Understanding Copy‑On‑Write in the Linux Kernel Using Linux 0.11 Source Code

The article introduces the copy‑on‑write (COW) principle in Linux kernels, using the simple educational OS Linux 0.11 as a concrete example to explore the underlying source code.

Reserve Knowledge : It first reviews the 32‑bit paging structures—page‑directory entries (PDE) and page‑table entries (PTE)—showing their layout (bits for present, read/write, user/supervisor, and the high‑order address bits). Images of the Intel Volume‑3 figures and tables illustrate the fields.

In Linux 0.11 the initial page‑table setup marks pages as present, writable, and user‑accessible (bits set to 111 ). The relevant assembly snippet from head.s is:

setup_paging:
   ...
   movl $pg0+7,_pg_dir      /* set present bit/user r/w */
   movl $pg1+7,_pg_dir+4   /* -------- " " -------- */
   movl $pg2+7,_pg_dir+8   /* -------- " " -------- */
   movl $pg3+7,_pg_dir+12  /* -------- " " -------- */
   movl $pg3+4092,%edi
   movl $0xfff007,%eax      /* 16 MiB‑4096+7 (r/w user,p) */
   std
1: stosl
   ...

The Essence of COW : When fork() creates a new process, the child initially shares the parent’s pages. The kernel marks those pages read‑only; only when a write occurs does a page‑fault fire, prompting the kernel to allocate a private copy for the writing process.

The article shows the memory‑layout diagrams before and after fork() , emphasizing that only the page tables are copied initially, while the actual physical pages remain shared.

Key Code Paths :

1. copy_page_tables duplicates the parent’s page tables and clears the write‑enable bit:

int copy_page_tables(...){
    // source and destination page tables are identical
    this_page = *from_page_table;
    // make both tables read‑only
    this_page &= ~2;
    *from_page_table = this_page;
    ...
}

2. The page‑fault handler decides between a write‑protect fault and a non‑present fault:

void do_page_fault(..., unsigned long error_code){
    if (error_code & 1)
        do_wp_page(error_code, address, current, user_esp);
    else
        do_no_page(error_code, address, current, user_esp);
}

3. do_wp_page and un_wp_page implement the actual copy‑on‑write logic. If the page is referenced only once, the kernel simply restores the write bit; otherwise it allocates a new page, updates the page‑table entry, and copies the contents:

void do_wp_page(unsigned long error_code, unsigned long address){
    // compute pointer to the page‑table entry for the faulting address
    un_wp_page((unsigned long *)(((address>>10)&0xffc) + (0xfffff000 & *((unsigned long *)((address>>20)&0xffc)))));
}

void un_wp_page(unsigned long *table_entry){
    unsigned long old_page, new_page;
    old_page = 0xfffff000 & *table_entry;
    if (mem_map[MAP_NR(old_page)] == 1) {
        *table_entry |= 2;          // make writable
        invalidate();
        return;
    }
    new_page = get_free_page();
    mem_map[MAP_NR(old_page)]--;
    *table_entry = new_page | 7;    // present, writable, user
    invalidate();
    copy_page(old_page, new_page);
}

#define invalidate() \
    __asm__("movl %eax,%cr3"::"a"(0))

These snippets demonstrate how the kernel uses the page‑fault (#0x14) interrupt to trigger COW, updating page‑table entries and copying pages only when necessary, thereby achieving efficient memory sharing.

Finally, the article notes that the same mechanism also supports demand‑paging (loading pages from disk) via the do_no_page path, which is beyond the scope of this discussion.