1 /* 2 * Copyright (C) 2008 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include "fault_handler.h" 18 19 #include <sys/ucontext.h> 20 21 #include "arch/instruction_set.h" 22 #include "art_method.h" 23 #include "base/enums.h" 24 #include "base/hex_dump.h" 25 #include "base/logging.h" // For VLOG. 26 #include "base/macros.h" 27 #include "runtime_globals.h" 28 #include "thread-current-inl.h" 29 30 // 31 // ARM specific fault handler functions. 32 // 33 34 namespace art { 35 36 extern "C" void art_quick_throw_null_pointer_exception_from_signal(); 37 extern "C" void art_quick_throw_stack_overflow(); 38 extern "C" void art_quick_implicit_suspend(); 39 40 // Get the size of a thumb2 instruction in bytes. 41 static uint32_t GetInstructionSize(uint8_t* pc) { 42 uint16_t instr = pc[0] | pc[1] << 8; 43 bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800); 44 uint32_t instr_size = is_32bit ? 4 : 2; 45 return instr_size; 46 } 47 48 void FaultManager::GetMethodAndReturnPcAndSp(siginfo_t* siginfo ATTRIBUTE_UNUSED, void* context, 49 ArtMethod** out_method, 50 uintptr_t* out_return_pc, uintptr_t* out_sp) { 51 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); 52 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); 53 *out_sp = static_cast<uintptr_t>(sc->arm_sp); 54 VLOG(signals) << "sp: " << std::hex << *out_sp; 55 if (*out_sp == 0) { 56 return; 57 } 58 59 // In the case of a stack overflow, the stack is not valid and we can't 60 // get the method from the top of the stack. However it's in r0. 61 uintptr_t* fault_addr = reinterpret_cast<uintptr_t*>(sc->fault_address); 62 uintptr_t* overflow_addr = reinterpret_cast<uintptr_t*>( 63 reinterpret_cast<uint8_t*>(*out_sp) - GetStackOverflowReservedBytes(InstructionSet::kArm)); 64 if (overflow_addr == fault_addr) { 65 *out_method = reinterpret_cast<ArtMethod*>(sc->arm_r0); 66 } else { 67 // The method is at the top of the stack. 68 *out_method = reinterpret_cast<ArtMethod*>(reinterpret_cast<uintptr_t*>(*out_sp)[0]); 69 } 70 71 // Work out the return PC. This will be the address of the instruction 72 // following the faulting ldr/str instruction. This is in thumb mode so 73 // the instruction might be a 16 or 32 bit one. Also, the GC map always 74 // has the bottom bit of the PC set so we also need to set that. 75 76 // Need to work out the size of the instruction that caused the exception. 77 uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc); 78 VLOG(signals) << "pc: " << std::hex << static_cast<void*>(ptr); 79 80 if (ptr == nullptr) { 81 // Somebody jumped to 0x0. Definitely not ours, and will definitely segfault below. 82 *out_method = nullptr; 83 return; 84 } 85 86 uint32_t instr_size = GetInstructionSize(ptr); 87 88 *out_return_pc = (sc->arm_pc + instr_size) | 1; 89 } 90 91 bool NullPointerHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info, void* context) { 92 if (!IsValidImplicitCheck(info)) { 93 return false; 94 } 95 // The code that looks for the catch location needs to know the value of the 96 // ARM PC at the point of call. For Null checks we insert a GC map that is immediately after 97 // the load/store instruction that might cause the fault. However the mapping table has 98 // the low bits set for thumb mode so we need to set the bottom bit for the LR 99 // register in order to find the mapping. 100 101 // Need to work out the size of the instruction that caused the exception. 102 struct ucontext *uc = reinterpret_cast<struct ucontext*>(context); 103 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); 104 uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc); 105 uint32_t instr_size = GetInstructionSize(ptr); 106 uintptr_t gc_map_location = (sc->arm_pc + instr_size) | 1; 107 108 // Push the gc map location to the stack and pass the fault address in LR. 109 sc->arm_sp -= sizeof(uintptr_t); 110 *reinterpret_cast<uintptr_t*>(sc->arm_sp) = gc_map_location; 111 sc->arm_lr = reinterpret_cast<uintptr_t>(info->si_addr); 112 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception_from_signal); 113 // Pass the faulting address as the first argument of 114 // art_quick_throw_null_pointer_exception_from_signal. 115 VLOG(signals) << "Generating null pointer exception"; 116 return true; 117 } 118 119 // A suspend check is done using the following instruction sequence: 120 // 0xf723c0b2: f8d902c0 ldr.w r0, [r9, #704] ; suspend_trigger_ 121 // .. some intervening instruction 122 // 0xf723c0b6: 6800 ldr r0, [r0, #0] 123 124 // The offset from r9 is Thread::ThreadSuspendTriggerOffset(). 125 // To check for a suspend check, we examine the instructions that caused 126 // the fault (at PC-4 and PC). 127 bool SuspensionHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED, 128 void* context) { 129 // These are the instructions to check for. The first one is the ldr r0,[r9,#xxx] 130 // where xxx is the offset of the suspend trigger. 131 uint32_t checkinst1 = 0xf8d90000 132 + Thread::ThreadSuspendTriggerOffset<PointerSize::k32>().Int32Value(); 133 uint16_t checkinst2 = 0x6800; 134 135 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); 136 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); 137 uint8_t* ptr2 = reinterpret_cast<uint8_t*>(sc->arm_pc); 138 uint8_t* ptr1 = ptr2 - 4; 139 VLOG(signals) << "checking suspend"; 140 141 uint16_t inst2 = ptr2[0] | ptr2[1] << 8; 142 VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2; 143 if (inst2 != checkinst2) { 144 // Second instruction is not good, not ours. 145 return false; 146 } 147 148 // The first instruction can a little bit up the stream due to load hoisting 149 // in the compiler. 150 uint8_t* limit = ptr1 - 40; // Compiler will hoist to a max of 20 instructions. 151 bool found = false; 152 while (ptr1 > limit) { 153 uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8); 154 VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1; 155 if (inst1 == checkinst1) { 156 found = true; 157 break; 158 } 159 ptr1 -= 2; // Min instruction size is 2 bytes. 160 } 161 if (found) { 162 VLOG(signals) << "suspend check match"; 163 // This is a suspend check. Arrange for the signal handler to return to 164 // art_quick_implicit_suspend. Also set LR so that after the suspend check it 165 // will resume the instruction (current PC + 2). PC points to the 166 // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger). 167 168 // NB: remember that we need to set the bottom bit of the LR register 169 // to switch to thumb mode. 170 VLOG(signals) << "arm lr: " << std::hex << sc->arm_lr; 171 VLOG(signals) << "arm pc: " << std::hex << sc->arm_pc; 172 sc->arm_lr = sc->arm_pc + 3; // +2 + 1 (for thumb) 173 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend); 174 175 // Now remove the suspend trigger that caused this fault. 176 Thread::Current()->RemoveSuspendTrigger(); 177 VLOG(signals) << "removed suspend trigger invoking test suspend"; 178 return true; 179 } 180 return false; 181 } 182 183 // Stack overflow fault handler. 184 // 185 // This checks that the fault address is equal to the current stack pointer 186 // minus the overflow region size (16K typically). The instruction sequence 187 // that generates this signal is: 188 // 189 // sub r12,sp,#16384 190 // ldr.w r12,[r12,#0] 191 // 192 // The second instruction will fault if r12 is inside the protected region 193 // on the stack. 194 // 195 // If we determine this is a stack overflow we need to move the stack pointer 196 // to the overflow region below the protected region. 197 198 bool StackOverflowHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED, 199 void* context) { 200 struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); 201 struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); 202 VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc; 203 VLOG(signals) << "sigcontext: " << std::hex << sc; 204 205 uintptr_t sp = sc->arm_sp; 206 VLOG(signals) << "sp: " << std::hex << sp; 207 208 uintptr_t fault_addr = sc->fault_address; 209 VLOG(signals) << "fault_addr: " << std::hex << fault_addr; 210 VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp << 211 ", fault_addr: " << fault_addr; 212 213 uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(InstructionSet::kArm); 214 215 // Check that the fault address is the value expected for a stack overflow. 216 if (fault_addr != overflow_addr) { 217 VLOG(signals) << "Not a stack overflow"; 218 return false; 219 } 220 221 VLOG(signals) << "Stack overflow found"; 222 223 // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from. 224 // The value of LR must be the same as it was when we entered the code that 225 // caused this fault. This will be inserted into a callee save frame by 226 // the function to which this handler returns (art_quick_throw_stack_overflow). 227 sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow); 228 229 // The kernel will now return to the address in sc->arm_pc. 230 return true; 231 } 232 } // namespace art 233
