static vm_fault_t handle_pte_fault(struct vm_fault *vmf)
{

    ...
	if (!vmf->pte)
		return do_pte_missing(vmf);

	if (!pte_present(vmf->orig_pte))
		return do_swap_page(vmf);

	if (pte_protnone(vmf->orig_pte) && vma_is_accessible(vmf->vma))
		return do_numa_page(vmf);

	if (unlikely(!pte_same(ptep_get(vmf->pte), entry))) {
		update_mmu_tlb(vmf->vma, vmf->address, vmf->pte);
		goto unlock;
	}
	if (vmf->flags & (FAULT_FLAG_WRITE|FAULT_FLAG_UNSHARE)) {
		if (!pte_write(entry))
			return do_wp_page(vmf);
		else if (likely(vmf->flags & FAULT_FLAG_WRITE))
			entry = pte_mkdirty(entry);
	}

    ...
}

do_pte_missing
->do_anonymous_page
--> vmf->flags & FAULT_FLAG_WRITE //入股只读分配零页
--> alloc_anon_folio //分配对应的物理内存，内存管理使用 folio 管理系统进行分配
--->...
---->__alloc_pages_slowpath

//https://github.com/bminor/glibc/blob/master/nptl/pthread_create.c#L621
__pthread_create_2_1 
    //https://github.com/bminor/glibc/blob/master/nptl/pthread_create.c#L297
    >create_thread 
        >__clone_internal (&args, &start_thread, pd);
            >__clone3
                //https://github.com/bminor/glibc/blob/master/sysdeps/unix/sysv/linux/aarch64/arch-syscall.h#L20
                >#define __NR_clone3 435
const int clone_flags = (CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SYSVSEM
			   | CLONE_SIGHAND | CLONE_THREAD
			   | CLONE_SETTLS | CLONE_PARENT_SETTID
			   | CLONE_CHILD_CLEARTID
			   | 0);

//kernel：
#define __NR_clone3 435
__SYSCALL(__NR_clone3, sys_clone3)

SYSCALL_DEFINE2(clone3, struct clone_args __user *, uargs, size_t, size)
{
    ...
	return kernel_clone(&kargs);
}
--->copy_process
---->copy_mm // 创建线程时，拷贝对应的MMU页表

	if (clone_flags & CLONE_VM) {
		mmget(oldmm);
		mm = oldmm;
	} else {
		mm = dup_mm(tsk, current->mm);
		if (!mm)
			return -ENOMEM;
	}

	tsk->mm = mm;
	tsk->active_mm = mm;

//https://elixir.bootlin.com/glibc/glibc-2.40.9000/source/posix/fork.c
__libc_fork
->_Fork //https://elixir.bootlin.com/glibc/glibc-2.40.9000/source/sysdeps/nptl/_Fork.c#L23
-->arch_fork //https://elixir.bootlin.com/glibc/glibc-2.40.9000/source/sysdeps/unix/sysv/linux/arch-fork.h#L35

const int flags = CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD;

//kernel：
...
...
同上面创建线程

//arch/arm64/kernel/head.S
->__HEAD
-->b primary_entry
--->adrp	x1, early_init_stack  //初始化栈、sp指针
--->adrp	x0, init_idmap_pg_dir //创建id_map映射区域，映射范围为 kernel镜像的 text段、data段
---->__cpu_setup //开启MMU

	mov_q	tcr, TCR_T0SZ(IDMAP_VA_BITS) | TCR_T1SZ(VA_BITS_MIN) | TCR_CACHE_FLAGS | \
		     TCR_SHARED | TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
		     TCR_TBI0 | TCR_A1 | TCR_KASAN_SW_FLAGS | TCR_MTE_FLAGS

	mov_q	x0, INIT_SCTLR_EL1_MMU_ON
---->__primary_switch
----->__enable_mmu //mmu貌似有两个开关，再开一个
----->map_kernel //开启MMU后映射kernel的DDR加载区域到虚拟地址








start_kernel // init/main.c
->setup_arch
-->early_fixmap_init   // 初始化恒等映射区
-->early_ioremap_init  // 没啥用
-->setup_machine_fdt   // 映射fdt设备树到虚拟内存
-->paging_init         // 映射swapper_pg_dir

//获取idmap_pg_dir变量（此变量在vmlinux.lds文件中指定）的物理地址
adrp	x0, idmap_pg_dir
//获取__idmap_text_start变量的物理地址
adrp	x3, __idmap_text_start
//进行映射
map_memory x0, x1, x3, x6, x7, x3, x4, x10, x11, x12, x13, x14

adrp	x0, init_pg_dir   // 运行时动态获取init_pg_dir的物理地址
mov_q	x5, KIMAGE_VADDR	// 编译时指定 KIMAGE_VADDR 虚拟地址 0xffff8xxxxxxx
add	x5, x5, x23			
mov	x4, PTRS_PER_PGD
adrp	x6, _end			   // 运行时动态获取init_pg_dir的物理地址
adrp	x3, _text			// 运行时动态获取init_pg_dir的物理地址
sub	x6, x6, x3			// _end - _text
add	x6, x6, x5			// runtime __va(_end)IMAGE_VADDR
map_memory x0, x1, x5, x6, x7, x3, x4, x10, x11, x12, x13, x14

adrp	x1, init_pg_dir
__enable_mmu
	phys_to_ttbr x1, x1
	phys_to_ttbr x2, x2
	msr	ttbr0_el1, x2			// load TTBR0
	offset_ttbr1 x1, x3
	msr	ttbr1_el1, x1			// load TTBR1

//FIXADDR_START = 0xfffffdfffe5fb000
//pgdp = 0xffff800011ce4fd8
//p4dp = 0xffff800011ce4fd8
//pudp = 0xffff800011858ff8
//pmdp = 0xffff800011859f90
//bm_pte = 0xffff80001185a000
void __init early_fixmap_init(void) {
    ...
    pgdp = pgd_offset_k(addr); //获取pgd的虚拟地址, 这里获取到的是swapper_pg_dir的虚拟地址;
    p4dp = p4d_offset(pgdp, addr); //获取p4d的虚拟地址，这里获取到的是: 0xffff800011ce4fd8
    ...
    __p4d_populate(p4dp, __pa_symbol(bm_pud), PUD_TYPE_TABLE);//往p4d中填地址
    ...
    __pud_populate(pudp, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);//往pud中填地址
    ...
    __pmd_populate(pmdp, __pa_symbol(bm_pte), PMD_TYPE_TABLE);//往pmd中填地址
}