ADD file via upload

exec.c

@@ -0,0 +1,580 @@
+/*
+ *  linux/fs/exec.c
+ *
+ *  (C) 1991  Linus Torvalds
+ */
+
+/*
+ * #!-checking implemented by tytso.
+ */
+
+/*
+ * Demand-loading implemented 01.12.91 - no need to read anything but
+ * the header into memory. The inode of the executable is put into
+ * "current->executable", and page faults do the actual loading. Clean.
+ *
+ * Once more I can proudly say that linux stood up to being changed: it
+ * was less than 2 hours work to get demand-loading completely implemented.
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <a.out.h>
+
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <asm/segment.h>
+
+extern int sys_exit(int exit_code);
+extern int sys_close(int fd);
+
+/*
+ * MAX_ARG_PAGES defines the number of pages allocated for arguments
+ * and envelope for the new program. 32 should suffice, this gives
+ * a maximum env+arg of 128kB !
+ */
+#define MAX_ARG_PAGES 32
+
+int upload_p(unsigned long address);
+int sys_uselib()
+{
+	return -ENOSYS;
+}
+
+/*
+ * create_tables() parses the env- and arg-strings in new user
+ * memory and creates the pointer tables from them, and puts their
+ * addresses on the "stack", returning the new stack pointer value.
+ */
+static unsigned long * create_tables(char * p,int argc,int envc)
+{
+	unsigned long *argv,*envp;
+	unsigned long * sp;
+
+	sp = (unsigned long *) (0xfffffffc & (unsigned long) p);
+	sp -= envc+1;
+	envp = sp;
+	sp -= argc+1;
+	argv = sp;
+	put_fs_long((unsigned long)envp,--sp);
+	put_fs_long((unsigned long)argv,--sp);
+	put_fs_long((unsigned long)argc,--sp);
+	while (argc-->0) {
+		put_fs_long((unsigned long) p,argv++);
+		while (get_fs_byte(p++)) /* nothing */ ;
+	}
+	put_fs_long(0,argv);
+	while (envc-->0) {
+		put_fs_long((unsigned long) p,envp++);
+		while (get_fs_byte(p++)) /* nothing */ ;
+	}
+	put_fs_long(0,envp);
+	return sp;
+}
+
+/*
+ * count() counts the number of arguments/envelopes
+ */
+static int count(char ** argv)
+{
+	int i=0;
+	char ** tmp;
+
+	if (tmp = argv)
+		while (get_fs_long((unsigned long *) (tmp++)))
+			i++;
+
+	return i;
+}
+
+/*
+ * 'copy_string()' copies argument/envelope strings from user
+ * memory to free pages in kernel mem. These are in a format ready
+ * to be put directly into the top of new user memory.
+ *
+ * Modified by TYT, 11/24/91 to add the from_kmem argument, which specifies
+ * whether the string and the string array are from user or kernel segments:
+ * 
+ * from_kmem     argv *        argv **
+ *    0          user space    user space
+ *    1          kernel space  user space
+ *    2          kernel space  kernel space
+ * 
+ * We do this by playing games with the fs segment register.  Since it
+ * it is expensive to load a segment register, we try to avoid calling
+ * set_fs() unless we absolutely have to.
+ */
+static unsigned long copy_strings(int argc,char ** argv,unsigned long *page,
+		unsigned long p, int from_kmem)
+{
+	char *tmp, *pag;
+	int len, offset = 0;
+	unsigned long old_fs, new_fs;
+
+	if (!p)
+		return 0;	/* bullet-proofing */
+	new_fs = get_ds();
+	old_fs = get_fs();
+	if (from_kmem==2)
+		set_fs(new_fs);
+	while (argc-- > 0) {
+		if (from_kmem == 1)
+			set_fs(new_fs);
+		if (!(tmp = (char *)get_fs_long(((unsigned long *)argv)+argc)))
+			panic("argc is wrong");
+		if (from_kmem == 1)
+			set_fs(old_fs);
+		len=0;		/* remember zero-padding */
+		do {
+			len++;
+		} while (get_fs_byte(tmp++));
+		if (p-len < 0) {	/* this shouldn't happen - 128kB */
+			set_fs(old_fs);
+			return 0;
+		}
+		while (len) {
+			--p; --tmp; --len;
+			if (--offset < 0) {
+				offset = p % PAGE_SIZE;
+				if (from_kmem==2)
+					set_fs(old_fs);
+				if (!(pag = (char *) page[p/PAGE_SIZE]) &&
+				    !(pag = (char *) (page[p/PAGE_SIZE] =
+				      (unsigned long *) get_free_page()))) 
+					return 0;
+				if (from_kmem==2)
+					set_fs(new_fs);
+
+			}
+			*(pag + offset) = get_fs_byte(tmp);
+		}
+	}
+	if (from_kmem==2)
+		set_fs(old_fs);
+	return p;
+}
+
+static unsigned long change_ldt(unsigned long text_size,unsigned long * page)
+{
+	unsigned long code_limit,data_limit,code_base,data_base;
+	int i;
+
+	code_limit = text_size+PAGE_SIZE -1;
+	code_limit &= 0xFFFFF000;
+	data_limit = 0x4000000;
+	code_base = get_base(current->ldt[1]);
+	data_base = code_base;
+	set_base(current->ldt[1],code_base);
+	set_limit(current->ldt[1],code_limit);
+	set_base(current->ldt[2],data_base);
+	set_limit(current->ldt[2],data_limit);
+/* make sure fs points to the NEW data segment */
+	__asm__("pushl $0x17\n\tpop %%fs"::);
+	data_base += data_limit;
+	for (i=MAX_ARG_PAGES-1 ; i>=0 ; i--) {
+		data_base -= PAGE_SIZE;
+		if (page[i])
+			put_page(page[i],data_base);
+	}
+	return data_limit;
+}
+
+/*
+ * 'do_execve()' executes a new program.
+ */
+int do_execve(unsigned long * eip,long tmp,char * filename,
+	char ** argv, char ** envp)
+{
+	struct m_inode * inode;
+	struct buffer_head * bh;
+	struct exec ex;
+	unsigned long page[MAX_ARG_PAGES];
+	int i,argc,envc;
+	int e_uid, e_gid;
+	int retval;
+	int sh_bang = 0;
+	unsigned long p=PAGE_SIZE*MAX_ARG_PAGES-4;
+
+	if ((0xffff & eip[1]) != 0x000f)
+		panic("execve called from supervisor mode");
+	for (i=0 ; i<MAX_ARG_PAGES ; i++)	/* clear page-table */
+		page[i]=0;
+	if (!(inode=namei(filename)))		/* get executables inode */
+		return -ENOENT;
+	argc = count(argv);
+	envc = count(envp);
+	
+restart_interp:
+	if (!S_ISREG(inode->i_mode)) {	/* must be regular file */
+		retval = -EACCES;
+		goto exec_error2;
+	}
+	i = inode->i_mode;
+	e_uid = (i & S_ISUID) ? inode->i_uid : current->euid;
+	e_gid = (i & S_ISGID) ? inode->i_gid : current->egid;
+	if (current->euid == inode->i_uid)
+		i >>= 6;
+	else if (current->egid == inode->i_gid)
+		i >>= 3;
+	if (!(i & 1) &&
+	    !((inode->i_mode & 0111) && suser())) {
+		retval = -ENOEXEC;
+		goto exec_error2;
+	}
+	if (!(bh = bread(inode->i_dev,inode->i_zone[0]))) {
+		retval = -EACCES;
+		goto exec_error2;
+	}
+	ex = *((struct exec *) bh->b_data);	/* read exec-header */
+	if ((bh->b_data[0] == '#') && (bh->b_data[1] == '!') && (!sh_bang)) {
+		/*
+		 * This section does the #! interpretation.
+		 * Sorta complicated, but hopefully it will work.  -TYT
+		 */
+
+		char buf[1023], *cp, *interp, *i_name, *i_arg;
+		unsigned long old_fs;
+
+		strncpy(buf, bh->b_data+2, 1022);
+		brelse(bh);
+		iput(inode);
+		buf[1022] = '\0';
+		if (cp = strchr(buf, '\n')) {
+			*cp = '\0';
+			for (cp = buf; (*cp == ' ') || (*cp == '\t'); cp++);
+		}
+		if (!cp || *cp == '\0') {
+			retval = -ENOEXEC; /* No interpreter name found */
+			goto exec_error1;
+		}
+		interp = i_name = cp;
+		i_arg = 0;
+		for ( ; *cp && (*cp != ' ') && (*cp != '\t'); cp++) {
+ 			if (*cp == '/')
+				i_name = cp+1;
+		}
+		if (*cp) {
+			*cp++ = '\0';
+			i_arg = cp;
+		}
+		/*
+		 * OK, we've parsed out the interpreter name and
+		 * (optional) argument.
+		 */
+		if (sh_bang++ == 0) {
+			p = copy_strings(envc, envp, page, p, 0);
+			p = copy_strings(--argc, argv+1, page, p, 0);
+		}
+		/*
+		 * Splice in (1) the interpreter's name for argv[0]
+		 *           (2) (optional) argument to interpreter
+		 *           (3) filename of shell script
+		 *
+		 * This is done in reverse order, because of how the
+		 * user environment and arguments are stored.
+		 */
+		p = copy_strings(1, &filename, page, p, 1);
+		argc++;
+		if (i_arg) {
+			p = copy_strings(1, &i_arg, page, p, 2);
+			argc++;
+		}
+		p = copy_strings(1, &i_name, page, p, 2);
+		argc++;
+		if (!p) {
+			retval = -ENOMEM;
+			goto exec_error1;
+		}
+		/*
+		 * OK, now restart the process with the interpreter's inode.
+		 */
+		old_fs = get_fs();
+		set_fs(get_ds());
+		if (!(inode=namei(interp))) { /* get executables inode */
+			set_fs(old_fs);
+			retval = -ENOENT;
+			goto exec_error1;
+		}
+		set_fs(old_fs);
+		goto restart_interp;
+	}
+	brelse(bh);
+	if (N_MAGIC(ex) != ZMAGIC || ex.a_trsize || ex.a_drsize ||
+		ex.a_text+ex.a_data+ex.a_bss>0x3000000 ||
+		inode->i_size < ex.a_text+ex.a_data+ex.a_syms+N_TXTOFF(ex)) {
+		retval = -ENOEXEC;
+		goto exec_error2;
+	}
+	if (N_TXTOFF(ex) != BLOCK_SIZE) {
+		printk("%s: N_TXTOFF != BLOCK_SIZE. See a.out.h.", filename);
+		retval = -ENOEXEC;
+		goto exec_error2;
+	}
+	if (!sh_bang) {
+		p = copy_strings(envc,envp,page,p,0);
+		p = copy_strings(argc,argv,page,p,0);
+		if (!p) {
+			retval = -ENOMEM;
+			goto exec_error2;
+		}
+	}
+/* OK, This is the point of no return */
+	if (current->executable)
+		iput(current->executable);
+	current->executable = inode;
+	for (i=0 ; i<32 ; i++)
+		current->sigaction[i].sa_handler = NULL;
+	for (i=0 ; i<NR_OPEN ; i++)
+		if ((current->close_on_exec>>i)&1)
+			sys_close(i);
+	current->close_on_exec = 0;
+	free_page_tables(get_base(current->ldt[1]),get_limit(0x0f));
+	free_page_tables(get_base(current->ldt[2]),get_limit(0x17));
+	if (last_task_used_math == current)
+		last_task_used_math = NULL;
+	current->used_math = 0;
+	p += change_ldt(ex.a_text,page)-MAX_ARG_PAGES*PAGE_SIZE;
+	p = (unsigned long) create_tables((char *)p,argc,envc);
+	current->brk = ex.a_bss +
+		(current->end_data = ex.a_data +
+		(current->end_code = ex.a_text));
+	current->start_stack = p & 0xfffff000;
+	current->euid = e_uid;
+	current->egid = e_gid;
+	i = ex.a_text+ex.a_data;
+	while (i&0xfff)
+		put_fs_byte(0,(char *) (i++));
+	eip[0] = ex.a_entry;		/* eip, magic happens :-) */
+	eip[3] = p;			/* stack pointer */
+	return 0;
+exec_error2:
+	iput(inode);
+exec_error1:
+	for (i=0 ; i<MAX_ARG_PAGES ; i++)
+		free_page(page[i]);
+	return(retval);
+}
+
+/*
+ * 'do_execve2()' executes a new program.
+ * don't happens page_fault
+ * created by dt
+ * fixed by yjk 
+ */
+int do_execve2(unsigned long * eip,long tmp,char * filename, 
+	char ** argv, char ** envp)
+{
+	struct m_inode * inode; 
+	struct buffer_head * bh;
+	struct exec ex;
+	unsigned long page[MAX_ARG_PAGES];
+	int i,argc,envc;
+	int e_uid, e_gid; /* Uid 文件拥有者的User ID;Gid 文件的Group ID*/
+	int retval; /* 返回值 */
+	int sh_bang = 0; /* 执行#! */
+	unsigned long p=PAGE_SIZE*MAX_ARG_PAGES-4;
+	unsigned long address;
+	unsigned long end_adr;
+	int nr[4]; /* 记录逻辑块号 */
+
+	/*eip指向系统调用前的eip，eip[1]则指向cs，判断一下这时候的cs是不是用户的cs*/
+	if ((0xffff & eip[1]) != 0x000f) /* 不是用户cs */
+		panic("execve called from supervisor mode");
+	for (i=0 ; i<MAX_ARG_PAGES ; i++)	/* 清空页表 */
+		page[i]=0;
+	if (!(inode=namei(filename)))		/* 获取可执行的 inode */
+		return -ENOENT;
+	argc = count(argv); /*计算参数个数 */
+	envc = count(envp); /* 计算环境变量个数 */
+	
+restart_interp:
+	if (!S_ISREG(inode->i_mode)) {	/* 必须是常规文件 */
+		retval = -EACCES;
+		goto exec_error2;
+	}
+	i = inode->i_mode;
+
+	/* 设置了uid则执行的时候uid是设置的uid，否则是用户的有效id
+	 * Uid 文件拥有者的User ID;Gid 文件的Group ID
+	 * 相等说明该文件是该用户创建的，则判断user位的权限
+	 * gid同理uid的判断
+	 */
+	e_uid = (i & S_ISUID) ? inode->i_uid : current->euid;
+	e_gid = (i & S_ISGID) ? inode->i_gid : current->egid;
+	if (current->euid == inode->i_uid)
+		i >>= 6; /* 判断用户权限 */
+	else if (current->egid == inode->i_gid)
+		i >>= 3; /*判断组权限*/
+	/* else 判断其它权限 */
+
+	if (!(i & 1) &&
+	    !((inode->i_mode & 0111) && suser())) {
+		retval = -ENOEXEC;
+		goto exec_error2;
+	} /* 好吧,我不知道这是干啥的....*/
+
+	/* 第一次读数据进来,执行文件的头，包括一些元数据 */
+	if (!(bh = bread(inode->i_dev,inode->i_zone[0]))) {
+		retval = -EACCES;
+		goto exec_error2;
+	}
+	ex = *((struct exec *) bh->b_data);	/* 读exec-header */
+	if ((bh->b_data[0] == '#') && (bh->b_data[1] == '!') && (!sh_bang)) {
+		/* 脚本文件，不是编译后的文件,sh_bang控制只会进入一次
+		   这部分执行#!翻译.
+		*/
+		char buf[1023], *cp, *interp, *i_name, *i_arg;
+		unsigned long old_fs;
+		
+		strncpy(buf, bh->b_data+2, 1022);/* 把#!之外的字符复制到buf */
+		brelse(bh);
+		iput(inode);
+		buf[1022] = '\0';
+		/* 找出buf里第一次出现换行字符的地址，没有则返回NULL */
+		if (cp = strchr(buf, '\n')) {
+			*cp = '\0'; /* 更新换行字符为\0，表示字符串结束 */
+			for (cp = buf; (*cp == ' ') || (*cp == '\t'); cp++);
+			/* 把以空格或\t分开的字符分别取出来 */
+		}
+		if (!cp || *cp == '\0') {
+			retval = -ENOEXEC; /* 未找到翻译 */
+			goto exec_error1;
+		}
+		/* 开始寻找解释器名字 
+		interp指向解释器路径的第一个字符，i_name指向解释器名称 */
+		interp = i_name = cp;
+		i_arg = 0;
+		for ( ; *cp && (*cp != ' ') && (*cp != '\t'); cp++) {
+ 			if (*cp == '/')
+				i_name = cp+1;
+		}
+		/* 遇到空格或制表符结束的，则修改他的值为0 */
+		if (*cp) {
+			*cp++ = '\0';
+			i_arg = cp; /* i_arg指向解释器名称的字符，即参数列表 */
+		}
+		/*
+		 * OK, we've parsed out the interpreter name and
+		 * (optional) argument.
+		 * 我们已经分开了解释器名字和(可选)变量
+		 */
+		if (sh_bang++ == 0) { /* sh_bang的初始值为0，+1*/
+			p = copy_strings(envc, envp, page, p, 0); 
+			p = copy_strings(--argc, argv+1, page, p, 0);
+		}
+		/*
+		 * Splice in (1) the interpreter's name for argv[0]
+		 *           (2) (optional) argument to interpreter
+		 *           (3) filename of shell script
+		 *
+		 * This is done in reverse order, because of how the
+		 * user environment and arguments are stored.
+		 */
+		/* 脚本的名字 */
+		p = copy_strings(1, &filename, page, p, 1);
+		argc++;
+		/* 解释器的参数列表 */
+		if (i_arg) {
+			p = copy_strings(1, &i_arg, page, p, 2);
+			argc++;
+		}
+		/* 解释器名字 */
+		p = copy_strings(1, &i_name, page, p, 2);
+		argc++;
+		if (!p) {
+			retval = -ENOMEM;
+			goto exec_error1;
+		}
+		/*
+		 * OK, now restart the process with the interpreter's inode.
+		 */
+		old_fs = get_fs();
+		set_fs(get_ds());
+		if (!(inode=namei(interp))) { /* get executables inode */
+			set_fs(old_fs);
+			retval = -ENOENT;
+			goto exec_error1;
+		}
+		set_fs(old_fs);
+		/* 复制完，加载解释器的可执行文件 */
+		goto restart_interp;
+	}
+	brelse(bh);
+	if (N_MAGIC(ex) != ZMAGIC || ex.a_trsize || ex.a_drsize ||
+		ex.a_text+ex.a_data+ex.a_bss>0x3000000 ||
+		inode->i_size < ex.a_text+ex.a_data+ex.a_syms+N_TXTOFF(ex)) {
+		retval = -ENOEXEC;
+		goto exec_error2;
+	}
+	/* 不是脚本文件 */
+	if (N_TXTOFF(ex) != BLOCK_SIZE) {
+		printk("%s: N_TXTOFF != BLOCK_SIZE. See a.out.h.", filename);
+		retval = -ENOEXEC;
+		goto exec_error2;
+	}
+	if (!sh_bang) {
+		p = copy_strings(envc,envp,page,p,0);
+		p = copy_strings(argc,argv,page,p,0);
+		if (!p) { /* 数据太多，超过限制 */
+			retval = -ENOMEM;
+			goto exec_error2;
+		}
+	}
+/* OK, This is the point of no return */
+	/* 替换该字段的值 */
+	if (current->executable)
+		iput(current->executable);
+	current->executable = inode;
+	for (i=0 ; i<32 ; i++) /* 清除信号处理函数 */
+		current->sigaction[i].sa_handler = NULL;
+	for (i=0 ; i<NR_OPEN ; i++) /* 设置了close_on_exec的则关闭对应的文件 */
+		if ((current->close_on_exec>>i)&1)
+			sys_close(i);
+	/* 清零 */
+	current->close_on_exec = 0;
+	/* 释放代码段和数据段的页表以及物理页 */
+	free_page_tables(get_base(current->ldt[1]),get_limit(0x0f));
+	free_page_tables(get_base(current->ldt[2]),get_limit(0x17));
+	if (last_task_used_math == current)
+		last_task_used_math = NULL;
+	current->used_math = 0;
+	/* hange_ldt返回数据段的最大长度，减去MAX_ARG_PAGES*PAGE_SIZE，
+		得到page的线性地址，加p得到p的线性地址，p是page里的偏移 */
+	p += change_ldt(ex.a_text,page)-MAX_ARG_PAGES*PAGE_SIZE;
+	/* 复制参数和环境变量到新的地址，栈往大地址增长，p的值变大 */
+	p = (unsigned long) create_tables((char *)p,argc,envc);
+	/* 代码、数据、bss段上面是堆指针 */
+	current->brk = ex.a_bss +
+		(current->end_data = ex.a_data +
+		(current->end_code = ex.a_text));
+		/*p按4kb对齐成为栈指针，栈里面现在是环境变量列表和参数列表*/
+	current->start_stack = p & 0xfffff000;
+	/* 进程的权限，setuid的时候，权限等于可执行文件拥有者的 */
+	current->euid = e_uid;
+	current->egid = e_gid;
+	i = ex.a_text+ex.a_data;
+	/* 如果代码段和数据段的长度不是4kb的倍数（即长度的低12位有值），则把没值的部分填充0*/
+	/*by dt original*/
+	end_adr=current->start_code+current->end_data;
+	for(address=current->start_code;address<=end_adr;address+=4096)
+		upload_p(address);
+	/* by dt original*/
+
+	while (i&0xfff)
+		put_fs_byte(0,(char *) (i++));
+	/* 设置eip的值，返回后从这开始执行 */
+	eip[0] = ex.a_entry;		/* eip, magic happens :-) */
+	/*  p成为栈指针即esp */
+	eip[3] = p;			/* stack pointer */
+	return 0;
+exec_error2:
+	iput(inode);
+exec_error1:
+	for (i=0 ; i<MAX_ARG_PAGES ; i++)
+		free_page(page[i]);
+	return(retval);
+}
+

memory.c

@@ -0,0 +1,487 @@
+/*
+ *  linux/mm/memory.c
+ *
+ *  (C) 1991  Linus Torvalds
+ */
+
+/*
+ * demand-loading started 01.12.91 - seems it is high on the list of
+ * things wanted, and it should be easy to implement. - Linus
+ */
+
+/*
+ * Ok, demand-loading was easy, shared pages a little bit tricker. Shared
+ * pages started 02.12.91, seems to work. - Linus.
+ *
+ * Tested sharing by executing about 30 /bin/sh: under the old kernel it
+ * would have taken more than the 6M I have free, but it worked well as
+ * far as I could see.
+ *
+ * Also corrected some "invalidate()"s - I wasn't doing enough of them.
+ */
+
+#include <signal.h>
+
+#include <asm/system.h>
+
+#include <linux/sched.h>
+#include <linux/head.h>
+#include <linux/kernel.h>
+
+volatile void do_exit(long code);
+
+static inline volatile void oom(void)
+{
+	printk("out of memory\n\r");
+	do_exit(SIGSEGV);
+}
+
+#define invalidate() \
+__asm__("movl %%eax,%%cr3"::"a" (0))
+
+/* these are not to be changed without changing head.s etc */
+#define LOW_MEM 0x100000
+#define PAGING_MEMORY (15*1024*1024)
+#define PAGING_PAGES (PAGING_MEMORY>>12)
+#define MAP_NR(addr) (((addr)-LOW_MEM)>>12)
+#define USED 100
+
+#define CODE_SPACE(addr) ((((addr)+4095)&~4095) < \
+current->start_code + current->end_code)
+
+static long HIGH_MEMORY = 0;
+
+#define copy_page(from,to) \
+__asm__("cld ; rep ; movsl"::"S" (from),"D" (to),"c" (1024))
+
+static unsigned char mem_map [ PAGING_PAGES ] = {0,};
+
+/*
+ * Get physical address of first (actually last :-) free page, and mark it
+ * used. If no free pages left, return 0.
+ */
+unsigned long get_free_page(void)
+{
+register unsigned long __res asm("ax");
+
+__asm__("std ; repne ; scasb\n\t"
+	"jne 1f\n\t"
+	"movb $1,1(%%edi)\n\t"
+	"sall $12,%%ecx\n\t"
+	"addl %2,%%ecx\n\t"
+	"movl %%ecx,%%edx\n\t"
+	"movl $1024,%%ecx\n\t"
+	"leal 4092(%%edx),%%edi\n\t"
+	"rep ; stosl\n\t"
+	"movl %%edx,%%eax\n\t"
+	"1:"
+	"cld\n\t"       /* by wyj */
+	:"=a" (__res)
+	:"0" (0),"i" (LOW_MEM),"c" (PAGING_PAGES),
+	"D" (mem_map+PAGING_PAGES-1)
+	);
+return __res;
+}
+
+/*
+ * Free a page of memory at physical address 'addr'. Used by
+ * 'free_page_tables()'
+ */
+void free_page(unsigned long addr)
+{
+	if (addr < LOW_MEM) return;
+	if (addr >= HIGH_MEMORY)
+		panic("trying to free nonexistent page");
+	addr -= LOW_MEM;
+	addr >>= 12;
+	if (mem_map[addr]--) return;
+	mem_map[addr]=0;
+	panic("trying to free free page");
+}
+
+/*
+ * This function frees a continuos block of page tables, as needed
+ * by 'exit()'. As does copy_page_tables(), this handles only 4Mb blocks.
+ */
+int free_page_tables(unsigned long from,unsigned long size)
+{
+	unsigned long *pg_table;
+	unsigned long * dir, nr;
+
+	if (from & 0x3fffff)
+		panic("free_page_tables called with wrong alignment");
+	if (!from)
+		panic("Trying to free up swapper memory space");
+	size = (size + 0x3fffff) >> 22;
+	dir = (unsigned long *) ((from>>20) & 0xffc); /* _pg_dir = 0 */
+	for ( ; size-->0 ; dir++) {
+		if (!(1 & *dir))
+			continue;
+		pg_table = (unsigned long *) (0xfffff000 & *dir);
+		for (nr=0 ; nr<1024 ; nr++) {
+			if (1 & *pg_table)
+				free_page(0xfffff000 & *pg_table);
+			*pg_table = 0;
+			pg_table++;
+		}
+		free_page(0xfffff000 & *dir);
+		*dir = 0;
+	}
+	invalidate();
+	return 0;
+}
+
+/*
+ *  Well, here is one of the most complicated functions in mm. It
+ * copies a range of linerar addresses by copying only the pages.
+ * Let's hope this is bug-free, 'cause this one I don't want to debug :-)
+ *
+ * Note! We don't copy just any chunks of memory - addresses have to
+ * be divisible by 4Mb (one page-directory entry), as this makes the
+ * function easier. It's used only by fork anyway.
+ *
+ * NOTE 2!! When from==0 we are copying kernel space for the first
+ * fork(). Then we DONT want to copy a full page-directory entry, as
+ * that would lead to some serious memory waste - we just copy the
+ * first 160 pages - 640kB. Even that is more than we need, but it
+ * doesn't take any more memory - we don't copy-on-write in the low
+ * 1 Mb-range, so the pages can be shared with the kernel. Thus the
+ * special case for nr=xxxx.
+ */
+int copy_page_tables(unsigned long from,unsigned long to,long size)
+{
+	unsigned long * from_page_table;
+	unsigned long * to_page_table;
+	unsigned long this_page;
+	unsigned long * from_dir, * to_dir;
+	unsigned long nr;
+
+	if ((from&0x3fffff) || (to&0x3fffff))
+		panic("copy_page_tables called with wrong alignment");
+	from_dir = (unsigned long *) ((from>>20) & 0xffc); /* _pg_dir = 0 */
+	to_dir = (unsigned long *) ((to>>20) & 0xffc);
+	size = ((unsigned) (size+0x3fffff)) >> 22;
+	for( ; size-->0 ; from_dir++,to_dir++) {
+		if (1 & *to_dir)
+			panic("copy_page_tables: already exist");
+		if (!(1 & *from_dir))
+			continue;
+		from_page_table = (unsigned long *) (0xfffff000 & *from_dir);
+		if (!(to_page_table = (unsigned long *) get_free_page()))
+			return -1;	/* Out of memory, see freeing */
+		*to_dir = ((unsigned long) to_page_table) | 7;
+		nr = (from==0)?0xA0:1024;
+		for ( ; nr-- > 0 ; from_page_table++,to_page_table++) {
+			this_page = *from_page_table;
+			if (!(1 & this_page))
+				continue;
+			this_page &= ~2;
+			*to_page_table = this_page;
+			if (this_page > LOW_MEM) {
+				*from_page_table = this_page;
+				this_page -= LOW_MEM;
+				this_page >>= 12;
+				mem_map[this_page]++;
+			}
+		}
+	}
+	invalidate();
+	return 0;
+}
+
+/*
+ * This function puts a page in memory at the wanted address.
+ * It returns the physical address of the page gotten, 0 if
+ * out of memory (either when trying to access page-table or
+ * page.)
+ */
+unsigned long put_page(unsigned long page,unsigned long address)
+{
+	unsigned long tmp, *page_table;
+
+/* NOTE !!! This uses the fact that _pg_dir=0 */
+
+	if (page < LOW_MEM || page >= HIGH_MEMORY)
+		printk("Trying to put page %p at %p\n",page,address);
+	if (mem_map[(page-LOW_MEM)>>12] != 1)
+		printk("mem_map disagrees with %p at %p\n",page,address);
+	page_table = (unsigned long *) ((address>>20) & 0xffc);
+	if ((*page_table)&1)
+		page_table = (unsigned long *) (0xfffff000 & *page_table);
+	else {
+		if (!(tmp=get_free_page()))
+			return 0;
+		*page_table = tmp|7;
+		page_table = (unsigned long *) tmp;
+	}
+	page_table[(address>>12) & 0x3ff] = page | 7;
+/* no need for invalidate */
+	return page;
+}
+
+void un_wp_page(unsigned long * table_entry)
+{
+	unsigned long old_page,new_page;
+
+	old_page = 0xfffff000 & *table_entry;
+	if (old_page >= LOW_MEM && mem_map[MAP_NR(old_page)]==1) {
+		*table_entry |= 2;
+		invalidate();
+		return;
+	}
+	if (!(new_page=get_free_page()))
+		oom();
+	if (old_page >= LOW_MEM)
+		mem_map[MAP_NR(old_page)]--;
+	*table_entry = new_page | 7;
+	invalidate();
+	copy_page(old_page,new_page);
+}	
+
+/*
+ * This routine handles present pages, when users try to write
+ * to a shared page. It is done by copying the page to a new address
+ * and decrementing the shared-page counter for the old page.
+ *
+ * If it's in code space we exit with a segment error.
+ */
+void do_wp_page(unsigned long error_code,unsigned long address)
+{
+#if 0
+/* we cannot do this yet: the estdio library writes to code space */
+/* stupid, stupid. I really want the libc.a from GNU */
+	if (CODE_SPACE(address))
+		do_exit(SIGSEGV);
+#endif
+	un_wp_page((unsigned long *)
+		(((address>>10) & 0xffc) + (0xfffff000 &
+		*((unsigned long *) ((address>>20) &0xffc)))));
+
+}
+
+void write_verify(unsigned long address)
+{
+	unsigned long page;
+
+	if (!( (page = *((unsigned long *) ((address>>20) & 0xffc)) )&1))
+		return;
+	page &= 0xfffff000;
+	page += ((address>>10) & 0xffc);
+	if ((3 & *(unsigned long *) page) == 1)  /* non-writeable, present */
+		un_wp_page((unsigned long *) page);
+	return;
+}
+
+void get_empty_page(unsigned long address)
+{
+	unsigned long tmp;
+
+	if (!(tmp=get_free_page()) || !put_page(tmp,address)) {
+		free_page(tmp);		/* 0 is ok - ignored */
+		oom();
+	}
+}
+
+/*
+ * try_to_share() checks the page at address "address" in the task "p",
+ * to see if it exists, and if it is clean. If so, share it with the current
+ * task.
+ *
+ * NOTE! This assumes we have checked that p != current, and that they
+ * share the same executable.
+ */
+static int try_to_share(unsigned long address, struct task_struct * p)
+{
+	unsigned long from;
+	unsigned long to;
+	unsigned long from_page;
+	unsigned long to_page;
+	unsigned long phys_addr;
+
+	from_page = to_page = ((address>>20) & 0xffc);
+	from_page += ((p->start_code>>20) & 0xffc);
+	to_page += ((current->start_code>>20) & 0xffc);
+/* is there a page-directory at from? */
+	from = *(unsigned long *) from_page;
+	if (!(from & 1))
+		return 0;
+	from &= 0xfffff000;
+	from_page = from + ((address>>10) & 0xffc);
+	phys_addr = *(unsigned long *) from_page;
+/* is the page clean and present? */
+	if ((phys_addr & 0x41) != 0x01)
+		return 0;
+	phys_addr &= 0xfffff000;
+	if (phys_addr >= HIGH_MEMORY || phys_addr < LOW_MEM)
+		return 0;
+	to = *(unsigned long *) to_page;
+	if (!(to & 1))
+		if (to = get_free_page())
+			*(unsigned long *) to_page = to | 7;
+		else
+			oom();
+	to &= 0xfffff000;
+	to_page = to + ((address>>10) & 0xffc);
+	if (1 & *(unsigned long *) to_page)
+		panic("try_to_share: to_page already exists");
+/* share them: write-protect */
+	*(unsigned long *) from_page &= ~2;
+	*(unsigned long *) to_page = *(unsigned long *) from_page;
+	invalidate();
+	phys_addr -= LOW_MEM;
+	phys_addr >>= 12;
+	mem_map[phys_addr]++;
+	return 1;
+}
+
+/*
+ * share_page() tries to find a process that could share a page with
+ * the current one. Address is the address of the wanted page relative
+ * to the current data space.
+ *
+ * We first check if it is at all feasible by checking executable->i_count.
+ * It should be >1 if there are other tasks sharing this inode.
+ */
+static int share_page(unsigned long address)
+{
+	struct task_struct ** p;
+
+	if (!current->executable)
+		return 0;
+	if (current->executable->i_count < 2)
+		return 0;
+	for (p = &LAST_TASK ; p > &FIRST_TASK ; --p) {
+		if (!*p)
+			continue;
+		if (current == *p)
+			continue;
+		if ((*p)->executable != current->executable)
+			continue;
+		if (try_to_share(address,*p))
+			return 1;
+	}
+	return 0;
+}
+
+void do_no_page(unsigned long error_code,unsigned long address)
+{
+	int nr[4];
+	unsigned long tmp;
+	unsigned long page;
+	int block,i;
+
+	if (current->pid > 5)
+		printk(" --do_no_page: address=%x, pid=%d\n", address, current->pid);
+	address &= 0xfffff000;
+	tmp = address - current->start_code;
+	if (!current->executable || tmp >= current->end_data) {
+		get_empty_page(address);
+		return;
+	}
+	if (share_page(tmp))
+		return;
+	if (!(page = get_free_page()))
+		oom();
+/* remember that 1 block is used for header */
+	block = 1 + tmp/BLOCK_SIZE;
+	for (i=0 ; i<4 ; block++,i++)
+		nr[i] = bmap(current->executable,block);
+	bread_page(page,current->executable->i_dev,nr);
+	i = tmp + 4096 - current->end_data;
+	tmp = page + 4096;
+	while (i-- > 0) {
+		tmp--;
+		*(char *)tmp = 0;
+	}
+	if (put_page(page,address))
+		return;
+	free_page(page);
+	oom();
+}
+
+void mem_init(long start_mem, long end_mem)
+{
+	int i;
+
+	HIGH_MEMORY = end_mem;
+	for (i=0 ; i<PAGING_PAGES ; i++)
+		mem_map[i] = USED;
+	i = MAP_NR(start_mem);
+	end_mem -= start_mem;
+	end_mem >>= 12;
+	while (end_mem-->0)
+		mem_map[i++]=0;
+}
+
+void calc_mem(void)
+{
+	int i,j,k,free=0;
+	long * pg_tbl;
+
+	for(i=0 ; i<PAGING_PAGES ; i++)
+		if (!mem_map[i]) free++;
+	printk("%d pages free (of %d)\n\r",free,PAGING_PAGES);
+	for(i=2 ; i<1024 ; i++) {
+		if (1&pg_dir[i]) {
+			pg_tbl=(long *) (0xfffff000 & pg_dir[i]);
+			for(j=k=0 ; j<1024 ; j++)
+				if (pg_tbl[j]&1)
+					k++;
+			printk("Pg-dir[%d] uses %d pages\n",i,k);
+		}
+	}
+}
+int upload_p(unsigned long address) /*created by dt, fixed by yjk*/ 
+{
+	int nr[4];  /* 记录逻辑块号 */
+	unsigned long tmp; /*线性地址在进程空间中相对于进程基址的偏移长度值。*/
+	unsigned long page;
+	int block,i;
+
+	address &= 0xfffff000; /*页面地址*/
+	tmp = address - current->start_code; /*首先算出指定线性地址在进程空间中相对于进程基址的偏移长度值.
+	
+	/* 若当前进程的executable 空，或者指定地址超出代码+数据长度，则申请一页物理内存，并映射
+	 * 影射到指定的线性地址处。executable 是进程的i 节点结构。该值为0，表明进程刚开始设置，
+	 * 需要内存；而指定的线性地址超出代码加数据长度，表明进程在申请新的内存空间，也需要给予。
+	 * 因此就直接调用get_empty_page()函数，申请一页物理内存并映射到指定线性地址处即可。
+	 */
+	
+	if (!current->executable || tmp >= current->end_data) {
+		get_empty_page(address);
+		return 0;
+	}
+
+	/* 
+	如果尝试共享页面成功,则退出
+	 */
+	if (share_page(tmp))
+		return 0;
+	/*取空闲页面，如果内存不够了，则显示内存不够，终止进程。*/
+	if (!(page = get_free_page()))
+		return -1;
+	
+	/* 记住程序头需要使用1个数据块*/
+	block = 1 + tmp/BLOCK_SIZE; /*block用来存储有几个数据块的*/
+	for (i=0 ; i<4 ; block++,i++) /*根据i节点信息，取数据块在设备上的对应的逻辑块号。*/
+		nr[i] = bmap(current->executable,block);
+	/*bmap:实现文件数据块号到设备中的逻辑块号的映射，
+		函数注册一个新逻辑快，并返回这个新逻辑块的块号*/
+
+	/* 读设备上一个页面的数据(4 个逻辑块)到指定物理地址page 处 */
+	bread_page(page,current->executable->i_dev,nr);
+
+	/*在增加了一页内存后，该页内存的部分可能会超过进程的end_data 位置
+	 *下面的循环即是对物理页面超出的部分进行清零处理。
+	 */
+	i = tmp + 4096 - current->end_data;
+	tmp = page + 4096;
+	while (i-- > 0) {
+		tmp--;
+		*(char *)tmp = 0;
+	}
+	if (put_page(page,address)) /*如果把物理页面映射到指定线性地址的操作成功，就返回*/
+		return 0;
+	free_page(page);/*否则就释放内存页，显示内存不够。*/
+	return -1;
+}

sched.c

@@ -0,0 +1,487 @@
+/*
+ *  linux/mm/memory.c
+ *
+ *  (C) 1991  Linus Torvalds
+ */
+
+/*
+ * demand-loading started 01.12.91 - seems it is high on the list of
+ * things wanted, and it should be easy to implement. - Linus
+ */
+
+/*
+ * Ok, demand-loading was easy, shared pages a little bit tricker. Shared
+ * pages started 02.12.91, seems to work. - Linus.
+ *
+ * Tested sharing by executing about 30 /bin/sh: under the old kernel it
+ * would have taken more than the 6M I have free, but it worked well as
+ * far as I could see.
+ *
+ * Also corrected some "invalidate()"s - I wasn't doing enough of them.
+ */
+
+#include <signal.h>
+
+#include <asm/system.h>
+
+#include <linux/sched.h>
+#include <linux/head.h>
+#include <linux/kernel.h>
+
+volatile void do_exit(long code);
+
+static inline volatile void oom(void)
+{
+	printk("out of memory\n\r");
+	do_exit(SIGSEGV);
+}
+
+#define invalidate() \
+__asm__("movl %%eax,%%cr3"::"a" (0))
+
+/* these are not to be changed without changing head.s etc */
+#define LOW_MEM 0x100000
+#define PAGING_MEMORY (15*1024*1024)
+#define PAGING_PAGES (PAGING_MEMORY>>12)
+#define MAP_NR(addr) (((addr)-LOW_MEM)>>12)
+#define USED 100
+
+#define CODE_SPACE(addr) ((((addr)+4095)&~4095) < \
+current->start_code + current->end_code)
+
+static long HIGH_MEMORY = 0;
+
+#define copy_page(from,to) \
+__asm__("cld ; rep ; movsl"::"S" (from),"D" (to),"c" (1024))
+
+static unsigned char mem_map [ PAGING_PAGES ] = {0,};
+
+/*
+ * Get physical address of first (actually last :-) free page, and mark it
+ * used. If no free pages left, return 0.
+ */
+unsigned long get_free_page(void)
+{
+register unsigned long __res asm("ax");
+
+__asm__("std ; repne ; scasb\n\t"
+	"jne 1f\n\t"
+	"movb $1,1(%%edi)\n\t"
+	"sall $12,%%ecx\n\t"
+	"addl %2,%%ecx\n\t"
+	"movl %%ecx,%%edx\n\t"
+	"movl $1024,%%ecx\n\t"
+	"leal 4092(%%edx),%%edi\n\t"
+	"rep ; stosl\n\t"
+	"movl %%edx,%%eax\n\t"
+	"1:"
+	"cld\n\t"       /* by wyj */
+	:"=a" (__res)
+	:"0" (0),"i" (LOW_MEM),"c" (PAGING_PAGES),
+	"D" (mem_map+PAGING_PAGES-1)
+	);
+return __res;
+}
+
+/*
+ * Free a page of memory at physical address 'addr'. Used by
+ * 'free_page_tables()'
+ */
+void free_page(unsigned long addr)
+{
+	if (addr < LOW_MEM) return;
+	if (addr >= HIGH_MEMORY)
+		panic("trying to free nonexistent page");
+	addr -= LOW_MEM;
+	addr >>= 12;
+	if (mem_map[addr]--) return;
+	mem_map[addr]=0;
+	panic("trying to free free page");
+}
+
+/*
+ * This function frees a continuos block of page tables, as needed
+ * by 'exit()'. As does copy_page_tables(), this handles only 4Mb blocks.
+ */
+int free_page_tables(unsigned long from,unsigned long size)
+{
+	unsigned long *pg_table;
+	unsigned long * dir, nr;
+
+	if (from & 0x3fffff)
+		panic("free_page_tables called with wrong alignment");
+	if (!from)
+		panic("Trying to free up swapper memory space");
+	size = (size + 0x3fffff) >> 22;
+	dir = (unsigned long *) ((from>>20) & 0xffc); /* _pg_dir = 0 */
+	for ( ; size-->0 ; dir++) {
+		if (!(1 & *dir))
+			continue;
+		pg_table = (unsigned long *) (0xfffff000 & *dir);
+		for (nr=0 ; nr<1024 ; nr++) {
+			if (1 & *pg_table)
+				free_page(0xfffff000 & *pg_table);
+			*pg_table = 0;
+			pg_table++;
+		}
+		free_page(0xfffff000 & *dir);
+		*dir = 0;
+	}
+	invalidate();
+	return 0;
+}
+
+/*
+ *  Well, here is one of the most complicated functions in mm. It
+ * copies a range of linerar addresses by copying only the pages.
+ * Let's hope this is bug-free, 'cause this one I don't want to debug :-)
+ *
+ * Note! We don't copy just any chunks of memory - addresses have to
+ * be divisible by 4Mb (one page-directory entry), as this makes the
+ * function easier. It's used only by fork anyway.
+ *
+ * NOTE 2!! When from==0 we are copying kernel space for the first
+ * fork(). Then we DONT want to copy a full page-directory entry, as
+ * that would lead to some serious memory waste - we just copy the
+ * first 160 pages - 640kB. Even that is more than we need, but it
+ * doesn't take any more memory - we don't copy-on-write in the low
+ * 1 Mb-range, so the pages can be shared with the kernel. Thus the
+ * special case for nr=xxxx.
+ */
+int copy_page_tables(unsigned long from,unsigned long to,long size)
+{
+	unsigned long * from_page_table;
+	unsigned long * to_page_table;
+	unsigned long this_page;
+	unsigned long * from_dir, * to_dir;
+	unsigned long nr;
+
+	if ((from&0x3fffff) || (to&0x3fffff))
+		panic("copy_page_tables called with wrong alignment");
+	from_dir = (unsigned long *) ((from>>20) & 0xffc); /* _pg_dir = 0 */
+	to_dir = (unsigned long *) ((to>>20) & 0xffc);
+	size = ((unsigned) (size+0x3fffff)) >> 22;
+	for( ; size-->0 ; from_dir++,to_dir++) {
+		if (1 & *to_dir)
+			panic("copy_page_tables: already exist");
+		if (!(1 & *from_dir))
+			continue;
+		from_page_table = (unsigned long *) (0xfffff000 & *from_dir);
+		if (!(to_page_table = (unsigned long *) get_free_page()))
+			return -1;	/* Out of memory, see freeing */
+		*to_dir = ((unsigned long) to_page_table) | 7;
+		nr = (from==0)?0xA0:1024;
+		for ( ; nr-- > 0 ; from_page_table++,to_page_table++) {
+			this_page = *from_page_table;
+			if (!(1 & this_page))
+				continue;
+			this_page &= ~2;
+			*to_page_table = this_page;
+			if (this_page > LOW_MEM) {
+				*from_page_table = this_page;
+				this_page -= LOW_MEM;
+				this_page >>= 12;
+				mem_map[this_page]++;
+			}
+		}
+	}
+	invalidate();
+	return 0;
+}
+
+/*
+ * This function puts a page in memory at the wanted address.
+ * It returns the physical address of the page gotten, 0 if
+ * out of memory (either when trying to access page-table or
+ * page.)
+ */
+unsigned long put_page(unsigned long page,unsigned long address)
+{
+	unsigned long tmp, *page_table;
+
+/* NOTE !!! This uses the fact that _pg_dir=0 */
+
+	if (page < LOW_MEM || page >= HIGH_MEMORY)
+		printk("Trying to put page %p at %p\n",page,address);
+	if (mem_map[(page-LOW_MEM)>>12] != 1)
+		printk("mem_map disagrees with %p at %p\n",page,address);
+	page_table = (unsigned long *) ((address>>20) & 0xffc);
+	if ((*page_table)&1)
+		page_table = (unsigned long *) (0xfffff000 & *page_table);
+	else {
+		if (!(tmp=get_free_page()))
+			return 0;
+		*page_table = tmp|7;
+		page_table = (unsigned long *) tmp;
+	}
+	page_table[(address>>12) & 0x3ff] = page | 7;
+/* no need for invalidate */
+	return page;
+}
+
+void un_wp_page(unsigned long * table_entry)
+{
+	unsigned long old_page,new_page;
+
+	old_page = 0xfffff000 & *table_entry;
+	if (old_page >= LOW_MEM && mem_map[MAP_NR(old_page)]==1) {
+		*table_entry |= 2;
+		invalidate();
+		return;
+	}
+	if (!(new_page=get_free_page()))
+		oom();
+	if (old_page >= LOW_MEM)
+		mem_map[MAP_NR(old_page)]--;
+	*table_entry = new_page | 7;
+	invalidate();
+	copy_page(old_page,new_page);
+}	
+
+/*
+ * This routine handles present pages, when users try to write
+ * to a shared page. It is done by copying the page to a new address
+ * and decrementing the shared-page counter for the old page.
+ *
+ * If it's in code space we exit with a segment error.
+ */
+void do_wp_page(unsigned long error_code,unsigned long address)
+{
+#if 0
+/* we cannot do this yet: the estdio library writes to code space */
+/* stupid, stupid. I really want the libc.a from GNU */
+	if (CODE_SPACE(address))
+		do_exit(SIGSEGV);
+#endif
+	un_wp_page((unsigned long *)
+		(((address>>10) & 0xffc) + (0xfffff000 &
+		*((unsigned long *) ((address>>20) &0xffc)))));
+
+}
+
+void write_verify(unsigned long address)
+{
+	unsigned long page;
+
+	if (!( (page = *((unsigned long *) ((address>>20) & 0xffc)) )&1))
+		return;
+	page &= 0xfffff000;
+	page += ((address>>10) & 0xffc);
+	if ((3 & *(unsigned long *) page) == 1)  /* non-writeable, present */
+		un_wp_page((unsigned long *) page);
+	return;
+}
+
+void get_empty_page(unsigned long address)
+{
+	unsigned long tmp;
+
+	if (!(tmp=get_free_page()) || !put_page(tmp,address)) {
+		free_page(tmp);		/* 0 is ok - ignored */
+		oom();
+	}
+}
+
+/*
+ * try_to_share() checks the page at address "address" in the task "p",
+ * to see if it exists, and if it is clean. If so, share it with the current
+ * task.
+ *
+ * NOTE! This assumes we have checked that p != current, and that they
+ * share the same executable.
+ */
+static int try_to_share(unsigned long address, struct task_struct * p)
+{
+	unsigned long from;
+	unsigned long to;
+	unsigned long from_page;
+	unsigned long to_page;
+	unsigned long phys_addr;
+
+	from_page = to_page = ((address>>20) & 0xffc);
+	from_page += ((p->start_code>>20) & 0xffc);
+	to_page += ((current->start_code>>20) & 0xffc);
+/* is there a page-directory at from? */
+	from = *(unsigned long *) from_page;
+	if (!(from & 1))
+		return 0;
+	from &= 0xfffff000;
+	from_page = from + ((address>>10) & 0xffc);
+	phys_addr = *(unsigned long *) from_page;
+/* is the page clean and present? */
+	if ((phys_addr & 0x41) != 0x01)
+		return 0;
+	phys_addr &= 0xfffff000;
+	if (phys_addr >= HIGH_MEMORY || phys_addr < LOW_MEM)
+		return 0;
+	to = *(unsigned long *) to_page;
+	if (!(to & 1))
+		if (to = get_free_page())
+			*(unsigned long *) to_page = to | 7;
+		else
+			oom();
+	to &= 0xfffff000;
+	to_page = to + ((address>>10) & 0xffc);
+	if (1 & *(unsigned long *) to_page)
+		panic("try_to_share: to_page already exists");
+/* share them: write-protect */
+	*(unsigned long *) from_page &= ~2;
+	*(unsigned long *) to_page = *(unsigned long *) from_page;
+	invalidate();
+	phys_addr -= LOW_MEM;
+	phys_addr >>= 12;
+	mem_map[phys_addr]++;
+	return 1;
+}
+
+/*
+ * share_page() tries to find a process that could share a page with
+ * the current one. Address is the address of the wanted page relative
+ * to the current data space.
+ *
+ * We first check if it is at all feasible by checking executable->i_count.
+ * It should be >1 if there are other tasks sharing this inode.
+ */
+static int share_page(unsigned long address)
+{
+	struct task_struct ** p;
+
+	if (!current->executable)
+		return 0;
+	if (current->executable->i_count < 2)
+		return 0;
+	for (p = &LAST_TASK ; p > &FIRST_TASK ; --p) {
+		if (!*p)
+			continue;
+		if (current == *p)
+			continue;
+		if ((*p)->executable != current->executable)
+			continue;
+		if (try_to_share(address,*p))
+			return 1;
+	}
+	return 0;
+}
+
+void do_no_page(unsigned long error_code,unsigned long address)
+{
+	int nr[4];
+	unsigned long tmp;
+	unsigned long page;
+	int block,i;
+
+	if (current->pid > 5)
+		printk(" --do_no_page: address=%x, pid=%d\n", address, current->pid);
+	address &= 0xfffff000;
+	tmp = address - current->start_code;
+	if (!current->executable || tmp >= current->end_data) {
+		get_empty_page(address);
+		return;
+	}
+	if (share_page(tmp))
+		return;
+	if (!(page = get_free_page()))
+		oom();
+/* remember that 1 block is used for header */
+	block = 1 + tmp/BLOCK_SIZE;
+	for (i=0 ; i<4 ; block++,i++)
+		nr[i] = bmap(current->executable,block);
+	bread_page(page,current->executable->i_dev,nr);
+	i = tmp + 4096 - current->end_data;
+	tmp = page + 4096;
+	while (i-- > 0) {
+		tmp--;
+		*(char *)tmp = 0;
+	}
+	if (put_page(page,address))
+		return;
+	free_page(page);
+	oom();
+}
+
+void mem_init(long start_mem, long end_mem)
+{
+	int i;
+
+	HIGH_MEMORY = end_mem;
+	for (i=0 ; i<PAGING_PAGES ; i++)
+		mem_map[i] = USED;
+	i = MAP_NR(start_mem);
+	end_mem -= start_mem;
+	end_mem >>= 12;
+	while (end_mem-->0)
+		mem_map[i++]=0;
+}
+
+void calc_mem(void)
+{
+	int i,j,k,free=0;
+	long * pg_tbl;
+
+	for(i=0 ; i<PAGING_PAGES ; i++)
+		if (!mem_map[i]) free++;
+	printk("%d pages free (of %d)\n\r",free,PAGING_PAGES);
+	for(i=2 ; i<1024 ; i++) {
+		if (1&pg_dir[i]) {
+			pg_tbl=(long *) (0xfffff000 & pg_dir[i]);
+			for(j=k=0 ; j<1024 ; j++)
+				if (pg_tbl[j]&1)
+					k++;
+			printk("Pg-dir[%d] uses %d pages\n",i,k);
+		}
+	}
+}
+int upload_p(unsigned long address) /*created by dt, fixed by yjk*/ 
+{
+	int nr[4];  /* 记录逻辑块号 */
+	unsigned long tmp; /*线性地址在进程空间中相对于进程基址的偏移长度值。*/
+	unsigned long page;
+	int block,i;
+
+	address &= 0xfffff000; /*页面地址*/
+	tmp = address - current->start_code; /*首先算出指定线性地址在进程空间中相对于进程基址的偏移长度值.
+	
+	/* 若当前进程的executable 空，或者指定地址超出代码+数据长度，则申请一页物理内存，并映射
+	 * 影射到指定的线性地址处。executable 是进程的i 节点结构。该值为0，表明进程刚开始设置，
+	 * 需要内存；而指定的线性地址超出代码加数据长度，表明进程在申请新的内存空间，也需要给予。
+	 * 因此就直接调用get_empty_page()函数，申请一页物理内存并映射到指定线性地址处即可。
+	 */
+	
+	if (!current->executable || tmp >= current->end_data) {
+		get_empty_page(address);
+		return 0;
+	}
+
+	/* 
+	如果尝试共享页面成功,则退出
+	 */
+	if (share_page(tmp))
+		return 0;
+	/*取空闲页面，如果内存不够了，则显示内存不够，终止进程。*/
+	if (!(page = get_free_page()))
+		return -1;
+	
+	/* 记住程序头需要使用1个数据块*/
+	block = 1 + tmp/BLOCK_SIZE; /*block用来存储有几个数据块的*/
+	for (i=0 ; i<4 ; block++,i++) /*根据i节点信息，取数据块在设备上的对应的逻辑块号。*/
+		nr[i] = bmap(current->executable,block);
+	/*bmap:实现文件数据块号到设备中的逻辑块号的映射，
+		函数注册一个新逻辑快，并返回这个新逻辑块的块号*/
+
+	/* 读设备上一个页面的数据(4 个逻辑块)到指定物理地址page 处 */
+	bread_page(page,current->executable->i_dev,nr);
+
+	/*在增加了一页内存后，该页内存的部分可能会超过进程的end_data 位置
+	 *下面的循环即是对物理页面超出的部分进行清零处理。
+	 */
+	i = tmp + 4096 - current->end_data;
+	tmp = page + 4096;
+	while (i-- > 0) {
+		tmp--;
+		*(char *)tmp = 0;
+	}
+	if (put_page(page,address)) /*如果把物理页面映射到指定线性地址的操作成功，就返回*/
+		return 0;
+	free_page(page);/*否则就释放内存页，显示内存不够。*/
+	return -1;
+}