[SLUB 1/5] Fix object counting

[SLUB 1/5] Fix object counting

[Christoph Lameter]

Object counting did not take into account that the number of full slabs
is the total number of slabs - number of partial - number of cpu slabs. As a
results the counts were off a bit. This issue surfaced when slab validation
was implemented.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

---
 mm/slub.c |   61 ++++++++++++++++++++++++++++++++++---------------------------
 1 file changed, 34 insertions(+), 27 deletions(-)

Index: linux-2.6.21-rc6-mm1/mm/slub.c
===================================================================
--- linux-2.6.21-rc6-mm1.orig/mm/slub.c	2007-04-09 22:29:21.000000000 -0700
+++ linux-2.6.21-rc6-mm1/mm/slub.c	2007-04-09 22:30:06.000000000 -0700
@@ -2318,23 +2318,34 @@ static unsigned long slab_objects(struct
 	int node;
 	int x;
 	unsigned long *nodes;
+	unsigned long *per_cpu;
 
-	nodes = kmalloc(sizeof(unsigned long) * nr_node_ids, GFP_KERNEL);
+	nodes = kzalloc(2 * sizeof(unsigned long) * nr_node_ids, GFP_KERNEL);
+	per_cpu = nodes + nr_node_ids;
+
+	for_each_possible_cpu(cpu) {
+		struct page *page = s->cpu_slab[cpu];
+		int node;
+
+		if (page) {
+			node = page_to_nid(page);
+			if (flags & SO_CPU) {
+				int x = 0;
+
+				if (flags & SO_OBJECTS)
+					x = page->inuse;
+				else
+					x = 1;
+				total += x;
+				nodes[node] += x;
+			}
+			per_cpu[node]++;
+		}
+	}
 
 	for_each_online_node(node) {
 		struct kmem_cache_node *n = get_node(s, node);
 
-		nodes[node] = 0;
-
-		if (flags & SO_FULL) {
-			if (flags & SO_OBJECTS)
-				x = atomic_read(&n->nr_slabs)
-						* s->objects;
-			else
-				x = atomic_read(&n->nr_slabs);
-			total += x;
-			nodes[node] += x;
-		}
 		if (flags & SO_PARTIAL) {
 			if (flags & SO_OBJECTS)
 				x = count_partial(n);
@@ -2343,24 +2354,20 @@ static unsigned long slab_objects(struct
 			total += x;
 			nodes[node] += x;
 		}
-	}
-
-	if (flags & SO_CPU)
-		for_each_possible_cpu(cpu) {
-			struct page *page = s->cpu_slab[cpu];
 
-			if (page) {
-				int x = 0;
-				int node = page_to_nid(page);
+		if (flags & SO_FULL) {
+			int full_slabs = atomic_read(&n->nr_slabs)
+					- per_cpu[node]
+					- n->nr_partial;
 
-				if (flags & SO_OBJECTS)
-					x = page->inuse;
-				else
-					x = 1;
-				total += x;
-				nodes[node] += x;
-			}
+			if (flags & SO_OBJECTS)
+				x = full_slabs * s->objects;
+			else
+				x = full_slabs;
+			total += x;
+			nodes[node] += x;
 		}
+	}
 
 	x = sprintf(buf, "%lu", total);
 #ifdef CONFIG_NUMA

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[SLUB 2/5] Enable tracking of full slabs

[Christoph Lameter]

Track full slabs if free/alloc tracking is on

If slab tracking is on then build a list of full slabs so that we can
verify the integrity of all slabs and are also able to built list of
alloc/free callers.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

---
 include/linux/slub_def.h |    1 +
 mm/slub.c                |   38 ++++++++++++++++++++++++++++++++++----
 2 files changed, 35 insertions(+), 4 deletions(-)

Index: linux-2.6.21-rc6-mm1/mm/slub.c
===================================================================
--- linux-2.6.21-rc6-mm1.orig/mm/slub.c	2007-04-09 19:55:32.000000000 -0700
+++ linux-2.6.21-rc6-mm1/mm/slub.c	2007-04-09 21:08:48.000000000 -0700
@@ -572,6 +572,36 @@ static int on_freelist(struct kmem_cache
 	return 0;
 }
 
+/*
+ * Tracking of fully allocated slabs for debugging
+ */
+static void add_full(struct kmem_cache *s, struct page *page)
+{
+	struct kmem_cache_node *n;
+
+	if (!(s->flags & SLAB_STORE_USER))
+		return;
+
+	n = get_node(s, page_to_nid(page));
+	spin_lock(&n->list_lock);
+	list_add(&page->lru, &n->full);
+	spin_unlock(&n->list_lock);
+}
+
+static void remove_full(struct kmem_cache *s, struct page *page)
+{
+	struct kmem_cache_node *n;
+
+	if (!(s->flags & SLAB_STORE_USER))
+		return;
+
+	n = get_node(s, page_to_nid(page));
+
+	spin_lock(&n->list_lock);
+	list_del(&page->lru);
+	spin_unlock(&n->list_lock);
+}
+
 static int alloc_object_checks(struct kmem_cache *s, struct page *page,
 							void *object)
 {
@@ -990,6 +1020,9 @@ static void putback_slab(struct kmem_cac
 	if (page->inuse) {
 		if (page->freelist)
 			add_partial(s, page);
+		else
+		if (PageError(page))
+			add_full(s, page);
 		slab_unlock(page);
 	} else {
 		slab_unlock(page);
@@ -1253,7 +1286,7 @@ out_unlock:
 slab_empty:
 	if (prior)
 		/*
-		 * Partially used slab that is on the partial list.
+		 * Slab on the partial list.
 		 */
 		remove_partial(s, page);
 
@@ -1265,6 +1298,8 @@ slab_empty:
 debug:
 	if (!free_object_checks(s, page, x))
 		goto out_unlock;
+	if (!PageActive(page) && !page->freelist)
+		remove_full(s, page);
 	if (s->flags & SLAB_STORE_USER)
 		set_track(s, x, TRACK_FREE, addr);
 	goto checks_ok;
@@ -1383,6 +1418,7 @@ static void init_kmem_cache_node(struct 
 	atomic_long_set(&n->nr_slabs, 0);
 	spin_lock_init(&n->list_lock);
 	INIT_LIST_HEAD(&n->partial);
+	INIT_LIST_HEAD(&n->full);
 }
 
 #ifdef CONFIG_NUMA
Index: linux-2.6.21-rc6-mm1/include/linux/slub_def.h
===================================================================
--- linux-2.6.21-rc6-mm1.orig/include/linux/slub_def.h	2007-04-09 19:26:38.000000000 -0700
+++ linux-2.6.21-rc6-mm1/include/linux/slub_def.h	2007-04-09 20:59:25.000000000 -0700
@@ -16,6 +16,7 @@ struct kmem_cache_node {
 	unsigned long nr_partial;
 	atomic_long_t nr_slabs;
 	struct list_head partial;
+	struct list_head full;
 };
 
 /*

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

Implement validation of slabs

This enables validation of slab. Validation means that all objects are checked
to see if there are redzone violations, if padding has been overwritten or any
pointers have been corrupted. Also checks the consistency of slab counters.

Validation enables the detection of metadata corruption without the kernel
having to execute code that actually uses (allocs/frees) and object. It allows
one to make sure that the slab metainformation and the guard values around
an object have not been compromised.

A single slabcache can be checked by writing a 1 to the "validate" file.

i.e.

echo 1 >/sys/slab/kmalloc-128/validate

or use the slabinfo tool to check all slabs

slabinfo -v

Error messages will show up in the syslog.

Note that validation can only reach slabs that are on a list. This means
that we are usually restricted to partial slabs and active slabs unless
SLAB_STORE_USER is active which will build a full slab list and allows
validation of slabs that are fully in use. Booting with "slub_debug" set
will enable SLAB_STORE_USER and then full diagnostic are available.

Note that we attempt to push cpu slabs back to the lists when we start the
check. If the cpu slab is reactivated before we get to it (another processor
grabs it before we get to it) then it cannot be checked.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

---
 mm/slub.c |   87 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 86 insertions(+), 1 deletion(-)

Index: linux-2.6.21-rc6-mm1/mm/slub.c
===================================================================
--- linux-2.6.21-rc6-mm1.orig/mm/slub.c	2007-04-09 22:30:09.000000000 -0700
+++ linux-2.6.21-rc6-mm1/mm/slub.c	2007-04-09 22:30:11.000000000 -0700
@@ -2321,6 +2321,92 @@ void *__kmalloc_node_track_caller(size_t
 
 #ifdef CONFIG_SYSFS
 
+static int validate_slab(struct kmem_cache *s, struct page *page)
+{
+	void *p;
+	void *addr = page_address(page);
+	unsigned long map[BITS_TO_LONGS(s->objects)];
+
+	if (!check_slab(s, page) ||
+			!on_freelist(s, page, NULL))
+		return 0;
+
+	/* Now we know that a valid freelist exists */
+	bitmap_zero(map, s->objects);
+
+	for(p = page->freelist; p; p = get_freepointer(s, p)) {
+		set_bit((p - addr) / s->size, map);
+		if (!check_object(s, page, p, 0))
+			return 0;
+	}
+
+	for(p = addr; p < addr + s->objects * s->size; p += s->size)
+		if (!test_bit((p - addr) / s->size, map))
+			if (!check_object(s, page, p, 1))
+				return 0;
+	return 1;
+}
+
+static void validate_slab_slab(struct kmem_cache *s, struct page *page)
+{
+	if (slab_trylock(page)) {
+		validate_slab(s, page);
+		slab_unlock(page);
+	} else
+		printk(KERN_INFO "SLUB: %s Skipped busy slab %p\n",
+			s->name, page);
+
+	if (!PageError(page))
+		printk(KERN_ERR "SLUB: %s PageError not set on slab %p\n",
+			s->name, page);
+}
+
+static int validate_slab_node(struct kmem_cache *s, struct kmem_cache_node *n)
+{
+	unsigned long count = 0;
+	struct page *page;
+	unsigned long flags;
+
+	spin_lock_irqsave(&n->list_lock, flags);
+
+	list_for_each_entry(page, &n->partial, lru) {
+		validate_slab_slab(s, page);
+		count++;
+	}
+	if (count != n->nr_partial)
+		printk("SLUB: %s %ld partial slabs counted but counter=%ld\n",
+			s->name, count, n->nr_partial);
+
+	if (!(s->flags & SLAB_STORE_USER))
+		goto out;
+
+	list_for_each_entry(page, &n->full, lru) {
+		validate_slab_slab(s, page);
+		count++;
+	}
+	if (count != atomic_long_read(&n->nr_slabs))
+		printk("SLUB: %s %ld slabs counted but counter=%ld\n",
+		s->name, count, atomic_long_read(&n->nr_slabs));
+
+out:
+	spin_unlock_irqrestore(&n->list_lock, flags);
+	return count;
+}
+
+static unsigned long validate_slab_cache(struct kmem_cache *s)
+{
+	int node;
+	unsigned long count = 0;
+
+	flush_all(s);
+	for_each_online_node(node) {
+		struct kmem_cache_node *n = get_node(s, node);
+
+		count += validate_slab_node(s, n);
+	}
+	return count;
+}
+
 static unsigned long count_partial(struct kmem_cache_node *n)
 {
 	unsigned long flags;
@@ -2450,7 +2536,6 @@ struct slab_attribute {
 	static struct slab_attribute _name##_attr =  \
 	__ATTR(_name, 0644, _name##_show, _name##_store)
 
-
 static ssize_t slab_size_show(struct kmem_cache *s, char *buf)
 {
 	return sprintf(buf, "%d\n", s->size);
@@ -2656,6 +2741,22 @@ static ssize_t store_user_store(struct k
 }
 SLAB_ATTR(store_user);
 
+static ssize_t validate_show(struct kmem_cache *s, char *buf)
+{
+	return 0;
+}
+
+static ssize_t validate_store(struct kmem_cache *s,
+			const char *buf, size_t length)
+{
+	if (buf[0] == '1')
+		validate_slab_cache(s);
+	else
+		return -EINVAL;
+	return length;
+}
+SLAB_ATTR(validate);
+
 #ifdef CONFIG_NUMA
 static ssize_t defrag_ratio_show(struct kmem_cache *s, char *buf)
 {
@@ -2695,6 +2796,7 @@ static struct attribute * slab_attrs[] =
 	&red_zone_attr.attr,
 	&poison_attr.attr,
 	&store_user_attr.attr,
+	&validate_attr.attr,
 #ifdef CONFIG_ZONE_DMA
 	&cache_dma_attr.attr,
 #endif

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[SLUB 4/5] Add ability to list alloc / free callers per slab

[Christoph Lameter]

This patch enables listing the callers who allocated or freed objects in a cache.

For example to list the allocators for kmalloc-128 do

cat /sys/slab/kmalloc-128/alloc_calls
      7 sn_io_slot_fixup+0x40/0x700
      7 sn_io_slot_fixup+0x80/0x700
      9 sn_bus_fixup+0xe0/0x380
      6 param_sysfs_setup+0xf0/0x280
    276 percpu_populate+0xf0/0x1a0
     19 __register_chrdev_region+0x30/0x360
      8 expand_files+0x2e0/0x6e0
      1 sys_epoll_create+0x60/0x200
      1 __mounts_open+0x140/0x2c0
     65 kmem_alloc+0x110/0x280
      3 alloc_disk_node+0xe0/0x200
     33 as_get_io_context+0x90/0x280
     74 kobject_kset_add_dir+0x40/0x140
     12 pci_create_bus+0x2a0/0x5c0
      1 acpi_ev_create_gpe_block+0x120/0x9e0
     41 con_insert_unipair+0x100/0x1c0
      1 uart_open+0x1c0/0xba0
      1 dma_pool_create+0xe0/0x340
      2 neigh_table_init_no_netlink+0x260/0x4c0
      6 neigh_parms_alloc+0x30/0x200
      1 netlink_kernel_create+0x130/0x320
      5 fz_hash_alloc+0x50/0xe0
      2 sn_common_hubdev_init+0xd0/0x6e0
     28 kernel_param_sysfs_setup+0x30/0x180
     72 process_zones+0x70/0x2e0

cat /sys/slab/kmalloc-128/free_calls
    558 <not-available>
      3 sn_io_slot_fixup+0x600/0x700
     84 free_fdtable_rcu+0x120/0x260
      2 seq_release+0x40/0x60
      6 kmem_free+0x70/0xc0
     24 free_as_io_context+0x20/0x200
      1 acpi_get_object_info+0x3a0/0x3e0
      1 acpi_add_single_object+0xcf0/0x1e40
      2 con_release_unimap+0x80/0x140
      1 free+0x20/0x40

SLAB_STORE_USER must be enabled for a slab cache by either booting with
"slab_debug" or enabling user tracking specifically for the slab of interest.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

---
 mm/slub.c |  162 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 162 insertions(+)

Index: linux-2.6.21-rc6-mm1/mm/slub.c
===================================================================
--- linux-2.6.21-rc6-mm1.orig/mm/slub.c	2007-04-09 22:30:11.000000000 -0700
+++ linux-2.6.21-rc6-mm1/mm/slub.c	2007-04-09 22:30:16.000000000 -0700
@@ -67,9 +67,6 @@
  *
  * - Support PAGE_ALLOC_DEBUG. Should be easy to do.
  *
- * - Support DEBUG_SLAB_LEAK. Trouble is we do not know where the full
- *   slabs are in SLUB.
- *
  * - SLAB_DEBUG_INITIAL is not supported but I have never seen a use of
  *   it.
  *
@@ -2407,6 +2404,169 @@ static unsigned long validate_slab_cache
 	return count;
 }
 
+/*
+ * Generate lists of locations where slabcache objects are allocated
+ * and freed.
+ */
+
+struct location {
+	unsigned long count;
+	void *addr;
+};
+
+struct loc_track {
+	unsigned long max;
+	unsigned long count;
+	struct location *loc;
+};
+
+static void free_loc_track(struct loc_track *t)
+{
+	if (t->max)
+		free_pages((unsigned long)t->loc,
+			get_order(sizeof(struct location) * t->max));
+}
+
+static int alloc_loc_track(struct loc_track *t, unsigned long max)
+{
+	struct location *l;
+	int order;
+
+	if (!max)
+		max = PAGE_SIZE / sizeof(struct location);
+
+	order = get_order(sizeof(struct location) * max);
+
+	l = (void *)__get_free_pages(GFP_KERNEL, order);
+
+	if (!l)
+		return 0;
+
+	if (t->count) {
+		memcpy(l, t->loc, sizeof(struct location) * t->count);
+		free_loc_track(t);
+	}
+	t->max = max;
+	t->loc = l;
+	return 1;
+}
+
+static int add_location(struct loc_track *t, struct kmem_cache *s,
+						void *addr)
+{
+	long start, end, pos;
+	struct location *l;
+	void *caddr;
+
+	start = -1;
+	end = t->count;
+
+	for(;;) {
+		pos = start + (end - start + 1) / 2;
+
+		/*
+		 * There is nothing at "end". If we end up there
+		 * we need to add something to before end.
+		 */
+		if (pos == end)
+			break;
+
+		caddr = t->loc[pos].addr;
+		if (addr == caddr) {
+			t->loc[pos].count++;
+			return 1;
+		}
+
+		if (addr < caddr)
+			end = pos;
+		else
+			start = pos;
+	}
+
+	/*
+	 * Not found. Insert new tracking element
+	 */
+	if (t->count >= t->max && !alloc_loc_track(t, 2 * t->max))
+		return 0;
+
+	l = t->loc + pos;
+	if (pos < t->count)
+		memmove(l + 1, l,
+			(t->count - pos) * sizeof(struct location));
+	t->count++;
+	l->count = 1;
+	l->addr = addr;
+	return 1;
+}
+
+static void process_slab(struct loc_track *t, struct kmem_cache *s,
+		struct page *page, enum track_item alloc)
+{
+	void *addr = page_address(page);
+	unsigned long map[BITS_TO_LONGS(s->objects)];
+	void *p;
+
+	bitmap_zero(map, s->objects);
+	for(p = page->freelist; p; p = get_freepointer(s, p))
+		set_bit((p - addr) / s->size, map);
+
+	for(p = addr; p < addr + s->objects * s->size; p += s->size)
+		if (!test_bit((p - addr) / s->size, map)) {
+			void *addr = get_track(s, p, alloc)->addr;
+
+			add_location(t, s, addr);
+		}
+}
+
+static int list_locations(struct kmem_cache *s, char *buf,
+					enum track_item alloc)
+{
+	int n = 0;
+	unsigned long i;
+	struct loc_track t;
+	int node;
+
+	t.count = 0;
+	t.max = 0;
+
+	/* Push back cpu slabs */
+	flush_all(s);
+
+	for_each_online_node(node) {
+		struct kmem_cache_node *n = get_node(s, node);
+		unsigned long flags;
+		struct page *page;
+
+		if (!atomic_read(&n->nr_slabs))
+			continue;
+
+		spin_lock_irqsave(&n->list_lock, flags);
+		list_for_each_entry(page, &n->partial, lru)
+			process_slab(&t, s, page, alloc);
+		list_for_each_entry(page, &n->full, lru)
+			process_slab(&t, s, page, alloc);
+		spin_unlock_irqrestore(&n->list_lock, flags);
+	}
+
+	for (i = 0; i < t.count; i++) {
+		void *addr = t.loc[i].addr;
+
+		if (n > PAGE_SIZE - 100)
+			break;
+		n += sprintf(buf + n, "%7ld ", t.loc[i].count);
+		if (addr)
+			n += sprint_symbol(buf + n, (unsigned long)t.loc[i].addr);
+		else
+			n += sprintf(buf + n, "<not-available>");
+		n += sprintf(buf + n, "\n");
+	}
+
+	free_loc_track(&t);
+	if (!t.count)
+		n += sprintf(buf, "No data\n");
+	return n;
+}
+
 static unsigned long count_partial(struct kmem_cache_node *n)
 {
 	unsigned long flags;
@@ -2757,6 +2917,22 @@ static ssize_t validate_store(struct kme
 }
 SLAB_ATTR(validate);
 
+static ssize_t alloc_calls_show(struct kmem_cache *s, char *buf)
+{
+	if (!(s->flags & SLAB_STORE_USER))
+		return -ENOSYS;
+	return list_locations(s, buf, TRACK_ALLOC);
+}
+SLAB_ATTR_RO(alloc_calls);
+
+static ssize_t free_calls_show(struct kmem_cache *s, char *buf)
+{
+	if (!(s->flags & SLAB_STORE_USER))
+		return -ENOSYS;
+	return list_locations(s, buf, TRACK_FREE);
+}
+SLAB_ATTR_RO(free_calls);
+
 #ifdef CONFIG_NUMA
 static ssize_t defrag_ratio_show(struct kmem_cache *s, char *buf)
 {
@@ -2797,6 +2973,8 @@ static struct attribute * slab_attrs[] =
 	&poison_attr.attr,
 	&store_user_attr.attr,
 	&validate_attr.attr,
+	&alloc_calls_attr.attr,
+	&free_calls_attr.attr,
 #ifdef CONFIG_ZONE_DMA
 	&cache_dma_attr.attr,
 #endif

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[SLUB 5/5] Drop version number

[Christoph Lameter]

Drop the version number since we do not have to manage patchsets anymore.

I hope that the set of features for SLUB is complete now.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6-mm1/mm/slub.c
===================================================================
--- linux-2.6.21-rc6-mm1.orig/mm/slub.c	2007-04-09 22:32:21.000000000 -0700
+++ linux-2.6.21-rc6-mm1/mm/slub.c	2007-04-09 22:32:37.000000000 -0700
@@ -2042,7 +2042,7 @@ void __init kmem_cache_init(void)
 		kmem_size = offsetof(struct kmem_cache, cpu_slab)
 			 + nr_cpu_ids * sizeof(struct page *);
 
-	printk(KERN_INFO "SLUB V6: General Slabs=%d, HW alignment=%d, "
+	printk(KERN_INFO "SLUB: General Slabs=%d, HW alignment=%d, "
 		"Processors=%d, Nodes=%d\n",
 		KMALLOC_SHIFT_HIGH, L1_CACHE_BYTES,
 		nr_cpu_ids, nr_node_ids);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Andrew Morton]

On Tue, 10 Apr 2007 12:19:21 -0700 (PDT)
Christoph Lameter <clameter@sgi.com> wrote:

> This enables validation of slab. Validation means that all objects are checked
> to see if there are redzone violations, if padding has been overwritten or any
> pointers have been corrupted. Also checks the consistency of slab counters.
> 
> Validation enables the detection of metadata corruption without the kernel
> having to execute code that actually uses (allocs/frees) and object. It allows
> one to make sure that the slab metainformation and the guard values around
> an object have not been compromised.
> 
> A single slabcache can be checked by writing a 1 to the "validate" file.
> 
> i.e.
> 
> echo 1 >/sys/slab/kmalloc-128/validate
> 
> or use the slabinfo tool to check all slabs
> 
> slabinfo -v
> 
> Error messages will show up in the syslog.

Neato.

It would be nice to get all this stuff user-documented, so there's one place to
go to work out how to drive slub.

We should force -mm testers to use slub by default, while providing them a
way of going back to slab if they hit problems.  Can you please cook up a
-mm-only patch for that?

Could print_track() be simplified by using -mm's sprint_symbol()?

I didn't immediately locate any description of what slab_lock() and
slab->list_lock are protecting, nor of the irq-safeness requirements upon
them.  That's important info.

How come slab_lock() isn't needed if CONFIG_SMP=n, CONFIG_PREEMPT=y?  I
think that bit_spin_lock() does the right thing, and the #ifdef CONFIG_SMP
in there should be removed.

The use of slab_trylock() could do with some commentary: under what
circumstances can it fail, what action do we take when it fails, why is
this OK, etc.

There are a bunch of functions which need to be called with local irqs
disabled for locking reasons.  Documenting this (perhaps with
VM_BUG_ON(!irqs_disabled()?) would be good.

calculate_order() is an important function.  The mapping between
object-size and what-size-slab-will-use is something which regularly comes
up, as it affects the reliability of the allocations of those objects, and
their cost, and their page allocator fragmentation effects, etc.  Hence I
think calculate_order() needs comprehensive commenting.  Rather than none ;)

What does that 65536 mean in kmem_cache_open? (Needs comment?)

Where do I go to learn what "s->defrag_ratio = 100;" means?

Why is kmem_cache_close() non-static and exported to modules? 

Please check that all printks have suitable facility levels (KERN_FOO).


I queued a pile of little cleanups, which you have been spammed with.  To
resync, a rollup up to and including the slub patches is at
http://userweb.kernel.org/~akpm/cl.gz (against 2.6.21-rc6).


Teeny, teeny maximally-fine-grained little patches from now on, please. 
Otherwise my whole house of cards will collapse.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Dave Jones]

On Tue, Apr 10, 2007 at 01:31:37PM -0700, Andrew Morton wrote:
 
 > > an object have not been compromised.
 > > 
 > > A single slabcache can be checked by writing a 1 to the "validate" file.
 > > 
 > > i.e.
 > > 
 > > echo 1 >/sys/slab/kmalloc-128/validate
 > > 
 > > or use the slabinfo tool to check all slabs
 > > 
 > > slabinfo -v
 > > 
 > > Error messages will show up in the syslog.
 > 
 > Neato.

I had a patch (I think originally from Manfred Spraul) that I carried
in Fedora for a while which this patch reminded me of.
Instead of a /sys file however, it ran off a timer every few
minutes to check redzones of unfreed objects.  It picked up a few bugs,
but eventually, I got bored rediffing it, it broke, and it fell by
the wayside.  (It was against slab too, rather than one of its
decendants).

Whilst I nursed that along for a few months, I made a few not-so-agressive
pushes to get it mainlined, but there seemed to be no real interest.
(Yikes, something that'll show we have *more* bugs? Noooo!)

Would be nice to have equal functionality across the different allocators.

	Dave

-- 
http://www.codemonkey.org.uk

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> It would be nice to get all this stuff user-documented, so there's one place to
> go to work out how to drive slub.

Ok. Some more writing to do.

> We should force -mm testers to use slub by default, while providing them a
> way of going back to slab if they hit problems.  Can you please cook up a
> -mm-only patch for that?

Will do.
 
> Could print_track() be simplified by using -mm's sprint_symbol()?

I thought sprint_symbol only gives the symbol? Does it give us the offset 
too?

> How come slab_lock() isn't needed if CONFIG_SMP=n, CONFIG_PREEMPT=y?  I
> think that bit_spin_lock() does the right thing, and the #ifdef CONFIG_SMP
> in there should be removed.

Right.... 

> The use of slab_trylock() could do with some commentary: under what
> circumstances can it fail, what action do we take when it fails, why is
> this OK, etc.

There is some comment when it is used in get_partial_node().

> There are a bunch of functions which need to be called with local irqs
> disabled for locking reasons.  Documenting this (perhaps with
> VM_BUG_ON(!irqs_disabled()?) would be good.

Ok.

> calculate_order() is an important function.  The mapping between
> object-size and what-size-slab-will-use is something which regularly comes
> up, as it affects the reliability of the allocations of those objects, and
> their cost, and their page allocator fragmentation effects, etc.  Hence I
> think calculate_order() needs comprehensive commenting.  Rather than none ;)

Ok.
 
> What does that 65536 mean in kmem_cache_open? (Needs comment?)
> 
> Where do I go to learn what "s->defrag_ratio = 100;" means?

Hmmm... There are some comments in get_any_partial() but I can clarify 
that.

> Why is kmem_cache_close() non-static and exported to modules? 

Leftover from a time when kmem_cache_open was exported. Needs fix.
 
> Please check that all printks have suitable facility levels (KERN_FOO).

> I queued a pile of little cleanups, which you have been spammed with.  To
> resync, a rollup up to and including the slub patches is at
> http://userweb.kernel.org/~akpm/cl.gz (against 2.6.21-rc6).

> Teeny, teeny maximally-fine-grained little patches from now on, please. 
> Otherwise my whole house of cards will collapse.

Allright.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> How come slab_lock() isn't needed if CONFIG_SMP=n, CONFIG_PREEMPT=y?  I
> think that bit_spin_lock() does the right thing, and the #ifdef CONFIG_SMP
> in there should be removed.

SLUB: We do not need #ifdef CONFIG_SMP around bit spinlocks.

Remove them.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 14:05:04.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 14:05:31.000000000 -0700
@@ -857,25 +857,19 @@ static void discard_slab(struct kmem_cac
  */
 static __always_inline void slab_lock(struct page *page)
 {
-#ifdef CONFIG_SMP
 	bit_spin_lock(PG_locked, &page->flags);
-#endif
 }
 
 static __always_inline void slab_unlock(struct page *page)
 {
-#ifdef CONFIG_SMP
 	bit_spin_unlock(PG_locked, &page->flags);
-#endif
 }
 
 static __always_inline int slab_trylock(struct page *page)
 {
 	int rc = 1;
 
-#ifdef CONFIG_SMP
 	rc = bit_spin_trylock(PG_locked, &page->flags);
-#endif
 	return rc;
 }
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> Please check that all printks have suitable facility levels (KERN_FOO).

SLUB: printk facility level cleanup

Consistently use KERN_ERR instead of KERN_CRIT. Fixup one location
where we did not use a facility level.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 14:07:02.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 14:09:01.000000000 -0700
@@ -496,14 +496,14 @@ static int check_object(struct kmem_cach
 static int check_slab(struct kmem_cache *s, struct page *page)
 {
 	if (!PageSlab(page)) {
-		printk(KERN_CRIT "SLUB: %s Not a valid slab page @0x%p "
+		printk(KERN_ERR "SLUB: %s Not a valid slab page @0x%p "
 			"flags=%lx mapping=0x%p count=%d \n",
 			s->name, page, page->flags, page->mapping,
 			page_count(page));
 		return 0;
 	}
 	if (page->offset * sizeof(void *) != s->offset) {
-		printk(KERN_CRIT "SLUB: %s Corrupted offset %lu in slab @0x%p"
+		printk(KERN_ERR "SLUB: %s Corrupted offset %lu in slab @0x%p"
 			" flags=0x%lx mapping=0x%p count=%d\n",
 			s->name,
 			(unsigned long)(page->offset * sizeof(void *)),
@@ -514,7 +514,7 @@ static int check_slab(struct kmem_cache 
 		return 0;
 	}
 	if (page->inuse > s->objects) {
-		printk(KERN_CRIT "SLUB: %s Inuse %u > max %u in slab "
+		printk(KERN_ERR "SLUB: %s Inuse %u > max %u in slab "
 			"page @0x%p flags=%lx mapping=0x%p count=%d\n",
 			s->name, page->inuse, s->objects, page, page->flags,
 			page->mapping, page_count(page));
@@ -560,7 +560,7 @@ static int on_freelist(struct kmem_cache
 	}
 
 	if (page->inuse != s->objects - nr) {
-		printk(KERN_CRIT "slab %s: page 0x%p wrong object count."
+		printk(KERN_ERR "slab %s: page 0x%p wrong object count."
 			" counter is %d but counted were %d\n",
 			s->name, page, page->inuse,
 			s->objects - nr);
@@ -625,7 +625,7 @@ static int alloc_object_checks(struct km
 	init_object(s, object, 1);
 
 	if (s->flags & SLAB_TRACE) {
-		printk("TRACE %s alloc 0x%p inuse=%d fp=0x%p\n",
+		printk(KERN_INFO "TRACE %s alloc 0x%p inuse=%d fp=0x%p\n",
 			s->name, object, page->inuse,
 			page->freelist);
 		dump_stack();
@@ -654,7 +654,7 @@ static int free_object_checks(struct kme
 	}
 
 	if (on_freelist(s, page, object)) {
-		printk(KERN_CRIT "SLUB: %s slab 0x%p object "
+		printk(KERN_ERR "SLUB: %s slab 0x%p object "
 			"0x%p already free.\n", s->name, page, object);
 		goto fail;
 	}
@@ -664,23 +664,23 @@ static int free_object_checks(struct kme
 
 	if (unlikely(s != page->slab)) {
 		if (!PageSlab(page))
-			printk(KERN_CRIT "slab_free %s size %d: attempt to"
+			printk(KERN_ERR "slab_free %s size %d: attempt to"
 				"free object(0x%p) outside of slab.\n",
 				s->name, s->size, object);
 		else
 		if (!page->slab)
-			printk(KERN_CRIT
+			printk(KERN_ERR
 				"slab_free : no slab(NULL) for object 0x%p.\n",
 						object);
 		else
-		printk(KERN_CRIT "slab_free %s(%d): object at 0x%p"
+		printk(KERN_ERR "slab_free %s(%d): object at 0x%p"
 				" belongs to slab %s(%d)\n",
 				s->name, s->size, object,
 				page->slab->name, page->slab->size);
 		goto fail;
 	}
 	if (s->flags & SLAB_TRACE) {
-		printk("TRACE %s free 0x%p inuse=%d fp=0x%p\n",
+		printk(KERN_INFO "TRACE %s free 0x%p inuse=%d fp=0x%p\n",
 			s->name, object, page->inuse,
 			page->freelist);
 		print_section("Object", object, s->objsize);
@@ -1794,7 +1794,7 @@ static int __init setup_slub_debug(char 
 				slub_debug |= SLAB_TRACE;
 				break;
 			default:
-				printk(KERN_CRIT "slub_debug option '%c' "
+				printk(KERN_ERR "slub_debug option '%c' "
 					"unknown. skipped\n",*str);
 			}
 	}

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> Why is kmem_cache_close() non-static and exported to modules? 

SLUB: kmem_cache_close is static and should not be exported.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 14:06:50.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 14:07:02.000000000 -0700
@@ -1700,7 +1700,6 @@ static int kmem_cache_close(struct kmem_
 	free_kmem_cache_nodes(s);
 	return 0;
 }
-EXPORT_SYMBOL(kmem_cache_close);
 
 /*
  * Close a cache and release the kmem_cache structure

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> Where do I go to learn what "s->defrag_ratio = 100;" means?


SLUB: add explanation for defrag_ratio = 100.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 14:16:33.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 14:19:05.000000000 -0700
@@ -961,6 +961,12 @@ static struct page *get_any_partial(stru
 	 *
 	 * A higher ratio means slabs may be taken from other nodes
 	 * thus reducing the number of partial slabs on those nodes.
+	 *
+	 * If /sys/slab/xx/defrag_ratio is set to 100 (which makes
+	 * defrag_ratio = 1000) then every (well almost) allocation
+	 * will first attempt to defrag slab caches on other nodes. This
+	 * means scanning over all nodes to look for partial slabs which
+	 * may be a bit expensive to do on every slab allocation.
 	 */
 	if (!s->defrag_ratio || get_cycles() % 1024 > s->defrag_ratio)
 		return NULL;

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> I didn't immediately locate any description of what slab_lock() and
> slab->list_lock are protecting, nor of the irq-safeness requirements upon
> them.  That's important info.

SLUB: Add explanation for locking

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 14:23:41.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 14:38:25.000000000 -0700
@@ -26,6 +26,42 @@
  *   1. slab_lock(page)
  *   2. slab->list_lock
  *
+ *   The slab_lock protects operations on the object of a particular
+ *   slab and its metadata in the page struct. If the slab lock
+ *   has been taken the no allocations nor frees can be performed
+ *   on the objects in the slab nor can the slab be added or removed
+ *   from the partial or full lists since this would mean modifying
+ *   the page_struct of the slab.
+ *
+ *   The list_lock protects the partial and full list on each node and
+ *   the partial slab counter. If taken then no new slabs may be added or
+ *   removed from the lists nor make the number of partial slabs be modified.
+ *   (Note that the total number of slabs is an atomic value that may be
+ *   modified without taking the list lock).
+ *   The list_lock is a centralized lock and thus we avoid taking it as
+ *   much as possible. As long as SLUB does not have to handle partial
+ *   slabs operations can continue without any centralized lock. F.e.
+ *   allocating a long series of objects that fill up slabs does not require
+ *   the list lock.
+ *
+ *   The lock order is sometimes inverted when we are trying to get a slab
+ *   off a list. We take the list_lock and then look for a page on the list
+ *   to use. While we do that objects in the slabs may be freed so we can
+ *   only operate on the slab if we have also taken the slab_lock. So we use
+ *   a slab_try_lock() on the page. If trylock was successful then no frees
+ *   can occur anymore and we can use the slab for allocations etc. If the
+ *   slab_try_lock does not succeed then frees are occur to the slab and
+ *   we better stay away from it for awhile since we may cause a bouncing
+ *   cacheline if we would try to acquire the lock. So go onto the next slab.
+ *   If all pages are busy then we may allocate a new slab instead of reusing
+ *   a partial slab. A new slab has no one operating on it and thus there is
+ *   no danger of cacheline contention.
+ *
+ *   Interrupts are disabled during allocation and deallocation in order to
+ *   make the slab allocator safe to use in the context of an irq. In addition
+ *   interrupts are disabled to insure that the processor does not change
+ *   while handling per_cpu slabs.
+ *
  * SLUB assigns one slab for allocation to each processor.
  * Allocations only occur from these slabs called cpu slabs.
  *

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Andrew Morton]

On Tue, 10 Apr 2007 16:47:11 -0400
Dave Jones <davej@redhat.com> wrote:

> On Tue, Apr 10, 2007 at 01:31:37PM -0700, Andrew Morton wrote:
>  
>  > > an object have not been compromised.
>  > > 
>  > > A single slabcache can be checked by writing a 1 to the "validate" file.
>  > > 
>  > > i.e.
>  > > 
>  > > echo 1 >/sys/slab/kmalloc-128/validate
>  > > 
>  > > or use the slabinfo tool to check all slabs
>  > > 
>  > > slabinfo -v
>  > > 
>  > > Error messages will show up in the syslog.
>  > 
>  > Neato.
> 
> I had a patch (I think originally from Manfred Spraul) that I carried
> in Fedora for a while which this patch reminded me of.
> Instead of a /sys file however, it ran off a timer every few
> minutes to check redzones of unfreed objects.

yup.  Of course, that can be done with a cronjob with slub.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> What does that 65536 mean in kmem_cache_open? (Needs comment?)

SLUB: Explain the 64k limits.

Note that these limits could now be removed since we no longer use
page->private for compound pages. But I think this is fine for now.

Signed-off-by: Christoph Lameter <clameter@sgi.com>


Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 15:40:58.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 15:47:16.000000000 -0700
@@ -1594,6 +1594,12 @@ static int calculate_sizes(struct kmem_c
 		return 0;
 
 	s->objects = (PAGE_SIZE << s->order) / size;
+
+	/*
+	 * Verify that the number of objects is within permitted limits.
+	 * The page->inuse field is only 16 bit wide! So we cannot have
+	 * more than 64k objects per slab.
+	 */
 	if (!s->objects || s->objects > 65535)
 		return 0;
 	return 1;
@@ -1616,9 +1622,23 @@ static int kmem_cache_open(struct kmem_c
 
 	BUG_ON(flags & SLUB_UNIMPLEMENTED);
 
-	if (s->size >= 65535 * sizeof(void *))
+	/*
+	 * The page->offset field is only 16 bit wide. This is an offset
+	 * in units of words from the beginning of an object. If the slab
+	 * size is bigger then we cannot move the free pointer behind the
+	 * object anymore.
+	 *
+	 * On 32 bit platforms the limit is 256k. On 64bit platforms
+	 * the limit is 512k.
+	 *
+	 * Debugging or ctor/dtors may create a need to move the free
+	 * pointer. Fail if this happens.
+	 */
+	if (s->size >= 65535 * sizeof(void *)) {
 		BUG_ON(flags & (SLAB_RED_ZONE | SLAB_POISON |
 				SLAB_STORE_USER | SLAB_DESTROY_BY_RCU));
+		BUG_ON(ctor || dtor);
+	}
 	else
 		/*
 		 * Enable debugging if selected on the kernel commandline.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> calculate_order() is an important function.  The mapping between
> object-size and what-size-slab-will-use is something which regularly comes
> up, as it affects the reliability of the allocations of those objects, and
> their cost, and their page allocator fragmentation effects, etc.  Hence I
> think calculate_order() needs comprehensive commenting.  Rather than none ;)

SLUB: explain sizing of slabs in detail

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 15:55:34.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 16:15:20.000000000 -0700
@@ -1403,6 +1403,27 @@ static int slub_debug;
 
 static char *slub_debug_slabs;
 
+/*
+ * Calculate the order of allocation given an slab object size.
+ *
+ * The order of allocation has significant impact on other elements
+ * of the system. Generally order 0 allocations should be preferred
+ * since they do not cause fragmentation in the page allocator. Larger
+ * objects may have problems with order 0 because there may be too much
+ * space left unused in a slab. We go to a higher order if more than 1/8th
+ * of the slab would be wasted.
+ *
+ * In order to reach satisfactory performance we must insure that
+ * a minimum number of objects is in one slab. Otherwise we may
+ * generate too much activity on the partial lists. This is less a
+ * concern for large slabs though. slub_max_order specified the order
+ * where we begin to stop considering the number of objects in a slab.
+ *
+ * Higher order allocations also allow the placement of more objects
+ * in a slab and thereby reduce object handling overhead. If the user
+ * has requested a higher mininum order then we start with that one
+ * instead of zero.
+ */
 static int calculate_order(int size)
 {
 	int order;
@@ -1430,6 +1451,10 @@ static int calculate_order(int size)
 	return order;
 }
 
+/*
+ * Function to figure out which alignment to use from the
+ * various ways of specifying it.
+ */
 static unsigned long calculate_alignment(unsigned long flags,
 		unsigned long align)
 {
@@ -1543,28 +1568,48 @@ static int init_kmem_cache_nodes(struct 
 }
 #endif
 
+/*
+ * calculate_sizes() determines the order and the distribution of data within
+ * a slab object.
+ */
 static int calculate_sizes(struct kmem_cache *s)
 {
 	unsigned long flags = s->flags;
 	unsigned long size = s->objsize;
 	unsigned long align = s->align;
 
+	/*
+	 * Determine if we can poison the object itself. If the user of
+	 * the slab may touch the object after free or before allocation
+	 * then we should never poison the object itself.
+	 */
 	if ((flags & SLAB_POISON) && !(flags & SLAB_DESTROY_BY_RCU) &&
 			!s->ctor && !s->dtor)
 		flags |= __OBJECT_POISON;
 	else
 		flags &= ~__OBJECT_POISON;
 
+	/*
+	 * Round up object size to the next word boundary. We can only
+	 * place the free pointer at word boundaries and this determines
+	 * the possible location of the free pointer.
+	 */
 	size = ALIGN(size, sizeof(void *));
 
 	/*
-	 * If we redzone then check if we have space through above
-	 * alignment. If not then add an additional word, so
-	 * that we have a guard value to check for overwrites.
+	 * If we redzone then check if we there is some space between the
+	 * end of the object and the free pointer. If not then add an
+	 * additional word, so that we can establish a redzone between
+	 * the object and the freepointer to be able to chek for overwrites.
 	 */
 	if ((flags & SLAB_RED_ZONE) && size == s->objsize)
 		size += sizeof(void *);
 
+	/*
+	 * With that we have determined how much of the slab is in actual
+	 * use by the object. This is the potential offset to the free
+	 * pointer.
+	 */
 	s->inuse = size;
 
 	if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
@@ -1582,10 +1627,24 @@ static int calculate_sizes(struct kmem_c
 	}
 
 	if (flags & SLAB_STORE_USER)
+		/*
+		 * Need to store information about allocs and frees after
+		 * the object.
+		 */
 		size += 2 * sizeof(struct track);
 
+	/*
+	 * Determine the alignment based on various parameters that the
+	 * user specified (this is unecessarily complex due to the attempt
+	 * to be compatible with SLAB. Should be cleaned up some day).
+	 */
 	align = calculate_alignment(flags, align);
 
+	/*
+	 * SLUB stores one object immediately after another beginning from
+	 * offset 0. In order to align the objects we have to simply size
+	 * each object to conform to the alignment.
+	 */
 	size = ALIGN(size, align);
 	s->size = size;
 
@@ -1593,6 +1652,9 @@ static int calculate_sizes(struct kmem_c
 	if (s->order < 0)
 		return 0;
 
+	/*
+	 * Determine the number of objects per slab
+	 */
 	s->objects = (PAGE_SIZE << s->order) / size;
 
 	/*

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> There are a bunch of functions which need to be called with local irqs
> disabled for locking reasons.  Documenting this (perhaps with
> VM_BUG_ON(!irqs_disabled()?) would be good.

SLUB: Add checks for interrupts disabled

This only adds interrupt disabled checks to code paths taken if
debugging is on. I want to avoid constant checks in hot paths (like in 
SLAB). VM_BUG_ON may be enabled by distributors who want to play it safe.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 16:18:13.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 16:25:33.000000000 -0700
@@ -531,6 +531,8 @@ static int check_object(struct kmem_cach
 
 static int check_slab(struct kmem_cache *s, struct page *page)
 {
+	VM_BUG_ON(!irqs_disabled());
+
 	if (!PageSlab(page)) {
 		printk(KERN_ERR "SLUB: %s Not a valid slab page @0x%p "
 			"flags=%lx mapping=0x%p count=%d \n",
@@ -612,6 +614,8 @@ static void add_full(struct kmem_cache *
 {
 	struct kmem_cache_node *n;
 
+	VM_BUG_ON(!irqs_disabled());
+
 	if (!(s->flags & SLAB_STORE_USER))
 		return;
 
@@ -625,6 +629,8 @@ static void remove_full(struct kmem_cach
 {
 	struct kmem_cache_node *n;
 
+	VM_BUG_ON(!irqs_disabled());
+
 	if (!(s->flags & SLAB_STORE_USER))
 		return;
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Andrew Morton]

On Tue, 10 Apr 2007 15:49:59 -0700 (PDT)
Christoph Lameter <clameter@sgi.com> wrote:

> +
> +	/*
> +	 * Verify that the number of objects is within permitted limits.
> +	 * The page->inuse field is only 16 bit wide! So we cannot have
> +	 * more than 64k objects per slab.
> +	 */
>  	if (!s->objects || s->objects > 65535)

So we _could_ use (sizeof(page->inuse) << 8).   A bit anal, I guess, but
it would provide documentation and future-proofness.  Dunno.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> It would be nice to get all this stuff user-documented, so there's one place to
> go to work out how to drive slub.

Index: linux-2.6.21-rc6/Documentation/vm/slub.txt
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.21-rc6/Documentation/vm/slub.txt	2007-04-10 16:59:03.000000000 -0700
@@ -0,0 +1,114 @@
+Short users guide for SLUB
+--------------------------
+
+First of all slub should transparently replace SLAB. If you enable
+SLUB then everything should work the same (Note the word "should".
+There is likely not much value in that word at this point).
+
+The basic philosophy of SLUB is very different from SLAB. SLAB
+requires rebuilding the kernel to activate debug options for all
+SLABS. SLUB always includes full debugging but its off by default.
+SLUB can enable debugging only for selected slabs in order to avoid
+an impact on overall system performance which may make a bug more
+difficult to find.
+
+In order to switch debugging on one can add a option "slub_debug"
+to the kernel command line. That will enable full debugging for
+all slabs.
+
+Typically one would then use the "slabinfo" command to get statistical
+data and perform operation on the slabs. By default slabinfo only lists
+slabs that have data in them. See "slabinfo -h" for more options when
+running the command. slabinfo is included in this directory and can
+be compiled with
+
+gcc -o slabinfo slabinfo.c
+
+Some of the modes of operation of slabinfo require that slub debugging
+be enabled on the command line. F.e. no tracking information will be
+available without debugging on and validation can only partially
+be performed if debugging was not switched on.
+
+Some more sophisticated uses of slub_debug:
+-------------------------------------------
+
+Parameters may be given to slub_debug. If none is specified then full
+debugging is enabled. Format:
+
+slub_debug=<Debug-Options>       Enable options for all slabs
+slub_debug=<Debug-Options>,<slab name>
+				Enable options only for select slabs
+
+Possible debug options are
+	F		Sanity checks on (enables SLAB_DEBUG_FREE. Sorry
+			SLAB legacy issues)
+	Z		Red zoning
+	P		Poisoning (object and padding)
+	U		User tracking (free and alloc)
+	T		Trace (please only use on single slabs)
+
+F.e. in order to boot just with sanity checks and red zoning one would specify:
+
+	slub_debug=FZ
+
+Trying to find an issue in the dentry cache? Try
+
+	slub_debug=,dentry_cache
+
+to only enable debugging on the dentry cache.
+
+Red zoning and tracking may realign the slab. We can just apply sanity checks to
+the dentry cache with
+
+	slub_debug=F,dentry_cache
+
+In case you forgot to enable debugging on the kernel command line: It is
+possible to enable debugging manually when the kernel is up. Look at the
+contents of:
+
+/sys/slab/<slab name>/
+
+Look at the writable files. Writing 1 to them will enable the
+corresponding debug option. All options can be set on a slab that does
+not contain objects. If the slab already contains objects then sanity checks
+and tracing may only be enabled. The other options may cause the realignment
+of objects.
+
+Careful with tracing: It may spew out lots of information and never stop if
+used on the wrong slab.
+
+SLAB Merging
+------------
+
+If no debugging is specified then SLUB may merge similar slabs together
+in order to reduce overhead and increase cache hotness of objects.
+slabinfo -a displays which slabs were merged together.
+
+Getting more performance
+------------------------
+
+To some degree SLUBs performance is limited by the need to take the
+list_lock once in a while to deal with partial slabs. That overhead is
+governed by the order of the allocation for each slab. The allocations
+can be influenced by kernel parameters:
+
+slub_min_objects=x		(default 8)
+slub_min_order=x		(default 0)
+slub_max_order=x		(default 4)
+
+slub_min_objects allows to specify how many objects must at least fit
+into one slab in order for the allocation order to be acceptable.
+In general slub will be able to perform this number of allocations
+on a slab without consulting centralized resources (list_lock) where
+contention may occur.
+
+slub_min_order specifies a minim order of slabs. A similar effect like
+slub_min_objects.
+
+slub_max_order specified the order at which slub_min_objects should no
+longer be checked. This is useful to avoid SLUB trying to generate
+super large order pages to fit slub_min_objects of a slab cache with
+large object sizes into one high order page.
+
+
+Christoph Lameter, <clameter@sgi.com>, April 10, 2007

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> We should force -mm testers to use slub by default, while providing them a
> way of going back to slab if they hit problems.  Can you please cook up a
> -mm-only patch for that?


SLUB: mm-only: Make SLUB the default slab allocator

Make SLUB the default slab allocator

WARNING: This is a new allocator. No guarantees.

Known areas of concern:

A. i386 and FRV arches have been disabled by setting
   ARCH_USES_SLAB_PAGE_STRUCT. SLUB cannot be enabled on those platforms.

   The issue is that both arches use the page->index and page->private field
   of memory allocated via the slab. SLUB uses these fields too. There are
   a variety of patches out there (some by me, some by Bill Irwin) to address
   this but without those you may be stuck until Bill Irwin comes up with a
   definite solution.

B. There may be undiscovered locations in arch code that are as badly
   behaved as i386 and FRV which will likely cause the arch not to boot
   and fail with mysterious error messages.

C. Unlike SLAB, SLUB does not special case page sized allocations. SLAB
   aligns kmallocs of page sized allocation on page boundaries.
   SLUB also does that most of the time but does not guarantee alignment
   beyond KMALLOC_ARCH_MINALIGN that is valid for other kmalloc slabs.
   In particular enabling debugging will add some tracking information
   to slabs which will usually cause page sized slabs to become no longer
   aligned on page boundaries.

   If there is arch code that relies on this behavior then we are likely
   to see funky behavior. Code that uses page sized allocations via kmalloc
   should either use the page allocator or explictly request page aligned
   data from the slab by creating a custom slab with the needed alignment.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/init/Kconfig
===================================================================
--- linux-2.6.21-rc6.orig/init/Kconfig	2007-04-10 17:00:56.000000000 -0700
+++ linux-2.6.21-rc6/init/Kconfig	2007-04-10 17:01:24.000000000 -0700
@@ -521,7 +521,7 @@ config PROC_KPAGEMAP
 
 choice
 	prompt "Choose SLAB allocator"
-	default SLAB
+	default SLUB
 	help
 	   This option allows to select a slab allocator.
 
@@ -534,7 +534,7 @@ config SLAB
 	  slab allocator.
 
 config SLUB
-	depends on EXPERIMENTAL && !ARCH_USES_SLAB_PAGE_STRUCT
+	depends on !ARCH_USES_SLAB_PAGE_STRUCT
 	bool "SLUB (Unqueued Allocator)"
 	help
 	   SLUB is a slab allocator that minimizes cache line usage

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Christoph Lameter]

On Tue, 10 Apr 2007, Andrew Morton wrote:

> Could print_track() be simplified by using -mm's sprint_symbol()?


SLUB: Use __print_symbol instead of kallsyms_lookup

SLUB contains a complicated section with #ifdef CONFIG_KALLSYSM and yadda
dadda. Remove that and replace with __print_symbol.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.21-rc6/mm/slub.c
===================================================================
--- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 19:21:29.000000000 -0700
+++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 19:21:51.000000000 -0700
@@ -290,27 +290,11 @@ static void init_tracking(struct kmem_ca
 
 static void print_track(const char *s, struct track *t)
 {
-#ifdef CONFIG_KALLSYMS
-	char *modname;
-	const char *name;
-	unsigned long offset, size;
-	char namebuf[KSYM_NAME_LEN + 1];
-#endif
-
 	if (!t->addr)
 		return;
 
-#ifdef CONFIG_KALLSYMS
-	name = kallsyms_lookup((unsigned long)t->addr, &size, &offset,
-		&modname, namebuf);
-
-	if (name) {
-		printk(KERN_ERR "%s: %s+%#lx/%#lx", s, name, offset, size);
-		if (modname)
-			printk(" [%s]", modname);
-	} else
-#endif
-		printk(KERN_ERR "%s: 0x%p", s, t->addr);
+	printk(KERN_ERR "%s: ", s);
+	__print_symbol("%s", (unsigned long)t->addr);
 	printk(" jiffies_ago=%lu cpu=%u pid=%d\n", jiffies - t->when, t->cpu, t->pid);
 }
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [SLUB 3/5] Validation of slabs (metadata and guard zones)

[Andrew Morton]

On Tue, 10 Apr 2007 19:24:00 -0700 (PDT) Christoph Lameter <clameter@sgi.com> wrote:

> SLUB contains a complicated section with #ifdef CONFIG_KALLSYSM and yadda
> dadda. Remove that and replace with __print_symbol.
> 
> Signed-off-by: Christoph Lameter <clameter@sgi.com>
> 
> Index: linux-2.6.21-rc6/mm/slub.c
> ===================================================================
> --- linux-2.6.21-rc6.orig/mm/slub.c	2007-04-10 19:21:29.000000000 -0700
> +++ linux-2.6.21-rc6/mm/slub.c	2007-04-10 19:21:51.000000000 -0700
> @@ -290,27 +290,11 @@ static void init_tracking(struct kmem_ca
>  
>  static void print_track(const char *s, struct track *t)
>  {
> -#ifdef CONFIG_KALLSYMS
> -	char *modname;
> -	const char *name;
> -	unsigned long offset, size;
> -	char namebuf[KSYM_NAME_LEN + 1];
> -#endif
> -
>  	if (!t->addr)
>  		return;
>  
> -#ifdef CONFIG_KALLSYMS
> -	name = kallsyms_lookup((unsigned long)t->addr, &size, &offset,
> -		&modname, namebuf);
> -
> -	if (name) {
> -		printk(KERN_ERR "%s: %s+%#lx/%#lx", s, name, offset, size);
> -		if (modname)
> -			printk(" [%s]", modname);
> -	} else
> -#endif
> -		printk(KERN_ERR "%s: 0x%p", s, t->addr);
> +	printk(KERN_ERR "%s: ", s);
> +	__print_symbol("%s", (unsigned long)t->addr);
>  	printk(" jiffies_ago=%lu cpu=%u pid=%d\n", jiffies - t->when, t->cpu, t->pid);
>  }

hm, that was a nice outcome.

We practically always have to cast the value when calling kallsyms functions.
I guess that means we goofed the design, should have made it void*.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

question on mmap

[sameer sameer]

Hi All,

I have a question regarding the implementation of
mmap. I am trying to find out if we the kernel
actually shares the memory across unrelated processes
using MAP_SHARED flag for a read only file mapping. 

When the file is mapped with PROT_READ arguement, then
will there be any difference in memory usage by
multiple processes if the mapping is done using
MAP_SHARED instead of MAP_PRIVATE ?

Are there any system commands which will let me know
how to calcuate the memory savings (if there are any)
?

Please let me know. 

Thanks,
Sameer


      Send a FREE SMS to your friend's mobile from Yahoo! Messenger. Get it now at http://in.messenger.yahoo.com/

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: question on mmap

[Hugh Dickins]

On Wed, 11 Apr 2007, sameer sameer wrote:
> 
> I have a question regarding the implementation of
> mmap. I am trying to find out if we the kernel
> actually shares the memory across unrelated processes
> using MAP_SHARED flag for a read only file mapping. 

Yes, it does.

> 
> When the file is mapped with PROT_READ arguement, then
> will there be any difference in memory usage by
> multiple processes if the mapping is done using
> MAP_SHARED instead of MAP_PRIVATE ?

No, no difference.

> 
> Are there any system commands which will let me know
> how to calcuate the memory savings (if there are any)

No such savings.

Hugh

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>