1 /*
2  * Copyright (C) 2006-2007 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "CursorWindow"
18 
19 #include <androidfw/CursorWindow.h>
20 
21 #include <sys/mman.h>
22 
23 #include "android-base/logging.h"
24 #include "cutils/ashmem.h"
25 
26 namespace android {
27 
28 /**
29  * By default windows are lightweight inline allocations of this size;
30  * they're only inflated to ashmem regions when more space is needed.
31  */
32 static constexpr const size_t kInlineSize = 16384;
33 
34 static constexpr const size_t kSlotShift = 4;
35 static constexpr const size_t kSlotSizeBytes = 1 << kSlotShift;
36 
CursorWindow()37 CursorWindow::CursorWindow() {
38 }
39 
~CursorWindow()40 CursorWindow::~CursorWindow() {
41     if (mAshmemFd != -1) {
42         ::munmap(mData, mSize);
43         ::close(mAshmemFd);
44     } else {
45         free(mData);
46     }
47 }
48 
create(const String8 & name,size_t inflatedSize,CursorWindow ** outWindow)49 status_t CursorWindow::create(const String8 &name, size_t inflatedSize, CursorWindow **outWindow) {
50     *outWindow = nullptr;
51 
52     CursorWindow* window = new CursorWindow();
53     if (!window) goto fail;
54 
55     window->mName = name;
56     window->mSize = std::min(kInlineSize, inflatedSize);
57     window->mInflatedSize = inflatedSize;
58     window->mData = malloc(window->mSize);
59     if (!window->mData) goto fail;
60     window->mReadOnly = false;
61 
62     window->clear();
63     window->updateSlotsData();
64 
65     *outWindow = window;
66     return OK;
67 
68 fail:
69     LOG(ERROR) << "Failed create";
70 fail_silent:
71     delete window;
72     return UNKNOWN_ERROR;
73 }
74 
maybeInflate()75 status_t CursorWindow::maybeInflate() {
76     int ashmemFd = 0;
77     void* newData = nullptr;
78 
79     // Bail early when we can't expand any further
80     if (mReadOnly || mSize == mInflatedSize) {
81         return INVALID_OPERATION;
82     }
83 
84     String8 ashmemName("CursorWindow: ");
85     ashmemName.append(mName);
86 
87     ashmemFd = ashmem_create_region(ashmemName.c_str(), mInflatedSize);
88     if (ashmemFd < 0) {
89         PLOG(ERROR) << "Failed ashmem_create_region";
90         goto fail_silent;
91     }
92 
93     if (ashmem_set_prot_region(ashmemFd, PROT_READ | PROT_WRITE) < 0) {
94         PLOG(ERROR) << "Failed ashmem_set_prot_region";
95         goto fail_silent;
96     }
97 
98     newData = ::mmap(nullptr, mInflatedSize, PROT_READ | PROT_WRITE, MAP_SHARED, ashmemFd, 0);
99     if (newData == MAP_FAILED) {
100         PLOG(ERROR) << "Failed mmap";
101         goto fail_silent;
102     }
103 
104     if (ashmem_set_prot_region(ashmemFd, PROT_READ) < 0) {
105         PLOG(ERROR) << "Failed ashmem_set_prot_region";
106         goto fail_silent;
107     }
108 
109     {
110         // Migrate existing contents into new ashmem region
111         uint32_t slotsSize = sizeOfSlots();
112         uint32_t newSlotsOffset = mInflatedSize - slotsSize;
113         memcpy(static_cast<uint8_t*>(newData),
114                 static_cast<uint8_t*>(mData), mAllocOffset);
115         memcpy(static_cast<uint8_t*>(newData) + newSlotsOffset,
116                 static_cast<uint8_t*>(mData) + mSlotsOffset, slotsSize);
117 
118         free(mData);
119         mAshmemFd = ashmemFd;
120         mData = newData;
121         mSize = mInflatedSize;
122         mSlotsOffset = newSlotsOffset;
123 
124         updateSlotsData();
125     }
126 
127     LOG(DEBUG) << "Inflated: " << this->toString();
128     return OK;
129 
130 fail:
131     LOG(ERROR) << "Failed maybeInflate";
132 fail_silent:
133     ::munmap(newData, mInflatedSize);
134     ::close(ashmemFd);
135     return UNKNOWN_ERROR;
136 }
137 
createFromParcel(Parcel * parcel,CursorWindow ** outWindow)138 status_t CursorWindow::createFromParcel(Parcel* parcel, CursorWindow** outWindow) {
139     *outWindow = nullptr;
140 
141     CursorWindow* window = new CursorWindow();
142     if (!window) goto fail;
143 
144     if (parcel->readString8(&window->mName)) goto fail;
145     if (parcel->readUint32(&window->mNumRows)) goto fail;
146     if (parcel->readUint32(&window->mNumColumns)) goto fail;
147     if (parcel->readUint32(&window->mSize)) goto fail;
148 
149     if ((window->mNumRows * window->mNumColumns * kSlotSizeBytes) > window->mSize) {
150         LOG(ERROR) << "Unexpected size " << window->mSize << " for " << window->mNumRows
151                 << " rows and " << window->mNumColumns << " columns";
152         goto fail_silent;
153     }
154 
155     bool isAshmem;
156     if (parcel->readBool(&isAshmem)) goto fail;
157     if (isAshmem) {
158         window->mAshmemFd = parcel->readFileDescriptor();
159         if (window->mAshmemFd < 0) {
160             LOG(ERROR) << "Failed readFileDescriptor";
161             goto fail_silent;
162         }
163 
164         window->mAshmemFd = ::fcntl(window->mAshmemFd, F_DUPFD_CLOEXEC, 0);
165         if (window->mAshmemFd < 0) {
166             PLOG(ERROR) << "Failed F_DUPFD_CLOEXEC";
167             goto fail_silent;
168         }
169 
170         window->mData = ::mmap(nullptr, window->mSize, PROT_READ, MAP_SHARED, window->mAshmemFd, 0);
171         if (window->mData == MAP_FAILED) {
172             PLOG(ERROR) << "Failed mmap";
173             goto fail_silent;
174         }
175     } else {
176         window->mAshmemFd = -1;
177 
178         if (window->mSize > kInlineSize) {
179             LOG(ERROR) << "Unexpected size " << window->mSize << " for inline window";
180             goto fail_silent;
181         }
182 
183         window->mData = malloc(window->mSize);
184         if (!window->mData) goto fail;
185 
186         if (parcel->read(window->mData, window->mSize)) goto fail;
187     }
188 
189     // We just came from a remote source, so we're read-only
190     // and we can't inflate ourselves
191     window->mInflatedSize = window->mSize;
192     window->mReadOnly = true;
193 
194     window->updateSlotsData();
195 
196     LOG(DEBUG) << "Created from parcel: " << window->toString();
197     *outWindow = window;
198     return OK;
199 
200 fail:
201     LOG(ERROR) << "Failed createFromParcel";
202 fail_silent:
203     delete window;
204     return UNKNOWN_ERROR;
205 }
206 
writeToParcel(Parcel * parcel)207 status_t CursorWindow::writeToParcel(Parcel* parcel) {
208     LOG(DEBUG) << "Writing to parcel: " << this->toString();
209 
210     if (parcel->writeString8(mName)) goto fail;
211     if (parcel->writeUint32(mNumRows)) goto fail;
212     if (parcel->writeUint32(mNumColumns)) goto fail;
213     if (mAshmemFd != -1) {
214         if (parcel->writeUint32(mSize)) goto fail;
215         if (parcel->writeBool(true)) goto fail;
216         if (parcel->writeDupFileDescriptor(mAshmemFd)) goto fail;
217     } else {
218         // Since we know we're going to be read-only on the remote side,
219         // we can compact ourselves on the wire.
220         size_t slotsSize = sizeOfSlots();
221         size_t compactedSize = sizeInUse();
222         if (parcel->writeUint32(compactedSize)) goto fail;
223         if (parcel->writeBool(false)) goto fail;
224         void* dest = parcel->writeInplace(compactedSize);
225         if (!dest) goto fail;
226         memcpy(static_cast<uint8_t*>(dest),
227                 static_cast<uint8_t*>(mData), mAllocOffset);
228         memcpy(static_cast<uint8_t*>(dest) + compactedSize - slotsSize,
229                 static_cast<uint8_t*>(mData) + mSlotsOffset, slotsSize);
230     }
231     return OK;
232 
233 fail:
234     LOG(ERROR) << "Failed writeToParcel";
235 fail_silent:
236     return UNKNOWN_ERROR;
237 }
238 
clear()239 status_t CursorWindow::clear() {
240     if (mReadOnly) {
241         return INVALID_OPERATION;
242     }
243     mAllocOffset = 0;
244     mSlotsOffset = mSize;
245     mNumRows = 0;
246     mNumColumns = 0;
247     return OK;
248 }
249 
updateSlotsData()250 void CursorWindow::updateSlotsData() {
251     mSlotsStart = static_cast<uint8_t*>(mData) + mSize - kSlotSizeBytes;
252     mSlotsEnd = static_cast<uint8_t*>(mData) + mSlotsOffset;
253 }
254 
offsetToPtr(uint32_t offset,uint32_t bufferSize=0)255 void* CursorWindow::offsetToPtr(uint32_t offset, uint32_t bufferSize = 0) {
256     if (offset > mSize) {
257         LOG(ERROR) << "Offset " << offset
258                 << " out of bounds, max value " << mSize;
259         return nullptr;
260     }
261     if (offset + bufferSize > mSize) {
262         LOG(ERROR) << "End offset " << (offset + bufferSize)
263                 << " out of bounds, max value " << mSize;
264         return nullptr;
265     }
266     return static_cast<uint8_t*>(mData) + offset;
267 }
268 
offsetFromPtr(void * ptr)269 uint32_t CursorWindow::offsetFromPtr(void* ptr) {
270     return static_cast<uint8_t*>(ptr) - static_cast<uint8_t*>(mData);
271 }
272 
setNumColumns(uint32_t numColumns)273 status_t CursorWindow::setNumColumns(uint32_t numColumns) {
274     if (mReadOnly) {
275         return INVALID_OPERATION;
276     }
277     uint32_t cur = mNumColumns;
278     if ((cur > 0 || mNumRows > 0) && cur != numColumns) {
279         LOG(ERROR) << "Trying to go from " << cur << " columns to " << numColumns;
280         return INVALID_OPERATION;
281     }
282     mNumColumns = numColumns;
283     return OK;
284 }
285 
allocRow()286 status_t CursorWindow::allocRow() {
287     if (mReadOnly) {
288         return INVALID_OPERATION;
289     }
290     size_t size = mNumColumns * kSlotSizeBytes;
291     int32_t newOffset = mSlotsOffset - size;
292     if (newOffset < (int32_t) mAllocOffset) {
293         maybeInflate();
294         newOffset = mSlotsOffset - size;
295         if (newOffset < (int32_t) mAllocOffset) {
296             return NO_MEMORY;
297         }
298     }
299     memset(offsetToPtr(newOffset), 0, size);
300     mSlotsOffset = newOffset;
301     updateSlotsData();
302     mNumRows++;
303     return OK;
304 }
305 
freeLastRow()306 status_t CursorWindow::freeLastRow() {
307     if (mReadOnly) {
308         return INVALID_OPERATION;
309     }
310     size_t size = mNumColumns * kSlotSizeBytes;
311     size_t newOffset = mSlotsOffset + size;
312     if (newOffset > mSize) {
313         return NO_MEMORY;
314     }
315     mSlotsOffset = newOffset;
316     updateSlotsData();
317     mNumRows--;
318     return OK;
319 }
320 
alloc(size_t size,uint32_t * outOffset)321 status_t CursorWindow::alloc(size_t size, uint32_t* outOffset) {
322     if (mReadOnly) {
323         return INVALID_OPERATION;
324     }
325     size_t alignedSize = (size + 3) & ~3;
326     size_t newOffset = mAllocOffset + alignedSize;
327     if (newOffset > mSlotsOffset) {
328         maybeInflate();
329         newOffset = mAllocOffset + alignedSize;
330         if (newOffset > mSlotsOffset) {
331             return NO_MEMORY;
332         }
333     }
334     *outOffset = mAllocOffset;
335     mAllocOffset = newOffset;
336     return OK;
337 }
338 
getFieldSlot(uint32_t row,uint32_t column)339 CursorWindow::FieldSlot* CursorWindow::getFieldSlot(uint32_t row, uint32_t column) {
340     // This is carefully tuned to use as few cycles as
341     // possible, since this is an extremely hot code path;
342     // see CursorWindow_bench.cpp for more details
343     void *result = static_cast<uint8_t*>(mSlotsStart)
344             - (((row * mNumColumns) + column) << kSlotShift);
345     if (result < mSlotsEnd || result > mSlotsStart || column >= mNumColumns) {
346         LOG(ERROR) << "Failed to read row " << row << ", column " << column
347                 << " from a window with " << mNumRows << " rows, " << mNumColumns << " columns";
348         return nullptr;
349     } else {
350         return static_cast<FieldSlot*>(result);
351     }
352 }
353 
putBlob(uint32_t row,uint32_t column,const void * value,size_t size)354 status_t CursorWindow::putBlob(uint32_t row, uint32_t column, const void* value, size_t size) {
355     return putBlobOrString(row, column, value, size, FIELD_TYPE_BLOB);
356 }
357 
putString(uint32_t row,uint32_t column,const char * value,size_t sizeIncludingNull)358 status_t CursorWindow::putString(uint32_t row, uint32_t column, const char* value,
359         size_t sizeIncludingNull) {
360     return putBlobOrString(row, column, value, sizeIncludingNull, FIELD_TYPE_STRING);
361 }
362 
putBlobOrString(uint32_t row,uint32_t column,const void * value,size_t size,int32_t type)363 status_t CursorWindow::putBlobOrString(uint32_t row, uint32_t column,
364         const void* value, size_t size, int32_t type) {
365     if (mReadOnly) {
366         return INVALID_OPERATION;
367     }
368 
369     FieldSlot* fieldSlot = getFieldSlot(row, column);
370     if (!fieldSlot) {
371         return BAD_VALUE;
372     }
373 
374     uint32_t offset;
375     if (alloc(size, &offset)) {
376         return NO_MEMORY;
377     }
378 
379     memcpy(offsetToPtr(offset), value, size);
380 
381     fieldSlot = getFieldSlot(row, column);
382     fieldSlot->type = type;
383     fieldSlot->data.buffer.offset = offset;
384     fieldSlot->data.buffer.size = size;
385     return OK;
386 }
387 
putLong(uint32_t row,uint32_t column,int64_t value)388 status_t CursorWindow::putLong(uint32_t row, uint32_t column, int64_t value) {
389     if (mReadOnly) {
390         return INVALID_OPERATION;
391     }
392 
393     FieldSlot* fieldSlot = getFieldSlot(row, column);
394     if (!fieldSlot) {
395         return BAD_VALUE;
396     }
397 
398     fieldSlot->type = FIELD_TYPE_INTEGER;
399     fieldSlot->data.l = value;
400     return OK;
401 }
402 
putDouble(uint32_t row,uint32_t column,double value)403 status_t CursorWindow::putDouble(uint32_t row, uint32_t column, double value) {
404     if (mReadOnly) {
405         return INVALID_OPERATION;
406     }
407 
408     FieldSlot* fieldSlot = getFieldSlot(row, column);
409     if (!fieldSlot) {
410         return BAD_VALUE;
411     }
412 
413     fieldSlot->type = FIELD_TYPE_FLOAT;
414     fieldSlot->data.d = value;
415     return OK;
416 }
417 
putNull(uint32_t row,uint32_t column)418 status_t CursorWindow::putNull(uint32_t row, uint32_t column) {
419     if (mReadOnly) {
420         return INVALID_OPERATION;
421     }
422 
423     FieldSlot* fieldSlot = getFieldSlot(row, column);
424     if (!fieldSlot) {
425         return BAD_VALUE;
426     }
427 
428     fieldSlot->type = FIELD_TYPE_NULL;
429     fieldSlot->data.buffer.offset = 0;
430     fieldSlot->data.buffer.size = 0;
431     return OK;
432 }
433 
434 }; // namespace android
435