kernel hacker修炼之道之内存管理-SLUB(释放SLAB对象kmem_cache_free())

释放SLAB对象kmem_cache_free()

作者：李万鹏

SLUB分配器调用kmem_cache_free()来释放object。

void kmem_cache_free(struct kmem_cache *s, void *x)
{
struct page *page;
/*获得对象所在的slab的第一个物理页*/
page = virt_to_head_page(x);
slab_free(s, page, x, _RET_IP_);
trace_kmem_cache_free(_RET_IP_, x);
}

通过调用virt_to_head_page获得这个slab的第一个物理页的page结构。
static inline struct page *virt_to_head_page(const void *x)
{
struct page *page = virt_to_page(x);
return compound_head(page);
}

static inline struct page *compound_head(struct page *page)
{
if (unlikely(PageTail(page)))
return page->first_page;
return page;
}

static __always_inline void slab_free(struct kmem_cache *s,
struct page *page, void *x, unsigned long addr)
{
void **object = (void *)x;
struct kmem_cache_cpu *c;
#ifdef CONFIG_CMPXCHG_LOCAL
unsigned long tid;
#else
unsigned long flags;
#endif
slab_free_hook(s, x);
#ifndef CONFIG_CMPXCHG_LOCAL
local_irq_save(flags);
#else
redo:
#endif
/*获得cpu local slab*/
c = __this_cpu_ptr(s->cpu_slab);
#ifdef CONFIG_CMPXCHG_LOCAL
tid = c->tid;
barrier();
#endif
if (likely(page == c->page && c->node != NUMA_NO_NODE)) {
set_freepointer(s, object, c->freelist);
#ifdef CONFIG_CMPXCHG_LOCAL
if (unlikely(!irqsafe_cpu_cmpxchg_double(
s->cpu_slab->freelist, s->cpu_slab->tid,
c->freelist, tid,
object, next_tid(tid)))) {
note_cmpxchg_failure("slab_free", s, tid);
goto redo;
}
#else
/*c->freelist指向了下一个空闲对象*/
c->freelist = object;
#endif
stat(s, FREE_FASTPATH);
} else
__slab_free(s, page, x, addr);
#ifndef CONFIG_CMPXCHG_LOCAL
local_irq_restore(flags);
#endif
}

static void __slab_free(struct kmem_cache *s, struct page *page,
void *x, unsigned long addr)
{
void *prior;
void **object = (void *)x;
#ifdef CONFIG_CMPXCHG_LOCAL
unsigned long flags;
local_irq_save(flags);
#endif
slab_lock(page);
stat(s, FREE_SLOWPATH);
if (kmem_cache_debug(s))
goto debug;
checks_ok:
/*保存cpu local slab链表的指针*/
prior = page->freelist;
/*把释放的这个object放到page->freelist链表的头*/
set_freepointer(s, object, prior);
page->freelist = object;
/*减少slab中obejct使用计数*/
page->inuse--;
/*如果slab被冻结，则该slab有可能是其他cpu的local slab，不能被添加到partial slab*/
if (unlikely(PageSlubFrozen(page))) {
stat(s, FREE_FROZEN);
goto out_unlock;
}
/*如果没有正在使用的object，slab为free了*/
if (unlikely(!page->inuse))
goto slab_empty;
/*
* Objects left in the slab. If it was not on the partial list before
* then add it.
*/
/*如果local slab没有空闲对象，此时有了一个空闲对象，加入slabs_partial*/
if (unlikely(!prior)) {
add_partial(get_node(s, page_to_nid(page)), page, 1);
stat(s, FREE_ADD_PARTIAL);
}
out_unlock:
slab_unlock(page);
#ifdef CONFIG_CMPXCHG_LOCAL
local_irq_restore(flags);
#endif
return;
slab_empty:
/*如果prior不为空，也不在local cpu slab上，说明在slabs_partial上，则减少slab的记数；如果prior为空，说明是full，又不是local slab，则只能在slabs_full上，释放一个对象就变成free了，说明原来的这个slab只有一个对象，且是被占用的*/
if (prior) {
/*
* Slab still on the partial list.
*/
remove_partial(s, page);
stat(s, FREE_REMOVE_PARTIAL);
}
slab_unlock(page);
#ifdef CONFIG_CMPXCHG_LOCAL
local_irq_restore(flags);
#endif
stat(s, FREE_SLAB);
/*销毁slab块*/
discard_slab(s, page);
return;
debug:
if (!free_debug_processing(s, page, x, addr))
goto out_unlock;
goto checks_ok;

}
static void remove_partial(struct kmem_cache *s, struct page *page)
{
struct kmem_cache_node *n = get_node(s, page_to_nid(page));
spin_lock(&n->list_lock);
__remove_partial(n, page);
spin_unlock(&n->list_lock);
}

static inline void __remove_partial(struct kmem_cache_node *n,
struct page *page)
{
list_del(&page->lru);
/*节点上slabs_partial中slab的个数减一*/
n->nr_partial--;
}