1: /*      $NetBSD: malloc.c,v 1.4 2004/12/14 00:21:01 nathanw Exp $    */
    2: 
    3: /*
    4:  * Copyright (c) 1983, 1993
    5:  *      The Regents of the University of California.  All rights reserved.
    6:  *
    7:  * Redistribution and use in source and binary forms, with or without
    8:  * modification, are permitted provided that the following conditions
    9:  * are met:
   10:  * 1. Redistributions of source code must retain the above copyright
   11:  *    notice, this list of conditions and the following disclaimer.
   12:  * 2. Redistributions in binary form must reproduce the above copyright
   13:  *    notice, this list of conditions and the following disclaimer in the
   14:  *    documentation and/or other materials provided with the distribution.
   15:  * 3. Neither the name of the University nor the names of its contributors
   16:  *    may be used to endorse or promote products derived from this software
   17:  *    without specific prior written permission.
   18:  *
   19:  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   20:  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   21:  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   22:  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   23:  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   24:  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   25:  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   26:  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   27:  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   28:  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   29:  * SUCH DAMAGE.
   30:  */
   31: 
   32: #include <sys/cdefs.h>
   33: #if defined(LIBC_SCCS) && !defined(lint)
   34: #if 0
   35: static char sccsid[] = "@(#)malloc.c    8.1 (Berkeley) 6/4/93";
   36: #else
   37: __RCSID("$NetBSD: malloc.c,v 1.4 2004/12/14 00:21:01 nathanw Exp $");
   38: #endif
   39: #endif /* LIBC_SCCS and not lint */
   40: 
   41: /*
   42:  * malloc.c (Caltech) 2/21/82
   43:  * Chris Kingsley, kingsley@cit-20.
   44:  *
   45:  * This is a very fast storage allocator.  It allocates blocks of a small 
   46:  * number of different sizes, and keeps free lists of each size.  Blocks that
   47:  * don't exactly fit are passed up to the next larger size.  In this 
   48:  * implementation, the available sizes are 2^n-4 (or 2^n-10) bytes long.
   49:  * This is designed for use in a virtual memory environment.
   50:  */
   51: 
   52: #include <sys/types.h>
   53: #if defined(DEBUG) || defined(RCHECK)
   54: #include <sys/uio.h>
   55: #endif
   56: #if defined(RCHECK) || defined(MSTATS)
   57: #include <stdio.h>
   58: #endif
   59: #include <stdlib.h>
   60: #include <string.h>
   61: #include <unistd.h>
   62: #include <pthread.h>
   63: 
   64: 
   65: /*
   66:  * The overhead on a block is at least 4 bytes.  When free, this space
   67:  * contains a pointer to the next free block, and the bottom two bits must
   68:  * be zero.  When in use, the first byte is set to MAGIC, and the second
   69:  * byte is the size index.  The remaining bytes are for alignment.
   70:  * If range checking is enabled then a second word holds the size of the
   71:  * requested block, less 1, rounded up to a multiple of sizeof(RMAGIC).
   72:  * The order of elements is critical: ov_magic must overlay the low order
   73:  * bits of ov_next, and ov_magic can not be a valid ov_next bit pattern.
   74:  */
   75: union   overhead {
   76:         union  overhead *ov_next;       /* when free */
   77:         struct {
   78:                 u_char        ovu_magic;     /* magic number */
   79:                 u_char        ovu_index;     /* bucket # */
   80: #ifdef RCHECK
   81:                 u_short       ovu_rmagic;   /* range magic number */
   82:                 u_long        ovu_size;      /* actual block size */
   83: #endif
   84:         } ovu;
   85: #define ov_magic        ovu.ovu_magic
   86: #define ov_index        ovu.ovu_index
   87: #define ov_rmagic       ovu.ovu_rmagic
   88: #define ov_size         ovu.ovu_size
   89: };
   90: 
   91: #define MAGIC           0xef             /* magic # on accounting info */
   92: #ifdef RCHECK
   93: #define RMAGIC          0x5555          /* magic # on range info */
   94: #endif
   95: 
   96: #ifdef RCHECK
   97: #define RSLOP           sizeof (u_short)
   98: #else
   99: #define RSLOP           0
  100: #endif
  101: 
  102: /*
  103:  * nextf[i] is the pointer to the next free block of size 2^(i+3).  The
  104:  * smallest allocatable block is 8 bytes.  The overhead information
  105:  * precedes the data area returned to the user.
  106:  */
  107: #define NBUCKETS 30
  108: static  union overhead *nextf[NBUCKETS];
  109: 
  110: static  long pagesz;                     /* page size */
  111: static  int pagebucket;                  /* page size bucket */
  112: 
  113: #ifdef MSTATS
  114: /*
  115:  * nmalloc[i] is the difference between the number of mallocs and frees
  116:  * for a given block size.
  117:  */
  118: static  u_int nmalloc[NBUCKETS];
  119: #endif
  120: 
  121: static  pthread_mutex_t malloc_mutex = PTHREAD_MUTEX_INITIALIZER;
  122: 
  123: static void morecore(int);
  124: static int findbucket(union overhead *, int);
  125: #ifdef MSTATS
  126: void mstats(const char *);
  127: #endif
  128: 
  129: #if defined(DEBUG) || defined(RCHECK)
  130: #define ASSERT(p)   if (!(p)) botch(__STRING(p))
  131: 
  132: static void botch(const char *);
  133: 
  134: /*
  135:  * NOTE: since this may be called while malloc_mutex is locked, stdio must not
  136:  *       be used in this function.
  137:  */
  138: static void
  139: botch(s)
  140:         const char *s;
  141: {
  142:         struct iovec iov[3];
  143: 
  144:         iov[0].iov_base        = "\nassertion botched: ";
  145:         iov[0].iov_len = 20;
  146:         iov[1].iov_base        = (void *)s;
  147:         iov[1].iov_len = strlen(s);
  148:         iov[2].iov_base        = "\n";
  149:         iov[2].iov_len = 1;
  150: 
  151:         /*
  152:          * This place deserves a word of warning: a cancellation point will
  153:          * occur when executing writev(), and we might be still owning
  154:          * malloc_mutex.  At this point we need to disable cancellation
  155:          * until `after' abort() because i) establishing a cancellation handler
  156:          * might, depending on the implementation, result in another malloc()
  157:          * to be executed, and ii) it is really not desirable to let execution
  158:          * continue.  `Fix me.'
  159:          * 
  160:          * Note that holding mutex_lock during abort() is safe.
  161:          */
  162: 
  163:         (void)writev(STDERR_FILENO, iov, 3);
  164:         abort();
  165: }
  166: #else
  167: #define ASSERT(p)
  168: #endif
  169: 
  170: void *
  171: malloc(nbytes)
  172:         size_t nbytes;
  173: {
  174:         union overhead *op;
  175:         int bucket;
  176:         long n;
  177:         unsigned amt;
  178: 
  179:         pthread_mutex_lock(&malloc_mutex);
  180: 
  181:         /*
  182:          * First time malloc is called, setup page size and
  183:          * align break pointer so all data will be page aligned.
  184:          */
  185:         if (pagesz == 0) {
  186:                 pagesz = n = getpagesize();
  187:                 ASSERT(pagesz > 0);
  188:                 op = (union overhead *)(void *)sbrk(0);
  189:                 n = n - sizeof (*op) - ((long)op & (n - 1));
  190:                 if (n < 0)
  191:                         n += pagesz;
  192:                 if (n) {
  193:                         if (sbrk((int)n) == (void *)-1) {
  194:                                 pthread_mutex_unlock(&malloc_mutex);
  195:                                 return (NULL);
  196:                         }
  197:                 }
  198:                 bucket = 0;
  199:                 amt = 8;
  200:                 while (pagesz > amt) {
  201:                         amt <<= 1;
  202:                         bucket++;
  203:                 }
  204:                 pagebucket = bucket;
  205:         }
  206:         /*
  207:          * Convert amount of memory requested into closest block size
  208:          * stored in hash buckets which satisfies request.
  209:          * Account for space used per block for accounting.
  210:          */
  211:         if (nbytes <= (n = pagesz - sizeof (*op) - RSLOP)) {
  212: #ifndef RCHECK
  213:                 amt = 8;      /* size of first bucket */
  214:                 bucket = 0;
  215: #else
  216:                 amt = 16;     /* size of first bucket */
  217:                 bucket = 1;
  218: #endif
  219:                 n = -((long)sizeof (*op) + RSLOP);
  220:         } else {
  221:                 amt = (unsigned)pagesz;
  222:                 bucket = pagebucket;
  223:         }
  224:         while (nbytes > amt + n) {
  225:                 amt <<= 1;
  226:                 if (amt == 0)
  227:                         return (NULL);
  228:                 bucket++;
  229:         }
  230:         /*
  231:          * If nothing in hash bucket right now,
  232:          * request more memory from the system.
  233:          */
  234:         if ((op = nextf[bucket]) == NULL) {
  235:                 morecore(bucket);
  236:                 if ((op = nextf[bucket]) == NULL) {
  237:                         pthread_mutex_unlock(&malloc_mutex);
  238:                         return (NULL);
  239:                 }
  240:         }
  241:         /* remove from linked list */
  242:         nextf[bucket] = op->ov_next;
  243:         op->ov_magic = MAGIC;
  244:         op->ov_index = bucket;
  245: #ifdef MSTATS
  246:         nmalloc[bucket]++;
  247: #endif
  248:         pthread_mutex_unlock(&malloc_mutex);
  249: #ifdef RCHECK
  250:         /*
  251:          * Record allocated size of block and
  252:          * bound space with magic numbers.
  253:          */
  254:         op->ov_size = (nbytes + RSLOP - 1) & ~(RSLOP - 1);
  255:         op->ov_rmagic = RMAGIC;
  256:         *(u_short *)((caddr_t)(op + 1) + op->ov_size) = RMAGIC;
  257: #endif
  258:         return ((void *)(op + 1));
  259: }
  260: 
  261: /*
  262:  * Allocate more memory to the indicated bucket.
  263:  */
  264: static void
  265: morecore(bucket)
  266:         int bucket;
  267: {
  268:         union overhead *op;
  269:         long sz;               /* size of desired block */
  270:         long amt;                    /* amount to allocate */
  271:         long nblks;                  /* how many blocks we get */
  272: 
  273:         /*
  274:          * sbrk_size <= 0 only for big, FLUFFY, requests (about
  275:          * 2^30 bytes on a VAX, I think) or for a negative arg.
  276:          */
  277:         sz = 1 << (bucket + 3);
  278: #ifdef DEBUG
  279:         ASSERT(sz > 0);
  280: #else
  281:         if (sz <= 0)
  282:                 return;
  283: #endif
  284:         if (sz < pagesz) {
  285:                 amt = pagesz;
  286:                 nblks = amt / sz;
  287:         } else {
  288:                 amt = sz + pagesz;
  289:                 nblks = 1;
  290:         }
  291:         op = (union overhead *)(void *)sbrk((int)amt);
  292:         /* no more room! */
  293:         if ((long)op == -1)
  294:                 return;
  295:         /*
  296:          * Add new memory allocated to that on
  297:          * free list for this hash bucket.
  298:          */
  299:         nextf[bucket] = op;
  300:         while (--nblks > 0) {
  301:                 op->ov_next =
  302:                     (union overhead *)(void *)((caddr_t)(void *)op+(size_t)sz);
  303:                 op = op->ov_next;
  304:         }
  305: }
  306: 
  307: void
  308: free(cp)
  309:         void *cp;
  310: {   
  311:         long size;
  312:         union overhead *op;
  313: 
  314:         if (cp == NULL)
  315:                 return;
  316:         op = (union overhead *)(void *)((caddr_t)cp - sizeof (union overhead));
  317: #ifdef DEBUG
  318:         ASSERT(op->ov_magic == MAGIC);               /* make sure it was in use */
  319: #else
  320:         if (op->ov_magic != MAGIC)
  321:                 return;                               /* sanity */
  322: #endif
  323: #ifdef RCHECK
  324:         ASSERT(op->ov_rmagic == RMAGIC);
  325:         ASSERT(*(u_short *)((caddr_t)(op + 1) + op->ov_size) == RMAGIC);
  326: #endif
  327:         size = op->ov_index;
  328:         ASSERT(size < NBUCKETS);
  329:         pthread_mutex_lock(&malloc_mutex);
  330:         op->ov_next = nextf[(unsigned int)size];/* also clobbers ov_magic */
  331:         nextf[(unsigned int)size] = op;
  332: #ifdef MSTATS
  333:         nmalloc[(size_t)size]--;
  334: #endif
  335:         pthread_mutex_unlock(&malloc_mutex);
  336: }
  337: 
  338: /*
  339:  * When a program attempts "storage compaction" as mentioned in the
  340:  * old malloc man page, it realloc's an already freed block.  Usually
  341:  * this is the last block it freed; occasionally it might be farther
  342:  * back.  We have to search all the free lists for the block in order
  343:  * to determine its bucket: 1st we make one pass thru the lists
  344:  * checking only the first block in each; if that fails we search
  345:  * ``__realloc_srchlen'' blocks in each list for a match (the variable
  346:  * is extern so the caller can modify it).  If that fails we just copy
  347:  * however many bytes was given to realloc() and hope it's not huge.
  348:  */
  349: int __realloc_srchlen = 4;      /* 4 should be plenty, -1 =>'s whole list */
  350: 
  351: void *
  352: realloc(cp, nbytes)
  353:         void *cp; 
  354:         size_t nbytes;
  355: {   
  356:         u_long onb;
  357:         long i;
  358:         union overhead *op;
  359:         char *res;
  360:         int was_alloced = 0;
  361: 
  362:         if (cp == NULL)
  363:                 return (malloc(nbytes));
  364:         if (nbytes == 0) {
  365:                 free (cp);
  366:                 return (NULL);
  367:         }
  368:         op = (union overhead *)(void *)((caddr_t)cp - sizeof (union overhead));
  369:         pthread_mutex_lock(&malloc_mutex);
  370:         if (op->ov_magic == MAGIC) {
  371:                 was_alloced++;
  372:                 i = op->ov_index;
  373:         } else {
  374:                 /*
  375:                  * Already free, doing "compaction".
  376:                  *
  377:                  * Search for the old block of memory on the
  378:                  * free list.  First, check the most common
  379:                  * case (last element free'd), then (this failing)
  380:                  * the last ``__realloc_srchlen'' items free'd.
  381:                  * If all lookups fail, then assume the size of
  382:                  * the memory block being realloc'd is the
  383:                  * largest possible (so that all "nbytes" of new
  384:                  * memory are copied into).  Note that this could cause
  385:                  * a memory fault if the old area was tiny, and the moon
  386:                  * is gibbous.  However, that is very unlikely.
  387:                  */
  388:                 if ((i = findbucket(op, 1)) < 0 &&
  389:                     (i = findbucket(op, __realloc_srchlen)) < 0)
  390:                         i = NBUCKETS;
  391:         }
  392:         onb = (u_long)1 << (u_long)(i + 3);
  393:         if (onb < pagesz)
  394:                 onb -= sizeof (*op) + RSLOP;
  395:         else
  396:                 onb += pagesz - sizeof (*op) - RSLOP;
  397:         /* avoid the copy if same size block */
  398:         if (was_alloced) {
  399:                 if (i) {
  400:                         i = (long)1 << (long)(i + 2);
  401:                         if (i < pagesz)
  402:                                 i -= sizeof (*op) + RSLOP;
  403:                         else
  404:                                 i += pagesz - sizeof (*op) - RSLOP;
  405:                 }
  406:                 if (nbytes <= onb && nbytes > i) {
  407: #ifdef RCHECK
  408:                         op->ov_size = (nbytes + RSLOP - 1) & ~(RSLOP - 1);
  409:                         *(u_short *)((caddr_t)(op + 1) + op->ov_size) = RMAGIC;
  410: #endif
  411:                         pthread_mutex_unlock(&malloc_mutex);
  412:                         return (cp);
  413:                         
  414:                 }
  415: #ifndef _REENT
  416:                 else
  417:                         free(cp);
  418: #endif
  419:         }
  420:         pthread_mutex_unlock(&malloc_mutex);
  421:         if ((res = malloc(nbytes)) == NULL) {
  422: #ifdef _REENT
  423:                 free(cp);
  424: #endif
  425:                 return (NULL);
  426:         }
  427: #ifndef _REENT
  428:         if (cp != res)         /* common optimization if "compacting" */
  429:                 (void)memmove(res, cp, (size_t)((nbytes < onb) ? nbytes : onb));
  430: #else
  431:         (void)memmove(res, cp, (size_t)((nbytes < onb) ? nbytes : onb));
  432:         free(cp);
  433: #endif
  434:         return (res);
  435: }
  436: 
  437: /*
  438:  * Search ``srchlen'' elements of each free list for a block whose
  439:  * header starts at ``freep''.  If srchlen is -1 search the whole list.
  440:  * Return bucket number, or -1 if not found.
  441:  */
  442: static int
  443: findbucket(freep, srchlen)
  444:         union overhead *freep;
  445:         int srchlen;
  446: {
  447:         union overhead *p;
  448:         int i, j;
  449: 
  450:         for (i = 0; i < NBUCKETS; i++) {
  451:                 j = 0;
  452:                 for (p = nextf[i]; p && j != srchlen; p = p->ov_next) {
  453:                         if (p == freep)
  454:                                 return (i);
  455:                         j++;
  456:                 }
  457:         }
  458:         return (-1);
  459: }
  460: 
  461: #ifdef MSTATS
  462: /*
  463:  * mstats - print out statistics about malloc
  464:  * 
  465:  * Prints two lines of numbers, one showing the length of the free list
  466:  * for each size category, the second showing the number of mallocs -
  467:  * frees for each size category.
  468:  */
  469: void
  470: mstats(s)
  471:         char *s;
  472: {
  473:         int i, j;
  474:         union overhead *p;
  475:         int totfree = 0,
  476:         totused = 0;
  477: 
  478:         fprintf(stderr, "Memory allocation statistics %s\nfree:\t", s);
  479:         for (i = 0; i < NBUCKETS; i++) {
  480:                 for (j = 0, p = nextf[i]; p; p = p->ov_next, j++)
  481:                         ;
  482:                 fprintf(stderr, " %d", j);
  483:                 totfree += j * (1 << (i + 3));
  484:         }
  485:         fprintf(stderr, "\nused:\t");
  486:         for (i = 0; i < NBUCKETS; i++) {
  487:                 fprintf(stderr, " %d", nmalloc[i]);
  488:                 totused += nmalloc[i] * (1 << (i + 3));
  489:         }
  490:         fprintf(stderr, "\n\tTotal in use: %d, total free: %d\n",
  491:             totused, totfree);
  492: }
  493: #endif