/*

 * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 *

 */

#include "precompiled.hpp"

#include "classfile/vmSymbols.hpp"

#include "memory/allocation.inline.hpp"

#include "memory/resourceArea.hpp"

#include "oops/oop.inline.hpp"

#include "os_bsd.inline.hpp"

#include "runtime/handles.inline.hpp"

#include "runtime/perfMemory.hpp"

#include "utilities/exceptions.hpp"

// put OS-includes here

# include <sys/types.h>

# include <sys/mman.h>

# include <errno.h>

# include <stdio.h>

# include <unistd.h>

# include <sys/stat.h>

# include <signal.h>

# include <pwd.h>

static char* backing_store_file_name = NULL;  // name of the backing store

                                              // file, if successfully created.

// Standard Memory Implementation Details

// create the PerfData memory region in standard memory.

//

static char* create_standard_memory(size_t size) {

  // allocate an aligned chuck of memory

  char* mapAddress = os::reserve_memory(size);

  if (mapAddress == NULL) {

    return NULL;

  }

  // commit memory

  if (!os::commit_memory(mapAddress, size)) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not commit PerfData memory\n");

    }

    os::release_memory(mapAddress, size);

    return NULL;

  }

  return mapAddress;

}

// delete the PerfData memory region

//

static void delete_standard_memory(char* addr, size_t size) {

  // there are no persistent external resources to cleanup for standard

  // memory. since DestroyJavaVM does not support unloading of the JVM,

  // cleanup of the memory resource is not performed. The memory will be

  // reclaimed by the OS upon termination of the process.

  //

  return;

}

// save the specified memory region to the given file

//

// Note: this function might be called from signal handler (by os::abort()),

// don't allocate heap memory.

//

static void save_memory_to_file(char* addr, size_t size) {

 const char* destfile = PerfMemory::get_perfdata_file_path();

 assert(destfile[0] != '\0', "invalid PerfData file path");

  int result;

  RESTARTABLE(::open(destfile, O_CREAT|O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE),

              result);;

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not create Perfdata save file: %s: %s\n",

              destfile, strerror(errno));

    }

  } else {

    int fd = result;

    for (size_t remaining = size; remaining > 0;) {

      RESTARTABLE(::write(fd, addr, remaining), result);

      if (result == OS_ERR) {

        if (PrintMiscellaneous && Verbose) {

          warning("Could not write Perfdata save file: %s: %s\n",

                  destfile, strerror(errno));

        }

        break;

      }

      remaining -= (size_t)result;

      addr += result;

    }

    RESTARTABLE(::close(fd), result);

    if (PrintMiscellaneous && Verbose) {

      if (result == OS_ERR) {

        warning("Could not close %s: %s\n", destfile, strerror(errno));

      }

    }

  }

}

// Shared Memory Implementation Details

// Note: the solaris and bsd shared memory implementation uses the mmap

// interface with a backing store file to implement named shared memory.

// Using the file system as the name space for shared memory allows a

// common name space to be supported across a variety of platforms. It

// also provides a name space that Java applications can deal with through

// simple file apis.

//

// The solaris and bsd implementations store the backing store file in

// a user specific temporary directory located in the /tmp file system,

// which is always a local file system and is sometimes a RAM based file

// system.

// return the user specific temporary directory name.

//

// the caller is expected to free the allocated memory.

//

static char* get_user_tmp_dir(const char* user) {

  const char* tmpdir = os::get_temp_directory();

  const char* perfdir = PERFDATA_NAME;

  size_t nbytes = strlen(tmpdir) + strlen(perfdir) + strlen(user) + 3;

  // construct the path name to user specific tmp directory

  snprintf(dirname, nbytes, "%s/%s_%s", tmpdir, perfdir, user);

  return dirname;

}

// convert the given file name into a process id. if the file

// does not meet the file naming constraints, return 0.

//

static pid_t filename_to_pid(const char* filename) {

  // a filename that doesn't begin with a digit is not a

  // candidate for conversion.

  //

  if (!isdigit(*filename)) {

    return 0;

  }

  // check if file name can be converted to an integer without

  // any leftover characters.

  //

  char* remainder = NULL;

  errno = 0;

  pid_t pid = (pid_t)strtol(filename, &remainder, 10);

  if (errno != 0) {

    return 0;

  }

  // check for left over characters. If any, then the filename is

  // not a candidate for conversion.

  //

  if (remainder != NULL && *remainder != '\0') {

    return 0;

  }

  // successful conversion, return the pid

  return pid;

}

// check if the given path is considered a secure directory for

// the backing store files. Returns true if the directory exists

// and is considered a secure location. Returns false if the path

// is a symbolic link or if an error occurred.

//

static bool is_directory_secure(const char* path) {

  struct stat statbuf;

  int result = 0;

  RESTARTABLE(::lstat(path, &statbuf), result);

  if (result == OS_ERR) {

    return false;

  }

  // the path exists, now check it's mode

  if (S_ISLNK(statbuf.st_mode) || !S_ISDIR(statbuf.st_mode)) {

    // the path represents a link or some non-directory file type,

    // which is not what we expected. declare it insecure.

    //

    return false;

  }

  else {

    // we have an existing directory, check if the permissions are safe.

    //

    if ((statbuf.st_mode & (S_IWGRP|S_IWOTH)) != 0) {

      // the directory is open for writing and could be subjected

      // to a symlnk attack. declare it insecure.

      //

      return false;

    }

  }

  return true;

}

// return the user name for the given user id

//

// the caller is expected to free the allocated memory.

//

static char* get_user_name(uid_t uid) {

  struct passwd pwent;

  // determine the max pwbuf size from sysconf, and hardcode

  // a default if this not available through sysconf.

  //

  long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);

  if (bufsize == -1)

    bufsize = 1024;

  // POSIX interface to getpwuid_r is used on LINUX

  struct passwd* p;

  int result = getpwuid_r(uid, &pwent, pwbuf, (size_t)bufsize, &p);

  if (result != 0 || p == NULL || p->pw_name == NULL || *(p->pw_name) == '\0') {

    if (PrintMiscellaneous && Verbose) {

      if (result != 0) {

        warning("Could not retrieve passwd entry: %s\n",

                strerror(result));

      }

      else if (p == NULL) {

        // this check is added to protect against an observed problem

        // with getpwuid_r() on RedHat 9 where getpwuid_r returns 0,

        // indicating success, but has p == NULL. This was observed when

        // inserting a file descriptor exhaustion fault prior to the call

        // getpwuid_r() call. In this case, error is set to the appropriate

        // error condition, but this is undocumented behavior. This check

        // is safe under any condition, but the use of errno in the output

        // message may result in an erroneous message.

        // Bug Id 89052 was opened with RedHat.

        //

        warning("Could not retrieve passwd entry: %s\n",

                strerror(errno));

      }

      else {

        warning("Could not determine user name: %s\n",

                p->pw_name == NULL ? "pw_name = NULL" :

                                     "pw_name zero length");

      }

    }

    return NULL;

  }

  strcpy(user_name, p->pw_name);

  return user_name;

}

// return the name of the user that owns the process identified by vmid.

//

// This method uses a slow directory search algorithm to find the backing

// store file for the specified vmid and returns the user name, as determined

// by the user name suffix of the hsperfdata_<username> directory name.

//

// the caller is expected to free the allocated memory.

//

static char* get_user_name_slow(int vmid, TRAPS) {

  // short circuit the directory search if the process doesn't even exist.

  if (kill(vmid, 0) == OS_ERR) {

    if (errno == ESRCH) {

      THROW_MSG_0(vmSymbols::java_lang_IllegalArgumentException(),

                  "Process not found");

    }

    else /* EPERM */ {

      THROW_MSG_0(vmSymbols::java_io_IOException(), strerror(errno));

    }

  }

  // directory search

  char* oldest_user = NULL;

  time_t oldest_ctime = 0;

  const char* tmpdirname = os::get_temp_directory();

  DIR* tmpdirp = os::opendir(tmpdirname);

  if (tmpdirp == NULL) {

    return NULL;

  }

  // for each entry in the directory that matches the pattern hsperfdata_*,

  // open the directory and check if the file for the given vmid exists.

  // The file with the expected name and the latest creation date is used

  // to determine the user name for the process id.

  //

  struct dirent* dentry;

  errno = 0;

  while ((dentry = os::readdir(tmpdirp, (struct dirent *)tdbuf)) != NULL) {

    // check if the directory entry is a hsperfdata file

    if (strncmp(dentry->d_name, PERFDATA_NAME, strlen(PERFDATA_NAME)) != 0) {

      continue;

    }

    char* usrdir_name = NEW_C_HEAP_ARRAY(char,

    strcpy(usrdir_name, tmpdirname);

    strcat(usrdir_name, "/");

    strcat(usrdir_name, dentry->d_name);

    DIR* subdirp = os::opendir(usrdir_name);

    if (subdirp == NULL) {

      continue;

    }

    // Since we don't create the backing store files in directories

    // pointed to by symbolic links, we also don't follow them when

    // looking for the files. We check for a symbolic link after the

    // call to opendir in order to eliminate a small window where the

    // symlink can be exploited.

    //

    if (!is_directory_secure(usrdir_name)) {

      os::closedir(subdirp);

      continue;

    }

    struct dirent* udentry;

    errno = 0;

    while ((udentry = os::readdir(subdirp, (struct dirent *)udbuf)) != NULL) {

      if (filename_to_pid(udentry->d_name) == vmid) {

        struct stat statbuf;

        int result;

        char* filename = NEW_C_HEAP_ARRAY(char,

        strcpy(filename, usrdir_name);

        strcat(filename, "/");

        strcat(filename, udentry->d_name);

        // don't follow symbolic links for the file

        RESTARTABLE(::lstat(filename, &statbuf), result);

        if (result == OS_ERR) {

           continue;

        }

        // skip over files that are not regular files.

        if (!S_ISREG(statbuf.st_mode)) {

          continue;

        }

        // compare and save filename with latest creation time

        if (statbuf.st_size > 0 && statbuf.st_ctime > oldest_ctime) {

          if (statbuf.st_ctime > oldest_ctime) {

            char* user = strchr(dentry->d_name, '_') + 1;

            strcpy(oldest_user, user);

            oldest_ctime = statbuf.st_ctime;

          }

        }

      }

    }

    os::closedir(subdirp);

  }

  os::closedir(tmpdirp);

  return(oldest_user);

}

// return the name of the user that owns the JVM indicated by the given vmid.

//

static char* get_user_name(int vmid, TRAPS) {

  return get_user_name_slow(vmid, CHECK_NULL);

}

// return the file name of the backing store file for the named

// shared memory region for the given user name and vmid.

//

// the caller is expected to free the allocated memory.

//

static char* get_sharedmem_filename(const char* dirname, int vmid) {

  // add 2 for the file separator and a null terminator.

  size_t nbytes = strlen(dirname) + UINT_CHARS + 2;

  snprintf(name, nbytes, "%s/%d", dirname, vmid);

  return name;

}

// remove file

//

// this method removes the file specified by the given path

//

static void remove_file(const char* path) {

  int result;

  // if the file is a directory, the following unlink will fail. since

  // we don't expect to find directories in the user temp directory, we

  // won't try to handle this situation. even if accidentially or

  // maliciously planted, the directory's presence won't hurt anything.

  //

  RESTARTABLE(::unlink(path), result);

  if (PrintMiscellaneous && Verbose && result == OS_ERR) {

    if (errno != ENOENT) {

      warning("Could not unlink shared memory backing"

              " store file %s : %s\n", path, strerror(errno));

    }

  }

}

// remove file

//

// this method removes the file with the given file name in the

// named directory.

//

static void remove_file(const char* dirname, const char* filename) {

  size_t nbytes = strlen(dirname) + strlen(filename) + 2;

  strcpy(path, dirname);

  strcat(path, "/");

  strcat(path, filename);

  remove_file(path);

}

// cleanup stale shared memory resources

//

// This method attempts to remove all stale shared memory files in

// the named user temporary directory. It scans the named directory

// for files matching the pattern ^$[0-9]*$. For each file found, the

// process id is extracted from the file name and a test is run to

// determine if the process is alive. If the process is not alive,

// any stale file resources are removed.

//

static void cleanup_sharedmem_resources(const char* dirname) {

  // open the user temp directory

  DIR* dirp = os::opendir(dirname);

  if (dirp == NULL) {

    // directory doesn't exist, so there is nothing to cleanup

    return;

  }

  if (!is_directory_secure(dirname)) {

    // the directory is not a secure directory

    return;

  }

  // for each entry in the directory that matches the expected file

  // name pattern, determine if the file resources are stale and if

  // so, remove the file resources. Note, instrumented HotSpot processes

  // for this user may start and/or terminate during this search and

  // remove or create new files in this directory. The behavior of this

  // loop under these conditions is dependent upon the implementation of

  // opendir/readdir.

  //

  struct dirent* entry;

  errno = 0;

  while ((entry = os::readdir(dirp, (struct dirent *)dbuf)) != NULL) {

    pid_t pid = filename_to_pid(entry->d_name);