/*

 * Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 *

 */

#include "precompiled.hpp"

#include "jvm.h"

#include "classfile/classFileStream.hpp"

#include "classfile/classLoader.hpp"

#include "classfile/javaClasses.hpp"

#include "classfile/stackMapTable.hpp"

#include "classfile/stackMapFrame.hpp"

#include "classfile/stackMapTableFormat.hpp"

#include "classfile/symbolTable.hpp"

#include "classfile/systemDictionary.hpp"

#include "classfile/verifier.hpp"

#include "classfile/vmSymbols.hpp"

#include "interpreter/bytecodes.hpp"

#include "interpreter/bytecodeStream.hpp"

#include "logging/log.hpp"

#include "logging/logStream.hpp"

#include "memory/oopFactory.hpp"

#include "memory/resourceArea.hpp"

#include "memory/universe.hpp"

#include "oops/constantPool.inline.hpp"

#include "oops/instanceKlass.hpp"

#include "oops/oop.inline.hpp"

#include "oops/typeArrayOop.hpp"

#include "runtime/fieldDescriptor.hpp"

#include "runtime/handles.inline.hpp"

#include "runtime/interfaceSupport.inline.hpp"

#include "runtime/javaCalls.hpp"

#include "runtime/jniHandles.inline.hpp"

#include "runtime/orderAccess.hpp"

#include "runtime/os.hpp"

#include "runtime/safepointVerifiers.hpp"

#include "runtime/thread.hpp"

#include "services/threadService.hpp"

#include "utilities/align.hpp"

#include "utilities/bytes.hpp"

#define NOFAILOVER_MAJOR_VERSION                       51

#define NONZERO_PADDING_BYTES_IN_SWITCH_MAJOR_VERSION  51

#define STATIC_METHOD_IN_INTERFACE_MAJOR_VERSION       52

#define MAX_ARRAY_DIMENSIONS 255

// Access to external entry for VerifyClassForMajorVersion - old byte code verifier

extern "C" {

  typedef jboolean (*verify_byte_codes_fn_t)(JNIEnv *, jclass, char *, jint, jint);

}

static verify_byte_codes_fn_t volatile _verify_byte_codes_fn = NULL;

static verify_byte_codes_fn_t verify_byte_codes_fn() {

  if (_verify_byte_codes_fn != NULL)

    return _verify_byte_codes_fn;

  MutexLocker locker(Verify_lock);

  if (_verify_byte_codes_fn != NULL)

    return _verify_byte_codes_fn;

  // Load verify dll

  char buffer[JVM_MAXPATHLEN];

  char ebuf[1024];

  if (!os::dll_locate_lib(buffer, sizeof(buffer), Arguments::get_dll_dir(), "verify"))

    return NULL; // Caller will throw VerifyError

  void *lib_handle = os::dll_load(buffer, ebuf, sizeof(ebuf));

  if (lib_handle == NULL)

    return NULL; // Caller will throw VerifyError

  void *fn = os::dll_lookup(lib_handle, "VerifyClassForMajorVersion");

  if (fn == NULL)

    return NULL; // Caller will throw VerifyError

  return _verify_byte_codes_fn = CAST_TO_FN_PTR(verify_byte_codes_fn_t, fn);

}

// Methods in Verifier

bool Verifier::should_verify_for(oop class_loader, bool should_verify_class) {

  return (class_loader == NULL || !should_verify_class) ?

    BytecodeVerificationLocal : BytecodeVerificationRemote;

}

bool Verifier::relax_access_for(oop loader) {

  bool trusted = java_lang_ClassLoader::is_trusted_loader(loader);

  bool need_verify =

    // verifyAll

    (BytecodeVerificationLocal && BytecodeVerificationRemote) ||

    // verifyRemote

    (!BytecodeVerificationLocal && BytecodeVerificationRemote && !trusted);

  return !need_verify;

}

void Verifier::trace_class_resolution(Klass* resolve_class, InstanceKlass* verify_class) {

  assert(verify_class != NULL, "Unexpected null verify_class");

  ResourceMark rm;

  Symbol* s = verify_class->source_file_name();

  const char* source_file = (s != NULL ? s->as_C_string() : NULL);

  const char* verify = verify_class->external_name();

  const char* resolve = resolve_class->external_name();

  // print in a single call to reduce interleaving between threads

  if (source_file != NULL) {

    log_debug(class, resolve)("%s %s %s (verification)", verify, resolve, source_file);

  } else {

    log_debug(class, resolve)("%s %s (verification)", verify, resolve);

  }

}

// Prints the end-verification message to the appropriate output.

void Verifier::log_end_verification(outputStream* st, const char* klassName, Symbol* exception_name, TRAPS) {

  if (HAS_PENDING_EXCEPTION) {

    st->print("Verification for %s has", klassName);

    st->print_cr(" exception pending %s ",

                 PENDING_EXCEPTION->klass()->external_name());

  } else if (exception_name != NULL) {

    st->print_cr("Verification for %s failed", klassName);

  }

  st->print_cr("End class verification for: %s", klassName);

}

bool Verifier::verify(InstanceKlass* klass, bool should_verify_class, TRAPS) {

  HandleMark hm(THREAD);

  ResourceMark rm(THREAD);

  // Eagerly allocate the identity hash code for a klass. This is a fallout

  // from 6320749 and 8059924: hash code generator is not supposed to be called

  // during the safepoint, but it allows to sneak the hashcode in during

  // verification. Without this eager hashcode generation, we may end up

  // installing the hashcode during some other operation, which may be at

  // safepoint -- blowing up the checks. It was previously done as the side

  // effect (sic!) for external_name(), but instead of doing that, we opt to

  // explicitly push the hashcode in here. This is signify the following block

  // is IMPORTANT:

  if (klass->java_mirror() != NULL) {

    klass->java_mirror()->identity_hash();

  }

  if (!is_eligible_for_verification(klass, should_verify_class)) {

    return true;

  }

  // Timer includes any side effects of class verification (resolution,

  // etc), but not recursive calls to Verifier::verify().

  JavaThread* jt = (JavaThread*)THREAD;

  PerfClassTraceTime timer(ClassLoader::perf_class_verify_time(),

                           ClassLoader::perf_class_verify_selftime(),

                           ClassLoader::perf_classes_verified(),

                           jt->get_thread_stat()->perf_recursion_counts_addr(),

                           jt->get_thread_stat()->perf_timers_addr(),

                           PerfClassTraceTime::CLASS_VERIFY);

  // If the class should be verified, first see if we can use the split

  // verifier.  If not, or if verification fails and can failover, then

  // call the inference verifier.

  Symbol* exception_name = NULL;

  const size_t message_buffer_len = klass->name()->utf8_length() + 1024;

  char* message_buffer = NULL;

  char* exception_message = NULL;

  log_info(class, init)("Start class verification for: %s", klass->external_name());

  if (klass->major_version() >= STACKMAP_ATTRIBUTE_MAJOR_VERSION) {

    ClassVerifier split_verifier(klass, THREAD);

    split_verifier.verify_class(THREAD);

    exception_name = split_verifier.result();

    // If DumpSharedSpaces is set then don't fall back to the old verifier on

    // verification failure. If a class fails verification with the split verifier,

    // it might fail the CDS runtime verifier constraint check. In that case, we

    // don't want to share the class. We only archive classes that pass the split

    // verifier.

    bool can_failover = !DumpSharedSpaces &&

      klass->major_version() < NOFAILOVER_MAJOR_VERSION;

    if (can_failover && !HAS_PENDING_EXCEPTION &&  // Split verifier doesn't set PENDING_EXCEPTION for failure

        (exception_name == vmSymbols::java_lang_VerifyError() ||

         exception_name == vmSymbols::java_lang_ClassFormatError())) {

      log_info(verification)("Fail over class verification to old verifier for: %s", klass->external_name());

      log_info(class, init)("Fail over class verification to old verifier for: %s", klass->external_name());

      message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);

      exception_message = message_buffer;

      exception_name = inference_verify(

        klass, message_buffer, message_buffer_len, THREAD);

    }

    if (exception_name != NULL) {

      exception_message = split_verifier.exception_message();

    }

  } else {

    message_buffer = NEW_RESOURCE_ARRAY(char, message_buffer_len);

    exception_message = message_buffer;

    exception_name = inference_verify(

        klass, message_buffer, message_buffer_len, THREAD);

  }

  LogTarget(Info, class, init) lt1;

  if (lt1.is_enabled()) {

    LogStream ls(lt1);

    log_end_verification(&ls, klass->external_name(), exception_name, THREAD);

  }

  LogTarget(Info, verification) lt2;

  if (lt2.is_enabled()) {

    LogStream ls(lt2);

    log_end_verification(&ls, klass->external_name(), exception_name, THREAD);

  }

  if (HAS_PENDING_EXCEPTION) {

    return false; // use the existing exception

  } else if (exception_name == NULL) {

    return true; // verification succeeded

  } else { // VerifyError or ClassFormatError to be created and thrown

    Klass* kls =

      SystemDictionary::resolve_or_fail(exception_name, true, CHECK_false);

    if (log_is_enabled(Debug, class, resolve)) {

      Verifier::trace_class_resolution(kls, klass);

    }

    while (kls != NULL) {

      if (kls == klass) {

        // If the class being verified is the exception we're creating

        // or one of it's superclasses, we're in trouble and are going

        // to infinitely recurse when we try to initialize the exception.

        // So bail out here by throwing the preallocated VM error.

        THROW_OOP_(Universe::virtual_machine_error_instance(), false);

      }

      kls = kls->super();

    }

    if (message_buffer != NULL) {

      message_buffer[message_buffer_len - 1] = '\0'; // just to be sure

    }

    assert(exception_message != NULL, "");

    THROW_MSG_(exception_name, exception_message, false);

  }

}

bool Verifier::is_eligible_for_verification(InstanceKlass* klass, bool should_verify_class) {

  Symbol* name = klass->name();

  Klass* refl_magic_klass = SystemDictionary::reflect_MagicAccessorImpl_klass();

  bool is_reflect = refl_magic_klass != NULL && klass->is_subtype_of(refl_magic_klass);

  return (should_verify_for(klass->class_loader(), should_verify_class) &&

    // return if the class is a bootstrapping class

    // or defineClass specified not to verify by default (flags override passed arg)

    // We need to skip the following four for bootstraping

    name != vmSymbols::java_lang_Object() &&

    name != vmSymbols::java_lang_Class() &&

    name != vmSymbols::java_lang_String() &&

    name != vmSymbols::java_lang_Throwable() &&

    // Can not verify the bytecodes for shared classes because they have

    // already been rewritten to contain constant pool cache indices,

    // which the verifier can't understand.

    // Shared classes shouldn't have stackmaps either.

    !klass->is_shared() &&

    // As of the fix for 4486457 we disable verification for all of the

    // dynamically-generated bytecodes associated with the 1.4

    // reflection implementation, not just those associated with

    // jdk/internal/reflect/SerializationConstructorAccessor.

    // NOTE: this is called too early in the bootstrapping process to be

    // guarded by Universe::is_gte_jdk14x_version().

    // Also for lambda generated code, gte jdk8

    (!is_reflect));

}

Symbol* Verifier::inference_verify(

    InstanceKlass* klass, char* message, size_t message_len, TRAPS) {

  JavaThread* thread = (JavaThread*)THREAD;

  JNIEnv *env = thread->jni_environment();

  verify_byte_codes_fn_t verify_func = verify_byte_codes_fn();

  if (verify_func == NULL) {

    jio_snprintf(message, message_len, "Could not link verifier");

    return vmSymbols::java_lang_VerifyError();

  }

  ResourceMark rm(THREAD);

  log_info(verification)("Verifying class %s with old format", klass->external_name());

  jclass cls = (jclass) JNIHandles::make_local(env, klass->java_mirror());

  jint result;

  {

    HandleMark hm(thread);

    ThreadToNativeFromVM ttn(thread);

    // ThreadToNativeFromVM takes care of changing thread_state, so safepoint

    // code knows that we have left the VM

    result = (*verify_func)(env, cls, message, (int)message_len, klass->major_version());

  }

  JNIHandles::destroy_local(cls);

  // These numbers are chosen so that VerifyClassCodes interface doesn't need

  // to be changed (still return jboolean (unsigned char)), and result is

  // 1 when verification is passed.

  if (result == 0) {

    return vmSymbols::java_lang_VerifyError();

  } else if (result == 1) {

    return NULL; // verified.

  } else if (result == 2) {

    THROW_MSG_(vmSymbols::java_lang_OutOfMemoryError(), message, NULL);

  } else if (result == 3) {

    return vmSymbols::java_lang_ClassFormatError();

  } else {

    ShouldNotReachHere();

    return NULL;

  }

}

TypeOrigin TypeOrigin::null() {

  return TypeOrigin();

}

TypeOrigin TypeOrigin::local(u2 index, StackMapFrame* frame) {

  assert(frame != NULL, "Must have a frame");

  return TypeOrigin(CF_LOCALS, index, StackMapFrame::copy(frame),

     frame->local_at(index));

}

TypeOrigin TypeOrigin::stack(u2 index, StackMapFrame* frame) {

  assert(frame != NULL, "Must have a frame");

  return TypeOrigin(CF_STACK, index, StackMapFrame::copy(frame),

      frame->stack_at(index));

}

TypeOrigin TypeOrigin::sm_local(u2 index, StackMapFrame* frame) {

  assert(frame != NULL, "Must have a frame");

  return TypeOrigin(SM_LOCALS, index, StackMapFrame::copy(frame),

      frame->local_at(index));

}

TypeOrigin TypeOrigin::sm_stack(u2 index, StackMapFrame* frame) {

  assert(frame != NULL, "Must have a frame");

  return TypeOrigin(SM_STACK, index, StackMapFrame::copy(frame),

      frame->stack_at(index));

}

TypeOrigin TypeOrigin::bad_index(u2 index) {

  return TypeOrigin(BAD_INDEX, index, NULL, VerificationType::bogus_type());

}

TypeOrigin TypeOrigin::cp(u2 index, VerificationType vt) {

  return TypeOrigin(CONST_POOL, index, NULL, vt);

}

TypeOrigin TypeOrigin::signature(VerificationType vt) {

  return TypeOrigin(SIG, 0, NULL, vt);

}

TypeOrigin TypeOrigin::implicit(VerificationType t) {

  return TypeOrigin(IMPLICIT, 0, NULL, t);

}

TypeOrigin TypeOrigin::frame(StackMapFrame* frame) {

  return TypeOrigin(FRAME_ONLY, 0, StackMapFrame::copy(frame),

                    VerificationType::bogus_type());

}

void TypeOrigin::reset_frame() {

  if (_frame != NULL) {

    _frame->restore();

  }

}

void TypeOrigin::details(outputStream* ss) const {

  _type.print_on(ss);

  switch (_origin) {

    case CF_LOCALS:

      ss->print(" (current frame, locals[%d])", _index);

      break;

    case CF_STACK:

      ss->print(" (current frame, stack[%d])", _index);

      break;

    case SM_LOCALS:

      ss->print(" (stack map, locals[%d])", _index);

      break;

    case SM_STACK:

      ss->print(" (stack map, stack[%d])", _index);

      break;

    case CONST_POOL:

      ss->print(" (constant pool %d)", _index);

      break;

    case SIG:

      ss->print(" (from method signature)");

      break;

    case IMPLICIT:

    case FRAME_ONLY:

    case NONE:

    default:

      ;

  }

}

#ifdef ASSERT

void TypeOrigin::print_on(outputStream* str) const {

  str->print("{%d,%d,%p:", _origin, _index, _frame);

  if (_frame != NULL) {

    _frame->print_on(str);

  } else {

    str->print("null");

  }

  str->print(",");

  _type.print_on(str);

  str->print("}");

}

#endif

void ErrorContext::details(outputStream* ss, const Method* method) const {

  if (is_valid()) {

    ss->cr();

    ss->print_cr("Exception Details:");

    location_details(ss, method);

    reason_details(ss);

    frame_details(ss);

    bytecode_details(ss, method);

    handler_details(ss, method);

    stackmap_details(ss, method);

  }

}

void ErrorContext::reason_details(outputStream* ss) const {

  streamIndentor si(ss);

  ss->indent().print_cr("Reason:");

  streamIndentor si2(ss);

  ss->indent().print("%s", "");

  switch (_fault) {

    case INVALID_BYTECODE:

      ss->print("Error exists in the bytecode");

      break;

    case WRONG_TYPE:

      if (_expected.is_valid()) {

        ss->print("Type ");

        _type.details(ss);

        ss->print(" is not assignable to ");

        _expected.details(ss);

      } else {

        ss->print("Invalid type: ");

        _type.details(ss);

      }

      break;

    case FLAGS_MISMATCH:

      if (_expected.is_valid()) {

        ss->print("Current frame's flags are not assignable "

                  "to stack map frame's.");

      } else {

        ss->print("Current frame's flags are invalid in this context.");

      }

      break;

    case BAD_CP_INDEX:

      ss->print("Constant pool index %d is invalid", _type.index());

      break;

    case BAD_LOCAL_INDEX:

      ss->print("Local index %d is invalid", _type.index());

      break;

    case LOCALS_SIZE_MISMATCH:

      ss->print("Current frame's local size doesn't match stackmap.");

      break;

    case STACK_SIZE_MISMATCH:

      ss->print("Current frame's stack size doesn't match stackmap.");

      break;

    case STACK_OVERFLOW:

      ss->print("Exceeded max stack size.");

      break;

    case STACK_UNDERFLOW:

      ss->print("Attempt to pop empty stack.");

      break;

    case MISSING_STACKMAP:

      ss->print("Expected stackmap frame at this location.");

      break;

    case BAD_STACKMAP:

      ss->print("Invalid stackmap specification.");

      break;

    case UNKNOWN:

    default:

      ShouldNotReachHere();

      ss->print_cr("Unknown");

  }

  ss->cr();