Cheri-research/snmalloc
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Remote queues hold Wild pointers

Browse Source
This commit is contained in:
Nathaniel Wesley Filardo
2021-09-28 15:47:15 +01:00
committed by Nathaniel Wesley Filardo
parent 94ab856ff5
commit 501c14661f
3 changed files with 66 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
src/mem/remoteallocator.h
View File

@@ -36,11 +36,11 @@ namespace snmalloc
// Store the message queue on a separate cacheline. It is mutable data that
// is read by other threads.
alignas(CACHELINE_SIZE)
FreeObject::AtomicQueuePtr<capptr::bounds::Alloc> back{nullptr};
FreeObject::AtomicQueuePtr<capptr::bounds::AllocWild> back{nullptr};
// Store the two ends on different cache lines as access by different
// threads.
alignas(CACHELINE_SIZE) FreeObject::QueuePtr<capptr::bounds::Alloc> front{
nullptr};
alignas(CACHELINE_SIZE)
FreeObject::QueuePtr<capptr::bounds::AllocWild> front{nullptr};
constexpr RemoteAllocator() = default;
@@ -50,17 +50,19 @@ namespace snmalloc
SNMALLOC_ASSERT(front != nullptr);
}
void init(FreeObject::QueuePtr<capptr::bounds::Alloc> stub)
void
init(FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>
stub)
{
FreeObject::atomic_store_null(stub, key_global);
front = stub;
back.store(stub, std::memory_order_relaxed);
front = capptr_rewild(stub);
back.store(front, std::memory_order_relaxed);
invariant();
}
FreeObject::QueuePtr<capptr::bounds::Alloc> destroy()
FreeObject::QueuePtr<capptr::bounds::AllocWild> destroy()
{
FreeObject::QueuePtr<capptr::bounds::Alloc> fnt = front;
FreeObject::QueuePtr<capptr::bounds::AllocWild> fnt = front;
back.store(nullptr, std::memory_order_relaxed);
front = nullptr;
return fnt;
@@ -68,7 +70,7 @@ namespace snmalloc
inline bool is_empty()
{
FreeObject::QueuePtr<capptr::bounds::Alloc> bk =
FreeObject::QueuePtr<capptr::bounds::AllocWild> bk =
back.load(std::memory_order_relaxed);
return bk == front;
@@ -78,23 +80,26 @@ namespace snmalloc
* Pushes a list of messages to the queue. Each message from first to
* last should be linked together through their next pointers.
*/
template<typename Domesticator>
void enqueue(
FreeObject::QueuePtr<capptr::bounds::Alloc> first,
FreeObject::QueuePtr<capptr::bounds::Alloc> last,
const FreeListKey& key)
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>
first,
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>
last,
const FreeListKey& key,
Domesticator domesticate)
{
invariant();
FreeObject::atomic_store_null(last, key);
// exchange needs to be a release, so nullptr in next is visible.
FreeObject::QueuePtr<capptr::bounds::Alloc> prev =
back.exchange(last, std::memory_order_release);
FreeObject::QueuePtr<capptr::bounds::AllocWild> prev =
back.exchange(capptr_rewild(last), std::memory_order_release);
// XXX prev is not known to be domesticated
FreeObject::atomic_store_next(prev, first, key);
FreeObject::atomic_store_next(domesticate(prev), first, key);
}
FreeObject::QueuePtr<capptr::bounds::Alloc> peek()
FreeObject::QueuePtr<capptr::bounds::AllocWild> peek()
{
return front;
}
@@ -104,19 +109,27 @@ namespace snmalloc
*/
template<typename Domesticator>
std::pair<
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::Alloc>,
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>,
bool>
dequeue(const FreeListKey& key, Domesticator domesticate)
{
invariant();
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::Alloc> first =
domesticate(front);
FreeObject::QueuePtr<capptr::bounds::Alloc> next =
first->atomic_read_next(key, domesticate);
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>
first = domesticate(front);
FreeObject::HeadPtr<capptr::bounds::Alloc, capptr::bounds::AllocWild>
next = first->atomic_read_next(key, domesticate);
if (next != nullptr)
{
front = next;
/*
* We've domesticate_queue-d next so that we can read through it, but
* we're storing it back into client-accessible memory in
* !QueueHeadsAreTame builds, so go ahead and consider it Wild again.
* On QueueHeadsAreTame builds, the subsequent domesticate_head call
* above will also be a type-level sleight of hand, but we can still
* justify it by the domesticate_queue that happened in this dequeue().
*/
front = capptr_rewild(next);
invariant();
return {first, true};
}