Linux malloc 期间内核会发生什么？

what happens in the kernel during malloc?

提问by liv2hak

I was asked this question during an interview. What they wanted to know was when the user calls malloc(4) to allocate 4 bytes of memory how does the operating system (Linux) respond? Which subsystem responds to this system call?

我在面试时被问到这个问题。他们想知道的是，当用户调用 malloc(4) 分配 4 个字节的内存时，操作系统 (Linux) 如何响应？哪个子系统响应这个系统调用？

I told him that malloc() will be serviced by the memory management subsystem. The malloc() implementation will go through the list of free memory(physical memory), we will call it free list, and find an appropriate chunk that is greater than or equal to 4 Bytes. Once it finds such a chunk, it will be deleted from free list and added to a used list. Then that physical memory will be mapped to the process heap vma struct. He didn't seem to be quite satisfied with this answer.How does the buddy system fit into this? Any help would be greatly appreciated.

我告诉他 malloc() 将由内存管理子系统提供服务。malloc() 的实现会遍历空闲内存（物理内存）的列表，我们称之为空闲列表，并找到一个合适的大于或等于 4 字节的块。一旦找到这样的块，它将从空闲列表中删除并添加到已使用列表中。然后该物理内存将映射到进程堆 vma 结构。他似乎对这个回答不太满意，这个好友系统是怎么适应的？任何帮助将不胜感激。

采纳答案by nos

When user space applications call malloc(), that call isn't implemented in the kernel. Instead, it's a library call (implemented glibc or similar).

当用户空间应用程序调用 时malloc()，该调用未在内核中实现。相反，它是一个库调用（实现的 glibc 或类似的）。

The short version is that the mallocimplementation in glibc either obtains memory from the brk()/sbrk()system call or anonymous memory via mmap(). This gives glibc a big contiguous (regarding virtual memory addresses) chunk of memory, which the mallocimplementation further slices and dices in smaller chunks and hands out to your application.

简而言之malloc，glibc中的实现要么从brk()/sbrk()系统调用中获取内存，要么通过mmap(). 这为 glibc 提供了一个大的连续（关于虚拟内存地址）内存块，malloc实现进一步将其切成较小的块并分发给您的应用程序。

Here's a small mallocimplementation that'll give you the idea, along with many, many links.

这是一个小malloc实现，可以为您提供想法，以及许多链接。

Note that nothing cares about physical memory yet -- that's handled by the kernel virtual memory system when the process data segment is altered via brk()/sbrk()or mmap(), and when the memory is referenced (by a read or write to the memory).

请注意，目前还没有任何东西关心物理内存——当进程数据段通过brk()/sbrk()或更改mmap()时，以及当内存被引用（通过读取或写入内存）时，由内核虚拟内存系统处理。

To summarize:

总结一下：

1. malloc()will search its managed pieces of memory to see if there's a piece of unused memory that satisfy the allocation requirements.
2. Failing that, malloc()will try to extend the process data segment(via sbrk()/brk()or in some cases mmap()). sbrk()ends up in the kernel.
3. The brk()/sbrk()calls in the kernel adjust some of the offsets in the struct mm_structof the process, so the process data segment will be larger. At first, there will be no physical memory mapped to the additional virtual addresses which extending the data segment gave.
4. When that unmapped memory is first touched (likely a read/write by the mallocimplementation) a fault handler will kick in and trap down to the kernel, where the kernel will assign physical memory to the unmapped memory.

1. malloc()将搜索它的托管内存块以查看是否有一块未使用的内存满足分配要求。
2. 如果失败，malloc()将尝试扩展流程数据段（通过sbrk()/brk()或在某些情况下mmap()）。sbrk()最终进入内核。
3. 内核中的brk()/sbrk()调用调整struct mm_struct了进程的一些偏移量，所以进程数据段会更大。首先，不会有物理内存映射到扩展数据段给出的附加虚拟地址。
4. 当第一次触及未映射的内存（可能是实现的读/写malloc）时，故障处理程序将启动并捕获到内核，内核将在那里将物理内存分配给未映射的内存。

回答by jweyrich

There's a mistake in your answer - mallocdoes notdeal with physical memory directly. It deals with paged virtual memory- although I'm not certain if it's true for every architecture out there.

您的答案有误 -malloc不直接处理物理内存。它处理分页虚拟内存- 尽管我不确定它是否适用于所有架构。

When your program tries to allocate memory and the free list doesn't contain a chunk of equal or larger size than the requested size, an entire new page is allocated. The page size is architecture dependent (4096 bytes on x86). Page allocation is something only the kernel can perform, thus a malloccall may cause a system call. The new address is then added to the free list, and mallocmanipulates the free list according to its implemention (check glibc for example).

当您的程序尝试分配内存并且空闲列表不包含大小等于或大于请求大小的块时，将分配一个完整的新页面。页大小取决于体系结构（x86 上为 4096 字节）。页分配是只有内核才能执行的事情，因此malloc调用可能会导致系统调用。然后将新地址添加到空闲列表中，并malloc根据其实现操作空闲列表（例如检查 glibc）。