| // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #ifndef BASE_ALLOCATOR_PARTITION_ALLOCATOR_PARTITION_ALLOC_H_ |
| #define BASE_ALLOCATOR_PARTITION_ALLOCATOR_PARTITION_ALLOC_H_ |
| |
| // DESCRIPTION |
| // PartitionRoot::Alloc() / PartitionRootGeneric::Alloc() and PartitionFree() / |
| // PartitionRootGeneric::Free() are approximately analagous to malloc() and |
| // free(). |
| // |
| // The main difference is that a PartitionRoot / PartitionRootGeneric object |
| // must be supplied to these functions, representing a specific "heap partition" |
| // that will be used to satisfy the allocation. Different partitions are |
| // guaranteed to exist in separate address spaces, including being separate from |
| // the main system heap. If the contained objects are all freed, physical memory |
| // is returned to the system but the address space remains reserved. |
| // See PartitionAlloc.md for other security properties PartitionAlloc provides. |
| // |
| // THE ONLY LEGITIMATE WAY TO OBTAIN A PartitionRoot IS THROUGH THE |
| // SizeSpecificPartitionAllocator / PartitionAllocatorGeneric classes. To |
| // minimize the instruction count to the fullest extent possible, the |
| // PartitionRoot is really just a header adjacent to other data areas provided |
| // by the allocator class. |
| // |
| // The PartitionRoot::Alloc() variant of the API has the following caveats: |
| // - Allocations and frees against a single partition must be single threaded. |
| // - Allocations must not exceed a max size, chosen at compile-time via a |
| // templated parameter to PartitionAllocator. |
| // - Allocation sizes must be aligned to the system pointer size. |
| // - Allocations are bucketed exactly according to size. |
| // |
| // And for PartitionRootGeneric::Alloc(): |
| // - Multi-threaded use against a single partition is ok; locking is handled. |
| // - Allocations of any arbitrary size can be handled (subject to a limit of |
| // INT_MAX bytes for security reasons). |
| // - Bucketing is by approximate size, for example an allocation of 4000 bytes |
| // might be placed into a 4096-byte bucket. Bucket sizes are chosen to try and |
| // keep worst-case waste to ~10%. |
| // |
| // The allocators are designed to be extremely fast, thanks to the following |
| // properties and design: |
| // - Just two single (reasonably predicatable) branches in the hot / fast path |
| // for both allocating and (significantly) freeing. |
| // - A minimal number of operations in the hot / fast path, with the slow paths |
| // in separate functions, leading to the possibility of inlining. |
| // - Each partition page (which is usually multiple physical pages) has a |
| // metadata structure which allows fast mapping of free() address to an |
| // underlying bucket. |
| // - Supports a lock-free API for fast performance in single-threaded cases. |
| // - The freelist for a given bucket is split across a number of partition |
| // pages, enabling various simple tricks to try and minimize fragmentation. |
| // - Fine-grained bucket sizes leading to less waste and better packing. |
| // |
| // The following security properties could be investigated in the future: |
| // - Per-object bucketing (instead of per-size) is mostly available at the API, |
| // but not used yet. |
| // - No randomness of freelist entries or bucket position. |
| // - Better checking for wild pointers in free(). |
| // - Better freelist masking function to guarantee fault on 32-bit. |
| |
| #include <limits.h> |
| #include <string.h> |
| |
| #include "base/allocator/partition_allocator/page_allocator.h" |
| #include "base/allocator/partition_allocator/partition_alloc_constants.h" |
| #include "base/allocator/partition_allocator/partition_bucket.h" |
| #include "base/allocator/partition_allocator/partition_cookie.h" |
| #include "base/allocator/partition_allocator/partition_page.h" |
| #include "base/allocator/partition_allocator/partition_root_base.h" |
| #include "base/allocator/partition_allocator/spin_lock.h" |
| #include "base/base_export.h" |
| #include "base/bits.h" |
| #include "base/compiler_specific.h" |
| #include "base/logging.h" |
| #include "base/macros.h" |
| #include "base/sys_byteorder.h" |
| #include "build_config.h" |
| |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| #include <stdlib.h> |
| #endif |
| |
| namespace base { |
| |
| class PartitionStatsDumper; |
| |
| enum PartitionPurgeFlags { |
| // Decommitting the ring list of empty pages is reasonably fast. |
| PartitionPurgeDecommitEmptyPages = 1 << 0, |
| // Discarding unused system pages is slower, because it involves walking all |
| // freelists in all active partition pages of all buckets >= system page |
| // size. It often frees a similar amount of memory to decommitting the empty |
| // pages, though. |
| PartitionPurgeDiscardUnusedSystemPages = 1 << 1, |
| }; |
| |
| // Never instantiate a PartitionRoot directly, instead use PartitionAlloc. |
| struct BASE_EXPORT PartitionRoot : public internal::PartitionRootBase { |
| PartitionRoot(); |
| ~PartitionRoot() override; |
| // This references the buckets OFF the edge of this struct. All uses of |
| // PartitionRoot must have the bucket array come right after. |
| // |
| // The PartitionAlloc templated class ensures the following is correct. |
| ALWAYS_INLINE internal::PartitionBucket* buckets() { |
| return reinterpret_cast<internal::PartitionBucket*>(this + 1); |
| } |
| ALWAYS_INLINE const internal::PartitionBucket* buckets() const { |
| return reinterpret_cast<const internal::PartitionBucket*>(this + 1); |
| } |
| |
| void Init(size_t num_buckets, size_t max_allocation); |
| |
| ALWAYS_INLINE void* Alloc(size_t size, const char* type_name); |
| |
| void PurgeMemory(int flags); |
| |
| void DumpStats(const char* partition_name, |
| bool is_light_dump, |
| PartitionStatsDumper* dumper); |
| }; |
| |
| // Never instantiate a PartitionRootGeneric directly, instead use |
| // PartitionAllocatorGeneric. |
| struct BASE_EXPORT PartitionRootGeneric : public internal::PartitionRootBase { |
| PartitionRootGeneric(); |
| ~PartitionRootGeneric() override; |
| subtle::SpinLock lock; |
| // Some pre-computed constants. |
| size_t order_index_shifts[kBitsPerSizeT + 1] = {}; |
| size_t order_sub_index_masks[kBitsPerSizeT + 1] = {}; |
| // The bucket lookup table lets us map a size_t to a bucket quickly. |
| // The trailing +1 caters for the overflow case for very large allocation |
| // sizes. It is one flat array instead of a 2D array because in the 2D |
| // world, we'd need to index array[blah][max+1] which risks undefined |
| // behavior. |
| internal::PartitionBucket* |
| bucket_lookups[((kBitsPerSizeT + 1) * kGenericNumBucketsPerOrder) + 1] = |
| {}; |
| internal::PartitionBucket buckets[kGenericNumBuckets] = {}; |
| |
| // Public API. |
| void Init(); |
| |
| ALWAYS_INLINE void* Alloc(size_t size, const char* type_name); |
| ALWAYS_INLINE void Free(void* ptr); |
| |
| NOINLINE void* Realloc(void* ptr, size_t new_size, const char* type_name); |
| |
| ALWAYS_INLINE size_t ActualSize(size_t size); |
| |
| void PurgeMemory(int flags); |
| |
| void DumpStats(const char* partition_name, |
| bool is_light_dump, |
| PartitionStatsDumper* partition_stats_dumper); |
| }; |
| |
| // Struct used to retrieve total memory usage of a partition. Used by |
| // PartitionStatsDumper implementation. |
| struct PartitionMemoryStats { |
| size_t total_mmapped_bytes; // Total bytes mmaped from the system. |
| size_t total_committed_bytes; // Total size of commmitted pages. |
| size_t total_resident_bytes; // Total bytes provisioned by the partition. |
| size_t total_active_bytes; // Total active bytes in the partition. |
| size_t total_decommittable_bytes; // Total bytes that could be decommitted. |
| size_t total_discardable_bytes; // Total bytes that could be discarded. |
| }; |
| |
| // Struct used to retrieve memory statistics about a partition bucket. Used by |
| // PartitionStatsDumper implementation. |
| struct PartitionBucketMemoryStats { |
| bool is_valid; // Used to check if the stats is valid. |
| bool is_direct_map; // True if this is a direct mapping; size will not be |
| // unique. |
| uint32_t bucket_slot_size; // The size of the slot in bytes. |
| uint32_t allocated_page_size; // Total size the partition page allocated from |
| // the system. |
| uint32_t active_bytes; // Total active bytes used in the bucket. |
| uint32_t resident_bytes; // Total bytes provisioned in the bucket. |
| uint32_t decommittable_bytes; // Total bytes that could be decommitted. |
| uint32_t discardable_bytes; // Total bytes that could be discarded. |
| uint32_t num_full_pages; // Number of pages with all slots allocated. |
| uint32_t num_active_pages; // Number of pages that have at least one |
| // provisioned slot. |
| uint32_t num_empty_pages; // Number of pages that are empty |
| // but not decommitted. |
| uint32_t num_decommitted_pages; // Number of pages that are empty |
| // and decommitted. |
| }; |
| |
| // Interface that is passed to PartitionDumpStats and |
| // PartitionDumpStatsGeneric for using the memory statistics. |
| class BASE_EXPORT PartitionStatsDumper { |
| public: |
| // Called to dump total memory used by partition, once per partition. |
| virtual void PartitionDumpTotals(const char* partition_name, |
| const PartitionMemoryStats*) = 0; |
| |
| // Called to dump stats about buckets, for each bucket. |
| virtual void PartitionsDumpBucketStats(const char* partition_name, |
| const PartitionBucketMemoryStats*) = 0; |
| }; |
| |
| BASE_EXPORT void PartitionAllocGlobalInit(void (*oom_handling_function)()); |
| |
| class BASE_EXPORT PartitionAllocHooks { |
| public: |
| typedef void AllocationHook(void* address, size_t, const char* type_name); |
| typedef void FreeHook(void* address); |
| |
| // To unhook, call Set*Hook with nullptr. |
| static void SetAllocationHook(AllocationHook* hook) { |
| // Chained allocation hooks are not supported. Registering a non-null |
| // hook when a non-null hook is already registered indicates somebody is |
| // trying to overwrite a hook. |
| CHECK(!hook || !allocation_hook_) << "Overwriting allocation hook"; |
| allocation_hook_ = hook; |
| } |
| static void SetFreeHook(FreeHook* hook) { |
| CHECK(!hook || !free_hook_) << "Overwriting free hook"; |
| free_hook_ = hook; |
| } |
| |
| static void AllocationHookIfEnabled(void* address, |
| size_t size, |
| const char* type_name) { |
| AllocationHook* hook = allocation_hook_; |
| if (UNLIKELY(hook != nullptr)) |
| hook(address, size, type_name); |
| } |
| |
| static void FreeHookIfEnabled(void* address) { |
| FreeHook* hook = free_hook_; |
| if (UNLIKELY(hook != nullptr)) |
| hook(address); |
| } |
| |
| static void ReallocHookIfEnabled(void* old_address, |
| void* new_address, |
| size_t size, |
| const char* type_name) { |
| // Report a reallocation as a free followed by an allocation. |
| AllocationHook* allocation_hook = allocation_hook_; |
| FreeHook* free_hook = free_hook_; |
| if (UNLIKELY(allocation_hook && free_hook)) { |
| free_hook(old_address); |
| allocation_hook(new_address, size, type_name); |
| } |
| } |
| |
| private: |
| // Pointers to hook functions that PartitionAlloc will call on allocation and |
| // free if the pointers are non-null. |
| static AllocationHook* allocation_hook_; |
| static FreeHook* free_hook_; |
| }; |
| |
| ALWAYS_INLINE void* PartitionRoot::Alloc(size_t size, const char* type_name) { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| void* result = malloc(size); |
| CHECK(result); |
| return result; |
| #else |
| size_t requested_size = size; |
| size = internal::PartitionCookieSizeAdjustAdd(size); |
| DCHECK(this->initialized); |
| size_t index = size >> kBucketShift; |
| DCHECK(index < this->num_buckets); |
| DCHECK(size == index << kBucketShift); |
| internal::PartitionBucket* bucket = &this->buckets()[index]; |
| void* result = AllocFromBucket(bucket, 0, size); |
| PartitionAllocHooks::AllocationHookIfEnabled(result, requested_size, |
| type_name); |
| return result; |
| #endif // defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| } |
| |
| ALWAYS_INLINE void PartitionFree(void* ptr) { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| free(ptr); |
| #else |
| // TODO(palmer): Check ptr alignment before continuing. Shall we do the check |
| // inside PartitionCookieFreePointerAdjust? |
| PartitionAllocHooks::FreeHookIfEnabled(ptr); |
| ptr = internal::PartitionCookieFreePointerAdjust(ptr); |
| internal::PartitionPage* page = internal::PartitionPage::FromPointer(ptr); |
| // TODO(palmer): See if we can afford to make this a CHECK. |
| DCHECK(internal::PartitionRootBase::IsValidPage(page)); |
| page->Free(ptr); |
| #endif |
| } |
| |
| ALWAYS_INLINE internal::PartitionBucket* PartitionGenericSizeToBucket( |
| PartitionRootGeneric* root, |
| size_t size) { |
| size_t order = kBitsPerSizeT - bits::CountLeadingZeroBitsSizeT(size); |
| // The order index is simply the next few bits after the most significant bit. |
| size_t order_index = (size >> root->order_index_shifts[order]) & |
| (kGenericNumBucketsPerOrder - 1); |
| // And if the remaining bits are non-zero we must bump the bucket up. |
| size_t sub_order_index = size & root->order_sub_index_masks[order]; |
| internal::PartitionBucket* bucket = |
| root->bucket_lookups[(order << kGenericNumBucketsPerOrderBits) + |
| order_index + !!sub_order_index]; |
| DCHECK(!bucket->slot_size || bucket->slot_size >= size); |
| DCHECK(!(bucket->slot_size % kGenericSmallestBucket)); |
| return bucket; |
| } |
| |
| ALWAYS_INLINE void* PartitionAllocGenericFlags(PartitionRootGeneric* root, |
| int flags, |
| size_t size, |
| const char* type_name) { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| void* result = malloc(size); |
| CHECK(result || flags & PartitionAllocReturnNull); |
| return result; |
| #else |
| DCHECK(root->initialized); |
| size_t requested_size = size; |
| size = internal::PartitionCookieSizeAdjustAdd(size); |
| internal::PartitionBucket* bucket = PartitionGenericSizeToBucket(root, size); |
| void* ret = nullptr; |
| { |
| subtle::SpinLock::Guard guard(root->lock); |
| ret = root->AllocFromBucket(bucket, flags, size); |
| } |
| PartitionAllocHooks::AllocationHookIfEnabled(ret, requested_size, type_name); |
| return ret; |
| #endif |
| } |
| |
| ALWAYS_INLINE void* PartitionRootGeneric::Alloc(size_t size, |
| const char* type_name) { |
| return PartitionAllocGenericFlags(this, 0, size, type_name); |
| } |
| |
| ALWAYS_INLINE void PartitionRootGeneric::Free(void* ptr) { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| free(ptr); |
| #else |
| DCHECK(this->initialized); |
| |
| if (UNLIKELY(!ptr)) |
| return; |
| |
| PartitionAllocHooks::FreeHookIfEnabled(ptr); |
| ptr = internal::PartitionCookieFreePointerAdjust(ptr); |
| internal::PartitionPage* page = internal::PartitionPage::FromPointer(ptr); |
| // TODO(palmer): See if we can afford to make this a CHECK. |
| DCHECK(IsValidPage(page)); |
| { |
| subtle::SpinLock::Guard guard(this->lock); |
| page->Free(ptr); |
| } |
| #endif |
| } |
| |
| BASE_EXPORT void* PartitionReallocGenericFlags(PartitionRootGeneric* root, |
| int flags, |
| void* ptr, |
| size_t new_size, |
| const char* type_name); |
| |
| ALWAYS_INLINE size_t PartitionRootGeneric::ActualSize(size_t size) { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| return size; |
| #else |
| DCHECK(this->initialized); |
| size = internal::PartitionCookieSizeAdjustAdd(size); |
| internal::PartitionBucket* bucket = PartitionGenericSizeToBucket(this, size); |
| if (LIKELY(!bucket->is_direct_mapped())) { |
| size = bucket->slot_size; |
| } else if (size > kGenericMaxDirectMapped) { |
| // Too large to allocate => return the size unchanged. |
| } else { |
| size = internal::PartitionBucket::get_direct_map_size(size); |
| } |
| return internal::PartitionCookieSizeAdjustSubtract(size); |
| #endif |
| } |
| |
| ALWAYS_INLINE bool PartitionAllocSupportsGetSize() { |
| #if defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| return false; |
| #else |
| return true; |
| #endif |
| } |
| |
| ALWAYS_INLINE size_t PartitionAllocGetSize(void* ptr) { |
| // No need to lock here. Only |ptr| being freed by another thread could |
| // cause trouble, and the caller is responsible for that not happening. |
| DCHECK(PartitionAllocSupportsGetSize()); |
| ptr = internal::PartitionCookieFreePointerAdjust(ptr); |
| internal::PartitionPage* page = internal::PartitionPage::FromPointer(ptr); |
| // TODO(palmer): See if we can afford to make this a CHECK. |
| DCHECK(internal::PartitionRootBase::IsValidPage(page)); |
| size_t size = page->bucket->slot_size; |
| return internal::PartitionCookieSizeAdjustSubtract(size); |
| } |
| |
| template <size_t N> |
| class SizeSpecificPartitionAllocator { |
| public: |
| SizeSpecificPartitionAllocator() { |
| memset(actual_buckets_, 0, |
| sizeof(internal::PartitionBucket) * arraysize(actual_buckets_)); |
| } |
| ~SizeSpecificPartitionAllocator() = default; |
| static const size_t kMaxAllocation = N - kAllocationGranularity; |
| static const size_t kNumBuckets = N / kAllocationGranularity; |
| void init() { partition_root_.Init(kNumBuckets, kMaxAllocation); } |
| ALWAYS_INLINE PartitionRoot* root() { return &partition_root_; } |
| |
| private: |
| PartitionRoot partition_root_; |
| internal::PartitionBucket actual_buckets_[kNumBuckets]; |
| }; |
| |
| class BASE_EXPORT PartitionAllocatorGeneric { |
| public: |
| PartitionAllocatorGeneric(); |
| ~PartitionAllocatorGeneric(); |
| |
| void init() { partition_root_.Init(); } |
| ALWAYS_INLINE PartitionRootGeneric* root() { return &partition_root_; } |
| |
| private: |
| PartitionRootGeneric partition_root_; |
| }; |
| |
| } // namespace base |
| |
| #endif // BASE_ALLOCATOR_PARTITION_ALLOCATOR_PARTITION_ALLOC_H_ |