OLD | NEW |
(Empty) | |
| 1 // Copyright (c) 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #ifndef BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_ |
| 6 #define BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_ |
| 7 |
| 8 #include <stdint.h> |
| 9 |
| 10 #include "base/base_export.h" |
| 11 #include "base/macros.h" |
| 12 |
| 13 namespace base { |
| 14 |
| 15 // Simple allocator for pieces of a memory block that may be shared across |
| 16 // multiple processes. |
| 17 // |
| 18 // This class provides for thread-secure (i.e. safe against other threads |
| 19 // or processes that may be compromised and thus have malicious intent) |
| 20 // allocation of memory within a designated block and also a mechanism by |
| 21 // which other threads can learn of the allocations with any additional |
| 22 // shared information. |
| 23 // |
| 24 // There is (currently) no way to release an allocated block of data because |
| 25 // doing so would risk invalidating pointers held by other processes and |
| 26 // greatly complicate the allocation algorithm. |
| 27 // |
| 28 // Construction of this object can accept new, clean (i.e. zeroed) memory |
| 29 // or previously initialized memory. In the first case, construction must |
| 30 // be allowed to complete before letting other allocators attach to the same |
| 31 // segment. In other words, don't share the segment until at least one |
| 32 // allocator has been attached to it. |
| 33 // |
| 34 // It should be noted that memory doesn't need to actually have zeros written |
| 35 // throughout; it just needs to read as zero until something diffferent is |
| 36 // written to a location. This is an important distinction as it supports the |
| 37 // use-case of non-pinned memory, such as from a demand-allocated region by |
| 38 // the OS or a memory-mapped file that auto-grows from a starting size of zero. |
| 39 class BASE_EXPORT SharedMemoryAllocator { |
| 40 public: |
| 41 struct Iterator { |
| 42 int32_t last; |
| 43 int32_t loop_detector; |
| 44 }; |
| 45 |
| 46 struct MemoryInfo { |
| 47 int32_t total; |
| 48 int32_t free; |
| 49 }; |
| 50 |
| 51 // The allocator operates on any arbitrary block of memory. Creation and |
| 52 // sharing of that block with another process is the responsibility of the |
| 53 // caller. The allocator needs to know only the block's |base| address, the |
| 54 // total |size| of the block, and any internal |page| size (zero if not |
| 55 // paged) across which allocations should not span. |
| 56 // |
| 57 // SharedMemoryAllocator does NOT take ownership of this memory block. The |
| 58 // caller must manage it and ensure it stays available throughout the lifetime |
| 59 // of this object. |
| 60 SharedMemoryAllocator(void* base, int32_t size, int32_t page_size); |
| 61 ~SharedMemoryAllocator(); |
| 62 |
| 63 // Get an object referenced by an |offset|. For safety reasons, the |type| |
| 64 // code and size-of |unused| are compared to ensure the reference is valid |
| 65 // and cannot return an object outside of the memory segment. A |type| of |
| 66 // zero will match any though the size is still checked. NULL is returned |
| 67 // if any problem is detected, such as corrupted storage or incorrect |
| 68 // parameters. Callers MUST check that the returned value is not-null EVERY |
| 69 // TIME before accessing it or risk crashing! Once dereferenced, the pointer |
| 70 // is safe to reuse forever. |
| 71 // |
| 72 // NOTE: Though this method will guarantee that an object of the specified |
| 73 // type can be accessed without going outside the bounds of the memory |
| 74 // segment, it makes not guarantees of the validity of the data within the |
| 75 // object itself. If it is expected that the contents of the segment could |
| 76 // be compromised with malicious intent, the object must be hardened as well. |
| 77 template<typename T> T* GetType(int32_t offset, int32_t type) { |
| 78 return static_cast<T*>(GetBlockData(offset, type, sizeof(T), false)); |
| 79 } |
| 80 |
| 81 // Reserve space in the memory segment of the desired |size| and |type|. |
| 82 // A return value of zero indicates the allocation failed, otherwise the |
| 83 // returned offset can be used by any process to get a real pointer via |
| 84 // the GetObject() call. |
| 85 int32_t Allocate(int32_t size, int32_t type); |
| 86 |
| 87 // Get the information about the amount of free space in the allocator. The |
| 88 // amount of free space should be treated as approximate due to extras from |
| 89 // alignment and metadata, but will never return less than could actually |
| 90 // be allocated. |
| 91 void GetMemoryInfo(MemoryInfo* meminfo); |
| 92 |
| 93 // Allocated objects can be added to an internal list that can then be |
| 94 // iterated over by other processes. |
| 95 void MakeIterable(int32_t offset); |
| 96 |
| 97 // Iterating uses a |state| structure (initialized by CreateIterator) and |
| 98 // returns both the offset reference to the object as well as the |type| of |
| 99 // that object. A zero return value indicates there are currently no more |
| 100 // objects to be found but future attempts can be made without having to |
| 101 // reset the iterator to "first". |
| 102 void CreateIterator(Iterator* state); |
| 103 int32_t GetNextIterable(Iterator* state, int32_t* type); |
| 104 |
| 105 // If there is some indication that the shared memory has become corrupted, |
| 106 // calling this will attempt to prevent further damage by indicating to |
| 107 // all processes that something is not as expected. |
| 108 void SetCorrupted(); |
| 109 bool IsCorrupted(); |
| 110 |
| 111 // Flag set if an allocation has failed because memory was full. |
| 112 bool IsFull(); |
| 113 |
| 114 private: |
| 115 struct SharedMetadata; |
| 116 struct BlockHeader; |
| 117 |
| 118 BlockHeader* GetBlock(int32_t offset, int32_t type, int32_t size, |
| 119 bool special); |
| 120 void* GetBlockData(int32_t offset, int32_t type, int32_t size, bool special); |
| 121 |
| 122 SharedMetadata* shared_meta_; |
| 123 char* mem_base_; // char because sizeof guaranteed 1 -- easy offset calc |
| 124 int32_t mem_size_; |
| 125 int32_t mem_page_; |
| 126 int32_t last_seen_; |
| 127 bool corrupted_; |
| 128 |
| 129 DISALLOW_COPY_AND_ASSIGN(SharedMemoryAllocator); |
| 130 }; |
| 131 |
| 132 } // namespace base |
| 133 |
| 134 #endif // BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_ |
OLD | NEW |