1 /*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "jni_env_ext.h"
18
19 #include <algorithm>
20 #include <vector>
21
22 #include "android-base/stringprintf.h"
23
24 #include "base/mutex.h"
25 #include "base/to_str.h"
26 #include "check_jni.h"
27 #include "hidden_api.h"
28 #include "indirect_reference_table.h"
29 #include "java_vm_ext.h"
30 #include "jni_internal.h"
31 #include "lock_word.h"
32 #include "mirror/object-inl.h"
33 #include "nth_caller_visitor.h"
34 #include "scoped_thread_state_change.h"
35 #include "thread-current-inl.h"
36 #include "thread_list.h"
37
38 namespace art {
39
40 using android::base::StringPrintf;
41
42 static constexpr size_t kMonitorsInitial = 32; // Arbitrary.
43 static constexpr size_t kMonitorsMax = 4096; // Maximum number of monitors held by JNI code.
44
45 const JNINativeInterface* JNIEnvExt::table_override_ = nullptr;
46
CheckLocalsValid(JNIEnvExt * in)47 bool JNIEnvExt::CheckLocalsValid(JNIEnvExt* in) NO_THREAD_SAFETY_ANALYSIS {
48 if (in == nullptr) {
49 return false;
50 }
51 return in->locals_.IsValid();
52 }
53
GetEnvHandler(JavaVMExt * vm,void ** env,jint version)54 jint JNIEnvExt::GetEnvHandler(JavaVMExt* vm, /*out*/void** env, jint version) {
55 UNUSED(vm);
56 // GetEnv always returns a JNIEnv* for the most current supported JNI version,
57 // and unlike other calls that take a JNI version doesn't care if you supply
58 // JNI_VERSION_1_1, which we don't otherwise support.
59 if (JavaVMExt::IsBadJniVersion(version) && version != JNI_VERSION_1_1) {
60 return JNI_EVERSION;
61 }
62 Thread* thread = Thread::Current();
63 CHECK(thread != nullptr);
64 *env = thread->GetJniEnv();
65 return JNI_OK;
66 }
67
Create(Thread * self_in,JavaVMExt * vm_in,std::string * error_msg)68 JNIEnvExt* JNIEnvExt::Create(Thread* self_in, JavaVMExt* vm_in, std::string* error_msg) {
69 std::unique_ptr<JNIEnvExt> ret(new JNIEnvExt(self_in, vm_in, error_msg));
70 if (CheckLocalsValid(ret.get())) {
71 return ret.release();
72 }
73 return nullptr;
74 }
75
JNIEnvExt(Thread * self_in,JavaVMExt * vm_in,std::string * error_msg)76 JNIEnvExt::JNIEnvExt(Thread* self_in, JavaVMExt* vm_in, std::string* error_msg)
77 : self_(self_in),
78 vm_(vm_in),
79 local_ref_cookie_(kIRTFirstSegment),
80 locals_(kLocalsInitial, kLocal, IndirectReferenceTable::ResizableCapacity::kYes, error_msg),
81 monitors_("monitors", kMonitorsInitial, kMonitorsMax),
82 critical_(0),
83 check_jni_(false),
84 runtime_deleted_(false) {
85 MutexLock mu(Thread::Current(), *Locks::jni_function_table_lock_);
86 check_jni_ = vm_in->IsCheckJniEnabled();
87 functions = GetFunctionTable(check_jni_);
88 unchecked_functions_ = GetJniNativeInterface();
89 }
90
SetFunctionsToRuntimeShutdownFunctions()91 void JNIEnvExt::SetFunctionsToRuntimeShutdownFunctions() {
92 functions = GetRuntimeShutdownNativeInterface();
93 }
94
~JNIEnvExt()95 JNIEnvExt::~JNIEnvExt() {
96 }
97
NewLocalRef(mirror::Object * obj)98 jobject JNIEnvExt::NewLocalRef(mirror::Object* obj) {
99 if (obj == nullptr) {
100 return nullptr;
101 }
102 std::string error_msg;
103 jobject ref = reinterpret_cast<jobject>(locals_.Add(local_ref_cookie_, obj, &error_msg));
104 if (UNLIKELY(ref == nullptr)) {
105 // This is really unexpected if we allow resizing local IRTs...
106 LOG(FATAL) << error_msg;
107 UNREACHABLE();
108 }
109 return ref;
110 }
111
DeleteLocalRef(jobject obj)112 void JNIEnvExt::DeleteLocalRef(jobject obj) {
113 if (obj != nullptr) {
114 locals_.Remove(local_ref_cookie_, reinterpret_cast<IndirectRef>(obj));
115 }
116 }
117
SetCheckJniEnabled(bool enabled)118 void JNIEnvExt::SetCheckJniEnabled(bool enabled) {
119 check_jni_ = enabled;
120 MutexLock mu(Thread::Current(), *Locks::jni_function_table_lock_);
121 functions = GetFunctionTable(enabled);
122 // Check whether this is a no-op because of override.
123 if (enabled && JNIEnvExt::table_override_ != nullptr) {
124 LOG(WARNING) << "Enabling CheckJNI after a JNIEnv function table override is not functional.";
125 }
126 }
127
DumpReferenceTables(std::ostream & os)128 void JNIEnvExt::DumpReferenceTables(std::ostream& os) {
129 locals_.Dump(os);
130 monitors_.Dump(os);
131 }
132
PushFrame(int capacity)133 void JNIEnvExt::PushFrame(int capacity) {
134 DCHECK_GE(locals_.FreeCapacity(), static_cast<size_t>(capacity));
135 stacked_local_ref_cookies_.push_back(local_ref_cookie_);
136 local_ref_cookie_ = locals_.GetSegmentState();
137 }
138
PopFrame()139 void JNIEnvExt::PopFrame() {
140 locals_.SetSegmentState(local_ref_cookie_);
141 local_ref_cookie_ = stacked_local_ref_cookies_.back();
142 stacked_local_ref_cookies_.pop_back();
143 }
144
145 // Note: the offset code is brittle, as we can't use OFFSETOF_MEMBER or offsetof easily. Thus, there
146 // are tests in jni_internal_test to match the results against the actual values.
147
148 // This is encoding the knowledge of the structure and layout of JNIEnv fields.
JNIEnvSize(size_t pointer_size)149 static size_t JNIEnvSize(size_t pointer_size) {
150 // A single pointer.
151 return pointer_size;
152 }
153
SegmentStateOffset(size_t pointer_size)154 Offset JNIEnvExt::SegmentStateOffset(size_t pointer_size) {
155 size_t locals_offset = JNIEnvSize(pointer_size) +
156 2 * pointer_size + // Thread* self + JavaVMExt* vm.
157 4 + // local_ref_cookie.
158 (pointer_size - 4); // Padding.
159 size_t irt_segment_state_offset =
160 IndirectReferenceTable::SegmentStateOffset(pointer_size).Int32Value();
161 return Offset(locals_offset + irt_segment_state_offset);
162 }
163
LocalRefCookieOffset(size_t pointer_size)164 Offset JNIEnvExt::LocalRefCookieOffset(size_t pointer_size) {
165 return Offset(JNIEnvSize(pointer_size) +
166 2 * pointer_size); // Thread* self + JavaVMExt* vm
167 }
168
SelfOffset(size_t pointer_size)169 Offset JNIEnvExt::SelfOffset(size_t pointer_size) {
170 return Offset(JNIEnvSize(pointer_size));
171 }
172
173 // Use some defining part of the caller's frame as the identifying mark for the JNI segment.
GetJavaCallFrame(Thread * self)174 static uintptr_t GetJavaCallFrame(Thread* self) REQUIRES_SHARED(Locks::mutator_lock_) {
175 NthCallerVisitor zeroth_caller(self, 0, false);
176 zeroth_caller.WalkStack();
177 if (zeroth_caller.caller == nullptr) {
178 // No Java code, must be from pure native code.
179 return 0;
180 } else if (zeroth_caller.GetCurrentQuickFrame() == nullptr) {
181 // Shadow frame = interpreter. Use the actual shadow frame's address.
182 DCHECK(zeroth_caller.GetCurrentShadowFrame() != nullptr);
183 return reinterpret_cast<uintptr_t>(zeroth_caller.GetCurrentShadowFrame());
184 } else {
185 // Quick frame = compiled code. Use the bottom of the frame.
186 return reinterpret_cast<uintptr_t>(zeroth_caller.GetCurrentQuickFrame());
187 }
188 }
189
RecordMonitorEnter(jobject obj)190 void JNIEnvExt::RecordMonitorEnter(jobject obj) {
191 locked_objects_.push_back(std::make_pair(GetJavaCallFrame(self_), obj));
192 }
193
ComputeMonitorDescription(Thread * self,jobject obj)194 static std::string ComputeMonitorDescription(Thread* self,
195 jobject obj) REQUIRES_SHARED(Locks::mutator_lock_) {
196 ObjPtr<mirror::Object> o = self->DecodeJObject(obj);
197 if ((o->GetLockWord(false).GetState() == LockWord::kThinLocked) &&
198 Locks::mutator_lock_->IsExclusiveHeld(self)) {
199 // Getting the identity hashcode here would result in lock inflation and suspension of the
200 // current thread, which isn't safe if this is the only runnable thread.
201 return StringPrintf("<@addr=0x%" PRIxPTR "> (a %s)",
202 reinterpret_cast<intptr_t>(o.Ptr()),
203 o->PrettyTypeOf().c_str());
204 } else {
205 // IdentityHashCode can cause thread suspension, which would invalidate o if it moved. So
206 // we get the pretty type before we call IdentityHashCode.
207 const std::string pretty_type(o->PrettyTypeOf());
208 return StringPrintf("<0x%08x> (a %s)", o->IdentityHashCode(), pretty_type.c_str());
209 }
210 }
211
RemoveMonitors(Thread * self,uintptr_t frame,ReferenceTable * monitors,std::vector<std::pair<uintptr_t,jobject>> * locked_objects)212 static void RemoveMonitors(Thread* self,
213 uintptr_t frame,
214 ReferenceTable* monitors,
215 std::vector<std::pair<uintptr_t, jobject>>* locked_objects)
216 REQUIRES_SHARED(Locks::mutator_lock_) {
217 auto kept_end = std::remove_if(
218 locked_objects->begin(),
219 locked_objects->end(),
220 [self, frame, monitors](const std::pair<uintptr_t, jobject>& pair)
221 REQUIRES_SHARED(Locks::mutator_lock_) {
222 if (frame == pair.first) {
223 ObjPtr<mirror::Object> o = self->DecodeJObject(pair.second);
224 monitors->Remove(o);
225 return true;
226 }
227 return false;
228 });
229 locked_objects->erase(kept_end, locked_objects->end());
230 }
231
CheckMonitorRelease(jobject obj)232 void JNIEnvExt::CheckMonitorRelease(jobject obj) {
233 uintptr_t current_frame = GetJavaCallFrame(self_);
234 std::pair<uintptr_t, jobject> exact_pair = std::make_pair(current_frame, obj);
235 auto it = std::find(locked_objects_.begin(), locked_objects_.end(), exact_pair);
236 bool will_abort = false;
237 if (it != locked_objects_.end()) {
238 locked_objects_.erase(it);
239 } else {
240 // Check whether this monitor was locked in another JNI "session."
241 ObjPtr<mirror::Object> mirror_obj = self_->DecodeJObject(obj);
242 for (std::pair<uintptr_t, jobject>& pair : locked_objects_) {
243 if (self_->DecodeJObject(pair.second) == mirror_obj) {
244 std::string monitor_descr = ComputeMonitorDescription(self_, pair.second);
245 vm_->JniAbortF("<JNI MonitorExit>",
246 "Unlocking monitor that wasn't locked here: %s",
247 monitor_descr.c_str());
248 will_abort = true;
249 break;
250 }
251 }
252 }
253
254 // When we abort, also make sure that any locks from the current "session" are removed from
255 // the monitors table, otherwise we may visit local objects in GC during abort (which won't be
256 // valid anymore).
257 if (will_abort) {
258 RemoveMonitors(self_, current_frame, &monitors_, &locked_objects_);
259 }
260 }
261
CheckNoHeldMonitors()262 void JNIEnvExt::CheckNoHeldMonitors() {
263 // The locked_objects_ are grouped by their stack frame component, as this enforces structured
264 // locking, and the groups form a stack. So the current frame entries are at the end. Check
265 // whether the vector is empty, and when there are elements, whether the last element belongs
266 // to this call - this signals that there are unlocked monitors.
267 if (!locked_objects_.empty()) {
268 uintptr_t current_frame = GetJavaCallFrame(self_);
269 std::pair<uintptr_t, jobject>& pair = locked_objects_[locked_objects_.size() - 1];
270 if (pair.first == current_frame) {
271 std::string monitor_descr = ComputeMonitorDescription(self_, pair.second);
272 vm_->JniAbortF("<JNI End>",
273 "Still holding a locked object on JNI end: %s",
274 monitor_descr.c_str());
275 // When we abort, also make sure that any locks from the current "session" are removed from
276 // the monitors table, otherwise we may visit local objects in GC during abort.
277 RemoveMonitors(self_, current_frame, &monitors_, &locked_objects_);
278 } else if (kIsDebugBuild) {
279 // Make sure there are really no other entries and our checking worked as expected.
280 for (std::pair<uintptr_t, jobject>& check_pair : locked_objects_) {
281 CHECK_NE(check_pair.first, current_frame);
282 }
283 }
284 }
285 // Ensure critical locks aren't held when returning to Java.
286 if (critical_ > 0) {
287 vm_->JniAbortF("<JNI End>",
288 "Critical lock held when returning to Java on thread %s",
289 ToStr<Thread>(*self_).c_str());
290 }
291 }
292
ThreadResetFunctionTable(Thread * thread,void * arg ATTRIBUTE_UNUSED)293 void ThreadResetFunctionTable(Thread* thread, void* arg ATTRIBUTE_UNUSED)
294 REQUIRES(Locks::jni_function_table_lock_) {
295 JNIEnvExt* env = thread->GetJniEnv();
296 bool check_jni = env->IsCheckJniEnabled();
297 env->functions = JNIEnvExt::GetFunctionTable(check_jni);
298 env->unchecked_functions_ = GetJniNativeInterface();
299 }
300
SetTableOverride(const JNINativeInterface * table_override)301 void JNIEnvExt::SetTableOverride(const JNINativeInterface* table_override) {
302 MutexLock mu(Thread::Current(), *Locks::thread_list_lock_);
303 MutexLock mu2(Thread::Current(), *Locks::jni_function_table_lock_);
304
305 JNIEnvExt::table_override_ = table_override;
306
307 // See if we have a runtime. Note: we cannot run other code (like JavaVMExt's CheckJNI install
308 // code), as we'd have to recursively lock the mutex.
309 Runtime* runtime = Runtime::Current();
310 if (runtime != nullptr) {
311 runtime->GetThreadList()->ForEach(ThreadResetFunctionTable, nullptr);
312 // Core Platform API checks rely on stack walking and classifying the caller. If a table
313 // override is installed do not try to guess what semantics should be.
314 runtime->SetCorePlatformApiEnforcementPolicy(hiddenapi::EnforcementPolicy::kDisabled);
315 }
316 }
317
GetFunctionTable(bool check_jni)318 const JNINativeInterface* JNIEnvExt::GetFunctionTable(bool check_jni) {
319 const JNINativeInterface* override = JNIEnvExt::table_override_;
320 if (override != nullptr) {
321 return override;
322 }
323 return check_jni ? GetCheckJniNativeInterface() : GetJniNativeInterface();
324 }
325
ResetFunctionTable()326 void JNIEnvExt::ResetFunctionTable() {
327 MutexLock mu(Thread::Current(), *Locks::thread_list_lock_);
328 MutexLock mu2(Thread::Current(), *Locks::jni_function_table_lock_);
329 Runtime* runtime = Runtime::Current();
330 CHECK(runtime != nullptr);
331 runtime->GetThreadList()->ForEach(ThreadResetFunctionTable, nullptr);
332 }
333
334 } // namespace art
335