Linux-3.14.12內存管理筆記【夥伴管理算法（4）】

此處承接前面未深刻分析的頁面釋放部分，主要詳細分析夥伴管理算法中頁面釋放的實現。頁面釋放的函數入口是__free_page()，其實則是一個宏定義。

具體實現：

【file:/include/linux/gfp.h】
#define __free_page(page) __free_pages((page), 0)

而__free_pages()的實現：

【file:/mm/page_alloc.c】
void __free_pages(struct page *page, unsigned int order)
{
    if (put_page_testzero(page)) {
        if (order == 0)
            free_hot_cold_page(page, 0);
        else
            __free_pages_ok(page, order);
    }
}

其中put_page_testzero()是對page結構的_count引用計數作原子減及測試，用於檢查內存頁面是否仍被使用，若是再也不使用，則進行釋放。其中order表示頁面數量，若是釋放的是單頁，則會調用free_hot_cold_page()將頁面釋放至per-cpu page緩存中，而不是夥伴管理算法；真正的釋放至夥伴管理算法的是__free_pages_ok()，同時也是用於多個頁面釋放的狀況。

此處接着則由free_hot_cold_page()開始分析：

【file:/mm/page_alloc.c】
/*
 * Free a 0-order page
 * cold == 1 ? free a cold page : free a hot page
 */
void free_hot_cold_page(struct page *page, int cold)
{
    struct zone *zone = page_zone(page);
    struct per_cpu_pages *pcp;
    unsigned long flags;
    int migratetype;
 
    if (!free_pages_prepare(page, 0))
        return;
 
    migratetype = get_pageblock_migratetype(page);
    set_freepage_migratetype(page, migratetype);
    local_irq_save(flags);
    __count_vm_event(PGFREE);
 
    /*
     * We only track unmovable, reclaimable and movable on pcp lists.
     * Free ISOLATE pages back to the allocator because they are being
     * offlined but treat RESERVE as movable pages so we can get those
     * areas back if necessary. Otherwise, we may have to free
     * excessively into the page allocator
     */
    if (migratetype >= MIGRATE_PCPTYPES) {
        if (unlikely(is_migrate_isolate(migratetype))) {
            free_one_page(zone, page, 0, migratetype);
            goto out;
        }
        migratetype = MIGRATE_MOVABLE;
    }
 
    pcp = &this_cpu_ptr(zone->pageset)->pcp;
    if (cold)
        list_add_tail(&page->lru, &pcp->lists[migratetype]);
    else
        list_add(&page->lru, &pcp->lists[migratetype]);
    pcp->count++;
    if (pcp->count >= pcp->high) {
        unsigned long batch = ACCESS_ONCE(pcp->batch);
        free_pcppages_bulk(zone, batch, pcp);
        pcp->count -= batch;
    }
 
out:
    local_irq_restore(flags);
}

先看一下free_pages_prepare()的實現：

【file:/mm/page_alloc.c】
static bool free_pages_prepare(struct page *page, unsigned int order)
{
    int i;
    int bad = 0;
 
    trace_mm_page_free(page, order);
    kmemcheck_free_shadow(page, order);
 
    if (PageAnon(page))
        page->mapping = NULL;
    for (i = 0; i < (1 << order); i++)
        bad += free_pages_check(page + i);
    if (bad)
        return false;
 
    if (!PageHighMem(page)) {
        debug_check_no_locks_freed(page_address(page),
                       PAGE_SIZE << order);
        debug_check_no_obj_freed(page_address(page),
                       PAGE_SIZE << order);
    }
    arch_free_page(page, order);
    kernel_map_pages(page, 1 << order, 0);
 
    return true;
}

其中trace_mm_page_free()用於trace追蹤機制；而kmemcheck_free_shadow()用於內存檢測工具kmemcheck，若是未定義CONFIG_KMEMCHECK的狀況下，它是一個空函數。接着後面的PageAnon()等都是用於檢查頁面狀態的狀況，以判斷頁面是否容許釋放，避免錯誤釋放頁面。由此可知該函數主要做用是檢查和調試。

接着回到free_hot_cold_page()函數中，get_pageblock_migratetype()和set_freepage_migratetype()分別是獲取和設置頁面的遷移類型，即設置到page->index；local_irq_save()和末尾的local_irq_restore()則用於保存恢復中斷請求標識。

if (migratetype >= MIGRATE_PCPTYPES) {

    if (unlikely(is_migrate_isolate(migratetype))) {

        free_one_page(zone, page, 0, migratetype);

        goto out;

    }

    migratetype = MIGRATE_MOVABLE;

}

這裏面的MIGRATE_PCPTYPES用來表示每CPU頁框高速緩存的數據結構中的鏈表的遷移類型數目，若是某個頁面類型大於MIGRATE_PCPTYPES則表示其可掛到可移動列表中，若是遷移類型是MIGRATE_ISOLATE則直接將該其釋放到夥伴管理算法中。

末尾部分：

pcp = &this_cpu_ptr(zone->pageset)->pcp;

    if (cold)

        list_add_tail(&page->lru, &pcp->lists[migratetype]);

    else

        list_add(&page->lru, &pcp->lists[migratetype]);

    pcp->count++;

    if (pcp->count >= pcp->high) {

        unsigned long batch = ACCESS_ONCE(pcp->batch);

        free_pcppages_bulk(zone, batch, pcp);

        pcp->count -= batch;

    }

其中pcp表示內存管理區的每CPU管理結構，cold表示冷熱頁面，若是是冷頁就將其掛接到對應遷移類型的鏈表尾，而如果熱頁則掛接到對應遷移類型的鏈表頭。其中if (pcp->count >= pcp->high)判斷值得注意，其用於若是釋放的頁面超過了每CPU緩存的最大頁面數時，則將其批量釋放至夥伴管理算法中，其中批量數爲pcp->batch。

具體分析一下釋放至夥伴管理算法的實現free_pcppages_bulk()：

【file:/mm/page_alloc.c】
/*
 * Frees a number of pages from the PCP lists
 * Assumes all pages on list are in same zone, and of same order.
 * count is the number of pages to free.
 *
 * If the zone was previously in an "all pages pinned" state then look to
 * see if this freeing clears that state.
 *
 * And clear the zone's pages_scanned counter, to hold off the "all pages are
 * pinned" detection logic.
 */
static void free_pcppages_bulk(struct zone *zone, int count,
                    struct per_cpu_pages *pcp)
{
    int migratetype = 0;
    int batch_free = 0;
    int to_free = count;
 
    spin_lock(&zone->lock);
    zone->pages_scanned = 0;
 
    while (to_free) {
        struct page *page;
        struct list_head *list;
 
        /*
         * Remove pages from lists in a round-robin fashion. A
         * batch_free count is maintained that is incremented when an
         * empty list is encountered. This is so more pages are freed
         * off fuller lists instead of spinning excessively around empty
         * lists
         */
        do {
            batch_free++;
            if (++migratetype == MIGRATE_PCPTYPES)
                migratetype = 0;
            list = &pcp->lists[migratetype];
        } while (list_empty(list));
 
        /* This is the only non-empty list. Free them all. */
        if (batch_free == MIGRATE_PCPTYPES)
            batch_free = to_free;
 
        do {
            int mt; /* migratetype of the to-be-freed page */
 
            page = list_entry(list->prev, struct page, lru);
            /* must delete as __free_one_page list manipulates */
            list_del(&page->lru);
            mt = get_freepage_migratetype(page);
            /* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
            __free_one_page(page, zone, 0, mt);
            trace_mm_page_pcpu_drain(page, 0, mt);
            if (likely(!is_migrate_isolate_page(page))) {
                __mod_zone_page_state(zone, NR_FREE_PAGES, 1);
                if (is_migrate_cma(mt))
                    __mod_zone_page_state(zone, NR_FREE_CMA_PAGES, 1);
            }
        } while (--to_free && --batch_free && !list_empty(list));
    }
    spin_unlock(&zone->lock);
}

裏面while大循環用於計數釋放指定批量數的頁面。其中釋放方式是先自MIGRATE_UNMOVABLE遷移類型起（止於MIGRATE_PCPTYPES遷移類型），遍歷各個鏈表統計其鏈表中頁面數：

do {

    batch_free++;

    if (++migratetype == MIGRATE_PCPTYPES)

        migratetype = 0;

    list = &pcp->lists[migratetype];

} while (list_empty(list));

若是隻有MIGRATE_PCPTYPES遷移類型的鏈表爲非空鏈表，則所有頁面將從該鏈表中釋放。

後面的do{}while()裏面，其先將頁面從lru鏈表中去除，而後獲取頁面的遷移類型，經過__free_one_page()釋放頁面，最後使用__mod_zone_page_state()修改管理區的狀態值。

着重分析一下__free_one_page()的實現：

【file:/mm/page_alloc.c】
/*
 * Freeing function for a buddy system allocator.
 *
 * The concept of a buddy system is to maintain direct-mapped table
 * (containing bit values) for memory blocks of various "orders".
 * The bottom level table contains the map for the smallest allocatable
 * units of memory (here, pages), and each level above it describes
 * pairs of units from the levels below, hence, "buddies".
 * At a high level, all that happens here is marking the table entry
 * at the bottom level available, and propagating the changes upward
 * as necessary, plus some accounting needed to play nicely with other
 * parts of the VM system.
 * At each level, we keep a list of pages, which are heads of continuous
 * free pages of length of (1 << order) and marked with _mapcount
 * PAGE_BUDDY_MAPCOUNT_VALUE. Page's order is recorded in page_private(page)
 * field.
 * So when we are allocating or freeing one, we can derive the state of the
 * other. That is, if we allocate a small block, and both were
 * free, the remainder of the region must be split into blocks.
 * If a block is freed, and its buddy is also free, then this
 * triggers coalescing into a block of larger size.
 *
 * -- nyc
 */
 
static inline void __free_one_page(struct page *page,
        struct zone *zone, unsigned int order,
        int migratetype)
{
    unsigned long page_idx;
    unsigned long combined_idx;
    unsigned long uninitialized_var(buddy_idx);
    struct page *buddy;
 
    VM_BUG_ON(!zone_is_initialized(zone));
 
    if (unlikely(PageCompound(page)))
        if (unlikely(destroy_compound_page(page, order)))
            return;
 
    VM_BUG_ON(migratetype == -1);
 
    page_idx = page_to_pfn(page) & ((1 << MAX_ORDER) - 1);
 
    VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
    VM_BUG_ON_PAGE(bad_range(zone, page), page);
 
    while (order < MAX_ORDER-1) {
        buddy_idx = __find_buddy_index(page_idx, order);
        buddy = page + (buddy_idx - page_idx);
        if (!page_is_buddy(page, buddy, order))
            break;
        /*
         * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page,
         * merge with it and move up one order.
         */
        if (page_is_guard(buddy)) {
            clear_page_guard_flag(buddy);
            set_page_private(page, 0);
            __mod_zone_freepage_state(zone, 1 << order,
                          migratetype);
        } else {
            list_del(&buddy->lru);
            zone->free_area[order].nr_free--;
            rmv_page_order(buddy);
        }
        combined_idx = buddy_idx & page_idx;
        page = page + (combined_idx - page_idx);
        page_idx = combined_idx;
        order++;
    }
    set_page_order(page, order);
 
    /*
     * If this is not the largest possible page, check if the buddy
     * of the next-highest order is free. If it is, it's possible
     * that pages are being freed that will coalesce soon. In case,
     * that is happening, add the free page to the tail of the list
     * so it's less likely to be used soon and more likely to be merged
     * as a higher order page
     */
    if ((order < MAX_ORDER-2) && pfn_valid_within(page_to_pfn(buddy))) {
        struct page *higher_page, *higher_buddy;
        combined_idx = buddy_idx & page_idx;
        higher_page = page + (combined_idx - page_idx);
        buddy_idx = __find_buddy_index(combined_idx, order + 1);
        higher_buddy = higher_page + (buddy_idx - combined_idx);
        if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
            list_add_tail(&page->lru,
                &zone->free_area[order].free_list[migratetype]);
            goto out;
        }
    }
 
    list_add(&page->lru, &zone->free_area[order].free_list[migratetype]);
out:
    zone->free_area[order].nr_free++;
}

於while (order < MAX_ORDER-1)前面主要是對釋放的頁面進行檢查校驗操做。而while循環內，經過__find_buddy_index()獲取與當前釋放的頁面處於同一階的夥伴頁面索引值，同時藉此索引值計算出夥伴頁面地址，並作夥伴頁面檢查以肯定其是否能夠合併，若不然退出；接着if (page_is_guard(buddy))用於對頁面的debug_flags成員作檢查，因爲未配置CONFIG_DEBUG_PAGEALLOC，page_is_guard()固定返回false；則剩下的操做主要就是將頁面從分配鏈中摘除，同時將頁面合併並將其處於的階提高一級。

退出while循環後，經過set_page_order()設置頁面最終可合併成爲的管理階。最後判斷當前合併的頁面是否爲最大階，不然將頁面放至夥伴管理鏈表的末尾，避免其過早被分配，得以機會進一步與高階頁面進行合併。末了，將最後的掛入的階的空閒計數加1。

至此夥伴管理算法的頁面釋放完畢。

而__free_pages_ok()的頁面釋放實現調用棧則是：

__free_pages_ok()

—>free_one_page()

—>__free_one_page()

異曲同工，最終仍是__free_one_page()來釋放，具體的過程就再也不仔細分析了。