内存管理 ---slab机制 分配对象

从一个缓存中分配对象总是遵循下面的原则：

1.本地高速缓存中是否有空闲对象，如果有的话则从其中获取对象，
2.如果本地高速缓存中没有对象，则从kmem_list3中的slab链表中寻找空闲对象并填充到本地高速缓存再分配；
3.如果所有的slab中都没有空闲对象了，那么就要创建新的slab,再分配 。


 

来自：http://blog.csdn.net/vanbreaker/article/details/7671211   

 Linux内核从slab中分配内存空间由kmalloc()或kmem_cache_alloc()函数实现。

kmalloc()->__kmalloc()->__do_kmalloc()；

/** * __do_kmalloc - allocate memory * @size: how many bytes of memory are required. * @flags: the type of memory to allocate (see kmalloc). * @caller: function caller for debug tracking of the caller */static __always_inline void *__do_kmalloc(size_t size, gfp_t flags,  void *caller){struct kmem_cache *cachep;void *ret;/* If you want to save a few bytes .text space: replace * __ with kmem_. * Then kmalloc uses the uninlined functions instead of the inline * functions. */   /*查找指定大小的通用cache，关于sizes数组，在前面     的初始化中就已经分析过了*/  cachep = __find_general_cachep(size, flags);if (unlikely(ZERO_OR_NULL_PTR(cachep)))return cachep;ret = __cache_alloc(cachep, flags, caller); /*实际的分配工作*/ trace_kmalloc((unsigned long) caller, ret,      size, cachep->size, flags);return ret;}

最后调用实际的分配工作：__do_cache_alloc()->__cache_alloc()->____cache_alloc();

static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags){void *objp;struct array_cache *ac;bool force_refill = false;check_irq_off();ac = cpu_cache_get(cachep); /* 获得本CPU的local cache */  if (likely(ac->avail)) {/* 如果local cache中有可用的空闲对象 */  ac->touched = 1;<span style="white-space:pre"> /* 从local cache的entry数组中提取最后面的空闲对象 */  </span>objp = ac_get_obj(cachep, ac, flags, false); /* * Allow for the possibility all avail objects are not allowed * by the current flags */if (objp) {STATS_INC_ALLOCHIT(cachep);goto out;}force_refill = true;  //标志位 是否需要refill}STATS_INC_ALLOCMISS(cachep); /* 从slab三链中提取空闲对象填充到local cache中 */  objp = cache_alloc_refill(cachep, flags, force_refill);/* * the 'ac' may be updated by cache_alloc_refill(), * and kmemleak_erase() requires its correct value. */ /* cache_alloc_refill的cache_grow打开了中断，local cache指针可能发生了变化，需要重新获得ac = cpu_cache_get(cachep);out:/* * To avoid a false negative, if an object that is in one of the * per-CPU caches is leaked, we need to make sure kmemleak doesn't * treat the array pointers as a reference to the object. */if (objp)kmemleak_erase(&ac->entry[ac->avail]);/* 分配出去的对象，其entry指针指向空 */  return objp;}

static inline void *ac_get_obj(struct kmem_cache *cachep,struct array_cache *ac, gfp_t flags, bool force_refill){void *objp;if (unlikely(sk_memalloc_socks()))objp = __ac_get_obj(cachep, ac, flags, force_refill);else  <span style="white-space:pre"> /*先将avail的值减1，这样avail对应的空闲对象是最热的，即最近释放出来的，           更有可能驻留在CPU高速缓存中*/  </span>objp = ac->entry[--ac->avail];return objp;}

核心：

tatic void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags,bool force_refill){int batchcount;struct kmem_list3 *l3;struct array_cache *ac;int node;check_irq_off();node = numa_mem_id(); /* 获得本内存节点，UMA只有一个节点 */  if (unlikely(force_refill))goto force_grow;retry:ac = cpu_cache_get(cachep);batchcount = ac->batchcount; /*获取批量转移的数目*/  if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {/* * If there was little recent activity on this cache, then * perform only a partial refill.  Otherwise we could generate * refill bouncing. */   /* 最近未使用过此local cache，没有必要添加过多的对象          ，添加的数目为默认的限定值 */  batchcount = BATCHREFILL_LIMIT;}l3 = cachep->nodelists[node];/*获取kmem_list3*/  BUG_ON(ac->avail > 0 || !l3);spin_lock(&l3->list_lock);/* See if we can refill from the shared array */<span style="white-space:pre"> /* shared local cache用于多核系统中，为所有cpu共享     ，如果有共享本地高速缓存     ，那么首先从shared local cache中批量搬运空闲对象到local cache中     。通过shared local cache使填充工作变得简单。*/  </span>if (l3->shared && transfer_objects(ac, l3->shared, batchcount)) {l3->shared->touched = 1;goto alloc_done;}<span style="white-space:pre">  /* 如果没有shared local cache，或是其中没有空闲的对象     ，从slab链表中分配 */  </span>while (batchcount > 0) {struct list_head *entry;struct slab *slabp;/* Get slab alloc is to come from. */<span style="white-space:pre">/*扫描slab链表，先从partial链表开始，如果整个partial链表都无法找到batchcount个空闲对象，        </span>    <span style="white-space:pre"> 再扫描free链表*/ </span>entry = l3->slabs_partial.next;if (entry == &l3->slabs_partial) { /*entry回到表头说明partial链表已经扫描完毕，开始扫描free链表*/ l3->free_touched = 1; /* 表示刚刚访问了slab空链表 */  entry = l3->slabs_free.next;if (entry == &l3->slabs_free)/* 空slab链表也为空，必须增加slab了 */  goto must_grow;}slabp = list_entry(entry, struct slab, list);check_slabp(cachep, slabp);check_spinlock_acquired(cachep);/* * The slab was either on partial or free list so * there must be at least one object available for * allocation. */BUG_ON(slabp->inuse >= cachep->num);<span style="white-space:pre">  /*如果slabp中还存在空闲对象并且还需要继续填充对象到本地高速缓存*/  </span>while (slabp->inuse < cachep->num && batchcount--) {STATS_INC_ALLOCED(cachep);STATS_INC_ACTIVE(cachep);STATS_SET_HIGH(cachep);<span style="white-space:pre"> /*填充的本质就是用ac后面的void*数组元素指向一个空闲对象</span><span style="white-space:pre"> ac->entry[ac->avail++] = slab_get_obj(cachep, slabp, node); </span><span style="white-space:pre"> */  </span>ac_put_obj(cachep, ac, slab_get_obj(cachep, slabp,node));}check_slabp(cachep, slabp);/* move slabp to correct slabp list: */list_del(&slabp->list);if (slabp->free == BUFCTL_END) /*free等于BUFCTL_END表示空闲对象已耗尽，将slab插入full链表*/  list_add(&slabp->list, &l3->slabs_full);elselist_add(&slabp->list, &l3->slabs_partial);}must_grow:<span style="white-space:pre"> /* 前面从slab链表中添加avail个空闲对象到local cache中     ，更新slab链表的空闲对象数 */ </span>l3->free_objects -= ac->avail;alloc_done:spin_unlock(&l3->list_lock);if (unlikely(!ac->avail)) { /* local cache中仍没有可用的空闲对象，说明slab                              三链中也没有空闲对象，需要创建新的空slab了 */ int x;force_grow:x = cache_grow(cachep, flags | GFP_THISNODE, node, NULL); /* 创建一个空slab */  /* cache_grow can reenable interrupts, then ac could change. */ac = cpu_cache_get(cachep);node = numa_mem_id();/* no objects in sight? abort */if (!x && (ac->avail == 0 || force_refill))return NULL;if (!ac->avail)/* objects refilled by interrupt? */goto retry;}ac->touched = 1;return ac_get_obj(cachep, ac, flags, force_refill); /* 返回local cache中最后一个空闲对象的虚拟地址 objp = ac->entry[--ac->avail];*/  }

辅助函数：

/* * Transfer objects in one arraycache to another. * Locking must be handled by the caller. * * Return the number of entries transferred. */static int transfer_objects(struct array_cache *to,struct array_cache *from, unsigned int max){/* Figure out how many entries to transfer */int nr = min(min(from->avail, max), to->limit - to->avail);if (!nr)return 0;/*拷贝*/memcpy(to->entry + to->avail, from->entry + from->avail -nr,sizeof(void *) *nr);/*两边数据更新*/from->avail -= nr;to->avail += nr;to->touched = 1;return nr;}

/*从slab中提取一个空闲对象*/static void *slab_get_obj(struct kmem_cache *cachep, struct slab *slabp,int nodeid){/* 获得一个空闲的对象，free是本slab中第一个空闲对象的索引 */void *objp = index_to_obj(cachep, slabp, slabp->free);kmem_bufctl_t next; /* 更新在用对象计数 */slabp->inuse++; /* 获得下一个空闲对象的索引 */next = slab_bufctl(slabp)[slabp->free];#if DEBUGslab_bufctl(slabp)[slabp->free] = BUFCTL_FREE;WARN_ON(slabp->nodeid != nodeid);#endif/* free指向下一个空闲的对象 */slabp->free = next;return objp;}

static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab, unsigned int idx){/* s_mem是slab中第一个对象的起始地址，buffer_size是每个对象的大小，这里根据对象索引计算对象的地址 */return slab->s_mem + cache->buffer_size * idx;}

static inline kmem_bufctl_t *slab_bufctl(struct slab *slabp){return (kmem_bufctl_t *) (slabp + 1);}

static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep){return cachep->array[smp_processor_id()];}

对于cache_grow 扩容 以后分析；