linux内存管理之kmalloc

   这里只说物理内存管理 linux内核的，看了很多讲解的内存的东西，但是自己总结的时候总感觉无从下手，这里就从实际物理内存分配接口开始吧。

Kmalloc  它分配连续的物理内存空间 ，它不负责把分配的内存空间清零，它能分配多大的呢？并且它只能分配ZONE_NORMAL的不能分配dma和high里的，也就是只分配低端内存.一般情况下内存被分为三个zone：NORMAL、DMA、HIGH.

这个函数是建立在slab分配器的基础上的,通过cache 而cache有通过slab 分配obj 。
在开始分析kmalloc函数之前，我们需要说明一下linux内核物理内存的分配函数API：
__get_free_pages它会调用alloc_pages，它的特点是不能从HIGHMEM分配内存，分配2的幂个连续物理页面。它有简化模式（只分配一page）
__get_free_page,而get_zeroed_page接口分配的页面内容对应填充为0. 从dma分配可以调用__get_dma_pages(它本质也是调用__get_free_pages）
 那么终极接口alloc_pages它可以从任何zone里申请内存，当然前提设置对应的flags.
参考内核：linux3.18.13  
参考书籍:《linux内核设计与实现》《linux设备驱动程序》《深入理解linux设备驱动内核机制》
下面我们就说说kmalloc：（关于分配时候的flags这里不讨论，具体可以参考资料）
我们先看头文件

#include 

而关于它的具体实现我们看slab.h中

点击(此处)折叠或打开

1. #ifdef CONFIG_SLUB
   
2. #include linux/slub_def.h>
   
3. #elif defined(CONFIG_SLOB)
   
4. #include linux/slob_def.h>
   
5. #else
   
6. #include linux/slab_def.h>
   
7. #endif

一般系统默认#include 

点击(此处)折叠或打开

1. static __always_inline void *kmalloc(size_t size, gfp_t flags)
   
2. {
   
3.     struct kmem_cache *cachep;
   
4.     void *ret;
   
5. 
   
6.     if (__builtin_constant_p(size)) {
   
7.         int i = 0;
   
8. 
   
9.         if (!size)
   
10.             return ZERO_SIZE_PTR;
    
11. 
    
12. #define CACHE(x) \
    
13.         if (size = x) \
    
14.             goto found; \
    
15.         else \
    
16.             i++;
    
17. #include linux/kmalloc_sizes.h> //这里查询申请的size在哪个范围 从32乘2递增。I每次加1.
    
18. #undef CACHE
    
19.         return NULL;
    
20. found:
    
21. #ifdef CONFIG_ZONE_DMA
    
22.         if (flags & GFP_DMA)
    
23.             cachep = malloc_sizes[i].cs_dmacachep; //很明显如果定义了dma，并且设置了dma标志则优先从dma cache里申请。malloc_sizes的初始化在slab.c里。可以具体分析一下。
    
24.         else
    
25. #endif
    
26.             cachep = malloc_sizes[i].cs_cachep; //从指定的cache链表分配内存，不浪费空间。
    
27. 
    
28.         ret = kmem_cache_alloc_trace(cachep, flags, size);
    
29. 
    
30.         return ret;
    
31.     }
    
32.     return __kmalloc(size, flags);
    
33. }

这里可以补充下代码关于 kmalloc_sizes . h

点击(此处)折叠或打开

1. #if (PAGE_SIZE == 4096)
   
2.     CACHE(32)
   
3. #endif
   
4.     CACHE(64)
   
5. #if L1_CACHE_BYTES 64
   
6.     CACHE(96)
   
7. #endif
   
8.     CACHE(128)
   
9. #if L1_CACHE_BYTES 128
   
10.     CACHE(192)
    
11. #endif
    
12.     CACHE(256)
    
13.     CACHE(512)
    
14.     CACHE(1024)
    
15.     CACHE(2048)
    
16.     CACHE(4096)
    
17.     CACHE(8192)
    
18.     CACHE(16384)
    
19.     CACHE(32768)
    
20.     CACHE(65536)
    
21.     CACHE(131072)
    
22. #if KMALLOC_MAX_SIZE >= 262144
    
23.     CACHE(262144)
    
24. #endif
    
25. #if KMALLOC_MAX_SIZE >= 524288
    
26.     CACHE(524288)
    
27. #endif
    
28. #if KMALLOC_MAX_SIZE >= 1048576
    
29.     CACHE(1048576)
    
30. #endif
    
31. #if KMALLOC_MAX_SIZE >= 2097152
    
32.     CACHE(2097152)
    
33. #endif
    
34. #if KMALLOC_MAX_SIZE >= 4194304
    
35.     CACHE(4194304)
    
36. #endif
    
37. #if KMALLOC_MAX_SIZE >= 8388608
    
38.     CACHE(8388608)
    
39. #endif
    
40. #if KMALLOC_MAX_SIZE >= 16777216
    
41.     CACHE(16777216)
    
42. #endif
    
43. #if KMALLOC_MAX_SIZE >= 33554432
    
44.     CACHE(33554432)
    
45. #endif

我们看到函数开头需要说明一下：
__builtin_constant_p 是编译器gcc内置函数，用于判断一个值是否为编译时常量，如果是常数，函数返回1 ，否则返回0。此内置函数的典型用法是在宏中用于手动编译时优化显然如果size为常数 则用__kmalloc(size, flags);申请内存.
它查询需要分配的内存在哪个系统cache然后调用

点击(此处)折叠或打开

1. #ifdef CONFIG_TRACING
   
2. extern void *kmem_cache_alloc_trace(struct kmem_cache *, gfp_t, size_t);
   
3. #else
   
4. static __always_inline void *
   
5. kmem_cache_alloc_trace(struct kmem_cache *cachep, gfp_t flags, size_t size)
   
6. {
   
7.     return kmem_cache_alloc(cachep, flags);
   
8. }
   
9. #endif

我们看具体代码：

点击(此处)折叠或打开

1. /**
   
2.  * kmem_cache_alloc - Allocate an object
   
3.  * @cachep: The cache to allocate from.
   
4.  * @flags: See kmalloc().
   
5.  *
   
6.  * Allocate an object from this cache. The flags are only relevant
   
7.  * if the cache has no available objects.
   
8.  */
   
9. void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
   
10. {
    
11.     void *ret = slab_alloc(cachep, flags, _RET_IP_);
    
12. 
    
13.     trace_kmem_cache_alloc(_RET_IP_, ret,                    // 跟踪调试会用到
    
14.              cachep->object_size, cachep->size, flags);
    
15. 
    
16.     return ret;
    
17. }

它实际的分配是slab_alloc：

点击(此处)折叠或打开

1. static __always_inline void *
   
2. slab_alloc(struct kmem_cache *cachep, gfp_t flags, unsigned long caller)
   
3. {
   
4.     unsigned long save_flags;
   
5.     void *objp;
   
6. 
   
7.     flags &= gfp_allowed_mask;   //  说明在gfp.h中 ，如下
   

   点击(此处)折叠或打开

   1. /*
      
   2.  * gfp_allowed_mask is set to GFP_BOOT_MASK during early boot to restrict what
      
   3.  * GFP flags are used before interrupts are enabled. Once interrupts are
      
   4.  * enabled, it is set to __GFP_BITS_MASK while the system is running. During
      
   5.  * hibernation, it is used by PM to avoid I/O during memory allocation while
      
   6.  * devices are suspended.
      
   7.  */
      
   8. extern gfp_t gfp_allowed_mask;
   
   
   
8. 
   
9.     lockdep_trace_alloc(flags);  // 调试用
   
10. 
    
11.     if (slab_should_failslab(cachep, flags))
    
12.         return NULL;
    
13. 
    
14.     cachep = memcg_kmem_get_cache(cachep, flags);
    
15. 
    
16.     cache_alloc_debugcheck_before(cachep, flags);
    
17.     local_irq_save(save_flags);
    
18.     objp = __do_cache_alloc(cachep, flags);
    
19.     local_irq_restore(save_flags);
    
20.     objp = cache_alloc_debugcheck_after(cachep, flags, objp, caller);
    
21.     kmemleak_alloc_recursive(objp, cachep->object_size, 1, cachep->flags,
    
22.                  flags);
    
23.     prefetchw(objp);
    
24. 
    
25.     if (likely(objp))
    
26.         kmemcheck_slab_alloc(cachep, flags, objp, cachep->object_size);
    
27. 
    
28.     if (unlikely((flags & __GFP_ZERO) && objp))
    
29.         memset(objp, 0, cachep->object_size);
    
30. 
    
31.     return objp;
    
32. }

它调用objp = __do_cache_alloc(cachep, flags); 除了检查一些标志等继续调用

____cache_alloc(cachep, flags);

它是一个统一的接口 （有检测numa和uma ，linux默认是uma 除非指定了numa）

点击(此处)折叠或打开

1. static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
   
2. {
   
3.     void *objp;
   
4.     struct array_cache *ac;
   
5.     bool force_refill = false;
   
6. 
   
7.     check_irq_off();
   
8. 
   
9.     ac = cpu_cache_get(cachep);
   
10.     if (likely(ac->avail)) {
    
11.         ac->touched = 1;
    
12.         objp = ac_get_obj(cachep, ac, flags, false);
    
13. 
    
14.         /*
    
15.          * Allow for the possibility all avail objects are not allowed
    
16.          * by the current flags
    
17.          */
    
18.         if (objp) {
    
19.             STATS_INC_ALLOCHIT(cachep);
    
20.             goto out;
    
21.         }
    
22.         force_refill = true;
    
23.     }
    
24. 
    
25.     STATS_INC_ALLOCMISS(cachep);
    
26.     objp = cache_alloc_refill(cachep, flags, force_refill);
    
27.     /*
    
28.      * the 'ac' may be updated by cache_alloc_refill(),
    
29.      * and kmemleak_erase() requires its correct value.
    
30.      */
    
31.     ac = cpu_cache_get(cachep);
    
32. 
    
33. out:
    
34.     /*
    
35.      * To avoid a false negative, if an object that is in one of the
    
36.      * per-CPU caches is leaked, we need to make sure kmemleak doesn't
    
37.      * treat the array pointers as a reference to the object.
    
38.      */
    
39.     if (objp)
    
40.         kmemleak_erase(&ac->entry[ac->avail]);
    
41.     return objp;
    
42. }

这里我们假定是第一次使用分配内存，那么根据在kmem_cache_init中的malloc_sizes[]的初始化，在kmalloc的时候返回的kmalloc_cache指针指向的cache中用到这样个函数：

点击(此处)折叠或打开

1. static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
   
2. {
   
3.     if (slab_state >= FULL)
   
4.         return enable_cpucache(cachep, gfp);
   
5. 
   
6.     if (slab_state == DOWN) {
   
7.         /*
   
8.          * Note: Creation of first cache (kmem_cache).
   
9.          * The setup_list3s is taken care
   
10.          * of by the caller of __kmem_cache_create
    
11.          */
    
12.         cachep->array[smp_processor_id()] = &initarray_generic.cache;
    
13.         slab_state = PARTIAL;
    
14.     } else if (slab_state == PARTIAL) {
    
15.         /*
    
16.          * Note: the second kmem_cache_create must create the cache
    
17.          * that's used by kmalloc(24), otherwise the creation of
    
18.          * further caches will BUG().
    
19.          */
    
20.         cachep->array[smp_processor_id()] = &initarray_generic.cache;
    
21. 
    
22.         /*
    
23.          * If the cache that's used by kmalloc(sizeof(kmem_list3)) is
    
24.          * the second cache, then we need to set up all its list3s,
    
25.          * otherwise the creation of further caches will BUG().
    
26.          */
    
27.         set_up_list3s(cachep, SIZE_AC);
    
28.         if (INDEX_AC == INDEX_L3)
    
29.             slab_state = PARTIAL_L3;
    
30.         else
    
31.             slab_state = PARTIAL_ARRAYCACHE;
    
32.     } else {
    
33.         /* Remaining boot caches */
    
34.         cachep->array[smp_processor_id()] =
    
35.             kmalloc(sizeof(struct arraycache_init), gfp);
    
36. 
    
37.         if (slab_state == PARTIAL_ARRAYCACHE) {
    
38.             set_up_list3s(cachep, SIZE_L3);
    
39.             slab_state = PARTIAL_L3;
    
40.         } else {
    
41.             int node;
    
42.             for_each_online_node(node) {
    
43.                 cachep->nodelists[node] =
    
44.                  kmalloc_node(sizeof(struct kmem_list3),
    
45.                         gfp, node);
    
46.                 BUG_ON(!cachep->nodelists[node]);
    
47.                 kmem_list3_init(cachep->nodelists[node]);
    
48.             }
    
49.         }
    
50.     }
    
51.     cachep->nodelists[numa_mem_id()]->next_reap =
    
52.             jiffies + REAPTIMEOUT_LIST3 +
    
53.             ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
    
54. 
    
55.     cpu_cache_get(cachep)->avail = 0;
    
56.     cpu_cache_get(cachep)->limit = BOOT_CPUCACHE_ENTRIES;   // 1
    
57.     cpu_cache_get(cachep)->batchcount = 1;
    
58.     cpu_cache_get(cachep)->touched = 0;
    
59.     cachep->batchcount = 1;
    
60.     cachep->limit = BOOT_CPUCACHE_ENTRIES;
    
61.     return 0;
    
62. }

我们知道不论array被赋了什么值，最后都要初始化avail等值.
所以如果array不可用，那么就会调用；当然如果array可用那么直接返回申请的obj的内存指针.

点击(此处)折叠或打开

1. static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags,
   
2.                             bool force_refill)
   
3. {
   
4.     int batchcount;
   
5.     struct kmem_list3 *l3;
   
6.     struct array_cache *ac;
   
7.     int node;
   
8. 
   
9.     check_irq_off();
   
10.     node = numa_mem_id();
    
11.     if (unlikely(force_refill))
    
12.         goto force_grow;
    
13. retry:
    
14.     ac = cpu_cache_get(cachep);
    
15.     batchcount = ac->batchcount;
    
16.     if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
    
17.         /*
    
18.          * If there was little recent activity on this cache, then
    
19.          * perform only a partial refill. Otherwise we could generate
    
20.          * refill bouncing.
    
21.          */
    
22.         batchcount = BATCHREFILL_LIMIT;
    
23.     }
    
24.     l3 = cachep->nodelists[node];
    
25. 
    
26.     BUG_ON(ac->avail > 0 || !l3);
    
27.     spin_lock(&l3->list_lock);
    
28. 
    
29.     /* See if we can refill from the shared array */
    
30.     if (l3->shared && transfer_objects(ac, l3->shared, batchcount)) {
    
31.         l3->shared->touched = 1;
    
32.         goto alloc_done;
    
33.     }
    
34. 
    
35.     while (batchcount > 0) {
    
36.         struct list_head *entry;
    
37.         struct slab *slabp;
    
38.         /* Get slab alloc is to come from. */
    
39.         entry = l3->slabs_partial.next;
    
40.         if (entry == &l3->slabs_partial) {
    
41.             l3->free_touched = 1;
    
42.             entry = l3->slabs_free.next;
    
43.             if (entry == &l3->slabs_free)
    
44.                 goto must_grow;
    
45.         }
    
46. 
    
47.         slabp = list_entry(entry, struct slab, list);
    
48.         check_slabp(cachep, slabp);
    
49.         check_spinlock_acquired(cachep);
    
50. 
    
51.         /*
    
52.          * The slab was either on partial or free list so
    
53.          * there must be at least one object available for
    
54.          * allocation.
    
55.          */
    
56.         BUG_ON(slabp->inuse >= cachep->num);
    
57. 
    
58.         while (slabp->inuse cachep->num && batchcount--) {
    
59.             STATS_INC_ALLOCED(cachep);
    
60.             STATS_INC_ACTIVE(cachep);
    
61.             STATS_SET_HIGH(cachep);
    
62. 
    
63.             ac_put_obj(cachep, ac, slab_get_obj(cachep, slabp,
    
64.                                     node));
    
65.         }
    
66.         check_slabp(cachep, slabp);
    
67. 
    
68.         /* move slabp to correct slabp list: */
    
69.         list_del(&slabp->list);
    
70.         if (slabp->free == BUFCTL_END)
    
71.             list_add(&slabp->list, &l3->slabs_full);
    
72.         else
    
73.             list_add(&slabp->list, &l3->slabs_partial);
    
74.     }
    
75. 
    
76. must_grow:
    
77.     l3->free_objects -= ac->avail;
    
78. alloc_done:
    
79.     spin_unlock(&l3->list_lock);
    
80. 
    
81.     if (unlikely(!ac->avail)) {
    
82.         int x;
    
83. force_grow:
    
84.         x = cache_grow(cachep, flags | GFP_THISNODE, node, NULL);   //  grow成功返回 1 
    
85. 
    
86.         /* cache_grow can reenable interrupts, then ac could change. */
    
87.         ac = cpu_cache_get(cachep);
    
88.         node = numa_mem_id();
    
89. 
    
90.         /* no objects in sight? abort */
    
91.         if (!x && (ac->avail == 0 || force_refill))
    
92.             return NULL;
    
93. 
    
94.         if (!ac->avail)        /* objects refilled by interrupt? */
    
95.             goto retry;
    
96.     }
    
97.     ac->touched = 1;
    
98. 
    
99.     return ac_get_obj(cachep, ac, flags, force_refill);
    
100. }

由于第一次使用nodelist上slab链表都为空，所以must_grow
它调用cache_grow，这个函数首先计算了slab着色处理。然后调用kmem_getpages申请page，大小根据cache->gfporder，它返回申请pages的虚拟地址.

点击(此处)折叠或打开

1. /*
   
2.  * Grow (by 1) the number of slabs within a cache. This is called by
   
3.  * kmem_cache_alloc() when there are no active objs left in a cache.
   
4.  */
   
5. static int cache_grow(struct kmem_cache *cachep,
   
6.         gfp_t flags, int nodeid, void *objp)
   
7. {
   
8.     struct slab *slabp;
   
9.     size_t offset;
   
10.     gfp_t local_flags;
    
11.     struct kmem_list3 *l3;
    
12. 
    
13.     /*
    
14.      * Be lazy and only check for valid flags here, keeping it out of the
    
15.      * critical path in kmem_cache_alloc().
    
16.      */
    
17.     BUG_ON(flags & GFP_SLAB_BUG_MASK);
    
18.     local_flags = flags & (GFP_CONSTRAINT_MASK|GFP_RECLAIM_MASK);
    
19. 
    
20.     /* Take the l3 list lock to change the colour_next on this node */
    
21.     check_irq_off();
    
22.     l3 = cachep->nodelists[nodeid];
    
23.     spin_lock(&l3->list_lock);
    
24. 
    
25.     /* Get colour for the slab, and cal the next value. */
    
26.     offset = l3->colour_next; // default 0
    
27.     l3->colour_next++;
    
28.     if (l3->colour_next >= cachep->colour)
    
29.         l3->colour_next = 0;
    
30.     spin_unlock(&l3->list_lock);
    
31. 
    
32.     offset *= cachep->colour_off; // first time ,offset is 0 ;
    
33. 
    
34.     if (local_flags & __GFP_WAIT)
    
35.         local_irq_enable();
    
36. 
    
37.     /*
    
38.      * The test for missing atomic flag is performed here, rather than
    
39.      * the more obvious place, simply to reduce the critical path length
    
40.      * in kmem_cache_alloc(). If a caller is seriously mis-behaving they
    
41.      * will eventually be caught here (where it matters).
    
42.      */
    
43.     kmem_flagcheck(cachep, flags);
    
44. 
    
45.     /*
    
46.      * Get mem for the objs. Attempt to allocate a physical page from
    
47.      * 'nodeid'.
    
48.      */
    
49.     if (!objp)
    
50.         objp = kmem_getpages(cachep, local_flags, nodeid);
    
51.     if (!objp)
    
52.         goto failed;
    
53. 
    
54.     /* Get slab management. */
    
55.     slabp = alloc_slabmgmt(cachep, objp, offset,
    
56.             local_flags & ~GFP_CONSTRAINT_MASK, nodeid);
    
57.     if (!slabp)
    
58.         goto opps1;
    
59. 
    
60.     slab_map_pages(cachep, slabp, objp);
    
61. 
    
62.     cache_init_objs(cachep, slabp);
    
63. 
    
64.     if (local_flags & __GFP_WAIT)
    
65.         local_irq_disable();
    
66.     check_irq_off();
    
67.     spin_lock(&l3->list_lock);
    
68. 
    
69.     /* Make slab active. */
    
70.     list_add_tail(&slabp->list, &(l3->slabs_free));  //  把新申请的slab添加到nodelist的slabs_free链表。
    
71.     STATS_INC_GROWN(cachep);
    
72.     l3->free_objects += cachep->num;                    //初始化可用的对象即每个slab可以包含的obj数目
    
73.     spin_unlock(&l3->list_lock);
    
74.     return 1;
    
75. opps1:
    
76.     kmem_freepages(cachep, objp);
    
77. failed:
    
78.     if (local_flags & __GFP_WAIT)
    
79.         local_irq_disable();
    
80.     return 0;
    
81. }

而关于slab着色跟硬件缓冲有关，为了尽量避免缓存冲突不命中问题，提高效率（cache_line问题）。可以参考《深入理解计算机系统》。

具体操作见：

点击(此处)折叠或打开

1. /*
   
2.  * Get the memory for a slab management obj.
   
3.  * For a slab cache when the slab descriptor is off-slab, slab descriptors
   
4.  * always come from malloc_sizes caches. The slab descriptor cannot
   
5.  * come from the same cache which is getting created because,
   
6.  * when we are searching for an appropriate cache for these
   
7.  * descriptors in kmem_cache_create, we search through the malloc_sizes array.
   
8.  * If we are creating a malloc_sizes cache here it would not be visible to
   
9.  * kmem_find_general_cachep till the initialization is complete.
   
10.  * Hence we cannot have slabp_cache same as the original cache.
    
11.  */
    
12. static struct slab *alloc_slabmgmt(struct kmem_cache *cachep, void *objp,
    
13.                  int colour_off, gfp_t local_flags,
    
14.                  int nodeid)
    
15. {
    
16.     struct slab *slabp;
    
17. 
    
18.     if (OFF_SLAB(cachep)) {     
19.    //  关于OFF_SLAB问题 可以看代码：
    
20.         
    

    点击(此处)折叠或打开

    1. CFLGS_OFF_SLAB 在__kmem_cache_create
       
    2.     /*
       
    3.      * Determine if the slab management is 'on' or 'off' slab.
       
    4.      * (bootstrapping cannot cope with offslab caches so don't do
       
    5.      * it too early on. Always use on-slab management when
       
    6.      * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak)
       
    7.      */
       
    8.     if ((size >= (PAGE_SIZE >> 3)) && !slab_early_init &&
       
    9.      !(flags & SLAB_NOLEAKTRACE))
       
    10.         /*
        
    11.          * Size is large, assume best to place the slab management obj
        
    12.          * off-slab (should allow better packing of objs).
        
    13.          */
        
    14.         flags |= CFLGS_OFF_SLAB;
    
    
    
21.             
    
22.         /* Slab management obj is off-slab. */
    
23.         slabp = kmem_cache_alloc_node(cachep->slabp_cache,
    
24.                      local_flags, nodeid);
    
25.         /*
    
26.          * If the first object in the slab is leaked (it's allocated
    
27.          * but no one has a reference to it), we want to make sure
    
28.          * kmemleak does not treat the ->s_mem pointer as a reference
    
29.          * to the object. Otherwise we will not report the leak.
    
30.          */
    
31.         kmemleak_scan_area(&slabp->list, sizeof(struct list_head),
    
32.                  local_flags);
    
33.         if (!slabp)
    
34.             return NULL;
    
35.     } else {
    
36.         slabp = objp + colour_off;    //   在__kmem_cache_create中cachep->colour_off = cache_line_size();
37.                                        // 在cache.h中#define cache_line_size() L1_CACHE_BYTES；  一般为32B 大小.
    
38.                                         // cachep->colour = left_over / cachep->colour_off;
    
39.         colour_off += cachep->slab_size;
    
40.     }
    
41.     slabp->inuse = 0;                    // num of objs active in slab
    
42.     slabp->colouroff = colour_off;   //第一个obj相对page地址的偏移
    
43.     slabp->s_mem = objp + colour_off;  //第一个obj的地址
    
44.     slabp->nodeid = nodeid;
    
45.     slabp->free = 0;                    
    
46.     return slabp;
    
47. }

我们看看另外一个很重要的操作：

点击(此处)折叠或打开

1. static void cache_init_objs(struct kmem_cache *cachep,
   
2.              struct slab *slabp)
   
3. {
   
4.     int i;
   
5. 
   
6.     for (i = 0; i cachep->num; i++) {
   
7.         void *objp = index_to_obj(cachep, slabp, i);
   
8. #if DEBUG
   
9.         /* need to poison the objs? */
   
10.         if (cachep->flags & SLAB_POISON)
    
11.             poison_obj(cachep, objp, POISON_FREE);
    
12.         if (cachep->flags & SLAB_STORE_USER)
    
13.             *dbg_userword(cachep, objp) = NULL;
    
14. 
    
15.         if (cachep->flags & SLAB_RED_ZONE) {
    
16.             *dbg_redzone1(cachep, objp) = RED_INACTIVE;
    
17.             *dbg_redzone2(cachep, objp) = RED_INACTIVE;
    
18.         }
    
19.         /*
    
20.          * Constructors are not allowed to allocate memory from the same
    
21.          * cache which they are a constructor for. Otherwise, deadlock.
    
22.          * They must also be threaded.
    
23.          */
    
24.         if (cachep->ctor && !(cachep->flags & SLAB_POISON))
    
25.             cachep->ctor(objp + obj_offset(cachep));
    
26. 
    
27.         if (cachep->flags & SLAB_RED_ZONE) {
    
28.             if (*dbg_redzone2(cachep, objp) != RED_INACTIVE)
    
29.                 slab_error(cachep, "constructor overwrote the"
    
30.                      " end of an object");
    
31.             if (*dbg_redzone1(cachep, objp) != RED_INACTIVE)
    
32.                 slab_error(cachep, "constructor overwrote the"
    
33.                      " start of an object");
    
34.         }
    
35.         if ((cachep->size % PAGE_SIZE) == 0 &&
    
36.              OFF_SLAB(cachep) && cachep->flags & SLAB_POISON)
    
37.             kernel_map_pages(virt_to_page(objp),
    
38.                      cachep->size / PAGE_SIZE, 0);
    
39. #else
    
40.         if (cachep->ctor)
    
41.             cachep->ctor(objp); //  根据构造函数初始化对象
    
42. #endif
    
43.         slab_bufctl(slabp)[i] = i + 1;  //  init  bufctl数组 1、2、3、4 .....  最后一个设置成为BUFCTL_END
    
44.     }
    
45.     slab_bufctl(slabp)[i - 1] = BUFCTL_END;
    
46. }