1 /*
2  * Copyright (C) 2008 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 
18 #include "fault_handler.h"
19 
20 #include <sys/ucontext.h>
21 #include "base/macros.h"
22 #include "base/hex_dump.h"
23 #include "globals.h"
24 #include "base/logging.h"
25 #include "base/hex_dump.h"
26 #include "instruction_set.h"
27 #include "mirror/art_method.h"
28 #include "mirror/art_method-inl.h"
29 #include "thread.h"
30 #include "thread-inl.h"
31 
32 //
33 // ARM specific fault handler functions.
34 //
35 
36 namespace art {
37 
38 extern "C" void art_quick_throw_null_pointer_exception();
39 extern "C" void art_quick_throw_stack_overflow();
40 extern "C" void art_quick_implicit_suspend();
41 
42 // Get the size of a thumb2 instruction in bytes.
GetInstructionSize(uint8_t * pc)43 static uint32_t GetInstructionSize(uint8_t* pc) {
44   uint16_t instr = pc[0] | pc[1] << 8;
45   bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800);
46   uint32_t instr_size = is_32bit ? 4 : 2;
47   return instr_size;
48 }
49 
HandleNestedSignal(int sig,siginfo_t * info,void * context)50 void FaultManager::HandleNestedSignal(int sig, siginfo_t* info, void* context) {
51   // Note that in this handler we set up the registers and return to
52   // longjmp directly rather than going through an assembly language stub.  The
53   // reason for this is that longjmp is (currently) in ARM mode and that would
54   // require switching modes in the stub - incurring an unwanted relocation.
55 
56   struct ucontext *uc = reinterpret_cast<struct ucontext*>(context);
57   struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
58   Thread* self = Thread::Current();
59   CHECK(self != nullptr);       // This will cause a SIGABRT if self is nullptr.
60 
61   sc->arm_r0 = reinterpret_cast<uintptr_t>(*self->GetNestedSignalState());
62   sc->arm_r1 = 1;
63   sc->arm_pc = reinterpret_cast<uintptr_t>(longjmp);
64   VLOG(signals) << "longjmp address: " << reinterpret_cast<void*>(sc->arm_pc);
65 }
66 
GetMethodAndReturnPcAndSp(siginfo_t * siginfo,void * context,mirror::ArtMethod ** out_method,uintptr_t * out_return_pc,uintptr_t * out_sp)67 void FaultManager::GetMethodAndReturnPcAndSp(siginfo_t* siginfo, void* context,
68                                              mirror::ArtMethod** out_method,
69                                              uintptr_t* out_return_pc, uintptr_t* out_sp) {
70   struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
71   struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
72   *out_sp = static_cast<uintptr_t>(sc->arm_sp);
73   VLOG(signals) << "sp: " << *out_sp;
74   if (*out_sp == 0) {
75     return;
76   }
77 
78   // In the case of a stack overflow, the stack is not valid and we can't
79   // get the method from the top of the stack.  However it's in r0.
80   uintptr_t* fault_addr = reinterpret_cast<uintptr_t*>(sc->fault_address);
81   uintptr_t* overflow_addr = reinterpret_cast<uintptr_t*>(
82       reinterpret_cast<uint8_t*>(*out_sp) - GetStackOverflowReservedBytes(kArm));
83   if (overflow_addr == fault_addr) {
84     *out_method = reinterpret_cast<mirror::ArtMethod*>(sc->arm_r0);
85   } else {
86     // The method is at the top of the stack.
87     *out_method = reinterpret_cast<mirror::ArtMethod*>(reinterpret_cast<uintptr_t*>(*out_sp)[0]);
88   }
89 
90   // Work out the return PC.  This will be the address of the instruction
91   // following the faulting ldr/str instruction.  This is in thumb mode so
92   // the instruction might be a 16 or 32 bit one.  Also, the GC map always
93   // has the bottom bit of the PC set so we also need to set that.
94 
95   // Need to work out the size of the instruction that caused the exception.
96   uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
97   VLOG(signals) << "pc: " << std::hex << static_cast<void*>(ptr);
98   uint32_t instr_size = GetInstructionSize(ptr);
99 
100   *out_return_pc = (sc->arm_pc + instr_size) | 1;
101 }
102 
Action(int sig,siginfo_t * info,void * context)103 bool NullPointerHandler::Action(int sig, siginfo_t* info, void* context) {
104   // The code that looks for the catch location needs to know the value of the
105   // ARM PC at the point of call.  For Null checks we insert a GC map that is immediately after
106   // the load/store instruction that might cause the fault.  However the mapping table has
107   // the low bits set for thumb mode so we need to set the bottom bit for the LR
108   // register in order to find the mapping.
109 
110   // Need to work out the size of the instruction that caused the exception.
111   struct ucontext *uc = reinterpret_cast<struct ucontext*>(context);
112   struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
113   uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
114 
115   uint32_t instr_size = GetInstructionSize(ptr);
116   sc->arm_lr = (sc->arm_pc + instr_size) | 1;      // LR needs to point to gc map location
117   sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception);
118   VLOG(signals) << "Generating null pointer exception";
119   return true;
120 }
121 
122 // A suspend check is done using the following instruction sequence:
123 // 0xf723c0b2: f8d902c0  ldr.w   r0, [r9, #704]  ; suspend_trigger_
124 // .. some intervening instruction
125 // 0xf723c0b6: 6800      ldr     r0, [r0, #0]
126 
127 // The offset from r9 is Thread::ThreadSuspendTriggerOffset().
128 // To check for a suspend check, we examine the instructions that caused
129 // the fault (at PC-4 and PC).
Action(int sig,siginfo_t * info,void * context)130 bool SuspensionHandler::Action(int sig, siginfo_t* info, void* context) {
131   // These are the instructions to check for.  The first one is the ldr r0,[r9,#xxx]
132   // where xxx is the offset of the suspend trigger.
133   uint32_t checkinst1 = 0xf8d90000 + Thread::ThreadSuspendTriggerOffset<4>().Int32Value();
134   uint16_t checkinst2 = 0x6800;
135 
136   struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
137   struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
138   uint8_t* ptr2 = reinterpret_cast<uint8_t*>(sc->arm_pc);
139   uint8_t* ptr1 = ptr2 - 4;
140   VLOG(signals) << "checking suspend";
141 
142   uint16_t inst2 = ptr2[0] | ptr2[1] << 8;
143   VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2;
144   if (inst2 != checkinst2) {
145     // Second instruction is not good, not ours.
146     return false;
147   }
148 
149   // The first instruction can a little bit up the stream due to load hoisting
150   // in the compiler.
151   uint8_t* limit = ptr1 - 40;   // Compiler will hoist to a max of 20 instructions.
152   bool found = false;
153   while (ptr1 > limit) {
154     uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8);
155     VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1;
156     if (inst1 == checkinst1) {
157       found = true;
158       break;
159     }
160     ptr1 -= 2;      // Min instruction size is 2 bytes.
161   }
162   if (found) {
163     VLOG(signals) << "suspend check match";
164     // This is a suspend check.  Arrange for the signal handler to return to
165     // art_quick_implicit_suspend.  Also set LR so that after the suspend check it
166     // will resume the instruction (current PC + 2).  PC points to the
167     // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger).
168 
169     // NB: remember that we need to set the bottom bit of the LR register
170     // to switch to thumb mode.
171     VLOG(signals) << "arm lr: " << std::hex << sc->arm_lr;
172     VLOG(signals) << "arm pc: " << std::hex << sc->arm_pc;
173     sc->arm_lr = sc->arm_pc + 3;      // +2 + 1 (for thumb)
174     sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend);
175 
176     // Now remove the suspend trigger that caused this fault.
177     Thread::Current()->RemoveSuspendTrigger();
178     VLOG(signals) << "removed suspend trigger invoking test suspend";
179     return true;
180   }
181   return false;
182 }
183 
184 // Stack overflow fault handler.
185 //
186 // This checks that the fault address is equal to the current stack pointer
187 // minus the overflow region size (16K typically).  The instruction sequence
188 // that generates this signal is:
189 //
190 // sub r12,sp,#16384
191 // ldr.w r12,[r12,#0]
192 //
193 // The second instruction will fault if r12 is inside the protected region
194 // on the stack.
195 //
196 // If we determine this is a stack overflow we need to move the stack pointer
197 // to the overflow region below the protected region.
198 
Action(int sig,siginfo_t * info,void * context)199 bool StackOverflowHandler::Action(int sig, siginfo_t* info, void* context) {
200   struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
201   struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
202   VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc;
203   VLOG(signals) << "sigcontext: " << std::hex << sc;
204 
205   uintptr_t sp = sc->arm_sp;
206   VLOG(signals) << "sp: " << std::hex << sp;
207 
208   uintptr_t fault_addr = sc->fault_address;
209   VLOG(signals) << "fault_addr: " << std::hex << fault_addr;
210   VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp <<
211     ", fault_addr: " << fault_addr;
212 
213   uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(kArm);
214 
215   // Check that the fault address is the value expected for a stack overflow.
216   if (fault_addr != overflow_addr) {
217     VLOG(signals) << "Not a stack overflow";
218     return false;
219   }
220 
221   VLOG(signals) << "Stack overflow found";
222 
223   // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from.
224   // The value of LR must be the same as it was when we entered the code that
225   // caused this fault.  This will be inserted into a callee save frame by
226   // the function to which this handler returns (art_quick_throw_stack_overflow).
227   sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow);
228 
229   // The kernel will now return to the address in sc->arm_pc.
230   return true;
231 }
232 }       // namespace art
233