1 /*
2  * Copyright (C) 2009 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef ART_RUNTIME_INDIRECT_REFERENCE_TABLE_H_
18 #define ART_RUNTIME_INDIRECT_REFERENCE_TABLE_H_
19 
20 #include <stdint.h>
21 
22 #include <iosfwd>
23 #include <limits>
24 #include <string>
25 
26 #include "base/bit_utils.h"
27 #include "base/logging.h"
28 #include "base/mutex.h"
29 #include "gc_root.h"
30 #include "obj_ptr.h"
31 #include "object_callbacks.h"
32 #include "offsets.h"
33 #include "read_barrier_option.h"
34 
35 namespace art {
36 
37 class RootInfo;
38 
39 namespace mirror {
40 class Object;
41 }  // namespace mirror
42 
43 class MemMap;
44 
45 // Maintain a table of indirect references.  Used for local/global JNI references.
46 //
47 // The table contains object references, where the strong (local/global) references are part of the
48 // GC root set (but not the weak global references). When an object is added we return an
49 // IndirectRef that is not a valid pointer but can be used to find the original value in O(1) time.
50 // Conversions to and from indirect references are performed on upcalls and downcalls, so they need
51 // to be very fast.
52 //
53 // To be efficient for JNI local variable storage, we need to provide operations that allow us to
54 // operate on segments of the table, where segments are pushed and popped as if on a stack. For
55 // example, deletion of an entry should only succeed if it appears in the current segment, and we
56 // want to be able to strip off the current segment quickly when a method returns. Additions to the
57 // table must be made in the current segment even if space is available in an earlier area.
58 //
59 // A new segment is created when we call into native code from interpreted code, or when we handle
60 // the JNI PushLocalFrame function.
61 //
62 // The GC must be able to scan the entire table quickly.
63 //
64 // In summary, these must be very fast:
65 //  - adding or removing a segment
66 //  - adding references to a new segment
67 //  - converting an indirect reference back to an Object
68 // These can be a little slower, but must still be pretty quick:
69 //  - adding references to a "mature" segment
70 //  - removing individual references
71 //  - scanning the entire table straight through
72 //
73 // If there's more than one segment, we don't guarantee that the table will fill completely before
74 // we fail due to lack of space. We do ensure that the current segment will pack tightly, which
75 // should satisfy JNI requirements (e.g. EnsureLocalCapacity).
76 //
77 // Only SynchronizedGet is synchronized.
78 
79 // Indirect reference definition.  This must be interchangeable with JNI's jobject, and it's
80 // convenient to let null be null, so we use void*.
81 //
82 // We need a (potentially) large table index and a 2-bit reference type (global, local, weak
83 // global). We also reserve some bits to be used to detect stale indirect references: we put a
84 // serial number in the extra bits, and keep a copy of the serial number in the table. This requires
85 // more memory and additional memory accesses on add/get, but is moving-GC safe. It will catch
86 // additional problems, e.g.: create iref1 for obj, delete iref1, create iref2 for same obj,
87 // lookup iref1. A pattern based on object bits will miss this.
88 typedef void* IndirectRef;
89 
90 // Indirect reference kind, used as the two low bits of IndirectRef.
91 //
92 // For convenience these match up with enum jobjectRefType from jni.h.
93 enum IndirectRefKind {
94   kHandleScopeOrInvalid = 0,           // <<stack indirect reference table or invalid reference>>
95   kLocal                = 1,           // <<local reference>>
96   kGlobal               = 2,           // <<global reference>>
97   kWeakGlobal           = 3,           // <<weak global reference>>
98   kLastKind             = kWeakGlobal
99 };
100 std::ostream& operator<<(std::ostream& os, const IndirectRefKind& rhs);
101 const char* GetIndirectRefKindString(const IndirectRefKind& kind);
102 
103 // Table definition.
104 //
105 // For the global reference table, the expected common operations are adding a new entry and
106 // removing a recently-added entry (usually the most-recently-added entry).  For JNI local
107 // references, the common operations are adding a new entry and removing an entire table segment.
108 //
109 // If we delete entries from the middle of the list, we will be left with "holes".  We track the
110 // number of holes so that, when adding new elements, we can quickly decide to do a trivial append
111 // or go slot-hunting.
112 //
113 // When the top-most entry is removed, any holes immediately below it are also removed. Thus,
114 // deletion of an entry may reduce "top_index" by more than one.
115 //
116 // To get the desired behavior for JNI locals, we need to know the bottom and top of the current
117 // "segment". The top is managed internally, and the bottom is passed in as a function argument.
118 // When we call a native method or push a local frame, the current top index gets pushed on, and
119 // serves as the new bottom. When we pop a frame off, the value from the stack becomes the new top
120 // index, and the value stored in the previous frame becomes the new bottom.
121 //
122 // Holes are being locally cached for the segment. Otherwise we'd have to pass bottom index and
123 // number of holes, which restricts us to 16 bits for the top index. The value is cached within the
124 // table. To avoid code in generated JNI transitions, which implicitly form segments, the code for
125 // adding and removing references needs to detect the change of a segment. Helper fields are used
126 // for this detection.
127 //
128 // Common alternative implementation: make IndirectRef a pointer to the actual reference slot.
129 // Instead of getting a table and doing a lookup, the lookup can be done instantly. Operations like
130 // determining the type and deleting the reference are more expensive because the table must be
131 // hunted for (i.e. you have to do a pointer comparison to see which table it's in), you can't move
132 // the table when expanding it (so realloc() is out), and tricks like serial number checking to
133 // detect stale references aren't possible (though we may be able to get similar benefits with other
134 // approaches).
135 //
136 // TODO: consider a "lastDeleteIndex" for quick hole-filling when an add immediately follows a
137 // delete; must invalidate after segment pop might be worth only using it for JNI globals.
138 //
139 // TODO: may want completely different add/remove algorithms for global and local refs to improve
140 // performance.  A large circular buffer might reduce the amortized cost of adding global
141 // references.
142 
143 // The state of the current segment. We only store the index. Splitting it for index and hole
144 // count restricts the range too much.
145 struct IRTSegmentState {
146   uint32_t top_index;
147 };
148 
149 // Use as initial value for "cookie", and when table has only one segment.
150 static constexpr IRTSegmentState kIRTFirstSegment = { 0 };
151 
152 // Try to choose kIRTPrevCount so that sizeof(IrtEntry) is a power of 2.
153 // Contains multiple entries but only one active one, this helps us detect use after free errors
154 // since the serial stored in the indirect ref wont match.
155 static constexpr size_t kIRTPrevCount = kIsDebugBuild ? 7 : 3;
156 
157 class IrtEntry {
158  public:
159   void Add(ObjPtr<mirror::Object> obj) REQUIRES_SHARED(Locks::mutator_lock_);
160 
GetReference()161   GcRoot<mirror::Object>* GetReference() {
162     DCHECK_LT(serial_, kIRTPrevCount);
163     return &references_[serial_];
164   }
165 
GetReference()166   const GcRoot<mirror::Object>* GetReference() const {
167     DCHECK_LT(serial_, kIRTPrevCount);
168     return &references_[serial_];
169   }
170 
GetSerial()171   uint32_t GetSerial() const {
172     return serial_;
173   }
174 
175   void SetReference(ObjPtr<mirror::Object> obj) REQUIRES_SHARED(Locks::mutator_lock_);
176 
177  private:
178   uint32_t serial_;
179   GcRoot<mirror::Object> references_[kIRTPrevCount];
180 };
181 static_assert(sizeof(IrtEntry) == (1 + kIRTPrevCount) * sizeof(uint32_t),
182               "Unexpected sizeof(IrtEntry)");
183 static_assert(IsPowerOfTwo(sizeof(IrtEntry)), "Unexpected sizeof(IrtEntry)");
184 
185 class IrtIterator {
186  public:
IrtIterator(IrtEntry * table,size_t i,size_t capacity)187   IrtIterator(IrtEntry* table, size_t i, size_t capacity) REQUIRES_SHARED(Locks::mutator_lock_)
188       : table_(table), i_(i), capacity_(capacity) {
189   }
190 
191   IrtIterator& operator++() REQUIRES_SHARED(Locks::mutator_lock_) {
192     ++i_;
193     return *this;
194   }
195 
REQUIRES_SHARED(Locks::mutator_lock_)196   GcRoot<mirror::Object>* operator*() REQUIRES_SHARED(Locks::mutator_lock_) {
197     // This does not have a read barrier as this is used to visit roots.
198     return table_[i_].GetReference();
199   }
200 
equals(const IrtIterator & rhs)201   bool equals(const IrtIterator& rhs) const {
202     return (i_ == rhs.i_ && table_ == rhs.table_);
203   }
204 
205  private:
206   IrtEntry* const table_;
207   size_t i_;
208   const size_t capacity_;
209 };
210 
211 bool inline operator==(const IrtIterator& lhs, const IrtIterator& rhs) {
212   return lhs.equals(rhs);
213 }
214 
215 bool inline operator!=(const IrtIterator& lhs, const IrtIterator& rhs) {
216   return !lhs.equals(rhs);
217 }
218 
219 class IndirectReferenceTable {
220  public:
221   enum class ResizableCapacity {
222     kNo,
223     kYes
224   };
225 
226   // WARNING: Construction of the IndirectReferenceTable may fail.
227   // error_msg must not be null. If error_msg is set by the constructor, then
228   // construction has failed and the IndirectReferenceTable will be in an
229   // invalid state. Use IsValid to check whether the object is in an invalid
230   // state.
231   IndirectReferenceTable(size_t max_count,
232                          IndirectRefKind kind,
233                          ResizableCapacity resizable,
234                          std::string* error_msg);
235 
236   ~IndirectReferenceTable();
237 
238   /*
239    * Checks whether construction of the IndirectReferenceTable succeeded.
240    *
241    * This object must only be used if IsValid() returns true. It is safe to
242    * call IsValid from multiple threads without locking or other explicit
243    * synchronization.
244    */
245   bool IsValid() const;
246 
247   // Add a new entry. "obj" must be a valid non-null object reference. This function will
248   // abort if the table is full (max entries reached, or expansion failed).
249   IndirectRef Add(IRTSegmentState previous_state, ObjPtr<mirror::Object> obj)
250       REQUIRES_SHARED(Locks::mutator_lock_);
251 
252   // Given an IndirectRef in the table, return the Object it refers to.
253   //
254   // This function may abort under error conditions.
255   template<ReadBarrierOption kReadBarrierOption = kWithReadBarrier>
256   ObjPtr<mirror::Object> Get(IndirectRef iref) const REQUIRES_SHARED(Locks::mutator_lock_)
257       ALWAYS_INLINE;
258 
259   // Synchronized get which reads a reference, acquiring a lock if necessary.
260   template<ReadBarrierOption kReadBarrierOption = kWithReadBarrier>
SynchronizedGet(IndirectRef iref)261   ObjPtr<mirror::Object> SynchronizedGet(IndirectRef iref) const
262       REQUIRES_SHARED(Locks::mutator_lock_) {
263     return Get<kReadBarrierOption>(iref);
264   }
265 
266   // Updates an existing indirect reference to point to a new object.
267   void Update(IndirectRef iref, ObjPtr<mirror::Object> obj) REQUIRES_SHARED(Locks::mutator_lock_);
268 
269   // Remove an existing entry.
270   //
271   // If the entry is not between the current top index and the bottom index
272   // specified by the cookie, we don't remove anything.  This is the behavior
273   // required by JNI's DeleteLocalRef function.
274   //
275   // Returns "false" if nothing was removed.
276   bool Remove(IRTSegmentState previous_state, IndirectRef iref);
277 
278   void AssertEmpty() REQUIRES_SHARED(Locks::mutator_lock_);
279 
280   void Dump(std::ostream& os) const REQUIRES_SHARED(Locks::mutator_lock_);
281 
282   // Return the #of entries in the entire table.  This includes holes, and
283   // so may be larger than the actual number of "live" entries.
Capacity()284   size_t Capacity() const {
285     return segment_state_.top_index;
286   }
287 
288   // Note IrtIterator does not have a read barrier as it's used to visit roots.
begin()289   IrtIterator begin() {
290     return IrtIterator(table_, 0, Capacity());
291   }
292 
end()293   IrtIterator end() {
294     return IrtIterator(table_, Capacity(), Capacity());
295   }
296 
297   void VisitRoots(RootVisitor* visitor, const RootInfo& root_info)
298       REQUIRES_SHARED(Locks::mutator_lock_);
299 
GetSegmentState()300   IRTSegmentState GetSegmentState() const {
301     return segment_state_;
302   }
303 
304   void SetSegmentState(IRTSegmentState new_state);
305 
SegmentStateOffset(size_t pointer_size ATTRIBUTE_UNUSED)306   static Offset SegmentStateOffset(size_t pointer_size ATTRIBUTE_UNUSED) {
307     // Note: Currently segment_state_ is at offset 0. We're testing the expected value in
308     //       jni_internal_test to make sure it stays correct. It is not OFFSETOF_MEMBER, as that
309     //       is not pointer-size-safe.
310     return Offset(0);
311   }
312 
313   // Release pages past the end of the table that may have previously held references.
314   void Trim() REQUIRES_SHARED(Locks::mutator_lock_);
315 
316   // Determine what kind of indirect reference this is. Opposite of EncodeIndirectRefKind.
GetIndirectRefKind(IndirectRef iref)317   ALWAYS_INLINE static inline IndirectRefKind GetIndirectRefKind(IndirectRef iref) {
318     return DecodeIndirectRefKind(reinterpret_cast<uintptr_t>(iref));
319   }
320 
321  private:
322   static constexpr size_t kSerialBits = MinimumBitsToStore(kIRTPrevCount);
323   static constexpr uint32_t kShiftedSerialMask = (1u << kSerialBits) - 1;
324 
325   static constexpr size_t kKindBits = MinimumBitsToStore(
326       static_cast<uint32_t>(IndirectRefKind::kLastKind));
327   static constexpr uint32_t kKindMask = (1u << kKindBits) - 1;
328 
EncodeIndex(uint32_t table_index)329   static constexpr uintptr_t EncodeIndex(uint32_t table_index) {
330     static_assert(sizeof(IndirectRef) == sizeof(uintptr_t), "Unexpected IndirectRef size");
331     DCHECK_LE(MinimumBitsToStore(table_index), BitSizeOf<uintptr_t>() - kSerialBits - kKindBits);
332     return (static_cast<uintptr_t>(table_index) << kKindBits << kSerialBits);
333   }
DecodeIndex(uintptr_t uref)334   static constexpr uint32_t DecodeIndex(uintptr_t uref) {
335     return static_cast<uint32_t>((uref >> kKindBits) >> kSerialBits);
336   }
337 
EncodeIndirectRefKind(IndirectRefKind kind)338   static constexpr uintptr_t EncodeIndirectRefKind(IndirectRefKind kind) {
339     return static_cast<uintptr_t>(kind);
340   }
DecodeIndirectRefKind(uintptr_t uref)341   static constexpr IndirectRefKind DecodeIndirectRefKind(uintptr_t uref) {
342     return static_cast<IndirectRefKind>(uref & kKindMask);
343   }
344 
EncodeSerial(uint32_t serial)345   static constexpr uintptr_t EncodeSerial(uint32_t serial) {
346     DCHECK_LE(MinimumBitsToStore(serial), kSerialBits);
347     return serial << kKindBits;
348   }
DecodeSerial(uintptr_t uref)349   static constexpr uint32_t DecodeSerial(uintptr_t uref) {
350     return static_cast<uint32_t>(uref >> kKindBits) & kShiftedSerialMask;
351   }
352 
EncodeIndirectRef(uint32_t table_index,uint32_t serial)353   constexpr uintptr_t EncodeIndirectRef(uint32_t table_index, uint32_t serial) const {
354     DCHECK_LT(table_index, max_entries_);
355     return EncodeIndex(table_index) | EncodeSerial(serial) | EncodeIndirectRefKind(kind_);
356   }
357 
358   static void ConstexprChecks();
359 
360   // Extract the table index from an indirect reference.
ExtractIndex(IndirectRef iref)361   ALWAYS_INLINE static uint32_t ExtractIndex(IndirectRef iref) {
362     return DecodeIndex(reinterpret_cast<uintptr_t>(iref));
363   }
364 
ToIndirectRef(uint32_t table_index)365   IndirectRef ToIndirectRef(uint32_t table_index) const {
366     DCHECK_LT(table_index, max_entries_);
367     uint32_t serial = table_[table_index].GetSerial();
368     return reinterpret_cast<IndirectRef>(EncodeIndirectRef(table_index, serial));
369   }
370 
371   // Resize the backing table. Currently must be larger than the current size.
372   bool Resize(size_t new_size, std::string* error_msg);
373 
374   void RecoverHoles(IRTSegmentState from);
375 
376   // Abort if check_jni is not enabled. Otherwise, just log as an error.
377   static void AbortIfNoCheckJNI(const std::string& msg);
378 
379   /* extra debugging checks */
380   bool GetChecked(IndirectRef) const REQUIRES_SHARED(Locks::mutator_lock_);
381   bool CheckEntry(const char*, IndirectRef, uint32_t) const;
382 
383   /// semi-public - read/write by jni down calls.
384   IRTSegmentState segment_state_;
385 
386   // Mem map where we store the indirect refs.
387   std::unique_ptr<MemMap> table_mem_map_;
388   // bottom of the stack. Do not directly access the object references
389   // in this as they are roots. Use Get() that has a read barrier.
390   IrtEntry* table_;
391   // bit mask, ORed into all irefs.
392   const IndirectRefKind kind_;
393 
394   // max #of entries allowed (modulo resizing).
395   size_t max_entries_;
396 
397   // Some values to retain old behavior with holes. Description of the algorithm is in the .cc
398   // file.
399   // TODO: Consider other data structures for compact tables, e.g., free lists.
400   size_t current_num_holes_;
401   IRTSegmentState last_known_previous_state_;
402 
403   // Whether the table's capacity may be resized. As there are no locks used, it is the caller's
404   // responsibility to ensure thread-safety.
405   ResizableCapacity resizable_;
406 };
407 
408 }  // namespace art
409 
410 #endif  // ART_RUNTIME_INDIRECT_REFERENCE_TABLE_H_
411