放页面引用
	put_page(page);
}

// 页面锁定：防止并发访问（如同时读写同一页面）
//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L831
void __lock_page(struct page *page)
{
	// 使用 wait queue 等待页面解锁
	DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
	__wait_on_bit_lock(page_waitqueue(page), &wait, bit_wait_io,
							TASK_UNINTERRUPTIBLE);
}

// 等待页面回写完成（常用于 fsync 路径）
//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L283
void wait_on_page_writeback(struct page *page)
{
	if (PageWriteback(page))
		wait_on_page_bit(page, PG_writeback);
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/fs.h#L855
struct file {
	......
	struct file_ra_state	f_ra;	// 预读状态
	......
};

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/fs.h#L1008
struct file_ra_state {
	pgoff_t start;			// 当前预读窗口的起始页偏移
	unsigned int size;		// 预读窗口总页数（同步+异步）
	unsigned int async_size;	// 异步预读部分的页数
	unsigned int ra_pages;		// 最大预读页数（通常为 /sys/block/xxx/queue/read_ahead_kb / 4）
	unsigned int mmap_miss;		// mmap 场景下的缺失计数
	loff_t prev_pos;		// 上一次读操作的文件位置（用于检测顺序性）
};

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/readahead.c#L505
// 同步预读：在page cache未命中时调用（页面不存在）
void page_cache_sync_readahead(struct address_space *mapping,
		struct file_ra_state *ra, struct file *filp,
		pgoff_t offset, unsigned long req_size)
{
	if (!ra->ra_pages)
		return;		// 预读被禁用

	// 检测到顺序访问模式时，触发预读
	ondemand_readahead(mapping, ra, filp, false, offset, req_size);
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/readahead.c#L522
// 异步预读：在读取到带有PG_readahead标记的页面时调用（页面存在但需要预取后续）
void page_cache_async_readahead(struct address_space *mapping,
		struct file_ra_state *ra, struct file *filp,
		struct page *page, pgoff_t offset,
		unsigned long req_size)
{
	if (!ra->ra_pages)
		return;

	// 检查页面是否设置了预读标记
	if (!PageReadahead(page))
		return;

	// 如果当前 BDI（块设备）拥堵，跳过预读
	if (inode_read_congested(mapping->host))
		return;

	// 清除预读标记并触发异步预读
	ClearPageReadahead(page);
	ondemand_readahead(mapping, ra, filp, true, offset, req_size);
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/readahead.c#L399
static unsigned long ondemand_readahead(struct address_space *mapping,
		   struct file_ra_state *ra, struct file *filp,
		   bool hit_readahead_marker, pgoff_t offset,
		   unsigned long req_size)
{
	unsigned long max = ra->ra_pages;	// 最大预读窗口
	pgoff_t prev_offset;

	// 情况1：起始读或上下文切换后的首次读
	if (!offset || !ra->size || offset >= ra->start + ra->size) {
		ra->start = offset;
		ra->size = get_init_ra_size(req_size, max);
		ra->async_size = ra->size > req_size ?
					ra->size - req_size : ra->size;
		goto readit;
	}

	// 情况2：顺序读，命中了异步预读标记并且hit_readahead_marker为true（page_cache_async_readahead函数）
	if (hit_readahead_marker && (offset == (ra->start + ra->size -
					ra->async_size))) {
		ra->start += ra->size;
		ra->size = get_next_ra_size(ra, max);	// 窗口翻倍增长
		ra->async_size = ra->size;
		goto readit;
	}

	// 情况3：检测到可能的顺序读（跳过检测等）
	......

readit:
	return ra_submit(ra, mapping, filp);	// 提交预读I/O
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L1855
static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
		struct iov_iter *iter, ssize_t written)
{
	struct address_space *mapping = filp->f_mapping;
	struct inode *inode = mapping->host;
	struct file_ra_state *ra = &filp->f_ra;
	pgoff_t index;		// 当前读取的页偏移
	pgoff_t last_index;	// 最后一页的偏移
	pgoff_t prev_index;
	......

	index = *ppos >> PAGE_SHIFT;	// 文件偏移转换为页偏移
	prev_index = ra->prev_pos >> PAGE_SHIFT;
	last_index = (*ppos + iter->count + PAGE_SIZE - 1) >> PAGE_SHIFT;

	for (;;) {
		struct page *page;
		pgoff_t end_index;
		......

find_page:
		// 步骤1：在 page cache 中查找
		page = find_get_page(mapping, index);
		if (!page) {
			// 步骤2：未命中，触发同步预读
			page_cache_sync_readahead(mapping, ra, filp,
					index, last_index - index);
			page = find_get_page(mapping, index);
			if (unlikely(!page))
				goto no_cached_page;
		}

		// 步骤3：如果该页设置了预读标记，触发异步预读
		if (PageReadahead(page)) {
			page_cache_async_readahead(mapping, ra, filp, page,
					index, last_index - index);
		}

		// 步骤4：确保页面数据是最新的
		if (!PageUptodate(page)) {
			......
			// 等待页面 I/O 完成
			error = wait_on_page_locked_killable(page);
			......
			if (!PageUptodate(page)) {
				// 数据未就绪，需要从磁盘读取
				goto page_not_up_to_date;
			}
		}

page_ok:
		// 步骤5：将数据从内核页面复制到用户空间缓冲区
		ret = copy_page_to_iter(page, offset, nr, iter);
		......
		index += offset >> PAGE_SHIFT;
		continue;

no_cached_page:
		// 预读后仍未命中，分配新页面
		page = page_cache_alloc_cold(mapping);
		......
		// 加入 page cache
		error = add_to_page_cache_lru(page, mapping, index,
				mapping_gfp_constraint(mapping, GFP_KERNEL));
		......
		goto readpage;

readpage:
		// 调用文件系统的 readpage 从磁盘读取数据
		error = mapping->a_ops->readpage(filp, page);
		......
		// 等待 I/O 完成
		if (!PageUptodate(page)) {
			error = lock_page_killable(page);
			......
		}
		goto page_ok;
	}
	......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/filemap.c#L2955
ssize_t generic_perform_write(struct file *file,
				struct iov_iter *i, loff_t pos)
{
	struct address_space *mapping = file->f_mapping;
	const struct address_space_operations *a_ops = mapping->a_ops;
	long status = 0;
	ssize_t written = 0;
	unsigned int flags = 0;

	do {
		struct page *page;
		unsigned long offset;	// 页内偏移
		unsigned long bytes;	// 本次写入的字节数
		......
		offset = (pos & (PAGE_SIZE - 1));
		bytes = min_t(unsigned long, PAGE_SIZE - offset,
						iov_iter_count(i));

again:
		// 步骤1：write_begin - 准备页面
		// 在 page cache 中查找或分配目标页面
		// 如果是部分页写入（非整页），还需要先从磁盘读入该页的现有数据
		status = a_ops->write_begin(file, mapping, pos, bytes,
						flags, &page, &fsdata);
		if (unlikely(status < 0))
			break;

		// 步骤2：将用户空间数据复制到内核页面
		// 使用原子方式复制，因为持有页面锁
		copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
		flush_dcache_page(page);

		// 步骤3：write_end - 完成写操作
		// 标记页面为脏（set_page_dirty），更新 inode 大小等元数据
		status = a_ops->write_end(file, mapping, pos, bytes,
						copied, page, fsdata);
		......

		// 步骤4：写入限流
		// 如果系统脏页过多，在这里等待，避免内存被脏页占满
		balance_dirty_pages_ratelimited(mapping);
		......
	} while (iov_iter_count(i));

	return written ? written : status;
}

//https://elixir.bootlin.com/linux/v4.11.6/source/fs/fs-writeback.c#L1843
void wb_workfn(struct work_struct *work)
{
	struct bdi_writeback *wb = container_of(to_delayed_work(work),
						struct bdi_writeback, dwork);
	long pages_written;

	......
	// 处理所有待回写的工作项
	if (likely(!current_is_workqueue_rescuer() ||
		   !test_bit(WB_registered, &wb->state))) {
		do {
			pages_written = wb_do_writeback(wb);
			......
		} while (!list_empty(&wb->work_list));
	} else {
		pages_written = wb_do_writeback(wb);
	}

	// 如果还有脏数据，重新调度回写工作
	if (!list_empty(&wb->work_list) ||
	    (wb_has_dirty_io(wb) && dirty_writeback_interval))
		wb_wakeup_delayed(wb);
	......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/page-writeback.c#L1541
static void balance_dirty_pages(struct address_space *mapping,
				struct bdi_writeback *wb,
				unsigned long pages_dirtied)
{
	......
	for (;;) {
		......
		// dirty_ratio 是硬限制：达到后进程必须等待
		if (dirty > thresh) {
			......
			// 计算需要暂停的时间
			pause = wb_dirty_limits(......);
			......
			// 通过 io_schedule_timeout 让出CPU，等待回写完成
			io_schedule_timeout(pause);
		}
		......
	}
}

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/mmzone.h#L185
enum lru_list {
	LRU_INACTIVE_ANON = LRU_BASE,			// 不活跃匿名页
	LRU_ACTIVE_ANON = LRU_BASE + LRU_ACTIVE,	// 活跃匿名页
	LRU_INACTIVE_FILE = LRU_FILE,			// 不活跃文件页
	LRU_ACTIVE_FILE = LRU_FILE + LRU_ACTIVE,	// 活跃文件页
	LRU_UNEVICTABLE,				// 不可回收页（如mlock锁定的页）
	NR_LRU_LISTS
};

//https://elixir.bootlin.com/linux/v4.11.6/source/include/linux/mmzone.h#L435
struct zone {
	......
	struct lruvec	lruvec;
	......
};

struct lruvec {
	struct list_head lists[NR_LRU_LISTS];	// 5 条 LRU 链表
	......
};

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/swap.c#L310
void mark_page_accessed(struct page *page)
{
	// 页面在 inactive 链表上被再次访问
	if (!PageActive(page) && !PageUnevictable(page) &&
			PageReferenced(page) && PageLRU(page)) {
		// 已有 referenced 标志，说明是第二次访问
		// 提升到 active 链表
		activate_page(page);
		ClearPageReferenced(page);
	} else if (!PageReferenced(page)) {
		// 首次访问：仅设置 referenced 标志
		SetPageReferenced(page);
	}
	......
}

//https://elixir.bootlin.com/linux/v4.11.6/source/mm/vmscan.c#L1970
static void shrink_active_list(unsigned long nr_to_scan,
			       struct lruvec *lruvec,
			       struct scan_control *sc,
			       enum lru_list lru)
{
	......
	while (!list_empty(&l_hold)) {
		......
		page = lru_to_page(&l_hold);
		......
		// 如果页面最近被访问过（referenced），保留在 active
		if (page_referenced(page, 0, sc->target_mem_cgroup,
				     &vm_flags)) {
			......
			// 被引用的页面仍保留在 active（发回 active 链表尾部）
			if (.....)
				list_add(&page->lru, &l_active);
			else
				list_add(&page->lru, &l_inactive);
		} else {
			// 未被引用，降级到 inactive
			ClearPageActive(page);
			list_add(&page->lru, &l_inactive);
		}
	}
	......
}