1 /*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "fault_handler.h"
18
19 #include <sys/ucontext.h>
20
21 #include "arch/instruction_set.h"
22 #include "art_method.h"
23 #include "base/enums.h"
24 #include "base/hex_dump.h"
25 #include "base/logging.h" // For VLOG.
26 #include "base/macros.h"
27 #include "runtime_globals.h"
28 #include "thread-current-inl.h"
29
30 //
31 // ARM specific fault handler functions.
32 //
33
34 namespace art {
35
36 extern "C" void art_quick_throw_null_pointer_exception_from_signal();
37 extern "C" void art_quick_throw_stack_overflow();
38 extern "C" void art_quick_implicit_suspend();
39
40 // Get the size of a thumb2 instruction in bytes.
GetInstructionSize(uint8_t * pc)41 static uint32_t GetInstructionSize(uint8_t* pc) {
42 uint16_t instr = pc[0] | pc[1] << 8;
43 bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800);
44 uint32_t instr_size = is_32bit ? 4 : 2;
45 return instr_size;
46 }
47
GetMethodAndReturnPcAndSp(siginfo_t * siginfo ATTRIBUTE_UNUSED,void * context,ArtMethod ** out_method,uintptr_t * out_return_pc,uintptr_t * out_sp,bool * out_is_stack_overflow)48 void FaultManager::GetMethodAndReturnPcAndSp(siginfo_t* siginfo ATTRIBUTE_UNUSED,
49 void* context,
50 ArtMethod** out_method,
51 uintptr_t* out_return_pc,
52 uintptr_t* out_sp,
53 bool* out_is_stack_overflow) {
54 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
55 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
56 *out_sp = static_cast<uintptr_t>(sc->arm_sp);
57 VLOG(signals) << "sp: " << std::hex << *out_sp;
58 if (*out_sp == 0) {
59 return;
60 }
61
62 // In the case of a stack overflow, the stack is not valid and we can't
63 // get the method from the top of the stack. However it's in r0.
64 uintptr_t* fault_addr = reinterpret_cast<uintptr_t*>(sc->fault_address);
65 uintptr_t* overflow_addr = reinterpret_cast<uintptr_t*>(
66 reinterpret_cast<uint8_t*>(*out_sp) - GetStackOverflowReservedBytes(InstructionSet::kArm));
67 if (overflow_addr == fault_addr) {
68 *out_method = reinterpret_cast<ArtMethod*>(sc->arm_r0);
69 *out_is_stack_overflow = true;
70 } else {
71 // The method is at the top of the stack.
72 *out_method = reinterpret_cast<ArtMethod*>(reinterpret_cast<uintptr_t*>(*out_sp)[0]);
73 *out_is_stack_overflow = false;
74 }
75
76 // Work out the return PC. This will be the address of the instruction
77 // following the faulting ldr/str instruction. This is in thumb mode so
78 // the instruction might be a 16 or 32 bit one. Also, the GC map always
79 // has the bottom bit of the PC set so we also need to set that.
80
81 // Need to work out the size of the instruction that caused the exception.
82 uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
83 VLOG(signals) << "pc: " << std::hex << static_cast<void*>(ptr);
84
85 if (ptr == nullptr) {
86 // Somebody jumped to 0x0. Definitely not ours, and will definitely segfault below.
87 *out_method = nullptr;
88 return;
89 }
90
91 uint32_t instr_size = GetInstructionSize(ptr);
92
93 *out_return_pc = (sc->arm_pc + instr_size) | 1;
94 }
95
Action(int sig ATTRIBUTE_UNUSED,siginfo_t * info,void * context)96 bool NullPointerHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info, void* context) {
97 if (!IsValidImplicitCheck(info)) {
98 return false;
99 }
100 // The code that looks for the catch location needs to know the value of the
101 // ARM PC at the point of call. For Null checks we insert a GC map that is immediately after
102 // the load/store instruction that might cause the fault. However the mapping table has
103 // the low bits set for thumb mode so we need to set the bottom bit for the LR
104 // register in order to find the mapping.
105
106 // Need to work out the size of the instruction that caused the exception.
107 struct ucontext *uc = reinterpret_cast<struct ucontext*>(context);
108 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
109 uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
110 bool in_thumb_mode = sc->arm_cpsr & (1 << 5);
111 uint32_t instr_size = in_thumb_mode ? GetInstructionSize(ptr) : 4;
112 uintptr_t gc_map_location = (sc->arm_pc + instr_size) | (in_thumb_mode ? 1 : 0);
113
114 // Push the gc map location to the stack and pass the fault address in LR.
115 sc->arm_sp -= sizeof(uintptr_t);
116 *reinterpret_cast<uintptr_t*>(sc->arm_sp) = gc_map_location;
117 sc->arm_lr = reinterpret_cast<uintptr_t>(info->si_addr);
118 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception_from_signal);
119 // Make sure the thumb bit is set as the handler is in thumb mode.
120 sc->arm_cpsr = sc->arm_cpsr | (1 << 5);
121 // Pass the faulting address as the first argument of
122 // art_quick_throw_null_pointer_exception_from_signal.
123 VLOG(signals) << "Generating null pointer exception";
124 return true;
125 }
126
127 // A suspend check is done using the following instruction sequence:
128 // 0xf723c0b2: f8d902c0 ldr.w r0, [r9, #704] ; suspend_trigger_
129 // .. some intervening instruction
130 // 0xf723c0b6: 6800 ldr r0, [r0, #0]
131
132 // The offset from r9 is Thread::ThreadSuspendTriggerOffset().
133 // To check for a suspend check, we examine the instructions that caused
134 // the fault (at PC-4 and PC).
Action(int sig ATTRIBUTE_UNUSED,siginfo_t * info ATTRIBUTE_UNUSED,void * context)135 bool SuspensionHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
136 void* context) {
137 // These are the instructions to check for. The first one is the ldr r0,[r9,#xxx]
138 // where xxx is the offset of the suspend trigger.
139 uint32_t checkinst1 = 0xf8d90000
140 + Thread::ThreadSuspendTriggerOffset<PointerSize::k32>().Int32Value();
141 uint16_t checkinst2 = 0x6800;
142
143 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
144 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
145 uint8_t* ptr2 = reinterpret_cast<uint8_t*>(sc->arm_pc);
146 uint8_t* ptr1 = ptr2 - 4;
147 VLOG(signals) << "checking suspend";
148
149 uint16_t inst2 = ptr2[0] | ptr2[1] << 8;
150 VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2;
151 if (inst2 != checkinst2) {
152 // Second instruction is not good, not ours.
153 return false;
154 }
155
156 // The first instruction can a little bit up the stream due to load hoisting
157 // in the compiler.
158 uint8_t* limit = ptr1 - 40; // Compiler will hoist to a max of 20 instructions.
159 bool found = false;
160 while (ptr1 > limit) {
161 uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8);
162 VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1;
163 if (inst1 == checkinst1) {
164 found = true;
165 break;
166 }
167 ptr1 -= 2; // Min instruction size is 2 bytes.
168 }
169 if (found) {
170 VLOG(signals) << "suspend check match";
171 // This is a suspend check. Arrange for the signal handler to return to
172 // art_quick_implicit_suspend. Also set LR so that after the suspend check it
173 // will resume the instruction (current PC + 2). PC points to the
174 // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger).
175
176 // NB: remember that we need to set the bottom bit of the LR register
177 // to switch to thumb mode.
178 VLOG(signals) << "arm lr: " << std::hex << sc->arm_lr;
179 VLOG(signals) << "arm pc: " << std::hex << sc->arm_pc;
180 sc->arm_lr = sc->arm_pc + 3; // +2 + 1 (for thumb)
181 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend);
182
183 // Now remove the suspend trigger that caused this fault.
184 Thread::Current()->RemoveSuspendTrigger();
185 VLOG(signals) << "removed suspend trigger invoking test suspend";
186 return true;
187 }
188 return false;
189 }
190
191 // Stack overflow fault handler.
192 //
193 // This checks that the fault address is equal to the current stack pointer
194 // minus the overflow region size (16K typically). The instruction sequence
195 // that generates this signal is:
196 //
197 // sub r12,sp,#16384
198 // ldr.w r12,[r12,#0]
199 //
200 // The second instruction will fault if r12 is inside the protected region
201 // on the stack.
202 //
203 // If we determine this is a stack overflow we need to move the stack pointer
204 // to the overflow region below the protected region.
205
Action(int sig ATTRIBUTE_UNUSED,siginfo_t * info ATTRIBUTE_UNUSED,void * context)206 bool StackOverflowHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
207 void* context) {
208 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
209 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
210 VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc;
211 VLOG(signals) << "sigcontext: " << std::hex << sc;
212
213 uintptr_t sp = sc->arm_sp;
214 VLOG(signals) << "sp: " << std::hex << sp;
215
216 uintptr_t fault_addr = sc->fault_address;
217 VLOG(signals) << "fault_addr: " << std::hex << fault_addr;
218 VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp <<
219 ", fault_addr: " << fault_addr;
220
221 uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(InstructionSet::kArm);
222
223 // Check that the fault address is the value expected for a stack overflow.
224 if (fault_addr != overflow_addr) {
225 VLOG(signals) << "Not a stack overflow";
226 return false;
227 }
228
229 VLOG(signals) << "Stack overflow found";
230
231 // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from.
232 // The value of LR must be the same as it was when we entered the code that
233 // caused this fault. This will be inserted into a callee save frame by
234 // the function to which this handler returns (art_quick_throw_stack_overflow).
235 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow);
236
237 // Make sure the thumb bit is set as the handler is in thumb mode.
238 sc->arm_cpsr = sc->arm_cpsr | (1 << 5);
239
240 // The kernel will now return to the address in sc->arm_pc.
241 return true;
242 }
243 } // namespace art
244