annotate src/os_cpu/linux_x86/vm/os_linux_x86.cpp @ 9029:1485461a0fd1

8197429: Increased stack guard causes segfaults on x86-32 Reviewed-by: dholmes
author aph
date Fri, 06 Jul 2018 17:25:06 +0100
parents 427b2fb1944f
children
rev   line source
duke@0 1 /*
dbuck@8815 2 * Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
duke@0 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
duke@0 4 *
duke@0 5 * This code is free software; you can redistribute it and/or modify it
duke@0 6 * under the terms of the GNU General Public License version 2 only, as
duke@0 7 * published by the Free Software Foundation.
duke@0 8 *
duke@0 9 * This code is distributed in the hope that it will be useful, but WITHOUT
duke@0 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
duke@0 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
duke@0 12 * version 2 for more details (a copy is included in the LICENSE file that
duke@0 13 * accompanied this code).
duke@0 14 *
duke@0 15 * You should have received a copy of the GNU General Public License version
duke@0 16 * 2 along with this work; if not, write to the Free Software Foundation,
duke@0 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
duke@0 18 *
trims@1472 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
trims@1472 20 * or visit www.oracle.com if you need additional information or have any
trims@1472 21 * questions.
duke@0 22 *
duke@0 23 */
duke@0 24
stefank@1879 25 // no precompiled headers
twisti@3883 26 #include "asm/macroAssembler.hpp"
stefank@1879 27 #include "classfile/classLoader.hpp"
stefank@1879 28 #include "classfile/systemDictionary.hpp"
stefank@1879 29 #include "classfile/vmSymbols.hpp"
stefank@1879 30 #include "code/icBuffer.hpp"
stefank@1879 31 #include "code/vtableStubs.hpp"
stefank@1879 32 #include "interpreter/interpreter.hpp"
stefank@1879 33 #include "jvm_linux.h"
stefank@1879 34 #include "memory/allocation.inline.hpp"
stefank@1879 35 #include "mutex_linux.inline.hpp"
stefank@1879 36 #include "os_share_linux.hpp"
stefank@1879 37 #include "prims/jniFastGetField.hpp"
stefank@1879 38 #include "prims/jvm.h"
stefank@1879 39 #include "prims/jvm_misc.hpp"
stefank@1879 40 #include "runtime/arguments.hpp"
stefank@1879 41 #include "runtime/extendedPC.hpp"
stefank@1879 42 #include "runtime/frame.inline.hpp"
stefank@1879 43 #include "runtime/interfaceSupport.hpp"
stefank@1879 44 #include "runtime/java.hpp"
stefank@1879 45 #include "runtime/javaCalls.hpp"
stefank@1879 46 #include "runtime/mutexLocker.hpp"
stefank@1879 47 #include "runtime/osThread.hpp"
stefank@1879 48 #include "runtime/sharedRuntime.hpp"
stefank@1879 49 #include "runtime/stubRoutines.hpp"
stefank@3864 50 #include "runtime/thread.inline.hpp"
stefank@1879 51 #include "runtime/timer.hpp"
stefank@1879 52 #include "utilities/events.hpp"
stefank@1879 53 #include "utilities/vmError.hpp"
duke@0 54
duke@0 55 // put OS-includes here
duke@0 56 # include <sys/types.h>
duke@0 57 # include <sys/mman.h>
duke@0 58 # include <pthread.h>
duke@0 59 # include <signal.h>
duke@0 60 # include <errno.h>
duke@0 61 # include <dlfcn.h>
duke@0 62 # include <stdlib.h>
duke@0 63 # include <stdio.h>
duke@0 64 # include <unistd.h>
duke@0 65 # include <sys/resource.h>
duke@0 66 # include <pthread.h>
duke@0 67 # include <sys/stat.h>
duke@0 68 # include <sys/time.h>
duke@0 69 # include <sys/utsname.h>
duke@0 70 # include <sys/socket.h>
duke@0 71 # include <sys/wait.h>
duke@0 72 # include <pwd.h>
duke@0 73 # include <poll.h>
duke@0 74 # include <ucontext.h>
duke@0 75 # include <fpu_control.h>
duke@0 76
duke@0 77 #ifdef AMD64
duke@0 78 #define REG_SP REG_RSP
duke@0 79 #define REG_PC REG_RIP
duke@0 80 #define REG_FP REG_RBP
duke@0 81 #define SPELL_REG_SP "rsp"
duke@0 82 #define SPELL_REG_FP "rbp"
duke@0 83 #else
duke@0 84 #define REG_SP REG_UESP
duke@0 85 #define REG_PC REG_EIP
duke@0 86 #define REG_FP REG_EBP
duke@0 87 #define SPELL_REG_SP "esp"
duke@0 88 #define SPELL_REG_FP "ebp"
duke@0 89 #endif // AMD64
duke@0 90
drchase@6245 91 PRAGMA_FORMAT_MUTE_WARNINGS_FOR_GCC
drchase@6245 92
duke@0 93 address os::current_stack_pointer() {
dcubed@50 94 #ifdef SPARC_WORKS
dcubed@50 95 register void *esp;
dcubed@50 96 __asm__("mov %%"SPELL_REG_SP", %0":"=r"(esp));
dcubed@50 97 return (address) ((char*)esp + sizeof(long)*2);
simonis@4795 98 #elif defined(__clang__)
simonis@4795 99 intptr_t* esp;
simonis@4795 100 __asm__ __volatile__ ("mov %%"SPELL_REG_SP", %0":"=r"(esp):);
simonis@4795 101 return (address) esp;
dcubed@50 102 #else
duke@0 103 register void *esp __asm__ (SPELL_REG_SP);
duke@0 104 return (address) esp;
dcubed@50 105 #endif
duke@0 106 }
duke@0 107
duke@0 108 char* os::non_memory_address_word() {
duke@0 109 // Must never look like an address returned by reserve_memory,
duke@0 110 // even in its subfields (as defined by the CPU immediate fields,
duke@0 111 // if the CPU splits constants across multiple instructions).
duke@0 112
duke@0 113 return (char*) -1;
duke@0 114 }
duke@0 115
zgu@3644 116 void os::initialize_thread(Thread* thr) {
duke@0 117 // Nothing to do.
duke@0 118 }
duke@0 119
duke@0 120 address os::Linux::ucontext_get_pc(ucontext_t * uc) {
duke@0 121 return (address)uc->uc_mcontext.gregs[REG_PC];
duke@0 122 }
duke@0 123
duke@0 124 intptr_t* os::Linux::ucontext_get_sp(ucontext_t * uc) {
duke@0 125 return (intptr_t*)uc->uc_mcontext.gregs[REG_SP];
duke@0 126 }
duke@0 127
duke@0 128 intptr_t* os::Linux::ucontext_get_fp(ucontext_t * uc) {
duke@0 129 return (intptr_t*)uc->uc_mcontext.gregs[REG_FP];
duke@0 130 }
duke@0 131
duke@0 132 // For Forte Analyzer AsyncGetCallTrace profiling support - thread
duke@0 133 // is currently interrupted by SIGPROF.
duke@0 134 // os::Solaris::fetch_frame_from_ucontext() tries to skip nested signal
duke@0 135 // frames. Currently we don't do that on Linux, so it's the same as
duke@0 136 // os::fetch_frame_from_context().
duke@0 137 ExtendedPC os::Linux::fetch_frame_from_ucontext(Thread* thread,
duke@0 138 ucontext_t* uc, intptr_t** ret_sp, intptr_t** ret_fp) {
duke@0 139
duke@0 140 assert(thread != NULL, "just checking");
duke@0 141 assert(ret_sp != NULL, "just checking");
duke@0 142 assert(ret_fp != NULL, "just checking");
duke@0 143
duke@0 144 return os::fetch_frame_from_context(uc, ret_sp, ret_fp);
duke@0 145 }
duke@0 146
duke@0 147 ExtendedPC os::fetch_frame_from_context(void* ucVoid,
duke@0 148 intptr_t** ret_sp, intptr_t** ret_fp) {
duke@0 149
duke@0 150 ExtendedPC epc;
duke@0 151 ucontext_t* uc = (ucontext_t*)ucVoid;
duke@0 152
duke@0 153 if (uc != NULL) {
duke@0 154 epc = ExtendedPC(os::Linux::ucontext_get_pc(uc));
duke@0 155 if (ret_sp) *ret_sp = os::Linux::ucontext_get_sp(uc);
duke@0 156 if (ret_fp) *ret_fp = os::Linux::ucontext_get_fp(uc);
duke@0 157 } else {
duke@0 158 // construct empty ExtendedPC for return value checking
duke@0 159 epc = ExtendedPC(NULL);
duke@0 160 if (ret_sp) *ret_sp = (intptr_t *)NULL;
duke@0 161 if (ret_fp) *ret_fp = (intptr_t *)NULL;
duke@0 162 }
duke@0 163
duke@0 164 return epc;
duke@0 165 }
duke@0 166
duke@0 167 frame os::fetch_frame_from_context(void* ucVoid) {
duke@0 168 intptr_t* sp;
duke@0 169 intptr_t* fp;
duke@0 170 ExtendedPC epc = fetch_frame_from_context(ucVoid, &sp, &fp);
duke@0 171 return frame(sp, fp, epc.pc());
duke@0 172 }
duke@0 173
duke@0 174 // By default, gcc always save frame pointer (%ebp/%rbp) on stack. It may get
duke@0 175 // turned off by -fomit-frame-pointer,
duke@0 176 frame os::get_sender_for_C_frame(frame* fr) {
duke@0 177 return frame(fr->sender_sp(), fr->link(), fr->sender_pc());
duke@0 178 }
duke@0 179
duke@0 180 intptr_t* _get_previous_fp() {
dcubed@50 181 #ifdef SPARC_WORKS
dcubed@50 182 register intptr_t **ebp;
dcubed@50 183 __asm__("mov %%"SPELL_REG_FP", %0":"=r"(ebp));
simonis@4795 184 #elif defined(__clang__)
simonis@4795 185 intptr_t **ebp;
simonis@4795 186 __asm__ __volatile__ ("mov %%"SPELL_REG_FP", %0":"=r"(ebp):);
dcubed@50 187 #else
duke@0 188 register intptr_t **ebp __asm__ (SPELL_REG_FP);
dcubed@50 189 #endif
duke@0 190 return (intptr_t*) *ebp; // we want what it points to.
duke@0 191 }
duke@0 192
duke@0 193
duke@0 194 frame os::current_frame() {
duke@0 195 intptr_t* fp = _get_previous_fp();
duke@0 196 frame myframe((intptr_t*)os::current_stack_pointer(),
duke@0 197 (intptr_t*)fp,
duke@0 198 CAST_FROM_FN_PTR(address, os::current_frame));
duke@0 199 if (os::is_first_C_frame(&myframe)) {
duke@0 200 // stack is not walkable
dholmes@4093 201 return frame();
duke@0 202 } else {
duke@0 203 return os::get_sender_for_C_frame(&myframe);
duke@0 204 }
duke@0 205 }
duke@0 206
duke@0 207 // Utility functions
duke@0 208
duke@0 209 // From IA32 System Programming Guide
duke@0 210 enum {
duke@0 211 trap_page_fault = 0xE
duke@0 212 };
duke@0 213
coleenp@2072 214 extern "C" JNIEXPORT int
duke@0 215 JVM_handle_linux_signal(int sig,
duke@0 216 siginfo_t* info,
duke@0 217 void* ucVoid,
duke@0 218 int abort_if_unrecognized) {
duke@0 219 ucontext_t* uc = (ucontext_t*) ucVoid;
duke@0 220
duke@0 221 Thread* t = ThreadLocalStorage::get_thread_slow();
duke@0 222
rbackman@4989 223 // Must do this before SignalHandlerMark, if crash protection installed we will longjmp away
rbackman@4989 224 // (no destructors can be run)
rbackman@4989 225 os::WatcherThreadCrashProtection::check_crash_protection(sig, t);
rbackman@4989 226
duke@0 227 SignalHandlerMark shm(t);
duke@0 228
duke@0 229 // Note: it's not uncommon that JNI code uses signal/sigset to install
duke@0 230 // then restore certain signal handler (e.g. to temporarily block SIGPIPE,
duke@0 231 // or have a SIGILL handler when detecting CPU type). When that happens,
duke@0 232 // JVM_handle_linux_signal() might be invoked with junk info/ucVoid. To
duke@0 233 // avoid unnecessary crash when libjsig is not preloaded, try handle signals
duke@0 234 // that do not require siginfo/ucontext first.
duke@0 235
duke@0 236 if (sig == SIGPIPE || sig == SIGXFSZ) {
duke@0 237 // allow chained handler to go first
duke@0 238 if (os::Linux::chained_handler(sig, info, ucVoid)) {
duke@0 239 return true;
duke@0 240 } else {
duke@0 241 if (PrintMiscellaneous && (WizardMode || Verbose)) {
duke@0 242 char buf[64];
duke@0 243 warning("Ignoring %s - see bugs 4229104 or 646499219",
duke@0 244 os::exception_name(sig, buf, sizeof(buf)));
duke@0 245 }
duke@0 246 return true;
duke@0 247 }
duke@0 248 }
duke@0 249
duke@0 250 JavaThread* thread = NULL;
duke@0 251 VMThread* vmthread = NULL;
duke@0 252 if (os::Linux::signal_handlers_are_installed) {
duke@0 253 if (t != NULL ){
duke@0 254 if(t->is_Java_thread()) {
duke@0 255 thread = (JavaThread*)t;
duke@0 256 }
duke@0 257 else if(t->is_VM_thread()){
duke@0 258 vmthread = (VMThread *)t;
duke@0 259 }
duke@0 260 }
duke@0 261 }
duke@0 262 /*
duke@0 263 NOTE: does not seem to work on linux.
duke@0 264 if (info == NULL || info->si_code <= 0 || info->si_code == SI_NOINFO) {
duke@0 265 // can't decode this kind of signal
duke@0 266 info = NULL;
duke@0 267 } else {
duke@0 268 assert(sig == info->si_signo, "bad siginfo");
duke@0 269 }
duke@0 270 */
duke@0 271 // decide if this trap can be handled by a stub
duke@0 272 address stub = NULL;
duke@0 273
duke@0 274 address pc = NULL;
duke@0 275
duke@0 276 //%note os_trap_1
duke@0 277 if (info != NULL && uc != NULL && thread != NULL) {
duke@0 278 pc = (address) os::Linux::ucontext_get_pc(uc);
duke@0 279
goetz@4965 280 if (StubRoutines::is_safefetch_fault(pc)) {
goetz@4965 281 uc->uc_mcontext.gregs[REG_PC] = intptr_t(StubRoutines::continuation_for_safefetch_fault(pc));
goetz@4965 282 return 1;
duke@0 283 }
duke@0 284
coleenp@4867 285 #ifndef AMD64
coleenp@4867 286 // Halt if SI_KERNEL before more crashes get misdiagnosed as Java bugs
coleenp@4867 287 // This can happen in any running code (currently more frequently in
coleenp@4867 288 // interpreter code but has been seen in compiled code)
coleenp@4867 289 if (sig == SIGSEGV && info->si_addr == 0 && info->si_code == SI_KERNEL) {
coleenp@4867 290 fatal("An irrecoverable SI_KERNEL SIGSEGV has occurred due "
coleenp@4867 291 "to unstable signal handling in this distribution.");
coleenp@4867 292 }
coleenp@4867 293 #endif // AMD64
coleenp@4867 294
duke@0 295 // Handle ALL stack overflow variations here
duke@0 296 if (sig == SIGSEGV) {
duke@0 297 address addr = (address) info->si_addr;
duke@0 298
duke@0 299 // check if fault address is within thread stack
duke@0 300 if (addr < thread->stack_base() &&
duke@0 301 addr >= thread->stack_base() - thread->stack_size()) {
duke@0 302 // stack overflow
duke@0 303 if (thread->in_stack_yellow_zone(addr)) {
duke@0 304 thread->disable_stack_yellow_zone();
duke@0 305 if (thread->thread_state() == _thread_in_Java) {
duke@0 306 // Throw a stack overflow exception. Guard pages will be reenabled
duke@0 307 // while unwinding the stack.
duke@0 308 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::STACK_OVERFLOW);
duke@0 309 } else {
duke@0 310 // Thread was in the vm or native code. Return and try to finish.
duke@0 311 return 1;
duke@0 312 }
duke@0 313 } else if (thread->in_stack_red_zone(addr)) {
duke@0 314 // Fatal red zone violation. Disable the guard pages and fall through
duke@0 315 // to handle_unexpected_exception way down below.
duke@0 316 thread->disable_stack_red_zone();
duke@0 317 tty->print_raw_cr("An irrecoverable stack overflow has occurred.");
iklam@4275 318
iklam@4275 319 // This is a likely cause, but hard to verify. Let's just print
iklam@4275 320 // it as a hint.
iklam@4275 321 tty->print_raw_cr("Please check if any of your loaded .so files has "
iklam@4275 322 "enabled executable stack (see man page execstack(8))");
duke@0 323 } else {
duke@0 324 // Accessing stack address below sp may cause SEGV if current
duke@0 325 // thread has MAP_GROWSDOWN stack. This should only happen when
duke@0 326 // current thread was created by user code with MAP_GROWSDOWN flag
duke@0 327 // and then attached to VM. See notes in os_linux.cpp.
duke@0 328 if (thread->osthread()->expanding_stack() == 0) {
duke@0 329 thread->osthread()->set_expanding_stack();
duke@0 330 if (os::Linux::manually_expand_stack(thread, addr)) {
duke@0 331 thread->osthread()->clear_expanding_stack();
duke@0 332 return 1;
duke@0 333 }
duke@0 334 thread->osthread()->clear_expanding_stack();
duke@0 335 } else {
duke@0 336 fatal("recursive segv. expanding stack.");
duke@0 337 }
duke@0 338 }
duke@0 339 }
duke@0 340 }
duke@0 341
kvn@5953 342 if ((sig == SIGSEGV) && VM_Version::is_cpuinfo_segv_addr(pc)) {
kvn@5953 343 // Verify that OS save/restore AVX registers.
kvn@5953 344 stub = VM_Version::cpuinfo_cont_addr();
kvn@5953 345 }
kvn@5953 346
duke@0 347 if (thread->thread_state() == _thread_in_Java) {
duke@0 348 // Java thread running in Java code => find exception handler if any
duke@0 349 // a fault inside compiled code, the interpreter, or a stub
duke@0 350
duke@0 351 if (sig == SIGSEGV && os::is_poll_address((address)info->si_addr)) {
duke@0 352 stub = SharedRuntime::get_poll_stub(pc);
duke@0 353 } else if (sig == SIGBUS /* && info->si_code == BUS_OBJERR */) {
duke@0 354 // BugId 4454115: A read from a MappedByteBuffer can fault
duke@0 355 // here if the underlying file has been truncated.
duke@0 356 // Do not crash the VM in such a case.
duke@0 357 CodeBlob* cb = CodeCache::find_blob_unsafe(pc);
morris@4328 358 nmethod* nm = (cb != NULL && cb->is_nmethod()) ? (nmethod*)cb : NULL;
duke@0 359 if (nm != NULL && nm->has_unsafe_access()) {
duke@0 360 stub = StubRoutines::handler_for_unsafe_access();
duke@0 361 }
duke@0 362 }
duke@0 363 else
duke@0 364
duke@0 365 #ifdef AMD64
duke@0 366 if (sig == SIGFPE &&
duke@0 367 (info->si_code == FPE_INTDIV || info->si_code == FPE_FLTDIV)) {
duke@0 368 stub =
duke@0 369 SharedRuntime::
duke@0 370 continuation_for_implicit_exception(thread,
duke@0 371 pc,
duke@0 372 SharedRuntime::
duke@0 373 IMPLICIT_DIVIDE_BY_ZERO);
duke@0 374 #else
duke@0 375 if (sig == SIGFPE /* && info->si_code == FPE_INTDIV */) {
duke@0 376 // HACK: si_code does not work on linux 2.2.12-20!!!
duke@0 377 int op = pc[0];
duke@0 378 if (op == 0xDB) {
duke@0 379 // FIST
duke@0 380 // TODO: The encoding of D2I in i486.ad can cause an exception
duke@0 381 // prior to the fist instruction if there was an invalid operation
duke@0 382 // pending. We want to dismiss that exception. From the win_32
duke@0 383 // side it also seems that if it really was the fist causing
duke@0 384 // the exception that we do the d2i by hand with different
duke@0 385 // rounding. Seems kind of weird.
duke@0 386 // NOTE: that we take the exception at the NEXT floating point instruction.
duke@0 387 assert(pc[0] == 0xDB, "not a FIST opcode");
duke@0 388 assert(pc[1] == 0x14, "not a FIST opcode");
duke@0 389 assert(pc[2] == 0x24, "not a FIST opcode");
duke@0 390 return true;
duke@0 391 } else if (op == 0xF7) {
duke@0 392 // IDIV
duke@0 393 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::IMPLICIT_DIVIDE_BY_ZERO);
duke@0 394 } else {
duke@0 395 // TODO: handle more cases if we are using other x86 instructions
duke@0 396 // that can generate SIGFPE signal on linux.
duke@0 397 tty->print_cr("unknown opcode 0x%X with SIGFPE.", op);
duke@0 398 fatal("please update this code.");
duke@0 399 }
duke@0 400 #endif // AMD64
duke@0 401 } else if (sig == SIGSEGV &&
duke@0 402 !MacroAssembler::needs_explicit_null_check((intptr_t)info->si_addr)) {
duke@0 403 // Determination of interpreter/vtable stub/compiled code null exception
duke@0 404 stub = SharedRuntime::continuation_for_implicit_exception(thread, pc, SharedRuntime::IMPLICIT_NULL);
duke@0 405 }
duke@0 406 } else if (thread->thread_state() == _thread_in_vm &&
duke@0 407 sig == SIGBUS && /* info->si_code == BUS_OBJERR && */
duke@0 408 thread->doing_unsafe_access()) {
duke@0 409 stub = StubRoutines::handler_for_unsafe_access();
duke@0 410 }
duke@0 411
duke@0 412 // jni_fast_Get<Primitive>Field can trap at certain pc's if a GC kicks in
duke@0 413 // and the heap gets shrunk before the field access.
duke@0 414 if ((sig == SIGSEGV) || (sig == SIGBUS)) {
duke@0 415 address addr = JNI_FastGetField::find_slowcase_pc(pc);
duke@0 416 if (addr != (address)-1) {
duke@0 417 stub = addr;
duke@0 418 }
duke@0 419 }
duke@0 420
duke@0 421 // Check to see if we caught the safepoint code in the
duke@0 422 // process of write protecting the memory serialization page.
duke@0 423 // It write enables the page immediately after protecting it
duke@0 424 // so we can just return to retry the write.
duke@0 425 if ((sig == SIGSEGV) &&
duke@0 426 os::is_memory_serialize_page(thread, (address) info->si_addr)) {
duke@0 427 // Block current thread until the memory serialize page permission restored.
duke@0 428 os::block_on_serialize_page_trap();
duke@0 429 return true;
duke@0 430 }
duke@0 431 }
duke@0 432
duke@0 433 #ifndef AMD64
duke@0 434 // Execution protection violation
duke@0 435 //
duke@0 436 // This should be kept as the last step in the triage. We don't
duke@0 437 // have a dedicated trap number for a no-execute fault, so be
duke@0 438 // conservative and allow other handlers the first shot.
duke@0 439 //
duke@0 440 // Note: We don't test that info->si_code == SEGV_ACCERR here.
duke@0 441 // this si_code is so generic that it is almost meaningless; and
duke@0 442 // the si_code for this condition may change in the future.
duke@0 443 // Furthermore, a false-positive should be harmless.
duke@0 444 if (UnguardOnExecutionViolation > 0 &&
duke@0 445 (sig == SIGSEGV || sig == SIGBUS) &&
duke@0 446 uc->uc_mcontext.gregs[REG_TRAPNO] == trap_page_fault) {
duke@0 447 int page_size = os::vm_page_size();
duke@0 448 address addr = (address) info->si_addr;
duke@0 449 address pc = os::Linux::ucontext_get_pc(uc);
duke@0 450 // Make sure the pc and the faulting address are sane.
duke@0 451 //
duke@0 452 // If an instruction spans a page boundary, and the page containing
duke@0 453 // the beginning of the instruction is executable but the following
duke@0 454 // page is not, the pc and the faulting address might be slightly
duke@0 455 // different - we still want to unguard the 2nd page in this case.
duke@0 456 //
duke@0 457 // 15 bytes seems to be a (very) safe value for max instruction size.
duke@0 458 bool pc_is_near_addr =
duke@0 459 (pointer_delta((void*) addr, (void*) pc, sizeof(char)) < 15);
duke@0 460 bool instr_spans_page_boundary =
duke@0 461 (align_size_down((intptr_t) pc ^ (intptr_t) addr,
duke@0 462 (intptr_t) page_size) > 0);
duke@0 463
duke@0 464 if (pc == addr || (pc_is_near_addr && instr_spans_page_boundary)) {
duke@0 465 static volatile address last_addr =
duke@0 466 (address) os::non_memory_address_word();
duke@0 467
duke@0 468 // In conservative mode, don't unguard unless the address is in the VM
duke@0 469 if (addr != last_addr &&
duke@0 470 (UnguardOnExecutionViolation > 1 || os::address_is_in_vm(addr))) {
duke@0 471
coleenp@477 472 // Set memory to RWX and retry
duke@0 473 address page_start =
duke@0 474 (address) align_size_down((intptr_t) addr, (intptr_t) page_size);
coleenp@477 475 bool res = os::protect_memory((char*) page_start, page_size,
coleenp@477 476 os::MEM_PROT_RWX);
duke@0 477
duke@0 478 if (PrintMiscellaneous && Verbose) {
duke@0 479 char buf[256];
duke@0 480 jio_snprintf(buf, sizeof(buf), "Execution protection violation "
duke@0 481 "at " INTPTR_FORMAT
duke@0 482 ", unguarding " INTPTR_FORMAT ": %s, errno=%d", addr,
duke@0 483 page_start, (res ? "success" : "failed"), errno);
duke@0 484 tty->print_raw_cr(buf);
duke@0 485 }
duke@0 486 stub = pc;
duke@0 487
duke@0 488 // Set last_addr so if we fault again at the same address, we don't end
duke@0 489 // up in an endless loop.
duke@0 490 //
duke@0 491 // There are two potential complications here. Two threads trapping at
duke@0 492 // the same address at the same time could cause one of the threads to
duke@0 493 // think it already unguarded, and abort the VM. Likely very rare.
duke@0 494 //
duke@0 495 // The other race involves two threads alternately trapping at
duke@0 496 // different addresses and failing to unguard the page, resulting in
duke@0 497 // an endless loop. This condition is probably even more unlikely than
duke@0 498 // the first.
duke@0 499 //
duke@0 500 // Although both cases could be avoided by using locks or thread local
duke@0 501 // last_addr, these solutions are unnecessary complication: this
duke@0 502 // handler is a best-effort safety net, not a complete solution. It is
duke@0 503 // disabled by default and should only be used as a workaround in case
duke@0 504 // we missed any no-execute-unsafe VM code.
duke@0 505
duke@0 506 last_addr = addr;
duke@0 507 }
duke@0 508 }
duke@0 509 }
duke@0 510 #endif // !AMD64
duke@0 511
duke@0 512 if (stub != NULL) {
duke@0 513 // save all thread context in case we need to restore it
duke@0 514 if (thread != NULL) thread->set_saved_exception_pc(pc);
duke@0 515
duke@0 516 uc->uc_mcontext.gregs[REG_PC] = (greg_t)stub;
duke@0 517 return true;
duke@0 518 }
duke@0 519
duke@0 520 // signal-chaining
duke@0 521 if (os::Linux::chained_handler(sig, info, ucVoid)) {
duke@0 522 return true;
duke@0 523 }
duke@0 524
duke@0 525 if (!abort_if_unrecognized) {
duke@0 526 // caller wants another chance, so give it to him
duke@0 527 return false;
duke@0 528 }
duke@0 529
duke@0 530 if (pc == NULL && uc != NULL) {
duke@0 531 pc = os::Linux::ucontext_get_pc(uc);
duke@0 532 }
duke@0 533
duke@0 534 // unmask current signal
duke@0 535 sigset_t newset;
duke@0 536 sigemptyset(&newset);
duke@0 537 sigaddset(&newset, sig);
duke@0 538 sigprocmask(SIG_UNBLOCK, &newset, NULL);
duke@0 539
duke@0 540 VMError err(t, sig, pc, info, ucVoid);
duke@0 541 err.report_and_die();
duke@0 542
duke@0 543 ShouldNotReachHere();
duke@0 544 }
duke@0 545
duke@0 546 void os::Linux::init_thread_fpu_state(void) {
duke@0 547 #ifndef AMD64
duke@0 548 // set fpu to 53 bit precision
duke@0 549 set_fpu_control_word(0x27f);
duke@0 550 #endif // !AMD64
duke@0 551 }
duke@0 552
duke@0 553 int os::Linux::get_fpu_control_word(void) {
duke@0 554 #ifdef AMD64
duke@0 555 return 0;
duke@0 556 #else
duke@0 557 int fpu_control;
duke@0 558 _FPU_GETCW(fpu_control);
duke@0 559 return fpu_control & 0xffff;
duke@0 560 #endif // AMD64
duke@0 561 }
duke@0 562
duke@0 563 void os::Linux::set_fpu_control_word(int fpu_control) {
duke@0 564 #ifndef AMD64
duke@0 565 _FPU_SETCW(fpu_control);
duke@0 566 #endif // !AMD64
duke@0 567 }
duke@0 568
duke@0 569 // Check that the linux kernel version is 2.4 or higher since earlier
duke@0 570 // versions do not support SSE without patches.
duke@0 571 bool os::supports_sse() {
duke@0 572 #ifdef AMD64
duke@0 573 return true;
duke@0 574 #else
duke@0 575 struct utsname uts;
duke@0 576 if( uname(&uts) != 0 ) return false; // uname fails?
duke@0 577 char *minor_string;
duke@0 578 int major = strtol(uts.release,&minor_string,10);
duke@0 579 int minor = strtol(minor_string+1,NULL,10);
duke@0 580 bool result = (major > 2 || (major==2 && minor >= 4));
duke@0 581 #ifndef PRODUCT
duke@0 582 if (PrintMiscellaneous && Verbose) {
duke@0 583 tty->print("OS version is %d.%d, which %s support SSE/SSE2\n",
duke@0 584 major,minor, result ? "DOES" : "does NOT");
duke@0 585 }
duke@0 586 #endif
duke@0 587 return result;
duke@0 588 #endif // AMD64
duke@0 589 }
duke@0 590
duke@0 591 bool os::is_allocatable(size_t bytes) {
duke@0 592 #ifdef AMD64
duke@0 593 // unused on amd64?
duke@0 594 return true;
duke@0 595 #else
duke@0 596
duke@0 597 if (bytes < 2 * G) {
duke@0 598 return true;
duke@0 599 }
duke@0 600
duke@0 601 char* addr = reserve_memory(bytes, NULL);
duke@0 602
duke@0 603 if (addr != NULL) {
duke@0 604 release_memory(addr, bytes);
duke@0 605 }
duke@0 606
duke@0 607 return addr != NULL;
duke@0 608 #endif // AMD64
duke@0 609 }
duke@0 610
duke@0 611 ////////////////////////////////////////////////////////////////////////////////
duke@0 612 // thread stack
duke@0 613
duke@0 614 #ifdef AMD64
duke@0 615 size_t os::Linux::min_stack_allowed = 64 * K;
duke@0 616
duke@0 617 // amd64: pthread on amd64 is always in floating stack mode
duke@0 618 bool os::Linux::supports_variable_stack_size() { return true; }
duke@0 619 #else
duke@0 620 size_t os::Linux::min_stack_allowed = (48 DEBUG_ONLY(+4))*K;
duke@0 621
dcubed@50 622 #ifdef __GNUC__
duke@0 623 #define GET_GS() ({int gs; __asm__ volatile("movw %%gs, %w0":"=q"(gs)); gs&0xffff;})
dcubed@50 624 #endif
duke@0 625
duke@0 626 // Test if pthread library can support variable thread stack size. LinuxThreads
duke@0 627 // in fixed stack mode allocates 2M fixed slot for each thread. LinuxThreads
duke@0 628 // in floating stack mode and NPTL support variable stack size.
duke@0 629 bool os::Linux::supports_variable_stack_size() {
duke@0 630 if (os::Linux::is_NPTL()) {
duke@0 631 // NPTL, yes
duke@0 632 return true;
duke@0 633
duke@0 634 } else {
duke@0 635 // Note: We can't control default stack size when creating a thread.
duke@0 636 // If we use non-default stack size (pthread_attr_setstacksize), both
duke@0 637 // floating stack and non-floating stack LinuxThreads will return the
duke@0 638 // same value. This makes it impossible to implement this function by
duke@0 639 // detecting thread stack size directly.
duke@0 640 //
duke@0 641 // An alternative approach is to check %gs. Fixed-stack LinuxThreads
duke@0 642 // do not use %gs, so its value is 0. Floating-stack LinuxThreads use
duke@0 643 // %gs (either as LDT selector or GDT selector, depending on kernel)
duke@0 644 // to access thread specific data.
duke@0 645 //
duke@0 646 // Note that %gs is a reserved glibc register since early 2001, so
duke@0 647 // applications are not allowed to change its value (Ulrich Drepper from
duke@0 648 // Redhat confirmed that all known offenders have been modified to use
duke@0 649 // either %fs or TSD). In the worst case scenario, when VM is embedded in
duke@0 650 // a native application that plays with %gs, we might see non-zero %gs
duke@0 651 // even LinuxThreads is running in fixed stack mode. As the result, we'll
duke@0 652 // return true and skip _thread_safety_check(), so we may not be able to
duke@0 653 // detect stack-heap collisions. But otherwise it's harmless.
duke@0 654 //
dcubed@50 655 #ifdef __GNUC__
duke@0 656 return (GET_GS() != 0);
dcubed@50 657 #else
dcubed@50 658 return false;
dcubed@50 659 #endif
duke@0 660 }
duke@0 661 }
duke@0 662 #endif // AMD64
duke@0 663
duke@0 664 // return default stack size for thr_type
duke@0 665 size_t os::Linux::default_stack_size(os::ThreadType thr_type) {
duke@0 666 // default stack size (compiler thread needs larger stack)
duke@0 667 #ifdef AMD64
duke@0 668 size_t s = (thr_type == os::compiler_thread ? 4 * M : 1 * M);
duke@0 669 #else
duke@0 670 size_t s = (thr_type == os::compiler_thread ? 2 * M : 512 * K);
duke@0 671 #endif // AMD64
duke@0 672 return s;
duke@0 673 }
duke@0 674
duke@0 675 size_t os::Linux::default_guard_size(os::ThreadType thr_type) {
duke@0 676 // Creating guard page is very expensive. Java thread has HotSpot
duke@0 677 // guard page, only enable glibc guard page for non-Java threads.
duke@0 678 return (thr_type == java_thread ? 0 : page_size());
duke@0 679 }
duke@0 680
duke@0 681 // Java thread:
duke@0 682 //
duke@0 683 // Low memory addresses
duke@0 684 // +------------------------+
duke@0 685 // | |\ JavaThread created by VM does not have glibc
duke@0 686 // | glibc guard page | - guard, attached Java thread usually has
duke@0 687 // | |/ 1 page glibc guard.
duke@0 688 // P1 +------------------------+ Thread::stack_base() - Thread::stack_size()
duke@0 689 // | |\
duke@0 690 // | HotSpot Guard Pages | - red and yellow pages
duke@0 691 // | |/
duke@0 692 // +------------------------+ JavaThread::stack_yellow_zone_base()
duke@0 693 // | |\
duke@0 694 // | Normal Stack | -
duke@0 695 // | |/
duke@0 696 // P2 +------------------------+ Thread::stack_base()
duke@0 697 //
duke@0 698 // Non-Java thread:
duke@0 699 //
duke@0 700 // Low memory addresses
duke@0 701 // +------------------------+
duke@0 702 // | |\
duke@0 703 // | glibc guard page | - usually 1 page
duke@0 704 // | |/
duke@0 705 // P1 +------------------------+ Thread::stack_base() - Thread::stack_size()
duke@0 706 // | |\
duke@0 707 // | Normal Stack | -
duke@0 708 // | |/
duke@0 709 // P2 +------------------------+ Thread::stack_base()
duke@0 710 //
duke@0 711 // ** P1 (aka bottom) and size ( P2 = P1 - size) are the address and stack size returned from
duke@0 712 // pthread_attr_getstack()
duke@0 713
duke@0 714 static void current_stack_region(address * bottom, size_t * size) {
dbuck@8815 715 if (os::is_primordial_thread()) {
dbuck@8815 716 // primordial thread needs special handling because pthread_getattr_np()
duke@0 717 // may return bogus value.
duke@0 718 *bottom = os::Linux::initial_thread_stack_bottom();
duke@0 719 *size = os::Linux::initial_thread_stack_size();
duke@0 720 } else {
duke@0 721 pthread_attr_t attr;
duke@0 722
duke@0 723 int rslt = pthread_getattr_np(pthread_self(), &attr);
duke@0 724
duke@0 725 // JVM needs to know exact stack location, abort if it fails
duke@0 726 if (rslt != 0) {
duke@0 727 if (rslt == ENOMEM) {
ccheung@4558 728 vm_exit_out_of_memory(0, OOM_MMAP_ERROR, "pthread_getattr_np");
duke@0 729 } else {
jcoomes@1410 730 fatal(err_msg("pthread_getattr_np failed with errno = %d", rslt));
duke@0 731 }
duke@0 732 }
duke@0 733
duke@0 734 if (pthread_attr_getstack(&attr, (void **)bottom, size) != 0) {
duke@0 735 fatal("Can not locate current stack attributes!");
duke@0 736 }
duke@0 737
duke@0 738 pthread_attr_destroy(&attr);
duke@0 739
duke@0 740 }
duke@0 741 assert(os::current_stack_pointer() >= *bottom &&
duke@0 742 os::current_stack_pointer() < *bottom + *size, "just checking");
duke@0 743 }
duke@0 744
duke@0 745 address os::current_stack_base() {
duke@0 746 address bottom;
duke@0 747 size_t size;
duke@0 748 current_stack_region(&bottom, &size);
duke@0 749 return (bottom + size);
duke@0 750 }
duke@0 751
duke@0 752 size_t os::current_stack_size() {
duke@0 753 // stack size includes normal stack and HotSpot guard pages
duke@0 754 address bottom;
duke@0 755 size_t size;
duke@0 756 current_stack_region(&bottom, &size);
duke@0 757 return size;
duke@0 758 }
duke@0 759
duke@0 760 /////////////////////////////////////////////////////////////////////////////
duke@0 761 // helper functions for fatal error handler
duke@0 762
duke@0 763 void os::print_context(outputStream *st, void *context) {
duke@0 764 if (context == NULL) return;
duke@0 765
duke@0 766 ucontext_t *uc = (ucontext_t*)context;
duke@0 767 st->print_cr("Registers:");
duke@0 768 #ifdef AMD64
duke@0 769 st->print( "RAX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RAX]);
duke@0 770 st->print(", RBX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RBX]);
duke@0 771 st->print(", RCX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RCX]);
duke@0 772 st->print(", RDX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RDX]);
duke@0 773 st->cr();
duke@0 774 st->print( "RSP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RSP]);
duke@0 775 st->print(", RBP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RBP]);
duke@0 776 st->print(", RSI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RSI]);
duke@0 777 st->print(", RDI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RDI]);
duke@0 778 st->cr();
duke@0 779 st->print( "R8 =" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R8]);
duke@0 780 st->print(", R9 =" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R9]);
duke@0 781 st->print(", R10=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R10]);
duke@0 782 st->print(", R11=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R11]);
duke@0 783 st->cr();
duke@0 784 st->print( "R12=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R12]);
duke@0 785 st->print(", R13=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R13]);
duke@0 786 st->print(", R14=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R14]);
duke@0 787 st->print(", R15=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_R15]);
duke@0 788 st->cr();
duke@0 789 st->print( "RIP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_RIP]);
never@1827 790 st->print(", EFLAGS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EFL]);
duke@0 791 st->print(", CSGSFS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_CSGSFS]);
duke@0 792 st->print(", ERR=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ERR]);
duke@0 793 st->cr();
duke@0 794 st->print(" TRAPNO=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_TRAPNO]);
duke@0 795 #else
duke@0 796 st->print( "EAX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EAX]);
duke@0 797 st->print(", EBX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EBX]);
duke@0 798 st->print(", ECX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ECX]);
duke@0 799 st->print(", EDX=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EDX]);
duke@0 800 st->cr();
duke@0 801 st->print( "ESP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_UESP]);
duke@0 802 st->print(", EBP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EBP]);
duke@0 803 st->print(", ESI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_ESI]);
duke@0 804 st->print(", EDI=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EDI]);
duke@0 805 st->cr();
duke@0 806 st->print( "EIP=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EIP]);
never@1827 807 st->print(", EFLAGS=" INTPTR_FORMAT, uc->uc_mcontext.gregs[REG_EFL]);
duke@0 808 st->print(", CR2=" INTPTR_FORMAT, uc->uc_mcontext.cr2);
duke@0 809 #endif // AMD64
duke@0 810 st->cr();
duke@0 811 st->cr();
duke@0 812
duke@0 813 intptr_t *sp = (intptr_t *)os::Linux::ucontext_get_sp(uc);
duke@0 814 st->print_cr("Top of Stack: (sp=" PTR_FORMAT ")", sp);
duke@0 815 print_hex_dump(st, (address)sp, (address)(sp + 8*sizeof(intptr_t)), sizeof(intptr_t));
duke@0 816 st->cr();
duke@0 817
duke@0 818 // Note: it may be unsafe to inspect memory near pc. For example, pc may
duke@0 819 // point to garbage if entry point in an nmethod is corrupted. Leave
duke@0 820 // this at the end, and hope for the best.
duke@0 821 address pc = os::Linux::ucontext_get_pc(uc);
duke@0 822 st->print_cr("Instructions: (pc=" PTR_FORMAT ")", pc);
never@1827 823 print_hex_dump(st, pc - 32, pc + 32, sizeof(char));
never@1827 824 }
never@1827 825
never@1827 826 void os::print_register_info(outputStream *st, void *context) {
never@1827 827 if (context == NULL) return;
never@1827 828
never@1827 829 ucontext_t *uc = (ucontext_t*)context;
never@1827 830
never@1827 831 st->print_cr("Register to memory mapping:");
never@1827 832 st->cr();
never@1827 833
never@1827 834 // this is horrendously verbose but the layout of the registers in the
never@1827 835 // context does not match how we defined our abstract Register set, so
never@1827 836 // we can't just iterate through the gregs area
never@1827 837
never@1827 838 // this is only for the "general purpose" registers
never@1827 839
never@1827 840 #ifdef AMD64
never@1827 841 st->print("RAX="); print_location(st, uc->uc_mcontext.gregs[REG_RAX]);
never@1827 842 st->print("RBX="); print_location(st, uc->uc_mcontext.gregs[REG_RBX]);
never@1827 843 st->print("RCX="); print_location(st, uc->uc_mcontext.gregs[REG_RCX]);
never@1827 844 st->print("RDX="); print_location(st, uc->uc_mcontext.gregs[REG_RDX]);
never@1827 845 st->print("RSP="); print_location(st, uc->uc_mcontext.gregs[REG_RSP]);
never@1827 846 st->print("RBP="); print_location(st, uc->uc_mcontext.gregs[REG_RBP]);
never@1827 847 st->print("RSI="); print_location(st, uc->uc_mcontext.gregs[REG_RSI]);
never@1827 848 st->print("RDI="); print_location(st, uc->uc_mcontext.gregs[REG_RDI]);
never@1827 849 st->print("R8 ="); print_location(st, uc->uc_mcontext.gregs[REG_R8]);
never@1827 850 st->print("R9 ="); print_location(st, uc->uc_mcontext.gregs[REG_R9]);
never@1827 851 st->print("R10="); print_location(st, uc->uc_mcontext.gregs[REG_R10]);
never@1827 852 st->print("R11="); print_location(st, uc->uc_mcontext.gregs[REG_R11]);
never@1827 853 st->print("R12="); print_location(st, uc->uc_mcontext.gregs[REG_R12]);
never@1827 854 st->print("R13="); print_location(st, uc->uc_mcontext.gregs[REG_R13]);
never@1827 855 st->print("R14="); print_location(st, uc->uc_mcontext.gregs[REG_R14]);
never@1827 856 st->print("R15="); print_location(st, uc->uc_mcontext.gregs[REG_R15]);
never@1827 857 #else
never@1827 858 st->print("EAX="); print_location(st, uc->uc_mcontext.gregs[REG_EAX]);
never@1827 859 st->print("EBX="); print_location(st, uc->uc_mcontext.gregs[REG_EBX]);
never@1827 860 st->print("ECX="); print_location(st, uc->uc_mcontext.gregs[REG_ECX]);
never@1827 861 st->print("EDX="); print_location(st, uc->uc_mcontext.gregs[REG_EDX]);
never@1827 862 st->print("ESP="); print_location(st, uc->uc_mcontext.gregs[REG_ESP]);
never@1827 863 st->print("EBP="); print_location(st, uc->uc_mcontext.gregs[REG_EBP]);
never@1827 864 st->print("ESI="); print_location(st, uc->uc_mcontext.gregs[REG_ESI]);
never@1827 865 st->print("EDI="); print_location(st, uc->uc_mcontext.gregs[REG_EDI]);
never@1827 866 #endif // AMD64
never@1827 867
never@1827 868 st->cr();
duke@0 869 }
duke@0 870
duke@0 871 void os::setup_fpu() {
duke@0 872 #ifndef AMD64
duke@0 873 address fpu_cntrl = StubRoutines::addr_fpu_cntrl_wrd_std();
duke@0 874 __asm__ volatile ( "fldcw (%0)" :
duke@0 875 : "r" (fpu_cntrl) : "memory");
duke@0 876 #endif // !AMD64
duke@0 877 }
roland@3171 878
roland@3171 879 #ifndef PRODUCT
roland@3171 880 void os::verify_stack_alignment() {
roland@3171 881 #ifdef AMD64
roland@3171 882 assert(((intptr_t)os::current_stack_pointer() & (StackAlignmentInBytes-1)) == 0, "incorrect stack alignment");
roland@3171 883 #endif
roland@3171 884 }
roland@3171 885 #endif
dsimms@5346 886
dsimms@5346 887
dsimms@5346 888 /*
dsimms@5346 889 * IA32 only: execute code at a high address in case buggy NX emulation is present. I.e. avoid CS limit
dsimms@5346 890 * updates (JDK-8023956).
dsimms@5346 891 */
dsimms@5346 892 void os::workaround_expand_exec_shield_cs_limit() {
dsimms@5346 893 #if defined(IA32)
dsimms@5346 894 size_t page_size = os::vm_page_size();
aph@9029 895
aph@9029 896 /*
aph@9029 897 * JDK-8197429
aph@9029 898 *
aph@9029 899 * Expand the stack mapping to the end of the initial stack before
aph@9029 900 * attempting to install the codebuf. This is needed because newer
aph@9029 901 * Linux kernels impose a distance of a megabyte between stack
aph@9029 902 * memory and other memory regions. If we try to install the
aph@9029 903 * codebuf before expanding the stack the installation will appear
aph@9029 904 * to succeed but we'll get a segfault later if we expand the stack
aph@9029 905 * in Java code.
aph@9029 906 *
aph@9029 907 */
aph@9029 908 if (os::is_primordial_thread()) {
aph@9029 909 address limit = Linux::initial_thread_stack_bottom();
aph@9029 910 if (! DisablePrimordialThreadGuardPages) {
aph@9029 911 limit += (StackYellowPages + StackRedPages) * page_size;
aph@9029 912 }
aph@9029 913 os::Linux::expand_stack_to(limit);
aph@9029 914 }
aph@9029 915
dsimms@5346 916 /*
dsimms@5346 917 * Take the highest VA the OS will give us and exec
dsimms@5346 918 *
dsimms@5346 919 * Although using -(pagesz) as mmap hint works on newer kernel as you would
dsimms@5346 920 * think, older variants affected by this work-around don't (search forward only).
dsimms@5346 921 *
dsimms@5346 922 * On the affected distributions, we understand the memory layout to be:
dsimms@5346 923 *
dsimms@5346 924 * TASK_LIMIT= 3G, main stack base close to TASK_LIMT.
dsimms@5346 925 *
dsimms@5346 926 * A few pages south main stack will do it.
dsimms@5346 927 *
dsimms@5346 928 * If we are embedded in an app other than launcher (initial != main stack),
dsimms@5346 929 * we don't have much control or understanding of the address space, just let it slide.
dsimms@5346 930 */
dsimms@5346 931 char* hint = (char*) (Linux::initial_thread_stack_bottom() -
dsimms@5346 932 ((StackYellowPages + StackRedPages + 1) * page_size));
dbuck@6871 933 char* codebuf = os::attempt_reserve_memory_at(page_size, hint);
aph@9029 934
aph@9029 935 if (codebuf == NULL) {
aph@9029 936 // JDK-8197429: There may be a stack gap of one megabyte between
aph@9029 937 // the limit of the stack and the nearest memory region: this is a
aph@9029 938 // Linux kernel workaround for CVE-2017-1000364. If we failed to
aph@9029 939 // map our codebuf, try again at an address one megabyte lower.
aph@9029 940 hint -= 1 * M;
aph@9029 941 codebuf = os::attempt_reserve_memory_at(page_size, hint);
aph@9029 942 }
aph@9029 943
dsimms@5346 944 if ( (codebuf == NULL) || (!os::commit_memory(codebuf, page_size, true)) ) {
dsimms@5346 945 return; // No matter, we tried, best effort.
dsimms@5346 946 }
dsimms@5346 947 if (PrintMiscellaneous && (Verbose || WizardMode)) {
dsimms@5346 948 tty->print_cr("[CS limit NX emulation work-around, exec code at: %p]", codebuf);
dsimms@5346 949 }
dsimms@5346 950
dsimms@5346 951 // Some code to exec: the 'ret' instruction
dsimms@5346 952 codebuf[0] = 0xC3;
dsimms@5346 953
dsimms@5346 954 // Call the code in the codebuf
dsimms@5346 955 __asm__ volatile("call *%0" : : "r"(codebuf));
dsimms@5346 956
dsimms@5346 957 // keep the page mapped so CS limit isn't reduced.
dsimms@5346 958 #endif
dsimms@5346 959 }