arena.h 16.5 KB
Newer Older
Kenton Varda's avatar
Kenton Varda committed
1 2
// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributors
// Licensed under the MIT License:
3
//
Kenton Varda's avatar
Kenton Varda committed
4 5 6 7 8 9
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
10
//
Kenton Varda's avatar
Kenton Varda committed
11 12
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
13
//
Kenton Varda's avatar
Kenton Varda committed
14 15 16 17 18 19 20
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
// THE SOFTWARE.
21

Kenton Varda's avatar
Kenton Varda committed
22 23
#ifndef CAPNP_ARENA_H_
#define CAPNP_ARENA_H_
24

25 26 27 28
#if defined(__GNUC__) && !CAPNP_HEADER_WARNINGS
#pragma GCC system_header
#endif

Kenton Varda's avatar
Kenton Varda committed
29
#ifndef CAPNP_PRIVATE
30 31
#error "This header is only meant to be included by Cap'n Proto's own source code."
#endif
32

33
#include <unordered_map>
Kenton Varda's avatar
Kenton Varda committed
34
#include <kj/common.h>
35
#include <kj/mutex.h>
36
#include <kj/exception.h>
37
#include <kj/vector.h>
38
#include "common.h"
39
#include "message.h"
40
#include "layout.h"
41 42

#if !CAPNP_LITE
43
#include "capability.h"
44
#endif  // !CAPNP_LITE
45

46
namespace capnp {
47

48
#if !CAPNP_LITE
49
class ClientHook;
50
#endif  // !CAPNP_LITE
51

52
namespace _ {  // private
53 54 55 56 57 58 59

class SegmentReader;
class SegmentBuilder;
class Arena;
class BuilderArena;
class ReadLimiter;

Kenton Varda's avatar
Kenton Varda committed
60
class Segment;
61
typedef kj::Id<uint32_t, Segment> SegmentId;
Kenton Varda's avatar
Kenton Varda committed
62

63 64 65 66 67 68 69 70 71 72 73 74 75 76
class ReadLimiter {
  // Used to keep track of how much data has been processed from a message, and cut off further
  // processing if and when a particular limit is reached.  This is primarily intended to guard
  // against maliciously-crafted messages which contain cycles or overlapping structures.  Cycles
  // and overlapping are not permitted by the Cap'n Proto format because in many cases they could
  // be used to craft a deceptively small message which could consume excessive server resources to
  // process, perhaps even sending it into an infinite loop.  Actually detecting overlaps would be
  // time-consuming, so instead we just keep track of how many words worth of data structures the
  // receiver has actually dereferenced and error out if this gets too high.
  //
  // This counting takes place as you call getters (for non-primitive values) on the message
  // readers.  If you call the same getter twice, the data it returns may be double-counted.  This
  // should not be a big deal in most cases -- just set the read limit high enough that it will
  // only trigger in unreasonable cases.
77 78 79 80
  //
  // This class is "safe" to use from multiple threads for its intended use case.  Threads may
  // overwrite each others' changes to the counter, but this is OK because it only means that the
  // limit is enforced a bit less strictly -- it will still kick in eventually.
81 82 83 84 85

public:
  inline explicit ReadLimiter();                     // No limit.
  inline explicit ReadLimiter(WordCount64 limit);    // Limit to the given number of words.

86 87
  inline void reset(WordCount64 limit);

88
  KJ_ALWAYS_INLINE(bool canRead(WordCount amount, Arena* arena));
89

90 91 92 93
  void unread(WordCount64 amount);
  // Adds back some words to the limit.  Useful when the caller knows they are double-reading
  // some data.

94
private:
95 96 97 98
  volatile uint64_t limit;
  // Current limit, decremented each time catRead() is called.  Volatile because multiple threads
  // could be trying to modify it at once.  (This is not real thread-safety, but good enough for
  // the purpose of this class.  See class comment.)
99

100
  KJ_DISALLOW_COPY(ReadLimiter);
101 102
};

103
#if !CAPNP_LITE
104 105 106 107 108 109 110
class BrokenCapFactory {
  // Callback for constructing broken caps.  We use this so that we can avoid arena.c++ having a
  // link-time dependency on capability code that lives in libcapnp-rpc.

public:
  virtual kj::Own<ClientHook> newBrokenCap(kj::StringPtr description) = 0;
};
111
#endif  // !CAPNP_LITE
112

113 114
class SegmentReader {
public:
115
  inline SegmentReader(Arena* arena, SegmentId id, kj::ArrayPtr<const word> ptr,
116 117
                       ReadLimiter* readLimiter);

118
  KJ_ALWAYS_INLINE(bool containsInterval(const void* from, const void* to));
119 120 121 122 123 124 125 126

  inline Arena* getArena();
  inline SegmentId getSegmentId();

  inline const word* getStartPtr();
  inline WordCount getOffsetTo(const word* ptr);
  inline WordCount getSize();

127
  inline kj::ArrayPtr<const word> getArray();
128

129 130 131
  inline void unread(WordCount64 amount);
  // Add back some words to the ReadLimiter.

132 133 134
private:
  Arena* arena;
  SegmentId id;
135
  kj::ArrayPtr<const word> ptr;
136 137
  ReadLimiter* readLimiter;

138
  KJ_DISALLOW_COPY(SegmentReader);
139 140 141 142 143 144

  friend class SegmentBuilder;
};

class SegmentBuilder: public SegmentReader {
public:
145
  inline SegmentBuilder(BuilderArena* arena, SegmentId id, kj::ArrayPtr<word> ptr,
146
                        ReadLimiter* readLimiter, size_t wordsUsed = 0);
147 148 149 150
  inline SegmentBuilder(BuilderArena* arena, SegmentId id, kj::ArrayPtr<const word> ptr,
                        ReadLimiter* readLimiter);
  inline SegmentBuilder(BuilderArena* arena, SegmentId id, decltype(nullptr),
                        ReadLimiter* readLimiter);
151

152
  KJ_ALWAYS_INLINE(word* allocate(WordCount amount));
153 154 155 156 157 158 159

  KJ_ALWAYS_INLINE(void checkWritable());
  // Throw an exception if the segment is read-only (meaning it is a reference to external data).

  KJ_ALWAYS_INLINE(word* getPtrUnchecked(WordCount offset));
  // Get a writable pointer into the segment.  Throws an exception if the segment is read-only (i.e.
  // a reference to external immutable data).
160 161 162

  inline BuilderArena* getArena();

163
  inline kj::ArrayPtr<const word> currentlyAllocated();
164

165 166
  inline void reset();

167 168
  inline bool isWritable() { return !readOnly; }

169 170 171 172
  inline void tryTruncate(word* from, word* to);
  // If `from` points just past the current end of the segment, then move the end back to `to`.
  // Otherwise, do nothing.

173
private:
174
  word* pos;
175
  // Pointer to a pointer to the current end point of the segment, i.e. the location where the
176
  // next object should be allocated.
177

178 179 180 181
  bool readOnly;

  void throwNotWritable();

182
  KJ_DISALLOW_COPY(SegmentBuilder);
183 184
};

185 186
class Arena {
public:
187
  virtual ~Arena() noexcept(false);
188 189 190 191 192

  virtual SegmentReader* tryGetSegment(SegmentId id) = 0;
  // Gets the segment with the given ID, or return nullptr if no such segment exists.

  virtual void reportReadLimitReached() = 0;
193
  // Called to report that the read limit has been reached.  See ReadLimiter, below.  This invokes
194
  // the VALIDATE_INPUT() macro which may throw an exception; if it returns normally, the caller
195
  // will need to continue with default values.
196

197
#if !CAPNP_LITE
198
  virtual kj::Maybe<kj::Own<ClientHook>> extractCap(uint index) = 0;
199
  // Extract the capability at the given index.  If the index is invalid, returns null.
200
#endif  // !CAPNP_LITE
201 202
};

203
class ReaderArena final: public Arena {
204
public:
205 206 207 208
  ReaderArena(MessageReader* message);
  ~ReaderArena() noexcept(false);
  KJ_DISALLOW_COPY(ReaderArena);

209
#if !CAPNP_LITE
210 211 212 213 214 215
  inline void initCapTable(kj::Array<kj::Maybe<kj::Own<ClientHook>>> capTable) {
    // Imbues the arena with a capability table.  This is not passed to the constructor because the
    // table itself may be built based on some other part of the message (as is the case with the
    // RPC protocol).
    this->capTable = kj::mv(capTable);
  }
216
#endif  // !CAPNP_LITE
217 218 219 220

  // implements Arena ------------------------------------------------
  SegmentReader* tryGetSegment(SegmentId id) override;
  void reportReadLimitReached() override;
221
#if !CAPNP_LITE
222
  kj::Maybe<kj::Own<ClientHook>> extractCap(uint index);
223
#endif  // !CAPNP_LITE
224 225

private:
226
  MessageReader* message;
227
  ReadLimiter readLimiter;
228
#if !CAPNP_LITE
229
  kj::Array<kj::Maybe<kj::Own<ClientHook>>> capTable;
230
#endif  // !CAPNP_LITE
231 232 233 234

  // Optimize for single-segment messages so that small messages are handled quickly.
  SegmentReader segment0;

235
  typedef std::unordered_map<uint, kj::Own<SegmentReader>> SegmentMap;
236
  kj::MutexGuarded<kj::Maybe<kj::Own<SegmentMap>>> moreSegments;
237 238 239 240 241 242 243
  // We need to mutex-guard the segment map because we lazily initialize segments when they are
  // first requested, but a Reader is allowed to be used concurrently in multiple threads.  Luckily
  // this only applies to large messages.
  //
  // TODO(perf):  Thread-local thing instead?  Some kind of lockless map?  Or do sharing of data
  //   in a different way, where you have to construct a new MessageReader in each thread (but
  //   possibly backed by the same data)?
244 245
};

246 247
class BuilderArena final: public Arena {
  // A BuilderArena that does not allow the injection of capabilities.
248

249
public:
250 251
  explicit BuilderArena(MessageBuilder* message);
  BuilderArena(MessageBuilder* message, kj::ArrayPtr<MessageBuilder::SegmentInit> segments);
252 253
  ~BuilderArena() noexcept(false);
  KJ_DISALLOW_COPY(BuilderArena);
254

255
  inline SegmentBuilder* getRootSegment() { return &segment0; }
256

257 258 259 260
  kj::ArrayPtr<const kj::ArrayPtr<const word>> getSegmentsForOutput();
  // Get an array of all the segments, suitable for writing out.  This only returns the allocated
  // portion of each segment, whereas tryGetSegment() returns something that includes
  // not-yet-allocated space.
261

262
#if !CAPNP_LITE
263 264
  inline kj::ArrayPtr<kj::Maybe<kj::Own<ClientHook>>> getCapTable() { return capTable; }
  // Return the capability table.
265
#endif  // !CAPNP_LITE
266

267
  SegmentBuilder* getSegment(SegmentId id);
268 269
  // Get the segment with the given id.  Crashes or throws an exception if no such segment exists.

270 271 272 273 274
  struct AllocateResult {
    SegmentBuilder* segment;
    word* words;
  };

275
  AllocateResult allocate(WordCount amount);
276 277 278 279
  // Find a segment with at least the given amount of space available and allocate the space.
  // Note that allocating directly from a particular segment is much faster, but allocating from
  // the arena is guaranteed to succeed.  Therefore callers should try to allocate from a specific
  // segment first if there is one, then fall back to the arena.
280

281 282 283 284 285 286 287 288 289 290 291
  SegmentBuilder* addExternalSegment(kj::ArrayPtr<const word> content);
  // Add a new segment to the arena which points to some existing memory region.  The segment is
  // assumed to be completley full; the arena will never allocate from it.  In fact, the segment
  // is considered read-only.  Any attempt to get a Builder pointing into this segment will throw
  // an exception.  Readers are allowed, however.
  //
  // This can be used to inject some external data into a message without a copy, e.g. embedding a
  // large mmap'd file into a message as `Data` without forcing that data to actually be read in
  // from disk (until the message itself is written out).  `Orphanage` provides the public API for
  // this feature.

292
#if !CAPNP_LITE
293
  uint injectCap(kj::Own<ClientHook>&& cap);
294 295 296
  // Add the capability to the message and return its index.  If the same ClientHook is injected
  // twice, this may return the same index both times, but in this case dropCap() needs to be
  // called an equal number of times to actually remove the cap.
297
#endif  // !CAPNP_LITE
298

299
  void dropCap(uint index);
300
  // Remove a capability injected earlier.  Called when the pointer is overwritten or zero'd out.
301

302 303 304
  // implements Arena ------------------------------------------------
  SegmentReader* tryGetSegment(SegmentId id) override;
  void reportReadLimitReached() override;
305
#if !CAPNP_LITE
306
  kj::Maybe<kj::Own<ClientHook>> extractCap(uint index);
307
#endif  // !CAPNP_LITE
308 309

private:
310
  MessageBuilder* message;
311
  ReadLimiter dummyLimiter;
312
#if !CAPNP_LITE
313
  kj::Vector<kj::Maybe<kj::Own<ClientHook>>> capTable;
314
#endif  // !CAPNP_LITE
315

316
  SegmentBuilder segment0;
317
  kj::ArrayPtr<const word> segment0ForOutput;
318

319
  struct MultiSegmentState {
320
    kj::Vector<kj::Own<SegmentBuilder>> builders;
321
    kj::Vector<kj::ArrayPtr<const word>> forOutput;
322
  };
323
  kj::Maybe<kj::Own<MultiSegmentState>> moreSegments;
324 325 326 327 328 329 330 331

  SegmentBuilder* segmentWithSpace = nullptr;
  // When allocating, look for space in this segment first before resorting to allocating a new
  // segment.  This is not necessarily the last segment because addExternalSegment() may add a
  // segment that is already-full, in which case we don't update this pointer.

  template <typename T>  // Can be `word` or `const word`.
  SegmentBuilder* addSegmentInternal(kj::ArrayPtr<T> content);
332 333 334 335 336
};

// =======================================================================================

inline ReadLimiter::ReadLimiter()
337
    : limit(kj::maxValue) {}
338

339
inline ReadLimiter::ReadLimiter(WordCount64 limit): limit(limit / WORDS) {}
340

341
inline void ReadLimiter::reset(WordCount64 limit) { this->limit = limit / WORDS; }
342

343
inline bool ReadLimiter::canRead(WordCount amount, Arena* arena) {
344 345 346 347
  // Be careful not to store an underflowed value into `limit`, even if multiple threads are
  // decrementing it.
  uint64_t current = limit;
  if (KJ_UNLIKELY(amount / WORDS > current)) {
348 349 350
    arena->reportReadLimitReached();
    return false;
  } else {
351
    limit = current - amount / WORDS;
352 353 354 355 356 357
    return true;
  }
}

// -------------------------------------------------------------------

358
inline SegmentReader::SegmentReader(Arena* arena, SegmentId id, kj::ArrayPtr<const word> ptr,
359 360 361
                                    ReadLimiter* readLimiter)
    : arena(arena), id(id), ptr(ptr), readLimiter(readLimiter) {}

362
inline bool SegmentReader::containsInterval(const void* from, const void* to) {
363
  return from >= this->ptr.begin() && to <= this->ptr.end() && from <= to &&
364 365 366 367
      readLimiter->canRead(
          intervalLength(reinterpret_cast<const byte*>(from),
                         reinterpret_cast<const byte*>(to)) / BYTES_PER_WORD,
          arena);
368 369 370 371 372 373 374 375 376
}

inline Arena* SegmentReader::getArena() { return arena; }
inline SegmentId SegmentReader::getSegmentId() { return id; }
inline const word* SegmentReader::getStartPtr() { return ptr.begin(); }
inline WordCount SegmentReader::getOffsetTo(const word* ptr) {
  return intervalLength(this->ptr.begin(), ptr);
}
inline WordCount SegmentReader::getSize() { return ptr.size() * WORDS; }
377
inline kj::ArrayPtr<const word> SegmentReader::getArray() { return ptr; }
378
inline void SegmentReader::unread(WordCount64 amount) { readLimiter->unread(amount); }
379 380 381 382

// -------------------------------------------------------------------

inline SegmentBuilder::SegmentBuilder(
383 384 385
    BuilderArena* arena, SegmentId id, kj::ArrayPtr<word> ptr, ReadLimiter* readLimiter,
    size_t wordsUsed)
    : SegmentReader(arena, id, ptr, readLimiter), pos(ptr.begin() + wordsUsed), readOnly(false) {}
386 387 388 389 390 391 392 393 394 395
inline SegmentBuilder::SegmentBuilder(
    BuilderArena* arena, SegmentId id, kj::ArrayPtr<const word> ptr, ReadLimiter* readLimiter)
    : SegmentReader(arena, id, ptr, readLimiter),
      // const_cast is safe here because the member won't ever be dereferenced because it appears
      // to point to the end of the segment anyway.
      pos(const_cast<word*>(ptr.end())),
      readOnly(true) {}
inline SegmentBuilder::SegmentBuilder(BuilderArena* arena, SegmentId id, decltype(nullptr),
                                      ReadLimiter* readLimiter)
    : SegmentReader(arena, id, nullptr, readLimiter), pos(nullptr), readOnly(false) {}
396 397

inline word* SegmentBuilder::allocate(WordCount amount) {
398
  if (intervalLength(pos, ptr.end()) < amount) {
399
    // Not enough space in the segment for this allocation.
400 401
    return nullptr;
  } else {
402
    // Success.
403 404
    word* result = pos;
    pos = pos + amount;
405 406 407 408
    return result;
  }
}

409 410 411 412
inline void SegmentBuilder::checkWritable() {
  if (KJ_UNLIKELY(readOnly)) throwNotWritable();
}

413 414 415 416 417 418 419 420 421 422
inline word* SegmentBuilder::getPtrUnchecked(WordCount offset) {
  return const_cast<word*>(ptr.begin() + offset);
}

inline BuilderArena* SegmentBuilder::getArena() {
  // Down-cast safe because SegmentBuilder's constructor always initializes its SegmentReader base
  // class with an Arena pointer that actually points to a BuilderArena.
  return static_cast<BuilderArena*>(arena);
}

423
inline kj::ArrayPtr<const word> SegmentBuilder::currentlyAllocated() {
424
  return kj::arrayPtr(ptr.begin(), pos - ptr.begin());
425 426
}

427 428
inline void SegmentBuilder::reset() {
  word* start = getPtrUnchecked(0 * WORDS);
429 430
  memset(start, 0, (pos - start) * sizeof(word));
  pos = start;
431 432
}

433 434 435 436
inline void SegmentBuilder::tryTruncate(word* from, word* to) {
  if (pos == from) pos = to;
}

437
}  // namespace _ (private)
438
}  // namespace capnp
439

Kenton Varda's avatar
Kenton Varda committed
440
#endif  // CAPNP_ARENA_H_