Loading...
--- xnu/xnu-344.49/libkern/c++/OSObject.cpp
+++ xnu/xnu-2050.9.2/libkern/c++/OSObject.cpp
@@ -1,16 +1,19 @@
/*
- * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000 Apple Inc. All rights reserved.
*
- * @APPLE_LICENSE_HEADER_START@
- *
- * Copyright (c) 1999-2003 Apple Computer, Inc. All Rights Reserved.
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ *
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
*
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
@@ -20,17 +23,22 @@
* Please see the License for the specific language governing rights and
* limitations under the License.
*
- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/* OSObject.cpp created by gvdl on Fri 1998-11-17 */
#include <libkern/c++/OSObject.h>
+#include <libkern/c++/OSArray.h>
#include <libkern/c++/OSSerialize.h>
#include <libkern/c++/OSLib.h>
+#include <libkern/OSDebug.h>
#include <libkern/c++/OSCPPDebug.h>
+#include <IOKit/IOKitDebug.h>
#include <libkern/OSAtomic.h>
#include <libkern/c++/OSCollection.h>
+
+#include <kern/queue.h>
__BEGIN_DECLS
int debug_ivars_size;
@@ -78,22 +86,6 @@
OSMetaClassDefineReservedUnused(OSObject, 13);
OSMetaClassDefineReservedUnused(OSObject, 14);
OSMetaClassDefineReservedUnused(OSObject, 15);
-OSMetaClassDefineReservedUnused(OSObject, 16);
-OSMetaClassDefineReservedUnused(OSObject, 17);
-OSMetaClassDefineReservedUnused(OSObject, 18);
-OSMetaClassDefineReservedUnused(OSObject, 19);
-OSMetaClassDefineReservedUnused(OSObject, 20);
-OSMetaClassDefineReservedUnused(OSObject, 21);
-OSMetaClassDefineReservedUnused(OSObject, 22);
-OSMetaClassDefineReservedUnused(OSObject, 23);
-OSMetaClassDefineReservedUnused(OSObject, 24);
-OSMetaClassDefineReservedUnused(OSObject, 25);
-OSMetaClassDefineReservedUnused(OSObject, 26);
-OSMetaClassDefineReservedUnused(OSObject, 27);
-OSMetaClassDefineReservedUnused(OSObject, 28);
-OSMetaClassDefineReservedUnused(OSObject, 29);
-OSMetaClassDefineReservedUnused(OSObject, 30);
-OSMetaClassDefineReservedUnused(OSObject, 31);
static const char *getClassName(const OSObject *obj)
{
@@ -120,42 +112,44 @@
void OSObject::taggedRetain(const void *tag) const
{
-#if !DEBUG
volatile UInt32 *countP = (volatile UInt32 *) &retainCount;
UInt32 inc = 1;
UInt32 origCount;
UInt32 newCount;
- // Increment the collecion bucket.
+ // Increment the collection bucket.
if ((const void *) OSTypeID(OSCollection) == tag)
inc |= (1UL<<16);
do {
origCount = *countP;
- if (-1UL == origCount)
- // @@@ Pinot: panic("Attempting to retain a freed object");
- return;
+ if ( ((UInt16) origCount | 0x1) == 0xffff ) {
+ const char *msg;
+ if (origCount & 0x1) {
+ // If count == 0xffff that means we are freeing now so we can
+ // just return obviously somebody is cleaning up dangling
+ // references.
+ msg = "Attempting to retain a freed object";
+ }
+ else {
+ // If count == 0xfffe then we have wrapped our reference count.
+ // We should stop counting now as this reference must be
+ // leaked rather than accidently wrapping around the clock and
+ // freeing a very active object later.
+
+#if !DEBUG
+ break; // Break out of update loop which pegs the reference
+#else /* DEBUG */
+ // @@@ gvdl: eventually need to make this panic optional
+ // based on a boot argument i.e. debug= boot flag
+ msg = "About to wrap the reference count, reference leak?";
+#endif /* !DEBUG */
+ }
+ panic("OSObject::refcount: %s", msg);
+ }
newCount = origCount + inc;
- } while (!OSCompareAndSwap(origCount, newCount, (UInt32 *) countP));
-#else
- volatile UInt32 *countP = (volatile UInt32 *) &retainCount;
- UInt32 inc = 1;
- UInt32 origCount;
- UInt32 newCount;
-
- // Increment the collecion bucket.
- if ((const void *) OSTypeID(OSCollection) == tag)
- inc |= (1UL<<16);
-
- do {
- origCount = *countP;
- if (-1UL == origCount)
- return; // We are freeing so leave now.
-
- newCount = origCount + inc;
- } while (!OSCompareAndSwap(origCount, newCount, (UInt32 *) countP));
-#endif
+ } while (!OSCompareAndSwap(origCount, newCount, const_cast<UInt32 *>(countP)));
}
void OSObject::taggedRelease(const void *tag) const
@@ -165,86 +159,69 @@
void OSObject::taggedRelease(const void *tag, const int when) const
{
-#if !DEBUG
volatile UInt32 *countP = (volatile UInt32 *) &retainCount;
UInt32 dec = 1;
UInt32 origCount;
UInt32 newCount;
UInt32 actualCount;
- // Increment the collecion bucket.
+ // Increment the collection bucket.
if ((const void *) OSTypeID(OSCollection) == tag)
dec |= (1UL<<16);
do {
origCount = *countP;
- if (-1UL == origCount)
- return; // We are freeing already leave now.
-
+
+ if ( ((UInt16) origCount | 0x1) == 0xffff ) {
+ if (origCount & 0x1) {
+ // If count == 0xffff that means we are freeing now so we can
+ // just return obviously somebody is cleaning up some dangling
+ // references. So we blow out immediately.
+ return;
+ }
+ else {
+ // If count == 0xfffe then we have wrapped our reference
+ // count. We should stop counting now as this reference must be
+ // leaked rather than accidently freeing an active object later.
+
+#if !DEBUG
+ return; // return out of function which pegs the reference
+#else /* DEBUG */
+ // @@@ gvdl: eventually need to make this panic optional
+ // based on a boot argument i.e. debug= boot flag
+ panic("OSObject::refcount: %s",
+ "About to unreference a pegged object, reference leak?");
+#endif /* !DEBUG */
+ }
+ }
actualCount = origCount - dec;
- if ((SInt16) actualCount < when)
- newCount = (UInt32) -1;
+ if ((UInt16) actualCount < when)
+ newCount = 0xffff;
else
newCount = actualCount;
- } while (!OSCompareAndSwap(origCount, newCount, (UInt32 *) countP));
+ } while (!OSCompareAndSwap(origCount, newCount, const_cast<UInt32 *>(countP)));
//
// This panic means that we have just attempted to release an object
- // who's retain count has gone to less than the number of collections
+ // whose retain count has gone to less than the number of collections
// it is a member off. Take a panic immediately.
- // In Fact the panic MAY not be a registry corruption but it is
+ // In fact the panic MAY not be a registry corruption but it is
// ALWAYS the wrong thing to do. I call it a registry corruption 'cause
// the registry is the biggest single use of a network of collections.
//
- if ((UInt16) actualCount < (actualCount >> 16))
- panic("A driver releasing a(n) %s has corrupted the registry\n",
- getClassName(this));
+// xxx - this error message is overly-specific;
+// xxx - any code in the kernel could trip this,
+// xxx - and it applies as noted to all collections, not just the registry
+ if ((UInt16) actualCount < (actualCount >> 16)) {
+ panic("A kext releasing a(n) %s has corrupted the registry.",
+ getClassName(this));
+ }
// Check for a 'free' condition and that if we are first through
- if ((UInt32) -1 == newCount)
- ((OSObject *) this)->free();
-#else
- // @@@ Pinot: Need to update the debug build release code.
- volatile UInt32 *countP = (volatile UInt32 *) &retainCount;
- UInt32 dec = 1;
- UInt32 origCount;
- UInt32 newCount;
-
- // Increment the collecion bucket.
- if ((const void *) OSTypeID(OSCollection) == tag)
- dec |= (1UL<<16);
-
- do {
- origCount = *countP;
- if (-1UL == origCount)
- return; // We are freeing already leave now.
-
- newCount = origCount - dec;
- } while (!OSCompareAndSwap(origCount, newCount, (UInt32 *) countP));
-
- //
- // This panic means that we have just attempted to release an object
- // who's retain count has gone to less than the number of collections
- // it is a member off. Take a panic immediately.
- // In Fact the panic MAY not be a registry corruption but it is
- // ALWAYS the wrong thing to do. I call it a registry corruption 'cause
- // the registry is the biggest single use of a network of collections.
- //
- if ((UInt16) newCount < (newCount >> 16))
- panic("A driver releasing a(n) %s has corrupted the registry\n",
- getClassName(this));
-
- // Check for a release too many
- if ((SInt16) newCount < 0)
- panic("An object has had a release too many\n",
- getClassName(this));
-
- // Check for a 'free' condition and that if we are first through
- if ((SInt16) newCount < when
- && OSCompareAndSwap(newCount, -1UL, (UInt32 *) countP))
- ((OSObject *) this)->free();
-#endif
+ if (newCount == 0xffff) {
+ (const_cast<OSObject *>(this))->free();
+ }
}
void OSObject::release() const
@@ -274,20 +251,91 @@
return s->addXMLEndTag("string");
}
+
+thread_t gOSObjectTrackThread;
+
+queue_head_t gOSObjectTrackList =
+ { (queue_t) &gOSObjectTrackList, (queue_t) &gOSObjectTrackList };
+
+lck_spin_t gOSObjectTrackLock;
+
+OSArray * OSFlushObjectTrackList(void)
+{
+ OSArray * array;
+ queue_entry_t next;
+
+ array = OSArray::withCapacity(16);
+
+ lck_spin_lock(&gOSObjectTrackLock);
+ while (!queue_empty(&gOSObjectTrackList))
+ {
+ next = queue_first(&gOSObjectTrackList);
+ remque(next);
+ lck_spin_unlock(&gOSObjectTrackLock);
+ array->setObject((OSObject *) (next + 1));
+ lck_spin_lock(&gOSObjectTrackLock);
+ }
+ lck_spin_unlock(&gOSObjectTrackLock);
+
+ return (array);
+}
+
+struct OSObjectTracking
+{
+ queue_chain_t link;
+ void * bt[14];
+};
+
void *OSObject::operator new(size_t size)
{
- void *mem = (void *) kalloc(size);
+ size_t tracking = (gIOKitDebug & kOSTraceObjectAlloc)
+ ? sizeof(OSObjectTracking) : 0;
+ OSObjectTracking * mem = (OSObjectTracking *) kalloc(size + tracking);
+
assert(mem);
+
+ if (tracking)
+ {
+ if ((((thread_t) 1) == gOSObjectTrackThread) || (current_thread() == gOSObjectTrackThread))
+ {
+ (void) OSBacktrace(&mem->bt[0], sizeof(mem->bt) / sizeof(mem->bt[0]));
+ lck_spin_lock(&gOSObjectTrackLock);
+ enqueue_tail(&gOSObjectTrackList, &mem->link);
+ lck_spin_unlock(&gOSObjectTrackLock);
+ }
+ else
+ mem->link.next = 0;
+ mem++;
+ }
+
bzero(mem, size);
ACCUMSIZE(size);
- return mem;
-}
-
-void OSObject::operator delete(void *mem, size_t size)
-{
- kfree((vm_offset_t) mem, size);
+ return (void *) mem;
+}
+
+void OSObject::operator delete(void *_mem, size_t size)
+{
+ size_t tracking = (gIOKitDebug & kOSTraceObjectAlloc)
+ ? sizeof(OSObjectTracking) : 0;
+ OSObjectTracking * mem = (OSObjectTracking *) _mem;
+
+ if (!mem)
+ return;
+
+ if (tracking)
+ {
+ mem--;
+ if (mem->link.next)
+ {
+ lck_spin_lock(&gOSObjectTrackLock);
+ remque(&mem->link);
+ lck_spin_unlock(&gOSObjectTrackLock);
+ }
+ }
+
+ kfree(mem, size + tracking);
ACCUMSIZE(-size);
}