signal_windows.go

     1  // Copyright 2011 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package runtime
     6  
     7  import (
     8  	"internal/abi"
     9  	"unsafe"
    10  )
    11  
    12  const (
    13  	_SEM_FAILCRITICALERRORS = 0x0001
    14  	_SEM_NOGPFAULTERRORBOX  = 0x0002
    15  	_SEM_NOOPENFILEERRORBOX = 0x8000
    16  
    17  	_WER_FAULT_REPORTING_NO_UI = 0x0020
    18  )
    19  
    20  func preventErrorDialogs() {
    21  	errormode := stdcall(_GetErrorMode)
    22  	stdcall(_SetErrorMode, errormode|_SEM_FAILCRITICALERRORS|_SEM_NOGPFAULTERRORBOX|_SEM_NOOPENFILEERRORBOX)
    23  
    24  	// Disable WER fault reporting UI.
    25  	// Do this even if WER is disabled as a whole,
    26  	// as WER might be enabled later with setTraceback("wer")
    27  	// and we still want the fault reporting UI to be disabled if this happens.
    28  	var werflags uintptr
    29  	stdcall(_WerGetFlags, currentProcess, uintptr(unsafe.Pointer(&werflags)))
    30  	stdcall(_WerSetFlags, werflags|_WER_FAULT_REPORTING_NO_UI)
    31  }
    32  
    33  // enableWER re-enables Windows error reporting without fault reporting UI.
    34  func enableWER() {
    35  	// re-enable Windows Error Reporting
    36  	errormode := stdcall(_GetErrorMode)
    37  	if errormode&_SEM_NOGPFAULTERRORBOX != 0 {
    38  		stdcall(_SetErrorMode, errormode^_SEM_NOGPFAULTERRORBOX)
    39  	}
    40  }
    41  
    42  // in sys_windows_386.s, sys_windows_amd64.s, and sys_windows_arm64.s
    43  func exceptiontramp()
    44  func firstcontinuetramp()
    45  func lastcontinuetramp()
    46  func sehtramp()
    47  func sigresume()
    48  
    49  func initExceptionHandler() {
    50  	stdcall(_AddVectoredExceptionHandler, 1, abi.FuncPCABI0(exceptiontramp))
    51  	if GOARCH == "386" {
    52  		// use SetUnhandledExceptionFilter for windows-386.
    53  		// note: SetUnhandledExceptionFilter handler won't be called, if debugging.
    54  		stdcall(_SetUnhandledExceptionFilter, abi.FuncPCABI0(lastcontinuetramp))
    55  	} else {
    56  		stdcall(_AddVectoredContinueHandler, 1, abi.FuncPCABI0(firstcontinuetramp))
    57  		stdcall(_AddVectoredContinueHandler, 0, abi.FuncPCABI0(lastcontinuetramp))
    58  	}
    59  }
    60  
    61  // isAbort returns true, if context r describes exception raised
    62  // by calling runtime.abort function.
    63  //
    64  //go:nosplit
    65  func isAbort(r *context) bool {
    66  	pc := r.ip()
    67  	if GOARCH == "386" || GOARCH == "amd64" {
    68  		// In the case of an abort, the exception IP is one byte after
    69  		// the INT3 (this differs from UNIX OSes).
    70  		pc--
    71  	}
    72  	return isAbortPC(pc)
    73  }
    74  
    75  // isgoexception reports whether this exception should be translated
    76  // into a Go panic or throw.
    77  //
    78  // It is nosplit to avoid growing the stack in case we're aborting
    79  // because of a stack overflow.
    80  //
    81  //go:nosplit
    82  func isgoexception(info *exceptionrecord, r *context) bool {
    83  	// Only handle exception if executing instructions in Go binary
    84  	// (not Windows library code).
    85  	// TODO(mwhudson): needs to loop to support shared libs
    86  	if r.ip() < firstmoduledata.text || firstmoduledata.etext < r.ip() {
    87  		return false
    88  	}
    89  
    90  	// Go will only handle some exceptions.
    91  	switch info.exceptioncode {
    92  	default:
    93  		return false
    94  	case _EXCEPTION_ACCESS_VIOLATION:
    95  	case _EXCEPTION_IN_PAGE_ERROR:
    96  	case _EXCEPTION_INT_DIVIDE_BY_ZERO:
    97  	case _EXCEPTION_INT_OVERFLOW:
    98  	case _EXCEPTION_FLT_DENORMAL_OPERAND:
    99  	case _EXCEPTION_FLT_DIVIDE_BY_ZERO:
   100  	case _EXCEPTION_FLT_INEXACT_RESULT:
   101  	case _EXCEPTION_FLT_OVERFLOW:
   102  	case _EXCEPTION_FLT_UNDERFLOW:
   103  	case _EXCEPTION_BREAKPOINT:
   104  	case _EXCEPTION_ILLEGAL_INSTRUCTION: // breakpoint arrives this way on arm64
   105  	}
   106  	return true
   107  }
   108  
   109  const (
   110  	callbackVEH = iota
   111  	callbackFirstVCH
   112  	callbackLastVCH
   113  )
   114  
   115  // sigFetchGSafe is like getg() but without panicking
   116  // when TLS is not set.
   117  // Only implemented on windows/386, which is the only
   118  // arch that loads TLS when calling getg(). Others
   119  // use a dedicated register.
   120  func sigFetchGSafe() *g
   121  
   122  func sigFetchG() *g {
   123  	if GOARCH == "386" {
   124  		return sigFetchGSafe()
   125  	}
   126  	return getg()
   127  }
   128  
   129  // sigtrampgo is called from the exception handler function, sigtramp,
   130  // written in assembly code.
   131  // Return EXCEPTION_CONTINUE_EXECUTION if the exception is handled,
   132  // else return EXCEPTION_CONTINUE_SEARCH.
   133  //
   134  // It is nosplit for the same reason as exceptionhandler.
   135  //
   136  //go:nosplit
   137  func sigtrampgo(ep *exceptionpointers, kind int) int32 {
   138  	gp := sigFetchG()
   139  	if gp == nil {
   140  		return _EXCEPTION_CONTINUE_SEARCH
   141  	}
   142  
   143  	var fn func(info *exceptionrecord, r *context, gp *g) int32
   144  	switch kind {
   145  	case callbackVEH:
   146  		fn = exceptionhandler
   147  	case callbackFirstVCH:
   148  		fn = firstcontinuehandler
   149  	case callbackLastVCH:
   150  		fn = lastcontinuehandler
   151  	default:
   152  		throw("unknown sigtramp callback")
   153  	}
   154  
   155  	// Check if we are running on g0 stack, and if we are,
   156  	// call fn directly instead of creating the closure.
   157  	// for the systemstack argument.
   158  	//
   159  	// A closure can't be marked as nosplit, so it might
   160  	// call morestack if we are at the g0 stack limit.
   161  	// If that happens, the runtime will call abort
   162  	// and end up in sigtrampgo again.
   163  	// TODO: revisit this workaround if/when closures
   164  	// can be compiled as nosplit.
   165  	//
   166  	// Note that this scenario should only occur on
   167  	// TestG0StackOverflow. Any other occurrence should
   168  	// be treated as a bug.
   169  	var ret int32
   170  	if gp != gp.m.g0 {
   171  		systemstack(func() {
   172  			ret = fn(ep.record, ep.context, gp)
   173  		})
   174  	} else {
   175  		ret = fn(ep.record, ep.context, gp)
   176  	}
   177  	if ret == _EXCEPTION_CONTINUE_SEARCH {
   178  		return ret
   179  	}
   180  
   181  	// Check if we need to set up the control flow guard workaround.
   182  	// On Windows, the stack pointer in the context must lie within
   183  	// system stack limits when we resume from exception.
   184  	// Store the resume SP and PC in alternate registers
   185  	// and return to sigresume on the g0 stack.
   186  	// sigresume makes no use of the stack at all,
   187  	// loading SP from RX and jumping to RY, being RX and RY two scratch registers.
   188  	// Note that blindly smashing RX and RY is only safe because we know sigpanic
   189  	// will not actually return to the original frame, so the registers
   190  	// are effectively dead. But this does mean we can't use the
   191  	// same mechanism for async preemption.
   192  	if ep.context.ip() == abi.FuncPCABI0(sigresume) {
   193  		// sigresume has already been set up by a previous exception.
   194  		return ret
   195  	}
   196  	prepareContextForSigResume(ep.context)
   197  	ep.context.set_sp(gp.m.g0.sched.sp)
   198  	ep.context.set_ip(abi.FuncPCABI0(sigresume))
   199  	return ret
   200  }
   201  
   202  // Called by sigtramp from Windows VEH handler.
   203  // Return value signals whether the exception has been handled (EXCEPTION_CONTINUE_EXECUTION)
   204  // or should be made available to other handlers in the chain (EXCEPTION_CONTINUE_SEARCH).
   205  //
   206  // This is nosplit to avoid growing the stack until we've checked for
   207  // _EXCEPTION_BREAKPOINT, which is raised by abort() if we overflow the g0 stack.
   208  //
   209  //go:nosplit
   210  func exceptionhandler(info *exceptionrecord, r *context, gp *g) int32 {
   211  	if !isgoexception(info, r) {
   212  		return _EXCEPTION_CONTINUE_SEARCH
   213  	}
   214  
   215  	if gp.throwsplit || isAbort(r) {
   216  		// We can't safely sigpanic because it may grow the stack.
   217  		// Or this is a call to abort.
   218  		// Don't go through any more of the Windows handler chain.
   219  		// Crash now.
   220  		winthrow(info, r, gp)
   221  	}
   222  
   223  	// After this point, it is safe to grow the stack.
   224  
   225  	// Make it look like a call to the signal func.
   226  	// Have to pass arguments out of band since
   227  	// augmenting the stack frame would break
   228  	// the unwinding code.
   229  	gp.sig = info.exceptioncode
   230  	gp.sigcode0 = info.exceptioninformation[0]
   231  	gp.sigcode1 = info.exceptioninformation[1]
   232  	gp.sigpc = r.ip()
   233  
   234  	// Only push runtime·sigpanic if r.ip() != 0.
   235  	// If r.ip() == 0, probably panicked because of a
   236  	// call to a nil func. Not pushing that onto sp will
   237  	// make the trace look like a call to runtime·sigpanic instead.
   238  	// (Otherwise the trace will end at runtime·sigpanic and we
   239  	// won't get to see who faulted.)
   240  	// Also don't push a sigpanic frame if the faulting PC
   241  	// is the entry of asyncPreempt. In this case, we suspended
   242  	// the thread right between the fault and the exception handler
   243  	// starting to run, and we have pushed an asyncPreempt call.
   244  	// The exception is not from asyncPreempt, so not to push a
   245  	// sigpanic call to make it look like that. Instead, just
   246  	// overwrite the PC. (See issue #35773)
   247  	if r.ip() != 0 && r.ip() != abi.FuncPCABI0(asyncPreempt) {
   248  		r.pushCall(abi.FuncPCABI0(sigpanic0), r.ip())
   249  	} else {
   250  		// Not safe to push the call. Just clobber the frame.
   251  		r.set_ip(abi.FuncPCABI0(sigpanic0))
   252  	}
   253  	return _EXCEPTION_CONTINUE_EXECUTION
   254  }
   255  
   256  // sehhandler is reached as part of the SEH chain.
   257  //
   258  // It is nosplit for the same reason as exceptionhandler.
   259  //
   260  //go:nosplit
   261  func sehhandler(_ *exceptionrecord, _ uint64, _ *context, dctxt *_DISPATCHER_CONTEXT) int32 {
   262  	g0 := getg()
   263  	if g0 == nil || g0.m.curg == nil {
   264  		// No g available, nothing to do here.
   265  		return _EXCEPTION_CONTINUE_SEARCH_SEH
   266  	}
   267  	// The Windows SEH machinery will unwind the stack until it finds
   268  	// a frame with a handler for the exception or until the frame is
   269  	// outside the stack boundaries, in which case it will call the
   270  	// UnhandledExceptionFilter. Unfortunately, it doesn't know about
   271  	// the goroutine stack, so it will stop unwinding when it reaches the
   272  	// first frame not running in g0. As a result, neither non-Go exceptions
   273  	// handlers higher up the stack nor UnhandledExceptionFilter will be called.
   274  	//
   275  	// To work around this, manually unwind the stack until the top of the goroutine
   276  	// stack is reached, and then pass the control back to Windows.
   277  	gp := g0.m.curg
   278  	ctxt := dctxt.ctx()
   279  	var base, sp uintptr
   280  	for {
   281  		entry := stdcall(_RtlLookupFunctionEntry, ctxt.ip(), uintptr(unsafe.Pointer(&base)), 0)
   282  		if entry == 0 {
   283  			break
   284  		}
   285  		stdcall(_RtlVirtualUnwind, 0, base, ctxt.ip(), entry, uintptr(unsafe.Pointer(ctxt)), 0, uintptr(unsafe.Pointer(&sp)), 0)
   286  		if sp < gp.stack.lo || gp.stack.hi <= sp {
   287  			break
   288  		}
   289  	}
   290  	return _EXCEPTION_CONTINUE_SEARCH_SEH
   291  }
   292  
   293  // It seems Windows searches ContinueHandler's list even
   294  // if ExceptionHandler returns EXCEPTION_CONTINUE_EXECUTION.
   295  // firstcontinuehandler will stop that search,
   296  // if exceptionhandler did the same earlier.
   297  //
   298  // It is nosplit for the same reason as exceptionhandler.
   299  //
   300  //go:nosplit
   301  func firstcontinuehandler(info *exceptionrecord, r *context, gp *g) int32 {
   302  	if !isgoexception(info, r) {
   303  		return _EXCEPTION_CONTINUE_SEARCH
   304  	}
   305  	return _EXCEPTION_CONTINUE_EXECUTION
   306  }
   307  
   308  // lastcontinuehandler is reached, because runtime cannot handle
   309  // current exception. lastcontinuehandler will print crash info and exit.
   310  //
   311  // It is nosplit for the same reason as exceptionhandler.
   312  //
   313  //go:nosplit
   314  func lastcontinuehandler(info *exceptionrecord, r *context, gp *g) int32 {
   315  	if islibrary || isarchive {
   316  		// Go DLL/archive has been loaded in a non-go program.
   317  		// If the exception does not originate from go, the go runtime
   318  		// should not take responsibility of crashing the process.
   319  		return _EXCEPTION_CONTINUE_SEARCH
   320  	}
   321  
   322  	// VEH is called before SEH, but arm64 MSVC DLLs use SEH to trap
   323  	// illegal instructions during runtime initialization to determine
   324  	// CPU features, so if we make it to the last handler and we're
   325  	// arm64 and it's an illegal instruction and this is coming from
   326  	// non-Go code, then assume it's this runtime probing happen, and
   327  	// pass that onward to SEH.
   328  	if GOARCH == "arm64" && info.exceptioncode == _EXCEPTION_ILLEGAL_INSTRUCTION &&
   329  		(r.ip() < firstmoduledata.text || firstmoduledata.etext < r.ip()) {
   330  		return _EXCEPTION_CONTINUE_SEARCH
   331  	}
   332  
   333  	winthrow(info, r, gp)
   334  	return 0 // not reached
   335  }
   336  
   337  // Always called on g0. gp is the G where the exception occurred.
   338  //
   339  //go:nosplit
   340  func winthrow(info *exceptionrecord, r *context, gp *g) {
   341  	g0 := getg()
   342  
   343  	if panicking.Load() != 0 { // traceback already printed
   344  		exit(2)
   345  	}
   346  	panicking.Store(1)
   347  
   348  	// In case we're handling a g0 stack overflow, blow away the
   349  	// g0 stack bounds so we have room to print the traceback. If
   350  	// this somehow overflows the stack, the OS will trap it.
   351  	g0.stack.lo = 0
   352  	g0.stackguard0 = g0.stack.lo + stackGuard
   353  	g0.stackguard1 = g0.stackguard0
   354  
   355  	print("Exception ", hex(info.exceptioncode), " ", hex(info.exceptioninformation[0]), " ", hex(info.exceptioninformation[1]), " ", hex(r.ip()), "\n")
   356  
   357  	print("PC=", hex(r.ip()), "\n")
   358  	if g0.m.incgo && gp == g0.m.g0 && g0.m.curg != nil {
   359  		if iscgo {
   360  			print("signal arrived during external code execution\n")
   361  		}
   362  		gp = g0.m.curg
   363  	}
   364  	print("\n")
   365  
   366  	g0.m.throwing = throwTypeRuntime
   367  	g0.m.caughtsig.set(gp)
   368  
   369  	level, _, docrash := gotraceback()
   370  	if level > 0 {
   371  		tracebacktrap(r.ip(), r.sp(), r.lr(), gp)
   372  		tracebackothers(gp)
   373  		dumpregs(r)
   374  	}
   375  
   376  	if docrash {
   377  		dieFromException(info, r)
   378  	}
   379  
   380  	exit(2)
   381  }
   382  
   383  func sigpanic() {
   384  	gp := getg()
   385  	if !canpanic() {
   386  		throw("unexpected signal during runtime execution")
   387  	}
   388  
   389  	switch gp.sig {
   390  	case _EXCEPTION_ACCESS_VIOLATION, _EXCEPTION_IN_PAGE_ERROR:
   391  		if gp.sigcode1 < 0x1000 {
   392  			panicmem()
   393  		}
   394  		if gp.paniconfault {
   395  			panicmemAddr(gp.sigcode1)
   396  		}
   397  		if inUserArenaChunk(gp.sigcode1) {
   398  			// We could check that the arena chunk is explicitly set to fault,
   399  			// but the fact that we faulted on accessing it is enough to prove
   400  			// that it is.
   401  			print("accessed data from freed user arena ", hex(gp.sigcode1), "\n")
   402  		} else {
   403  			print("unexpected fault address ", hex(gp.sigcode1), "\n")
   404  		}
   405  		throw("fault")
   406  	case _EXCEPTION_INT_DIVIDE_BY_ZERO:
   407  		panicdivide()
   408  	case _EXCEPTION_INT_OVERFLOW:
   409  		panicoverflow()
   410  	case _EXCEPTION_FLT_DENORMAL_OPERAND,
   411  		_EXCEPTION_FLT_DIVIDE_BY_ZERO,
   412  		_EXCEPTION_FLT_INEXACT_RESULT,
   413  		_EXCEPTION_FLT_OVERFLOW,
   414  		_EXCEPTION_FLT_UNDERFLOW:
   415  		panicfloat()
   416  	}
   417  	throw("fault")
   418  }
   419  
   420  // Following are not implemented.
   421  
   422  func initsig(preinit bool) {
   423  }
   424  
   425  func sigenable(sig uint32) {
   426  }
   427  
   428  func sigdisable(sig uint32) {
   429  }
   430  
   431  func sigignore(sig uint32) {
   432  }
   433  
   434  func signame(sig uint32) string {
   435  	return ""
   436  }
   437  
   438  //go:nosplit
   439  func crash() {
   440  	dieFromException(nil, nil)
   441  }
   442  
   443  // dieFromException raises an exception that bypasses all exception handlers.
   444  // This provides the expected exit status for the shell.
   445  //
   446  //go:nosplit
   447  func dieFromException(info *exceptionrecord, r *context) {
   448  	if info == nil {
   449  		gp := getg()
   450  		if gp.sig != 0 {
   451  			// Try to reconstruct an exception record from
   452  			// the exception information stored in gp.
   453  			info = &exceptionrecord{
   454  				exceptionaddress: gp.sigpc,
   455  				exceptioncode:    gp.sig,
   456  				numberparameters: 2,
   457  			}
   458  			info.exceptioninformation[0] = gp.sigcode0
   459  			info.exceptioninformation[1] = gp.sigcode1
   460  		} else {
   461  			// By default, a failing Go application exits with exit code 2.
   462  			// Use this value when gp does not contain exception info.
   463  			info = &exceptionrecord{
   464  				exceptioncode: 2,
   465  			}
   466  		}
   467  	}
   468  	const FAIL_FAST_GENERATE_EXCEPTION_ADDRESS = 0x1
   469  	stdcall(_RaiseFailFastException, uintptr(unsafe.Pointer(info)), uintptr(unsafe.Pointer(r)), FAIL_FAST_GENERATE_EXCEPTION_ADDRESS)
   470  }
   471  
   472  // gsignalStack is unused on Windows.
   473  type gsignalStack struct{}
   474
View as plain text