4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright (c) 2013 Joyent, Inc. All rights reserved.
26 * Don't Panic! If you find the blocks of assembly that follow confusing and
27 * you're questioning why they exist, please go read section 8 of the umem.c big
28 * theory statement. Next familiarize yourself with the malloc and free
29 * implementations in libumem's malloc.c.
31 * What follows is the amd64 implementation of the thread caching automatic
32 * assembly generation. The amd64 calling conventions are documented in the
33 * 64-bit System V ABI. For our purposes what matters is that our first argument
34 * will come in rdi. Our functions have to preserve rbp, rbx, and r12->r15. We
35 * are free to do whatever we want with rax, rcx, rdx, rsi, rdi, and r8->r11.
37 * For both our implementation of malloc and free we only use the registers we
38 * don't have to preserve.
40 * Malloc register usage:
41 * o. rdi: Original size to malloc. This never changes and is preserved.
42 * o. rsi: Adjusted malloc size for malloc_data_tag(s).
43 * o. rcx: Pointer to the tmem_t in the ulwp_t.
44 * o. rdx: Pointer to the tmem_t array of roots
45 * o. r8: Size of the cache
46 * o. r9: Scratch register
48 * Free register usage:
49 * o. rdi: Original buffer to free. This never changes and is preserved.
50 * o. rax: The actual buffer, adjusted for the hidden malloc_data_t(s).
51 * o. rcx: Pointer to the tmem_t in the ulwp_t.
52 * o. rdx: Pointer to the tmem_t array of roots
53 * o. r8: Size of the cache
54 * o. r9: Scratch register
56 * Once we determine what cache we are using, we increment %rdx to the
57 * appropriate offset and set %r8 with the size of the cache. This means that
58 * when we break out to the normal buffer allocation point %rdx contains the
59 * head of the linked list and %r8 is the amount that we have to adjust the
60 * thread's cached amount by.
62 * Each block of assembly has psuedocode that describes its purpose.
67 #include <sys/types.h>
69 #include <umem_impl.h>
70 #include "umem_base.h"
74 const int umem_genasm_supported
= 1;
75 static uintptr_t umem_genasm_mptr
= (uintptr_t)&_malloc
;
76 static size_t umem_genasm_msize
= 576;
77 static uintptr_t umem_genasm_fptr
= (uintptr_t)&_free
;
78 static size_t umem_genasm_fsize
= 576;
79 static uintptr_t umem_genasm_omptr
= (uintptr_t)umem_malloc
;
80 static uintptr_t umem_genasm_ofptr
= (uintptr_t)umem_malloc_free
;
82 #define UMEM_GENASM_MAX64 (UINT32_MAX / sizeof (uintptr_t))
83 #define PTC_JMPADDR(dest, src) (dest - (src + 4))
84 #define PTC_ROOT_SIZE sizeof (uintptr_t)
85 #define MULTINOP 0x0000441f0f
88 * void *ptcmalloc(size_t orig_size);
90 * size_t size = orig_size + 8;
91 * if (size > UMEM_SECOND_ALIGN)
94 * if (size < orig_size)
95 * goto tomalloc; ! This is overflow
97 * if (size > cache_max)
100 * tmem_t *t = (uintptr_t)curthread() + umem_thr_offset;
101 * void **roots = t->tm_roots;
103 #define PTC_MALINIT_JOUT 0x13
104 #define PTC_MALINIT_MCS 0x1a
105 #define PTC_MALINIT_JOV 0x20
106 #define PTC_MALINIT_SOFF 0x30
107 static const uint8_t malinit
[] = {
108 0x48, 0x8d, 0x77, 0x08, /* leaq 0x8(%rdi),%rsi */
109 0x48, 0x83, 0xfe, 0x10, /* cmpq $0x10, %rsi */
110 0x76, 0x04, /* jbe +0x4 */
111 0x48, 0x8d, 0x77, 0x10, /* leaq 0x10(%rdi),%rsi */
112 0x48, 0x39, 0xfe, /* cmpq %rdi,%rsi */
113 0x0f, 0x82, 0x00, 0x00, 0x00, 0x00, /* jb +errout */
115 0x00, 0x00, 0x00, 0x00, /* cmpq sizeof ($CACHE), %rsi */
116 0x0f, 0x87, 0x00, 0x00, 0x00, 0x00, /* ja +errout */
117 0x64, 0x48, 0x8b, 0x0c, 0x25,
118 0x00, 0x00, 0x00, 0x00, /* movq %fs:0x0,%rcx */
120 0x00, 0x00, 0x00, 0x00, /* addq $SOFF, %rcx */
121 0x48, 0x8d, 0x51, 0x08, /* leaq 0x8(%rcx),%rdx */
125 * void ptcfree(void *buf);
130 * malloc_data_t *tag = buf;
132 * int size = tag->malloc_size;
133 * int tagval = UMEM_MALLOC_DECODE(tag->malloc_tag, size);
134 * if (tagval == MALLOC_SECOND_MAGIC) {
136 * } else if (tagval != MALLOC_MAGIC) {
140 * if (size > cache_max)
143 * tmem_t *t = (uintptr_t)curthread() + umem_thr_offset;
144 * void **roots = t->tm_roots;
146 #define PTC_FRINI_JDONE 0x05
147 #define PTC_FRINI_JFREE 0x25
148 #define PTC_FRINI_MCS 0x30
149 #define PTC_FRINI_JOV 0x36
150 #define PTC_FRINI_SOFF 0x46
151 static const uint8_t freeinit
[] = {
152 0x48, 0x85, 0xff, /* testq %rdi,%rdi */
153 0x0f, 0x84, 0x00, 0x00, 0x00, 0x00, /* jmp $JDONE (done) */
154 0x8b, 0x77, 0xf8, /* movl -0x8(%rdi),%esi */
155 0x8b, 0x47, 0xfc, /* movl -0x4(%rdi),%eax */
156 0x01, 0xf0, /* addl %esi,%eax */
157 0x3d, 0x00, 0x70, 0xba, 0x16, /* cmpl $MALLOC_2_MAGIC, %eax */
158 0x75, 0x06, /* jne +0x6 (checkover) */
159 0x48, 0x8d, 0x47, 0xf0, /* leaq -0x10(%rdi),%eax */
160 0xeb, 0x0f, /* jmp +0xf (freebuf) */
161 0x3d, 0x00, 0xc0, 0x10, 0x3a, /* cmpl $MALLOC_MAGIC, %eax */
162 0x0f, 0x85, 0x00, 0x00, 0x00, 0x00, /* jmp +JFREE (goto torfree) */
163 0x48, 0x8d, 0x47, 0xf8, /* leaq -0x8(%rdi),%rax */
165 0x00, 0x00, 0x00, 0x00, /* cmpq sizeof ($CACHE), %rsi */
166 0x0f, 0x87, 0x00, 0x00, 0x00, 0x00, /* ja +errout */
167 0x64, 0x48, 0x8b, 0x0c, 0x25,
168 0x00, 0x00, 0x00, 0x00, /* movq %fs:0x0,%rcx */
170 0x00, 0x00, 0x00, 0x00, /* addq $SOFF, %rcx */
171 0x48, 0x8d, 0x51, 0x08, /* leaq 0x8(%rcx),%rdx */
175 * if (size <= $CACHE_SIZE) {
176 * csize = $CACHE_SIZE;
177 * } else ... ! goto next cache
179 #define PTC_INICACHE_CMP 0x03
180 #define PTC_INICACHE_SIZE 0x0c
181 #define PTC_INICACHE_JMP 0x11
182 static const uint8_t inicache
[] = {
184 0x00, 0x00, 0x00, 0x00, /* cmpq sizeof ($CACHE), %rsi */
185 0x77, 0x0c, /* ja +0xc (next cache) */
187 0x00, 0x00, 0x00, 0x00, /* movq sizeof ($CACHE), %r8 */
188 0xe9, 0x00, 0x00, 0x00, 0x00, /* jmp $JMP (allocbuf) */
192 * if (size <= $CACHE_SIZE) {
193 * csize = $CACHE_SIZE;
194 * roots += $CACHE_NUM;
195 * } else ... ! goto next cache
197 #define PTC_GENCACHE_CMP 0x03
198 #define PTC_GENCACHE_SIZE 0x0c
199 #define PTC_GENCACHE_NUM 0x13
200 #define PTC_GENCACHE_JMP 0x18
201 static const uint8_t gencache
[] = {
203 0x00, 0x00, 0x00, 0x00, /* cmpq sizeof ($CACHE), %rsi */
204 0x77, 0x14, /* ja +0xc (next cache) */
206 0x00, 0x00, 0x00, 0x00, /* movq sizeof ($CACHE), %r8 */
208 0x00, 0x00, 0x00, 0x00, /* addq $8*ii, %rdx */
209 0xe9, 0x00, 0x00, 0x00, 0x00 /* jmp +$JMP (allocbuf ) */
213 * else if (size <= $CACHE_SIZE) {
214 * csize = $CACHE_SIZE;
215 * roots += $CACHE_NUM;
217 * goto tofunc; ! goto tomalloc if ptcmalloc.
218 * } ! goto tofree if ptcfree.
220 #define PTC_FINCACHE_CMP 0x03
221 #define PTC_FINCACHE_JMP 0x08
222 #define PTC_FINCACHE_SIZE 0x0c
223 #define PTC_FINCACHE_NUM 0x13
224 static const uint8_t fincache
[] = {
226 0x00, 0x00, 0x00, 0x00, /* cmpq sizeof ($CACHE), %rsi */
227 0x77, 0x00, /* ja +JMP (to real malloc) */
229 0x00, 0x00, 0x00, 0x00, /* movq sizeof ($CACHE), %r8 */
231 0x00, 0x00, 0x00, 0x00, /* addq $8*ii, %rdx */
239 * malloc_data_t *ret = *root;
240 * *root = *(void **)ret;
241 * t->tm_size += csize;
242 * ret->malloc_size = size;
244 * if (size > UMEM_SECOND_ALIGN) {
245 * ret->malloc_data = UMEM_MALLOC_ENCODE(MALLOC_SECOND_MAGIC, size);
248 * ret->malloc_data = UMEM_MALLOC_ENCODE(MALLOC_SECOND_MAGIC, size);
252 * return ((void *)ret);
254 * return (malloc(orig_size));
256 #define PTC_MALFINI_ALLABEL 0x00
257 #define PTC_MALFINI_JMLABEL 0x40
258 #define PTC_MALFINI_JMADDR 0x41
259 static const uint8_t malfini
[] = {
260 0x48, 0x8b, 0x02, /* movl (%rdx),%rax */
261 0x48, 0x85, 0xc0, /* testq %rax,%rax */
262 0x74, 0x38, /* je +0x38 (errout) */
263 0x4c, 0x8b, 0x08, /* movq (%rax),%r9 */
264 0x4c, 0x89, 0x0a, /* movq %r9,(%rdx) */
265 0x4c, 0x29, 0x01, /* subq %rsi,(%rcx) */
266 0x48, 0x83, 0xfe, 0x10, /* cmpq $0x10,%rsi */
267 0x76, 0x15, /* jbe +0x15 */
268 0x41, 0xb9, 0x00, 0x70, 0xba, 0x16, /* movl $MALLOC_MAGIC_2, %r9d */
269 0x89, 0x70, 0x08, /* movl %r9d,0x8(%rax) */
270 0x41, 0x29, 0xf1, /* subl %esi, %r9d */
271 0x44, 0x89, 0x48, 0x0c, /* movl %r9d, 0xc(%rax) */
272 0x48, 0x83, 0xc0, 0x10, /* addq $0x10, %rax */
274 0x41, 0xb9, 0x00, 0xc0, 0x10, 0x3a, /* movl %MALLOC_MAGIC, %r9d */
275 0x89, 0x30, /* movl %esi,(%rax) */
276 0x41, 0x29, 0xf1, /* subl %esi,%r9d */
277 0x44, 0x89, 0x48, 0x04, /* movl %r9d,0x4(%rax) */
278 0x48, 0x83, 0xc0, 0x08, /* addq $0x8,%rax */
280 0xe9, 0x00, 0x00, 0x00, 0x00 /* jmp $MALLOC */
284 * if (t->tm_size + csize > umem_ptc_size)
287 * t->tm_size += csize
288 * *(void **)tag = *root;
295 #define PTC_FRFINI_RBUFLABEL 0x00
296 #define PTC_FRFINI_CACHEMAX 0x09
297 #define PTC_FRFINI_DONELABEL 0x1b
298 #define PTC_FRFINI_JFLABEL 0x1c
299 #define PTC_FRFINI_JFADDR 0x1d
300 static const uint8_t freefini
[] = {
301 0x4c, 0x8b, 0x09, /* movq (%rcx),%r9 */
302 0x4d, 0x01, 0xc1, /* addq %r8, %r9 */
304 0x00, 0x00, 0x00, 0x00, /* cmpl $THR_CACHE_MAX, %r9 */
305 0x77, 0x0d, /* jae +0xd (torfree) */
306 0x4c, 0x01, 0x01, /* addq %r8,(%rcx) */
307 0x4c, 0x8b, 0x0a, /* movq (%rdx),%r9 */
308 0x4c, 0x89, 0x08, /* movq %r9,(%rax) */
309 0x48, 0x89, 0x02, /* movq %rax,(%rdx) */
311 0xe9, 0x00, 0x00, 0x00, 0x00 /* jmp free */
315 * Construct the initial part of malloc. off contains the offset from curthread
316 * to the root of the tmem structure. ep is the address of the label to error
317 * and jump to free. csize is the size of the largest umem_cache in ptcumem.
320 genasm_malinit(uint8_t *bp
, uint32_t off
, uint32_t ep
, uint32_t csize
)
324 bcopy(malinit
, bp
, sizeof (malinit
));
325 addr
= PTC_JMPADDR(ep
, PTC_MALINIT_JOUT
);
326 bcopy(&addr
, bp
+ PTC_MALINIT_JOUT
, sizeof (addr
));
327 bcopy(&csize
, bp
+ PTC_MALINIT_MCS
, sizeof (csize
));
328 addr
= PTC_JMPADDR(ep
, PTC_MALINIT_JOV
);
329 bcopy(&addr
, bp
+ PTC_MALINIT_JOV
, sizeof (addr
));
330 bcopy(&off
, bp
+ PTC_MALINIT_SOFF
, sizeof (off
));
332 return (sizeof (malinit
));
336 genasm_frinit(uint8_t *bp
, uint32_t off
, uint32_t dp
, uint32_t ep
, uint32_t mcs
)
340 bcopy(freeinit
, bp
, sizeof (freeinit
));
341 addr
= PTC_JMPADDR(dp
, PTC_FRINI_JDONE
);
342 bcopy(&addr
, bp
+ PTC_FRINI_JDONE
, sizeof (addr
));
343 addr
= PTC_JMPADDR(ep
, PTC_FRINI_JFREE
);
344 bcopy(&addr
, bp
+ PTC_FRINI_JFREE
, sizeof (addr
));
345 bcopy(&mcs
, bp
+ PTC_FRINI_MCS
, sizeof (mcs
));
346 addr
= PTC_JMPADDR(ep
, PTC_FRINI_JOV
);
347 bcopy(&addr
, bp
+ PTC_FRINI_JOV
, sizeof (addr
));
348 bcopy(&off
, bp
+ PTC_FRINI_SOFF
, sizeof (off
));
349 return (sizeof (freeinit
));
354 * Create the initial cache entry of the specified size. The value of ap tells
355 * us what the address of the label to try and allocate a buffer. This value is
356 * an offset from the current base to that value.
359 genasm_firstcache(uint8_t *bp
, uint32_t csize
, uint32_t ap
)
363 bcopy(inicache
, bp
, sizeof (inicache
));
364 bcopy(&csize
, bp
+ PTC_INICACHE_CMP
, sizeof (csize
));
365 bcopy(&csize
, bp
+ PTC_INICACHE_SIZE
, sizeof (csize
));
366 addr
= PTC_JMPADDR(ap
, PTC_INICACHE_JMP
);
368 bcopy(&addr
, bp
+ PTC_INICACHE_JMP
, sizeof (addr
));
370 return (sizeof (inicache
));
374 genasm_gencache(uint8_t *bp
, int num
, uint32_t csize
, uint32_t ap
)
379 ASSERT(UINT32_MAX
/ PTC_ROOT_SIZE
> num
);
381 bcopy(gencache
, bp
, sizeof (gencache
));
382 bcopy(&csize
, bp
+ PTC_GENCACHE_CMP
, sizeof (csize
));
383 bcopy(&csize
, bp
+ PTC_GENCACHE_SIZE
, sizeof (csize
));
384 coff
= num
* PTC_ROOT_SIZE
;
385 bcopy(&coff
, bp
+ PTC_GENCACHE_NUM
, sizeof (coff
));
386 addr
= PTC_JMPADDR(ap
, PTC_GENCACHE_JMP
);
387 bcopy(&addr
, bp
+ PTC_GENCACHE_JMP
, sizeof (addr
));
389 return (sizeof (gencache
));
393 genasm_lastcache(uint8_t *bp
, int num
, uint32_t csize
, uint32_t ep
)
398 ASSERT(ep
<= 0xff && ep
> 7);
399 ASSERT(UINT32_MAX
/ PTC_ROOT_SIZE
> num
);
400 bcopy(fincache
, bp
, sizeof (fincache
));
401 bcopy(&csize
, bp
+ PTC_FINCACHE_CMP
, sizeof (csize
));
402 bcopy(&csize
, bp
+ PTC_FINCACHE_SIZE
, sizeof (csize
));
403 coff
= num
* PTC_ROOT_SIZE
;
404 bcopy(&coff
, bp
+ PTC_FINCACHE_NUM
, sizeof (coff
));
405 eap
= ep
- PTC_FINCACHE_JMP
- 1;
406 bcopy(&eap
, bp
+ PTC_FINCACHE_JMP
, sizeof (eap
));
408 return (sizeof (fincache
));
412 genasm_malfini(uint8_t *bp
, uintptr_t mptr
)
416 bcopy(malfini
, bp
, sizeof (malfini
));
417 addr
= PTC_JMPADDR(mptr
, ((uintptr_t)bp
+ PTC_MALFINI_JMADDR
));
418 bcopy(&addr
, bp
+ PTC_MALFINI_JMADDR
, sizeof (addr
));
420 return (sizeof (malfini
));
424 genasm_frfini(uint8_t *bp
, uint32_t maxthr
, uintptr_t fptr
)
428 bcopy(freefini
, bp
, sizeof (freefini
));
429 bcopy(&maxthr
, bp
+ PTC_FRFINI_CACHEMAX
, sizeof (maxthr
));
430 addr
= PTC_JMPADDR(fptr
, ((uintptr_t)bp
+ PTC_FRFINI_JFADDR
));
431 bcopy(&addr
, bp
+ PTC_FRFINI_JFADDR
, sizeof (addr
));
433 return (sizeof (freefini
));
437 * The malloc inline assembly is constructed as follows:
439 * o Malloc prologue assembly
440 * o Generic first-cache check
441 * o n Generic cache checks (where n = _tmem_get_entries() - 2)
442 * o Generic last-cache check
443 * o Malloc epilogue assembly
445 * Generally there are at least three caches. When there is only one cache we
446 * only use the generic last-cache. In the case where there are two caches, we
447 * just leave out the middle ones.
450 genasm_malloc(void *base
, size_t len
, int nents
, int *umem_alloc_sizes
)
455 uint32_t allocoff
, erroff
;
457 total
= sizeof (malinit
) + sizeof (malfini
) + sizeof (fincache
);
460 total
+= sizeof (inicache
) + sizeof (gencache
) * (nents
- 2);
465 erroff
= total
- sizeof (malfini
) + PTC_MALFINI_JMLABEL
;
466 allocoff
= total
- sizeof (malfini
) + PTC_MALFINI_ALLABEL
;
470 off
= genasm_malinit(bp
, umem_tmem_off
, erroff
,
471 umem_alloc_sizes
[nents
-1]);
477 off
= genasm_firstcache(bp
, umem_alloc_sizes
[0], allocoff
);
483 for (ii
= 1; ii
< nents
- 1; ii
++) {
484 off
= genasm_gencache(bp
, ii
, umem_alloc_sizes
[ii
], allocoff
);
490 bp
+= genasm_lastcache(bp
, nents
- 1, umem_alloc_sizes
[nents
- 1],
492 bp
+= genasm_malfini(bp
, umem_genasm_omptr
);
493 ASSERT(((uintptr_t)bp
- total
) == (uintptr_t)base
);
499 genasm_free(void *base
, size_t len
, int nents
, int *umem_alloc_sizes
)
504 uint32_t rbufoff
, retoff
, erroff
;
506 /* Assume that nents has already been audited for us */
507 total
= sizeof (freeinit
) + sizeof (freefini
) + sizeof (fincache
);
509 total
+= sizeof (inicache
) + sizeof (gencache
) * (nents
- 2);
514 erroff
= total
- (sizeof (freefini
) - PTC_FRFINI_JFLABEL
);
515 rbufoff
= total
- (sizeof (freefini
) - PTC_FRFINI_RBUFLABEL
);
516 retoff
= total
- (sizeof (freefini
) - PTC_FRFINI_DONELABEL
);
520 off
= genasm_frinit(bp
, umem_tmem_off
, retoff
, erroff
,
521 umem_alloc_sizes
[nents
- 1]);
527 off
= genasm_firstcache(bp
, umem_alloc_sizes
[0], rbufoff
);
533 for (ii
= 1; ii
< nents
- 1; ii
++) {
534 off
= genasm_gencache(bp
, ii
, umem_alloc_sizes
[ii
], rbufoff
);
540 bp
+= genasm_lastcache(bp
, nents
- 1, umem_alloc_sizes
[nents
- 1],
542 bp
+= genasm_frfini(bp
, umem_ptc_size
, umem_genasm_ofptr
);
543 ASSERT(((uintptr_t)bp
- total
) == (uintptr_t)base
);
550 umem_genasm(int *cp
, umem_cache_t
**caches
, int nc
)
557 mptr
= (void *)((uintptr_t)umem_genasm_mptr
+ 5);
558 fptr
= (void *)((uintptr_t)umem_genasm_fptr
+ 5);
559 if (umem_genasm_mptr
== 0 || umem_genasm_msize
== 0 ||
560 umem_genasm_fptr
== 0 || umem_genasm_fsize
== 0)
564 * The total number of caches that we can service is the minimum of:
565 * o the amount supported by libc
566 * o the total number of umem caches
567 * o we use a single byte addl, so it's MAX_UINT32 / sizeof (uintptr_t)
568 * For 64-bit, this is MAX_UINT32 >> 3, a lot.
570 nents
= _tmem_get_nentries();
572 if (UMEM_GENASM_MAX64
< nents
)
573 nents
= UMEM_GENASM_MAX64
;
578 /* Based on our constraints, this is not an error */
579 if (nents
== 0 || umem_ptc_size
== 0)
582 /* Take into account the jump */
583 if (genasm_malloc(mptr
, umem_genasm_msize
, nents
, cp
) != 0)
586 if (genasm_free(fptr
, umem_genasm_fsize
, nents
, cp
) != 0)
590 /* nop out the jump with a multibyte jump */
591 vptr
= (void *)umem_genasm_mptr
;
593 v
|= *vptr
& (0xffffffULL
<< 40);
594 (void) atomic_swap_64(vptr
, v
);
595 vptr
= (void *)umem_genasm_fptr
;
597 v
|= *vptr
& (0xffffffULL
<< 40);
598 (void) atomic_swap_64(vptr
, v
);
600 for (i
= 0; i
< nents
; i
++)
601 caches
[i
]->cache_flags
|= UMF_PTC
;