Create "persistent memory allocator" for persisting and sharing objects.

base/memory/shared_memory_allocator.h

+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_
+#define BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_
+
+#include <stdint.h>
+
+#include "base/base_export.h"
+#include "base/macros.h"
+
+namespace base {
+
+// Simple allocator for pieces of a memory block that may be shared across
+// multiple processes.
+//
+// This class provides for thread-secure (i.e. safe against other threads
+// or processes that may be compromised and thus have malicious intent)

[chrisha, 2015/10/30 14:36:46]

How can this possibly be true? If I'm a malicious thread I can simply write
whatever I want all over memory, and fool the allocator into thinking anything I
want it to think.

I don't this strong security against malicious writers is a requirement. Some
kind of weak consistency is useful, but making this all out secure in the face
of something in our process is both unrealistic and unnecessary.

+// allocation of memory within a designated block and also a mechanism by
+// which other threads can learn of the allocations with any additional
+// shared information.
+//
+// There is (currently) no way to release an allocated block of data because
+// doing so would risk invalidating pointers held by other processes and
+// greatly complicate the allocation algorithm.

[chrisha, 2015/10/30 14:36:46]

Pointer invalidation isn't a reason, as this is true of all allocators, and
memory management is the user's responsibility.

(It doesn't support it because of the complication aspect, and the fact that we
don't actually require it.)

+class BASE_EXPORT SharedMemoryAllocator {
+ public:
+  struct Iterator {
+    int32_t last;
+  };
+
+  struct MemoryInfo {
+    int32_t total;
+    int32_t free;
+  };
+
+  // The allocator operates on any arbitrary block of memory.  Creation and
+  // sharing of that block with another process is the responsibility of the
+  // caller.  The allocator needs to know only the block's |base| address, the
+  // total |size| of the block, and any internal |page| size (zero if not
+  // paged) across which allocations should not span.
+  //
+  // SharedMemoryAllocator does NOT take ownership of this memory block.  The
+  // caller must manage it and ensure it stays available throughout the lifetime
+  // of this object.
+  SharedMemoryAllocator(void* base, int32_t size, int32_t page);
+  ~SharedMemoryAllocator();
+
+  // Get an object referenced by an |offset|.  For safety reasons, the |type|
+  // code and size-of |unused| are compared to ensure the reference is valid
+  // and cannot return an object outside of the memory segment.  A |type| of
+  // zero will match any though the size is still checked.  NULL is returned
+  // if any problem is detected, such as corrupted storage or incorrect
+  // parameters.  Callers MUST check that the returned value is not-null EVERY
+  // TIME before accessing it or risk crashing!  Once dereferenced, the pointer
+  // is safe to reuse forever.
+  //
+  // NOTE: Though this method will guarantee that an object of the specified
+  // type can be accessed without going outside the bounds of the memory
+  // segment, it makes not guarantees of the validity of the data within the
+  // object itself.  If it is expected that the contents of the segment could
+  // be compromised with malicious intent, the object must be hardened as well.
+  template<typename T> T* GetObject(int32_t offset, int32_t type) {
+    return static_cast<T*>(GetBlockData(offset, type, sizeof(T), false));
+  }
+
+  // Reserve space in the memory segment of the desired |size| and |type|.
+  // A return value of zero indicates the allocation failed, otherwise the
+  // returned offset can be used by any process to get a real pointer via
+  // the GetObject() call.
+  int32_t Allocate(int32_t size, int32_t type);
+
+  // Get the information about the amount of free space in the allocator.  The
+  // amount of free space should be treated as approximate due to extras from
+  // alignment and metadata, but will never return less than could actually
+  // be allocated.
+  void GetMemoryInfo(MemoryInfo* meminfo);
+
+  // Allocated objects can be added to an internal list that can then be
+  // iterated over by other processes.
+  void MakeIterable(int32_t offset);
+
+  // Iterating uses a |state| structure (initialized by GetFirstIterable) and
+  // returns both the offset reference to the object as well as the |type| of
+  // that object.  A zero return value indicates there are currently no more
+  // objects to be found but future attempts can be made without having to
+  // reset the iterator to "first".
+  int32_t GetFirstIterable(Iterator* state, int32_t* type);
+  int32_t GetNextIterable(Iterator* state, int32_t* type);
+
+  // If there is some indication that the shared memory has become corrupted,
+  // calling this will attempt to prevent further damage by indicating to
+  // all processes that something is not as expected.
+  void SetCorrupted();
+  bool IsCorrupted();
+
+  // Flag set if an allocation has failed because memory was full.
+  bool IsFull();
+
+ private:
+  struct SharedMetadata;
+  struct BlockHeader;
+
+  BlockHeader* GetBlock(int32_t offset, int32_t type, int32_t size,
+                        bool special);
+  void* GetBlockData(int32_t offset, int32_t type, int32_t size, bool special);
+
+  SharedMetadata* shared_meta_;
+  char* mem_base_;  // char because sizeof guaranteed 1 -- easy offset calc
+  int32_t mem_size_;
+  int32_t mem_page_;
+  int32_t last_seen_;
+  bool corrupted_;
+
+  DISALLOW_COPY_AND_ASSIGN(SharedMemoryAllocator);
+};
+
+}  // namespace base
+
+#endif  // BASE_MEMORY_SHARED_MEMORY_ALLOCATOR_H_