slub.c 142.1 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
C
Christoph Lameter 已提交
2 3 4 5
/*
 * SLUB: A slab allocator that limits cache line use instead of queuing
 * objects in per cpu and per node lists.
 *
6 7
 * The allocator synchronizes using per slab locks or atomic operatios
 * and only uses a centralized lock to manage a pool of partial slabs.
C
Christoph Lameter 已提交
8
 *
C
Christoph Lameter 已提交
9
 * (C) 2007 SGI, Christoph Lameter
10
 * (C) 2011 Linux Foundation, Christoph Lameter
C
Christoph Lameter 已提交
11 12 13
 */

#include <linux/mm.h>
N
Nick Piggin 已提交
14
#include <linux/swap.h> /* struct reclaim_state */
C
Christoph Lameter 已提交
15 16 17 18 19
#include <linux/module.h>
#include <linux/bit_spinlock.h>
#include <linux/interrupt.h>
#include <linux/bitops.h>
#include <linux/slab.h>
20
#include "slab.h"
21
#include <linux/proc_fs.h>
22
#include <linux/notifier.h>
C
Christoph Lameter 已提交
23
#include <linux/seq_file.h>
24
#include <linux/kasan.h>
C
Christoph Lameter 已提交
25 26 27 28
#include <linux/cpu.h>
#include <linux/cpuset.h>
#include <linux/mempolicy.h>
#include <linux/ctype.h>
29
#include <linux/debugobjects.h>
C
Christoph Lameter 已提交
30
#include <linux/kallsyms.h>
31
#include <linux/memory.h>
R
Roman Zippel 已提交
32
#include <linux/math64.h>
A
Akinobu Mita 已提交
33
#include <linux/fault-inject.h>
34
#include <linux/stacktrace.h>
35
#include <linux/prefetch.h>
36
#include <linux/memcontrol.h>
37
#include <linux/random.h>
C
Christoph Lameter 已提交
38

39 40
#include <trace/events/kmem.h>

41 42
#include "internal.h"

C
Christoph Lameter 已提交
43 44
/*
 * Lock order:
45
 *   1. slab_mutex (Global Mutex)
46 47
 *   2. node->list_lock
 *   3. slab_lock(page) (Only on some arches and for debugging)
C
Christoph Lameter 已提交
48
 *
49
 *   slab_mutex
50
 *
51
 *   The role of the slab_mutex is to protect the list of all the slabs
52 53 54 55 56 57 58 59 60 61 62 63 64 65
 *   and to synchronize major metadata changes to slab cache structures.
 *
 *   The slab_lock is only used for debugging and on arches that do not
 *   have the ability to do a cmpxchg_double. It only protects the second
 *   double word in the page struct. Meaning
 *	A. page->freelist	-> List of object free in a page
 *	B. page->counters	-> Counters of objects
 *	C. page->frozen		-> frozen state
 *
 *   If a slab is frozen then it is exempt from list management. It is not
 *   on any list. The processor that froze the slab is the one who can
 *   perform list operations on the page. Other processors may put objects
 *   onto the freelist but the processor that froze the slab is the only
 *   one that can retrieve the objects from the page's freelist.
C
Christoph Lameter 已提交
66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85
 *
 *   The list_lock protects the partial and full list on each node and
 *   the partial slab counter. If taken then no new slabs may be added or
 *   removed from the lists nor make the number of partial slabs be modified.
 *   (Note that the total number of slabs is an atomic value that may be
 *   modified without taking the list lock).
 *
 *   The list_lock is a centralized lock and thus we avoid taking it as
 *   much as possible. As long as SLUB does not have to handle partial
 *   slabs, operations can continue without any centralized lock. F.e.
 *   allocating a long series of objects that fill up slabs does not require
 *   the list lock.
 *   Interrupts are disabled during allocation and deallocation in order to
 *   make the slab allocator safe to use in the context of an irq. In addition
 *   interrupts are disabled to ensure that the processor does not change
 *   while handling per_cpu slabs, due to kernel preemption.
 *
 * SLUB assigns one slab for allocation to each processor.
 * Allocations only occur from these slabs called cpu slabs.
 *
C
Christoph Lameter 已提交
86 87
 * Slabs with free elements are kept on a partial list and during regular
 * operations no list for full slabs is used. If an object in a full slab is
C
Christoph Lameter 已提交
88
 * freed then the slab will show up again on the partial lists.
C
Christoph Lameter 已提交
89 90
 * We track full slabs for debugging purposes though because otherwise we
 * cannot scan all objects.
C
Christoph Lameter 已提交
91 92 93 94 95 96 97
 *
 * Slabs are freed when they become empty. Teardown and setup is
 * minimal so we rely on the page allocators per cpu caches for
 * fast frees and allocs.
 *
 * Overloading of page flags that are otherwise used for LRU management.
 *
98 99 100 101 102 103 104 105 106 107 108 109
 * PageActive 		The slab is frozen and exempt from list processing.
 * 			This means that the slab is dedicated to a purpose
 * 			such as satisfying allocations for a specific
 * 			processor. Objects may be freed in the slab while
 * 			it is frozen but slab_free will then skip the usual
 * 			list operations. It is up to the processor holding
 * 			the slab to integrate the slab into the slab lists
 * 			when the slab is no longer needed.
 *
 * 			One use of this flag is to mark slabs that are
 * 			used for allocations. Then such a slab becomes a cpu
 * 			slab. The cpu slab may be equipped with an additional
110
 * 			freelist that allows lockless access to
111 112
 * 			free objects in addition to the regular freelist
 * 			that requires the slab lock.
C
Christoph Lameter 已提交
113 114 115
 *
 * PageError		Slab requires special handling due to debug
 * 			options set. This moves	slab handling out of
116
 * 			the fast path and disables lockless freelists.
C
Christoph Lameter 已提交
117 118
 */

119 120
static inline int kmem_cache_debug(struct kmem_cache *s)
{
121
#ifdef CONFIG_SLUB_DEBUG
122
	return unlikely(s->flags & SLAB_DEBUG_FLAGS);
123
#else
124
	return 0;
125
#endif
126
}
127

128
void *fixup_red_left(struct kmem_cache *s, void *p)
J
Joonsoo Kim 已提交
129 130 131 132 133 134 135
{
	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
		p += s->red_left_pad;

	return p;
}

136 137 138 139 140 141 142 143 144
static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s)
{
#ifdef CONFIG_SLUB_CPU_PARTIAL
	return !kmem_cache_debug(s);
#else
	return false;
#endif
}

C
Christoph Lameter 已提交
145 146 147 148 149 150 151 152 153 154 155
/*
 * Issues still to be resolved:
 *
 * - Support PAGE_ALLOC_DEBUG. Should be easy to do.
 *
 * - Variable sizing of the per node arrays
 */

/* Enable to test recovery from slab corruption on boot */
#undef SLUB_RESILIENCY_TEST

156 157 158
/* Enable to log cmpxchg failures */
#undef SLUB_DEBUG_CMPXCHG

159 160 161 162
/*
 * Mininum number of partial slabs. These will be left on the partial
 * lists even if they are empty. kmem_cache_shrink may reclaim them.
 */
C
Christoph Lameter 已提交
163
#define MIN_PARTIAL 5
C
Christoph Lameter 已提交
164

165 166 167
/*
 * Maximum number of desirable partial slabs.
 * The existence of more partial slabs makes kmem_cache_shrink
Z
Zhi Yong Wu 已提交
168
 * sort the partial list by the number of objects in use.
169 170 171
 */
#define MAX_PARTIAL 10

172
#define DEBUG_DEFAULT_FLAGS (SLAB_CONSISTENCY_CHECKS | SLAB_RED_ZONE | \
C
Christoph Lameter 已提交
173
				SLAB_POISON | SLAB_STORE_USER)
C
Christoph Lameter 已提交
174

175 176 177 178 179 180 181 182
/*
 * These debug flags cannot use CMPXCHG because there might be consistency
 * issues when checking or reading debug information
 */
#define SLAB_NO_CMPXCHG (SLAB_CONSISTENCY_CHECKS | SLAB_STORE_USER | \
				SLAB_TRACE)


183
/*
184 185 186
 * Debugging flags that require metadata to be stored in the slab.  These get
 * disabled when slub_debug=O is used and a cache's min order increases with
 * metadata.
187
 */
188
#define DEBUG_METADATA_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER)
189

190 191
#define OO_SHIFT	16
#define OO_MASK		((1 << OO_SHIFT) - 1)
192
#define MAX_OBJS_PER_PAGE	32767 /* since page.objects is u15 */
193

C
Christoph Lameter 已提交
194
/* Internal SLUB flags */
195
/* Poison object */
196
#define __OBJECT_POISON		((slab_flags_t __force)0x80000000U)
197
/* Use cmpxchg_double */
198
#define __CMPXCHG_DOUBLE	((slab_flags_t __force)0x40000000U)
C
Christoph Lameter 已提交
199

200 201 202
/*
 * Tracking user of a slab.
 */
203
#define TRACK_ADDRS_COUNT 16
204
struct track {
205
	unsigned long addr;	/* Called from address */
206 207 208
#ifdef CONFIG_STACKTRACE
	unsigned long addrs[TRACK_ADDRS_COUNT];	/* Called from address */
#endif
209 210 211 212 213 214 215
	int cpu;		/* Was running on cpu */
	int pid;		/* Pid context */
	unsigned long when;	/* When did the operation occur */
};

enum track_item { TRACK_ALLOC, TRACK_FREE };

216
#ifdef CONFIG_SYSFS
C
Christoph Lameter 已提交
217 218
static int sysfs_slab_add(struct kmem_cache *);
static int sysfs_slab_alias(struct kmem_cache *, const char *);
219
static void memcg_propagate_slab_attrs(struct kmem_cache *s);
220
static void sysfs_slab_remove(struct kmem_cache *s);
C
Christoph Lameter 已提交
221
#else
222 223 224
static inline int sysfs_slab_add(struct kmem_cache *s) { return 0; }
static inline int sysfs_slab_alias(struct kmem_cache *s, const char *p)
							{ return 0; }
225
static inline void memcg_propagate_slab_attrs(struct kmem_cache *s) { }
226
static inline void sysfs_slab_remove(struct kmem_cache *s) { }
C
Christoph Lameter 已提交
227 228
#endif

229
static inline void stat(const struct kmem_cache *s, enum stat_item si)
230 231
{
#ifdef CONFIG_SLUB_STATS
232 233 234 235 236
	/*
	 * The rmw is racy on a preemptible kernel but this is acceptable, so
	 * avoid this_cpu_add()'s irq-disable overhead.
	 */
	raw_cpu_inc(s->cpu_slab->stat[si]);
237 238 239
#endif
}

C
Christoph Lameter 已提交
240 241 242 243
/********************************************************************
 * 			Core slab cache functions
 *******************************************************************/

244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266
/*
 * Returns freelist pointer (ptr). With hardening, this is obfuscated
 * with an XOR of the address where the pointer is held and a per-cache
 * random number.
 */
static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
				 unsigned long ptr_addr)
{
#ifdef CONFIG_SLAB_FREELIST_HARDENED
	return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
#else
	return ptr;
#endif
}

/* Returns the freelist pointer recorded at location ptr_addr. */
static inline void *freelist_dereference(const struct kmem_cache *s,
					 void *ptr_addr)
{
	return freelist_ptr(s, (void *)*(unsigned long *)(ptr_addr),
			    (unsigned long)ptr_addr);
}

267 268
static inline void *get_freepointer(struct kmem_cache *s, void *object)
{
269
	return freelist_dereference(s, object + s->offset);
270 271
}

272 273
static void prefetch_freepointer(const struct kmem_cache *s, void *object)
{
274 275
	if (object)
		prefetch(freelist_dereference(s, object + s->offset));
276 277
}

278 279
static inline void *get_freepointer_safe(struct kmem_cache *s, void *object)
{
280
	unsigned long freepointer_addr;
281 282
	void *p;

283 284 285
	if (!debug_pagealloc_enabled())
		return get_freepointer(s, object);

286 287 288
	freepointer_addr = (unsigned long)object + s->offset;
	probe_kernel_read(&p, (void **)freepointer_addr, sizeof(p));
	return freelist_ptr(s, p, freepointer_addr);
289 290
}

291 292
static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
{
293 294
	unsigned long freeptr_addr = (unsigned long)object + s->offset;

295 296 297 298
#ifdef CONFIG_SLAB_FREELIST_HARDENED
	BUG_ON(object == fp); /* naive detection of double free or corruption */
#endif

299
	*(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
300 301 302
}

/* Loop over all objects in a slab */
303
#define for_each_object(__p, __s, __addr, __objects) \
J
Joonsoo Kim 已提交
304 305 306
	for (__p = fixup_red_left(__s, __addr); \
		__p < (__addr) + (__objects) * (__s)->size; \
		__p += (__s)->size)
307

308
#define for_each_object_idx(__p, __idx, __s, __addr, __objects) \
J
Joonsoo Kim 已提交
309 310 311
	for (__p = fixup_red_left(__s, __addr), __idx = 1; \
		__idx <= __objects; \
		__p += (__s)->size, __idx++)
312

313 314 315 316 317 318
/* Determine object index from a given position */
static inline int slab_index(void *p, struct kmem_cache *s, void *addr)
{
	return (p - addr) / s->size;
}

319 320 321 322 323
static inline int order_objects(int order, unsigned long size, int reserved)
{
	return ((PAGE_SIZE << order) - reserved) / size;
}

324
static inline struct kmem_cache_order_objects oo_make(int order,
325
		unsigned long size, int reserved)
326 327
{
	struct kmem_cache_order_objects x = {
328
		(order << OO_SHIFT) + order_objects(order, size, reserved)
329 330 331 332 333 334 335
	};

	return x;
}

static inline int oo_order(struct kmem_cache_order_objects x)
{
336
	return x.x >> OO_SHIFT;
337 338 339 340
}

static inline int oo_objects(struct kmem_cache_order_objects x)
{
341
	return x.x & OO_MASK;
342 343
}

344 345 346 347 348
/*
 * Per slab locking using the pagelock
 */
static __always_inline void slab_lock(struct page *page)
{
349
	VM_BUG_ON_PAGE(PageTail(page), page);
350 351 352 353 354
	bit_spin_lock(PG_locked, &page->flags);
}

static __always_inline void slab_unlock(struct page *page)
{
355
	VM_BUG_ON_PAGE(PageTail(page), page);
356 357 358
	__bit_spin_unlock(PG_locked, &page->flags);
}

359 360 361 362 363 364
static inline void set_page_slub_counters(struct page *page, unsigned long counters_new)
{
	struct page tmp;
	tmp.counters = counters_new;
	/*
	 * page->counters can cover frozen/inuse/objects as well
365 366
	 * as page->_refcount.  If we assign to ->counters directly
	 * we run the risk of losing updates to page->_refcount, so
367 368 369 370 371 372 373
	 * be careful and only assign to the fields we need.
	 */
	page->frozen  = tmp.frozen;
	page->inuse   = tmp.inuse;
	page->objects = tmp.objects;
}

374 375 376 377 378 379 380
/* Interrupts must be disabled (for the fallback code to work right) */
static inline bool __cmpxchg_double_slab(struct kmem_cache *s, struct page *page,
		void *freelist_old, unsigned long counters_old,
		void *freelist_new, unsigned long counters_new,
		const char *n)
{
	VM_BUG_ON(!irqs_disabled());
381 382
#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
    defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
383
	if (s->flags & __CMPXCHG_DOUBLE) {
384
		if (cmpxchg_double(&page->freelist, &page->counters,
385 386
				   freelist_old, counters_old,
				   freelist_new, counters_new))
387
			return true;
388 389 390 391
	} else
#endif
	{
		slab_lock(page);
392 393
		if (page->freelist == freelist_old &&
					page->counters == counters_old) {
394
			page->freelist = freelist_new;
395
			set_page_slub_counters(page, counters_new);
396
			slab_unlock(page);
397
			return true;
398 399 400 401 402 403 404 405
		}
		slab_unlock(page);
	}

	cpu_relax();
	stat(s, CMPXCHG_DOUBLE_FAIL);

#ifdef SLUB_DEBUG_CMPXCHG
406
	pr_info("%s %s: cmpxchg double redo ", n, s->name);
407 408
#endif

409
	return false;
410 411
}

412 413 414 415 416
static inline bool cmpxchg_double_slab(struct kmem_cache *s, struct page *page,
		void *freelist_old, unsigned long counters_old,
		void *freelist_new, unsigned long counters_new,
		const char *n)
{
417 418
#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
    defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
419
	if (s->flags & __CMPXCHG_DOUBLE) {
420
		if (cmpxchg_double(&page->freelist, &page->counters,
421 422
				   freelist_old, counters_old,
				   freelist_new, counters_new))
423
			return true;
424 425 426
	} else
#endif
	{
427 428 429
		unsigned long flags;

		local_irq_save(flags);
430
		slab_lock(page);
431 432
		if (page->freelist == freelist_old &&
					page->counters == counters_old) {
433
			page->freelist = freelist_new;
434
			set_page_slub_counters(page, counters_new);
435
			slab_unlock(page);
436
			local_irq_restore(flags);
437
			return true;
438
		}
439
		slab_unlock(page);
440
		local_irq_restore(flags);
441 442 443 444 445 446
	}

	cpu_relax();
	stat(s, CMPXCHG_DOUBLE_FAIL);

#ifdef SLUB_DEBUG_CMPXCHG
447
	pr_info("%s %s: cmpxchg double redo ", n, s->name);
448 449
#endif

450
	return false;
451 452
}

C
Christoph Lameter 已提交
453
#ifdef CONFIG_SLUB_DEBUG
454 455 456
/*
 * Determine a map of object in use on a page.
 *
457
 * Node listlock must be held to guarantee that the page does
458 459 460 461 462 463 464 465 466 467 468
 * not vanish from under us.
 */
static void get_map(struct kmem_cache *s, struct page *page, unsigned long *map)
{
	void *p;
	void *addr = page_address(page);

	for (p = page->freelist; p; p = get_freepointer(s, p))
		set_bit(slab_index(p, s, addr), map);
}

J
Joonsoo Kim 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484
static inline int size_from_object(struct kmem_cache *s)
{
	if (s->flags & SLAB_RED_ZONE)
		return s->size - s->red_left_pad;

	return s->size;
}

static inline void *restore_red_left(struct kmem_cache *s, void *p)
{
	if (s->flags & SLAB_RED_ZONE)
		p -= s->red_left_pad;

	return p;
}

C
Christoph Lameter 已提交
485 486 487
/*
 * Debug settings:
 */
488
#if defined(CONFIG_SLUB_DEBUG_ON)
489
static slab_flags_t slub_debug = DEBUG_DEFAULT_FLAGS;
490
#else
491
static slab_flags_t slub_debug;
492
#endif
C
Christoph Lameter 已提交
493 494

static char *slub_debug_slabs;
495
static int disable_higher_order_debug;
C
Christoph Lameter 已提交
496

497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512
/*
 * slub is about to manipulate internal object metadata.  This memory lies
 * outside the range of the allocated object, so accessing it would normally
 * be reported by kasan as a bounds error.  metadata_access_enable() is used
 * to tell kasan that these accesses are OK.
 */
static inline void metadata_access_enable(void)
{
	kasan_disable_current();
}

static inline void metadata_access_disable(void)
{
	kasan_enable_current();
}

C
Christoph Lameter 已提交
513 514 515
/*
 * Object debugging
 */
J
Joonsoo Kim 已提交
516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535

/* Verify that a pointer has an address that is valid within a slab page */
static inline int check_valid_pointer(struct kmem_cache *s,
				struct page *page, void *object)
{
	void *base;

	if (!object)
		return 1;

	base = page_address(page);
	object = restore_red_left(s, object);
	if (object < base || object >= base + page->objects * s->size ||
		(object - base) % s->size) {
		return 0;
	}

	return 1;
}

536 537
static void print_section(char *level, char *text, u8 *addr,
			  unsigned int length)
C
Christoph Lameter 已提交
538
{
539
	metadata_access_enable();
540
	print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, 16, 1, addr,
541
			length, 1);
542
	metadata_access_disable();
C
Christoph Lameter 已提交
543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558
}

static struct track *get_track(struct kmem_cache *s, void *object,
	enum track_item alloc)
{
	struct track *p;

	if (s->offset)
		p = object + s->offset + sizeof(void *);
	else
		p = object + s->inuse;

	return p + alloc;
}

static void set_track(struct kmem_cache *s, void *object,
559
			enum track_item alloc, unsigned long addr)
C
Christoph Lameter 已提交
560
{
A
Akinobu Mita 已提交
561
	struct track *p = get_track(s, object, alloc);
C
Christoph Lameter 已提交
562 563

	if (addr) {
564 565 566 567 568 569 570 571
#ifdef CONFIG_STACKTRACE
		struct stack_trace trace;
		int i;

		trace.nr_entries = 0;
		trace.max_entries = TRACK_ADDRS_COUNT;
		trace.entries = p->addrs;
		trace.skip = 3;
572
		metadata_access_enable();
573
		save_stack_trace(&trace);
574
		metadata_access_disable();
575 576 577 578 579 580 581 582 583

		/* See rant in lockdep.c */
		if (trace.nr_entries != 0 &&
		    trace.entries[trace.nr_entries - 1] == ULONG_MAX)
			trace.nr_entries--;

		for (i = trace.nr_entries; i < TRACK_ADDRS_COUNT; i++)
			p->addrs[i] = 0;
#endif
C
Christoph Lameter 已提交
584 585
		p->addr = addr;
		p->cpu = smp_processor_id();
A
Alexey Dobriyan 已提交
586
		p->pid = current->pid;
C
Christoph Lameter 已提交
587 588 589 590 591 592 593
		p->when = jiffies;
	} else
		memset(p, 0, sizeof(struct track));
}

static void init_tracking(struct kmem_cache *s, void *object)
{
594 595 596
	if (!(s->flags & SLAB_STORE_USER))
		return;

597 598
	set_track(s, object, TRACK_FREE, 0UL);
	set_track(s, object, TRACK_ALLOC, 0UL);
C
Christoph Lameter 已提交
599 600
}

601
static void print_track(const char *s, struct track *t, unsigned long pr_time)
C
Christoph Lameter 已提交
602 603 604 605
{
	if (!t->addr)
		return;

606
	pr_err("INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
607
	       s, (void *)t->addr, pr_time - t->when, t->cpu, t->pid);
608 609 610 611 612
#ifdef CONFIG_STACKTRACE
	{
		int i;
		for (i = 0; i < TRACK_ADDRS_COUNT; i++)
			if (t->addrs[i])
613
				pr_err("\t%pS\n", (void *)t->addrs[i]);
614 615 616 617
			else
				break;
	}
#endif
618 619 620 621
}

static void print_tracking(struct kmem_cache *s, void *object)
{
622
	unsigned long pr_time = jiffies;
623 624 625
	if (!(s->flags & SLAB_STORE_USER))
		return;

626 627
	print_track("Allocated", get_track(s, object, TRACK_ALLOC), pr_time);
	print_track("Freed", get_track(s, object, TRACK_FREE), pr_time);
628 629 630 631
}

static void print_page_info(struct page *page)
{
632
	pr_err("INFO: Slab 0x%p objects=%u used=%u fp=0x%p flags=0x%04lx\n",
633
	       page, page->objects, page->inuse, page->freelist, page->flags);
634 635 636 637 638

}

static void slab_bug(struct kmem_cache *s, char *fmt, ...)
{
639
	struct va_format vaf;
640 641 642
	va_list args;

	va_start(args, fmt);
643 644
	vaf.fmt = fmt;
	vaf.va = &args;
645
	pr_err("=============================================================================\n");
646
	pr_err("BUG %s (%s): %pV\n", s->name, print_tainted(), &vaf);
647
	pr_err("-----------------------------------------------------------------------------\n\n");
648

649
	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
650
	va_end(args);
C
Christoph Lameter 已提交
651 652
}

653 654
static void slab_fix(struct kmem_cache *s, char *fmt, ...)
{
655
	struct va_format vaf;
656 657 658
	va_list args;

	va_start(args, fmt);
659 660 661
	vaf.fmt = fmt;
	vaf.va = &args;
	pr_err("FIX %s: %pV\n", s->name, &vaf);
662 663 664 665
	va_end(args);
}

static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
C
Christoph Lameter 已提交
666 667
{
	unsigned int off;	/* Offset of last byte */
668
	u8 *addr = page_address(page);
669 670 671 672 673

	print_tracking(s, p);

	print_page_info(page);

674 675
	pr_err("INFO: Object 0x%p @offset=%tu fp=0x%p\n\n",
	       p, p - addr, get_freepointer(s, p));
676

J
Joonsoo Kim 已提交
677
	if (s->flags & SLAB_RED_ZONE)
678 679
		print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
			      s->red_left_pad);
J
Joonsoo Kim 已提交
680
	else if (p > addr + 16)
681
		print_section(KERN_ERR, "Bytes b4 ", p - 16, 16);
C
Christoph Lameter 已提交
682

683 684
	print_section(KERN_ERR, "Object ", p,
		      min_t(unsigned long, s->object_size, PAGE_SIZE));
C
Christoph Lameter 已提交
685
	if (s->flags & SLAB_RED_ZONE)
686
		print_section(KERN_ERR, "Redzone ", p + s->object_size,
687
			s->inuse - s->object_size);
C
Christoph Lameter 已提交
688 689 690 691 692 693

	if (s->offset)
		off = s->offset + sizeof(void *);
	else
		off = s->inuse;

694
	if (s->flags & SLAB_STORE_USER)
C
Christoph Lameter 已提交
695 696
		off += 2 * sizeof(struct track);

697 698
	off += kasan_metadata_size(s);

J
Joonsoo Kim 已提交
699
	if (off != size_from_object(s))
C
Christoph Lameter 已提交
700
		/* Beginning of the filler is the free pointer */
701 702
		print_section(KERN_ERR, "Padding ", p + off,
			      size_from_object(s) - off);
703 704

	dump_stack();
C
Christoph Lameter 已提交
705 706
}

707
void object_err(struct kmem_cache *s, struct page *page,
C
Christoph Lameter 已提交
708 709
			u8 *object, char *reason)
{
710
	slab_bug(s, "%s", reason);
711
	print_trailer(s, page, object);
C
Christoph Lameter 已提交
712 713
}

714 715
static void slab_err(struct kmem_cache *s, struct page *page,
			const char *fmt, ...)
C
Christoph Lameter 已提交
716 717 718 719
{
	va_list args;
	char buf[100];

720 721
	va_start(args, fmt);
	vsnprintf(buf, sizeof(buf), fmt, args);
C
Christoph Lameter 已提交
722
	va_end(args);
723
	slab_bug(s, "%s", buf);
724
	print_page_info(page);
C
Christoph Lameter 已提交
725 726 727
	dump_stack();
}

728
static void init_object(struct kmem_cache *s, void *object, u8 val)
C
Christoph Lameter 已提交
729 730 731
{
	u8 *p = object;

J
Joonsoo Kim 已提交
732 733 734
	if (s->flags & SLAB_RED_ZONE)
		memset(p - s->red_left_pad, val, s->red_left_pad);

C
Christoph Lameter 已提交
735
	if (s->flags & __OBJECT_POISON) {
736 737
		memset(p, POISON_FREE, s->object_size - 1);
		p[s->object_size - 1] = POISON_END;
C
Christoph Lameter 已提交
738 739 740
	}

	if (s->flags & SLAB_RED_ZONE)
741
		memset(p + s->object_size, val, s->inuse - s->object_size);
C
Christoph Lameter 已提交
742 743
}

744 745 746 747 748 749 750 751 752
static void restore_bytes(struct kmem_cache *s, char *message, u8 data,
						void *from, void *to)
{
	slab_fix(s, "Restoring 0x%p-0x%p=0x%x\n", from, to - 1, data);
	memset(from, data, to - from);
}

static int check_bytes_and_report(struct kmem_cache *s, struct page *page,
			u8 *object, char *what,
P
Pekka Enberg 已提交
753
			u8 *start, unsigned int value, unsigned int bytes)
754 755 756 757
{
	u8 *fault;
	u8 *end;

758
	metadata_access_enable();
759
	fault = memchr_inv(start, value, bytes);
760
	metadata_access_disable();
761 762 763 764 765 766 767 768
	if (!fault)
		return 1;

	end = start + bytes;
	while (end > fault && end[-1] == value)
		end--;

	slab_bug(s, "%s overwritten", what);
769
	pr_err("INFO: 0x%p-0x%p. First byte 0x%x instead of 0x%x\n",
770 771 772 773 774
					fault, end - 1, fault[0], value);
	print_trailer(s, page, object);

	restore_bytes(s, what, value, fault, end);
	return 0;
C
Christoph Lameter 已提交
775 776 777 778 779 780 781 782 783
}

/*
 * Object layout:
 *
 * object address
 * 	Bytes of the object to be managed.
 * 	If the freepointer may overlay the object then the free
 * 	pointer is the first word of the object.
C
Christoph Lameter 已提交
784
 *
C
Christoph Lameter 已提交
785 786 787
 * 	Poisoning uses 0x6b (POISON_FREE) and the last byte is
 * 	0xa5 (POISON_END)
 *
788
 * object + s->object_size
C
Christoph Lameter 已提交
789
 * 	Padding to reach word boundary. This is also used for Redzoning.
C
Christoph Lameter 已提交
790
 * 	Padding is extended by another word if Redzoning is enabled and
791
 * 	object_size == inuse.
C
Christoph Lameter 已提交
792
 *
C
Christoph Lameter 已提交
793 794 795 796
 * 	We fill with 0xbb (RED_INACTIVE) for inactive objects and with
 * 	0xcc (RED_ACTIVE) for objects in use.
 *
 * object + s->inuse
C
Christoph Lameter 已提交
797 798
 * 	Meta data starts here.
 *
C
Christoph Lameter 已提交
799 800
 * 	A. Free pointer (if we cannot overwrite object on free)
 * 	B. Tracking data for SLAB_STORE_USER
C
Christoph Lameter 已提交
801
 * 	C. Padding to reach required alignment boundary or at mininum
C
Christoph Lameter 已提交
802
 * 		one word if debugging is on to be able to detect writes
C
Christoph Lameter 已提交
803 804 805
 * 		before the word boundary.
 *
 *	Padding is done using 0x5a (POISON_INUSE)
C
Christoph Lameter 已提交
806 807
 *
 * object + s->size
C
Christoph Lameter 已提交
808
 * 	Nothing is used beyond s->size.
C
Christoph Lameter 已提交
809
 *
810
 * If slabcaches are merged then the object_size and inuse boundaries are mostly
C
Christoph Lameter 已提交
811
 * ignored. And therefore no slab options that rely on these boundaries
C
Christoph Lameter 已提交
812 813 814 815 816 817 818 819 820 821 822 823 824 825 826
 * may be used with merged slabcaches.
 */

static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p)
{
	unsigned long off = s->inuse;	/* The end of info */

	if (s->offset)
		/* Freepointer is placed after the object. */
		off += sizeof(void *);

	if (s->flags & SLAB_STORE_USER)
		/* We also have user information there */
		off += 2 * sizeof(struct track);

827 828
	off += kasan_metadata_size(s);

J
Joonsoo Kim 已提交
829
	if (size_from_object(s) == off)
C
Christoph Lameter 已提交
830 831
		return 1;

832
	return check_bytes_and_report(s, page, p, "Object padding",
J
Joonsoo Kim 已提交
833
			p + off, POISON_INUSE, size_from_object(s) - off);
C
Christoph Lameter 已提交
834 835
}

836
/* Check the pad bytes at the end of a slab page */
C
Christoph Lameter 已提交
837 838
static int slab_pad_check(struct kmem_cache *s, struct page *page)
{
839 840 841
	u8 *start;
	u8 *fault;
	u8 *end;
842
	u8 *pad;
843 844
	int length;
	int remainder;
C
Christoph Lameter 已提交
845 846 847 848

	if (!(s->flags & SLAB_POISON))
		return 1;

849
	start = page_address(page);
850
	length = (PAGE_SIZE << compound_order(page)) - s->reserved;
851 852
	end = start + length;
	remainder = length % s->size;
C
Christoph Lameter 已提交
853 854 855
	if (!remainder)
		return 1;

856
	pad = end - remainder;
857
	metadata_access_enable();
858
	fault = memchr_inv(pad, POISON_INUSE, remainder);
859
	metadata_access_disable();
860 861 862 863 864 865
	if (!fault)
		return 1;
	while (end > fault && end[-1] == POISON_INUSE)
		end--;

	slab_err(s, page, "Padding overwritten. 0x%p-0x%p", fault, end - 1);
866
	print_section(KERN_ERR, "Padding ", pad, remainder);
867

868
	restore_bytes(s, "slab padding", POISON_INUSE, fault, end);
869
	return 0;
C
Christoph Lameter 已提交
870 871 872
}

static int check_object(struct kmem_cache *s, struct page *page,
873
					void *object, u8 val)
C
Christoph Lameter 已提交
874 875
{
	u8 *p = object;
876
	u8 *endobject = object + s->object_size;
C
Christoph Lameter 已提交
877 878

	if (s->flags & SLAB_RED_ZONE) {
J
Joonsoo Kim 已提交
879 880 881 882
		if (!check_bytes_and_report(s, page, object, "Redzone",
			object - s->red_left_pad, val, s->red_left_pad))
			return 0;

883
		if (!check_bytes_and_report(s, page, object, "Redzone",
884
			endobject, val, s->inuse - s->object_size))
C
Christoph Lameter 已提交
885 886
			return 0;
	} else {
887
		if ((s->flags & SLAB_POISON) && s->object_size < s->inuse) {
I
Ingo Molnar 已提交
888
			check_bytes_and_report(s, page, p, "Alignment padding",
889 890
				endobject, POISON_INUSE,
				s->inuse - s->object_size);
I
Ingo Molnar 已提交
891
		}
C
Christoph Lameter 已提交
892 893 894
	}

	if (s->flags & SLAB_POISON) {
895
		if (val != SLUB_RED_ACTIVE && (s->flags & __OBJECT_POISON) &&
896
			(!check_bytes_and_report(s, page, p, "Poison", p,
897
					POISON_FREE, s->object_size - 1) ||
898
			 !check_bytes_and_report(s, page, p, "Poison",
899
				p + s->object_size - 1, POISON_END, 1)))
C
Christoph Lameter 已提交
900 901 902 903 904 905 906
			return 0;
		/*
		 * check_pad_bytes cleans up on its own.
		 */
		check_pad_bytes(s, page, p);
	}

907
	if (!s->offset && val == SLUB_RED_ACTIVE)
C
Christoph Lameter 已提交
908 909 910 911 912 913 914 915 916 917
		/*
		 * Object and freepointer overlap. Cannot check
		 * freepointer while object is allocated.
		 */
		return 1;

	/* Check free pointer validity */
	if (!check_valid_pointer(s, page, get_freepointer(s, p))) {
		object_err(s, page, p, "Freepointer corrupt");
		/*
N
Nick Andrew 已提交
918
		 * No choice but to zap it and thus lose the remainder
C
Christoph Lameter 已提交
919
		 * of the free objects in this slab. May cause
C
Christoph Lameter 已提交
920
		 * another error because the object count is now wrong.
C
Christoph Lameter 已提交
921
		 */
922
		set_freepointer(s, p, NULL);
C
Christoph Lameter 已提交
923 924 925 926 927 928 929
		return 0;
	}
	return 1;
}

static int check_slab(struct kmem_cache *s, struct page *page)
{
930 931
	int maxobj;

C
Christoph Lameter 已提交
932 933 934
	VM_BUG_ON(!irqs_disabled());

	if (!PageSlab(page)) {
935
		slab_err(s, page, "Not a valid slab page");
C
Christoph Lameter 已提交
936 937
		return 0;
	}
938

939
	maxobj = order_objects(compound_order(page), s->size, s->reserved);
940 941
	if (page->objects > maxobj) {
		slab_err(s, page, "objects %u > max %u",
942
			page->objects, maxobj);
943 944 945
		return 0;
	}
	if (page->inuse > page->objects) {
946
		slab_err(s, page, "inuse %u > max %u",
947
			page->inuse, page->objects);
C
Christoph Lameter 已提交
948 949 950 951 952 953 954 955
		return 0;
	}
	/* Slab_pad_check fixes things up after itself */
	slab_pad_check(s, page);
	return 1;
}

/*
C
Christoph Lameter 已提交
956 957
 * Determine if a certain object on a page is on the freelist. Must hold the
 * slab lock to guarantee that the chains are in a consistent state.
C
Christoph Lameter 已提交
958 959 960 961
 */
static int on_freelist(struct kmem_cache *s, struct page *page, void *search)
{
	int nr = 0;
962
	void *fp;
C
Christoph Lameter 已提交
963
	void *object = NULL;
964
	int max_objects;
C
Christoph Lameter 已提交
965

966
	fp = page->freelist;
967
	while (fp && nr <= page->objects) {
C
Christoph Lameter 已提交
968 969 970 971 972 973
		if (fp == search)
			return 1;
		if (!check_valid_pointer(s, page, fp)) {
			if (object) {
				object_err(s, page, object,
					"Freechain corrupt");
974
				set_freepointer(s, object, NULL);
C
Christoph Lameter 已提交
975
			} else {
976
				slab_err(s, page, "Freepointer corrupt");
977
				page->freelist = NULL;
978
				page->inuse = page->objects;
979
				slab_fix(s, "Freelist cleared");
C
Christoph Lameter 已提交
980 981 982 983 984 985 986 987 988
				return 0;
			}
			break;
		}
		object = fp;
		fp = get_freepointer(s, object);
		nr++;
	}

989
	max_objects = order_objects(compound_order(page), s->size, s->reserved);
990 991
	if (max_objects > MAX_OBJS_PER_PAGE)
		max_objects = MAX_OBJS_PER_PAGE;
992 993

	if (page->objects != max_objects) {
J
Joe Perches 已提交
994 995
		slab_err(s, page, "Wrong number of objects. Found %d but should be %d",
			 page->objects, max_objects);
996 997 998
		page->objects = max_objects;
		slab_fix(s, "Number of objects adjusted.");
	}
999
	if (page->inuse != page->objects - nr) {
J
Joe Perches 已提交
1000 1001
		slab_err(s, page, "Wrong object count. Counter is %d but counted were %d",
			 page->inuse, page->objects - nr);
1002
		page->inuse = page->objects - nr;
1003
		slab_fix(s, "Object count adjusted.");
C
Christoph Lameter 已提交
1004 1005 1006 1007
	}
	return search == NULL;
}

1008 1009
static void trace(struct kmem_cache *s, struct page *page, void *object,
								int alloc)
C
Christoph Lameter 已提交
1010 1011
{
	if (s->flags & SLAB_TRACE) {
1012
		pr_info("TRACE %s %s 0x%p inuse=%d fp=0x%p\n",
C
Christoph Lameter 已提交
1013 1014 1015 1016 1017 1018
			s->name,
			alloc ? "alloc" : "free",
			object, page->inuse,
			page->freelist);

		if (!alloc)
1019
			print_section(KERN_INFO, "Object ", (void *)object,
1020
					s->object_size);
C
Christoph Lameter 已提交
1021 1022 1023 1024 1025

		dump_stack();
	}
}

1026
/*
C
Christoph Lameter 已提交
1027
 * Tracking of fully allocated slabs for debugging purposes.
1028
 */
1029 1030
static void add_full(struct kmem_cache *s,
	struct kmem_cache_node *n, struct page *page)
1031
{
1032 1033 1034
	if (!(s->flags & SLAB_STORE_USER))
		return;

1035
	lockdep_assert_held(&n->list_lock);
1036 1037 1038
	list_add(&page->lru, &n->full);
}

P
Peter Zijlstra 已提交
1039
static void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, struct page *page)
1040 1041 1042 1043
{
	if (!(s->flags & SLAB_STORE_USER))
		return;

1044
	lockdep_assert_held(&n->list_lock);
1045 1046 1047
	list_del(&page->lru);
}

1048 1049 1050 1051 1052 1053 1054 1055
/* Tracking of the number of slabs for debugging purposes */
static inline unsigned long slabs_node(struct kmem_cache *s, int node)
{
	struct kmem_cache_node *n = get_node(s, node);

	return atomic_long_read(&n->nr_slabs);
}

1056 1057 1058 1059 1060
static inline unsigned long node_nr_slabs(struct kmem_cache_node *n)
{
	return atomic_long_read(&n->nr_slabs);
}

1061
static inline void inc_slabs_node(struct kmem_cache *s, int node, int objects)
1062 1063 1064 1065 1066 1067 1068 1069 1070
{
	struct kmem_cache_node *n = get_node(s, node);

	/*
	 * May be called early in order to allocate a slab for the
	 * kmem_cache_node structure. Solve the chicken-egg
	 * dilemma by deferring the increment of the count during
	 * bootstrap (see early_kmem_cache_node_alloc).
	 */
1071
	if (likely(n)) {
1072
		atomic_long_inc(&n->nr_slabs);
1073 1074
		atomic_long_add(objects, &n->total_objects);
	}
1075
}
1076
static inline void dec_slabs_node(struct kmem_cache *s, int node, int objects)
1077 1078 1079 1080
{
	struct kmem_cache_node *n = get_node(s, node);

	atomic_long_dec(&n->nr_slabs);
1081
	atomic_long_sub(objects, &n->total_objects);
1082 1083 1084
}

/* Object debug checks for alloc/free paths */
C
Christoph Lameter 已提交
1085 1086 1087 1088 1089 1090
static void setup_object_debug(struct kmem_cache *s, struct page *page,
								void *object)
{
	if (!(s->flags & (SLAB_STORE_USER|SLAB_RED_ZONE|__OBJECT_POISON)))
		return;

1091
	init_object(s, object, SLUB_RED_INACTIVE);
C
Christoph Lameter 已提交
1092 1093 1094
	init_tracking(s, object);
}

1095
static inline int alloc_consistency_checks(struct kmem_cache *s,
1096
					struct page *page,
1097
					void *object, unsigned long addr)
C
Christoph Lameter 已提交
1098 1099
{
	if (!check_slab(s, page))
1100
		return 0;
C
Christoph Lameter 已提交
1101 1102 1103

	if (!check_valid_pointer(s, page, object)) {
		object_err(s, page, object, "Freelist Pointer check fails");
1104
		return 0;
C
Christoph Lameter 已提交
1105 1106
	}

1107
	if (!check_object(s, page, object, SLUB_RED_INACTIVE))
1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120
		return 0;

	return 1;
}

static noinline int alloc_debug_processing(struct kmem_cache *s,
					struct page *page,
					void *object, unsigned long addr)
{
	if (s->flags & SLAB_CONSISTENCY_CHECKS) {
		if (!alloc_consistency_checks(s, page, object, addr))
			goto bad;
	}
C
Christoph Lameter 已提交
1121

C
Christoph Lameter 已提交
1122 1123 1124 1125
	/* Success perform special debug activities for allocs */
	if (s->flags & SLAB_STORE_USER)
		set_track(s, object, TRACK_ALLOC, addr);
	trace(s, page, object, 1);
1126
	init_object(s, object, SLUB_RED_ACTIVE);
C
Christoph Lameter 已提交
1127
	return 1;
C
Christoph Lameter 已提交
1128

C
Christoph Lameter 已提交
1129 1130 1131 1132 1133
bad:
	if (PageSlab(page)) {
		/*
		 * If this is a slab page then lets do the best we can
		 * to avoid issues in the future. Marking all objects
C
Christoph Lameter 已提交
1134
		 * as used avoids touching the remaining objects.
C
Christoph Lameter 已提交
1135
		 */
1136
		slab_fix(s, "Marking all objects used");
1137
		page->inuse = page->objects;
1138
		page->freelist = NULL;
C
Christoph Lameter 已提交
1139 1140 1141 1142
	}
	return 0;
}

1143 1144
static inline int free_consistency_checks(struct kmem_cache *s,
		struct page *page, void *object, unsigned long addr)
C
Christoph Lameter 已提交
1145 1146
{
	if (!check_valid_pointer(s, page, object)) {
1147
		slab_err(s, page, "Invalid object pointer 0x%p", object);
1148
		return 0;
C
Christoph Lameter 已提交
1149 1150 1151
	}

	if (on_freelist(s, page, object)) {
1152
		object_err(s, page, object, "Object already free");
1153
		return 0;
C
Christoph Lameter 已提交
1154 1155
	}

1156
	if (!check_object(s, page, object, SLUB_RED_ACTIVE))
1157
		return 0;
C
Christoph Lameter 已提交
1158

1159
	if (unlikely(s != page->slab_cache)) {
I
Ingo Molnar 已提交
1160
		if (!PageSlab(page)) {
J
Joe Perches 已提交
1161 1162
			slab_err(s, page, "Attempt to free object(0x%p) outside of slab",
				 object);
1163
		} else if (!page->slab_cache) {
1164 1165
			pr_err("SLUB <none>: no slab for object 0x%p.\n",
			       object);
1166
			dump_stack();
P
Pekka Enberg 已提交
1167
		} else
1168 1169
			object_err(s, page, object,
					"page slab pointer corrupt.");
1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200
		return 0;
	}
	return 1;
}

/* Supports checking bulk free of a constructed freelist */
static noinline int free_debug_processing(
	struct kmem_cache *s, struct page *page,
	void *head, void *tail, int bulk_cnt,
	unsigned long addr)
{
	struct kmem_cache_node *n = get_node(s, page_to_nid(page));
	void *object = head;
	int cnt = 0;
	unsigned long uninitialized_var(flags);
	int ret = 0;

	spin_lock_irqsave(&n->list_lock, flags);
	slab_lock(page);

	if (s->flags & SLAB_CONSISTENCY_CHECKS) {
		if (!check_slab(s, page))
			goto out;
	}

next_object:
	cnt++;

	if (s->flags & SLAB_CONSISTENCY_CHECKS) {
		if (!free_consistency_checks(s, page, object, addr))
			goto out;
C
Christoph Lameter 已提交
1201
	}
C
Christoph Lameter 已提交
1202 1203 1204 1205

	if (s->flags & SLAB_STORE_USER)
		set_track(s, object, TRACK_FREE, addr);
	trace(s, page, object, 0);
1206
	/* Freepointer not overwritten by init_object(), SLAB_POISON moved it */
1207
	init_object(s, object, SLUB_RED_INACTIVE);
1208 1209 1210 1211 1212 1213

	/* Reached end of constructed freelist yet? */
	if (object != tail) {
		object = get_freepointer(s, object);
		goto next_object;
	}
1214 1215
	ret = 1;

1216
out:
1217 1218 1219 1220
	if (cnt != bulk_cnt)
		slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
			 bulk_cnt, cnt);

1221
	slab_unlock(page);
1222
	spin_unlock_irqrestore(&n->list_lock, flags);
1223 1224 1225
	if (!ret)
		slab_fix(s, "Object at 0x%p not freed", object);
	return ret;
C
Christoph Lameter 已提交
1226 1227
}

C
Christoph Lameter 已提交
1228 1229
static int __init setup_slub_debug(char *str)
{
1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253
	slub_debug = DEBUG_DEFAULT_FLAGS;
	if (*str++ != '=' || !*str)
		/*
		 * No options specified. Switch on full debugging.
		 */
		goto out;

	if (*str == ',')
		/*
		 * No options but restriction on slabs. This means full
		 * debugging for slabs matching a pattern.
		 */
		goto check_slabs;

	slub_debug = 0;
	if (*str == '-')
		/*
		 * Switch off all debugging measures.
		 */
		goto out;

	/*
	 * Determine which debug features should be switched on
	 */
P
Pekka Enberg 已提交
1254
	for (; *str && *str != ','; str++) {
1255 1256
		switch (tolower(*str)) {
		case 'f':
1257
			slub_debug |= SLAB_CONSISTENCY_CHECKS;
1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270
			break;
		case 'z':
			slub_debug |= SLAB_RED_ZONE;
			break;
		case 'p':
			slub_debug |= SLAB_POISON;
			break;
		case 'u':
			slub_debug |= SLAB_STORE_USER;
			break;
		case 't':
			slub_debug |= SLAB_TRACE;
			break;
1271 1272 1273
		case 'a':
			slub_debug |= SLAB_FAILSLAB;
			break;
1274 1275 1276 1277 1278 1279 1280
		case 'o':
			/*
			 * Avoid enabling debugging on caches if its minimum
			 * order would increase as a result.
			 */
			disable_higher_order_debug = 1;
			break;
1281
		default:
1282 1283
			pr_err("slub_debug option '%c' unknown. skipped\n",
			       *str);
1284
		}
C
Christoph Lameter 已提交
1285 1286
	}

1287
check_slabs:
C
Christoph Lameter 已提交
1288 1289
	if (*str == ',')
		slub_debug_slabs = str + 1;
1290
out:
C
Christoph Lameter 已提交
1291 1292 1293 1294 1295
	return 1;
}

__setup("slub_debug", setup_slub_debug);

1296 1297
slab_flags_t kmem_cache_flags(unsigned long object_size,
	slab_flags_t flags, const char *name,
1298
	void (*ctor)(void *))
C
Christoph Lameter 已提交
1299 1300
{
	/*
1301
	 * Enable debugging if selected on the kernel commandline.
C
Christoph Lameter 已提交
1302
	 */
1303 1304
	if (slub_debug && (!slub_debug_slabs || (name &&
		!strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs)))))
1305
		flags |= slub_debug;
1306 1307

	return flags;
C
Christoph Lameter 已提交
1308
}
1309
#else /* !CONFIG_SLUB_DEBUG */
C
Christoph Lameter 已提交
1310 1311
static inline void setup_object_debug(struct kmem_cache *s,
			struct page *page, void *object) {}
C
Christoph Lameter 已提交
1312

C
Christoph Lameter 已提交
1313
static inline int alloc_debug_processing(struct kmem_cache *s,
1314
	struct page *page, void *object, unsigned long addr) { return 0; }
C
Christoph Lameter 已提交
1315

1316
static inline int free_debug_processing(
1317 1318
	struct kmem_cache *s, struct page *page,
	void *head, void *tail, int bulk_cnt,
1319
	unsigned long addr) { return 0; }
C
Christoph Lameter 已提交
1320 1321 1322 1323

static inline int slab_pad_check(struct kmem_cache *s, struct page *page)
			{ return 1; }
static inline int check_object(struct kmem_cache *s, struct page *page,
1324
			void *object, u8 val) { return 1; }
1325 1326
static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,
					struct page *page) {}
P
Peter Zijlstra 已提交
1327 1328
static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n,
					struct page *page) {}
1329 1330
slab_flags_t kmem_cache_flags(unsigned long object_size,
	slab_flags_t flags, const char *name,
1331
	void (*ctor)(void *))
1332 1333 1334
{
	return flags;
}
C
Christoph Lameter 已提交
1335
#define slub_debug 0
1336

1337 1338
#define disable_higher_order_debug 0

1339 1340
static inline unsigned long slabs_node(struct kmem_cache *s, int node)
							{ return 0; }
1341 1342
static inline unsigned long node_nr_slabs(struct kmem_cache_node *n)
							{ return 0; }
1343 1344 1345 1346
static inline void inc_slabs_node(struct kmem_cache *s, int node,
							int objects) {}
static inline void dec_slabs_node(struct kmem_cache *s, int node,
							int objects) {}
1347

1348 1349 1350 1351 1352 1353
#endif /* CONFIG_SLUB_DEBUG */

/*
 * Hooks for other subsystems that check memory allocations. In a typical
 * production configuration these hooks all should produce no code at all.
 */
1354 1355 1356
static inline void kmalloc_large_node_hook(void *ptr, size_t size, gfp_t flags)
{
	kmemleak_alloc(ptr, size, 1, flags);
1357
	kasan_kmalloc_large(ptr, size, flags);
1358 1359
}

1360
static __always_inline void kfree_hook(void *x)
1361 1362
{
	kmemleak_free(x);
1363
	kasan_kfree_large(x, _RET_IP_);
1364 1365
}

1366
static __always_inline void *slab_free_hook(struct kmem_cache *s, void *x)
1367
{
1368 1369
	void *freeptr;

1370
	kmemleak_free_recursive(x, s->flags);
1371

1372 1373 1374 1375 1376
	/*
	 * Trouble is that we may no longer disable interrupts in the fast path
	 * So in order to make the debug calls that expect irqs to be
	 * disabled we need to disable interrupts temporarily.
	 */
1377
#ifdef CONFIG_LOCKDEP
1378 1379 1380 1381 1382 1383 1384 1385 1386 1387
	{
		unsigned long flags;

		local_irq_save(flags);
		debug_check_no_locks_freed(x, s->object_size);
		local_irq_restore(flags);
	}
#endif
	if (!(s->flags & SLAB_DEBUG_OBJECTS))
		debug_check_no_obj_freed(x, s->object_size);
1388

1389 1390 1391 1392 1393
	freeptr = get_freepointer(s, x);
	/*
	 * kasan_slab_free() may put x into memory quarantine, delaying its
	 * reuse. In this case the object's freelist pointer is changed.
	 */
1394
	kasan_slab_free(s, x, _RET_IP_);
1395
	return freeptr;
1396
}
1397

1398 1399 1400 1401 1402 1403 1404
static inline void slab_free_freelist_hook(struct kmem_cache *s,
					   void *head, void *tail)
{
/*
 * Compiler cannot detect this function can be removed if slab_free_hook()
 * evaluates to nothing.  Thus, catch all relevant config debug options here.
 */
1405
#if defined(CONFIG_LOCKDEP)	||		\
1406 1407 1408 1409 1410 1411
	defined(CONFIG_DEBUG_KMEMLEAK) ||	\
	defined(CONFIG_DEBUG_OBJECTS_FREE) ||	\
	defined(CONFIG_KASAN)

	void *object = head;
	void *tail_obj = tail ? : head;
1412
	void *freeptr;
1413 1414

	do {
1415 1416
		freeptr = slab_free_hook(s, object);
	} while ((object != tail_obj) && (object = freeptr));
1417 1418 1419
#endif
}

1420 1421 1422 1423
static void setup_object(struct kmem_cache *s, struct page *page,
				void *object)
{
	setup_object_debug(s, page, object);
1424
	kasan_init_slab_obj(s, object);
1425 1426 1427 1428 1429 1430 1431
	if (unlikely(s->ctor)) {
		kasan_unpoison_object_data(s, object);
		s->ctor(object);
		kasan_poison_object_data(s, object);
	}
}

C
Christoph Lameter 已提交
1432 1433 1434
/*
 * Slab allocation and freeing
 */
1435 1436
static inline struct page *alloc_slab_page(struct kmem_cache *s,
		gfp_t flags, int node, struct kmem_cache_order_objects oo)
1437
{
1438
	struct page *page;
1439 1440
	int order = oo_order(oo);

1441
	if (node == NUMA_NO_NODE)
1442
		page = alloc_pages(flags, order);
1443
	else
1444
		page = __alloc_pages_node(node, flags, order);
1445

1446 1447 1448 1449
	if (page && memcg_charge_slab(page, flags, order, s)) {
		__free_pages(page, order);
		page = NULL;
	}
1450 1451

	return page;
1452 1453
}

T
Thomas Garnier 已提交
1454 1455 1456 1457 1458 1459 1460
#ifdef CONFIG_SLAB_FREELIST_RANDOM
/* Pre-initialize the random sequence cache */
static int init_cache_random_seq(struct kmem_cache *s)
{
	int err;
	unsigned long i, count = oo_objects(s->oo);

1461 1462 1463 1464
	/* Bailout if already initialised */
	if (s->random_seq)
		return 0;

T
Thomas Garnier 已提交
1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560
	err = cache_random_seq_create(s, count, GFP_KERNEL);
	if (err) {
		pr_err("SLUB: Unable to initialize free list for %s\n",
			s->name);
		return err;
	}

	/* Transform to an offset on the set of pages */
	if (s->random_seq) {
		for (i = 0; i < count; i++)
			s->random_seq[i] *= s->size;
	}
	return 0;
}

/* Initialize each random sequence freelist per cache */
static void __init init_freelist_randomization(void)
{
	struct kmem_cache *s;

	mutex_lock(&slab_mutex);

	list_for_each_entry(s, &slab_caches, list)
		init_cache_random_seq(s);

	mutex_unlock(&slab_mutex);
}

/* Get the next entry on the pre-computed freelist randomized */
static void *next_freelist_entry(struct kmem_cache *s, struct page *page,
				unsigned long *pos, void *start,
				unsigned long page_limit,
				unsigned long freelist_count)
{
	unsigned int idx;

	/*
	 * If the target page allocation failed, the number of objects on the
	 * page might be smaller than the usual size defined by the cache.
	 */
	do {
		idx = s->random_seq[*pos];
		*pos += 1;
		if (*pos >= freelist_count)
			*pos = 0;
	} while (unlikely(idx >= page_limit));

	return (char *)start + idx;
}

/* Shuffle the single linked freelist based on a random pre-computed sequence */
static bool shuffle_freelist(struct kmem_cache *s, struct page *page)
{
	void *start;
	void *cur;
	void *next;
	unsigned long idx, pos, page_limit, freelist_count;

	if (page->objects < 2 || !s->random_seq)
		return false;

	freelist_count = oo_objects(s->oo);
	pos = get_random_int() % freelist_count;

	page_limit = page->objects * s->size;
	start = fixup_red_left(s, page_address(page));

	/* First entry is used as the base of the freelist */
	cur = next_freelist_entry(s, page, &pos, start, page_limit,
				freelist_count);
	page->freelist = cur;

	for (idx = 1; idx < page->objects; idx++) {
		setup_object(s, page, cur);
		next = next_freelist_entry(s, page, &pos, start, page_limit,
			freelist_count);
		set_freepointer(s, cur, next);
		cur = next;
	}
	setup_object(s, page, cur);
	set_freepointer(s, cur, NULL);

	return true;
}
#else
static inline int init_cache_random_seq(struct kmem_cache *s)
{
	return 0;
}
static inline void init_freelist_randomization(void) { }
static inline bool shuffle_freelist(struct kmem_cache *s, struct page *page)
{
	return false;
}
#endif /* CONFIG_SLAB_FREELIST_RANDOM */

C
Christoph Lameter 已提交
1561 1562
static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
{
P
Pekka Enberg 已提交
1563
	struct page *page;
1564
	struct kmem_cache_order_objects oo = s->oo;
1565
	gfp_t alloc_gfp;
1566 1567
	void *start, *p;
	int idx, order;
T
Thomas Garnier 已提交
1568
	bool shuffle;
C
Christoph Lameter 已提交
1569

1570 1571
	flags &= gfp_allowed_mask;

1572
	if (gfpflags_allow_blocking(flags))
1573 1574
		local_irq_enable();

1575
	flags |= s->allocflags;
1576

1577 1578 1579 1580 1581
	/*
	 * Let the initial higher-order allocation fail under memory pressure
	 * so we fall-back to the minimum order allocation.
	 */
	alloc_gfp = (flags | __GFP_NOWARN | __GFP_NORETRY) & ~__GFP_NOFAIL;
1582
	if ((alloc_gfp & __GFP_DIRECT_RECLAIM) && oo_order(oo) > oo_order(s->min))
1583
		alloc_gfp = (alloc_gfp | __GFP_NOMEMALLOC) & ~(__GFP_RECLAIM|__GFP_NOFAIL);
1584

1585
	page = alloc_slab_page(s, alloc_gfp, node, oo);
1586 1587
	if (unlikely(!page)) {
		oo = s->min;
1588
		alloc_gfp = flags;
1589 1590 1591 1592
		/*
		 * Allocation may have failed due to fragmentation.
		 * Try a lower order alloc if possible
		 */
1593
		page = alloc_slab_page(s, alloc_gfp, node, oo);
1594 1595 1596
		if (unlikely(!page))
			goto out;
		stat(s, ORDER_FALLBACK);
1597
	}
V
Vegard Nossum 已提交
1598

1599
	page->objects = oo_objects(oo);
C
Christoph Lameter 已提交
1600

G
Glauber Costa 已提交
1601
	order = compound_order(page);
1602
	page->slab_cache = s;
1603
	__SetPageSlab(page);
1604
	if (page_is_pfmemalloc(page))
1605
		SetPageSlabPfmemalloc(page);
C
Christoph Lameter 已提交
1606 1607 1608 1609

	start = page_address(page);

	if (unlikely(s->flags & SLAB_POISON))
G
Glauber Costa 已提交
1610
		memset(start, POISON_INUSE, PAGE_SIZE << order);
C
Christoph Lameter 已提交
1611

1612 1613
	kasan_poison_slab(page);

T
Thomas Garnier 已提交
1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624
	shuffle = shuffle_freelist(s, page);

	if (!shuffle) {
		for_each_object_idx(p, idx, s, start, page->objects) {
			setup_object(s, page, p);
			if (likely(idx < page->objects))
				set_freepointer(s, p, p + s->size);
			else
				set_freepointer(s, p, NULL);
		}
		page->freelist = fixup_red_left(s, start);
C
Christoph Lameter 已提交
1625 1626
	}

1627
	page->inuse = page->objects;
1628
	page->frozen = 1;
1629

C
Christoph Lameter 已提交
1630
out:
1631
	if (gfpflags_allow_blocking(flags))
1632 1633 1634 1635
		local_irq_disable();
	if (!page)
		return NULL;

1636
	mod_lruvec_page_state(page,
1637 1638 1639 1640 1641 1642
		(s->flags & SLAB_RECLAIM_ACCOUNT) ?
		NR_SLAB_RECLAIMABLE : NR_SLAB_UNRECLAIMABLE,
		1 << oo_order(oo));

	inc_slabs_node(s, page_to_nid(page), page->objects);

C
Christoph Lameter 已提交
1643 1644 1645
	return page;
}

1646 1647 1648
static struct page *new_slab(struct kmem_cache *s, gfp_t flags, int node)
{
	if (unlikely(flags & GFP_SLAB_BUG_MASK)) {
1649
		gfp_t invalid_mask = flags & GFP_SLAB_BUG_MASK;
1650 1651 1652
		flags &= ~GFP_SLAB_BUG_MASK;
		pr_warn("Unexpected gfp: %#x (%pGg). Fixing up to gfp: %#x (%pGg). Fix your code!\n",
				invalid_mask, &invalid_mask, flags, &flags);
1653
		dump_stack();
1654 1655 1656 1657 1658 1659
	}

	return allocate_slab(s,
		flags & (GFP_RECLAIM_MASK | GFP_CONSTRAINT_MASK), node);
}

C
Christoph Lameter 已提交
1660 1661
static void __free_slab(struct kmem_cache *s, struct page *page)
{
1662 1663
	int order = compound_order(page);
	int pages = 1 << order;
C
Christoph Lameter 已提交
1664

1665
	if (s->flags & SLAB_CONSISTENCY_CHECKS) {
C
Christoph Lameter 已提交
1666 1667 1668
		void *p;

		slab_pad_check(s, page);
1669 1670
		for_each_object(p, s, page_address(page),
						page->objects)
1671
			check_object(s, page, p, SLUB_RED_INACTIVE);
C
Christoph Lameter 已提交
1672 1673
	}

1674
	mod_lruvec_page_state(page,
C
Christoph Lameter 已提交
1675 1676
		(s->flags & SLAB_RECLAIM_ACCOUNT) ?
		NR_SLAB_RECLAIMABLE : NR_SLAB_UNRECLAIMABLE,
P
Pekka Enberg 已提交
1677
		-pages);
C
Christoph Lameter 已提交
1678

1679
	__ClearPageSlabPfmemalloc(page);
1680
	__ClearPageSlab(page);
G
Glauber Costa 已提交
1681

1682
	page_mapcount_reset(page);
N
Nick Piggin 已提交
1683 1684
	if (current->reclaim_state)
		current->reclaim_state->reclaimed_slab += pages;
1685 1686
	memcg_uncharge_slab(page, order, s);
	__free_pages(page, order);
C
Christoph Lameter 已提交
1687 1688
}

1689 1690 1691
#define need_reserve_slab_rcu						\
	(sizeof(((struct page *)NULL)->lru) < sizeof(struct rcu_head))

C
Christoph Lameter 已提交
1692 1693 1694 1695
static void rcu_free_slab(struct rcu_head *h)
{
	struct page *page;

1696 1697 1698 1699 1700
	if (need_reserve_slab_rcu)
		page = virt_to_head_page(h);
	else
		page = container_of((struct list_head *)h, struct page, lru);

1701
	__free_slab(page->slab_cache, page);
C
Christoph Lameter 已提交
1702 1703 1704 1705
}

static void free_slab(struct kmem_cache *s, struct page *page)
{
1706
	if (unlikely(s->flags & SLAB_TYPESAFE_BY_RCU)) {
1707 1708 1709 1710 1711 1712 1713 1714 1715
		struct rcu_head *head;

		if (need_reserve_slab_rcu) {
			int order = compound_order(page);
			int offset = (PAGE_SIZE << order) - s->reserved;

			VM_BUG_ON(s->reserved != sizeof(*head));
			head = page_address(page) + offset;
		} else {
1716
			head = &page->rcu_head;
1717
		}
C
Christoph Lameter 已提交
1718 1719 1720 1721 1722 1723 1724 1725

		call_rcu(head, rcu_free_slab);
	} else
		__free_slab(s, page);
}

static void discard_slab(struct kmem_cache *s, struct page *page)
{
1726
	dec_slabs_node(s, page_to_nid(page), page->objects);
C
Christoph Lameter 已提交
1727 1728 1729 1730
	free_slab(s, page);
}

/*
1731
 * Management of partially allocated slabs.
C
Christoph Lameter 已提交
1732
 */
1733 1734
static inline void
__add_partial(struct kmem_cache_node *n, struct page *page, int tail)
C
Christoph Lameter 已提交
1735
{
C
Christoph Lameter 已提交
1736
	n->nr_partial++;
1737
	if (tail == DEACTIVATE_TO_TAIL)
1738 1739 1740
		list_add_tail(&page->lru, &n->partial);
	else
		list_add(&page->lru, &n->partial);
C
Christoph Lameter 已提交
1741 1742
}

1743 1744
static inline void add_partial(struct kmem_cache_node *n,
				struct page *page, int tail)
1745
{
P
Peter Zijlstra 已提交
1746
	lockdep_assert_held(&n->list_lock);
1747 1748
	__add_partial(n, page, tail);
}
P
Peter Zijlstra 已提交
1749

1750 1751 1752 1753
static inline void remove_partial(struct kmem_cache_node *n,
					struct page *page)
{
	lockdep_assert_held(&n->list_lock);
1754 1755
	list_del(&page->lru);
	n->nr_partial--;
1756 1757
}

C
Christoph Lameter 已提交
1758
/*
1759 1760
 * Remove slab from the partial list, freeze it and
 * return the pointer to the freelist.
C
Christoph Lameter 已提交
1761
 *
1762
 * Returns a list of objects or NULL if it fails.
C
Christoph Lameter 已提交
1763
 */
1764
static inline void *acquire_slab(struct kmem_cache *s,
1765
		struct kmem_cache_node *n, struct page *page,
1766
		int mode, int *objects)
C
Christoph Lameter 已提交
1767
{
1768 1769 1770 1771
	void *freelist;
	unsigned long counters;
	struct page new;

P
Peter Zijlstra 已提交
1772 1773
	lockdep_assert_held(&n->list_lock);

1774 1775 1776 1777 1778
	/*
	 * Zap the freelist and set the frozen bit.
	 * The old freelist is the list of objects for the
	 * per cpu allocation list.
	 */
1779 1780 1781
	freelist = page->freelist;
	counters = page->counters;
	new.counters = counters;
1782
	*objects = new.objects - new.inuse;
1783
	if (mode) {
1784
		new.inuse = page->objects;
1785 1786 1787 1788
		new.freelist = NULL;
	} else {
		new.freelist = freelist;
	}
1789

1790
	VM_BUG_ON(new.frozen);
1791
	new.frozen = 1;
1792

1793
	if (!__cmpxchg_double_slab(s, page,
1794
			freelist, counters,
1795
			new.freelist, new.counters,
1796 1797
			"acquire_slab"))
		return NULL;
1798 1799

	remove_partial(n, page);
1800
	WARN_ON(!freelist);
1801
	return freelist;
C
Christoph Lameter 已提交
1802 1803
}

1804
static void put_cpu_partial(struct kmem_cache *s, struct page *page, int drain);
1805
static inline bool pfmemalloc_match(struct page *page, gfp_t gfpflags);
1806

C
Christoph Lameter 已提交
1807
/*
C
Christoph Lameter 已提交
1808
 * Try to allocate a partial slab from a specific node.
C
Christoph Lameter 已提交
1809
 */
1810 1811
static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
				struct kmem_cache_cpu *c, gfp_t flags)
C
Christoph Lameter 已提交
1812
{
1813 1814
	struct page *page, *page2;
	void *object = NULL;
1815 1816
	int available = 0;
	int objects;
C
Christoph Lameter 已提交
1817 1818 1819 1820

	/*
	 * Racy check. If we mistakenly see no partial slabs then we
	 * just allocate an empty slab. If we mistakenly try to get a
C
Christoph Lameter 已提交
1821 1822
	 * partial slab and there is none available then get_partials()
	 * will return NULL.
C
Christoph Lameter 已提交
1823 1824 1825 1826 1827
	 */
	if (!n || !n->nr_partial)
		return NULL;

	spin_lock(&n->list_lock);
1828
	list_for_each_entry_safe(page, page2, &n->partial, lru) {
1829
		void *t;
1830

1831 1832 1833
		if (!pfmemalloc_match(page, flags))
			continue;

1834
		t = acquire_slab(s, n, page, object == NULL, &objects);
1835 1836 1837
		if (!t)
			break;

1838
		available += objects;
1839
		if (!object) {
1840 1841 1842 1843
			c->page = page;
			stat(s, ALLOC_FROM_PARTIAL);
			object = t;
		} else {
1844
			put_cpu_partial(s, page, 0);
1845
			stat(s, CPU_PARTIAL_NODE);
1846
		}
1847
		if (!kmem_cache_has_cpu_partial(s)
1848
			|| available > slub_cpu_partial(s) / 2)
1849 1850
			break;

1851
	}
C
Christoph Lameter 已提交
1852
	spin_unlock(&n->list_lock);
1853
	return object;
C
Christoph Lameter 已提交
1854 1855 1856
}

/*
C
Christoph Lameter 已提交
1857
 * Get a page from somewhere. Search in increasing NUMA distances.
C
Christoph Lameter 已提交
1858
 */
1859
static void *get_any_partial(struct kmem_cache *s, gfp_t flags,
1860
		struct kmem_cache_cpu *c)
C
Christoph Lameter 已提交
1861 1862 1863
{
#ifdef CONFIG_NUMA
	struct zonelist *zonelist;
1864
	struct zoneref *z;
1865 1866
	struct zone *zone;
	enum zone_type high_zoneidx = gfp_zone(flags);
1867
	void *object;
1868
	unsigned int cpuset_mems_cookie;
C
Christoph Lameter 已提交
1869 1870

	/*
C
Christoph Lameter 已提交
1871 1872 1873 1874
	 * The defrag ratio allows a configuration of the tradeoffs between
	 * inter node defragmentation and node local allocations. A lower
	 * defrag_ratio increases the tendency to do local allocations
	 * instead of attempting to obtain partial slabs from other nodes.
C
Christoph Lameter 已提交
1875
	 *
C
Christoph Lameter 已提交
1876 1877 1878 1879
	 * If the defrag_ratio is set to 0 then kmalloc() always
	 * returns node local objects. If the ratio is higher then kmalloc()
	 * may return off node objects because partial slabs are obtained
	 * from other nodes and filled up.
C
Christoph Lameter 已提交
1880
	 *
1881 1882 1883 1884 1885
	 * If /sys/kernel/slab/xx/remote_node_defrag_ratio is set to 100
	 * (which makes defrag_ratio = 1000) then every (well almost)
	 * allocation will first attempt to defrag slab caches on other nodes.
	 * This means scanning over all nodes to look for partial slabs which
	 * may be expensive if we do it every time we are trying to find a slab
C
Christoph Lameter 已提交
1886
	 * with available objects.
C
Christoph Lameter 已提交
1887
	 */
1888 1889
	if (!s->remote_node_defrag_ratio ||
			get_cycles() % 1024 > s->remote_node_defrag_ratio)
C
Christoph Lameter 已提交
1890 1891
		return NULL;

1892
	do {
1893
		cpuset_mems_cookie = read_mems_allowed_begin();
1894
		zonelist = node_zonelist(mempolicy_slab_node(), flags);
1895 1896 1897 1898 1899
		for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
			struct kmem_cache_node *n;

			n = get_node(s, zone_to_nid(zone));

1900
			if (n && cpuset_zone_allowed(zone, flags) &&
1901
					n->nr_partial > s->min_partial) {
1902
				object = get_partial_node(s, n, c, flags);
1903 1904
				if (object) {
					/*
1905 1906 1907 1908 1909
					 * Don't check read_mems_allowed_retry()
					 * here - if mems_allowed was updated in
					 * parallel, that was a harmless race
					 * between allocation and the cpuset
					 * update
1910 1911 1912
					 */
					return object;
				}
1913
			}
C
Christoph Lameter 已提交
1914
		}
1915
	} while (read_mems_allowed_retry(cpuset_mems_cookie));
C
Christoph Lameter 已提交
1916 1917 1918 1919 1920 1921 1922
#endif
	return NULL;
}

/*
 * Get a partial page, lock it and return it.
 */
1923
static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
1924
		struct kmem_cache_cpu *c)
C
Christoph Lameter 已提交
1925
{
1926
	void *object;
1927 1928 1929 1930 1931 1932
	int searchnode = node;

	if (node == NUMA_NO_NODE)
		searchnode = numa_mem_id();
	else if (!node_present_pages(node))
		searchnode = node_to_mem_node(node);
C
Christoph Lameter 已提交
1933

1934
	object = get_partial_node(s, get_node(s, searchnode), c, flags);
1935 1936
	if (object || node != NUMA_NO_NODE)
		return object;
C
Christoph Lameter 已提交
1937

1938
	return get_any_partial(s, flags, c);
C
Christoph Lameter 已提交
1939 1940
}

1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981
#ifdef CONFIG_PREEMPT
/*
 * Calculate the next globally unique transaction for disambiguiation
 * during cmpxchg. The transactions start with the cpu number and are then
 * incremented by CONFIG_NR_CPUS.
 */
#define TID_STEP  roundup_pow_of_two(CONFIG_NR_CPUS)
#else
/*
 * No preemption supported therefore also no need to check for
 * different cpus.
 */
#define TID_STEP 1
#endif

static inline unsigned long next_tid(unsigned long tid)
{
	return tid + TID_STEP;
}

static inline unsigned int tid_to_cpu(unsigned long tid)
{
	return tid % TID_STEP;
}

static inline unsigned long tid_to_event(unsigned long tid)
{
	return tid / TID_STEP;
}

static inline unsigned int init_tid(int cpu)
{
	return cpu;
}

static inline void note_cmpxchg_failure(const char *n,
		const struct kmem_cache *s, unsigned long tid)
{
#ifdef SLUB_DEBUG_CMPXCHG
	unsigned long actual_tid = __this_cpu_read(s->cpu_slab->tid);

1982
	pr_info("%s %s: cmpxchg redo ", n, s->name);
1983 1984 1985

#ifdef CONFIG_PREEMPT
	if (tid_to_cpu(tid) != tid_to_cpu(actual_tid))
1986
		pr_warn("due to cpu change %d -> %d\n",
1987 1988 1989 1990
			tid_to_cpu(tid), tid_to_cpu(actual_tid));
	else
#endif
	if (tid_to_event(tid) != tid_to_event(actual_tid))
1991
		pr_warn("due to cpu running other code. Event %ld->%ld\n",
1992 1993
			tid_to_event(tid), tid_to_event(actual_tid));
	else
1994
		pr_warn("for unknown reason: actual=%lx was=%lx target=%lx\n",
1995 1996
			actual_tid, tid, next_tid(tid));
#endif
1997
	stat(s, CMPXCHG_DOUBLE_CPU_FAIL);
1998 1999
}

2000
static void init_kmem_cache_cpus(struct kmem_cache *s)
2001 2002 2003 2004 2005 2006
{
	int cpu;

	for_each_possible_cpu(cpu)
		per_cpu_ptr(s->cpu_slab, cpu)->tid = init_tid(cpu);
}
2007

C
Christoph Lameter 已提交
2008 2009 2010
/*
 * Remove the cpu slab
 */
2011
static void deactivate_slab(struct kmem_cache *s, struct page *page,
2012
				void *freelist, struct kmem_cache_cpu *c)
C
Christoph Lameter 已提交
2013
{
2014 2015 2016 2017 2018
	enum slab_modes { M_NONE, M_PARTIAL, M_FULL, M_FREE };
	struct kmem_cache_node *n = get_node(s, page_to_nid(page));
	int lock = 0;
	enum slab_modes l = M_NONE, m = M_NONE;
	void *nextfree;
2019
	int tail = DEACTIVATE_TO_HEAD;
2020 2021 2022 2023
	struct page new;
	struct page old;

	if (page->freelist) {
2024
		stat(s, DEACTIVATE_REMOTE_FREES);
2025
		tail = DEACTIVATE_TO_TAIL;
2026 2027
	}

2028
	/*
2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045
	 * Stage one: Free all available per cpu objects back
	 * to the page freelist while it is still frozen. Leave the
	 * last one.
	 *
	 * There is no need to take the list->lock because the page
	 * is still frozen.
	 */
	while (freelist && (nextfree = get_freepointer(s, freelist))) {
		void *prior;
		unsigned long counters;

		do {
			prior = page->freelist;
			counters = page->counters;
			set_freepointer(s, freelist, prior);
			new.counters = counters;
			new.inuse--;
2046
			VM_BUG_ON(!new.frozen);
2047

2048
		} while (!__cmpxchg_double_slab(s, page,
2049 2050 2051 2052 2053 2054 2055
			prior, counters,
			freelist, new.counters,
			"drain percpu freelist"));

		freelist = nextfree;
	}

2056
	/*
2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068
	 * Stage two: Ensure that the page is unfrozen while the
	 * list presence reflects the actual number of objects
	 * during unfreeze.
	 *
	 * We setup the list membership and then perform a cmpxchg
	 * with the count. If there is a mismatch then the page
	 * is not unfrozen but the page is on the wrong list.
	 *
	 * Then we restart the process which may have to remove
	 * the page from the list that we just put it on again
	 * because the number of objects in the slab may have
	 * changed.
2069
	 */
2070
redo:
2071

2072 2073
	old.freelist = page->freelist;
	old.counters = page->counters;
2074
	VM_BUG_ON(!old.frozen);
2075

2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086
	/* Determine target state of the slab */
	new.counters = old.counters;
	if (freelist) {
		new.inuse--;
		set_freepointer(s, freelist, old.freelist);
		new.freelist = freelist;
	} else
		new.freelist = old.freelist;

	new.frozen = 0;

2087
	if (!new.inuse && n->nr_partial >= s->min_partial)
2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119
		m = M_FREE;
	else if (new.freelist) {
		m = M_PARTIAL;
		if (!lock) {
			lock = 1;
			/*
			 * Taking the spinlock removes the possiblity
			 * that acquire_slab() will see a slab page that
			 * is frozen
			 */
			spin_lock(&n->list_lock);
		}
	} else {
		m = M_FULL;
		if (kmem_cache_debug(s) && !lock) {
			lock = 1;
			/*
			 * This also ensures that the scanning of full
			 * slabs from diagnostic functions will not see
			 * any frozen slabs.
			 */
			spin_lock(&n->list_lock);
		}
	}

	if (l != m) {

		if (l == M_PARTIAL)

			remove_partial(n, page);

		else if (l == M_FULL)
2120

P
Peter Zijlstra 已提交
2121
			remove_full(s, n, page);
2122 2123 2124 2125

		if (m == M_PARTIAL) {

			add_partial(n, page, tail);
2126
			stat(s, tail);
2127 2128

		} else if (m == M_FULL) {
2129

2130 2131 2132 2133 2134 2135 2136
			stat(s, DEACTIVATE_FULL);
			add_full(s, n, page);

		}
	}

	l = m;
2137
	if (!__cmpxchg_double_slab(s, page,
2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149
				old.freelist, old.counters,
				new.freelist, new.counters,
				"unfreezing slab"))
		goto redo;

	if (lock)
		spin_unlock(&n->list_lock);

	if (m == M_FREE) {
		stat(s, DEACTIVATE_EMPTY);
		discard_slab(s, page);
		stat(s, FREE_SLAB);
2150
	}
2151 2152 2153

	c->page = NULL;
	c->freelist = NULL;
C
Christoph Lameter 已提交
2154 2155
}

2156 2157 2158
/*
 * Unfreeze all the cpu partial slabs.
 *
2159 2160 2161
 * This function must be called with interrupts disabled
 * for the cpu using c (or some other guarantee must be there
 * to guarantee no concurrent accesses).
2162
 */
2163 2164
static void unfreeze_partials(struct kmem_cache *s,
		struct kmem_cache_cpu *c)
2165
{
2166
#ifdef CONFIG_SLUB_CPU_PARTIAL
2167
	struct kmem_cache_node *n = NULL, *n2 = NULL;
2168
	struct page *page, *discard_page = NULL;
2169 2170 2171 2172 2173 2174

	while ((page = c->partial)) {
		struct page new;
		struct page old;

		c->partial = page->next;
2175 2176 2177 2178 2179 2180 2181 2182 2183

		n2 = get_node(s, page_to_nid(page));
		if (n != n2) {
			if (n)
				spin_unlock(&n->list_lock);

			n = n2;
			spin_lock(&n->list_lock);
		}
2184 2185 2186 2187 2188

		do {

			old.freelist = page->freelist;
			old.counters = page->counters;
2189
			VM_BUG_ON(!old.frozen);
2190 2191 2192 2193 2194 2195

			new.counters = old.counters;
			new.freelist = old.freelist;

			new.frozen = 0;

2196
		} while (!__cmpxchg_double_slab(s, page,
2197 2198 2199 2200
				old.freelist, old.counters,
				new.freelist, new.counters,
				"unfreezing slab"));

2201
		if (unlikely(!new.inuse && n->nr_partial >= s->min_partial)) {
2202 2203
			page->next = discard_page;
			discard_page = page;
2204 2205 2206
		} else {
			add_partial(n, page, DEACTIVATE_TO_TAIL);
			stat(s, FREE_ADD_PARTIAL);
2207 2208 2209 2210 2211
		}
	}

	if (n)
		spin_unlock(&n->list_lock);
2212 2213 2214 2215 2216 2217 2218 2219 2220

	while (discard_page) {
		page = discard_page;
		discard_page = discard_page->next;

		stat(s, DEACTIVATE_EMPTY);
		discard_slab(s, page);
		stat(s, FREE_SLAB);
	}
2221
#endif
2222 2223 2224 2225
}

/*
 * Put a page that was just frozen (in __slab_free) into a partial page
2226
 * slot if available.
2227 2228 2229 2230
 *
 * If we did not find a slot then simply move all the partials to the
 * per node partial list.
 */
2231
static void put_cpu_partial(struct kmem_cache *s, struct page *page, int drain)
2232
{
2233
#ifdef CONFIG_SLUB_CPU_PARTIAL
2234 2235 2236 2237
	struct page *oldpage;
	int pages;
	int pobjects;

2238
	preempt_disable();
2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253
	do {
		pages = 0;
		pobjects = 0;
		oldpage = this_cpu_read(s->cpu_slab->partial);

		if (oldpage) {
			pobjects = oldpage->pobjects;
			pages = oldpage->pages;
			if (drain && pobjects > s->cpu_partial) {
				unsigned long flags;
				/*
				 * partial array is full. Move the existing
				 * set to the per node partial list.
				 */
				local_irq_save(flags);
2254
				unfreeze_partials(s, this_cpu_ptr(s->cpu_slab));
2255
				local_irq_restore(flags);
2256
				oldpage = NULL;
2257 2258
				pobjects = 0;
				pages = 0;
2259
				stat(s, CPU_PARTIAL_DRAIN);
2260 2261 2262 2263 2264 2265 2266 2267 2268 2269
			}
		}

		pages++;
		pobjects += page->objects - page->inuse;

		page->pages = pages;
		page->pobjects = pobjects;
		page->next = oldpage;

2270 2271
	} while (this_cpu_cmpxchg(s->cpu_slab->partial, oldpage, page)
								!= oldpage);
2272 2273 2274 2275 2276 2277 2278 2279
	if (unlikely(!s->cpu_partial)) {
		unsigned long flags;

		local_irq_save(flags);
		unfreeze_partials(s, this_cpu_ptr(s->cpu_slab));
		local_irq_restore(flags);
	}
	preempt_enable();
2280
#endif
2281 2282
}

2283
static inline void flush_slab(struct kmem_cache *s, struct kmem_cache_cpu *c)
C
Christoph Lameter 已提交
2284
{
2285
	stat(s, CPUSLAB_FLUSH);
2286
	deactivate_slab(s, c->page, c->freelist, c);
2287 2288

	c->tid = next_tid(c->tid);
C
Christoph Lameter 已提交
2289 2290 2291 2292
}

/*
 * Flush cpu slab.
C
Christoph Lameter 已提交
2293
 *
C
Christoph Lameter 已提交
2294 2295
 * Called from IPI handler with interrupts disabled.
 */
2296
static inline void __flush_cpu_slab(struct kmem_cache *s, int cpu)
C
Christoph Lameter 已提交
2297
{
2298
	struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu);
C
Christoph Lameter 已提交
2299

2300 2301 2302 2303
	if (likely(c)) {
		if (c->page)
			flush_slab(s, c);

2304
		unfreeze_partials(s, c);
2305
	}
C
Christoph Lameter 已提交
2306 2307 2308 2309 2310 2311
}

static void flush_cpu_slab(void *d)
{
	struct kmem_cache *s = d;

2312
	__flush_cpu_slab(s, smp_processor_id());
C
Christoph Lameter 已提交
2313 2314
}

2315 2316 2317 2318 2319
static bool has_cpu_slab(int cpu, void *info)
{
	struct kmem_cache *s = info;
	struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu);

2320
	return c->page || slub_percpu_partial(c);
2321 2322
}

C
Christoph Lameter 已提交
2323 2324
static void flush_all(struct kmem_cache *s)
{
2325
	on_each_cpu_cond(has_cpu_slab, flush_cpu_slab, s, 1, GFP_ATOMIC);
C
Christoph Lameter 已提交
2326 2327
}

2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346
/*
 * Use the cpu notifier to insure that the cpu slabs are flushed when
 * necessary.
 */
static int slub_cpu_dead(unsigned int cpu)
{
	struct kmem_cache *s;
	unsigned long flags;

	mutex_lock(&slab_mutex);
	list_for_each_entry(s, &slab_caches, list) {
		local_irq_save(flags);
		__flush_cpu_slab(s, cpu);
		local_irq_restore(flags);
	}
	mutex_unlock(&slab_mutex);
	return 0;
}

2347 2348 2349 2350
/*
 * Check if the objects in a per cpu structure fit numa
 * locality expectations.
 */
2351
static inline int node_match(struct page *page, int node)
2352 2353
{
#ifdef CONFIG_NUMA
2354
	if (!page || (node != NUMA_NO_NODE && page_to_nid(page) != node))
2355 2356 2357 2358 2359
		return 0;
#endif
	return 1;
}

2360
#ifdef CONFIG_SLUB_DEBUG
P
Pekka Enberg 已提交
2361 2362 2363 2364 2365
static int count_free(struct page *page)
{
	return page->objects - page->inuse;
}

2366 2367 2368 2369 2370 2371 2372
static inline unsigned long node_nr_objs(struct kmem_cache_node *n)
{
	return atomic_long_read(&n->total_objects);
}
#endif /* CONFIG_SLUB_DEBUG */

#if defined(CONFIG_SLUB_DEBUG) || defined(CONFIG_SYSFS)
P
Pekka Enberg 已提交
2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385
static unsigned long count_partial(struct kmem_cache_node *n,
					int (*get_count)(struct page *))
{
	unsigned long flags;
	unsigned long x = 0;
	struct page *page;

	spin_lock_irqsave(&n->list_lock, flags);
	list_for_each_entry(page, &n->partial, lru)
		x += get_count(page);
	spin_unlock_irqrestore(&n->list_lock, flags);
	return x;
}
2386
#endif /* CONFIG_SLUB_DEBUG || CONFIG_SYSFS */
2387

P
Pekka Enberg 已提交
2388 2389 2390
static noinline void
slab_out_of_memory(struct kmem_cache *s, gfp_t gfpflags, int nid)
{
2391 2392 2393
#ifdef CONFIG_SLUB_DEBUG
	static DEFINE_RATELIMIT_STATE(slub_oom_rs, DEFAULT_RATELIMIT_INTERVAL,
				      DEFAULT_RATELIMIT_BURST);
P
Pekka Enberg 已提交
2394
	int node;
C
Christoph Lameter 已提交
2395
	struct kmem_cache_node *n;
P
Pekka Enberg 已提交
2396

2397 2398 2399
	if ((gfpflags & __GFP_NOWARN) || !__ratelimit(&slub_oom_rs))
		return;

2400 2401
	pr_warn("SLUB: Unable to allocate memory on node %d, gfp=%#x(%pGg)\n",
		nid, gfpflags, &gfpflags);
2402 2403 2404
	pr_warn("  cache: %s, object size: %d, buffer size: %d, default order: %d, min order: %d\n",
		s->name, s->object_size, s->size, oo_order(s->oo),
		oo_order(s->min));
P
Pekka Enberg 已提交
2405

2406
	if (oo_order(s->min) > get_order(s->object_size))
2407 2408
		pr_warn("  %s debugging increased min order, use slub_debug=O to disable.\n",
			s->name);
2409

C
Christoph Lameter 已提交
2410
	for_each_kmem_cache_node(s, node, n) {
P
Pekka Enberg 已提交
2411 2412 2413 2414
		unsigned long nr_slabs;
		unsigned long nr_objs;
		unsigned long nr_free;

2415 2416 2417
		nr_free  = count_partial(n, count_free);
		nr_slabs = node_nr_slabs(n);
		nr_objs  = node_nr_objs(n);
P
Pekka Enberg 已提交
2418

2419
		pr_warn("  node %d: slabs: %ld, objs: %ld, free: %ld\n",
P
Pekka Enberg 已提交
2420 2421
			node, nr_slabs, nr_objs, nr_free);
	}
2422
#endif
P
Pekka Enberg 已提交
2423 2424
}

2425 2426 2427
static inline void *new_slab_objects(struct kmem_cache *s, gfp_t flags,
			int node, struct kmem_cache_cpu **pc)
{
2428
	void *freelist;
2429 2430
	struct kmem_cache_cpu *c = *pc;
	struct page *page;
2431

2432
	freelist = get_partial(s, flags, node, c);
2433

2434 2435 2436 2437
	if (freelist)
		return freelist;

	page = new_slab(s, flags, node);
2438
	if (page) {
2439
		c = raw_cpu_ptr(s->cpu_slab);
2440 2441 2442 2443 2444 2445 2446
		if (c->page)
			flush_slab(s, c);

		/*
		 * No other reference to the page yet so we can
		 * muck around with it freely without cmpxchg
		 */
2447
		freelist = page->freelist;
2448 2449 2450 2451 2452 2453
		page->freelist = NULL;

		stat(s, ALLOC_SLAB);
		c->page = page;
		*pc = c;
	} else
2454
		freelist = NULL;
2455

2456
	return freelist;
2457 2458
}

2459 2460 2461 2462 2463 2464 2465 2466
static inline bool pfmemalloc_match(struct page *page, gfp_t gfpflags)
{
	if (unlikely(PageSlabPfmemalloc(page)))
		return gfp_pfmemalloc_allowed(gfpflags);

	return true;
}

2467
/*
2468 2469
 * Check the page->freelist of a page and either transfer the freelist to the
 * per cpu freelist or deactivate the page.
2470 2471 2472 2473
 *
 * The page is still frozen if the return value is not NULL.
 *
 * If this function returns NULL then the page has been unfrozen.
2474 2475
 *
 * This function must be called with interrupt disabled.
2476 2477 2478 2479 2480 2481 2482 2483 2484 2485
 */
static inline void *get_freelist(struct kmem_cache *s, struct page *page)
{
	struct page new;
	unsigned long counters;
	void *freelist;

	do {
		freelist = page->freelist;
		counters = page->counters;
2486

2487
		new.counters = counters;
2488
		VM_BUG_ON(!new.frozen);
2489 2490 2491 2492

		new.inuse = page->objects;
		new.frozen = freelist != NULL;

2493
	} while (!__cmpxchg_double_slab(s, page,
2494 2495 2496 2497 2498 2499 2500
		freelist, counters,
		NULL, new.counters,
		"get_freelist"));

	return freelist;
}

C
Christoph Lameter 已提交
2501
/*
2502 2503 2504 2505 2506 2507
 * Slow path. The lockless freelist is empty or we need to perform
 * debugging duties.
 *
 * Processing is still very fast if new objects have been freed to the
 * regular freelist. In that case we simply take over the regular freelist
 * as the lockless freelist and zap the regular freelist.
C
Christoph Lameter 已提交
2508
 *
2509 2510 2511
 * If that is not working then we fall back to the partial lists. We take the
 * first element of the freelist as the object to allocate now and move the
 * rest of the freelist to the lockless freelist.
C
Christoph Lameter 已提交
2512
 *
2513
 * And if we were unable to get a new slab from the partial slab lists then
C
Christoph Lameter 已提交
2514 2515
 * we need to allocate a new slab. This is the slowest path since it involves
 * a call to the page allocator and the setup of a new slab.
2516 2517 2518
 *
 * Version of __slab_alloc to use when we know that interrupts are
 * already disabled (which is the case for bulk allocation).
C
Christoph Lameter 已提交
2519
 */
2520
static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
2521
			  unsigned long addr, struct kmem_cache_cpu *c)
C
Christoph Lameter 已提交
2522
{
2523
	void *freelist;
2524
	struct page *page;
C
Christoph Lameter 已提交
2525

2526 2527
	page = c->page;
	if (!page)
C
Christoph Lameter 已提交
2528
		goto new_slab;
2529
redo:
2530

2531
	if (unlikely(!node_match(page, node))) {
2532 2533 2534 2535 2536 2537 2538
		int searchnode = node;

		if (node != NUMA_NO_NODE && !node_present_pages(node))
			searchnode = node_to_mem_node(node);

		if (unlikely(!node_match(page, searchnode))) {
			stat(s, ALLOC_NODE_MISMATCH);
2539
			deactivate_slab(s, page, c->freelist, c);
2540 2541
			goto new_slab;
		}
2542
	}
C
Christoph Lameter 已提交
2543

2544 2545 2546 2547 2548 2549
	/*
	 * By rights, we should be searching for a slab page that was
	 * PFMEMALLOC but right now, we are losing the pfmemalloc
	 * information when the page leaves the per-cpu allocator
	 */
	if (unlikely(!pfmemalloc_match(page, gfpflags))) {
2550
		deactivate_slab(s, page, c->freelist, c);
2551 2552 2553
		goto new_slab;
	}

2554
	/* must check again c->freelist in case of cpu migration or IRQ */
2555 2556
	freelist = c->freelist;
	if (freelist)
2557
		goto load_freelist;
2558

2559
	freelist = get_freelist(s, page);
C
Christoph Lameter 已提交
2560

2561
	if (!freelist) {
2562 2563
		c->page = NULL;
		stat(s, DEACTIVATE_BYPASS);
2564
		goto new_slab;
2565
	}
C
Christoph Lameter 已提交
2566

2567
	stat(s, ALLOC_REFILL);
C
Christoph Lameter 已提交
2568

2569
load_freelist:
2570 2571 2572 2573 2574
	/*
	 * freelist is pointing to the list of objects to be used.
	 * page is pointing to the page from which the objects are obtained.
	 * That page must be frozen for per cpu allocations to work.
	 */
2575
	VM_BUG_ON(!c->page->frozen);
2576
	c->freelist = get_freepointer(s, freelist);
2577
	c->tid = next_tid(c->tid);
2578
	return freelist;
C
Christoph Lameter 已提交
2579 2580

new_slab:
2581

2582 2583 2584
	if (slub_percpu_partial(c)) {
		page = c->page = slub_percpu_partial(c);
		slub_set_percpu_partial(c, page);
2585 2586
		stat(s, CPU_PARTIAL_ALLOC);
		goto redo;
C
Christoph Lameter 已提交
2587 2588
	}

2589
	freelist = new_slab_objects(s, gfpflags, node, &c);
2590

2591
	if (unlikely(!freelist)) {
2592
		slab_out_of_memory(s, gfpflags, node);
2593
		return NULL;
C
Christoph Lameter 已提交
2594
	}
2595

2596
	page = c->page;
2597
	if (likely(!kmem_cache_debug(s) && pfmemalloc_match(page, gfpflags)))
2598
		goto load_freelist;
2599

2600
	/* Only entered in the debug case */
2601 2602
	if (kmem_cache_debug(s) &&
			!alloc_debug_processing(s, page, freelist, addr))
2603
		goto new_slab;	/* Slab failed checks. Next slab needed */
2604

2605
	deactivate_slab(s, page, get_freepointer(s, freelist), c);
2606
	return freelist;
2607 2608
}

2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633
/*
 * Another one that disabled interrupt and compensates for possible
 * cpu changes by refetching the per cpu area pointer.
 */
static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
			  unsigned long addr, struct kmem_cache_cpu *c)
{
	void *p;
	unsigned long flags;

	local_irq_save(flags);
#ifdef CONFIG_PREEMPT
	/*
	 * We may have been preempted and rescheduled on a different
	 * cpu before disabling interrupts. Need to reload cpu area
	 * pointer.
	 */
	c = this_cpu_ptr(s->cpu_slab);
#endif

	p = ___slab_alloc(s, gfpflags, node, addr, c);
	local_irq_restore(flags);
	return p;
}

2634 2635 2636 2637 2638 2639 2640 2641 2642 2643
/*
 * Inlined fastpath so that allocation functions (kmalloc, kmem_cache_alloc)
 * have the fastpath folded into their functions. So no function call
 * overhead for requests that can be satisfied on the fastpath.
 *
 * The fastpath works by first checking if the lockless freelist can be used.
 * If not then __slab_alloc is called for slow processing.
 *
 * Otherwise we can simply pick the next object from the lockless free list.
 */
2644
static __always_inline void *slab_alloc_node(struct kmem_cache *s,
2645
		gfp_t gfpflags, int node, unsigned long addr)
2646
{
2647
	void *object;
2648
	struct kmem_cache_cpu *c;
2649
	struct page *page;
2650
	unsigned long tid;
2651

2652 2653
	s = slab_pre_alloc_hook(s, gfpflags);
	if (!s)
A
Akinobu Mita 已提交
2654
		return NULL;
2655 2656 2657 2658 2659 2660
redo:
	/*
	 * Must read kmem_cache cpu data via this cpu ptr. Preemption is
	 * enabled. We may switch back and forth between cpus while
	 * reading from one cpu area. That does not matter as long
	 * as we end up on the original cpu again when doing the cmpxchg.
2661
	 *
2662 2663 2664
	 * We should guarantee that tid and kmem_cache are retrieved on
	 * the same cpu. It could be different if CONFIG_PREEMPT so we need
	 * to check if it is matched or not.
2665
	 */
2666 2667 2668
	do {
		tid = this_cpu_read(s->cpu_slab->tid);
		c = raw_cpu_ptr(s->cpu_slab);
2669 2670
	} while (IS_ENABLED(CONFIG_PREEMPT) &&
		 unlikely(tid != READ_ONCE(c->tid)));
2671 2672 2673 2674 2675 2676 2677 2678 2679 2680

	/*
	 * Irqless object alloc/free algorithm used here depends on sequence
	 * of fetching cpu_slab's data. tid should be fetched before anything
	 * on c to guarantee that object and page associated with previous tid
	 * won't be used with current tid. If we fetch tid first, object and
	 * page could be one associated with next tid and our alloc/free
	 * request will be failed. In this case, we will retry. So, no problem.
	 */
	barrier();
2681 2682 2683 2684 2685 2686 2687 2688

	/*
	 * The transaction ids are globally unique per cpu and per operation on
	 * a per cpu queue. Thus they can be guarantee that the cmpxchg_double
	 * occurs on the right processor and that there was no operation on the
	 * linked list in between.
	 */

2689
	object = c->freelist;
2690
	page = c->page;
D
Dave Hansen 已提交
2691
	if (unlikely(!object || !node_match(page, node))) {
2692
		object = __slab_alloc(s, gfpflags, node, addr, c);
D
Dave Hansen 已提交
2693 2694
		stat(s, ALLOC_SLOWPATH);
	} else {
2695 2696
		void *next_object = get_freepointer_safe(s, object);

2697
		/*
L
Lucas De Marchi 已提交
2698
		 * The cmpxchg will only match if there was no additional
2699 2700
		 * operation and if we are on the right processor.
		 *
2701 2702
		 * The cmpxchg does the following atomically (without lock
		 * semantics!)
2703 2704 2705 2706
		 * 1. Relocate first pointer to the current per cpu area.
		 * 2. Verify that tid and freelist have not been changed
		 * 3. If they were not changed replace tid and freelist
		 *
2707 2708 2709
		 * Since this is without lock semantics the protection is only
		 * against code executing on this cpu *not* from access by
		 * other cpus.
2710
		 */
2711
		if (unlikely(!this_cpu_cmpxchg_double(
2712 2713
				s->cpu_slab->freelist, s->cpu_slab->tid,
				object, tid,
2714
				next_object, next_tid(tid)))) {
2715 2716 2717 2718

			note_cmpxchg_failure("slab_alloc", s, tid);
			goto redo;
		}
2719
		prefetch_freepointer(s, next_object);
2720
		stat(s, ALLOC_FASTPATH);
2721
	}
2722

2723
	if (unlikely(gfpflags & __GFP_ZERO) && object)
2724
		memset(object, 0, s->object_size);
2725

2726
	slab_post_alloc_hook(s, gfpflags, 1, &object);
V
Vegard Nossum 已提交
2727

2728
	return object;
C
Christoph Lameter 已提交
2729 2730
}

2731 2732 2733 2734 2735 2736
static __always_inline void *slab_alloc(struct kmem_cache *s,
		gfp_t gfpflags, unsigned long addr)
{
	return slab_alloc_node(s, gfpflags, NUMA_NO_NODE, addr);
}

C
Christoph Lameter 已提交
2737 2738
void *kmem_cache_alloc(struct kmem_cache *s, gfp_t gfpflags)
{
2739
	void *ret = slab_alloc(s, gfpflags, _RET_IP_);
E
Eduard - Gabriel Munteanu 已提交
2740

2741 2742
	trace_kmem_cache_alloc(_RET_IP_, ret, s->object_size,
				s->size, gfpflags);
E
Eduard - Gabriel Munteanu 已提交
2743 2744

	return ret;
C
Christoph Lameter 已提交
2745 2746 2747
}
EXPORT_SYMBOL(kmem_cache_alloc);

2748
#ifdef CONFIG_TRACING
2749 2750
void *kmem_cache_alloc_trace(struct kmem_cache *s, gfp_t gfpflags, size_t size)
{
2751
	void *ret = slab_alloc(s, gfpflags, _RET_IP_);
2752
	trace_kmalloc(_RET_IP_, ret, size, s->size, gfpflags);
2753
	kasan_kmalloc(s, ret, size, gfpflags);
2754 2755 2756
	return ret;
}
EXPORT_SYMBOL(kmem_cache_alloc_trace);
E
Eduard - Gabriel Munteanu 已提交
2757 2758
#endif

C
Christoph Lameter 已提交
2759 2760 2761
#ifdef CONFIG_NUMA
void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t gfpflags, int node)
{
2762
	void *ret = slab_alloc_node(s, gfpflags, node, _RET_IP_);
E
Eduard - Gabriel Munteanu 已提交
2763

2764
	trace_kmem_cache_alloc_node(_RET_IP_, ret,
2765
				    s->object_size, s->size, gfpflags, node);
E
Eduard - Gabriel Munteanu 已提交
2766 2767

	return ret;
C
Christoph Lameter 已提交
2768 2769 2770
}
EXPORT_SYMBOL(kmem_cache_alloc_node);

2771
#ifdef CONFIG_TRACING
2772
void *kmem_cache_alloc_node_trace(struct kmem_cache *s,
E
Eduard - Gabriel Munteanu 已提交
2773
				    gfp_t gfpflags,
2774
				    int node, size_t size)
E
Eduard - Gabriel Munteanu 已提交
2775
{
2776
	void *ret = slab_alloc_node(s, gfpflags, node, _RET_IP_);
2777 2778 2779

	trace_kmalloc_node(_RET_IP_, ret,
			   size, s->size, gfpflags, node);
2780

2781
	kasan_kmalloc(s, ret, size, gfpflags);
2782
	return ret;
E
Eduard - Gabriel Munteanu 已提交
2783
}
2784
EXPORT_SYMBOL(kmem_cache_alloc_node_trace);
E
Eduard - Gabriel Munteanu 已提交
2785
#endif
2786
#endif
E
Eduard - Gabriel Munteanu 已提交
2787

C
Christoph Lameter 已提交
2788
/*
K
Kim Phillips 已提交
2789
 * Slow path handling. This may still be called frequently since objects
2790
 * have a longer lifetime than the cpu slabs in most processing loads.
C
Christoph Lameter 已提交
2791
 *
2792 2793 2794
 * So we still attempt to reduce cache line usage. Just take the slab
 * lock and free the item. If there is no additional partial page
 * handling required then we can return immediately.
C
Christoph Lameter 已提交
2795
 */
2796
static void __slab_free(struct kmem_cache *s, struct page *page,
2797 2798 2799
			void *head, void *tail, int cnt,
			unsigned long addr)

C
Christoph Lameter 已提交
2800 2801
{
	void *prior;
2802 2803 2804 2805
	int was_frozen;
	struct page new;
	unsigned long counters;
	struct kmem_cache_node *n = NULL;
2806
	unsigned long uninitialized_var(flags);
C
Christoph Lameter 已提交
2807

2808
	stat(s, FREE_SLOWPATH);
C
Christoph Lameter 已提交
2809

2810
	if (kmem_cache_debug(s) &&
2811
	    !free_debug_processing(s, page, head, tail, cnt, addr))
2812
		return;
C
Christoph Lameter 已提交
2813

2814
	do {
2815 2816 2817 2818
		if (unlikely(n)) {
			spin_unlock_irqrestore(&n->list_lock, flags);
			n = NULL;
		}
2819 2820
		prior = page->freelist;
		counters = page->counters;
2821
		set_freepointer(s, tail, prior);
2822 2823
		new.counters = counters;
		was_frozen = new.frozen;
2824
		new.inuse -= cnt;
2825
		if ((!new.inuse || !prior) && !was_frozen) {
2826

P
Peter Zijlstra 已提交
2827
			if (kmem_cache_has_cpu_partial(s) && !prior) {
2828 2829

				/*
2830 2831 2832 2833
				 * Slab was on no list before and will be
				 * partially empty
				 * We can defer the list move and instead
				 * freeze it.
2834 2835 2836
				 */
				new.frozen = 1;

P
Peter Zijlstra 已提交
2837
			} else { /* Needs to be taken off a list */
2838

2839
				n = get_node(s, page_to_nid(page));
2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850
				/*
				 * Speculatively acquire the list_lock.
				 * If the cmpxchg does not succeed then we may
				 * drop the list_lock without any processing.
				 *
				 * Otherwise the list_lock will synchronize with
				 * other processors updating the list of slabs.
				 */
				spin_lock_irqsave(&n->list_lock, flags);

			}
2851
		}
C
Christoph Lameter 已提交
2852

2853 2854
	} while (!cmpxchg_double_slab(s, page,
		prior, counters,
2855
		head, new.counters,
2856
		"__slab_free"));
C
Christoph Lameter 已提交
2857

2858
	if (likely(!n)) {
2859 2860 2861 2862 2863

		/*
		 * If we just froze the page then put it onto the
		 * per cpu partial list.
		 */
2864
		if (new.frozen && !was_frozen) {
2865
			put_cpu_partial(s, page, 1);
2866 2867
			stat(s, CPU_PARTIAL_FREE);
		}
2868
		/*
2869 2870 2871
		 * The list lock was not taken therefore no list
		 * activity can be necessary.
		 */
2872 2873 2874 2875
		if (was_frozen)
			stat(s, FREE_FROZEN);
		return;
	}
C
Christoph Lameter 已提交
2876

2877
	if (unlikely(!new.inuse && n->nr_partial >= s->min_partial))
2878 2879
		goto slab_empty;

C
Christoph Lameter 已提交
2880
	/*
2881 2882
	 * Objects left in the slab. If it was not on the partial list before
	 * then add it.
C
Christoph Lameter 已提交
2883
	 */
2884 2885
	if (!kmem_cache_has_cpu_partial(s) && unlikely(!prior)) {
		if (kmem_cache_debug(s))
P
Peter Zijlstra 已提交
2886
			remove_full(s, n, page);
2887 2888
		add_partial(n, page, DEACTIVATE_TO_TAIL);
		stat(s, FREE_ADD_PARTIAL);
2889
	}
2890
	spin_unlock_irqrestore(&n->list_lock, flags);
C
Christoph Lameter 已提交
2891 2892 2893
	return;

slab_empty:
2894
	if (prior) {
C
Christoph Lameter 已提交
2895
		/*
2896
		 * Slab on the partial list.
C
Christoph Lameter 已提交
2897
		 */
2898
		remove_partial(n, page);
2899
		stat(s, FREE_REMOVE_PARTIAL);
P
Peter Zijlstra 已提交
2900
	} else {
2901
		/* Slab must be on the full list */
P
Peter Zijlstra 已提交
2902 2903
		remove_full(s, n, page);
	}
2904

2905
	spin_unlock_irqrestore(&n->list_lock, flags);
2906
	stat(s, FREE_SLAB);
C
Christoph Lameter 已提交
2907 2908 2909
	discard_slab(s, page);
}

2910 2911 2912 2913 2914 2915 2916 2917 2918 2919
/*
 * Fastpath with forced inlining to produce a kfree and kmem_cache_free that
 * can perform fastpath freeing without additional function calls.
 *
 * The fastpath is only possible if we are freeing to the current cpu slab
 * of this processor. This typically the case if we have just allocated
 * the item before.
 *
 * If fastpath is not possible then fall back to __slab_free where we deal
 * with all sorts of special processing.
2920 2921 2922 2923
 *
 * Bulk free of a freelist with several objects (all pointing to the
 * same page) possible by specifying head and tail ptr, plus objects
 * count (cnt). Bulk free indicated by tail pointer being set.
2924
 */
2925 2926 2927
static __always_inline void do_slab_free(struct kmem_cache *s,
				struct page *page, void *head, void *tail,
				int cnt, unsigned long addr)
2928
{
2929
	void *tail_obj = tail ? : head;
2930
	struct kmem_cache_cpu *c;
2931 2932 2933 2934 2935 2936
	unsigned long tid;
redo:
	/*
	 * Determine the currently cpus per cpu slab.
	 * The cpu may change afterward. However that does not matter since
	 * data is retrieved via this pointer. If we are on the same cpu
2937
	 * during the cmpxchg then the free will succeed.
2938
	 */
2939 2940 2941
	do {
		tid = this_cpu_read(s->cpu_slab->tid);
		c = raw_cpu_ptr(s->cpu_slab);
2942 2943
	} while (IS_ENABLED(CONFIG_PREEMPT) &&
		 unlikely(tid != READ_ONCE(c->tid)));
2944

2945 2946
	/* Same with comment on barrier() in slab_alloc_node() */
	barrier();
2947

2948
	if (likely(page == c->page)) {
2949
		set_freepointer(s, tail_obj, c->freelist);
2950

2951
		if (unlikely(!this_cpu_cmpxchg_double(
2952 2953
				s->cpu_slab->freelist, s->cpu_slab->tid,
				c->freelist, tid,
2954
				head, next_tid(tid)))) {
2955 2956 2957 2958

			note_cmpxchg_failure("slab_free", s, tid);
			goto redo;
		}
2959
		stat(s, FREE_FASTPATH);
2960
	} else
2961
		__slab_free(s, page, head, tail_obj, cnt, addr);
2962 2963 2964

}

2965 2966 2967 2968 2969 2970 2971 2972 2973
static __always_inline void slab_free(struct kmem_cache *s, struct page *page,
				      void *head, void *tail, int cnt,
				      unsigned long addr)
{
	slab_free_freelist_hook(s, head, tail);
	/*
	 * slab_free_freelist_hook() could have put the items into quarantine.
	 * If so, no need to free them.
	 */
2974
	if (s->flags & SLAB_KASAN && !(s->flags & SLAB_TYPESAFE_BY_RCU))
2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985
		return;
	do_slab_free(s, page, head, tail, cnt, addr);
}

#ifdef CONFIG_KASAN
void ___cache_free(struct kmem_cache *cache, void *x, unsigned long addr)
{
	do_slab_free(cache, virt_to_head_page(x), x, NULL, 1, addr);
}
#endif

C
Christoph Lameter 已提交
2986 2987
void kmem_cache_free(struct kmem_cache *s, void *x)
{
2988 2989
	s = cache_from_obj(s, x);
	if (!s)
2990
		return;
2991
	slab_free(s, virt_to_head_page(x), x, NULL, 1, _RET_IP_);
2992
	trace_kmem_cache_free(_RET_IP_, x);
C
Christoph Lameter 已提交
2993 2994 2995
}
EXPORT_SYMBOL(kmem_cache_free);

2996
struct detached_freelist {
2997
	struct page *page;
2998 2999 3000
	void *tail;
	void *freelist;
	int cnt;
3001
	struct kmem_cache *s;
3002
};
3003

3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015
/*
 * This function progressively scans the array with free objects (with
 * a limited look ahead) and extract objects belonging to the same
 * page.  It builds a detached freelist directly within the given
 * page/objects.  This can happen without any need for
 * synchronization, because the objects are owned by running process.
 * The freelist is build up as a single linked list in the objects.
 * The idea is, that this detached freelist can then be bulk
 * transferred to the real freelist(s), but only requiring a single
 * synchronization primitive.  Look ahead in the array is limited due
 * to performance reasons.
 */
3016 3017 3018
static inline
int build_detached_freelist(struct kmem_cache *s, size_t size,
			    void **p, struct detached_freelist *df)
3019 3020 3021 3022
{
	size_t first_skipped_index = 0;
	int lookahead = 3;
	void *object;
3023
	struct page *page;
3024

3025 3026
	/* Always re-init detached_freelist */
	df->page = NULL;
3027

3028 3029
	do {
		object = p[--size];
3030
		/* Do we need !ZERO_OR_NULL_PTR(object) here? (for kfree) */
3031
	} while (!object && size);
3032

3033 3034
	if (!object)
		return 0;
3035

3036 3037 3038 3039 3040 3041
	page = virt_to_head_page(object);
	if (!s) {
		/* Handle kalloc'ed objects */
		if (unlikely(!PageSlab(page))) {
			BUG_ON(!PageCompound(page));
			kfree_hook(object);
3042
			__free_pages(page, compound_order(page));
3043 3044 3045 3046 3047 3048 3049 3050
			p[size] = NULL; /* mark object processed */
			return size;
		}
		/* Derive kmem_cache from object */
		df->s = page->slab_cache;
	} else {
		df->s = cache_from_obj(s, object); /* Support for memcg */
	}
3051

3052
	/* Start new detached freelist */
3053
	df->page = page;
3054
	set_freepointer(df->s, object, NULL);
3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067
	df->tail = object;
	df->freelist = object;
	p[size] = NULL; /* mark object processed */
	df->cnt = 1;

	while (size) {
		object = p[--size];
		if (!object)
			continue; /* Skip processed objects */

		/* df->page is always set at this point */
		if (df->page == virt_to_head_page(object)) {
			/* Opportunity build freelist */
3068
			set_freepointer(df->s, object, df->freelist);
3069 3070 3071 3072 3073
			df->freelist = object;
			df->cnt++;
			p[size] = NULL; /* mark object processed */

			continue;
3074
		}
3075 3076 3077 3078 3079 3080 3081

		/* Limit look ahead search */
		if (!--lookahead)
			break;

		if (!first_skipped_index)
			first_skipped_index = size + 1;
3082
	}
3083 3084 3085 3086 3087

	return first_skipped_index;
}

/* Note that interrupts must be enabled when calling this function. */
3088
void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
3089 3090 3091 3092 3093 3094 3095 3096
{
	if (WARN_ON(!size))
		return;

	do {
		struct detached_freelist df;

		size = build_detached_freelist(s, size, p, &df);
A
Arnd Bergmann 已提交
3097
		if (!df.page)
3098 3099
			continue;

3100
		slab_free(df.s, df.page, df.freelist, df.tail, df.cnt,_RET_IP_);
3101
	} while (likely(size));
3102 3103 3104
}
EXPORT_SYMBOL(kmem_cache_free_bulk);

3105
/* Note that interrupts must be enabled when calling this function. */
3106 3107
int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
			  void **p)
3108
{
3109 3110 3111
	struct kmem_cache_cpu *c;
	int i;

3112 3113 3114 3115
	/* memcg and kmem_cache debug support */
	s = slab_pre_alloc_hook(s, flags);
	if (unlikely(!s))
		return false;
3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126
	/*
	 * Drain objects in the per cpu slab, while disabling local
	 * IRQs, which protects against PREEMPT and interrupts
	 * handlers invoking normal fastpath.
	 */
	local_irq_disable();
	c = this_cpu_ptr(s->cpu_slab);

	for (i = 0; i < size; i++) {
		void *object = c->freelist;

3127 3128 3129 3130 3131
		if (unlikely(!object)) {
			/*
			 * Invoking slow path likely have side-effect
			 * of re-populating per CPU c->freelist
			 */
3132
			p[i] = ___slab_alloc(s, flags, NUMA_NO_NODE,
3133
					    _RET_IP_, c);
3134 3135 3136
			if (unlikely(!p[i]))
				goto error;

3137 3138 3139
			c = this_cpu_ptr(s->cpu_slab);
			continue; /* goto for-loop */
		}
3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153
		c->freelist = get_freepointer(s, object);
		p[i] = object;
	}
	c->tid = next_tid(c->tid);
	local_irq_enable();

	/* Clear memory outside IRQ disabled fastpath loop */
	if (unlikely(flags & __GFP_ZERO)) {
		int j;

		for (j = 0; j < i; j++)
			memset(p[j], 0, s->object_size);
	}

3154 3155
	/* memcg and kmem_cache debug support */
	slab_post_alloc_hook(s, flags, size, p);
3156
	return i;
3157 3158
error:
	local_irq_enable();
3159 3160
	slab_post_alloc_hook(s, flags, i, p);
	__kmem_cache_free_bulk(s, i, p);
3161
	return 0;
3162 3163 3164 3165
}
EXPORT_SYMBOL(kmem_cache_alloc_bulk);


C
Christoph Lameter 已提交
3166
/*
C
Christoph Lameter 已提交
3167 3168 3169 3170
 * Object placement in a slab is made very easy because we always start at
 * offset 0. If we tune the size of the object to the alignment then we can
 * get the required alignment by putting one properly sized object after
 * another.
C
Christoph Lameter 已提交
3171 3172 3173 3174
 *
 * Notice that the allocation order determines the sizes of the per cpu
 * caches. Each processor has always one slab available for allocations.
 * Increasing the allocation order reduces the number of times that slabs
C
Christoph Lameter 已提交
3175
 * must be moved on and off the partial lists and is therefore a factor in
C
Christoph Lameter 已提交
3176 3177 3178 3179 3180 3181 3182 3183 3184 3185
 * locking overhead.
 */

/*
 * Mininum / Maximum order of slab pages. This influences locking overhead
 * and slab fragmentation. A higher order reduces the number of partial slabs
 * and increases the number of allocations possible without having to
 * take the list_lock.
 */
static int slub_min_order;
3186
static int slub_max_order = PAGE_ALLOC_COSTLY_ORDER;
3187
static int slub_min_objects;
C
Christoph Lameter 已提交
3188 3189 3190 3191

/*
 * Calculate the order of allocation given an slab object size.
 *
C
Christoph Lameter 已提交
3192 3193 3194 3195
 * The order of allocation has significant impact on performance and other
 * system components. Generally order 0 allocations should be preferred since
 * order 0 does not cause fragmentation in the page allocator. Larger objects
 * be problematic to put into order 0 slabs because there may be too much
C
Christoph Lameter 已提交
3196
 * unused space left. We go to a higher order if more than 1/16th of the slab
C
Christoph Lameter 已提交
3197 3198 3199 3200 3201 3202
 * would be wasted.
 *
 * In order to reach satisfactory performance we must ensure that a minimum
 * number of objects is in one slab. Otherwise we may generate too much
 * activity on the partial lists which requires taking the list_lock. This is
 * less a concern for large slabs though which are rarely used.
C
Christoph Lameter 已提交
3203
 *
C
Christoph Lameter 已提交
3204 3205 3206 3207
 * slub_max_order specifies the order where we begin to stop considering the
 * number of objects in a slab as critical. If we reach slub_max_order then
 * we try to keep the page order as low as possible. So we accept more waste
 * of space in favor of a small page order.
C
Christoph Lameter 已提交
3208
 *
C
Christoph Lameter 已提交
3209 3210 3211 3212
 * Higher order allocations also allow the placement of more objects in a
 * slab and thereby reduce object handling overhead. If the user has
 * requested a higher mininum order then we start with that one instead of
 * the smallest order which will fit the object.
C
Christoph Lameter 已提交
3213
 */
3214
static inline int slab_order(int size, int min_objects,
3215
				int max_order, int fract_leftover, int reserved)
C
Christoph Lameter 已提交
3216 3217 3218
{
	int order;
	int rem;
3219
	int min_order = slub_min_order;
C
Christoph Lameter 已提交
3220

3221
	if (order_objects(min_order, size, reserved) > MAX_OBJS_PER_PAGE)
3222
		return get_order(size * MAX_OBJS_PER_PAGE) - 1;
3223

3224
	for (order = max(min_order, get_order(min_objects * size + reserved));
3225
			order <= max_order; order++) {
C
Christoph Lameter 已提交
3226

3227
		unsigned long slab_size = PAGE_SIZE << order;
C
Christoph Lameter 已提交
3228

3229
		rem = (slab_size - reserved) % size;
C
Christoph Lameter 已提交
3230

3231
		if (rem <= slab_size / fract_leftover)
C
Christoph Lameter 已提交
3232 3233
			break;
	}
C
Christoph Lameter 已提交
3234

C
Christoph Lameter 已提交
3235 3236 3237
	return order;
}

3238
static inline int calculate_order(int size, int reserved)
3239 3240 3241 3242
{
	int order;
	int min_objects;
	int fraction;
3243
	int max_objects;
3244 3245 3246 3247 3248 3249

	/*
	 * Attempt to find best configuration for a slab. This
	 * works by first attempting to generate a layout with
	 * the best configuration and backing off gradually.
	 *
3250
	 * First we increase the acceptable waste in a slab. Then
3251 3252 3253
	 * we reduce the minimum objects required in a slab.
	 */
	min_objects = slub_min_objects;
3254 3255
	if (!min_objects)
		min_objects = 4 * (fls(nr_cpu_ids) + 1);
3256
	max_objects = order_objects(slub_max_order, size, reserved);
3257 3258
	min_objects = min(min_objects, max_objects);

3259
	while (min_objects > 1) {
C
Christoph Lameter 已提交
3260
		fraction = 16;
3261 3262
		while (fraction >= 4) {
			order = slab_order(size, min_objects,
3263
					slub_max_order, fraction, reserved);
3264 3265 3266 3267
			if (order <= slub_max_order)
				return order;
			fraction /= 2;
		}
3268
		min_objects--;
3269 3270 3271 3272 3273 3274
	}

	/*
	 * We were unable to place multiple objects in a slab. Now
	 * lets see if we can place a single object there.
	 */
3275
	order = slab_order(size, 1, slub_max_order, 1, reserved);
3276 3277 3278 3279 3280 3281
	if (order <= slub_max_order)
		return order;

	/*
	 * Doh this slab cannot be placed using slub_max_order.
	 */
3282
	order = slab_order(size, 1, MAX_ORDER, 1, reserved);
D
David Rientjes 已提交
3283
	if (order < MAX_ORDER)
3284 3285 3286 3287
		return order;
	return -ENOSYS;
}

3288
static void
3289
init_kmem_cache_node(struct kmem_cache_node *n)
C
Christoph Lameter 已提交
3290 3291 3292 3293
{
	n->nr_partial = 0;
	spin_lock_init(&n->list_lock);
	INIT_LIST_HEAD(&n->partial);
3294
#ifdef CONFIG_SLUB_DEBUG
3295
	atomic_long_set(&n->nr_slabs, 0);
3296
	atomic_long_set(&n->total_objects, 0);
3297
	INIT_LIST_HEAD(&n->full);
3298
#endif
C
Christoph Lameter 已提交
3299 3300
}

3301
static inline int alloc_kmem_cache_cpus(struct kmem_cache *s)
3302
{
3303
	BUILD_BUG_ON(PERCPU_DYNAMIC_EARLY_SIZE <
3304
			KMALLOC_SHIFT_HIGH * sizeof(struct kmem_cache_cpu));
3305

3306
	/*
3307 3308
	 * Must align to double word boundary for the double cmpxchg
	 * instructions to work; see __pcpu_double_call_return_bool().
3309
	 */
3310 3311
	s->cpu_slab = __alloc_percpu(sizeof(struct kmem_cache_cpu),
				     2 * sizeof(void *));
3312 3313 3314 3315 3316

	if (!s->cpu_slab)
		return 0;

	init_kmem_cache_cpus(s);
3317

3318
	return 1;
3319 3320
}

3321 3322
static struct kmem_cache *kmem_cache_node;

C
Christoph Lameter 已提交
3323 3324 3325 3326 3327
/*
 * No kmalloc_node yet so do it by hand. We know that this is the first
 * slab on the node for this slabcache. There are no concurrent accesses
 * possible.
 *
Z
Zhi Yong Wu 已提交
3328 3329
 * Note that this function only works on the kmem_cache_node
 * when allocating for the kmem_cache_node. This is used for bootstrapping
3330
 * memory on a fresh node that has no slab structures yet.
C
Christoph Lameter 已提交
3331
 */
3332
static void early_kmem_cache_node_alloc(int node)
C
Christoph Lameter 已提交
3333 3334 3335 3336
{
	struct page *page;
	struct kmem_cache_node *n;

3337
	BUG_ON(kmem_cache_node->size < sizeof(struct kmem_cache_node));
C
Christoph Lameter 已提交
3338

3339
	page = new_slab(kmem_cache_node, GFP_NOWAIT, node);
C
Christoph Lameter 已提交
3340 3341

	BUG_ON(!page);
3342
	if (page_to_nid(page) != node) {
3343 3344
		pr_err("SLUB: Unable to allocate memory from node %d\n", node);
		pr_err("SLUB: Allocating a useless per node structure in order to be able to continue\n");
3345 3346
	}

C
Christoph Lameter 已提交
3347 3348
	n = page->freelist;
	BUG_ON(!n);
3349
	page->freelist = get_freepointer(kmem_cache_node, n);
3350
	page->inuse = 1;
3351
	page->frozen = 0;
3352
	kmem_cache_node->node[node] = n;
3353
#ifdef CONFIG_SLUB_DEBUG
3354
	init_object(kmem_cache_node, n, SLUB_RED_ACTIVE);
3355
	init_tracking(kmem_cache_node, n);
3356
#endif
3357 3358
	kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node),
		      GFP_KERNEL);
3359
	init_kmem_cache_node(n);
3360
	inc_slabs_node(kmem_cache_node, node, page->objects);
C
Christoph Lameter 已提交
3361

3362
	/*
3363 3364
	 * No locks need to be taken here as it has just been
	 * initialized and there is no concurrent access.
3365
	 */
3366
	__add_partial(n, page, DEACTIVATE_TO_HEAD);
C
Christoph Lameter 已提交
3367 3368 3369 3370 3371
}

static void free_kmem_cache_nodes(struct kmem_cache *s)
{
	int node;
C
Christoph Lameter 已提交
3372
	struct kmem_cache_node *n;
C
Christoph Lameter 已提交
3373

C
Christoph Lameter 已提交
3374
	for_each_kmem_cache_node(s, node, n) {
C
Christoph Lameter 已提交
3375
		s->node[node] = NULL;
3376
		kmem_cache_free(kmem_cache_node, n);
C
Christoph Lameter 已提交
3377 3378 3379
	}
}

3380 3381
void __kmem_cache_release(struct kmem_cache *s)
{
T
Thomas Garnier 已提交
3382
	cache_random_seq_destroy(s);
3383 3384 3385 3386
	free_percpu(s->cpu_slab);
	free_kmem_cache_nodes(s);
}

3387
static int init_kmem_cache_nodes(struct kmem_cache *s)
C
Christoph Lameter 已提交
3388 3389 3390
{
	int node;

C
Christoph Lameter 已提交
3391
	for_each_node_state(node, N_NORMAL_MEMORY) {
C
Christoph Lameter 已提交
3392 3393
		struct kmem_cache_node *n;

3394
		if (slab_state == DOWN) {
3395
			early_kmem_cache_node_alloc(node);
3396 3397
			continue;
		}
3398
		n = kmem_cache_alloc_node(kmem_cache_node,
3399
						GFP_KERNEL, node);
C
Christoph Lameter 已提交
3400

3401 3402 3403
		if (!n) {
			free_kmem_cache_nodes(s);
			return 0;
C
Christoph Lameter 已提交
3404
		}
3405

3406
		init_kmem_cache_node(n);
3407
		s->node[node] = n;
C
Christoph Lameter 已提交
3408 3409 3410 3411
	}
	return 1;
}

3412
static void set_min_partial(struct kmem_cache *s, unsigned long min)
3413 3414 3415 3416 3417 3418 3419 3420
{
	if (min < MIN_PARTIAL)
		min = MIN_PARTIAL;
	else if (min > MAX_PARTIAL)
		min = MAX_PARTIAL;
	s->min_partial = min;
}

3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 3453
static void set_cpu_partial(struct kmem_cache *s)
{
#ifdef CONFIG_SLUB_CPU_PARTIAL
	/*
	 * cpu_partial determined the maximum number of objects kept in the
	 * per cpu partial lists of a processor.
	 *
	 * Per cpu partial lists mainly contain slabs that just have one
	 * object freed. If they are used for allocation then they can be
	 * filled up again with minimal effort. The slab will never hit the
	 * per node partial lists and therefore no locking will be required.
	 *
	 * This setting also determines
	 *
	 * A) The number of objects from per cpu partial slabs dumped to the
	 *    per node list when we reach the limit.
	 * B) The number of objects in cpu partial slabs to extract from the
	 *    per node list when we run out of per cpu objects. We only fetch
	 *    50% to keep some capacity around for frees.
	 */
	if (!kmem_cache_has_cpu_partial(s))
		s->cpu_partial = 0;
	else if (s->size >= PAGE_SIZE)
		s->cpu_partial = 2;
	else if (s->size >= 1024)
		s->cpu_partial = 6;
	else if (s->size >= 256)
		s->cpu_partial = 13;
	else
		s->cpu_partial = 30;
#endif
}

C
Christoph Lameter 已提交
3454 3455 3456 3457
/*
 * calculate_sizes() determines the order and the distribution of data within
 * a slab object.
 */
3458
static int calculate_sizes(struct kmem_cache *s, int forced_order)
C
Christoph Lameter 已提交
3459
{
3460
	slab_flags_t flags = s->flags;
3461
	size_t size = s->object_size;
3462
	int order;
C
Christoph Lameter 已提交
3463

3464 3465 3466 3467 3468 3469 3470 3471
	/*
	 * Round up object size to the next word boundary. We can only
	 * place the free pointer at word boundaries and this determines
	 * the possible location of the free pointer.
	 */
	size = ALIGN(size, sizeof(void *));

#ifdef CONFIG_SLUB_DEBUG
C
Christoph Lameter 已提交
3472 3473 3474 3475 3476
	/*
	 * Determine if we can poison the object itself. If the user of
	 * the slab may touch the object after free or before allocation
	 * then we should never poison the object itself.
	 */
3477
	if ((flags & SLAB_POISON) && !(flags & SLAB_TYPESAFE_BY_RCU) &&
3478
			!s->ctor)
C
Christoph Lameter 已提交
3479 3480 3481 3482 3483 3484
		s->flags |= __OBJECT_POISON;
	else
		s->flags &= ~__OBJECT_POISON;


	/*
C
Christoph Lameter 已提交
3485
	 * If we are Redzoning then check if there is some space between the
C
Christoph Lameter 已提交
3486
	 * end of the object and the free pointer. If not then add an
C
Christoph Lameter 已提交
3487
	 * additional word to have some bytes to store Redzone information.
C
Christoph Lameter 已提交
3488
	 */
3489
	if ((flags & SLAB_RED_ZONE) && size == s->object_size)
C
Christoph Lameter 已提交
3490
		size += sizeof(void *);
C
Christoph Lameter 已提交
3491
#endif
C
Christoph Lameter 已提交
3492 3493

	/*
C
Christoph Lameter 已提交
3494 3495
	 * With that we have determined the number of bytes in actual use
	 * by the object. This is the potential offset to the free pointer.
C
Christoph Lameter 已提交
3496 3497 3498
	 */
	s->inuse = size;

3499
	if (((flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) ||
3500
		s->ctor)) {
C
Christoph Lameter 已提交
3501 3502 3503 3504 3505 3506 3507 3508 3509 3510 3511 3512
		/*
		 * Relocate free pointer after the object if it is not
		 * permitted to overwrite the first word of the object on
		 * kmem_cache_free.
		 *
		 * This is the case if we do RCU, have a constructor or
		 * destructor or are poisoning the objects.
		 */
		s->offset = size;
		size += sizeof(void *);
	}

3513
#ifdef CONFIG_SLUB_DEBUG
C
Christoph Lameter 已提交
3514 3515 3516 3517 3518 3519
	if (flags & SLAB_STORE_USER)
		/*
		 * Need to store information about allocs and frees after
		 * the object.
		 */
		size += 2 * sizeof(struct track);
3520
#endif
C
Christoph Lameter 已提交
3521

3522 3523
	kasan_cache_create(s, &size, &s->flags);
#ifdef CONFIG_SLUB_DEBUG
J
Joonsoo Kim 已提交
3524
	if (flags & SLAB_RED_ZONE) {
C
Christoph Lameter 已提交
3525 3526 3527 3528
		/*
		 * Add some empty padding so that we can catch
		 * overwrites from earlier objects rather than let
		 * tracking information or the free pointer be
3529
		 * corrupted if a user writes before the start
C
Christoph Lameter 已提交
3530 3531 3532
		 * of the object.
		 */
		size += sizeof(void *);
J
Joonsoo Kim 已提交
3533 3534 3535 3536 3537

		s->red_left_pad = sizeof(void *);
		s->red_left_pad = ALIGN(s->red_left_pad, s->align);
		size += s->red_left_pad;
	}
C
Christoph Lameter 已提交
3538
#endif
C
Christoph Lameter 已提交
3539

C
Christoph Lameter 已提交
3540 3541 3542 3543 3544
	/*
	 * SLUB stores one object immediately after another beginning from
	 * offset 0. In order to align the objects we have to simply size
	 * each object to conform to the alignment.
	 */
3545
	size = ALIGN(size, s->align);
C
Christoph Lameter 已提交
3546
	s->size = size;
3547 3548 3549
	if (forced_order >= 0)
		order = forced_order;
	else
3550
		order = calculate_order(size, s->reserved);
C
Christoph Lameter 已提交
3551

3552
	if (order < 0)
C
Christoph Lameter 已提交
3553 3554
		return 0;

3555
	s->allocflags = 0;
3556
	if (order)
3557 3558 3559
		s->allocflags |= __GFP_COMP;

	if (s->flags & SLAB_CACHE_DMA)
3560
		s->allocflags |= GFP_DMA;
3561 3562 3563 3564

	if (s->flags & SLAB_RECLAIM_ACCOUNT)
		s->allocflags |= __GFP_RECLAIMABLE;

C
Christoph Lameter 已提交
3565 3566 3567
	/*
	 * Determine the number of objects per slab
	 */
3568 3569
	s->oo = oo_make(order, size, s->reserved);
	s->min = oo_make(get_order(size), size, s->reserved);
3570 3571
	if (oo_objects(s->oo) > oo_objects(s->max))
		s->max = s->oo;
C
Christoph Lameter 已提交
3572

3573
	return !!oo_objects(s->oo);
C
Christoph Lameter 已提交
3574 3575
}

3576
static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
C
Christoph Lameter 已提交
3577
{
3578
	s->flags = kmem_cache_flags(s->size, flags, s->name, s->ctor);
3579
	s->reserved = 0;
3580 3581 3582
#ifdef CONFIG_SLAB_FREELIST_HARDENED
	s->random = get_random_long();
#endif
C
Christoph Lameter 已提交
3583

3584
	if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU))
3585
		s->reserved = sizeof(struct rcu_head);
C
Christoph Lameter 已提交
3586

3587
	if (!calculate_sizes(s, -1))
C
Christoph Lameter 已提交
3588
		goto error;
3589 3590 3591 3592 3593
	if (disable_higher_order_debug) {
		/*
		 * Disable debugging flags that store metadata if the min slab
		 * order increased.
		 */
3594
		if (get_order(s->size) > get_order(s->object_size)) {
3595 3596 3597 3598 3599 3600
			s->flags &= ~DEBUG_METADATA_FLAGS;
			s->offset = 0;
			if (!calculate_sizes(s, -1))
				goto error;
		}
	}
C
Christoph Lameter 已提交
3601

3602 3603
#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
    defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
3604
	if (system_has_cmpxchg_double() && (s->flags & SLAB_NO_CMPXCHG) == 0)
3605 3606 3607 3608
		/* Enable fast mode */
		s->flags |= __CMPXCHG_DOUBLE;
#endif

3609 3610 3611 3612
	/*
	 * The larger the object size is, the more pages we want on the partial
	 * list to avoid pounding the page allocator excessively.
	 */
3613 3614
	set_min_partial(s, ilog2(s->size) / 2);

3615
	set_cpu_partial(s);
3616

C
Christoph Lameter 已提交
3617
#ifdef CONFIG_NUMA
3618
	s->remote_node_defrag_ratio = 1000;
C
Christoph Lameter 已提交
3619
#endif
T
Thomas Garnier 已提交
3620 3621 3622 3623 3624 3625 3626

	/* Initialize the pre-computed randomized freelist if slab is up */
	if (slab_state >= UP) {
		if (init_cache_random_seq(s))
			goto error;
	}

3627
	if (!init_kmem_cache_nodes(s))
3628
		goto error;
C
Christoph Lameter 已提交
3629

3630
	if (alloc_kmem_cache_cpus(s))
3631
		return 0;
3632

3633
	free_kmem_cache_nodes(s);
C
Christoph Lameter 已提交
3634 3635
error:
	if (flags & SLAB_PANIC)
J
Joe Perches 已提交
3636 3637
		panic("Cannot create slab %s size=%lu realsize=%u order=%u offset=%u flags=%lx\n",
		      s->name, (unsigned long)s->size, s->size,
3638
		      oo_order(s->oo), s->offset, (unsigned long)flags);
3639
	return -EINVAL;
C
Christoph Lameter 已提交
3640 3641
}

3642 3643 3644 3645 3646 3647
static void list_slab_objects(struct kmem_cache *s, struct page *page,
							const char *text)
{
#ifdef CONFIG_SLUB_DEBUG
	void *addr = page_address(page);
	void *p;
N
Namhyung Kim 已提交
3648 3649
	unsigned long *map = kzalloc(BITS_TO_LONGS(page->objects) *
				     sizeof(long), GFP_ATOMIC);
E
Eric Dumazet 已提交
3650 3651
	if (!map)
		return;
3652
	slab_err(s, page, text, s->name);
3653 3654
	slab_lock(page);

3655
	get_map(s, page, map);
3656 3657 3658
	for_each_object(p, s, addr, page->objects) {

		if (!test_bit(slab_index(p, s, addr), map)) {
3659
			pr_err("INFO: Object 0x%p @offset=%tu\n", p, p - addr);
3660 3661 3662 3663
			print_tracking(s, p);
		}
	}
	slab_unlock(page);
E
Eric Dumazet 已提交
3664
	kfree(map);
3665 3666 3667
#endif
}

C
Christoph Lameter 已提交
3668
/*
C
Christoph Lameter 已提交
3669
 * Attempt to free all partial slabs on a node.
3670 3671
 * This is called from __kmem_cache_shutdown(). We must take list_lock
 * because sysfs file might still access partial list after the shutdowning.
C
Christoph Lameter 已提交
3672
 */
C
Christoph Lameter 已提交
3673
static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
C
Christoph Lameter 已提交
3674
{
3675
	LIST_HEAD(discard);
C
Christoph Lameter 已提交
3676 3677
	struct page *page, *h;

3678 3679
	BUG_ON(irqs_disabled());
	spin_lock_irq(&n->list_lock);
3680
	list_for_each_entry_safe(page, h, &n->partial, lru) {
C
Christoph Lameter 已提交
3681
		if (!page->inuse) {
3682
			remove_partial(n, page);
3683
			list_add(&page->lru, &discard);
3684 3685
		} else {
			list_slab_objects(s, page,
3686
			"Objects remaining in %s on __kmem_cache_shutdown()");
C
Christoph Lameter 已提交
3687
		}
3688
	}
3689
	spin_unlock_irq(&n->list_lock);
3690 3691 3692

	list_for_each_entry_safe(page, h, &discard, lru)
		discard_slab(s, page);
C
Christoph Lameter 已提交
3693 3694 3695
}

/*
C
Christoph Lameter 已提交
3696
 * Release all resources used by a slab cache.
C
Christoph Lameter 已提交
3697
 */
3698
int __kmem_cache_shutdown(struct kmem_cache *s)
C
Christoph Lameter 已提交
3699 3700
{
	int node;
C
Christoph Lameter 已提交
3701
	struct kmem_cache_node *n;
C
Christoph Lameter 已提交
3702 3703 3704

	flush_all(s);
	/* Attempt to free all objects */
C
Christoph Lameter 已提交
3705
	for_each_kmem_cache_node(s, node, n) {
C
Christoph Lameter 已提交
3706 3707
		free_partial(s, n);
		if (n->nr_partial || slabs_node(s, node))
C
Christoph Lameter 已提交
3708 3709
			return 1;
	}
3710
	sysfs_slab_remove(s);
C
Christoph Lameter 已提交
3711 3712 3713 3714 3715 3716 3717 3718 3719
	return 0;
}

/********************************************************************
 *		Kmalloc subsystem
 *******************************************************************/

static int __init setup_slub_min_order(char *str)
{
P
Pekka Enberg 已提交
3720
	get_option(&str, &slub_min_order);
C
Christoph Lameter 已提交
3721 3722 3723 3724 3725 3726 3727 3728

	return 1;
}

__setup("slub_min_order=", setup_slub_min_order);

static int __init setup_slub_max_order(char *str)
{
P
Pekka Enberg 已提交
3729
	get_option(&str, &slub_max_order);
D
David Rientjes 已提交
3730
	slub_max_order = min(slub_max_order, MAX_ORDER - 1);
C
Christoph Lameter 已提交
3731 3732 3733 3734 3735 3736 3737 3738

	return 1;
}

__setup("slub_max_order=", setup_slub_max_order);

static int __init setup_slub_min_objects(char *str)
{
P
Pekka Enberg 已提交
3739
	get_option(&str, &slub_min_objects);
C
Christoph Lameter 已提交
3740 3741 3742 3743 3744 3745 3746 3747

	return 1;
}

__setup("slub_min_objects=", setup_slub_min_objects);

void *__kmalloc(size_t size, gfp_t flags)
{
3748
	struct kmem_cache *s;
E
Eduard - Gabriel Munteanu 已提交
3749
	void *ret;
C
Christoph Lameter 已提交
3750

3751
	if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
3752
		return kmalloc_large(size, flags);
3753

3754
	s = kmalloc_slab(size, flags);
3755 3756

	if (unlikely(ZERO_OR_NULL_PTR(s)))
3757 3758
		return s;

3759
	ret = slab_alloc(s, flags, _RET_IP_);
E
Eduard - Gabriel Munteanu 已提交
3760

3761
	trace_kmalloc(_RET_IP_, ret, size, s->size, flags);
E
Eduard - Gabriel Munteanu 已提交
3762

3763
	kasan_kmalloc(s, ret, size, flags);
3764

E
Eduard - Gabriel Munteanu 已提交
3765
	return ret;
C
Christoph Lameter 已提交
3766 3767 3768
}
EXPORT_SYMBOL(__kmalloc);

3769
#ifdef CONFIG_NUMA
3770 3771
static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
{
3772
	struct page *page;
3773
	void *ptr = NULL;
3774

3775
	flags |= __GFP_COMP;
3776
	page = alloc_pages_node(node, flags, get_order(size));
3777
	if (page)
3778 3779
		ptr = page_address(page);

3780
	kmalloc_large_node_hook(ptr, size, flags);
3781
	return ptr;
3782 3783
}

C
Christoph Lameter 已提交
3784 3785
void *__kmalloc_node(size_t size, gfp_t flags, int node)
{
3786
	struct kmem_cache *s;
E
Eduard - Gabriel Munteanu 已提交
3787
	void *ret;
C
Christoph Lameter 已提交
3788

3789
	if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) {
E
Eduard - Gabriel Munteanu 已提交
3790 3791
		ret = kmalloc_large_node(size, flags, node);

3792 3793 3794
		trace_kmalloc_node(_RET_IP_, ret,
				   size, PAGE_SIZE << get_order(size),
				   flags, node);
E
Eduard - Gabriel Munteanu 已提交
3795 3796 3797

		return ret;
	}
3798

3799
	s = kmalloc_slab(size, flags);
3800 3801

	if (unlikely(ZERO_OR_NULL_PTR(s)))
3802 3803
		return s;

3804
	ret = slab_alloc_node(s, flags, node, _RET_IP_);
E
Eduard - Gabriel Munteanu 已提交
3805

3806
	trace_kmalloc_node(_RET_IP_, ret, size, s->size, flags, node);
E
Eduard - Gabriel Munteanu 已提交
3807

3808
	kasan_kmalloc(s, ret, size, flags);
3809

E
Eduard - Gabriel Munteanu 已提交
3810
	return ret;
C
Christoph Lameter 已提交
3811 3812 3813 3814
}
EXPORT_SYMBOL(__kmalloc_node);
#endif

K
Kees Cook 已提交
3815 3816
#ifdef CONFIG_HARDENED_USERCOPY
/*
3817 3818 3819
 * Rejects incorrectly sized objects and objects that are to be copied
 * to/from userspace but do not fall entirely within the containing slab
 * cache's usercopy region.
K
Kees Cook 已提交
3820 3821 3822 3823
 *
 * Returns NULL if check passes, otherwise const char * to name of cache
 * to indicate an error.
 */
3824 3825
void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
			 bool to_user)
K
Kees Cook 已提交
3826 3827 3828 3829 3830 3831 3832 3833 3834 3835
{
	struct kmem_cache *s;
	unsigned long offset;
	size_t object_size;

	/* Find object and usable object size. */
	s = page->slab_cache;

	/* Reject impossible pointers. */
	if (ptr < page_address(page))
3836 3837
		usercopy_abort("SLUB object not in SLUB page?!", NULL,
			       to_user, 0, n);
K
Kees Cook 已提交
3838 3839 3840 3841 3842 3843 3844

	/* Find offset within object. */
	offset = (ptr - page_address(page)) % s->size;

	/* Adjust for redzone and reject if within the redzone. */
	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) {
		if (offset < s->red_left_pad)
3845 3846
			usercopy_abort("SLUB object in left red zone",
				       s->name, to_user, offset, n);
K
Kees Cook 已提交
3847 3848 3849
		offset -= s->red_left_pad;
	}

3850 3851 3852 3853
	/* Allow address range falling entirely within usercopy region. */
	if (offset >= s->useroffset &&
	    offset - s->useroffset <= s->usersize &&
	    n <= s->useroffset - offset + s->usersize)
3854
		return;
K
Kees Cook 已提交
3855

3856 3857 3858 3859 3860 3861 3862
	/*
	 * If the copy is still within the allocated object, produce
	 * a warning instead of rejecting the copy. This is intended
	 * to be a temporary method to find any missing usercopy
	 * whitelists.
	 */
	object_size = slab_ksize(s);
3863 3864
	if (usercopy_fallback &&
	    offset <= object_size && n <= object_size - offset) {
3865 3866 3867
		usercopy_warn("SLUB object", s->name, to_user, offset, n);
		return;
	}
K
Kees Cook 已提交
3868

3869
	usercopy_abort("SLUB object", s->name, to_user, offset, n);
K
Kees Cook 已提交
3870 3871 3872
}
#endif /* CONFIG_HARDENED_USERCOPY */

3873
static size_t __ksize(const void *object)
C
Christoph Lameter 已提交
3874
{
3875
	struct page *page;
C
Christoph Lameter 已提交
3876

3877
	if (unlikely(object == ZERO_SIZE_PTR))
3878 3879
		return 0;

3880 3881
	page = virt_to_head_page(object);

P
Pekka Enberg 已提交
3882 3883
	if (unlikely(!PageSlab(page))) {
		WARN_ON(!PageCompound(page));
3884
		return PAGE_SIZE << compound_order(page);
P
Pekka Enberg 已提交
3885
	}
C
Christoph Lameter 已提交
3886

3887
	return slab_ksize(page->slab_cache);
C
Christoph Lameter 已提交
3888
}
3889 3890 3891 3892 3893

size_t ksize(const void *object)
{
	size_t size = __ksize(object);
	/* We assume that ksize callers could use whole allocated area,
3894 3895 3896
	 * so we need to unpoison this area.
	 */
	kasan_unpoison_shadow(object, size);
3897 3898
	return size;
}
K
Kirill A. Shutemov 已提交
3899
EXPORT_SYMBOL(ksize);
C
Christoph Lameter 已提交
3900 3901 3902 3903

void kfree(const void *x)
{
	struct page *page;
3904
	void *object = (void *)x;
C
Christoph Lameter 已提交
3905

3906 3907
	trace_kfree(_RET_IP_, x);

3908
	if (unlikely(ZERO_OR_NULL_PTR(x)))
C
Christoph Lameter 已提交
3909 3910
		return;

3911
	page = virt_to_head_page(x);
3912
	if (unlikely(!PageSlab(page))) {
3913
		BUG_ON(!PageCompound(page));
3914
		kfree_hook(object);
3915
		__free_pages(page, compound_order(page));
3916 3917
		return;
	}
3918
	slab_free(page->slab_cache, page, object, NULL, 1, _RET_IP_);
C
Christoph Lameter 已提交
3919 3920 3921
}
EXPORT_SYMBOL(kfree);

3922 3923
#define SHRINK_PROMOTE_MAX 32

3924
/*
3925 3926 3927
 * kmem_cache_shrink discards empty slabs and promotes the slabs filled
 * up most to the head of the partial lists. New allocations will then
 * fill those up and thus they can be removed from the partial lists.
C
Christoph Lameter 已提交
3928 3929 3930 3931
 *
 * The slabs with the least items are placed last. This results in them
 * being allocated from last increasing the chance that the last objects
 * are freed in them.
3932
 */
3933
int __kmem_cache_shrink(struct kmem_cache *s)
3934 3935 3936 3937 3938 3939
{
	int node;
	int i;
	struct kmem_cache_node *n;
	struct page *page;
	struct page *t;
3940 3941
	struct list_head discard;
	struct list_head promote[SHRINK_PROMOTE_MAX];
3942
	unsigned long flags;
3943
	int ret = 0;
3944 3945

	flush_all(s);
C
Christoph Lameter 已提交
3946
	for_each_kmem_cache_node(s, node, n) {
3947 3948 3949
		INIT_LIST_HEAD(&discard);
		for (i = 0; i < SHRINK_PROMOTE_MAX; i++)
			INIT_LIST_HEAD(promote + i);
3950 3951 3952 3953

		spin_lock_irqsave(&n->list_lock, flags);

		/*
3954
		 * Build lists of slabs to discard or promote.
3955
		 *
C
Christoph Lameter 已提交
3956 3957
		 * Note that concurrent frees may occur while we hold the
		 * list_lock. page->inuse here is the upper limit.
3958 3959
		 */
		list_for_each_entry_safe(page, t, &n->partial, lru) {
3960 3961 3962 3963 3964 3965 3966 3967 3968 3969
			int free = page->objects - page->inuse;

			/* Do not reread page->inuse */
			barrier();

			/* We do not keep full slabs on the list */
			BUG_ON(free <= 0);

			if (free == page->objects) {
				list_move(&page->lru, &discard);
3970
				n->nr_partial--;
3971 3972
			} else if (free <= SHRINK_PROMOTE_MAX)
				list_move(&page->lru, promote + free - 1);
3973 3974 3975
		}

		/*
3976 3977
		 * Promote the slabs filled up most to the head of the
		 * partial list.
3978
		 */
3979 3980
		for (i = SHRINK_PROMOTE_MAX - 1; i >= 0; i--)
			list_splice(promote + i, &n->partial);
3981 3982

		spin_unlock_irqrestore(&n->list_lock, flags);
3983 3984

		/* Release empty slabs */
3985
		list_for_each_entry_safe(page, t, &discard, lru)
3986
			discard_slab(s, page);
3987 3988 3989

		if (slabs_node(s, node))
			ret = 1;
3990 3991
	}

3992
	return ret;
3993 3994
}

3995
#ifdef CONFIG_MEMCG
3996 3997
static void kmemcg_cache_deact_after_rcu(struct kmem_cache *s)
{
3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011
	/*
	 * Called with all the locks held after a sched RCU grace period.
	 * Even if @s becomes empty after shrinking, we can't know that @s
	 * doesn't have allocations already in-flight and thus can't
	 * destroy @s until the associated memcg is released.
	 *
	 * However, let's remove the sysfs files for empty caches here.
	 * Each cache has a lot of interface files which aren't
	 * particularly useful for empty draining caches; otherwise, we can
	 * easily end up with millions of unnecessary sysfs files on
	 * systems which have a lot of memory and transient cgroups.
	 */
	if (!__kmem_cache_shrink(s))
		sysfs_slab_remove(s);
4012 4013
}

4014 4015 4016 4017 4018 4019
void __kmemcg_cache_deactivate(struct kmem_cache *s)
{
	/*
	 * Disable empty slabs caching. Used to avoid pinning offline
	 * memory cgroups by kmem pages that can be freed.
	 */
4020
	slub_set_cpu_partial(s, 0);
4021 4022 4023 4024
	s->min_partial = 0;

	/*
	 * s->cpu_partial is checked locklessly (see put_cpu_partial), so
4025
	 * we have to make sure the change is visible before shrinking.
4026
	 */
4027
	slab_deactivate_memcg_cache_rcu_sched(s, kmemcg_cache_deact_after_rcu);
4028 4029 4030
}
#endif

4031 4032 4033 4034
static int slab_mem_going_offline_callback(void *arg)
{
	struct kmem_cache *s;

4035
	mutex_lock(&slab_mutex);
4036
	list_for_each_entry(s, &slab_caches, list)
4037
		__kmem_cache_shrink(s);
4038
	mutex_unlock(&slab_mutex);
4039 4040 4041 4042 4043 4044 4045 4046 4047 4048 4049

	return 0;
}

static void slab_mem_offline_callback(void *arg)
{
	struct kmem_cache_node *n;
	struct kmem_cache *s;
	struct memory_notify *marg = arg;
	int offline_node;

4050
	offline_node = marg->status_change_nid_normal;
4051 4052 4053 4054 4055 4056 4057 4058

	/*
	 * If the node still has available memory. we need kmem_cache_node
	 * for it yet.
	 */
	if (offline_node < 0)
		return;

4059
	mutex_lock(&slab_mutex);
4060 4061 4062 4063 4064 4065
	list_for_each_entry(s, &slab_caches, list) {
		n = get_node(s, offline_node);
		if (n) {
			/*
			 * if n->nr_slabs > 0, slabs still exist on the node
			 * that is going down. We were unable to free them,
4066
			 * and offline_pages() function shouldn't call this
4067 4068
			 * callback. So, we must fail.
			 */
4069
			BUG_ON(slabs_node(s, offline_node));
4070 4071

			s->node[offline_node] = NULL;
4072
			kmem_cache_free(kmem_cache_node, n);
4073 4074
		}
	}
4075
	mutex_unlock(&slab_mutex);
4076 4077 4078 4079 4080 4081 4082
}

static int slab_mem_going_online_callback(void *arg)
{
	struct kmem_cache_node *n;
	struct kmem_cache *s;
	struct memory_notify *marg = arg;
4083
	int nid = marg->status_change_nid_normal;
4084 4085 4086 4087 4088 4089 4090 4091 4092 4093
	int ret = 0;

	/*
	 * If the node's memory is already available, then kmem_cache_node is
	 * already created. Nothing to do.
	 */
	if (nid < 0)
		return 0;

	/*
4094
	 * We are bringing a node online. No memory is available yet. We must
4095 4096 4097
	 * allocate a kmem_cache_node structure in order to bring the node
	 * online.
	 */
4098
	mutex_lock(&slab_mutex);
4099 4100 4101 4102 4103 4104
	list_for_each_entry(s, &slab_caches, list) {
		/*
		 * XXX: kmem_cache_alloc_node will fallback to other nodes
		 *      since memory is not yet available from the node that
		 *      is brought up.
		 */
4105
		n = kmem_cache_alloc(kmem_cache_node, GFP_KERNEL);
4106 4107 4108 4109
		if (!n) {
			ret = -ENOMEM;
			goto out;
		}
4110
		init_kmem_cache_node(n);
4111 4112 4113
		s->node[nid] = n;
	}
out:
4114
	mutex_unlock(&slab_mutex);
4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137
	return ret;
}

static int slab_memory_callback(struct notifier_block *self,
				unsigned long action, void *arg)
{
	int ret = 0;

	switch (action) {
	case MEM_GOING_ONLINE:
		ret = slab_mem_going_online_callback(arg);
		break;
	case MEM_GOING_OFFLINE:
		ret = slab_mem_going_offline_callback(arg);
		break;
	case MEM_OFFLINE:
	case MEM_CANCEL_ONLINE:
		slab_mem_offline_callback(arg);
		break;
	case MEM_ONLINE:
	case MEM_CANCEL_OFFLINE:
		break;
	}
4138 4139 4140 4141
	if (ret)
		ret = notifier_from_errno(ret);
	else
		ret = NOTIFY_OK;
4142 4143 4144
	return ret;
}

4145 4146 4147 4148
static struct notifier_block slab_memory_callback_nb = {
	.notifier_call = slab_memory_callback,
	.priority = SLAB_CALLBACK_PRI,
};
4149

C
Christoph Lameter 已提交
4150 4151 4152 4153
/********************************************************************
 *			Basic setup of slabs
 *******************************************************************/

4154 4155
/*
 * Used for early kmem_cache structures that were allocated using
4156 4157
 * the page allocator. Allocate them properly then fix up the pointers
 * that may be pointing to the wrong kmem_cache structure.
4158 4159
 */

4160
static struct kmem_cache * __init bootstrap(struct kmem_cache *static_cache)
4161 4162
{
	int node;
4163
	struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT);
C
Christoph Lameter 已提交
4164
	struct kmem_cache_node *n;
4165

4166
	memcpy(s, static_cache, kmem_cache->object_size);
4167

4168 4169 4170 4171 4172 4173
	/*
	 * This runs very early, and only the boot processor is supposed to be
	 * up.  Even if it weren't true, IRQs are not up so we couldn't fire
	 * IPIs around.
	 */
	__flush_cpu_slab(s, smp_processor_id());
C
Christoph Lameter 已提交
4174
	for_each_kmem_cache_node(s, node, n) {
4175 4176
		struct page *p;

C
Christoph Lameter 已提交
4177 4178
		list_for_each_entry(p, &n->partial, lru)
			p->slab_cache = s;
4179

L
Li Zefan 已提交
4180
#ifdef CONFIG_SLUB_DEBUG
C
Christoph Lameter 已提交
4181 4182
		list_for_each_entry(p, &n->full, lru)
			p->slab_cache = s;
4183 4184
#endif
	}
4185
	slab_init_memcg_params(s);
4186
	list_add(&s->list, &slab_caches);
4187
	memcg_link_cache(s);
4188
	return s;
4189 4190
}

C
Christoph Lameter 已提交
4191 4192
void __init kmem_cache_init(void)
{
4193 4194
	static __initdata struct kmem_cache boot_kmem_cache,
		boot_kmem_cache_node;
4195

4196 4197 4198
	if (debug_guardpage_minorder())
		slub_max_order = 0;

4199 4200
	kmem_cache_node = &boot_kmem_cache_node;
	kmem_cache = &boot_kmem_cache;
4201

4202
	create_boot_cache(kmem_cache_node, "kmem_cache_node",
4203
		sizeof(struct kmem_cache_node), SLAB_HWCACHE_ALIGN, 0, 0);
4204

4205
	register_hotmemory_notifier(&slab_memory_callback_nb);
C
Christoph Lameter 已提交
4206 4207 4208 4209

	/* Able to allocate the per node structures */
	slab_state = PARTIAL;

4210 4211 4212
	create_boot_cache(kmem_cache, "kmem_cache",
			offsetof(struct kmem_cache, node) +
				nr_node_ids * sizeof(struct kmem_cache_node *),
4213
		       SLAB_HWCACHE_ALIGN, 0, 0);
4214

4215
	kmem_cache = bootstrap(&boot_kmem_cache);
C
Christoph Lameter 已提交
4216

4217 4218 4219 4220 4221
	/*
	 * Allocate kmem_cache_node properly from the kmem_cache slab.
	 * kmem_cache_node is separately allocated so no need to
	 * update any list pointers.
	 */
4222
	kmem_cache_node = bootstrap(&boot_kmem_cache_node);
4223 4224

	/* Now we can use the kmem_cache to allocate kmalloc slabs */
4225
	setup_kmalloc_cache_index_table();
4226
	create_kmalloc_caches(0);
C
Christoph Lameter 已提交
4227

T
Thomas Garnier 已提交
4228 4229 4230
	/* Setup random freelists for each cache */
	init_freelist_randomization();

4231 4232
	cpuhp_setup_state_nocalls(CPUHP_SLUB_DEAD, "slub:dead", NULL,
				  slub_cpu_dead);
C
Christoph Lameter 已提交
4233

4234
	pr_info("SLUB: HWalign=%d, Order=%d-%d, MinObjects=%d, CPUs=%u, Nodes=%d\n",
4235
		cache_line_size(),
C
Christoph Lameter 已提交
4236 4237 4238 4239
		slub_min_order, slub_max_order, slub_min_objects,
		nr_cpu_ids, nr_node_ids);
}

4240 4241 4242 4243
void __init kmem_cache_init_late(void)
{
}

4244
struct kmem_cache *
4245
__kmem_cache_alias(const char *name, size_t size, size_t align,
4246
		   slab_flags_t flags, void (*ctor)(void *))
C
Christoph Lameter 已提交
4247
{
4248
	struct kmem_cache *s, *c;
C
Christoph Lameter 已提交
4249

4250
	s = find_mergeable(size, align, flags, name, ctor);
C
Christoph Lameter 已提交
4251 4252
	if (s) {
		s->refcount++;
4253

C
Christoph Lameter 已提交
4254 4255 4256 4257
		/*
		 * Adjust the object sizes so that we clear
		 * the complete object on kzalloc.
		 */
4258
		s->object_size = max(s->object_size, (int)size);
C
Christoph Lameter 已提交
4259
		s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
C
Christoph Lameter 已提交
4260

4261
		for_each_memcg_cache(c, s) {
4262 4263 4264 4265 4266
			c->object_size = s->object_size;
			c->inuse = max_t(int, c->inuse,
					 ALIGN(size, sizeof(void *)));
		}

4267 4268
		if (sysfs_slab_alias(s, name)) {
			s->refcount--;
4269
			s = NULL;
4270
		}
4271
	}
C
Christoph Lameter 已提交
4272

4273 4274
	return s;
}
P
Pekka Enberg 已提交
4275

4276
int __kmem_cache_create(struct kmem_cache *s, slab_flags_t flags)
4277
{
4278 4279 4280 4281 4282
	int err;

	err = kmem_cache_open(s, flags);
	if (err)
		return err;
4283

4284 4285 4286 4287
	/* Mutex is not taken during early boot */
	if (slab_state <= UP)
		return 0;

4288
	memcg_propagate_slab_attrs(s);
4289 4290
	err = sysfs_slab_add(s);
	if (err)
4291
		__kmem_cache_release(s);
4292

4293
	return err;
C
Christoph Lameter 已提交
4294 4295
}

4296
void *__kmalloc_track_caller(size_t size, gfp_t gfpflags, unsigned long caller)
C
Christoph Lameter 已提交
4297
{
4298
	struct kmem_cache *s;
4299
	void *ret;
4300

4301
	if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
4302 4303
		return kmalloc_large(size, gfpflags);

4304
	s = kmalloc_slab(size, gfpflags);
C
Christoph Lameter 已提交
4305

4306
	if (unlikely(ZERO_OR_NULL_PTR(s)))
4307
		return s;
C
Christoph Lameter 已提交
4308

4309
	ret = slab_alloc(s, gfpflags, caller);
4310

L
Lucas De Marchi 已提交
4311
	/* Honor the call site pointer we received. */
4312
	trace_kmalloc(caller, ret, size, s->size, gfpflags);
4313 4314

	return ret;
C
Christoph Lameter 已提交
4315 4316
}

4317
#ifdef CONFIG_NUMA
C
Christoph Lameter 已提交
4318
void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
4319
					int node, unsigned long caller)
C
Christoph Lameter 已提交
4320
{
4321
	struct kmem_cache *s;
4322
	void *ret;
4323

4324
	if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) {
4325 4326 4327 4328 4329 4330 4331 4332
		ret = kmalloc_large_node(size, gfpflags, node);

		trace_kmalloc_node(caller, ret,
				   size, PAGE_SIZE << get_order(size),
				   gfpflags, node);

		return ret;
	}
4333

4334
	s = kmalloc_slab(size, gfpflags);
C
Christoph Lameter 已提交
4335

4336
	if (unlikely(ZERO_OR_NULL_PTR(s)))
4337
		return s;
C
Christoph Lameter 已提交
4338

4339
	ret = slab_alloc_node(s, gfpflags, node, caller);
4340

L
Lucas De Marchi 已提交
4341
	/* Honor the call site pointer we received. */
4342
	trace_kmalloc_node(caller, ret, size, s->size, gfpflags, node);
4343 4344

	return ret;
C
Christoph Lameter 已提交
4345
}
4346
#endif
C
Christoph Lameter 已提交
4347

4348
#ifdef CONFIG_SYSFS
4349 4350 4351 4352 4353 4354 4355 4356 4357
static int count_inuse(struct page *page)
{
	return page->inuse;
}

static int count_total(struct page *page)
{
	return page->objects;
}
4358
#endif
4359

4360
#ifdef CONFIG_SLUB_DEBUG
4361 4362
static int validate_slab(struct kmem_cache *s, struct page *page,
						unsigned long *map)
4363 4364
{
	void *p;
4365
	void *addr = page_address(page);
4366 4367 4368 4369 4370 4371

	if (!check_slab(s, page) ||
			!on_freelist(s, page, NULL))
		return 0;

	/* Now we know that a valid freelist exists */
4372
	bitmap_zero(map, page->objects);
4373

4374 4375 4376 4377 4378
	get_map(s, page, map);
	for_each_object(p, s, addr, page->objects) {
		if (test_bit(slab_index(p, s, addr), map))
			if (!check_object(s, page, p, SLUB_RED_INACTIVE))
				return 0;
4379 4380
	}

4381
	for_each_object(p, s, addr, page->objects)
4382
		if (!test_bit(slab_index(p, s, addr), map))
4383
			if (!check_object(s, page, p, SLUB_RED_ACTIVE))
4384 4385 4386 4387
				return 0;
	return 1;
}

4388 4389
static void validate_slab_slab(struct kmem_cache *s, struct page *page,
						unsigned long *map)
4390
{
4391 4392 4393
	slab_lock(page);
	validate_slab(s, page, map);
	slab_unlock(page);
4394 4395
}

4396 4397
static int validate_slab_node(struct kmem_cache *s,
		struct kmem_cache_node *n, unsigned long *map)
4398 4399 4400 4401 4402 4403 4404 4405
{
	unsigned long count = 0;
	struct page *page;
	unsigned long flags;

	spin_lock_irqsave(&n->list_lock, flags);

	list_for_each_entry(page, &n->partial, lru) {
4406
		validate_slab_slab(s, page, map);
4407 4408 4409
		count++;
	}
	if (count != n->nr_partial)
4410 4411
		pr_err("SLUB %s: %ld partial slabs counted but counter=%ld\n",
		       s->name, count, n->nr_partial);
4412 4413 4414 4415 4416

	if (!(s->flags & SLAB_STORE_USER))
		goto out;

	list_for_each_entry(page, &n->full, lru) {
4417
		validate_slab_slab(s, page, map);
4418 4419 4420
		count++;
	}
	if (count != atomic_long_read(&n->nr_slabs))
4421 4422
		pr_err("SLUB: %s %ld slabs counted but counter=%ld\n",
		       s->name, count, atomic_long_read(&n->nr_slabs));
4423 4424 4425 4426 4427 4428

out:
	spin_unlock_irqrestore(&n->list_lock, flags);
	return count;
}

4429
static long validate_slab_cache(struct kmem_cache *s)
4430 4431 4432
{
	int node;
	unsigned long count = 0;
4433
	unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
4434
				sizeof(unsigned long), GFP_KERNEL);
C
Christoph Lameter 已提交
4435
	struct kmem_cache_node *n;
4436 4437 4438

	if (!map)
		return -ENOMEM;
4439 4440

	flush_all(s);
C
Christoph Lameter 已提交
4441
	for_each_kmem_cache_node(s, node, n)
4442 4443
		count += validate_slab_node(s, n, map);
	kfree(map);
4444 4445
	return count;
}
4446
/*
C
Christoph Lameter 已提交
4447
 * Generate lists of code addresses where slabcache objects are allocated
4448 4449 4450 4451 4452
 * and freed.
 */

struct location {
	unsigned long count;
4453
	unsigned long addr;
4454 4455 4456 4457 4458
	long long sum_time;
	long min_time;
	long max_time;
	long min_pid;
	long max_pid;
R
Rusty Russell 已提交
4459
	DECLARE_BITMAP(cpus, NR_CPUS);
4460
	nodemask_t nodes;
4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475
};

struct loc_track {
	unsigned long max;
	unsigned long count;
	struct location *loc;
};

static void free_loc_track(struct loc_track *t)
{
	if (t->max)
		free_pages((unsigned long)t->loc,
			get_order(sizeof(struct location) * t->max));
}

4476
static int alloc_loc_track(struct loc_track *t, unsigned long max, gfp_t flags)
4477 4478 4479 4480 4481 4482
{
	struct location *l;
	int order;

	order = get_order(sizeof(struct location) * max);

4483
	l = (void *)__get_free_pages(flags, order);
4484 4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496
	if (!l)
		return 0;

	if (t->count) {
		memcpy(l, t->loc, sizeof(struct location) * t->count);
		free_loc_track(t);
	}
	t->max = max;
	t->loc = l;
	return 1;
}

static int add_location(struct loc_track *t, struct kmem_cache *s,
4497
				const struct track *track)
4498 4499 4500
{
	long start, end, pos;
	struct location *l;
4501
	unsigned long caddr;
4502
	unsigned long age = jiffies - track->when;
4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517

	start = -1;
	end = t->count;

	for ( ; ; ) {
		pos = start + (end - start + 1) / 2;

		/*
		 * There is nothing at "end". If we end up there
		 * we need to add something to before end.
		 */
		if (pos == end)
			break;

		caddr = t->loc[pos].addr;
4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533
		if (track->addr == caddr) {

			l = &t->loc[pos];
			l->count++;
			if (track->when) {
				l->sum_time += age;
				if (age < l->min_time)
					l->min_time = age;
				if (age > l->max_time)
					l->max_time = age;

				if (track->pid < l->min_pid)
					l->min_pid = track->pid;
				if (track->pid > l->max_pid)
					l->max_pid = track->pid;

R
Rusty Russell 已提交
4534 4535
				cpumask_set_cpu(track->cpu,
						to_cpumask(l->cpus));
4536 4537
			}
			node_set(page_to_nid(virt_to_page(track)), l->nodes);
4538 4539 4540
			return 1;
		}

4541
		if (track->addr < caddr)
4542 4543 4544 4545 4546 4547
			end = pos;
		else
			start = pos;
	}

	/*
C
Christoph Lameter 已提交
4548
	 * Not found. Insert new tracking element.
4549
	 */
4550
	if (t->count >= t->max && !alloc_loc_track(t, 2 * t->max, GFP_ATOMIC))
4551 4552 4553 4554 4555 4556 4557 4558
		return 0;

	l = t->loc + pos;
	if (pos < t->count)
		memmove(l + 1, l,
			(t->count - pos) * sizeof(struct location));
	t->count++;
	l->count = 1;
4559 4560 4561 4562 4563 4564
	l->addr = track->addr;
	l->sum_time = age;
	l->min_time = age;
	l->max_time = age;
	l->min_pid = track->pid;
	l->max_pid = track->pid;
R
Rusty Russell 已提交
4565 4566
	cpumask_clear(to_cpumask(l->cpus));
	cpumask_set_cpu(track->cpu, to_cpumask(l->cpus));
4567 4568
	nodes_clear(l->nodes);
	node_set(page_to_nid(virt_to_page(track)), l->nodes);
4569 4570 4571 4572
	return 1;
}

static void process_slab(struct loc_track *t, struct kmem_cache *s,
E
Eric Dumazet 已提交
4573
		struct page *page, enum track_item alloc,
N
Namhyung Kim 已提交
4574
		unsigned long *map)
4575
{
4576
	void *addr = page_address(page);
4577 4578
	void *p;

4579
	bitmap_zero(map, page->objects);
4580
	get_map(s, page, map);
4581

4582
	for_each_object(p, s, addr, page->objects)
4583 4584
		if (!test_bit(slab_index(p, s, addr), map))
			add_location(t, s, get_track(s, p, alloc));
4585 4586 4587 4588 4589
}

static int list_locations(struct kmem_cache *s, char *buf,
					enum track_item alloc)
{
4590
	int len = 0;
4591
	unsigned long i;
4592
	struct loc_track t = { 0, 0, NULL };
4593
	int node;
E
Eric Dumazet 已提交
4594 4595
	unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
				     sizeof(unsigned long), GFP_KERNEL);
C
Christoph Lameter 已提交
4596
	struct kmem_cache_node *n;
4597

E
Eric Dumazet 已提交
4598
	if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
4599
				     GFP_KERNEL)) {
E
Eric Dumazet 已提交
4600
		kfree(map);
4601
		return sprintf(buf, "Out of memory\n");
E
Eric Dumazet 已提交
4602
	}
4603 4604 4605
	/* Push back cpu slabs */
	flush_all(s);

C
Christoph Lameter 已提交
4606
	for_each_kmem_cache_node(s, node, n) {
4607 4608 4609
		unsigned long flags;
		struct page *page;

4610
		if (!atomic_long_read(&n->nr_slabs))
4611 4612 4613 4614
			continue;

		spin_lock_irqsave(&n->list_lock, flags);
		list_for_each_entry(page, &n->partial, lru)
E
Eric Dumazet 已提交
4615
			process_slab(&t, s, page, alloc, map);
4616
		list_for_each_entry(page, &n->full, lru)
E
Eric Dumazet 已提交
4617
			process_slab(&t, s, page, alloc, map);
4618 4619 4620 4621
		spin_unlock_irqrestore(&n->list_lock, flags);
	}

	for (i = 0; i < t.count; i++) {
4622
		struct location *l = &t.loc[i];
4623

H
Hugh Dickins 已提交
4624
		if (len > PAGE_SIZE - KSYM_SYMBOL_LEN - 100)
4625
			break;
4626
		len += sprintf(buf + len, "%7ld ", l->count);
4627 4628

		if (l->addr)
J
Joe Perches 已提交
4629
			len += sprintf(buf + len, "%pS", (void *)l->addr);
4630
		else
4631
			len += sprintf(buf + len, "<not-available>");
4632 4633

		if (l->sum_time != l->min_time) {
4634
			len += sprintf(buf + len, " age=%ld/%ld/%ld",
R
Roman Zippel 已提交
4635 4636 4637
				l->min_time,
				(long)div_u64(l->sum_time, l->count),
				l->max_time);
4638
		} else
4639
			len += sprintf(buf + len, " age=%ld",
4640 4641 4642
				l->min_time);

		if (l->min_pid != l->max_pid)
4643
			len += sprintf(buf + len, " pid=%ld-%ld",
4644 4645
				l->min_pid, l->max_pid);
		else
4646
			len += sprintf(buf + len, " pid=%ld",
4647 4648
				l->min_pid);

R
Rusty Russell 已提交
4649 4650
		if (num_online_cpus() > 1 &&
				!cpumask_empty(to_cpumask(l->cpus)) &&
4651 4652 4653 4654
				len < PAGE_SIZE - 60)
			len += scnprintf(buf + len, PAGE_SIZE - len - 50,
					 " cpus=%*pbl",
					 cpumask_pr_args(to_cpumask(l->cpus)));
4655

4656
		if (nr_online_nodes > 1 && !nodes_empty(l->nodes) &&
4657 4658 4659 4660
				len < PAGE_SIZE - 60)
			len += scnprintf(buf + len, PAGE_SIZE - len - 50,
					 " nodes=%*pbl",
					 nodemask_pr_args(&l->nodes));
4661

4662
		len += sprintf(buf + len, "\n");
4663 4664 4665
	}

	free_loc_track(&t);
E
Eric Dumazet 已提交
4666
	kfree(map);
4667
	if (!t.count)
4668 4669
		len += sprintf(buf, "No data\n");
	return len;
4670
}
4671
#endif
4672

4673
#ifdef SLUB_RESILIENCY_TEST
4674
static void __init resiliency_test(void)
4675 4676 4677
{
	u8 *p;

4678
	BUILD_BUG_ON(KMALLOC_MIN_SIZE > 16 || KMALLOC_SHIFT_HIGH < 10);
4679

4680 4681 4682
	pr_err("SLUB resiliency testing\n");
	pr_err("-----------------------\n");
	pr_err("A. Corruption after allocation\n");
4683 4684 4685

	p = kzalloc(16, GFP_KERNEL);
	p[16] = 0x12;
4686 4687
	pr_err("\n1. kmalloc-16: Clobber Redzone/next pointer 0x12->0x%p\n\n",
	       p + 16);
4688 4689 4690 4691 4692 4693

	validate_slab_cache(kmalloc_caches[4]);

	/* Hmmm... The next two are dangerous */
	p = kzalloc(32, GFP_KERNEL);
	p[32 + sizeof(void *)] = 0x34;
4694 4695 4696
	pr_err("\n2. kmalloc-32: Clobber next pointer/next slab 0x34 -> -0x%p\n",
	       p);
	pr_err("If allocated object is overwritten then not detectable\n\n");
4697 4698 4699 4700 4701

	validate_slab_cache(kmalloc_caches[5]);
	p = kzalloc(64, GFP_KERNEL);
	p += 64 + (get_cycles() & 0xff) * sizeof(void *);
	*p = 0x56;
4702 4703 4704
	pr_err("\n3. kmalloc-64: corrupting random byte 0x56->0x%p\n",
	       p);
	pr_err("If allocated object is overwritten then not detectable\n\n");
4705 4706
	validate_slab_cache(kmalloc_caches[6]);

4707
	pr_err("\nB. Corruption after free\n");
4708 4709 4710
	p = kzalloc(128, GFP_KERNEL);
	kfree(p);
	*p = 0x78;
4711
	pr_err("1. kmalloc-128: Clobber first word 0x78->0x%p\n\n", p);
4712 4713 4714 4715 4716
	validate_slab_cache(kmalloc_caches[7]);

	p = kzalloc(256, GFP_KERNEL);
	kfree(p);
	p[50] = 0x9a;
4717
	pr_err("\n2. kmalloc-256: Clobber 50th byte 0x9a->0x%p\n\n", p);
4718 4719 4720 4721 4722
	validate_slab_cache(kmalloc_caches[8]);

	p = kzalloc(512, GFP_KERNEL);
	kfree(p);
	p[512] = 0xab;
4723
	pr_err("\n3. kmalloc-512: Clobber redzone 0xab->0x%p\n\n", p);
4724 4725 4726 4727 4728 4729 4730 4731
	validate_slab_cache(kmalloc_caches[9]);
}
#else
#ifdef CONFIG_SYSFS
static void resiliency_test(void) {};
#endif
#endif

4732
#ifdef CONFIG_SYSFS
C
Christoph Lameter 已提交
4733
enum slab_stat_type {
4734 4735 4736 4737 4738
	SL_ALL,			/* All slabs */
	SL_PARTIAL,		/* Only partially allocated slabs */
	SL_CPU,			/* Only slabs used for cpu caches */
	SL_OBJECTS,		/* Determine allocated objects not slabs */
	SL_TOTAL		/* Determine object capacity not slabs */
C
Christoph Lameter 已提交
4739 4740
};

4741
#define SO_ALL		(1 << SL_ALL)
C
Christoph Lameter 已提交
4742 4743 4744
#define SO_PARTIAL	(1 << SL_PARTIAL)
#define SO_CPU		(1 << SL_CPU)
#define SO_OBJECTS	(1 << SL_OBJECTS)
4745
#define SO_TOTAL	(1 << SL_TOTAL)
C
Christoph Lameter 已提交
4746

4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762
#ifdef CONFIG_MEMCG
static bool memcg_sysfs_enabled = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON);

static int __init setup_slub_memcg_sysfs(char *str)
{
	int v;

	if (get_option(&str, &v) > 0)
		memcg_sysfs_enabled = v;

	return 1;
}

__setup("slub_memcg_sysfs=", setup_slub_memcg_sysfs);
#endif

4763 4764
static ssize_t show_slab_objects(struct kmem_cache *s,
			    char *buf, unsigned long flags)
C
Christoph Lameter 已提交
4765 4766 4767 4768 4769 4770
{
	unsigned long total = 0;
	int node;
	int x;
	unsigned long *nodes;

4771
	nodes = kzalloc(sizeof(unsigned long) * nr_node_ids, GFP_KERNEL);
4772 4773
	if (!nodes)
		return -ENOMEM;
C
Christoph Lameter 已提交
4774

4775 4776
	if (flags & SO_CPU) {
		int cpu;
C
Christoph Lameter 已提交
4777

4778
		for_each_possible_cpu(cpu) {
4779 4780
			struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab,
							       cpu);
4781
			int node;
4782
			struct page *page;
4783

4784
			page = READ_ONCE(c->page);
4785 4786
			if (!page)
				continue;
4787

4788 4789 4790 4791 4792 4793 4794
			node = page_to_nid(page);
			if (flags & SO_TOTAL)
				x = page->objects;
			else if (flags & SO_OBJECTS)
				x = page->inuse;
			else
				x = 1;
4795

4796 4797 4798
			total += x;
			nodes[node] += x;

4799
			page = slub_percpu_partial_read_once(c);
4800
			if (page) {
L
Li Zefan 已提交
4801 4802 4803 4804 4805 4806 4807
				node = page_to_nid(page);
				if (flags & SO_TOTAL)
					WARN_ON_ONCE(1);
				else if (flags & SO_OBJECTS)
					WARN_ON_ONCE(1);
				else
					x = page->pages;
4808 4809
				total += x;
				nodes[node] += x;
4810
			}
C
Christoph Lameter 已提交
4811 4812 4813
		}
	}

4814
	get_online_mems();
4815
#ifdef CONFIG_SLUB_DEBUG
4816
	if (flags & SO_ALL) {
C
Christoph Lameter 已提交
4817 4818 4819
		struct kmem_cache_node *n;

		for_each_kmem_cache_node(s, node, n) {
4820

4821 4822 4823 4824 4825
			if (flags & SO_TOTAL)
				x = atomic_long_read(&n->total_objects);
			else if (flags & SO_OBJECTS)
				x = atomic_long_read(&n->total_objects) -
					count_partial(n, count_free);
C
Christoph Lameter 已提交
4826
			else
4827
				x = atomic_long_read(&n->nr_slabs);
C
Christoph Lameter 已提交
4828 4829 4830 4831
			total += x;
			nodes[node] += x;
		}

4832 4833 4834
	} else
#endif
	if (flags & SO_PARTIAL) {
C
Christoph Lameter 已提交
4835
		struct kmem_cache_node *n;
C
Christoph Lameter 已提交
4836

C
Christoph Lameter 已提交
4837
		for_each_kmem_cache_node(s, node, n) {
4838 4839 4840 4841
			if (flags & SO_TOTAL)
				x = count_partial(n, count_total);
			else if (flags & SO_OBJECTS)
				x = count_partial(n, count_inuse);
C
Christoph Lameter 已提交
4842
			else
4843
				x = n->nr_partial;
C
Christoph Lameter 已提交
4844 4845 4846 4847 4848 4849
			total += x;
			nodes[node] += x;
		}
	}
	x = sprintf(buf, "%lu", total);
#ifdef CONFIG_NUMA
C
Christoph Lameter 已提交
4850
	for (node = 0; node < nr_node_ids; node++)
C
Christoph Lameter 已提交
4851 4852 4853 4854
		if (nodes[node])
			x += sprintf(buf + x, " N%d=%lu",
					node, nodes[node]);
#endif
4855
	put_online_mems();
C
Christoph Lameter 已提交
4856 4857 4858 4859
	kfree(nodes);
	return x + sprintf(buf + x, "\n");
}

4860
#ifdef CONFIG_SLUB_DEBUG
C
Christoph Lameter 已提交
4861 4862 4863
static int any_slab_objects(struct kmem_cache *s)
{
	int node;
C
Christoph Lameter 已提交
4864
	struct kmem_cache_node *n;
C
Christoph Lameter 已提交
4865

C
Christoph Lameter 已提交
4866
	for_each_kmem_cache_node(s, node, n)
4867
		if (atomic_long_read(&n->total_objects))
C
Christoph Lameter 已提交
4868
			return 1;
C
Christoph Lameter 已提交
4869

C
Christoph Lameter 已提交
4870 4871
	return 0;
}
4872
#endif
C
Christoph Lameter 已提交
4873 4874

#define to_slab_attr(n) container_of(n, struct slab_attribute, attr)
4875
#define to_slab(n) container_of(n, struct kmem_cache, kobj)
C
Christoph Lameter 已提交
4876 4877 4878 4879 4880 4881 4882 4883

struct slab_attribute {
	struct attribute attr;
	ssize_t (*show)(struct kmem_cache *s, char *buf);
	ssize_t (*store)(struct kmem_cache *s, const char *x, size_t count);
};

#define SLAB_ATTR_RO(_name) \
4884 4885
	static struct slab_attribute _name##_attr = \
	__ATTR(_name, 0400, _name##_show, NULL)
C
Christoph Lameter 已提交
4886 4887 4888

#define SLAB_ATTR(_name) \
	static struct slab_attribute _name##_attr =  \
4889
	__ATTR(_name, 0600, _name##_show, _name##_store)
C
Christoph Lameter 已提交
4890 4891 4892 4893 4894 4895 4896 4897 4898 4899 4900 4901 4902 4903 4904

static ssize_t slab_size_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", s->size);
}
SLAB_ATTR_RO(slab_size);

static ssize_t align_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", s->align);
}
SLAB_ATTR_RO(align);

static ssize_t object_size_show(struct kmem_cache *s, char *buf)
{
4905
	return sprintf(buf, "%d\n", s->object_size);
C
Christoph Lameter 已提交
4906 4907 4908 4909 4910
}
SLAB_ATTR_RO(object_size);

static ssize_t objs_per_slab_show(struct kmem_cache *s, char *buf)
{
4911
	return sprintf(buf, "%d\n", oo_objects(s->oo));
C
Christoph Lameter 已提交
4912 4913 4914
}
SLAB_ATTR_RO(objs_per_slab);

4915 4916 4917
static ssize_t order_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
4918 4919 4920
	unsigned long order;
	int err;

4921
	err = kstrtoul(buf, 10, &order);
4922 4923
	if (err)
		return err;
4924 4925 4926 4927 4928 4929 4930 4931

	if (order > slub_max_order || order < slub_min_order)
		return -EINVAL;

	calculate_sizes(s, order);
	return length;
}

C
Christoph Lameter 已提交
4932 4933
static ssize_t order_show(struct kmem_cache *s, char *buf)
{
4934
	return sprintf(buf, "%d\n", oo_order(s->oo));
C
Christoph Lameter 已提交
4935
}
4936
SLAB_ATTR(order);
C
Christoph Lameter 已提交
4937

4938 4939 4940 4941 4942 4943 4944 4945 4946 4947 4948
static ssize_t min_partial_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%lu\n", s->min_partial);
}

static ssize_t min_partial_store(struct kmem_cache *s, const char *buf,
				 size_t length)
{
	unsigned long min;
	int err;

4949
	err = kstrtoul(buf, 10, &min);
4950 4951 4952
	if (err)
		return err;

4953
	set_min_partial(s, min);
4954 4955 4956 4957
	return length;
}
SLAB_ATTR(min_partial);

4958 4959
static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf)
{
4960
	return sprintf(buf, "%u\n", slub_cpu_partial(s));
4961 4962 4963 4964 4965 4966 4967 4968
}

static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf,
				 size_t length)
{
	unsigned long objects;
	int err;

4969
	err = kstrtoul(buf, 10, &objects);
4970 4971
	if (err)
		return err;
4972
	if (objects && !kmem_cache_has_cpu_partial(s))
4973
		return -EINVAL;
4974

4975
	slub_set_cpu_partial(s, objects);
4976 4977 4978 4979 4980
	flush_all(s);
	return length;
}
SLAB_ATTR(cpu_partial);

C
Christoph Lameter 已提交
4981 4982
static ssize_t ctor_show(struct kmem_cache *s, char *buf)
{
J
Joe Perches 已提交
4983 4984 4985
	if (!s->ctor)
		return 0;
	return sprintf(buf, "%pS\n", s->ctor);
C
Christoph Lameter 已提交
4986 4987 4988 4989 4990
}
SLAB_ATTR_RO(ctor);

static ssize_t aliases_show(struct kmem_cache *s, char *buf)
{
4991
	return sprintf(buf, "%d\n", s->refcount < 0 ? 0 : s->refcount - 1);
C
Christoph Lameter 已提交
4992 4993 4994 4995 4996
}
SLAB_ATTR_RO(aliases);

static ssize_t partial_show(struct kmem_cache *s, char *buf)
{
4997
	return show_slab_objects(s, buf, SO_PARTIAL);
C
Christoph Lameter 已提交
4998 4999 5000 5001 5002
}
SLAB_ATTR_RO(partial);

static ssize_t cpu_slabs_show(struct kmem_cache *s, char *buf)
{
5003
	return show_slab_objects(s, buf, SO_CPU);
C
Christoph Lameter 已提交
5004 5005 5006 5007 5008
}
SLAB_ATTR_RO(cpu_slabs);

static ssize_t objects_show(struct kmem_cache *s, char *buf)
{
5009
	return show_slab_objects(s, buf, SO_ALL|SO_OBJECTS);
C
Christoph Lameter 已提交
5010 5011 5012
}
SLAB_ATTR_RO(objects);

5013 5014 5015 5016 5017 5018
static ssize_t objects_partial_show(struct kmem_cache *s, char *buf)
{
	return show_slab_objects(s, buf, SO_PARTIAL|SO_OBJECTS);
}
SLAB_ATTR_RO(objects_partial);

5019 5020 5021 5022 5023 5024 5025 5026
static ssize_t slabs_cpu_partial_show(struct kmem_cache *s, char *buf)
{
	int objects = 0;
	int pages = 0;
	int cpu;
	int len;

	for_each_online_cpu(cpu) {
5027 5028 5029
		struct page *page;

		page = slub_percpu_partial(per_cpu_ptr(s->cpu_slab, cpu));
5030 5031 5032 5033 5034 5035 5036 5037 5038 5039 5040

		if (page) {
			pages += page->pages;
			objects += page->pobjects;
		}
	}

	len = sprintf(buf, "%d(%d)", objects, pages);

#ifdef CONFIG_SMP
	for_each_online_cpu(cpu) {
5041 5042 5043
		struct page *page;

		page = slub_percpu_partial(per_cpu_ptr(s->cpu_slab, cpu));
5044 5045 5046 5047 5048 5049 5050 5051 5052 5053

		if (page && len < PAGE_SIZE - 20)
			len += sprintf(buf + len, " C%d=%d(%d)", cpu,
				page->pobjects, page->pages);
	}
#endif
	return len + sprintf(buf + len, "\n");
}
SLAB_ATTR_RO(slabs_cpu_partial);

5054 5055 5056 5057 5058 5059 5060 5061 5062 5063 5064 5065 5066 5067 5068 5069 5070 5071 5072 5073 5074 5075 5076 5077 5078 5079 5080 5081 5082
static ssize_t reclaim_account_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_RECLAIM_ACCOUNT));
}

static ssize_t reclaim_account_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
	s->flags &= ~SLAB_RECLAIM_ACCOUNT;
	if (buf[0] == '1')
		s->flags |= SLAB_RECLAIM_ACCOUNT;
	return length;
}
SLAB_ATTR(reclaim_account);

static ssize_t hwcache_align_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_HWCACHE_ALIGN));
}
SLAB_ATTR_RO(hwcache_align);

#ifdef CONFIG_ZONE_DMA
static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_CACHE_DMA));
}
SLAB_ATTR_RO(cache_dma);
#endif

5083 5084 5085 5086 5087 5088
static ssize_t usersize_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%zu\n", s->usersize);
}
SLAB_ATTR_RO(usersize);

5089 5090
static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
{
5091
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_TYPESAFE_BY_RCU));
5092 5093 5094
}
SLAB_ATTR_RO(destroy_by_rcu);

5095 5096 5097 5098 5099 5100
static ssize_t reserved_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", s->reserved);
}
SLAB_ATTR_RO(reserved);

5101
#ifdef CONFIG_SLUB_DEBUG
5102 5103 5104 5105 5106 5107
static ssize_t slabs_show(struct kmem_cache *s, char *buf)
{
	return show_slab_objects(s, buf, SO_ALL);
}
SLAB_ATTR_RO(slabs);

5108 5109 5110 5111 5112 5113
static ssize_t total_objects_show(struct kmem_cache *s, char *buf)
{
	return show_slab_objects(s, buf, SO_ALL|SO_TOTAL);
}
SLAB_ATTR_RO(total_objects);

C
Christoph Lameter 已提交
5114 5115
static ssize_t sanity_checks_show(struct kmem_cache *s, char *buf)
{
5116
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_CONSISTENCY_CHECKS));
C
Christoph Lameter 已提交
5117 5118 5119 5120 5121
}

static ssize_t sanity_checks_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
5122
	s->flags &= ~SLAB_CONSISTENCY_CHECKS;
5123 5124
	if (buf[0] == '1') {
		s->flags &= ~__CMPXCHG_DOUBLE;
5125
		s->flags |= SLAB_CONSISTENCY_CHECKS;
5126
	}
C
Christoph Lameter 已提交
5127 5128 5129 5130 5131 5132 5133 5134 5135 5136 5137 5138
	return length;
}
SLAB_ATTR(sanity_checks);

static ssize_t trace_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_TRACE));
}

static ssize_t trace_store(struct kmem_cache *s, const char *buf,
							size_t length)
{
5139 5140 5141 5142 5143 5144 5145 5146
	/*
	 * Tracing a merged cache is going to give confusing results
	 * as well as cause other issues like converting a mergeable
	 * cache into an umergeable one.
	 */
	if (s->refcount > 1)
		return -EINVAL;

C
Christoph Lameter 已提交
5147
	s->flags &= ~SLAB_TRACE;
5148 5149
	if (buf[0] == '1') {
		s->flags &= ~__CMPXCHG_DOUBLE;
C
Christoph Lameter 已提交
5150
		s->flags |= SLAB_TRACE;
5151
	}
C
Christoph Lameter 已提交
5152 5153 5154 5155 5156 5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167
	return length;
}
SLAB_ATTR(trace);

static ssize_t red_zone_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_RED_ZONE));
}

static ssize_t red_zone_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
	if (any_slab_objects(s))
		return -EBUSY;

	s->flags &= ~SLAB_RED_ZONE;
5168
	if (buf[0] == '1') {
C
Christoph Lameter 已提交
5169
		s->flags |= SLAB_RED_ZONE;
5170
	}
5171
	calculate_sizes(s, -1);
C
Christoph Lameter 已提交
5172 5173 5174 5175 5176 5177 5178 5179 5180 5181 5182 5183 5184 5185 5186 5187
	return length;
}
SLAB_ATTR(red_zone);

static ssize_t poison_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_POISON));
}

static ssize_t poison_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
	if (any_slab_objects(s))
		return -EBUSY;

	s->flags &= ~SLAB_POISON;
5188
	if (buf[0] == '1') {
C
Christoph Lameter 已提交
5189
		s->flags |= SLAB_POISON;
5190
	}
5191
	calculate_sizes(s, -1);
C
Christoph Lameter 已提交
5192 5193 5194 5195 5196 5197 5198 5199 5200 5201 5202 5203 5204 5205 5206 5207
	return length;
}
SLAB_ATTR(poison);

static ssize_t store_user_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_STORE_USER));
}

static ssize_t store_user_store(struct kmem_cache *s,
				const char *buf, size_t length)
{
	if (any_slab_objects(s))
		return -EBUSY;

	s->flags &= ~SLAB_STORE_USER;
5208 5209
	if (buf[0] == '1') {
		s->flags &= ~__CMPXCHG_DOUBLE;
C
Christoph Lameter 已提交
5210
		s->flags |= SLAB_STORE_USER;
5211
	}
5212
	calculate_sizes(s, -1);
C
Christoph Lameter 已提交
5213 5214 5215 5216
	return length;
}
SLAB_ATTR(store_user);

5217 5218 5219 5220 5221 5222 5223 5224
static ssize_t validate_show(struct kmem_cache *s, char *buf)
{
	return 0;
}

static ssize_t validate_store(struct kmem_cache *s,
			const char *buf, size_t length)
{
5225 5226 5227 5228 5229 5230 5231 5232
	int ret = -EINVAL;

	if (buf[0] == '1') {
		ret = validate_slab_cache(s);
		if (ret >= 0)
			ret = length;
	}
	return ret;
5233 5234
}
SLAB_ATTR(validate);
5235 5236 5237 5238 5239 5240 5241 5242 5243 5244 5245 5246 5247 5248 5249 5250 5251 5252 5253 5254 5255 5256 5257 5258 5259 5260 5261

static ssize_t alloc_calls_show(struct kmem_cache *s, char *buf)
{
	if (!(s->flags & SLAB_STORE_USER))
		return -ENOSYS;
	return list_locations(s, buf, TRACK_ALLOC);
}
SLAB_ATTR_RO(alloc_calls);

static ssize_t free_calls_show(struct kmem_cache *s, char *buf)
{
	if (!(s->flags & SLAB_STORE_USER))
		return -ENOSYS;
	return list_locations(s, buf, TRACK_FREE);
}
SLAB_ATTR_RO(free_calls);
#endif /* CONFIG_SLUB_DEBUG */

#ifdef CONFIG_FAILSLAB
static ssize_t failslab_show(struct kmem_cache *s, char *buf)
{
	return sprintf(buf, "%d\n", !!(s->flags & SLAB_FAILSLAB));
}

static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
							size_t length)
{
5262 5263 5264
	if (s->refcount > 1)
		return -EINVAL;

5265 5266 5267 5268 5269 5270
	s->flags &= ~SLAB_FAILSLAB;
	if (buf[0] == '1')
		s->flags |= SLAB_FAILSLAB;
	return length;
}
SLAB_ATTR(failslab);
5271
#endif
5272

5273 5274 5275 5276 5277 5278 5279 5280
static ssize_t shrink_show(struct kmem_cache *s, char *buf)
{
	return 0;
}

static ssize_t shrink_store(struct kmem_cache *s,
			const char *buf, size_t length)
{
5281 5282 5283
	if (buf[0] == '1')
		kmem_cache_shrink(s);
	else
5284 5285 5286 5287 5288
		return -EINVAL;
	return length;
}
SLAB_ATTR(shrink);

C
Christoph Lameter 已提交
5289
#ifdef CONFIG_NUMA
5290
static ssize_t remote_node_defrag_ratio_show(struct kmem_cache *s, char *buf)
C
Christoph Lameter 已提交
5291
{
5292
	return sprintf(buf, "%d\n", s->remote_node_defrag_ratio / 10);
C
Christoph Lameter 已提交
5293 5294
}

5295
static ssize_t remote_node_defrag_ratio_store(struct kmem_cache *s,
C
Christoph Lameter 已提交
5296 5297
				const char *buf, size_t length)
{
5298 5299 5300
	unsigned long ratio;
	int err;

5301
	err = kstrtoul(buf, 10, &ratio);
5302 5303 5304
	if (err)
		return err;

5305
	if (ratio <= 100)
5306
		s->remote_node_defrag_ratio = ratio * 10;
C
Christoph Lameter 已提交
5307 5308 5309

	return length;
}
5310
SLAB_ATTR(remote_node_defrag_ratio);
C
Christoph Lameter 已提交
5311 5312
#endif

5313 5314 5315 5316 5317 5318 5319 5320 5321 5322 5323 5324
#ifdef CONFIG_SLUB_STATS
static int show_stat(struct kmem_cache *s, char *buf, enum stat_item si)
{
	unsigned long sum  = 0;
	int cpu;
	int len;
	int *data = kmalloc(nr_cpu_ids * sizeof(int), GFP_KERNEL);

	if (!data)
		return -ENOMEM;

	for_each_online_cpu(cpu) {
5325
		unsigned x = per_cpu_ptr(s->cpu_slab, cpu)->stat[si];
5326 5327 5328 5329 5330 5331 5332

		data[cpu] = x;
		sum += x;
	}

	len = sprintf(buf, "%lu", sum);

5333
#ifdef CONFIG_SMP
5334 5335
	for_each_online_cpu(cpu) {
		if (data[cpu] && len < PAGE_SIZE - 20)
5336
			len += sprintf(buf + len, " C%d=%u", cpu, data[cpu]);
5337
	}
5338
#endif
5339 5340 5341 5342
	kfree(data);
	return len + sprintf(buf + len, "\n");
}

D
David Rientjes 已提交
5343 5344 5345 5346 5347
static void clear_stat(struct kmem_cache *s, enum stat_item si)
{
	int cpu;

	for_each_online_cpu(cpu)
5348
		per_cpu_ptr(s->cpu_slab, cpu)->stat[si] = 0;
D
David Rientjes 已提交
5349 5350
}

5351 5352 5353 5354 5355
#define STAT_ATTR(si, text) 					\
static ssize_t text##_show(struct kmem_cache *s, char *buf)	\
{								\
	return show_stat(s, buf, si);				\
}								\
D
David Rientjes 已提交
5356 5357 5358 5359 5360 5361 5362 5363 5364
static ssize_t text##_store(struct kmem_cache *s,		\
				const char *buf, size_t length)	\
{								\
	if (buf[0] != '0')					\
		return -EINVAL;					\
	clear_stat(s, si);					\
	return length;						\
}								\
SLAB_ATTR(text);						\
5365 5366 5367 5368 5369 5370 5371 5372 5373 5374 5375

STAT_ATTR(ALLOC_FASTPATH, alloc_fastpath);
STAT_ATTR(ALLOC_SLOWPATH, alloc_slowpath);
STAT_ATTR(FREE_FASTPATH, free_fastpath);
STAT_ATTR(FREE_SLOWPATH, free_slowpath);
STAT_ATTR(FREE_FROZEN, free_frozen);
STAT_ATTR(FREE_ADD_PARTIAL, free_add_partial);
STAT_ATTR(FREE_REMOVE_PARTIAL, free_remove_partial);
STAT_ATTR(ALLOC_FROM_PARTIAL, alloc_from_partial);
STAT_ATTR(ALLOC_SLAB, alloc_slab);
STAT_ATTR(ALLOC_REFILL, alloc_refill);
5376
STAT_ATTR(ALLOC_NODE_MISMATCH, alloc_node_mismatch);
5377 5378 5379 5380 5381 5382 5383
STAT_ATTR(FREE_SLAB, free_slab);
STAT_ATTR(CPUSLAB_FLUSH, cpuslab_flush);
STAT_ATTR(DEACTIVATE_FULL, deactivate_full);
STAT_ATTR(DEACTIVATE_EMPTY, deactivate_empty);
STAT_ATTR(DEACTIVATE_TO_HEAD, deactivate_to_head);
STAT_ATTR(DEACTIVATE_TO_TAIL, deactivate_to_tail);
STAT_ATTR(DEACTIVATE_REMOTE_FREES, deactivate_remote_frees);
5384
STAT_ATTR(DEACTIVATE_BYPASS, deactivate_bypass);
5385
STAT_ATTR(ORDER_FALLBACK, order_fallback);
5386 5387
STAT_ATTR(CMPXCHG_DOUBLE_CPU_FAIL, cmpxchg_double_cpu_fail);
STAT_ATTR(CMPXCHG_DOUBLE_FAIL, cmpxchg_double_fail);
5388 5389
STAT_ATTR(CPU_PARTIAL_ALLOC, cpu_partial_alloc);
STAT_ATTR(CPU_PARTIAL_FREE, cpu_partial_free);
5390 5391
STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node);
STAT_ATTR(CPU_PARTIAL_DRAIN, cpu_partial_drain);
5392 5393
#endif

P
Pekka Enberg 已提交
5394
static struct attribute *slab_attrs[] = {
C
Christoph Lameter 已提交
5395 5396 5397 5398
	&slab_size_attr.attr,
	&object_size_attr.attr,
	&objs_per_slab_attr.attr,
	&order_attr.attr,
5399
	&min_partial_attr.attr,
5400
	&cpu_partial_attr.attr,
C
Christoph Lameter 已提交
5401
	&objects_attr.attr,
5402
	&objects_partial_attr.attr,
C
Christoph Lameter 已提交
5403 5404 5405 5406 5407 5408 5409 5410
	&partial_attr.attr,
	&cpu_slabs_attr.attr,
	&ctor_attr.attr,
	&aliases_attr.attr,
	&align_attr.attr,
	&hwcache_align_attr.attr,
	&reclaim_account_attr.attr,
	&destroy_by_rcu_attr.attr,
5411
	&shrink_attr.attr,
5412
	&reserved_attr.attr,
5413
	&slabs_cpu_partial_attr.attr,
5414
#ifdef CONFIG_SLUB_DEBUG
5415 5416 5417 5418
	&total_objects_attr.attr,
	&slabs_attr.attr,
	&sanity_checks_attr.attr,
	&trace_attr.attr,
C
Christoph Lameter 已提交
5419 5420 5421
	&red_zone_attr.attr,
	&poison_attr.attr,
	&store_user_attr.attr,
5422
	&validate_attr.attr,
5423 5424
	&alloc_calls_attr.attr,
	&free_calls_attr.attr,
5425
#endif
C
Christoph Lameter 已提交
5426 5427 5428 5429
#ifdef CONFIG_ZONE_DMA
	&cache_dma_attr.attr,
#endif
#ifdef CONFIG_NUMA
5430
	&remote_node_defrag_ratio_attr.attr,
5431 5432 5433 5434 5435 5436 5437 5438 5439 5440 5441 5442
#endif
#ifdef CONFIG_SLUB_STATS
	&alloc_fastpath_attr.attr,
	&alloc_slowpath_attr.attr,
	&free_fastpath_attr.attr,
	&free_slowpath_attr.attr,
	&free_frozen_attr.attr,
	&free_add_partial_attr.attr,
	&free_remove_partial_attr.attr,
	&alloc_from_partial_attr.attr,
	&alloc_slab_attr.attr,
	&alloc_refill_attr.attr,
5443
	&alloc_node_mismatch_attr.attr,
5444 5445 5446 5447 5448 5449 5450
	&free_slab_attr.attr,
	&cpuslab_flush_attr.attr,
	&deactivate_full_attr.attr,
	&deactivate_empty_attr.attr,
	&deactivate_to_head_attr.attr,
	&deactivate_to_tail_attr.attr,
	&deactivate_remote_frees_attr.attr,
5451
	&deactivate_bypass_attr.attr,
5452
	&order_fallback_attr.attr,
5453 5454
	&cmpxchg_double_fail_attr.attr,
	&cmpxchg_double_cpu_fail_attr.attr,
5455 5456
	&cpu_partial_alloc_attr.attr,
	&cpu_partial_free_attr.attr,
5457 5458
	&cpu_partial_node_attr.attr,
	&cpu_partial_drain_attr.attr,
C
Christoph Lameter 已提交
5459
#endif
5460 5461 5462
#ifdef CONFIG_FAILSLAB
	&failslab_attr.attr,
#endif
5463
	&usersize_attr.attr,
5464

C
Christoph Lameter 已提交
5465 5466 5467
	NULL
};

5468
static const struct attribute_group slab_attr_group = {
C
Christoph Lameter 已提交
5469 5470 5471 5472 5473 5474 5475 5476 5477 5478 5479 5480 5481 5482 5483 5484 5485 5486 5487 5488 5489 5490 5491 5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503 5504 5505
	.attrs = slab_attrs,
};

static ssize_t slab_attr_show(struct kobject *kobj,
				struct attribute *attr,
				char *buf)
{
	struct slab_attribute *attribute;
	struct kmem_cache *s;
	int err;

	attribute = to_slab_attr(attr);
	s = to_slab(kobj);

	if (!attribute->show)
		return -EIO;

	err = attribute->show(s, buf);

	return err;
}

static ssize_t slab_attr_store(struct kobject *kobj,
				struct attribute *attr,
				const char *buf, size_t len)
{
	struct slab_attribute *attribute;
	struct kmem_cache *s;
	int err;

	attribute = to_slab_attr(attr);
	s = to_slab(kobj);

	if (!attribute->store)
		return -EIO;

	err = attribute->store(s, buf, len);
5506
#ifdef CONFIG_MEMCG
5507
	if (slab_state >= FULL && err >= 0 && is_root_cache(s)) {
5508
		struct kmem_cache *c;
C
Christoph Lameter 已提交
5509

5510 5511 5512 5513
		mutex_lock(&slab_mutex);
		if (s->max_attr_size < len)
			s->max_attr_size = len;

5514 5515 5516 5517 5518 5519 5520 5521 5522 5523 5524 5525 5526 5527 5528 5529 5530
		/*
		 * This is a best effort propagation, so this function's return
		 * value will be determined by the parent cache only. This is
		 * basically because not all attributes will have a well
		 * defined semantics for rollbacks - most of the actions will
		 * have permanent effects.
		 *
		 * Returning the error value of any of the children that fail
		 * is not 100 % defined, in the sense that users seeing the
		 * error code won't be able to know anything about the state of
		 * the cache.
		 *
		 * Only returning the error code for the parent cache at least
		 * has well defined semantics. The cache being written to
		 * directly either failed or succeeded, in which case we loop
		 * through the descendants with best-effort propagation.
		 */
5531 5532
		for_each_memcg_cache(c, s)
			attribute->store(c, buf, len);
5533 5534 5535
		mutex_unlock(&slab_mutex);
	}
#endif
C
Christoph Lameter 已提交
5536 5537 5538
	return err;
}

5539 5540
static void memcg_propagate_slab_attrs(struct kmem_cache *s)
{
5541
#ifdef CONFIG_MEMCG
5542 5543
	int i;
	char *buffer = NULL;
5544
	struct kmem_cache *root_cache;
5545

5546
	if (is_root_cache(s))
5547 5548
		return;

5549
	root_cache = s->memcg_params.root_cache;
5550

5551 5552 5553 5554
	/*
	 * This mean this cache had no attribute written. Therefore, no point
	 * in copying default values around
	 */
5555
	if (!root_cache->max_attr_size)
5556 5557 5558 5559 5560 5561
		return;

	for (i = 0; i < ARRAY_SIZE(slab_attrs); i++) {
		char mbuf[64];
		char *buf;
		struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
5562
		ssize_t len;
5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576 5577

		if (!attr || !attr->store || !attr->show)
			continue;

		/*
		 * It is really bad that we have to allocate here, so we will
		 * do it only as a fallback. If we actually allocate, though,
		 * we can just use the allocated buffer until the end.
		 *
		 * Most of the slub attributes will tend to be very small in
		 * size, but sysfs allows buffers up to a page, so they can
		 * theoretically happen.
		 */
		if (buffer)
			buf = buffer;
5578
		else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
5579 5580 5581 5582 5583 5584 5585 5586
			buf = mbuf;
		else {
			buffer = (char *) get_zeroed_page(GFP_KERNEL);
			if (WARN_ON(!buffer))
				continue;
			buf = buffer;
		}

5587 5588 5589
		len = attr->show(root_cache, buf);
		if (len > 0)
			attr->store(s, buf, len);
5590 5591 5592 5593 5594 5595 5596
	}

	if (buffer)
		free_page((unsigned long)buffer);
#endif
}

5597 5598 5599 5600 5601
static void kmem_cache_release(struct kobject *k)
{
	slab_kmem_cache_release(to_slab(k));
}

5602
static const struct sysfs_ops slab_sysfs_ops = {
C
Christoph Lameter 已提交
5603 5604 5605 5606 5607 5608
	.show = slab_attr_show,
	.store = slab_attr_store,
};

static struct kobj_type slab_ktype = {
	.sysfs_ops = &slab_sysfs_ops,
5609
	.release = kmem_cache_release,
C
Christoph Lameter 已提交
5610 5611 5612 5613 5614 5615 5616 5617 5618 5619 5620
};

static int uevent_filter(struct kset *kset, struct kobject *kobj)
{
	struct kobj_type *ktype = get_ktype(kobj);

	if (ktype == &slab_ktype)
		return 1;
	return 0;
}

5621
static const struct kset_uevent_ops slab_uevent_ops = {
C
Christoph Lameter 已提交
5622 5623 5624
	.filter = uevent_filter,
};

5625
static struct kset *slab_kset;
C
Christoph Lameter 已提交
5626

5627 5628
static inline struct kset *cache_kset(struct kmem_cache *s)
{
5629
#ifdef CONFIG_MEMCG
5630
	if (!is_root_cache(s))
5631
		return s->memcg_params.root_cache->memcg_kset;
5632 5633 5634 5635
#endif
	return slab_kset;
}

C
Christoph Lameter 已提交
5636 5637 5638
#define ID_STR_LENGTH 64

/* Create a unique string id for a slab cache:
C
Christoph Lameter 已提交
5639 5640
 *
 * Format	:[flags-]size
C
Christoph Lameter 已提交
5641 5642 5643 5644 5645 5646 5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657 5658 5659 5660
 */
static char *create_unique_id(struct kmem_cache *s)
{
	char *name = kmalloc(ID_STR_LENGTH, GFP_KERNEL);
	char *p = name;

	BUG_ON(!name);

	*p++ = ':';
	/*
	 * First flags affecting slabcache operations. We will only
	 * get here for aliasable slabs so we do not need to support
	 * too many flags. The flags here must cover all flags that
	 * are matched during merging to guarantee that the id is
	 * unique.
	 */
	if (s->flags & SLAB_CACHE_DMA)
		*p++ = 'd';
	if (s->flags & SLAB_RECLAIM_ACCOUNT)
		*p++ = 'a';
5661
	if (s->flags & SLAB_CONSISTENCY_CHECKS)
C
Christoph Lameter 已提交
5662
		*p++ = 'F';
V
Vladimir Davydov 已提交
5663 5664
	if (s->flags & SLAB_ACCOUNT)
		*p++ = 'A';
C
Christoph Lameter 已提交
5665 5666 5667
	if (p != name + 1)
		*p++ = '-';
	p += sprintf(p, "%07d", s->size);
5668

C
Christoph Lameter 已提交
5669 5670 5671 5672
	BUG_ON(p > name + ID_STR_LENGTH - 1);
	return name;
}

5673 5674 5675 5676 5677 5678 5679 5680 5681 5682 5683 5684
static void sysfs_slab_remove_workfn(struct work_struct *work)
{
	struct kmem_cache *s =
		container_of(work, struct kmem_cache, kobj_remove_work);

	if (!s->kobj.state_in_sysfs)
		/*
		 * For a memcg cache, this may be called during
		 * deactivation and again on shutdown.  Remove only once.
		 * A cache is never shut down before deactivation is
		 * complete, so no need to worry about synchronization.
		 */
5685
		goto out;
5686 5687 5688 5689 5690 5691

#ifdef CONFIG_MEMCG
	kset_unregister(s->memcg_kset);
#endif
	kobject_uevent(&s->kobj, KOBJ_REMOVE);
	kobject_del(&s->kobj);
5692
out:
5693 5694 5695
	kobject_put(&s->kobj);
}

C
Christoph Lameter 已提交
5696 5697 5698 5699
static int sysfs_slab_add(struct kmem_cache *s)
{
	int err;
	const char *name;
5700
	struct kset *kset = cache_kset(s);
5701
	int unmergeable = slab_unmergeable(s);
C
Christoph Lameter 已提交
5702

5703 5704
	INIT_WORK(&s->kobj_remove_work, sysfs_slab_remove_workfn);

5705 5706 5707 5708 5709
	if (!kset) {
		kobject_init(&s->kobj, &slab_ktype);
		return 0;
	}

5710 5711 5712 5713
	if (!unmergeable && disable_higher_order_debug &&
			(slub_debug & DEBUG_METADATA_FLAGS))
		unmergeable = 1;

C
Christoph Lameter 已提交
5714 5715 5716 5717 5718 5719
	if (unmergeable) {
		/*
		 * Slabcache can never be merged so we can use the name proper.
		 * This is typically the case for debug situations. In that
		 * case we can catch duplicate names easily.
		 */
5720
		sysfs_remove_link(&slab_kset->kobj, s->name);
C
Christoph Lameter 已提交
5721 5722 5723 5724 5725 5726 5727 5728 5729
		name = s->name;
	} else {
		/*
		 * Create a unique name for the slab as a target
		 * for the symlinks.
		 */
		name = create_unique_id(s);
	}

5730
	s->kobj.kset = kset;
5731
	err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
5732
	if (err)
5733
		goto out;
C
Christoph Lameter 已提交
5734 5735

	err = sysfs_create_group(&s->kobj, &slab_attr_group);
5736 5737
	if (err)
		goto out_del_kobj;
5738

5739
#ifdef CONFIG_MEMCG
5740
	if (is_root_cache(s) && memcg_sysfs_enabled) {
5741 5742
		s->memcg_kset = kset_create_and_add("cgroup", NULL, &s->kobj);
		if (!s->memcg_kset) {
5743 5744
			err = -ENOMEM;
			goto out_del_kobj;
5745 5746 5747 5748
		}
	}
#endif

C
Christoph Lameter 已提交
5749 5750 5751 5752 5753
	kobject_uevent(&s->kobj, KOBJ_ADD);
	if (!unmergeable) {
		/* Setup first alias */
		sysfs_slab_alias(s, s->name);
	}
5754 5755 5756 5757 5758 5759 5760
out:
	if (!unmergeable)
		kfree(name);
	return err;
out_del_kobj:
	kobject_del(&s->kobj);
	goto out;
C
Christoph Lameter 已提交
5761 5762
}

5763
static void sysfs_slab_remove(struct kmem_cache *s)
C
Christoph Lameter 已提交
5764
{
5765
	if (slab_state < FULL)
5766 5767 5768 5769 5770 5771
		/*
		 * Sysfs has not been setup yet so no need to remove the
		 * cache from sysfs.
		 */
		return;

5772 5773
	kobject_get(&s->kobj);
	schedule_work(&s->kobj_remove_work);
5774 5775 5776 5777 5778 5779
}

void sysfs_slab_release(struct kmem_cache *s)
{
	if (slab_state >= FULL)
		kobject_put(&s->kobj);
C
Christoph Lameter 已提交
5780 5781 5782 5783
}

/*
 * Need to buffer aliases during bootup until sysfs becomes
N
Nick Andrew 已提交
5784
 * available lest we lose that information.
C
Christoph Lameter 已提交
5785 5786 5787 5788 5789 5790 5791
 */
struct saved_alias {
	struct kmem_cache *s;
	const char *name;
	struct saved_alias *next;
};

A
Adrian Bunk 已提交
5792
static struct saved_alias *alias_list;
C
Christoph Lameter 已提交
5793 5794 5795 5796 5797

static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
	struct saved_alias *al;

5798
	if (slab_state == FULL) {
C
Christoph Lameter 已提交
5799 5800 5801
		/*
		 * If we have a leftover link then remove it.
		 */
5802 5803
		sysfs_remove_link(&slab_kset->kobj, name);
		return sysfs_create_link(&slab_kset->kobj, &s->kobj, name);
C
Christoph Lameter 已提交
5804 5805 5806 5807 5808 5809 5810 5811 5812 5813 5814 5815 5816 5817 5818
	}

	al = kmalloc(sizeof(struct saved_alias), GFP_KERNEL);
	if (!al)
		return -ENOMEM;

	al->s = s;
	al->name = name;
	al->next = alias_list;
	alias_list = al;
	return 0;
}

static int __init slab_sysfs_init(void)
{
5819
	struct kmem_cache *s;
C
Christoph Lameter 已提交
5820 5821
	int err;

5822
	mutex_lock(&slab_mutex);
5823

5824
	slab_kset = kset_create_and_add("slab", &slab_uevent_ops, kernel_kobj);
5825
	if (!slab_kset) {
5826
		mutex_unlock(&slab_mutex);
5827
		pr_err("Cannot register slab subsystem.\n");
C
Christoph Lameter 已提交
5828 5829 5830
		return -ENOSYS;
	}

5831
	slab_state = FULL;
5832

5833
	list_for_each_entry(s, &slab_caches, list) {
5834
		err = sysfs_slab_add(s);
5835
		if (err)
5836 5837
			pr_err("SLUB: Unable to add boot slab %s to sysfs\n",
			       s->name);
5838
	}
C
Christoph Lameter 已提交
5839 5840 5841 5842 5843 5844

	while (alias_list) {
		struct saved_alias *al = alias_list;

		alias_list = alias_list->next;
		err = sysfs_slab_alias(al->s, al->name);
5845
		if (err)
5846 5847
			pr_err("SLUB: Unable to add boot slab alias %s to sysfs\n",
			       al->name);
C
Christoph Lameter 已提交
5848 5849 5850
		kfree(al);
	}

5851
	mutex_unlock(&slab_mutex);
C
Christoph Lameter 已提交
5852 5853 5854 5855 5856
	resiliency_test();
	return 0;
}

__initcall(slab_sysfs_init);
5857
#endif /* CONFIG_SYSFS */
P
Pekka J Enberg 已提交
5858 5859 5860 5861

/*
 * The /proc/slabinfo ABI
 */
Y
Yang Shi 已提交
5862
#ifdef CONFIG_SLUB_DEBUG
5863
void get_slabinfo(struct kmem_cache *s, struct slabinfo *sinfo)
P
Pekka J Enberg 已提交
5864 5865
{
	unsigned long nr_slabs = 0;
5866 5867
	unsigned long nr_objs = 0;
	unsigned long nr_free = 0;
P
Pekka J Enberg 已提交
5868
	int node;
C
Christoph Lameter 已提交
5869
	struct kmem_cache_node *n;
P
Pekka J Enberg 已提交
5870

C
Christoph Lameter 已提交
5871
	for_each_kmem_cache_node(s, node, n) {
5872 5873
		nr_slabs += node_nr_slabs(n);
		nr_objs += node_nr_objs(n);
5874
		nr_free += count_partial(n, count_free);
P
Pekka J Enberg 已提交
5875 5876
	}

5877 5878 5879 5880 5881 5882
	sinfo->active_objs = nr_objs - nr_free;
	sinfo->num_objs = nr_objs;
	sinfo->active_slabs = nr_slabs;
	sinfo->num_slabs = nr_slabs;
	sinfo->objects_per_slab = oo_objects(s->oo);
	sinfo->cache_order = oo_order(s->oo);
P
Pekka J Enberg 已提交
5883 5884
}

5885
void slabinfo_show_stats(struct seq_file *m, struct kmem_cache *s)
5886 5887 5888
{
}

5889 5890
ssize_t slabinfo_write(struct file *file, const char __user *buffer,
		       size_t count, loff_t *ppos)
5891
{
5892
	return -EIO;
5893
}
Y
Yang Shi 已提交
5894
#endif /* CONFIG_SLUB_DEBUG */