1/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17
18#include "fault_handler.h"
19
20#include <sys/ucontext.h>
21
22#include "art_method-inl.h"
23#include "base/macros.h"
24#include "base/hex_dump.h"
25#include "globals.h"
26#include "base/logging.h"
27#include "base/hex_dump.h"
28#include "thread.h"
29#include "thread-inl.h"
30
31//
32// ARM specific fault handler functions.
33//
34
35namespace art {
36
37extern "C" void art_quick_throw_null_pointer_exception();
38extern "C" void art_quick_throw_stack_overflow();
39extern "C" void art_quick_implicit_suspend();
40
41// Get the size of a thumb2 instruction in bytes.
42static uint32_t GetInstructionSize(uint8_t* pc) {
43  uint16_t instr = pc[0] | pc[1] << 8;
44  bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800);
45  uint32_t instr_size = is_32bit ? 4 : 2;
46  return instr_size;
47}
48
49void FaultManager::HandleNestedSignal(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
50                                      void* context) {
51  // Note that in this handler we set up the registers and return to
52  // longjmp directly rather than going through an assembly language stub.  The
53  // reason for this is that longjmp is (currently) in ARM mode and that would
54  // require switching modes in the stub - incurring an unwanted relocation.
55
56  struct ucontext *uc = reinterpret_cast<struct ucontext*>(context);
57  struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
58  Thread* self = Thread::Current();
59  CHECK(self != nullptr);  // This will cause a SIGABRT if self is null.
60
61  sc->arm_r0 = reinterpret_cast<uintptr_t>(*self->GetNestedSignalState());
62  sc->arm_r1 = 1;
63  sc->arm_pc = reinterpret_cast<uintptr_t>(longjmp);
64  VLOG(signals) << "longjmp address: " << reinterpret_cast<void*>(sc->arm_pc);
65}
66
67void FaultManager::GetMethodAndReturnPcAndSp(siginfo_t* siginfo ATTRIBUTE_UNUSED, void* context,
68                                             ArtMethod** out_method,
69                                             uintptr_t* out_return_pc, uintptr_t* out_sp) {
70  struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
71  struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
72  *out_sp = static_cast<uintptr_t>(sc->arm_sp);
73  VLOG(signals) << "sp: " << std::hex << *out_sp;
74  if (*out_sp == 0) {
75    return;
76  }
77
78  // In the case of a stack overflow, the stack is not valid and we can't
79  // get the method from the top of the stack.  However it's in r0.
80  uintptr_t* fault_addr = reinterpret_cast<uintptr_t*>(sc->fault_address);
81  uintptr_t* overflow_addr = reinterpret_cast<uintptr_t*>(
82      reinterpret_cast<uint8_t*>(*out_sp) - GetStackOverflowReservedBytes(kArm));
83  if (overflow_addr == fault_addr) {
84    *out_method = reinterpret_cast<ArtMethod*>(sc->arm_r0);
85  } else {
86    // The method is at the top of the stack.
87    *out_method = reinterpret_cast<ArtMethod*>(reinterpret_cast<uintptr_t*>(*out_sp)[0]);
88  }
89
90  // Work out the return PC.  This will be the address of the instruction
91  // following the faulting ldr/str instruction.  This is in thumb mode so
92  // the instruction might be a 16 or 32 bit one.  Also, the GC map always
93  // has the bottom bit of the PC set so we also need to set that.
94
95  // Need to work out the size of the instruction that caused the exception.
96  uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
97  VLOG(signals) << "pc: " << std::hex << static_cast<void*>(ptr);
98
99  if (ptr == nullptr) {
100    // Somebody jumped to 0x0. Definitely not ours, and will definitely segfault below.
101    *out_method = nullptr;
102    return;
103  }
104
105  uint32_t instr_size = GetInstructionSize(ptr);
106
107  *out_return_pc = (sc->arm_pc + instr_size) | 1;
108}
109
110bool NullPointerHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
111                                void* context) {
112  // The code that looks for the catch location needs to know the value of the
113  // ARM PC at the point of call.  For Null checks we insert a GC map that is immediately after
114  // the load/store instruction that might cause the fault.  However the mapping table has
115  // the low bits set for thumb mode so we need to set the bottom bit for the LR
116  // register in order to find the mapping.
117
118  // Need to work out the size of the instruction that caused the exception.
119  struct ucontext *uc = reinterpret_cast<struct ucontext*>(context);
120  struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
121  uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc);
122
123  uint32_t instr_size = GetInstructionSize(ptr);
124  sc->arm_lr = (sc->arm_pc + instr_size) | 1;      // LR needs to point to gc map location
125  sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception);
126  VLOG(signals) << "Generating null pointer exception";
127  return true;
128}
129
130// A suspend check is done using the following instruction sequence:
131// 0xf723c0b2: f8d902c0  ldr.w   r0, [r9, #704]  ; suspend_trigger_
132// .. some intervening instruction
133// 0xf723c0b6: 6800      ldr     r0, [r0, #0]
134
135// The offset from r9 is Thread::ThreadSuspendTriggerOffset().
136// To check for a suspend check, we examine the instructions that caused
137// the fault (at PC-4 and PC).
138bool SuspensionHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
139                               void* context) {
140  // These are the instructions to check for.  The first one is the ldr r0,[r9,#xxx]
141  // where xxx is the offset of the suspend trigger.
142  uint32_t checkinst1 = 0xf8d90000 + Thread::ThreadSuspendTriggerOffset<4>().Int32Value();
143  uint16_t checkinst2 = 0x6800;
144
145  struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
146  struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
147  uint8_t* ptr2 = reinterpret_cast<uint8_t*>(sc->arm_pc);
148  uint8_t* ptr1 = ptr2 - 4;
149  VLOG(signals) << "checking suspend";
150
151  uint16_t inst2 = ptr2[0] | ptr2[1] << 8;
152  VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2;
153  if (inst2 != checkinst2) {
154    // Second instruction is not good, not ours.
155    return false;
156  }
157
158  // The first instruction can a little bit up the stream due to load hoisting
159  // in the compiler.
160  uint8_t* limit = ptr1 - 40;   // Compiler will hoist to a max of 20 instructions.
161  bool found = false;
162  while (ptr1 > limit) {
163    uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8);
164    VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1;
165    if (inst1 == checkinst1) {
166      found = true;
167      break;
168    }
169    ptr1 -= 2;      // Min instruction size is 2 bytes.
170  }
171  if (found) {
172    VLOG(signals) << "suspend check match";
173    // This is a suspend check.  Arrange for the signal handler to return to
174    // art_quick_implicit_suspend.  Also set LR so that after the suspend check it
175    // will resume the instruction (current PC + 2).  PC points to the
176    // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger).
177
178    // NB: remember that we need to set the bottom bit of the LR register
179    // to switch to thumb mode.
180    VLOG(signals) << "arm lr: " << std::hex << sc->arm_lr;
181    VLOG(signals) << "arm pc: " << std::hex << sc->arm_pc;
182    sc->arm_lr = sc->arm_pc + 3;      // +2 + 1 (for thumb)
183    sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend);
184
185    // Now remove the suspend trigger that caused this fault.
186    Thread::Current()->RemoveSuspendTrigger();
187    VLOG(signals) << "removed suspend trigger invoking test suspend";
188    return true;
189  }
190  return false;
191}
192
193// Stack overflow fault handler.
194//
195// This checks that the fault address is equal to the current stack pointer
196// minus the overflow region size (16K typically).  The instruction sequence
197// that generates this signal is:
198//
199// sub r12,sp,#16384
200// ldr.w r12,[r12,#0]
201//
202// The second instruction will fault if r12 is inside the protected region
203// on the stack.
204//
205// If we determine this is a stack overflow we need to move the stack pointer
206// to the overflow region below the protected region.
207
208bool StackOverflowHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED,
209                                  void* context) {
210  struct ucontext* uc = reinterpret_cast<struct ucontext*>(context);
211  struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext);
212  VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc;
213  VLOG(signals) << "sigcontext: " << std::hex << sc;
214
215  uintptr_t sp = sc->arm_sp;
216  VLOG(signals) << "sp: " << std::hex << sp;
217
218  uintptr_t fault_addr = sc->fault_address;
219  VLOG(signals) << "fault_addr: " << std::hex << fault_addr;
220  VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp <<
221    ", fault_addr: " << fault_addr;
222
223  uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(kArm);
224
225  // Check that the fault address is the value expected for a stack overflow.
226  if (fault_addr != overflow_addr) {
227    VLOG(signals) << "Not a stack overflow";
228    return false;
229  }
230
231  VLOG(signals) << "Stack overflow found";
232
233  // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from.
234  // The value of LR must be the same as it was when we entered the code that
235  // caused this fault.  This will be inserted into a callee save frame by
236  // the function to which this handler returns (art_quick_throw_stack_overflow).
237  sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow);
238
239  // The kernel will now return to the address in sc->arm_pc.
240  return true;
241}
242}       // namespace art
243