Loading...
--- libmalloc/libmalloc-317.121.1/src/magazine_malloc.c
+++ libmalloc/libmalloc-474.0.13/src/magazine_malloc.c
@@ -48,10 +48,22 @@
int max_magazines;
// Control whether medium is enabled at all when creating new magazine zones
-bool magazine_medium_enabled = true;
+bool magazine_medium_enabled = DEFAULT_MEDIUM_ALLOCATOR_ENABLED;
// Control the DRAM limit at which medium kicks in.
uint64_t magazine_medium_active_threshold = MEDIUM_ACTIVATION_THRESHOLD;
+
+#if CONFIG_MEDIUM_ALLOCATOR
+
+// Control the dram divisor that's used to scale up medium's madvise window.
+// We'll double the window for each multiple of magazine_medium_madvise_dram_scale_divisor
+// bytes of dram on the system rounded down to the neareast power of 2.
+// This is done by setting magazine_medium_madvise_window_scale_factor.
+uint64_t magazine_medium_madvise_dram_scale_divisor = MEDIUM_MADVISE_DRAM_SCALE_DIVISOR;
+
+// Controls how much to scale up medium's madvise window.
+uint64_t magazine_medium_madvise_window_scale_factor = 1;
+#endif // CONFIG_MEDIUM_ALLOCATOR
// Control the DRAM limit at which the expanded large cache kicks in.
uint64_t magazine_large_expanded_cache_threshold = LARGE_CACHE_EXPANDED_THRESHOLD;
@@ -78,27 +90,30 @@
/*
* Mark these MALLOC_NOINLINE to avoid bloating the purgeable zone call backs
*/
-void
-szone_free(szone_t *szone, void *ptr)
+static void
+_szone_free(szone_t *szone, void *ptr, bool try)
{
region_t tiny_region;
region_t small_region;
#if DEBUG_MALLOC
if (LOG(szone, ptr)) {
- malloc_report(ASL_LEVEL_INFO, "in szone_free with %p\n", ptr);
+ malloc_report(ASL_LEVEL_INFO, "in _szone_free with %p\n", ptr);
}
#endif
if (!ptr) {
return;
+ }
+ if ((uintptr_t)ptr & (TINY_QUANTUM - 1)) {
+ if (!try) {
+ malloc_zone_error(szone->debug_flags, true, "Non-aligned pointer %p being freed\n", ptr);
+ return;
+ }
+ goto not_claimed;
}
/*
* Try to free to a tiny region.
*/
- if ((uintptr_t)ptr & (TINY_QUANTUM - 1)) {
- malloc_zone_error(szone->debug_flags, true, "Non-aligned pointer %p being freed\n", ptr);
- return;
- }
if ((tiny_region = tiny_region_for_ptr_no_lock(&szone->tiny_rack, ptr)) != NULL) {
if (TINY_INDEX_FOR_PTR(ptr) >= NUM_TINY_BLOCKS) {
malloc_zone_error(szone->debug_flags, true, "Pointer %p to metadata being freed\n", ptr);
@@ -112,8 +127,11 @@
* Try to free to a small region.
*/
if ((uintptr_t)ptr & (SMALL_QUANTUM - 1)) {
- malloc_zone_error(szone->debug_flags, true, "Non-aligned pointer %p being freed (2)\n", ptr);
- return;
+ if (!try) {
+ malloc_zone_error(szone->debug_flags, true, "Non-aligned pointer %p being freed (2)\n", ptr);
+ return;
+ }
+ goto not_claimed;
}
if ((small_region = small_region_for_ptr_no_lock(&szone->small_rack, ptr)) != NULL) {
if (SMALL_META_INDEX_FOR_PTR(ptr) >= NUM_SMALL_BLOCKS) {
@@ -140,10 +158,31 @@
/* check that it's a legal large allocation */
if ((uintptr_t)ptr & (vm_page_quanta_size - 1)) {
- malloc_zone_error(szone->debug_flags, true, "non-page-aligned, non-allocated pointer %p being freed\n", ptr);
- return;
- }
- free_large(szone, ptr);
+ if (!try) {
+ malloc_zone_error(szone->debug_flags, true, "non-page-aligned, non-allocated pointer %p being freed\n", ptr);
+ return;
+ }
+ goto not_claimed;
+ }
+ bool claimed = free_large(szone, ptr, try);
+ if (!try || claimed) {
+ return;
+ }
+
+not_claimed:
+ find_zone_and_free(ptr, true);
+}
+
+void
+szone_free(szone_t *szone, void *ptr)
+{
+ _szone_free(szone, ptr, false);
+}
+
+static void
+szone_try_free_default(szone_t *szone, void *ptr)
+{
+ _szone_free(szone, ptr, true);
}
void
@@ -215,7 +254,7 @@
malloc_zone_error(szone->debug_flags, true, "non-page-aligned, non-allocated pointer %p being freed\n", ptr);
return;
}
- free_large(szone, ptr);
+ free_large(szone, ptr, false);
}
MALLOC_NOINLINE void *
@@ -262,6 +301,10 @@
*/
if ((szone->debug_flags & MALLOC_DO_SCRIBBLE) && ptr && !cleared_requested && size) {
memset(ptr, SCRIBBLE_BYTE, szone_size(szone, ptr));
+ }
+
+ if (os_unlikely(!ptr)) {
+ malloc_set_errno_fast(MZ_POSIX, ENOMEM);
}
return ptr;
@@ -606,8 +649,10 @@
if (num_kernel_pages == 0) { /* Overflowed */
return NULL;
} else {
+ MALLOC_STATIC_ASSERT(sizeof(size_t) == sizeof(long), "builtin_ctzl should be the right intrinsic for size_t");
+
return large_malloc(szone, num_kernel_pages,
- MAX(vm_page_quanta_shift, __builtin_ctz((unsigned)alignment)), 0);
+ MAX(vm_page_quanta_shift, __builtin_ctzl(alignment)), 0);
}
/* NOTREACHED */
__builtin_unreachable();
@@ -663,37 +708,9 @@
#if CONFIG_LARGE_CACHE
if (large_cache_enabled) {
- SZONE_LOCK(szone);
-
- /* disable any memory pressure responder */
- szone->flotsam_enabled = FALSE;
-
- // stack allocated copy of the death-row cache
- int idx = szone->large_entry_cache_oldest, idx_max = szone->large_entry_cache_newest;
- large_entry_t local_entry_cache[LARGE_ENTRY_CACHE_SIZE_HIGH];
-
- memcpy((void *)local_entry_cache, (void *)szone->large_entry_cache, sizeof(local_entry_cache));
-
- szone->large_entry_cache_oldest = szone->large_entry_cache_newest = 0;
- szone->large_entry_cache[0].address = 0x0;
- szone->large_entry_cache[0].size = 0;
- szone->large_entry_cache_bytes = 0;
- szone->large_entry_cache_reserve_bytes = 0;
-
- SZONE_UNLOCK(szone);
-
- // deallocate the death-row cache outside the zone lock
- while (idx != idx_max) {
- mvm_deallocate_pages((void *)local_entry_cache[idx].address, local_entry_cache[idx].size, szone->debug_flags);
- if (++idx == szone->large_cache_depth) {
- idx = 0;
- }
- }
- if (0 != local_entry_cache[idx].address && 0 != local_entry_cache[idx].size) {
- mvm_deallocate_pages((void *)local_entry_cache[idx].address, local_entry_cache[idx].size, szone->debug_flags);
- }
- }
-#endif
+ large_destroy_cache(szone);
+ }
+#endif // CONFIG_LARGE_CACHE
/* destroy large entries */
index = szone->num_large_entries;
@@ -798,33 +815,10 @@
{
size_t index;
- /* check tiny regions - chould check region count */
- for (index = 0; index < szone->tiny_rack.region_generation->num_regions_allocated; ++index) {
- region_t tiny = szone->tiny_rack.region_generation->hashed_regions[index];
-
- if (HASHRING_REGION_DEALLOCATED == tiny) {
- continue;
- }
-
- if (tiny) {
- magazine_t *tiny_mag_ptr = mag_lock_zine_for_region_trailer(szone->tiny_rack.magazines,
- REGION_TRAILER_FOR_TINY_REGION(tiny),
- MAGAZINE_INDEX_FOR_TINY_REGION(tiny));
-
- if (!tiny_check_region(&szone->tiny_rack, tiny, index, szone_check_counter)) {
- SZONE_MAGAZINE_PTR_UNLOCK(tiny_mag_ptr);
- szone->debug_flags &= ~CHECK_REGIONS;
- return 0;
- }
- SZONE_MAGAZINE_PTR_UNLOCK(tiny_mag_ptr);
- }
- }
- /* check tiny free lists */
- for (index = 0; index < NUM_TINY_SLOTS; ++index) {
- if (!tiny_free_list_check(&szone->tiny_rack, (grain_t)index, szone_check_counter)) {
- szone->debug_flags &= ~CHECK_REGIONS;
- return 0;
- }
+ boolean_t tiny_result = tiny_check(&szone->tiny_rack, szone_check_counter);
+ if (!tiny_result) {
+ szone->debug_flags &= ~CHECK_REGIONS;
+ return 0;
}
/* check small regions - could check region count */
@@ -910,6 +904,10 @@
return szone_check_all(szone, "");
}
+// To support the sanitizer zone, we need to be able to perform zone enumeration across different
+// architecture slices on macOS, because ReportCrash is always running as a native (arm64e) process,
+// but we also need to be able to inspect x86_64 targets that are running under Rosetta. So the data
+// layout and zone logic needs to match between x86_64 and arm64(e).
static kern_return_t
szone_ptr_in_use_enumerator(task_t task,
void *context,
@@ -1050,6 +1048,15 @@
zone_address, info[0], info[1], info[2], info[3], info[12]);
printer("\ttiny=%u(%u) small=%u(%u) large=%u(%u)\n", info[4],
info[5], info[6], info[7], info[8], info[9]);
+
+ // FIXME: The rest of the code here assumes that regions have their normal
+ // alignment, which isn't guaranteed when looking at regions mapped from
+ // other processes
+ if (!mach_task_is_self(task)) {
+ printer("(unable to safely further examine remote process)\n");
+ return;
+ }
+
// tiny
printer("%lu tiny regions:\n", mapped_szone->tiny_rack.num_regions);
if (mapped_szone->tiny_rack.num_regions_dealloc) {
@@ -1435,7 +1442,7 @@
#endif // CONFIG_MEDIUM_ALLOCATOR
#endif // CONFIG_MADVISE_PRESSURE_RELIEF
-#if CONFIG_LARGE_CACHE
+#if CONFIG_LARGE_CACHE && !CONFIG_DEFERRED_RECLAIM
if (large_cache_enabled && szone->flotsam_enabled) {
SZONE_LOCK(szone);
@@ -1469,7 +1476,7 @@
total += local_entry_cache[idx].size;
}
}
-#endif
+#endif // CONFIG_LARGE_CACHE && !CONFIG_DEFERRED_RECLAIM
MAGMALLOC_PRESSURERELIEFEND((void *)szone, szone->basic_zone.zone_name, (int)goal, (int)total); // DTrace USDT Probe
MALLOC_TRACE(TRACE_malloc_memory_pressure | DBG_FUNC_END, (uint64_t)szone, goal, total, 0);
@@ -1731,7 +1738,7 @@
// Initialize the security token.
szone->cookie = (uintptr_t)malloc_entropy[0];
- szone->basic_zone.version = 12;
+ szone->basic_zone.version = 13;
szone->basic_zone.size = (void *)szone_size;
szone->basic_zone.malloc = (void *)szone_malloc;
szone->basic_zone.calloc = (void *)szone_calloc;
@@ -1746,6 +1753,7 @@
szone->basic_zone.free_definite_size = (void *)szone_free_definite_size;
szone->basic_zone.pressure_relief = (void *)szone_pressure_relief;
szone->basic_zone.claimed_address = (void *)szone_claimed_address;
+ szone->basic_zone.try_free_default = (void *)szone_try_free_default;
/* Set to zero once and for all as required by CFAllocator. */
szone->basic_zone.reserved1 = 0;