1//===-- primary64.h ---------------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#ifndef SCUDO_PRIMARY64_H_
10#define SCUDO_PRIMARY64_H_
11
12#include "allocator_common.h"
13#include "bytemap.h"
14#include "common.h"
15#include "condition_variable.h"
16#include "list.h"
17#include "mem_map.h"
18#include "memtag.h"
19#include "options.h"
20#include "release.h"
21#include "size_class_allocator.h"
22#include "stats.h"
23#include "string_utils.h"
24#include "thread_annotations.h"
25#include "tracing.h"
26
27#include <inttypes.h>
28
29namespace scudo {
30
31// SizeClassAllocator64 is an allocator tuned for 64-bit address space.
32//
33// It starts by reserving NumClasses * 2^RegionSizeLog bytes, equally divided in
34// Regions, specific to each size class. Note that the base of that mapping is
35// random (based to the platform specific map() capabilities). If
36// PrimaryEnableRandomOffset is set, each Region actually starts at a random
37// offset from its base.
38//
39// Regions are mapped incrementally on demand to fulfill allocation requests,
40// those mappings being split into equally sized Blocks based on the size class
41// they belong to. The Blocks created are shuffled to prevent predictable
42// address patterns (the predictability increases with the size of the Blocks).
43//
44// The 1st Region (for size class 0) holds the Batches. This is a
45// structure used to transfer arrays of available pointers from the class size
46// freelist to the thread specific freelist, and back.
47//
48// The memory used by this allocator is never unmapped, but can be partially
49// released if the platform allows for it.
50
51template <typename Config> class SizeClassAllocator64 {
52public:
53 typedef typename Config::CompactPtrT CompactPtrT;
54 typedef typename Config::SizeClassMap SizeClassMap;
55 typedef typename Config::ConditionVariableT ConditionVariableT;
56 static const uptr CompactPtrScale = Config::getCompactPtrScale();
57 static const uptr RegionSizeLog = Config::getRegionSizeLog();
58 static const uptr GroupSizeLog = Config::getGroupSizeLog();
59 static_assert(RegionSizeLog >= GroupSizeLog,
60 "Group size shouldn't be greater than the region size");
61 static const uptr GroupScale = GroupSizeLog - CompactPtrScale;
62 typedef SizeClassAllocator64<Config> ThisT;
63 typedef Batch<ThisT> BatchT;
64 typedef BatchGroup<ThisT> BatchGroupT;
65 using SizeClassAllocatorT =
66 typename Conditional<Config::getEnableBlockCache(),
67 SizeClassAllocatorLocalCache<ThisT>,
68 SizeClassAllocatorNoCache<ThisT>>::type;
69 static const u16 MaxNumBlocksInBatch = SizeClassMap::MaxNumCachedHint;
70
71 static constexpr uptr getSizeOfBatchClass() {
72 const uptr HeaderSize = sizeof(BatchT);
73 return roundUp(X: HeaderSize + sizeof(CompactPtrT) * MaxNumBlocksInBatch,
74 Boundary: 1 << CompactPtrScale);
75 }
76
77 static_assert(sizeof(BatchGroupT) <= getSizeOfBatchClass(),
78 "BatchGroupT also uses BatchClass");
79
80 // BachClass is used to store internal metadata so it needs to be at least as
81 // large as the largest data structure.
82 static uptr getSizeByClassId(uptr ClassId) {
83 return (ClassId == SizeClassMap::BatchClassId)
84 ? getSizeOfBatchClass()
85 : SizeClassMap::getSizeByClassId(ClassId);
86 }
87
88 static bool canAllocate(uptr Size) { return Size <= SizeClassMap::MaxSize; }
89 static bool conditionVariableEnabled() {
90 return Config::hasConditionVariableT();
91 }
92
93 BlockInfo findNearestBlock(uptr Ptr);
94
95 void init(s32 ReleaseToOsInterval) NO_THREAD_SAFETY_ANALYSIS;
96
97 void unmapTestOnly();
98
99 // When all blocks are freed, it has to be the same size as `AllocatedUser`.
100 void verifyAllBlocksAreReleasedTestOnly();
101
102 u16 popBlocks(SizeClassAllocatorT *SizeClassAllocator, uptr ClassId,
103 CompactPtrT *ToArray, const u16 MaxBlockCount);
104
105 // Push the array of free blocks to the designated batch group.
106 void pushBlocks(SizeClassAllocatorT *SizeClassAllocator, uptr ClassId,
107 CompactPtrT *Array, u32 Size);
108
109 void disable() NO_THREAD_SAFETY_ANALYSIS;
110 void enable() NO_THREAD_SAFETY_ANALYSIS;
111
112 template <typename F> void iterateOverBlocks(F Callback);
113
114 void getStats(ScopedString *Str);
115 void getFragmentationInfo(ScopedString *Str);
116 void getMemoryGroupFragmentationInfo(ScopedString *Str);
117
118 bool setOption(Option O, sptr Value);
119
120 // These are used for returning unused pages. Note that it doesn't unmap the
121 // pages, it only suggests that the physical pages can be released.
122 uptr tryReleaseToOS(uptr ClassId, ReleaseToOS ReleaseType);
123 uptr releaseToOS(ReleaseToOS ReleaseType);
124
125 uptr getCompactPtrBaseByClassId(uptr ClassId) {
126 return getRegionInfo(ClassId)->RegionBeg;
127 }
128
129 CompactPtrT compactPtr(uptr ClassId, uptr Ptr) {
130 DCHECK_LE(ClassId, SizeClassMap::LargestClassId);
131 return compactPtrInternal(Base: getCompactPtrBaseByClassId(ClassId), Ptr);
132 }
133
134 void *decompactPtr(uptr ClassId, CompactPtrT CompactPtr) {
135 DCHECK_LE(ClassId, SizeClassMap::LargestClassId);
136 return reinterpret_cast<void *>(
137 decompactPtrInternal(Base: getCompactPtrBaseByClassId(ClassId), CompactPtr));
138 }
139
140 AtomicOptions Options;
141
142private:
143 static const uptr RegionSize = 1UL << RegionSizeLog;
144 static const uptr NumClasses = SizeClassMap::NumClasses;
145 static const uptr MapSizeIncrement = Config::getMapSizeIncrement();
146 // Fill at most this number of batches from the newly map'd memory.
147 static const u32 MaxNumBatches = SCUDO_ANDROID ? 4U : 8U;
148
149 struct ReleaseToOsInfo {
150 uptr BytesInFreeListAtLastCheckpoint;
151 uptr NumReleasesAttempted;
152 uptr LastReleasedBytes;
153 // The minimum size of pushed blocks to trigger page release.
154 uptr TryReleaseThreshold;
155 // The number of bytes not triggering `releaseToOSMaybe()` because of
156 // the length of release interval.
157 uptr PendingPushedBytesDelta;
158 u64 LastReleaseAtNs;
159 };
160
161 struct BlocksInfo {
162 SinglyLinkedList<BatchGroupT> BlockList = {};
163 uptr PoppedBlocks = 0;
164 uptr PushedBlocks = 0;
165 };
166
167 struct PagesInfo {
168 MemMapT MemMap = {};
169 // Bytes mapped for user memory.
170 uptr MappedUser = 0;
171 // Bytes allocated for user memory.
172 uptr AllocatedUser = 0;
173 };
174
175 struct UnpaddedRegionInfo {
176 // Mutex for operations on freelist
177 HybridMutex FLLock;
178 ConditionVariableT FLLockCV GUARDED_BY(FLLock);
179 // Mutex for memmap operations
180 HybridMutex MMLock ACQUIRED_BEFORE(FLLock);
181 // `RegionBeg` is initialized before thread creation and won't be changed.
182 uptr RegionBeg = 0;
183 u32 RandState GUARDED_BY(MMLock) = 0;
184 BlocksInfo FreeListInfo GUARDED_BY(FLLock);
185 PagesInfo MemMapInfo GUARDED_BY(MMLock);
186 ReleaseToOsInfo ReleaseInfo GUARDED_BY(MMLock) = {};
187 bool Exhausted GUARDED_BY(MMLock) = false;
188 bool isPopulatingFreeList GUARDED_BY(FLLock) = false;
189 };
190 struct RegionInfo : UnpaddedRegionInfo {
191 char Padding[SCUDO_CACHE_LINE_SIZE -
192 (sizeof(UnpaddedRegionInfo) % SCUDO_CACHE_LINE_SIZE)] = {};
193 };
194 static_assert(sizeof(RegionInfo) % SCUDO_CACHE_LINE_SIZE == 0, "");
195
196 RegionInfo *getRegionInfo(uptr ClassId) {
197 DCHECK_LT(ClassId, NumClasses);
198 return &RegionInfoArray[ClassId];
199 }
200
201 uptr getRegionBaseByClassId(uptr ClassId) {
202 RegionInfo *Region = getRegionInfo(ClassId);
203 Region->MMLock.assertHeld();
204
205 if (!Config::getEnableContiguousRegions() &&
206 !Region->MemMapInfo.MemMap.isAllocated()) {
207 return 0U;
208 }
209 return Region->MemMapInfo.MemMap.getBase();
210 }
211
212 CompactPtrT compactPtrInternal(uptr Base, uptr Ptr) const {
213 return static_cast<CompactPtrT>((Ptr - Base) >> CompactPtrScale);
214 }
215 uptr decompactPtrInternal(uptr Base, CompactPtrT CompactPtr) const {
216 return Base + (static_cast<uptr>(CompactPtr) << CompactPtrScale);
217 }
218 uptr compactPtrGroup(CompactPtrT CompactPtr) const {
219 const uptr Mask = (static_cast<uptr>(1) << GroupScale) - 1;
220 return static_cast<uptr>(CompactPtr) & ~Mask;
221 }
222 uptr decompactGroupBase(uptr Base, uptr CompactPtrGroupBase) const {
223 DCHECK_EQ(CompactPtrGroupBase % (static_cast<uptr>(1) << (GroupScale)), 0U);
224 return Base + (CompactPtrGroupBase << CompactPtrScale);
225 }
226 ALWAYS_INLINE bool isSmallBlock(uptr BlockSize) const {
227 const uptr PageSize = getPageSizeCached();
228 return BlockSize < PageSize / 16U;
229 }
230 ALWAYS_INLINE uptr getMinReleaseAttemptSize(uptr BlockSize) {
231 return roundUp(X: BlockSize, Boundary: getPageSizeCached());
232 }
233
234 ALWAYS_INLINE void initRegion(RegionInfo *Region, uptr ClassId,
235 MemMapT MemMap, bool EnableRandomOffset)
236 REQUIRES(Region->MMLock);
237
238 void pushBlocksImpl(SizeClassAllocatorT *SizeClassAllocator, uptr ClassId,
239 RegionInfo *Region, CompactPtrT *Array, u32 Size,
240 bool SameGroup = false) REQUIRES(Region->FLLock);
241
242 // Similar to `pushBlocksImpl` but has some logics specific to BatchClass.
243 void pushBatchClassBlocks(RegionInfo *Region, CompactPtrT *Array, u32 Size)
244 REQUIRES(Region->FLLock);
245
246 // Pop at most `MaxBlockCount` from the freelist of the given region.
247 u16 popBlocksImpl(SizeClassAllocatorT *SizeClassAllocator, uptr ClassId,
248 RegionInfo *Region, CompactPtrT *ToArray,
249 const u16 MaxBlockCount) REQUIRES(Region->FLLock);
250 // Same as `popBlocksImpl` but is used when conditional variable is enabled.
251 u16 popBlocksWithCV(SizeClassAllocatorT *SizeClassAllocator, uptr ClassId,
252 RegionInfo *Region, CompactPtrT *ToArray,
253 const u16 MaxBlockCount, bool &ReportRegionExhausted);
254
255 // When there's no blocks available in the freelist, it tries to prepare more
256 // blocks by mapping more pages.
257 NOINLINE u16 populateFreeListAndPopBlocks(
258 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, RegionInfo *Region,
259 CompactPtrT *ToArray, const u16 MaxBlockCount) REQUIRES(Region->MMLock)
260 EXCLUDES(Region->FLLock);
261
262 void getStats(ScopedString *Str, uptr ClassId, RegionInfo *Region)
263 REQUIRES(Region->MMLock, Region->FLLock);
264 void getRegionFragmentationInfo(RegionInfo *Region, uptr ClassId,
265 ScopedString *Str) REQUIRES(Region->MMLock);
266 void getMemoryGroupFragmentationInfoInRegion(RegionInfo *Region, uptr ClassId,
267 ScopedString *Str)
268 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock);
269
270 NOINLINE uptr releaseToOSMaybe(RegionInfo *Region, uptr ClassId,
271 ReleaseToOS ReleaseType = ReleaseToOS::Normal)
272 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock);
273 bool hasChanceToReleasePages(RegionInfo *Region, uptr BlockSize,
274 uptr BytesInFreeList, ReleaseToOS ReleaseType)
275 REQUIRES(Region->MMLock, Region->FLLock);
276 SinglyLinkedList<BatchGroupT>
277 collectGroupsToRelease(RegionInfo *Region, const uptr BlockSize,
278 const uptr AllocatedUserEnd, const uptr CompactPtrBase)
279 REQUIRES(Region->MMLock, Region->FLLock);
280 PageReleaseContext
281 markFreeBlocks(RegionInfo *Region, const uptr BlockSize,
282 const uptr AllocatedUserEnd, const uptr CompactPtrBase,
283 SinglyLinkedList<BatchGroupT> &GroupsToRelease)
284 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock);
285
286 void mergeGroupsToReleaseBack(RegionInfo *Region,
287 SinglyLinkedList<BatchGroupT> &GroupsToRelease)
288 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock);
289
290 // The minimum size of pushed blocks that we will try to release the pages in
291 // that size class.
292 uptr SmallerBlockReleasePageDelta = 0;
293 atomic_s32 ReleaseToOsIntervalMs = {};
294 alignas(SCUDO_CACHE_LINE_SIZE) RegionInfo RegionInfoArray[NumClasses];
295};
296
297template <typename Config>
298void SizeClassAllocator64<Config>::init(s32 ReleaseToOsInterval)
299 NO_THREAD_SAFETY_ANALYSIS {
300 DCHECK(isAligned(reinterpret_cast<uptr>(this), alignof(ThisT)));
301
302 const uptr PageSize = getPageSizeCached();
303 const uptr GroupSize = (1UL << GroupSizeLog);
304 const uptr PagesInGroup = GroupSize / PageSize;
305 const uptr MinSizeClass = getSizeByClassId(ClassId: 1);
306 // When trying to release pages back to memory, visiting smaller size
307 // classes is expensive. Therefore, we only try to release smaller size
308 // classes when the amount of free blocks goes over a certain threshold (See
309 // the comment in releaseToOSMaybe() for more details). For example, for
310 // size class 32, we only do the release when the size of free blocks is
311 // greater than 97% of pages in a group. However, this may introduce another
312 // issue that if the number of free blocks is bouncing between 97% ~ 100%.
313 // Which means we may try many page releases but only release very few of
314 // them (less than 3% in a group). Even though we have
315 // `&ReleaseToOsIntervalMs` which slightly reduce the frequency of these
316 // calls but it will be better to have another guard to mitigate this issue.
317 //
318 // Here we add another constraint on the minimum size requirement. The
319 // constraint is determined by the size of in-use blocks in the minimal size
320 // class. Take size class 32 as an example,
321 //
322 // +- one memory group -+
323 // +----------------------+------+
324 // | 97% of free blocks | |
325 // +----------------------+------+
326 // \ /
327 // 3% in-use blocks
328 //
329 // * The release size threshold is 97%.
330 //
331 // The 3% size in a group is about 7 pages. For two consecutive
332 // releaseToOSMaybe(), we require the difference between `PushedBlocks`
333 // should be greater than 7 pages. This mitigates the page releasing
334 // thrashing which is caused by memory usage bouncing around the threshold.
335 // The smallest size class takes longest time to do the page release so we
336 // use its size of in-use blocks as a heuristic.
337 SmallerBlockReleasePageDelta = PagesInGroup * (1 + MinSizeClass / 16U) / 100;
338
339 u32 Seed;
340 const u64 Time = getMonotonicTimeFast();
341 if (!getRandom(Buffer: reinterpret_cast<void *>(&Seed), Length: sizeof(Seed)))
342 Seed = static_cast<u32>(Time ^ (reinterpret_cast<uptr>(&Seed) >> 12));
343
344 for (uptr I = 0; I < NumClasses; I++)
345 getRegionInfo(ClassId: I)->RandState = getRandomU32(State: &Seed);
346
347 if (Config::getEnableContiguousRegions()) {
348 ReservedMemoryT ReservedMemory = {};
349 // Reserve the space required for the Primary.
350 CHECK(ReservedMemory.create(/*Addr=*/0U, RegionSize * NumClasses,
351 "scudo:primary_reserve"));
352 const uptr PrimaryBase = ReservedMemory.getBase();
353
354 for (uptr I = 0; I < NumClasses; I++) {
355 MemMapT RegionMemMap = ReservedMemory.dispatch(
356 Addr: PrimaryBase + (I << RegionSizeLog), Size: RegionSize);
357 RegionInfo *Region = getRegionInfo(ClassId: I);
358
359 initRegion(Region, ClassId: I, MemMap: RegionMemMap, EnableRandomOffset: Config::getEnableRandomOffset());
360 }
361 shuffle(RegionInfoArray, NumClasses, &Seed);
362 }
363
364 // The binding should be done after region shuffling so that it won't bind
365 // the FLLock from the wrong region.
366 for (uptr I = 0; I < NumClasses; I++)
367 getRegionInfo(ClassId: I)->FLLockCV.bindTestOnly(getRegionInfo(ClassId: I)->FLLock);
368
369 // The default value in the primary config has the higher priority.
370 if (Config::getDefaultReleaseToOsIntervalMs() != INT32_MIN)
371 ReleaseToOsInterval = Config::getDefaultReleaseToOsIntervalMs();
372 setOption(O: Option::ReleaseInterval, Value: static_cast<sptr>(ReleaseToOsInterval));
373}
374
375template <typename Config>
376void SizeClassAllocator64<Config>::initRegion(RegionInfo *Region, uptr ClassId,
377 MemMapT MemMap,
378 bool EnableRandomOffset)
379 REQUIRES(Region->MMLock) {
380 DCHECK(!Region->MemMapInfo.MemMap.isAllocated());
381 DCHECK(MemMap.isAllocated());
382
383 const uptr PageSize = getPageSizeCached();
384
385 Region->MemMapInfo.MemMap = MemMap;
386
387 Region->RegionBeg = MemMap.getBase();
388 if (EnableRandomOffset) {
389 Region->RegionBeg += (getRandomModN(&Region->RandState, 16) + 1) * PageSize;
390 }
391
392 const uptr BlockSize = getSizeByClassId(ClassId);
393 // Releasing small blocks is expensive, set a higher threshold to avoid
394 // frequent page releases.
395 if (isSmallBlock(BlockSize)) {
396 Region->ReleaseInfo.TryReleaseThreshold =
397 PageSize * SmallerBlockReleasePageDelta;
398 } else {
399 Region->ReleaseInfo.TryReleaseThreshold =
400 getMinReleaseAttemptSize(BlockSize);
401 }
402}
403
404template <typename Config> void SizeClassAllocator64<Config>::unmapTestOnly() {
405 for (uptr I = 0; I < NumClasses; I++) {
406 RegionInfo *Region = getRegionInfo(ClassId: I);
407 {
408 ScopedLock ML(Region->MMLock);
409 MemMapT MemMap = Region->MemMapInfo.MemMap;
410 if (MemMap.isAllocated())
411 MemMap.unmap();
412 }
413 *Region = {};
414 }
415}
416
417template <typename Config>
418void SizeClassAllocator64<Config>::verifyAllBlocksAreReleasedTestOnly() {
419 // `BatchGroup` and `Batch` also use the blocks from BatchClass.
420 uptr BatchClassUsedInFreeLists = 0;
421 for (uptr I = 0; I < NumClasses; I++) {
422 // We have to count BatchClassUsedInFreeLists in other regions first.
423 if (I == SizeClassMap::BatchClassId)
424 continue;
425 RegionInfo *Region = getRegionInfo(ClassId: I);
426 ScopedLock ML(Region->MMLock);
427 ScopedLock FL(Region->FLLock);
428 const uptr BlockSize = getSizeByClassId(ClassId: I);
429 uptr TotalBlocks = 0;
430 for (BatchGroupT &BG : Region->FreeListInfo.BlockList) {
431 // `BG::Batches` are `Batches`. +1 for `BatchGroup`.
432 BatchClassUsedInFreeLists += BG.Batches.size() + 1;
433 for (const auto &It : BG.Batches)
434 TotalBlocks += It.getCount();
435 }
436
437 DCHECK_EQ(TotalBlocks, Region->MemMapInfo.AllocatedUser / BlockSize);
438 DCHECK_EQ(Region->FreeListInfo.PushedBlocks,
439 Region->FreeListInfo.PoppedBlocks);
440 }
441
442 RegionInfo *Region = getRegionInfo(ClassId: SizeClassMap::BatchClassId);
443 ScopedLock ML(Region->MMLock);
444 ScopedLock FL(Region->FLLock);
445 const uptr BlockSize = getSizeByClassId(ClassId: SizeClassMap::BatchClassId);
446 uptr TotalBlocks = 0;
447 for (BatchGroupT &BG : Region->FreeListInfo.BlockList) {
448 if (LIKELY(!BG.Batches.empty())) {
449 for (const auto &It : BG.Batches)
450 TotalBlocks += It.getCount();
451 } else {
452 // `BatchGroup` with empty freelist doesn't have `Batch` record
453 // itself.
454 ++TotalBlocks;
455 }
456 }
457 DCHECK_EQ(TotalBlocks + BatchClassUsedInFreeLists,
458 Region->MemMapInfo.AllocatedUser / BlockSize);
459 DCHECK_GE(Region->FreeListInfo.PoppedBlocks,
460 Region->FreeListInfo.PushedBlocks);
461 const uptr BlocksInUse =
462 Region->FreeListInfo.PoppedBlocks - Region->FreeListInfo.PushedBlocks;
463 DCHECK_EQ(BlocksInUse, BatchClassUsedInFreeLists);
464}
465
466template <typename Config>
467u16 SizeClassAllocator64<Config>::popBlocks(
468 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, CompactPtrT *ToArray,
469 const u16 MaxBlockCount) {
470 DCHECK_LT(ClassId, NumClasses);
471 RegionInfo *Region = getRegionInfo(ClassId);
472 u16 PopCount = 0;
473
474 {
475 ScopedLock L(Region->FLLock);
476 PopCount = popBlocksImpl(SizeClassAllocator, ClassId, Region, ToArray,
477 MaxBlockCount);
478 if (PopCount != 0U)
479 return PopCount;
480 }
481
482 bool ReportRegionExhausted = false;
483
484 if (conditionVariableEnabled()) {
485 PopCount = popBlocksWithCV(SizeClassAllocator, ClassId, Region, ToArray,
486 MaxBlockCount, ReportRegionExhausted);
487 } else {
488 while (true) {
489 // When two threads compete for `Region->MMLock`, we only want one of
490 // them to call populateFreeListAndPopBlocks(). To avoid both of them
491 // doing that, always check the freelist before mapping new pages.
492 ScopedLock ML(Region->MMLock);
493 {
494 ScopedLock FL(Region->FLLock);
495 PopCount = popBlocksImpl(SizeClassAllocator, ClassId, Region, ToArray,
496 MaxBlockCount);
497 if (PopCount != 0U)
498 return PopCount;
499 }
500
501 const bool RegionIsExhausted = Region->Exhausted;
502 if (!RegionIsExhausted) {
503 PopCount = populateFreeListAndPopBlocks(SizeClassAllocator, ClassId,
504 Region, ToArray, MaxBlockCount);
505 }
506 ReportRegionExhausted = !RegionIsExhausted && Region->Exhausted;
507 break;
508 }
509 }
510
511 if (UNLIKELY(ReportRegionExhausted)) {
512 Printf(Format: "Can't populate more pages for size class %zu.\n",
513 getSizeByClassId(ClassId));
514
515 // Theoretically, BatchClass shouldn't be used up. Abort immediately when
516 // it happens.
517 if (ClassId == SizeClassMap::BatchClassId)
518 reportOutOfBatchClass();
519 }
520
521 return PopCount;
522}
523
524template <typename Config>
525u16 SizeClassAllocator64<Config>::popBlocksWithCV(
526 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, RegionInfo *Region,
527 CompactPtrT *ToArray, const u16 MaxBlockCount,
528 bool &ReportRegionExhausted) {
529 u16 PopCount = 0;
530
531 while (true) {
532 // We only expect one thread doing the freelist refillment and other
533 // threads will be waiting for either the completion of the
534 // `populateFreeListAndPopBlocks()` or `pushBlocks()` called by other
535 // threads.
536 bool PopulateFreeList = false;
537 {
538 ScopedLock FL(Region->FLLock);
539 if (!Region->isPopulatingFreeList) {
540 Region->isPopulatingFreeList = true;
541 PopulateFreeList = true;
542 }
543 }
544
545 if (PopulateFreeList) {
546 ScopedLock ML(Region->MMLock);
547
548 const bool RegionIsExhausted = Region->Exhausted;
549 if (!RegionIsExhausted) {
550 PopCount = populateFreeListAndPopBlocks(SizeClassAllocator, ClassId,
551 Region, ToArray, MaxBlockCount);
552 }
553 ReportRegionExhausted = !RegionIsExhausted && Region->Exhausted;
554
555 {
556 // Before reacquiring the `FLLock`, the freelist may be used up again
557 // and some threads are waiting for the freelist refillment by the
558 // current thread. It's important to set
559 // `Region->isPopulatingFreeList` to false so the threads about to
560 // sleep will notice the status change.
561 ScopedLock FL(Region->FLLock);
562 Region->isPopulatingFreeList = false;
563 Region->FLLockCV.notifyAll(Region->FLLock);
564 }
565
566 break;
567 }
568
569 // At here, there are two preconditions to be met before waiting,
570 // 1. The freelist is empty.
571 // 2. Region->isPopulatingFreeList == true, i.e, someone is still doing
572 // `populateFreeListAndPopBlocks()`.
573 //
574 // Note that it has the chance that freelist is empty but
575 // Region->isPopulatingFreeList == false because all the new populated
576 // blocks were used up right after the refillment. Therefore, we have to
577 // check if someone is still populating the freelist.
578 ScopedLock FL(Region->FLLock);
579 PopCount = popBlocksImpl(SizeClassAllocator, ClassId, Region, ToArray,
580 MaxBlockCount);
581 if (PopCount != 0U)
582 break;
583
584 if (!Region->isPopulatingFreeList)
585 continue;
586
587 // Now the freelist is empty and someone's doing the refillment. We will
588 // wait until anyone refills the freelist or someone finishes doing
589 // `populateFreeListAndPopBlocks()`. The refillment can be done by
590 // `populateFreeListAndPopBlocks()`, `pushBlocks()`,
591 // `pushBatchClassBlocks()` and `mergeGroupsToReleaseBack()`.
592 Region->FLLockCV.wait(Region->FLLock);
593
594 PopCount = popBlocksImpl(SizeClassAllocator, ClassId, Region, ToArray,
595 MaxBlockCount);
596 if (PopCount != 0U)
597 break;
598 }
599
600 return PopCount;
601}
602
603template <typename Config>
604u16 SizeClassAllocator64<Config>::popBlocksImpl(
605 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, RegionInfo *Region,
606 CompactPtrT *ToArray, const u16 MaxBlockCount) REQUIRES(Region->FLLock) {
607 if (Region->FreeListInfo.BlockList.empty())
608 return 0U;
609
610 SinglyLinkedList<BatchT> &Batches =
611 Region->FreeListInfo.BlockList.front()->Batches;
612
613 if (Batches.empty()) {
614 DCHECK_EQ(ClassId, SizeClassMap::BatchClassId);
615 BatchGroupT *BG = Region->FreeListInfo.BlockList.front();
616 Region->FreeListInfo.BlockList.pop_front();
617
618 // Block used by `BatchGroup` is from BatchClassId. Turn the block into
619 // `Batch` with single block.
620 BatchT *TB = reinterpret_cast<BatchT *>(BG);
621 ToArray[0] =
622 compactPtr(ClassId: SizeClassMap::BatchClassId, Ptr: reinterpret_cast<uptr>(TB));
623 Region->FreeListInfo.PoppedBlocks += 1;
624 return 1U;
625 }
626
627 // So far, instead of always filling blocks to `MaxBlockCount`, we only
628 // examine single `Batch` to minimize the time spent in the primary
629 // allocator. Besides, the sizes of `Batch` and
630 // `SizeClassAllocatorT::getMaxCached()` may also impact the time spent on
631 // accessing the primary allocator.
632 // TODO(chiahungduan): Evaluate if we want to always prepare `MaxBlockCount`
633 // blocks and/or adjust the size of `Batch` according to
634 // `SizeClassAllocatorT::getMaxCached()`.
635 BatchT *B = Batches.front();
636 DCHECK_NE(B, nullptr);
637 DCHECK_GT(B->getCount(), 0U);
638
639 // BachClassId should always take all blocks in the Batch. Read the
640 // comment in `pushBatchClassBlocks()` for more details.
641 const u16 PopCount = ClassId == SizeClassMap::BatchClassId
642 ? B->getCount()
643 : Min(MaxBlockCount, B->getCount());
644 B->moveNToArray(ToArray, PopCount);
645
646 // TODO(chiahungduan): The deallocation of unused BatchClassId blocks can be
647 // done without holding `FLLock`.
648 if (B->empty()) {
649 Batches.pop_front();
650 // `Batch` of BatchClassId is self-contained, no need to
651 // deallocate. Read the comment in `pushBatchClassBlocks()` for more
652 // details.
653 if (ClassId != SizeClassMap::BatchClassId)
654 SizeClassAllocator->deallocate(SizeClassMap::BatchClassId, B);
655
656 if (Batches.empty()) {
657 BatchGroupT *BG = Region->FreeListInfo.BlockList.front();
658 Region->FreeListInfo.BlockList.pop_front();
659
660 // We don't keep BatchGroup with zero blocks to avoid empty-checking
661 // while allocating. Note that block used for constructing BatchGroup is
662 // recorded as free blocks in the last element of BatchGroup::Batches.
663 // Which means, once we pop the last Batch, the block is
664 // implicitly deallocated.
665 if (ClassId != SizeClassMap::BatchClassId)
666 SizeClassAllocator->deallocate(SizeClassMap::BatchClassId, BG);
667 }
668 }
669
670 Region->FreeListInfo.PoppedBlocks += PopCount;
671
672 return PopCount;
673}
674
675template <typename Config>
676u16 SizeClassAllocator64<Config>::populateFreeListAndPopBlocks(
677 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, RegionInfo *Region,
678 CompactPtrT *ToArray, const u16 MaxBlockCount) REQUIRES(Region->MMLock)
679 EXCLUDES(Region->FLLock) {
680 if (!Config::getEnableContiguousRegions() &&
681 !Region->MemMapInfo.MemMap.isAllocated()) {
682 ReservedMemoryT ReservedMemory;
683 if (UNLIKELY(!ReservedMemory.create(/*Addr=*/0U, RegionSize,
684 "scudo:primary_reserve",
685 MAP_ALLOWNOMEM))) {
686 Printf(Format: "Can't reserve pages for size class %zu.\n",
687 getSizeByClassId(ClassId));
688 return 0U;
689 }
690 initRegion(Region, ClassId,
691 MemMap: ReservedMemory.dispatch(Addr: ReservedMemory.getBase(),
692 Size: ReservedMemory.getCapacity()),
693 /*EnableRandomOffset=*/EnableRandomOffset: false);
694 }
695
696 DCHECK(Region->MemMapInfo.MemMap.isAllocated());
697 const uptr Size = getSizeByClassId(ClassId);
698 const u16 MaxCount = SizeClassAllocatorT::getMaxCached(Size);
699 const uptr RegionBeg = Region->RegionBeg;
700 const uptr MappedUser = Region->MemMapInfo.MappedUser;
701 const uptr TotalUserBytes =
702 Region->MemMapInfo.AllocatedUser + MaxCount * Size;
703 // Map more space for blocks, if necessary.
704 if (TotalUserBytes > MappedUser) {
705 // Do the mmap for the user memory.
706 const uptr MapSize = roundUp(X: TotalUserBytes - MappedUser, Boundary: MapSizeIncrement);
707 const uptr RegionBase = RegionBeg - getRegionBaseByClassId(ClassId);
708 if (UNLIKELY(RegionBase + MappedUser + MapSize > RegionSize)) {
709 Region->Exhausted = true;
710 return 0U;
711 }
712
713 if (UNLIKELY(!Region->MemMapInfo.MemMap.remap(
714 RegionBeg + MappedUser, MapSize, "scudo:primary",
715 MAP_ALLOWNOMEM | MAP_RESIZABLE |
716 (useMemoryTagging<Config>(Options.load()) ? MAP_MEMTAG : 0)))) {
717 return 0U;
718 }
719 Region->MemMapInfo.MappedUser += MapSize;
720 SizeClassAllocator->getStats().add(StatMapped, MapSize);
721 }
722
723 const u32 NumberOfBlocks =
724 Min(A: MaxNumBatches * MaxCount,
725 B: static_cast<u32>((Region->MemMapInfo.MappedUser -
726 Region->MemMapInfo.AllocatedUser) /
727 Size));
728 DCHECK_GT(NumberOfBlocks, 0);
729
730 constexpr u32 ShuffleArraySize = MaxNumBatches * MaxNumBlocksInBatch;
731 CompactPtrT ShuffleArray[ShuffleArraySize];
732 DCHECK_LE(NumberOfBlocks, ShuffleArraySize);
733
734 const uptr CompactPtrBase = getCompactPtrBaseByClassId(ClassId);
735 uptr P = RegionBeg + Region->MemMapInfo.AllocatedUser;
736 for (u32 I = 0; I < NumberOfBlocks; I++, P += Size)
737 ShuffleArray[I] = compactPtrInternal(Base: CompactPtrBase, Ptr: P);
738
739 ScopedLock L(Region->FLLock);
740
741 if (ClassId != SizeClassMap::BatchClassId) {
742 u32 N = 1;
743 uptr CurGroup = compactPtrGroup(CompactPtr: ShuffleArray[0]);
744 for (u32 I = 1; I < NumberOfBlocks; I++) {
745 if (UNLIKELY(compactPtrGroup(ShuffleArray[I]) != CurGroup)) {
746 shuffle(ShuffleArray + I - N, N, &Region->RandState);
747 pushBlocksImpl(SizeClassAllocator, ClassId, Region,
748 Array: ShuffleArray + I - N, Size: N,
749 /*SameGroup=*/SameGroup: true);
750 N = 1;
751 CurGroup = compactPtrGroup(CompactPtr: ShuffleArray[I]);
752 } else {
753 ++N;
754 }
755 }
756
757 shuffle(ShuffleArray + NumberOfBlocks - N, N, &Region->RandState);
758 pushBlocksImpl(SizeClassAllocator, ClassId, Region,
759 Array: &ShuffleArray[NumberOfBlocks - N], Size: N,
760 /*SameGroup=*/SameGroup: true);
761 } else {
762 pushBatchClassBlocks(Region, Array: ShuffleArray, Size: NumberOfBlocks);
763 }
764
765 const u16 PopCount = popBlocksImpl(SizeClassAllocator, ClassId, Region,
766 ToArray, MaxBlockCount);
767 DCHECK_NE(PopCount, 0U);
768
769 // Note that `PushedBlocks` and `PoppedBlocks` are supposed to only record
770 // the requests from `PushBlocks` and `PopBatch` which are external
771 // interfaces. `populateFreeListAndPopBlocks` is the internal interface so
772 // we should set the values back to avoid incorrectly setting the stats.
773 Region->FreeListInfo.PushedBlocks -= NumberOfBlocks;
774
775 const uptr AllocatedUser = Size * NumberOfBlocks;
776 SizeClassAllocator->getStats().add(StatFree, AllocatedUser);
777 Region->MemMapInfo.AllocatedUser += AllocatedUser;
778
779 return PopCount;
780}
781
782template <typename Config>
783void SizeClassAllocator64<Config>::pushBlocks(
784 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, CompactPtrT *Array,
785 u32 Size) {
786 DCHECK_LT(ClassId, NumClasses);
787 DCHECK_GT(Size, 0);
788
789 RegionInfo *Region = getRegionInfo(ClassId);
790 if (ClassId == SizeClassMap::BatchClassId) {
791 ScopedLock L(Region->FLLock);
792 pushBatchClassBlocks(Region, Array, Size);
793 if (conditionVariableEnabled())
794 Region->FLLockCV.notifyAll(Region->FLLock);
795 return;
796 }
797
798 // TODO(chiahungduan): Consider not doing grouping if the group size is not
799 // greater than the block size with a certain scale.
800 bool SameGroup = true;
801 if (GroupSizeLog < RegionSizeLog && Size > 1) {
802 // Sort the blocks such that blocks belonging to the same group are
803 // ordered together.
804 uptr FirstPtrGroup = compactPtrGroup(CompactPtr: Array[0]);
805 for (u32 I = 1; I < Size; ++I) {
806 CompactPtrT Cur = Array[I];
807 uptr CurPtrGroup = compactPtrGroup(CompactPtr: Cur);
808 SameGroup = SameGroup && CurPtrGroup == FirstPtrGroup;
809 if (!SameGroup) {
810 // Sorting only necessary if there are different groups.
811 u32 J = I;
812 while (J > 0 && CurPtrGroup < compactPtrGroup(CompactPtr: Array[J - 1])) {
813 Array[J] = Array[J - 1];
814 --J;
815 }
816 Array[J] = Cur;
817 }
818 }
819 }
820
821 {
822 ScopedLock L(Region->FLLock);
823 pushBlocksImpl(SizeClassAllocator, ClassId, Region, Array, Size, SameGroup);
824 if (conditionVariableEnabled())
825 Region->FLLockCV.notifyAll(Region->FLLock);
826 }
827}
828
829// Push the blocks to their batch group. The layout will be like,
830//
831// FreeListInfo.BlockList - > BG -> BG -> BG
832// | | |
833// v v v
834// TB TB TB
835// |
836// v
837// TB
838//
839// Each BlockGroup(BG) will associate with unique group id and the free blocks
840// are managed by a list of Batch(TB). To reduce the time of inserting blocks,
841// BGs are sorted and the input `Array` are supposed to be sorted so that we can
842// get better performance of maintaining sorted property. Use `SameGroup=true`
843// to indicate that all blocks in the array are from the same group then we will
844// skip checking the group id of each block.
845template <typename Config>
846void SizeClassAllocator64<Config>::pushBlocksImpl(
847 SizeClassAllocatorT *SizeClassAllocator, uptr ClassId, RegionInfo *Region,
848 CompactPtrT *Array, u32 Size, bool SameGroup) REQUIRES(Region->FLLock) {
849 DCHECK_NE(ClassId, SizeClassMap::BatchClassId);
850 DCHECK_GT(Size, 0U);
851
852 auto CreateGroup = [&](uptr CompactPtrGroupBase) {
853 BatchGroupT *BG = reinterpret_cast<BatchGroupT *>(
854 SizeClassAllocator->getBatchClassBlock());
855 BG->Batches.clear();
856 BatchT *TB =
857 reinterpret_cast<BatchT *>(SizeClassAllocator->getBatchClassBlock());
858 TB->clear();
859
860 BG->CompactPtrGroupBase = CompactPtrGroupBase;
861 BG->Batches.push_front(TB);
862 BG->BytesInBGAtLastCheckpoint = 0;
863 BG->MaxCachedPerBatch = MaxNumBlocksInBatch;
864
865 return BG;
866 };
867
868 auto InsertBlocks = [&](BatchGroupT *BG, CompactPtrT *Array, u32 Size) {
869 SinglyLinkedList<BatchT> &Batches = BG->Batches;
870 BatchT *CurBatch = Batches.front();
871 DCHECK_NE(CurBatch, nullptr);
872
873 for (u32 I = 0; I < Size;) {
874 DCHECK_GE(BG->MaxCachedPerBatch, CurBatch->getCount());
875 u16 UnusedSlots =
876 static_cast<u16>(BG->MaxCachedPerBatch - CurBatch->getCount());
877 if (UnusedSlots == 0) {
878 CurBatch = reinterpret_cast<BatchT *>(
879 SizeClassAllocator->getBatchClassBlock());
880 CurBatch->clear();
881 Batches.push_front(CurBatch);
882 UnusedSlots = BG->MaxCachedPerBatch;
883 }
884 // `UnusedSlots` is u16 so the result will be also fit in u16.
885 u16 AppendSize = static_cast<u16>(Min<u32>(A: UnusedSlots, B: Size - I));
886 CurBatch->appendFromArray(&Array[I], AppendSize);
887 I += AppendSize;
888 }
889 };
890
891 Region->FreeListInfo.PushedBlocks += Size;
892 BatchGroupT *Cur = Region->FreeListInfo.BlockList.front();
893
894 // In the following, `Cur` always points to the BatchGroup for blocks that
895 // will be pushed next. `Prev` is the element right before `Cur`.
896 BatchGroupT *Prev = nullptr;
897
898 while (Cur != nullptr &&
899 compactPtrGroup(CompactPtr: Array[0]) > Cur->CompactPtrGroupBase) {
900 Prev = Cur;
901 Cur = Cur->Next;
902 }
903
904 if (Cur == nullptr || compactPtrGroup(CompactPtr: Array[0]) != Cur->CompactPtrGroupBase) {
905 Cur = CreateGroup(compactPtrGroup(CompactPtr: Array[0]));
906 if (Prev == nullptr)
907 Region->FreeListInfo.BlockList.push_front(Cur);
908 else
909 Region->FreeListInfo.BlockList.insert(Prev, Cur);
910 }
911
912 // All the blocks are from the same group, just push without checking group
913 // id.
914 if (SameGroup) {
915 for (u32 I = 0; I < Size; ++I)
916 DCHECK_EQ(compactPtrGroup(Array[I]), Cur->CompactPtrGroupBase);
917
918 InsertBlocks(Cur, Array, Size);
919 return;
920 }
921
922 // The blocks are sorted by group id. Determine the segment of group and
923 // push them to their group together.
924 u32 Count = 1;
925 for (u32 I = 1; I < Size; ++I) {
926 if (compactPtrGroup(CompactPtr: Array[I - 1]) != compactPtrGroup(CompactPtr: Array[I])) {
927 DCHECK_EQ(compactPtrGroup(Array[I - 1]), Cur->CompactPtrGroupBase);
928 InsertBlocks(Cur, Array + I - Count, Count);
929
930 while (Cur != nullptr &&
931 compactPtrGroup(CompactPtr: Array[I]) > Cur->CompactPtrGroupBase) {
932 Prev = Cur;
933 Cur = Cur->Next;
934 }
935
936 if (Cur == nullptr ||
937 compactPtrGroup(CompactPtr: Array[I]) != Cur->CompactPtrGroupBase) {
938 Cur = CreateGroup(compactPtrGroup(CompactPtr: Array[I]));
939 DCHECK_NE(Prev, nullptr);
940 Region->FreeListInfo.BlockList.insert(Prev, Cur);
941 }
942
943 Count = 1;
944 } else {
945 ++Count;
946 }
947 }
948
949 InsertBlocks(Cur, Array + Size - Count, Count);
950}
951
952template <typename Config>
953void SizeClassAllocator64<Config>::pushBatchClassBlocks(RegionInfo *Region,
954 CompactPtrT *Array,
955 u32 Size)
956 REQUIRES(Region->FLLock) {
957 DCHECK_EQ(Region, getRegionInfo(SizeClassMap::BatchClassId));
958
959 // Free blocks are recorded by Batch in freelist for all
960 // size-classes. In addition, Batch is allocated from BatchClassId.
961 // In order not to use additional block to record the free blocks in
962 // BatchClassId, they are self-contained. I.e., A Batch records the
963 // block address of itself. See the figure below:
964 //
965 // Batch at 0xABCD
966 // +----------------------------+
967 // | Free blocks' addr |
968 // | +------+------+------+ |
969 // | |0xABCD|... |... | |
970 // | +------+------+------+ |
971 // +----------------------------+
972 //
973 // When we allocate all the free blocks in the Batch, the block used
974 // by Batch is also free for use. We don't need to recycle the
975 // Batch. Note that the correctness is maintained by the invariant,
976 //
977 // Each popBlocks() request returns the entire Batch. Returning
978 // part of the blocks in a Batch is invalid.
979 //
980 // This ensures that Batch won't leak the address itself while it's
981 // still holding other valid data.
982 //
983 // Besides, BatchGroup is also allocated from BatchClassId and has its
984 // address recorded in the Batch too. To maintain the correctness,
985 //
986 // The address of BatchGroup is always recorded in the last Batch
987 // in the freelist (also imply that the freelist should only be
988 // updated with push_front). Once the last Batch is popped,
989 // the block used by BatchGroup is also free for use.
990 //
991 // With this approach, the blocks used by BatchGroup and Batch are
992 // reusable and don't need additional space for them.
993
994 Region->FreeListInfo.PushedBlocks += Size;
995 BatchGroupT *BG = Region->FreeListInfo.BlockList.front();
996
997 if (BG == nullptr) {
998 // Construct `BatchGroup` on the last element.
999 BG = reinterpret_cast<BatchGroupT *>(
1000 decompactPtr(ClassId: SizeClassMap::BatchClassId, CompactPtr: Array[Size - 1]));
1001 --Size;
1002 BG->Batches.clear();
1003 // BatchClass hasn't enabled memory group. Use `0` to indicate there's no
1004 // memory group here.
1005 BG->CompactPtrGroupBase = 0;
1006 BG->BytesInBGAtLastCheckpoint = 0;
1007 BG->MaxCachedPerBatch = SizeClassAllocatorT::getMaxCached(
1008 getSizeByClassId(ClassId: SizeClassMap::BatchClassId));
1009
1010 Region->FreeListInfo.BlockList.push_front(BG);
1011 }
1012
1013 if (UNLIKELY(Size == 0))
1014 return;
1015
1016 // This happens under 2 cases.
1017 // 1. just allocated a new `BatchGroup`.
1018 // 2. Only 1 block is pushed when the freelist is empty.
1019 if (BG->Batches.empty()) {
1020 // Construct the `Batch` on the last element.
1021 BatchT *TB = reinterpret_cast<BatchT *>(
1022 decompactPtr(ClassId: SizeClassMap::BatchClassId, CompactPtr: Array[Size - 1]));
1023 TB->clear();
1024 // As mentioned above, addresses of `Batch` and `BatchGroup` are
1025 // recorded in the Batch.
1026 TB->add(Array[Size - 1]);
1027 TB->add(compactPtr(ClassId: SizeClassMap::BatchClassId, Ptr: reinterpret_cast<uptr>(BG)));
1028 --Size;
1029 BG->Batches.push_front(TB);
1030 }
1031
1032 BatchT *CurBatch = BG->Batches.front();
1033 DCHECK_NE(CurBatch, nullptr);
1034
1035 for (u32 I = 0; I < Size;) {
1036 u16 UnusedSlots =
1037 static_cast<u16>(BG->MaxCachedPerBatch - CurBatch->getCount());
1038 if (UnusedSlots == 0) {
1039 CurBatch = reinterpret_cast<BatchT *>(
1040 decompactPtr(ClassId: SizeClassMap::BatchClassId, CompactPtr: Array[I]));
1041 CurBatch->clear();
1042 // Self-contained
1043 CurBatch->add(Array[I]);
1044 ++I;
1045 // TODO(chiahungduan): Avoid the use of push_back() in `Batches` of
1046 // BatchClassId.
1047 BG->Batches.push_front(CurBatch);
1048 UnusedSlots = static_cast<u16>(BG->MaxCachedPerBatch - 1);
1049 }
1050 // `UnusedSlots` is u16 so the result will be also fit in u16.
1051 const u16 AppendSize = static_cast<u16>(Min<u32>(A: UnusedSlots, B: Size - I));
1052 CurBatch->appendFromArray(&Array[I], AppendSize);
1053 I += AppendSize;
1054 }
1055}
1056
1057template <typename Config>
1058void SizeClassAllocator64<Config>::disable() NO_THREAD_SAFETY_ANALYSIS {
1059 // The BatchClassId must be locked last since other classes can use it.
1060 for (sptr I = static_cast<sptr>(NumClasses) - 1; I >= 0; I--) {
1061 if (static_cast<uptr>(I) == SizeClassMap::BatchClassId)
1062 continue;
1063 getRegionInfo(ClassId: static_cast<uptr>(I))->MMLock.lock();
1064 getRegionInfo(ClassId: static_cast<uptr>(I))->FLLock.lock();
1065 }
1066 getRegionInfo(ClassId: SizeClassMap::BatchClassId)->MMLock.lock();
1067 getRegionInfo(ClassId: SizeClassMap::BatchClassId)->FLLock.lock();
1068}
1069
1070template <typename Config>
1071void SizeClassAllocator64<Config>::enable() NO_THREAD_SAFETY_ANALYSIS {
1072 getRegionInfo(ClassId: SizeClassMap::BatchClassId)->FLLock.unlock();
1073 getRegionInfo(ClassId: SizeClassMap::BatchClassId)->MMLock.unlock();
1074 for (uptr I = 0; I < NumClasses; I++) {
1075 if (I == SizeClassMap::BatchClassId)
1076 continue;
1077 getRegionInfo(ClassId: I)->FLLock.unlock();
1078 getRegionInfo(ClassId: I)->MMLock.unlock();
1079 }
1080}
1081
1082template <typename Config>
1083template <typename F>
1084void SizeClassAllocator64<Config>::iterateOverBlocks(F Callback) {
1085 for (uptr I = 0; I < NumClasses; I++) {
1086 if (I == SizeClassMap::BatchClassId)
1087 continue;
1088 RegionInfo *Region = getRegionInfo(ClassId: I);
1089 // TODO: The call of `iterateOverBlocks` requires disabling
1090 // SizeClassAllocator64. We may consider locking each region on demand
1091 // only.
1092 Region->FLLock.assertHeld();
1093 Region->MMLock.assertHeld();
1094 const uptr BlockSize = getSizeByClassId(ClassId: I);
1095 const uptr From = Region->RegionBeg;
1096 const uptr To = From + Region->MemMapInfo.AllocatedUser;
1097 for (uptr Block = From; Block < To; Block += BlockSize)
1098 Callback(Block);
1099 }
1100}
1101
1102template <typename Config>
1103void SizeClassAllocator64<Config>::getStats(ScopedString *Str) {
1104 // TODO(kostyak): get the RSS per region.
1105 Str->append(Format: "\nConfig Stats Primary64: ");
1106 Config::getConfigValues(Str);
1107 uptr TotalMapped = 0;
1108 uptr PoppedBlocks = 0;
1109 uptr PushedBlocks = 0;
1110 for (uptr I = 0; I < NumClasses; I++) {
1111 RegionInfo *Region = getRegionInfo(ClassId: I);
1112 {
1113 ScopedLock L(Region->MMLock);
1114 TotalMapped += Region->MemMapInfo.MappedUser;
1115 }
1116 {
1117 ScopedLock L(Region->FLLock);
1118 PoppedBlocks += Region->FreeListInfo.PoppedBlocks;
1119 PushedBlocks += Region->FreeListInfo.PushedBlocks;
1120 }
1121 }
1122 const s32 IntervalMs = atomic_load_relaxed(A: &ReleaseToOsIntervalMs);
1123 Str->append(Format: "Stats: SizeClassAllocator64: %zuM mapped (%uM rss) in %zu "
1124 "allocations; remains %zu; ReleaseToOsIntervalMs = %d\n",
1125 TotalMapped >> 20, 0U, PoppedBlocks, PoppedBlocks - PushedBlocks,
1126 IntervalMs >= 0 ? IntervalMs : -1);
1127
1128 for (uptr I = 0; I < NumClasses; I++) {
1129 RegionInfo *Region = getRegionInfo(ClassId: I);
1130 ScopedLock L1(Region->MMLock);
1131 ScopedLock L2(Region->FLLock);
1132 getStats(Str, I, Region);
1133 }
1134}
1135
1136template <typename Config>
1137void SizeClassAllocator64<Config>::getStats(ScopedString *Str, uptr ClassId,
1138 RegionInfo *Region)
1139 REQUIRES(Region->MMLock, Region->FLLock) {
1140 if (Region->MemMapInfo.MappedUser == 0)
1141 return;
1142 const uptr BlockSize = getSizeByClassId(ClassId);
1143 const uptr InUseBlocks =
1144 Region->FreeListInfo.PoppedBlocks - Region->FreeListInfo.PushedBlocks;
1145 const uptr BytesInFreeList =
1146 Region->MemMapInfo.AllocatedUser - InUseBlocks * BlockSize;
1147 uptr RegionPushedBytesDelta = 0;
1148 if (BytesInFreeList >= Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint) {
1149 RegionPushedBytesDelta =
1150 BytesInFreeList - Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint;
1151 }
1152 const uptr TotalChunks = Region->MemMapInfo.AllocatedUser / BlockSize;
1153 Str->append(
1154 "%s %02zu (%6zu): mapped: %6zuK popped: %7zu pushed: %7zu "
1155 "inuse: %6zu total: %6zu releases attempted: %6zu last "
1156 "released: %6zuK latest pushed bytes: %6zuK region: 0x%zx "
1157 "(0x%zx)",
1158 Region->Exhausted ? "E" : " ", ClassId, getSizeByClassId(ClassId),
1159 Region->MemMapInfo.MappedUser >> 10, Region->FreeListInfo.PoppedBlocks,
1160 Region->FreeListInfo.PushedBlocks, InUseBlocks, TotalChunks,
1161 Region->ReleaseInfo.NumReleasesAttempted,
1162 Region->ReleaseInfo.LastReleasedBytes >> 10, RegionPushedBytesDelta >> 10,
1163 Region->RegionBeg, getRegionBaseByClassId(ClassId));
1164 const u64 CurTimeNs = getMonotonicTimeFast();
1165 const u64 LastReleaseAtNs = Region->ReleaseInfo.LastReleaseAtNs;
1166 if (LastReleaseAtNs != 0 && CurTimeNs != LastReleaseAtNs) {
1167 const u64 DiffSinceLastReleaseNs =
1168 CurTimeNs - Region->ReleaseInfo.LastReleaseAtNs;
1169 const u64 LastReleaseSecAgo = DiffSinceLastReleaseNs / 1000000000;
1170 const u64 LastReleaseMsAgo =
1171 (DiffSinceLastReleaseNs % 1000000000) / 1000000;
1172 Str->append(Format: " Latest release: %6" PRIu64 ":%03" PRIu64 " seconds ago",
1173 LastReleaseSecAgo, LastReleaseMsAgo);
1174 }
1175 const s64 ResidentPages = Region->MemMapInfo.MemMap.getResidentPages();
1176 if (ResidentPages >= 0) {
1177 Str->append(Format: " Resident Pages: %6" PRIu64, ResidentPages);
1178 }
1179 Str->append(Format: "\n");
1180}
1181
1182template <typename Config>
1183void SizeClassAllocator64<Config>::getFragmentationInfo(ScopedString *Str) {
1184 Str->append(
1185 Format: "Fragmentation Stats: SizeClassAllocator64: page size = %zu bytes\n",
1186 getPageSizeCached());
1187
1188 for (uptr I = 1; I < NumClasses; I++) {
1189 RegionInfo *Region = getRegionInfo(ClassId: I);
1190 ScopedLock L(Region->MMLock);
1191 getRegionFragmentationInfo(Region, ClassId: I, Str);
1192 }
1193}
1194
1195template <typename Config>
1196void SizeClassAllocator64<Config>::getRegionFragmentationInfo(
1197 RegionInfo *Region, uptr ClassId, ScopedString *Str)
1198 REQUIRES(Region->MMLock) {
1199 const uptr BlockSize = getSizeByClassId(ClassId);
1200 const uptr AllocatedUserEnd =
1201 Region->MemMapInfo.AllocatedUser + Region->RegionBeg;
1202
1203 SinglyLinkedList<BatchGroupT> GroupsToRelease;
1204 {
1205 ScopedLock L(Region->FLLock);
1206 GroupsToRelease = Region->FreeListInfo.BlockList;
1207 Region->FreeListInfo.BlockList.clear();
1208 }
1209
1210 FragmentationRecorder Recorder;
1211 if (!GroupsToRelease.empty()) {
1212 PageReleaseContext Context =
1213 markFreeBlocks(Region, BlockSize, AllocatedUserEnd,
1214 CompactPtrBase: getCompactPtrBaseByClassId(ClassId), GroupsToRelease);
1215 auto SkipRegion = [](UNUSED uptr RegionIndex) { return false; };
1216 releaseFreeMemoryToOS(Context, Recorder, SkipRegion);
1217
1218 mergeGroupsToReleaseBack(Region, GroupsToRelease);
1219 }
1220
1221 ScopedLock L(Region->FLLock);
1222 const uptr PageSize = getPageSizeCached();
1223 const uptr TotalBlocks = Region->MemMapInfo.AllocatedUser / BlockSize;
1224 const uptr InUseBlocks =
1225 Region->FreeListInfo.PoppedBlocks - Region->FreeListInfo.PushedBlocks;
1226 const uptr AllocatedPagesCount =
1227 roundUp(Region->MemMapInfo.AllocatedUser, PageSize) / PageSize;
1228 DCHECK_GE(AllocatedPagesCount, Recorder.getReleasedPagesCount());
1229 const uptr InUsePages =
1230 AllocatedPagesCount - Recorder.getReleasedPagesCount();
1231 const uptr InUseBytes = InUsePages * PageSize;
1232
1233 uptr Integral;
1234 uptr Fractional;
1235 computePercentage(Numerator: BlockSize * InUseBlocks, Denominator: InUseBytes, Integral: &Integral,
1236 Fractional: &Fractional);
1237 Str->append(Format: " %02zu (%6zu): inuse/total blocks: %6zu/%6zu inuse/total "
1238 "pages: %6zu/%6zu inuse bytes: %6zuK util: %3zu.%02zu%%\n",
1239 ClassId, BlockSize, InUseBlocks, TotalBlocks, InUsePages,
1240 AllocatedPagesCount, InUseBytes >> 10, Integral, Fractional);
1241}
1242
1243template <typename Config>
1244void SizeClassAllocator64<Config>::getMemoryGroupFragmentationInfoInRegion(
1245 RegionInfo *Region, uptr ClassId, ScopedString *Str)
1246 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock) {
1247 const uptr BlockSize = getSizeByClassId(ClassId);
1248 const uptr AllocatedUserEnd =
1249 Region->MemMapInfo.AllocatedUser + Region->RegionBeg;
1250
1251 SinglyLinkedList<BatchGroupT> GroupsToRelease;
1252 {
1253 ScopedLock L(Region->FLLock);
1254 GroupsToRelease = Region->FreeListInfo.BlockList;
1255 Region->FreeListInfo.BlockList.clear();
1256 }
1257
1258 constexpr uptr GroupSize = (1UL << GroupSizeLog);
1259 constexpr uptr MaxNumGroups = RegionSize / GroupSize;
1260
1261 MemoryGroupFragmentationRecorder<GroupSize, MaxNumGroups> Recorder;
1262 if (!GroupsToRelease.empty()) {
1263 PageReleaseContext Context =
1264 markFreeBlocks(Region, BlockSize, AllocatedUserEnd,
1265 CompactPtrBase: getCompactPtrBaseByClassId(ClassId), GroupsToRelease);
1266 auto SkipRegion = [](UNUSED uptr RegionIndex) { return false; };
1267 releaseFreeMemoryToOS(Context, Recorder, SkipRegion);
1268
1269 mergeGroupsToReleaseBack(Region, GroupsToRelease);
1270 }
1271
1272 Str->append(Format: "MemoryGroupFragmentationInfo in Region %zu (%zu)\n", ClassId,
1273 BlockSize);
1274
1275 const uptr MaxNumGroupsInUse =
1276 roundUp(Region->MemMapInfo.AllocatedUser, GroupSize) / GroupSize;
1277 for (uptr I = 0; I < MaxNumGroupsInUse; ++I) {
1278 uptr Integral;
1279 uptr Fractional;
1280 computePercentage(Recorder.NumPagesInOneGroup - Recorder.getNumFreePages(I),
1281 Recorder.NumPagesInOneGroup, &Integral, &Fractional);
1282 Str->append("MemoryGroup #%zu (0x%zx): util: %3zu.%02zu%%\n", I,
1283 Region->RegionBeg + I * GroupSize, Integral, Fractional);
1284 }
1285}
1286
1287template <typename Config>
1288void SizeClassAllocator64<Config>::getMemoryGroupFragmentationInfo(
1289 ScopedString *Str) {
1290 Str->append(
1291 Format: "Fragmentation Stats: SizeClassAllocator64: page size = %zu bytes\n",
1292 getPageSizeCached());
1293
1294 for (uptr I = 1; I < NumClasses; I++) {
1295 RegionInfo *Region = getRegionInfo(ClassId: I);
1296 ScopedLock L(Region->MMLock);
1297 getMemoryGroupFragmentationInfoInRegion(Region, ClassId: I, Str);
1298 }
1299}
1300
1301template <typename Config>
1302bool SizeClassAllocator64<Config>::setOption(Option O, sptr Value) {
1303 if (O == Option::ReleaseInterval) {
1304 const s32 Interval =
1305 Max(Min(static_cast<s32>(Value), Config::getMaxReleaseToOsIntervalMs()),
1306 Config::getMinReleaseToOsIntervalMs());
1307 atomic_store_relaxed(A: &ReleaseToOsIntervalMs, V: Interval);
1308 return true;
1309 }
1310 // Not supported by the Primary, but not an error either.
1311 return true;
1312}
1313
1314template <typename Config>
1315uptr SizeClassAllocator64<Config>::tryReleaseToOS(uptr ClassId,
1316 ReleaseToOS ReleaseType) {
1317 RegionInfo *Region = getRegionInfo(ClassId);
1318 // Note that the tryLock() may fail spuriously, given that it should rarely
1319 // happen and page releasing is fine to skip, we don't take certain
1320 // approaches to ensure one page release is done.
1321 if (Region->MMLock.tryLock()) {
1322 uptr BytesReleased = releaseToOSMaybe(Region, ClassId, ReleaseType);
1323 Region->MMLock.unlock();
1324 return BytesReleased;
1325 }
1326 return 0;
1327}
1328
1329template <typename Config>
1330uptr SizeClassAllocator64<Config>::releaseToOS(ReleaseToOS ReleaseType) {
1331 SCUDO_SCOPED_TRACE(GetPrimaryReleaseToOSTraceName(ReleaseType));
1332
1333 uptr TotalReleasedBytes = 0;
1334 for (uptr I = 0; I < NumClasses; I++) {
1335 if (I == SizeClassMap::BatchClassId)
1336 continue;
1337 RegionInfo *Region = getRegionInfo(ClassId: I);
1338 if (ReleaseType == ReleaseToOS::ForceFast) {
1339 // Never wait for the lock, always move on if there is already
1340 // a release operation in progress.
1341 if (Region->MMLock.tryLock()) {
1342 TotalReleasedBytes += releaseToOSMaybe(Region, ClassId: I, ReleaseType);
1343 Region->MMLock.unlock();
1344 }
1345 } else {
1346 ScopedLock L(Region->MMLock);
1347 TotalReleasedBytes += releaseToOSMaybe(Region, ClassId: I, ReleaseType);
1348 }
1349 }
1350 return TotalReleasedBytes;
1351}
1352
1353template <typename Config>
1354BlockInfo SizeClassAllocator64<Config>::findNearestBlock(uptr Ptr)
1355 NO_THREAD_SAFETY_ANALYSIS {
1356 uptr ClassId;
1357 uptr MinDistance = -1UL;
1358 for (uptr I = 0; I != NumClasses; ++I) {
1359 if (I == SizeClassMap::BatchClassId)
1360 continue;
1361
1362 ScopedLock ML(RegionInfoArray[I].MMLock);
1363 uptr Begin = RegionInfoArray[I].RegionBeg;
1364 uptr End = Begin + RegionInfoArray[I].MemMapInfo.AllocatedUser;
1365 if (Begin > End || End - Begin < SizeClassMap::getSizeByClassId(I))
1366 continue;
1367 uptr RegionDistance;
1368 if (Begin <= Ptr) {
1369 if (Ptr < End)
1370 RegionDistance = 0;
1371 else
1372 RegionDistance = Ptr - End;
1373 } else {
1374 RegionDistance = Begin - Ptr;
1375 }
1376
1377 if (RegionDistance < MinDistance) {
1378 MinDistance = RegionDistance;
1379 ClassId = I;
1380 if (RegionDistance == 0)
1381 break;
1382 }
1383 }
1384
1385 if (MinDistance > 8192) {
1386 return {};
1387 }
1388
1389 ScopedLock ML(RegionInfoArray[ClassId].MMLock);
1390 BlockInfo B = {};
1391 B.RegionBegin = RegionInfoArray[ClassId].RegionBeg;
1392 B.RegionEnd =
1393 B.RegionBegin + RegionInfoArray[ClassId].MemMapInfo.AllocatedUser;
1394 B.BlockSize = SizeClassMap::getSizeByClassId(ClassId);
1395 B.BlockBegin = B.RegionBegin + uptr(sptr(Ptr - B.RegionBegin) /
1396 sptr(B.BlockSize) * sptr(B.BlockSize));
1397 while (B.BlockBegin < B.RegionBegin)
1398 B.BlockBegin += B.BlockSize;
1399 while (B.RegionEnd < B.BlockBegin + B.BlockSize)
1400 B.BlockBegin -= B.BlockSize;
1401 return B;
1402}
1403
1404template <typename Config>
1405uptr SizeClassAllocator64<Config>::releaseToOSMaybe(RegionInfo *Region,
1406 uptr ClassId,
1407 ReleaseToOS ReleaseType)
1408 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock) {
1409 const uptr BlockSize = getSizeByClassId(ClassId);
1410 uptr BytesInFreeList;
1411 const uptr AllocatedUserEnd =
1412 Region->MemMapInfo.AllocatedUser + Region->RegionBeg;
1413 uptr RegionPushedBytesDelta = 0;
1414 SinglyLinkedList<BatchGroupT> GroupsToRelease;
1415
1416 {
1417 ScopedLock L(Region->FLLock);
1418
1419 BytesInFreeList =
1420 Region->MemMapInfo.AllocatedUser - (Region->FreeListInfo.PoppedBlocks -
1421 Region->FreeListInfo.PushedBlocks) *
1422 BlockSize;
1423 if (UNLIKELY(BytesInFreeList == 0))
1424 return 0;
1425
1426 // ==================================================================== //
1427 // 1. Check if we have enough free blocks and if it's worth doing a page
1428 // release.
1429 // ==================================================================== //
1430 if (ReleaseType != ReleaseToOS::ForceAll &&
1431 !hasChanceToReleasePages(Region, BlockSize, BytesInFreeList,
1432 ReleaseType)) {
1433 return 0;
1434 }
1435
1436 // Given that we will unlock the freelist for block operations, cache the
1437 // value here so that when we are adapting the `TryReleaseThreshold`
1438 // later, we are using the right metric.
1439 RegionPushedBytesDelta =
1440 BytesInFreeList - Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint;
1441
1442 // ==================================================================== //
1443 // 2. Determine which groups can release the pages. Use a heuristic to
1444 // gather groups that are candidates for doing a release.
1445 // ==================================================================== //
1446 if (ReleaseType == ReleaseToOS::ForceAll) {
1447 GroupsToRelease = Region->FreeListInfo.BlockList;
1448 Region->FreeListInfo.BlockList.clear();
1449 } else {
1450 GroupsToRelease =
1451 collectGroupsToRelease(Region, BlockSize, AllocatedUserEnd,
1452 CompactPtrBase: getCompactPtrBaseByClassId(ClassId));
1453 }
1454 if (GroupsToRelease.empty())
1455 return 0;
1456 }
1457
1458 // The following steps contribute to the majority time spent in page
1459 // releasing thus we increment the counter here.
1460 ++Region->ReleaseInfo.NumReleasesAttempted;
1461
1462 // Note that we have extracted the `GroupsToRelease` from region freelist.
1463 // It's safe to let pushBlocks()/popBlocks() access the remaining region
1464 // freelist. In the steps 3 and 4, we will temporarily release the FLLock
1465 // and lock it again before step 5.
1466
1467 // ==================================================================== //
1468 // 3. Mark the free blocks in `GroupsToRelease` in the `PageReleaseContext`.
1469 // Then we can tell which pages are in-use by querying
1470 // `PageReleaseContext`.
1471 // ==================================================================== //
1472
1473 // Only add trace point after the quick returns have occurred to avoid
1474 // incurring performance penalties. Most of the time in this function
1475 // will be the mark free blocks call and the actual release to OS call.
1476 SCUDO_SCOPED_TRACE(GetPrimaryReleaseToOSMaybeTraceName(ReleaseType));
1477
1478 PageReleaseContext Context =
1479 markFreeBlocks(Region, BlockSize, AllocatedUserEnd,
1480 CompactPtrBase: getCompactPtrBaseByClassId(ClassId), GroupsToRelease);
1481 if (UNLIKELY(!Context.hasBlockMarked())) {
1482 mergeGroupsToReleaseBack(Region, GroupsToRelease);
1483 return 0;
1484 }
1485
1486 // ==================================================================== //
1487 // 4. Release the unused physical pages back to the OS.
1488 // ==================================================================== //
1489 RegionReleaseRecorder<MemMapT> Recorder(&Region->MemMapInfo.MemMap,
1490 Region->RegionBeg,
1491 Context.getReleaseOffset());
1492 auto SkipRegion = [](UNUSED uptr RegionIndex) { return false; };
1493 releaseFreeMemoryToOS(Context, Recorder, SkipRegion);
1494 if (Recorder.getReleasedBytes() > 0) {
1495 // This is the case that we didn't hit the release threshold but it has
1496 // been past a certain period of time. Thus we try to release some pages
1497 // and if it does release some additional pages, it's hint that we are
1498 // able to lower the threshold. Currently, this case happens when the
1499 // `RegionPushedBytesDelta` is over half of the `TryReleaseThreshold`. As
1500 // a result, we shrink the threshold to half accordingly.
1501 // TODO(chiahungduan): Apply the same adjustment strategy to small blocks.
1502 if (!isSmallBlock(BlockSize)) {
1503 if (RegionPushedBytesDelta < Region->ReleaseInfo.TryReleaseThreshold &&
1504 Recorder.getReleasedBytes() >
1505 Region->ReleaseInfo.LastReleasedBytes +
1506 getMinReleaseAttemptSize(BlockSize)) {
1507 Region->ReleaseInfo.TryReleaseThreshold =
1508 Max(Region->ReleaseInfo.TryReleaseThreshold / 2,
1509 getMinReleaseAttemptSize(BlockSize));
1510 }
1511 }
1512
1513 Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint = BytesInFreeList;
1514 Region->ReleaseInfo.LastReleasedBytes = Recorder.getReleasedBytes();
1515 }
1516 Region->ReleaseInfo.LastReleaseAtNs = getMonotonicTimeFast();
1517
1518 if (Region->ReleaseInfo.PendingPushedBytesDelta > 0) {
1519 // Instead of increasing the threshold by the amount of
1520 // `PendingPushedBytesDelta`, we only increase half of the amount so that
1521 // it won't be a leap (which may lead to higher memory pressure) because
1522 // of certain memory usage bursts which don't happen frequently.
1523 Region->ReleaseInfo.TryReleaseThreshold +=
1524 Region->ReleaseInfo.PendingPushedBytesDelta / 2;
1525 // This is another guard of avoiding the growth of threshold indefinitely.
1526 // Note that we may consider to make this configurable if we have a better
1527 // way to model this.
1528 Region->ReleaseInfo.TryReleaseThreshold = Min<uptr>(
1529 Region->ReleaseInfo.TryReleaseThreshold, (1UL << GroupSizeLog) / 2);
1530 Region->ReleaseInfo.PendingPushedBytesDelta = 0;
1531 }
1532
1533 // ====================================================================== //
1534 // 5. Merge the `GroupsToRelease` back to the freelist.
1535 // ====================================================================== //
1536 mergeGroupsToReleaseBack(Region, GroupsToRelease);
1537
1538 return Recorder.getReleasedBytes();
1539}
1540
1541template <typename Config>
1542bool SizeClassAllocator64<Config>::hasChanceToReleasePages(
1543 RegionInfo *Region, uptr BlockSize, uptr BytesInFreeList,
1544 ReleaseToOS ReleaseType) REQUIRES(Region->MMLock, Region->FLLock) {
1545 DCHECK_GE(Region->FreeListInfo.PoppedBlocks,
1546 Region->FreeListInfo.PushedBlocks);
1547 // Always update `BytesInFreeListAtLastCheckpoint` with the smallest value
1548 // so that we won't underestimate the releasable pages. For example, the
1549 // following is the region usage,
1550 //
1551 // BytesInFreeListAtLastCheckpoint AllocatedUser
1552 // v v
1553 // |--------------------------------------->
1554 // ^ ^
1555 // BytesInFreeList ReleaseThreshold
1556 //
1557 // In general, if we have collected enough bytes and the amount of free
1558 // bytes meets the ReleaseThreshold, we will try to do page release. If we
1559 // don't update `BytesInFreeListAtLastCheckpoint` when the current
1560 // `BytesInFreeList` is smaller, we may take longer time to wait for enough
1561 // freed blocks because we miss the bytes between
1562 // (BytesInFreeListAtLastCheckpoint - BytesInFreeList).
1563 if (BytesInFreeList <= Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint) {
1564 Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint = BytesInFreeList;
1565 }
1566
1567 const uptr RegionPushedBytesDelta =
1568 BytesInFreeList - Region->ReleaseInfo.BytesInFreeListAtLastCheckpoint;
1569
1570 if (ReleaseType == ReleaseToOS::Normal) {
1571 if (RegionPushedBytesDelta < Region->ReleaseInfo.TryReleaseThreshold / 2)
1572 return false;
1573
1574 const s64 IntervalMs = atomic_load_relaxed(A: &ReleaseToOsIntervalMs);
1575 if (IntervalMs < 0)
1576 return false;
1577
1578 const u64 IntervalNs = static_cast<u64>(IntervalMs) * 1000000;
1579 const u64 CurTimeNs = getMonotonicTimeFast();
1580 const u64 DiffSinceLastReleaseNs =
1581 CurTimeNs - Region->ReleaseInfo.LastReleaseAtNs;
1582
1583 // At here, `RegionPushedBytesDelta` is more than half of
1584 // `TryReleaseThreshold`. If the last release happened 2 release interval
1585 // before, we will still try to see if there's any chance to release some
1586 // memory even it doesn't exceed the threshold.
1587 if (RegionPushedBytesDelta < Region->ReleaseInfo.TryReleaseThreshold) {
1588 // We want the threshold to have a shorter response time to the variant
1589 // memory usage patterns. According to data collected during experiments
1590 // (which were done with 1, 2, 4, 8 intervals), `2` strikes the better
1591 // balance between the memory usage and number of page release attempts.
1592 if (DiffSinceLastReleaseNs < 2 * IntervalNs)
1593 return false;
1594 } else if (DiffSinceLastReleaseNs < IntervalNs) {
1595 // `TryReleaseThreshold` is capped by (1UL << GroupSizeLog) / 2). If
1596 // RegionPushedBytesDelta grows to twice the threshold, it implies some
1597 // huge deallocations have happened so we better try to release some
1598 // pages. Note this tends to happen for larger block sizes.
1599 if (RegionPushedBytesDelta > (1ULL << GroupSizeLog))
1600 return true;
1601
1602 // In this case, we are over the threshold but we just did some page
1603 // release in the same release interval. This is a hint that we may want
1604 // a higher threshold so that we can release more memory at once.
1605 // `TryReleaseThreshold` will be adjusted according to how many bytes
1606 // are not released, i.e., the `PendingPushedBytesdelta` here.
1607 // TODO(chiahungduan): Apply the same adjustment strategy to small
1608 // blocks.
1609 if (!isSmallBlock(BlockSize))
1610 Region->ReleaseInfo.PendingPushedBytesDelta = RegionPushedBytesDelta;
1611
1612 // Memory was returned recently.
1613 return false;
1614 }
1615 } // if (ReleaseType == ReleaseToOS::Normal)
1616
1617 return true;
1618}
1619
1620template <typename Config>
1621SinglyLinkedList<typename SizeClassAllocator64<Config>::BatchGroupT>
1622SizeClassAllocator64<Config>::collectGroupsToRelease(
1623 RegionInfo *Region, const uptr BlockSize, const uptr AllocatedUserEnd,
1624 const uptr CompactPtrBase) REQUIRES(Region->MMLock, Region->FLLock) {
1625 const uptr GroupSize = (1UL << GroupSizeLog);
1626 const uptr PageSize = getPageSizeCached();
1627 SinglyLinkedList<BatchGroupT> GroupsToRelease;
1628
1629 // We are examining each group and will take the minimum distance to the
1630 // release threshold as the next `TryReleaseThreshold`. Note that if the
1631 // size of free blocks has reached the release threshold, the distance to
1632 // the next release will be PageSize * SmallerBlockReleasePageDelta. See the
1633 // comment on `SmallerBlockReleasePageDelta` for more details.
1634 uptr MinDistToThreshold = GroupSize;
1635
1636 for (BatchGroupT *BG = Region->FreeListInfo.BlockList.front(),
1637 *Prev = nullptr;
1638 BG != nullptr;) {
1639 // Group boundary is always GroupSize-aligned from CompactPtr base. The
1640 // layout of memory groups is like,
1641 //
1642 // (CompactPtrBase)
1643 // #1 CompactPtrGroupBase #2 CompactPtrGroupBase ...
1644 // | | |
1645 // v v v
1646 // +-----------------------+-----------------------+
1647 // \ / \ /
1648 // --- GroupSize --- --- GroupSize ---
1649 //
1650 // After decompacting the CompactPtrGroupBase, we expect the alignment
1651 // property is held as well.
1652 const uptr BatchGroupBase =
1653 decompactGroupBase(Base: CompactPtrBase, CompactPtrGroupBase: BG->CompactPtrGroupBase);
1654 DCHECK_LE(Region->RegionBeg, BatchGroupBase);
1655 DCHECK_GE(AllocatedUserEnd, BatchGroupBase);
1656 DCHECK_EQ((Region->RegionBeg - BatchGroupBase) % GroupSize, 0U);
1657 // Batches are pushed in front of BG.Batches. The first one may
1658 // not have all caches used.
1659 const uptr NumBlocks = (BG->Batches.size() - 1) * BG->MaxCachedPerBatch +
1660 BG->Batches.front()->getCount();
1661 const uptr BytesInBG = NumBlocks * BlockSize;
1662
1663 if (BytesInBG <= BG->BytesInBGAtLastCheckpoint) {
1664 BG->BytesInBGAtLastCheckpoint = BytesInBG;
1665 Prev = BG;
1666 BG = BG->Next;
1667 continue;
1668 }
1669
1670 const uptr PushedBytesDelta = BytesInBG - BG->BytesInBGAtLastCheckpoint;
1671 if (PushedBytesDelta < getMinReleaseAttemptSize(BlockSize)) {
1672 Prev = BG;
1673 BG = BG->Next;
1674 continue;
1675 }
1676
1677 // Given the randomness property, we try to release the pages only if the
1678 // bytes used by free blocks exceed certain proportion of group size. Note
1679 // that this heuristic only applies when all the spaces in a BatchGroup
1680 // are allocated.
1681 if (isSmallBlock(BlockSize)) {
1682 const uptr BatchGroupEnd = BatchGroupBase + GroupSize;
1683 const uptr AllocatedGroupSize = AllocatedUserEnd >= BatchGroupEnd
1684 ? GroupSize
1685 : AllocatedUserEnd - BatchGroupBase;
1686 const uptr ReleaseThreshold =
1687 (AllocatedGroupSize * (100 - 1U - BlockSize / 16U)) / 100U;
1688 const bool HighDensity = BytesInBG >= ReleaseThreshold;
1689 const bool MayHaveReleasedAll = NumBlocks >= (GroupSize / BlockSize);
1690 // If all blocks in the group are released, we will do range marking
1691 // which is fast. Otherwise, we will wait until we have accumulated
1692 // a certain amount of free memory.
1693 const bool ReachReleaseDelta =
1694 MayHaveReleasedAll
1695 ? true
1696 : PushedBytesDelta >= PageSize * SmallerBlockReleasePageDelta;
1697
1698 if (!HighDensity) {
1699 DCHECK_LE(BytesInBG, ReleaseThreshold);
1700 // The following is the usage of a memory group,
1701 //
1702 // BytesInBG ReleaseThreshold
1703 // / \ v
1704 // +---+---------------------------+-----+
1705 // | | | | |
1706 // +---+---------------------------+-----+
1707 // \ / ^
1708 // PushedBytesDelta GroupEnd
1709 MinDistToThreshold =
1710 Min(A: MinDistToThreshold,
1711 B: ReleaseThreshold - BytesInBG + PushedBytesDelta);
1712 } else {
1713 // If it reaches high density at this round, the next time we will try
1714 // to release is based on SmallerBlockReleasePageDelta
1715 MinDistToThreshold =
1716 Min(A: MinDistToThreshold, B: PageSize * SmallerBlockReleasePageDelta);
1717 }
1718
1719 if (!HighDensity || !ReachReleaseDelta) {
1720 Prev = BG;
1721 BG = BG->Next;
1722 continue;
1723 }
1724 }
1725
1726 // If `BG` is the first BatchGroupT in the list, we only need to advance
1727 // `BG` and call FreeListInfo.BlockList::pop_front(). No update is needed
1728 // for `Prev`.
1729 //
1730 // (BG) (BG->Next)
1731 // Prev Cur BG
1732 // | | |
1733 // v v v
1734 // nil +--+ +--+
1735 // |X | -> | | -> ...
1736 // +--+ +--+
1737 //
1738 // Otherwise, `Prev` will be used to extract the `Cur` from the
1739 // `FreeListInfo.BlockList`.
1740 //
1741 // (BG) (BG->Next)
1742 // Prev Cur BG
1743 // | | |
1744 // v v v
1745 // +--+ +--+ +--+
1746 // | | -> |X | -> | | -> ...
1747 // +--+ +--+ +--+
1748 //
1749 // After FreeListInfo.BlockList::extract(),
1750 //
1751 // Prev Cur BG
1752 // | | |
1753 // v v v
1754 // +--+ +--+ +--+
1755 // | |-+ |X | +->| | -> ...
1756 // +--+ | +--+ | +--+
1757 // +--------+
1758 //
1759 // Note that we need to advance before pushing this BatchGroup to
1760 // GroupsToRelease because it's a destructive operation.
1761
1762 BatchGroupT *Cur = BG;
1763 BG = BG->Next;
1764
1765 // Ideally, we may want to update this only after successful release.
1766 // However, for smaller blocks, each block marking is a costly operation.
1767 // Therefore, we update it earlier.
1768 // TODO: Consider updating this after releasing pages if `ReleaseRecorder`
1769 // can tell the released bytes in each group.
1770 Cur->BytesInBGAtLastCheckpoint = BytesInBG;
1771
1772 if (Prev != nullptr)
1773 Region->FreeListInfo.BlockList.extract(Prev, Cur);
1774 else
1775 Region->FreeListInfo.BlockList.pop_front();
1776 GroupsToRelease.push_back(Cur);
1777 }
1778
1779 // Only small blocks have the adaptive `TryReleaseThreshold`.
1780 if (isSmallBlock(BlockSize)) {
1781 // If the MinDistToThreshold is not updated, that means each memory group
1782 // may have only pushed less than a page size. In that case, just set it
1783 // back to normal.
1784 if (MinDistToThreshold == GroupSize)
1785 MinDistToThreshold = PageSize * SmallerBlockReleasePageDelta;
1786 Region->ReleaseInfo.TryReleaseThreshold = MinDistToThreshold;
1787 }
1788
1789 return GroupsToRelease;
1790}
1791
1792template <typename Config>
1793PageReleaseContext SizeClassAllocator64<Config>::markFreeBlocks(
1794 RegionInfo *Region, const uptr BlockSize, const uptr AllocatedUserEnd,
1795 const uptr CompactPtrBase, SinglyLinkedList<BatchGroupT> &GroupsToRelease)
1796 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock) {
1797 const uptr GroupSize = (1UL << GroupSizeLog);
1798 auto DecompactPtr = [CompactPtrBase, this](CompactPtrT CompactPtr) {
1799 return decompactPtrInternal(Base: CompactPtrBase, CompactPtr);
1800 };
1801
1802 const uptr ReleaseBase = decompactGroupBase(
1803 Base: CompactPtrBase, CompactPtrGroupBase: GroupsToRelease.front()->CompactPtrGroupBase);
1804 const uptr LastGroupEnd =
1805 Min(decompactGroupBase(Base: CompactPtrBase,
1806 CompactPtrGroupBase: GroupsToRelease.back()->CompactPtrGroupBase) +
1807 GroupSize,
1808 AllocatedUserEnd);
1809 // The last block may straddle the group boundary. Rounding up to BlockSize
1810 // to get the exact range.
1811 const uptr ReleaseEnd =
1812 roundUpSlow(LastGroupEnd - Region->RegionBeg, BlockSize) +
1813 Region->RegionBeg;
1814 const uptr ReleaseRangeSize = ReleaseEnd - ReleaseBase;
1815 const uptr ReleaseOffset = ReleaseBase - Region->RegionBeg;
1816
1817 PageReleaseContext Context(BlockSize, /*NumberOfRegions=*/1U,
1818 ReleaseRangeSize, ReleaseOffset);
1819 // We may not be able to do the page release in a rare case that we may
1820 // fail on PageMap allocation.
1821 if (UNLIKELY(!Context.ensurePageMapAllocated()))
1822 return Context;
1823
1824 for (BatchGroupT &BG : GroupsToRelease) {
1825 const uptr BatchGroupBase =
1826 decompactGroupBase(Base: CompactPtrBase, CompactPtrGroupBase: BG.CompactPtrGroupBase);
1827 const uptr BatchGroupEnd = BatchGroupBase + GroupSize;
1828 const uptr AllocatedGroupSize = AllocatedUserEnd >= BatchGroupEnd
1829 ? GroupSize
1830 : AllocatedUserEnd - BatchGroupBase;
1831 const uptr BatchGroupUsedEnd = BatchGroupBase + AllocatedGroupSize;
1832 const bool MayContainLastBlockInRegion =
1833 BatchGroupUsedEnd == AllocatedUserEnd;
1834 const bool BlockAlignedWithUsedEnd =
1835 (BatchGroupUsedEnd - Region->RegionBeg) % BlockSize == 0;
1836
1837 uptr MaxContainedBlocks = AllocatedGroupSize / BlockSize;
1838 if (!BlockAlignedWithUsedEnd)
1839 ++MaxContainedBlocks;
1840
1841 const uptr NumBlocks = (BG.Batches.size() - 1) * BG.MaxCachedPerBatch +
1842 BG.Batches.front()->getCount();
1843
1844 if (NumBlocks == MaxContainedBlocks) {
1845 for (const auto &It : BG.Batches) {
1846 if (&It != BG.Batches.front())
1847 DCHECK_EQ(It.getCount(), BG.MaxCachedPerBatch);
1848 for (u16 I = 0; I < It.getCount(); ++I)
1849 DCHECK_EQ(compactPtrGroup(It.get(I)), BG.CompactPtrGroupBase);
1850 }
1851
1852 Context.markRangeAsAllCounted(From: BatchGroupBase, To: BatchGroupUsedEnd,
1853 Base: Region->RegionBeg, /*RegionIndex=*/RegionIndex: 0,
1854 RegionSize: Region->MemMapInfo.AllocatedUser);
1855 } else {
1856 DCHECK_LT(NumBlocks, MaxContainedBlocks);
1857 // Note that we don't always visit blocks in each BatchGroup so that we
1858 // may miss the chance of releasing certain pages that cross
1859 // BatchGroups.
1860 Context.markFreeBlocksInRegion(
1861 BG.Batches, DecompactPtr, Region->RegionBeg, /*RegionIndex=*/0,
1862 Region->MemMapInfo.AllocatedUser, MayContainLastBlockInRegion);
1863 }
1864 }
1865
1866 DCHECK(Context.hasBlockMarked());
1867
1868 return Context;
1869}
1870
1871template <typename Config>
1872void SizeClassAllocator64<Config>::mergeGroupsToReleaseBack(
1873 RegionInfo *Region, SinglyLinkedList<BatchGroupT> &GroupsToRelease)
1874 REQUIRES(Region->MMLock) EXCLUDES(Region->FLLock) {
1875 ScopedLock L(Region->FLLock);
1876
1877 // After merging two freelists, we may have redundant `BatchGroup`s that
1878 // need to be recycled. The number of unused `BatchGroup`s is expected to be
1879 // small. Pick a constant which is inferred from real programs.
1880 constexpr uptr MaxUnusedSize = 8;
1881 CompactPtrT Blocks[MaxUnusedSize];
1882 u32 Idx = 0;
1883 RegionInfo *BatchClassRegion = getRegionInfo(ClassId: SizeClassMap::BatchClassId);
1884 // We can't call pushBatchClassBlocks() to recycle the unused `BatchGroup`s
1885 // when we are manipulating the freelist of `BatchClassRegion`. Instead, we
1886 // should just push it back to the freelist when we merge two `BatchGroup`s.
1887 // This logic hasn't been implemented because we haven't supported releasing
1888 // pages in `BatchClassRegion`.
1889 DCHECK_NE(BatchClassRegion, Region);
1890
1891 // Merge GroupsToRelease back to the Region::FreeListInfo.BlockList. Note
1892 // that both `Region->FreeListInfo.BlockList` and `GroupsToRelease` are
1893 // sorted.
1894 for (BatchGroupT *BG = Region->FreeListInfo.BlockList.front(),
1895 *Prev = nullptr;
1896 ;) {
1897 if (BG == nullptr || GroupsToRelease.empty()) {
1898 if (!GroupsToRelease.empty())
1899 Region->FreeListInfo.BlockList.append_back(&GroupsToRelease);
1900 break;
1901 }
1902
1903 DCHECK(!BG->Batches.empty());
1904
1905 if (BG->CompactPtrGroupBase <
1906 GroupsToRelease.front()->CompactPtrGroupBase) {
1907 Prev = BG;
1908 BG = BG->Next;
1909 continue;
1910 }
1911
1912 BatchGroupT *Cur = GroupsToRelease.front();
1913 BatchT *UnusedBatch = nullptr;
1914 GroupsToRelease.pop_front();
1915
1916 if (BG->CompactPtrGroupBase == Cur->CompactPtrGroupBase) {
1917 // We have updated `BatchGroup::BytesInBGAtLastCheckpoint` while
1918 // collecting the `GroupsToRelease`.
1919 BG->BytesInBGAtLastCheckpoint = Cur->BytesInBGAtLastCheckpoint;
1920 const uptr MaxCachedPerBatch = BG->MaxCachedPerBatch;
1921
1922 // Note that the first Batches in both `Batches` may not be
1923 // full and only the first Batch can have non-full blocks. Thus
1924 // we have to merge them before appending one to another.
1925 if (Cur->Batches.front()->getCount() == MaxCachedPerBatch) {
1926 BG->Batches.append_back(&Cur->Batches);
1927 } else {
1928 BatchT *NonFullBatch = Cur->Batches.front();
1929 Cur->Batches.pop_front();
1930 const u16 NonFullBatchCount = NonFullBatch->getCount();
1931 // The remaining Batches in `Cur` are full.
1932 BG->Batches.append_back(&Cur->Batches);
1933
1934 if (BG->Batches.front()->getCount() == MaxCachedPerBatch) {
1935 // Only 1 non-full Batch, push it to the front.
1936 BG->Batches.push_front(NonFullBatch);
1937 } else {
1938 const u16 NumBlocksToMove = static_cast<u16>(
1939 Min(A: static_cast<u16>(MaxCachedPerBatch -
1940 BG->Batches.front()->getCount()),
1941 B: NonFullBatchCount));
1942 BG->Batches.front()->appendFromBatch(NonFullBatch, NumBlocksToMove);
1943 if (NonFullBatch->isEmpty())
1944 UnusedBatch = NonFullBatch;
1945 else
1946 BG->Batches.push_front(NonFullBatch);
1947 }
1948 }
1949
1950 const u32 NeededSlots = UnusedBatch == nullptr ? 1U : 2U;
1951 if (UNLIKELY(Idx + NeededSlots > MaxUnusedSize)) {
1952 ScopedLock L(BatchClassRegion->FLLock);
1953 pushBatchClassBlocks(Region: BatchClassRegion, Array: Blocks, Size: Idx);
1954 if (conditionVariableEnabled())
1955 BatchClassRegion->FLLockCV.notifyAll(BatchClassRegion->FLLock);
1956 Idx = 0;
1957 }
1958 Blocks[Idx++] =
1959 compactPtr(ClassId: SizeClassMap::BatchClassId, Ptr: reinterpret_cast<uptr>(Cur));
1960 if (UnusedBatch) {
1961 Blocks[Idx++] = compactPtr(ClassId: SizeClassMap::BatchClassId,
1962 Ptr: reinterpret_cast<uptr>(UnusedBatch));
1963 }
1964 Prev = BG;
1965 BG = BG->Next;
1966 continue;
1967 }
1968
1969 // At here, the `BG` is the first BatchGroup with CompactPtrGroupBase
1970 // larger than the first element in `GroupsToRelease`. We need to insert
1971 // `GroupsToRelease::front()` (which is `Cur` below) before `BG`.
1972 //
1973 // 1. If `Prev` is nullptr, we simply push `Cur` to the front of
1974 // FreeListInfo.BlockList.
1975 // 2. Otherwise, use `insert()` which inserts an element next to `Prev`.
1976 //
1977 // Afterwards, we don't need to advance `BG` because the order between
1978 // `BG` and the new `GroupsToRelease::front()` hasn't been checked.
1979 if (Prev == nullptr)
1980 Region->FreeListInfo.BlockList.push_front(Cur);
1981 else
1982 Region->FreeListInfo.BlockList.insert(Prev, Cur);
1983 DCHECK_EQ(Cur->Next, BG);
1984 Prev = Cur;
1985 }
1986
1987 if (Idx != 0) {
1988 ScopedLock L(BatchClassRegion->FLLock);
1989 pushBatchClassBlocks(Region: BatchClassRegion, Array: Blocks, Size: Idx);
1990 if (conditionVariableEnabled())
1991 BatchClassRegion->FLLockCV.notifyAll(BatchClassRegion->FLLock);
1992 }
1993
1994 if (SCUDO_DEBUG) {
1995 BatchGroupT *Prev = Region->FreeListInfo.BlockList.front();
1996 for (BatchGroupT *Cur = Prev->Next; Cur != nullptr;
1997 Prev = Cur, Cur = Cur->Next) {
1998 CHECK_LT(Prev->CompactPtrGroupBase, Cur->CompactPtrGroupBase);
1999 }
2000 }
2001
2002 if (conditionVariableEnabled())
2003 Region->FLLockCV.notifyAll(Region->FLLock);
2004}
2005} // namespace scudo
2006
2007#endif // SCUDO_PRIMARY64_H_
2008