if (WARN_ON(vmf->pgoff >= ubuf->pagecount))
    return VM_FAULT_SIGBUS;

vmf->page = ubuf->pages[vmf->pgoff];
get_page(vmf->page);
return 0;

vmf->page = ubuf->pages[vmf->pgoff];
get_page(vmf->page);
return 0;

pgoff_t pgoff = vmf->pgoff;

if (pgoff >= ubuf->pagecount)
    return VM_FAULT_SIGBUS;
vmf->page = ubuf->pages[pgoff];
get_page(vmf->page);
return 0;

struct udmabuf_create {
    __u32 memfd;                       /* 0x00：memfd 的文件描述符 */
    __u32 flags;                       /* 0x04：创建标志，如 UDMABUF_FLAGS_CLOEXEC */
    __u64 offset;                      /* 0x08：memfd 内的起始偏移（字节） */
    __u64 size;                        /* 0x10：区间大小（字节） */
};                                     /* sizeof == 24 */

struct udmabuf_create_list {
    __u32 flags;                       /* 创建标志，如 UDMABUF_FLAGS_CLOEXEC */
    __u32 count;                       /* 创建项的数量 */
    struct udmabuf_create_item list[]; /* 柔性数组，每项描述一个 memfd 区间 */
};

struct udmabuf_create_item {
    __u32 memfd;                       /* 0x00：memfd 的文件描述符 */
    __u32 __pad;                       /* 0x04：显式填充，保证 8 字节对齐 */
    __u64 offset;                      /* 0x08：memfd 内的起始偏移（字节） */
    __u64 size;                        /* 0x10：区间大小（字节） */
};                                     /* sizeof == 24 */

struct udmabuf {
    unsigned long       pagecount;   /* 0x00：pages[] 数组中的页指针数量 */
    struct page       **pages;       /* 0x08：由 kmalloc_array 分配的页指针数组 */
    struct sg_table    *sg;          /* 0x10：scatter-gather 表，供 dma-buf 导出使用 */
    struct miscdevice  *device;      /* 0x18：关联的 miscdevice，指向 /dev/udmabuf */
};                                   /* sizeof == 0x20 */

struct file {
    union { ... } f_u;                 /* 0x00：联合体，RCU 或 llist */
    struct path f_path;                /* 0x10：文件路径 */
    struct inode *f_inode;             /* 0x20：inode */
    const struct file_operations *f_op;/* 0x28：文件操作集 */
    spinlock_t f_lock;                 /* 0x30：锁 */
    atomic_long_t f_count;             /* 0x38：引用计数 */
    unsigned int f_flags;              /* 0x40：打开标志 */
    fmode_t f_mode;                    /* 0x44：访问模式 */
    struct mutex f_pos_lock;           /* 0x48：位置锁 */
    loff_t f_pos;                      /* 0x68：当前偏移 */
    struct fown_struct f_owner;        /* 0x70：所有者信息 */
    const struct cred *f_cred;         /* 0x90：凭证 */
    struct file_ra_state f_ra;         /* 0x98：预读状态 */
    u64 f_version;                     /* 0xb8：版本 */
    void *f_security;                  /* 0xc0：安全数据 */
    void *private_data;                /* 0xc8：私有数据 */
    struct hlist_head *f_ep;           /* 0xd0：epoll 头 */
    struct address_space *f_mapping;   /* 0xd8：地址空间 */
    errseq_t f_wb_err;                 /* 0xe0：写回错误 */
    errseq_t f_sb_err;                 /* 0xe4：超级块错误 */
};                                     /* sizeof == 232 */

struct file_operations {
    struct module *owner;              /* 0x00：所属模块 */
    loff_t (*llseek)(...);             /* 0x08：llseek */
    ssize_t (*read)(...);              /* 0x10：read */
    ssize_t (*write)(...);             /* 0x18：write */
    ssize_t (*read_iter)(...);         /* 0x20：read_iter */
    ssize_t (*write_iter)(...);        /* 0x28：write_iter */
    int (*iopoll)(...);                /* 0x30：iopoll */
    int (*iterate)(...);               /* 0x38：iterate */
    int (*iterate_shared)(...);        /* 0x40：iterate_shared */
    __poll_t (*poll)(...);             /* 0x48：poll */
    long (*unlocked_ioctl)(...);       /* 0x50：unlocked_ioctl */
    long (*compat_ioctl)(...);         /* 0x58：compat_ioctl */
    int (*mmap)(struct file *, struct vm_area_struct *); /* 0x60：mmap */
    unsigned long mmap_supported_flags;/* 0x68：支持的 mmap 标志 */
    int (*open)(...);                  /* 0x70：open */
    int (*flush)(...);                 /* 0x78：flush */
    int (*release)(...);               /* 0x80：release */
    int (*fsync)(...);                 /* 0x88：fsync */
    int (*fasync)(...);                /* 0x90：fasync */
    int (*lock)(...);                  /* 0x98：lock */
    ssize_t (*sendpage)(...);          /* 0xa0：sendpage */
    unsigned long (*get_unmapped_area)(...); /* 0xa8：get_unmapped_area */
    int (*check_flags)(...);           /* 0xb0：check_flags */
    int (*flock)(...);                 /* 0xb8：flock */
    ssize_t (*splice_write)(...);      /* 0xc0：splice_write */
    ssize_t (*splice_read)(...);       /* 0xc8：splice_read */
    int (*setlease)(...);              /* 0xd0：setlease */
    long (*fallocate)(...);            /* 0xd8：fallocate */
    void (*show_fdinfo)(...);          /* 0xe0：show_fdinfo */
    ssize_t (*copy_file_range)(...);   /* 0xe8：copy_file_range */
    loff_t (*remap_file_range)(...);   /* 0xf0：remap_file_range */
    int (*fadvise)(...);               /* 0xf8：fadvise */
};                                     /* sizeof == 256 */

struct miscdevice {
    int minor;                         /* 0x00：次设备号 */
    const char *name;                  /* 0x08：设备名 */
    const struct file_operations *fops;/* 0x10：文件操作集 */
    struct list_head list;             /* 0x18：misc 设备链表 */
    struct device *parent;             /* 0x28：父设备 */
    struct device *this_device;        /* 0x30：本设备 */
    const struct attribute_group **groups; /* 0x38：属性组 */
    const char *nodename;              /* 0x40：节点名 */
    umode_t mode;                      /* 0x48：权限模式 */
};                                     /* sizeof == 80 */

struct dma_buf {
    size_t size;                       /* 0x00：缓冲区大小（字节） */
    struct file *file;                 /* 0x08：关联的 file */
    struct list_head attachments;      /* 0x10：附件链表 */
    const struct dma_buf_ops *ops;     /* 0x20：dma_buf 操作集 */
    struct mutex lock;                 /* 0x28：锁 */
    unsigned int vmapping_counter;     /* 0x48：vmap 计数 */
    struct iosys_map vmap_ptr;         /* 0x50：vmap 地址 */
    const char *exp_name;              /* 0x60：导出名 */
    const char *name;                  /* 0x68：名称 */
    spinlock_t name_lock;              /* 0x70：名称锁 */
    struct module *owner;              /* 0x78：所属模块 */
    struct list_head list_node;        /* 0x80：全局链表节点 */
    void *priv;                        /* 0x90：私有数据，udmabuf 中指向 ubuf */
    struct dma_resv *resv;             /* 0x98：预留对象 */
    wait_queue_head_t poll;            /* 0xa0：轮询等待队列 */
    struct dma_buf_poll_cb_t cb_in;    /* 0xb8：入方向轮询回调 */
    struct dma_buf_poll_cb_t cb_out;   /* 0xe0：出方向轮询回调 */
};                                     /* sizeof == 264 */

struct dma_buf_export_info {
    const char *exp_name;              /* 0x00：导出名 */
    struct module *owner;              /* 0x08：所属模块 */
    const struct dma_buf_ops *ops;     /* 0x10：操作集 */
    size_t size;                       /* 0x18：大小 */
    int flags;                         /* 0x20：标志 */
    struct dma_resv *resv;             /* 0x28：预留对象 */
    void *priv;                        /* 0x30：私有数据 */
};                                     /* sizeof == 56 */

struct dma_buf_ops {
    bool cache_sgt_mapping;            /* 0x00：是否缓存 sg 映射 */
    int (*attach)(...);                /* 0x08：attach 回调 */
    void (*detach)(...);               /* 0x10：detach 回调 */
    int (*pin)(...);                   /* 0x18：pin 回调 */
    void (*unpin)(...);                /* 0x20：unpin 回调 */
    struct sg_table *(*map_dma_buf)(...); /* 0x28：映射回调 */
    void (*unmap_dma_buf)(...);        /* 0x30：取消映射回调 */
    void (*release)(...);              /* 0x38：释放回调 */
    int (*begin_cpu_access)(...);      /* 0x40：开始 CPU 访问 */
    int (*end_cpu_access)(...);        /* 0x48：结束 CPU 访问 */
    int (*mmap)(struct dma_buf *, struct vm_area_struct *); /* 0x50：mmap 回调 */
    int (*vmap)(...);                  /* 0x58：vmap 回调 */
    void (*vunmap)(...);               /* 0x60：vunmap 回调 */
};                                     /* sizeof == 104 */

struct vm_area_struct {
    unsigned long vm_start;            /* 0x00：VMA 起始虚拟地址 */
    unsigned long vm_end;              /* 0x08：VMA 结束虚拟地址 */
    struct vm_area_struct *vm_next;    /* 0x10：VMA 链表中下一个 */
    struct vm_area_struct *vm_prev;    /* 0x18：VMA 链表中上一个 */
    struct rb_node vm_rb;              /* 0x20：红黑树节点，用于按地址索引 */
    unsigned long rb_subtree_gap;      /* 0x38：红黑树子树间隙 */
    struct mm_struct *vm_mm;           /* 0x40：所属 mm_struct */
    pgprot_t vm_page_prot;             /* 0x48：页保护位 */
    unsigned long vm_flags;            /* 0x50：VMA 标志，如 VM_SHARED、VM_WRITE */
    union {                            /* 0x58：共享映射或匿名名称 */
        struct { ... } shared;
        struct anon_vma_name *anon_name;
    };
    struct list_head anon_vma_chain;   /* 0x78：anon_vma 链 */
    struct anon_vma *anon_vma;         /* 0x88：匿名 VMA 的反向映射 */
    const struct vm_operations_struct *vm_ops; /* 0x90：VMA 操作集，fault 回调在此 */
    unsigned long vm_pgoff;            /* 0x98：映射在文件中的起始页偏移 */
    struct file *vm_file;              /* 0xa0：映射的文件 */
    void *vm_private_data;             /* 0xa8：私有数据，udmabuf 映射时指向 ubuf */
    atomic_long_t swap_readahead_info; /* 0xb0：交换预读信息 */
    struct mempolicy *vm_policy;       /* 0xb8：NUMA 内存策略 */
    struct vm_userfaultfd_ctx vm_userfaultfd_ctx; /* 0xc0：userfaultfd 上下文 */
};                                     /* sizeof == 200 */

struct vm_operations_struct {
    void (*open)(struct vm_area_struct *);   /* 0x00：打开回调 */
    void (*close)(struct vm_area_struct *);  /* 0x08：关闭回调 */
    int (*may_split)(...);                   /* 0x10：拆分检查 */
    int (*mremap)(struct vm_area_struct *);  /* 0x18：mremap 回调 */
    int (*mprotect)(...);                    /* 0x20：mprotect 回调 */
    vm_fault_t (*fault)(struct vm_fault *);  /* 0x28：缺页回调 */
    vm_fault_t (*huge_fault)(...);           /* 0x30：巨大页缺页 */
    vm_fault_t (*map_pages)(...);            /* 0x38：映射多页 */
    unsigned long (*pagesize)(...);          /* 0x40：页大小 */
    vm_fault_t (*page_mkwrite)(...);         /* 0x48：页可写回调 */
    vm_fault_t (*pfn_mkwrite)(...);          /* 0x50：PFN 可写回调 */
    int (*access)(...);                      /* 0x58：访问回调 */
    const char *(*name)(...);                /* 0x60：名称回调 */
    int (*set_policy)(...);                  /* 0x68：设置策略 */
    struct mempolicy *(*get_policy)(...);    /* 0x70：获取策略 */
    struct page *(*find_special_page)(...);  /* 0x78：查找特殊页 */
};                                           /* sizeof == 128 */

struct vm_fault {
    const struct {
        struct vm_area_struct *vma;    /* 0x00：触发缺页的 VMA */
        gfp_t gfp_mask;                /* 0x08：分配掩码 */
        unsigned long pgoff;           /* 0x10：缺页页在 VMA 中的页偏移 */
        unsigned long address;         /* 0x18：触发缺页的虚拟地址 */
        unsigned long real_address;    /* 0x20：实际地址 */
    };
    enum fault_flag flags;             /* 0x28：缺页标志 */
    pmd_t *pmd;                        /* 0x30：PMD 指针 */
    pud_t *pud;                        /* 0x38：PUD 指针 */
    union { pte_t orig_pte; pmd_t orig_pmd; }; /* 0x40：原始 PTE/PMD */
    struct page *cow_page;             /* 0x48：COW 页 */
    struct page *page;                 /* 0x50：缺页处理结果页 */
    pte_t *pte;                        /* 0x58：PTE 指针 */
    spinlock_t *ptl;                   /* 0x60：PTE 锁 */
    pgtable_t prealloc_pte;            /* 0x68：预分配 PTE */
};                                     /* sizeof == 112 */

struct page {
    unsigned long flags;               /* 0x00：页标志 */
    union {                            /* 0x08：多种复用联合体 */
        struct {                       /* 页缓存/匿名页常用视图 */
            union {
                struct list_head lru;  /* 0x08：LRU 链表 */
                struct { void *__filler; unsigned int mlock_count; };
            };
            struct address_space *mapping; /* 0x18：所属地址空间 */
            unsigned long index;       /* 0x20：在地址空间中的索引 */
            unsigned long private;     /* 0x28：私有数据 */
        };
        struct { ... } pp;             /* page_pool 视图 */
        struct { ... } compound;       /* 复合页视图 */
        struct { ... } deferred;       /* 延迟列表视图 */
        struct { ... } pt;             /* 页表视图 */
        struct { ... } zone_device;    /* ZONE_DEVICE 视图 */
        struct callback_head callback_head; /* 0x08：RCU 回调 */
    };
    union {
        atomic_t _mapcount;            /* 0x30：映射计数 */
        unsigned int page_type;        /* 0x30：页类型 */
    };
    atomic_t _refcount;                /* 0x34：引用计数 */
    unsigned long memcg_data;          /* 0x38：内存 cgroup 数据 */
};                                     /* sizeof == 64 */

struct address_space {
    struct inode *host;                /* 0x00：宿主 inode */
    struct xarray i_pages;             /* 0x08：页缓存 xarray */
    struct rw_semaphore invalidate_lock; /* 0x18：失效锁 */
    gfp_t gfp_mask;                    /* 0x40：分配掩码 */
    atomic_t i_mmap_writable;          /* 0x44：可写映射计数 */
    struct rb_root_cached i_mmap;      /* 0x48：反向映射红黑树 */
    struct rw_semaphore i_mmap_rwsem;  /* 0x58：反向映射读写信号量 */
    unsigned long nrpages;             /* 0x80：页数量 */
    unsigned long writeback_index;     /* 0x88：写回索引 */
    const struct address_space_operations *a_ops; /* 0x90：地址空间操作 */
    unsigned long flags;               /* 0x98：标志 */
    errseq_t wb_err;                   /* 0xa0：写回错误 */
    spinlock_t private_lock;           /* 0xa4：私有锁 */
    struct list_head private_list;     /* 0xa8：私有链表 */
    void *private_data;                /* 0xb8：私有数据 */
};                                     /* sizeof == 192 */

struct inode {
    umode_t i_mode;                    /* 0x00：文件模式 */
    unsigned short i_opflags;          /* 0x02：操作标志 */
    kuid_t i_uid;                      /* 0x04：用户 ID */
    kgid_t i_gid;                      /* 0x08：组 ID */
    unsigned int i_flags;              /* 0x0c：inode 标志 */
    struct posix_acl *i_acl;           /* 0x10：访问控制列表 */
    struct posix_acl *i_default_acl;   /* 0x18：默认访问控制列表 */
    const struct inode_operations *i_op; /* 0x20：inode 操作 */
    struct super_block *i_sb;          /* 0x28：超级块 */
    struct address_space *i_mapping;   /* 0x30：地址空间 */
    void *i_security;                  /* 0x38：安全数据 */
    unsigned long i_ino;               /* 0x40：inode 号 */
    union { const unsigned int i_nlink; unsigned int __i_nlink; }; /* 0x48：链接数 */
    dev_t i_rdev;                      /* 0x4c：设备号 */
    loff_t i_size;                     /* 0x50：文件大小 */
    struct timespec64 i_atime;         /* 0x58：访问时间 */
    struct timespec64 i_mtime;         /* 0x68：修改时间 */
    struct timespec64 i_ctime;         /* 0x78：状态改变时间 */
    spinlock_t i_lock;                 /* 0x88：锁 */
    unsigned short i_bytes;            /* 0x8c：字节数 */
    u8 i_blkbits;                      /* 0x8e：块位数 */
    u8 i_write_hint;                   /* 0x8f：写提示 */
    blkcnt_t i_blocks;                 /* 0x90：块数 */
    unsigned long i_state;             /* 0x98：状态 */
    struct rw_semaphore i_rwsem;       /* 0xa0：读写信号量 */
    unsigned long dirtied_when;        /* 0xc8：脏页时间 */
    unsigned long dirtied_time_when;   /* 0xd0：脏页时间 */
    struct hlist_node i_hash;          /* 0xd8：哈希节点 */
    struct list_head i_io_list;        /* 0xe8：IO 链表 */
    struct bdi_writeback *i_wb;        /* 0xf8：回写控制 */
    int i_wb_frn_winner;               /* 0x100：回写公平竞争 */
    u16 i_wb_frn_avg_time;             /* 0x104：平均时间 */
    u16 i_wb_frn_history;              /* 0x106：历史 */
    struct list_head i_lru;            /* 0x108：LRU 链表 */
    struct list_head i_sb_list;        /* 0x118：超级块链表 */
    struct list_head i_wb_list;        /* 0x128：回写链表 */
    union { struct hlist_head i_dentry; struct callback_head i_rcu; }; /* 0x138：目录项或 RCU */
    atomic64_t i_version;              /* 0x148：版本 */
    atomic64_t i_sequence;             /* 0x150：序列 */
    atomic_t i_count;                  /* 0x158：引用计数 */
    atomic_t i_dio_count;              /* 0x15c：直接 IO 计数 */
    atomic_t i_writecount;             /* 0x160：写计数 */
    atomic_t i_readcount;              /* 0x164：读计数 */
    union { const struct file_operations *i_fop; void (*free_inode)(struct inode *); }; /* 0x168：文件操作或释放回调 */
    struct file_lock_context *i_flctx; /* 0x170：文件锁上下文 */
    struct address_space i_data;       /* 0x178：内嵌地址空间 */
    struct list_head i_devices;        /* 0x238：设备链表 */
    union { struct pipe_inode_info *i_pipe; struct cdev *i_cdev; char *i_link; unsigned int i_dir_seq; }; /* 0x248：管道、字符设备等 */
    __u32 i_generation;                /* 0x250：生成号 */
    __u32 i_fsnotify_mask;             /* 0x254：fsnotify 掩码 */
    struct fsnotify_mark_connector *i_fsnotify_marks; /* 0x258：fsnotify 标记 */
    struct fscrypt_info *i_crypt_info; /* 0x260：加密信息 */
    struct fsverity_info *i_verity_info; /* 0x268：完整性信息 */
    void *i_private;                   /* 0x270：私有数据 */
};                                     /* sizeof == 632 */

struct pipe_buffer {
    struct page *page;                 /* 0x00：管道缓冲区引用的页 */
    unsigned int offset;               /* 0x08：页内偏移 */
    unsigned int len;                  /* 0x0c：数据长度 */
    const struct pipe_buf_operations *ops; /* 0x10：缓冲区操作集 */
    unsigned int flags;                /* 0x18：标志 */
    unsigned long private;             /* 0x20：私有数据 */
};                                     /* sizeof == 40 */

struct hstate {
    struct mutex resize_lock;          /* 0x00：调整锁 */
    int next_nid_to_alloc;             /* 0x20：下一个分配节点 */
    int next_nid_to_free;              /* 0x24：下一个释放节点 */
    unsigned int order;                /* 0x28：巨大页阶数 */
    unsigned int demote_order;         /* 0x2c：降级阶数 */
    unsigned long mask;                /* 0x30：掩码 */
    unsigned long max_huge_pages;      /* 0x38：最大巨大页数 */
    unsigned long nr_huge_pages;       /* 0x40：巨大页数量 */
    unsigned long free_huge_pages;     /* 0x48：空闲巨大页数 */
    unsigned long resv_huge_pages;     /* 0x50：预留巨大页数 */
    unsigned long surplus_huge_pages;  /* 0x58：剩余巨大页数 */
    unsigned long nr_overcommit_huge_pages; /* 0x60：超量提交巨大页数 */
    struct list_head hugepage_activelist; /* 0x68：活动巨大页链表 */
    struct list_head hugepage_freelists[1024]; /* 0x78：空闲巨大页链表 */
    unsigned int max_huge_pages_node[1024];    /* 0x4078：每节点最大巨大页数 */
    unsigned int nr_huge_pages_node[1024];     /* 0x5078：每节点巨大页数 */
    unsigned int free_huge_pages_node[1024];   /* 0x6078：每节点空闲巨大页数 */
    unsigned int surplus_huge_pages_node[1024];/* 0x7078：每节点剩余巨大页数 */
    unsigned int nr_free_vmemmap_pages;        /* 0x8078：空闲 vmemmap 页数 */
    struct cftype cgroup_files_dfl[8];         /* 0x8080：默认 cgroup 文件 */
    struct cftype cgroup_files_legacy[10];     /* 0x8740：传统 cgroup 文件 */
    char name[32];                             /* 0x8fb0：名称 */
};                                             /* sizeof == 36816 */

static long udmabuf_ioctl(struct file *filp, unsigned int ioctl,
			  unsigned long arg)
{
	long ret;

	switch (ioctl) {
	case UDMABUF_CREATE:
		ret = udmabuf_ioctl_create(filp, arg); /* 创建单个 memfd 对应的 udmabuf */
		break;
	case UDMABUF_CREATE_LIST:
		ret = udmabuf_ioctl_create_list(filp, arg); /* 创建多个 memfd 项组成的 udmabuf */
		break;
	default:
		ret = -ENOTTY;
		break;
	}
	return ret;
}

static long udmabuf_create(struct miscdevice *device,
			   struct udmabuf_create_list *head,
			   struct udmabuf_create_item *list)
{
	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
	struct file *memfd = NULL;
	struct address_space *mapping = NULL;
	struct udmabuf *ubuf;
	struct dma_buf *buf;
	pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
	struct page *page, *hpage = NULL;
	pgoff_t subpgoff, maxsubpgs;
	struct hstate *hpstate;
	int seals, ret = -EINVAL;
	u32 i, flags;

	ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); /* 分配 udmabuf 结构体并清零 */
	if (!ubuf)
		return -ENOMEM;

	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; /* 计算全局页数上限 */
	for (i = 0; i < head->count; i++) {
		if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
			goto err;                      /* 每项偏移必须页对齐 */
		if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
			goto err;                      /* 每项大小必须页对齐 */
		ubuf->pagecount += list[i].size >> PAGE_SHIFT; /* 累加总页数 */
		if (ubuf->pagecount > pglimit)
			goto err;                      /* 超过全局页数上限则失败 */
	}

	if (!ubuf->pagecount)
		goto err;                          /* 页数为 0 则失败 */

	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
				    GFP_KERNEL); /* 分配页指针数组，2048 页对应 16 KiB，即 order-2 */
	if (!ubuf->pages) {
		ret = -ENOMEM;
		goto err;
	}

	pgbuf = 0;
	for (i = 0; i < head->count; i++) {
		ret = -EBADFD;
		memfd = fget(list[i].memfd);       /* 获取 memfd 对应的 struct file */
		if (!memfd)
			goto err;
		mapping = file_inode(memfd)->i_mapping;
		if (!shmem_mapping(mapping) && !is_file_hugepages(memfd))
			goto err;                      /* 仅支持 shmem 或 hugetlbfs 后备 */
		seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
		if (seals == -EINVAL)
			goto err;
		ret = -EINVAL;
		if ((seals & SEALS_WANTED) != SEALS_WANTED ||
		    (seals & SEALS_DENIED) != 0)
			goto err;                      /* 检查 memfd seals 是否满足要求 */
		pgoff = list[i].offset >> PAGE_SHIFT; /* 计算 memfd 内的起始页偏移 */
		pgcnt = list[i].size   >> PAGE_SHIFT; /* 计算该项的页数 */
		if (is_file_hugepages(memfd)) {
			hpstate = hstate_file(memfd);
			pgoff = list[i].offset >> huge_page_shift(hpstate);
			subpgoff = (list[i].offset &
				    ~huge_page_mask(hpstate)) >> PAGE_SHIFT;
			maxsubpgs = huge_page_size(hpstate) >> PAGE_SHIFT;
		}
		for (pgidx = 0; pgidx < pgcnt; pgidx++) {
			if (is_file_hugepages(memfd)) {
				if (!hpage) {
					hpage = find_get_page_flags(mapping, pgoff,
								    FGP_ACCESSED);
					if (!hpage) {
						ret = -EINVAL;
						goto err;
					}
				}
				page = hpage + subpgoff;
				get_page(page);
				subpgoff++;
				if (subpgoff == maxsubpgs) {
					put_page(hpage);
					hpage = NULL;
					subpgoff = 0;
					pgoff++;
				}
			} else {
				page = shmem_read_mapping_page(mapping,
							       pgoff + pgidx);
				if (IS_ERR(page)) {
					ret = PTR_ERR(page);
					goto err;
				}
			}
			ubuf->pages[pgbuf++] = page;   /* 将后备页指针填入 pages[] 数组 */
		}
		fput(memfd);
		memfd = NULL;
		if (hpage) {
			put_page(hpage);
			hpage = NULL;
		}
	}

	exp_info.ops  = &udmabuf_ops;
	exp_info.size = ubuf->pagecount << PAGE_SHIFT; /* dma_buf 大小等于总页数乘页大小 */
	exp_info.priv = ubuf;
	exp_info.flags = O_RDWR;

	ubuf->device = device;
	buf = dma_buf_export(&exp_info);           /* 导出 dma_buf */
	if (IS_ERR(buf)) {
		ret = PTR_ERR(buf);
		goto err;
	}

	flags = 0;
	if (head->flags & UDMABUF_FLAGS_CLOEXEC)
		flags |= O_CLOEXEC;
	return dma_buf_fd(buf, flags);             /* 返回关联的 fd */

err:
	while (pgbuf > 0)
		put_page(ubuf->pages[--pgbuf]);    /* 回滚已获取的页引用 */
	if (memfd)
		fput(memfd);
	kfree(ubuf->pages);
	kfree(ubuf);
	return ret;
}

static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
{
	struct udmabuf_create_list head;
	struct udmabuf_create_item *list;
	int ret = -EINVAL;
	u32 lsize;

	if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
		return -EFAULT;                    /* 从用户态拷贝创建列表头部 */
	if (head.count > list_limit)
		return -EINVAL;                    /* 项数超过限制则拒绝 */
	lsize = sizeof(struct udmabuf_create_item) * head.count;
	list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
	if (IS_ERR(list))
		return PTR_ERR(list);              /* 从用户态拷贝创建项列表 */

	ret = udmabuf_create(filp->private_data, &head, list);
	kfree(list);                               /* 释放临时列表 */
	return ret;
}

SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
		unsigned long, prot, unsigned long, flags,
		unsigned long, fd, unsigned long, off)
{
	if (off & ~PAGE_MASK)          /* 检查文件偏移是否页对齐；未对齐则返回 -EINVAL */
		return -EINVAL;

	return ksys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
	/* 将字节偏移右移 PAGE_SHIFT，转换为以页为单位的 pgoff，继续处理 */
}

unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len,
			      unsigned long prot, unsigned long flags,
			      unsigned long fd, unsigned long pgoff)
{
	struct file *file = NULL;
	unsigned long retval;

	if (!(flags & MAP_ANONYMOUS)) {
		audit_mmap_fd(fd, flags);              /* 审计 mmap 的文件描述符操作 */
		file = fget(fd);                       /* 根据 fd 获取 struct file */
		if (!file)
			return -EBADF;
		if (is_file_hugepages(file)) {         /* 若为 hugetlbfs 文件，按巨大页大小对齐长度 */
			len = ALIGN(len, huge_page_size(hstate_file(file)));
		} else if (unlikely(flags & MAP_HUGETLB)) {
			retval = -EINVAL;
			goto out_fput;
		}
	} else if (flags & MAP_HUGETLB) {          /* 匿名映射但要求巨大页 */
		struct hstate *hs;

		hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
		if (!hs)
			return -EINVAL;

		len = ALIGN(len, huge_page_size(hs));
		/*
		 * VM_NORESERVE is used because the reservations will be
		 * taken when vm_ops->mmap() is called
		 */
		file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
				VM_NORESERVE,
				HUGETLB_ANONHUGE_INODE,
				(flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
		if (IS_ERR(file))
			return PTR_ERR(file);
	}

	retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff);
	/* 进入通用 mmap 处理路径；此时 pgoff 已由用户态偏移转换而来 */
out_fput:
	if (file)
		fput(file);                            /* 释放 file 引用 */
	return retval;
}

/**
 * account_locked_vm - account locked pages to an mm's locked_vm
 * @mm:          mm to account against, may be NULL
 * @pages:       number of pages to account
 * @inc:         %true if @pages should be considered positive, %false if not
 *
 * Assumes a non-NULL @mm is valid (i.e. at least one reference on it).
 *
 * Return:
 * * 0       on success, or if mm is NULL
 * * -ENOMEM if RLIMIT_MEMLOCK would be exceeded.
 */
int account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc)
{
	int ret;

	if (pages == 0 || !mm)
		return 0;

	mmap_write_lock(mm);                       /* 获取 mmap 写锁，保护 mm 相关字段 */
	ret = __account_locked_vm(mm, pages, inc, current,
				  capable(CAP_IPC_LOCK)); /* 按权限进行锁定内存记账 */
	mmap_write_unlock(mm);                     /* 释放 mmap 写锁 */

	return ret;
}
EXPORT_SYMBOL_GPL(account_locked_vm);

unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,
	unsigned long len, unsigned long prot,
	unsigned long flag, unsigned long pgoff)
{
	unsigned long ret;
	struct mm_struct *mm = current->mm;
	unsigned long populate;
	LIST_HEAD(uf);

	ret = security_mmap_file(file, prot, flag); /* LSM 安全检查 */
	if (!ret) {
		if (mmap_write_lock_killable(mm))       /* 获取 mmap 写锁，可被信号中断 */
			return -EINTR;
		ret = do_mmap(file, addr, len, prot, flag, pgoff, &populate,
			      &uf);                     /* 执行实际映射创建 */
		mmap_write_unlock(mm);                  /* 释放 mmap 写锁 */
		userfaultfd_unmap_complete(mm, &uf);    /* 处理 userfaultfd 的 unmap 完成事件 */
		if (populate)
			mm_populate(ret, populate);         /* 若需要，提前填充页表 */
	}
	return ret;
}

unsigned long vm_mmap(struct file *file, unsigned long addr,
		unsigned long len, unsigned long prot,
		unsigned long flag, unsigned long offset)
{
	if (unlikely(offset + PAGE_ALIGN(len) < offset))
		return -EINVAL;                        /* 检查偏移加长度是否溢出 */
	if (unlikely(offset_in_page(offset)))
		return -EINVAL;                        /* 检查偏移是否页对齐 */

	return vm_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
	/* 将字节偏移转换为页偏移，进入通用 mmap 路径 */
}

/*
 * The caller must write-lock current->mm->mmap_lock.
 */
unsigned long do_mmap(struct file *file, unsigned long addr,
			unsigned long len, unsigned long prot,
			unsigned long flags, unsigned long pgoff,
			unsigned long *populate, struct list_head *uf)
{
	struct mm_struct *mm = current->mm;
	vm_flags_t vm_flags;
	int pkey = 0;

	*populate = 0;

	if (!len)
		return -EINVAL;                        /* 长度为 0 直接拒绝 */

	/*
	 * Does the application expect PROT_READ to imply PROT_EXEC?
	 *
	 * (the exception is when the underlying filesystem is noexec
	 *  mounted, in which case we dont add PROT_EXEC.)
	 */
	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
		if (!(file && path_noexec(&file->f_path)))
			prot |= PROT_EXEC;             /* 根据进程 personality 调整执行权限 */

	/* force arch specific MAP_FIXED handling in get_unmapped_area */
	if (flags & MAP_FIXED_NOREPLACE)
		flags |= MAP_FIXED;

	if (!(flags & MAP_FIXED))
		addr = round_hint_to_min(addr);        /* 对非固定映射的地址提示进行对齐 */

	/* Careful about overflows.. */
	len = PAGE_ALIGN(len);                     /* 将长度按页对齐 */
	if (!len)
		return -ENOMEM;

	/* offset overflow? */
	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
		return -EOVERFLOW;                     /* 检查 pgoff + 页数是否溢出 */

	/* Too many mappings? */
	if (mm->map_count > sysctl_max_map_count)
		return -ENOMEM;                        /* 映射数量超过上限 */

	/* Obtain the address to map to. we verify (or select) it and ensure
	 * that it represents a valid section of the address space.
	 */
	addr = get_unmapped_area(file, addr, len, pgoff, flags);
	/* 选择或验证目标虚拟地址；文件映射会调用文件相关的 get_unmapped_area */
	if (IS_ERR_VALUE(addr))
		return addr;

	if (flags & MAP_FIXED_NOREPLACE) {
		if (find_vma_intersection(mm, addr, addr + len))
			return -EEXIST;                /* MAP_FIXED_NOREPLACE 下地址冲突则拒绝 */
	}

	if (prot == PROT_EXEC) {
		pkey = execute_only_pkey(mm);          /* 获取执行专用 pkey */
		if (pkey < 0)
			pkey = 0;
	}

	/* Do simple checking here so the lower-level routines won't have
	 * to. we assume access permissions have been handled by the open
	 * of the memory object, so we don't do any here.
	 */
	vm_flags = calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
	/* 将保护位和标志位转换为 vm_flags */

	if (flags & MAP_LOCKED)
		if (!can_do_mlock())
			return -EPERM;                 /* MAP_LOCKED 需要相应权限 */

	if (mlock_future_check(mm, vm_flags, len))
		return -EAGAIN;                        /* 检查未来锁定内存是否超出限制 */

	if (file) {
		struct inode *inode = file_inode(file);
		unsigned long flags_mask;

		if (!file_mmap_ok(file, inode, pgoff, len))
			return -EOVERFLOW;             /* 检查文件映射的偏移和长度是否合法 */

		flags_mask = LEGACY_MAP_MASK | file->f_op->mmap_supported_flags;

		switch (flags & MAP_TYPE) {
		case MAP_SHARED:
			/*
			 * Force use of MAP_SHARED_VALIDATE with non-legacy
			 * flags. E.g. MAP_SYNC is dangerous to use with
			 * MAP_SHARED as you don't know which consistency model
			 * you will get. We silently ignore unsupported flags
			 * with MAP_SHARED to preserve backward compatibility.
			 */
			flags &= LEGACY_MAP_MASK;
			fallthrough;
		case MAP_SHARED_VALIDATE:
			if (flags & ~flags_mask)
				return -EOPNOTSUPP;    /* 检查标志是否被文件系统支持 */
			if (prot & PROT_WRITE) {
				if (!(file->f_mode & FMODE_WRITE))
					return -EACCES;    /* 可写映射要求文件可写 */
				if (IS_SWAPFILE(file->f_mapping->host))
					return -ETXTBSY;   /* 不允许映射交换文件 */
			}

			/*
			 * Make sure we don't allow writing to an append-only
			 * file..
			 */
			if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE))
				return -EACCES;            /* 追加写文件不允许可写映射 */

			vm_flags |= VM_SHARED | VM_MAYSHARE;
			if (!(file->f_mode & FMODE_WRITE))
				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
			fallthrough;
		case MAP_PRIVATE:
			if (!(file->f_mode & FMODE_READ))
				return -EACCES;            /* 私有映射要求文件可读 */
			if (path_noexec(&file->f_path)) {
				if (vm_flags & VM_EXEC)
					return -EPERM;         /* noexec 文件系统不允许执行映射 */
				vm_flags &= ~VM_MAYEXEC;
			}

			if (!file->f_op->mmap)
				return -ENODEV;            /* 文件必须支持 mmap 操作 */
			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
				return -EINVAL;            /* 文件映射不允许增长方向标志 */
			break;

		default:
			return -EINVAL;
		}
	} else {
		switch (flags & MAP_TYPE) {
		case MAP_SHARED:
			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
				return -EINVAL;
			/*
			 * Ignore pgoff.
			 */
			pgoff = 0;                         /* 匿名共享映射忽略 pgoff */
			vm_flags |= VM_SHARED | VM_MAYSHARE;
			break;
		case MAP_PRIVATE:
			/*
			 * Set pgoff according to addr for anon_vma.
			 */
			pgoff = addr >> PAGE_SHIFT;        /* 匿名私有映射按地址设置 pgoff */
			break;
		default:
			return -EINVAL;
		}
	}

	/*
	 * Set 'VM_NORESERVE' if we should not account for the
	 * memory use of this mapping.
	 */
	if (flags & MAP_NORESERVE) {
		/* We honor MAP_NORESERVE if allowed to overcommit */
		if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
			vm_flags |= VM_NORESERVE;

		/* hugetlb applies strict overcommit unless MAP_NORESERVE */
		if (file && is_file_hugepages(file))
			vm_flags |= VM_NORESERVE;
	}

	addr = mmap_region(file, addr, len, vm_flags, pgoff, uf);
	/* 进入 VMA 创建与文件 mmap 回调调用阶段 */
	if (!IS_ERR_VALUE(addr) &&
	    ((vm_flags & VM_LOCKED) ||
	     (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
		*populate = len;                       /* 标记需要提前填充 */
	return addr;
}

unsigned long mmap_region(struct file *file, unsigned long addr,
		unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
		struct list_head *uf)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma, *prev, *merge;
	int error;
	struct rb_node **rb_link, *rb_parent;
	unsigned long charged = 0;

	/* Check against address space limit. */
	if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) {
		unsigned long nr_pages;

		/*
		 * MAP_FIXED may remove pages of mappings that intersects with
		 * requested mapping. Account for the pages it would unmap.
		 */
		nr_pages = count_vma_pages_range(mm, addr, addr + len);

		if (!may_expand_vm(mm, vm_flags,
					(len >> PAGE_SHIFT) - nr_pages))
			return -ENOMEM;                /* 地址空间扩展受限则拒绝 */
	}

	/* Clear old maps, set up prev, rb_link, rb_parent, and uf */
	if (munmap_vma_range(mm, addr, len, &prev, &rb_link, &rb_parent, uf))
		return -ENOMEM;                        /* 清除目标范围内的旧映射 */
	/*
	 * Private writable mapping: check memory availability
	 */
	if (accountable_mapping(file, vm_flags)) {
		charged = len >> PAGE_SHIFT;
		if (security_vm_enough_memory_mm(mm, charged))
			return -ENOMEM;                /* 私有可写映射需要内存记账 */
		vm_flags |= VM_ACCOUNT;
	}

	/*
	 * Can we just expand an old mapping?
	 */
	vma = vma_merge(mm, prev, addr, addr + len, vm_flags,
			NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX, NULL);
	if (vma)
		goto out;                              /* 若可与旧 VMA 合并，则直接复用 */

	/*
	 * Determine the object being mapped and call the appropriate
	 * specific mapper. the address has already been validated, but
	 * not unmapped, but the maps are removed from the list.
	 */
	vma = vm_area_alloc(mm);                   /* 分配新的 vm_area_struct */
	if (!vma) {
		error = -ENOMEM;
		goto unacct_error;
	}

	vma->vm_start = addr;
	vma->vm_end = addr + len;
	vma->vm_flags = vm_flags;
	vma->vm_page_prot = vm_get_page_prot(vm_flags);
	vma->vm_pgoff = pgoff;                     /* 记录映射的起始页偏移 */

	if (file) {
		if (vm_flags & VM_SHARED) {
			error = mapping_map_writable(file->f_mapping);
			if (error)
				goto free_vma;             /* 共享可写映射需要标记 mapping 可写 */
		}

		vma->vm_file = get_file(file);
		error = call_mmap(file, vma);          /* 调用文件操作中的 mmap 回调 */
		if (error)
			goto unmap_and_free_vma;

		/* Can addr have changed??
		 *
		 * Answer: Yes, several device drivers can do it in their
		 *         f_op->mmap method. -DaveM
		 * Bug: If addr is changed, prev, rb_link, rb_parent should
		 *      be updated for vma_link()
		 */
		WARN_ON_ONCE(addr != vma->vm_start);

		addr = vma->vm_start;

		/* If vm_flags changed after call_mmap(), we should try merge vma again
		 * as we may succeed this time.
		 */
		if (unlikely(vm_flags != vma->vm_flags && prev)) {
			merge = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags,
				NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX, NULL);
			if (merge) {
				/* ->mmap() can change vma->vm_file and fput the original file. So
				 * fput the vma->vm_file here or we would add an extra fput for file
				 * and cause general protection fault ultimately.
				 */
				fput(vma->vm_file);
				vm_area_free(vma);
				vma = merge;
				/* Update vm_flags to pick up the change. */
				vm_flags = vma->vm_flags;
				goto unmap_writable;
			}
		}

		vm_flags = vma->vm_flags;
	} else if (vm_flags & VM_SHARED) {
		error = shmem_zero_setup(vma);
		if (error)
			goto free_vma;                 /* 匿名共享映射使用 shmem 零页设置 */
	} else {
		vma_set_anonymous(vma);                /* 匿名私有映射设置 anonymous 标志 */
	}

	/* Allow architectures to sanity-check the vm_flags */
	if (!arch_validate_flags(vma->vm_flags)) {
		error = -EINVAL;
		if (file)
			goto unmap_and_free_vma;
		else
			goto free_vma;
	}

	vma_link(mm, vma, prev, rb_link, rb_parent); /* 将 VMA 插入 mm 的红黑树与链表 */
	/* Once vma denies write, undo our temporary denial count */
unmap_writable:
	if (file && vm_flags & VM_SHARED)
		mapping_unmap_writable(file->f_mapping);
	file = vma->vm_file;
out:
	perf_event_mmap(vma);                      /* 通知 perf 事件 */

	vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT); /* 更新虚拟内存统计 */
	if (vm_flags & VM_LOCKED) {
		if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
					is_vm_hugetlb_page(vma) ||
					vma == get_gate_vma(current->mm))
			vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
		else
			mm->locked_vm += (len >> PAGE_SHIFT);
	}

	if (file)
		uprobe_mmap(vma);                      /* 通知 uprobe 映射事件 */

	/*
	 * New (or expanded) vma always get soft dirty status.
	 * Otherwise user-space soft-dirty page tracker won't
	 * be able to distinguish situation when vma area unmapped,
	 * then new mapped in-place (which must be aimed as
	 * a completely new data area).
	 */
	vma->vm_flags |= VM_SOFTDIRTY;

	vma_set_page_prot(vma);                    /* 根据 vm_flags 设置页保护 */

	return addr;

unmap_and_free_vma:
	fput(vma->vm_file);
	vma->vm_file = NULL;

	/* Undo any partial mapping done by a device driver. */
	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
	charged = 0;
	if (vm_flags & VM_SHARED)
		mapping_unmap_writable(file->f_mapping);
free_vma:
	vm_area_free(vma);
unacct_error:
	if (charged)
		vm_unacct_memory(charged);
	return error;
}

static inline int call_mmap(struct file *file, struct vm_area_struct *vma)
{
	return file->f_op->mmap(file, vma);        /* 调用具体文件系统的 mmap 回调 */
}

static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
{
	struct dma_buf *dmabuf;

	if (!is_dma_buf_file(file))
		return -EINVAL;                        /* 确认文件属于 dma_buf */

	dmabuf = file->private_data;

	/* check if buffer supports mmap */
	if (!dmabuf->ops->mmap)
		return -EINVAL;                        /* dma_buf 必须支持 mmap */

	/* check for overflowing the buffer's size */
	if (vma->vm_pgoff + vma_pages(vma) >
	    dmabuf->size >> PAGE_SHIFT)
		return -EINVAL;                        /* 初始映射的 pgoff + 页数不能超过 dma_buf 大小 */
	/*
	 * 注意：该检查仅在初始 mmap() 时执行。后续通过 mremap() 扩大 VMA 时，
	 * 不会重新进入 dma_buf_mmap_internal()，因此该边界检查可能被绕过。
	 */

	return dmabuf->ops->mmap(dmabuf, vma);     /* 转发到 dma_buf 操作集的 mmap 回调 */
}

static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
{
	struct udmabuf *ubuf = buf->priv;

	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
		return -EINVAL;                        /* udmabuf 仅支持共享映射 */

	vma->vm_ops = &udmabuf_vm_ops;             /* 安装 udmabuf 的缺页处理操作集 */
	vma->vm_private_data = ubuf;               /* 将 udmabuf 对象保存到 VMA 私有数据 */
	return 0;
}

/*
 * By the time we get here, we already hold the mm semaphore
 *
 * The mmap_lock may have been released depending on flags and our
 * return value.  See filemap_fault() and __folio_lock_or_retry().
 */
vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
			   unsigned int flags, struct pt_regs *regs)
{
	vm_fault_t ret;

	__set_current_state(TASK_RUNNING);

	count_vm_event(PGFAULT);                   /* 统计缺页事件 */
	count_memcg_event_mm(vma->vm_mm, PGFAULT); /* 按 memcg 统计缺页事件 */

	/* do counter updates before entering really critical section. */
	check_sync_rss_stat(current);              /* 同步 RSS 统计 */

	if (!arch_vma_access_permitted(vma, flags & FAULT_FLAG_WRITE,
					    flags & FAULT_FLAG_INSTRUCTION,
					    flags & FAULT_FLAG_REMOTE))
		return VM_FAULT_SIGSEGV;           /* 架构相关的访问权限检查 */

	/*
	 * Enable the memcg OOM handling for faults triggered in user
	 * space.  Kernel faults are handled more gracefully.
	 */
	if (flags & FAULT_FLAG_USER)
		mem_cgroup_enter_user_fault();     /* 用户态缺页进入 memcg OOM 处理状态 */

	if (unlikely(is_vm_hugetlb_page(vma)))
		ret = hugetlb_fault(vma->vm_mm, vma, address, flags); /* 巨大页缺页路径 */
	else
		ret = __handle_mm_fault(vma, address, flags); /* 普通页缺页路径 */

	if (flags & FAULT_FLAG_USER) {
		mem_cgroup_exit_user_fault();
		/*
		 * The task may have entered a memcg OOM situation but
		 * if the allocation error was handled gracefully (no
		 * VM_FAULT_OOM), there is no need to kill anything.
		 * Just clean up the OOM state peacefully.
		 */
		if (task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM))
			mem_cgroup_oom_synchronize(false);
	}

	mm_account_fault(regs, address, flags, ret); /* 缺页记账 */

	return ret;
}

static vm_fault_t do_shared_fault(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	vm_fault_t ret, tmp;

	ret = __do_fault(vmf);                     /* 调用底层 fault 回调获取页 */
	if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
		return ret;

	/*
	 * Check if the backing address space wants to know that the page is
	 * about to become writable
	 */
	if (vma->vm_ops->page_mkwrite) {
		unlock_page(vmf->page);
		tmp = do_page_mkwrite(vmf);         /* 若支持 page_mkwrite，通知后备存储 */
		if (unlikely(!tmp ||
				(tmp & (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))) {
			put_page(vmf->page);
			return tmp;
		}
	}

	ret |= finish_fault(vmf);                  /* 完成 PTE 安装，将页映射到用户态 */
	if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE |
					VM_FAULT_RETRY))) {
		unlock_page(vmf->page);
		put_page(vmf->page);
		return ret;
	}

	ret |= fault_dirty_shared_page(vmf);       /* 处理共享页的脏页标记 */
	return ret;
}

/*
 * The mmap_lock must have been held on entry, and may have been
 * released depending on flags and vma->vm_ops->fault() return value.
 * See filemap_fault() and __lock_page_retry().
 */
static vm_fault_t __do_fault(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	vm_fault_t ret;

	/*
	 * Preallocate pte before we take page_lock because this might lead to
	 * deadlocks for memcg reclaim which waits for pages under writeback:
	 *				lock_page(A)
	 *				SetPageWriteback(A)
	 *				unlock_page(A)
	 * lock_page(B)
	 *				lock_page(B)
	 * pte_alloc_one
	 *   shrink_page_list
	 *     wait_on_page_writeback(A)
	 *				SetPageWriteback(B)
	 *				unlock_page(B)
	 *				# flush A, B to clear the writeback
	 */
	if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
		vmf->prealloc_pte = pte_alloc_one(vma->vm_mm); /* 预分配 PTE 页 */
		if (!vmf->prealloc_pte)
			return VM_FAULT_OOM;
	}

	ret = vma->vm_ops->fault(vmf);             /* 调用 VMA 的 fault 回调，即 udmabuf_vm_fault() */
	if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
			    VM_FAULT_DONE_COW)))
		return ret;

	if (unlikely(PageHWPoison(vmf->page))) {   /* 检查页是否被硬件毒化 */
		struct page *page = vmf->page;
		vm_fault_t poisonret = VM_FAULT_HWPOISON;
		if (ret & VM_FAULT_LOCKED) {
			if (page_mapped(page))
				unmap_mapping_pages(page_mapping(page),
						    page->index, 1, false);
			/* Retry if a clean page was removed from the cache. */
			if (invalidate_inode_page(page))
				poisonret = VM_FAULT_NOPAGE;
			unlock_page(page);
		}
		put_page(page);
		vmf->page = NULL;
		return poisonret;
	}

	if (unlikely(!(ret & VM_FAULT_LOCKED)))
		lock_page(vmf->page);              /* 若 fault 回调未锁页，则在此锁页 */
	else
		VM_BUG_ON_PAGE(!PageLocked(vmf->page), vmf->page);

	return ret;
}

static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	struct udmabuf *ubuf = vma->vm_private_data;

	vmf->page = ubuf->pages[vmf->pgoff];       /* 缺陷点：未检查 vmf->pgoff 是否小于 pagecount */
	get_page(vmf->page);                       /* 递增越界所得页的引用计数 */
	return 0;                                  /* 返回 0，表示缺页处理成功 */
}