内存管理---slab机制 销毁对象

 Linux内核中将对象释放到slab中上层所用函数为kfree()或kmem_cache_free()。两个函数都会调用__cache_free()函数。

缓存回收对象基于以下原则

1.本地高速缓存的空间还可以容纳空闲对象，则直接将对象放回本地高速缓存

2.本地高速缓存的空间已满，则按batchcount的值将对象从本地高速缓存转移到slab中，转移是基于先进先出的原则的，也就是转移entry数组最前面的batchcount个空闲对象，因为这些对象在数组中存在的时间相对较长，不太可能仍然驻留在CPU高速缓存中

1，当本地CPU cache中空闲对象数小于规定上限时，只需将对象放入本地CPU cache中；

2，当local cache中对象过多（大于等于规定上限），需要释放一批对象到slab三链中。由函数cache_flusharray()实现。

1）如果三链中存在共享本地cache，那么首先选择释放到共享本地cache中，能释放多少是多少；

2）如果没有shared local cache，释放对象到slab三链中，实现函数为free_block()。对于free_block()函数，当三链中的空闲对象数过多时，销毁此cache。不然，添加此slab到空闲链表。因为在分配的时候我们看到将slab结构从cache链表中脱离了，在这里，根据page描述符的lru找到slab并将它添加到三链的空闲链表中。

* * Release an obj back to its cache. If the obj has a constructed state, it must * be in this state _before_ it is released.  Called with disabled ints. */static inline void __cache_free(struct kmem_cache *cachep, void *objp,    void *caller){struct array_cache *ac = cpu_cache_get(cachep); /* 获得本CPU的local cache */ check_irq_off();kmemleak_free_recursive(objp, cachep->flags);objp = cache_free_debugcheck(cachep, objp, caller);kmemcheck_slab_free(cachep, objp, cachep->object_size);/* * Skip calling cache_free_alien() when the platform is not numa. * This will avoid cache misses that happen while accessing slabp (which * is per page memory  reference) to get nodeid. Instead use a global * variable to skip the call, which is mostly likely to be present in * the cache. */if (nr_online_nodes > 1 && cache_free_alien(cachep, objp))return;/*如果本地高速缓存中的空闲对象小于空闲对象上限，则直接用entry中的元素记录对象的地址*/  if (likely(ac->avail < ac->limit)) {STATS_INC_FREEHIT(cachep);} else {STATS_INC_FREEMISS(cachep);/*否则将本地高速缓存中的空闲对象批量转移到slab中*/  cache_flusharray(cachep, ac);}ac_put_obj(cachep, ac, objp);//实际上执行ac->entry[ac->avail++] = objp;}

/*local cache中对象过多，需要释放一批对象到slab三链中。*/

static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac){int batchcount;struct kmem_list3 *l3;int node = numa_node_id();batchcount = ac->batchcount; /* 每次释放batchcount个对象 */  #if DEBUGBUG_ON(!batchcount || batchcount > ac->avail);#endifcheck_irq_off();l3 = cachep->nodelists[node];spin_lock(&l3->list_lock);if (l3->shared) {/*如果开启了共享本地高速缓存*//*获取共享的array_cache*/struct array_cache *shared_array = l3->shared; /* 如果存在shared local cache，将对象释放到其中 */ /*计算共享本地高速缓存还可容纳的空闲对象数*/int max = shared_array->limit - shared_array->avail;if (max) {if (batchcount > max)batchcount = max;/*将batchcount个对象移到共享本地高速缓存中*/memcpy(&(shared_array->entry[shared_array->avail]),       ac->entry, sizeof(void *) * batchcount);shared_array->avail += batchcount;goto free_done;}}/*将本地高速缓存的前batchcount个对象放回slab*/ /* 无shared local cache，释放对象到slab三链中 */  free_block(cachep, ac->entry, batchcount, node);free_done:#if STATS{int i = 0;struct list_head *p;p = l3->slabs_free.next;while (p != &(l3->slabs_free)) {struct slab *slabp;slabp = list_entry(p, struct slab, list);BUG_ON(slabp->inuse);i++;p = p->next;}STATS_SET_FREEABLE(cachep, i);}#endifspin_unlock(&l3->list_lock);ac->avail -= batchcount;/*刷新本地高速缓存的avail值*//* local cache前面有batchcount个空位，将后面的对象依次前移batchcount位 */  memmove(ac->entry, &(ac->entry[batchcount]), sizeof(void *)*ac->avail);}

static void free_block(struct kmem_cache *cachep, void **objpp, int nr_objects,       int node){int i;struct kmem_list3 *l3;for (i = 0; i < nr_objects; i++) {void *objp = objpp[i];struct slab *slabp;/*通过对象的虚拟地址得到slab描述符*/<span style="white-space:pre">/* 通过虚拟地址得到page，再通过page得到slab */ </span>slabp = virt_to_slab(objp);/*获取kmem_list3*/l3 = cachep->nodelists[node];/*先将slab从所在链表中删除*/list_del(&slabp->list);check_spinlock_acquired_node(cachep, node);check_slabp(cachep, slabp);/*将一个对象放回slab上*/slab_put_obj(cachep, slabp, objp, node);STATS_DEC_ACTIVE(cachep);/*kmem_list3中的空闲对象数加1*/l3->free_objects++;check_slabp(cachep, slabp);/* fixup slab chains *//*slab的对象全部空闲*/if (slabp->inuse == 0) {/*如果空闲对象数大于了空闲对象上限*/if (l3->free_objects > l3->free_limit) {/*总空闲对象数减去一个slab的对象数*/l3->free_objects -= cachep->num;/* No need to drop any previously held * lock here, even if we have a off-slab slab * descriptor it is guaranteed to come from * a different cache, refer to comments before * alloc_slabmgmt. */ /*销毁该slab*/slab_destroy(cachep, slabp);} else {/*将该slab添加到free链表*/list_add(&slabp->list, &l3->slabs_free);}} else {/*否则添加到partial链表*//* Unconditionally move a slab to the end of the * partial list on free - maximum time for the * other objects to be freed, too. */list_add_tail(&slabp->list, &l3->slabs_partial);}}}

对象释放到其slab中

static void slab_put_obj(struct kmem_cache *cachep, struct slab *slabp,void *objp, int nodeid){ /* 获得对象在kmem_bufctl_t数组中的索引 */unsigned int objnr = obj_to_index(cachep, slabp, objp);#if DEBUG/* Verify that the slab belongs to the intended node */WARN_ON(slabp->nodeid != nodeid);if (slab_bufctl(slabp)[objnr] + 1 <= SLAB_LIMIT + 1) {printk(KERN_ERR "slab: double free detected in cache ""'%s', objp %p\n", cachep->name, objp);BUG();}#endif/*这两步相当于静态链表的插入操作*//* 指向slab中原来的第一个空闲对象 */slab_bufctl(slabp)[objnr] = slabp->free;/* 释放的对象作为第一个空闲对象 */slabp->free = objnr;/* 已分配对象数减一 */slabp->inuse--;}

/* 通过虚拟地址得到page，再通过page得到slab */static inline struct slab *virt_to_slab(const void *obj){struct page *page = virt_to_head_page(obj);return page_get_slab(page);}