Annotation of sys/kern/kern_malloc_debug.c, Revision 1.1.1.1
1.1 nbrk 1: /* $OpenBSD: kern_malloc_debug.c,v 1.26 2007/04/13 18:57:49 art Exp $ */
2:
3: /*
4: * Copyright (c) 1999, 2000 Artur Grabowski <art@openbsd.org>
5: * All rights reserved.
6: *
7: * Redistribution and use in source and binary forms, with or without
8: * modification, are permitted provided that the following conditions
9: * are met:
10: *
11: * 1. Redistributions of source code must retain the above copyright
12: * notice, this list of conditions and the following disclaimer.
13: * 2. The name of the author may not be used to endorse or promote products
14: * derived from this software without specific prior written permission.
15: *
16: * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
17: * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
18: * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
19: * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
20: * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21: * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
22: * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
23: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
24: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
25: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26: */
27:
28: /*
29: * This really belongs in kern/kern_malloc.c, but it was too much pollution.
30: */
31:
32: /*
33: * It's only possible to debug one type/size at a time. The question is
34: * if this is a limitation or a feature. We never want to run this as the
35: * default malloc because we'll run out of memory really fast. Adding
36: * more types will also add to the complexity of the code.
37: *
38: * This is really simple. Every malloc() allocates two virtual pages,
39: * the second page is left unmapped, and the value returned is aligned
40: * so that it ends at (or very close to) the page boundary to catch overflows.
41: * Every free() changes the protection of the first page to VM_PROT_NONE so
42: * that we can catch any dangling writes to it.
43: * To minimize the risk of writes to recycled chunks we keep an LRU of latest
44: * freed chunks. The length of it is controlled by MALLOC_DEBUG_CHUNKS.
45: *
46: * Don't expect any performance.
47: *
48: * TODO:
49: * - support for size >= PAGE_SIZE
50: * - add support to the fault handler to give better diagnostics if we fail.
51: */
52:
53: #include <sys/param.h>
54: #include <sys/proc.h>
55: #include <sys/kernel.h>
56: #include <sys/malloc.h>
57: #include <sys/systm.h>
58: #include <sys/pool.h>
59:
60: #include <uvm/uvm.h>
61:
62: /*
63: * debug_malloc_type and debug_malloc_size define the type and size of
64: * memory to be debugged. Use 0 for a wildcard. debug_malloc_size_lo
65: * is the lower limit and debug_malloc_size_hi the upper limit of sizes
66: * being debugged; 0 will not work as a wildcard for the upper limit.
67: * For any debugging to take place, type must be != -1, size must be >= 0,
68: * and if the limits are being used, size must be set to 0.
69: * See /usr/src/sys/sys/malloc.h and malloc(9) for a list of types.
70: *
71: * Although those are variables, it's a really bad idea to change the type
72: * if any memory chunks of this type are used. It's ok to change the size
73: * in runtime.
74: */
75: int debug_malloc_type = -1;
76: int debug_malloc_size = -1;
77: int debug_malloc_size_lo = -1;
78: int debug_malloc_size_hi = -1;
79:
80: /*
81: * MALLOC_DEBUG_CHUNKS is the number of memory chunks we require on the
82: * freelist before we reuse them.
83: */
84: #define MALLOC_DEBUG_CHUNKS 16
85:
86: void debug_malloc_allocate_free(int);
87:
88: struct debug_malloc_entry {
89: TAILQ_ENTRY(debug_malloc_entry) md_list;
90: vaddr_t md_va;
91: paddr_t md_pa;
92: size_t md_size;
93: int md_type;
94: };
95:
96: TAILQ_HEAD(,debug_malloc_entry) debug_malloc_freelist;
97: TAILQ_HEAD(,debug_malloc_entry) debug_malloc_usedlist;
98:
99: int debug_malloc_allocs;
100: int debug_malloc_frees;
101: int debug_malloc_pages;
102: int debug_malloc_chunks_on_freelist;
103:
104: int debug_malloc_initialized;
105:
106: struct pool debug_malloc_pool;
107:
108: int
109: debug_malloc(unsigned long size, int type, int flags, void **addr)
110: {
111: struct debug_malloc_entry *md = NULL;
112: int s, wait = (flags & M_NOWAIT) == 0;
113:
114: /* Careful not to compare unsigned long to int -1 */
115: if (((type != debug_malloc_type && debug_malloc_type != 0) ||
116: (size != debug_malloc_size && debug_malloc_size != 0) ||
117: (debug_malloc_size_lo != -1 && size < debug_malloc_size_lo) ||
118: (debug_malloc_size_hi != -1 && size > debug_malloc_size_hi) ||
119: !debug_malloc_initialized) && type != M_DEBUG)
120: return (0);
121:
122: /* XXX - fix later */
123: if (size > PAGE_SIZE)
124: return (0);
125:
126: s = splvm();
127: if (debug_malloc_chunks_on_freelist < MALLOC_DEBUG_CHUNKS)
128: debug_malloc_allocate_free(wait);
129:
130: md = TAILQ_FIRST(&debug_malloc_freelist);
131: if (md == NULL) {
132: splx(s);
133: return (0);
134: }
135: TAILQ_REMOVE(&debug_malloc_freelist, md, md_list);
136: debug_malloc_chunks_on_freelist--;
137:
138: TAILQ_INSERT_HEAD(&debug_malloc_usedlist, md, md_list);
139: debug_malloc_allocs++;
140: splx(s);
141:
142: pmap_kenter_pa(md->md_va, md->md_pa, VM_PROT_READ|VM_PROT_WRITE);
143: pmap_update(pmap_kernel());
144:
145: md->md_size = size;
146: md->md_type = type;
147:
148: /*
149: * Align the returned addr so that it ends where the first page
150: * ends. roundup to get decent alignment.
151: */
152: *addr = (void *)(md->md_va + PAGE_SIZE - roundup(size, sizeof(long)));
153: return (1);
154: }
155:
156: int
157: debug_free(void *addr, int type)
158: {
159: struct debug_malloc_entry *md;
160: vaddr_t va;
161: int s;
162:
163: if (type != debug_malloc_type && debug_malloc_type != 0 &&
164: type != M_DEBUG)
165: return (0);
166:
167: /*
168: * trunc_page to get the address of the page.
169: */
170: va = trunc_page((vaddr_t)addr);
171:
172: s = splvm();
173: TAILQ_FOREACH(md, &debug_malloc_usedlist, md_list)
174: if (md->md_va == va)
175: break;
176:
177: /*
178: * If we are not responsible for this entry, let the normal free
179: * handle it
180: */
181: if (md == NULL) {
182: /*
183: * sanity check. Check for multiple frees.
184: */
185: TAILQ_FOREACH(md, &debug_malloc_freelist, md_list)
186: if (md->md_va == va)
187: panic("debug_free: already free");
188: splx(s);
189: return (0);
190: }
191:
192: debug_malloc_frees++;
193: TAILQ_REMOVE(&debug_malloc_usedlist, md, md_list);
194:
195: TAILQ_INSERT_TAIL(&debug_malloc_freelist, md, md_list);
196: debug_malloc_chunks_on_freelist++;
197: /*
198: * unmap the page.
199: */
200: pmap_kremove(md->md_va, PAGE_SIZE);
201: pmap_update(pmap_kernel());
202: splx(s);
203:
204: return (1);
205: }
206:
207: void
208: debug_malloc_init(void)
209: {
210:
211: TAILQ_INIT(&debug_malloc_freelist);
212: TAILQ_INIT(&debug_malloc_usedlist);
213:
214: debug_malloc_allocs = 0;
215: debug_malloc_frees = 0;
216: debug_malloc_pages = 0;
217: debug_malloc_chunks_on_freelist = 0;
218:
219: pool_init(&debug_malloc_pool, sizeof(struct debug_malloc_entry),
220: 0, 0, 0, "mdbepl", NULL);
221:
222: debug_malloc_initialized = 1;
223: }
224:
225: /*
226: * Add one chunk to the freelist.
227: *
228: * called at splvm.
229: */
230: void
231: debug_malloc_allocate_free(int wait)
232: {
233: vaddr_t va, offset;
234: struct vm_page *pg;
235: struct debug_malloc_entry *md;
236:
237: splassert(IPL_VM);
238:
239: md = pool_get(&debug_malloc_pool, wait ? PR_WAITOK : PR_NOWAIT);
240: if (md == NULL)
241: return;
242:
243: va = uvm_km_kmemalloc(kmem_map, NULL, PAGE_SIZE * 2,
244: UVM_KMF_VALLOC | (wait ? 0: UVM_KMF_NOWAIT));
245: if (va == 0) {
246: pool_put(&debug_malloc_pool, md);
247: return;
248: }
249:
250: offset = va - vm_map_min(kernel_map);
251: for (;;) {
252: pg = uvm_pagealloc(NULL, 0, NULL, 0);
253: if (pg) {
254: atomic_clearbits_int(&pg->pg_flags, PG_BUSY);
255: UVM_PAGE_OWN(pg, NULL);
256: }
257:
258: if (pg)
259: break;
260:
261: if (wait == 0) {
262: uvm_unmap(kmem_map, va, va + PAGE_SIZE * 2);
263: pool_put(&debug_malloc_pool, md);
264: return;
265: }
266: uvm_wait("debug_malloc");
267: }
268:
269: md->md_va = va;
270: md->md_pa = VM_PAGE_TO_PHYS(pg);
271:
272: debug_malloc_pages++;
273: TAILQ_INSERT_HEAD(&debug_malloc_freelist, md, md_list);
274: debug_malloc_chunks_on_freelist++;
275: }
276:
277: void
278: debug_malloc_print(void)
279: {
280:
281: debug_malloc_printit(printf, NULL);
282: }
283:
284: void
285: debug_malloc_assert_allocated(void *addr, const char *func)
286: {
287: struct debug_malloc_entry *md;
288: vaddr_t va = (vaddr_t)addr;
289:
290: TAILQ_FOREACH(md, &debug_malloc_freelist, md_list) {
291: if (va >= md->md_va &&
292: va < md->md_va + 2 * PAGE_SIZE)
293: panic("debug_malloc: (%s): %p - freed", func, addr);
294: }
295: TAILQ_FOREACH(md, &debug_malloc_usedlist, md_list) {
296: if (va >= md->md_va + PAGE_SIZE &&
297: va < md->md_va + 2 * PAGE_SIZE)
298: panic("debug_malloc: (%s): %p - overflow", func, addr);
299: }
300: }
301:
302: void
303: debug_malloc_printit(int (*pr)(const char *, ...), vaddr_t addr)
304: {
305: struct debug_malloc_entry *md;
306:
307: if (addr) {
308: TAILQ_FOREACH(md, &debug_malloc_freelist, md_list) {
309: if (addr >= md->md_va &&
310: addr < md->md_va + 2 * PAGE_SIZE) {
311: (*pr)("Memory at address 0x%x is in a freed "
312: "area. type %d, size: %d\n ",
313: addr, md->md_type, md->md_size);
314: return;
315: }
316: }
317: TAILQ_FOREACH(md, &debug_malloc_usedlist, md_list) {
318: if (addr >= md->md_va + PAGE_SIZE &&
319: addr < md->md_va + 2 * PAGE_SIZE) {
320: (*pr)("Memory at address 0x%x is just outside "
321: "an allocated area. type %d, size: %d\n",
322: addr, md->md_type, md->md_size);
323: return;
324: }
325: }
326: (*pr)("Memory at address 0x%x is outside debugged malloc.\n");
327: return;
328: }
329:
330: (*pr)("allocs: %d\n", debug_malloc_allocs);
331: (*pr)("frees: %d\n", debug_malloc_frees);
332: (*pr)("pages used: %d\n", debug_malloc_pages);
333: (*pr)("chunks on freelist: %d\n", debug_malloc_chunks_on_freelist);
334:
335: (*pr)("\taddr:\tsize:\n");
336: (*pr)("free chunks:\n");
337: TAILQ_FOREACH(md, &debug_malloc_freelist, md_list)
338: (*pr)("\t0x%x\t0x%x\t%d\n", md->md_va, md->md_size,
339: md->md_type);
340: (*pr)("used chunks:\n");
341: TAILQ_FOREACH(md, &debug_malloc_usedlist, md_list)
342: (*pr)("\t0x%x\t0x%x\t%d\n", md->md_va, md->md_size,
343: md->md_type);
344: }
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to kern_malloc_debug.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / kern