fb64 commented on code in PR #1334: URL: https://github.com/apache/arrow-java/pull/1334#discussion_r4208464930
########## memory/memory-ffm/src/main/java/org/apache/arrow/memory/ffm/FfmMemoryAccessor.java: ########## @@ -0,0 +1,181 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.arrow.memory.ffm; + +import java.lang.foreign.MemorySegment; +import java.lang.foreign.ValueLayout; +import java.nio.ByteBuffer; +import org.apache.arrow.memory.util.MemoryUtilAccessor; + +/** + * {@link MemoryUtilAccessor} backed by {@code java.lang.foreign} ({@link MemorySegment} and the + * foreign {@link java.lang.foreign.Linker}). Does not use {@code sun.misc.Unsafe} or reflection + * into {@code java.nio} internals, so it requires neither {@code --add-opens} nor {@code + * sun.misc.Unsafe} availability. + * + * <p><b>Required JVM flag.</b> This accessor calls the restricted methods {@link + * MemorySegment#reinterpret(long)} and {@link java.lang.foreign.Linker#downcallHandle}, the latter + * for {@code malloc} and {@code free}. That is a real, current requirement, not a caveat that this + * module already handles for you: classpath (unnamed-module) consumers must pass {@code + * --enable-native-access=ALL-UNNAMED} and module-path consumers must pass {@code + * --enable-native-access=org.apache.arrow.memory.ffm} on the JVM command line. Without it the JVM + * prints a warning on every restricted call today, and a future JDK that enables restricted-method + * enforcement by default will turn that into a hard {@link IllegalCallerException}. The {@code + * Enable-Native-Access: ALL-UNNAMED} entry in this module's jar manifest does <em>not</em> cover + * this: the JVM only honours that attribute in the manifest of the jar it was launched with via + * {@code java -jar}, never for a jar that is merely a classpath dependency. + * + * <p>{@link #allocateMemory}/{@link #freeMemory} call {@code malloc}/{@code free} directly, like + * the {@code sun.misc.Unsafe}-backed accessor, so {@link #freeMemory} accepts any address returned + * by {@code malloc}. + */ +public final class FfmMemoryAccessor implements MemoryUtilAccessor { + + public static final MemoryUtilAccessor INSTANCE = new FfmMemoryAccessor(); + + private FfmMemoryAccessor() {} + + private static MemorySegment segment(long address, long byteSize) { + return MemorySegment.ofAddress(address).reinterpret(byteSize); + } + + private static int checkedInt(long value) { + if (value < 0 || value > Integer.MAX_VALUE) { + throw new IllegalArgumentException("value out of int range: " + value); + } + return (int) value; + } + + /** Allocates {@code bytes} of uninitialized native memory with the C library's {@code malloc}. */ + @Override + public long allocateMemory(long bytes) { + return NativeMemory.allocate(bytes); + } + + /** Frees native memory with the C library's {@code free}. */ + @Override + public void freeMemory(long address) { + NativeMemory.free(address); + } + + @Override + public byte getByte(long address) { + return segment(address, Byte.BYTES).get(ValueLayout.JAVA_BYTE, 0); + } + + @Override + public void putByte(long address, byte value) { + segment(address, Byte.BYTES).set(ValueLayout.JAVA_BYTE, 0, value); + } + + @Override + public short getShort(long address) { + return segment(address, Short.BYTES).get(ValueLayout.JAVA_SHORT_UNALIGNED, 0); + } + + @Override + public void putShort(long address, short value) { + segment(address, Short.BYTES).set(ValueLayout.JAVA_SHORT_UNALIGNED, 0, value); + } + + @Override + public int getInt(long address) { + return segment(address, Integer.BYTES).get(ValueLayout.JAVA_INT_UNALIGNED, 0); + } + + @Override + public void putInt(long address, int value) { + segment(address, Integer.BYTES).set(ValueLayout.JAVA_INT_UNALIGNED, 0, value); + } + + @Override + public long getLong(long address) { + return segment(address, Long.BYTES).get(ValueLayout.JAVA_LONG_UNALIGNED, 0); + } + + @Override + public void putLong(long address, long value) { + segment(address, Long.BYTES).set(ValueLayout.JAVA_LONG_UNALIGNED, 0, value); + } + + @Override + public void setMemory(long address, long bytes, byte value) { + segment(address, bytes).fill(value); + } + + @Override + public void copyMemory(long srcAddress, long destAddress, long bytes) { + MemorySegment.copy(segment(srcAddress, bytes), 0, segment(destAddress, bytes), 0, bytes); + } + + @Override + public void copyToMemory(byte[] src, long srcIndex, long destAddress, long bytes) { + MemorySegment.copy( + src, + checkedInt(srcIndex), + segment(destAddress, bytes), + ValueLayout.JAVA_BYTE, + 0, + checkedInt(bytes)); + } + + @Override + public void copyFromMemory(long srcAddress, byte[] dest, long destIndex, long bytes) { + MemorySegment.copy( + segment(srcAddress, bytes), + ValueLayout.JAVA_BYTE, + 0, + dest, + checkedInt(destIndex), + checkedInt(bytes)); + } Review Comment: Yes, this is deliberate, due to `MemorySegment.copy` taking an `int` index and length on the array side, since Java arrays are int-indexed, so a valid call always fits. Every call site in Arrow (`ArrowBuf`, the JDBC `ClobConsumer`, the decimal vectors) passes ints or checks the array bounds first, so `checkedInt` can only fail on a caller bug, where the Unsafe accessor would copy outside the array without any check... I'll add a comment on `checkedInt` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
