2010-01-17 01:53:50 +08:00
|
|
|
#define JEMALLOC_ARENA_C_
|
2010-02-12 06:45:59 +08:00
|
|
|
#include "jemalloc/internal/jemalloc_internal.h"
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/******************************************************************************/
|
|
|
|
/* Data. */
|
|
|
|
|
|
|
|
ssize_t opt_lg_dirty_mult = LG_DIRTY_MULT_DEFAULT;
|
2012-02-29 08:50:47 +08:00
|
|
|
arena_bin_info_t arena_bin_info[NBINS];
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-04-17 05:31:24 +08:00
|
|
|
JEMALLOC_ALIGNED(CACHELINE)
|
|
|
|
const uint32_t small_bin2size[NBINS] = {
|
|
|
|
#define SIZE_CLASS(bin, delta, size) \
|
|
|
|
size,
|
|
|
|
SIZE_CLASSES
|
|
|
|
#undef SIZE_CLASS
|
|
|
|
};
|
|
|
|
|
2012-04-30 18:38:29 +08:00
|
|
|
JEMALLOC_ALIGNED(CACHELINE)
|
2012-02-29 08:50:47 +08:00
|
|
|
const uint8_t small_size2bin[] = {
|
2011-03-07 14:56:36 +08:00
|
|
|
#define S2B_8(i) i,
|
2010-01-17 01:53:50 +08:00
|
|
|
#define S2B_16(i) S2B_8(i) S2B_8(i)
|
|
|
|
#define S2B_32(i) S2B_16(i) S2B_16(i)
|
|
|
|
#define S2B_64(i) S2B_32(i) S2B_32(i)
|
|
|
|
#define S2B_128(i) S2B_64(i) S2B_64(i)
|
|
|
|
#define S2B_256(i) S2B_128(i) S2B_128(i)
|
2012-02-29 08:50:47 +08:00
|
|
|
#define S2B_512(i) S2B_256(i) S2B_256(i)
|
|
|
|
#define S2B_1024(i) S2B_512(i) S2B_512(i)
|
|
|
|
#define S2B_2048(i) S2B_1024(i) S2B_1024(i)
|
|
|
|
#define S2B_4096(i) S2B_2048(i) S2B_2048(i)
|
|
|
|
#define S2B_8192(i) S2B_4096(i) S2B_4096(i)
|
|
|
|
#define SIZE_CLASS(bin, delta, size) \
|
|
|
|
S2B_##delta(bin)
|
|
|
|
SIZE_CLASSES
|
2010-01-17 01:53:50 +08:00
|
|
|
#undef S2B_8
|
|
|
|
#undef S2B_16
|
|
|
|
#undef S2B_32
|
|
|
|
#undef S2B_64
|
|
|
|
#undef S2B_128
|
|
|
|
#undef S2B_256
|
2012-02-29 08:50:47 +08:00
|
|
|
#undef S2B_512
|
|
|
|
#undef S2B_1024
|
|
|
|
#undef S2B_2048
|
|
|
|
#undef S2B_4096
|
|
|
|
#undef S2B_8192
|
|
|
|
#undef SIZE_CLASS
|
|
|
|
};
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/******************************************************************************/
|
2014-01-15 08:23:03 +08:00
|
|
|
/*
|
|
|
|
* Function prototypes for static functions that are referenced prior to
|
|
|
|
* definition.
|
|
|
|
*/
|
|
|
|
|
2010-10-01 07:55:08 +08:00
|
|
|
static void arena_purge(arena_t *arena, bool all);
|
2012-10-31 06:42:37 +08:00
|
|
|
static void arena_run_dalloc(arena_t *arena, arena_run_t *run, bool dirty,
|
|
|
|
bool cleaned);
|
2010-01-17 01:53:50 +08:00
|
|
|
static void arena_dalloc_bin_run(arena_t *arena, arena_chunk_t *chunk,
|
|
|
|
arena_run_t *run, arena_bin_t *bin);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
static void arena_bin_lower_run(arena_t *arena, arena_chunk_t *chunk,
|
|
|
|
arena_run_t *run, arena_bin_t *bin);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/******************************************************************************/
|
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
JEMALLOC_INLINE_C size_t
|
|
|
|
arena_mapelm_to_pageind(arena_chunk_map_t *mapelm)
|
|
|
|
{
|
|
|
|
uintptr_t map_offset =
|
|
|
|
CHUNK_ADDR2OFFSET(mapelm) - offsetof(arena_chunk_t, map);
|
|
|
|
|
|
|
|
return ((map_offset / sizeof(arena_chunk_map_t)) + map_bias);
|
|
|
|
}
|
|
|
|
|
|
|
|
JEMALLOC_INLINE_C size_t
|
|
|
|
arena_mapelm_to_bits(arena_chunk_map_t *mapelm)
|
|
|
|
{
|
|
|
|
|
|
|
|
return (mapelm->bits);
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static inline int
|
|
|
|
arena_run_comp(arena_chunk_map_t *a, arena_chunk_map_t *b)
|
|
|
|
{
|
|
|
|
uintptr_t a_mapelm = (uintptr_t)a;
|
|
|
|
uintptr_t b_mapelm = (uintptr_t)b;
|
|
|
|
|
|
|
|
assert(a != NULL);
|
|
|
|
assert(b != NULL);
|
|
|
|
|
|
|
|
return ((a_mapelm > b_mapelm) - (a_mapelm < b_mapelm));
|
|
|
|
}
|
|
|
|
|
2010-03-01 07:00:18 +08:00
|
|
|
/* Generate red-black tree functions. */
|
2012-02-11 12:22:09 +08:00
|
|
|
rb_gen(static UNUSED, arena_run_tree_, arena_run_tree_t, arena_chunk_map_t,
|
|
|
|
u.rb_link, arena_run_comp)
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
static inline int
|
|
|
|
arena_avail_comp(arena_chunk_map_t *a, arena_chunk_map_t *b)
|
|
|
|
{
|
|
|
|
int ret;
|
2014-04-07 04:24:16 +08:00
|
|
|
size_t a_size;
|
|
|
|
size_t b_size = arena_mapelm_to_bits(b) & ~PAGE_MASK;
|
|
|
|
uintptr_t a_mapelm = (uintptr_t)a;
|
|
|
|
uintptr_t b_mapelm = (uintptr_t)b;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
if (a_mapelm & CHUNK_MAP_KEY)
|
|
|
|
a_size = a_mapelm & ~PAGE_MASK;
|
|
|
|
else
|
|
|
|
a_size = arena_mapelm_to_bits(a) & ~PAGE_MASK;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
ret = (a_size > b_size) - (a_size < b_size);
|
|
|
|
if (ret == 0 && (!(a_mapelm & CHUNK_MAP_KEY)))
|
2010-01-17 01:53:50 +08:00
|
|
|
ret = (a_mapelm > b_mapelm) - (a_mapelm < b_mapelm);
|
|
|
|
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
2010-03-01 07:00:18 +08:00
|
|
|
/* Generate red-black tree functions. */
|
2012-02-11 12:22:09 +08:00
|
|
|
rb_gen(static UNUSED, arena_avail_tree_, arena_avail_tree_t, arena_chunk_map_t,
|
|
|
|
u.rb_link, arena_avail_comp)
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
static inline int
|
|
|
|
arena_chunk_dirty_comp(arena_chunk_t *a, arena_chunk_t *b)
|
|
|
|
{
|
|
|
|
|
|
|
|
assert(a != NULL);
|
|
|
|
assert(b != NULL);
|
|
|
|
|
2012-11-08 02:05:04 +08:00
|
|
|
/*
|
|
|
|
* Short-circuit for self comparison. The following comparison code
|
|
|
|
* would come to the same result, but at the cost of executing the slow
|
|
|
|
* path.
|
|
|
|
*/
|
|
|
|
if (a == b)
|
|
|
|
return (0);
|
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
/*
|
|
|
|
* Order such that chunks with higher fragmentation are "less than"
|
2012-11-08 02:05:04 +08:00
|
|
|
* those with lower fragmentation -- purging order is from "least" to
|
|
|
|
* "greatest". Fragmentation is measured as:
|
2012-10-31 06:42:37 +08:00
|
|
|
*
|
|
|
|
* mean current avail run size
|
|
|
|
* --------------------------------
|
|
|
|
* mean defragmented avail run size
|
|
|
|
*
|
|
|
|
* navail
|
|
|
|
* -----------
|
|
|
|
* nruns_avail nruns_avail-nruns_adjac
|
|
|
|
* = ========================= = -----------------------
|
|
|
|
* navail nruns_avail
|
|
|
|
* -----------------------
|
|
|
|
* nruns_avail-nruns_adjac
|
|
|
|
*
|
|
|
|
* The following code multiplies away the denominator prior to
|
|
|
|
* comparison, in order to avoid division.
|
|
|
|
*
|
|
|
|
*/
|
2012-11-08 02:05:04 +08:00
|
|
|
{
|
|
|
|
size_t a_val = (a->nruns_avail - a->nruns_adjac) *
|
|
|
|
b->nruns_avail;
|
|
|
|
size_t b_val = (b->nruns_avail - b->nruns_adjac) *
|
|
|
|
a->nruns_avail;
|
|
|
|
|
|
|
|
if (a_val < b_val)
|
|
|
|
return (1);
|
|
|
|
if (a_val > b_val)
|
|
|
|
return (-1);
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Break ties by chunk address. For fragmented chunks, report lower
|
|
|
|
* addresses as "lower", so that fragmentation reduction happens first
|
|
|
|
* at lower addresses. However, use the opposite ordering for
|
|
|
|
* unfragmented chunks, in order to increase the chances of
|
|
|
|
* re-allocating dirty runs.
|
|
|
|
*/
|
2012-10-31 06:42:37 +08:00
|
|
|
{
|
|
|
|
uintptr_t a_chunk = (uintptr_t)a;
|
|
|
|
uintptr_t b_chunk = (uintptr_t)b;
|
2012-11-08 02:05:04 +08:00
|
|
|
int ret = ((a_chunk > b_chunk) - (a_chunk < b_chunk));
|
|
|
|
if (a->nruns_adjac == 0) {
|
|
|
|
assert(b->nruns_adjac == 0);
|
|
|
|
ret = -ret;
|
|
|
|
}
|
|
|
|
return (ret);
|
2012-10-31 06:42:37 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Generate red-black tree functions. */
|
|
|
|
rb_gen(static UNUSED, arena_chunk_dirty_, arena_chunk_tree_t, arena_chunk_t,
|
|
|
|
dirty_link, arena_chunk_dirty_comp)
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
arena_avail_adjac_pred(arena_chunk_t *chunk, size_t pageind)
|
|
|
|
{
|
|
|
|
bool ret;
|
|
|
|
|
|
|
|
if (pageind-1 < map_bias)
|
|
|
|
ret = false;
|
|
|
|
else {
|
|
|
|
ret = (arena_mapbits_allocated_get(chunk, pageind-1) == 0);
|
|
|
|
assert(ret == false || arena_mapbits_dirty_get(chunk,
|
|
|
|
pageind-1) != arena_mapbits_dirty_get(chunk, pageind));
|
|
|
|
}
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
arena_avail_adjac_succ(arena_chunk_t *chunk, size_t pageind, size_t npages)
|
|
|
|
{
|
|
|
|
bool ret;
|
|
|
|
|
|
|
|
if (pageind+npages == chunk_npages)
|
|
|
|
ret = false;
|
|
|
|
else {
|
|
|
|
assert(pageind+npages < chunk_npages);
|
|
|
|
ret = (arena_mapbits_allocated_get(chunk, pageind+npages) == 0);
|
|
|
|
assert(ret == false || arena_mapbits_dirty_get(chunk, pageind)
|
|
|
|
!= arena_mapbits_dirty_get(chunk, pageind+npages));
|
|
|
|
}
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
arena_avail_adjac(arena_chunk_t *chunk, size_t pageind, size_t npages)
|
|
|
|
{
|
|
|
|
|
|
|
|
return (arena_avail_adjac_pred(chunk, pageind) ||
|
|
|
|
arena_avail_adjac_succ(chunk, pageind, npages));
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_avail_insert(arena_t *arena, arena_chunk_t *chunk, size_t pageind,
|
|
|
|
size_t npages, bool maybe_adjac_pred, bool maybe_adjac_succ)
|
|
|
|
{
|
|
|
|
|
|
|
|
assert(npages == (arena_mapbits_unallocated_size_get(chunk, pageind) >>
|
|
|
|
LG_PAGE));
|
|
|
|
|
|
|
|
/*
|
|
|
|
* chunks_dirty is keyed by nruns_{avail,adjac}, so the chunk must be
|
|
|
|
* removed and reinserted even if the run to be inserted is clean.
|
|
|
|
*/
|
|
|
|
if (chunk->ndirty != 0)
|
|
|
|
arena_chunk_dirty_remove(&arena->chunks_dirty, chunk);
|
|
|
|
|
|
|
|
if (maybe_adjac_pred && arena_avail_adjac_pred(chunk, pageind))
|
|
|
|
chunk->nruns_adjac++;
|
|
|
|
if (maybe_adjac_succ && arena_avail_adjac_succ(chunk, pageind, npages))
|
|
|
|
chunk->nruns_adjac++;
|
|
|
|
chunk->nruns_avail++;
|
|
|
|
assert(chunk->nruns_avail > chunk->nruns_adjac);
|
|
|
|
|
|
|
|
if (arena_mapbits_dirty_get(chunk, pageind) != 0) {
|
|
|
|
arena->ndirty += npages;
|
|
|
|
chunk->ndirty += npages;
|
|
|
|
}
|
|
|
|
if (chunk->ndirty != 0)
|
|
|
|
arena_chunk_dirty_insert(&arena->chunks_dirty, chunk);
|
|
|
|
|
|
|
|
arena_avail_tree_insert(&arena->runs_avail, arena_mapp_get(chunk,
|
|
|
|
pageind));
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_avail_remove(arena_t *arena, arena_chunk_t *chunk, size_t pageind,
|
|
|
|
size_t npages, bool maybe_adjac_pred, bool maybe_adjac_succ)
|
|
|
|
{
|
|
|
|
|
|
|
|
assert(npages == (arena_mapbits_unallocated_size_get(chunk, pageind) >>
|
|
|
|
LG_PAGE));
|
|
|
|
|
|
|
|
/*
|
|
|
|
* chunks_dirty is keyed by nruns_{avail,adjac}, so the chunk must be
|
|
|
|
* removed and reinserted even if the run to be removed is clean.
|
|
|
|
*/
|
|
|
|
if (chunk->ndirty != 0)
|
|
|
|
arena_chunk_dirty_remove(&arena->chunks_dirty, chunk);
|
|
|
|
|
|
|
|
if (maybe_adjac_pred && arena_avail_adjac_pred(chunk, pageind))
|
|
|
|
chunk->nruns_adjac--;
|
|
|
|
if (maybe_adjac_succ && arena_avail_adjac_succ(chunk, pageind, npages))
|
|
|
|
chunk->nruns_adjac--;
|
|
|
|
chunk->nruns_avail--;
|
|
|
|
assert(chunk->nruns_avail > chunk->nruns_adjac || (chunk->nruns_avail
|
|
|
|
== 0 && chunk->nruns_adjac == 0));
|
|
|
|
|
|
|
|
if (arena_mapbits_dirty_get(chunk, pageind) != 0) {
|
|
|
|
arena->ndirty -= npages;
|
|
|
|
chunk->ndirty -= npages;
|
|
|
|
}
|
|
|
|
if (chunk->ndirty != 0)
|
|
|
|
arena_chunk_dirty_insert(&arena->chunks_dirty, chunk);
|
|
|
|
|
|
|
|
arena_avail_tree_remove(&arena->runs_avail, arena_mapp_get(chunk,
|
|
|
|
pageind));
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static inline void *
|
2011-03-16 04:59:15 +08:00
|
|
|
arena_run_reg_alloc(arena_run_t *run, arena_bin_info_t *bin_info)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
void *ret;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
unsigned regind;
|
|
|
|
bitmap_t *bitmap = (bitmap_t *)((uintptr_t)run +
|
|
|
|
(uintptr_t)bin_info->bitmap_offset);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-03-14 05:41:58 +08:00
|
|
|
assert(run->nfree > 0);
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
assert(bitmap_full(bitmap, &bin_info->bitmap_info) == false);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
regind = bitmap_sfu(bitmap, &bin_info->bitmap_info);
|
|
|
|
ret = (void *)((uintptr_t)run + (uintptr_t)bin_info->reg0_offset +
|
2012-04-06 15:35:09 +08:00
|
|
|
(uintptr_t)(bin_info->reg_interval * regind));
|
2010-03-14 05:41:58 +08:00
|
|
|
run->nfree--;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
if (regind == run->nextind)
|
|
|
|
run->nextind++;
|
|
|
|
assert(regind < run->nextind);
|
2010-03-14 05:41:58 +08:00
|
|
|
return (ret);
|
2010-02-11 02:37:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void
|
2010-03-14 05:41:58 +08:00
|
|
|
arena_run_reg_dalloc(arena_run_t *run, void *ptr)
|
2010-02-11 02:37:56 +08:00
|
|
|
{
|
2011-03-16 04:59:15 +08:00
|
|
|
arena_chunk_t *chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
2012-05-02 15:30:36 +08:00
|
|
|
size_t pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> LG_PAGE;
|
|
|
|
size_t mapbits = arena_mapbits_get(chunk, pageind);
|
2012-05-03 07:11:03 +08:00
|
|
|
size_t binind = arena_ptr_small_binind_get(ptr, mapbits);
|
2011-03-16 04:59:15 +08:00
|
|
|
arena_bin_info_t *bin_info = &arena_bin_info[binind];
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
unsigned regind = arena_run_regind(run, bin_info, ptr);
|
|
|
|
bitmap_t *bitmap = (bitmap_t *)((uintptr_t)run +
|
|
|
|
(uintptr_t)bin_info->bitmap_offset);
|
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
assert(run->nfree < bin_info->nregs);
|
2010-03-14 05:41:58 +08:00
|
|
|
/* Freeing an interior pointer can cause assertion failure. */
|
|
|
|
assert(((uintptr_t)ptr - ((uintptr_t)run +
|
2012-04-06 15:35:09 +08:00
|
|
|
(uintptr_t)bin_info->reg0_offset)) %
|
|
|
|
(uintptr_t)bin_info->reg_interval == 0);
|
2010-10-19 08:45:40 +08:00
|
|
|
assert((uintptr_t)ptr >= (uintptr_t)run +
|
2011-03-16 04:59:15 +08:00
|
|
|
(uintptr_t)bin_info->reg0_offset);
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
/* Freeing an unallocated pointer can cause assertion failure. */
|
|
|
|
assert(bitmap_get(bitmap, &bin_info->bitmap_info, regind));
|
2010-01-17 01:53:50 +08:00
|
|
|
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
bitmap_unset(bitmap, &bin_info->bitmap_info, regind);
|
2010-03-14 05:41:58 +08:00
|
|
|
run->nfree++;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2010-10-19 08:45:40 +08:00
|
|
|
static inline void
|
2013-01-22 12:04:42 +08:00
|
|
|
arena_run_zero(arena_chunk_t *chunk, size_t run_ind, size_t npages)
|
|
|
|
{
|
|
|
|
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED((void *)((uintptr_t)chunk +
|
|
|
|
(run_ind << LG_PAGE)), (npages << LG_PAGE));
|
2013-01-22 12:04:42 +08:00
|
|
|
memset((void *)((uintptr_t)chunk + (run_ind << LG_PAGE)), 0,
|
|
|
|
(npages << LG_PAGE));
|
|
|
|
}
|
|
|
|
|
2013-10-20 14:48:40 +08:00
|
|
|
static inline void
|
|
|
|
arena_run_page_mark_zeroed(arena_chunk_t *chunk, size_t run_ind)
|
|
|
|
{
|
|
|
|
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_DEFINED((void *)((uintptr_t)chunk + (run_ind
|
|
|
|
<< LG_PAGE)), PAGE);
|
2013-10-20 14:48:40 +08:00
|
|
|
}
|
|
|
|
|
2013-01-22 12:04:42 +08:00
|
|
|
static inline void
|
|
|
|
arena_run_page_validate_zeroed(arena_chunk_t *chunk, size_t run_ind)
|
2010-10-19 08:45:40 +08:00
|
|
|
{
|
2010-10-25 11:08:37 +08:00
|
|
|
size_t i;
|
2012-04-02 22:04:34 +08:00
|
|
|
UNUSED size_t *p = (size_t *)((uintptr_t)chunk + (run_ind << LG_PAGE));
|
2010-10-25 11:08:37 +08:00
|
|
|
|
2013-10-20 14:48:40 +08:00
|
|
|
arena_run_page_mark_zeroed(chunk, run_ind);
|
2012-04-02 22:04:34 +08:00
|
|
|
for (i = 0; i < PAGE / sizeof(size_t); i++)
|
2010-10-19 08:45:40 +08:00
|
|
|
assert(p[i] == 0);
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static void
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_cactive_update(arena_t *arena, size_t add_pages, size_t sub_pages)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
if (config_stats) {
|
|
|
|
ssize_t cactive_diff = CHUNK_CEILING((arena->nactive +
|
|
|
|
add_pages) << LG_PAGE) - CHUNK_CEILING((arena->nactive -
|
|
|
|
sub_pages) << LG_PAGE);
|
|
|
|
if (cactive_diff != 0)
|
|
|
|
stats_cactive_add(cactive_diff);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_split_remove(arena_t *arena, arena_chunk_t *chunk, size_t run_ind,
|
|
|
|
size_t flag_dirty, size_t need_pages)
|
|
|
|
{
|
|
|
|
size_t total_pages, rem_pages;
|
|
|
|
|
|
|
|
total_pages = arena_mapbits_unallocated_size_get(chunk, run_ind) >>
|
|
|
|
LG_PAGE;
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, run_ind+total_pages-1) ==
|
|
|
|
flag_dirty);
|
|
|
|
assert(need_pages <= total_pages);
|
|
|
|
rem_pages = total_pages - need_pages;
|
|
|
|
|
|
|
|
arena_avail_remove(arena, chunk, run_ind, total_pages, true, true);
|
|
|
|
arena_cactive_update(arena, need_pages, 0);
|
|
|
|
arena->nactive += need_pages;
|
|
|
|
|
|
|
|
/* Keep track of trailing unused pages for later use. */
|
|
|
|
if (rem_pages > 0) {
|
|
|
|
if (flag_dirty != 0) {
|
|
|
|
arena_mapbits_unallocated_set(chunk,
|
|
|
|
run_ind+need_pages, (rem_pages << LG_PAGE),
|
|
|
|
flag_dirty);
|
|
|
|
arena_mapbits_unallocated_set(chunk,
|
|
|
|
run_ind+total_pages-1, (rem_pages << LG_PAGE),
|
|
|
|
flag_dirty);
|
|
|
|
} else {
|
|
|
|
arena_mapbits_unallocated_set(chunk, run_ind+need_pages,
|
|
|
|
(rem_pages << LG_PAGE),
|
|
|
|
arena_mapbits_unzeroed_get(chunk,
|
|
|
|
run_ind+need_pages));
|
|
|
|
arena_mapbits_unallocated_set(chunk,
|
|
|
|
run_ind+total_pages-1, (rem_pages << LG_PAGE),
|
|
|
|
arena_mapbits_unzeroed_get(chunk,
|
|
|
|
run_ind+total_pages-1));
|
|
|
|
}
|
|
|
|
arena_avail_insert(arena, chunk, run_ind+need_pages, rem_pages,
|
|
|
|
false, true);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_split_large_helper(arena_t *arena, arena_run_t *run, size_t size,
|
|
|
|
bool remove, bool zero)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
size_t flag_dirty, run_ind, need_pages, i;
|
2012-05-02 15:30:36 +08:00
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
2012-04-02 22:04:34 +08:00
|
|
|
run_ind = (unsigned)(((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE);
|
2012-05-02 15:30:36 +08:00
|
|
|
flag_dirty = arena_mapbits_dirty_get(chunk, run_ind);
|
2012-04-02 22:04:34 +08:00
|
|
|
need_pages = (size >> LG_PAGE);
|
2010-01-17 01:53:50 +08:00
|
|
|
assert(need_pages > 0);
|
|
|
|
|
2013-10-30 09:17:42 +08:00
|
|
|
if (remove) {
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_remove(arena, chunk, run_ind, flag_dirty,
|
|
|
|
need_pages);
|
|
|
|
}
|
2013-10-30 09:17:42 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
if (zero) {
|
|
|
|
if (flag_dirty == 0) {
|
2013-10-30 09:17:42 +08:00
|
|
|
/*
|
2014-01-15 08:23:03 +08:00
|
|
|
* The run is clean, so some pages may be zeroed (i.e.
|
|
|
|
* never before touched).
|
2013-10-30 09:17:42 +08:00
|
|
|
*/
|
2014-01-15 08:23:03 +08:00
|
|
|
for (i = 0; i < need_pages; i++) {
|
|
|
|
if (arena_mapbits_unzeroed_get(chunk, run_ind+i)
|
|
|
|
!= 0)
|
|
|
|
arena_run_zero(chunk, run_ind+i, 1);
|
|
|
|
else if (config_debug) {
|
|
|
|
arena_run_page_validate_zeroed(chunk,
|
|
|
|
run_ind+i);
|
|
|
|
} else {
|
|
|
|
arena_run_page_mark_zeroed(chunk,
|
|
|
|
run_ind+i);
|
2010-03-19 11:36:40 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2013-10-20 14:48:40 +08:00
|
|
|
} else {
|
2014-01-15 08:23:03 +08:00
|
|
|
/* The run is dirty, so all pages must be zeroed. */
|
|
|
|
arena_run_zero(chunk, run_ind, need_pages);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2010-03-19 11:36:40 +08:00
|
|
|
} else {
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED((void *)((uintptr_t)chunk +
|
2013-10-20 14:48:40 +08:00
|
|
|
(run_ind << LG_PAGE)), (need_pages << LG_PAGE));
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2014-01-15 08:23:03 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Set the last element first, in case the run only contains one page
|
|
|
|
* (i.e. both statements set the same element).
|
|
|
|
*/
|
|
|
|
arena_mapbits_large_set(chunk, run_ind+need_pages-1, 0, flag_dirty);
|
|
|
|
arena_mapbits_large_set(chunk, run_ind, size, flag_dirty);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2013-10-30 09:17:42 +08:00
|
|
|
static void
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_large(arena_t *arena, arena_run_t *run, size_t size, bool zero)
|
2013-10-30 09:17:42 +08:00
|
|
|
{
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_large_helper(arena, run, size, true, zero);
|
2013-10-30 09:17:42 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_init_large(arena_t *arena, arena_run_t *run, size_t size, bool zero)
|
2013-10-30 09:17:42 +08:00
|
|
|
{
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_large_helper(arena, run, size, false, zero);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_split_small(arena_t *arena, arena_run_t *run, size_t size,
|
|
|
|
size_t binind)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
size_t flag_dirty, run_ind, need_pages, i;
|
|
|
|
|
|
|
|
assert(binind != BININD_INVALID);
|
|
|
|
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
|
|
|
run_ind = (unsigned)(((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE);
|
|
|
|
flag_dirty = arena_mapbits_dirty_get(chunk, run_ind);
|
|
|
|
need_pages = (size >> LG_PAGE);
|
|
|
|
assert(need_pages > 0);
|
|
|
|
|
|
|
|
arena_run_split_remove(arena, chunk, run_ind, flag_dirty, need_pages);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Propagate the dirty and unzeroed flags to the allocated small run,
|
|
|
|
* so that arena_dalloc_bin_run() has the ability to conditionally trim
|
|
|
|
* clean pages.
|
|
|
|
*/
|
|
|
|
arena_mapbits_small_set(chunk, run_ind, 0, binind, flag_dirty);
|
|
|
|
/*
|
|
|
|
* The first page will always be dirtied during small run
|
|
|
|
* initialization, so a validation failure here would not actually
|
|
|
|
* cause an observable failure.
|
|
|
|
*/
|
|
|
|
if (config_debug && flag_dirty == 0 && arena_mapbits_unzeroed_get(chunk,
|
|
|
|
run_ind) == 0)
|
|
|
|
arena_run_page_validate_zeroed(chunk, run_ind);
|
|
|
|
for (i = 1; i < need_pages - 1; i++) {
|
|
|
|
arena_mapbits_small_set(chunk, run_ind+i, i, binind, 0);
|
|
|
|
if (config_debug && flag_dirty == 0 &&
|
|
|
|
arena_mapbits_unzeroed_get(chunk, run_ind+i) == 0)
|
|
|
|
arena_run_page_validate_zeroed(chunk, run_ind+i);
|
|
|
|
}
|
|
|
|
arena_mapbits_small_set(chunk, run_ind+need_pages-1, need_pages-1,
|
|
|
|
binind, flag_dirty);
|
|
|
|
if (config_debug && flag_dirty == 0 && arena_mapbits_unzeroed_get(chunk,
|
|
|
|
run_ind+need_pages-1) == 0)
|
|
|
|
arena_run_page_validate_zeroed(chunk, run_ind+need_pages-1);
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED((void *)((uintptr_t)chunk +
|
2014-01-15 08:23:03 +08:00
|
|
|
(run_ind << LG_PAGE)), (need_pages << LG_PAGE));
|
2013-10-30 09:17:42 +08:00
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static arena_chunk_t *
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_chunk_init_spare(arena_t *arena)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
assert(arena->spare != NULL);
|
2010-03-19 11:36:40 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
chunk = arena->spare;
|
|
|
|
arena->spare = NULL;
|
2010-01-25 09:13:07 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
assert(arena_mapbits_allocated_get(chunk, map_bias) == 0);
|
|
|
|
assert(arena_mapbits_allocated_get(chunk, chunk_npages-1) == 0);
|
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, map_bias) ==
|
|
|
|
arena_maxclass);
|
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, chunk_npages-1) ==
|
|
|
|
arena_maxclass);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, map_bias) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, chunk_npages-1));
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
return (chunk);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
static arena_chunk_t *
|
|
|
|
arena_chunk_init_hard(arena_t *arena)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
bool zero;
|
|
|
|
size_t unzeroed, i;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
assert(arena->spare == NULL);
|
2012-10-31 06:42:37 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
zero = false;
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
chunk = (arena_chunk_t *)chunk_alloc(chunksize, chunksize, false,
|
|
|
|
&zero, arena->dss_prec);
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
if (chunk == NULL)
|
|
|
|
return (NULL);
|
|
|
|
if (config_stats)
|
|
|
|
arena->stats.mapped += chunksize;
|
|
|
|
|
|
|
|
chunk->arena = arena;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Claim that no pages are in use, since the header is merely overhead.
|
|
|
|
*/
|
|
|
|
chunk->ndirty = 0;
|
|
|
|
|
|
|
|
chunk->nruns_avail = 0;
|
|
|
|
chunk->nruns_adjac = 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the map to contain one maximal free untouched run. Mark
|
|
|
|
* the pages as zeroed iff chunk_alloc() returned a zeroed chunk.
|
|
|
|
*/
|
|
|
|
unzeroed = zero ? 0 : CHUNK_MAP_UNZEROED;
|
|
|
|
arena_mapbits_unallocated_set(chunk, map_bias, arena_maxclass,
|
|
|
|
unzeroed);
|
|
|
|
/*
|
|
|
|
* There is no need to initialize the internal page map entries unless
|
|
|
|
* the chunk is not zeroed.
|
|
|
|
*/
|
|
|
|
if (zero == false) {
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED(
|
|
|
|
(void *)arena_mapp_get(chunk, map_bias+1),
|
|
|
|
(size_t)((uintptr_t) arena_mapp_get(chunk, chunk_npages-1) -
|
|
|
|
(uintptr_t)arena_mapp_get(chunk, map_bias+1)));
|
2014-01-15 08:23:03 +08:00
|
|
|
for (i = map_bias+1; i < chunk_npages-1; i++)
|
|
|
|
arena_mapbits_unzeroed_set(chunk, i, unzeroed);
|
|
|
|
} else {
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_DEFINED((void *)arena_mapp_get(chunk,
|
2014-01-15 08:23:03 +08:00
|
|
|
map_bias+1), (size_t)((uintptr_t) arena_mapp_get(chunk,
|
|
|
|
chunk_npages-1) - (uintptr_t)arena_mapp_get(chunk,
|
|
|
|
map_bias+1)));
|
|
|
|
if (config_debug) {
|
|
|
|
for (i = map_bias+1; i < chunk_npages-1; i++) {
|
|
|
|
assert(arena_mapbits_unzeroed_get(chunk, i) ==
|
|
|
|
unzeroed);
|
2012-05-02 15:30:36 +08:00
|
|
|
}
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
}
|
2010-03-19 11:36:40 +08:00
|
|
|
}
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_mapbits_unallocated_set(chunk, chunk_npages-1, arena_maxclass,
|
|
|
|
unzeroed);
|
|
|
|
|
|
|
|
return (chunk);
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_chunk_t *
|
|
|
|
arena_chunk_alloc(arena_t *arena)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
|
|
|
|
if (arena->spare != NULL)
|
|
|
|
chunk = arena_chunk_init_spare(arena);
|
2014-03-26 13:36:05 +08:00
|
|
|
else {
|
2014-01-15 08:23:03 +08:00
|
|
|
chunk = arena_chunk_init_hard(arena);
|
2014-03-26 13:36:05 +08:00
|
|
|
if (chunk == NULL)
|
|
|
|
return (NULL);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
/* Insert the run into the runs_avail tree. */
|
|
|
|
arena_avail_insert(arena, chunk, map_bias, chunk_npages-map_bias,
|
|
|
|
false, false);
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
return (chunk);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_chunk_dealloc(arena_t *arena, arena_chunk_t *chunk)
|
|
|
|
{
|
2012-05-11 08:09:17 +08:00
|
|
|
assert(arena_mapbits_allocated_get(chunk, map_bias) == 0);
|
|
|
|
assert(arena_mapbits_allocated_get(chunk, chunk_npages-1) == 0);
|
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, map_bias) ==
|
|
|
|
arena_maxclass);
|
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, chunk_npages-1) ==
|
|
|
|
arena_maxclass);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, map_bias) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, chunk_npages-1));
|
|
|
|
|
2010-04-14 11:53:21 +08:00
|
|
|
/*
|
2012-10-31 06:42:37 +08:00
|
|
|
* Remove run from the runs_avail tree, so that the arena does not use
|
|
|
|
* it.
|
2010-04-14 11:53:21 +08:00
|
|
|
*/
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_avail_remove(arena, chunk, map_bias, chunk_npages-map_bias,
|
|
|
|
false, false);
|
2010-04-14 11:53:21 +08:00
|
|
|
|
|
|
|
if (arena->spare != NULL) {
|
2010-03-15 10:43:56 +08:00
|
|
|
arena_chunk_t *spare = arena->spare;
|
|
|
|
|
2010-04-14 11:53:21 +08:00
|
|
|
arena->spare = chunk;
|
2010-03-15 10:43:56 +08:00
|
|
|
malloc_mutex_unlock(&arena->lock);
|
2011-11-12 06:41:59 +08:00
|
|
|
chunk_dealloc((void *)spare, chunksize, true);
|
2010-03-15 10:43:56 +08:00
|
|
|
malloc_mutex_lock(&arena->lock);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
arena->stats.mapped -= chunksize;
|
2010-04-14 11:53:21 +08:00
|
|
|
} else
|
|
|
|
arena->spare = chunk;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_alloc_large_helper(arena_t *arena, size_t size, bool zero)
|
|
|
|
{
|
|
|
|
arena_run_t *run;
|
2014-04-07 04:24:16 +08:00
|
|
|
arena_chunk_map_t *mapelm;
|
|
|
|
arena_chunk_map_t *key;
|
2014-01-15 08:23:03 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
key = (arena_chunk_map_t *)(size | CHUNK_MAP_KEY);
|
|
|
|
mapelm = arena_avail_tree_nsearch(&arena->runs_avail, key);
|
2014-01-15 08:23:03 +08:00
|
|
|
if (mapelm != NULL) {
|
|
|
|
arena_chunk_t *run_chunk = CHUNK_ADDR2BASE(mapelm);
|
2014-04-07 04:24:16 +08:00
|
|
|
size_t pageind = arena_mapelm_to_pageind(mapelm);
|
2014-01-15 08:23:03 +08:00
|
|
|
|
|
|
|
run = (arena_run_t *)((uintptr_t)run_chunk + (pageind <<
|
|
|
|
LG_PAGE));
|
|
|
|
arena_run_split_large(arena, run, size, zero);
|
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
|
|
|
arena_run_alloc_large(arena_t *arena, size_t size, bool zero)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
arena_run_t *run;
|
|
|
|
|
|
|
|
assert(size <= arena_maxclass);
|
|
|
|
assert((size & PAGE_MASK) == 0);
|
|
|
|
|
|
|
|
/* Search the arena's chunks for the lowest best fit. */
|
|
|
|
run = arena_run_alloc_large_helper(arena, size, zero);
|
|
|
|
if (run != NULL)
|
|
|
|
return (run);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* No usable runs. Create a new chunk from which to allocate the run.
|
|
|
|
*/
|
|
|
|
chunk = arena_chunk_alloc(arena);
|
|
|
|
if (chunk != NULL) {
|
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (map_bias << LG_PAGE));
|
|
|
|
arena_run_split_large(arena, run, size, zero);
|
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* arena_chunk_alloc() failed, but another thread may have made
|
|
|
|
* sufficient memory available while this one dropped arena->lock in
|
|
|
|
* arena_chunk_alloc(), so search one more time.
|
|
|
|
*/
|
|
|
|
return (arena_run_alloc_large_helper(arena, size, zero));
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
|
|
|
arena_run_alloc_small_helper(arena_t *arena, size_t size, size_t binind)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
arena_run_t *run;
|
2014-04-07 04:24:16 +08:00
|
|
|
arena_chunk_map_t *mapelm;
|
|
|
|
arena_chunk_map_t *key;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
key = (arena_chunk_map_t *)(size | CHUNK_MAP_KEY);
|
|
|
|
mapelm = arena_avail_tree_nsearch(&arena->runs_avail, key);
|
2010-01-17 01:53:50 +08:00
|
|
|
if (mapelm != NULL) {
|
|
|
|
arena_chunk_t *run_chunk = CHUNK_ADDR2BASE(mapelm);
|
2014-04-07 04:24:16 +08:00
|
|
|
size_t pageind = arena_mapelm_to_pageind(mapelm);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-03-15 10:43:56 +08:00
|
|
|
run = (arena_run_t *)((uintptr_t)run_chunk + (pageind <<
|
2012-04-02 22:04:34 +08:00
|
|
|
LG_PAGE));
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_small(arena, run, size, binind);
|
2010-01-17 01:53:50 +08:00
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
2012-05-11 06:47:24 +08:00
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_alloc_small(arena_t *arena, size_t size, size_t binind)
|
2012-05-11 06:47:24 +08:00
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
arena_run_t *run;
|
|
|
|
|
|
|
|
assert(size <= arena_maxclass);
|
|
|
|
assert((size & PAGE_MASK) == 0);
|
2014-01-15 08:23:03 +08:00
|
|
|
assert(binind != BININD_INVALID);
|
2012-05-11 06:47:24 +08:00
|
|
|
|
|
|
|
/* Search the arena's chunks for the lowest best fit. */
|
2014-01-15 08:23:03 +08:00
|
|
|
run = arena_run_alloc_small_helper(arena, size, binind);
|
2012-05-11 06:47:24 +08:00
|
|
|
if (run != NULL)
|
|
|
|
return (run);
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/*
|
|
|
|
* No usable runs. Create a new chunk from which to allocate the run.
|
|
|
|
*/
|
|
|
|
chunk = arena_chunk_alloc(arena);
|
2010-03-15 10:43:56 +08:00
|
|
|
if (chunk != NULL) {
|
2012-04-02 22:04:34 +08:00
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (map_bias << LG_PAGE));
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_small(arena, run, size, binind);
|
2010-03-15 10:43:56 +08:00
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* arena_chunk_alloc() failed, but another thread may have made
|
|
|
|
* sufficient memory available while this one dropped arena->lock in
|
|
|
|
* arena_chunk_alloc(), so search one more time.
|
|
|
|
*/
|
2014-01-15 08:23:03 +08:00
|
|
|
return (arena_run_alloc_small_helper(arena, size, binind));
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2010-03-15 08:36:10 +08:00
|
|
|
static inline void
|
|
|
|
arena_maybe_purge(arena_t *arena)
|
|
|
|
{
|
2012-10-31 06:42:37 +08:00
|
|
|
size_t npurgeable, threshold;
|
|
|
|
|
|
|
|
/* Don't purge if the option is disabled. */
|
|
|
|
if (opt_lg_dirty_mult < 0)
|
|
|
|
return;
|
|
|
|
/* Don't purge if all dirty pages are already being purged. */
|
|
|
|
if (arena->ndirty <= arena->npurgatory)
|
|
|
|
return;
|
|
|
|
npurgeable = arena->ndirty - arena->npurgatory;
|
|
|
|
threshold = (arena->nactive >> opt_lg_dirty_mult);
|
|
|
|
/*
|
|
|
|
* Don't purge unless the number of purgeable pages exceeds the
|
|
|
|
* threshold.
|
|
|
|
*/
|
|
|
|
if (npurgeable <= threshold)
|
|
|
|
return;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_purge(arena, false);
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
static arena_chunk_t *
|
|
|
|
chunks_dirty_iter_cb(arena_chunk_tree_t *tree, arena_chunk_t *chunk, void *arg)
|
2010-03-15 08:36:10 +08:00
|
|
|
{
|
2014-01-15 08:23:03 +08:00
|
|
|
size_t *ndirty = (size_t *)arg;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
assert(chunk->ndirty != 0);
|
|
|
|
*ndirty += chunk->ndirty;
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static size_t
|
|
|
|
arena_compute_npurgatory(arena_t *arena, bool all)
|
|
|
|
{
|
|
|
|
size_t npurgatory, npurgeable;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
|
|
|
/*
|
2014-01-15 08:23:03 +08:00
|
|
|
* Compute the minimum number of pages that this thread should try to
|
|
|
|
* purge.
|
2010-03-15 08:36:10 +08:00
|
|
|
*/
|
2014-01-15 08:23:03 +08:00
|
|
|
npurgeable = arena->ndirty - arena->npurgatory;
|
2012-05-11 08:09:17 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
if (all == false) {
|
|
|
|
size_t threshold = (arena->nactive >> opt_lg_dirty_mult);
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
npurgatory = npurgeable - threshold;
|
|
|
|
} else
|
|
|
|
npurgatory = npurgeable;
|
2012-10-31 06:42:37 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
return (npurgatory);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_chunk_stash_dirty(arena_t *arena, arena_chunk_t *chunk, bool all,
|
|
|
|
arena_chunk_mapelms_t *mapelms)
|
|
|
|
{
|
|
|
|
size_t pageind, npages;
|
2012-10-31 06:42:37 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Temporarily allocate free dirty runs within chunk. If all is false,
|
|
|
|
* only operate on dirty runs that are fragments; otherwise operate on
|
|
|
|
* all dirty runs.
|
|
|
|
*/
|
|
|
|
for (pageind = map_bias; pageind < chunk_npages; pageind += npages) {
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_chunk_map_t *mapelm = arena_mapp_get(chunk, pageind);
|
2012-05-02 15:30:36 +08:00
|
|
|
if (arena_mapbits_allocated_get(chunk, pageind) == 0) {
|
2012-10-31 06:42:37 +08:00
|
|
|
size_t run_size =
|
|
|
|
arena_mapbits_unallocated_size_get(chunk, pageind);
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
npages = run_size >> LG_PAGE;
|
2010-03-16 13:25:23 +08:00
|
|
|
assert(pageind + npages <= chunk_npages);
|
2012-05-11 08:09:17 +08:00
|
|
|
assert(arena_mapbits_dirty_get(chunk, pageind) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, pageind+npages-1));
|
2010-03-23 02:45:01 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
if (arena_mapbits_dirty_get(chunk, pageind) != 0 &&
|
|
|
|
(all || arena_avail_adjac(chunk, pageind,
|
|
|
|
npages))) {
|
|
|
|
arena_run_t *run = (arena_run_t *)((uintptr_t)
|
|
|
|
chunk + (uintptr_t)(pageind << LG_PAGE));
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_large(arena, run, run_size,
|
|
|
|
false);
|
2010-03-19 11:36:40 +08:00
|
|
|
/* Append to list for later processing. */
|
|
|
|
ql_elm_new(mapelm, u.ql_link);
|
2014-01-15 08:23:03 +08:00
|
|
|
ql_tail_insert(mapelms, mapelm, u.ql_link);
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
|
|
|
} else {
|
2012-10-31 06:42:37 +08:00
|
|
|
/* Skip run. */
|
|
|
|
if (arena_mapbits_large_get(chunk, pageind) != 0) {
|
|
|
|
npages = arena_mapbits_large_size_get(chunk,
|
2012-05-02 15:30:36 +08:00
|
|
|
pageind) >> LG_PAGE;
|
2012-10-31 06:42:37 +08:00
|
|
|
} else {
|
2012-04-25 05:22:02 +08:00
|
|
|
size_t binind;
|
|
|
|
arena_bin_info_t *bin_info;
|
2010-03-15 08:36:10 +08:00
|
|
|
arena_run_t *run = (arena_run_t *)((uintptr_t)
|
2012-04-02 22:04:34 +08:00
|
|
|
chunk + (uintptr_t)(pageind << LG_PAGE));
|
2010-03-16 13:25:23 +08:00
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_small_runind_get(chunk,
|
|
|
|
pageind) == 0);
|
2012-04-25 05:22:02 +08:00
|
|
|
binind = arena_bin_index(arena, run->bin);
|
|
|
|
bin_info = &arena_bin_info[binind];
|
2012-10-31 06:42:37 +08:00
|
|
|
npages = bin_info->run_size >> LG_PAGE;
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2010-03-16 13:25:23 +08:00
|
|
|
assert(pageind == chunk_npages);
|
2012-10-31 06:42:37 +08:00
|
|
|
assert(chunk->ndirty == 0 || all == false);
|
|
|
|
assert(chunk->nruns_adjac == 0);
|
2014-01-15 08:23:03 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static size_t
|
|
|
|
arena_chunk_purge_stashed(arena_t *arena, arena_chunk_t *chunk,
|
|
|
|
arena_chunk_mapelms_t *mapelms)
|
|
|
|
{
|
|
|
|
size_t npurged, pageind, npages, nmadvise;
|
|
|
|
arena_chunk_map_t *mapelm;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
nmadvise = 0;
|
2012-10-31 06:42:37 +08:00
|
|
|
npurged = 0;
|
2014-01-15 08:23:03 +08:00
|
|
|
ql_foreach(mapelm, mapelms, u.ql_link) {
|
2012-10-09 08:56:11 +08:00
|
|
|
bool unzeroed;
|
|
|
|
size_t flag_unzeroed, i;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
pageind = arena_mapelm_to_pageind(mapelm);
|
2012-10-31 06:42:37 +08:00
|
|
|
npages = arena_mapbits_large_size_get(chunk, pageind) >>
|
|
|
|
LG_PAGE;
|
2010-03-16 13:25:23 +08:00
|
|
|
assert(pageind + npages <= chunk_npages);
|
2012-10-09 08:56:11 +08:00
|
|
|
unzeroed = pages_purge((void *)((uintptr_t)chunk + (pageind <<
|
|
|
|
LG_PAGE)), (npages << LG_PAGE));
|
|
|
|
flag_unzeroed = unzeroed ? CHUNK_MAP_UNZEROED : 0;
|
|
|
|
/*
|
|
|
|
* Set the unzeroed flag for all pages, now that pages_purge()
|
|
|
|
* has returned whether the pages were zeroed as a side effect
|
|
|
|
* of purging. This chunk map modification is safe even though
|
|
|
|
* the arena mutex isn't currently owned by this thread,
|
|
|
|
* because the run is marked as allocated, thus protecting it
|
|
|
|
* from being modified by any other thread. As long as these
|
|
|
|
* writes don't perturb the first and last elements'
|
|
|
|
* CHUNK_MAP_ALLOCATED bits, behavior is well defined.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < npages; i++) {
|
|
|
|
arena_mapbits_unzeroed_set(chunk, pageind+i,
|
|
|
|
flag_unzeroed);
|
|
|
|
}
|
2012-10-31 06:42:37 +08:00
|
|
|
npurged += npages;
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
nmadvise++;
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
arena->stats.nmadvise += nmadvise;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
return (npurged);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_chunk_unstash_purged(arena_t *arena, arena_chunk_t *chunk,
|
|
|
|
arena_chunk_mapelms_t *mapelms)
|
|
|
|
{
|
|
|
|
arena_chunk_map_t *mapelm;
|
|
|
|
size_t pageind;
|
|
|
|
|
2010-03-15 08:36:10 +08:00
|
|
|
/* Deallocate runs. */
|
2014-01-15 08:23:03 +08:00
|
|
|
for (mapelm = ql_first(mapelms); mapelm != NULL;
|
|
|
|
mapelm = ql_first(mapelms)) {
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_run_t *run;
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2014-04-07 04:24:16 +08:00
|
|
|
pageind = arena_mapelm_to_pageind(mapelm);
|
2012-10-31 06:42:37 +08:00
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (uintptr_t)(pageind <<
|
|
|
|
LG_PAGE));
|
2014-01-15 08:23:03 +08:00
|
|
|
ql_remove(mapelms, mapelm, u.ql_link);
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_run_dalloc(arena, run, false, true);
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
2012-10-31 06:42:37 +08:00
|
|
|
}
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
static inline size_t
|
|
|
|
arena_chunk_purge(arena_t *arena, arena_chunk_t *chunk, bool all)
|
2012-10-31 06:42:37 +08:00
|
|
|
{
|
2014-01-15 08:23:03 +08:00
|
|
|
size_t npurged;
|
|
|
|
arena_chunk_mapelms_t mapelms;
|
2012-10-31 06:42:37 +08:00
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
ql_new(&mapelms);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If chunk is the spare, temporarily re-allocate it, 1) so that its
|
|
|
|
* run is reinserted into runs_avail, and 2) so that it cannot be
|
|
|
|
* completely discarded by another thread while arena->lock is dropped
|
|
|
|
* by this thread. Note that the arena_run_dalloc() call will
|
|
|
|
* implicitly deallocate the chunk, so no explicit action is required
|
|
|
|
* in this function to deallocate the chunk.
|
|
|
|
*
|
|
|
|
* Note that once a chunk contains dirty pages, it cannot again contain
|
|
|
|
* a single run unless 1) it is a dirty run, or 2) this function purges
|
|
|
|
* dirty pages and causes the transition to a single clean run. Thus
|
|
|
|
* (chunk == arena->spare) is possible, but it is not possible for
|
|
|
|
* this function to be called on the spare unless it contains a dirty
|
|
|
|
* run.
|
|
|
|
*/
|
|
|
|
if (chunk == arena->spare) {
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, map_bias) != 0);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, chunk_npages-1) != 0);
|
|
|
|
|
|
|
|
arena_chunk_alloc(arena);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (config_stats)
|
|
|
|
arena->stats.purged += chunk->ndirty;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Operate on all dirty runs if there is no clean/dirty run
|
|
|
|
* fragmentation.
|
|
|
|
*/
|
|
|
|
if (chunk->nruns_adjac == 0)
|
|
|
|
all = true;
|
|
|
|
|
|
|
|
arena_chunk_stash_dirty(arena, chunk, all, &mapelms);
|
|
|
|
npurged = arena_chunk_purge_stashed(arena, chunk, &mapelms);
|
|
|
|
arena_chunk_unstash_purged(arena, chunk, &mapelms);
|
|
|
|
|
|
|
|
return (npurged);
|
2010-03-15 08:36:10 +08:00
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static void
|
2010-10-01 07:55:08 +08:00
|
|
|
arena_purge(arena_t *arena, bool all)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
2010-03-15 08:36:10 +08:00
|
|
|
size_t npurgatory;
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_debug) {
|
|
|
|
size_t ndirty = 0;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_chunk_dirty_iter(&arena->chunks_dirty, NULL,
|
|
|
|
chunks_dirty_iter_cb, (void *)&ndirty);
|
2012-02-11 12:22:09 +08:00
|
|
|
assert(ndirty == arena->ndirty);
|
2010-03-05 13:35:07 +08:00
|
|
|
}
|
2011-03-24 11:39:02 +08:00
|
|
|
assert(arena->ndirty > arena->npurgatory || all);
|
|
|
|
assert((arena->nactive >> opt_lg_dirty_mult) < (arena->ndirty -
|
2011-06-13 07:46:03 +08:00
|
|
|
arena->npurgatory) || all);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
arena->stats.npurge++;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/*
|
2014-01-15 08:23:03 +08:00
|
|
|
* Add the minimum number of pages this thread should try to purge to
|
|
|
|
* arena->npurgatory. This will keep multiple threads from racing to
|
|
|
|
* reduce ndirty below the threshold.
|
2010-01-17 01:53:50 +08:00
|
|
|
*/
|
2014-01-15 08:23:03 +08:00
|
|
|
npurgatory = arena_compute_npurgatory(arena, all);
|
2010-04-09 11:31:58 +08:00
|
|
|
arena->npurgatory += npurgatory;
|
|
|
|
|
2010-03-15 08:36:10 +08:00
|
|
|
while (npurgatory > 0) {
|
2012-10-31 06:42:37 +08:00
|
|
|
size_t npurgeable, npurged, nunpurged;
|
|
|
|
|
2010-03-15 08:36:10 +08:00
|
|
|
/* Get next chunk with dirty pages. */
|
2012-10-31 06:42:37 +08:00
|
|
|
chunk = arena_chunk_dirty_first(&arena->chunks_dirty);
|
2010-03-15 08:36:10 +08:00
|
|
|
if (chunk == NULL) {
|
|
|
|
/*
|
|
|
|
* This thread was unable to purge as many pages as
|
|
|
|
* originally intended, due to races with other threads
|
2010-04-09 11:31:58 +08:00
|
|
|
* that either did some of the purging work, or re-used
|
|
|
|
* dirty pages.
|
2010-03-15 08:36:10 +08:00
|
|
|
*/
|
2010-04-09 11:31:58 +08:00
|
|
|
arena->npurgatory -= npurgatory;
|
|
|
|
return;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2012-10-31 06:42:37 +08:00
|
|
|
npurgeable = chunk->ndirty;
|
|
|
|
assert(npurgeable != 0);
|
2010-03-15 08:36:10 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
if (npurgeable > npurgatory && chunk->nruns_adjac == 0) {
|
2010-04-09 11:31:58 +08:00
|
|
|
/*
|
2012-10-31 06:42:37 +08:00
|
|
|
* This thread will purge all the dirty pages in chunk,
|
|
|
|
* so set npurgatory to reflect this thread's intent to
|
|
|
|
* purge the pages. This tends to reduce the chances
|
|
|
|
* of the following scenario:
|
2010-04-09 11:31:58 +08:00
|
|
|
*
|
|
|
|
* 1) This thread sets arena->npurgatory such that
|
|
|
|
* (arena->ndirty - arena->npurgatory) is at the
|
|
|
|
* threshold.
|
|
|
|
* 2) This thread drops arena->lock.
|
|
|
|
* 3) Another thread causes one or more pages to be
|
|
|
|
* dirtied, and immediately determines that it must
|
|
|
|
* purge dirty pages.
|
|
|
|
*
|
|
|
|
* If this scenario *does* play out, that's okay,
|
|
|
|
* because all of the purging work being done really
|
|
|
|
* needs to happen.
|
|
|
|
*/
|
2012-10-31 06:42:37 +08:00
|
|
|
arena->npurgatory += npurgeable - npurgatory;
|
|
|
|
npurgatory = npurgeable;
|
2010-04-09 11:31:58 +08:00
|
|
|
}
|
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
/*
|
|
|
|
* Keep track of how many pages are purgeable, versus how many
|
|
|
|
* actually get purged, and adjust counters accordingly.
|
|
|
|
*/
|
|
|
|
arena->npurgatory -= npurgeable;
|
|
|
|
npurgatory -= npurgeable;
|
|
|
|
npurged = arena_chunk_purge(arena, chunk, all);
|
|
|
|
nunpurged = npurgeable - npurged;
|
|
|
|
arena->npurgatory += nunpurged;
|
|
|
|
npurgatory += nunpurged;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-10-01 07:55:08 +08:00
|
|
|
void
|
|
|
|
arena_purge_all(arena_t *arena)
|
|
|
|
{
|
|
|
|
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
arena_purge(arena, true);
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static void
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_coalesce(arena_t *arena, arena_chunk_t *chunk, size_t *p_size,
|
|
|
|
size_t *p_run_ind, size_t *p_run_pages, size_t flag_dirty)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
2014-01-15 08:23:03 +08:00
|
|
|
size_t size = *p_size;
|
|
|
|
size_t run_ind = *p_run_ind;
|
|
|
|
size_t run_pages = *p_run_pages;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/* Try to coalesce forward. */
|
|
|
|
if (run_ind + run_pages < chunk_npages &&
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_allocated_get(chunk, run_ind+run_pages) == 0 &&
|
|
|
|
arena_mapbits_dirty_get(chunk, run_ind+run_pages) == flag_dirty) {
|
|
|
|
size_t nrun_size = arena_mapbits_unallocated_size_get(chunk,
|
|
|
|
run_ind+run_pages);
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t nrun_pages = nrun_size >> LG_PAGE;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Remove successor from runs_avail; the coalesced run is
|
|
|
|
* inserted later.
|
|
|
|
*/
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk,
|
|
|
|
run_ind+run_pages+nrun_pages-1) == nrun_size);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk,
|
|
|
|
run_ind+run_pages+nrun_pages-1) == flag_dirty);
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_avail_remove(arena, chunk, run_ind+run_pages, nrun_pages,
|
|
|
|
false, true);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
size += nrun_size;
|
2010-10-18 10:56:09 +08:00
|
|
|
run_pages += nrun_pages;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_unallocated_size_set(chunk, run_ind, size);
|
|
|
|
arena_mapbits_unallocated_size_set(chunk, run_ind+run_pages-1,
|
|
|
|
size);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Try to coalesce backward. */
|
2014-01-15 08:23:03 +08:00
|
|
|
if (run_ind > map_bias && arena_mapbits_allocated_get(chunk,
|
|
|
|
run_ind-1) == 0 && arena_mapbits_dirty_get(chunk, run_ind-1) ==
|
|
|
|
flag_dirty) {
|
2012-05-02 15:30:36 +08:00
|
|
|
size_t prun_size = arena_mapbits_unallocated_size_get(chunk,
|
|
|
|
run_ind-1);
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t prun_pages = prun_size >> LG_PAGE;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-10-18 10:56:09 +08:00
|
|
|
run_ind -= prun_pages;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Remove predecessor from runs_avail; the coalesced run is
|
|
|
|
* inserted later.
|
|
|
|
*/
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, run_ind) ==
|
|
|
|
prun_size);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, run_ind) == flag_dirty);
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_avail_remove(arena, chunk, run_ind, prun_pages, true,
|
|
|
|
false);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
size += prun_size;
|
2010-10-18 10:56:09 +08:00
|
|
|
run_pages += prun_pages;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_unallocated_size_set(chunk, run_ind, size);
|
|
|
|
arena_mapbits_unallocated_size_set(chunk, run_ind+run_pages-1,
|
|
|
|
size);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2014-01-15 08:23:03 +08:00
|
|
|
*p_size = size;
|
|
|
|
*p_run_ind = run_ind;
|
|
|
|
*p_run_pages = run_pages;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_dalloc(arena_t *arena, arena_run_t *run, bool dirty, bool cleaned)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
size_t size, run_ind, run_pages, flag_dirty;
|
|
|
|
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
|
|
|
run_ind = (size_t)(((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE);
|
|
|
|
assert(run_ind >= map_bias);
|
|
|
|
assert(run_ind < chunk_npages);
|
|
|
|
if (arena_mapbits_large_get(chunk, run_ind) != 0) {
|
|
|
|
size = arena_mapbits_large_size_get(chunk, run_ind);
|
|
|
|
assert(size == PAGE ||
|
|
|
|
arena_mapbits_large_size_get(chunk,
|
|
|
|
run_ind+(size>>LG_PAGE)-1) == 0);
|
|
|
|
} else {
|
|
|
|
size_t binind = arena_bin_index(arena, run->bin);
|
|
|
|
arena_bin_info_t *bin_info = &arena_bin_info[binind];
|
|
|
|
size = bin_info->run_size;
|
|
|
|
}
|
|
|
|
run_pages = (size >> LG_PAGE);
|
|
|
|
arena_cactive_update(arena, 0, run_pages);
|
|
|
|
arena->nactive -= run_pages;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The run is dirty if the caller claims to have dirtied it, as well as
|
|
|
|
* if it was already dirty before being allocated and the caller
|
|
|
|
* doesn't claim to have cleaned it.
|
|
|
|
*/
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, run_ind) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, run_ind+run_pages-1));
|
|
|
|
if (cleaned == false && arena_mapbits_dirty_get(chunk, run_ind) != 0)
|
|
|
|
dirty = true;
|
|
|
|
flag_dirty = dirty ? CHUNK_MAP_DIRTY : 0;
|
|
|
|
|
|
|
|
/* Mark pages as unallocated in the chunk map. */
|
|
|
|
if (dirty) {
|
|
|
|
arena_mapbits_unallocated_set(chunk, run_ind, size,
|
|
|
|
CHUNK_MAP_DIRTY);
|
|
|
|
arena_mapbits_unallocated_set(chunk, run_ind+run_pages-1, size,
|
|
|
|
CHUNK_MAP_DIRTY);
|
|
|
|
} else {
|
|
|
|
arena_mapbits_unallocated_set(chunk, run_ind, size,
|
|
|
|
arena_mapbits_unzeroed_get(chunk, run_ind));
|
|
|
|
arena_mapbits_unallocated_set(chunk, run_ind+run_pages-1, size,
|
|
|
|
arena_mapbits_unzeroed_get(chunk, run_ind+run_pages-1));
|
|
|
|
}
|
|
|
|
|
|
|
|
arena_run_coalesce(arena, chunk, &size, &run_ind, &run_pages,
|
|
|
|
flag_dirty);
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/* Insert into runs_avail, now that coalescing is complete. */
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_unallocated_size_get(chunk, run_ind) ==
|
|
|
|
arena_mapbits_unallocated_size_get(chunk, run_ind+run_pages-1));
|
|
|
|
assert(arena_mapbits_dirty_get(chunk, run_ind) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, run_ind+run_pages-1));
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_avail_insert(arena, chunk, run_ind, run_pages, true, true);
|
2010-04-14 11:53:21 +08:00
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
/* Deallocate chunk if it is now completely unused. */
|
|
|
|
if (size == arena_maxclass) {
|
|
|
|
assert(run_ind == map_bias);
|
|
|
|
assert(run_pages == (arena_maxclass >> LG_PAGE));
|
2010-01-17 01:53:50 +08:00
|
|
|
arena_chunk_dealloc(arena, chunk);
|
2012-05-02 15:30:36 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-01-28 10:27:09 +08:00
|
|
|
/*
|
2010-04-14 11:53:21 +08:00
|
|
|
* It is okay to do dirty page processing here even if the chunk was
|
2010-01-28 10:27:09 +08:00
|
|
|
* deallocated above, since in that case it is the spare. Waiting
|
|
|
|
* until after possible chunk deallocation to do dirty processing
|
|
|
|
* allows for an old spare to be fully deallocated, thus decreasing the
|
|
|
|
* chances of spuriously crossing the dirty page purging threshold.
|
|
|
|
*/
|
2010-04-14 11:53:21 +08:00
|
|
|
if (dirty)
|
2010-03-15 08:36:10 +08:00
|
|
|
arena_maybe_purge(arena);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_trim_head(arena_t *arena, arena_chunk_t *chunk, arena_run_t *run,
|
|
|
|
size_t oldsize, size_t newsize)
|
|
|
|
{
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE;
|
|
|
|
size_t head_npages = (oldsize - newsize) >> LG_PAGE;
|
2012-05-02 15:30:36 +08:00
|
|
|
size_t flag_dirty = arena_mapbits_dirty_get(chunk, pageind);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
assert(oldsize > newsize);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Update the chunk map so that arena_run_dalloc() can treat the
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
* leading run as separately allocated. Set the last element of each
|
|
|
|
* run first, in case of single-page runs.
|
2010-01-17 01:53:50 +08:00
|
|
|
*/
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_large_size_get(chunk, pageind) == oldsize);
|
2012-05-11 11:59:39 +08:00
|
|
|
arena_mapbits_large_set(chunk, pageind+head_npages-1, 0, flag_dirty);
|
|
|
|
arena_mapbits_large_set(chunk, pageind, oldsize-newsize, flag_dirty);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_debug) {
|
2012-04-02 22:04:34 +08:00
|
|
|
UNUSED size_t tail_npages = newsize >> LG_PAGE;
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_large_size_get(chunk,
|
|
|
|
pageind+head_npages+tail_npages-1) == 0);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk,
|
|
|
|
pageind+head_npages+tail_npages-1) == flag_dirty);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
}
|
2012-05-11 11:59:39 +08:00
|
|
|
arena_mapbits_large_set(chunk, pageind+head_npages, newsize,
|
|
|
|
flag_dirty);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_run_dalloc(arena, run, false, false);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_run_trim_tail(arena_t *arena, arena_chunk_t *chunk, arena_run_t *run,
|
|
|
|
size_t oldsize, size_t newsize, bool dirty)
|
|
|
|
{
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE;
|
|
|
|
size_t head_npages = newsize >> LG_PAGE;
|
2012-05-02 15:30:36 +08:00
|
|
|
size_t flag_dirty = arena_mapbits_dirty_get(chunk, pageind);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
assert(oldsize > newsize);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Update the chunk map so that arena_run_dalloc() can treat the
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
* trailing run as separately allocated. Set the last element of each
|
|
|
|
* run first, in case of single-page runs.
|
2010-01-17 01:53:50 +08:00
|
|
|
*/
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_mapbits_large_size_get(chunk, pageind) == oldsize);
|
2012-05-11 11:59:39 +08:00
|
|
|
arena_mapbits_large_set(chunk, pageind+head_npages-1, 0, flag_dirty);
|
|
|
|
arena_mapbits_large_set(chunk, pageind, newsize, flag_dirty);
|
2012-05-02 15:30:36 +08:00
|
|
|
|
|
|
|
if (config_debug) {
|
|
|
|
UNUSED size_t tail_npages = (oldsize - newsize) >> LG_PAGE;
|
|
|
|
assert(arena_mapbits_large_size_get(chunk,
|
|
|
|
pageind+head_npages+tail_npages-1) == 0);
|
|
|
|
assert(arena_mapbits_dirty_get(chunk,
|
|
|
|
pageind+head_npages+tail_npages-1) == flag_dirty);
|
|
|
|
}
|
|
|
|
arena_mapbits_large_set(chunk, pageind+head_npages, oldsize-newsize,
|
2012-05-11 11:59:39 +08:00
|
|
|
flag_dirty);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
arena_run_dalloc(arena, (arena_run_t *)((uintptr_t)run + newsize),
|
2012-10-31 06:42:37 +08:00
|
|
|
dirty, false);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
2012-02-14 09:36:52 +08:00
|
|
|
arena_bin_runs_first(arena_bin_t *bin)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
2012-02-14 09:36:52 +08:00
|
|
|
arena_chunk_map_t *mapelm = arena_run_tree_first(&bin->runs);
|
2010-01-17 01:53:50 +08:00
|
|
|
if (mapelm != NULL) {
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
size_t pageind;
|
2012-04-25 05:22:02 +08:00
|
|
|
arena_run_t *run;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(mapelm);
|
2014-04-07 04:24:16 +08:00
|
|
|
pageind = arena_mapelm_to_pageind(mapelm);
|
2012-05-02 15:30:36 +08:00
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (uintptr_t)((pageind -
|
|
|
|
arena_mapbits_small_runind_get(chunk, pageind)) <<
|
2012-04-02 22:04:34 +08:00
|
|
|
LG_PAGE));
|
2012-02-14 09:36:52 +08:00
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_bin_runs_insert(arena_bin_t *bin, arena_run_t *run)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk = CHUNK_ADDR2BASE(run);
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE;
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_chunk_map_t *mapelm = arena_mapp_get(chunk, pageind);
|
2012-02-14 09:36:52 +08:00
|
|
|
|
|
|
|
assert(arena_run_tree_search(&bin->runs, mapelm) == NULL);
|
|
|
|
|
|
|
|
arena_run_tree_insert(&bin->runs, mapelm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_bin_runs_remove(arena_bin_t *bin, arena_run_t *run)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE;
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_chunk_map_t *mapelm = arena_mapp_get(chunk, pageind);
|
2012-02-14 09:36:52 +08:00
|
|
|
|
|
|
|
assert(arena_run_tree_search(&bin->runs, mapelm) != NULL);
|
|
|
|
|
|
|
|
arena_run_tree_remove(&bin->runs, mapelm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
|
|
|
arena_bin_nonfull_run_tryget(arena_bin_t *bin)
|
|
|
|
{
|
|
|
|
arena_run_t *run = arena_bin_runs_first(bin);
|
|
|
|
if (run != NULL) {
|
|
|
|
arena_bin_runs_remove(bin, run);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
bin->stats.reruns++;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2012-02-14 09:36:52 +08:00
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
static arena_run_t *
|
|
|
|
arena_bin_nonfull_run_get(arena_t *arena, arena_bin_t *bin)
|
|
|
|
{
|
|
|
|
arena_run_t *run;
|
|
|
|
size_t binind;
|
|
|
|
arena_bin_info_t *bin_info;
|
|
|
|
|
|
|
|
/* Look for a usable run. */
|
|
|
|
run = arena_bin_nonfull_run_tryget(bin);
|
|
|
|
if (run != NULL)
|
|
|
|
return (run);
|
2010-01-17 01:53:50 +08:00
|
|
|
/* No existing runs have any space available. */
|
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
binind = arena_bin_index(arena, bin);
|
|
|
|
bin_info = &arena_bin_info[binind];
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/* Allocate a new run. */
|
2010-03-15 10:43:56 +08:00
|
|
|
malloc_mutex_unlock(&bin->lock);
|
2010-03-16 13:25:23 +08:00
|
|
|
/******************************/
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_lock(&arena->lock);
|
2014-01-15 08:23:03 +08:00
|
|
|
run = arena_run_alloc_small(arena, bin_info->run_size, binind);
|
2010-03-15 10:43:56 +08:00
|
|
|
if (run != NULL) {
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
bitmap_t *bitmap = (bitmap_t *)((uintptr_t)run +
|
|
|
|
(uintptr_t)bin_info->bitmap_offset);
|
|
|
|
|
2010-03-15 10:43:56 +08:00
|
|
|
/* Initialize run internals. */
|
|
|
|
run->bin = bin;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
run->nextind = 0;
|
2011-03-16 04:59:15 +08:00
|
|
|
run->nfree = bin_info->nregs;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
bitmap_init(bitmap, &bin_info->bitmap_info);
|
2010-03-16 13:25:23 +08:00
|
|
|
}
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
/********************************/
|
|
|
|
malloc_mutex_lock(&bin->lock);
|
|
|
|
if (run != NULL) {
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
bin->stats.nruns++;
|
|
|
|
bin->stats.curruns++;
|
|
|
|
}
|
2010-03-15 10:43:56 +08:00
|
|
|
return (run);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2014-01-15 08:23:03 +08:00
|
|
|
* arena_run_alloc_small() failed, but another thread may have made
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
* sufficient memory available while this one dropped bin->lock above,
|
2010-03-15 10:43:56 +08:00
|
|
|
* so search one more time.
|
|
|
|
*/
|
2012-02-14 09:36:52 +08:00
|
|
|
run = arena_bin_nonfull_run_tryget(bin);
|
|
|
|
if (run != NULL)
|
2010-03-15 10:43:56 +08:00
|
|
|
return (run);
|
|
|
|
|
|
|
|
return (NULL);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2010-03-14 05:41:58 +08:00
|
|
|
/* Re-fill bin->runcur, then call arena_run_reg_alloc(). */
|
2010-01-17 01:53:50 +08:00
|
|
|
static void *
|
|
|
|
arena_bin_malloc_hard(arena_t *arena, arena_bin_t *bin)
|
|
|
|
{
|
2010-03-15 10:43:56 +08:00
|
|
|
void *ret;
|
2011-03-16 04:59:15 +08:00
|
|
|
size_t binind;
|
|
|
|
arena_bin_info_t *bin_info;
|
2010-03-15 10:43:56 +08:00
|
|
|
arena_run_t *run;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
binind = arena_bin_index(arena, bin);
|
|
|
|
bin_info = &arena_bin_info[binind];
|
2010-03-15 10:43:56 +08:00
|
|
|
bin->runcur = NULL;
|
|
|
|
run = arena_bin_nonfull_run_get(arena, bin);
|
|
|
|
if (bin->runcur != NULL && bin->runcur->nfree > 0) {
|
|
|
|
/*
|
|
|
|
* Another thread updated runcur while this one ran without the
|
|
|
|
* bin lock in arena_bin_nonfull_run_get().
|
|
|
|
*/
|
|
|
|
assert(bin->runcur->nfree > 0);
|
2011-03-16 04:59:15 +08:00
|
|
|
ret = arena_run_reg_alloc(bin->runcur, bin_info);
|
2010-03-15 10:43:56 +08:00
|
|
|
if (run != NULL) {
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
arena_chunk_t *chunk;
|
|
|
|
|
|
|
|
/*
|
2014-01-15 08:23:03 +08:00
|
|
|
* arena_run_alloc_small() may have allocated run, or
|
|
|
|
* it may have pulled run from the bin's run tree.
|
|
|
|
* Therefore it is unsafe to make any assumptions about
|
|
|
|
* how run has previously been used, and
|
|
|
|
* arena_bin_lower_run() must be called, as if a region
|
|
|
|
* were just deallocated from the run.
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
*/
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
2011-03-16 04:59:15 +08:00
|
|
|
if (run->nfree == bin_info->nregs)
|
2010-10-18 11:57:30 +08:00
|
|
|
arena_dalloc_bin_run(arena, chunk, run, bin);
|
|
|
|
else
|
|
|
|
arena_bin_lower_run(arena, chunk, run, bin);
|
2010-03-15 10:43:56 +08:00
|
|
|
}
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (run == NULL)
|
2010-01-17 01:53:50 +08:00
|
|
|
return (NULL);
|
2010-03-15 10:43:56 +08:00
|
|
|
|
|
|
|
bin->runcur = run;
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
assert(bin->runcur->nfree > 0);
|
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
return (arena_run_reg_alloc(bin->runcur, bin_info));
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2012-02-11 12:22:09 +08:00
|
|
|
arena_tcache_fill_small(arena_t *arena, tcache_bin_t *tbin, size_t binind,
|
|
|
|
uint64_t prof_accumbytes)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
unsigned i, nfill;
|
|
|
|
arena_bin_t *bin;
|
|
|
|
arena_run_t *run;
|
|
|
|
void *ptr;
|
|
|
|
|
|
|
|
assert(tbin->ncached == 0);
|
|
|
|
|
2013-02-07 03:59:30 +08:00
|
|
|
if (config_prof && arena_prof_accum(arena, prof_accumbytes))
|
|
|
|
prof_idump();
|
2010-03-16 13:25:23 +08:00
|
|
|
bin = &arena->bins[binind];
|
|
|
|
malloc_mutex_lock(&bin->lock);
|
2011-03-21 15:18:17 +08:00
|
|
|
for (i = 0, nfill = (tcache_bin_info[binind].ncached_max >>
|
|
|
|
tbin->lg_fill_div); i < nfill; i++) {
|
2010-01-17 01:53:50 +08:00
|
|
|
if ((run = bin->runcur) != NULL && run->nfree > 0)
|
2011-03-16 04:59:15 +08:00
|
|
|
ptr = arena_run_reg_alloc(run, &arena_bin_info[binind]);
|
2010-01-17 01:53:50 +08:00
|
|
|
else
|
|
|
|
ptr = arena_bin_malloc_hard(arena, bin);
|
2010-03-08 07:34:14 +08:00
|
|
|
if (ptr == NULL)
|
2010-01-17 01:53:50 +08:00
|
|
|
break;
|
2012-04-06 15:35:09 +08:00
|
|
|
if (config_fill && opt_junk) {
|
|
|
|
arena_alloc_junk_small(ptr, &arena_bin_info[binind],
|
|
|
|
true);
|
|
|
|
}
|
2011-03-19 01:53:15 +08:00
|
|
|
/* Insert such that low regions get used first. */
|
|
|
|
tbin->avail[nfill - 1 - i] = ptr;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
bin->stats.allocated += i * arena_bin_info[binind].reg_size;
|
|
|
|
bin->stats.nmalloc += i;
|
|
|
|
bin->stats.nrequests += tbin->tstats.nrequests;
|
|
|
|
bin->stats.nfills++;
|
|
|
|
tbin->tstats.nrequests = 0;
|
|
|
|
}
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_unlock(&bin->lock);
|
2010-01-17 01:53:50 +08:00
|
|
|
tbin->ncached = i;
|
|
|
|
}
|
|
|
|
|
2012-04-06 15:35:09 +08:00
|
|
|
void
|
|
|
|
arena_alloc_junk_small(void *ptr, arena_bin_info_t *bin_info, bool zero)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (zero) {
|
|
|
|
size_t redzone_size = bin_info->redzone_size;
|
|
|
|
memset((void *)((uintptr_t)ptr - redzone_size), 0xa5,
|
|
|
|
redzone_size);
|
|
|
|
memset((void *)((uintptr_t)ptr + bin_info->reg_size), 0xa5,
|
|
|
|
redzone_size);
|
|
|
|
} else {
|
|
|
|
memset((void *)((uintptr_t)ptr - bin_info->redzone_size), 0xa5,
|
|
|
|
bin_info->reg_interval);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-12-18 07:14:36 +08:00
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_redzone_corruption
|
|
|
|
#define arena_redzone_corruption JEMALLOC_N(arena_redzone_corruption_impl)
|
|
|
|
#endif
|
|
|
|
static void
|
|
|
|
arena_redzone_corruption(void *ptr, size_t usize, bool after,
|
|
|
|
size_t offset, uint8_t byte)
|
|
|
|
{
|
|
|
|
|
|
|
|
malloc_printf("<jemalloc>: Corrupt redzone %zu byte%s %s %p "
|
|
|
|
"(size %zu), byte=%#x\n", offset, (offset == 1) ? "" : "s",
|
|
|
|
after ? "after" : "before", ptr, usize, byte);
|
|
|
|
}
|
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_redzone_corruption
|
2014-01-08 08:47:56 +08:00
|
|
|
#define arena_redzone_corruption JEMALLOC_N(arena_redzone_corruption)
|
|
|
|
arena_redzone_corruption_t *arena_redzone_corruption =
|
|
|
|
JEMALLOC_N(arena_redzone_corruption_impl);
|
2013-12-18 07:14:36 +08:00
|
|
|
#endif
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_redzones_validate(void *ptr, arena_bin_info_t *bin_info, bool reset)
|
2012-04-06 15:35:09 +08:00
|
|
|
{
|
|
|
|
size_t size = bin_info->reg_size;
|
|
|
|
size_t redzone_size = bin_info->redzone_size;
|
|
|
|
size_t i;
|
|
|
|
bool error = false;
|
|
|
|
|
|
|
|
for (i = 1; i <= redzone_size; i++) {
|
2013-12-18 07:14:36 +08:00
|
|
|
uint8_t *byte = (uint8_t *)((uintptr_t)ptr - i);
|
|
|
|
if (*byte != 0xa5) {
|
2012-04-06 15:35:09 +08:00
|
|
|
error = true;
|
2013-12-18 07:14:36 +08:00
|
|
|
arena_redzone_corruption(ptr, size, false, i, *byte);
|
|
|
|
if (reset)
|
|
|
|
*byte = 0xa5;
|
2012-04-06 15:35:09 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
for (i = 0; i < redzone_size; i++) {
|
2013-12-18 07:14:36 +08:00
|
|
|
uint8_t *byte = (uint8_t *)((uintptr_t)ptr + size + i);
|
|
|
|
if (*byte != 0xa5) {
|
2012-04-06 15:35:09 +08:00
|
|
|
error = true;
|
2013-12-18 07:14:36 +08:00
|
|
|
arena_redzone_corruption(ptr, size, true, i, *byte);
|
|
|
|
if (reset)
|
|
|
|
*byte = 0xa5;
|
2012-04-06 15:35:09 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if (opt_abort && error)
|
|
|
|
abort();
|
2013-12-18 07:14:36 +08:00
|
|
|
}
|
|
|
|
|
2014-01-08 08:47:56 +08:00
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_dalloc_junk_small
|
|
|
|
#define arena_dalloc_junk_small JEMALLOC_N(arena_dalloc_junk_small_impl)
|
|
|
|
#endif
|
2013-12-18 07:14:36 +08:00
|
|
|
void
|
|
|
|
arena_dalloc_junk_small(void *ptr, arena_bin_info_t *bin_info)
|
|
|
|
{
|
|
|
|
size_t redzone_size = bin_info->redzone_size;
|
2012-04-06 15:35:09 +08:00
|
|
|
|
2013-12-18 07:14:36 +08:00
|
|
|
arena_redzones_validate(ptr, bin_info, false);
|
2012-04-06 15:35:09 +08:00
|
|
|
memset((void *)((uintptr_t)ptr - redzone_size), 0x5a,
|
|
|
|
bin_info->reg_interval);
|
|
|
|
}
|
2014-01-08 08:47:56 +08:00
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_dalloc_junk_small
|
|
|
|
#define arena_dalloc_junk_small JEMALLOC_N(arena_dalloc_junk_small)
|
|
|
|
arena_dalloc_junk_small_t *arena_dalloc_junk_small =
|
|
|
|
JEMALLOC_N(arena_dalloc_junk_small_impl);
|
|
|
|
#endif
|
2012-04-06 15:35:09 +08:00
|
|
|
|
2013-12-18 07:14:36 +08:00
|
|
|
void
|
|
|
|
arena_quarantine_junk_small(void *ptr, size_t usize)
|
|
|
|
{
|
|
|
|
size_t binind;
|
|
|
|
arena_bin_info_t *bin_info;
|
|
|
|
cassert(config_fill);
|
|
|
|
assert(opt_junk);
|
|
|
|
assert(opt_quarantine);
|
|
|
|
assert(usize <= SMALL_MAXCLASS);
|
|
|
|
|
|
|
|
binind = SMALL_SIZE2BIN(usize);
|
|
|
|
bin_info = &arena_bin_info[binind];
|
|
|
|
arena_redzones_validate(ptr, bin_info, true);
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
void *
|
|
|
|
arena_malloc_small(arena_t *arena, size_t size, bool zero)
|
|
|
|
{
|
|
|
|
void *ret;
|
|
|
|
arena_bin_t *bin;
|
|
|
|
arena_run_t *run;
|
|
|
|
size_t binind;
|
|
|
|
|
2011-03-07 14:56:36 +08:00
|
|
|
binind = SMALL_SIZE2BIN(size);
|
2012-02-29 08:50:47 +08:00
|
|
|
assert(binind < NBINS);
|
2010-01-17 01:53:50 +08:00
|
|
|
bin = &arena->bins[binind];
|
2014-04-17 05:31:24 +08:00
|
|
|
size = small_bin2size[binind];
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_lock(&bin->lock);
|
2010-01-17 01:53:50 +08:00
|
|
|
if ((run = bin->runcur) != NULL && run->nfree > 0)
|
2011-03-16 04:59:15 +08:00
|
|
|
ret = arena_run_reg_alloc(run, &arena_bin_info[binind]);
|
2010-01-17 01:53:50 +08:00
|
|
|
else
|
|
|
|
ret = arena_bin_malloc_hard(arena, bin);
|
|
|
|
|
|
|
|
if (ret == NULL) {
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_unlock(&bin->lock);
|
2010-01-17 01:53:50 +08:00
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
bin->stats.allocated += size;
|
|
|
|
bin->stats.nmalloc++;
|
|
|
|
bin->stats.nrequests++;
|
|
|
|
}
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_unlock(&bin->lock);
|
2013-02-07 03:59:30 +08:00
|
|
|
if (config_prof && isthreaded == false && arena_prof_accum(arena, size))
|
|
|
|
prof_idump();
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
if (zero == false) {
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill) {
|
2012-04-06 15:35:09 +08:00
|
|
|
if (opt_junk) {
|
|
|
|
arena_alloc_junk_small(ret,
|
|
|
|
&arena_bin_info[binind], false);
|
|
|
|
} else if (opt_zero)
|
2012-02-11 12:22:09 +08:00
|
|
|
memset(ret, 0, size);
|
|
|
|
}
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED(ret, size);
|
2012-04-06 15:35:09 +08:00
|
|
|
} else {
|
|
|
|
if (config_fill && opt_junk) {
|
|
|
|
arena_alloc_junk_small(ret, &arena_bin_info[binind],
|
|
|
|
true);
|
|
|
|
}
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED(ret, size);
|
2010-01-17 01:53:50 +08:00
|
|
|
memset(ret, 0, size);
|
2012-04-06 15:35:09 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
void *
|
|
|
|
arena_malloc_large(arena_t *arena, size_t size, bool zero)
|
|
|
|
{
|
|
|
|
void *ret;
|
2013-02-07 03:59:30 +08:00
|
|
|
UNUSED bool idump;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/* Large allocation. */
|
|
|
|
size = PAGE_CEILING(size);
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
2014-01-15 08:23:03 +08:00
|
|
|
ret = (void *)arena_run_alloc_large(arena, size, zero);
|
2010-01-17 01:53:50 +08:00
|
|
|
if (ret == NULL) {
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
return (NULL);
|
|
|
|
}
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
arena->stats.nmalloc_large++;
|
|
|
|
arena->stats.nrequests_large++;
|
|
|
|
arena->stats.allocated_large += size;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nmalloc++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nrequests++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].curruns++;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_prof)
|
2013-02-07 03:59:30 +08:00
|
|
|
idump = arena_prof_accum_locked(arena, size);
|
2010-01-17 01:53:50 +08:00
|
|
|
malloc_mutex_unlock(&arena->lock);
|
2013-02-07 03:59:30 +08:00
|
|
|
if (config_prof && idump)
|
|
|
|
prof_idump();
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
if (zero == false) {
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill) {
|
|
|
|
if (opt_junk)
|
|
|
|
memset(ret, 0xa5, size);
|
|
|
|
else if (opt_zero)
|
|
|
|
memset(ret, 0, size);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Only handles large allocations that require more than page alignment. */
|
|
|
|
void *
|
2012-04-12 09:13:45 +08:00
|
|
|
arena_palloc(arena_t *arena, size_t size, size_t alignment, bool zero)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
void *ret;
|
2012-04-12 09:13:45 +08:00
|
|
|
size_t alloc_size, leadsize, trailsize;
|
|
|
|
arena_run_t *run;
|
2010-01-17 01:53:50 +08:00
|
|
|
arena_chunk_t *chunk;
|
|
|
|
|
|
|
|
assert((size & PAGE_MASK) == 0);
|
2010-10-21 08:39:18 +08:00
|
|
|
|
|
|
|
alignment = PAGE_CEILING(alignment);
|
2012-04-12 09:13:45 +08:00
|
|
|
alloc_size = size + alignment - PAGE;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
2014-01-15 08:23:03 +08:00
|
|
|
run = arena_run_alloc_large(arena, alloc_size, false);
|
2012-04-12 09:13:45 +08:00
|
|
|
if (run == NULL) {
|
2010-01-17 01:53:50 +08:00
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
return (NULL);
|
|
|
|
}
|
2012-04-12 09:13:45 +08:00
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(run);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-04-12 09:13:45 +08:00
|
|
|
leadsize = ALIGNMENT_CEILING((uintptr_t)run, alignment) -
|
|
|
|
(uintptr_t)run;
|
|
|
|
assert(alloc_size >= leadsize + size);
|
|
|
|
trailsize = alloc_size - leadsize - size;
|
|
|
|
ret = (void *)((uintptr_t)run + leadsize);
|
|
|
|
if (leadsize != 0) {
|
|
|
|
arena_run_trim_head(arena, chunk, run, alloc_size, alloc_size -
|
|
|
|
leadsize);
|
|
|
|
}
|
|
|
|
if (trailsize != 0) {
|
|
|
|
arena_run_trim_tail(arena, chunk, ret, size + trailsize, size,
|
|
|
|
false);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_init_large(arena, (arena_run_t *)ret, size, zero);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
arena->stats.nmalloc_large++;
|
|
|
|
arena->stats.nrequests_large++;
|
|
|
|
arena->stats.allocated_large += size;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nmalloc++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nrequests++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].curruns++;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill && zero == false) {
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
if (opt_junk)
|
|
|
|
memset(ret, 0xa5, size);
|
|
|
|
else if (opt_zero)
|
|
|
|
memset(ret, 0, size);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
2010-04-01 07:45:04 +08:00
|
|
|
void
|
|
|
|
arena_prof_promoted(const void *ptr, size_t size)
|
|
|
|
{
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
size_t pageind, binind;
|
|
|
|
|
2012-04-19 04:38:40 +08:00
|
|
|
cassert(config_prof);
|
2010-04-01 07:45:04 +08:00
|
|
|
assert(ptr != NULL);
|
|
|
|
assert(CHUNK_ADDR2BASE(ptr) != ptr);
|
2012-04-06 15:35:09 +08:00
|
|
|
assert(isalloc(ptr, false) == PAGE);
|
|
|
|
assert(isalloc(ptr, true) == PAGE);
|
2012-02-29 08:50:47 +08:00
|
|
|
assert(size <= SMALL_MAXCLASS);
|
2010-04-01 07:45:04 +08:00
|
|
|
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(ptr);
|
2012-04-02 22:04:34 +08:00
|
|
|
pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> LG_PAGE;
|
2011-03-07 14:56:36 +08:00
|
|
|
binind = SMALL_SIZE2BIN(size);
|
2012-02-29 08:50:47 +08:00
|
|
|
assert(binind < NBINS);
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_large_binind_set(chunk, pageind, binind);
|
2010-04-01 07:45:04 +08:00
|
|
|
|
2012-04-06 15:35:09 +08:00
|
|
|
assert(isalloc(ptr, false) == PAGE);
|
|
|
|
assert(isalloc(ptr, true) == size);
|
2010-04-01 07:45:04 +08:00
|
|
|
}
|
2010-02-11 02:37:56 +08:00
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static void
|
2010-10-18 15:04:44 +08:00
|
|
|
arena_dissociate_bin_run(arena_chunk_t *chunk, arena_run_t *run,
|
2010-01-17 01:53:50 +08:00
|
|
|
arena_bin_t *bin)
|
|
|
|
{
|
|
|
|
|
2010-03-19 11:36:40 +08:00
|
|
|
/* Dissociate run from bin. */
|
2010-01-17 01:53:50 +08:00
|
|
|
if (run == bin->runcur)
|
|
|
|
bin->runcur = NULL;
|
2011-03-16 04:59:15 +08:00
|
|
|
else {
|
|
|
|
size_t binind = arena_bin_index(chunk->arena, bin);
|
|
|
|
arena_bin_info_t *bin_info = &arena_bin_info[binind];
|
|
|
|
|
|
|
|
if (bin_info->nregs != 1) {
|
|
|
|
/*
|
|
|
|
* This block's conditional is necessary because if the
|
|
|
|
* run only contains one region, then it never gets
|
|
|
|
* inserted into the non-full runs tree.
|
|
|
|
*/
|
2012-02-14 09:36:52 +08:00
|
|
|
arena_bin_runs_remove(bin, run);
|
2011-03-16 04:59:15 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2010-10-18 15:04:44 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
arena_dalloc_bin_run(arena_t *arena, arena_chunk_t *chunk, arena_run_t *run,
|
|
|
|
arena_bin_t *bin)
|
|
|
|
{
|
2011-03-16 04:59:15 +08:00
|
|
|
size_t binind;
|
|
|
|
arena_bin_info_t *bin_info;
|
2010-10-18 15:04:44 +08:00
|
|
|
size_t npages, run_ind, past;
|
|
|
|
|
|
|
|
assert(run != bin->runcur);
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(arena_run_tree_search(&bin->runs,
|
|
|
|
arena_mapp_get(chunk, ((uintptr_t)run-(uintptr_t)chunk)>>LG_PAGE))
|
|
|
|
== NULL);
|
2010-03-14 12:32:56 +08:00
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
binind = arena_bin_index(chunk->arena, run->bin);
|
|
|
|
bin_info = &arena_bin_info[binind];
|
|
|
|
|
2010-03-15 10:43:56 +08:00
|
|
|
malloc_mutex_unlock(&bin->lock);
|
|
|
|
/******************************/
|
2012-04-02 22:04:34 +08:00
|
|
|
npages = bin_info->run_size >> LG_PAGE;
|
|
|
|
run_ind = (size_t)(((uintptr_t)run - (uintptr_t)chunk) >> LG_PAGE);
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
past = (size_t)(PAGE_CEILING((uintptr_t)run +
|
|
|
|
(uintptr_t)bin_info->reg0_offset + (uintptr_t)(run->nextind *
|
2012-04-06 15:35:09 +08:00
|
|
|
bin_info->reg_interval - bin_info->redzone_size) -
|
|
|
|
(uintptr_t)chunk) >> LG_PAGE);
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_lock(&arena->lock);
|
2010-03-19 11:36:40 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the run was originally clean, and some pages were never touched,
|
|
|
|
* trim the clean pages before deallocating the dirty portion of the
|
|
|
|
* run.
|
|
|
|
*/
|
2012-05-11 08:09:17 +08:00
|
|
|
assert(arena_mapbits_dirty_get(chunk, run_ind) ==
|
|
|
|
arena_mapbits_dirty_get(chunk, run_ind+npages-1));
|
2012-05-02 15:30:36 +08:00
|
|
|
if (arena_mapbits_dirty_get(chunk, run_ind) == 0 && past - run_ind <
|
|
|
|
npages) {
|
2012-05-11 08:09:17 +08:00
|
|
|
/* Trim clean pages. Convert to large run beforehand. */
|
|
|
|
assert(npages > 0);
|
2012-05-11 11:59:39 +08:00
|
|
|
arena_mapbits_large_set(chunk, run_ind, bin_info->run_size, 0);
|
|
|
|
arena_mapbits_large_set(chunk, run_ind+npages-1, 0, 0);
|
2012-04-02 22:04:34 +08:00
|
|
|
arena_run_trim_tail(arena, chunk, run, (npages << LG_PAGE),
|
|
|
|
((past - run_ind) << LG_PAGE), false);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
/* npages = past - run_ind; */
|
2010-03-14 05:41:58 +08:00
|
|
|
}
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_run_dalloc(arena, run, true, false);
|
2010-03-14 12:32:56 +08:00
|
|
|
malloc_mutex_unlock(&arena->lock);
|
2010-03-15 10:43:56 +08:00
|
|
|
/****************************/
|
|
|
|
malloc_mutex_lock(&bin->lock);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
bin->stats.curruns--;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
static void
|
|
|
|
arena_bin_lower_run(arena_t *arena, arena_chunk_t *chunk, arena_run_t *run,
|
|
|
|
arena_bin_t *bin)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
|
2010-10-18 11:57:30 +08:00
|
|
|
/*
|
2012-02-14 09:36:52 +08:00
|
|
|
* Make sure that if bin->runcur is non-NULL, it refers to the lowest
|
|
|
|
* non-full run. It is okay to NULL runcur out rather than proactively
|
|
|
|
* keeping it pointing at the lowest non-full run.
|
2010-10-18 11:57:30 +08:00
|
|
|
*/
|
2012-02-14 09:36:52 +08:00
|
|
|
if ((uintptr_t)run < (uintptr_t)bin->runcur) {
|
2010-10-18 11:57:30 +08:00
|
|
|
/* Switch runcur. */
|
2012-02-14 09:36:52 +08:00
|
|
|
if (bin->runcur->nfree > 0)
|
|
|
|
arena_bin_runs_insert(bin, bin->runcur);
|
2010-10-18 11:57:30 +08:00
|
|
|
bin->runcur = run;
|
2012-02-14 09:36:52 +08:00
|
|
|
if (config_stats)
|
|
|
|
bin->stats.reruns++;
|
|
|
|
} else
|
|
|
|
arena_bin_runs_insert(bin, run);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_dalloc_bin_locked(arena_t *arena, arena_chunk_t *chunk, void *ptr,
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
arena_chunk_map_t *mapelm)
|
|
|
|
{
|
|
|
|
size_t pageind;
|
|
|
|
arena_run_t *run;
|
|
|
|
arena_bin_t *bin;
|
2012-04-25 05:22:02 +08:00
|
|
|
arena_bin_info_t *bin_info;
|
|
|
|
size_t size, binind;
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
|
2012-04-02 22:04:34 +08:00
|
|
|
pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> LG_PAGE;
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (uintptr_t)((pageind -
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_small_runind_get(chunk, pageind)) << LG_PAGE));
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
bin = run->bin;
|
2014-04-07 04:24:16 +08:00
|
|
|
binind = arena_ptr_small_binind_get(ptr, arena_mapbits_get(chunk, pageind));
|
2012-04-25 05:22:02 +08:00
|
|
|
bin_info = &arena_bin_info[binind];
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill || config_stats)
|
|
|
|
size = bin_info->reg_size;
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill && opt_junk)
|
2012-04-06 15:35:09 +08:00
|
|
|
arena_dalloc_junk_small(ptr, bin_info);
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
|
|
|
|
arena_run_reg_dalloc(run, ptr);
|
2011-03-16 04:59:15 +08:00
|
|
|
if (run->nfree == bin_info->nregs) {
|
2010-10-18 15:04:44 +08:00
|
|
|
arena_dissociate_bin_run(chunk, run, bin);
|
2010-10-18 11:57:30 +08:00
|
|
|
arena_dalloc_bin_run(arena, chunk, run, bin);
|
2010-10-18 15:04:44 +08:00
|
|
|
} else if (run->nfree == 1 && run != bin->runcur)
|
2010-10-18 11:57:30 +08:00
|
|
|
arena_bin_lower_run(arena, chunk, run, bin);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
bin->stats.allocated -= size;
|
|
|
|
bin->stats.ndalloc++;
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
void
|
|
|
|
arena_dalloc_bin(arena_t *arena, arena_chunk_t *chunk, void *ptr,
|
|
|
|
size_t pageind, arena_chunk_map_t *mapelm)
|
|
|
|
{
|
|
|
|
arena_run_t *run;
|
|
|
|
arena_bin_t *bin;
|
|
|
|
|
|
|
|
run = (arena_run_t *)((uintptr_t)chunk + (uintptr_t)((pageind -
|
|
|
|
arena_mapbits_small_runind_get(chunk, pageind)) << LG_PAGE));
|
|
|
|
bin = run->bin;
|
|
|
|
malloc_mutex_lock(&bin->lock);
|
|
|
|
arena_dalloc_bin_locked(arena, chunk, ptr, mapelm);
|
|
|
|
malloc_mutex_unlock(&bin->lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
arena_dalloc_small(arena_t *arena, arena_chunk_t *chunk, void *ptr,
|
|
|
|
size_t pageind)
|
|
|
|
{
|
|
|
|
arena_chunk_map_t *mapelm;
|
|
|
|
|
|
|
|
if (config_debug) {
|
2012-05-03 07:11:03 +08:00
|
|
|
/* arena_ptr_small_binind_get() does extra sanity checking. */
|
|
|
|
assert(arena_ptr_small_binind_get(ptr, arena_mapbits_get(chunk,
|
|
|
|
pageind)) != BININD_INVALID);
|
2012-05-02 15:30:36 +08:00
|
|
|
}
|
|
|
|
mapelm = arena_mapp_get(chunk, pageind);
|
|
|
|
arena_dalloc_bin(arena, chunk, ptr, pageind, mapelm);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-01-08 08:47:56 +08:00
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_dalloc_junk_large
|
|
|
|
#define arena_dalloc_junk_large JEMALLOC_N(arena_dalloc_junk_large_impl)
|
|
|
|
#endif
|
|
|
|
static void
|
|
|
|
arena_dalloc_junk_large(void *ptr, size_t usize)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (config_fill && opt_junk)
|
|
|
|
memset(ptr, 0x5a, usize);
|
|
|
|
}
|
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_dalloc_junk_large
|
|
|
|
#define arena_dalloc_junk_large JEMALLOC_N(arena_dalloc_junk_large)
|
|
|
|
arena_dalloc_junk_large_t *arena_dalloc_junk_large =
|
|
|
|
JEMALLOC_N(arena_dalloc_junk_large_impl);
|
|
|
|
#endif
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
void
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_dalloc_large_locked(arena_t *arena, arena_chunk_t *chunk, void *ptr)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
2010-01-31 19:57:29 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_fill || config_stats) {
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> LG_PAGE;
|
2014-01-08 08:47:56 +08:00
|
|
|
size_t usize = arena_mapbits_large_size_get(chunk, pageind);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2014-01-08 08:47:56 +08:00
|
|
|
arena_dalloc_junk_large(ptr, usize);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
arena->stats.ndalloc_large++;
|
2014-01-08 08:47:56 +08:00
|
|
|
arena->stats.allocated_large -= usize;
|
|
|
|
arena->stats.lstats[(usize >> LG_PAGE) - 1].ndalloc++;
|
|
|
|
arena->stats.lstats[(usize >> LG_PAGE) - 1].curruns--;
|
2012-02-11 12:22:09 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_run_dalloc(arena, (arena_run_t *)ptr, true, false);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
void
|
|
|
|
arena_dalloc_large(arena_t *arena, arena_chunk_t *chunk, void *ptr)
|
|
|
|
{
|
|
|
|
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
arena_dalloc_large_locked(arena, chunk, ptr);
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
static void
|
|
|
|
arena_ralloc_large_shrink(arena_t *arena, arena_chunk_t *chunk, void *ptr,
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
size_t oldsize, size_t size)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
|
|
|
|
assert(size < oldsize);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Shrink the run, and make trailing pages available for other
|
|
|
|
* allocations.
|
|
|
|
*/
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
arena_run_trim_tail(arena, chunk, (arena_run_t *)ptr, oldsize, size,
|
|
|
|
true);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
arena->stats.ndalloc_large++;
|
|
|
|
arena->stats.allocated_large -= oldsize;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(oldsize >> LG_PAGE) - 1].ndalloc++;
|
|
|
|
arena->stats.lstats[(oldsize >> LG_PAGE) - 1].curruns--;
|
2012-02-11 12:22:09 +08:00
|
|
|
|
|
|
|
arena->stats.nmalloc_large++;
|
|
|
|
arena->stats.nrequests_large++;
|
|
|
|
arena->stats.allocated_large += size;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nmalloc++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nrequests++;
|
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].curruns++;
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
static bool
|
|
|
|
arena_ralloc_large_grow(arena_t *arena, arena_chunk_t *chunk, void *ptr,
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
size_t oldsize, size_t size, size_t extra, bool zero)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> LG_PAGE;
|
|
|
|
size_t npages = oldsize >> LG_PAGE;
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
size_t followsize;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-05-02 15:30:36 +08:00
|
|
|
assert(oldsize == arena_mapbits_large_size_get(chunk, pageind));
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/* Try to extend the run. */
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
assert(size + extra > oldsize);
|
2010-01-17 01:53:50 +08:00
|
|
|
malloc_mutex_lock(&arena->lock);
|
2010-10-02 08:35:43 +08:00
|
|
|
if (pageind + npages < chunk_npages &&
|
2012-05-02 15:30:36 +08:00
|
|
|
arena_mapbits_allocated_get(chunk, pageind+npages) == 0 &&
|
|
|
|
(followsize = arena_mapbits_unallocated_size_get(chunk,
|
|
|
|
pageind+npages)) >= size - oldsize) {
|
2010-01-17 01:53:50 +08:00
|
|
|
/*
|
|
|
|
* The next run is available and sufficiently large. Split the
|
|
|
|
* following run, then merge the first part with the existing
|
|
|
|
* allocation.
|
|
|
|
*/
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
size_t flag_dirty;
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
size_t splitsize = (oldsize + followsize <= size + extra)
|
|
|
|
? followsize : size + extra - oldsize;
|
2014-01-15 08:23:03 +08:00
|
|
|
arena_run_split_large(arena, (arena_run_t *)((uintptr_t)chunk +
|
|
|
|
((pageind+npages) << LG_PAGE)), splitsize, zero);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2010-10-18 15:04:44 +08:00
|
|
|
size = oldsize + splitsize;
|
2012-04-02 22:04:34 +08:00
|
|
|
npages = size >> LG_PAGE;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
/*
|
|
|
|
* Mark the extended run as dirty if either portion of the run
|
|
|
|
* was dirty before allocation. This is rather pedantic,
|
|
|
|
* because there's not actually any sequence of events that
|
|
|
|
* could cause the resulting run to be passed to
|
|
|
|
* arena_run_dalloc() with the dirty argument set to false
|
|
|
|
* (which is when dirty flag consistency would really matter).
|
|
|
|
*/
|
2012-05-02 15:30:36 +08:00
|
|
|
flag_dirty = arena_mapbits_dirty_get(chunk, pageind) |
|
|
|
|
arena_mapbits_dirty_get(chunk, pageind+npages-1);
|
|
|
|
arena_mapbits_large_set(chunk, pageind, size, flag_dirty);
|
|
|
|
arena_mapbits_large_set(chunk, pageind+npages-1, 0, flag_dirty);
|
2010-01-31 19:49:35 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
arena->stats.ndalloc_large++;
|
|
|
|
arena->stats.allocated_large -= oldsize;
|
2012-05-02 15:30:36 +08:00
|
|
|
arena->stats.lstats[(oldsize >> LG_PAGE) - 1].ndalloc++;
|
|
|
|
arena->stats.lstats[(oldsize >> LG_PAGE) - 1].curruns--;
|
2012-02-11 12:22:09 +08:00
|
|
|
|
|
|
|
arena->stats.nmalloc_large++;
|
|
|
|
arena->stats.nrequests_large++;
|
|
|
|
arena->stats.allocated_large += size;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nmalloc++;
|
2012-05-02 15:30:36 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].nrequests++;
|
2012-04-02 22:04:34 +08:00
|
|
|
arena->stats.lstats[(size >> LG_PAGE) - 1].curruns++;
|
Fix numerous arena bugs.
In arena_ralloc_large_grow(), update the map element for the end of the
newly grown run, rather than the interior map element that was the
beginning of the appended run. This is a long-standing bug, and it had
the potential to cause massive corruption, but triggering it required
roughly the following sequence of events:
1) Large in-place growing realloc(), with left-over space in the run
that followed the large object.
2) Allocation of the remainder run left over from (1).
3) Deallocation of the remainder run *before* deallocation of the
large run, with unfortunate interior map state left over from
previous run allocation/deallocation activity, such that one or
more pages of allocated memory would be treated as part of the
remainder run during run coalescing.
In summary, this was a bad bug, but it was difficult to trigger.
In arena_bin_malloc_hard(), if another thread wins the race to allocate
a bin run, dispose of the spare run via arena_bin_lower_run() rather
than arena_run_dalloc(), since the run has already been prepared for use
as a bin run. This bug has existed since March 14, 2010:
e00572b384c81bd2aba57fac32f7077a34388915
mmap()/munmap() without arena->lock or bin->lock.
Fix bugs in arena_dalloc_bin_run(), arena_trim_head(),
arena_trim_tail(), and arena_ralloc_large_grow() that could cause the
CHUNK_MAP_UNZEROED map bit to become corrupted. These are all
long-standing bugs, but the chances of them actually causing problems
was much lower before the CHUNK_MAP_ZEROED --> CHUNK_MAP_UNZEROED
conversion.
Fix a large run statistics regression in arena_ralloc_large_grow() that
was introduced on September 17, 2010:
8e3c3c61b5bb676a705450708e7e79698cdc9e0c
Add {,r,s,d}allocm().
Add debug code to validate that supposedly pre-zeroed memory really is.
2010-10-18 08:51:37 +08:00
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
return (false);
|
|
|
|
}
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
|
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
2014-01-08 08:47:56 +08:00
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_ralloc_junk_large
|
|
|
|
#define arena_ralloc_junk_large JEMALLOC_N(arena_ralloc_junk_large_impl)
|
|
|
|
#endif
|
|
|
|
static void
|
|
|
|
arena_ralloc_junk_large(void *ptr, size_t old_usize, size_t usize)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (config_fill && opt_junk) {
|
|
|
|
memset((void *)((uintptr_t)ptr + usize), 0x5a,
|
|
|
|
old_usize - usize);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#ifdef JEMALLOC_JET
|
|
|
|
#undef arena_ralloc_junk_large
|
|
|
|
#define arena_ralloc_junk_large JEMALLOC_N(arena_ralloc_junk_large)
|
|
|
|
arena_ralloc_junk_large_t *arena_ralloc_junk_large =
|
|
|
|
JEMALLOC_N(arena_ralloc_junk_large_impl);
|
|
|
|
#endif
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/*
|
|
|
|
* Try to resize a large allocation, in order to avoid copying. This will
|
|
|
|
* always fail if growing an object, and the following run is already in use.
|
|
|
|
*/
|
|
|
|
static bool
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
arena_ralloc_large(void *ptr, size_t oldsize, size_t size, size_t extra,
|
|
|
|
bool zero)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
size_t psize;
|
|
|
|
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
psize = PAGE_CEILING(size + extra);
|
2010-01-17 01:53:50 +08:00
|
|
|
if (psize == oldsize) {
|
|
|
|
/* Same size class. */
|
|
|
|
return (false);
|
|
|
|
} else {
|
|
|
|
arena_chunk_t *chunk;
|
|
|
|
arena_t *arena;
|
|
|
|
|
|
|
|
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(ptr);
|
|
|
|
arena = chunk->arena;
|
|
|
|
|
|
|
|
if (psize < oldsize) {
|
|
|
|
/* Fill before shrinking in order avoid a race. */
|
2014-01-08 08:47:56 +08:00
|
|
|
arena_ralloc_junk_large(ptr, oldsize, psize);
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
arena_ralloc_large_shrink(arena, chunk, ptr, oldsize,
|
|
|
|
psize);
|
2010-01-17 01:53:50 +08:00
|
|
|
return (false);
|
|
|
|
} else {
|
|
|
|
bool ret = arena_ralloc_large_grow(arena, chunk, ptr,
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
oldsize, PAGE_CEILING(size),
|
|
|
|
psize - PAGE_CEILING(size), zero);
|
2014-01-08 08:47:56 +08:00
|
|
|
if (config_fill && ret == false && zero == false) {
|
|
|
|
if (opt_junk) {
|
|
|
|
memset((void *)((uintptr_t)ptr +
|
|
|
|
oldsize), 0xa5, isalloc(ptr,
|
|
|
|
config_prof) - oldsize);
|
|
|
|
} else if (opt_zero) {
|
|
|
|
memset((void *)((uintptr_t)ptr +
|
|
|
|
oldsize), 0, isalloc(ptr,
|
|
|
|
config_prof) - oldsize);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-01-13 07:05:44 +08:00
|
|
|
bool
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
arena_ralloc_no_move(void *ptr, size_t oldsize, size_t size, size_t extra,
|
|
|
|
bool zero)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
|
|
|
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
/*
|
|
|
|
* Avoid moving the allocation if the size class can be left the same.
|
|
|
|
*/
|
2010-01-17 01:53:50 +08:00
|
|
|
if (oldsize <= arena_maxclass) {
|
2012-02-29 08:50:47 +08:00
|
|
|
if (oldsize <= SMALL_MAXCLASS) {
|
2011-03-16 04:59:15 +08:00
|
|
|
assert(arena_bin_info[SMALL_SIZE2BIN(oldsize)].reg_size
|
|
|
|
== oldsize);
|
2012-02-29 08:50:47 +08:00
|
|
|
if ((size + extra <= SMALL_MAXCLASS &&
|
2011-03-07 14:56:36 +08:00
|
|
|
SMALL_SIZE2BIN(size + extra) ==
|
|
|
|
SMALL_SIZE2BIN(oldsize)) || (size <= oldsize &&
|
2013-12-16 13:49:40 +08:00
|
|
|
size + extra >= oldsize))
|
2014-01-13 07:05:44 +08:00
|
|
|
return (false);
|
2010-01-17 01:53:50 +08:00
|
|
|
} else {
|
|
|
|
assert(size <= arena_maxclass);
|
2012-02-29 08:50:47 +08:00
|
|
|
if (size + extra > SMALL_MAXCLASS) {
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
if (arena_ralloc_large(ptr, oldsize, size,
|
|
|
|
extra, zero) == false)
|
2014-01-13 07:05:44 +08:00
|
|
|
return (false);
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
/* Reallocation would require a move. */
|
2014-01-13 07:05:44 +08:00
|
|
|
return (true);
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void *
|
2012-10-12 04:53:15 +08:00
|
|
|
arena_ralloc(arena_t *arena, void *ptr, size_t oldsize, size_t size,
|
|
|
|
size_t extra, size_t alignment, bool zero, bool try_tcache_alloc,
|
|
|
|
bool try_tcache_dalloc)
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
{
|
|
|
|
void *ret;
|
|
|
|
size_t copysize;
|
|
|
|
|
|
|
|
/* Try to avoid moving the allocation. */
|
2014-01-13 07:05:44 +08:00
|
|
|
if (arena_ralloc_no_move(ptr, oldsize, size, extra, zero) == false)
|
|
|
|
return (ptr);
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/*
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
* size and oldsize are different enough that we need to move the
|
|
|
|
* object. In that case, fall back to allocating new space and
|
|
|
|
* copying.
|
2010-01-17 01:53:50 +08:00
|
|
|
*/
|
2011-03-23 15:37:29 +08:00
|
|
|
if (alignment != 0) {
|
2012-04-12 09:13:45 +08:00
|
|
|
size_t usize = sa2u(size + extra, alignment);
|
2011-03-23 15:37:29 +08:00
|
|
|
if (usize == 0)
|
|
|
|
return (NULL);
|
Implement the *allocx() API.
Implement the *allocx() API, which is a successor to the *allocm() API.
The *allocx() functions are slightly simpler to use because they have
fewer parameters, they directly return the results of primary interest,
and mallocx()/rallocx() avoid the strict aliasing pitfall that
allocm()/rallocx() share with posix_memalign(). The following code
violates strict aliasing rules:
foo_t *foo;
allocm((void **)&foo, NULL, 42, 0);
whereas the following is safe:
foo_t *foo;
void *p;
allocm(&p, NULL, 42, 0);
foo = (foo_t *)p;
mallocx() does not have this problem:
foo_t *foo = (foo_t *)mallocx(42, 0);
2013-12-13 14:35:52 +08:00
|
|
|
ret = ipalloct(usize, alignment, zero, try_tcache_alloc, arena);
|
2011-03-23 15:37:29 +08:00
|
|
|
} else
|
2012-10-12 04:53:15 +08:00
|
|
|
ret = arena_malloc(arena, size + extra, zero, try_tcache_alloc);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
if (ret == NULL) {
|
|
|
|
if (extra == 0)
|
|
|
|
return (NULL);
|
|
|
|
/* Try again, this time without extra. */
|
2011-03-23 15:37:29 +08:00
|
|
|
if (alignment != 0) {
|
2012-04-12 09:13:45 +08:00
|
|
|
size_t usize = sa2u(size, alignment);
|
2011-03-23 15:37:29 +08:00
|
|
|
if (usize == 0)
|
|
|
|
return (NULL);
|
Implement the *allocx() API.
Implement the *allocx() API, which is a successor to the *allocm() API.
The *allocx() functions are slightly simpler to use because they have
fewer parameters, they directly return the results of primary interest,
and mallocx()/rallocx() avoid the strict aliasing pitfall that
allocm()/rallocx() share with posix_memalign(). The following code
violates strict aliasing rules:
foo_t *foo;
allocm((void **)&foo, NULL, 42, 0);
whereas the following is safe:
foo_t *foo;
void *p;
allocm(&p, NULL, 42, 0);
foo = (foo_t *)p;
mallocx() does not have this problem:
foo_t *foo = (foo_t *)mallocx(42, 0);
2013-12-13 14:35:52 +08:00
|
|
|
ret = ipalloct(usize, alignment, zero, try_tcache_alloc,
|
2012-10-12 04:53:15 +08:00
|
|
|
arena);
|
2011-03-23 15:37:29 +08:00
|
|
|
} else
|
2012-10-12 04:53:15 +08:00
|
|
|
ret = arena_malloc(arena, size, zero, try_tcache_alloc);
|
Add {,r,s,d}allocm().
Add allocm(), rallocm(), sallocm(), and dallocm(), which are a
functional superset of malloc(), calloc(), posix_memalign(),
malloc_usable_size(), and free().
2010-09-18 06:46:18 +08:00
|
|
|
|
|
|
|
if (ret == NULL)
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Junk/zero-filling were already done by ipalloc()/arena_malloc(). */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Copy at most size bytes (not size+extra), since the caller has no
|
|
|
|
* expectation that the extra bytes will be reliably preserved.
|
|
|
|
*/
|
2010-01-17 01:53:50 +08:00
|
|
|
copysize = (size < oldsize) ? size : oldsize;
|
2014-04-16 07:35:08 +08:00
|
|
|
JEMALLOC_VALGRIND_MAKE_MEM_UNDEFINED(ret, copysize);
|
2010-01-17 01:53:50 +08:00
|
|
|
memcpy(ret, ptr, copysize);
|
Implement the *allocx() API.
Implement the *allocx() API, which is a successor to the *allocm() API.
The *allocx() functions are slightly simpler to use because they have
fewer parameters, they directly return the results of primary interest,
and mallocx()/rallocx() avoid the strict aliasing pitfall that
allocm()/rallocx() share with posix_memalign(). The following code
violates strict aliasing rules:
foo_t *foo;
allocm((void **)&foo, NULL, 42, 0);
whereas the following is safe:
foo_t *foo;
void *p;
allocm(&p, NULL, 42, 0);
foo = (foo_t *)p;
mallocx() does not have this problem:
foo_t *foo = (foo_t *)mallocx(42, 0);
2013-12-13 14:35:52 +08:00
|
|
|
iqalloct(ptr, try_tcache_dalloc);
|
2010-01-17 01:53:50 +08:00
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
2012-10-12 04:53:15 +08:00
|
|
|
dss_prec_t
|
|
|
|
arena_dss_prec_get(arena_t *arena)
|
|
|
|
{
|
|
|
|
dss_prec_t ret;
|
|
|
|
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
ret = arena->dss_prec;
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
return (ret);
|
|
|
|
}
|
|
|
|
|
2014-04-16 03:09:48 +08:00
|
|
|
bool
|
2012-10-12 04:53:15 +08:00
|
|
|
arena_dss_prec_set(arena_t *arena, dss_prec_t dss_prec)
|
|
|
|
{
|
|
|
|
|
2014-04-16 03:09:48 +08:00
|
|
|
if (have_dss == false)
|
|
|
|
return (dss_prec != dss_prec_disabled);
|
2012-10-12 04:53:15 +08:00
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
arena->dss_prec = dss_prec;
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
2014-04-16 03:09:48 +08:00
|
|
|
return (false);
|
2012-10-12 04:53:15 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
arena_stats_merge(arena_t *arena, const char **dss, size_t *nactive,
|
|
|
|
size_t *ndirty, arena_stats_t *astats, malloc_bin_stats_t *bstats,
|
|
|
|
malloc_large_stats_t *lstats)
|
|
|
|
{
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
malloc_mutex_lock(&arena->lock);
|
|
|
|
*dss = dss_prec_names[arena->dss_prec];
|
|
|
|
*nactive += arena->nactive;
|
|
|
|
*ndirty += arena->ndirty;
|
|
|
|
|
|
|
|
astats->mapped += arena->stats.mapped;
|
|
|
|
astats->npurge += arena->stats.npurge;
|
|
|
|
astats->nmadvise += arena->stats.nmadvise;
|
|
|
|
astats->purged += arena->stats.purged;
|
|
|
|
astats->allocated_large += arena->stats.allocated_large;
|
|
|
|
astats->nmalloc_large += arena->stats.nmalloc_large;
|
|
|
|
astats->ndalloc_large += arena->stats.ndalloc_large;
|
|
|
|
astats->nrequests_large += arena->stats.nrequests_large;
|
|
|
|
|
|
|
|
for (i = 0; i < nlclasses; i++) {
|
|
|
|
lstats[i].nmalloc += arena->stats.lstats[i].nmalloc;
|
|
|
|
lstats[i].ndalloc += arena->stats.lstats[i].ndalloc;
|
|
|
|
lstats[i].nrequests += arena->stats.lstats[i].nrequests;
|
|
|
|
lstats[i].curruns += arena->stats.lstats[i].curruns;
|
|
|
|
}
|
|
|
|
malloc_mutex_unlock(&arena->lock);
|
|
|
|
|
|
|
|
for (i = 0; i < NBINS; i++) {
|
|
|
|
arena_bin_t *bin = &arena->bins[i];
|
|
|
|
|
|
|
|
malloc_mutex_lock(&bin->lock);
|
|
|
|
bstats[i].allocated += bin->stats.allocated;
|
|
|
|
bstats[i].nmalloc += bin->stats.nmalloc;
|
|
|
|
bstats[i].ndalloc += bin->stats.ndalloc;
|
|
|
|
bstats[i].nrequests += bin->stats.nrequests;
|
|
|
|
if (config_tcache) {
|
|
|
|
bstats[i].nfills += bin->stats.nfills;
|
|
|
|
bstats[i].nflushes += bin->stats.nflushes;
|
|
|
|
}
|
|
|
|
bstats[i].nruns += bin->stats.nruns;
|
|
|
|
bstats[i].reruns += bin->stats.reruns;
|
|
|
|
bstats[i].curruns += bin->stats.curruns;
|
|
|
|
malloc_mutex_unlock(&bin->lock);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
bool
|
|
|
|
arena_new(arena_t *arena, unsigned ind)
|
|
|
|
{
|
|
|
|
unsigned i;
|
|
|
|
arena_bin_t *bin;
|
|
|
|
|
2010-02-11 02:37:56 +08:00
|
|
|
arena->ind = ind;
|
2011-03-19 04:41:33 +08:00
|
|
|
arena->nthreads = 0;
|
2010-02-11 02:37:56 +08:00
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
if (malloc_mutex_init(&arena->lock))
|
|
|
|
return (true);
|
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats) {
|
|
|
|
memset(&arena->stats, 0, sizeof(arena_stats_t));
|
|
|
|
arena->stats.lstats =
|
|
|
|
(malloc_large_stats_t *)base_alloc(nlclasses *
|
|
|
|
sizeof(malloc_large_stats_t));
|
|
|
|
if (arena->stats.lstats == NULL)
|
|
|
|
return (true);
|
|
|
|
memset(arena->stats.lstats, 0, nlclasses *
|
|
|
|
sizeof(malloc_large_stats_t));
|
|
|
|
if (config_tcache)
|
|
|
|
ql_new(&arena->tcache_ql);
|
|
|
|
}
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_prof)
|
|
|
|
arena->prof_accumbytes = 0;
|
2010-02-12 05:19:21 +08:00
|
|
|
|
2012-10-12 04:53:15 +08:00
|
|
|
arena->dss_prec = chunk_dss_prec_get();
|
|
|
|
|
2010-01-17 01:53:50 +08:00
|
|
|
/* Initialize chunks. */
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_chunk_dirty_new(&arena->chunks_dirty);
|
2010-01-17 01:53:50 +08:00
|
|
|
arena->spare = NULL;
|
|
|
|
|
|
|
|
arena->nactive = 0;
|
|
|
|
arena->ndirty = 0;
|
2010-04-09 11:31:58 +08:00
|
|
|
arena->npurgatory = 0;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
2012-10-31 06:42:37 +08:00
|
|
|
arena_avail_tree_new(&arena->runs_avail);
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/* Initialize bins. */
|
2012-02-29 08:50:47 +08:00
|
|
|
for (i = 0; i < NBINS; i++) {
|
2010-01-17 01:53:50 +08:00
|
|
|
bin = &arena->bins[i];
|
2010-03-14 12:32:56 +08:00
|
|
|
if (malloc_mutex_init(&bin->lock))
|
|
|
|
return (true);
|
2010-01-17 01:53:50 +08:00
|
|
|
bin->runcur = NULL;
|
|
|
|
arena_run_tree_new(&bin->runs);
|
2012-02-11 12:22:09 +08:00
|
|
|
if (config_stats)
|
|
|
|
memset(&bin->stats, 0, sizeof(malloc_bin_stats_t));
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
return (false);
|
|
|
|
}
|
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
/*
|
|
|
|
* Calculate bin_info->run_size such that it meets the following constraints:
|
|
|
|
*
|
|
|
|
* *) bin_info->run_size >= min_run_size
|
|
|
|
* *) bin_info->run_size <= arena_maxclass
|
|
|
|
* *) run header overhead <= RUN_MAX_OVRHD (or header overhead relaxed).
|
2011-03-23 00:00:56 +08:00
|
|
|
* *) bin_info->nregs <= RUN_MAXREGS
|
2011-03-16 04:59:15 +08:00
|
|
|
*
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
* bin_info->nregs, bin_info->bitmap_offset, and bin_info->reg0_offset are also
|
|
|
|
* calculated here, since these settings are all interdependent.
|
2011-03-16 04:59:15 +08:00
|
|
|
*/
|
|
|
|
static size_t
|
|
|
|
bin_info_run_size_calc(arena_bin_info_t *bin_info, size_t min_run_size)
|
|
|
|
{
|
2012-04-06 15:35:09 +08:00
|
|
|
size_t pad_size;
|
2011-03-16 04:59:15 +08:00
|
|
|
size_t try_run_size, good_run_size;
|
|
|
|
uint32_t try_nregs, good_nregs;
|
|
|
|
uint32_t try_hdr_size, good_hdr_size;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
uint32_t try_bitmap_offset, good_bitmap_offset;
|
2012-04-06 15:35:09 +08:00
|
|
|
uint32_t try_redzone0_offset, good_redzone0_offset;
|
2011-03-16 04:59:15 +08:00
|
|
|
|
2012-04-02 22:04:34 +08:00
|
|
|
assert(min_run_size >= PAGE);
|
2011-03-16 04:59:15 +08:00
|
|
|
assert(min_run_size <= arena_maxclass);
|
|
|
|
|
2012-04-06 15:35:09 +08:00
|
|
|
/*
|
|
|
|
* Determine redzone size based on minimum alignment and minimum
|
|
|
|
* redzone size. Add padding to the end of the run if it is needed to
|
|
|
|
* align the regions. The padding allows each redzone to be half the
|
|
|
|
* minimum alignment; without the padding, each redzone would have to
|
|
|
|
* be twice as large in order to maintain alignment.
|
|
|
|
*/
|
|
|
|
if (config_fill && opt_redzone) {
|
|
|
|
size_t align_min = ZU(1) << (ffs(bin_info->reg_size) - 1);
|
|
|
|
if (align_min <= REDZONE_MINSIZE) {
|
|
|
|
bin_info->redzone_size = REDZONE_MINSIZE;
|
|
|
|
pad_size = 0;
|
|
|
|
} else {
|
|
|
|
bin_info->redzone_size = align_min >> 1;
|
|
|
|
pad_size = bin_info->redzone_size;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
bin_info->redzone_size = 0;
|
|
|
|
pad_size = 0;
|
|
|
|
}
|
|
|
|
bin_info->reg_interval = bin_info->reg_size +
|
|
|
|
(bin_info->redzone_size << 1);
|
|
|
|
|
2011-03-16 04:59:15 +08:00
|
|
|
/*
|
|
|
|
* Calculate known-valid settings before entering the run_size
|
|
|
|
* expansion loop, so that the first part of the loop always copies
|
|
|
|
* valid settings.
|
|
|
|
*
|
|
|
|
* The do..while loop iteratively reduces the number of regions until
|
|
|
|
* the run header and the regions no longer overlap. A closed formula
|
|
|
|
* would be quite messy, since there is an interdependency between the
|
|
|
|
* header's mask length and the number of regions.
|
|
|
|
*/
|
|
|
|
try_run_size = min_run_size;
|
2012-04-06 15:35:09 +08:00
|
|
|
try_nregs = ((try_run_size - sizeof(arena_run_t)) /
|
|
|
|
bin_info->reg_interval)
|
2011-03-16 04:59:15 +08:00
|
|
|
+ 1; /* Counter-act try_nregs-- in loop. */
|
2011-03-23 00:00:56 +08:00
|
|
|
if (try_nregs > RUN_MAXREGS) {
|
|
|
|
try_nregs = RUN_MAXREGS
|
|
|
|
+ 1; /* Counter-act try_nregs-- in loop. */
|
|
|
|
}
|
2011-03-16 04:59:15 +08:00
|
|
|
do {
|
|
|
|
try_nregs--;
|
|
|
|
try_hdr_size = sizeof(arena_run_t);
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
/* Pad to a long boundary. */
|
|
|
|
try_hdr_size = LONG_CEILING(try_hdr_size);
|
|
|
|
try_bitmap_offset = try_hdr_size;
|
|
|
|
/* Add space for bitmap. */
|
|
|
|
try_hdr_size += bitmap_size(try_nregs);
|
2012-04-06 15:35:09 +08:00
|
|
|
try_redzone0_offset = try_run_size - (try_nregs *
|
|
|
|
bin_info->reg_interval) - pad_size;
|
|
|
|
} while (try_hdr_size > try_redzone0_offset);
|
2011-03-16 04:59:15 +08:00
|
|
|
|
|
|
|
/* run_size expansion loop. */
|
|
|
|
do {
|
|
|
|
/*
|
|
|
|
* Copy valid settings before trying more aggressive settings.
|
|
|
|
*/
|
|
|
|
good_run_size = try_run_size;
|
|
|
|
good_nregs = try_nregs;
|
|
|
|
good_hdr_size = try_hdr_size;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
good_bitmap_offset = try_bitmap_offset;
|
2012-04-06 15:35:09 +08:00
|
|
|
good_redzone0_offset = try_redzone0_offset;
|
2011-03-16 04:59:15 +08:00
|
|
|
|
|
|
|
/* Try more aggressive settings. */
|
2012-04-02 22:04:34 +08:00
|
|
|
try_run_size += PAGE;
|
2012-04-06 15:35:09 +08:00
|
|
|
try_nregs = ((try_run_size - sizeof(arena_run_t) - pad_size) /
|
|
|
|
bin_info->reg_interval)
|
2011-03-16 04:59:15 +08:00
|
|
|
+ 1; /* Counter-act try_nregs-- in loop. */
|
2011-03-23 00:00:56 +08:00
|
|
|
if (try_nregs > RUN_MAXREGS) {
|
|
|
|
try_nregs = RUN_MAXREGS
|
|
|
|
+ 1; /* Counter-act try_nregs-- in loop. */
|
|
|
|
}
|
2011-03-16 04:59:15 +08:00
|
|
|
do {
|
|
|
|
try_nregs--;
|
|
|
|
try_hdr_size = sizeof(arena_run_t);
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
/* Pad to a long boundary. */
|
|
|
|
try_hdr_size = LONG_CEILING(try_hdr_size);
|
|
|
|
try_bitmap_offset = try_hdr_size;
|
|
|
|
/* Add space for bitmap. */
|
|
|
|
try_hdr_size += bitmap_size(try_nregs);
|
2012-04-06 15:35:09 +08:00
|
|
|
try_redzone0_offset = try_run_size - (try_nregs *
|
|
|
|
bin_info->reg_interval) - pad_size;
|
|
|
|
} while (try_hdr_size > try_redzone0_offset);
|
2011-03-16 04:59:15 +08:00
|
|
|
} while (try_run_size <= arena_maxclass
|
2012-04-06 15:35:09 +08:00
|
|
|
&& RUN_MAX_OVRHD * (bin_info->reg_interval << 3) >
|
|
|
|
RUN_MAX_OVRHD_RELAX
|
|
|
|
&& (try_redzone0_offset << RUN_BFP) > RUN_MAX_OVRHD * try_run_size
|
2011-03-23 00:00:56 +08:00
|
|
|
&& try_nregs < RUN_MAXREGS);
|
2011-03-16 04:59:15 +08:00
|
|
|
|
2012-04-06 15:35:09 +08:00
|
|
|
assert(good_hdr_size <= good_redzone0_offset);
|
2011-03-16 04:59:15 +08:00
|
|
|
|
|
|
|
/* Copy final settings. */
|
|
|
|
bin_info->run_size = good_run_size;
|
|
|
|
bin_info->nregs = good_nregs;
|
Use bitmaps to track small regions.
The previous free list implementation, which embedded singly linked
lists in available regions, had the unfortunate side effect of causing
many cache misses during thread cache fills. Fix this in two places:
- arena_run_t: Use a new bitmap implementation to track which regions
are available. Furthermore, revert to preferring the
lowest available region (as jemalloc did with its old
bitmap-based approach).
- tcache_t: Move read-only tcache_bin_t metadata into
tcache_bin_info_t, and add a contiguous array of pointers
to tcache_t in order to track cached objects. This
substantially increases the size of tcache_t, but results
in much higher data locality for common tcache operations.
As a side benefit, it is again possible to efficiently
flush the least recently used cached objects, so this
change changes flushing from MRU to LRU.
The new bitmap implementation uses a multi-level summary approach to
make finding the lowest available region very fast. In practice,
bitmaps only have one or two levels, though the implementation is
general enough to handle extremely large bitmaps, mainly so that large
page sizes can still be entertained.
Fix tcache_bin_flush_large() to always flush statistics, in the same way
that tcache_bin_flush_small() was recently fixed.
Use JEMALLOC_DEBUG rather than NDEBUG.
Add dassert(), and use it for debug-only asserts.
2011-03-17 01:30:13 +08:00
|
|
|
bin_info->bitmap_offset = good_bitmap_offset;
|
2012-04-06 15:35:09 +08:00
|
|
|
bin_info->reg0_offset = good_redzone0_offset + bin_info->redzone_size;
|
|
|
|
|
|
|
|
assert(bin_info->reg0_offset - bin_info->redzone_size + (bin_info->nregs
|
|
|
|
* bin_info->reg_interval) + pad_size == bin_info->run_size);
|
2011-03-16 04:59:15 +08:00
|
|
|
|
|
|
|
return (good_run_size);
|
|
|
|
}
|
|
|
|
|
2012-02-29 08:50:47 +08:00
|
|
|
static void
|
2011-03-16 04:59:15 +08:00
|
|
|
bin_info_init(void)
|
|
|
|
{
|
|
|
|
arena_bin_info_t *bin_info;
|
2012-04-02 22:04:34 +08:00
|
|
|
size_t prev_run_size = PAGE;
|
2012-02-29 08:50:47 +08:00
|
|
|
|
|
|
|
#define SIZE_CLASS(bin, delta, size) \
|
|
|
|
bin_info = &arena_bin_info[bin]; \
|
|
|
|
bin_info->reg_size = size; \
|
|
|
|
prev_run_size = bin_info_run_size_calc(bin_info, prev_run_size);\
|
|
|
|
bitmap_info_init(&bin_info->bitmap_info, bin_info->nregs);
|
|
|
|
SIZE_CLASSES
|
|
|
|
#undef SIZE_CLASS
|
2011-03-16 04:59:15 +08:00
|
|
|
}
|
|
|
|
|
2012-02-29 08:50:47 +08:00
|
|
|
void
|
2010-01-30 06:30:41 +08:00
|
|
|
arena_boot(void)
|
2010-01-17 01:53:50 +08:00
|
|
|
{
|
2010-01-30 06:30:41 +08:00
|
|
|
size_t header_size;
|
2010-10-02 08:35:43 +08:00
|
|
|
unsigned i;
|
2010-01-17 01:53:50 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Compute the header size such that it is large enough to contain the
|
2010-10-02 08:35:43 +08:00
|
|
|
* page map. The page map is biased to omit entries for the header
|
|
|
|
* itself, so some iteration is necessary to compute the map bias.
|
|
|
|
*
|
|
|
|
* 1) Compute safe header_size and map_bias values that include enough
|
|
|
|
* space for an unbiased page map.
|
|
|
|
* 2) Refine map_bias based on (1) to omit the header pages in the page
|
|
|
|
* map. The resulting map_bias may be one too small.
|
|
|
|
* 3) Refine map_bias based on (2). The result will be >= the result
|
|
|
|
* from (2), and will always be correct.
|
2010-01-17 01:53:50 +08:00
|
|
|
*/
|
2010-10-02 08:35:43 +08:00
|
|
|
map_bias = 0;
|
|
|
|
for (i = 0; i < 3; i++) {
|
2012-04-02 22:04:34 +08:00
|
|
|
header_size = offsetof(arena_chunk_t, map) +
|
|
|
|
(sizeof(arena_chunk_map_t) * (chunk_npages-map_bias));
|
|
|
|
map_bias = (header_size >> LG_PAGE) + ((header_size & PAGE_MASK)
|
|
|
|
!= 0);
|
2010-10-02 08:35:43 +08:00
|
|
|
}
|
|
|
|
assert(map_bias > 0);
|
|
|
|
|
2012-04-02 22:04:34 +08:00
|
|
|
arena_maxclass = chunksize - (map_bias << LG_PAGE);
|
2010-01-30 06:30:41 +08:00
|
|
|
|
2012-02-29 08:50:47 +08:00
|
|
|
bin_info_init();
|
2010-01-17 01:53:50 +08:00
|
|
|
}
|
2012-03-14 07:31:41 +08:00
|
|
|
|
|
|
|
void
|
|
|
|
arena_prefork(arena_t *arena)
|
|
|
|
{
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
malloc_mutex_prefork(&arena->lock);
|
|
|
|
for (i = 0; i < NBINS; i++)
|
|
|
|
malloc_mutex_prefork(&arena->bins[i].lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
arena_postfork_parent(arena_t *arena)
|
|
|
|
{
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
for (i = 0; i < NBINS; i++)
|
|
|
|
malloc_mutex_postfork_parent(&arena->bins[i].lock);
|
|
|
|
malloc_mutex_postfork_parent(&arena->lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
arena_postfork_child(arena_t *arena)
|
|
|
|
{
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
for (i = 0; i < NBINS; i++)
|
|
|
|
malloc_mutex_postfork_child(&arena->bins[i].lock);
|
|
|
|
malloc_mutex_postfork_child(&arena->lock);
|
|
|
|
}
|