/*
 * 指定了首选节点，但未设置 __GFP_THISNODE 时：
 *
 * 1) 在传给 get_from_partial() 的 trynode_flags 中加入
 *    __GFP_THISNODE，只尝试从目标节点获取部分空闲的 slab。
 * 2) 如果步骤 1) 失败，则以最多允许
 *    GFP_NOWAIT | __GFP_THISNODE 的方式，尽力尝试
 *    从目标节点分配一个新的 slab。
 * 3) 如果步骤 2) 失败，则使用原始 gfpflags 重试。
 *    这样，get_from_partial() 会先尝试其他节点的部分空闲
 *    slab 链表，之后才可能从其他节点分配新的页。
 */

// ___slab_alloc 4533
if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE)
            && try_thisnode)) {
    trynode_flags &= GFP_NOWAIT | __GFP_NOMEMALLOC | __GFP_ACCOUNT;
    trynode_flags |= __GFP_NOWARN | __GFP_THISNODE;
}

// ___slab_alloc
object = get_from_partial(s, node, trynode_flags, ac);

/*
 * Get an object from a partial slab
 */
static void *get_from_partial(struct kmem_cache *s, int node, gfp_t flags,
                  const struct slab_alloc_context *ac)
{
    int searchnode = node;
    void *object;

    if (node == NUMA_NO_NODE)
        searchnode = numa_mem_id();

    object = get_from_partial_node(s, get_node(s, searchnode), flags, ac);
    if (object || (node != NUMA_NO_NODE && (flags & __GFP_THISNODE)))
        return object;

    return get_from_any_partial(s, flags, ac);
}

/*
 * Try to allocate object from a partial slab on a specific node.
 */
static void *get_from_partial_node(struct kmem_cache *s,
                   struct kmem_cache_node *n,
                   gfp_t gfp_flags,
                   const struct slab_alloc_context *ac)
{
    struct slab *slab, *slab2;
    unsigned long flags;
    void *object = NULL;

    /*
     * Racy check. If we mistakenly see no partial slabs then we
     * just allocate an empty slab. If we mistakenly try to get a
     * partial slab and there is none available then get_from_partial()
     * will return NULL.
     */
    if (!n || !n->nr_partial)
        return NULL;

    if (alloc_flags_allow_spinning(ac->alloc_flags))
        spin_lock_irqsave(&n->list_lock, flags);
    else if (!spin_trylock_irqsave(&n->list_lock, flags))
        return NULL;
    list_for_each_entry_safe(slab, slab2, &n->partial, slab_list) {

        struct freelist_counters old, new;

        if (!pfmemalloc_match(slab, gfp_flags))
            continue;

        if (IS_ENABLED(CONFIG_SLUB_TINY) || kmem_cache_debug(s)) {
            object = alloc_single_from_partial(s, n, slab,
                            ac->orig_size);
            if (object)
                break;
            continue;
        }

        /*
         * get a single object from the slab. This might race against
         * __slab_free(), which however has to take the list_lock if
         * it's about to make the slab fully free.
         */
        do {
            old.freelist = slab->freelist;
            old.counters = slab->counters;

            new.freelist = get_freepointer(s, old.freelist);
            new.counters = old.counters;
            new.inuse++;

        } while (!__slab_update_freelist(s, slab, &old, &new, "get_from_partial_node"));

        object = old.freelist;
        if (!new.freelist)
            remove_partial(n, slab);

        break;
    }
    spin_unlock_irqrestore(&n->list_lock, flags);
    return object;
}

/*
 * Called only for kmem_cache_debug() caches instead of remove_partial(), with a
 * slab from the n->partial list. Remove only a single object from the slab, do
 * the alloc_debug_processing() checks and leave the slab on the list, or move
 * it to full list if it was the last free object.
 */
static void *alloc_single_from_partial(struct kmem_cache *s,
        struct kmem_cache_node *n, struct slab *slab, int orig_size)
{
    void *object;

    slab_lockdep_assert_held(&n->list_lock);

#ifdef CONFIG_SLUB_DEBUG
    if (s->flags & SLAB_CONSISTENCY_CHECKS) {
        if (!validate_slab_ptr(slab)) {
            slab_err(s, slab, "Not a valid slab page");
            return NULL;
        }
    }
#endif

    object = slab->freelist;
    slab->freelist = get_freepointer(s, object);
    slab->inuse++;

    if (!alloc_debug_processing(s, slab, object, orig_size)) {
        remove_partial(n, slab);
        return NULL;
    }

    if (slab->inuse == slab->objects) {
        remove_partial(n, slab);
        add_full(s, n, slab);
    }

    return object;
}

/* Reuses the bits in struct page */
struct slab {
    memdesc_flags_t flags;

    struct kmem_cache *slab_cache;
    union {
        struct {
            struct list_head slab_list;
            /* Double-word boundary */
            struct freelist_counters;
        };
        struct rcu_head rcu_head;
    };

    unsigned int __page_type;
    atomic_t __page_refcount;
#ifdef CONFIG_SLAB_OBJ_EXT
    unsigned long obj_exts;
#endif
};

/*
 * The slab lists for all objects.
 */
struct kmem_cache_node {
    spinlock_t list_lock;
    unsigned long nr_partial;
    struct list_head partial;
#ifdef CONFIG_SLUB_DEBUG
    atomic_long_t nr_slabs;
    atomic_long_t total_objects;
    struct list_head full;
#endif
};

zonelist = node_zonelist(mempolicy_slab_node(), gfp_flags);
for_each_zone_zonelist(zone, z, zonelist, highest_zoneidx) {
    struct kmem_cache_node *n;
    n = get_node(s, zone_to_nid(zone));
    if (n && cpuset_zone_allowed(zone, gfp_flags) &&
            n->nr_partial > s->min_partial) {

        void *object = get_from_partial_node(s, n,
                        gfp_flags, ac);
        if (object) {
            /*
             * Don't check read_mems_allowed_retry()
             * here - if mems_allowed was updated in
             * parallel, that was a harmless race
             * between allocation and the cpuset
             * update
             */
            return object;
        }
    }
}

// 4568
slab = new_slab(s, trynode_flags, ac->alloc_flags, node);

// 3440
static struct slab *new_slab(struct kmem_cache *s, gfp_t flags,
                 unsigned int alloc_flags, int node)
{
    if (unlikely(flags & GFP_SLAB_BUG_MASK))
        flags = kmalloc_fix_flags(flags);

    WARN_ON_ONCE(s->ctor && (flags & __GFP_ZERO));

    flags &= GFP_RECLAIM_MASK | GFP_CONSTRAINT_MASK;

    return allocate_slab(s, flags, alloc_flags, node);
}

/* Allocate and initialize a slab without building its freelist. */
static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags,
                  unsigned int alloc_flags, int node)
{
    bool allow_spin = alloc_flags_allow_spinning(alloc_flags);
    struct slab *slab;
    struct kmem_cache_order_objects oo = s->oo;
    gfp_t alloc_gfp;
    void *start;

    flags &= gfp_allowed_mask;

    flags |= s->allocflags;

    /*
     * Let the initial higher-order allocation fail under memory pressure
     * so we fall-back to the minimum order allocation.
     */
    alloc_gfp = (flags | __GFP_NOWARN | __GFP_NORETRY) & ~__GFP_NOFAIL;
    if ((alloc_gfp & __GFP_DIRECT_RECLAIM) && oo_order(oo) > oo_order(s->min))
        alloc_gfp = (alloc_gfp | __GFP_NOMEMALLOC) & ~__GFP_RECLAIM;

    slab = alloc_slab_page(alloc_gfp, node, oo, allow_spin);
    if (unlikely(!slab)) {
        oo = s->min;
        alloc_gfp = flags;
        /*
         * Allocation may have failed due to fragmentation.
         * Try a lower order alloc if possible
         */
        slab = alloc_slab_page(alloc_gfp, node, oo, allow_spin);
        if (unlikely(!slab))
            return NULL;
        stat(s, ORDER_FALLBACK);
    }

    /* Initializes frozen, inuse, and any extra 64bit-only flags */
    slab->counters = 0;

    slab->objects = oo_objects(oo);

#ifdef CONFIG_64BIT
    if (cache_needs_objcg(s))
        slab->obj_exts_needs_objcg = 1;
#endif
    slab->slab_cache = s;

    kasan_poison_slab(slab);

    start = slab_address(slab);

    setup_slab_debug(s, slab, start);
    init_slab_obj_exts(slab);
    /*
     * Poison the slab before initializing the slabobj_ext array
     * to prevent the array from being overwritten.
     */
    alloc_slab_obj_exts_early(s, slab);
    account_slab(slab, oo_order(oo), s, flags, alloc_flags);

    return slab;
}

/**
 * DOC: 回收行为修饰标志
 *
 * 回收行为修饰标志
 *
 * %__GFP_DIRECT_RECLAIM 表示调用者可以进入直接内存回收。
 * 如果有备用方案，可以清除此标志，以避免不必要的延迟。
 * %__GFP_RECLAIM 是同时允许或禁止直接回收与 kswapd 回收的简写。
 *
 * 分配器的默认行为取决于请求大小。内核将阶数
 * order > %PAGE_ALLOC_COSTLY_ORDER 的分配称为高成本分配。
 * 非高成本分配通常非常关键，不能轻易失败，因此默认会隐式采用
 * 尽量保证成功的策略，但存在例外，例如 OOM 受害任务的分配可能失败，
 * 所以调用者仍然必须检查分配结果。
 * 高成本分配则尽量避免干扰系统，即使没有触发 OOM killer，
 * 也可能放弃尝试。
 *
 * 以下三个修饰标志可以覆盖其中一些隐含规则。
 * 注意，它们都必须与 %__GFP_DIRECT_RECLAIM 一起使用。
 *
 * %__GFP_NORETRY：
 * 在内存压力下，虚拟内存子系统（VM）只会尝试非常轻量的
 * 直接内存回收来获取内存，因此仍可能睡眠。
 * 它会避免触发 OOM killer 等对系统影响较大的操作。
 * 调用者必须处理分配失败；在严重内存压力下，失败很可能发生。
 * 当失败可以以较低成本处理时，例如仅导致吞吐量下降，
 * 适合使用此标志。
 *
 * %__GFP_NOFAIL：
 * VM 必须无限重试，因为调用者无法处理分配失败。
 * 分配可能无限期阻塞，但绝不会返回失败，因此检查失败没有意义。
 *
 * 此类分配必须允许阻塞，并与 __GFP_DIRECT_RECLAIM 一起使用。
 * 绝不能在不允许睡眠的上下文中使用。
 *
 * 对新增使用场景应仔细评估，只有不存在合理的失败处理策略时
 * 才应使用此标志。不过，使用该标志明确优于调用者自行编写
 * 围绕分配器无限重试的循环。
 *
 * 不支持使用 __GFP_NOFAIL 从伙伴系统分配 order > 1 的页面。
 * 请考虑改用 kvmalloc()。
 *
 * %__GFP_NOMEMALLOC 用于明确禁止使用紧急保留内存。
 * 如果同时设置了 %__GFP_MEMALLOC，则本标志优先
 */

if ((alloc_gfp & __GFP_DIRECT_RECLAIM) && oo_order(oo) > oo_order(s->min))
        alloc_gfp = (alloc_gfp | __GFP_NOMEMALLOC) & ~__GFP_RECLAIM;

/* Structure used to iterate over objects within a slab */
struct slab_obj_iter {
    unsigned long pos;
    void *start;
};

static unsigned int alloc_from_new_slab(struct kmem_cache *s, struct slab *slab,
        void **p, unsigned int count, bool allow_spin)
{
    unsigned int allocated = 0;
    struct slab_obj_iter iter;
    bool needs_add_partial = true;
    unsigned long flags;

    /*
     * Are we going to put the slab on the partial list?
     * Note slab->inuse is 0 on a new slab.
     */
    if (count >= slab->objects) {
        needs_add_partial = false;
        count = slab->objects;
    }

    init_slab_obj_iter(s, slab, &iter, allow_spin);

    while (allocated < count) {
        p[allocated] = next_slab_obj(s, &iter);
        allocated++;
    }
    slab->inuse = count;
    build_slab_freelist(s, slab, &iter);

    if (needs_add_partial) {
        struct kmem_cache_node *n = get_node(s, slab_nid(slab));

        if (allow_spin) {
            spin_lock_irqsave(&n->list_lock, flags);
        } else if (!spin_trylock_irqsave(&n->list_lock, flags)) {
            /*
             * Unlucky, discard newly allocated slab.
             * The slab is not fully free, but it's fine as
             * objects are not allocated to users.
             */
            free_new_slab_nolock(s, slab);
            return 0;
        }
        add_partial(n, slab, ADD_TO_HEAD);
        spin_unlock_irqrestore(&n->list_lock, flags);
    }

    inc_slabs_node(s, slab_nid(slab), slab->objects);
    return allocated;
}