非专业理解slub

struct kmem_cache {
        /* percpu变量，由于每个cpu分配对象减少cpu直接的竞争 */
        struct kmem_cache_cpu __percpu *cpu_slab;
        /* Used for retrieving partial slabs, etc. */
        slab_flags_t flags;
        /* 部分满slab的最少数量 */
        unsigned long min_partial;
        /* 包含元数据的对象大小 */
        unsigned int size;      /* The size of an object including metadata */
        /* 不包含元数据的对象大小 */
        unsigned int object_size;/* The size of an object without metadata */
        struct reciprocal_value reciprocal_size;
        /* 空闲对象的起始地址+offset就是FP的值，也就是下一个空闲对象的地址 */
        unsigned int offset;    /* Free pointer offset */
#ifdef CONFIG_SLUB_CPU_PARTIAL
        /* Number of per cpu partial objects to keep around */
        unsigned int cpu_partial;
        /* Number of per cpu partial pages to keep around */
        unsigned int cpu_partial_pages;
#endif
        struct kmem_cache_order_objects oo;

        /* Allocation and freeing of slabs */
        struct kmem_cache_order_objects max;
        struct kmem_cache_order_objects min;
        gfp_t allocflags;       /* gfp flags to use on each alloc */
        int refcount;           /* Refcount for slab cache destroy */
        void (*ctor)(void *);
        unsigned int inuse;             /* Offset to metadata */
        unsigned int align;             /* Alignment */
        unsigned int red_left_pad;      /* Left redzone padding size */
        const char *name;       /* Name (only for display!) */
        /* 用于链接到全局链表slab_caches上 */
        struct list_head list;  /* List of slab caches */
#ifdef CONFIG_SYSFS
        struct kobject kobj;    /* For sysfs */
#endif
##ifdef CONFIG_SLAB_FREELIST_HARDENED
        unsigned long random;
#endif

#ifdef CONFIG_NUMA
        /*
         * Defragmentation by allocating from a remote node.
         */
        unsigned int remote_node_defrag_ratio;
#endif

#ifdef CONFIG_SLAB_FREELIST_RANDOM
        unsigned int *random_seq;
#endif

#ifdef CONFIG_KASAN
        struct kasan_cache kasan_info;
#endif

        unsigned int useroffset;        /* Usercopy region offset */
        unsigned int usersize;          /* Usercopy region size */

        /* 对应系统中每个node的部分满slab */
        struct kmem_cache_node *node[MAX_NUMNODES];
};

static struct kmem_cache *kmem_cache_node; ------ mm/slub.c
struct kmem_cache *kmem_cache; ------  mm/slab_common.c

void __init kmem_cache_init(void)
{
        /* 创建两个局部静态变量用来初始化缓存的基础数据结构kmem_cache和kmem_cache_node。它们用__initdata
         * 进行修饰，说明只在内核初始化的时候才有效。
         */
        static __initdata struct kmem_cache boot_kmem_cache,
                boot_kmem_cache_node;
        int node;

        if (debug_guardpage_minorder())
                slub_max_order = 0; 

        /* Print slub debugging pointers without hashing */
        if (__slub_debug_enabled())
                no_hash_pointers_enable(NULL);

        /* 让两个全局变量指向静态局部变量 */
        kmem_cache_node = &boot_kmem_cache_node;
        kmem_cache = &boot_kmem_cache;

        /*
         * Initialize the nodemask for which we will allocate per node
         * structures. Here we don't need taking slab_mutex yet.
         */
        for_each_node_state(node, N_NORMAL_MEMORY)
                node_set(node, slab_nodes);

        /* 先创建kmem_cache_node缓存，因为在下面创建kmem_cache缓存的时候要分配
         * kmem_cache_node实例用来填充node数组。
         * 这里还有一个问题是在创建kmem_cache_node缓存时如何填充该缓存中的node数组呢？
         * 这需要early_kmem_cache_node_alloc()函数来完成，下面会说到。
         */
        create_boot_cache(kmem_cache_node, "kmem_cache_node",
                sizeof(struct kmem_cache_node), SLAB_HWCACHE_ALIGN, 0, 0);

        register_hotmemory_notifier(&slab_memory_callback_nb);

        /* Able to allocate the per node structures */
        /* 设置slab的全局状态，PARTIAL意味着可以从kmem_cache_node缓存中获取对象了。*/
        slab_state = PARTIAL;

        /* 创建kmem_cache缓存。*/
        create_boot_cache(kmem_cache, "kmem_cache",
                        offsetof(struct kmem_cache, node) +
                                nr_node_ids * sizeof(struct kmem_cache_node *),
                       SLAB_HWCACHE_ALIGN, 0, 0);

        /* 此时kmem_cache和kmem_cache_node两个缓存都创建好了，但是它们的数据存储在本地
         * 静态局部变量boot_kmem_cache和boot_kmem_cache_node中。bootstrap()函数从这两个
         * 缓存中分别再动态分配一个实例，然后复制两个静态局部变量的内容到动态分配的实例中。bootstrap()
         * 函数执行完成后两个静态局部变量就被放弃了，还因为它们只是用于初始化的变量，所以必须
         * 被丢弃。
         */
        kmem_cache = bootstrap(&boot_kmem_cache);
        kmem_cache_node = bootstrap(&boot_kmem_cache_node);

        /* Now we can use the kmem_cache to allocate kmalloc slabs */
        /* 这时候可以通过前面分配的kmem_cache和kmem_cache_node两个缓存创建通用缓存了。*/
        setup_kmalloc_cache_index_table();
        create_kmalloc_caches(0);

        /* Setup random freelists for each cache */
        init_freelist_randomization();

        cpuhp_setup_state_nocalls(CPUHP_SLUB_DEAD, "slub:dead", NULL,
                                  slub_cpu_dead);

        /* 宣告slab初始化完成 */
        pr_info("SLUB: HWalign=%d, Order=%u-%u, MinObjects=%u, CPUs=%u, Nodes=%u\n",
                cache_line_size(),
                slub_min_order, slub_max_order, slub_min_objects,
                nr_cpu_ids, nr_node_ids);
}

static void early_kmem_cache_node_alloc(int node)
{
        struct page *page;
        struct kmem_cache_node *n;
                
        BUG_ON(kmem_cache_node->size < sizeof(struct kmem_cache_node));
        
        /* 分配一个新页 */
        page = new_slab(kmem_cache_node, GFP_NOWAIT, node);

        BUG_ON(!page);
        if (page_to_nid(page) != node) {       
                pr_err("SLUB: Unable to allocate memory from node %d\n", node);
                pr_err("SLUB: Allocating a useless per node structure in order to be able to continue\n");
        }

        n = page->freelist;
        BUG_ON(!n);
        /* 打开调试的情况下，初始化slab中的调试内容 */
#ifdef CONFIG_SLUB_DEBUG
        init_object(kmem_cache_node, n, SLUB_RED_ACTIVE);
        init_tracking(kmem_cache_node, n);
#endif  
        n = kasan_slab_alloc(kmem_cache_node, n, GFP_KERNEL, false);
        /* 给page中与slab有关的域赋值 */
        page->freelist = get_freepointer(kmem_cache_node, n);
        page->inuse = 1;
        page->frozen = 0;
        /* 新分配的kmem_cache_node对象复制给全局kmem_cache_node缓存 */
        kmem_cache_node->node[node] = n;
        /* 初始化per-node */
        init_kmem_cache_node(n);
        inc_slabs_node(kmem_cache_node, node, page->objects);

        /*
         * No locks need to be taken here as it has just been
         * initialized and there is no concurrent access.
         */
        /* 如函数名，把新的slab也就是page添加到对应node缓存的部分满链表。这里需要注意的是
         * n是从当前的page中分配出来的一个对象，而现在page属于部分满slab，由缓存对象n进行
         * 管理。
         */
        __add_partial(n, page, DEACTIVATE_TO_HEAD);
}

static struct kmem_cache * __init bootstrap(struct kmem_cache *static_cache)
{
        int node;
        /* 通过create_boot_cache()函数创建的全局kmem_cache缓存可以分配对象了，这里直接分配一个kmem_cache对象 */
        struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT);
        struct kmem_cache_node *n;

        /* 把boot_kmem_cache的内容复制到新分配的kmem_cache对象中 */
        memcpy(s, static_cache, kmem_cache->object_size);

        /*   
         * This runs very early, and only the boot processor is supposed to be
         * up.  Even if it weren't true, IRQs are not up so we couldn't fire
         * IPIs around.
         */
        /* 把per-cpu的slab放回到kmem_cache_node中的部分满链表，因为cpu_slab变量中的page
         * 指向boot_kmem_cache，如果执行list_for_each_entry(p, &n->partial, slab_list)
         * 此时partial中是空的，page没有指向正确的slab缓存。
         */
        __flush_cpu_slab(s, smp_processor_id());
        for_each_kmem_cache_node(s, node, n) { 
                struct page *p;

                list_for_each_entry(p, &n->partial, slab_list)
                        p->slab_cache = s; 

#ifdef CONFIG_SLUB_DEBUG
                list_for_each_entry(p, &n->full, slab_list)
                        p->slab_cache = s; 
#endif
        }

        /* 把kmem_cache缓存添加到全局链表 */
        list_add(&s->list, &slab_caches);
        return s;
}

struct kmem_cache *
kmem_cache_create(const char *name, unsigned int size, unsigned int align,
                slab_flags_t flags, void (*ctor)(void *))

struct kmem_cache *
kmalloc_caches[NR_KMALLOC_TYPES][KMALLOC_SHIFT_HIGH + 1] __ro_after_init =
{ /* initialization for gas warning: ignoring changed section attributes */ };
EXPORT_SYMBOL(kmalloc_caches);

enum kmalloc_cache_type {
        /* 普通的kmalloc */
        KMALLOC_NORMAL = 0,
#ifndef CONFIG_ZONE_DMA
        /* 系统中不包含DMA区时，DMA专用的通用缓存类型 */
        KMALLOC_DMA = KMALLOC_NORMAL,
#endif
#ifndef CONFIG_MEMCG_KMEM
        KMALLOC_CGROUP = KMALLOC_NORMAL,
#else
        /* 用于cgroup记账的kmalloc */
        KMALLOC_CGROUP,
#endif
        /* 可回收的kmalloc */
        KMALLOC_RECLAIM,
#ifdef CONFIG_ZONE_DMA
        /* 系统中有DMA区时，DMA专有的通用缓存类型 */
        KMALLOC_DMA,
#endif
        /* kmalloc的类型数量，也就是kmalloc_caches第一维数组个数 */
        NR_KMALLOC_TYPES
};

#define INIT_KMALLOC_INFO(__size, __short_size)                 \
{                                                               \
        .name[KMALLOC_NORMAL]  = "kmalloc-" #__short_size,      \
        .name[KMALLOC_RECLAIM] = "kmalloc-rcl-" #__short_size,  \
        KMALLOC_CGROUP_NAME(__short_size)                       \
        KMALLOC_DMA_NAME(__short_size)                          \
        .size = __size,                                         \
}

/*
 * kmalloc_info[] is to make slub_debug=,kmalloc-xx option work at boot time.
 * kmalloc_index() supports up to 2^25=32MB, so the final entry of the table is
 * kmalloc-32M.
 */
const struct kmalloc_info_struct kmalloc_info[] __initconst = {
        INIT_KMALLOC_INFO(0, 0),
        INIT_KMALLOC_INFO(96, 96), 
        INIT_KMALLOC_INFO(192, 192),
        INIT_KMALLOC_INFO(8, 8),
        INIT_KMALLOC_INFO(16, 16), 
        INIT_KMALLOC_INFO(32, 32), 
        INIT_KMALLOC_INFO(64, 64), 
        INIT_KMALLOC_INFO(128, 128),
        INIT_KMALLOC_INFO(256, 256),
        INIT_KMALLOC_INFO(512, 512),
        INIT_KMALLOC_INFO(1024, 1k), 
        INIT_KMALLOC_INFO(2048, 2k), 
        INIT_KMALLOC_INFO(4096, 4k), 
        INIT_KMALLOC_INFO(8192, 8k), 
        INIT_KMALLOC_INFO(16384, 16k),
        INIT_KMALLOC_INFO(32768, 32k),
        INIT_KMALLOC_INFO(65536, 64k),
        INIT_KMALLOC_INFO(131072, 128k),
        INIT_KMALLOC_INFO(262144, 256k),
        INIT_KMALLOC_INFO(524288, 512k),
        INIT_KMALLOC_INFO(1048576, 1M), 
        INIT_KMALLOC_INFO(2097152, 2M), 
        INIT_KMALLOC_INFO(4194304, 4M), 
        INIT_KMALLOC_INFO(8388608, 8M), 
        INIT_KMALLOC_INFO(16777216, 16M),
        INIT_KMALLOC_INFO(33554432, 32M) 
};

void kmem_cache_destroy(struct kmem_cache *s);

static int calculate_sizes(struct kmem_cache *s, int forced_order)
{
......        
        if ((flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) ||
            ((flags & SLAB_RED_ZONE) && s->object_size < sizeof(void *)) ||
            s->ctor) {
                /*   
                 * Relocate free pointer after the object if it is not
                 * permitted to overwrite the first word of the object on
                 * kmem_cache_free.
                 *
                 * This is the case if we do RCU, have a constructor or
                 * destructor, are poisoning the objects, or are
                 * redzoning an object smaller than sizeof(void *).
                 *
                 * The assumption that s->offset >= s->inuse means free
                 * pointer is outside of the object is used in the
                 * freeptr_outside_object() function. If that is no
                 * longer true, the function needs to be modified.
                 */
                s->offset = size;
                /* FP放在对象对齐之后的位置 */
                size += sizeof(void *);
        } else {
                /*   
                 * Store freelist pointer near middle of object to keep
                 * it away from the edges of the object to avoid small
                 * sized over/underflows from neighboring allocations.
                 */
                /* FP放在payload接近中间的位置 */
                s->offset = ALIGN_DOWN(s->object_size / 2, sizeof(void *)); 
        }
......
}

static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
{
......
        //分配内存
        slab = alloc_slab_page(s, alloc_gfp, node, oo); 
......
        /* 在打开CONFIG_SLAB_FREELIST_RANDOM的情况下建立随机空闲对象链表 */
        shuffle = shuffle_freelist(s, slab);

        /* 否则从低地址开始依次链接slab中的空闲对象 */
        if (!shuffle) {
                start = fixup_red_left(s, start);
                /* 填充对象中的debug内存空间，例如poison，redzone等 */
                start = setup_object(s, slab, start);
                /* freelist指向第一个空闲对象 */
                slab->freelist = start;
                for (idx = 0, p = start; idx < slab->objects - 1; idx++) {
                        next = p + s->size;
                        /* 填充对象中的debug内存空间，例如poison，redzone等 */
                        next = setup_object(s, slab, next);
                        /* 把当前对象中的FP指向下一个对象的起始位置 */
                        set_freepointer(s, p, next);
                        p = next;
                }
                /* 设置最后一个空闲对象的FP为NULL */
                set_freepointer(s, p, NULL);
        }
......
        return slab;
}

/* 分配slab中的一个空闲对象 */
void *kmem_cache_alloc(struct kmem_cache *s, gfp_t gfpflags);
/* 在指定node上分配slab中的一个空闲对象 */
void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t gfpflags, int node)
/* 释放对象 */
void kmem_cache_free(struct kmem_cache *s, void *x);

/* 分配指定size的通用对象 */
static __always_inline __alloc_size(1) void *kmalloc(size_t size, gfp_t flags)
/* 在指定node上分配指定size的通用对象 */
static __always_inline __alloc_size(1) void *kmalloc_node(size_t size, gfp_t flags, int node)
/* 释放通用对象 */
void kfree(const void *x)

echo 1 > /sys/kernel/slab/dentry/shrink

struct kmem_cache *
__kmem_cache_alias(const char *name, unsigned int size, unsigned int align,
                   slab_flags_t flags, void (*ctor)(void *))

slub_debug=U,anon_vma

~# cat /sys/kernel/debug/slab/anon_vma/alloc_traces 
     19 anon_vma_fork+0x59/0x140 age=221998/221998/221998 pid=136 cpus=0 nodes=0
     76 __anon_vma_prepare+0xdd/0x160 age=6/196463/222989 pid=1-309 cpus=0-3 nodes=0-1

struct slab {
        unsigned long __page_flags;

#if defined(CONFIG_SLAB)

        union {
                struct list_head slab_list;
                struct rcu_head rcu_head;
        };
        struct kmem_cache *slab_cache;
        void *freelist; /* array of free object indexes */
        void *s_mem;    /* first object */
        unsigned int active;

#elif defined(CONFIG_SLUB)

        union {
                struct list_head slab_list;
                struct rcu_head rcu_head;
#ifdef CONFIG_SLUB_CPU_PARTIAL
                struct {
                        struct slab *next;
                        int slabs;      /* Nr of slabs left */
                };
#endif
        };
        struct kmem_cache *slab_cache;
        /* Double-word boundary */
        void *freelist;         /* first free object */
        union {
                unsigned long counters;
                struct {
                        unsigned inuse:16;
                        unsigned objects:15;
                        unsigned frozen:1;
                };
        };
        unsigned int __unused;

#elif defined(CONFIG_SLOB)

        struct list_head slab_list;
        void *__unused_1;
        void *freelist;         /* first free block */
        long units;
        unsigned int __unused_2;

#else
#error "Unexpected slab allocator configured"
#endif

        atomic_t __page_refcount;
#ifdef CONFIG_MEMCG
        unsigned long memcg_data;
#endif
};

                              struct {        /* Partial pages */
                                        struct page *next;             
#ifdef CONFIG_64BIT           
                                        int pages;      /* Nr of pages left */
#else  
                                        short int pages;               
#endif 
                                };  

#ifdef CONFIG_SLUB_CPU_PARTIAL
                struct {
                        struct slab *next;
                        int slabs;      /* Nr of slabs left */
                };
#endif