From c5e08573bfe832e640241411173fb8851815f2d3 Mon Sep 17 00:00:00 2001 From: Nathaniel Filardo Date: Tue, 15 Dec 2020 22:19:13 +0000 Subject: [PATCH] NFC: prepare RemoteCache API for amplification When post()-ing the RemoteCache to message queues, we push an entire bucket onto a remote allocator's incoming queue (specifically, the allocator owning the front Remote in the bucket we're moving). In order to do that, we need to exceed the bounds of the Remote allocation and reference its Allocslab header (to get the ->message_queue). On StrictProvenance architectures, this will require that we amplify the head Remote* and then engage in some pointer math. While Remotes contain the address of the message_queue as the allocator's identity, this may not be a pointer, just an address, and may have undergone obfuscation anyway. --- src/mem/alloc.h | 8 +++++--- src/mem/globalalloc.h | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/mem/alloc.h b/src/mem/alloc.h index 5b51954..1098224 100644 --- a/src/mem/alloc.h +++ b/src/mem/alloc.h @@ -561,8 +561,10 @@ namespace snmalloc l->last = r; } - void post(alloc_id_t id) + void post(LargeAlloc* large_allocator, alloc_id_t id) { + UNUSED(large_allocator); + // When the cache gets big, post lists to their target allocators. capacity = REMOTE_CACHE; @@ -896,7 +898,7 @@ namespace snmalloc return; stats().remote_post(); - remote.post(get_trunc_id()); + remote.post(&large_allocator, get_trunc_id()); } /** @@ -1565,7 +1567,7 @@ namespace snmalloc remote.dealloc(target->trunc_id(), offseted, sizeclass); stats().remote_post(); - remote.post(get_trunc_id()); + remote.post(&large_allocator, get_trunc_id()); } ChunkMap& chunkmap() diff --git a/src/mem/globalalloc.h b/src/mem/globalalloc.h index 16cf29a..ee6a417 100644 --- a/src/mem/globalalloc.h +++ b/src/mem/globalalloc.h @@ -126,7 +126,7 @@ namespace snmalloc if (alloc->remote.capacity < REMOTE_CACHE) { alloc->stats().remote_post(); - alloc->remote.post(alloc->get_trunc_id()); + alloc->remote.post(&alloc->large_allocator, alloc->get_trunc_id()); done = false; }