trap-handler-x64-unittest.cc 16.4 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "include/v8config.h"

#if V8_OS_LINUX
#include <signal.h>
#include <ucontext.h>
#elif V8_OS_MACOSX
#include <signal.h>
#include <sys/ucontext.h>
#elif V8_OS_WIN
#include <windows.h>
#endif

#include "testing/gtest/include/gtest/gtest.h"

#if V8_OS_POSIX
#include "include/v8-wasm-trap-handler-posix.h"
#elif V8_OS_WIN
#include "include/v8-wasm-trap-handler-win.h"
#endif
#include "src/allocation.h"
#include "src/assembler-inl.h"
#include "src/base/page-allocator.h"
#include "src/macro-assembler-inl.h"
#include "src/simulator.h"
#include "src/trap-handler/trap-handler.h"
#include "src/vector.h"
#include "src/wasm/wasm-engine.h"
#include "src/wasm/wasm-memory.h"

#include "test/common/assembler-tester.h"
#include "test/unittests/test-utils.h"

namespace v8 {
namespace internal {
namespace wasm {

namespace {
constexpr Register scratch = r10;
bool g_test_handler_executed = false;
#if V8_OS_LINUX || V8_OS_MACOSX
struct sigaction g_old_segv_action;
struct sigaction g_old_fpe_action;
struct sigaction g_old_bus_action;  // We get SIGBUS on Mac sometimes.
#elif V8_OS_WIN
void* g_registered_handler = nullptr;
#endif

// The recovery address allows us to recover from an intentional crash.
Address g_recovery_address;
// Flag to indicate if the test handler should call the trap handler as a first
// chance handler.
bool g_use_as_first_chance_handler = false;
}  // namespace

#define __ masm.

enum TrapHandlerStyle : int {
  // The test uses the default trap handler of V8.
  kDefault = 0,
  // The test installs the trap handler callback in its own test handler.
  kCallback = 1
};

std::string PrintTrapHandlerTestParam(
    ::testing::TestParamInfo<TrapHandlerStyle> info) {
  switch (info.param) {
    case kDefault:
      return "DefaultTrapHandler";
    case kCallback:
      return "Callback";
  }
  UNREACHABLE();
}

class TrapHandlerTest : public TestWithIsolate,
                        public ::testing::WithParamInterface<TrapHandlerStyle> {
 protected:
  void SetUp() override {
    void* base = nullptr;
    size_t length = 0;
    accessible_memory_start_ =
        i_isolate()
            ->wasm_engine()
            ->memory_tracker()
            ->TryAllocateBackingStoreForTesting(
                i_isolate()->heap(), 1 * kWasmPageSize, &base, &length);
    memory_buffer_ =
        base::AddressRegion(reinterpret_cast<Address>(base), length);

    // The allocated memory buffer ends with a guard page.
    crash_address_ = memory_buffer_.end() - 32;
    // Allocate a buffer for the generated code.
97 98
    buffer_ = AllocateAssemblerBuffer(AssemblerBase::kMinimalBufferSize,
                                      GetRandomMmapAddr());
99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122

    InitRecoveryCode();

#if V8_OS_LINUX || V8_OS_MACOSX
    // Set up a signal handler to recover from the expected crash.
    struct sigaction action;
    action.sa_sigaction = SignalHandler;
    sigemptyset(&action.sa_mask);
    action.sa_flags = SA_SIGINFO;
    // SIGSEGV happens for wasm oob memory accesses on Linux.
    CHECK_EQ(0, sigaction(SIGSEGV, &action, &g_old_segv_action));
    // SIGBUS happens for wasm oob memory accesses on macOS.
    CHECK_EQ(0, sigaction(SIGBUS, &action, &g_old_bus_action));
    // SIGFPE to simulate crashes which are not handled by the trap handler.
    CHECK_EQ(0, sigaction(SIGFPE, &action, &g_old_fpe_action));
#elif V8_OS_WIN
    g_registered_handler =
        AddVectoredExceptionHandler(/*first=*/0, TestHandler);
#endif
  }

  void TearDown() override {
    // We should always have left wasm code.
    CHECK(!GetThreadInWasmFlag());
123 124
    buffer_.reset();
    recovery_buffer_.reset();
125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148

    // Free the allocated backing store.
    i_isolate()->wasm_engine()->memory_tracker()->FreeBackingStoreForTesting(
        memory_buffer_, accessible_memory_start_);

    // Clean up the trap handler
    trap_handler::RemoveTrapHandler();
    if (!g_test_handler_executed) {
#if V8_OS_LINUX || V8_OS_MACOSX
      // The test handler cleans up the signal handler setup in the test. If the
      // test handler was not called, we have to do the cleanup ourselves.
      CHECK_EQ(0, sigaction(SIGSEGV, &g_old_segv_action, nullptr));
      CHECK_EQ(0, sigaction(SIGFPE, &g_old_fpe_action, nullptr));
      CHECK_EQ(0, sigaction(SIGBUS, &g_old_bus_action, nullptr));
#elif V8_OS_WIN
      RemoveVectoredExceptionHandler(g_registered_handler);
      g_registered_handler = nullptr;
#endif
    }
  }

  void InitRecoveryCode() {
    // Create a code snippet where we can jump to to recover from a signal or
    // exception. The code snippet only consists of a return statement.
149 150
    recovery_buffer_ = AllocateAssemblerBuffer(
        AssemblerBase::kMinimalBufferSize, GetRandomMmapAddr());
151

152 153
    MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                        recovery_buffer_->CreateView());
154 155 156 157 158
    int recovery_offset = __ pc_offset();
    __ Pop(scratch);
    __ Ret();
    CodeDesc desc;
    masm.GetCode(nullptr, &desc);
159
    recovery_buffer_->MakeExecutable();
160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
    g_recovery_address =
        reinterpret_cast<Address>(desc.buffer + recovery_offset);
  }

#if V8_OS_LINUX || V8_OS_MACOSX
  static void SignalHandler(int signal, siginfo_t* info, void* context) {
    if (g_use_as_first_chance_handler) {
      if (v8::TryHandleWebAssemblyTrapPosix(signal, info, context)) {
        return;
      }
    }

    // Reset the signal handler, to avoid that this signal handler is called
    // repeatedly.
    sigaction(SIGSEGV, &g_old_segv_action, nullptr);
    sigaction(SIGFPE, &g_old_fpe_action, nullptr);
    sigaction(SIGBUS, &g_old_bus_action, nullptr);

    g_test_handler_executed = true;
    // Set the $rip to the recovery code.
    ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
#if V8_OS_LINUX
    uc->uc_mcontext.gregs[REG_RIP] = g_recovery_address;
#else  // V8_OS_MACOSX
    uc->uc_mcontext->__ss.__rip = g_recovery_address;
#endif
  }
#endif

#if V8_OS_WIN
  static LONG WINAPI TestHandler(EXCEPTION_POINTERS* exception) {
    if (g_use_as_first_chance_handler) {
      if (v8::TryHandleWebAssemblyTrapWindows(exception)) {
        return EXCEPTION_CONTINUE_EXECUTION;
      }
    }
    RemoveVectoredExceptionHandler(g_registered_handler);
    g_registered_handler = nullptr;
    g_test_handler_executed = true;
    exception->ContextRecord->Rip = g_recovery_address;
    return EXCEPTION_CONTINUE_EXECUTION;
  }
#endif

 public:
  void SetupTrapHandler(TrapHandlerStyle style) {
    bool use_default_handler = style == kDefault;
    g_use_as_first_chance_handler = !use_default_handler;
    CHECK(v8::V8::EnableWebAssemblyTrapHandler(use_default_handler));
  }

  void GenerateSetThreadInWasmFlagCode(MacroAssembler* masm) {
    masm->Move(scratch,
213 214
               i_isolate()->thread_local_top()->thread_in_wasm_flag_address_,
               RelocInfo::NONE);
215 216 217 218 219
    masm->movl(MemOperand(scratch, 0), Immediate(1));
  }

  void GenerateResetThreadInWasmFlagCode(MacroAssembler* masm) {
    masm->Move(scratch,
220 221
               i_isolate()->thread_local_top()->thread_in_wasm_flag_address_,
               RelocInfo::NONE);
222 223 224 225 226 227 228 229 230
    masm->movl(MemOperand(scratch, 0), Immediate(0));
  }

  bool GetThreadInWasmFlag() {
    return *reinterpret_cast<int*>(
        trap_handler::GetThreadInWasmThreadLocalAddress());
  }

  // Execute the code in buffer.
231 232 233 234
  void ExecuteBuffer() {
    buffer_->MakeExecutable();
    GeneratedCode<void>::FromAddress(
        i_isolate(), reinterpret_cast<Address>(buffer_->start()))
235
        .Call();
236
    CHECK(!g_test_handler_executed);
237 238 239 240
  }

  // Execute the code in buffer. We expect a crash which we recover from in the
  // test handler.
241 242
  void ExecuteExpectCrash(TestingAssemblerBuffer* buffer,
                          bool check_wasm_flag = true) {
243
    CHECK(!g_test_handler_executed);
244
    buffer->MakeExecutable();
245
    GeneratedCode<void>::FromAddress(i_isolate(),
246
                                     reinterpret_cast<Address>(buffer->start()))
247
        .Call();
248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264
    CHECK(g_test_handler_executed);
    g_test_handler_executed = false;
    if (check_wasm_flag) CHECK(!GetThreadInWasmFlag());
  }

  bool test_handler_executed() { return g_test_handler_executed; }

  // Allocated memory which corresponds to wasm memory with guard regions.
  base::AddressRegion memory_buffer_;
  // Address within the guard region of the wasm memory. Accessing this memory
  // address causes a signal or exception.
  Address crash_address_;
  // The start of the accessible region in the allocated memory. This pointer is
  // needed to de-register the memory from the wasm memory tracker again.
  void* accessible_memory_start_;

  // Buffer for generated code.
265
  std::unique_ptr<TestingAssemblerBuffer> buffer_;
266
  // Buffer for the code for the landing pad of the test handler.
267
  std::unique_ptr<TestingAssemblerBuffer> recovery_buffer_;
268 269 270 271 272
};

TEST_P(TrapHandlerTest, TestTrapHandlerRecovery) {
  // Test that the wasm trap handler can recover a memory access violation in
  // wasm code (we fake the wasm code and the access violation).
273 274
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292
  __ Push(scratch);
  GenerateSetThreadInWasmFlagCode(&masm);
  __ Move(scratch, crash_address_, RelocInfo::NONE);
  int crash_offset = __ pc_offset();
  __ testl(MemOperand(scratch, 0), Immediate(1));
  int recovery_offset = __ pc_offset();
  GenerateResetThreadInWasmFlagCode(&masm);
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  SetupTrapHandler(GetParam());
  trap_handler::ProtectedInstructionData protected_instruction{crash_offset,
                                                               recovery_offset};
  trap_handler::RegisterHandlerData(reinterpret_cast<Address>(desc.buffer),
                                    desc.instr_size, 1, &protected_instruction);

293
  ExecuteBuffer();
294 295 296 297 298
}

TEST_P(TrapHandlerTest, TestReleaseHandlerData) {
  // Test that after we release handler data in the trap handler, it cannot
  // recover from the specific memory access violation anymore.
299 300
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320
  __ Push(scratch);
  GenerateSetThreadInWasmFlagCode(&masm);
  __ Move(scratch, crash_address_, RelocInfo::NONE);
  int crash_offset = __ pc_offset();
  __ testl(MemOperand(scratch, 0), Immediate(1));
  int recovery_offset = __ pc_offset();
  GenerateResetThreadInWasmFlagCode(&masm);
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  trap_handler::ProtectedInstructionData protected_instruction{crash_offset,
                                                               recovery_offset};
  int handler_id = trap_handler::RegisterHandlerData(
      reinterpret_cast<Address>(desc.buffer), desc.instr_size, 1,
      &protected_instruction);

  SetupTrapHandler(GetParam());

321
  ExecuteBuffer();
322 323 324 325 326

  // Deregister from the trap handler. The trap handler should not do the
  // recovery now.
  trap_handler::ReleaseHandlerData(handler_id);

327
  ExecuteExpectCrash(buffer_.get());
328 329 330 331 332
}

TEST_P(TrapHandlerTest, TestNoThreadInWasmFlag) {
  // That that if the thread_in_wasm flag is not set, the trap handler does not
  // get active.
333 334
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351
  __ Push(scratch);
  __ Move(scratch, crash_address_, RelocInfo::NONE);
  int crash_offset = __ pc_offset();
  __ testl(MemOperand(scratch, 0), Immediate(1));
  int recovery_offset = __ pc_offset();
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  trap_handler::ProtectedInstructionData protected_instruction{crash_offset,
                                                               recovery_offset};
  trap_handler::RegisterHandlerData(reinterpret_cast<Address>(desc.buffer),
                                    desc.instr_size, 1, &protected_instruction);

  SetupTrapHandler(GetParam());

352
  ExecuteExpectCrash(buffer_.get());
353 354 355 356 357
}

TEST_P(TrapHandlerTest, TestCrashInWasmNoProtectedInstruction) {
  // Test that if the crash in wasm happened at an instruction which is not
  // protected, then the trap handler does not handle it.
358 359
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
  __ Push(scratch);
  GenerateSetThreadInWasmFlagCode(&masm);
  int no_crash_offset = __ pc_offset();
  __ Move(scratch, crash_address_, RelocInfo::NONE);
  __ testl(MemOperand(scratch, 0), Immediate(1));
  // Offset where the crash is not happening.
  int recovery_offset = __ pc_offset();
  GenerateResetThreadInWasmFlagCode(&masm);
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  trap_handler::ProtectedInstructionData protected_instruction{no_crash_offset,
                                                               recovery_offset};
  trap_handler::RegisterHandlerData(reinterpret_cast<Address>(desc.buffer),
                                    desc.instr_size, 1, &protected_instruction);

  SetupTrapHandler(GetParam());

380
  ExecuteExpectCrash(buffer_.get());
381 382 383 384 385
}

TEST_P(TrapHandlerTest, TestCrashInWasmWrongCrashType) {
  // Test that if the crash reason is not a memory access violation, then the
  // wasm trap handler does not handle it.
386 387
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
  __ Push(scratch);
  GenerateSetThreadInWasmFlagCode(&masm);
  __ xorq(scratch, scratch);
  int crash_offset = __ pc_offset();
  __ divq(scratch);
  // Offset where the crash is not happening.
  int recovery_offset = __ pc_offset();
  GenerateResetThreadInWasmFlagCode(&masm);
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  trap_handler::ProtectedInstructionData protected_instruction{crash_offset,
                                                               recovery_offset};
  trap_handler::RegisterHandlerData(reinterpret_cast<Address>(desc.buffer),
                                    desc.instr_size, 1, &protected_instruction);

  SetupTrapHandler(GetParam());

#if V8_OS_POSIX
  // The V8 default trap handler does not register for SIGFPE, therefore the
  // thread-in-wasm flag is never reset in this test. We therefore do not check
  // the value of this flag.
  bool check_wasm_flag = GetParam() != kDefault;
#else
  bool check_wasm_flag = true;
#endif
416
  ExecuteExpectCrash(buffer_.get(), check_wasm_flag);
417 418 419 420 421 422 423 424 425
  if (!check_wasm_flag) {
    // Reset the thread-in-wasm flag because it was probably not reset in the
    // trap handler.
    *trap_handler::GetThreadInWasmThreadLocalAddress() = 0;
  }
}

class CodeRunner : public v8::base::Thread {
 public:
426
  CodeRunner(TrapHandlerTest* test, TestingAssemblerBuffer* buffer)
427 428 429 430 431 432
      : Thread(Options("CodeRunner")), test_(test), buffer_(buffer) {}

  void Run() override { test_->ExecuteExpectCrash(buffer_); }

 private:
  TrapHandlerTest* test_;
433
  TestingAssemblerBuffer* buffer_;
434 435 436 437 438 439 440
};

TEST_P(TrapHandlerTest, TestCrashInOtherThread) {
  // Test setup:
  // The current thread enters wasm land (sets the thread_in_wasm flag)
  // A second thread crashes at a protected instruction without having the flag
  // set.
441 442
  MacroAssembler masm(nullptr, AssemblerOptions{}, CodeObjectRequired::kNo,
                      buffer_->CreateView());
443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459
  __ Push(scratch);
  __ Move(scratch, crash_address_, RelocInfo::NONE);
  int crash_offset = __ pc_offset();
  __ testl(MemOperand(scratch, 0), Immediate(1));
  int recovery_offset = __ pc_offset();
  __ Pop(scratch);
  __ Ret();
  CodeDesc desc;
  masm.GetCode(nullptr, &desc);

  trap_handler::ProtectedInstructionData protected_instruction{crash_offset,
                                                               recovery_offset};
  trap_handler::RegisterHandlerData(reinterpret_cast<Address>(desc.buffer),
                                    desc.instr_size, 1, &protected_instruction);

  SetupTrapHandler(GetParam());

460
  CodeRunner runner(this, buffer_.get());
461 462 463 464 465 466 467 468 469 470
  CHECK(!GetThreadInWasmFlag());
  // Set the thread-in-wasm flag manually in this thread.
  *trap_handler::GetThreadInWasmThreadLocalAddress() = 1;
  runner.Start();
  runner.Join();
  CHECK(GetThreadInWasmFlag());
  // Reset the thread-in-wasm flag.
  *trap_handler::GetThreadInWasmThreadLocalAddress() = 0;
}

471 472 473
INSTANTIATE_TEST_SUITE_P(/* no prefix */, TrapHandlerTest,
                         ::testing::Values(kDefault, kCallback),
                         PrintTrapHandlerTestParam);
474 475 476 477 478

#undef __
}  // namespace wasm
}  // namespace internal
}  // namespace v8