kmem

crash> kmem -p

  PAGE    PHYSICAL   MAPPING    INDEX CNT FLAGS
c09d0000  82000000  edc023a0      3000  2 860
c09d0020  82001000  edc025a0         0  2 860
c09d0040  82002000         0        83  1 0
c09d0060  82003000  ede59ba0       2b7  1 20228

_count:CNT
A usage reference counter for the page. If it is set to -1, the corresponding page frame is free
and can be assigned to any process or to the kernel itself. If it is set to a value greater than or
equal to 0, the page frame is assigned to one or more processes or is used to store some
kernel data structures. The page_count( ) function returns the value of the _count field
increased by one, that is, the number of users of the page.

flags:FLAGS
Includes up to 32 flags (see Table 8-2) that describe the status of the page frame. For each
PG_ xyz flag, the kernel defines some macros that manipulate its value. Usually, the PageXyz
macro returns the value of the flag, while the SetPageXyz and ClearPageXyz macro set and
clear the corresponding bit, respectively.

PAGE:
crash> mem_map
mem_map = $3 = (struct page *) 0xc09d0000
crash> page
struct page {
    unsigned long flags;
    struct address_space *mapping;
    struct {
        union {
            unsigned long index;
            void *freelist;
        };
        union {
            unsigned long counters;
            struct {
                union {
                    atomic_t _mapcount;
                    struct {
                        unsigned int inuse : 16;
                        unsigned int objects : 15;
                        unsigned int frozen : 1;
                    };
                };
                atomic_t _count;
            };
        };
    };
    union {
        struct list_head lru;
        struct {
            struct page *next;
            short pages;
            short pobjects;
        };
    };
    union {
        unsigned long private;
        struct kmem_cache *slab;
        struct page *first_page;
    };
}
SIZE: 32

crash> struct page -o
struct page {
   [0] unsigned long flags;
   [4] struct address_space *mapping;
       struct {
           union {
   [8]         unsigned long index;
   [8]         void *freelist;
           };
           union {
  [12]         unsigned long counters;
               struct {
                   union {
  [12]                 atomic_t _mapcount;
                       struct {
  [12]                     unsigned int inuse : 16;
  [12]                     unsigned int objects : 15;
  [12]                     unsigned int frozen : 1;
                       };
                   };
  [16]             atomic_t _count;
               };
           };
       };
       union {
  [20]     struct list_head lru;
           struct {
  [20]         struct page *next;
  [24]         short pages;
  [26]         short pobjects;
           };
       };
       union {
  [28]     unsigned long private;
  [28]     struct kmem_cache *slab;
  [28]     struct page *first_page;
       };
}

SIZE: 32

crash> kmem -s

CACHE    NAME                 OBJSIZE  ALLOCATED     TOTAL  SLABS  SSIZE
ee0004e0 size-16384             16384         20        21     21    16k

crash> kmem_cache
struct kmem_cache {
    unsigned int batchcount;
    unsigned int limit;
    unsigned int shared;
    unsigned int buffer_size;
    u32 reciprocal_buffer_size;
    unsigned int flags;
    unsigned int num;
    unsigned int gfporder;
    gfp_t gfpflags;
    size_t colour;
    unsigned int colour_off;
    struct kmem_cache *slabp_cache;
    unsigned int slab_size;
    unsigned int dflags;
    void (*ctor)(void *);
    const char *name;
    struct list_head next;
    struct kmem_list3 **nodelists;
    struct array_cache *array[2];
}
SIZE: 84

crash> kmem_cache ee0004e0

struct kmem_cache {
  batchcount = 4,
  limit = 8,
  shared = 0,
  buffer_size = 16384,
  reciprocal_buffer_size = 262144,
  flags = 2147753984,
  num = 1,
  gfporder = 2,
  gfpflags = 0,
  colour = 0,
  colour_off = 32,
  slabp_cache = 0xee0000c0,
  slab_size = 32,
  dflags = 0,
  ctor = 0x0,
  name = 0xc0678ded "size-16384",
  next = {
    next = 0xee0004c0,
    prev = 0xee000580
  },
  nodelists = 0xee000534,
  array = {0xee0081a0, 0xee045f20}
}

crash>  kmem_list3

struct kmem_list3 {
    struct list_head slabs_partial;
    struct list_head slabs_full;
    struct list_head slabs_free;
    unsigned long free_objects;
    unsigned int free_limit;
    unsigned int colour_next;
    spinlock_t list_lock;
    struct array_cache *shared;
    struct array_cache **alien;
    unsigned long next_reap;
    int free_touched;
}
SIZE: 60

crash> rd 0xee000534
ee000534:  ee002360

crash> kmem_list3 ee002360
struct kmem_list3 {
  slabs_partial = {
    next = 0xee002360,
    prev = 0xee002360
  },
  slabs_full = {
    next = 0xdc89b6a0,
    prev = 0xee10fdc0
  },
  slabs_free = {
    next = 0xee002370,
    prev = 0xee002370
  },
  free_objects = 0,
  free_limit = 9,
  colour_next = 0,
  list_lock = {
    {
      rlock = {
        raw_lock = {
          lock = 0
        },
        break_lock = 0
      }
    }
  },
  shared = 0x0,
  alien = 0x0,
  next_reap = 134200,
  free_touched = 1
}

crash> slab

struct slab {
    union {
        struct {
            struct list_head list;
            unsigned long colouroff;
            void *s_mem;
            unsigned int inuse;
            kmem_bufctl_t free;
            unsigned short nodeid;
        };
        struct slab_rcu __slab_cover_slab_rcu;
    };
}
SIZE: 28

crash> slab dc89b6a0
struct slab {
  {
    {
      list = {
        next = 0xc2fe5960,
        prev = 0xee002368
      },
      colouroff = 0,
      s_mem = 0xd5fa0000,
      inuse = 1,
      free = 4294967295,
      nodeid = 0
    },
    __slab_cover_slab_rcu = {
      head = {
        next = 0xc2fe5960,
        func = 0xee002368
      },
      cachep = 0x0,
      addr = 0xd5fa0000
    }
  }
}

crash> kmem -S size-16384

CACHE    NAME                 OBJSIZE  ALLOCATED     TOTAL  SLABS  SSIZE
ee0004e0 size-16384             16384         20        21     21    16k

/*1*/
SLAB      MEMORY    TOTAL  ALLOCATED  FREE
dc89b6a0  d5fa0000      1          0     1
FREE / [ALLOCATED]
   d5fa0000  (cpu 0 cache)