int main(int argc, char **argv) {
 // 創(chuàng)建內(nèi)存文件
 fd = memfd_create("Server memfd", ...);

 // 為內(nèi)存文件申請 MAP_SHARED 類型的內(nèi)存
 shm = mmap(NULL, shm_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

 // 向共享內(nèi)存中寫入數(shù)據(jù)
 sprintf(shm, "這段內(nèi)容是保存在共享內(nèi)存里的，接收方和發(fā)送方都能根據(jù)自己的fd訪問到這塊內(nèi)容");

 // 把共享內(nèi)存文件的句柄給接收方進程發(fā)送過去
 struct msghdr msgh;
 *((int *) CMSG_DATA(CMSG_FIRSTHDR(&msgh))) = fd;
 sendmsg(conn, &msgh, 0);
 ......
}

int main(int argc, char **argv) {
 // 通過 Unix Domain Socket 連接發(fā)送方
 connect(conn, (struct sockaddr *)&address, sizeof(struct sockaddr_un));

 // 通過連接取出發(fā)送方發(fā)送過來的內(nèi)存文件句柄
 int size = recvmsg(conn, &msgh, 0);
 fd = *((int *) CMSG_DATA(cmsgh));

 // 讀取共享文件中的內(nèi)容
 shm = mmap(NULL, shm_size, PROT_READ, MAP_PRIVATE, fd, 0);
 printf("共享內(nèi)存中的文件內(nèi)容是: %s\n", shm);
 ......
}

// file:mm/memfd.c
SYSCALL_DEFINE2(memfd_create,
  const char __user *, uname,
  unsigned int, flags)
{
 ...
 // 申請一個未使用過的文件句柄
 fd = get_unused_fd_flags((flags & MFD_CLOEXEC) ? O_CLOEXEC : 0);

 // 創(chuàng)建一個共享內(nèi)存的文件
 file = shmem_file_setup(name, 0, VM_NORESERVE);

 fd_install(fd, file);
 return fd;
}

// file:mm/shmem.c
static struct file *__shmem_file_setup(struct vfsmount *mnt, const char *name, ...)
{
 ...
 // 申請一個 inode
 inode = shmem_get_inode(mnt->mnt_sb, NULL, S_IFREG | S_IRWXUGO, 0,
    flags);
 inode->i_flags |= i_flags;
 inode->i_size = size;

 ...
 // 創(chuàng)建一個文件
 res = alloc_file_pseudo(inode, mnt, name, O_RDWR,
    &shmem_file_operations);
 return res;
}

//file:arch/x86/kernel/sys_x86_64.c
SYSCALL_DEFINE6(mmap, unsigned long, addr, ...)
{
 return ksys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
}

SYSCALL_DEFINE6(mmap
-> ksys_mmap_pgoff
---> vm_mmap_pgoff
------> do_mmap_pgoff
--------> do_mmap

//file:mm/mmap.c
unsigned long do_mmap(struct file *file, unsigned long addr,
   unsigned long len, unsigned long prot,
   unsigned long flags, vm_flags_t vm_flags,
   unsigned long pgoff, unsigned long *populate,
   struct list_head *uf)
{
 struct mm_struct * mm = current->mm;
 ...

 // 如果包含 MAP_SHARED，則對要申請的虛擬內(nèi)存設(shè)置一個 VM_SHARED
 switch (flags & MAP_TYPE) {
  case MAP_SHARED:
  case MAP_SHARED_VALIDATE:
   vm_flags |= VM_SHARED | VM_MAYSHARE; 
   ... 
 } 
 ... 

 addr = mmap_region(file, addr, len, vm_flags, pgoff, uf);
 ......
}

//file:mm/mmap.c
unsigned long mmap_region(struct file *file, ...)
{
 struct mm_struct *mm = current->mm;
 ......

 // 申請?zhí)摂M內(nèi)存vma
 vma = vm_area_alloc(mm);

 // vma初始化
 vma->vm_start = addr;
 vma->vm_end = addr + len;
 vma->vm_flags = vm_flags;
 vma->vm_page_prot = vm_get_page_prot(vm_flags);
 vma->vm_pgoff = pgoff;
 ......

 // 加入到進程的虛擬內(nèi)存 vma 鏈表中來
 vma_link(mm, vma, prev, rb_link, rb_parent);
}

static void send_fd(int conn, int fd) {
    struct msghdr msgh;
    struct iovec iov;
    ...

    // 把文件句柄放到消息中來
    *((int *) CMSG_DATA(CMSG_FIRSTHDR(&msgh))) = fd;

    // 發(fā)送出去
    sendmsg(conn, &msgh, 0);
}

//file:net/socket.c
SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
{
 return __sys_sendmsg(fd, msg, flags, true);
}

SYSCALL_DEFINE3(sendmsg, ...)
-> __sys_sendmsg
---> ___sys_sendmsg
-----> ____sys_sendmsg
-------> sock_sendmsg
---------> sock_sendmsg_nosec
-----------> unix_stream_sendmsg

//file:net/unix/af_unix.c 
static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, ...)
{
 // 把文件描述符指向的文件信息復(fù)制到 scm_cookie 中
 struct scm_cookie scm;
 scm_send(sock, msg, &scm, false);

 // 不斷構(gòu)建數(shù)據(jù)包發(fā)送，直到發(fā)送完畢
    while (sent < len) {
     // 申請一塊緩存區(qū)
     skb = sock_alloc_send_pskb(sk, size - data_len, data_len,
        msg->msg_flags & MSG_DONTWAIT, &err,
        get_order(UNIX_SKB_FRAGS_SZ));

     // 拷貝數(shù)據(jù)到 skb
     err = unix_scm_to_skb(&scm, skb, !fds_sent);
     err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, size);
     
     // 直接把 skb 放到對端的接收隊列中
     skb_queue_tail(&other->sk_receive_queue, skb);
  
  //發(fā)送完畢回調(diào)
  other->sk_data_ready(other);
  sent += size;
     ...
    }
}

scm_send
-> __scm_send
---> scm_fp_copy

//file:net/core/scm.c
static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
 ...
 //把每一個要發(fā)送的 fd 對應(yīng)的 file 給找出來
 for (i=0; i< num; i++)
 {
  int fd = fdp[i];
  struct file *file;

  if (fd < 0 || !(file = fget_raw(fd)))
   return -EBADF;
  *fpp++ = file;
  fpl->count++;
 }
}

//file:net/unix/af_unix.c
static int unix_stream_read_generic(struct unix_stream_read_state *state,
        bool freezable)
{
 do {
  // 拿出一個 skb
  last = skb = skb_peek(&sk->sk_receive_queue);
  ...
 }
 ...
 if (state->msg)
  scm_recv(sock, state->msg, &scm, flags);
 return copied ? : err;
}

//file:net/core/scm.c
void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{

 for (i = 0; i < fdmax; i++) {
  err = receive_fd_user(scm->fp->fp[i], cmsg_data + i, o_flags);
  if (err < 0)
   break;
 }
 ...
}

//file:fs/file.c
int __receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)
{
 //申請一個新的文件描述符
 new_fd = get_unused_fd_flags(o_flags);
 ...

 //關(guān)聯(lián)文件
 fd_install(new_fd, get_file(file));
 return new_fd;
}