1 /*
2  * Copyright (C) 2011 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "jni_env_ext.h"
18 
19 #include <algorithm>
20 #include <vector>
21 
22 #include "android-base/stringprintf.h"
23 
24 #include "base/mutex.h"
25 #include "base/to_str.h"
26 #include "check_jni.h"
27 #include "hidden_api.h"
28 #include "indirect_reference_table.h"
29 #include "java_vm_ext.h"
30 #include "jni_internal.h"
31 #include "lock_word.h"
32 #include "mirror/object-inl.h"
33 #include "nth_caller_visitor.h"
34 #include "scoped_thread_state_change.h"
35 #include "thread-current-inl.h"
36 #include "thread_list.h"
37 
38 namespace art {
39 
40 using android::base::StringPrintf;
41 
42 static constexpr size_t kMonitorsInitial = 32;  // Arbitrary.
43 static constexpr size_t kMonitorsMax = 4096;  // Arbitrary sanity check.
44 
45 const JNINativeInterface* JNIEnvExt::table_override_ = nullptr;
46 
CheckLocalsValid(JNIEnvExt * in)47 bool JNIEnvExt::CheckLocalsValid(JNIEnvExt* in) NO_THREAD_SAFETY_ANALYSIS {
48   if (in == nullptr) {
49     return false;
50   }
51   return in->locals_.IsValid();
52 }
53 
GetEnvHandler(JavaVMExt * vm,void ** env,jint version)54 jint JNIEnvExt::GetEnvHandler(JavaVMExt* vm, /*out*/void** env, jint version) {
55   UNUSED(vm);
56   // GetEnv always returns a JNIEnv* for the most current supported JNI version,
57   // and unlike other calls that take a JNI version doesn't care if you supply
58   // JNI_VERSION_1_1, which we don't otherwise support.
59   if (JavaVMExt::IsBadJniVersion(version) && version != JNI_VERSION_1_1) {
60     return JNI_EVERSION;
61   }
62   Thread* thread = Thread::Current();
63   CHECK(thread != nullptr);
64   *env = thread->GetJniEnv();
65   return JNI_OK;
66 }
67 
Create(Thread * self_in,JavaVMExt * vm_in,std::string * error_msg)68 JNIEnvExt* JNIEnvExt::Create(Thread* self_in, JavaVMExt* vm_in, std::string* error_msg) {
69   std::unique_ptr<JNIEnvExt> ret(new JNIEnvExt(self_in, vm_in, error_msg));
70   if (CheckLocalsValid(ret.get())) {
71     return ret.release();
72   }
73   return nullptr;
74 }
75 
JNIEnvExt(Thread * self_in,JavaVMExt * vm_in,std::string * error_msg)76 JNIEnvExt::JNIEnvExt(Thread* self_in, JavaVMExt* vm_in, std::string* error_msg)
77     : self_(self_in),
78       vm_(vm_in),
79       local_ref_cookie_(kIRTFirstSegment),
80       locals_(kLocalsInitial, kLocal, IndirectReferenceTable::ResizableCapacity::kYes, error_msg),
81       monitors_("monitors", kMonitorsInitial, kMonitorsMax),
82       critical_(0),
83       check_jni_(false),
84       runtime_deleted_(false) {
85   MutexLock mu(Thread::Current(), *Locks::jni_function_table_lock_);
86   check_jni_ = vm_in->IsCheckJniEnabled();
87   functions = GetFunctionTable(check_jni_);
88   unchecked_functions_ = GetJniNativeInterface();
89 }
90 
SetFunctionsToRuntimeShutdownFunctions()91 void JNIEnvExt::SetFunctionsToRuntimeShutdownFunctions() {
92   functions = GetRuntimeShutdownNativeInterface();
93 }
94 
~JNIEnvExt()95 JNIEnvExt::~JNIEnvExt() {
96 }
97 
NewLocalRef(mirror::Object * obj)98 jobject JNIEnvExt::NewLocalRef(mirror::Object* obj) {
99   if (obj == nullptr) {
100     return nullptr;
101   }
102   std::string error_msg;
103   jobject ref = reinterpret_cast<jobject>(locals_.Add(local_ref_cookie_, obj, &error_msg));
104   if (UNLIKELY(ref == nullptr)) {
105     // This is really unexpected if we allow resizing local IRTs...
106     LOG(FATAL) << error_msg;
107     UNREACHABLE();
108   }
109   return ref;
110 }
111 
DeleteLocalRef(jobject obj)112 void JNIEnvExt::DeleteLocalRef(jobject obj) {
113   if (obj != nullptr) {
114     locals_.Remove(local_ref_cookie_, reinterpret_cast<IndirectRef>(obj));
115   }
116 }
117 
SetCheckJniEnabled(bool enabled)118 void JNIEnvExt::SetCheckJniEnabled(bool enabled) {
119   check_jni_ = enabled;
120   MutexLock mu(Thread::Current(), *Locks::jni_function_table_lock_);
121   functions = GetFunctionTable(enabled);
122   // Check whether this is a no-op because of override.
123   if (enabled && JNIEnvExt::table_override_ != nullptr) {
124     LOG(WARNING) << "Enabling CheckJNI after a JNIEnv function table override is not functional.";
125   }
126 }
127 
DumpReferenceTables(std::ostream & os)128 void JNIEnvExt::DumpReferenceTables(std::ostream& os) {
129   locals_.Dump(os);
130   monitors_.Dump(os);
131 }
132 
PushFrame(int capacity)133 void JNIEnvExt::PushFrame(int capacity) {
134   DCHECK_GE(locals_.FreeCapacity(), static_cast<size_t>(capacity));
135   stacked_local_ref_cookies_.push_back(local_ref_cookie_);
136   local_ref_cookie_ = locals_.GetSegmentState();
137 }
138 
PopFrame()139 void JNIEnvExt::PopFrame() {
140   locals_.SetSegmentState(local_ref_cookie_);
141   local_ref_cookie_ = stacked_local_ref_cookies_.back();
142   stacked_local_ref_cookies_.pop_back();
143 }
144 
145 // Note: the offset code is brittle, as we can't use OFFSETOF_MEMBER or offsetof easily. Thus, there
146 //       are tests in jni_internal_test to match the results against the actual values.
147 
148 // This is encoding the knowledge of the structure and layout of JNIEnv fields.
JNIEnvSize(size_t pointer_size)149 static size_t JNIEnvSize(size_t pointer_size) {
150   // A single pointer.
151   return pointer_size;
152 }
153 
SegmentStateOffset(size_t pointer_size)154 Offset JNIEnvExt::SegmentStateOffset(size_t pointer_size) {
155   size_t locals_offset = JNIEnvSize(pointer_size) +
156                          2 * pointer_size +          // Thread* self + JavaVMExt* vm.
157                          4 +                         // local_ref_cookie.
158                          (pointer_size - 4);         // Padding.
159   size_t irt_segment_state_offset =
160       IndirectReferenceTable::SegmentStateOffset(pointer_size).Int32Value();
161   return Offset(locals_offset + irt_segment_state_offset);
162 }
163 
LocalRefCookieOffset(size_t pointer_size)164 Offset JNIEnvExt::LocalRefCookieOffset(size_t pointer_size) {
165   return Offset(JNIEnvSize(pointer_size) +
166                 2 * pointer_size);          // Thread* self + JavaVMExt* vm
167 }
168 
SelfOffset(size_t pointer_size)169 Offset JNIEnvExt::SelfOffset(size_t pointer_size) {
170   return Offset(JNIEnvSize(pointer_size));
171 }
172 
173 // Use some defining part of the caller's frame as the identifying mark for the JNI segment.
GetJavaCallFrame(Thread * self)174 static uintptr_t GetJavaCallFrame(Thread* self) REQUIRES_SHARED(Locks::mutator_lock_) {
175   NthCallerVisitor zeroth_caller(self, 0, false);
176   zeroth_caller.WalkStack();
177   if (zeroth_caller.caller == nullptr) {
178     // No Java code, must be from pure native code.
179     return 0;
180   } else if (zeroth_caller.GetCurrentQuickFrame() == nullptr) {
181     // Shadow frame = interpreter. Use the actual shadow frame's address.
182     DCHECK(zeroth_caller.GetCurrentShadowFrame() != nullptr);
183     return reinterpret_cast<uintptr_t>(zeroth_caller.GetCurrentShadowFrame());
184   } else {
185     // Quick frame = compiled code. Use the bottom of the frame.
186     return reinterpret_cast<uintptr_t>(zeroth_caller.GetCurrentQuickFrame());
187   }
188 }
189 
RecordMonitorEnter(jobject obj)190 void JNIEnvExt::RecordMonitorEnter(jobject obj) {
191   locked_objects_.push_back(std::make_pair(GetJavaCallFrame(self_), obj));
192 }
193 
ComputeMonitorDescription(Thread * self,jobject obj)194 static std::string ComputeMonitorDescription(Thread* self,
195                                              jobject obj) REQUIRES_SHARED(Locks::mutator_lock_) {
196   ObjPtr<mirror::Object> o = self->DecodeJObject(obj);
197   if ((o->GetLockWord(false).GetState() == LockWord::kThinLocked) &&
198       Locks::mutator_lock_->IsExclusiveHeld(self)) {
199     // Getting the identity hashcode here would result in lock inflation and suspension of the
200     // current thread, which isn't safe if this is the only runnable thread.
201     return StringPrintf("<@addr=0x%" PRIxPTR "> (a %s)",
202                         reinterpret_cast<intptr_t>(o.Ptr()),
203                         o->PrettyTypeOf().c_str());
204   } else {
205     // IdentityHashCode can cause thread suspension, which would invalidate o if it moved. So
206     // we get the pretty type before we call IdentityHashCode.
207     const std::string pretty_type(o->PrettyTypeOf());
208     return StringPrintf("<0x%08x> (a %s)", o->IdentityHashCode(), pretty_type.c_str());
209   }
210 }
211 
RemoveMonitors(Thread * self,uintptr_t frame,ReferenceTable * monitors,std::vector<std::pair<uintptr_t,jobject>> * locked_objects)212 static void RemoveMonitors(Thread* self,
213                            uintptr_t frame,
214                            ReferenceTable* monitors,
215                            std::vector<std::pair<uintptr_t, jobject>>* locked_objects)
216     REQUIRES_SHARED(Locks::mutator_lock_) {
217   auto kept_end = std::remove_if(
218       locked_objects->begin(),
219       locked_objects->end(),
220       [self, frame, monitors](const std::pair<uintptr_t, jobject>& pair)
221           REQUIRES_SHARED(Locks::mutator_lock_) {
222         if (frame == pair.first) {
223           ObjPtr<mirror::Object> o = self->DecodeJObject(pair.second);
224           monitors->Remove(o);
225           return true;
226         }
227         return false;
228       });
229   locked_objects->erase(kept_end, locked_objects->end());
230 }
231 
CheckMonitorRelease(jobject obj)232 void JNIEnvExt::CheckMonitorRelease(jobject obj) {
233   uintptr_t current_frame = GetJavaCallFrame(self_);
234   std::pair<uintptr_t, jobject> exact_pair = std::make_pair(current_frame, obj);
235   auto it = std::find(locked_objects_.begin(), locked_objects_.end(), exact_pair);
236   bool will_abort = false;
237   if (it != locked_objects_.end()) {
238     locked_objects_.erase(it);
239   } else {
240     // Check whether this monitor was locked in another JNI "session."
241     ObjPtr<mirror::Object> mirror_obj = self_->DecodeJObject(obj);
242     for (std::pair<uintptr_t, jobject>& pair : locked_objects_) {
243       if (self_->DecodeJObject(pair.second) == mirror_obj) {
244         std::string monitor_descr = ComputeMonitorDescription(self_, pair.second);
245         vm_->JniAbortF("<JNI MonitorExit>",
246                       "Unlocking monitor that wasn't locked here: %s",
247                       monitor_descr.c_str());
248         will_abort = true;
249         break;
250       }
251     }
252   }
253 
254   // When we abort, also make sure that any locks from the current "session" are removed from
255   // the monitors table, otherwise we may visit local objects in GC during abort (which won't be
256   // valid anymore).
257   if (will_abort) {
258     RemoveMonitors(self_, current_frame, &monitors_, &locked_objects_);
259   }
260 }
261 
CheckNoHeldMonitors()262 void JNIEnvExt::CheckNoHeldMonitors() {
263   // The locked_objects_ are grouped by their stack frame component, as this enforces structured
264   // locking, and the groups form a stack. So the current frame entries are at the end. Check
265   // whether the vector is empty, and when there are elements, whether the last element belongs
266   // to this call - this signals that there are unlocked monitors.
267   if (!locked_objects_.empty()) {
268     uintptr_t current_frame = GetJavaCallFrame(self_);
269     std::pair<uintptr_t, jobject>& pair = locked_objects_[locked_objects_.size() - 1];
270     if (pair.first == current_frame) {
271       std::string monitor_descr = ComputeMonitorDescription(self_, pair.second);
272       vm_->JniAbortF("<JNI End>",
273                     "Still holding a locked object on JNI end: %s",
274                     monitor_descr.c_str());
275       // When we abort, also make sure that any locks from the current "session" are removed from
276       // the monitors table, otherwise we may visit local objects in GC during abort.
277       RemoveMonitors(self_, current_frame, &monitors_, &locked_objects_);
278     } else if (kIsDebugBuild) {
279       // Make sure there are really no other entries and our checking worked as expected.
280       for (std::pair<uintptr_t, jobject>& check_pair : locked_objects_) {
281         CHECK_NE(check_pair.first, current_frame);
282       }
283     }
284   }
285   // Ensure critical locks aren't held when returning to Java.
286   if (critical_ > 0) {
287     vm_->JniAbortF("<JNI End>",
288                   "Critical lock held when returning to Java on thread %s",
289                   ToStr<Thread>(*self_).c_str());
290   }
291 }
292 
ThreadResetFunctionTable(Thread * thread,void * arg ATTRIBUTE_UNUSED)293 void ThreadResetFunctionTable(Thread* thread, void* arg ATTRIBUTE_UNUSED)
294     REQUIRES(Locks::jni_function_table_lock_) {
295   JNIEnvExt* env = thread->GetJniEnv();
296   bool check_jni = env->IsCheckJniEnabled();
297   env->functions = JNIEnvExt::GetFunctionTable(check_jni);
298   env->unchecked_functions_ = GetJniNativeInterface();
299 }
300 
SetTableOverride(const JNINativeInterface * table_override)301 void JNIEnvExt::SetTableOverride(const JNINativeInterface* table_override) {
302   MutexLock mu(Thread::Current(), *Locks::thread_list_lock_);
303   MutexLock mu2(Thread::Current(), *Locks::jni_function_table_lock_);
304 
305   JNIEnvExt::table_override_ = table_override;
306 
307   // See if we have a runtime. Note: we cannot run other code (like JavaVMExt's CheckJNI install
308   // code), as we'd have to recursively lock the mutex.
309   Runtime* runtime = Runtime::Current();
310   if (runtime != nullptr) {
311     runtime->GetThreadList()->ForEach(ThreadResetFunctionTable, nullptr);
312     // Core Platform API checks rely on stack walking and classifying the caller. If a table
313     // override is installed do not try to guess what semantics should be.
314     runtime->SetCorePlatformApiEnforcementPolicy(hiddenapi::EnforcementPolicy::kDisabled);
315   }
316 }
317 
GetFunctionTable(bool check_jni)318 const JNINativeInterface* JNIEnvExt::GetFunctionTable(bool check_jni) {
319   const JNINativeInterface* override = JNIEnvExt::table_override_;
320   if (override != nullptr) {
321     return override;
322   }
323   return check_jni ? GetCheckJniNativeInterface() : GetJniNativeInterface();
324 }
325 
ResetFunctionTable()326 void JNIEnvExt::ResetFunctionTable() {
327   MutexLock mu(Thread::Current(), *Locks::thread_list_lock_);
328   MutexLock mu2(Thread::Current(), *Locks::jni_function_table_lock_);
329   Runtime* runtime = Runtime::Current();
330   CHECK(runtime != nullptr);
331   runtime->GetThreadList()->ForEach(ThreadResetFunctionTable, nullptr);
332 }
333 
334 }  // namespace art
335