$B%a%b%j4IM}!"%"%I%l%96u4V!"%Z!<%8%F!<%V%k(B

$B"!(Bx86$B$N%Z!<%8!&%F!<%V%k(B(PAE$BM-8z(B)

• p $B$,(B 2 $B%S%C%H(B
• q $B$,(B 0 $B%S%C%H(B
• r $B$,(B 9 $B%S%C%H(B
• s $B$,(B 9 $B%S%C%H(B
• offset $B$,(B 12 $B%S%C%H(B

$B"#%Z!<%8!&%U%)!<%k%H(B

• $B@5$7$$%"%I%l%9$r:G=i$K%"%/%;%9$7$?>l9g(B
  • $B%Z!<%8%F!<%V%k$,$J$1$l$P:n$k!#(B
  • $B%Z!<%8!&%U%l!<%`$,3d$jEv$F$i$l$F$$$J$1$l$P!"3d$jEv$F$k!#(B
  • $B%U%!%$%k$HBP1~$7$F$$$l$P!"%U%!%$%k$+$iFbMF$rFI$_9~$`!#(B $BBP1~$7$F$$$J$1$l$P!"(B0 $B$GKd$a$k!#(B
• $B@5$7$$%"%I%l%9$r#22sL\0J9_$K%"%/%;%9$7$?>l9g(B
  • $B%Z!<%8%$%s$N=hM}$r9T$&(B
• $BIT@5$J%"%I%l%9$r%"%/%;%9(B
  • $B%(%i!<(B(EFAULT$BEy(B) $B$G%W%m%;%9$r=*N;$5$;$k(B

$B"!(Bx86 do_page_fault()

arch/x86/mm/fault.c
 948:	dotraplinkage void __kprobes
 949:	do_page_fault(struct pt_regs *regs, unsigned long error_code)
 950:	{
 951:	        struct vm_area_struct *vma;
 952:	        struct task_struct *tsk;
 953:	        unsigned long address;
 954:	        struct mm_struct *mm;
 955:	        int write;
 956:	        int fault;
 957:	
 958:	        tsk = current;
 959:	        mm = tsk->mm;
...
 962:	        address = read_cr2();
...
1077:	        vma = find_vma(mm, address);
1078:	        if (unlikely(!vma)) {
1079:	                bad_area(regs, error_code, address);
1080:	                return;
1081:	        }
1082:	        if (likely(vma->vm_start <= address))
1083:	                goto good_area;
1084:	        if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) {
1085:	                bad_area(regs, error_code, address);
1086:	                return;
1087:	        }
...
1100:	        if (unlikely(expand_stack(vma, address))) {
1101:	                bad_area(regs, error_code, address);
1102:	                return;
1103:	        }
...
1109:	good_area:
1110:	        write = error_code & PF_WRITE;
1111:	
1112:	        if (unlikely(access_error(error_code, write, vma))) {
1113:	                bad_area_access_error(regs, error_code, address);
1114:	                return;
1115:	        }
..
1122:	        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
...
1142:	}

• $B%O!<%I%&%'%"0MB8$N%3!<%I!#(Barch/x86 $B$N2<$K$"$k!#(B
• tsk $B$K8=:_ mm $B$K8=:_ Linux $B%+!<%M%k$K=P$F$/$k(B likely() $B$d(B unlikely() $B$O!"9bB.2=$N$?$a$N(B $B%R%s%H$J$N$G!"0UL#$rGD0.$9$k;~$K$OB8:_$7$J$$$b$N$H$7$F$h$$!#(B
• x86 $B$N(B cr2 (control register 2) $B$K!"%Z!<%8!&%U%)!<%k%H$,@8$8$?(B $B%"%I%l%9$,4^$^$l$F$$$k!#(B
• find_vma() $B$G!"(Bvm_area_struct $B$rC5$9!#8+$D$+$i$J$1$l$P!"(B bad_area()$B!#(Bfind_vma() $B$O!"%-%c%C%7%c$d(B red-black tree $B$r;H$C$F9bB.$K(B vm_area_struct $B$rC5$9!#(B
• $BIaDL$O!"(Bvma->vm_start $B$h$j$b(B address $B$OBg$-$$!#(B
• $B%9%?%C%/$K$D$$$F$O!"(Bvm_flags $B$N(B VM_GROWSDOWN $B%S%C%H$,(B $BN)$C$F$$$k!#(B
• $B$=$N>l9g$O!"%9%?%C%/$N(B vma $B$r<+F0E*$K3HD%$9$k!#(B
• good_area $B$N>l9g!"=q$-9~$_$K4X$9$k%"%/%;%95v2D$,$"$k$+$r%A%'%C%/$9$k!#(B
• handle_mm_fault() $B$r8F$S!"%Z!<%8%F!<%V%k$r:n$k!#(B

$B"!(Bhandle_mm_fault()

mm/memory.c
3198:	int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
3199:	                unsigned long address, unsigned int flags)
3200:	{
3201:	        pgd_t *pgd;
3202:	        pud_t *pud;
3203:	        pmd_t *pmd;
3204:	        pte_t *pte;
...
3216:	        pgd = pgd_offset(mm, address);
3217:	        pud = pud_alloc(mm, pgd, address);
3218:	        if (!pud)
3219:	                return VM_FAULT_OOM;
3220:	        pmd = pmd_alloc(mm, pud, address);
3221:	        if (!pmd)
3222:	                return VM_FAULT_OOM;
3223:	        pte = pte_alloc_map(mm, pmd, address);
3224:	        if (!pte)
3225:	                return VM_FAULT_OOM;
3226:	
3227:	        return handle_pte_fault(mm, vma, address, pte, pmd, flags);
3228:	}

• $B%Z!<%8%F!<%V%k$r(B pgd, pud, pmd, pte $B$N=g$K3d$jEv$F$F$$$/!#(B
• $B:G8e$K(B pte $B$N(B1$B%(%s%H%j$r(B handle_pte_fault() $B$G:n$k!#(B

$B"!(Bhandle_pte_fault()

3142:	static inline int handle_pte_fault(struct mm_struct *mm,
3143:	                struct vm_area_struct *vma, unsigned long address,
3144:	                pte_t *pte, pmd_t *pmd, unsigned int flags)
3145:	{
3146:	        pte_t entry;
...
3149:	        entry = *pte;
...
3151:	                if (pte_none(entry)) {
3152:	                        if (vma->vm_ops) {
3153:	                                if (likely(vma->vm_ops->fault))
3154:	                                        return do_linear_fault(mm, vma, address,
3155:	                                                pte, pmd, flags, entry);
3156:	                        }
3157:	                        return do_anonymous_page(mm, vma, address,
3158:	                                                 pte, pmd, flags);
3159:	                }
3160:	                if (pte_file(entry))
3161:	                        return do_nonlinear_fault(mm, vma, address,
3162:	                                        pte, pmd, flags, entry);
3163:	                return do_swap_page(mm, vma, address,
3164:	                                        pte, pmd, flags, entry);
...
3193:	}

• pte $B$,$^$C$5$i(B($B=i$a$F%"%/%;%9$5$l$?(B)
  • vma->vm_ops->fault $B$H$$$&4X?t$,$"$l$P!"(B do_linear_fault() $B$G=hM}$9$k!#(B
  • $BL5$1$l$P!"(Bdo_anonymous_page() $B$G=hM}!#(B 0 $B$G=i4|2=$5$l$?%Z!<%8$r3d$jEv$F$k!#(B
• pte $B$,$^$C$5$i$G$O$J$$(B
  • do_swap_page() $B$G%Z!<%8%$%s!#(B $B%G%#%9%/$+$i#1%Z!<%8FI$_=P$9!#(B

$B"#%/%$%:(B5 $B%a%b%j4IM}!"%"%I%l%96u4V!"%Z!<%8%F!<%V%k(B

$B!zLdBj(B(501) /proc/PID/maps

$B!zLdBj(B(502) 1$BCJ$N%Z!<%8%F!<%V%k(B

$B!zLdBj(B(503) 2$BCJ$N%Z!<%8%F!<%V%k(B

• 1$BCJL\(B: 31..22$B%S%C%H(B ($B>e0L(B10$B%S%C%H(B)
• 2$BCJL\(B: 21..12$B%S%C%H(B
• $B%*%U%;%C%H(B: $B2<0L(B12$B%S%C%H(B (11..0$B%S%C%H(B)