1 | /* Malloc implementation for multiple threads without lock contention. |
2 | Copyright (C) 2001-2016 Free Software Foundation, Inc. |
3 | This file is part of the GNU C Library. |
4 | Contributed by Wolfram Gloger <wg@malloc.de>, 2001. |
5 | |
6 | The GNU C Library is free software; you can redistribute it and/or |
7 | modify it under the terms of the GNU Lesser General Public License as |
8 | published by the Free Software Foundation; either version 2.1 of the |
9 | License, or (at your option) any later version. |
10 | |
11 | The GNU C Library is distributed in the hope that it will be useful, |
12 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
14 | Lesser General Public License for more details. |
15 | |
16 | You should have received a copy of the GNU Lesser General Public |
17 | License along with the GNU C Library; see the file COPYING.LIB. If |
18 | not, see <http://www.gnu.org/licenses/>. */ |
19 | |
20 | #include <stdbool.h> |
21 | |
22 | /* Compile-time constants. */ |
23 | |
24 | #define HEAP_MIN_SIZE (32 * 1024) |
25 | #ifndef HEAP_MAX_SIZE |
26 | # ifdef DEFAULT_MMAP_THRESHOLD_MAX |
27 | # define HEAP_MAX_SIZE (2 * DEFAULT_MMAP_THRESHOLD_MAX) |
28 | # else |
29 | # define HEAP_MAX_SIZE (1024 * 1024) /* must be a power of two */ |
30 | # endif |
31 | #endif |
32 | |
33 | /* HEAP_MIN_SIZE and HEAP_MAX_SIZE limit the size of mmap()ed heaps |
34 | that are dynamically created for multi-threaded programs. The |
35 | maximum size must be a power of two, for fast determination of |
36 | which heap belongs to a chunk. It should be much larger than the |
37 | mmap threshold, so that requests with a size just below that |
38 | threshold can be fulfilled without creating too many heaps. */ |
39 | |
40 | /***************************************************************************/ |
41 | |
42 | #define top(ar_ptr) ((ar_ptr)->top) |
43 | |
44 | /* A heap is a single contiguous memory region holding (coalesceable) |
45 | malloc_chunks. It is allocated with mmap() and always starts at an |
46 | address aligned to HEAP_MAX_SIZE. */ |
47 | |
48 | typedef struct _heap_info |
49 | { |
50 | mstate ar_ptr; /* Arena for this heap. */ |
51 | struct _heap_info *prev; /* Previous heap. */ |
52 | size_t size; /* Current size in bytes. */ |
53 | size_t mprotect_size; /* Size in bytes that has been mprotected |
54 | PROT_READ|PROT_WRITE. */ |
55 | /* Make sure the following data is properly aligned, particularly |
56 | that sizeof (heap_info) + 2 * SIZE_SZ is a multiple of |
57 | MALLOC_ALIGNMENT. */ |
58 | char pad[-6 * SIZE_SZ & MALLOC_ALIGN_MASK]; |
59 | } heap_info; |
60 | |
61 | /* Get a compile-time error if the heap_info padding is not correct |
62 | to make alignment work as expected in sYSMALLOc. */ |
63 | extern int sanity_check_heap_info_alignment[(sizeof (heap_info) |
64 | + 2 * SIZE_SZ) % MALLOC_ALIGNMENT |
65 | ? -1 : 1]; |
66 | |
67 | /* Thread specific data. */ |
68 | |
69 | static __thread mstate thread_arena attribute_tls_model_ie; |
70 | |
71 | /* Arena free list. free_list_lock synchronizes access to the |
72 | free_list variable below, and the next_free and attached_threads |
73 | members of struct malloc_state objects. No other locks must be |
74 | acquired after free_list_lock has been acquired. */ |
75 | |
76 | static mutex_t free_list_lock = _LIBC_LOCK_INITIALIZER; |
77 | static size_t narenas = 1; |
78 | static mstate free_list; |
79 | |
80 | /* list_lock prevents concurrent writes to the next member of struct |
81 | malloc_state objects. |
82 | |
83 | Read access to the next member is supposed to synchronize with the |
84 | atomic_write_barrier and the write to the next member in |
85 | _int_new_arena. This suffers from data races; see the FIXME |
86 | comments in _int_new_arena and reused_arena. |
87 | |
88 | list_lock also prevents concurrent forks. At the time list_lock is |
89 | acquired, no arena lock must have been acquired, but it is |
90 | permitted to acquire arena locks subsequently, while list_lock is |
91 | acquired. */ |
92 | static mutex_t list_lock = _LIBC_LOCK_INITIALIZER; |
93 | |
94 | /* Mapped memory in non-main arenas (reliable only for NO_THREADS). */ |
95 | static unsigned long arena_mem; |
96 | |
97 | /* Already initialized? */ |
98 | int __malloc_initialized = -1; |
99 | |
100 | /**************************************************************************/ |
101 | |
102 | |
103 | /* arena_get() acquires an arena and locks the corresponding mutex. |
104 | First, try the one last locked successfully by this thread. (This |
105 | is the common case and handled with a macro for speed.) Then, loop |
106 | once over the circularly linked list of arenas. If no arena is |
107 | readily available, create a new one. In this latter case, `size' |
108 | is just a hint as to how much memory will be required immediately |
109 | in the new arena. */ |
110 | |
111 | #define arena_get(ptr, size) do { \ |
112 | ptr = thread_arena; \ |
113 | arena_lock (ptr, size); \ |
114 | } while (0) |
115 | |
116 | #define arena_lock(ptr, size) do { \ |
117 | if (ptr && !arena_is_corrupt (ptr)) \ |
118 | (void) mutex_lock (&ptr->mutex); \ |
119 | else \ |
120 | ptr = arena_get2 ((size), NULL); \ |
121 | } while (0) |
122 | |
123 | /* find the heap and corresponding arena for a given ptr */ |
124 | |
125 | #define heap_for_ptr(ptr) \ |
126 | ((heap_info *) ((unsigned long) (ptr) & ~(HEAP_MAX_SIZE - 1))) |
127 | #define arena_for_chunk(ptr) \ |
128 | (chunk_non_main_arena (ptr) ? heap_for_ptr (ptr)->ar_ptr : &main_arena) |
129 | |
130 | |
131 | /**************************************************************************/ |
132 | |
133 | /* atfork support. */ |
134 | |
135 | /* The following three functions are called around fork from a |
136 | multi-threaded process. We do not use the general fork handler |
137 | mechanism to make sure that our handlers are the last ones being |
138 | called, so that other fork handlers can use the malloc |
139 | subsystem. */ |
140 | |
141 | void |
142 | internal_function |
143 | __malloc_fork_lock_parent (void) |
144 | { |
145 | if (__malloc_initialized < 1) |
146 | return; |
147 | |
148 | /* We do not acquire free_list_lock here because we completely |
149 | reconstruct free_list in __malloc_fork_unlock_child. */ |
150 | |
151 | (void) mutex_lock (&list_lock); |
152 | |
153 | for (mstate ar_ptr = &main_arena;; ) |
154 | { |
155 | (void) mutex_lock (&ar_ptr->mutex); |
156 | ar_ptr = ar_ptr->next; |
157 | if (ar_ptr == &main_arena) |
158 | break; |
159 | } |
160 | } |
161 | |
162 | void |
163 | internal_function |
164 | __malloc_fork_unlock_parent (void) |
165 | { |
166 | if (__malloc_initialized < 1) |
167 | return; |
168 | |
169 | for (mstate ar_ptr = &main_arena;; ) |
170 | { |
171 | (void) mutex_unlock (&ar_ptr->mutex); |
172 | ar_ptr = ar_ptr->next; |
173 | if (ar_ptr == &main_arena) |
174 | break; |
175 | } |
176 | (void) mutex_unlock (&list_lock); |
177 | } |
178 | |
179 | void |
180 | internal_function |
181 | __malloc_fork_unlock_child (void) |
182 | { |
183 | if (__malloc_initialized < 1) |
184 | return; |
185 | |
186 | /* Push all arenas to the free list, except thread_arena, which is |
187 | attached to the current thread. */ |
188 | mutex_init (&free_list_lock); |
189 | if (thread_arena != NULL) |
190 | thread_arena->attached_threads = 1; |
191 | free_list = NULL; |
192 | for (mstate ar_ptr = &main_arena;; ) |
193 | { |
194 | mutex_init (&ar_ptr->mutex); |
195 | if (ar_ptr != thread_arena) |
196 | { |
197 | /* This arena is no longer attached to any thread. */ |
198 | ar_ptr->attached_threads = 0; |
199 | ar_ptr->next_free = free_list; |
200 | free_list = ar_ptr; |
201 | } |
202 | ar_ptr = ar_ptr->next; |
203 | if (ar_ptr == &main_arena) |
204 | break; |
205 | } |
206 | |
207 | mutex_init (&list_lock); |
208 | } |
209 | |
210 | /* Initialization routine. */ |
211 | #include <string.h> |
212 | extern char **_environ; |
213 | |
214 | static char * |
215 | internal_function |
216 | next_env_entry (char ***position) |
217 | { |
218 | char **current = *position; |
219 | char *result = NULL; |
220 | |
221 | while (*current != NULL) |
222 | { |
223 | if (__builtin_expect ((*current)[0] == 'M', 0) |
224 | && (*current)[1] == 'A' |
225 | && (*current)[2] == 'L' |
226 | && (*current)[3] == 'L' |
227 | && (*current)[4] == 'O' |
228 | && (*current)[5] == 'C' |
229 | && (*current)[6] == '_') |
230 | { |
231 | result = &(*current)[7]; |
232 | |
233 | /* Save current position for next visit. */ |
234 | *position = ++current; |
235 | |
236 | break; |
237 | } |
238 | |
239 | ++current; |
240 | } |
241 | |
242 | return result; |
243 | } |
244 | |
245 | |
246 | #ifdef SHARED |
247 | static void * |
248 | __failing_morecore (ptrdiff_t d) |
249 | { |
250 | return (void *) MORECORE_FAILURE; |
251 | } |
252 | |
253 | extern struct dl_open_hook *_dl_open_hook; |
254 | libc_hidden_proto (_dl_open_hook); |
255 | #endif |
256 | |
257 | static void |
258 | ptmalloc_init (void) |
259 | { |
260 | if (__malloc_initialized >= 0) |
261 | return; |
262 | |
263 | __malloc_initialized = 0; |
264 | |
265 | #ifdef SHARED |
266 | /* In case this libc copy is in a non-default namespace, never use brk. |
267 | Likewise if dlopened from statically linked program. */ |
268 | Dl_info di; |
269 | struct link_map *l; |
270 | |
271 | if (_dl_open_hook != NULL |
272 | || (_dl_addr (ptmalloc_init, &di, &l, NULL) != 0 |
273 | && l->l_ns != LM_ID_BASE)) |
274 | __morecore = __failing_morecore; |
275 | #endif |
276 | |
277 | thread_arena = &main_arena; |
278 | const char *s = NULL; |
279 | if (__glibc_likely (_environ != NULL)) |
280 | { |
281 | char **runp = _environ; |
282 | char *envline; |
283 | |
284 | while (__builtin_expect ((envline = next_env_entry (&runp)) != NULL, |
285 | 0)) |
286 | { |
287 | size_t len = strcspn (envline, "=" ); |
288 | |
289 | if (envline[len] != '=') |
290 | /* This is a "MALLOC_" variable at the end of the string |
291 | without a '=' character. Ignore it since otherwise we |
292 | will access invalid memory below. */ |
293 | continue; |
294 | |
295 | switch (len) |
296 | { |
297 | case 6: |
298 | if (memcmp (envline, "CHECK_" , 6) == 0) |
299 | s = &envline[7]; |
300 | break; |
301 | case 8: |
302 | if (!__builtin_expect (__libc_enable_secure, 0)) |
303 | { |
304 | if (memcmp (envline, "TOP_PAD_" , 8) == 0) |
305 | __libc_mallopt (M_TOP_PAD, atoi (&envline[9])); |
306 | else if (memcmp (envline, "PERTURB_" , 8) == 0) |
307 | __libc_mallopt (M_PERTURB, atoi (&envline[9])); |
308 | } |
309 | break; |
310 | case 9: |
311 | if (!__builtin_expect (__libc_enable_secure, 0)) |
312 | { |
313 | if (memcmp (envline, "MMAP_MAX_" , 9) == 0) |
314 | __libc_mallopt (M_MMAP_MAX, atoi (&envline[10])); |
315 | else if (memcmp (envline, "ARENA_MAX" , 9) == 0) |
316 | __libc_mallopt (M_ARENA_MAX, atoi (&envline[10])); |
317 | } |
318 | break; |
319 | case 10: |
320 | if (!__builtin_expect (__libc_enable_secure, 0)) |
321 | { |
322 | if (memcmp (envline, "ARENA_TEST" , 10) == 0) |
323 | __libc_mallopt (M_ARENA_TEST, atoi (&envline[11])); |
324 | } |
325 | break; |
326 | case 15: |
327 | if (!__builtin_expect (__libc_enable_secure, 0)) |
328 | { |
329 | if (memcmp (envline, "TRIM_THRESHOLD_" , 15) == 0) |
330 | __libc_mallopt (M_TRIM_THRESHOLD, atoi (&envline[16])); |
331 | else if (memcmp (envline, "MMAP_THRESHOLD_" , 15) == 0) |
332 | __libc_mallopt (M_MMAP_THRESHOLD, atoi (&envline[16])); |
333 | } |
334 | break; |
335 | default: |
336 | break; |
337 | } |
338 | } |
339 | } |
340 | if (s && s[0]) |
341 | { |
342 | __libc_mallopt (M_CHECK_ACTION, (int) (s[0] - '0')); |
343 | if (check_action != 0) |
344 | __malloc_check_init (); |
345 | } |
346 | void (*hook) (void) = atomic_forced_read (__malloc_initialize_hook); |
347 | if (hook != NULL) |
348 | (*hook)(); |
349 | __malloc_initialized = 1; |
350 | } |
351 | |
352 | /* Managing heaps and arenas (for concurrent threads) */ |
353 | |
354 | #if MALLOC_DEBUG > 1 |
355 | |
356 | /* Print the complete contents of a single heap to stderr. */ |
357 | |
358 | static void |
359 | dump_heap (heap_info *heap) |
360 | { |
361 | char *ptr; |
362 | mchunkptr p; |
363 | |
364 | fprintf (stderr, "Heap %p, size %10lx:\n" , heap, (long) heap->size); |
365 | ptr = (heap->ar_ptr != (mstate) (heap + 1)) ? |
366 | (char *) (heap + 1) : (char *) (heap + 1) + sizeof (struct malloc_state); |
367 | p = (mchunkptr) (((unsigned long) ptr + MALLOC_ALIGN_MASK) & |
368 | ~MALLOC_ALIGN_MASK); |
369 | for (;; ) |
370 | { |
371 | fprintf (stderr, "chunk %p size %10lx" , p, (long) p->size); |
372 | if (p == top (heap->ar_ptr)) |
373 | { |
374 | fprintf (stderr, " (top)\n" ); |
375 | break; |
376 | } |
377 | else if (p->size == (0 | PREV_INUSE)) |
378 | { |
379 | fprintf (stderr, " (fence)\n" ); |
380 | break; |
381 | } |
382 | fprintf (stderr, "\n" ); |
383 | p = next_chunk (p); |
384 | } |
385 | } |
386 | #endif /* MALLOC_DEBUG > 1 */ |
387 | |
388 | /* If consecutive mmap (0, HEAP_MAX_SIZE << 1, ...) calls return decreasing |
389 | addresses as opposed to increasing, new_heap would badly fragment the |
390 | address space. In that case remember the second HEAP_MAX_SIZE part |
391 | aligned to HEAP_MAX_SIZE from last mmap (0, HEAP_MAX_SIZE << 1, ...) |
392 | call (if it is already aligned) and try to reuse it next time. We need |
393 | no locking for it, as kernel ensures the atomicity for us - worst case |
394 | we'll call mmap (addr, HEAP_MAX_SIZE, ...) for some value of addr in |
395 | multiple threads, but only one will succeed. */ |
396 | static char *aligned_heap_area; |
397 | |
398 | /* Create a new heap. size is automatically rounded up to a multiple |
399 | of the page size. */ |
400 | |
401 | static heap_info * |
402 | internal_function |
403 | new_heap (size_t size, size_t top_pad) |
404 | { |
405 | size_t pagesize = GLRO (dl_pagesize); |
406 | char *p1, *p2; |
407 | unsigned long ul; |
408 | heap_info *h; |
409 | |
410 | if (size + top_pad < HEAP_MIN_SIZE) |
411 | size = HEAP_MIN_SIZE; |
412 | else if (size + top_pad <= HEAP_MAX_SIZE) |
413 | size += top_pad; |
414 | else if (size > HEAP_MAX_SIZE) |
415 | return 0; |
416 | else |
417 | size = HEAP_MAX_SIZE; |
418 | size = ALIGN_UP (size, pagesize); |
419 | |
420 | /* A memory region aligned to a multiple of HEAP_MAX_SIZE is needed. |
421 | No swap space needs to be reserved for the following large |
422 | mapping (on Linux, this is the case for all non-writable mappings |
423 | anyway). */ |
424 | p2 = MAP_FAILED; |
425 | if (aligned_heap_area) |
426 | { |
427 | p2 = (char *) MMAP (aligned_heap_area, HEAP_MAX_SIZE, PROT_NONE, |
428 | MAP_NORESERVE); |
429 | aligned_heap_area = NULL; |
430 | if (p2 != MAP_FAILED && ((unsigned long) p2 & (HEAP_MAX_SIZE - 1))) |
431 | { |
432 | __munmap (p2, HEAP_MAX_SIZE); |
433 | p2 = MAP_FAILED; |
434 | } |
435 | } |
436 | if (p2 == MAP_FAILED) |
437 | { |
438 | p1 = (char *) MMAP (0, HEAP_MAX_SIZE << 1, PROT_NONE, MAP_NORESERVE); |
439 | if (p1 != MAP_FAILED) |
440 | { |
441 | p2 = (char *) (((unsigned long) p1 + (HEAP_MAX_SIZE - 1)) |
442 | & ~(HEAP_MAX_SIZE - 1)); |
443 | ul = p2 - p1; |
444 | if (ul) |
445 | __munmap (p1, ul); |
446 | else |
447 | aligned_heap_area = p2 + HEAP_MAX_SIZE; |
448 | __munmap (p2 + HEAP_MAX_SIZE, HEAP_MAX_SIZE - ul); |
449 | } |
450 | else |
451 | { |
452 | /* Try to take the chance that an allocation of only HEAP_MAX_SIZE |
453 | is already aligned. */ |
454 | p2 = (char *) MMAP (0, HEAP_MAX_SIZE, PROT_NONE, MAP_NORESERVE); |
455 | if (p2 == MAP_FAILED) |
456 | return 0; |
457 | |
458 | if ((unsigned long) p2 & (HEAP_MAX_SIZE - 1)) |
459 | { |
460 | __munmap (p2, HEAP_MAX_SIZE); |
461 | return 0; |
462 | } |
463 | } |
464 | } |
465 | if (__mprotect (p2, size, PROT_READ | PROT_WRITE) != 0) |
466 | { |
467 | __munmap (p2, HEAP_MAX_SIZE); |
468 | return 0; |
469 | } |
470 | h = (heap_info *) p2; |
471 | h->size = size; |
472 | h->mprotect_size = size; |
473 | LIBC_PROBE (memory_heap_new, 2, h, h->size); |
474 | return h; |
475 | } |
476 | |
477 | /* Grow a heap. size is automatically rounded up to a |
478 | multiple of the page size. */ |
479 | |
480 | static int |
481 | grow_heap (heap_info *h, long diff) |
482 | { |
483 | size_t pagesize = GLRO (dl_pagesize); |
484 | long new_size; |
485 | |
486 | diff = ALIGN_UP (diff, pagesize); |
487 | new_size = (long) h->size + diff; |
488 | if ((unsigned long) new_size > (unsigned long) HEAP_MAX_SIZE) |
489 | return -1; |
490 | |
491 | if ((unsigned long) new_size > h->mprotect_size) |
492 | { |
493 | if (__mprotect ((char *) h + h->mprotect_size, |
494 | (unsigned long) new_size - h->mprotect_size, |
495 | PROT_READ | PROT_WRITE) != 0) |
496 | return -2; |
497 | |
498 | h->mprotect_size = new_size; |
499 | } |
500 | |
501 | h->size = new_size; |
502 | LIBC_PROBE (memory_heap_more, 2, h, h->size); |
503 | return 0; |
504 | } |
505 | |
506 | /* Shrink a heap. */ |
507 | |
508 | static int |
509 | shrink_heap (heap_info *h, long diff) |
510 | { |
511 | long new_size; |
512 | |
513 | new_size = (long) h->size - diff; |
514 | if (new_size < (long) sizeof (*h)) |
515 | return -1; |
516 | |
517 | /* Try to re-map the extra heap space freshly to save memory, and make it |
518 | inaccessible. See malloc-sysdep.h to know when this is true. */ |
519 | if (__glibc_unlikely (check_may_shrink_heap ())) |
520 | { |
521 | if ((char *) MMAP ((char *) h + new_size, diff, PROT_NONE, |
522 | MAP_FIXED) == (char *) MAP_FAILED) |
523 | return -2; |
524 | |
525 | h->mprotect_size = new_size; |
526 | } |
527 | else |
528 | __madvise ((char *) h + new_size, diff, MADV_DONTNEED); |
529 | /*fprintf(stderr, "shrink %p %08lx\n", h, new_size);*/ |
530 | |
531 | h->size = new_size; |
532 | LIBC_PROBE (memory_heap_less, 2, h, h->size); |
533 | return 0; |
534 | } |
535 | |
536 | /* Delete a heap. */ |
537 | |
538 | #define delete_heap(heap) \ |
539 | do { \ |
540 | if ((char *) (heap) + HEAP_MAX_SIZE == aligned_heap_area) \ |
541 | aligned_heap_area = NULL; \ |
542 | __munmap ((char *) (heap), HEAP_MAX_SIZE); \ |
543 | } while (0) |
544 | |
545 | static int |
546 | internal_function |
547 | heap_trim (heap_info *heap, size_t pad) |
548 | { |
549 | mstate ar_ptr = heap->ar_ptr; |
550 | unsigned long pagesz = GLRO (dl_pagesize); |
551 | mchunkptr top_chunk = top (ar_ptr), p, bck, fwd; |
552 | heap_info *prev_heap; |
553 | long new_size, top_size, top_area, , prev_size, misalign; |
554 | |
555 | /* Can this heap go away completely? */ |
556 | while (top_chunk == chunk_at_offset (heap, sizeof (*heap))) |
557 | { |
558 | prev_heap = heap->prev; |
559 | prev_size = prev_heap->size - (MINSIZE - 2 * SIZE_SZ); |
560 | p = chunk_at_offset (prev_heap, prev_size); |
561 | /* fencepost must be properly aligned. */ |
562 | misalign = ((long) p) & MALLOC_ALIGN_MASK; |
563 | p = chunk_at_offset (prev_heap, prev_size - misalign); |
564 | assert (p->size == (0 | PREV_INUSE)); /* must be fencepost */ |
565 | p = prev_chunk (p); |
566 | new_size = chunksize (p) + (MINSIZE - 2 * SIZE_SZ) + misalign; |
567 | assert (new_size > 0 && new_size < (long) (2 * MINSIZE)); |
568 | if (!prev_inuse (p)) |
569 | new_size += p->prev_size; |
570 | assert (new_size > 0 && new_size < HEAP_MAX_SIZE); |
571 | if (new_size + (HEAP_MAX_SIZE - prev_heap->size) < pad + MINSIZE + pagesz) |
572 | break; |
573 | ar_ptr->system_mem -= heap->size; |
574 | arena_mem -= heap->size; |
575 | LIBC_PROBE (memory_heap_free, 2, heap, heap->size); |
576 | delete_heap (heap); |
577 | heap = prev_heap; |
578 | if (!prev_inuse (p)) /* consolidate backward */ |
579 | { |
580 | p = prev_chunk (p); |
581 | unlink (ar_ptr, p, bck, fwd); |
582 | } |
583 | assert (((unsigned long) ((char *) p + new_size) & (pagesz - 1)) == 0); |
584 | assert (((char *) p + new_size) == ((char *) heap + heap->size)); |
585 | top (ar_ptr) = top_chunk = p; |
586 | set_head (top_chunk, new_size | PREV_INUSE); |
587 | /*check_chunk(ar_ptr, top_chunk);*/ |
588 | } |
589 | |
590 | /* Uses similar logic for per-thread arenas as the main arena with systrim |
591 | and _int_free by preserving the top pad and rounding down to the nearest |
592 | page. */ |
593 | top_size = chunksize (top_chunk); |
594 | if ((unsigned long)(top_size) < |
595 | (unsigned long)(mp_.trim_threshold)) |
596 | return 0; |
597 | |
598 | top_area = top_size - MINSIZE - 1; |
599 | if (top_area < 0 || (size_t) top_area <= pad) |
600 | return 0; |
601 | |
602 | /* Release in pagesize units and round down to the nearest page. */ |
603 | extra = ALIGN_DOWN(top_area - pad, pagesz); |
604 | if (extra == 0) |
605 | return 0; |
606 | |
607 | /* Try to shrink. */ |
608 | if (shrink_heap (heap, extra) != 0) |
609 | return 0; |
610 | |
611 | ar_ptr->system_mem -= extra; |
612 | arena_mem -= extra; |
613 | |
614 | /* Success. Adjust top accordingly. */ |
615 | set_head (top_chunk, (top_size - extra) | PREV_INUSE); |
616 | /*check_chunk(ar_ptr, top_chunk);*/ |
617 | return 1; |
618 | } |
619 | |
620 | /* Create a new arena with initial size "size". */ |
621 | |
622 | /* If REPLACED_ARENA is not NULL, detach it from this thread. Must be |
623 | called while free_list_lock is held. */ |
624 | static void |
625 | detach_arena (mstate replaced_arena) |
626 | { |
627 | if (replaced_arena != NULL) |
628 | { |
629 | assert (replaced_arena->attached_threads > 0); |
630 | /* The current implementation only detaches from main_arena in |
631 | case of allocation failure. This means that it is likely not |
632 | beneficial to put the arena on free_list even if the |
633 | reference count reaches zero. */ |
634 | --replaced_arena->attached_threads; |
635 | } |
636 | } |
637 | |
638 | static mstate |
639 | _int_new_arena (size_t size) |
640 | { |
641 | mstate a; |
642 | heap_info *h; |
643 | char *ptr; |
644 | unsigned long misalign; |
645 | |
646 | h = new_heap (size + (sizeof (*h) + sizeof (*a) + MALLOC_ALIGNMENT), |
647 | mp_.top_pad); |
648 | if (!h) |
649 | { |
650 | /* Maybe size is too large to fit in a single heap. So, just try |
651 | to create a minimally-sized arena and let _int_malloc() attempt |
652 | to deal with the large request via mmap_chunk(). */ |
653 | h = new_heap (sizeof (*h) + sizeof (*a) + MALLOC_ALIGNMENT, mp_.top_pad); |
654 | if (!h) |
655 | return 0; |
656 | } |
657 | a = h->ar_ptr = (mstate) (h + 1); |
658 | malloc_init_state (a); |
659 | a->attached_threads = 1; |
660 | /*a->next = NULL;*/ |
661 | a->system_mem = a->max_system_mem = h->size; |
662 | arena_mem += h->size; |
663 | |
664 | /* Set up the top chunk, with proper alignment. */ |
665 | ptr = (char *) (a + 1); |
666 | misalign = (unsigned long) chunk2mem (ptr) & MALLOC_ALIGN_MASK; |
667 | if (misalign > 0) |
668 | ptr += MALLOC_ALIGNMENT - misalign; |
669 | top (a) = (mchunkptr) ptr; |
670 | set_head (top (a), (((char *) h + h->size) - ptr) | PREV_INUSE); |
671 | |
672 | LIBC_PROBE (memory_arena_new, 2, a, size); |
673 | mstate replaced_arena = thread_arena; |
674 | thread_arena = a; |
675 | mutex_init (&a->mutex); |
676 | |
677 | (void) mutex_lock (&list_lock); |
678 | |
679 | /* Add the new arena to the global list. */ |
680 | a->next = main_arena.next; |
681 | /* FIXME: The barrier is an attempt to synchronize with read access |
682 | in reused_arena, which does not acquire list_lock while |
683 | traversing the list. */ |
684 | atomic_write_barrier (); |
685 | main_arena.next = a; |
686 | |
687 | (void) mutex_unlock (&list_lock); |
688 | |
689 | (void) mutex_lock (&free_list_lock); |
690 | detach_arena (replaced_arena); |
691 | (void) mutex_unlock (&free_list_lock); |
692 | |
693 | /* Lock this arena. NB: Another thread may have been attached to |
694 | this arena because the arena is now accessible from the |
695 | main_arena.next list and could have been picked by reused_arena. |
696 | This can only happen for the last arena created (before the arena |
697 | limit is reached). At this point, some arena has to be attached |
698 | to two threads. We could acquire the arena lock before list_lock |
699 | to make it less likely that reused_arena picks this new arena, |
700 | but this could result in a deadlock with |
701 | __malloc_fork_lock_parent. */ |
702 | |
703 | (void) mutex_lock (&a->mutex); |
704 | |
705 | return a; |
706 | } |
707 | |
708 | |
709 | /* Remove an arena from free_list. */ |
710 | static mstate |
711 | get_free_list (void) |
712 | { |
713 | mstate replaced_arena = thread_arena; |
714 | mstate result = free_list; |
715 | if (result != NULL) |
716 | { |
717 | (void) mutex_lock (&free_list_lock); |
718 | result = free_list; |
719 | if (result != NULL) |
720 | { |
721 | free_list = result->next_free; |
722 | |
723 | /* The arena will be attached to this thread. */ |
724 | assert (result->attached_threads == 0); |
725 | result->attached_threads = 1; |
726 | |
727 | detach_arena (replaced_arena); |
728 | } |
729 | (void) mutex_unlock (&free_list_lock); |
730 | |
731 | if (result != NULL) |
732 | { |
733 | LIBC_PROBE (memory_arena_reuse_free_list, 1, result); |
734 | (void) mutex_lock (&result->mutex); |
735 | thread_arena = result; |
736 | } |
737 | } |
738 | |
739 | return result; |
740 | } |
741 | |
742 | /* Remove the arena from the free list (if it is present). |
743 | free_list_lock must have been acquired by the caller. */ |
744 | static void |
745 | remove_from_free_list (mstate arena) |
746 | { |
747 | mstate *previous = &free_list; |
748 | for (mstate p = free_list; p != NULL; p = p->next_free) |
749 | { |
750 | assert (p->attached_threads == 0); |
751 | if (p == arena) |
752 | { |
753 | /* Remove the requested arena from the list. */ |
754 | *previous = p->next_free; |
755 | break; |
756 | } |
757 | else |
758 | previous = &p->next_free; |
759 | } |
760 | } |
761 | |
762 | /* Lock and return an arena that can be reused for memory allocation. |
763 | Avoid AVOID_ARENA as we have already failed to allocate memory in |
764 | it and it is currently locked. */ |
765 | static mstate |
766 | reused_arena (mstate avoid_arena) |
767 | { |
768 | mstate result; |
769 | /* FIXME: Access to next_to_use suffers from data races. */ |
770 | static mstate next_to_use; |
771 | if (next_to_use == NULL) |
772 | next_to_use = &main_arena; |
773 | |
774 | /* Iterate over all arenas (including those linked from |
775 | free_list). */ |
776 | result = next_to_use; |
777 | do |
778 | { |
779 | if (!arena_is_corrupt (result) && !mutex_trylock (&result->mutex)) |
780 | goto out; |
781 | |
782 | /* FIXME: This is a data race, see _int_new_arena. */ |
783 | result = result->next; |
784 | } |
785 | while (result != next_to_use); |
786 | |
787 | /* Avoid AVOID_ARENA as we have already failed to allocate memory |
788 | in that arena and it is currently locked. */ |
789 | if (result == avoid_arena) |
790 | result = result->next; |
791 | |
792 | /* Make sure that the arena we get is not corrupted. */ |
793 | mstate begin = result; |
794 | while (arena_is_corrupt (result) || result == avoid_arena) |
795 | { |
796 | result = result->next; |
797 | if (result == begin) |
798 | /* We looped around the arena list. We could not find any |
799 | arena that was either not corrupted or not the one we |
800 | wanted to avoid. */ |
801 | return NULL; |
802 | } |
803 | |
804 | /* No arena available without contention. Wait for the next in line. */ |
805 | LIBC_PROBE (memory_arena_reuse_wait, 3, &result->mutex, result, avoid_arena); |
806 | (void) mutex_lock (&result->mutex); |
807 | |
808 | out: |
809 | /* Attach the arena to the current thread. */ |
810 | { |
811 | /* Update the arena thread attachment counters. */ |
812 | mstate replaced_arena = thread_arena; |
813 | (void) mutex_lock (&free_list_lock); |
814 | detach_arena (replaced_arena); |
815 | |
816 | /* We may have picked up an arena on the free list. We need to |
817 | preserve the invariant that no arena on the free list has a |
818 | positive attached_threads counter (otherwise, |
819 | arena_thread_freeres cannot use the counter to determine if the |
820 | arena needs to be put on the free list). We unconditionally |
821 | remove the selected arena from the free list. The caller of |
822 | reused_arena checked the free list and observed it to be empty, |
823 | so the list is very short. */ |
824 | remove_from_free_list (result); |
825 | |
826 | ++result->attached_threads; |
827 | |
828 | (void) mutex_unlock (&free_list_lock); |
829 | } |
830 | |
831 | LIBC_PROBE (memory_arena_reuse, 2, result, avoid_arena); |
832 | thread_arena = result; |
833 | next_to_use = result->next; |
834 | |
835 | return result; |
836 | } |
837 | |
838 | static mstate |
839 | internal_function |
840 | arena_get2 (size_t size, mstate avoid_arena) |
841 | { |
842 | mstate a; |
843 | |
844 | static size_t narenas_limit; |
845 | |
846 | a = get_free_list (); |
847 | if (a == NULL) |
848 | { |
849 | /* Nothing immediately available, so generate a new arena. */ |
850 | if (narenas_limit == 0) |
851 | { |
852 | if (mp_.arena_max != 0) |
853 | narenas_limit = mp_.arena_max; |
854 | else if (narenas > mp_.arena_test) |
855 | { |
856 | int n = __get_nprocs (); |
857 | |
858 | if (n >= 1) |
859 | narenas_limit = NARENAS_FROM_NCORES (n); |
860 | else |
861 | /* We have no information about the system. Assume two |
862 | cores. */ |
863 | narenas_limit = NARENAS_FROM_NCORES (2); |
864 | } |
865 | } |
866 | repeat:; |
867 | size_t n = narenas; |
868 | /* NB: the following depends on the fact that (size_t)0 - 1 is a |
869 | very large number and that the underflow is OK. If arena_max |
870 | is set the value of arena_test is irrelevant. If arena_test |
871 | is set but narenas is not yet larger or equal to arena_test |
872 | narenas_limit is 0. There is no possibility for narenas to |
873 | be too big for the test to always fail since there is not |
874 | enough address space to create that many arenas. */ |
875 | if (__glibc_unlikely (n <= narenas_limit - 1)) |
876 | { |
877 | if (catomic_compare_and_exchange_bool_acq (&narenas, n + 1, n)) |
878 | goto repeat; |
879 | a = _int_new_arena (size); |
880 | if (__glibc_unlikely (a == NULL)) |
881 | catomic_decrement (&narenas); |
882 | } |
883 | else |
884 | a = reused_arena (avoid_arena); |
885 | } |
886 | return a; |
887 | } |
888 | |
889 | /* If we don't have the main arena, then maybe the failure is due to running |
890 | out of mmapped areas, so we can try allocating on the main arena. |
891 | Otherwise, it is likely that sbrk() has failed and there is still a chance |
892 | to mmap(), so try one of the other arenas. */ |
893 | static mstate |
894 | arena_get_retry (mstate ar_ptr, size_t bytes) |
895 | { |
896 | LIBC_PROBE (memory_arena_retry, 2, bytes, ar_ptr); |
897 | if (ar_ptr != &main_arena) |
898 | { |
899 | (void) mutex_unlock (&ar_ptr->mutex); |
900 | /* Don't touch the main arena if it is corrupt. */ |
901 | if (arena_is_corrupt (&main_arena)) |
902 | return NULL; |
903 | |
904 | ar_ptr = &main_arena; |
905 | (void) mutex_lock (&ar_ptr->mutex); |
906 | } |
907 | else |
908 | { |
909 | (void) mutex_unlock (&ar_ptr->mutex); |
910 | ar_ptr = arena_get2 (bytes, ar_ptr); |
911 | } |
912 | |
913 | return ar_ptr; |
914 | } |
915 | |
916 | static void __attribute__ ((section ("__libc_thread_freeres_fn" ))) |
917 | arena_thread_freeres (void) |
918 | { |
919 | mstate a = thread_arena; |
920 | thread_arena = NULL; |
921 | |
922 | if (a != NULL) |
923 | { |
924 | (void) mutex_lock (&free_list_lock); |
925 | /* If this was the last attached thread for this arena, put the |
926 | arena on the free list. */ |
927 | assert (a->attached_threads > 0); |
928 | if (--a->attached_threads == 0) |
929 | { |
930 | a->next_free = free_list; |
931 | free_list = a; |
932 | } |
933 | (void) mutex_unlock (&free_list_lock); |
934 | } |
935 | } |
936 | text_set_element (__libc_thread_subfreeres, arena_thread_freeres); |
937 | |
938 | /* |
939 | * Local variables: |
940 | * c-basic-offset: 2 |
941 | * End: |
942 | */ |
943 | |