| OLD | NEW |
| (Empty) |
| 1 /* | |
| 2 * Copyright 2008 The Native Client Authors. All rights reserved. | |
| 3 * Use of this source code is governed by a BSD-style license that can | |
| 4 * be found in the LICENSE file. | |
| 5 */ | |
| 6 | |
| 7 /* | |
| 8 * NaCl Service Runtime Object Proxy. Used for the NaCl virtual file | |
| 9 * system and as a generic object proxy mechanism. | |
| 10 * | |
| 11 * NB: this code has not been integrated with the rest of NaCl, and is | |
| 12 * likely to change. | |
| 13 * | |
| 14 * Note that for NaCl file system use, the proxy is an NFS-like "file | |
| 15 * handle" and the object is a NaClDesc object. These objects may | |
| 16 * contain access rights -- names of kernel managed objects, which are | |
| 17 * reference counted -- and, at least for some uses, the proxy may be | |
| 18 * used to acquire the orignal object via access-rights transfer. | |
| 19 * Note that two transfers of the same object results in two distinct | |
| 20 * names referring to the same underlying kernel object. | |
| 21 * | |
| 22 * In the latter, generic object proxy case, the object being proxied | |
| 23 * is typically a generic pointer (void *) in the proxy name space | |
| 24 * owner's address space, and all operations (method calls, etc) are | |
| 25 * remoted. | |
| 26 * | |
| 27 * Transfers of proxies is just a data copy and thus should be | |
| 28 * efficient. | |
| 29 */ | |
| 30 | |
| 31 #ifndef NATIVE_CLIENT_SERVICE_RUNTIME_FS_OBJ_PROXY_H_ | |
| 32 #define NATIVE_CLIENT_SERVICE_RUNTIME_FS_OBJ_PROXY_H_ | |
| 33 | |
| 34 #include "native_client/src/include/nacl_base.h" | |
| 35 | |
| 36 #include "native_client/src/shared/platform/nacl_secure_random.h" | |
| 37 #include "native_client/src/shared/platform/nacl_sync_checked.h" | |
| 38 #include "native_client/src/trusted/service_runtime/generic_container/container.
h" | |
| 39 | |
| 40 EXTERN_C_BEGIN | |
| 41 | |
| 42 /* | |
| 43 * An object proxy object is used with two primary operations: (1) | |
| 44 * when sending an object out, we check if we have already assigned an | |
| 45 * ID to the object, and if not, generate one; we remember the object | |
| 46 * and its ID and return the ID. (2) when receiving an object ID (for | |
| 47 * an object that we had sent out), find the corresponding object. | |
| 48 */ | |
| 49 | |
| 50 struct NaClObjProxyEntry; /* fwd */ | |
| 51 | |
| 52 struct NaClObjProxy { | |
| 53 /* private: */ | |
| 54 struct NaClMutex mu; | |
| 55 struct NaClContainer *obj_to_name; | |
| 56 struct NaClContainer *name_to_obj; | |
| 57 int name_bytes; | |
| 58 struct NaClHashFunctor *obj_to_name_functor; | |
| 59 struct NaClHashFunctor *name_to_obj_functor; | |
| 60 struct NaClSecureRngIf *rng; | |
| 61 struct NaClObjProxyEntry *key; | |
| 62 }; | |
| 63 | |
| 64 /** | |
| 65 * Constructor for a NaClObjProxy object. Return zero on failure (bool). | |
| 66 * | |
| 67 * name_bytes is the length of the randomly generated names to be used | |
| 68 * with the mapping. Whenever an object is inserted into the object | |
| 69 * proxy, a randomly chosen name of that many bytes is generated to | |
| 70 * represent that object. No explicit collision detection is done, so | |
| 71 * name_bytes should be sufficiently large that birthday collisions | |
| 72 * would be extremely unlikely. For example, if name_bytes 8, then | |
| 73 * assuming that the random number generator is good, the probability | |
| 74 * of collision becomes unacceptable approximately when 2**(8*8/2) = | |
| 75 * 2**32 objects have been allocated. | |
| 76 * | |
| 77 * The choice of the RNG is fixed. The NaClSecureRng interface does | |
| 78 * not use virtual functions, so we cannot (yet) provide a | |
| 79 * debug/testing ctor that accepts a custom RNG. | |
| 80 * | |
| 81 * Since the object proxy does not take ownership of the objects, it | |
| 82 * is the responsibility of the caller to ensure that the objects' | |
| 83 * lifetime is at least that of the lifetime of the object proxy | |
| 84 * object. | |
| 85 * | |
| 86 * Ownership of the rng is NOT passed to the NaClObjProxy object; it | |
| 87 * is the responsibility of the caller to ensure that (1) its lifetime | |
| 88 * is at least that of the NaClObjProxy object, and (2) the | |
| 89 * NaClSecureRng is either itself thread-safe, or that no other thread | |
| 90 * will access its methods. | |
| 91 * | |
| 92 * NB: NaClSecureRngModuleInit must have been invoked prior to any | |
| 93 * invocation of NaClObjProxyCtor. | |
| 94 */ | |
| 95 int NaClObjProxyCtor(struct NaClObjProxy *self, | |
| 96 struct NaClSecureRngIf *rng, | |
| 97 int name_bytes); | |
| 98 | |
| 99 /** | |
| 100 * Destroys the ObjProxy object. | |
| 101 */ | |
| 102 void NaClObjProxyDtor(struct NaClObjProxy *self); | |
| 103 | |
| 104 /** | |
| 105 * Given an object, find its name. May return NULL if the object is | |
| 106 * not found. | |
| 107 */ | |
| 108 uint8_t const *NaClObjProxyFindNameByObj(struct NaClObjProxy *self, void *obj); | |
| 109 | |
| 110 /** | |
| 111 * Given an object's name, find it and return the object via the out | |
| 112 * argument. Returns non-zero if found, so a NULL pointer can be | |
| 113 * proxied. | |
| 114 */ | |
| 115 int NaClObjProxyFindObjByName(struct NaClObjProxy *self, | |
| 116 uint8_t const *name, | |
| 117 void **out); | |
| 118 | |
| 119 /** | |
| 120 * Given a new object, assign a new name to it and insert the mapping | |
| 121 * into the NaClObjProxy object; returns the new name. The returned | |
| 122 * name is valid as long as the object remains in the object proxy. | |
| 123 */ | |
| 124 uint8_t const *NaClObjProxyInsert(struct NaClObjProxy *self, void *obj); | |
| 125 | |
| 126 /** | |
| 127 * Remove a previously inserted object. | |
| 128 */ | |
| 129 int NaClObjProxyRemove(struct NaClObjProxy *self, void *obj); | |
| 130 | |
| 131 EXTERN_C_END | |
| 132 | |
| 133 #endif /* NATIVE_CLIENT_SERVICE_RUNTIME_FS_OBJ_PROXY_H_ */ | |
| OLD | NEW |