Linux内核代码分析--slab.c

快来打我* 2022-03-26 15:36 333阅读 0赞

**一、准备知识：**

1.  slab的概念：
    
     *  提出的原因：由于操作系统在运行中会不断产生、使用、释放大量重复的对象，  
        所以对这样的重复对象的生成进行改进可以大大提高效率
     *  最早由sun的工程师提出(1994年)并首先在sunos5.4上应用。
2.  slab算法的基本思路：*分配：  
    if(对相对应的缓存区有空闲位置)  
    使用这个位置，不必再初始化；  
    else\{  
    分配内存；  
    初始化对象；  
    \}  
    释放：  
    在缓存中标记空闲，不做析构；  
    资源不足：  
    寻找未使用的对象空间；  
    按照要求对部分对象做析构；  
    释放对象占用的空间；*
3.  缓存区：每一个对象放在一个缓存区
4.  slab：每个slab块都是页面大小的整数倍（有上限）
5.  着色：字节数按照硬件的要求对齐，可以大大提高硬件缓存的利用率和效率。
6.  slab块的两种管理模式：
    
     *  on-slab 适用于小对象（小于1/8页），slab管理结构存放在slab块中。
     *  off-slab适用于大对象，(大于等于1/8页),对象和slab块的管理结构都由cache\_slabp中分配。  
        根据slab提出者的论文,slab不适合用在大对象上。
7.  slab涉及的重要操作：
    
     *  缓存区创建kmem\_cache\_create与销毁kmem\_cache\_destory
     *  缓存区收缩kmem\_cache\_shrink与扩张kmem\_cache\_grow
     *  对象分配kmem\_cache\_alloc与释放kmem\_cache\_free
     *  内核态内存的申请kmalloc与释放kfree

**二、涉及的重要数据结构：**

1.  typedef unsigned int kmem\_bufctl\_t：slab块中的管理结构
2.  cache\_size表：保存了不同大小(2^n)页面指向cache\_cache的两种指针(dma和非dma)。
3.  链表：最重要的是在管理slab结构中出现的3个链表，分别为完全使用的，部分使用的和完全没用过的slab。
4.  结构体：见下面的代码分析。

**三** **、代码分析：**每个颜色代表的含义： 红色：代码注释； 藕荷色：编译预处理需要处理的内容； **蓝色：**C语言关键字、函数定义； **绿色：**宏定义；黑色：代码； 灰色：输出信息； 深蓝色：我给出的注解。 /\*  
\* linux/mm/slab.c  
\* Written by Mark Hemment, 1996/97.  
\* (markhe@nextd.demon.co.uk)  
\*  
\* kmem\_cache\_destroy() + some cleanup - 1999 Andrea Arcangeli  
\*  
\* Major cleanup, different bufctl logic, per-cpu arrays  
\* (c) 2000 Manfred Spraul  
\* 以上为版权信息   
\* An implementation of the Slab Allocator as described in outline in;  
\* UNIX Internals: The New Frontiers by Uresh Vahalia  
\* Pub: Prentice Hall ISBN 0-13-101908-2  关于slab分配符的一本书   
\* or with a little more detail in;  
\* The Slab Allocator: An Object-Caching Kernel Memory Allocator  
\* Jeff Bonwick (Sun Microsystems).  
\* Presented at: USENIX Summer 1994 Technical Conference    
这个人在1994年USENIX年会上首先提出了关于slab（对象缓存）的概念[www.usenix.org][]   
\*  
\*  
\* The memory is organized in caches, one cache for each object type.  
\* (e.g. inode\_cache, dentry\_cache, buffer\_head, vm\_area\_struct)  
\* Each cache consists out of many slabs (they are small (usually one  
\* page long) and always contiguous), and each slab contains multiple  
\* initialized objects.  
\* 注释大意：在缓存中，每一个类型的对象都对应一种缓存，比如inode\_cache dentry\_cache buffer\_head vm\_area\_struct等等。  
每一个缓存包含了很多slab(通常都很小，可能只有一个页那么大)   
\* Each cache can only support one memory type (GFP\_DMA, GFP\_HIGHMEM,  
\* normal). If you need a special memory type, then must create a new  
\* cache for that memory type.  
\* 注释大意：每个缓存只能支持一种内存的模式(GFP\_DMA, GFP\_HIGHMEM, normal,这些都在include/linux/mm.h中作为宏定义)   
\* In order to reduce fragmentation, the slabs are sorted in 3 groups:  
\* full slabs with 0 free objects  
\* partial slabs  
\* empty slabs with no allocated objects  
\* 注释大意：为了减少碎片，slab被分在3个组：  
全都使用了的slab,没有空闲的对象  
部分slab  
全空的slab,没有分配任何对象   
\* If partial slabs exist, then new allocations come from these slabs,  
\* otherwise from empty slabs or new slabs are allocated.  
\* 注释大意：如果部分slab存在，则从这些slab中分配，如果不存在那就分配空的或者新的slab。   
\* kmem\_cache\_destroy() CAN CRASH if you try to allocate from the cache  
\* during kmem\_cache\_destroy(). The caller must prevent concurrent allocs.  
\* 注释大意：假如在执行kmem\_cache\_destory()的时候，又要求缓存分配，则会出现崩溃。调用的时候一定要注意避免并发申请。   
\* On SMP systems, each cache has a short per-cpu head array, most allocs  
\* and frees go into that array, and if that array overflows, then 1/2  
\* of the entries in the array are given back into the global cache.  
\* This reduces the number of spinlock operations.  
\* 注释大意：在对称多处理器器的系统上，每个缓存都有一个对应CPU的数组，  
几乎所有的分配和释放操作都会进入这个数组。如果这个数组超过限制了，则数组中一般的内容送回到全局缓存中。  
这样可以减少自旋锁的数目。   
\* The c\_cpuarray may not be read with enabled local interrupts.  
\* 注释大意：当本地的中断处在激活的状态下，c\_cpuarry是不可读的   
\* SMP synchronization:  
\* constructors and destructors are called without any locking.  
\* Several members in kmem\_cache\_t and slab\_t never change, they  
\* are accessed without any locking.  
\* The per-cpu arrays are never accessed from the wrong cpu, no locking.  
\* The non-constant members are protected with a per-cache irq spinlock.  
\* 注释大意：多处理器的同步：  
构建和析构都是在不加锁的情况下调用的  
许多kmem\_cache\_t和slab\_t的成员是永远不会改变的，因此不用加锁。  
那些改变的成员通过每一个缓存的中断请求自旋锁来保护。   
\* Further notes from the original documentation:  
\* 注释大意：更多的资料：   
\* 11 April '97. Started multi-threading - markhe  
\* The global cache-chain is protected by the semaphore 'cache\_chain\_sem'.  
\* The sem is only needed when accessing/extending the cache-chain, which  
\* can never happen inside an interrupt (kmem\_cache\_create(),  
\* kmem\_cache\_shrink() and kmem\_cache\_reap()).  
\* 注释大意：1997年4月11日，markhe开始做多线程的支持工作。  
全局缓存链通过互斥锁cache\_chain\_sem来保护  
这个互斥锁只在访问或者扩展缓存链的时候才需要，不会在中断的过程中(kmem\_cache\_create(),kmem\_cache\_shrink(),kmem\_cache\_reap())出现   
\* To prevent kmem\_cache\_shrink() trying to shrink a 'growing' cache (which  
\* maybe be sleeping and therefore not holding the semaphore/lock), the  
\* growing field is used. This also prevents reaping from a cache.  
\* 注释大意：为了避免kmem\_cache\_shrink()试图收缩正在增长的缓存（处在睡眠状态，并且不持有互斥锁或者锁），  
避免收缩正在被使用的增长的区域，(这个互斥锁)还可以避免回收缓存。   
\* At present, each engine can be growing a cache. This should be blocked.  
\* 注释大意：目前，每个部件都可以是一个正在增长的缓存，这是需要在未来做出改变的。   
\*/  
  
\#include <linux/config.h> 编译的时候调用生成的autoconf.h  
\#include <linux/slab.h> 自己的头文件  
\#include <linux/interrupt.h> 中断相关的头文件  
\#include <linux/init.h> 初始化相关的头文件  
\#include <linux/compiler.h> 编译器相关的头文件  
\#include <linux/seq\_file.h> 对顺序文件作操作的头文件  
\#include <asm/uaccess.h> 访问用户态内存操作的头文件  
  
/\*  
\* DEBUG - 1 for kmem\_cache\_create() to honour; SLAB\_DEBUG\_INITIAL,  
\* SLAB\_RED\_ZONE & SLAB\_POISON.  
\* 0 for faster, smaller code (especially in the critical paths).  
\* 注释大意：如果宏DEBUG为1，则kmem\_cache\_create()中执行SLAB\_DEBUG\_INITIAL,SLAB\_RED\_ZONE,SLAB\_POSION相关操作   
\* STATS - 1 to collect stats for /proc/slabinfo.  
\* 0 for faster, smaller code (especially in the critical paths).  
\* 注释大意：如果STATS为1，则从/proc/slabinfo中收集状态信息。为0的时候可以产生更快并且更小的代码(尤其是在重要的步骤中)   
\* FORCED\_DEBUG - 1 enables SLAB\_RED\_ZONE and SLAB\_POISON (if possible)  
\*/ 注释大意：如果FORCED\_DEBUG为1，则激活SLAB\_RED\_ZONE,并在可能的情况下激活SLAB\_POSION  
  
\#ifdef CONFIG\_DEBUG\_SLAB 预编译处理，如果定义了CONFIG\_DEBUG\_SLAB，则将下面三个宏定义为1，否则定义为0  
**\#define DEBUG 1  
\#define STATS 1  
\#define FORCED\_DEBUG 1**  
\#else  
**\#define DEBUG 0  
\#define STATS 0  
\#define FORCED\_DEBUG 0**  
\#endif  
  
/\*  
\* Parameters for kmem\_cache\_reap  
\*/ 注释大意：缓存回收需要的参数  
**\#define REAP\_SCANLEN 10  
\#define REAP\_PERFECT 10**  
  
/\* Shouldn't this be in a header file somewhere? \*/ 注释大意：这个是否应该加入到某个头文件中？  
**\#define BYTES\_PER\_WORD sizeof(void \*)**  
  
/\* Legal flag mask for kmem\_cache\_create(). \*/ 注释大意：kmem\_cache\_create()法定的标志位  
\#if DEBUG 条件编译，如果在调试模式下  
\# define CREATE\_MASK (SLAB\_DEBUG\_INITIAL | SLAB\_RED\_ZONE | \\  
SLAB\_POISON | SLAB\_HWCACHE\_ALIGN | \\  
SLAB\_NO\_REAP | SLAB\_CACHE\_DMA | \\  
SLAB\_MUST\_HWCACHE\_ALIGN)  
\#else 在非调试模式下  
\# define CREATE\_MASK (SLAB\_HWCACHE\_ALIGN | SLAB\_NO\_REAP | \\  
SLAB\_CACHE\_DMA | SLAB\_MUST\_HWCACHE\_ALIGN)  
\#endif  
  
/\*  
\* kmem\_bufctl\_t:  
\*  
\* Bufctl's are used for linking objs within a slab  
\* linked offsets.  
\* 注释大意：Bufctl是用来连接slab中的对象的   
\* This implementation relies on "struct page" for locating the cache &  
\* slab an object belongs to.  
 注释大意：这个调用通过寻找页面结构体来找对向所属的缓存和slab。   
\* This allows the bufctl structure to be small (one int), but limits  
\* the number of objects a slab (not a cache) can contain when off-slab  
\* bufctls are used. The limit is the size of the largest general cache  
\* that does not use off-slab slabs.  
 注释大意：bufctl结构体可以非常的小(比如一个整型），但是在off-slab bufctls使用后  
slab(不是缓存)中的对象数目是有限的。这个限制数是不使用off-slab的slab最大的普通缓存的大小   
\* For 32bit archs with 4 kB pages, is this 56.  
 注释大意：对于32位结构的系统而言，4k的页面，这个限制数目为56。   
\* This is not serious, as it is only for large objects, when it is unwise  
\* to have too many per slab.  
 注释大意：这个限制并不是很严重，因为它只是针对大的对象而言的。  
每个slab中包含很多大的对象是不明智的。   
\* Note: This limit can be raised by introducing a general cache whose size  
\* is less than 512 (PAGE\_SIZE<<3), but greater than 256.  
\*/ 注释大意：这个限制可以通过引入一个小于512(PAGE\_SIZE<<3)但是大于256的普通缓存来提升。  
  
**\#define BUFCTL\_END 0xffffFFFF** 定义宏BUFCTL\_END  
**\#define SLAB\_LIMIT 0xffffFFFE** 定义宏SLAB\_LIMIT typedef unsigned int kmem\_bufctl\_t; 定义类型kem\_bufctl\_t实际上是无符号的整型数  
  
/\* Max number of objs-per-slab for caches which use off-slab slabs.  
\* Needed to avoid a possible looping condition in kmem\_cache\_grow().  
\*/ 注释大意：使用off-slab对象缓存的每个slab中对象的最大数目  
在kmem\_cache\_grow()中需要避免可能出现的自我循环情况  
static unsigned long offslab\_limit; 定义offslab\_limit为一个无符号整型数  
  
/\*  
\* slab\_t  
\*  
\* Manages the objs in a slab. Placed either at the beginning of mem allocated  
\* for a slab, or allocated from an general cache.  
\* Slabs are chained into three list: fully used, partial, fully free slabs.  
\* 注释大意：管理slab中的对象，出现在为slab分配的内存的起始处或者分配的普通缓存。  
slab有3个链，一个是完全使用的，一个是部分使用的，一个是完全空的  
typedef struct slab\_s \{  
struct list\_head list;  
unsigned long colouroff;  
void \*s\_mem; /\* including colour offset \*/ 着色的偏移量  
unsigned int inuse; /\* num of objs active in slab \*/ 在slab中正在被使用的对象数  
kmem\_bufctl\_t free; slab中第一个空闲对象相对s\_mem的偏移量。  
\} slab\_t; slab的链状结构定义。  
  
**\#define slab\_bufctl(slabp) \\  
((kmem\_bufctl\_t \*)(((slab\_t\*)slabp)+1))** 宏定义slab\_bufctl  
  
/\*  
\* cpucache\_t  
\*  
\* Per cpu structures  
\* The limit is stored in the per-cpu structure to reduce the data cache  
\* footprint.  
\*/ 注释大意：每个CPU的结构  
  
typedef struct cpucache\_s  \{  
unsigned int avail; 可用  
unsigned int limit; 限制  
\} cpucache\_t; 定义cpucache结构体  
  
**\#define cc\_entry(cpucache) \\  
((void \*\*)(((cpucache\_t\*)(cpucache))+1))** 宏定义cc\_entry(cpu缓存入口)为一个函数指针  
**\#define cc\_data(cachep) \\  
((cachep)->cpudata\[smp\_processor\_id()\])** 宏定义cc\_data为缓存中cpu的标号  
/\*  
\* kmem\_cache\_t  
\*  
\* manages a cache.  
\*/  
  
**\#define CACHE\_NAMELEN 20 /\* max name length for a slab cache \*/** 宏定义slab中最长的命名为20  
  
struct kmem\_cache\_s  \{  
/\* 1) each alloc & free \*/ 对于每次申请和释放操作，都首先从满的和部分使用的slab开始，然后再是空的slab  
/\* full, partial first, then free \*/  
struct list\_head slabs\_full;  
struct list\_head slabs\_partial;  
struct list\_head slabs\_free; 前面说到的3个不同状态的链  
unsigned int objsize; 对象的大小  
unsigned int flags; /\* constant flags \*/ 属性标志  
属性标志可能存在的几种：  
SLAB\_POISON：标志未初始化的部分，用0xA5(即10100101)填充  
SLAB\_RED\_ZONE: 标志红色区域。红色区域的开始和结束的位置有一个特殊标示来保存这个对象的状态  
RED\_MAGIC1(0x5A2CF071)为活跃状态，RED\_MAGIC2(0x170FC2A5)为不活跃状态  
当分配对象的时色区域变为活跃状态，初始化空闲对象和收回对象空间时变为不活跃。  
红色区域可以防止堆栈溢出(划了边界了，不能越界)。  
SLAB\_NO\_REAP: 即使内存紧缺也不自动收缩这块缓存  
SLAB\_HWCACHE\_ALIGN: 使用硬件对齐  
CFLAGS\_OFF\_SLAB: off-slab模式(对大的对象操作的时候用这个)  
以上变量定义在include/linux/slab.h  
unsigned int num; /\* \# of objs per slab \*/ 每个slab中对象的数目  
spinlock\_t spinlock; 自旋锁  
\#ifdef CONFIG\_SMP 如果定义了SMP  
unsigned int batchcount; 则定义一个批处理计数  
\#endif  
  
/\* 2) slab additions /removals \*/  slab的增加和消除  
/\* order of pgs per slab (2^n) \*/   
unsigned int gfporder; 每个slab中页面数目是2的多少次方  
  
/\* force GFP flags, e.g. GFP\_DMA \*/  
unsigned int gfpflags; 申请页面的时候的优先级，在include/linux/mm.h中定义  
  
size\_t colour; /\* cache colouring range \*/ 着色的范围  
unsigned int colour\_off; /\* colour offset \*/ 着色的偏移量  
unsigned int colour\_next; /\* cache colouring \*/ 下一个着色的  
kmem\_cache\_t \*slabp\_cache; 针对off slab模式指向cache\_slabp缓冲区的指针  
unsigned int growing; 对正在增长的slab设置的标志，以便避免在增长的时候进行了收缩操作。  
unsigned int dflags; /\* dynamic flags \*/ 对动态作的标志  
  
/\* constructor func \*/  
void (\*ctor)(void \*, kmem\_cache\_t \*, unsigned long); 构造函数  
  
/\* de-constructor func \*/  
void (\*dtor)(void \*, kmem\_cache\_t \*, unsigned long); 析构函数  
  
unsigned long failures; 失败标记  
  
/\* 3) cache creation/removal \*/ 缓存增加和消除  
char name\[CACHE\_NAMELEN\]; 缓存区的名字(在/proc/slabinfo中的名字)  
struct list\_head next; 指向下一个缓存结构的指针  
\#ifdef CONFIG\_SMP 编译预处理，如果是对称多处理器  
/\* 4) per-cpu data \*/  
cpucache\_t \*cpudata\[NR\_CPUS\];   
则设置一个指向每一个CPU运行的进程的指针(NR\_CPUS作为宏定义在include/linux/threads.h)  
\#endif  
\#if STATS  编译预处理，如果需要记录状态  
unsigned long num\_active; 活跃的数目  
unsigned long num\_allocations; 分配的数目  
unsigned long high\_mark; 最多活跃的标记  
unsigned long grown; 增长标记  
unsigned long reaped; 回收的标记  
unsigned long errors; 出错的标记  
\#ifdef CONFIG\_SMP  编译预处理，如果定义了对称多处理器  
atomic\_t allochit; 原子计数器分配命中数  
atomic\_t allocmiss; 原子计数器分配未命中数  
atomic\_t freehit; 原子计数器释放命中数  
atomic\_t freemiss; 原子计数器释放未命中数  
\#endif  
\#endif  
\};  
  
/\* internal c\_flags \*/  
**\#define CFLGS\_OFF\_SLAB 0x010000UL /\* slab management in own cache \*/** slab管理自己的缓存  
**\#define CFLGS\_OPTIMIZE 0x020000UL /\* optimized slab lookup \*/**  优化slab查找  
  
/\* c\_dflags (dynamic flags). Need to hold the spinlock to access this member \*/ 动态标志，访问的时候要加一个自旋锁  
**\#define DFLGS\_GROWN 0x000001UL /\* don't reap a recently grown \*/**  
  
**\#define OFF\_SLAB(x) ((x)->flags & CFLGS\_OFF\_SLAB)** 设置off slab模式  
**\#define OPTIMIZE(x) ((x)->flags & CFLGS\_OPTIMIZE)** 设置优化模式  
**\#define GROWN(x) ((x)->dlags & DFLGS\_GROWN)** 设置动态增长标志  
  
\#if STATS  编译预处理，如果察看状态  
**\#define STATS\_INC\_ACTIVE(x) ((x)->num\_active++)** 活跃加1  
**\#define STATS\_DEC\_ACTIVE(x) ((x)->num\_active--)** 活跃减1  
**\#define STATS\_INC\_ALLOCED(x) ((x)->num\_allocations++)** 已经分配加1  
**\#define STATS\_INC\_GROWN(x) ((x)->grown++)** 增长加1  
**\#define STATS\_INC\_REAPED(x) ((x)->reaped++)** 回收加1  
**\#define STATS\_SET\_HIGH(x) do \{ if ((x)->num\_active > (x)->high\_mark) \\  
(x)->high\_mark = (x)->num\_active; \\  
\} while (0)** 设置最多活跃  
**\#define STATS\_INC\_ERR(x) ((x)->errors++)** 错误加1  
\#else  编译预处理，如果不察看状态，那么都是空操作  
**\#define STATS\_INC\_ACTIVE(x) do \{ \} while (0)  
\#define STATS\_DEC\_ACTIVE(x) do \{ \} while (0)  
\#define STATS\_INC\_ALLOCED(x) do \{ \} while (0)  
\#define STATS\_INC\_GROWN(x) do \{ \} while (0)  
\#define STATS\_INC\_REAPED(x) do \{ \} while (0)  
\#define STATS\_SET\_HIGH(x) do \{ \} while (0)  
\#define STATS\_INC\_ERR(x) do \{ \} while (0)**  
\#endif  
  
\#if STATS && defined(CONFIG\_SMP) 编译预处理，如果察看状态并且是对称多处理器  
**\#define STATS\_INC\_ALLOCHIT(x) atomic\_inc(&(x)->allochit)** 原子操作增加分配命中  
**\#define STATS\_INC\_ALLOCMISS(x) atomic\_inc(&(x)->allocmiss)** 原子操作增加分配没有命中  
**\#define STATS\_INC\_FREEHIT(x) atomic\_inc(&(x)->freehit)** 原子操作增加释放命中的   
**\#define STATS\_INC\_FREEMISS(x) atomic\_inc(&(x)->freemiss)** 原子操作增加释放没有命中的  
\#else  编译预处理，如果不察看状态，那么都是空操作  
**\#define STATS\_INC\_ALLOCHIT(x) do \{ \} while (0)  
\#define STATS\_INC\_ALLOCMISS(x) do \{ \} while (0)  
\#define STATS\_INC\_FREEHIT(x) do \{ \} while (0)  
\#define STATS\_INC\_FREEMISS(x) do \{ \} while (0)**  
\#endif  
  
\#if DEBUG 编译预处理，如果设置了查错模式  
/\* Magic nums for obj red zoning.  
\* Placed in the first word before and the first word after an obj.  
\*/ 为红色区域标记的magic number.(前面已经提到过)  
**\#define RED\_MAGIC1 0x5A2CF071UL /\* when obj is active \*/  
\#define RED\_MAGIC2 0x170FC2A5UL /\* when obj is inactive \*/**  
  
/\* ...and for poisoning \*/ 没有初始化标记  
**\#define POISON\_BYTE 0x5a /\* byte value for poisoning \*/** 01011010作为起始标记  
**\#define POISON\_END 0xa5 /\* end-byte of poisoning \*/** 10100101作为结束标记  
**额外的知识：**使用0xA5填充未初始化的区域的原因：  
对于为初始化的区域，也可以考虑用0xFF或0x00填充，但是用0xA5填充可以确保不出现偶然的相邻位的短路：  
例如，D0 D1 D2 D3 ....D7,其中D1-D2出现了短路  
对于用0x00填充而言：D0-D7 00000000  
对于用0xFF填充而言：D0-D7 11111111  
对于用0xA5填充而言：D0-D7 10000101  
可以非常容易的检查出来硬件的失效或者偶然的错误  
参考：Software-Based Memory Testing 1997 by Michael Barr  http://www.netrino.com/Articles/MemoryTesting/paper.html  
\#endif  
  
/\* maximum size of an obj (in 2^order pages) \*/  对象可以占用的最大的页面的2的幂  
**\#define MAX\_OBJ\_ORDER 5 /\* 32 pages \*/** 2的5次方等于32  
  
/\*  
\* Do not go above this order unless 0 objects fit into the slab.  
\*/ 当没有对象适合在slab中的时候，空闲页最多不超过4个页，最少不小于2个页。  
**\#define BREAK\_GFP\_ORDER\_HI 2  
\#define BREAK\_GFP\_ORDER\_LO 1**  
static int slab\_break\_gfp\_order = BREAK\_GFP\_ORDER\_LO; 初始为2个页  
  
/\*  
\* Absolute limit for the gfp order  最多的空闲页的硬上限为2的5次方，即32   
\*/  
**\#define MAX\_GFP\_ORDER 5 /\* 32 pages \*/**  
  
  
/\* Macros for storing/retrieving the cachep and or slab from the  
\* global 'mem\_map'. These are used to find the slab an obj belongs to.  
\* With kfree(), these are used to find the cache which an obj belongs to.  
\*/ 注释大意：下面的这些宏是用来在全局mem\_map(内存映射)中存储/找回cachep或slab。  
这些宏是用来找到对象所属的slab,通过使用kfree()来找到对象所属的缓存。  
**\#define SET\_PAGE\_CACHE(pg,x) ((pg)->list.next = (struct list\_head \*)(x))  
\#define GET\_PAGE\_CACHE(pg) ((kmem\_cache\_t \*)(pg)->list.next)  
\#define SET\_PAGE\_SLAB(pg,x) ((pg)->list.prev = (struct list\_head \*)(x))  
\#define GET\_PAGE\_SLAB(pg) ((slab\_t \*)(pg)->list.prev)**  
上面这些宏是通过对页面的链来做操作实现功能的  
/\* Size description struct for general caches. \*/ 下面的结构体是对于普通缓存的描述  
typedef struct cache\_sizes  \{  
size\_t cs\_size; 缓存的大小  
kmem\_cache\_t \*cs\_cachep; 指向cache\_cache中kmem\_cache\_cache\_s型通用缓存区描述结构  
kmem\_cache\_t \*cs\_dmacachep; 指向cache\_cache中kmem\_cache\_cache\_s型通用缓存区描述结构，处理dma数据块用的  
\} cache\_sizes\_t;  
  
static cache\_sizes\_t cache\_sizes\[\] = \{ 定义缓存的大小  
\#if PAGE\_SIZE == 4096  编译预处理，假如页面的大小为4096  
\{ 32, NULL, NULL\},  
\#endif  
\{ 64, NULL, NULL\},  
\{ 128, NULL, NULL\},  
\{ 256, NULL, NULL\},  
\{ 512, NULL, NULL\},  
\{ 1024, NULL, NULL\},  
\{ 2048, NULL, NULL\},  
\{ 4096, NULL, NULL\},  
\{ 8192, NULL, NULL\},  
\{ 16384, NULL, NULL\},  
\{ 32768, NULL, NULL\},  
\{ 65536, NULL, NULL\},  
\{131072, NULL, NULL\},  
\{ 0, NULL, NULL\}  
\}; 后面的NULL就是为cs\_cachep和cs\_dmacachep准备的  
  
/\* internal cache of cache description objs \*/  内部缓存的缓存描述对象结构体  
static kmem\_cache\_t cache\_cache = \{  
**slabs\_full:** LIST\_HEAD\_INIT(cache\_cache.slabs\_full),  
**slabs\_partial:** LIST\_HEAD\_INIT(cache\_cache.slabs\_partial),  
**slabs\_free:** LIST\_HEAD\_INIT(cache\_cache.slabs\_free), 三种状态的链表  
**objsize:**  sizeof(kmem\_cache\_t), 对象的大小  
 **flags:** SLAB\_NO\_REAP,  设置标志为不自动回收  
**spinlock:** SPIN\_LOCK\_UNLOCKED, 设置自旋锁为不锁定状态  
**colour\_off:** L1\_CACHE\_BYTES, 设定着色范围为1级缓存的大小  
**name:**  "kmem\_cache", 设置名称  
\};  
  
/\* Guard access to the cache-chain. \*/  
static struct semaphore cache\_chain\_sem; 设置互斥锁，以便保护缓存链  
  
/\* Place maintainer for reaping. \*/ 准备回收用的指针  
static kmem\_cache\_t \*clock\_searchp = &cache\_cache;  
  
**\#define cache\_chain (cache\_cache.next)** 宏定义缓存链  
  
\#ifdef CONFIG\_SMP  编译预处理，如果是对称多处理器  
/\*  
\* chicken and egg problem: delay the per-cpu array allocation  
\* until the general caches are up.  
\*/ 注释大意：先有鸡还是先有蛋的问题：等普通缓存就绪之后再分配每个CPU的数组。  
static int g\_cpucache\_up; 定义普通缓存是否就绪的状态变量  
  
**static void enable\_cpucache (kmem\_cache\_t \*cachep)**; 激活cpu缓存  
**static void enable\_all\_cpucaches (void)**; 激活所有cpu缓存  
\#endif  
  
/\* Cal the num objs, wastage, and bytes left over for a given slab size. \*/  
 本函数负责计算对象的数目，浪费的空间，以及在所给的slab中剩余的空间。  
**static void kmem\_cache\_estimate (unsigned long gfporder, size\_t size,  
int flags, size\_t \*left\_over, unsigned int \*num)**  
\{  
int i;  
size\_t wastage = PAGE\_SIZE<<gfporder;  
size\_t extra = 0;  
size\_t base = 0;  
  
if (!(flags & CFLGS\_OFF\_SLAB)) \{  
base = sizeof(slab\_t);  
extra = sizeof(kmem\_bufctl\_t);  
\}  
i = 0;  
while (i\*size + L1\_CACHE\_ALIGN(base+i\*extra) <= wastage)  
i++;  
if (i > 0)  
i--;  
  
if (i > SLAB\_LIMIT)  
i = SLAB\_LIMIT;  
  
\*num = i;  
wastage -= i\*size;  
wastage -= L1\_CACHE\_ALIGN(base+i\*extra);  
\*left\_over = wastage; 计算出来的浪费的空间  
\}  
  
/\* Initialisation - setup the \`cache' cache. \*/  
 本函数负责初始化缓存的"缓存"  
**void \_\_init kmem\_cache\_init(void)**  
\{  
size\_t left\_over;  
  
init\_MUTEX(&cache\_chain\_sem);  
INIT\_LIST\_HEAD(&cache\_chain);  
  
kmem\_cache\_estimate(0, cache\_cache.objsize, 0,  
&left\_over, &cache\_cache.num);  
if (!cache\_cache.num)  
BUG();  
  
cache\_cache.colour = left\_over/cache\_cache.colour\_off;  
cache\_cache.colour\_next = 0;  
\}  
  
  
/\* Initialisation - setup remaining internal and general caches.  
\* Called after the gfp() functions have been enabled, and before smp\_init().  
\*/ 初始化cache\_size表的过程。设置保留的内部和普通缓存。在函数gfp() (GFP, get free page)已经被激活之后再调用，  
并且在smp\_init() (对称多处理器初始化) 执行后再调用。  
**void \_\_init kmem\_cache\_sizes\_init(void)**  
\{  
cache\_sizes\_t \*sizes = cache\_sizes;  
char name\[20\]; **显然有问题的，前面已经定义了CACHE\_NAMELEN，这里竟然不用！  
显然是开发不统一造成的，未来修改代码的时候很可能造成不好影响**  
/\*  
\* Fragmentation resistance on low memory - only use bigger  
\* page orders on machines with more than 32MB of memory.  
\*/ 为了避免在小内存的时候出现碎片，只有当内存大于32M的时候才会用比较大的页面数,2^n(幂)  
if (num\_physpages > (32 << 20) >> PAGE\_SHIFT)  
slab\_break\_gfp\_order = BREAK\_GFP\_ORDER\_HI;  
do \{  
/\* For performance, all the general caches are L1 aligned.  
\* This should be particularly beneficial on SMP boxes, as it  
\* eliminates "false sharing".  
\* Note for systems short on memory removing the alignment will  
\* allow tighter packing of the smaller caches. \*/  
 注释大意:出于性能的考虑，所有的普通缓存都是按照L1缓存的大小对齐的。  
这样做对对称多处理器的系统来说是非常有益的，这是由于对称多处理器系统消除了假共享。  
snprintf(name, sizeof(name),  "size-%Zd",sizes->cs\_size); 为/proc/slabinfo做准备  
if (!(sizes->cs\_cachep =  
kmem\_cache\_create(name, sizes->cs\_size,  
0, SLAB\_HWCACHE\_ALIGN, NULL, NULL))) \{  
BUG();  
\} 如果创建缓存失败，则报错。  
  
/\* Inc off-slab bufctl limit until the ceiling is hit. \*/ 增加off-slab模式的控制限制，直到到达底线  
if (!(OFF\_SLAB(sizes->cs\_cachep))) \{  
offslab\_limit = sizes->cs\_size- sizeof(slab\_t);  
offslab\_limit /= 2; **这里实际上有问题，应该写成offslab\_limit /=sizeof(kmem\_bufctl\_t)  
如果按照/2计算的话，那永远都不会到达底线了。这个问题在2.6的内核中已经修正  
参考资料：[http://www.cs.helsinki.fi/linux/linux-kernel/2001-17/1193.html][http_www.cs.helsinki.fi_linux_linux-kernel_2001-17_1193.html]**  
\}  
snprintf(name, sizeof(name),  "size-%Zd(DMA)",sizes->cs\_size); 设置名称  
sizes->cs\_dmacachep = kmem\_cache\_create(name, sizes->cs\_size, 0,  
SLAB\_CACHE\_DMA|SLAB\_HWCACHE\_ALIGN, NULL, NULL);  
if (!sizes->cs\_dmacachep)  
BUG();  
sizes++;  
\} while (sizes->cs\_size);  
\}  
  
**int \_\_init kmem\_cpucache\_init(void)**  
\{  
\#ifdef CONFIG\_SMP  编译预处理，如果是多处理器  
g\_cpucache\_up = 1; 设置普通缓存已经激活标志  
enable\_all\_cpucaches(); 激活所有cpu的缓存 **怀疑有问题，不作为原子操作可以吗？而且先设置激活然后执行？**   
 \#endif  
return 0;  
\}  
  
**\_\_initcall(kmem\_cpucache\_init)**;  
  
/\* Interface to system's page allocator. No need to hold the cache-lock.  
\*/ 对系统页分配器的借口，不需要加缓存锁。  
static inline void \* kmem\_getpages (kmem\_cache\_t \*cachep, unsigned long flags)  
\{  
void \*addr;  
  
/\*  
\* If we requested dmaable memory, we will get it. Even if we  
\* did not request dmaable memory, we might get it, but that  
\* would be relatively rare and ignorable.  
\*/ 如果我们要求dma方式的内存，那么我们将获得。即使我们没有要求可以dma方式的内存，  
我们仍然可能会获取到，但是通常情况下这个是不会被忽略的。  
flags |= cachep->gfpflags;  
addr = (void\*) \_\_get\_free\_pages(flags, cachep->gfporder);  
/\* Assume that now we have the pages no one else can legally  
\* messes with the 'struct page's.  
\* However vm\_scan() might try to test the structure to see if  
\* it is a named-page or buffer-page. The members it tests are  
\* of no interest here.....  
\*/ 到此为止，我们已经有了别人不能弄乱的页面了。尽管vm\_scan()有可能会去检测这个结构，看看是一个命名了的页还是一个缓存页。  
对于成员的测试在这里并不关心。  
return addr;  
\}  
  
/\* Interface to system's page release. \*/  
 系统释放页面的接口。  
**static inline void kmem\_freepages (kmem\_cache\_t \*cachep, void \*addr)**  
\{  
unsigned long i = (1<<cachep->gfporder);  
struct page \*page = virt\_to\_page(addr);  
  
/\* free\_pages() does not clear the type bit - we do that.  
\* The pages have been unlinked from their cache-slab,  
\* but their 'struct page's might be accessed in  
\* vm\_scan(). Shouldn't be a worry.  
\*/ free\_page()不清除标志位，我们这里手工去做。  
这些页面从slab缓存中移出，但是他们的结构化页仍然可能被vm\_scan()访问到，但是不必担心。  
while (i--) \{  
PageClearSlab(page); 清除标记位  
page++;  
\}  
free\_pages((unsigned long)addr, cachep->gfporder); 释放页  
\}  
  
\#if DEBUG  条件编译，如果设置调试模式  
**static inline void kmem\_poison\_obj (kmem\_cache\_t \*cachep, void \*addr)**  
\{  
int size = cachep->objsize;  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
addr += BYTES\_PER\_WORD;  
size -= 2\*BYTES\_PER\_WORD;  
\} 留出红区  
memset(addr, POISON\_BYTE, size); 设置未初始化的地址内容为POSION\_BYTE  
\*(unsigned char \*)(addr+size-1) = POISON\_END; 写结尾  
\}  
  
**static inline int kmem\_check\_poison\_obj (kmem\_cache\_t \*cachep, void \*addr)** 检查未初始化的空间的对象  
\{  
int size = cachep->objsize;  
void \*end;  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
addr += BYTES\_PER\_WORD;  
size -= 2\*BYTES\_PER\_WORD;  
\} 红区  
end = memchr(addr, POISON\_END, size);  
if (end != (addr+size-1))  
return 1; 出错退出  
return 0; 正常退出  
\}  
\#endif  
  
/\* Destroy all the objs in a slab, and release the mem back to the system.  
\* Before calling the slab must have been unlinked from the cache.  
\* The cache-lock is not held/needed.  
\*/ 注释大意：销毁slab中的所有对象，释放内存给系统。  
调用前，slab必须已经和cache取消了连接  
缓存锁不被占用，也不需要缓存锁。  
**static void kmem\_slab\_destroy (kmem\_cache\_t \*cachep, slab\_t \*slabp)**  
\{  
if (cachep->dtor  
\#if DEBUG  
|| cachep->flags & (SLAB\_POISON | SLAB\_RED\_ZONE) 如果调试模式，则作红区处理  
\#endif  
) \{  
int i;  
for (i = 0; i < cachep->num; i++) \{  
void\* objp = slabp->s\_mem+cachep->objsize\*i;  
\#if DEBUG  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
if (\*((unsigned long\*)(objp)) != RED\_MAGIC1)  
BUG();  
if (\*((unsigned long\*)(objp + cachep->objsize  
\-BYTES\_PER\_WORD)) != RED\_MAGIC1)  
BUG(); 红区的边界不对，则报错  
objp += BYTES\_PER\_WORD;  
\}  
\#endif  
if (cachep->dtor)  
(cachep->dtor)(objp, cachep, 0); 清空  
\#if DEBUG  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
objp -= BYTES\_PER\_WORD; 减去一个字的长度  
\}  
if ((cachep->flags & SLAB\_POISON) &&  
kmem\_check\_poison\_obj(cachep, objp)) 检查未初始化的部分，如果有问题则报错  
BUG();  
\#endif  
\}  
\}  
  
kmem\_freepages(cachep, slabp->s\_mem-slabp->colouroff); 释放资源  
if (OFF\_SLAB(cachep)) 释放off-slab模式的资源  
kmem\_cache\_free(cachep->slabp\_cache, slabp);  
\}  
  
/\*\*  
\* kmem\_cache\_create - Create a cache.  
\* @name: A string which is used in /proc/slabinfo to identify this cache.  
\* @size: The size of objects to be created in this cache.  
\* @offset: The offset to use within the page.  
\* @flags: SLAB flags  
\* @ctor: A constructor for the objects.  
\* @dtor: A destructor for the objects.  
\*  
\* Returns a ptr to the cache on success, NULL on failure.  
\* Cannot be called within a int, but can be interrupted.  
\* The @ctor is run when new pages are allocated by the cache  
\* and the @dtor is run before the pages are handed back.  
\* The flags are  
\*  
\* %SLAB\_POISON - Poison the slab with a known test pattern (a5a5a5a5)  
\* to catch references to uninitialised memory.  
\*  
\* %SLAB\_RED\_ZONE - Insert \`Red' zones around the allocated memory to check  
\* for buffer overruns.  
\*  
\* %SLAB\_NO\_REAP - Don't automatically reap this cache when we're under  
\* memory pressure.  
\*  
\* %SLAB\_HWCACHE\_ALIGN - Align the objects in this cache to a hardware  
\* cacheline. This can be beneficial if you're counting cycles as closely  
\* as davem.  
\*/  
kmem\_cache\_t \*  
**kmem\_cache\_create (const char \*name, size\_t size, size\_t offset,  
unsigned long flags, void (\*ctor)(void\*, kmem\_cache\_t \*, unsigned long),  
void (\*dtor)(void\*, kmem\_cache\_t \*, unsigned long))**  
\{  
const char \*func\_nm = KERN\_ERR "kmem\_create: ";  
size\_t left\_over, align, slab\_size;  
kmem\_cache\_t \*cachep = NULL;  
  
/\*  
\* Sanity checks... these are all serious usage bugs.  
\*/ 健壮性检察  
if ((!name) ||  
((strlen(name) >= CACHE\_NAMELEN - 1)) ||  
in\_interrupt() ||  
(size < BYTES\_PER\_WORD) ||  
(size > (1<<MAX\_OBJ\_ORDER)\*PAGE\_SIZE) ||  
(dtor && !ctor) ||  
(offset < 0 || offset > size))  
BUG();  
  
\#if DEBUG  条件编译  
if ((flags & SLAB\_DEBUG\_INITIAL) && !ctor) \{  
/\* No constructor, but inital state check requested \*/ 没有构建者，但是要求初始化检查  
printk( "%sNo con, but init state check requested - %s\\n", func\_nm, name);  
flags &= ~SLAB\_DEBUG\_INITIAL;  
\}  
  
if ((flags & SLAB\_POISON) && ctor) \{ 在没有构建者的情况下要求设置未初始化  
/\* request for poisoning, but we can't do that with a constructor \*/  
printk( "%sPoisoning requested, but con given - %s\\n", func\_nm, name);  
flags &= ~SLAB\_POISON;  
\}  
\#if FORCED\_DEBUG  
if ((size < (PAGE\_SIZE>>3)) && !(flags & SLAB\_MUST\_HWCACHE\_ALIGN))  
/\*  
\* do not red zone large object, causes severe  
\* fragmentation.  
\*/ 不将大的对象放入到红区，否则会造成大量碎片  
flags |= SLAB\_RED\_ZONE;  
if (!ctor)  
flags |= SLAB\_POISON;  
\#endif  
\#endif  
  
/\*  
\* Always checks flags, a caller might be expecting debug  
\* support which isn't available.  
\*/  
BUG\_ON(flags & ~CREATE\_MASK);  
  
/\* Get cache's description obj. \*/ 调用kmem\_cache\_alloc从cache\_cache中分配一个对象  
cachep = (kmem\_cache\_t \*) kmem\_cache\_alloc(&cache\_cache, SLAB\_KERNEL);  
if (!cachep)  
goto opps;  
memset(cachep, 0, sizeof(kmem\_cache\_t)); 将新分配的空间全都设置为0  
  
/\* Check that size is in terms of words. This is needed to avoid  
\* unaligned accesses for some archs when redzoning is used, and makes  
\* sure any on-slab bufctl's are also correctly aligned.  
\*/ 检查每个字的大小。在某些体系结构的系统中，要通过这个避免再没有对齐的情况下对红区的访问  
并且确认所有on-slab 缓存控制结构体已经正确对齐  
if (size & (BYTES\_PER\_WORD-1)) \{  
size += (BYTES\_PER\_WORD-1);  
size &= ~(BYTES\_PER\_WORD-1);  
printk( "%sForcing size word alignment - %s\\n", func\_nm, name);  
\}  
  
\#if DEBUG  
if (flags & SLAB\_RED\_ZONE) \{  
/\*  
\* There is no point trying to honour cache alignment  
\* when redzoning.  
\*/  
flags &= ~SLAB\_HWCACHE\_ALIGN;  
size += 2\*BYTES\_PER\_WORD; /\* words for redzone \*/ 红区的字数  
\}  
\#endif  
align = BYTES\_PER\_WORD;  
if (flags & SLAB\_HWCACHE\_ALIGN) 如果要求硬件对齐，则按照CPU L1缓存的大小对齐，否则按照字长对齐  
align = L1\_CACHE\_BYTES;  
  
/\* Determine if the slab management is 'on' or 'off' slab. \*/  
if (size >= (PAGE\_SIZE>>3)) 判断on-slab还是off-slab  
/\*  
\* Size is large, assume best to place the slab management obj  
\* off-slab (should allow better packing of objs).  
\*/ 如果大(超过512字节），那就采用off-slab模式  
flags |= CFLGS\_OFF\_SLAB;  
  
if (flags & SLAB\_HWCACHE\_ALIGN) \{  
/\* Need to adjust size so that objs are cache aligned. \*/  
/\* Small obj size, can get at least two per cache line. \*/  
/\* FIXME: only power of 2 supported, was better \*/  
 调整对象的大小，以便能和缓存对齐  
while (size < align/2)  
align /= 2;  
size = (size+align-1)&(~(align-1));  
\}  
  
/\* Cal size (in pages) of slabs, and the num of objs per slab.  
\* This could be made much more intelligent. For now, try to avoid  
\* using high page-orders for slabs. When the gfp() funcs are more  
\* friendly towards high-order requests, this should be changed.  
\*/ 计算页面中slab的大小，每个slab中对象的个数。  
do \{  
unsigned int break\_flag = 0;  
**cal\_wastage:**  
kmem\_cache\_estimate(cachep->gfporder, size, flags,  
&left\_over, &cachep->num);   
计算消耗，left\_over保存剩余的空间，cachep->num保存slab块中可以存放的对象个数  
if (break\_flag)  
break;  
if (cachep->gfporder >= MAX\_GFP\_ORDER) 如果超大(32\*4096=128K)，则退出循环  
break;  
if (!cachep->num) 超过可以保存的数目了，则退出循环。  
goto next;  
if (flags & CFLGS\_OFF\_SLAB && cachep->num > offslab\_limit) \{ 超过offslab最大的限制，则重新计算花费，然后退出  
/\* Oops, this num of objs will cause problems. \*/  
cachep->gfporder--;  
break\_flag++;  
goto cal\_wastage;  
\}  
  
/\*  
\* Large num of objs is good, but v. large slabs are currently  
\* bad for the gfp()s.  
\*/ 对象数目越多越好，但是过多的slab目前会对gfp()造成不好的影响  
if (cachep->gfporder >= slab\_break\_gfp\_order)  
break;  
  
if ((left\_over\*8) <= (PAGE\_SIZE<<cachep->gfporder))   
防止浪费的操作：假设slab只比对象大一点点，那么可能会造成一个对象的空间大的浪费，增加slab的大小，以便能存放更多的对象。  
如果浪费小于等于1/8则不再增长slab  
break; /\* Acceptable internal fragmentation. \*/  
**next:**  
cachep->gfporder++;  
\} while (1);  
  
if (!cachep->num) \{ 如果超限，则报错释放资源，返回  
printk( "kmem\_cache\_create: couldn't create cache %s.\\n", name);  
kmem\_cache\_free(&cache\_cache, cachep);  
cachep = NULL;  
goto opps;  
\}  
slab\_size = L1\_CACHE\_ALIGN(cachep->num\* sizeof(kmem\_bufctl\_t)+ sizeof(slab\_t)); slab块中管理变量的大小总和(L1 cache对齐)  
  
/\*  
\* If the slab has been placed off-slab, and we have enough space then  
\* move it on-slab. This is at the expense of any extra colouring.  
\*/ 能用on-slab的时候就用on-slab  
if (flags & CFLGS\_OFF\_SLAB && left\_over >= slab\_size) \{  
flags &= ~CFLGS\_OFF\_SLAB;  
left\_over -= slab\_size;  
\}  
  
/\* Offset must be a multiple of the alignment. \*/ 将offset设置为合适的对齐偏移量  
offset += (align-1);  
offset &= ~(align-1);  
if (!offset)  
offset = L1\_CACHE\_BYTES; 如果没有偏移，那就按照L1缓存的大小对齐。  
cachep->colour\_off = offset; 着色偏移量  
cachep->colour = left\_over/offset; 当前着色  
  
/\* init remaining fields \*/ 初始化其他的部分  
if (!cachep->gfporder && !(flags & CFLGS\_OFF\_SLAB))  
flags |= CFLGS\_OPTIMIZE;  
  
cachep->flags = flags; 设标志  
cachep->gfpflags = 0;  
if (flags & SLAB\_CACHE\_DMA)  
cachep->gfpflags |= GFP\_DMA;  
spin\_lock\_init(&cachep->spinlock); 初始化锁  
cachep->objsize = size; 设大小  
INIT\_LIST\_HEAD(&cachep->slabs\_full);  
INIT\_LIST\_HEAD(&cachep->slabs\_partial);  
INIT\_LIST\_HEAD(&cachep->slabs\_free); 初始化3个队列  
  
if (flags & CFLGS\_OFF\_SLAB)  
cachep->slabp\_cache = kmem\_find\_general\_cachep(slab\_size,0); 指向cache\_cache中与slab\_size对应的变量  
cachep->ctor = ctor; 构建者  
cachep->dtor = dtor; 析构  
/\* Copy name over so we don't have problems with unloaded modules \*/  
strcpy(cachep->name, name); 为了避免模块被卸载后出现问题，在这里保存一下名字。  
  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器的情况下，如果普通缓存激活了，那么激活cpu缓存。  
if (g\_cpucache\_up)  
enable\_cpucache(cachep);  
\#endif  
/\* Need the semaphore to access the chain. \*/  
down(&cache\_chain\_sem); 设置信号量，以便可以访问缓存链  
\{  
struct list\_head \*p;  
  
list\_for\_each(p, &cache\_chain) \{  
kmem\_cache\_t \*pc = list\_entry(p, kmem\_cache\_t, next);  
  
/\* The name field is constant - no lock needed. \*/ 名称出错，则报错  
if (!strcmp(pc->name, name))  
BUG();  
\}  
\}  
  
/\* There is no reason to lock our new cache before we  
\* link it in - no one knows about it yet...  
\*/ 在加入链之前没有必要锁定新的缓存，因为还没有任何进程可以知道他  
list\_add(&cachep->next, &cache\_chain);  
up(&cache\_chain\_sem); 锁定  
**opps:**  
return cachep; 返回新建缓存区的指针  
\}  
  
  
\#if DEBUG  条件编译  
/\*  
\* This check if the kmem\_cache\_t pointer is chained in the cache\_cache  
\* list. -arca  
\*/ 检查kmem\_cache\_t是否连接到了cache\_cache链表中  
**static int is\_chained\_kmem\_cache(kmem\_cache\_t \* cachep)**  
\{  
struct list\_head \*p;  
int ret = 0;  
  
/\* Find the cache in the chain of caches. \*/  
down(&cache\_chain\_sem);  
list\_for\_each(p, &cache\_chain) \{  
if (p == &cachep->next) \{  
ret = 1;  
break;  
\}  
\}  
up(&cache\_chain\_sem);  
  
return ret;  
\}  
\#else 如果不要求调试，则定义空操作  
**\#define is\_chained\_kmem\_cache(x) 1**  
\#endif  
  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器  
/\*  
\* Waits for all CPUs to execute func().  
\*/ 在所有的CPU上都执行某个函数  
**static void smp\_call\_function\_all\_cpus(void (\*func) (void \*arg), void \*arg)**  
\{  
local\_irq\_disable(); 关中断  
func(arg); 执行函数  
local\_irq\_enable(); 开中断  
  
if (smp\_call\_function(func, arg, 1, 1)) 如果掉用函数有问题，则报错  
BUG();  
\}  
typedef struct ccupdate\_struct\_s  
\{  
kmem\_cache\_t \*cachep;  
cpucache\_t \*new\[NR\_CPUS\];  
\} ccupdate\_struct\_t;  
  
**static void do\_ccupdate\_local(void \*info)**  
\{  
ccupdate\_struct\_t \*new = (ccupdate\_struct\_t \*)info;  
cpucache\_t \*old = cc\_data(new->cachep);  
  
cc\_data(new->cachep) = new->new\[smp\_processor\_id()\];  
new->new\[smp\_processor\_id()\] = old;  
\} 本地作cpu缓存更新  
  
**static void free\_block (kmem\_cache\_t\* cachep, void\*\* objpp, int len)**;  
  
**static void drain\_cpu\_caches(kmem\_cache\_t \*cachep)**  
\{ 耗尽cpu缓存  
ccupdate\_struct\_t new;  
int i;  
  
memset(&new.new,0, sizeof(new.new));  
  
new.cachep = cachep;  
  
down(&cache\_chain\_sem);  
smp\_call\_function\_all\_cpus(do\_ccupdate\_local, (void \*)&new);  
  
for (i = 0; i < smp\_num\_cpus; i++) \{  
cpucache\_t\* ccold = new.new\[cpu\_logical\_map(i)\];  
if (!ccold || (ccold->avail == 0))  
continue;  
local\_irq\_disable();  
free\_block(cachep, cc\_entry(ccold), ccold->avail);  
local\_irq\_enable();  
ccold->avail = 0;  
\}  
smp\_call\_function\_all\_cpus(do\_ccupdate\_local, (void \*)&new);  
up(&cache\_chain\_sem);  
\}  
  
\#else  不是对称多处理器的情况定义一个空操作  
**\#define drain\_cpu\_caches(cachep) do \{ \} while (0)**  
\#endif  
  
/\*  
\* Called with the &cachep->spinlock held, returns number of slabs released  
\*/ 调用的时候要保持自旋锁，返回释放的slab数目  
**static int \_\_kmem\_cache\_shrink\_locked(kmem\_cache\_t \*cachep)**  
\{  
slab\_t \*slabp;  
int ret = 0;  
  
/\* If the cache is growing, stop shrinking. \*/ 如果正在增长，那么不可以收缩  
while (!cachep->growing) \{  
struct list\_head \*p;  
  
p = cachep->slabs\_free.prev;  
if (p == &cachep->slabs\_free)  
break;  
  
slabp = list\_entry(cachep->slabs\_free.prev, slab\_t, list);  
\#if DEBUG  
if (slabp->inuse)  
BUG();  
\#endif  
list\_del(&slabp->list); 遍历链表，从后向前删除  
  
spin\_unlock\_irq(&cachep->spinlock); 发解除自旋锁的中断  
kmem\_slab\_destroy(cachep, slabp); 删除缓存区  
ret++;  
spin\_lock\_irq(&cachep->spinlock); 重新加锁  
\}  
return ret;  
\}  
  
**static int \_\_kmem\_cache\_shrink(kmem\_cache\_t \*cachep)收缩操作**  
\{  
int ret;  
  
drain\_cpu\_caches(cachep);  
  
spin\_lock\_irq(&cachep->spinlock); 加自旋锁  
\_\_kmem\_cache\_shrink\_locked(cachep); 执行删除  
ret = !list\_empty(&cachep->slabs\_full) ||  
!list\_empty(&cachep->slabs\_partial); 检查是否为空链表，如果是的话返回1，否则返回0  
spin\_unlock\_irq(&cachep->spinlock); 解锁  
return ret;  
\}  
  
/\*\*  
\* kmem\_cache\_shrink - Shrink a cache.  
\* @cachep: The cache to shrink.  
\*  
\* Releases as many slabs as possible for a cache.  
\* Returns number of pages released.  
\*/ 收缩操作，释放尽量多的slab,返回释放的页面数  
**int kmem\_cache\_shrink(kmem\_cache\_t \*cachep)**  
\{  
int ret;  
  
if (!cachep || in\_interrupt() || !is\_chained\_kmem\_cache(cachep)) 如果要收缩NULL,正在中断中，要收缩链上的缓存，则报错  
BUG();  
  
spin\_lock\_irq(&cachep->spinlock); 发加锁中断  
ret = \_\_kmem\_cache\_shrink\_locked(cachep); 收缩  
spin\_unlock\_irq(&cachep->spinlock); 发解锁中断  
  
return ret << cachep->gfporder;  
\}  
  
/\*\*  
\* kmem\_cache\_destroy - delete a cache  
\* @cachep: the cache to destroy  
\* 注释大意：kmem\_cache\_destory删除一个缓存,cachep是将要被删除的缓存   
\* Remove a kmem\_cache\_t object from the slab cache.  
\* Returns 0 on success.  
\* 返回0则成功   
\* It is expected this function will be called by a module when it is  
\* unloaded. This will remove the cache completely, and avoid a duplicate  
\* cache being allocated each time a module is loaded and unloaded, if the  
\* module doesn't have persistent in-kernel storage across loads and unloads.  
\* 在模块被卸载的时候，这个函数需要被调用。他将完全清除缓存，  
以便避免不能永久访问内核存储区的模块每次卸载和挂载的时候会出现重复的缓存被要求分配。   
\* The cache must be empty before calling this function.  
\* 在调用前，缓存必须是空的   
\* The caller must guarantee that noone will allocate memory from the cache  
\* during the kmem\_cache\_destroy().  
\*/ 调用者必须确认，在执行清除缓存操作的时候，不会有人申请内存  
**int kmem\_cache\_destroy (kmem\_cache\_t \* cachep)**  
\{  
if (!cachep || in\_interrupt() || cachep->growing) 如果要销毁NULL,正在中断中，要销毁正在增长的缓存，则报错  
BUG();  
  
/\* Find the cache in the chain of caches. \*/  
down(&cache\_chain\_sem); 允许访问缓存链  
/\* the chain is never empty, cache\_cache is never destroyed \*/  
if (clock\_searchp == cachep) 如果链不空，则无法销毁  
clock\_searchp = list\_entry(cachep->next.next,  
kmem\_cache\_t, next);  
list\_del(&cachep->next);  
up(&cache\_chain\_sem);  
  
if (\_\_kmem\_cache\_shrink(cachep)) \{ 如果无法一直收缩(非空)，则报错  
printk(KERN\_ERR "kmem\_cache\_destroy: Can't free all objects %p\\n",  
cachep);  
down(&cache\_chain\_sem);  
list\_add(&cachep->next,&cache\_chain);  
up(&cache\_chain\_sem);  
return 1;  
\}  
\#ifdef CONFIG\_SMP 条件编译，多处理器情况  
\{  
int i;  
for (i = 0; i < NR\_CPUS; i++)  
kfree(cachep->cpudata\[i\]); 释放每个cpu相应的缓存的数组  
\}  
\#endif  
kmem\_cache\_free(&cache\_cache, cachep); 释放内存  
  
return 0;  
\}  
  
/\* Get the memory for a slab management obj. \*/ 为slab管理对象申请内存  
static inline slab\_t \* kmem\_cache\_slabmgmt (kmem\_cache\_t \*cachep,  
void \*objp, int colour\_off, int local\_flags)  
\{  
slab\_t \*slabp;  
  
if (OFF\_SLAB(cachep)) \{  
/\* Slab management obj is off-slab. \*/ 如果是off-slab模式的  
slabp = kmem\_cache\_alloc(cachep->slabp\_cache, local\_flags);  
if (!slabp) 出错处理  
return NULL;  
\} else \{ on-slab模式  
/\* FIXME: change to  
slabp = objp  
\* if you enable OPTIMIZE  
\*/  
slabp = objp+colour\_off; 根据着色空间进行偏移  
colour\_off += L1\_CACHE\_ALIGN(cachep->num \*  
sizeof(kmem\_bufctl\_t) +  sizeof(slab\_t)); 计算着色空间更新  
\}  
slabp->inuse = 0; 活动对象为0  
slabp->colouroff = colour\_off; 着色空间更新  
slabp->s\_mem = objp+colour\_off; slab块中第一个对象的地址  
  
return slabp;  
\}  
  
**static inline void kmem\_cache\_init\_objs (kmem\_cache\_t \* cachep,  
slab\_t \* slabp, unsigned long ctor\_flags)**  
\{  
int i;  
  
for (i = 0; i < cachep->num; i++) \{ 对slab块中每一个对象进行构造  
void\* objp = slabp->s\_mem+cachep->objsize\*i;   
\#if DEBUG  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
\*((unsigned long\*)(objp)) = RED\_MAGIC1;  
\*((unsigned long\*)(objp + cachep->objsize -  
BYTES\_PER\_WORD)) = RED\_MAGIC1;  
objp += BYTES\_PER\_WORD;  
\}  
\#endif  
  
/\*  
\* Constructors are not allowed to allocate memory from  
\* the same cache which they are a constructor for.  
\* Otherwise, deadlock. They must also be threaded.  
\*/ 构造函数不能从他们自己构造的同一个缓存中申请内存，否则会造成死锁。  
if (cachep->ctor)  
cachep->ctor(objp, cachep, ctor\_flags);  
\#if DEBUG  
if (cachep->flags & SLAB\_RED\_ZONE)  
objp -= BYTES\_PER\_WORD;  
if (cachep->flags & SLAB\_POISON)  
/\* need to poison the objs \*/  
kmem\_poison\_obj(cachep, objp);  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
if (\*((unsigned long\*)(objp)) != RED\_MAGIC1)  
BUG();  
if (\*((unsigned long\*)(objp + cachep->objsize -  
BYTES\_PER\_WORD)) != RED\_MAGIC1)  
BUG();  
\}  
\#endif  
slab\_bufctl(slabp)\[i\] = i+1;  
\}  
slab\_bufctl(slabp)\[i-1\] = BUFCTL\_END; 标示结束(0xffffFFFF)  
slabp->free = 0; 第一个空闲对象(对象数组的下标设置为0）  
\}  
  
/\*  
\* Grow (by 1) the number of slabs within a cache. This is called by  
\* kmem\_cache\_alloc() when there are no active objs left in a cache.  
\*/ 增加1个slab在cache中。这个函数缓存中没有活跃对象时，被kmem\_cache\_alloc()调用  
**static int kmem\_cache\_grow (kmem\_cache\_t \* cachep, int flags)**  
\{  
slab\_t \*slabp;  
struct page \*page;  
void \*objp;  
size\_t offset;  
unsigned int i, local\_flags;  
unsigned long ctor\_flags;  
unsigned long save\_flags;  
  
/\* Be lazy and only check for valid flags here,  
\* keeping it out of the critical path in kmem\_cache\_alloc().  
\*/ 只检查不合法的标示，重要的完整性检查在kmem\_cache\_alloc中完成  
if (flags & ~(SLAB\_DMA|SLAB\_LEVEL\_MASK|SLAB\_NO\_GROW))  
BUG();  
if (flags & SLAB\_NO\_GROW) 如果不允许增加，则直接返回  
return 0;  
  
/\*  
\* The test for missing atomic flag is performed here, rather than  
\* the more obvious place, simply to reduce the critical path length  
\* in kmem\_cache\_alloc(). If a caller is seriously mis-behaving they  
\* will eventually be caught here (where it matters).  
\*/ 原子操作位一定要设置，以便防止被中断处理程序调用的时候中断处理时间过长。  
如果GFP\_WAIT GFP\_HIGH GFP\_IO GFP\_HIGHMEM没有被设置则报错  
如果正在中断中，报错  
if (in\_interrupt() && (flags & SLAB\_LEVEL\_MASK) != SLAB\_ATOMIC)  
BUG();  
  
ctor\_flags = SLAB\_CTOR\_CONSTRUCTOR;  
local\_flags = (flags & SLAB\_LEVEL\_MASK);  
if (local\_flags == SLAB\_ATOMIC)  
/\*  
\* Not allowed to sleep. Need to tell a constructor about  
\* this - it might need to know...  
\*/ 告诉构造者，不能进入睡眠状态  
ctor\_flags |= SLAB\_CTOR\_ATOMIC;  
  
/\* About to mess with non-constant members - lock. \*/ 对变量的处理，存中断  
spin\_lock\_irqsave(&cachep->spinlock, save\_flags);  
  
/\* Get colour for the slab, and cal the next value. \*/ 获得slab颜色，算下一个着色值  
offset = cachep->colour\_next;  
cachep->colour\_next++;  
if (cachep->colour\_next >= cachep->colour) 如果计数器>=最大值  
cachep->colour\_next = 0; 绕了一圈，回到起点  
offset \*= cachep->colour\_off; offset等于当前slab所有偏移量的大小（offset=数目\*每一个对象的偏移量)  
cachep->dflags |= DFLGS\_GROWN; 设置动态增长位  
  
cachep->growing++; 标志正在增长  
spin\_unlock\_irqrestore(&cachep->spinlock, save\_flags); 恢复中断  
  
/\* A series of memory allocations for a new slab.  
\* Neither the cache-chain semaphore, or cache-lock, are  
\* held, but the incrementing c\_growing prevents this  
\* cache from being reaped or shrunk.  
\* Note: The cache could be selected in for reaping in  
\* kmem\_cache\_reap(), but when the final test is made the  
\* growing value will be seen.  
\*/ 注释大意：为新的slab做的一系列的内存申请操作。  
通过c\_growing来避免这块缓存被回收或者收缩，而不是通过加互斥锁或者缓存锁来实现。  
需要注意，这块缓存可以被选进回收的函数kmem\_cache\_reap()，但是在那里面会发现这块缓存正在增长所以不回收。  
  
/\* Get mem for the objs. \*/  
if (!(objp = kmem\_getpages(cachep, flags))) 为对象申请页面  
goto failed; 出错处理  
  
/\* Get slab management. \*/ 获得slab管理对象  
if (!(slabp = kmem\_cache\_slabmgmt(cachep, objp, offset, local\_flags)))  
goto opps1; 出错处理  
  
/\* Nasty!!!!!! I hope this is OK. \*/  
i = 1 << cachep->gfporder; i=slab块的页面数  
page = virt\_to\_page(objp); page是指向这个对象所在页面指针  
 do \{  
SET\_PAGE\_CACHE(page, cachep); 设置页所在的cache，即(page->list.next=(struct list\_head \*)cachep  
SET\_PAGE\_SLAB(page, slabp); 设置页所在的slab，即(page->list.prev=(struct list\_head \*)slabp  
PageSetSlab(page); 设置页在slab中  
page++; 下一页  
\} while (--i); 循环，直到在slab中的页都设置好了  
  
kmem\_cache\_init\_objs(cachep, slabp, ctor\_flags); 初始化对象  
  
spin\_lock\_irqsave(&cachep->spinlock, save\_flags); 存中断  
cachep->growing--; 标记缓存不增长  
  
/\* Make slab active. \*/  
list\_add\_tail(&slabp->list, &cachep->slabs\_free); 将新创建的slab放在该缓存区slab链的尾部  
STATS\_INC\_GROWN(cachep); 增长状态  
cachep->failures = 0; 缓存失效次数等于0  
  
spin\_unlock\_irqrestore(&cachep->spinlock, save\_flags); 解锁，回复中断状态  
return 1; 正常返回  
**opps1:**  
kmem\_freepages(cachep, objp); 释放页面  
**failed:**  
spin\_lock\_irqsave(&cachep->spinlock, save\_flags);  
cachep->growing--; 不增长状态  
spin\_unlock\_irqrestore(&cachep->spinlock, save\_flags);  
return 0;  
\}  
  
/\*  
\* Perform extra freeing checks:  
\* - detect double free  
\* - detect bad pointers.  
\* Called with the cache-lock held.  
\*/ 检查是否有多余的free,是否有野指针，调用的时候需要有缓存锁  
  
\#if DEBUG  条件编译，如果是查错模式  
**static int kmem\_extra\_free\_checks (kmem\_cache\_t \* cachep,  
slab\_t \*slabp, void \* objp)**  
\{  
int i;  
unsigned int objnr = (objp-slabp->s\_mem)/cachep->objsize;  
  
if (objnr >= cachep->num)  
BUG();  
if (objp != slabp->s\_mem + objnr\*cachep->objsize)  
BUG();  
  
/\* Check slab's freelist to see if this obj is there. \*/ 检查对象是否在施放列表里  
for (i = slabp->free; i != BUFCTL\_END; i = slab\_bufctl(slabp)\[i\]) \{  
if (i == objnr)  
BUG();  
\}  
return 0;  
\}  
\#endif  
  
**static inline void kmem\_cache\_alloc\_head(kmem\_cache\_t \*cachep, int flags)**  
\{  
if (flags & SLAB\_DMA) \{  
if (!(cachep->gfpflags & GFP\_DMA)) 如果flags包含SLAB\_DMA并且缓存要求新页的flag不包含GFP\_DMA则报错  
BUG();  
\} else \{  
if (cachep->gfpflags & GFP\_DMA) 如果flags不包含SLAB\_DMA并且缓存要求新页的flag包含GFP\_DMA则报错  
BUG();  
\}  
\}  
  
static inline void \* kmem\_cache\_alloc\_one\_tail (kmem\_cache\_t \*cachep,  
slab\_t \*slabp)  
\{  
void \*objp;  
  
STATS\_INC\_ALLOCED(cachep);  
STATS\_INC\_ACTIVE(cachep);  
STATS\_SET\_HIGH(cachep); 统计操作(如果STATS不是1，则相当于空操作)  
  
/\* get obj pointer \*/  
slabp->inuse++; slab的活动对象加1  
objp = slabp->s\_mem + slabp->free\*cachep->objsize;   
指向该slab中第一个空闲对象地址的指针(=第一个对象地址+空闲数目\*对象的大小)  
slabp->free=slab\_bufctl(slabp)\[slabp->free\]; 当前对象的下一个空闲对象在对象数组中的下标(即第几个)  
  
if (unlikely(slabp->free == BUFCTL\_END)) \{ 满了，把它放到满了的slab列表中。  
list\_del(&slabp->list); 从当前列表中删除  
list\_add(&slabp->list, &cachep->slabs\_full); 放到满了的列表里  
\}  
\#if DEBUG  条件编译，调试模式下  
if (cachep->flags & SLAB\_POISON) 在未初始化的slab区域  
if (kmem\_check\_poison\_obj(cachep, objp)) 如果是未初始化的对象，则报错  
BUG();  
if (cachep->flags & SLAB\_RED\_ZONE) \{ 在红区  
/\* Set alloc red-zone, and check old one. \*/  
if (xchg((unsigned long \*)objp, RED\_MAGIC2) != 如果边界有问题则报错  
RED\_MAGIC1)  
BUG();  
if (xchg((unsigned long \*)(objp+cachep->objsize -  
BYTES\_PER\_WORD), RED\_MAGIC2) != RED\_MAGIC1) 对象大小出错则报错  
BUG();  
objp += BYTES\_PER\_WORD;  
\}  
\#endif  
return objp; 返回新分配的对象地址  
\}  
  
/\*  
\* Returns a ptr to an obj in the given cache.  
\* caller must guarantee synchronization  
\* \#define for the goto optimization 8-)  
\*/ 返回一个指向给定的cache中一个对象的指针  
调用者必须确保同步  
使用define以便保证对goto的优化  
**\#define kmem\_cache\_alloc\_one(cachep) \\  
(\{ \\  
struct list\_head \* slabs\_partial, \* entry; \\  
slab\_t \*slabp; \\  
\\  
slabs\_partial = &(cachep)->slabs\_partial; \\  
entry = slabs\_partial->next; \\  
if (unlikely(entry == slabs\_partial)) \{ \\  
struct list\_head \* slabs\_free; \\  
slabs\_free = &(cachep)->slabs\_free; \\  
entry = slabs\_free->next; \\  
if (unlikely(entry == slabs\_free)) \\  
goto alloc\_new\_slab; \\  
list\_del(entry); \\  
list\_add(entry, slabs\_partial); \\  
\} \\  
\\  
slabp = list\_entry(entry, slab\_t, list); \\  
kmem\_cache\_alloc\_one\_tail(cachep, slabp); \\  
\})**  
  
\#ifdef CONFIG\_SMP  条件编译，对称多处理机的支持，申请一批缓存  
void\* kmem\_cache\_alloc\_batch(kmem\_cache\_t\* cachep, cpucache\_t\* cc, int flags)  
\{  
int batchcount = cachep->batchcount;  
  
spin\_lock(&cachep->spinlock);  
while (batchcount--) \{  
struct list\_head \* slabs\_partial, \* entry;  
slab\_t \*slabp;  
/\* Get slab alloc is to come from. \*/  
slabs\_partial = &(cachep)->slabs\_partial;  
entry = slabs\_partial->next;  
if (unlikely(entry == slabs\_partial)) \{  
struct list\_head \* slabs\_free;  
slabs\_free = &(cachep)->slabs\_free;  
entry = slabs\_free->next;  
if (unlikely(entry == slabs\_free))  
break;  
list\_del(entry);  
list\_add(entry, slabs\_partial);  
\}  
  
slabp = list\_entry(entry, slab\_t, list);  
cc\_entry(cc)\[cc->avail++\] =  
kmem\_cache\_alloc\_one\_tail(cachep, slabp);  
\}  
spin\_unlock(&cachep->spinlock);  
  
if (cc->avail)  
return cc\_entry(cc)\[--cc->avail\];  
return NULL;  
\}  
\#endif  
  
static inline void \* \_\_kmem\_cache\_alloc (kmem\_cache\_t \*cachep, int flags)  
\{  
unsigned long save\_flags;  
void\* objp;  
  
kmem\_cache\_alloc\_head(cachep, flags); 检查申请是否合理  
**try\_again:**  
local\_irq\_save(save\_flags); 保存中断  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器的情况  
\{  
cpucache\_t \*cc = cc\_data(cachep); cpu缓存指针指向送入的缓存  
  
if (cc) \{ 有缓存的情况  
if (cc->avail) \{ 如果CPU缓存可用  
STATS\_INC\_ALLOCHIT(cachep); 命中计数  
objp = cc\_entry(cc)\[--cc->avail\]; 对象的指针指向cpu缓存，并且cpu缓存可用数目减1  
\} else \{ cpu缓存不可用  
STATS\_INC\_ALLOCMISS(cachep); 没有命中计数加1  
objp = kmem\_cache\_alloc\_batch(cachep,cc,flags); 对象指针指向批量申请缓存返回的地址  
if (!objp)  
goto alloc\_new\_slab\_nolock; 没有申请下缓存，则不加锁申请新的slab块  
\}  
\} else \{ 没有缓存的情况  
spin\_lock(&cachep->spinlock); 加锁  
objp = kmem\_cache\_alloc\_one(cachep); 申请新的缓存  
spin\_unlock(&cachep->spinlock); 解锁  
\}  
\}  
\#else  
objp = kmem\_cache\_alloc\_one(cachep); 单处理器，直接申请一个新的对象空间  
\#endif  
local\_irq\_restore(save\_flags); 恢复中断  
return objp; 返回申请的对象指针  
**alloc\_new\_slab:**  
\#ifdef CONFIG\_SMP  条件编译，如果是对称多处理器，则解锁  
spin\_unlock(&cachep->spinlock);  
**alloc\_new\_slab\_nolock:**  
\#endif  
local\_irq\_restore(save\_flags); 恢复中断  
if (kmem\_cache\_grow(cachep, flags)) 如果在给定的cache中成功增加了一个slab  
/\* Someone may have stolen our objs. Doesn't matter, we'll  
\* just come back here again.  
\*/ 其他的人可能会直接要走刚刚申请下来的对象空间。如果出现这种情况，那么还会执行这里  
goto try\_again; 则重新分配对象的空间  
return NULL; 如果不能给对象分配空间，并且不能在缓存里创建新的slab块，则返回空指针。  
\}  
  
/\*  
\* Release an obj back to its cache. If the obj has a constructed  
\* state, it should be in this state \_before\_ it is released.  
\* - caller is responsible for the synchronization  
\*/  
  
\#if DEBUG  
\# define CHECK\_NR(pg) \\  
do \{ \\  
if (!VALID\_PAGE(pg)) \{ \\  
printk(KERN\_ERR "kfree: out of range ptr %lxh.\\n", \\  
(unsigned long)objp); \\  
BUG(); \\  
\} \\  
\} while (0)  
\# define CHECK\_PAGE(page) \\  
do \{ \\  
CHECK\_NR(page); \\  
if (!PageSlab(page)) \{ \\  
printk(KERN\_ERR "kfree: bad ptr %lxh.\\n", \\  
(unsigned long)objp); \\  
BUG(); \\  
\} \\  
\} while (0)  
  
\#else  
\# define CHECK\_PAGE(pg) do \{ \} while (0)  
\#endif  
**之所以使用do\{\}while(0)这样的写法是为了保证在任何情况宏被调用的时候都能保持相同的语义  
参考：[http://www.rtems.com/rtems/maillistArchives/rtems-users/2001/august/msg00056.html][http_www.rtems.com_rtems_maillistArchives_rtems-users_2001_august_msg00056.html]  
static inline void kmem\_cache\_free\_one(kmem\_cache\_t \*cachep, void \*objp)**  
\{  
slab\_t\* slabp;  
  
CHECK\_PAGE(virt\_to\_page(objp)); 检查指向对象的页  
/\* reduces memory footprint  
\*  
if (OPTIMIZE(cachep))  
slabp = (void\*)((unsigned long)objp&(~(PAGE\_SIZE-1)));  
else  
\*/  
slabp = GET\_PAGE\_SLAB(virt\_to\_page(objp)); 获取对象所在的slab块  
  
\#if DEBUG  
if (cachep->flags & SLAB\_DEBUG\_INITIAL)  
/\* Need to call the slab's constructor so the  
\* caller can perform a verify of its state (debugging).  
\* Called without the cache-lock held.  
\*/  
cachep->ctor(objp, cachep, SLAB\_CTOR\_CONSTRUCTOR|SLAB\_CTOR\_VERIFY);  
  
if (cachep->flags & SLAB\_RED\_ZONE) \{  
objp -= BYTES\_PER\_WORD;  
if (xchg((unsigned long \*)objp, RED\_MAGIC1) != RED\_MAGIC2)  
/\* Either write before start, or a double free. \*/  
BUG();  
if (xchg((unsigned long \*)(objp+cachep->objsize -  
BYTES\_PER\_WORD), RED\_MAGIC1) != RED\_MAGIC2)  
/\* Either write past end, or a double free. \*/  
BUG();  
\}  
if (cachep->flags & SLAB\_POISON)  
kmem\_poison\_obj(cachep, objp);  
if (kmem\_extra\_free\_checks(cachep, slabp, objp))  
return;  
\#endif  
\{  
unsigned int objnr = (objp-slabp->s\_mem)/cachep->objsize;  
  
slab\_bufctl(slabp)\[objnr\] = slabp->free;  
slabp->free = objnr; 上限等于新的对象的数目  
\}  
STATS\_DEC\_ACTIVE(cachep); 减少一个活跃的对象计数  
  
/\* fixup slab chains \*/ 修复slab链  
\{  
int inuse = slabp->inuse;  
if (unlikely(!--slabp->inuse)) \{  
/\* Was partial or full, now empty. \*/ 满的或者半满的移到空的里面(只有一个在用的)  
list\_del(&slabp->list);  
list\_add(&slabp->list, &cachep->slabs\_free);  
\} else if (unlikely(inuse == cachep->num)) \{  
/\* Was full. \*/ 满的变成半满  
list\_del(&slabp->list);  
list\_add(&slabp->list, &cachep->slabs\_partial);  
\}  
\}  
\}  
  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器  
**static inline void \_\_free\_block (kmem\_cache\_t\* cachep,  
void\*\* objpp, int len)**  
\{  
for ( ; len > 0; len--, objpp++)  
kmem\_cache\_free\_one(cachep, \*objpp); 只要还有，就一直释放，直到空了  
\}  
  
**static void free\_block (kmem\_cache\_t\* cachep, void\*\* objpp, int len)**  
\{  
spin\_lock(&cachep->spinlock);  
\_\_free\_block(cachep, objpp, len); 加锁，调用\_\_free\_block()，解锁  
spin\_unlock(&cachep->spinlock);  
\}  
\#endif  
  
/\*  
\* \_\_kmem\_cache\_free  
\* called with disabled ints  
\*/  
**static inline void \_\_kmem\_cache\_free (kmem\_cache\_t \*cachep, void\* objp)**  
\{  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器支持，对每个CPU的缓存作释放操作并且计数（如果定义STATS为1，否则不计数)。  
cpucache\_t \*cc = cc\_data(cachep);  
  
CHECK\_PAGE(virt\_to\_page(objp));  
if (cc) \{  
int batchcount;  
if (cc->avail < cc->limit) \{  
STATS\_INC\_FREEHIT(cachep);  
cc\_entry(cc)\[cc->avail++\] = objp;  
return;  
\}  
STATS\_INC\_FREEMISS(cachep);  
batchcount = cachep->batchcount;  
cc->avail -= batchcount;  
free\_block(cachep,  
&cc\_entry(cc)\[cc->avail\],batchcount);  
cc\_entry(cc)\[cc->avail++\] = objp;  
return;  
\} else \{  
free\_block(cachep, &objp, 1);  
\}  
\#else  
kmem\_cache\_free\_one(cachep, objp); 单CPU,直接释放  
\#endif  
\}  
  
/\*\*  
\* kmem\_cache\_alloc - Allocate an object  
\* @cachep: The cache to allocate from.  
\* @flags: See kmalloc().  
\*  
\* Allocate an object from this cache. The flags are only relevant  
\* if the cache has no available objects.  
\*/ 申请一个对象空间  
void \* kmem\_cache\_alloc (kmem\_cache\_t \*cachep, int flags)  
\{  
return \_\_kmem\_cache\_alloc(cachep, flags);  
\}  
  
/\*\*  
\* kmalloc - allocate memory 申请内核态内存   
\* @size: how many bytes of memory are required. 需要申请的大小   
\* @flags: the type of memory to allocate. 申请的类型   
\*  
\* kmalloc is the normal method of allocating memory  
\* in the kernel.  
\*  
\* The @flags argument may be one of:  
\*  
\* %GFP\_USER - Allocate memory on behalf of user. May sleep. 根据用户来申请，申请的时候有可能会转入睡眠   
\*  
\* %GFP\_KERNEL - Allocate normal kernel ram. May sleep. 申请普通内核内存，申请的时候有可能会转入睡眠   
\*  
\* %GFP\_ATOMIC - Allocation will not sleep. Use inside interrupt handlers. 申请原子操作过程，申请的过程不会被打断。在中断处理中使用。   
\*  
\* Additionally, the %GFP\_DMA flag may be set to indicate the memory  
\* must be suitable for DMA. This can mean different things on different  
\* platforms. For example, on i386, it means that the memory must come  
\* from the first 16MB.  
\*/ 申请支持DMA方式访问。在不同的平台上有不同的含义，比如i386平台指必须来自前16M内存。  
void \* kmalloc (size\_t size, int flags)  
\{  
cache\_sizes\_t \*csizep = cache\_sizes;  
  
for (; csizep->cs\_size; csizep++) \{  
if (size > csizep->cs\_size) 遍历缓存链表，找到第一个符合要求的slab块  
 continue;  
return \_\_kmem\_cache\_alloc(flags & GFP\_DMA ?  根据是否是DMA来决定在哪个链上找  
csizep->cs\_dmacachep : csizep->cs\_cachep, flags);  
\}  
return NULL; 不成功则返回NULL  
\}  
  
/\*\*  
\* kmem\_cache\_free - Deallocate an object  
\* @cachep: The cache the allocation was from.  
\* @objp: The previously allocated object.  
\*  
\* Free an object which was previously allocated from this  
\* cache.  
\*/ 释放缓存中的一个对象  
**void kmem\_cache\_free (kmem\_cache\_t \*cachep, void \*objp)**  
\{  
unsigned long flags;  
\#if DEBUG  条件编译  
CHECK\_PAGE(virt\_to\_page(objp));  
if (cachep != GET\_PAGE\_CACHE(virt\_to\_page(objp))) 如果对象不在缓存的页里，那么报错  
BUG();  
\#endif  
  
local\_irq\_save(flags);  
\_\_kmem\_cache\_free(cachep, objp); 存中断，执行释放，恢复中断  
local\_irq\_restore(flags);  
\}  
  
/\*\*  
\* kfree - free previously allocated memory  
\* @objp: pointer returned by kmalloc.  
\*  
\* Don't free memory not originally allocated by kmalloc()  
\* or you will run into trouble.  
\*/ 释放以前申请的内存，不要释放不是kmalloc()分配的内存，否则会出现问题  
**void kfree (const void \*objp)**  
\{  
kmem\_cache\_t \*c;  
unsigned long flags;  
  
if (!objp) 空无法释放  
return;  
local\_irq\_save(flags); 存中断  
CHECK\_PAGE(virt\_to\_page(objp)); 检查对象所在的页  
c = GET\_PAGE\_CACHE(virt\_to\_page(objp)); c指向对象所在的页  
\_\_kmem\_cache\_free(c, (void\*)objp); 释放这个对象  
local\_irq\_restore(flags); 恢复中断  
\}  
  
**unsigned int kmem\_cache\_size(kmem\_cache\_t \*cachep)**  
\{  
\#if DEBUG  条件编译,调试模式下  
if (cachep->flags & SLAB\_RED\_ZONE)  
return (cachep->objsize - 2\*BYTES\_PER\_WORD); 如果是红区剪掉边沿的2个字占用的空间  
 \#endif  
return cachep->objsize; 返回缓存中对象空间的大小  
\}  
  
kmem\_cache\_t \* kmem\_find\_general\_cachep (size\_t size, int gfpflags)  
\{ 寻找普通缓存  
cache\_sizes\_t \*csizep = cache\_sizes;  
  
/\* This function could be moved to the header file, and  
\* made inline so consumers can quickly determine what  
\* cache pointer they require.  
\*/ 注释建议将本函数移动到某一头文件中  
for ( ; csizep->cs\_size; csizep++) \{  
if (size > csizep->cs\_size)  
continue;  
break;  
\}  
return (gfpflags & GFP\_DMA) ? csizep->cs\_dmacachep : csizep->cs\_cachep; 判读是否要求dma,返回相应的  
\}  
  
\#ifdef CONFIG\_SMP  条件编译，对称多处理器的支持：  
  
/\* called with cache\_chain\_sem acquired. \*/ 需要有cache\_chain\_sem允许才可以被调用  
**static int kmem\_tune\_cpucache (kmem\_cache\_t\* cachep, int limit, int batchcount)**  
\{ 对于cpu缓存的优化  
ccupdate\_struct\_t new;  
int i;  
  
/\*  
\* These are admin-provided, so we are more graceful.  
\*/  
if (limit < 0)  
return \-EINVAL;  
if (batchcount < 0)  
return \-EINVAL;  
if (batchcount > limit)  
return \-EINVAL;  
if (limit != 0 && !batchcount)  
return \-EINVAL;  
  
memset(&new.new,0, sizeof(new.new)); 对新的cpu缓存更新结构体置0  
if (limit) \{  
for (i = 0; i< smp\_num\_cpus; i++) \{ 对每个CPU都按照上限大小+结构体大小分配内核态内存  
cpucache\_t\* ccnew;  
  
ccnew = kmalloc( sizeof(void\*)\*limit+  
sizeof(cpucache\_t), GFP\_KERNEL);  
if (!ccnew)  
goto oom; 出错处理  
ccnew->limit = limit; 设置上限  
ccnew->avail = 0; 0个可用  
new.new\[cpu\_logical\_map(i)\] = ccnew; 新的cpu逻辑映射  
\}  
\}  
new.cachep = cachep; 指向原有缓存区  
spin\_lock\_irq(&cachep->spinlock); 加锁  
cachep->batchcount = batchcount; 计数  
spin\_unlock\_irq(&cachep->spinlock); 解锁  
  
smp\_call\_function\_all\_cpus(do\_ccupdate\_local, (void \*)&new); 给每个cpu都做这个操作  
  
for (i = 0; i < smp\_num\_cpus; i++) \{ 每个释放原有的cpu缓存  
cpucache\_t\* ccold = new.new\[cpu\_logical\_map(i)\];  
if (!ccold)  
continue;  
local\_irq\_disable();  
free\_block(cachep, cc\_entry(ccold), ccold->avail);  
local\_irq\_enable();  
kfree(ccold);  
\}  
return 0;  
**oom:**  
for (i--; i >= 0; i--)  
kfree(new.new\[cpu\_logical\_map(i)\]); 释放新的cpu逻辑映射  
return \-ENOMEM; 没有内存错误  
\}  
  
**static void enable\_cpucache (kmem\_cache\_t \*cachep)**  
\{  
int err;  
int limit;  
  
/\* FIXME: optimize \*/ 设上限  
if (cachep->objsize > PAGE\_SIZE)  
return;  
if (cachep->objsize > 1024)  
limit = 60;  
else if (cachep->objsize > 256)  
limit = 124;  
else  
limit = 252;  
  
err = kmem\_tune\_cpucache(cachep, limit, limit/2);  
if (err)  
printk(KERN\_ERR "enable\_cpucache failed for %s, error %d.\\n",  
cachep->name, -err);  
\} 激活CPU缓存   
  
**static void enable\_all\_cpucaches (void)**  
\{  
struct list\_head\* p;  
  
down(&cache\_chain\_sem); 允许操作缓存链  
  
p = &cache\_cache.next;  
do \{  
kmem\_cache\_t\* cachep = list\_entry(p, kmem\_cache\_t, next);  
  
enable\_cpucache(cachep); 挨个激活  
p = cachep->next.next;  
\} while (p != &cache\_cache.next);  
  
up(&cache\_chain\_sem); 禁止操作缓存链  
\}  
\#endif  
  
/\*\*  
\* kmem\_cache\_reap - Reclaim memory from caches.  
\* @gfp\_mask: the type of memory required.  
\*  
\* Called from do\_try\_to\_free\_pages() and \_\_alloc\_pages()  
\*/ 从缓存中回收内存，在do\_try\_to\_free\_pages()和alloc\_pages()中调用  
**int kmem\_cache\_reap (int gfp\_mask)**  
\{  
slab\_t \*slabp;  
kmem\_cache\_t \*searchp;  
kmem\_cache\_t \*best\_cachep;  
unsigned int best\_pages;  
unsigned int best\_len;  
unsigned int scan;  
int ret = 0;  
  
if (gfp\_mask & \_\_GFP\_WAIT) 需要的内存中包含了GFP\_WAIT位  
down(&cache\_chain\_sem); 允许链操作  
else  
if (down\_trylock(&cache\_chain\_sem)) 非阻塞允许链操作  
return 0;  
  
scan = REAP\_SCANLEN (扫描长度10)  
best\_len = 0;  
best\_pages = 0;  
best\_cachep = NULL;  
searchp = clock\_searchp; 指上次成功回收内存的缓存区结构  
 do \{  
unsigned int pages;  
struct list\_head\* p;  
unsigned int full\_free;  
  
/\* It's safe to test this without holding the cache-lock. \*/  
if (searchp->flags & SLAB\_NO\_REAP) 如果不让回收，则到下一轮  
 goto next;  
spin\_lock\_irq(&searchp->spinlock); 加锁  
if (searchp->growing) 如果正在增长，则到下一轮(同时解锁定)  
goto next\_unlock;  
if (searchp->dflags & DFLGS\_GROWN) \{  
searchp->dflags &= ~DFLGS\_GROWN;  
goto next\_unlock; 如果是动态变量，则将dflags清0，然后到下一轮(同时解锁定)  
\}  
\#ifdef CONFIG\_SMP  条件编译。对称多处理器的情况  
\{  
cpucache\_t \*cc = cc\_data(searchp);  
if (cc && cc->avail) \{  如果有cpu缓存，并且可用，则释放  
\_\_free\_block(searchp, cc\_entry(cc), cc->avail);  
cc->avail = 0;  
\}  
\}  
\#endif  
  
full\_free = 0;  
p = searchp->slabs\_free.next; 指向下一个空slab的对象空间  
 while (p != &searchp->slabs\_free) \{   
slabp = list\_entry(p, slab\_t, list);  
\#if DEBUG  条件编译，如果空的里面有正在使用的对象则报错  
if (slabp->inuse)  
BUG();  
\#endif  
full\_free++;  
p = p->next;  
\} 统计共有多少空的(保存在full\_free)  
  
/\*  
\* Try to avoid slabs with constructors and/or  
\* more than one page per slab (as it can be difficult  
\* to get high orders from gfp()).  
\*/  
pages = full\_free \* (1<<searchp->gfporder); page等于所有的空闲slab块占有的页面数  
if (searchp->ctor) 如果有自己的构建函数  
pages = (pages\*4+1)/5;  
if (searchp->gfporder) 如果超过了1个页面  
pages = (pages\*4+1)/5;  
if (pages > best\_pages) \{ 如果页面数比原有最多的页面数多，则最佳的准备释放的缓存变为新的  
best\_cachep = searchp;  
best\_len = full\_free;  
best\_pages = pages;  
if (pages >= REAP\_PERFECT) \{ 如果大于REAP\_PREFECT(10),则将clock\_searchp指向这些页，然后直接跳转到perfect  
clock\_searchp = list\_entry(searchp->next.next,  
kmem\_cache\_t,next);  
goto perfect;  
\}  
\}  
**next\_unlock:**  
spin\_unlock\_irq(&searchp->spinlock); 解锁  
**next:**  
searchp = list\_entry(searchp->next.next,kmem\_cache\_t,next); 指向下一个链  
\} while (--scan && searchp != clock\_searchp); 搜索达到限制次数或者已经找了所有的slab  
  
clock\_searchp = searchp;  
  
if (!best\_cachep) 找不到可以回收的  
 /\* couldn't find anything to reap \*/  
goto out; 退出  
  
spin\_lock\_irq(&best\_cachep->spinlock); 加锁  
**perfect:**  
/\* free only 50% of the free slabs \*/  
best\_len = (best\_len + 1)/2; 认为可以释放的只有一半  
for (scan = 0; scan < best\_len; scan++) \{  
struct list\_head \*p;  
  
if (best\_cachep->growing) 如果正在增长，则推出  
break;  
p = best\_cachep->slabs\_free.prev;  
if (p == &best\_cachep->slabs\_free) 如果指向了头，则退出  
break;  
slabp = list\_entry(p,slab\_t,list);  
\#if DEBUG  条件编译  
if (slabp->inuse)  如果正在使用，则报错  
BUG();  
\#endif  
list\_del(&slabp->list); 删除链  
STATS\_INC\_REAPED(best\_cachep); 回收计数  
  
/\* Safe to drop the lock. The slab is no longer linked to the  
\* cache.  
\*/ 由于slab已经不在链中，所以可以解锁  
spin\_unlock\_irq(&best\_cachep->spinlock); 解锁  
kmem\_slab\_destroy(best\_cachep, slabp); 删除这个slab，将内存还给系统  
spin\_lock\_irq(&best\_cachep->spinlock); 加锁  
\}  
spin\_unlock\_irq(&best\_cachep->spinlock); 解锁  
ret = scan \* (1 << best\_cachep->gfporder); 返回释放的个数  
**out:**  
up(&cache\_chain\_sem); 禁止对缓存链操作  
 return ret;  
\}  
  
\#ifdef CONFIG\_PROC\_FS  下面是对/proc/slabinfo支持的操作。  
**static void \*s\_start(struct seq\_file \*m, loff\_t \*pos)**  
\{  
loff\_t n = \*pos;  
struct list\_head \*p;  
  
down(&cache\_chain\_sem);  
if (!n)  
return (void \*)1;  
p = &cache\_cache.next;  
while (--n) \{  
p = p->next;  
if (p == &cache\_cache.next)  
return NULL;  
\}  
return list\_entry(p, kmem\_cache\_t, next);  
\}  
  
**static void \*s\_next(struct seq\_file \*m, void \*p, loff\_t \*pos)**  
\{  
kmem\_cache\_t \*cachep = p;  
\++\*pos;  
if (p == (void \*)1)  
return &cache\_cache;  
cachep = list\_entry(cachep->next.next, kmem\_cache\_t, next);  
return cachep == &cache\_cache ? NULL : cachep;  
\}  
  
**static void s\_stop(struct seq\_file \*m, void \*p)**  
\{  
up(&cache\_chain\_sem);  
\}  
  
**static int s\_show(struct seq\_file \*m, void \*p)**  
\{  
kmem\_cache\_t \*cachep = p;  
struct list\_head \*q;  
slab\_t \*slabp;  
unsigned long active\_objs;  
unsigned long num\_objs;  
unsigned long active\_slabs = 0;  
unsigned long num\_slabs;  
const char \*name;  
  
if (p == (void\*)1) \{  
/\*  
\* Output format version, so at least we can change it  
\* without \_too\_ many complaints.  
\*/  
seq\_puts(m, "slabinfo - version: 1.1"  
\#if STATS  
" (statistics)"  
\#endif  
\#ifdef CONFIG\_SMP  
" (SMP)"  
\#endif  
"\\n");  
return 0;  
\}  
  
spin\_lock\_irq(&cachep->spinlock);  
active\_objs = 0;  
num\_slabs = 0;  
list\_for\_each(q,&cachep->slabs\_full) \{  
slabp = list\_entry(q, slab\_t, list);  
if (slabp->inuse != cachep->num)  
BUG();  
active\_objs += cachep->num;  
active\_slabs++;  
\}  
list\_for\_each(q,&cachep->slabs\_partial) \{  
slabp = list\_entry(q, slab\_t, list);  
if (slabp->inuse == cachep->num || !slabp->inuse)  
BUG();  
active\_objs += slabp->inuse;  
active\_slabs++;  
\}  
list\_for\_each(q,&cachep->slabs\_free) \{  
slabp = list\_entry(q, slab\_t, list);  
if (slabp->inuse)  
BUG();  
num\_slabs++;  
\}  
num\_slabs+=active\_slabs;  
num\_objs = num\_slabs\*cachep->num;  
  
name = cachep->name;  
\{  
char tmp;  
mm\_segment\_t old\_fs;  
old\_fs = get\_fs();  
set\_fs(KERNEL\_DS);  
if (\_\_get\_user(tmp, name))  
name = "broken";  
set\_fs(old\_fs);  
\}  
  
seq\_printf(m, "%-17s %6lu %6lu %6u %4lu %4lu %4u",  
name, active\_objs, num\_objs, cachep->objsize,  
active\_slabs, num\_slabs, (1<<cachep->gfporder));  
  
\#if STATS  
\{  
unsigned long errors = cachep->errors;  
unsigned long high = cachep->high\_mark;  
unsigned long grown = cachep->grown;  
unsigned long reaped = cachep->reaped;  
unsigned long allocs = cachep->num\_allocations;  
  
seq\_printf(m, " : %6lu %7lu %5lu %4lu %4lu",  
high, allocs, grown, reaped, errors);  
\}  
\#endif  
\#ifdef CONFIG\_SMP  
\{  
cpucache\_t \*cc = cc\_data(cachep);  
unsigned int batchcount = cachep->batchcount;  
unsigned int limit;  
  
if (cc)  
limit = cc->limit;  
else  
limit = 0;  
seq\_printf(m, " : %4u %4u",  
limit, batchcount);  
\}  
\#endif  
\#if STATS && defined(CONFIG\_SMP)  
\{  
unsigned long allochit = atomic\_read(&cachep->allochit);  
unsigned long allocmiss = atomic\_read(&cachep->allocmiss);  
unsigned long freehit = atomic\_read(&cachep->freehit);  
unsigned long freemiss = atomic\_read(&cachep->freemiss);  
seq\_printf(m, " : %6lu %6lu %6lu %6lu",  
allochit, allocmiss, freehit, freemiss);  
\}  
\#endif  
spin\_unlock\_irq(&cachep->spinlock);  
seq\_putc(m, '\\n');  
return 0;  
\}  
  
/\*\*  
\* slabinfo\_op - iterator that generates /proc/slabinfo  
\*  
\* Output layout:  
\* cache-name  
\* num-active-objs  
\* total-objs  
\* object size  
\* num-active-slabs  
\* total-slabs  
\* num-pages-per-slab  
\* + further values on SMP and with statistics enabled  
\*/  
  
struct seq\_operations  slabinfo\_op = \{  
**start:** s\_start,  
**next:** s\_next,  
**stop:** s\_stop,  
**show:** s\_show  
\};  
  
**\#define MAX\_SLABINFO\_WRITE 128**  
/\*\*  
\* slabinfo\_write - SMP tuning for the slab allocator  
\* @file: unused  
\* @buffer: user buffer  
\* @count: data len  
\* @data: unused  
\*/  
**ssize\_t slabinfo\_write(struct file \*file, const char \*buffer,  
size\_t count, loff\_t \*ppos)**  
\{  
\#ifdef CONFIG\_SMP  
char kbuf\[MAX\_SLABINFO\_WRITE+1\], \*tmp;  
int limit, batchcount, res;  
struct list\_head \*p;  
  
if (count > MAX\_SLABINFO\_WRITE)  
return \-EINVAL;  
if (copy\_from\_user(&kbuf, buffer, count))  
return \-EFAULT;  
kbuf\[MAX\_SLABINFO\_WRITE\] = '\\0';  
  
tmp = strchr(kbuf, ' ');  
if (!tmp)  
return \-EINVAL;  
\*tmp = '\\0';  
tmp++;  
limit = simple\_strtol(tmp, &tmp, 10);  
while (\*tmp == ' ')  
tmp++;  
batchcount = simple\_strtol(tmp, &tmp, 10);  
  
/\* Find the cache in the chain of caches. \*/  
down(&cache\_chain\_sem);  
res = -EINVAL;  
list\_for\_each(p,&cache\_chain) \{  
kmem\_cache\_t \*cachep = list\_entry(p, kmem\_cache\_t, next);  
  
if (!strcmp(cachep->name, kbuf)) \{  
res = kmem\_tune\_cpucache(cachep, limit, batchcount);  
break;  
\}  
\}  
up(&cache\_chain\_sem);  
if (res >= 0)  
res = count;  
return res;  
\#else  
return \-EINVAL;  
\#endif  
\}  
\#endif

[www.usenix.org]: http://www.usenix.org/
[http_www.cs.helsinki.fi_linux_linux-kernel_2001-17_1193.html]: http://www.cs.helsinki.fi/linux/linux-kernel/2001-17/1193.html
[http_www.rtems.com_rtems_maillistArchives_rtems-users_2001_august_msg00056.html]: http://www.rtems.com/rtems/maillistArchives/rtems-users/2001/august/msg00056.html