1 /* 2 * linux/mm/slab.c 3 * Written by Mark Hemment, 1996/97. 4 * (markhe@nextd.demon.co.uk) 5 * 6 * kmem_cache_destroy() + some cleanup - 1999 Andrea Arcangeli 7 * 8 * Major cleanup, different bufctl logic, per-cpu arrays 9 * (c) 2000 Manfred Spraul 10 * 11 * Cleanup, make the head arrays unconditional, preparation for NUMA 12 * (c) 2002 Manfred Spraul 13 * 14 * An implementation of the Slab Allocator as described in outline in; 15 * UNIX Internals: The New Frontiers by Uresh Vahalia 16 * Pub: Prentice Hall ISBN 0-13-101908-2 17 * or with a little more detail in; 18 * The Slab Allocator: An Object-Caching Kernel Memory Allocator 19 * Jeff Bonwick (Sun Microsystems). 20 * Presented at: USENIX Summer 1994 Technical Conference 21 * 22 * The memory is organized in caches, one cache for each object type. 23 * (e.g. inode_cache, dentry_cache, buffer_head, vm_area_struct) 24 * Each cache consists out of many slabs (they are small (usually one 25 * page long) and always contiguous), and each slab contains multiple 26 * initialized objects. 27 * 28 * This means, that your constructor is used only for newly allocated 29 * slabs and you must pass objects with the same initializations to 30 * kmem_cache_free. 31 * 32 * Each cache can only support one memory type (GFP_DMA, GFP_HIGHMEM, 33 * normal). If you need a special memory type, then must create a new 34 * cache for that memory type. 35 * 36 * In order to reduce fragmentation, the slabs are sorted in 3 groups: 37 * full slabs with 0 free objects 38 * partial slabs 39 * empty slabs with no allocated objects 40 * 41 * If partial slabs exist, then new allocations come from these slabs, 42 * otherwise from empty slabs or new slabs are allocated. 43 * 44 * kmem_cache_destroy() CAN CRASH if you try to allocate from the cache 45 * during kmem_cache_destroy(). The caller must prevent concurrent allocs. 46 * 47 * Each cache has a short per-cpu head array, most allocs 48 * and frees go into that array, and if that array overflows, then 1/2 49 * of the entries in the array are given back into the global cache. 50 * The head array is strictly LIFO and should improve the cache hit rates. 51 * On SMP, it additionally reduces the spinlock operations. 52 * 53 * The c_cpuarray may not be read with enabled local interrupts - 54 * it's changed with a smp_call_function(). 55 * 56 * SMP synchronization: 57 * constructors and destructors are called without any locking. 58 * Several members in struct kmem_cache and struct slab never change, they 59 * are accessed without any locking. 60 * The per-cpu arrays are never accessed from the wrong cpu, no locking, 61 * and local interrupts are disabled so slab code is preempt-safe. 62 * The non-constant members are protected with a per-cache irq spinlock. 63 * 64 * Many thanks to Mark Hemment, who wrote another per-cpu slab patch 65 * in 2000 - many ideas in the current implementation are derived from 66 * his patch. 67 * 68 * Further notes from the original documentation: 69 * 70 * 11 April '97. Started multi-threading - markhe 71 * The global cache-chain is protected by the mutex 'slab_mutex'. 72 * The sem is only needed when accessing/extending the cache-chain, which 73 * can never happen inside an interrupt (kmem_cache_create(), 74 * kmem_cache_shrink() and kmem_cache_reap()). 75 * 76 * At present, each engine can be growing a cache. This should be blocked. 77 * 78 * 15 March 2005. NUMA slab allocator. 79 * Shai Fultheim <shai@scalex86.org>. 80 * Shobhit Dayal <shobhit@calsoftinc.com> 81 * Alok N Kataria <alokk@calsoftinc.com> 82 * Christoph Lameter <christoph@lameter.com> 83 * 84 * Modified the slab allocator to be node aware on NUMA systems. 85 * Each node has its own list of partial, free and full slabs. 86 * All object allocations for a node occur from node specific slab lists. 87 */ 88 89 #include <linux/slab.h> 90 #include <linux/mm.h> 91 #include <linux/poison.h> 92 #include <linux/swap.h> 93 #include <linux/cache.h> 94 #include <linux/interrupt.h> 95 #include <linux/init.h> 96 #include <linux/compiler.h> 97 #include <linux/cpuset.h> 98 #include <linux/proc_fs.h> 99 #include <linux/seq_file.h> 100 #include <linux/notifier.h> 101 #include <linux/kallsyms.h> 102 #include <linux/cpu.h> 103 #include <linux/sysctl.h> 104 #include <linux/module.h> 105 #include <linux/rcupdate.h> 106 #include <linux/string.h> 107 #include <linux/uaccess.h> 108 #include <linux/nodemask.h> 109 #include <linux/kmemleak.h> 110 #include <linux/mempolicy.h> 111 #include <linux/mutex.h> 112 #include <linux/fault-inject.h> 113 #include <linux/rtmutex.h> 114 #include <linux/reciprocal_div.h> 115 #include <linux/debugobjects.h> 116 #include <linux/kmemcheck.h> 117 #include <linux/memory.h> 118 #include <linux/prefetch.h> 119 120 #include <net/sock.h> 121 122 #include <asm/cacheflush.h> 123 #include <asm/tlbflush.h> 124 #include <asm/page.h> 125 126 #include <trace/events/kmem.h> 127 128 #include "internal.h" 129 130 #include "slab.h" 131 132 /* 133 * DEBUG - 1 for kmem_cache_create() to honour; SLAB_RED_ZONE & SLAB_POISON. 134 * 0 for faster, smaller code (especially in the critical paths). 135 * 136 * STATS - 1 to collect stats for /proc/slabinfo. 137 * 0 for faster, smaller code (especially in the critical paths). 138 * 139 * FORCED_DEBUG - 1 enables SLAB_RED_ZONE and SLAB_POISON (if possible) 140 */ 141 142 #ifdef CONFIG_DEBUG_SLAB 143 #define DEBUG 1 144 #define STATS 1 145 #define FORCED_DEBUG 1 146 #else 147 #define DEBUG 0 148 #define STATS 0 149 #define FORCED_DEBUG 0 150 #endif 151 152 /* Shouldn't this be in a header file somewhere? */ 153 #define BYTES_PER_WORD sizeof(void *) 154 #define REDZONE_ALIGN max(BYTES_PER_WORD, __alignof__(unsigned long long)) 155 156 #ifndef ARCH_KMALLOC_FLAGS 157 #define ARCH_KMALLOC_FLAGS SLAB_HWCACHE_ALIGN 158 #endif 159 160 #define FREELIST_BYTE_INDEX (((PAGE_SIZE >> BITS_PER_BYTE) \ 161 <= SLAB_OBJ_MIN_SIZE) ? 1 : 0) 162 163 #if FREELIST_BYTE_INDEX 164 typedef unsigned char freelist_idx_t; 165 #else 166 typedef unsigned short freelist_idx_t; 167 #endif 168 169 #define SLAB_OBJ_MAX_NUM ((1 << sizeof(freelist_idx_t) * BITS_PER_BYTE) - 1) 170 171 /* 172 * true if a page was allocated from pfmemalloc reserves for network-based 173 * swap 174 */ 175 static bool pfmemalloc_active __read_mostly; 176 177 /* 178 * struct array_cache 179 * 180 * Purpose: 181 * - LIFO ordering, to hand out cache-warm objects from _alloc 182 * - reduce the number of linked list operations 183 * - reduce spinlock operations 184 * 185 * The limit is stored in the per-cpu structure to reduce the data cache 186 * footprint. 187 * 188 */ 189 struct array_cache { 190 unsigned int avail; 191 unsigned int limit; 192 unsigned int batchcount; 193 unsigned int touched; 194 void *entry[]; /* 195 * Must have this definition in here for the proper 196 * alignment of array_cache. Also simplifies accessing 197 * the entries. 198 * 199 * Entries should not be directly dereferenced as 200 * entries belonging to slabs marked pfmemalloc will 201 * have the lower bits set SLAB_OBJ_PFMEMALLOC 202 */ 203 }; 204 205 struct alien_cache { 206 spinlock_t lock; 207 struct array_cache ac; 208 }; 209 210 #define SLAB_OBJ_PFMEMALLOC 1 211 static inline bool is_obj_pfmemalloc(void *objp) 212 { 213 return (unsigned long)objp & SLAB_OBJ_PFMEMALLOC; 214 } 215 216 static inline void set_obj_pfmemalloc(void **objp) 217 { 218 *objp = (void *)((unsigned long)*objp | SLAB_OBJ_PFMEMALLOC); 219 return; 220 } 221 222 static inline void clear_obj_pfmemalloc(void **objp) 223 { 224 *objp = (void *)((unsigned long)*objp & ~SLAB_OBJ_PFMEMALLOC); 225 } 226 227 /* 228 * bootstrap: The caches do not work without cpuarrays anymore, but the 229 * cpuarrays are allocated from the generic caches... 230 */ 231 #define BOOT_CPUCACHE_ENTRIES 1 232 struct arraycache_init { 233 struct array_cache cache; 234 void *entries[BOOT_CPUCACHE_ENTRIES]; 235 }; 236 237 /* 238 * Need this for bootstrapping a per node allocator. 239 */ 240 #define NUM_INIT_LISTS (3 * MAX_NUMNODES) 241 static struct kmem_cache_node __initdata init_kmem_cache_node[NUM_INIT_LISTS]; 242 #define CACHE_CACHE 0 243 #define SIZE_AC MAX_NUMNODES 244 #define SIZE_NODE (2 * MAX_NUMNODES) 245 246 static int drain_freelist(struct kmem_cache *cache, 247 struct kmem_cache_node *n, int tofree); 248 static void free_block(struct kmem_cache *cachep, void **objpp, int len, 249 int node, struct list_head *list); 250 static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list); 251 static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp); 252 static void cache_reap(struct work_struct *unused); 253 254 static int slab_early_init = 1; 255 256 #define INDEX_AC kmalloc_index(sizeof(struct arraycache_init)) 257 #define INDEX_NODE kmalloc_index(sizeof(struct kmem_cache_node)) 258 259 static void kmem_cache_node_init(struct kmem_cache_node *parent) 260 { 261 INIT_LIST_HEAD(&parent->slabs_full); 262 INIT_LIST_HEAD(&parent->slabs_partial); 263 INIT_LIST_HEAD(&parent->slabs_free); 264 parent->shared = NULL; 265 parent->alien = NULL; 266 parent->colour_next = 0; 267 spin_lock_init(&parent->list_lock); 268 parent->free_objects = 0; 269 parent->free_touched = 0; 270 } 271 272 #define MAKE_LIST(cachep, listp, slab, nodeid) \ 273 do { \ 274 INIT_LIST_HEAD(listp); \ 275 list_splice(&get_node(cachep, nodeid)->slab, listp); \ 276 } while (0) 277 278 #define MAKE_ALL_LISTS(cachep, ptr, nodeid) \ 279 do { \ 280 MAKE_LIST((cachep), (&(ptr)->slabs_full), slabs_full, nodeid); \ 281 MAKE_LIST((cachep), (&(ptr)->slabs_partial), slabs_partial, nodeid); \ 282 MAKE_LIST((cachep), (&(ptr)->slabs_free), slabs_free, nodeid); \ 283 } while (0) 284 285 #define CFLGS_OFF_SLAB (0x80000000UL) 286 #define OFF_SLAB(x) ((x)->flags & CFLGS_OFF_SLAB) 287 288 #define BATCHREFILL_LIMIT 16 289 /* 290 * Optimization question: fewer reaps means less probability for unnessary 291 * cpucache drain/refill cycles. 292 * 293 * OTOH the cpuarrays can contain lots of objects, 294 * which could lock up otherwise freeable slabs. 295 */ 296 #define REAPTIMEOUT_AC (2*HZ) 297 #define REAPTIMEOUT_NODE (4*HZ) 298 299 #if STATS 300 #define STATS_INC_ACTIVE(x) ((x)->num_active++) 301 #define STATS_DEC_ACTIVE(x) ((x)->num_active--) 302 #define STATS_INC_ALLOCED(x) ((x)->num_allocations++) 303 #define STATS_INC_GROWN(x) ((x)->grown++) 304 #define STATS_ADD_REAPED(x,y) ((x)->reaped += (y)) 305 #define STATS_SET_HIGH(x) \ 306 do { \ 307 if ((x)->num_active > (x)->high_mark) \ 308 (x)->high_mark = (x)->num_active; \ 309 } while (0) 310 #define STATS_INC_ERR(x) ((x)->errors++) 311 #define STATS_INC_NODEALLOCS(x) ((x)->node_allocs++) 312 #define STATS_INC_NODEFREES(x) ((x)->node_frees++) 313 #define STATS_INC_ACOVERFLOW(x) ((x)->node_overflow++) 314 #define STATS_SET_FREEABLE(x, i) \ 315 do { \ 316 if ((x)->max_freeable < i) \ 317 (x)->max_freeable = i; \ 318 } while (0) 319 #define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit) 320 #define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss) 321 #define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit) 322 #define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss) 323 #else 324 #define STATS_INC_ACTIVE(x) do { } while (0) 325 #define STATS_DEC_ACTIVE(x) do { } while (0) 326 #define STATS_INC_ALLOCED(x) do { } while (0) 327 #define STATS_INC_GROWN(x) do { } while (0) 328 #define STATS_ADD_REAPED(x,y) do { (void)(y); } while (0) 329 #define STATS_SET_HIGH(x) do { } while (0) 330 #define STATS_INC_ERR(x) do { } while (0) 331 #define STATS_INC_NODEALLOCS(x) do { } while (0) 332 #define STATS_INC_NODEFREES(x) do { } while (0) 333 #define STATS_INC_ACOVERFLOW(x) do { } while (0) 334 #define STATS_SET_FREEABLE(x, i) do { } while (0) 335 #define STATS_INC_ALLOCHIT(x) do { } while (0) 336 #define STATS_INC_ALLOCMISS(x) do { } while (0) 337 #define STATS_INC_FREEHIT(x) do { } while (0) 338 #define STATS_INC_FREEMISS(x) do { } while (0) 339 #endif 340 341 #if DEBUG 342 343 /* 344 * memory layout of objects: 345 * 0 : objp 346 * 0 .. cachep->obj_offset - BYTES_PER_WORD - 1: padding. This ensures that 347 * the end of an object is aligned with the end of the real 348 * allocation. Catches writes behind the end of the allocation. 349 * cachep->obj_offset - BYTES_PER_WORD .. cachep->obj_offset - 1: 350 * redzone word. 351 * cachep->obj_offset: The real object. 352 * cachep->size - 2* BYTES_PER_WORD: redzone word [BYTES_PER_WORD long] 353 * cachep->size - 1* BYTES_PER_WORD: last caller address 354 * [BYTES_PER_WORD long] 355 */ 356 static int obj_offset(struct kmem_cache *cachep) 357 { 358 return cachep->obj_offset; 359 } 360 361 static unsigned long long *dbg_redzone1(struct kmem_cache *cachep, void *objp) 362 { 363 BUG_ON(!(cachep->flags & SLAB_RED_ZONE)); 364 return (unsigned long long*) (objp + obj_offset(cachep) - 365 sizeof(unsigned long long)); 366 } 367 368 static unsigned long long *dbg_redzone2(struct kmem_cache *cachep, void *objp) 369 { 370 BUG_ON(!(cachep->flags & SLAB_RED_ZONE)); 371 if (cachep->flags & SLAB_STORE_USER) 372 return (unsigned long long *)(objp + cachep->size - 373 sizeof(unsigned long long) - 374 REDZONE_ALIGN); 375 return (unsigned long long *) (objp + cachep->size - 376 sizeof(unsigned long long)); 377 } 378 379 static void **dbg_userword(struct kmem_cache *cachep, void *objp) 380 { 381 BUG_ON(!(cachep->flags & SLAB_STORE_USER)); 382 return (void **)(objp + cachep->size - BYTES_PER_WORD); 383 } 384 385 #else 386 387 #define obj_offset(x) 0 388 #define dbg_redzone1(cachep, objp) ({BUG(); (unsigned long long *)NULL;}) 389 #define dbg_redzone2(cachep, objp) ({BUG(); (unsigned long long *)NULL;}) 390 #define dbg_userword(cachep, objp) ({BUG(); (void **)NULL;}) 391 392 #endif 393 394 #define OBJECT_FREE (0) 395 #define OBJECT_ACTIVE (1) 396 397 #ifdef CONFIG_DEBUG_SLAB_LEAK 398 399 static void set_obj_status(struct page *page, int idx, int val) 400 { 401 int freelist_size; 402 char *status; 403 struct kmem_cache *cachep = page->slab_cache; 404 405 freelist_size = cachep->num * sizeof(freelist_idx_t); 406 status = (char *)page->freelist + freelist_size; 407 status[idx] = val; 408 } 409 410 static inline unsigned int get_obj_status(struct page *page, int idx) 411 { 412 int freelist_size; 413 char *status; 414 struct kmem_cache *cachep = page->slab_cache; 415 416 freelist_size = cachep->num * sizeof(freelist_idx_t); 417 status = (char *)page->freelist + freelist_size; 418 419 return status[idx]; 420 } 421 422 #else 423 static inline void set_obj_status(struct page *page, int idx, int val) {} 424 425 #endif 426 427 /* 428 * Do not go above this order unless 0 objects fit into the slab or 429 * overridden on the command line. 430 */ 431 #define SLAB_MAX_ORDER_HI 1 432 #define SLAB_MAX_ORDER_LO 0 433 static int slab_max_order = SLAB_MAX_ORDER_LO; 434 static bool slab_max_order_set __initdata; 435 436 static inline struct kmem_cache *virt_to_cache(const void *obj) 437 { 438 struct page *page = virt_to_head_page(obj); 439 return page->slab_cache; 440 } 441 442 static inline void *index_to_obj(struct kmem_cache *cache, struct page *page, 443 unsigned int idx) 444 { 445 return page->s_mem + cache->size * idx; 446 } 447 448 /* 449 * We want to avoid an expensive divide : (offset / cache->size) 450 * Using the fact that size is a constant for a particular cache, 451 * we can replace (offset / cache->size) by 452 * reciprocal_divide(offset, cache->reciprocal_buffer_size) 453 */ 454 static inline unsigned int obj_to_index(const struct kmem_cache *cache, 455 const struct page *page, void *obj) 456 { 457 u32 offset = (obj - page->s_mem); 458 return reciprocal_divide(offset, cache->reciprocal_buffer_size); 459 } 460 461 static struct arraycache_init initarray_generic = 462 { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} }; 463 464 /* internal cache of cache description objs */ 465 static struct kmem_cache kmem_cache_boot = { 466 .batchcount = 1, 467 .limit = BOOT_CPUCACHE_ENTRIES, 468 .shared = 1, 469 .size = sizeof(struct kmem_cache), 470 .name = "kmem_cache", 471 }; 472 473 #define BAD_ALIEN_MAGIC 0x01020304ul 474 475 static DEFINE_PER_CPU(struct delayed_work, slab_reap_work); 476 477 static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep) 478 { 479 return cachep->array[smp_processor_id()]; 480 } 481 482 static size_t calculate_freelist_size(int nr_objs, size_t align) 483 { 484 size_t freelist_size; 485 486 freelist_size = nr_objs * sizeof(freelist_idx_t); 487 if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) 488 freelist_size += nr_objs * sizeof(char); 489 490 if (align) 491 freelist_size = ALIGN(freelist_size, align); 492 493 return freelist_size; 494 } 495 496 static int calculate_nr_objs(size_t slab_size, size_t buffer_size, 497 size_t idx_size, size_t align) 498 { 499 int nr_objs; 500 size_t remained_size; 501 size_t freelist_size; 502 int extra_space = 0; 503 504 if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) 505 extra_space = sizeof(char); 506 /* 507 * Ignore padding for the initial guess. The padding 508 * is at most @align-1 bytes, and @buffer_size is at 509 * least @align. In the worst case, this result will 510 * be one greater than the number of objects that fit 511 * into the memory allocation when taking the padding 512 * into account. 513 */ 514 nr_objs = slab_size / (buffer_size + idx_size + extra_space); 515 516 /* 517 * This calculated number will be either the right 518 * amount, or one greater than what we want. 519 */ 520 remained_size = slab_size - nr_objs * buffer_size; 521 freelist_size = calculate_freelist_size(nr_objs, align); 522 if (remained_size < freelist_size) 523 nr_objs--; 524 525 return nr_objs; 526 } 527 528 /* 529 * Calculate the number of objects and left-over bytes for a given buffer size. 530 */ 531 static void cache_estimate(unsigned long gfporder, size_t buffer_size, 532 size_t align, int flags, size_t *left_over, 533 unsigned int *num) 534 { 535 int nr_objs; 536 size_t mgmt_size; 537 size_t slab_size = PAGE_SIZE << gfporder; 538 539 /* 540 * The slab management structure can be either off the slab or 541 * on it. For the latter case, the memory allocated for a 542 * slab is used for: 543 * 544 * - One unsigned int for each object 545 * - Padding to respect alignment of @align 546 * - @buffer_size bytes for each object 547 * 548 * If the slab management structure is off the slab, then the 549 * alignment will already be calculated into the size. Because 550 * the slabs are all pages aligned, the objects will be at the 551 * correct alignment when allocated. 552 */ 553 if (flags & CFLGS_OFF_SLAB) { 554 mgmt_size = 0; 555 nr_objs = slab_size / buffer_size; 556 557 } else { 558 nr_objs = calculate_nr_objs(slab_size, buffer_size, 559 sizeof(freelist_idx_t), align); 560 mgmt_size = calculate_freelist_size(nr_objs, align); 561 } 562 *num = nr_objs; 563 *left_over = slab_size - nr_objs*buffer_size - mgmt_size; 564 } 565 566 #if DEBUG 567 #define slab_error(cachep, msg) __slab_error(__func__, cachep, msg) 568 569 static void __slab_error(const char *function, struct kmem_cache *cachep, 570 char *msg) 571 { 572 printk(KERN_ERR "slab error in %s(): cache `%s': %s\n", 573 function, cachep->name, msg); 574 dump_stack(); 575 add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); 576 } 577 #endif 578 579 /* 580 * By default on NUMA we use alien caches to stage the freeing of 581 * objects allocated from other nodes. This causes massive memory 582 * inefficiencies when using fake NUMA setup to split memory into a 583 * large number of small nodes, so it can be disabled on the command 584 * line 585 */ 586 587 static int use_alien_caches __read_mostly = 1; 588 static int __init noaliencache_setup(char *s) 589 { 590 use_alien_caches = 0; 591 return 1; 592 } 593 __setup("noaliencache", noaliencache_setup); 594 595 static int __init slab_max_order_setup(char *str) 596 { 597 get_option(&str, &slab_max_order); 598 slab_max_order = slab_max_order < 0 ? 0 : 599 min(slab_max_order, MAX_ORDER - 1); 600 slab_max_order_set = true; 601 602 return 1; 603 } 604 __setup("slab_max_order=", slab_max_order_setup); 605 606 #ifdef CONFIG_NUMA 607 /* 608 * Special reaping functions for NUMA systems called from cache_reap(). 609 * These take care of doing round robin flushing of alien caches (containing 610 * objects freed on different nodes from which they were allocated) and the 611 * flushing of remote pcps by calling drain_node_pages. 612 */ 613 static DEFINE_PER_CPU(unsigned long, slab_reap_node); 614 615 static void init_reap_node(int cpu) 616 { 617 int node; 618 619 node = next_node(cpu_to_mem(cpu), node_online_map); 620 if (node == MAX_NUMNODES) 621 node = first_node(node_online_map); 622 623 per_cpu(slab_reap_node, cpu) = node; 624 } 625 626 static void next_reap_node(void) 627 { 628 int node = __this_cpu_read(slab_reap_node); 629 630 node = next_node(node, node_online_map); 631 if (unlikely(node >= MAX_NUMNODES)) 632 node = first_node(node_online_map); 633 __this_cpu_write(slab_reap_node, node); 634 } 635 636 #else 637 #define init_reap_node(cpu) do { } while (0) 638 #define next_reap_node(void) do { } while (0) 639 #endif 640 641 /* 642 * Initiate the reap timer running on the target CPU. We run at around 1 to 2Hz 643 * via the workqueue/eventd. 644 * Add the CPU number into the expiration time to minimize the possibility of 645 * the CPUs getting into lockstep and contending for the global cache chain 646 * lock. 647 */ 648 static void start_cpu_timer(int cpu) 649 { 650 struct delayed_work *reap_work = &per_cpu(slab_reap_work, cpu); 651 652 /* 653 * When this gets called from do_initcalls via cpucache_init(), 654 * init_workqueues() has already run, so keventd will be setup 655 * at that time. 656 */ 657 if (keventd_up() && reap_work->work.func == NULL) { 658 init_reap_node(cpu); 659 INIT_DEFERRABLE_WORK(reap_work, cache_reap); 660 schedule_delayed_work_on(cpu, reap_work, 661 __round_jiffies_relative(HZ, cpu)); 662 } 663 } 664 665 static void init_arraycache(struct array_cache *ac, int limit, int batch) 666 { 667 /* 668 * The array_cache structures contain pointers to free object. 669 * However, when such objects are allocated or transferred to another 670 * cache the pointers are not cleared and they could be counted as 671 * valid references during a kmemleak scan. Therefore, kmemleak must 672 * not scan such objects. 673 */ 674 kmemleak_no_scan(ac); 675 if (ac) { 676 ac->avail = 0; 677 ac->limit = limit; 678 ac->batchcount = batch; 679 ac->touched = 0; 680 } 681 } 682 683 static struct array_cache *alloc_arraycache(int node, int entries, 684 int batchcount, gfp_t gfp) 685 { 686 size_t memsize = sizeof(void *) * entries + sizeof(struct array_cache); 687 struct array_cache *ac = NULL; 688 689 ac = kmalloc_node(memsize, gfp, node); 690 init_arraycache(ac, entries, batchcount); 691 return ac; 692 } 693 694 static inline bool is_slab_pfmemalloc(struct page *page) 695 { 696 return PageSlabPfmemalloc(page); 697 } 698 699 /* Clears pfmemalloc_active if no slabs have pfmalloc set */ 700 static void recheck_pfmemalloc_active(struct kmem_cache *cachep, 701 struct array_cache *ac) 702 { 703 struct kmem_cache_node *n = get_node(cachep, numa_mem_id()); 704 struct page *page; 705 unsigned long flags; 706 707 if (!pfmemalloc_active) 708 return; 709 710 spin_lock_irqsave(&n->list_lock, flags); 711 list_for_each_entry(page, &n->slabs_full, lru) 712 if (is_slab_pfmemalloc(page)) 713 goto out; 714 715 list_for_each_entry(page, &n->slabs_partial, lru) 716 if (is_slab_pfmemalloc(page)) 717 goto out; 718 719 list_for_each_entry(page, &n->slabs_free, lru) 720 if (is_slab_pfmemalloc(page)) 721 goto out; 722 723 pfmemalloc_active = false; 724 out: 725 spin_unlock_irqrestore(&n->list_lock, flags); 726 } 727 728 static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac, 729 gfp_t flags, bool force_refill) 730 { 731 int i; 732 void *objp = ac->entry[--ac->avail]; 733 734 /* Ensure the caller is allowed to use objects from PFMEMALLOC slab */ 735 if (unlikely(is_obj_pfmemalloc(objp))) { 736 struct kmem_cache_node *n; 737 738 if (gfp_pfmemalloc_allowed(flags)) { 739 clear_obj_pfmemalloc(&objp); 740 return objp; 741 } 742 743 /* The caller cannot use PFMEMALLOC objects, find another one */ 744 for (i = 0; i < ac->avail; i++) { 745 /* If a !PFMEMALLOC object is found, swap them */ 746 if (!is_obj_pfmemalloc(ac->entry[i])) { 747 objp = ac->entry[i]; 748 ac->entry[i] = ac->entry[ac->avail]; 749 ac->entry[ac->avail] = objp; 750 return objp; 751 } 752 } 753 754 /* 755 * If there are empty slabs on the slabs_free list and we are 756 * being forced to refill the cache, mark this one !pfmemalloc. 757 */ 758 n = get_node(cachep, numa_mem_id()); 759 if (!list_empty(&n->slabs_free) && force_refill) { 760 struct page *page = virt_to_head_page(objp); 761 ClearPageSlabPfmemalloc(page); 762 clear_obj_pfmemalloc(&objp); 763 recheck_pfmemalloc_active(cachep, ac); 764 return objp; 765 } 766 767 /* No !PFMEMALLOC objects available */ 768 ac->avail++; 769 objp = NULL; 770 } 771 772 return objp; 773 } 774 775 static inline void *ac_get_obj(struct kmem_cache *cachep, 776 struct array_cache *ac, gfp_t flags, bool force_refill) 777 { 778 void *objp; 779 780 if (unlikely(sk_memalloc_socks())) 781 objp = __ac_get_obj(cachep, ac, flags, force_refill); 782 else 783 objp = ac->entry[--ac->avail]; 784 785 return objp; 786 } 787 788 static void *__ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac, 789 void *objp) 790 { 791 if (unlikely(pfmemalloc_active)) { 792 /* Some pfmemalloc slabs exist, check if this is one */ 793 struct page *page = virt_to_head_page(objp); 794 if (PageSlabPfmemalloc(page)) 795 set_obj_pfmemalloc(&objp); 796 } 797 798 return objp; 799 } 800 801 static inline void ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac, 802 void *objp) 803 { 804 if (unlikely(sk_memalloc_socks())) 805 objp = __ac_put_obj(cachep, ac, objp); 806 807 ac->entry[ac->avail++] = objp; 808 } 809 810 /* 811 * Transfer objects in one arraycache to another. 812 * Locking must be handled by the caller. 813 * 814 * Return the number of entries transferred. 815 */ 816 static int transfer_objects(struct array_cache *to, 817 struct array_cache *from, unsigned int max) 818 { 819 /* Figure out how many entries to transfer */ 820 int nr = min3(from->avail, max, to->limit - to->avail); 821 822 if (!nr) 823 return 0; 824 825 memcpy(to->entry + to->avail, from->entry + from->avail -nr, 826 sizeof(void *) *nr); 827 828 from->avail -= nr; 829 to->avail += nr; 830 return nr; 831 } 832 833 #ifndef CONFIG_NUMA 834 835 #define drain_alien_cache(cachep, alien) do { } while (0) 836 #define reap_alien(cachep, n) do { } while (0) 837 838 static inline struct alien_cache **alloc_alien_cache(int node, 839 int limit, gfp_t gfp) 840 { 841 return (struct alien_cache **)BAD_ALIEN_MAGIC; 842 } 843 844 static inline void free_alien_cache(struct alien_cache **ac_ptr) 845 { 846 } 847 848 static inline int cache_free_alien(struct kmem_cache *cachep, void *objp) 849 { 850 return 0; 851 } 852 853 static inline void *alternate_node_alloc(struct kmem_cache *cachep, 854 gfp_t flags) 855 { 856 return NULL; 857 } 858 859 static inline void *____cache_alloc_node(struct kmem_cache *cachep, 860 gfp_t flags, int nodeid) 861 { 862 return NULL; 863 } 864 865 #else /* CONFIG_NUMA */ 866 867 static void *____cache_alloc_node(struct kmem_cache *, gfp_t, int); 868 static void *alternate_node_alloc(struct kmem_cache *, gfp_t); 869 870 static struct alien_cache *__alloc_alien_cache(int node, int entries, 871 int batch, gfp_t gfp) 872 { 873 size_t memsize = sizeof(void *) * entries + sizeof(struct alien_cache); 874 struct alien_cache *alc = NULL; 875 876 alc = kmalloc_node(memsize, gfp, node); 877 init_arraycache(&alc->ac, entries, batch); 878 spin_lock_init(&alc->lock); 879 return alc; 880 } 881 882 static struct alien_cache **alloc_alien_cache(int node, int limit, gfp_t gfp) 883 { 884 struct alien_cache **alc_ptr; 885 size_t memsize = sizeof(void *) * nr_node_ids; 886 int i; 887 888 if (limit > 1) 889 limit = 12; 890 alc_ptr = kzalloc_node(memsize, gfp, node); 891 if (!alc_ptr) 892 return NULL; 893 894 for_each_node(i) { 895 if (i == node || !node_online(i)) 896 continue; 897 alc_ptr[i] = __alloc_alien_cache(node, limit, 0xbaadf00d, gfp); 898 if (!alc_ptr[i]) { 899 for (i--; i >= 0; i--) 900 kfree(alc_ptr[i]); 901 kfree(alc_ptr); 902 return NULL; 903 } 904 } 905 return alc_ptr; 906 } 907 908 static void free_alien_cache(struct alien_cache **alc_ptr) 909 { 910 int i; 911 912 if (!alc_ptr) 913 return; 914 for_each_node(i) 915 kfree(alc_ptr[i]); 916 kfree(alc_ptr); 917 } 918 919 static void __drain_alien_cache(struct kmem_cache *cachep, 920 struct array_cache *ac, int node, 921 struct list_head *list) 922 { 923 struct kmem_cache_node *n = get_node(cachep, node); 924 925 if (ac->avail) { 926 spin_lock(&n->list_lock); 927 /* 928 * Stuff objects into the remote nodes shared array first. 929 * That way we could avoid the overhead of putting the objects 930 * into the free lists and getting them back later. 931 */ 932 if (n->shared) 933 transfer_objects(n->shared, ac, ac->limit); 934 935 free_block(cachep, ac->entry, ac->avail, node, list); 936 ac->avail = 0; 937 spin_unlock(&n->list_lock); 938 } 939 } 940 941 /* 942 * Called from cache_reap() to regularly drain alien caches round robin. 943 */ 944 static void reap_alien(struct kmem_cache *cachep, struct kmem_cache_node *n) 945 { 946 int node = __this_cpu_read(slab_reap_node); 947 948 if (n->alien) { 949 struct alien_cache *alc = n->alien[node]; 950 struct array_cache *ac; 951 952 if (alc) { 953 ac = &alc->ac; 954 if (ac->avail && spin_trylock_irq(&alc->lock)) { 955 LIST_HEAD(list); 956 957 __drain_alien_cache(cachep, ac, node, &list); 958 spin_unlock_irq(&alc->lock); 959 slabs_destroy(cachep, &list); 960 } 961 } 962 } 963 } 964 965 static void drain_alien_cache(struct kmem_cache *cachep, 966 struct alien_cache **alien) 967 { 968 int i = 0; 969 struct alien_cache *alc; 970 struct array_cache *ac; 971 unsigned long flags; 972 973 for_each_online_node(i) { 974 alc = alien[i]; 975 if (alc) { 976 LIST_HEAD(list); 977 978 ac = &alc->ac; 979 spin_lock_irqsave(&alc->lock, flags); 980 __drain_alien_cache(cachep, ac, i, &list); 981 spin_unlock_irqrestore(&alc->lock, flags); 982 slabs_destroy(cachep, &list); 983 } 984 } 985 } 986 987 static inline int cache_free_alien(struct kmem_cache *cachep, void *objp) 988 { 989 int nodeid = page_to_nid(virt_to_page(objp)); 990 struct kmem_cache_node *n; 991 struct alien_cache *alien = NULL; 992 struct array_cache *ac; 993 int node; 994 LIST_HEAD(list); 995 996 node = numa_mem_id(); 997 998 /* 999 * Make sure we are not freeing a object from another node to the array 1000 * cache on this cpu. 1001 */ 1002 if (likely(nodeid == node)) 1003 return 0; 1004 1005 n = get_node(cachep, node); 1006 STATS_INC_NODEFREES(cachep); 1007 if (n->alien && n->alien[nodeid]) { 1008 alien = n->alien[nodeid]; 1009 ac = &alien->ac; 1010 spin_lock(&alien->lock); 1011 if (unlikely(ac->avail == ac->limit)) { 1012 STATS_INC_ACOVERFLOW(cachep); 1013 __drain_alien_cache(cachep, ac, nodeid, &list); 1014 } 1015 ac_put_obj(cachep, ac, objp); 1016 spin_unlock(&alien->lock); 1017 slabs_destroy(cachep, &list); 1018 } else { 1019 n = get_node(cachep, nodeid); 1020 spin_lock(&n->list_lock); 1021 free_block(cachep, &objp, 1, nodeid, &list); 1022 spin_unlock(&n->list_lock); 1023 slabs_destroy(cachep, &list); 1024 } 1025 return 1; 1026 } 1027 #endif 1028 1029 /* 1030 * Allocates and initializes node for a node on each slab cache, used for 1031 * either memory or cpu hotplug. If memory is being hot-added, the kmem_cache_node 1032 * will be allocated off-node since memory is not yet online for the new node. 1033 * When hotplugging memory or a cpu, existing node are not replaced if 1034 * already in use. 1035 * 1036 * Must hold slab_mutex. 1037 */ 1038 static int init_cache_node_node(int node) 1039 { 1040 struct kmem_cache *cachep; 1041 struct kmem_cache_node *n; 1042 const size_t memsize = sizeof(struct kmem_cache_node); 1043 1044 list_for_each_entry(cachep, &slab_caches, list) { 1045 /* 1046 * Set up the kmem_cache_node for cpu before we can 1047 * begin anything. Make sure some other cpu on this 1048 * node has not already allocated this 1049 */ 1050 n = get_node(cachep, node); 1051 if (!n) { 1052 n = kmalloc_node(memsize, GFP_KERNEL, node); 1053 if (!n) 1054 return -ENOMEM; 1055 kmem_cache_node_init(n); 1056 n->next_reap = jiffies + REAPTIMEOUT_NODE + 1057 ((unsigned long)cachep) % REAPTIMEOUT_NODE; 1058 1059 /* 1060 * The kmem_cache_nodes don't come and go as CPUs 1061 * come and go. slab_mutex is sufficient 1062 * protection here. 1063 */ 1064 cachep->node[node] = n; 1065 } 1066 1067 spin_lock_irq(&n->list_lock); 1068 n->free_limit = 1069 (1 + nr_cpus_node(node)) * 1070 cachep->batchcount + cachep->num; 1071 spin_unlock_irq(&n->list_lock); 1072 } 1073 return 0; 1074 } 1075 1076 static inline int slabs_tofree(struct kmem_cache *cachep, 1077 struct kmem_cache_node *n) 1078 { 1079 return (n->free_objects + cachep->num - 1) / cachep->num; 1080 } 1081 1082 static void cpuup_canceled(long cpu) 1083 { 1084 struct kmem_cache *cachep; 1085 struct kmem_cache_node *n = NULL; 1086 int node = cpu_to_mem(cpu); 1087 const struct cpumask *mask = cpumask_of_node(node); 1088 1089 list_for_each_entry(cachep, &slab_caches, list) { 1090 struct array_cache *nc; 1091 struct array_cache *shared; 1092 struct alien_cache **alien; 1093 LIST_HEAD(list); 1094 1095 /* cpu is dead; no one can alloc from it. */ 1096 nc = cachep->array[cpu]; 1097 cachep->array[cpu] = NULL; 1098 n = get_node(cachep, node); 1099 1100 if (!n) 1101 goto free_array_cache; 1102 1103 spin_lock_irq(&n->list_lock); 1104 1105 /* Free limit for this kmem_cache_node */ 1106 n->free_limit -= cachep->batchcount; 1107 if (nc) 1108 free_block(cachep, nc->entry, nc->avail, node, &list); 1109 1110 if (!cpumask_empty(mask)) { 1111 spin_unlock_irq(&n->list_lock); 1112 goto free_array_cache; 1113 } 1114 1115 shared = n->shared; 1116 if (shared) { 1117 free_block(cachep, shared->entry, 1118 shared->avail, node, &list); 1119 n->shared = NULL; 1120 } 1121 1122 alien = n->alien; 1123 n->alien = NULL; 1124 1125 spin_unlock_irq(&n->list_lock); 1126 1127 kfree(shared); 1128 if (alien) { 1129 drain_alien_cache(cachep, alien); 1130 free_alien_cache(alien); 1131 } 1132 free_array_cache: 1133 slabs_destroy(cachep, &list); 1134 kfree(nc); 1135 } 1136 /* 1137 * In the previous loop, all the objects were freed to 1138 * the respective cache's slabs, now we can go ahead and 1139 * shrink each nodelist to its limit. 1140 */ 1141 list_for_each_entry(cachep, &slab_caches, list) { 1142 n = get_node(cachep, node); 1143 if (!n) 1144 continue; 1145 drain_freelist(cachep, n, slabs_tofree(cachep, n)); 1146 } 1147 } 1148 1149 static int cpuup_prepare(long cpu) 1150 { 1151 struct kmem_cache *cachep; 1152 struct kmem_cache_node *n = NULL; 1153 int node = cpu_to_mem(cpu); 1154 int err; 1155 1156 /* 1157 * We need to do this right in the beginning since 1158 * alloc_arraycache's are going to use this list. 1159 * kmalloc_node allows us to add the slab to the right 1160 * kmem_cache_node and not this cpu's kmem_cache_node 1161 */ 1162 err = init_cache_node_node(node); 1163 if (err < 0) 1164 goto bad; 1165 1166 /* 1167 * Now we can go ahead with allocating the shared arrays and 1168 * array caches 1169 */ 1170 list_for_each_entry(cachep, &slab_caches, list) { 1171 struct array_cache *nc; 1172 struct array_cache *shared = NULL; 1173 struct alien_cache **alien = NULL; 1174 1175 nc = alloc_arraycache(node, cachep->limit, 1176 cachep->batchcount, GFP_KERNEL); 1177 if (!nc) 1178 goto bad; 1179 if (cachep->shared) { 1180 shared = alloc_arraycache(node, 1181 cachep->shared * cachep->batchcount, 1182 0xbaadf00d, GFP_KERNEL); 1183 if (!shared) { 1184 kfree(nc); 1185 goto bad; 1186 } 1187 } 1188 if (use_alien_caches) { 1189 alien = alloc_alien_cache(node, cachep->limit, GFP_KERNEL); 1190 if (!alien) { 1191 kfree(shared); 1192 kfree(nc); 1193 goto bad; 1194 } 1195 } 1196 cachep->array[cpu] = nc; 1197 n = get_node(cachep, node); 1198 BUG_ON(!n); 1199 1200 spin_lock_irq(&n->list_lock); 1201 if (!n->shared) { 1202 /* 1203 * We are serialised from CPU_DEAD or 1204 * CPU_UP_CANCELLED by the cpucontrol lock 1205 */ 1206 n->shared = shared; 1207 shared = NULL; 1208 } 1209 #ifdef CONFIG_NUMA 1210 if (!n->alien) { 1211 n->alien = alien; 1212 alien = NULL; 1213 } 1214 #endif 1215 spin_unlock_irq(&n->list_lock); 1216 kfree(shared); 1217 free_alien_cache(alien); 1218 } 1219 1220 return 0; 1221 bad: 1222 cpuup_canceled(cpu); 1223 return -ENOMEM; 1224 } 1225 1226 static int cpuup_callback(struct notifier_block *nfb, 1227 unsigned long action, void *hcpu) 1228 { 1229 long cpu = (long)hcpu; 1230 int err = 0; 1231 1232 switch (action) { 1233 case CPU_UP_PREPARE: 1234 case CPU_UP_PREPARE_FROZEN: 1235 mutex_lock(&slab_mutex); 1236 err = cpuup_prepare(cpu); 1237 mutex_unlock(&slab_mutex); 1238 break; 1239 case CPU_ONLINE: 1240 case CPU_ONLINE_FROZEN: 1241 start_cpu_timer(cpu); 1242 break; 1243 #ifdef CONFIG_HOTPLUG_CPU 1244 case CPU_DOWN_PREPARE: 1245 case CPU_DOWN_PREPARE_FROZEN: 1246 /* 1247 * Shutdown cache reaper. Note that the slab_mutex is 1248 * held so that if cache_reap() is invoked it cannot do 1249 * anything expensive but will only modify reap_work 1250 * and reschedule the timer. 1251 */ 1252 cancel_delayed_work_sync(&per_cpu(slab_reap_work, cpu)); 1253 /* Now the cache_reaper is guaranteed to be not running. */ 1254 per_cpu(slab_reap_work, cpu).work.func = NULL; 1255 break; 1256 case CPU_DOWN_FAILED: 1257 case CPU_DOWN_FAILED_FROZEN: 1258 start_cpu_timer(cpu); 1259 break; 1260 case CPU_DEAD: 1261 case CPU_DEAD_FROZEN: 1262 /* 1263 * Even if all the cpus of a node are down, we don't free the 1264 * kmem_cache_node of any cache. This to avoid a race between 1265 * cpu_down, and a kmalloc allocation from another cpu for 1266 * memory from the node of the cpu going down. The node 1267 * structure is usually allocated from kmem_cache_create() and 1268 * gets destroyed at kmem_cache_destroy(). 1269 */ 1270 /* fall through */ 1271 #endif 1272 case CPU_UP_CANCELED: 1273 case CPU_UP_CANCELED_FROZEN: 1274 mutex_lock(&slab_mutex); 1275 cpuup_canceled(cpu); 1276 mutex_unlock(&slab_mutex); 1277 break; 1278 } 1279 return notifier_from_errno(err); 1280 } 1281 1282 static struct notifier_block cpucache_notifier = { 1283 &cpuup_callback, NULL, 0 1284 }; 1285 1286 #if defined(CONFIG_NUMA) && defined(CONFIG_MEMORY_HOTPLUG) 1287 /* 1288 * Drains freelist for a node on each slab cache, used for memory hot-remove. 1289 * Returns -EBUSY if all objects cannot be drained so that the node is not 1290 * removed. 1291 * 1292 * Must hold slab_mutex. 1293 */ 1294 static int __meminit drain_cache_node_node(int node) 1295 { 1296 struct kmem_cache *cachep; 1297 int ret = 0; 1298 1299 list_for_each_entry(cachep, &slab_caches, list) { 1300 struct kmem_cache_node *n; 1301 1302 n = get_node(cachep, node); 1303 if (!n) 1304 continue; 1305 1306 drain_freelist(cachep, n, slabs_tofree(cachep, n)); 1307 1308 if (!list_empty(&n->slabs_full) || 1309 !list_empty(&n->slabs_partial)) { 1310 ret = -EBUSY; 1311 break; 1312 } 1313 } 1314 return ret; 1315 } 1316 1317 static int __meminit slab_memory_callback(struct notifier_block *self, 1318 unsigned long action, void *arg) 1319 { 1320 struct memory_notify *mnb = arg; 1321 int ret = 0; 1322 int nid; 1323 1324 nid = mnb->status_change_nid; 1325 if (nid < 0) 1326 goto out; 1327 1328 switch (action) { 1329 case MEM_GOING_ONLINE: 1330 mutex_lock(&slab_mutex); 1331 ret = init_cache_node_node(nid); 1332 mutex_unlock(&slab_mutex); 1333 break; 1334 case MEM_GOING_OFFLINE: 1335 mutex_lock(&slab_mutex); 1336 ret = drain_cache_node_node(nid); 1337 mutex_unlock(&slab_mutex); 1338 break; 1339 case MEM_ONLINE: 1340 case MEM_OFFLINE: 1341 case MEM_CANCEL_ONLINE: 1342 case MEM_CANCEL_OFFLINE: 1343 break; 1344 } 1345 out: 1346 return notifier_from_errno(ret); 1347 } 1348 #endif /* CONFIG_NUMA && CONFIG_MEMORY_HOTPLUG */ 1349 1350 /* 1351 * swap the static kmem_cache_node with kmalloced memory 1352 */ 1353 static void __init init_list(struct kmem_cache *cachep, struct kmem_cache_node *list, 1354 int nodeid) 1355 { 1356 struct kmem_cache_node *ptr; 1357 1358 ptr = kmalloc_node(sizeof(struct kmem_cache_node), GFP_NOWAIT, nodeid); 1359 BUG_ON(!ptr); 1360 1361 memcpy(ptr, list, sizeof(struct kmem_cache_node)); 1362 /* 1363 * Do not assume that spinlocks can be initialized via memcpy: 1364 */ 1365 spin_lock_init(&ptr->list_lock); 1366 1367 MAKE_ALL_LISTS(cachep, ptr, nodeid); 1368 cachep->node[nodeid] = ptr; 1369 } 1370 1371 /* 1372 * For setting up all the kmem_cache_node for cache whose buffer_size is same as 1373 * size of kmem_cache_node. 1374 */ 1375 static void __init set_up_node(struct kmem_cache *cachep, int index) 1376 { 1377 int node; 1378 1379 for_each_online_node(node) { 1380 cachep->node[node] = &init_kmem_cache_node[index + node]; 1381 cachep->node[node]->next_reap = jiffies + 1382 REAPTIMEOUT_NODE + 1383 ((unsigned long)cachep) % REAPTIMEOUT_NODE; 1384 } 1385 } 1386 1387 /* 1388 * The memory after the last cpu cache pointer is used for the 1389 * the node pointer. 1390 */ 1391 static void setup_node_pointer(struct kmem_cache *cachep) 1392 { 1393 cachep->node = (struct kmem_cache_node **)&cachep->array[nr_cpu_ids]; 1394 } 1395 1396 /* 1397 * Initialisation. Called after the page allocator have been initialised and 1398 * before smp_init(). 1399 */ 1400 void __init kmem_cache_init(void) 1401 { 1402 int i; 1403 1404 BUILD_BUG_ON(sizeof(((struct page *)NULL)->lru) < 1405 sizeof(struct rcu_head)); 1406 kmem_cache = &kmem_cache_boot; 1407 setup_node_pointer(kmem_cache); 1408 1409 if (num_possible_nodes() == 1) 1410 use_alien_caches = 0; 1411 1412 for (i = 0; i < NUM_INIT_LISTS; i++) 1413 kmem_cache_node_init(&init_kmem_cache_node[i]); 1414 1415 set_up_node(kmem_cache, CACHE_CACHE); 1416 1417 /* 1418 * Fragmentation resistance on low memory - only use bigger 1419 * page orders on machines with more than 32MB of memory if 1420 * not overridden on the command line. 1421 */ 1422 if (!slab_max_order_set && totalram_pages > (32 << 20) >> PAGE_SHIFT) 1423 slab_max_order = SLAB_MAX_ORDER_HI; 1424 1425 /* Bootstrap is tricky, because several objects are allocated 1426 * from caches that do not exist yet: 1427 * 1) initialize the kmem_cache cache: it contains the struct 1428 * kmem_cache structures of all caches, except kmem_cache itself: 1429 * kmem_cache is statically allocated. 1430 * Initially an __init data area is used for the head array and the 1431 * kmem_cache_node structures, it's replaced with a kmalloc allocated 1432 * array at the end of the bootstrap. 1433 * 2) Create the first kmalloc cache. 1434 * The struct kmem_cache for the new cache is allocated normally. 1435 * An __init data area is used for the head array. 1436 * 3) Create the remaining kmalloc caches, with minimally sized 1437 * head arrays. 1438 * 4) Replace the __init data head arrays for kmem_cache and the first 1439 * kmalloc cache with kmalloc allocated arrays. 1440 * 5) Replace the __init data for kmem_cache_node for kmem_cache and 1441 * the other cache's with kmalloc allocated memory. 1442 * 6) Resize the head arrays of the kmalloc caches to their final sizes. 1443 */ 1444 1445 /* 1) create the kmem_cache */ 1446 1447 /* 1448 * struct kmem_cache size depends on nr_node_ids & nr_cpu_ids 1449 */ 1450 create_boot_cache(kmem_cache, "kmem_cache", 1451 offsetof(struct kmem_cache, array[nr_cpu_ids]) + 1452 nr_node_ids * sizeof(struct kmem_cache_node *), 1453 SLAB_HWCACHE_ALIGN); 1454 list_add(&kmem_cache->list, &slab_caches); 1455 1456 /* 2+3) create the kmalloc caches */ 1457 1458 /* 1459 * Initialize the caches that provide memory for the array cache and the 1460 * kmem_cache_node structures first. Without this, further allocations will 1461 * bug. 1462 */ 1463 1464 kmalloc_caches[INDEX_AC] = create_kmalloc_cache("kmalloc-ac", 1465 kmalloc_size(INDEX_AC), ARCH_KMALLOC_FLAGS); 1466 1467 if (INDEX_AC != INDEX_NODE) 1468 kmalloc_caches[INDEX_NODE] = 1469 create_kmalloc_cache("kmalloc-node", 1470 kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS); 1471 1472 slab_early_init = 0; 1473 1474 /* 4) Replace the bootstrap head arrays */ 1475 { 1476 struct array_cache *ptr; 1477 1478 ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT); 1479 1480 memcpy(ptr, cpu_cache_get(kmem_cache), 1481 sizeof(struct arraycache_init)); 1482 1483 kmem_cache->array[smp_processor_id()] = ptr; 1484 1485 ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT); 1486 1487 BUG_ON(cpu_cache_get(kmalloc_caches[INDEX_AC]) 1488 != &initarray_generic.cache); 1489 memcpy(ptr, cpu_cache_get(kmalloc_caches[INDEX_AC]), 1490 sizeof(struct arraycache_init)); 1491 1492 kmalloc_caches[INDEX_AC]->array[smp_processor_id()] = ptr; 1493 } 1494 /* 5) Replace the bootstrap kmem_cache_node */ 1495 { 1496 int nid; 1497 1498 for_each_online_node(nid) { 1499 init_list(kmem_cache, &init_kmem_cache_node[CACHE_CACHE + nid], nid); 1500 1501 init_list(kmalloc_caches[INDEX_AC], 1502 &init_kmem_cache_node[SIZE_AC + nid], nid); 1503 1504 if (INDEX_AC != INDEX_NODE) { 1505 init_list(kmalloc_caches[INDEX_NODE], 1506 &init_kmem_cache_node[SIZE_NODE + nid], nid); 1507 } 1508 } 1509 } 1510 1511 create_kmalloc_caches(ARCH_KMALLOC_FLAGS); 1512 } 1513 1514 void __init kmem_cache_init_late(void) 1515 { 1516 struct kmem_cache *cachep; 1517 1518 slab_state = UP; 1519 1520 /* 6) resize the head arrays to their final sizes */ 1521 mutex_lock(&slab_mutex); 1522 list_for_each_entry(cachep, &slab_caches, list) 1523 if (enable_cpucache(cachep, GFP_NOWAIT)) 1524 BUG(); 1525 mutex_unlock(&slab_mutex); 1526 1527 /* Done! */ 1528 slab_state = FULL; 1529 1530 /* 1531 * Register a cpu startup notifier callback that initializes 1532 * cpu_cache_get for all new cpus 1533 */ 1534 register_cpu_notifier(&cpucache_notifier); 1535 1536 #ifdef CONFIG_NUMA 1537 /* 1538 * Register a memory hotplug callback that initializes and frees 1539 * node. 1540 */ 1541 hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI); 1542 #endif 1543 1544 /* 1545 * The reap timers are started later, with a module init call: That part 1546 * of the kernel is not yet operational. 1547 */ 1548 } 1549 1550 static int __init cpucache_init(void) 1551 { 1552 int cpu; 1553 1554 /* 1555 * Register the timers that return unneeded pages to the page allocator 1556 */ 1557 for_each_online_cpu(cpu) 1558 start_cpu_timer(cpu); 1559 1560 /* Done! */ 1561 slab_state = FULL; 1562 return 0; 1563 } 1564 __initcall(cpucache_init); 1565 1566 static noinline void 1567 slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid) 1568 { 1569 #if DEBUG 1570 struct kmem_cache_node *n; 1571 struct page *page; 1572 unsigned long flags; 1573 int node; 1574 static DEFINE_RATELIMIT_STATE(slab_oom_rs, DEFAULT_RATELIMIT_INTERVAL, 1575 DEFAULT_RATELIMIT_BURST); 1576 1577 if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slab_oom_rs)) 1578 return; 1579 1580 printk(KERN_WARNING 1581 "SLAB: Unable to allocate memory on node %d (gfp=0x%x)\n", 1582 nodeid, gfpflags); 1583 printk(KERN_WARNING " cache: %s, object size: %d, order: %d\n", 1584 cachep->name, cachep->size, cachep->gfporder); 1585 1586 for_each_kmem_cache_node(cachep, node, n) { 1587 unsigned long active_objs = 0, num_objs = 0, free_objects = 0; 1588 unsigned long active_slabs = 0, num_slabs = 0; 1589 1590 spin_lock_irqsave(&n->list_lock, flags); 1591 list_for_each_entry(page, &n->slabs_full, lru) { 1592 active_objs += cachep->num; 1593 active_slabs++; 1594 } 1595 list_for_each_entry(page, &n->slabs_partial, lru) { 1596 active_objs += page->active; 1597 active_slabs++; 1598 } 1599 list_for_each_entry(page, &n->slabs_free, lru) 1600 num_slabs++; 1601 1602 free_objects += n->free_objects; 1603 spin_unlock_irqrestore(&n->list_lock, flags); 1604 1605 num_slabs += active_slabs; 1606 num_objs = num_slabs * cachep->num; 1607 printk(KERN_WARNING 1608 " node %d: slabs: %ld/%ld, objs: %ld/%ld, free: %ld\n", 1609 node, active_slabs, num_slabs, active_objs, num_objs, 1610 free_objects); 1611 } 1612 #endif 1613 } 1614 1615 /* 1616 * Interface to system's page allocator. No need to hold the 1617 * kmem_cache_node ->list_lock. 1618 * 1619 * If we requested dmaable memory, we will get it. Even if we 1620 * did not request dmaable memory, we might get it, but that 1621 * would be relatively rare and ignorable. 1622 */ 1623 static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags, 1624 int nodeid) 1625 { 1626 struct page *page; 1627 int nr_pages; 1628 1629 flags |= cachep->allocflags; 1630 if (cachep->flags & SLAB_RECLAIM_ACCOUNT) 1631 flags |= __GFP_RECLAIMABLE; 1632 1633 if (memcg_charge_slab(cachep, flags, cachep->gfporder)) 1634 return NULL; 1635 1636 page = alloc_pages_exact_node(nodeid, flags | __GFP_NOTRACK, cachep->gfporder); 1637 if (!page) { 1638 memcg_uncharge_slab(cachep, cachep->gfporder); 1639 slab_out_of_memory(cachep, flags, nodeid); 1640 return NULL; 1641 } 1642 1643 /* Record if ALLOC_NO_WATERMARKS was set when allocating the slab */ 1644 if (unlikely(page->pfmemalloc)) 1645 pfmemalloc_active = true; 1646 1647 nr_pages = (1 << cachep->gfporder); 1648 if (cachep->flags & SLAB_RECLAIM_ACCOUNT) 1649 add_zone_page_state(page_zone(page), 1650 NR_SLAB_RECLAIMABLE, nr_pages); 1651 else 1652 add_zone_page_state(page_zone(page), 1653 NR_SLAB_UNRECLAIMABLE, nr_pages); 1654 __SetPageSlab(page); 1655 if (page->pfmemalloc) 1656 SetPageSlabPfmemalloc(page); 1657 1658 if (kmemcheck_enabled && !(cachep->flags & SLAB_NOTRACK)) { 1659 kmemcheck_alloc_shadow(page, cachep->gfporder, flags, nodeid); 1660 1661 if (cachep->ctor) 1662 kmemcheck_mark_uninitialized_pages(page, nr_pages); 1663 else 1664 kmemcheck_mark_unallocated_pages(page, nr_pages); 1665 } 1666 1667 return page; 1668 } 1669 1670 /* 1671 * Interface to system's page release. 1672 */ 1673 static void kmem_freepages(struct kmem_cache *cachep, struct page *page) 1674 { 1675 const unsigned long nr_freed = (1 << cachep->gfporder); 1676 1677 kmemcheck_free_shadow(page, cachep->gfporder); 1678 1679 if (cachep->flags & SLAB_RECLAIM_ACCOUNT) 1680 sub_zone_page_state(page_zone(page), 1681 NR_SLAB_RECLAIMABLE, nr_freed); 1682 else 1683 sub_zone_page_state(page_zone(page), 1684 NR_SLAB_UNRECLAIMABLE, nr_freed); 1685 1686 BUG_ON(!PageSlab(page)); 1687 __ClearPageSlabPfmemalloc(page); 1688 __ClearPageSlab(page); 1689 page_mapcount_reset(page); 1690 page->mapping = NULL; 1691 1692 if (current->reclaim_state) 1693 current->reclaim_state->reclaimed_slab += nr_freed; 1694 __free_pages(page, cachep->gfporder); 1695 memcg_uncharge_slab(cachep, cachep->gfporder); 1696 } 1697 1698 static void kmem_rcu_free(struct rcu_head *head) 1699 { 1700 struct kmem_cache *cachep; 1701 struct page *page; 1702 1703 page = container_of(head, struct page, rcu_head); 1704 cachep = page->slab_cache; 1705 1706 kmem_freepages(cachep, page); 1707 } 1708 1709 #if DEBUG 1710 1711 #ifdef CONFIG_DEBUG_PAGEALLOC 1712 static void store_stackinfo(struct kmem_cache *cachep, unsigned long *addr, 1713 unsigned long caller) 1714 { 1715 int size = cachep->object_size; 1716 1717 addr = (unsigned long *)&((char *)addr)[obj_offset(cachep)]; 1718 1719 if (size < 5 * sizeof(unsigned long)) 1720 return; 1721 1722 *addr++ = 0x12345678; 1723 *addr++ = caller; 1724 *addr++ = smp_processor_id(); 1725 size -= 3 * sizeof(unsigned long); 1726 { 1727 unsigned long *sptr = &caller; 1728 unsigned long svalue; 1729 1730 while (!kstack_end(sptr)) { 1731 svalue = *sptr++; 1732 if (kernel_text_address(svalue)) { 1733 *addr++ = svalue; 1734 size -= sizeof(unsigned long); 1735 if (size <= sizeof(unsigned long)) 1736 break; 1737 } 1738 } 1739 1740 } 1741 *addr++ = 0x87654321; 1742 } 1743 #endif 1744 1745 static void poison_obj(struct kmem_cache *cachep, void *addr, unsigned char val) 1746 { 1747 int size = cachep->object_size; 1748 addr = &((char *)addr)[obj_offset(cachep)]; 1749 1750 memset(addr, val, size); 1751 *(unsigned char *)(addr + size - 1) = POISON_END; 1752 } 1753 1754 static void dump_line(char *data, int offset, int limit) 1755 { 1756 int i; 1757 unsigned char error = 0; 1758 int bad_count = 0; 1759 1760 printk(KERN_ERR "%03x: ", offset); 1761 for (i = 0; i < limit; i++) { 1762 if (data[offset + i] != POISON_FREE) { 1763 error = data[offset + i]; 1764 bad_count++; 1765 } 1766 } 1767 print_hex_dump(KERN_CONT, "", 0, 16, 1, 1768 &data[offset], limit, 1); 1769 1770 if (bad_count == 1) { 1771 error ^= POISON_FREE; 1772 if (!(error & (error - 1))) { 1773 printk(KERN_ERR "Single bit error detected. Probably " 1774 "bad RAM.\n"); 1775 #ifdef CONFIG_X86 1776 printk(KERN_ERR "Run memtest86+ or a similar memory " 1777 "test tool.\n"); 1778 #else 1779 printk(KERN_ERR "Run a memory test tool.\n"); 1780 #endif 1781 } 1782 } 1783 } 1784 #endif 1785 1786 #if DEBUG 1787 1788 static void print_objinfo(struct kmem_cache *cachep, void *objp, int lines) 1789 { 1790 int i, size; 1791 char *realobj; 1792 1793 if (cachep->flags & SLAB_RED_ZONE) { 1794 printk(KERN_ERR "Redzone: 0x%llx/0x%llx.\n", 1795 *dbg_redzone1(cachep, objp), 1796 *dbg_redzone2(cachep, objp)); 1797 } 1798 1799 if (cachep->flags & SLAB_STORE_USER) { 1800 printk(KERN_ERR "Last user: [<%p>](%pSR)\n", 1801 *dbg_userword(cachep, objp), 1802 *dbg_userword(cachep, objp)); 1803 } 1804 realobj = (char *)objp + obj_offset(cachep); 1805 size = cachep->object_size; 1806 for (i = 0; i < size && lines; i += 16, lines--) { 1807 int limit; 1808 limit = 16; 1809 if (i + limit > size) 1810 limit = size - i; 1811 dump_line(realobj, i, limit); 1812 } 1813 } 1814 1815 static void check_poison_obj(struct kmem_cache *cachep, void *objp) 1816 { 1817 char *realobj; 1818 int size, i; 1819 int lines = 0; 1820 1821 realobj = (char *)objp + obj_offset(cachep); 1822 size = cachep->object_size; 1823 1824 for (i = 0; i < size; i++) { 1825 char exp = POISON_FREE; 1826 if (i == size - 1) 1827 exp = POISON_END; 1828 if (realobj[i] != exp) { 1829 int limit; 1830 /* Mismatch ! */ 1831 /* Print header */ 1832 if (lines == 0) { 1833 printk(KERN_ERR 1834 "Slab corruption (%s): %s start=%p, len=%d\n", 1835 print_tainted(), cachep->name, realobj, size); 1836 print_objinfo(cachep, objp, 0); 1837 } 1838 /* Hexdump the affected line */ 1839 i = (i / 16) * 16; 1840 limit = 16; 1841 if (i + limit > size) 1842 limit = size - i; 1843 dump_line(realobj, i, limit); 1844 i += 16; 1845 lines++; 1846 /* Limit to 5 lines */ 1847 if (lines > 5) 1848 break; 1849 } 1850 } 1851 if (lines != 0) { 1852 /* Print some data about the neighboring objects, if they 1853 * exist: 1854 */ 1855 struct page *page = virt_to_head_page(objp); 1856 unsigned int objnr; 1857 1858 objnr = obj_to_index(cachep, page, objp); 1859 if (objnr) { 1860 objp = index_to_obj(cachep, page, objnr - 1); 1861 realobj = (char *)objp + obj_offset(cachep); 1862 printk(KERN_ERR "Prev obj: start=%p, len=%d\n", 1863 realobj, size); 1864 print_objinfo(cachep, objp, 2); 1865 } 1866 if (objnr + 1 < cachep->num) { 1867 objp = index_to_obj(cachep, page, objnr + 1); 1868 realobj = (char *)objp + obj_offset(cachep); 1869 printk(KERN_ERR "Next obj: start=%p, len=%d\n", 1870 realobj, size); 1871 print_objinfo(cachep, objp, 2); 1872 } 1873 } 1874 } 1875 #endif 1876 1877 #if DEBUG 1878 static void slab_destroy_debugcheck(struct kmem_cache *cachep, 1879 struct page *page) 1880 { 1881 int i; 1882 for (i = 0; i < cachep->num; i++) { 1883 void *objp = index_to_obj(cachep, page, i); 1884 1885 if (cachep->flags & SLAB_POISON) { 1886 #ifdef CONFIG_DEBUG_PAGEALLOC 1887 if (cachep->size % PAGE_SIZE == 0 && 1888 OFF_SLAB(cachep)) 1889 kernel_map_pages(virt_to_page(objp), 1890 cachep->size / PAGE_SIZE, 1); 1891 else 1892 check_poison_obj(cachep, objp); 1893 #else 1894 check_poison_obj(cachep, objp); 1895 #endif 1896 } 1897 if (cachep->flags & SLAB_RED_ZONE) { 1898 if (*dbg_redzone1(cachep, objp) != RED_INACTIVE) 1899 slab_error(cachep, "start of a freed object " 1900 "was overwritten"); 1901 if (*dbg_redzone2(cachep, objp) != RED_INACTIVE) 1902 slab_error(cachep, "end of a freed object " 1903 "was overwritten"); 1904 } 1905 } 1906 } 1907 #else 1908 static void slab_destroy_debugcheck(struct kmem_cache *cachep, 1909 struct page *page) 1910 { 1911 } 1912 #endif 1913 1914 /** 1915 * slab_destroy - destroy and release all objects in a slab 1916 * @cachep: cache pointer being destroyed 1917 * @page: page pointer being destroyed 1918 * 1919 * Destroy all the objs in a slab page, and release the mem back to the system. 1920 * Before calling the slab page must have been unlinked from the cache. The 1921 * kmem_cache_node ->list_lock is not held/needed. 1922 */ 1923 static void slab_destroy(struct kmem_cache *cachep, struct page *page) 1924 { 1925 void *freelist; 1926 1927 freelist = page->freelist; 1928 slab_destroy_debugcheck(cachep, page); 1929 if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU)) { 1930 struct rcu_head *head; 1931 1932 /* 1933 * RCU free overloads the RCU head over the LRU. 1934 * slab_page has been overloeaded over the LRU, 1935 * however it is not used from now on so that 1936 * we can use it safely. 1937 */ 1938 head = (void *)&page->rcu_head; 1939 call_rcu(head, kmem_rcu_free); 1940 1941 } else { 1942 kmem_freepages(cachep, page); 1943 } 1944 1945 /* 1946 * From now on, we don't use freelist 1947 * although actual page can be freed in rcu context 1948 */ 1949 if (OFF_SLAB(cachep)) 1950 kmem_cache_free(cachep->freelist_cache, freelist); 1951 } 1952 1953 static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list) 1954 { 1955 struct page *page, *n; 1956 1957 list_for_each_entry_safe(page, n, list, lru) { 1958 list_del(&page->lru); 1959 slab_destroy(cachep, page); 1960 } 1961 } 1962 1963 /** 1964 * calculate_slab_order - calculate size (page order) of slabs 1965 * @cachep: pointer to the cache that is being created 1966 * @size: size of objects to be created in this cache. 1967 * @align: required alignment for the objects. 1968 * @flags: slab allocation flags 1969 * 1970 * Also calculates the number of objects per slab. 1971 * 1972 * This could be made much more intelligent. For now, try to avoid using 1973 * high order pages for slabs. When the gfp() functions are more friendly 1974 * towards high-order requests, this should be changed. 1975 */ 1976 static size_t calculate_slab_order(struct kmem_cache *cachep, 1977 size_t size, size_t align, unsigned long flags) 1978 { 1979 unsigned long offslab_limit; 1980 size_t left_over = 0; 1981 int gfporder; 1982 1983 for (gfporder = 0; gfporder <= KMALLOC_MAX_ORDER; gfporder++) { 1984 unsigned int num; 1985 size_t remainder; 1986 1987 cache_estimate(gfporder, size, align, flags, &remainder, &num); 1988 if (!num) 1989 continue; 1990 1991 /* Can't handle number of objects more than SLAB_OBJ_MAX_NUM */ 1992 if (num > SLAB_OBJ_MAX_NUM) 1993 break; 1994 1995 if (flags & CFLGS_OFF_SLAB) { 1996 size_t freelist_size_per_obj = sizeof(freelist_idx_t); 1997 /* 1998 * Max number of objs-per-slab for caches which 1999 * use off-slab slabs. Needed to avoid a possible 2000 * looping condition in cache_grow(). 2001 */ 2002 if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) 2003 freelist_size_per_obj += sizeof(char); 2004 offslab_limit = size; 2005 offslab_limit /= freelist_size_per_obj; 2006 2007 if (num > offslab_limit) 2008 break; 2009 } 2010 2011 /* Found something acceptable - save it away */ 2012 cachep->num = num; 2013 cachep->gfporder = gfporder; 2014 left_over = remainder; 2015 2016 /* 2017 * A VFS-reclaimable slab tends to have most allocations 2018 * as GFP_NOFS and we really don't want to have to be allocating 2019 * higher-order pages when we are unable to shrink dcache. 2020 */ 2021 if (flags & SLAB_RECLAIM_ACCOUNT) 2022 break; 2023 2024 /* 2025 * Large number of objects is good, but very large slabs are 2026 * currently bad for the gfp()s. 2027 */ 2028 if (gfporder >= slab_max_order) 2029 break; 2030 2031 /* 2032 * Acceptable internal fragmentation? 2033 */ 2034 if (left_over * 8 <= (PAGE_SIZE << gfporder)) 2035 break; 2036 } 2037 return left_over; 2038 } 2039 2040 static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp) 2041 { 2042 if (slab_state >= FULL) 2043 return enable_cpucache(cachep, gfp); 2044 2045 if (slab_state == DOWN) { 2046 /* 2047 * Note: Creation of first cache (kmem_cache). 2048 * The setup_node is taken care 2049 * of by the caller of __kmem_cache_create 2050 */ 2051 cachep->array[smp_processor_id()] = &initarray_generic.cache; 2052 slab_state = PARTIAL; 2053 } else if (slab_state == PARTIAL) { 2054 /* 2055 * Note: the second kmem_cache_create must create the cache 2056 * that's used by kmalloc(24), otherwise the creation of 2057 * further caches will BUG(). 2058 */ 2059 cachep->array[smp_processor_id()] = &initarray_generic.cache; 2060 2061 /* 2062 * If the cache that's used by kmalloc(sizeof(kmem_cache_node)) is 2063 * the second cache, then we need to set up all its node/, 2064 * otherwise the creation of further caches will BUG(). 2065 */ 2066 set_up_node(cachep, SIZE_AC); 2067 if (INDEX_AC == INDEX_NODE) 2068 slab_state = PARTIAL_NODE; 2069 else 2070 slab_state = PARTIAL_ARRAYCACHE; 2071 } else { 2072 /* Remaining boot caches */ 2073 cachep->array[smp_processor_id()] = 2074 kmalloc(sizeof(struct arraycache_init), gfp); 2075 2076 if (slab_state == PARTIAL_ARRAYCACHE) { 2077 set_up_node(cachep, SIZE_NODE); 2078 slab_state = PARTIAL_NODE; 2079 } else { 2080 int node; 2081 for_each_online_node(node) { 2082 cachep->node[node] = 2083 kmalloc_node(sizeof(struct kmem_cache_node), 2084 gfp, node); 2085 BUG_ON(!cachep->node[node]); 2086 kmem_cache_node_init(cachep->node[node]); 2087 } 2088 } 2089 } 2090 cachep->node[numa_mem_id()]->next_reap = 2091 jiffies + REAPTIMEOUT_NODE + 2092 ((unsigned long)cachep) % REAPTIMEOUT_NODE; 2093 2094 cpu_cache_get(cachep)->avail = 0; 2095 cpu_cache_get(cachep)->limit = BOOT_CPUCACHE_ENTRIES; 2096 cpu_cache_get(cachep)->batchcount = 1; 2097 cpu_cache_get(cachep)->touched = 0; 2098 cachep->batchcount = 1; 2099 cachep->limit = BOOT_CPUCACHE_ENTRIES; 2100 return 0; 2101 } 2102 2103 /** 2104 * __kmem_cache_create - Create a cache. 2105 * @cachep: cache management descriptor 2106 * @flags: SLAB flags 2107 * 2108 * Returns a ptr to the cache on success, NULL on failure. 2109 * Cannot be called within a int, but can be interrupted. 2110 * The @ctor is run when new pages are allocated by the cache. 2111 * 2112 * The flags are 2113 * 2114 * %SLAB_POISON - Poison the slab with a known test pattern (a5a5a5a5) 2115 * to catch references to uninitialised memory. 2116 * 2117 * %SLAB_RED_ZONE - Insert `Red' zones around the allocated memory to check 2118 * for buffer overruns. 2119 * 2120 * %SLAB_HWCACHE_ALIGN - Align the objects in this cache to a hardware 2121 * cacheline. This can be beneficial if you're counting cycles as closely 2122 * as davem. 2123 */ 2124 int 2125 __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) 2126 { 2127 size_t left_over, freelist_size; 2128 size_t ralign = BYTES_PER_WORD; 2129 gfp_t gfp; 2130 int err; 2131 size_t size = cachep->size; 2132 2133 #if DEBUG 2134 #if FORCED_DEBUG 2135 /* 2136 * Enable redzoning and last user accounting, except for caches with 2137 * large objects, if the increased size would increase the object size 2138 * above the next power of two: caches with object sizes just above a 2139 * power of two have a significant amount of internal fragmentation. 2140 */ 2141 if (size < 4096 || fls(size - 1) == fls(size-1 + REDZONE_ALIGN + 2142 2 * sizeof(unsigned long long))) 2143 flags |= SLAB_RED_ZONE | SLAB_STORE_USER; 2144 if (!(flags & SLAB_DESTROY_BY_RCU)) 2145 flags |= SLAB_POISON; 2146 #endif 2147 if (flags & SLAB_DESTROY_BY_RCU) 2148 BUG_ON(flags & SLAB_POISON); 2149 #endif 2150 2151 /* 2152 * Check that size is in terms of words. This is needed to avoid 2153 * unaligned accesses for some archs when redzoning is used, and makes 2154 * sure any on-slab bufctl's are also correctly aligned. 2155 */ 2156 if (size & (BYTES_PER_WORD - 1)) { 2157 size += (BYTES_PER_WORD - 1); 2158 size &= ~(BYTES_PER_WORD - 1); 2159 } 2160 2161 if (flags & SLAB_RED_ZONE) { 2162 ralign = REDZONE_ALIGN; 2163 /* If redzoning, ensure that the second redzone is suitably 2164 * aligned, by adjusting the object size accordingly. */ 2165 size += REDZONE_ALIGN - 1; 2166 size &= ~(REDZONE_ALIGN - 1); 2167 } 2168 2169 /* 3) caller mandated alignment */ 2170 if (ralign < cachep->align) { 2171 ralign = cachep->align; 2172 } 2173 /* disable debug if necessary */ 2174 if (ralign > __alignof__(unsigned long long)) 2175 flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER); 2176 /* 2177 * 4) Store it. 2178 */ 2179 cachep->align = ralign; 2180 2181 if (slab_is_available()) 2182 gfp = GFP_KERNEL; 2183 else 2184 gfp = GFP_NOWAIT; 2185 2186 setup_node_pointer(cachep); 2187 #if DEBUG 2188 2189 /* 2190 * Both debugging options require word-alignment which is calculated 2191 * into align above. 2192 */ 2193 if (flags & SLAB_RED_ZONE) { 2194 /* add space for red zone words */ 2195 cachep->obj_offset += sizeof(unsigned long long); 2196 size += 2 * sizeof(unsigned long long); 2197 } 2198 if (flags & SLAB_STORE_USER) { 2199 /* user store requires one word storage behind the end of 2200 * the real object. But if the second red zone needs to be 2201 * aligned to 64 bits, we must allow that much space. 2202 */ 2203 if (flags & SLAB_RED_ZONE) 2204 size += REDZONE_ALIGN; 2205 else 2206 size += BYTES_PER_WORD; 2207 } 2208 #if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC) 2209 if (size >= kmalloc_size(INDEX_NODE + 1) 2210 && cachep->object_size > cache_line_size() 2211 && ALIGN(size, cachep->align) < PAGE_SIZE) { 2212 cachep->obj_offset += PAGE_SIZE - ALIGN(size, cachep->align); 2213 size = PAGE_SIZE; 2214 } 2215 #endif 2216 #endif 2217 2218 /* 2219 * Determine if the slab management is 'on' or 'off' slab. 2220 * (bootstrapping cannot cope with offslab caches so don't do 2221 * it too early on. Always use on-slab management when 2222 * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak) 2223 */ 2224 if ((size >= (PAGE_SIZE >> 5)) && !slab_early_init && 2225 !(flags & SLAB_NOLEAKTRACE)) 2226 /* 2227 * Size is large, assume best to place the slab management obj 2228 * off-slab (should allow better packing of objs). 2229 */ 2230 flags |= CFLGS_OFF_SLAB; 2231 2232 size = ALIGN(size, cachep->align); 2233 /* 2234 * We should restrict the number of objects in a slab to implement 2235 * byte sized index. Refer comment on SLAB_OBJ_MIN_SIZE definition. 2236 */ 2237 if (FREELIST_BYTE_INDEX && size < SLAB_OBJ_MIN_SIZE) 2238 size = ALIGN(SLAB_OBJ_MIN_SIZE, cachep->align); 2239 2240 left_over = calculate_slab_order(cachep, size, cachep->align, flags); 2241 2242 if (!cachep->num) 2243 return -E2BIG; 2244 2245 freelist_size = calculate_freelist_size(cachep->num, cachep->align); 2246 2247 /* 2248 * If the slab has been placed off-slab, and we have enough space then 2249 * move it on-slab. This is at the expense of any extra colouring. 2250 */ 2251 if (flags & CFLGS_OFF_SLAB && left_over >= freelist_size) { 2252 flags &= ~CFLGS_OFF_SLAB; 2253 left_over -= freelist_size; 2254 } 2255 2256 if (flags & CFLGS_OFF_SLAB) { 2257 /* really off slab. No need for manual alignment */ 2258 freelist_size = calculate_freelist_size(cachep->num, 0); 2259 2260 #ifdef CONFIG_PAGE_POISONING 2261 /* If we're going to use the generic kernel_map_pages() 2262 * poisoning, then it's going to smash the contents of 2263 * the redzone and userword anyhow, so switch them off. 2264 */ 2265 if (size % PAGE_SIZE == 0 && flags & SLAB_POISON) 2266 flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER); 2267 #endif 2268 } 2269 2270 cachep->colour_off = cache_line_size(); 2271 /* Offset must be a multiple of the alignment. */ 2272 if (cachep->colour_off < cachep->align) 2273 cachep->colour_off = cachep->align; 2274 cachep->colour = left_over / cachep->colour_off; 2275 cachep->freelist_size = freelist_size; 2276 cachep->flags = flags; 2277 cachep->allocflags = __GFP_COMP; 2278 if (CONFIG_ZONE_DMA_FLAG && (flags & SLAB_CACHE_DMA)) 2279 cachep->allocflags |= GFP_DMA; 2280 cachep->size = size; 2281 cachep->reciprocal_buffer_size = reciprocal_value(size); 2282 2283 if (flags & CFLGS_OFF_SLAB) { 2284 cachep->freelist_cache = kmalloc_slab(freelist_size, 0u); 2285 /* 2286 * This is a possibility for one of the kmalloc_{dma,}_caches. 2287 * But since we go off slab only for object size greater than 2288 * PAGE_SIZE/8, and kmalloc_{dma,}_caches get created 2289 * in ascending order,this should not happen at all. 2290 * But leave a BUG_ON for some lucky dude. 2291 */ 2292 BUG_ON(ZERO_OR_NULL_PTR(cachep->freelist_cache)); 2293 } 2294 2295 err = setup_cpu_cache(cachep, gfp); 2296 if (err) { 2297 __kmem_cache_shutdown(cachep); 2298 return err; 2299 } 2300 2301 return 0; 2302 } 2303 2304 #if DEBUG 2305 static void check_irq_off(void) 2306 { 2307 BUG_ON(!irqs_disabled()); 2308 } 2309 2310 static void check_irq_on(void) 2311 { 2312 BUG_ON(irqs_disabled()); 2313 } 2314 2315 static void check_spinlock_acquired(struct kmem_cache *cachep) 2316 { 2317 #ifdef CONFIG_SMP 2318 check_irq_off(); 2319 assert_spin_locked(&get_node(cachep, numa_mem_id())->list_lock); 2320 #endif 2321 } 2322 2323 static void check_spinlock_acquired_node(struct kmem_cache *cachep, int node) 2324 { 2325 #ifdef CONFIG_SMP 2326 check_irq_off(); 2327 assert_spin_locked(&get_node(cachep, node)->list_lock); 2328 #endif 2329 } 2330 2331 #else 2332 #define check_irq_off() do { } while(0) 2333 #define check_irq_on() do { } while(0) 2334 #define check_spinlock_acquired(x) do { } while(0) 2335 #define check_spinlock_acquired_node(x, y) do { } while(0) 2336 #endif 2337 2338 static void drain_array(struct kmem_cache *cachep, struct kmem_cache_node *n, 2339 struct array_cache *ac, 2340 int force, int node); 2341 2342 static void do_drain(void *arg) 2343 { 2344 struct kmem_cache *cachep = arg; 2345 struct array_cache *ac; 2346 int node = numa_mem_id(); 2347 struct kmem_cache_node *n; 2348 LIST_HEAD(list); 2349 2350 check_irq_off(); 2351 ac = cpu_cache_get(cachep); 2352 n = get_node(cachep, node); 2353 spin_lock(&n->list_lock); 2354 free_block(cachep, ac->entry, ac->avail, node, &list); 2355 spin_unlock(&n->list_lock); 2356 slabs_destroy(cachep, &list); 2357 ac->avail = 0; 2358 } 2359 2360 static void drain_cpu_caches(struct kmem_cache *cachep) 2361 { 2362 struct kmem_cache_node *n; 2363 int node; 2364 2365 on_each_cpu(do_drain, cachep, 1); 2366 check_irq_on(); 2367 for_each_kmem_cache_node(cachep, node, n) 2368 if (n->alien) 2369 drain_alien_cache(cachep, n->alien); 2370 2371 for_each_kmem_cache_node(cachep, node, n) 2372 drain_array(cachep, n, n->shared, 1, node); 2373 } 2374 2375 /* 2376 * Remove slabs from the list of free slabs. 2377 * Specify the number of slabs to drain in tofree. 2378 * 2379 * Returns the actual number of slabs released. 2380 */ 2381 static int drain_freelist(struct kmem_cache *cache, 2382 struct kmem_cache_node *n, int tofree) 2383 { 2384 struct list_head *p; 2385 int nr_freed; 2386 struct page *page; 2387 2388 nr_freed = 0; 2389 while (nr_freed < tofree && !list_empty(&n->slabs_free)) { 2390 2391 spin_lock_irq(&n->list_lock); 2392 p = n->slabs_free.prev; 2393 if (p == &n->slabs_free) { 2394 spin_unlock_irq(&n->list_lock); 2395 goto out; 2396 } 2397 2398 page = list_entry(p, struct page, lru); 2399 #if DEBUG 2400 BUG_ON(page->active); 2401 #endif 2402 list_del(&page->lru); 2403 /* 2404 * Safe to drop the lock. The slab is no longer linked 2405 * to the cache. 2406 */ 2407 n->free_objects -= cache->num; 2408 spin_unlock_irq(&n->list_lock); 2409 slab_destroy(cache, page); 2410 nr_freed++; 2411 } 2412 out: 2413 return nr_freed; 2414 } 2415 2416 int __kmem_cache_shrink(struct kmem_cache *cachep) 2417 { 2418 int ret = 0; 2419 int node; 2420 struct kmem_cache_node *n; 2421 2422 drain_cpu_caches(cachep); 2423 2424 check_irq_on(); 2425 for_each_kmem_cache_node(cachep, node, n) { 2426 drain_freelist(cachep, n, slabs_tofree(cachep, n)); 2427 2428 ret += !list_empty(&n->slabs_full) || 2429 !list_empty(&n->slabs_partial); 2430 } 2431 return (ret ? 1 : 0); 2432 } 2433 2434 int __kmem_cache_shutdown(struct kmem_cache *cachep) 2435 { 2436 int i; 2437 struct kmem_cache_node *n; 2438 int rc = __kmem_cache_shrink(cachep); 2439 2440 if (rc) 2441 return rc; 2442 2443 for_each_online_cpu(i) 2444 kfree(cachep->array[i]); 2445 2446 /* NUMA: free the node structures */ 2447 for_each_kmem_cache_node(cachep, i, n) { 2448 kfree(n->shared); 2449 free_alien_cache(n->alien); 2450 kfree(n); 2451 cachep->node[i] = NULL; 2452 } 2453 return 0; 2454 } 2455 2456 /* 2457 * Get the memory for a slab management obj. 2458 * 2459 * For a slab cache when the slab descriptor is off-slab, the 2460 * slab descriptor can't come from the same cache which is being created, 2461 * Because if it is the case, that means we defer the creation of 2462 * the kmalloc_{dma,}_cache of size sizeof(slab descriptor) to this point. 2463 * And we eventually call down to __kmem_cache_create(), which 2464 * in turn looks up in the kmalloc_{dma,}_caches for the disired-size one. 2465 * This is a "chicken-and-egg" problem. 2466 * 2467 * So the off-slab slab descriptor shall come from the kmalloc_{dma,}_caches, 2468 * which are all initialized during kmem_cache_init(). 2469 */ 2470 static void *alloc_slabmgmt(struct kmem_cache *cachep, 2471 struct page *page, int colour_off, 2472 gfp_t local_flags, int nodeid) 2473 { 2474 void *freelist; 2475 void *addr = page_address(page); 2476 2477 if (OFF_SLAB(cachep)) { 2478 /* Slab management obj is off-slab. */ 2479 freelist = kmem_cache_alloc_node(cachep->freelist_cache, 2480 local_flags, nodeid); 2481 if (!freelist) 2482 return NULL; 2483 } else { 2484 freelist = addr + colour_off; 2485 colour_off += cachep->freelist_size; 2486 } 2487 page->active = 0; 2488 page->s_mem = addr + colour_off; 2489 return freelist; 2490 } 2491 2492 static inline freelist_idx_t get_free_obj(struct page *page, unsigned int idx) 2493 { 2494 return ((freelist_idx_t *)page->freelist)[idx]; 2495 } 2496 2497 static inline void set_free_obj(struct page *page, 2498 unsigned int idx, freelist_idx_t val) 2499 { 2500 ((freelist_idx_t *)(page->freelist))[idx] = val; 2501 } 2502 2503 static void cache_init_objs(struct kmem_cache *cachep, 2504 struct page *page) 2505 { 2506 int i; 2507 2508 for (i = 0; i < cachep->num; i++) { 2509 void *objp = index_to_obj(cachep, page, i); 2510 #if DEBUG 2511 /* need to poison the objs? */ 2512 if (cachep->flags & SLAB_POISON) 2513 poison_obj(cachep, objp, POISON_FREE); 2514 if (cachep->flags & SLAB_STORE_USER) 2515 *dbg_userword(cachep, objp) = NULL; 2516 2517 if (cachep->flags & SLAB_RED_ZONE) { 2518 *dbg_redzone1(cachep, objp) = RED_INACTIVE; 2519 *dbg_redzone2(cachep, objp) = RED_INACTIVE; 2520 } 2521 /* 2522 * Constructors are not allowed to allocate memory from the same 2523 * cache which they are a constructor for. Otherwise, deadlock. 2524 * They must also be threaded. 2525 */ 2526 if (cachep->ctor && !(cachep->flags & SLAB_POISON)) 2527 cachep->ctor(objp + obj_offset(cachep)); 2528 2529 if (cachep->flags & SLAB_RED_ZONE) { 2530 if (*dbg_redzone2(cachep, objp) != RED_INACTIVE) 2531 slab_error(cachep, "constructor overwrote the" 2532 " end of an object"); 2533 if (*dbg_redzone1(cachep, objp) != RED_INACTIVE) 2534 slab_error(cachep, "constructor overwrote the" 2535 " start of an object"); 2536 } 2537 if ((cachep->size % PAGE_SIZE) == 0 && 2538 OFF_SLAB(cachep) && cachep->flags & SLAB_POISON) 2539 kernel_map_pages(virt_to_page(objp), 2540 cachep->size / PAGE_SIZE, 0); 2541 #else 2542 if (cachep->ctor) 2543 cachep->ctor(objp); 2544 #endif 2545 set_obj_status(page, i, OBJECT_FREE); 2546 set_free_obj(page, i, i); 2547 } 2548 } 2549 2550 static void kmem_flagcheck(struct kmem_cache *cachep, gfp_t flags) 2551 { 2552 if (CONFIG_ZONE_DMA_FLAG) { 2553 if (flags & GFP_DMA) 2554 BUG_ON(!(cachep->allocflags & GFP_DMA)); 2555 else 2556 BUG_ON(cachep->allocflags & GFP_DMA); 2557 } 2558 } 2559 2560 static void *slab_get_obj(struct kmem_cache *cachep, struct page *page, 2561 int nodeid) 2562 { 2563 void *objp; 2564 2565 objp = index_to_obj(cachep, page, get_free_obj(page, page->active)); 2566 page->active++; 2567 #if DEBUG 2568 WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid); 2569 #endif 2570 2571 return objp; 2572 } 2573 2574 static void slab_put_obj(struct kmem_cache *cachep, struct page *page, 2575 void *objp, int nodeid) 2576 { 2577 unsigned int objnr = obj_to_index(cachep, page, objp); 2578 #if DEBUG 2579 unsigned int i; 2580 2581 /* Verify that the slab belongs to the intended node */ 2582 WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid); 2583 2584 /* Verify double free bug */ 2585 for (i = page->active; i < cachep->num; i++) { 2586 if (get_free_obj(page, i) == objnr) { 2587 printk(KERN_ERR "slab: double free detected in cache " 2588 "'%s', objp %p\n", cachep->name, objp); 2589 BUG(); 2590 } 2591 } 2592 #endif 2593 page->active--; 2594 set_free_obj(page, page->active, objnr); 2595 } 2596 2597 /* 2598 * Map pages beginning at addr to the given cache and slab. This is required 2599 * for the slab allocator to be able to lookup the cache and slab of a 2600 * virtual address for kfree, ksize, and slab debugging. 2601 */ 2602 static void slab_map_pages(struct kmem_cache *cache, struct page *page, 2603 void *freelist) 2604 { 2605 page->slab_cache = cache; 2606 page->freelist = freelist; 2607 } 2608 2609 /* 2610 * Grow (by 1) the number of slabs within a cache. This is called by 2611 * kmem_cache_alloc() when there are no active objs left in a cache. 2612 */ 2613 static int cache_grow(struct kmem_cache *cachep, 2614 gfp_t flags, int nodeid, struct page *page) 2615 { 2616 void *freelist; 2617 size_t offset; 2618 gfp_t local_flags; 2619 struct kmem_cache_node *n; 2620 2621 /* 2622 * Be lazy and only check for valid flags here, keeping it out of the 2623 * critical path in kmem_cache_alloc(). 2624 */ 2625 BUG_ON(flags & GFP_SLAB_BUG_MASK); 2626 local_flags = flags & (GFP_CONSTRAINT_MASK|GFP_RECLAIM_MASK); 2627 2628 /* Take the node list lock to change the colour_next on this node */ 2629 check_irq_off(); 2630 n = get_node(cachep, nodeid); 2631 spin_lock(&n->list_lock); 2632 2633 /* Get colour for the slab, and cal the next value. */ 2634 offset = n->colour_next; 2635 n->colour_next++; 2636 if (n->colour_next >= cachep->colour) 2637 n->colour_next = 0; 2638 spin_unlock(&n->list_lock); 2639 2640 offset *= cachep->colour_off; 2641 2642 if (local_flags & __GFP_WAIT) 2643 local_irq_enable(); 2644 2645 /* 2646 * The test for missing atomic flag is performed here, rather than 2647 * the more obvious place, simply to reduce the critical path length 2648 * in kmem_cache_alloc(). If a caller is seriously mis-behaving they 2649 * will eventually be caught here (where it matters). 2650 */ 2651 kmem_flagcheck(cachep, flags); 2652 2653 /* 2654 * Get mem for the objs. Attempt to allocate a physical page from 2655 * 'nodeid'. 2656 */ 2657 if (!page) 2658 page = kmem_getpages(cachep, local_flags, nodeid); 2659 if (!page) 2660 goto failed; 2661 2662 /* Get slab management. */ 2663 freelist = alloc_slabmgmt(cachep, page, offset, 2664 local_flags & ~GFP_CONSTRAINT_MASK, nodeid); 2665 if (!freelist) 2666 goto opps1; 2667 2668 slab_map_pages(cachep, page, freelist); 2669 2670 cache_init_objs(cachep, page); 2671 2672 if (local_flags & __GFP_WAIT) 2673 local_irq_disable(); 2674 check_irq_off(); 2675 spin_lock(&n->list_lock); 2676 2677 /* Make slab active. */ 2678 list_add_tail(&page->lru, &(n->slabs_free)); 2679 STATS_INC_GROWN(cachep); 2680 n->free_objects += cachep->num; 2681 spin_unlock(&n->list_lock); 2682 return 1; 2683 opps1: 2684 kmem_freepages(cachep, page); 2685 failed: 2686 if (local_flags & __GFP_WAIT) 2687 local_irq_disable(); 2688 return 0; 2689 } 2690 2691 #if DEBUG 2692 2693 /* 2694 * Perform extra freeing checks: 2695 * - detect bad pointers. 2696 * - POISON/RED_ZONE checking 2697 */ 2698 static void kfree_debugcheck(const void *objp) 2699 { 2700 if (!virt_addr_valid(objp)) { 2701 printk(KERN_ERR "kfree_debugcheck: out of range ptr %lxh.\n", 2702 (unsigned long)objp); 2703 BUG(); 2704 } 2705 } 2706 2707 static inline void verify_redzone_free(struct kmem_cache *cache, void *obj) 2708 { 2709 unsigned long long redzone1, redzone2; 2710 2711 redzone1 = *dbg_redzone1(cache, obj); 2712 redzone2 = *dbg_redzone2(cache, obj); 2713 2714 /* 2715 * Redzone is ok. 2716 */ 2717 if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE) 2718 return; 2719 2720 if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE) 2721 slab_error(cache, "double free detected"); 2722 else 2723 slab_error(cache, "memory outside object was overwritten"); 2724 2725 printk(KERN_ERR "%p: redzone 1:0x%llx, redzone 2:0x%llx.\n", 2726 obj, redzone1, redzone2); 2727 } 2728 2729 static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, 2730 unsigned long caller) 2731 { 2732 unsigned int objnr; 2733 struct page *page; 2734 2735 BUG_ON(virt_to_cache(objp) != cachep); 2736 2737 objp -= obj_offset(cachep); 2738 kfree_debugcheck(objp); 2739 page = virt_to_head_page(objp); 2740 2741 if (cachep->flags & SLAB_RED_ZONE) { 2742 verify_redzone_free(cachep, objp); 2743 *dbg_redzone1(cachep, objp) = RED_INACTIVE; 2744 *dbg_redzone2(cachep, objp) = RED_INACTIVE; 2745 } 2746 if (cachep->flags & SLAB_STORE_USER) 2747 *dbg_userword(cachep, objp) = (void *)caller; 2748 2749 objnr = obj_to_index(cachep, page, objp); 2750 2751 BUG_ON(objnr >= cachep->num); 2752 BUG_ON(objp != index_to_obj(cachep, page, objnr)); 2753 2754 set_obj_status(page, objnr, OBJECT_FREE); 2755 if (cachep->flags & SLAB_POISON) { 2756 #ifdef CONFIG_DEBUG_PAGEALLOC 2757 if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) { 2758 store_stackinfo(cachep, objp, caller); 2759 kernel_map_pages(virt_to_page(objp), 2760 cachep->size / PAGE_SIZE, 0); 2761 } else { 2762 poison_obj(cachep, objp, POISON_FREE); 2763 } 2764 #else 2765 poison_obj(cachep, objp, POISON_FREE); 2766 #endif 2767 } 2768 return objp; 2769 } 2770 2771 #else 2772 #define kfree_debugcheck(x) do { } while(0) 2773 #define cache_free_debugcheck(x,objp,z) (objp) 2774 #endif 2775 2776 static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags, 2777 bool force_refill) 2778 { 2779 int batchcount; 2780 struct kmem_cache_node *n; 2781 struct array_cache *ac; 2782 int node; 2783 2784 check_irq_off(); 2785 node = numa_mem_id(); 2786 if (unlikely(force_refill)) 2787 goto force_grow; 2788 retry: 2789 ac = cpu_cache_get(cachep); 2790 batchcount = ac->batchcount; 2791 if (!ac->touched && batchcount > BATCHREFILL_LIMIT) { 2792 /* 2793 * If there was little recent activity on this cache, then 2794 * perform only a partial refill. Otherwise we could generate 2795 * refill bouncing. 2796 */ 2797 batchcount = BATCHREFILL_LIMIT; 2798 } 2799 n = get_node(cachep, node); 2800 2801 BUG_ON(ac->avail > 0 || !n); 2802 spin_lock(&n->list_lock); 2803 2804 /* See if we can refill from the shared array */ 2805 if (n->shared && transfer_objects(ac, n->shared, batchcount)) { 2806 n->shared->touched = 1; 2807 goto alloc_done; 2808 } 2809 2810 while (batchcount > 0) { 2811 struct list_head *entry; 2812 struct page *page; 2813 /* Get slab alloc is to come from. */ 2814 entry = n->slabs_partial.next; 2815 if (entry == &n->slabs_partial) { 2816 n->free_touched = 1; 2817 entry = n->slabs_free.next; 2818 if (entry == &n->slabs_free) 2819 goto must_grow; 2820 } 2821 2822 page = list_entry(entry, struct page, lru); 2823 check_spinlock_acquired(cachep); 2824 2825 /* 2826 * The slab was either on partial or free list so 2827 * there must be at least one object available for 2828 * allocation. 2829 */ 2830 BUG_ON(page->active >= cachep->num); 2831 2832 while (page->active < cachep->num && batchcount--) { 2833 STATS_INC_ALLOCED(cachep); 2834 STATS_INC_ACTIVE(cachep); 2835 STATS_SET_HIGH(cachep); 2836 2837 ac_put_obj(cachep, ac, slab_get_obj(cachep, page, 2838 node)); 2839 } 2840 2841 /* move slabp to correct slabp list: */ 2842 list_del(&page->lru); 2843 if (page->active == cachep->num) 2844 list_add(&page->lru, &n->slabs_full); 2845 else 2846 list_add(&page->lru, &n->slabs_partial); 2847 } 2848 2849 must_grow: 2850 n->free_objects -= ac->avail; 2851 alloc_done: 2852 spin_unlock(&n->list_lock); 2853 2854 if (unlikely(!ac->avail)) { 2855 int x; 2856 force_grow: 2857 x = cache_grow(cachep, flags | GFP_THISNODE, node, NULL); 2858 2859 /* cache_grow can reenable interrupts, then ac could change. */ 2860 ac = cpu_cache_get(cachep); 2861 node = numa_mem_id(); 2862 2863 /* no objects in sight? abort */ 2864 if (!x && (ac->avail == 0 || force_refill)) 2865 return NULL; 2866 2867 if (!ac->avail) /* objects refilled by interrupt? */ 2868 goto retry; 2869 } 2870 ac->touched = 1; 2871 2872 return ac_get_obj(cachep, ac, flags, force_refill); 2873 } 2874 2875 static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep, 2876 gfp_t flags) 2877 { 2878 might_sleep_if(flags & __GFP_WAIT); 2879 #if DEBUG 2880 kmem_flagcheck(cachep, flags); 2881 #endif 2882 } 2883 2884 #if DEBUG 2885 static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep, 2886 gfp_t flags, void *objp, unsigned long caller) 2887 { 2888 struct page *page; 2889 2890 if (!objp) 2891 return objp; 2892 if (cachep->flags & SLAB_POISON) { 2893 #ifdef CONFIG_DEBUG_PAGEALLOC 2894 if ((cachep->size % PAGE_SIZE) == 0 && OFF_SLAB(cachep)) 2895 kernel_map_pages(virt_to_page(objp), 2896 cachep->size / PAGE_SIZE, 1); 2897 else 2898 check_poison_obj(cachep, objp); 2899 #else 2900 check_poison_obj(cachep, objp); 2901 #endif 2902 poison_obj(cachep, objp, POISON_INUSE); 2903 } 2904 if (cachep->flags & SLAB_STORE_USER) 2905 *dbg_userword(cachep, objp) = (void *)caller; 2906 2907 if (cachep->flags & SLAB_RED_ZONE) { 2908 if (*dbg_redzone1(cachep, objp) != RED_INACTIVE || 2909 *dbg_redzone2(cachep, objp) != RED_INACTIVE) { 2910 slab_error(cachep, "double free, or memory outside" 2911 " object was overwritten"); 2912 printk(KERN_ERR 2913 "%p: redzone 1:0x%llx, redzone 2:0x%llx\n", 2914 objp, *dbg_redzone1(cachep, objp), 2915 *dbg_redzone2(cachep, objp)); 2916 } 2917 *dbg_redzone1(cachep, objp) = RED_ACTIVE; 2918 *dbg_redzone2(cachep, objp) = RED_ACTIVE; 2919 } 2920 2921 page = virt_to_head_page(objp); 2922 set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE); 2923 objp += obj_offset(cachep); 2924 if (cachep->ctor && cachep->flags & SLAB_POISON) 2925 cachep->ctor(objp); 2926 if (ARCH_SLAB_MINALIGN && 2927 ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) { 2928 printk(KERN_ERR "0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n", 2929 objp, (int)ARCH_SLAB_MINALIGN); 2930 } 2931 return objp; 2932 } 2933 #else 2934 #define cache_alloc_debugcheck_after(a,b,objp,d) (objp) 2935 #endif 2936 2937 static bool slab_should_failslab(struct kmem_cache *cachep, gfp_t flags) 2938 { 2939 if (unlikely(cachep == kmem_cache)) 2940 return false; 2941 2942 return should_failslab(cachep->object_size, flags, cachep->flags); 2943 } 2944 2945 static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags) 2946 { 2947 void *objp; 2948 struct array_cache *ac; 2949 bool force_refill = false; 2950 2951 check_irq_off(); 2952 2953 ac = cpu_cache_get(cachep); 2954 if (likely(ac->avail)) { 2955 ac->touched = 1; 2956 objp = ac_get_obj(cachep, ac, flags, false); 2957 2958 /* 2959 * Allow for the possibility all avail objects are not allowed 2960 * by the current flags 2961 */ 2962 if (objp) { 2963 STATS_INC_ALLOCHIT(cachep); 2964 goto out; 2965 } 2966 force_refill = true; 2967 } 2968 2969 STATS_INC_ALLOCMISS(cachep); 2970 objp = cache_alloc_refill(cachep, flags, force_refill); 2971 /* 2972 * the 'ac' may be updated by cache_alloc_refill(), 2973 * and kmemleak_erase() requires its correct value. 2974 */ 2975 ac = cpu_cache_get(cachep); 2976 2977 out: 2978 /* 2979 * To avoid a false negative, if an object that is in one of the 2980 * per-CPU caches is leaked, we need to make sure kmemleak doesn't 2981 * treat the array pointers as a reference to the object. 2982 */ 2983 if (objp) 2984 kmemleak_erase(&ac->entry[ac->avail]); 2985 return objp; 2986 } 2987 2988 #ifdef CONFIG_NUMA 2989 /* 2990 * Try allocating on another node if PFA_SPREAD_SLAB is a mempolicy is set. 2991 * 2992 * If we are in_interrupt, then process context, including cpusets and 2993 * mempolicy, may not apply and should not be used for allocation policy. 2994 */ 2995 static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags) 2996 { 2997 int nid_alloc, nid_here; 2998 2999 if (in_interrupt() || (flags & __GFP_THISNODE)) 3000 return NULL; 3001 nid_alloc = nid_here = numa_mem_id(); 3002 if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD)) 3003 nid_alloc = cpuset_slab_spread_node(); 3004 else if (current->mempolicy) 3005 nid_alloc = mempolicy_slab_node(); 3006 if (nid_alloc != nid_here) 3007 return ____cache_alloc_node(cachep, flags, nid_alloc); 3008 return NULL; 3009 } 3010 3011 /* 3012 * Fallback function if there was no memory available and no objects on a 3013 * certain node and fall back is permitted. First we scan all the 3014 * available node for available objects. If that fails then we 3015 * perform an allocation without specifying a node. This allows the page 3016 * allocator to do its reclaim / fallback magic. We then insert the 3017 * slab into the proper nodelist and then allocate from it. 3018 */ 3019 static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags) 3020 { 3021 struct zonelist *zonelist; 3022 gfp_t local_flags; 3023 struct zoneref *z; 3024 struct zone *zone; 3025 enum zone_type high_zoneidx = gfp_zone(flags); 3026 void *obj = NULL; 3027 int nid; 3028 unsigned int cpuset_mems_cookie; 3029 3030 if (flags & __GFP_THISNODE) 3031 return NULL; 3032 3033 local_flags = flags & (GFP_CONSTRAINT_MASK|GFP_RECLAIM_MASK); 3034 3035 retry_cpuset: 3036 cpuset_mems_cookie = read_mems_allowed_begin(); 3037 zonelist = node_zonelist(mempolicy_slab_node(), flags); 3038 3039 retry: 3040 /* 3041 * Look through allowed nodes for objects available 3042 * from existing per node queues. 3043 */ 3044 for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) { 3045 nid = zone_to_nid(zone); 3046 3047 if (cpuset_zone_allowed_hardwall(zone, flags) && 3048 get_node(cache, nid) && 3049 get_node(cache, nid)->free_objects) { 3050 obj = ____cache_alloc_node(cache, 3051 flags | GFP_THISNODE, nid); 3052 if (obj) 3053 break; 3054 } 3055 } 3056 3057 if (!obj) { 3058 /* 3059 * This allocation will be performed within the constraints 3060 * of the current cpuset / memory policy requirements. 3061 * We may trigger various forms of reclaim on the allowed 3062 * set and go into memory reserves if necessary. 3063 */ 3064 struct page *page; 3065 3066 if (local_flags & __GFP_WAIT) 3067 local_irq_enable(); 3068 kmem_flagcheck(cache, flags); 3069 page = kmem_getpages(cache, local_flags, numa_mem_id()); 3070 if (local_flags & __GFP_WAIT) 3071 local_irq_disable(); 3072 if (page) { 3073 /* 3074 * Insert into the appropriate per node queues 3075 */ 3076 nid = page_to_nid(page); 3077 if (cache_grow(cache, flags, nid, page)) { 3078 obj = ____cache_alloc_node(cache, 3079 flags | GFP_THISNODE, nid); 3080 if (!obj) 3081 /* 3082 * Another processor may allocate the 3083 * objects in the slab since we are 3084 * not holding any locks. 3085 */ 3086 goto retry; 3087 } else { 3088 /* cache_grow already freed obj */ 3089 obj = NULL; 3090 } 3091 } 3092 } 3093 3094 if (unlikely(!obj && read_mems_allowed_retry(cpuset_mems_cookie))) 3095 goto retry_cpuset; 3096 return obj; 3097 } 3098 3099 /* 3100 * A interface to enable slab creation on nodeid 3101 */ 3102 static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, 3103 int nodeid) 3104 { 3105 struct list_head *entry; 3106 struct page *page; 3107 struct kmem_cache_node *n; 3108 void *obj; 3109 int x; 3110 3111 VM_BUG_ON(nodeid > num_online_nodes()); 3112 n = get_node(cachep, nodeid); 3113 BUG_ON(!n); 3114 3115 retry: 3116 check_irq_off(); 3117 spin_lock(&n->list_lock); 3118 entry = n->slabs_partial.next; 3119 if (entry == &n->slabs_partial) { 3120 n->free_touched = 1; 3121 entry = n->slabs_free.next; 3122 if (entry == &n->slabs_free) 3123 goto must_grow; 3124 } 3125 3126 page = list_entry(entry, struct page, lru); 3127 check_spinlock_acquired_node(cachep, nodeid); 3128 3129 STATS_INC_NODEALLOCS(cachep); 3130 STATS_INC_ACTIVE(cachep); 3131 STATS_SET_HIGH(cachep); 3132 3133 BUG_ON(page->active == cachep->num); 3134 3135 obj = slab_get_obj(cachep, page, nodeid); 3136 n->free_objects--; 3137 /* move slabp to correct slabp list: */ 3138 list_del(&page->lru); 3139 3140 if (page->active == cachep->num) 3141 list_add(&page->lru, &n->slabs_full); 3142 else 3143 list_add(&page->lru, &n->slabs_partial); 3144 3145 spin_unlock(&n->list_lock); 3146 goto done; 3147 3148 must_grow: 3149 spin_unlock(&n->list_lock); 3150 x = cache_grow(cachep, flags | GFP_THISNODE, nodeid, NULL); 3151 if (x) 3152 goto retry; 3153 3154 return fallback_alloc(cachep, flags); 3155 3156 done: 3157 return obj; 3158 } 3159 3160 static __always_inline void * 3161 slab_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid, 3162 unsigned long caller) 3163 { 3164 unsigned long save_flags; 3165 void *ptr; 3166 int slab_node = numa_mem_id(); 3167 3168 flags &= gfp_allowed_mask; 3169 3170 lockdep_trace_alloc(flags); 3171 3172 if (slab_should_failslab(cachep, flags)) 3173 return NULL; 3174 3175 cachep = memcg_kmem_get_cache(cachep, flags); 3176 3177 cache_alloc_debugcheck_before(cachep, flags); 3178 local_irq_save(save_flags); 3179 3180 if (nodeid == NUMA_NO_NODE) 3181 nodeid = slab_node; 3182 3183 if (unlikely(!get_node(cachep, nodeid))) { 3184 /* Node not bootstrapped yet */ 3185 ptr = fallback_alloc(cachep, flags); 3186 goto out; 3187 } 3188 3189 if (nodeid == slab_node) { 3190 /* 3191 * Use the locally cached objects if possible. 3192 * However ____cache_alloc does not allow fallback 3193 * to other nodes. It may fail while we still have 3194 * objects on other nodes available. 3195 */ 3196 ptr = ____cache_alloc(cachep, flags); 3197 if (ptr) 3198 goto out; 3199 } 3200 /* ___cache_alloc_node can fall back to other nodes */ 3201 ptr = ____cache_alloc_node(cachep, flags, nodeid); 3202 out: 3203 local_irq_restore(save_flags); 3204 ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, caller); 3205 kmemleak_alloc_recursive(ptr, cachep->object_size, 1, cachep->flags, 3206 flags); 3207 3208 if (likely(ptr)) { 3209 kmemcheck_slab_alloc(cachep, flags, ptr, cachep->object_size); 3210 if (unlikely(flags & __GFP_ZERO)) 3211 memset(ptr, 0, cachep->object_size); 3212 } 3213 3214 return ptr; 3215 } 3216 3217 static __always_inline void * 3218 __do_cache_alloc(struct kmem_cache *cache, gfp_t flags) 3219 { 3220 void *objp; 3221 3222 if (current->mempolicy || cpuset_do_slab_mem_spread()) { 3223 objp = alternate_node_alloc(cache, flags); 3224 if (objp) 3225 goto out; 3226 } 3227 objp = ____cache_alloc(cache, flags); 3228 3229 /* 3230 * We may just have run out of memory on the local node. 3231 * ____cache_alloc_node() knows how to locate memory on other nodes 3232 */ 3233 if (!objp) 3234 objp = ____cache_alloc_node(cache, flags, numa_mem_id()); 3235 3236 out: 3237 return objp; 3238 } 3239 #else 3240 3241 static __always_inline void * 3242 __do_cache_alloc(struct kmem_cache *cachep, gfp_t flags) 3243 { 3244 return ____cache_alloc(cachep, flags); 3245 } 3246 3247 #endif /* CONFIG_NUMA */ 3248 3249 static __always_inline void * 3250 slab_alloc(struct kmem_cache *cachep, gfp_t flags, unsigned long caller) 3251 { 3252 unsigned long save_flags; 3253 void *objp; 3254 3255 flags &= gfp_allowed_mask; 3256 3257 lockdep_trace_alloc(flags); 3258 3259 if (slab_should_failslab(cachep, flags)) 3260 return NULL; 3261 3262 cachep = memcg_kmem_get_cache(cachep, flags); 3263 3264 cache_alloc_debugcheck_before(cachep, flags); 3265 local_irq_save(save_flags); 3266 objp = __do_cache_alloc(cachep, flags); 3267 local_irq_restore(save_flags); 3268 objp = cache_alloc_debugcheck_after(cachep, flags, objp, caller); 3269 kmemleak_alloc_recursive(objp, cachep->object_size, 1, cachep->flags, 3270 flags); 3271 prefetchw(objp); 3272 3273 if (likely(objp)) { 3274 kmemcheck_slab_alloc(cachep, flags, objp, cachep->object_size); 3275 if (unlikely(flags & __GFP_ZERO)) 3276 memset(objp, 0, cachep->object_size); 3277 } 3278 3279 return objp; 3280 } 3281 3282 /* 3283 * Caller needs to acquire correct kmem_cache_node's list_lock 3284 * @list: List of detached free slabs should be freed by caller 3285 */ 3286 static void free_block(struct kmem_cache *cachep, void **objpp, 3287 int nr_objects, int node, struct list_head *list) 3288 { 3289 int i; 3290 struct kmem_cache_node *n = get_node(cachep, node); 3291 3292 for (i = 0; i < nr_objects; i++) { 3293 void *objp; 3294 struct page *page; 3295 3296 clear_obj_pfmemalloc(&objpp[i]); 3297 objp = objpp[i]; 3298 3299 page = virt_to_head_page(objp); 3300 list_del(&page->lru); 3301 check_spinlock_acquired_node(cachep, node); 3302 slab_put_obj(cachep, page, objp, node); 3303 STATS_DEC_ACTIVE(cachep); 3304 n->free_objects++; 3305 3306 /* fixup slab chains */ 3307 if (page->active == 0) { 3308 if (n->free_objects > n->free_limit) { 3309 n->free_objects -= cachep->num; 3310 list_add_tail(&page->lru, list); 3311 } else { 3312 list_add(&page->lru, &n->slabs_free); 3313 } 3314 } else { 3315 /* Unconditionally move a slab to the end of the 3316 * partial list on free - maximum time for the 3317 * other objects to be freed, too. 3318 */ 3319 list_add_tail(&page->lru, &n->slabs_partial); 3320 } 3321 } 3322 } 3323 3324 static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac) 3325 { 3326 int batchcount; 3327 struct kmem_cache_node *n; 3328 int node = numa_mem_id(); 3329 LIST_HEAD(list); 3330 3331 batchcount = ac->batchcount; 3332 #if DEBUG 3333 BUG_ON(!batchcount || batchcount > ac->avail); 3334 #endif 3335 check_irq_off(); 3336 n = get_node(cachep, node); 3337 spin_lock(&n->list_lock); 3338 if (n->shared) { 3339 struct array_cache *shared_array = n->shared; 3340 int max = shared_array->limit - shared_array->avail; 3341 if (max) { 3342 if (batchcount > max) 3343 batchcount = max; 3344 memcpy(&(shared_array->entry[shared_array->avail]), 3345 ac->entry, sizeof(void *) * batchcount); 3346 shared_array->avail += batchcount; 3347 goto free_done; 3348 } 3349 } 3350 3351 free_block(cachep, ac->entry, batchcount, node, &list); 3352 free_done: 3353 #if STATS 3354 { 3355 int i = 0; 3356 struct list_head *p; 3357 3358 p = n->slabs_free.next; 3359 while (p != &(n->slabs_free)) { 3360 struct page *page; 3361 3362 page = list_entry(p, struct page, lru); 3363 BUG_ON(page->active); 3364 3365 i++; 3366 p = p->next; 3367 } 3368 STATS_SET_FREEABLE(cachep, i); 3369 } 3370 #endif 3371 spin_unlock(&n->list_lock); 3372 slabs_destroy(cachep, &list); 3373 ac->avail -= batchcount; 3374 memmove(ac->entry, &(ac->entry[batchcount]), sizeof(void *)*ac->avail); 3375 } 3376 3377 /* 3378 * Release an obj back to its cache. If the obj has a constructed state, it must 3379 * be in this state _before_ it is released. Called with disabled ints. 3380 */ 3381 static inline void __cache_free(struct kmem_cache *cachep, void *objp, 3382 unsigned long caller) 3383 { 3384 struct array_cache *ac = cpu_cache_get(cachep); 3385 3386 check_irq_off(); 3387 kmemleak_free_recursive(objp, cachep->flags); 3388 objp = cache_free_debugcheck(cachep, objp, caller); 3389 3390 kmemcheck_slab_free(cachep, objp, cachep->object_size); 3391 3392 /* 3393 * Skip calling cache_free_alien() when the platform is not numa. 3394 * This will avoid cache misses that happen while accessing slabp (which 3395 * is per page memory reference) to get nodeid. Instead use a global 3396 * variable to skip the call, which is mostly likely to be present in 3397 * the cache. 3398 */ 3399 if (nr_online_nodes > 1 && cache_free_alien(cachep, objp)) 3400 return; 3401 3402 if (likely(ac->avail < ac->limit)) { 3403 STATS_INC_FREEHIT(cachep); 3404 } else { 3405 STATS_INC_FREEMISS(cachep); 3406 cache_flusharray(cachep, ac); 3407 } 3408 3409 ac_put_obj(cachep, ac, objp); 3410 } 3411 3412 /** 3413 * kmem_cache_alloc - Allocate an object 3414 * @cachep: The cache to allocate from. 3415 * @flags: See kmalloc(). 3416 * 3417 * Allocate an object from this cache. The flags are only relevant 3418 * if the cache has no available objects. 3419 */ 3420 void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags) 3421 { 3422 void *ret = slab_alloc(cachep, flags, _RET_IP_); 3423 3424 trace_kmem_cache_alloc(_RET_IP_, ret, 3425 cachep->object_size, cachep->size, flags); 3426 3427 return ret; 3428 } 3429 EXPORT_SYMBOL(kmem_cache_alloc); 3430 3431 #ifdef CONFIG_TRACING 3432 void * 3433 kmem_cache_alloc_trace(struct kmem_cache *cachep, gfp_t flags, size_t size) 3434 { 3435 void *ret; 3436 3437 ret = slab_alloc(cachep, flags, _RET_IP_); 3438 3439 trace_kmalloc(_RET_IP_, ret, 3440 size, cachep->size, flags); 3441 return ret; 3442 } 3443 EXPORT_SYMBOL(kmem_cache_alloc_trace); 3444 #endif 3445 3446 #ifdef CONFIG_NUMA 3447 /** 3448 * kmem_cache_alloc_node - Allocate an object on the specified node 3449 * @cachep: The cache to allocate from. 3450 * @flags: See kmalloc(). 3451 * @nodeid: node number of the target node. 3452 * 3453 * Identical to kmem_cache_alloc but it will allocate memory on the given 3454 * node, which can improve the performance for cpu bound structures. 3455 * 3456 * Fallback to other node is possible if __GFP_THISNODE is not set. 3457 */ 3458 void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid) 3459 { 3460 void *ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_); 3461 3462 trace_kmem_cache_alloc_node(_RET_IP_, ret, 3463 cachep->object_size, cachep->size, 3464 flags, nodeid); 3465 3466 return ret; 3467 } 3468 EXPORT_SYMBOL(kmem_cache_alloc_node); 3469 3470 #ifdef CONFIG_TRACING 3471 void *kmem_cache_alloc_node_trace(struct kmem_cache *cachep, 3472 gfp_t flags, 3473 int nodeid, 3474 size_t size) 3475 { 3476 void *ret; 3477 3478 ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_); 3479 3480 trace_kmalloc_node(_RET_IP_, ret, 3481 size, cachep->size, 3482 flags, nodeid); 3483 return ret; 3484 } 3485 EXPORT_SYMBOL(kmem_cache_alloc_node_trace); 3486 #endif 3487 3488 static __always_inline void * 3489 __do_kmalloc_node(size_t size, gfp_t flags, int node, unsigned long caller) 3490 { 3491 struct kmem_cache *cachep; 3492 3493 cachep = kmalloc_slab(size, flags); 3494 if (unlikely(ZERO_OR_NULL_PTR(cachep))) 3495 return cachep; 3496 return kmem_cache_alloc_node_trace(cachep, flags, node, size); 3497 } 3498 3499 #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_TRACING) 3500 void *__kmalloc_node(size_t size, gfp_t flags, int node) 3501 { 3502 return __do_kmalloc_node(size, flags, node, _RET_IP_); 3503 } 3504 EXPORT_SYMBOL(__kmalloc_node); 3505 3506 void *__kmalloc_node_track_caller(size_t size, gfp_t flags, 3507 int node, unsigned long caller) 3508 { 3509 return __do_kmalloc_node(size, flags, node, caller); 3510 } 3511 EXPORT_SYMBOL(__kmalloc_node_track_caller); 3512 #else 3513 void *__kmalloc_node(size_t size, gfp_t flags, int node) 3514 { 3515 return __do_kmalloc_node(size, flags, node, 0); 3516 } 3517 EXPORT_SYMBOL(__kmalloc_node); 3518 #endif /* CONFIG_DEBUG_SLAB || CONFIG_TRACING */ 3519 #endif /* CONFIG_NUMA */ 3520 3521 /** 3522 * __do_kmalloc - allocate memory 3523 * @size: how many bytes of memory are required. 3524 * @flags: the type of memory to allocate (see kmalloc). 3525 * @caller: function caller for debug tracking of the caller 3526 */ 3527 static __always_inline void *__do_kmalloc(size_t size, gfp_t flags, 3528 unsigned long caller) 3529 { 3530 struct kmem_cache *cachep; 3531 void *ret; 3532 3533 cachep = kmalloc_slab(size, flags); 3534 if (unlikely(ZERO_OR_NULL_PTR(cachep))) 3535 return cachep; 3536 ret = slab_alloc(cachep, flags, caller); 3537 3538 trace_kmalloc(caller, ret, 3539 size, cachep->size, flags); 3540 3541 return ret; 3542 } 3543 3544 3545 #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_TRACING) 3546 void *__kmalloc(size_t size, gfp_t flags) 3547 { 3548 return __do_kmalloc(size, flags, _RET_IP_); 3549 } 3550 EXPORT_SYMBOL(__kmalloc); 3551 3552 void *__kmalloc_track_caller(size_t size, gfp_t flags, unsigned long caller) 3553 { 3554 return __do_kmalloc(size, flags, caller); 3555 } 3556 EXPORT_SYMBOL(__kmalloc_track_caller); 3557 3558 #else 3559 void *__kmalloc(size_t size, gfp_t flags) 3560 { 3561 return __do_kmalloc(size, flags, 0); 3562 } 3563 EXPORT_SYMBOL(__kmalloc); 3564 #endif 3565 3566 /** 3567 * kmem_cache_free - Deallocate an object 3568 * @cachep: The cache the allocation was from. 3569 * @objp: The previously allocated object. 3570 * 3571 * Free an object which was previously allocated from this 3572 * cache. 3573 */ 3574 void kmem_cache_free(struct kmem_cache *cachep, void *objp) 3575 { 3576 unsigned long flags; 3577 cachep = cache_from_obj(cachep, objp); 3578 if (!cachep) 3579 return; 3580 3581 local_irq_save(flags); 3582 debug_check_no_locks_freed(objp, cachep->object_size); 3583 if (!(cachep->flags & SLAB_DEBUG_OBJECTS)) 3584 debug_check_no_obj_freed(objp, cachep->object_size); 3585 __cache_free(cachep, objp, _RET_IP_); 3586 local_irq_restore(flags); 3587 3588 trace_kmem_cache_free(_RET_IP_, objp); 3589 } 3590 EXPORT_SYMBOL(kmem_cache_free); 3591 3592 /** 3593 * kfree - free previously allocated memory 3594 * @objp: pointer returned by kmalloc. 3595 * 3596 * If @objp is NULL, no operation is performed. 3597 * 3598 * Don't free memory not originally allocated by kmalloc() 3599 * or you will run into trouble. 3600 */ 3601 void kfree(const void *objp) 3602 { 3603 struct kmem_cache *c; 3604 unsigned long flags; 3605 3606 trace_kfree(_RET_IP_, objp); 3607 3608 if (unlikely(ZERO_OR_NULL_PTR(objp))) 3609 return; 3610 local_irq_save(flags); 3611 kfree_debugcheck(objp); 3612 c = virt_to_cache(objp); 3613 debug_check_no_locks_freed(objp, c->object_size); 3614 3615 debug_check_no_obj_freed(objp, c->object_size); 3616 __cache_free(c, (void *)objp, _RET_IP_); 3617 local_irq_restore(flags); 3618 } 3619 EXPORT_SYMBOL(kfree); 3620 3621 /* 3622 * This initializes kmem_cache_node or resizes various caches for all nodes. 3623 */ 3624 static int alloc_kmem_cache_node(struct kmem_cache *cachep, gfp_t gfp) 3625 { 3626 int node; 3627 struct kmem_cache_node *n; 3628 struct array_cache *new_shared; 3629 struct alien_cache **new_alien = NULL; 3630 3631 for_each_online_node(node) { 3632 3633 if (use_alien_caches) { 3634 new_alien = alloc_alien_cache(node, cachep->limit, gfp); 3635 if (!new_alien) 3636 goto fail; 3637 } 3638 3639 new_shared = NULL; 3640 if (cachep->shared) { 3641 new_shared = alloc_arraycache(node, 3642 cachep->shared*cachep->batchcount, 3643 0xbaadf00d, gfp); 3644 if (!new_shared) { 3645 free_alien_cache(new_alien); 3646 goto fail; 3647 } 3648 } 3649 3650 n = get_node(cachep, node); 3651 if (n) { 3652 struct array_cache *shared = n->shared; 3653 LIST_HEAD(list); 3654 3655 spin_lock_irq(&n->list_lock); 3656 3657 if (shared) 3658 free_block(cachep, shared->entry, 3659 shared->avail, node, &list); 3660 3661 n->shared = new_shared; 3662 if (!n->alien) { 3663 n->alien = new_alien; 3664 new_alien = NULL; 3665 } 3666 n->free_limit = (1 + nr_cpus_node(node)) * 3667 cachep->batchcount + cachep->num; 3668 spin_unlock_irq(&n->list_lock); 3669 slabs_destroy(cachep, &list); 3670 kfree(shared); 3671 free_alien_cache(new_alien); 3672 continue; 3673 } 3674 n = kmalloc_node(sizeof(struct kmem_cache_node), gfp, node); 3675 if (!n) { 3676 free_alien_cache(new_alien); 3677 kfree(new_shared); 3678 goto fail; 3679 } 3680 3681 kmem_cache_node_init(n); 3682 n->next_reap = jiffies + REAPTIMEOUT_NODE + 3683 ((unsigned long)cachep) % REAPTIMEOUT_NODE; 3684 n->shared = new_shared; 3685 n->alien = new_alien; 3686 n->free_limit = (1 + nr_cpus_node(node)) * 3687 cachep->batchcount + cachep->num; 3688 cachep->node[node] = n; 3689 } 3690 return 0; 3691 3692 fail: 3693 if (!cachep->list.next) { 3694 /* Cache is not active yet. Roll back what we did */ 3695 node--; 3696 while (node >= 0) { 3697 n = get_node(cachep, node); 3698 if (n) { 3699 kfree(n->shared); 3700 free_alien_cache(n->alien); 3701 kfree(n); 3702 cachep->node[node] = NULL; 3703 } 3704 node--; 3705 } 3706 } 3707 return -ENOMEM; 3708 } 3709 3710 struct ccupdate_struct { 3711 struct kmem_cache *cachep; 3712 struct array_cache *new[0]; 3713 }; 3714 3715 static void do_ccupdate_local(void *info) 3716 { 3717 struct ccupdate_struct *new = info; 3718 struct array_cache *old; 3719 3720 check_irq_off(); 3721 old = cpu_cache_get(new->cachep); 3722 3723 new->cachep->array[smp_processor_id()] = new->new[smp_processor_id()]; 3724 new->new[smp_processor_id()] = old; 3725 } 3726 3727 /* Always called with the slab_mutex held */ 3728 static int __do_tune_cpucache(struct kmem_cache *cachep, int limit, 3729 int batchcount, int shared, gfp_t gfp) 3730 { 3731 struct ccupdate_struct *new; 3732 int i; 3733 3734 new = kzalloc(sizeof(*new) + nr_cpu_ids * sizeof(struct array_cache *), 3735 gfp); 3736 if (!new) 3737 return -ENOMEM; 3738 3739 for_each_online_cpu(i) { 3740 new->new[i] = alloc_arraycache(cpu_to_mem(i), limit, 3741 batchcount, gfp); 3742 if (!new->new[i]) { 3743 for (i--; i >= 0; i--) 3744 kfree(new->new[i]); 3745 kfree(new); 3746 return -ENOMEM; 3747 } 3748 } 3749 new->cachep = cachep; 3750 3751 on_each_cpu(do_ccupdate_local, (void *)new, 1); 3752 3753 check_irq_on(); 3754 cachep->batchcount = batchcount; 3755 cachep->limit = limit; 3756 cachep->shared = shared; 3757 3758 for_each_online_cpu(i) { 3759 LIST_HEAD(list); 3760 struct array_cache *ccold = new->new[i]; 3761 int node; 3762 struct kmem_cache_node *n; 3763 3764 if (!ccold) 3765 continue; 3766 3767 node = cpu_to_mem(i); 3768 n = get_node(cachep, node); 3769 spin_lock_irq(&n->list_lock); 3770 free_block(cachep, ccold->entry, ccold->avail, node, &list); 3771 spin_unlock_irq(&n->list_lock); 3772 slabs_destroy(cachep, &list); 3773 kfree(ccold); 3774 } 3775 kfree(new); 3776 return alloc_kmem_cache_node(cachep, gfp); 3777 } 3778 3779 static int do_tune_cpucache(struct kmem_cache *cachep, int limit, 3780 int batchcount, int shared, gfp_t gfp) 3781 { 3782 int ret; 3783 struct kmem_cache *c = NULL; 3784 int i = 0; 3785 3786 ret = __do_tune_cpucache(cachep, limit, batchcount, shared, gfp); 3787 3788 if (slab_state < FULL) 3789 return ret; 3790 3791 if ((ret < 0) || !is_root_cache(cachep)) 3792 return ret; 3793 3794 VM_BUG_ON(!mutex_is_locked(&slab_mutex)); 3795 for_each_memcg_cache_index(i) { 3796 c = cache_from_memcg_idx(cachep, i); 3797 if (c) 3798 /* return value determined by the parent cache only */ 3799 __do_tune_cpucache(c, limit, batchcount, shared, gfp); 3800 } 3801 3802 return ret; 3803 } 3804 3805 /* Called with slab_mutex held always */ 3806 static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp) 3807 { 3808 int err; 3809 int limit = 0; 3810 int shared = 0; 3811 int batchcount = 0; 3812 3813 if (!is_root_cache(cachep)) { 3814 struct kmem_cache *root = memcg_root_cache(cachep); 3815 limit = root->limit; 3816 shared = root->shared; 3817 batchcount = root->batchcount; 3818 } 3819 3820 if (limit && shared && batchcount) 3821 goto skip_setup; 3822 /* 3823 * The head array serves three purposes: 3824 * - create a LIFO ordering, i.e. return objects that are cache-warm 3825 * - reduce the number of spinlock operations. 3826 * - reduce the number of linked list operations on the slab and 3827 * bufctl chains: array operations are cheaper. 3828 * The numbers are guessed, we should auto-tune as described by 3829 * Bonwick. 3830 */ 3831 if (cachep->size > 131072) 3832 limit = 1; 3833 else if (cachep->size > PAGE_SIZE) 3834 limit = 8; 3835 else if (cachep->size > 1024) 3836 limit = 24; 3837 else if (cachep->size > 256) 3838 limit = 54; 3839 else 3840 limit = 120; 3841 3842 /* 3843 * CPU bound tasks (e.g. network routing) can exhibit cpu bound 3844 * allocation behaviour: Most allocs on one cpu, most free operations 3845 * on another cpu. For these cases, an efficient object passing between 3846 * cpus is necessary. This is provided by a shared array. The array 3847 * replaces Bonwick's magazine layer. 3848 * On uniprocessor, it's functionally equivalent (but less efficient) 3849 * to a larger limit. Thus disabled by default. 3850 */ 3851 shared = 0; 3852 if (cachep->size <= PAGE_SIZE && num_possible_cpus() > 1) 3853 shared = 8; 3854 3855 #if DEBUG 3856 /* 3857 * With debugging enabled, large batchcount lead to excessively long 3858 * periods with disabled local interrupts. Limit the batchcount 3859 */ 3860 if (limit > 32) 3861 limit = 32; 3862 #endif 3863 batchcount = (limit + 1) / 2; 3864 skip_setup: 3865 err = do_tune_cpucache(cachep, limit, batchcount, shared, gfp); 3866 if (err) 3867 printk(KERN_ERR "enable_cpucache failed for %s, error %d.\n", 3868 cachep->name, -err); 3869 return err; 3870 } 3871 3872 /* 3873 * Drain an array if it contains any elements taking the node lock only if 3874 * necessary. Note that the node listlock also protects the array_cache 3875 * if drain_array() is used on the shared array. 3876 */ 3877 static void drain_array(struct kmem_cache *cachep, struct kmem_cache_node *n, 3878 struct array_cache *ac, int force, int node) 3879 { 3880 LIST_HEAD(list); 3881 int tofree; 3882 3883 if (!ac || !ac->avail) 3884 return; 3885 if (ac->touched && !force) { 3886 ac->touched = 0; 3887 } else { 3888 spin_lock_irq(&n->list_lock); 3889 if (ac->avail) { 3890 tofree = force ? ac->avail : (ac->limit + 4) / 5; 3891 if (tofree > ac->avail) 3892 tofree = (ac->avail + 1) / 2; 3893 free_block(cachep, ac->entry, tofree, node, &list); 3894 ac->avail -= tofree; 3895 memmove(ac->entry, &(ac->entry[tofree]), 3896 sizeof(void *) * ac->avail); 3897 } 3898 spin_unlock_irq(&n->list_lock); 3899 slabs_destroy(cachep, &list); 3900 } 3901 } 3902 3903 /** 3904 * cache_reap - Reclaim memory from caches. 3905 * @w: work descriptor 3906 * 3907 * Called from workqueue/eventd every few seconds. 3908 * Purpose: 3909 * - clear the per-cpu caches for this CPU. 3910 * - return freeable pages to the main free memory pool. 3911 * 3912 * If we cannot acquire the cache chain mutex then just give up - we'll try 3913 * again on the next iteration. 3914 */ 3915 static void cache_reap(struct work_struct *w) 3916 { 3917 struct kmem_cache *searchp; 3918 struct kmem_cache_node *n; 3919 int node = numa_mem_id(); 3920 struct delayed_work *work = to_delayed_work(w); 3921 3922 if (!mutex_trylock(&slab_mutex)) 3923 /* Give up. Setup the next iteration. */ 3924 goto out; 3925 3926 list_for_each_entry(searchp, &slab_caches, list) { 3927 check_irq_on(); 3928 3929 /* 3930 * We only take the node lock if absolutely necessary and we 3931 * have established with reasonable certainty that 3932 * we can do some work if the lock was obtained. 3933 */ 3934 n = get_node(searchp, node); 3935 3936 reap_alien(searchp, n); 3937 3938 drain_array(searchp, n, cpu_cache_get(searchp), 0, node); 3939 3940 /* 3941 * These are racy checks but it does not matter 3942 * if we skip one check or scan twice. 3943 */ 3944 if (time_after(n->next_reap, jiffies)) 3945 goto next; 3946 3947 n->next_reap = jiffies + REAPTIMEOUT_NODE; 3948 3949 drain_array(searchp, n, n->shared, 0, node); 3950 3951 if (n->free_touched) 3952 n->free_touched = 0; 3953 else { 3954 int freed; 3955 3956 freed = drain_freelist(searchp, n, (n->free_limit + 3957 5 * searchp->num - 1) / (5 * searchp->num)); 3958 STATS_ADD_REAPED(searchp, freed); 3959 } 3960 next: 3961 cond_resched(); 3962 } 3963 check_irq_on(); 3964 mutex_unlock(&slab_mutex); 3965 next_reap_node(); 3966 out: 3967 /* Set up the next iteration */ 3968 schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_AC)); 3969 } 3970 3971 #ifdef CONFIG_SLABINFO 3972 void get_slabinfo(struct kmem_cache *cachep, struct slabinfo *sinfo) 3973 { 3974 struct page *page; 3975 unsigned long active_objs; 3976 unsigned long num_objs; 3977 unsigned long active_slabs = 0; 3978 unsigned long num_slabs, free_objects = 0, shared_avail = 0; 3979 const char *name; 3980 char *error = NULL; 3981 int node; 3982 struct kmem_cache_node *n; 3983 3984 active_objs = 0; 3985 num_slabs = 0; 3986 for_each_kmem_cache_node(cachep, node, n) { 3987 3988 check_irq_on(); 3989 spin_lock_irq(&n->list_lock); 3990 3991 list_for_each_entry(page, &n->slabs_full, lru) { 3992 if (page->active != cachep->num && !error) 3993 error = "slabs_full accounting error"; 3994 active_objs += cachep->num; 3995 active_slabs++; 3996 } 3997 list_for_each_entry(page, &n->slabs_partial, lru) { 3998 if (page->active == cachep->num && !error) 3999 error = "slabs_partial accounting error"; 4000 if (!page->active && !error) 4001 error = "slabs_partial accounting error"; 4002 active_objs += page->active; 4003 active_slabs++; 4004 } 4005 list_for_each_entry(page, &n->slabs_free, lru) { 4006 if (page->active && !error) 4007 error = "slabs_free accounting error"; 4008 num_slabs++; 4009 } 4010 free_objects += n->free_objects; 4011 if (n->shared) 4012 shared_avail += n->shared->avail; 4013 4014 spin_unlock_irq(&n->list_lock); 4015 } 4016 num_slabs += active_slabs; 4017 num_objs = num_slabs * cachep->num; 4018 if (num_objs - active_objs != free_objects && !error) 4019 error = "free_objects accounting error"; 4020 4021 name = cachep->name; 4022 if (error) 4023 printk(KERN_ERR "slab: cache %s error: %s\n", name, error); 4024 4025 sinfo->active_objs = active_objs; 4026 sinfo->num_objs = num_objs; 4027 sinfo->active_slabs = active_slabs; 4028 sinfo->num_slabs = num_slabs; 4029 sinfo->shared_avail = shared_avail; 4030 sinfo->limit = cachep->limit; 4031 sinfo->batchcount = cachep->batchcount; 4032 sinfo->shared = cachep->shared; 4033 sinfo->objects_per_slab = cachep->num; 4034 sinfo->cache_order = cachep->gfporder; 4035 } 4036 4037 void slabinfo_show_stats(struct seq_file *m, struct kmem_cache *cachep) 4038 { 4039 #if STATS 4040 { /* node stats */ 4041 unsigned long high = cachep->high_mark; 4042 unsigned long allocs = cachep->num_allocations; 4043 unsigned long grown = cachep->grown; 4044 unsigned long reaped = cachep->reaped; 4045 unsigned long errors = cachep->errors; 4046 unsigned long max_freeable = cachep->max_freeable; 4047 unsigned long node_allocs = cachep->node_allocs; 4048 unsigned long node_frees = cachep->node_frees; 4049 unsigned long overflows = cachep->node_overflow; 4050 4051 seq_printf(m, " : globalstat %7lu %6lu %5lu %4lu " 4052 "%4lu %4lu %4lu %4lu %4lu", 4053 allocs, high, grown, 4054 reaped, errors, max_freeable, node_allocs, 4055 node_frees, overflows); 4056 } 4057 /* cpu stats */ 4058 { 4059 unsigned long allochit = atomic_read(&cachep->allochit); 4060 unsigned long allocmiss = atomic_read(&cachep->allocmiss); 4061 unsigned long freehit = atomic_read(&cachep->freehit); 4062 unsigned long freemiss = atomic_read(&cachep->freemiss); 4063 4064 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu", 4065 allochit, allocmiss, freehit, freemiss); 4066 } 4067 #endif 4068 } 4069 4070 #define MAX_SLABINFO_WRITE 128 4071 /** 4072 * slabinfo_write - Tuning for the slab allocator 4073 * @file: unused 4074 * @buffer: user buffer 4075 * @count: data length 4076 * @ppos: unused 4077 */ 4078 ssize_t slabinfo_write(struct file *file, const char __user *buffer, 4079 size_t count, loff_t *ppos) 4080 { 4081 char kbuf[MAX_SLABINFO_WRITE + 1], *tmp; 4082 int limit, batchcount, shared, res; 4083 struct kmem_cache *cachep; 4084 4085 if (count > MAX_SLABINFO_WRITE) 4086 return -EINVAL; 4087 if (copy_from_user(&kbuf, buffer, count)) 4088 return -EFAULT; 4089 kbuf[MAX_SLABINFO_WRITE] = '\0'; 4090 4091 tmp = strchr(kbuf, ' '); 4092 if (!tmp) 4093 return -EINVAL; 4094 *tmp = '\0'; 4095 tmp++; 4096 if (sscanf(tmp, " %d %d %d", &limit, &batchcount, &shared) != 3) 4097 return -EINVAL; 4098 4099 /* Find the cache in the chain of caches. */ 4100 mutex_lock(&slab_mutex); 4101 res = -EINVAL; 4102 list_for_each_entry(cachep, &slab_caches, list) { 4103 if (!strcmp(cachep->name, kbuf)) { 4104 if (limit < 1 || batchcount < 1 || 4105 batchcount > limit || shared < 0) { 4106 res = 0; 4107 } else { 4108 res = do_tune_cpucache(cachep, limit, 4109 batchcount, shared, 4110 GFP_KERNEL); 4111 } 4112 break; 4113 } 4114 } 4115 mutex_unlock(&slab_mutex); 4116 if (res >= 0) 4117 res = count; 4118 return res; 4119 } 4120 4121 #ifdef CONFIG_DEBUG_SLAB_LEAK 4122 4123 static void *leaks_start(struct seq_file *m, loff_t *pos) 4124 { 4125 mutex_lock(&slab_mutex); 4126 return seq_list_start(&slab_caches, *pos); 4127 } 4128 4129 static inline int add_caller(unsigned long *n, unsigned long v) 4130 { 4131 unsigned long *p; 4132 int l; 4133 if (!v) 4134 return 1; 4135 l = n[1]; 4136 p = n + 2; 4137 while (l) { 4138 int i = l/2; 4139 unsigned long *q = p + 2 * i; 4140 if (*q == v) { 4141 q[1]++; 4142 return 1; 4143 } 4144 if (*q > v) { 4145 l = i; 4146 } else { 4147 p = q + 2; 4148 l -= i + 1; 4149 } 4150 } 4151 if (++n[1] == n[0]) 4152 return 0; 4153 memmove(p + 2, p, n[1] * 2 * sizeof(unsigned long) - ((void *)p - (void *)n)); 4154 p[0] = v; 4155 p[1] = 1; 4156 return 1; 4157 } 4158 4159 static void handle_slab(unsigned long *n, struct kmem_cache *c, 4160 struct page *page) 4161 { 4162 void *p; 4163 int i; 4164 4165 if (n[0] == n[1]) 4166 return; 4167 for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) { 4168 if (get_obj_status(page, i) != OBJECT_ACTIVE) 4169 continue; 4170 4171 if (!add_caller(n, (unsigned long)*dbg_userword(c, p))) 4172 return; 4173 } 4174 } 4175 4176 static void show_symbol(struct seq_file *m, unsigned long address) 4177 { 4178 #ifdef CONFIG_KALLSYMS 4179 unsigned long offset, size; 4180 char modname[MODULE_NAME_LEN], name[KSYM_NAME_LEN]; 4181 4182 if (lookup_symbol_attrs(address, &size, &offset, modname, name) == 0) { 4183 seq_printf(m, "%s+%#lx/%#lx", name, offset, size); 4184 if (modname[0]) 4185 seq_printf(m, " [%s]", modname); 4186 return; 4187 } 4188 #endif 4189 seq_printf(m, "%p", (void *)address); 4190 } 4191 4192 static int leaks_show(struct seq_file *m, void *p) 4193 { 4194 struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list); 4195 struct page *page; 4196 struct kmem_cache_node *n; 4197 const char *name; 4198 unsigned long *x = m->private; 4199 int node; 4200 int i; 4201 4202 if (!(cachep->flags & SLAB_STORE_USER)) 4203 return 0; 4204 if (!(cachep->flags & SLAB_RED_ZONE)) 4205 return 0; 4206 4207 /* OK, we can do it */ 4208 4209 x[1] = 0; 4210 4211 for_each_kmem_cache_node(cachep, node, n) { 4212 4213 check_irq_on(); 4214 spin_lock_irq(&n->list_lock); 4215 4216 list_for_each_entry(page, &n->slabs_full, lru) 4217 handle_slab(x, cachep, page); 4218 list_for_each_entry(page, &n->slabs_partial, lru) 4219 handle_slab(x, cachep, page); 4220 spin_unlock_irq(&n->list_lock); 4221 } 4222 name = cachep->name; 4223 if (x[0] == x[1]) { 4224 /* Increase the buffer size */ 4225 mutex_unlock(&slab_mutex); 4226 m->private = kzalloc(x[0] * 4 * sizeof(unsigned long), GFP_KERNEL); 4227 if (!m->private) { 4228 /* Too bad, we are really out */ 4229 m->private = x; 4230 mutex_lock(&slab_mutex); 4231 return -ENOMEM; 4232 } 4233 *(unsigned long *)m->private = x[0] * 2; 4234 kfree(x); 4235 mutex_lock(&slab_mutex); 4236 /* Now make sure this entry will be retried */ 4237 m->count = m->size; 4238 return 0; 4239 } 4240 for (i = 0; i < x[1]; i++) { 4241 seq_printf(m, "%s: %lu ", name, x[2*i+3]); 4242 show_symbol(m, x[2*i+2]); 4243 seq_putc(m, '\n'); 4244 } 4245 4246 return 0; 4247 } 4248 4249 static const struct seq_operations slabstats_op = { 4250 .start = leaks_start, 4251 .next = slab_next, 4252 .stop = slab_stop, 4253 .show = leaks_show, 4254 }; 4255 4256 static int slabstats_open(struct inode *inode, struct file *file) 4257 { 4258 unsigned long *n = kzalloc(PAGE_SIZE, GFP_KERNEL); 4259 int ret = -ENOMEM; 4260 if (n) { 4261 ret = seq_open(file, &slabstats_op); 4262 if (!ret) { 4263 struct seq_file *m = file->private_data; 4264 *n = PAGE_SIZE / (2 * sizeof(unsigned long)); 4265 m->private = n; 4266 n = NULL; 4267 } 4268 kfree(n); 4269 } 4270 return ret; 4271 } 4272 4273 static const struct file_operations proc_slabstats_operations = { 4274 .open = slabstats_open, 4275 .read = seq_read, 4276 .llseek = seq_lseek, 4277 .release = seq_release_private, 4278 }; 4279 #endif 4280 4281 static int __init slab_proc_init(void) 4282 { 4283 #ifdef CONFIG_DEBUG_SLAB_LEAK 4284 proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations); 4285 #endif 4286 return 0; 4287 } 4288 module_init(slab_proc_init); 4289 #endif 4290 4291 /** 4292 * ksize - get the actual amount of memory allocated for a given object 4293 * @objp: Pointer to the object 4294 * 4295 * kmalloc may internally round up allocations and return more memory 4296 * than requested. ksize() can be used to determine the actual amount of 4297 * memory allocated. The caller may use this additional memory, even though 4298 * a smaller amount of memory was initially specified with the kmalloc call. 4299 * The caller must guarantee that objp points to a valid object previously 4300 * allocated with either kmalloc() or kmem_cache_alloc(). The object 4301 * must not be freed during the duration of the call. 4302 */ 4303 size_t ksize(const void *objp) 4304 { 4305 BUG_ON(!objp); 4306 if (unlikely(objp == ZERO_SIZE_PTR)) 4307 return 0; 4308 4309 return virt_to_cache(objp)->object_size; 4310 } 4311 EXPORT_SYMBOL(ksize); 4312