diff --git a/src/support/lockedpool.cpp b/src/support/lockedpool.cpp index f20cf3aca..a321e0724 100644 --- a/src/support/lockedpool.cpp +++ b/src/support/lockedpool.cpp @@ -1,410 +1,413 @@ // Copyright (c) 2016 The Bitcoin Core developers // Distributed under the MIT software license, see the accompanying // file COPYING or http://www.opensource.org/licenses/mit-license.php. #include #include #if defined(HAVE_CONFIG_H) #include #endif #ifdef WIN32 #ifndef NOMINMAX #define NOMINMAX #endif #include #else #include // for PAGESIZE #include // for mmap #include // for getrlimit #include // for sysconf #endif #include +#include +#include +#include #ifdef ARENA_DEBUG #include #include #endif LockedPoolManager *LockedPoolManager::_instance = nullptr; /*******************************************************************************/ // Utilities // /** Align up to power of 2 */ static inline size_t align_up(size_t x, size_t align) { return (x + align - 1) & ~(align - 1); } /*******************************************************************************/ // Implementation: Arena Arena::Arena(void *base_in, size_t size_in, size_t alignment_in) : base(static_cast(base_in)), end(static_cast(base_in) + size_in), alignment(alignment_in) { // Start with one free chunk that covers the entire arena auto it = size_to_free_chunk.emplace(size_in, base); chunks_free.emplace(base, it); chunks_free_end.emplace(base + size_in, it); } Arena::~Arena() {} void *Arena::alloc(size_t size) { // Round to next multiple of alignment size = align_up(size, alignment); // Don't handle zero-sized chunks if (size == 0) { return nullptr; } // Pick a large enough free-chunk. Returns an iterator pointing to the first // element that is not less than key. This allocation strategy is best-fit. // According to "Dynamic Storage Allocation: A Survey and Critical Review", // Wilson et. al. 1995, // http://www.scs.stanford.edu/14wi-cs140/sched/readings/wilson.pdf, // best-fit and first-fit policies seem to work well in practice. auto size_ptr_it = size_to_free_chunk.lower_bound(size); if (size_ptr_it == size_to_free_chunk.end()) { return nullptr; } // Create the used-chunk, taking its space from the end of the free-chunk const size_t size_remaining = size_ptr_it->first - size; auto alloced = chunks_used.emplace(size_ptr_it->second + size_remaining, size).first; chunks_free_end.erase(size_ptr_it->second + size_ptr_it->first); if (size_ptr_it->first == size) { // whole chunk is used up chunks_free.erase(size_ptr_it->second); } else { // still some memory left in the chunk auto it_remaining = size_to_free_chunk.emplace(size_remaining, size_ptr_it->second); chunks_free[size_ptr_it->second] = it_remaining; chunks_free_end.emplace(size_ptr_it->second + size_remaining, it_remaining); } size_to_free_chunk.erase(size_ptr_it); return reinterpret_cast(alloced->first); } void Arena::free(void *ptr) { // Freeing the nullptr pointer is OK. if (ptr == nullptr) { return; } // Remove chunk from used map auto i = chunks_used.find(static_cast(ptr)); if (i == chunks_used.end()) { throw std::runtime_error("Arena: invalid or double free"); } std::pair freed = *i; chunks_used.erase(i); // coalesce freed with previous chunk auto prev = chunks_free_end.find(freed.first); if (prev != chunks_free_end.end()) { freed.first -= prev->second->first; freed.second += prev->second->first; size_to_free_chunk.erase(prev->second); chunks_free_end.erase(prev); } // coalesce freed with chunk after freed auto next = chunks_free.find(freed.first + freed.second); if (next != chunks_free.end()) { freed.second += next->second->first; size_to_free_chunk.erase(next->second); chunks_free.erase(next); } // Add/set space with coalesced free chunk auto it = size_to_free_chunk.emplace(freed.second, freed.first); chunks_free[freed.first] = it; chunks_free_end[freed.first + freed.second] = it; } Arena::Stats Arena::stats() const { Arena::Stats r{0, 0, 0, chunks_used.size(), chunks_free.size()}; for (const auto &chunk : chunks_used) { r.used += chunk.second; } for (const auto &chunk : chunks_free) { r.free += chunk.second->first; } r.total = r.used + r.free; return r; } #ifdef ARENA_DEBUG static void printchunk(void *base, size_t sz, bool used) { std::cout << "0x" << std::hex << std::setw(16) << std::setfill('0') << base << " 0x" << std::hex << std::setw(16) << std::setfill('0') << sz << " 0x" << used << std::endl; } void Arena::walk() const { for (const auto &chunk : chunks_used) { printchunk(chunk.first, chunk.second, true); } std::cout << std::endl; for (const auto &chunk : chunks_free) { printchunk(chunk.first, chunk.second->first, false); } std::cout << std::endl; } #endif /*******************************************************************************/ // Implementation: Win32LockedPageAllocator #ifdef WIN32 /** * LockedPageAllocator specialized for Windows. */ class Win32LockedPageAllocator : public LockedPageAllocator { public: Win32LockedPageAllocator(); void *AllocateLocked(size_t len, bool *lockingSuccess) override; void FreeLocked(void *addr, size_t len) override; size_t GetLimit() override; private: size_t page_size; }; Win32LockedPageAllocator::Win32LockedPageAllocator() { // Determine system page size in bytes SYSTEM_INFO sSysInfo; GetSystemInfo(&sSysInfo); page_size = sSysInfo.dwPageSize; } void *Win32LockedPageAllocator::AllocateLocked(size_t len, bool *lockingSuccess) { len = align_up(len, page_size); void *addr = VirtualAlloc(nullptr, len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); if (addr) { // VirtualLock is used to attempt to keep keying material out of swap. // Note that it does not provide this as a guarantee, but, in practice, // memory that has been VirtualLock'd almost never gets written to the // pagefile except in rare circumstances where memory is extremely low. *lockingSuccess = VirtualLock(const_cast(addr), len) != 0; } return addr; } void Win32LockedPageAllocator::FreeLocked(void *addr, size_t len) { len = align_up(len, page_size); memory_cleanse(addr, len); VirtualUnlock(const_cast(addr), len); } size_t Win32LockedPageAllocator::GetLimit() { // TODO is there a limit on Windows, how to get it? return std::numeric_limits::max(); } #endif /*******************************************************************************/ // Implementation: PosixLockedPageAllocator #ifndef WIN32 /** * LockedPageAllocator specialized for OSes that don't try to be special * snowflakes. */ class PosixLockedPageAllocator : public LockedPageAllocator { public: PosixLockedPageAllocator(); void *AllocateLocked(size_t len, bool *lockingSuccess) override; void FreeLocked(void *addr, size_t len) override; size_t GetLimit() override; private: size_t page_size; }; PosixLockedPageAllocator::PosixLockedPageAllocator() { // Determine system page size in bytes #if defined(PAGESIZE) // defined in climits page_size = PAGESIZE; #else // assume some POSIX OS page_size = sysconf(_SC_PAGESIZE); #endif } // Some systems (at least OS X) do not define MAP_ANONYMOUS yet and define // MAP_ANON which is deprecated #ifndef MAP_ANONYMOUS #define MAP_ANONYMOUS MAP_ANON #endif void *PosixLockedPageAllocator::AllocateLocked(size_t len, bool *lockingSuccess) { void *addr; len = align_up(len, page_size); addr = mmap(nullptr, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (addr == MAP_FAILED) { return nullptr; } if (addr) { *lockingSuccess = mlock(addr, len) == 0; #if defined(MADV_DONTDUMP) // Linux madvise(addr, len, MADV_DONTDUMP); #elif defined(MADV_NOCORE) // FreeBSD madvise(addr, len, MADV_NOCORE); #endif } return addr; } void PosixLockedPageAllocator::FreeLocked(void *addr, size_t len) { len = align_up(len, page_size); memory_cleanse(addr, len); munlock(addr, len); munmap(addr, len); } size_t PosixLockedPageAllocator::GetLimit() { #ifdef RLIMIT_MEMLOCK struct rlimit rlim; if (getrlimit(RLIMIT_MEMLOCK, &rlim) == 0) { if (rlim.rlim_cur != RLIM_INFINITY) { return rlim.rlim_cur; } } #endif return std::numeric_limits::max(); } #endif /*******************************************************************************/ // Implementation: LockedPool LockedPool::LockedPool(std::unique_ptr allocator_in, LockingFailed_Callback lf_cb_in) : allocator(std::move(allocator_in)), lf_cb(lf_cb_in), cumulative_bytes_locked(0) {} LockedPool::~LockedPool() {} void *LockedPool::alloc(size_t size) { std::lock_guard lock(mutex); // Don't handle impossible sizes if (size == 0 || size > ARENA_SIZE) { return nullptr; } // Try allocating from each current arena for (auto &arena : arenas) { void *addr = arena.alloc(size); if (addr) { return addr; } } // If that fails, create a new one if (new_arena(ARENA_SIZE, ARENA_ALIGN)) { return arenas.back().alloc(size); } return nullptr; } void LockedPool::free(void *ptr) { std::lock_guard lock(mutex); // TODO we can do better than this linear search by keeping a map of arena // extents to arena, and looking up the address. for (auto &arena : arenas) { if (arena.addressInArena(ptr)) { arena.free(ptr); return; } } throw std::runtime_error( "LockedPool: invalid address not pointing to any arena"); } LockedPool::Stats LockedPool::stats() const { std::lock_guard lock(mutex); LockedPool::Stats r{0, 0, 0, cumulative_bytes_locked, 0, 0}; for (const auto &arena : arenas) { Arena::Stats i = arena.stats(); r.used += i.used; r.free += i.free; r.total += i.total; r.chunks_used += i.chunks_used; r.chunks_free += i.chunks_free; } return r; } bool LockedPool::new_arena(size_t size, size_t align) { bool locked; // If this is the first arena, handle this specially: Cap the upper size by // the process limit. This makes sure that the first arena will at least be // locked. An exception to this is if the process limit is 0: in this case // no memory can be locked at all so we'll skip past this logic. if (arenas.empty()) { size_t limit = allocator->GetLimit(); if (limit > 0) { size = std::min(size, limit); } } void *addr = allocator->AllocateLocked(size, &locked); if (!addr) { return false; } if (locked) { cumulative_bytes_locked += size; } else if (lf_cb) { // Call the locking-failed callback if locking failed if (!lf_cb()) { // If the callback returns false, free the memory and fail, // otherwise consider the user warned and proceed. allocator->FreeLocked(addr, size); return false; } } arenas.emplace_back(allocator.get(), addr, size, align); return true; } LockedPool::LockedPageArena::LockedPageArena(LockedPageAllocator *allocator_in, void *base_in, size_t size_in, size_t align_in) : Arena(base_in, size_in, align_in), base(base_in), size(size_in), allocator(allocator_in) {} LockedPool::LockedPageArena::~LockedPageArena() { allocator->FreeLocked(base, size); } /*******************************************************************************/ // Implementation: LockedPoolManager // LockedPoolManager::LockedPoolManager( std::unique_ptr allocator_in) : LockedPool(std::move(allocator_in), &LockedPoolManager::LockingFailed) {} bool LockedPoolManager::LockingFailed() { // TODO: log something but how? without including util.h return true; } void LockedPoolManager::CreateInstance() { // Using a local static instance guarantees that the object is initialized when // it's first needed and also deinitialized after all objects that use it are // done with it. I can think of one unlikely scenario where we may have a static // deinitialization order/problem, but the check in LockedPoolManagerBase's // destructor helps us detect if that ever happens. #ifdef WIN32 std::unique_ptr allocator( new Win32LockedPageAllocator()); #else std::unique_ptr allocator( new PosixLockedPageAllocator()); #endif static LockedPoolManager instance(std::move(allocator)); LockedPoolManager::_instance = &instance; } diff --git a/src/support/lockedpool.h b/src/support/lockedpool.h index 036c9b3cb..6f204d01e 100644 --- a/src/support/lockedpool.h +++ b/src/support/lockedpool.h @@ -1,253 +1,253 @@ // Copyright (c) 2016 The Bitcoin Core developers // Distributed under the MIT software license, see the accompanying // file COPYING or http://www.opensource.org/licenses/mit-license.php. #ifndef BITCOIN_SUPPORT_LOCKEDPOOL_H #define BITCOIN_SUPPORT_LOCKEDPOOL_H -#include +#include #include #include #include #include #include /** * OS-dependent allocation and deallocation of locked/pinned memory pages. * Abstract base class. */ class LockedPageAllocator { public: virtual ~LockedPageAllocator() {} /** * Allocate and lock memory pages. * If len is not a multiple of the system page size, it is rounded up. * Returns nullptr in case of allocation failure. * * If locking the memory pages could not be accomplished it will still * return the memory, however the lockingSuccess flag will be false. * lockingSuccess is undefined if the allocation fails. */ virtual void *AllocateLocked(size_t len, bool *lockingSuccess) = 0; /** * Unlock and free memory pages. * Clear the memory before unlocking. */ virtual void FreeLocked(void *addr, size_t len) = 0; /** * Get the total limit on the amount of memory that may be locked by this * process, in bytes. Return size_t max if there is no limit or the limit is * unknown. Return 0 if no memory can be locked at all. */ virtual size_t GetLimit() = 0; }; /** * An arena manages a contiguous region of memory by dividing it into chunks. */ class Arena { public: Arena(void *base, size_t size, size_t alignment); virtual ~Arena(); Arena(const Arena &other) = delete; // non construction-copyable Arena &operator=(const Arena &) = delete; // non copyable /** Memory statistics. */ struct Stats { size_t used; size_t free; size_t total; size_t chunks_used; size_t chunks_free; }; /** * Allocate size bytes from this arena. * Returns pointer on success, or 0 if memory is full or the application * tried to allocate 0 bytes. */ void *alloc(size_t size); /** * Free a previously allocated chunk of memory. * Freeing the zero pointer has no effect. * Raises std::runtime_error in case of error. */ void free(void *ptr); /** Get arena usage statistics */ Stats stats() const; #ifdef ARENA_DEBUG void walk() const; #endif /** * Return whether a pointer points inside this arena. * This returns base <= ptr < (base+size) so only use it for (inclusive) * chunk starting addresses. */ bool addressInArena(void *ptr) const { return ptr >= base && ptr < end; } private: typedef std::multimap SizeToChunkSortedMap; /** Map to enable O(log(n)) best-fit allocation, as it's sorted by size */ SizeToChunkSortedMap size_to_free_chunk; typedef std::unordered_map ChunkToSizeMap; /** Map from begin of free chunk to its node in size_to_free_chunk */ ChunkToSizeMap chunks_free; /** Map from end of free chunk to its node in size_to_free_chunk */ ChunkToSizeMap chunks_free_end; /** Map from begin of used chunk to its size */ std::unordered_map chunks_used; /** Base address of arena */ char *base; /** End address of arena */ char *end; /** Minimum chunk alignment */ size_t alignment; }; /** * Pool for locked memory chunks. * * To avoid sensitive key data from being swapped to disk, the memory in this * pool is locked/pinned. * * An arena manages a contiguous region of memory. The pool starts out with one * arena but can grow to multiple arenas if the need arises. * * Unlike a normal C heap, the administrative structures are separate from the * managed memory. This has been done as the sizes and bases of objects are not * in themselves sensitive information, as to conserve precious locked memory. * In some operating systems the amount of memory that can be locked is small. */ class LockedPool { public: /** * Size of one arena of locked memory. This is a compromise. * Do not set this too low, as managing many arenas will increase allocation * and deallocation overhead. Setting it too high allocates more locked * memory from the OS than strictly necessary. */ static const size_t ARENA_SIZE = 256 * 1024; /** * Chunk alignment. Another compromise. Setting this too high will waste * memory, setting it too low will facilitate fragmentation. */ static const size_t ARENA_ALIGN = 16; /** * Callback when allocation succeeds but locking fails. */ typedef bool (*LockingFailed_Callback)(); /** Memory statistics. */ struct Stats { size_t used; size_t free; size_t total; size_t locked; size_t chunks_used; size_t chunks_free; }; /** * Create a new LockedPool. This takes ownership of the MemoryPageLocker, * you can only instantiate this with LockedPool(std::move(...)). * * The second argument is an optional callback when locking a newly * allocated arena failed. If this callback is provided and returns false, * the allocation fails (hard fail), if it returns true the allocation * proceeds, but it could warn. */ explicit LockedPool(std::unique_ptr allocator, LockingFailed_Callback lf_cb_in = nullptr); ~LockedPool(); LockedPool(const LockedPool &other) = delete; // non construction-copyable LockedPool &operator=(const LockedPool &) = delete; // non copyable /** * Allocate size bytes from this arena. * Returns pointer on success, or 0 if memory is full or the application * tried to allocate 0 bytes. */ void *alloc(size_t size); /** * Free a previously allocated chunk of memory. * Freeing the zero pointer has no effect. * Raises std::runtime_error in case of error. */ void free(void *ptr); /** Get pool usage statistics */ Stats stats() const; private: std::unique_ptr allocator; /** Create an arena from locked pages */ class LockedPageArena : public Arena { public: LockedPageArena(LockedPageAllocator *alloc_in, void *base_in, size_t size, size_t align); ~LockedPageArena(); private: void *base; size_t size; LockedPageAllocator *allocator; }; bool new_arena(size_t size, size_t align); std::list arenas; LockingFailed_Callback lf_cb; size_t cumulative_bytes_locked; /** * Mutex protects access to this pool's data structures, including arenas. */ mutable std::mutex mutex; }; /** * Singleton class to keep track of locked (ie, non-swappable) memory, for use * in std::allocator templates. * * Some implementations of the STL allocate memory in some constructors (i.e., * see MSVC's vector implementation where it allocates 1 byte of memory in * the allocator). Due to the unpredictable order of static initializers, we * have to make sure the LockedPoolManager instance exists before any other * STL-based objects that use secure_allocator are created. So instead of having * LockedPoolManager also be static-initialized, it is created on demand. */ class LockedPoolManager : public LockedPool { public: /** Return the current instance, or create it once */ static LockedPoolManager &Instance() { static std::once_flag init_flag; std::call_once(init_flag, LockedPoolManager::CreateInstance); return *LockedPoolManager::_instance; } private: explicit LockedPoolManager(std::unique_ptr allocator); /** Create a new LockedPoolManager specialized to the OS */ static void CreateInstance(); /** Called when locking fails, warn the user here */ static bool LockingFailed(); static LockedPoolManager *_instance; }; #endif // BITCOIN_SUPPORT_LOCKEDPOOL_H