Wed, 25 Sep 2013 13:58:13 +0200
8023956: Provide a work-around to broken Linux 32 bit "Exec Shield" using CS for NX emulation (crashing with SI_KERNEL)
Summary: Execute some code at a high virtual address value, and keep mapped
Reviewed-by: coleenp, zgu
1 /*
2 * Copyright (c) 1999, 2012, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 *
23 */
25 // no precompiled headers
26 #include "asm/macroAssembler.hpp"
27 #include "classfile/classLoader.hpp"
28 #include "classfile/systemDictionary.hpp"
29 #include "classfile/vmSymbols.hpp"
30 #include "code/icBuffer.hpp"
31 #include "code/vtableStubs.hpp"
32 #include "interpreter/interpreter.hpp"
33 #include "jvm_linux.h"
34 #include "memory/allocation.inline.hpp"
35 #include "mutex_linux.inline.hpp"
36 #include "os_share_linux.hpp"
37 #include "prims/jniFastGetField.hpp"
38 #include "prims/jvm.h"
39 #include "prims/jvm_misc.hpp"
40 #include "runtime/arguments.hpp"
41 #include "runtime/extendedPC.hpp"
42 #include "runtime/frame.inline.hpp"
43 #include "runtime/interfaceSupport.hpp"
44 #include "runtime/java.hpp"
45 #include "runtime/javaCalls.hpp"
46 #include "runtime/mutexLocker.hpp"
47 #include "runtime/osThread.hpp"
48 #include "runtime/sharedRuntime.hpp"
49 #include "runtime/stubRoutines.hpp"
50 #include "runtime/thread.inline.hpp"
51 #include "runtime/timer.hpp"
52 #include "utilities/events.hpp"
53 #include "utilities/vmError.hpp"
55 // put OS-includes here
56 # include <sys/types.h>
57 # include <sys/mman.h>
58 # include <pthread.h>
59 # include <signal.h>
60 # include <errno.h>
61 # include <dlfcn.h>
62 # include <stdlib.h>
63 # include <stdio.h>
64 # include <unistd.h>
65 # include <sys/resource.h>
66 # include <pthread.h>
67 # include <sys/stat.h>
68 # include <sys/time.h>
69 # include <sys/utsname.h>
70 # include <sys/socket.h>
71 # include <sys/wait.h>
72 # include <pwd.h>
73 # include <poll.h>
74 # include <ucontext.h>
75 # include <fpu_control.h>
77 #ifdef AMD64
78 #define REG_SP REG_RSP
79 #define REG_PC REG_RIP
80 #define REG_FP REG_RBP
81 #define SPELL_REG_SP "rsp"
82 #define SPELL_REG_FP "rbp"
83 #else
84 #define REG_SP REG_UESP
85 #define REG_PC REG_EIP
86 #define REG_FP REG_EBP
87 #define SPELL_REG_SP "esp"
88 #define SPELL_REG_FP "ebp"
89 #endif // AMD64
91 address os::current_stack_pointer() {
92 #ifdef SPARC_WORKS
93 register void *esp;
94 __asm__("mov %%"SPELL_REG_SP", %0":"=r"(esp));
95 return (address) ((char*)esp + sizeof(long)*2);
96 #elif defined(__clang__)
97 intptr_t* esp;
98 __asm__ __volatile__ ("mov %%"SPELL_REG_SP", %0":"=r"(esp):);
99 return (address) esp;
100 #else
101 register void *esp __asm__ (SPELL_REG_SP);
102 return (address) esp;
103 #endif
104 }
106 char* os::non_memory_address_word() {
107 // Must never look like an address returned by reserve_memory,
108 // even in its subfields (as defined by the CPU immediate fields,
109 // if the CPU splits constants across multiple instructions).
111 return (char*) -1;
112 }
114 void os::initialize_thread(Thread* thr) {
115 // Nothing to do.
116 }
118 address os::Linux::ucontext_get_pc(ucontext_t * uc) {
119 return (address)uc->uc_mcontext.gregs[REG_PC];
120 }
122 intptr_t* os::Linux::ucontext_get_sp(ucontext_t * uc) {
123 return (intptr_t*)uc->uc_mcontext.gregs[REG_SP];
124 }
126 intptr_t* os::Linux::ucontext_get_fp(ucontext_t * uc) {
127 return (intptr_t*)uc->uc_mcontext.gregs[REG_FP];
128 }
130 // For Forte Analyzer AsyncGetCallTrace profiling support - thread
131 // is currently interrupted by SIGPROF.
132 // os::Solaris::fetch_frame_from_ucontext() tries to skip nested signal
133 // frames. Currently we don't do that on Linux, so it's the same as
134 // os::fetch_frame_from_context().
135 ExtendedPC os::Linux::fetch_frame_from_ucontext(Thread* thread,
136 ucontext_t* uc, intptr_t** ret_sp, intptr_t** ret_fp) {
138 assert(thread != NULL, "just checking");
139 assert(ret_sp != NULL, "just checking");
140 assert(ret_fp != NULL, "just checking");
142 return os::fetch_frame_from_context(uc, ret_sp, ret_fp);
143 }
145 ExtendedPC os::fetch_frame_from_context(void* ucVoid,
146 intptr_t** ret_sp, intptr_t** ret_fp) {
148 ExtendedPC epc;
149 ucontext_t* uc = (ucontext_t*)ucVoid;
151 if (uc != NULL) {
152 epc = ExtendedPC(os::Linux::ucontext_get_pc(uc));
153 if (ret_sp) *ret_sp = os::Linux::ucontext_get_sp(uc);
154 if (ret_fp) *ret_fp = os::Linux::ucontext_get_fp(uc);
155 } else {
156 // construct empty ExtendedPC for return value checking
157 epc = ExtendedPC(NULL);
158 if (ret_sp) *ret_sp = (intptr_t *)NULL;
159 if (ret_fp) *ret_fp = (intptr_t *)NULL;
160 }
162 return epc;
163 }
165 frame os::fetch_frame_from_context(void* ucVoid) {
166 intptr_t* sp;
167 intptr_t* fp;
168 ExtendedPC epc = fetch_frame_from_context(ucVoid, &sp, &fp);
169 return frame(sp, fp, epc.pc());
170 }
172 // By default, gcc always save frame pointer (%ebp/%rbp) on stack. It may get
173 // turned off by -fomit-frame-pointer,
174 frame os::get_sender_for_C_frame(frame* fr) {
175 return frame(fr->sender_sp(), fr->link(), fr->sender_pc());
176 }
178 intptr_t* _get_previous_fp() {
179 #ifdef SPARC_WORKS
180 register intptr_t **ebp;
181 __asm__("mov %%"SPELL_REG_FP", %0":"=r"(ebp));
182 #elif defined(__clang__)
183 intptr_t **ebp;
184 __asm__ __volatile__ ("mov %%"SPELL_REG_FP", %0":"=r"(ebp):);
185 #else
186 register intptr_t **ebp __asm__ (SPELL_REG_FP);
187 #endif
188 return (intptr_t*) *ebp; // we want what it points to.
189 }
192 frame os::current_frame() {
193 intptr_t* fp = _get_previous_fp();
194 frame myframe((intptr_t*)os::current_stack_pointer(),
195 (intptr_t*)fp,
196 CAST_FROM_FN_PTR(address, os::current_frame));
197 if (os::is_first_C_frame(&myframe)) {
198 // stack is not walkable
199 return frame();
200 } else {
201 return os::get_sender_for_C_frame(&myframe);
202 }
203 }
205 // Utility functions
207 // From IA32 System Programming Guide
208 enum {
209 trap_page_fault = 0xE
210 };
212 extern "C" JNIEXPORT int
213 JVM_handle_linux_signal(int sig,
214 siginfo_t* info,
215 void* ucVoid,
216 int abort_if_unrecognized) {
217 ucontext_t* uc = (ucontext_t*) ucVoid;
219 Thread* t = ThreadLocalStorage::get_thread_slow();
221 // Must do this before SignalHandlerMark, if crash protection installed we will longjmp away
222 // (no destructors can be run)
223 os::WatcherThreadCrashProtection::check_crash_protection(sig, t);
225 SignalHandlerMark shm(t);
227 // Note: it's not uncommon that JNI code uses signal/sigset to install
228 // then restore certain signal handler (e.g. to temporarily block SIGPIPE,
229 // or have a SIGILL handler when detecting CPU type). When that happens,
230 // JVM_handle_linux_signal() might be invoked with junk info/ucVoid. To
231 // avoid unnecessary crash when libjsig is not preloaded, try handle signals
232 // that do not require siginfo/ucontext first.
234 if (sig == SIGPIPE || sig == SIGXFSZ) {
235 // allow chained handler to go first
236 if (os::Linux::chained_handler(sig, info, ucVoid)) {
237 return true;
238 } else {
239 if (PrintMiscellaneous && (WizardMode || Verbose)) {
240 char buf[64];
241 warning("Ignoring %s - see bugs 4229104 or 646499219",
242 os::exception_name(sig, buf, sizeof(buf)));
243 }
244 return true;
245 }
246 }
248 JavaThread* thread = NULL;
249 VMThread* vmthread = NULL;
250 if (os::Linux::signal_handlers_are_installed) {
251 if (t != NULL ){
252 if(t->is_Java_thread()) {
253 thread = (JavaThread*)t;
254 }
255 else if(t->is_VM_thread()){
256 vmthread = (VMThread *)t;
257 }
258 }
259 }
260 /*
261 NOTE: does not seem to work on linux.
262 if (info == NULL || info->si_code <= 0 || info->si_code == SI_NOINFO) {
263 // can't decode this kind of signal
264 info = NULL;
265 } else {
266 assert(sig == info->si_signo, "bad siginfo");
267 }
268 */
269 // decide if this trap can be handled by a stub
270 address stub = NULL;
272 address pc = NULL;
274 //%note os_trap_1
275 if (info != NULL && uc != NULL && thread != NULL) {
276 pc = (address) os::Linux::ucontext_get_pc(uc);
278 if (StubRoutines::is_safefetch_fault(pc)) {
279 uc->uc_mcontext.gregs[REG_PC] = intptr_t(StubRoutines::continuation_for_safefetch_fault(pc));
280 return 1;
281 }
283 #ifndef AMD64
284 // Halt if SI_KERNEL before more crashes get misdiagnosed as Java bugs
285 // This can happen in any running code (currently more frequently in
286 // interpreter code but has been seen in compiled code)
287 if (sig == SIGSEGV && info->si_addr == 0 && info->si_code == SI_KERNEL) {
288 fatal("An irrecoverable SI_KERNEL SIGSEGV has occurred due "
289 "to unstable signal handling in this distribution.");
290 }
291 #endif // AMD64
293 // Handle ALL stack overflow variations here
294 if (sig == SIGSEGV) {
295 address addr = (address) info->si_addr;
297 // check if fault address is within thread stack
298 if (addr < thread->stack_base() &&
299 addr >= thread->stack_base() - thread->stack_size()) {
300 // stack overflow
301 if (thread->in_stack_yellow_zone(addr)) {
302 thread->disable_stack_yellow_zone();
303 if (thread->thread_state() == _thread_in_Java) {
304 // Throw a stack overflow exception. Guard pages will be reenabled
305 // while unwinding the stack.
306 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::STACK_OVERFLOW);
307 } else {
308 // Thread was in the vm or native code. Return and try to finish.
309 return 1;
310 }
311 } else if (thread->in_stack_red_zone(addr)) {
312 // Fatal red zone violation. Disable the guard pages and fall through
313 // to handle_unexpected_exception way down below.
314 thread->disable_stack_red_zone();
315 tty->print_raw_cr("An irrecoverable stack overflow has occurred.");
317 // This is a likely cause, but hard to verify. Let's just print
318 // it as a hint.
319 tty->print_raw_cr("Please check if any of your loaded .so files has "
320 "enabled executable stack (see man page execstack(8))");
321 } else {
322 // Accessing stack address below sp may cause SEGV if current
323 // thread has MAP_GROWSDOWN stack. This should only happen when
324 // current thread was created by user code with MAP_GROWSDOWN flag
325 // and then attached to VM. See notes in os_linux.cpp.
326 if (thread->osthread()->expanding_stack() == 0) {
327 thread->osthread()->set_expanding_stack();
328 if (os::Linux::manually_expand_stack(thread, addr)) {
329 thread->osthread()->clear_expanding_stack();
330 return 1;
331 }
332 thread->osthread()->clear_expanding_stack();
333 } else {
334 fatal("recursive segv. expanding stack.");
335 }
336 }
337 }
338 }
340 if (thread->thread_state() == _thread_in_Java) {
341 // Java thread running in Java code => find exception handler if any
342 // a fault inside compiled code, the interpreter, or a stub
344 if (sig == SIGSEGV && os::is_poll_address((address)info->si_addr)) {
345 stub = SharedRuntime::get_poll_stub(pc);
346 } else if (sig == SIGBUS /* && info->si_code == BUS_OBJERR */) {
347 // BugId 4454115: A read from a MappedByteBuffer can fault
348 // here if the underlying file has been truncated.
349 // Do not crash the VM in such a case.
350 CodeBlob* cb = CodeCache::find_blob_unsafe(pc);
351 nmethod* nm = (cb != NULL && cb->is_nmethod()) ? (nmethod*)cb : NULL;
352 if (nm != NULL && nm->has_unsafe_access()) {
353 stub = StubRoutines::handler_for_unsafe_access();
354 }
355 }
356 else
358 #ifdef AMD64
359 if (sig == SIGFPE &&
360 (info->si_code == FPE_INTDIV || info->si_code == FPE_FLTDIV)) {
361 stub =
362 SharedRuntime::
363 continuation_for_implicit_exception(thread,
364 pc,
365 SharedRuntime::
366 IMPLICIT_DIVIDE_BY_ZERO);
367 #else
368 if (sig == SIGFPE /* && info->si_code == FPE_INTDIV */) {
369 // HACK: si_code does not work on linux 2.2.12-20!!!
370 int op = pc[0];
371 if (op == 0xDB) {
372 // FIST
373 // TODO: The encoding of D2I in i486.ad can cause an exception
374 // prior to the fist instruction if there was an invalid operation
375 // pending. We want to dismiss that exception. From the win_32
376 // side it also seems that if it really was the fist causing
377 // the exception that we do the d2i by hand with different
378 // rounding. Seems kind of weird.
379 // NOTE: that we take the exception at the NEXT floating point instruction.
380 assert(pc[0] == 0xDB, "not a FIST opcode");
381 assert(pc[1] == 0x14, "not a FIST opcode");
382 assert(pc[2] == 0x24, "not a FIST opcode");
383 return true;
384 } else if (op == 0xF7) {
385 // IDIV
386 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::IMPLICIT_DIVIDE_BY_ZERO);
387 } else {
388 // TODO: handle more cases if we are using other x86 instructions
389 // that can generate SIGFPE signal on linux.
390 tty->print_cr("unknown opcode 0x%X with SIGFPE.", op);
391 fatal("please update this code.");
392 }
393 #endif // AMD64
394 } else if (sig == SIGSEGV &&
395 !MacroAssembler::needs_explicit_null_check((intptr_t)info->si_addr)) {
396 // Determination of interpreter/vtable stub/compiled code null exception
397 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::IMPLICIT_NULL);
398 }
399 } else if (thread->thread_state() == _thread_in_vm &&
400 sig == SIGBUS && /* info->si_code == BUS_OBJERR && */
401 thread->doing_unsafe_access()) {
402 stub = StubRoutines::handler_for_unsafe_access();
403 }
405 // jni_fast_Get<Primitive>Field can trap at certain pc's if a GC kicks in
406 // and the heap gets shrunk before the field access.
407 if ((sig == SIGSEGV) || (sig == SIGBUS)) {
408 address addr = JNI_FastGetField::find_slowcase_pc(pc);
409 if (addr != (address)-1) {
410 stub = addr;
411 }
412 }
414 // Check to see if we caught the safepoint code in the
415 // process of write protecting the memory serialization page.
416 // It write enables the page immediately after protecting it
417 // so we can just return to retry the write.
418 if ((sig == SIGSEGV) &&
419 os::is_memory_serialize_page(thread, (address) info->si_addr)) {
420 // Block current thread until the memory serialize page permission restored.
421 os::block_on_serialize_page_trap();
422 return true;
423 }
424 }
426 #ifndef AMD64
427 // Execution protection violation
428 //
429 // This should be kept as the last step in the triage. We don't
430 // have a dedicated trap number for a no-execute fault, so be
431 // conservative and allow other handlers the first shot.
432 //
433 // Note: We don't test that info->si_code == SEGV_ACCERR here.
434 // this si_code is so generic that it is almost meaningless; and
435 // the si_code for this condition may change in the future.
436 // Furthermore, a false-positive should be harmless.
437 if (UnguardOnExecutionViolation > 0 &&
438 (sig == SIGSEGV || sig == SIGBUS) &&
439 uc->uc_mcontext.gregs[REG_TRAPNO] == trap_page_fault) {
440 int page_size = os::vm_page_size();
441 address addr = (address) info->si_addr;
442 address pc = os::Linux::ucontext_get_pc(uc);
443 // Make sure the pc and the faulting address are sane.
444 //
445 // If an instruction spans a page boundary, and the page containing
446 // the beginning of the instruction is executable but the following
447 // page is not, the pc and the faulting address might be slightly
448 // different - we still want to unguard the 2nd page in this case.
449 //
450 // 15 bytes seems to be a (very) safe value for max instruction size.
451 bool pc_is_near_addr =
452 (pointer_delta((void*) addr, (void*) pc, sizeof(char)) < 15);
453 bool instr_spans_page_boundary =
454 (align_size_down((intptr_t) pc ^ (intptr_t) addr,
455 (intptr_t) page_size) > 0);
457 if (pc == addr || (pc_is_near_addr && instr_spans_page_boundary)) {
458 static volatile address last_addr =
459 (address) os::non_memory_address_word();
461 // In conservative mode, don't unguard unless the address is in the VM
462 if (addr != last_addr &&
463 (UnguardOnExecutionViolation > 1 || os::address_is_in_vm(addr))) {
465 // Set memory to RWX and retry
466 address page_start =
467 (address) align_size_down((intptr_t) addr, (intptr_t) page_size);
468 bool res = os::protect_memory((char*) page_start, page_size,
469 os::MEM_PROT_RWX);
471 if (PrintMiscellaneous && Verbose) {
472 char buf[256];
473 jio_snprintf(buf, sizeof(buf), "Execution protection violation "
474 "at " INTPTR_FORMAT
475 ", unguarding " INTPTR_FORMAT ": %s, errno=%d", addr,
476 page_start, (res ? "success" : "failed"), errno);
477 tty->print_raw_cr(buf);
478 }
479 stub = pc;
481 // Set last_addr so if we fault again at the same address, we don't end
482 // up in an endless loop.
483 //
484 // There are two potential complications here. Two threads trapping at
485 // the same address at the same time could cause one of the threads to
486 // think it already unguarded, and abort the VM. Likely very rare.
487 //
488 // The other race involves two threads alternately trapping at
489 // different addresses and failing to unguard the page, resulting in
490 // an endless loop. This condition is probably even more unlikely than
491 // the first.
492 //
493 // Although both cases could be avoided by using locks or thread local
494 // last_addr, these solutions are unnecessary complication: this
495 // handler is a best-effort safety net, not a complete solution. It is
496 // disabled by default and should only be used as a workaround in case
497 // we missed any no-execute-unsafe VM code.
499 last_addr = addr;
500 }
501 }
502 }
503 #endif // !AMD64
505 if (stub != NULL) {
506 // save all thread context in case we need to restore it
507 if (thread != NULL) thread->set_saved_exception_pc(pc);
509 uc->uc_mcontext.gregs[REG_PC] = (greg_t)stub;
510 return true;
511 }
513 // signal-chaining
514 if (os::Linux::chained_handler(sig, info, ucVoid)) {
515 return true;
516 }
518 if (!abort_if_unrecognized) {
519 // caller wants another chance, so give it to him
520 return false;
521 }
523 if (pc == NULL && uc != NULL) {
524 pc = os::Linux::ucontext_get_pc(uc);
525 }
527 // unmask current signal
528 sigset_t newset;
529 sigemptyset(&newset);
530 sigaddset(&newset, sig);
531 sigprocmask(SIG_UNBLOCK, &newset, NULL);
533 VMError err(t, sig, pc, info, ucVoid);
534 err.report_and_die();
536 ShouldNotReachHere();
537 }
539 void os::Linux::init_thread_fpu_state(void) {
540 #ifndef AMD64
541 // set fpu to 53 bit precision
542 set_fpu_control_word(0x27f);
543 #endif // !AMD64
544 }
546 int os::Linux::get_fpu_control_word(void) {
547 #ifdef AMD64
548 return 0;
549 #else
550 int fpu_control;
551 _FPU_GETCW(fpu_control);
552 return fpu_control & 0xffff;
553 #endif // AMD64
554 }
556 void os::Linux::set_fpu_control_word(int fpu_control) {
557 #ifndef AMD64
558 _FPU_SETCW(fpu_control);
559 #endif // !AMD64
560 }
562 // Check that the linux kernel version is 2.4 or higher since earlier
563 // versions do not support SSE without patches.
564 bool os::supports_sse() {
565 #ifdef AMD64
566 return true;
567 #else
568 struct utsname uts;
569 if( uname(&uts) != 0 ) return false; // uname fails?
570 char *minor_string;
571 int major = strtol(uts.release,&minor_string,10);
572 int minor = strtol(minor_string+1,NULL,10);
573 bool result = (major > 2 || (major==2 && minor >= 4));
574 #ifndef PRODUCT
575 if (PrintMiscellaneous && Verbose) {
576 tty->print("OS version is %d.%d, which %s support SSE/SSE2\n",
577 major,minor, result ? "DOES" : "does NOT");
578 }
579 #endif
580 return result;
581 #endif // AMD64
582 }
584 bool os::is_allocatable(size_t bytes) {
585 #ifdef AMD64
586 // unused on amd64?
587 return true;
588 #else
590 if (bytes < 2 * G) {
591 return true;
592 }
594 char* addr = reserve_memory(bytes, NULL);
596 if (addr != NULL) {
597 release_memory(addr, bytes);
598 }
600 return addr != NULL;
601 #endif // AMD64
602 }
604 ////////////////////////////////////////////////////////////////////////////////
605 // thread stack
607 #ifdef AMD64
608 size_t os::Linux::min_stack_allowed = 64 * K;
610 // amd64: pthread on amd64 is always in floating stack mode
611 bool os::Linux::supports_variable_stack_size() { return true; }
612 #else
613 size_t os::Linux::min_stack_allowed = (48 DEBUG_ONLY(+4))*K;
615 #ifdef __GNUC__
616 #define GET_GS() ({int gs; __asm__ volatile("movw %%gs, %w0":"=q"(gs)); gs&0xffff;})
617 #endif
619 // Test if pthread library can support variable thread stack size. LinuxThreads
620 // in fixed stack mode allocates 2M fixed slot for each thread. LinuxThreads
621 // in floating stack mode and NPTL support variable stack size.
622 bool os::Linux::supports_variable_stack_size() {
623 if (os::Linux::is_NPTL()) {
624 // NPTL, yes
625 return true;
627 } else {
628 // Note: We can't control default stack size when creating a thread.
629 // If we use non-default stack size (pthread_attr_setstacksize), both
630 // floating stack and non-floating stack LinuxThreads will return the
631 // same value. This makes it impossible to implement this function by
632 // detecting thread stack size directly.
633 //
634 // An alternative approach is to check %gs. Fixed-stack LinuxThreads
635 // do not use %gs, so its value is 0. Floating-stack LinuxThreads use
636 // %gs (either as LDT selector or GDT selector, depending on kernel)
637 // to access thread specific data.
638 //
639 // Note that %gs is a reserved glibc register since early 2001, so
640 // applications are not allowed to change its value (Ulrich Drepper from
641 // Redhat confirmed that all known offenders have been modified to use
642 // either %fs or TSD). In the worst case scenario, when VM is embedded in
643 // a native application that plays with %gs, we might see non-zero %gs
644 // even LinuxThreads is running in fixed stack mode. As the result, we'll
645 // return true and skip _thread_safety_check(), so we may not be able to
646 // detect stack-heap collisions. But otherwise it's harmless.
647 //
648 #ifdef __GNUC__
649 return (GET_GS() != 0);
650 #else
651 return false;
652 #endif
653 }
654 }
655 #endif // AMD64
657 // return default stack size for thr_type
658 size_t os::Linux::default_stack_size(os::ThreadType thr_type) {
659 // default stack size (compiler thread needs larger stack)
660 #ifdef AMD64
661 size_t s = (thr_type == os::compiler_thread ? 4 * M : 1 * M);
662 #else
663 size_t s = (thr_type == os::compiler_thread ? 2 * M : 512 * K);
664 #endif // AMD64
665 return s;
666 }
668 size_t os::Linux::default_guard_size(os::ThreadType thr_type) {
669 // Creating guard page is very expensive. Java thread has HotSpot
670 // guard page, only enable glibc guard page for non-Java threads.
671 return (thr_type == java_thread ? 0 : page_size());
672 }
674 // Java thread:
675 //
676 // Low memory addresses
677 // +------------------------+
678 // | |\ JavaThread created by VM does not have glibc
679 // | glibc guard page | - guard, attached Java thread usually has
680 // | |/ 1 page glibc guard.
681 // P1 +------------------------+ Thread::stack_base() - Thread::stack_size()
682 // | |\
683 // | HotSpot Guard Pages | - red and yellow pages
684 // | |/
685 // +------------------------+ JavaThread::stack_yellow_zone_base()
686 // | |\
687 // | Normal Stack | -
688 // | |/
689 // P2 +------------------------+ Thread::stack_base()
690 //
691 // Non-Java thread:
692 //
693 // Low memory addresses
694 // +------------------------+
695 // | |\
696 // | glibc guard page | - usually 1 page
697 // | |/
698 // P1 +------------------------+ Thread::stack_base() - Thread::stack_size()
699 // | |\
700 // | Normal Stack | -
701 // | |/
702 // P2 +------------------------+ Thread::stack_base()
703 //
704 // ** P1 (aka bottom) and size ( P2 = P1 - size) are the address and stack size returned from
705 // pthread_attr_getstack()
707 static void current_stack_region(address * bottom, size_t * size) {
708 if (os::Linux::is_initial_thread()) {
709 // initial thread needs special handling because pthread_getattr_np()
710 // may return bogus value.
711 *bottom = os::Linux::initial_thread_stack_bottom();
712 *size = os::Linux::initial_thread_stack_size();
713 } else {
714 pthread_attr_t attr;
716 int rslt = pthread_getattr_np(pthread_self(), &attr);
718 // JVM needs to know exact stack location, abort if it fails
719 if (rslt != 0) {
720 if (rslt == ENOMEM) {
721 vm_exit_out_of_memory(0, OOM_MMAP_ERROR, "pthread_getattr_np");
722 } else {
723 fatal(err_msg("pthread_getattr_np failed with errno = %d", rslt));
724 }
725 }
727 if (pthread_attr_getstack(&attr, (void **)bottom, size) != 0) {
728 fatal("Can not locate current stack attributes!");
729 }
731 pthread_attr_destroy(&attr);
733 }
734 assert(os::current_stack_pointer() >= *bottom &&
735 os::current_stack_pointer() < *bottom + *size, "just checking");
736 }
738 address os::current_stack_base() {
739 address bottom;
740 size_t size;
741 current_stack_region(&bottom, &size);
742 return (bottom + size);
743 }
745 size_t os::current_stack_size() {
746 // stack size includes normal stack and HotSpot guard pages
747 address bottom;
748 size_t size;
749 current_stack_region(&bottom, &size);
750 return size;
751 }
753 /////////////////////////////////////////////////////////////////////////////
754 // helper functions for fatal error handler
756 void os::print_context(outputStream *st, void *context) {
757 if (context == NULL) return;
759 ucontext_t *uc = (ucontext_t*)context;
760 st->print_cr("Registers:");
761 #ifdef AMD64
762 st->print( "RAX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RAX]);
763 st->print(", RBX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RBX]);
764 st->print(", RCX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RCX]);
765 st->print(", RDX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RDX]);
766 st->cr();
767 st->print( "RSP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RSP]);
768 st->print(", RBP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RBP]);
769 st->print(", RSI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RSI]);
770 st->print(", RDI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RDI]);
771 st->cr();
772 st->print( "R8 =" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R8]);
773 st->print(", R9 =" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R9]);
774 st->print(", R10=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R10]);
775 st->print(", R11=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R11]);
776 st->cr();
777 st->print( "R12=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R12]);
778 st->print(", R13=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R13]);
779 st->print(", R14=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R14]);
780 st->print(", R15=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R15]);
781 st->cr();
782 st->print( "RIP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RIP]);
783 st->print(", EFLAGS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EFL]);
784 st->print(", CSGSFS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_CSGSFS]);
785 st->print(", ERR=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ERR]);
786 st->cr();
787 st->print(" TRAPNO=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_TRAPNO]);
788 #else
789 st->print( "EAX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EAX]);
790 st->print(", EBX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EBX]);
791 st->print(", ECX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ECX]);
792 st->print(", EDX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EDX]);
793 st->cr();
794 st->print( "ESP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_UESP]);
795 st->print(", EBP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EBP]);
796 st->print(", ESI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ESI]);
797 st->print(", EDI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EDI]);
798 st->cr();
799 st->print( "EIP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EIP]);
800 st->print(", EFLAGS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EFL]);
801 st->print(", CR2=" INTPTR_FORMAT, uc->uc_mcontext.cr2);
802 #endif // AMD64
803 st->cr();
804 st->cr();
806 intptr_t *sp = (intptr_t *)os::Linux::ucontext_get_sp(uc);
807 st->print_cr("Top of Stack: (sp=" PTR_FORMAT ")", sp);
808 print_hex_dump(st, (address)sp, (address)(sp + 8*sizeof(intptr_t)), sizeof(intptr_t));
809 st->cr();
811 // Note: it may be unsafe to inspect memory near pc. For example, pc may
812 // point to garbage if entry point in an nmethod is corrupted. Leave
813 // this at the end, and hope for the best.
814 address pc = os::Linux::ucontext_get_pc(uc);
815 st->print_cr("Instructions: (pc=" PTR_FORMAT ")", pc);
816 print_hex_dump(st, pc - 32, pc + 32, sizeof(char));
817 }
819 void os::print_register_info(outputStream *st, void *context) {
820 if (context == NULL) return;
822 ucontext_t *uc = (ucontext_t*)context;
824 st->print_cr("Register to memory mapping:");
825 st->cr();
827 // this is horrendously verbose but the layout of the registers in the
828 // context does not match how we defined our abstract Register set, so
829 // we can't just iterate through the gregs area
831 // this is only for the "general purpose" registers
833 #ifdef AMD64
834 st->print("RAX="); print_location(st, uc->uc_mcontext.gregs[REG_RAX]);
835 st->print("RBX="); print_location(st, uc->uc_mcontext.gregs[REG_RBX]);
836 st->print("RCX="); print_location(st, uc->uc_mcontext.gregs[REG_RCX]);
837 st->print("RDX="); print_location(st, uc->uc_mcontext.gregs[REG_RDX]);
838 st->print("RSP="); print_location(st, uc->uc_mcontext.gregs[REG_RSP]);
839 st->print("RBP="); print_location(st, uc->uc_mcontext.gregs[REG_RBP]);
840 st->print("RSI="); print_location(st, uc->uc_mcontext.gregs[REG_RSI]);
841 st->print("RDI="); print_location(st, uc->uc_mcontext.gregs[REG_RDI]);
842 st->print("R8 ="); print_location(st, uc->uc_mcontext.gregs[REG_R8]);
843 st->print("R9 ="); print_location(st, uc->uc_mcontext.gregs[REG_R9]);
844 st->print("R10="); print_location(st, uc->uc_mcontext.gregs[REG_R10]);
845 st->print("R11="); print_location(st, uc->uc_mcontext.gregs[REG_R11]);
846 st->print("R12="); print_location(st, uc->uc_mcontext.gregs[REG_R12]);
847 st->print("R13="); print_location(st, uc->uc_mcontext.gregs[REG_R13]);
848 st->print("R14="); print_location(st, uc->uc_mcontext.gregs[REG_R14]);
849 st->print("R15="); print_location(st, uc->uc_mcontext.gregs[REG_R15]);
850 #else
851 st->print("EAX="); print_location(st, uc->uc_mcontext.gregs[REG_EAX]);
852 st->print("EBX="); print_location(st, uc->uc_mcontext.gregs[REG_EBX]);
853 st->print("ECX="); print_location(st, uc->uc_mcontext.gregs[REG_ECX]);
854 st->print("EDX="); print_location(st, uc->uc_mcontext.gregs[REG_EDX]);
855 st->print("ESP="); print_location(st, uc->uc_mcontext.gregs[REG_ESP]);
856 st->print("EBP="); print_location(st, uc->uc_mcontext.gregs[REG_EBP]);
857 st->print("ESI="); print_location(st, uc->uc_mcontext.gregs[REG_ESI]);
858 st->print("EDI="); print_location(st, uc->uc_mcontext.gregs[REG_EDI]);
859 #endif // AMD64
861 st->cr();
862 }
864 void os::setup_fpu() {
865 #ifndef AMD64
866 address fpu_cntrl = StubRoutines::addr_fpu_cntrl_wrd_std();
867 __asm__ volatile ( "fldcw (%0)" :
868 : "r" (fpu_cntrl) : "memory");
869 #endif // !AMD64
870 }
872 #ifndef PRODUCT
873 void os::verify_stack_alignment() {
874 #ifdef AMD64
875 assert(((intptr_t)os::current_stack_pointer() & (StackAlignmentInBytes-1)) == 0, "incorrect stack alignment");
876 #endif
877 }
878 #endif
881 /*
882 * IA32 only: execute code at a high address in case buggy NX emulation is present. I.e. avoid CS limit
883 * updates (JDK-8023956).
884 */
885 void os::workaround_expand_exec_shield_cs_limit() {
886 #if defined(IA32)
887 size_t page_size = os::vm_page_size();
888 /*
889 * Take the highest VA the OS will give us and exec
890 *
891 * Although using -(pagesz) as mmap hint works on newer kernel as you would
892 * think, older variants affected by this work-around don't (search forward only).
893 *
894 * On the affected distributions, we understand the memory layout to be:
895 *
896 * TASK_LIMIT= 3G, main stack base close to TASK_LIMT.
897 *
898 * A few pages south main stack will do it.
899 *
900 * If we are embedded in an app other than launcher (initial != main stack),
901 * we don't have much control or understanding of the address space, just let it slide.
902 */
903 char* hint = (char*) (Linux::initial_thread_stack_bottom() -
904 ((StackYellowPages + StackRedPages + 1) * page_size));
905 char* codebuf = os::reserve_memory(page_size, hint);
906 if ( (codebuf == NULL) || (!os::commit_memory(codebuf, page_size, true)) ) {
907 return; // No matter, we tried, best effort.
908 }
909 if (PrintMiscellaneous && (Verbose || WizardMode)) {
910 tty->print_cr("[CS limit NX emulation work-around, exec code at: %p]", codebuf);
911 }
913 // Some code to exec: the 'ret' instruction
914 codebuf[0] = 0xC3;
916 // Call the code in the codebuf
917 __asm__ volatile("call *%0" : : "r"(codebuf));
919 // keep the page mapped so CS limit isn't reduced.
920 #endif
921 }