1 /*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "fault_handler.h"
18
19 #include <sys/ucontext.h>
20
21 #include "arch/instruction_set.h"
22 #include "art_method.h"
23 #include "base/hex_dump.h"
24 #include "base/logging.h" // For VLOG.
25 #include "base/macros.h"
26 #include "base/pointer_size.h"
27 #include "runtime_globals.h"
28 #include "thread-current-inl.h"
29
30 //
31 // ARM specific fault handler functions.
32 //
33
34 namespace art HIDDEN {
35
36 extern "C" void art_quick_throw_null_pointer_exception_from_signal();
37 extern "C" void art_quick_throw_stack_overflow();
38 extern "C" void art_quick_implicit_suspend();
39
40 // Get the size of a thumb2 instruction in bytes.
GetInstructionSize(uint8_t * pc)41 static uint32_t GetInstructionSize(uint8_t* pc) {
42 uint16_t instr = pc[0] | pc[1] << 8;
43 bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800);
44 uint32_t instr_size = is_32bit ? 4 : 2;
45 return instr_size;
46 }
47
GetFaultPc(siginfo_t * siginfo,void * context)48 uintptr_t FaultManager::GetFaultPc([[maybe_unused]] siginfo_t* siginfo, void* context) {
49 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
50 mcontext_t* mc = reinterpret_cast<mcontext_t*>(&uc->uc_mcontext);
51 if (mc->arm_sp == 0) {
52 VLOG(signals) << "Missing SP";
53 return 0u;
54 }
55 return mc->arm_pc;
56 }
57
GetFaultSp(void * context)58 uintptr_t FaultManager::GetFaultSp(void* context) {
59 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
60 mcontext_t* mc = reinterpret_cast<mcontext_t*>(&uc->uc_mcontext);
61 return mc->arm_sp;
62 }
63
Action(int sig,siginfo_t * info,void * context)64 bool NullPointerHandler::Action([[maybe_unused]] int sig, siginfo_t* info, void* context) {
65 uintptr_t fault_address = reinterpret_cast<uintptr_t>(info->si_addr);
66 if (!IsValidFaultAddress(fault_address)) {
67 return false;
68 }
69
70 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
71 mcontext_t* mc = reinterpret_cast<mcontext_t*>(&uc->uc_mcontext);
72 ArtMethod** sp = reinterpret_cast<ArtMethod**>(mc->arm_sp);
73 if (!IsValidMethod(*sp)) {
74 return false;
75 }
76
77 // For null checks in compiled code we insert a stack map that is immediately
78 // after the load/store instruction that might cause the fault and we need to
79 // pass the return PC to the handler. For null checks in Nterp, we similarly
80 // need the return PC to recognize that this was a null check in Nterp, so
81 // that the handler can get the needed data from the Nterp frame.
82
83 // Note: Currently, Nterp is compiled to the A32 instruction set and managed
84 // code is compiled to the T32 instruction set.
85 // To find the stack map for compiled code, we need to set the bottom bit in
86 // the return PC indicating T32 just like we would if we were going to return
87 // to that PC (though we're going to jump to the exception handler instead).
88
89 // Need to work out the size of the instruction that caused the exception.
90 uint8_t* ptr = reinterpret_cast<uint8_t*>(mc->arm_pc);
91 bool in_thumb_mode = mc->arm_cpsr & (1 << 5);
92 uint32_t instr_size = in_thumb_mode ? GetInstructionSize(ptr) : 4;
93 uintptr_t return_pc = (mc->arm_pc + instr_size) | (in_thumb_mode ? 1 : 0);
94
95 // Push the return PC to the stack and pass the fault address in LR.
96 mc->arm_sp -= sizeof(uintptr_t);
97 *reinterpret_cast<uintptr_t*>(mc->arm_sp) = return_pc;
98 mc->arm_lr = fault_address;
99
100 // Arrange for the signal handler to return to the NPE entrypoint.
101 mc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception_from_signal);
102 // Make sure the thumb bit is set as the handler is in thumb mode.
103 mc->arm_cpsr = mc->arm_cpsr | (1 << 5);
104 // Pass the faulting address as the first argument of
105 // art_quick_throw_null_pointer_exception_from_signal.
106 VLOG(signals) << "Generating null pointer exception";
107 return true;
108 }
109
110 // A suspend check is done using the following instruction sequence:
111 // 0xf723c0b2: f8d902c0 ldr.w r0, [r9, #704] ; suspend_trigger_
112 // .. some intervening instruction
113 // 0xf723c0b6: 6800 ldr r0, [r0, #0]
114
115 // The offset from r9 is Thread::ThreadSuspendTriggerOffset().
116 // To check for a suspend check, we examine the instructions that caused
117 // the fault (at PC-4 and PC).
Action(int sig,siginfo_t * info,void * context)118 bool SuspensionHandler::Action([[maybe_unused]] int sig,
119 [[maybe_unused]] siginfo_t* info,
120 void* context) {
121 // These are the instructions to check for. The first one is the ldr r0,[r9,#xxx]
122 // where xxx is the offset of the suspend trigger.
123 uint32_t checkinst1 = 0xf8d90000
124 + Thread::ThreadSuspendTriggerOffset<PointerSize::k32>().Int32Value();
125 uint16_t checkinst2 = 0x6800;
126
127 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
128 mcontext_t* mc = reinterpret_cast<mcontext_t*>(&uc->uc_mcontext);
129 uint8_t* ptr2 = reinterpret_cast<uint8_t*>(mc->arm_pc);
130 uint8_t* ptr1 = ptr2 - 4;
131 VLOG(signals) << "checking suspend";
132
133 uint16_t inst2 = ptr2[0] | ptr2[1] << 8;
134 VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2;
135 if (inst2 != checkinst2) {
136 // Second instruction is not good, not ours.
137 return false;
138 }
139
140 // The first instruction can a little bit up the stream due to load hoisting
141 // in the compiler.
142 uint8_t* limit = ptr1 - 40; // Compiler will hoist to a max of 20 instructions.
143 bool found = false;
144 while (ptr1 > limit) {
145 uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8);
146 VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1;
147 if (inst1 == checkinst1) {
148 found = true;
149 break;
150 }
151 ptr1 -= 2; // Min instruction size is 2 bytes.
152 }
153 if (found) {
154 VLOG(signals) << "suspend check match";
155 // This is a suspend check. Arrange for the signal handler to return to
156 // art_quick_implicit_suspend. Also set LR so that after the suspend check it
157 // will resume the instruction (current PC + 2). PC points to the
158 // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger).
159
160 // NB: remember that we need to set the bottom bit of the LR register
161 // to switch to thumb mode.
162 VLOG(signals) << "arm lr: " << std::hex << mc->arm_lr;
163 VLOG(signals) << "arm pc: " << std::hex << mc->arm_pc;
164 mc->arm_lr = mc->arm_pc + 3; // +2 + 1 (for thumb)
165 mc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend);
166
167 // Now remove the suspend trigger that caused this fault.
168 Thread::Current()->RemoveSuspendTrigger();
169 VLOG(signals) << "removed suspend trigger invoking test suspend";
170 return true;
171 }
172 return false;
173 }
174
175 // Stack overflow fault handler.
176 //
177 // This checks that the fault address is equal to the current stack pointer
178 // minus the overflow region size (16K typically). The instruction sequence
179 // that generates this signal is:
180 //
181 // sub r12,sp,#16384
182 // ldr.w r12,[r12,#0]
183 //
184 // The second instruction will fault if r12 is inside the protected region
185 // on the stack.
186 //
187 // If we determine this is a stack overflow we need to move the stack pointer
188 // to the overflow region below the protected region.
189
Action(int sig,siginfo_t * info,void * context)190 bool StackOverflowHandler::Action([[maybe_unused]] int sig,
191 [[maybe_unused]] siginfo_t* info,
192 void* context) {
193 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
194 mcontext_t* mc = reinterpret_cast<mcontext_t*>(&uc->uc_mcontext);
195 VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc;
196 VLOG(signals) << "sigcontext: " << std::hex << mc;
197
198 uintptr_t sp = mc->arm_sp;
199 VLOG(signals) << "sp: " << std::hex << sp;
200
201 uintptr_t fault_addr = mc->fault_address;
202 VLOG(signals) << "fault_addr: " << std::hex << fault_addr;
203 VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp <<
204 ", fault_addr: " << fault_addr;
205
206 uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(InstructionSet::kArm);
207
208 // Check that the fault address is the value expected for a stack overflow.
209 if (fault_addr != overflow_addr) {
210 VLOG(signals) << "Not a stack overflow";
211 return false;
212 }
213
214 VLOG(signals) << "Stack overflow found";
215
216 // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from.
217 // The value of LR must be the same as it was when we entered the code that
218 // caused this fault. This will be inserted into a callee save frame by
219 // the function to which this handler returns (art_quick_throw_stack_overflow).
220 mc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow);
221
222 // Make sure the thumb bit is set as the handler is in thumb mode.
223 mc->arm_cpsr = mc->arm_cpsr | (1 << 5);
224
225 // The kernel will now return to the address in sc->arm_pc.
226 return true;
227 }
228 } // namespace art
229