Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | |
| 18 | #include "fault_handler.h" |
Dave Allison | 8ce6b90 | 2014-08-26 11:07:58 -0700 | [diff] [blame] | 19 | |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 20 | #include <sys/ucontext.h> |
Mathieu Chartier | e401d14 | 2015-04-22 13:56:20 -0700 | [diff] [blame] | 21 | |
| 22 | #include "art_method-inl.h" |
Andreas Gampe | 542451c | 2016-07-26 09:02:02 -0700 | [diff] [blame] | 23 | #include "base/enums.h" |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 24 | #include "base/macros.h" |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 25 | #include "base/hex_dump.h" |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 26 | #include "globals.h" |
| 27 | #include "base/logging.h" |
| 28 | #include "base/hex_dump.h" |
| 29 | #include "thread.h" |
| 30 | #include "thread-inl.h" |
| 31 | |
| 32 | // |
| 33 | // ARM specific fault handler functions. |
| 34 | // |
| 35 | |
| 36 | namespace art { |
| 37 | |
Nicolas Geoffray | e8e1127 | 2016-06-28 18:08:46 +0100 | [diff] [blame] | 38 | extern "C" void art_quick_throw_null_pointer_exception_from_signal(); |
Dave Allison | 648d711 | 2014-07-25 16:15:27 -0700 | [diff] [blame] | 39 | extern "C" void art_quick_throw_stack_overflow(); |
Dave Allison | 8325296 | 2014-04-03 16:33:48 -0700 | [diff] [blame] | 40 | extern "C" void art_quick_implicit_suspend(); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 41 | |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 42 | // Get the size of a thumb2 instruction in bytes. |
| 43 | static uint32_t GetInstructionSize(uint8_t* pc) { |
| 44 | uint16_t instr = pc[0] | pc[1] << 8; |
| 45 | bool is_32bit = ((instr & 0xF000) == 0xF000) || ((instr & 0xF800) == 0xE800); |
| 46 | uint32_t instr_size = is_32bit ? 4 : 2; |
| 47 | return instr_size; |
| 48 | } |
| 49 | |
Chih-Hung Hsieh | c4f990e | 2014-11-04 14:39:03 -0800 | [diff] [blame] | 50 | void FaultManager::HandleNestedSignal(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED, |
| 51 | void* context) { |
Dave Allison | 8ce6b90 | 2014-08-26 11:07:58 -0700 | [diff] [blame] | 52 | // Note that in this handler we set up the registers and return to |
| 53 | // longjmp directly rather than going through an assembly language stub. The |
| 54 | // reason for this is that longjmp is (currently) in ARM mode and that would |
| 55 | // require switching modes in the stub - incurring an unwanted relocation. |
| 56 | |
| 57 | struct ucontext *uc = reinterpret_cast<struct ucontext*>(context); |
| 58 | struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); |
| 59 | Thread* self = Thread::Current(); |
Mathieu Chartier | 2cebb24 | 2015-04-21 16:50:40 -0700 | [diff] [blame] | 60 | CHECK(self != nullptr); // This will cause a SIGABRT if self is null. |
Dave Allison | 8ce6b90 | 2014-08-26 11:07:58 -0700 | [diff] [blame] | 61 | |
| 62 | sc->arm_r0 = reinterpret_cast<uintptr_t>(*self->GetNestedSignalState()); |
| 63 | sc->arm_r1 = 1; |
| 64 | sc->arm_pc = reinterpret_cast<uintptr_t>(longjmp); |
| 65 | VLOG(signals) << "longjmp address: " << reinterpret_cast<void*>(sc->arm_pc); |
| 66 | } |
| 67 | |
Chih-Hung Hsieh | c4f990e | 2014-11-04 14:39:03 -0800 | [diff] [blame] | 68 | void FaultManager::GetMethodAndReturnPcAndSp(siginfo_t* siginfo ATTRIBUTE_UNUSED, void* context, |
Mathieu Chartier | e401d14 | 2015-04-22 13:56:20 -0700 | [diff] [blame] | 69 | ArtMethod** out_method, |
Mathieu Chartier | c751fdc | 2014-03-30 15:25:44 -0700 | [diff] [blame] | 70 | uintptr_t* out_return_pc, uintptr_t* out_sp) { |
Dave Allison | 69dfe51 | 2014-07-11 17:11:58 +0000 | [diff] [blame] | 71 | struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 72 | struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); |
Mathieu Chartier | c751fdc | 2014-03-30 15:25:44 -0700 | [diff] [blame] | 73 | *out_sp = static_cast<uintptr_t>(sc->arm_sp); |
Narayan Kamath | f561aab | 2015-06-19 15:23:46 +0100 | [diff] [blame] | 74 | VLOG(signals) << "sp: " << std::hex << *out_sp; |
Mathieu Chartier | c751fdc | 2014-03-30 15:25:44 -0700 | [diff] [blame] | 75 | if (*out_sp == 0) { |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 76 | return; |
| 77 | } |
| 78 | |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 79 | // In the case of a stack overflow, the stack is not valid and we can't |
| 80 | // get the method from the top of the stack. However it's in r0. |
| 81 | uintptr_t* fault_addr = reinterpret_cast<uintptr_t*>(sc->fault_address); |
| 82 | uintptr_t* overflow_addr = reinterpret_cast<uintptr_t*>( |
Andreas Gampe | 7ea6f79 | 2014-07-14 16:21:44 -0700 | [diff] [blame] | 83 | reinterpret_cast<uint8_t*>(*out_sp) - GetStackOverflowReservedBytes(kArm)); |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 84 | if (overflow_addr == fault_addr) { |
Mathieu Chartier | e401d14 | 2015-04-22 13:56:20 -0700 | [diff] [blame] | 85 | *out_method = reinterpret_cast<ArtMethod*>(sc->arm_r0); |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 86 | } else { |
| 87 | // The method is at the top of the stack. |
Mathieu Chartier | e401d14 | 2015-04-22 13:56:20 -0700 | [diff] [blame] | 88 | *out_method = reinterpret_cast<ArtMethod*>(reinterpret_cast<uintptr_t*>(*out_sp)[0]); |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 89 | } |
| 90 | |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 91 | // Work out the return PC. This will be the address of the instruction |
| 92 | // following the faulting ldr/str instruction. This is in thumb mode so |
| 93 | // the instruction might be a 16 or 32 bit one. Also, the GC map always |
| 94 | // has the bottom bit of the PC set so we also need to set that. |
| 95 | |
| 96 | // Need to work out the size of the instruction that caused the exception. |
| 97 | uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 98 | VLOG(signals) << "pc: " << std::hex << static_cast<void*>(ptr); |
Andreas Gampe | 9415886 | 2015-04-03 02:17:06 -0700 | [diff] [blame] | 99 | |
| 100 | if (ptr == nullptr) { |
| 101 | // Somebody jumped to 0x0. Definitely not ours, and will definitely segfault below. |
| 102 | *out_method = nullptr; |
| 103 | return; |
| 104 | } |
| 105 | |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 106 | uint32_t instr_size = GetInstructionSize(ptr); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 107 | |
Mathieu Chartier | c751fdc | 2014-03-30 15:25:44 -0700 | [diff] [blame] | 108 | *out_return_pc = (sc->arm_pc + instr_size) | 1; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 109 | } |
| 110 | |
Nicolas Geoffray | e8e1127 | 2016-06-28 18:08:46 +0100 | [diff] [blame] | 111 | bool NullPointerHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info, void* context) { |
| 112 | if (!IsValidImplicitCheck(info)) { |
| 113 | return false; |
| 114 | } |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 115 | // The code that looks for the catch location needs to know the value of the |
| 116 | // ARM PC at the point of call. For Null checks we insert a GC map that is immediately after |
| 117 | // the load/store instruction that might cause the fault. However the mapping table has |
| 118 | // the low bits set for thumb mode so we need to set the bottom bit for the LR |
| 119 | // register in order to find the mapping. |
| 120 | |
| 121 | // Need to work out the size of the instruction that caused the exception. |
Mathieu Chartier | c751fdc | 2014-03-30 15:25:44 -0700 | [diff] [blame] | 122 | struct ucontext *uc = reinterpret_cast<struct ucontext*>(context); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 123 | struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); |
| 124 | uint8_t* ptr = reinterpret_cast<uint8_t*>(sc->arm_pc); |
Vladimir Marko | 7aa7560 | 2016-09-07 15:09:21 +0100 | [diff] [blame] | 125 | |
Nicolas Geoffray | 0719b5b | 2016-09-12 22:05:33 +0000 | [diff] [blame^] | 126 | uint32_t instr_size = GetInstructionSize(ptr); |
| 127 | sc->arm_lr = (sc->arm_pc + instr_size) | 1; // LR needs to point to gc map location |
Nicolas Geoffray | e8e1127 | 2016-06-28 18:08:46 +0100 | [diff] [blame] | 128 | sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_null_pointer_exception_from_signal); |
| 129 | // Pass the faulting address as the first argument of |
| 130 | // art_quick_throw_null_pointer_exception_from_signal. |
Nicolas Geoffray | 0719b5b | 2016-09-12 22:05:33 +0000 | [diff] [blame^] | 131 | sc->arm_r0 = reinterpret_cast<uintptr_t>(info->si_addr); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 132 | VLOG(signals) << "Generating null pointer exception"; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 133 | return true; |
| 134 | } |
| 135 | |
| 136 | // A suspend check is done using the following instruction sequence: |
| 137 | // 0xf723c0b2: f8d902c0 ldr.w r0, [r9, #704] ; suspend_trigger_ |
| 138 | // .. some intervening instruction |
| 139 | // 0xf723c0b6: 6800 ldr r0, [r0, #0] |
| 140 | |
| 141 | // The offset from r9 is Thread::ThreadSuspendTriggerOffset(). |
| 142 | // To check for a suspend check, we examine the instructions that caused |
| 143 | // the fault (at PC-4 and PC). |
Chih-Hung Hsieh | c4f990e | 2014-11-04 14:39:03 -0800 | [diff] [blame] | 144 | bool SuspensionHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED, |
| 145 | void* context) { |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 146 | // These are the instructions to check for. The first one is the ldr r0,[r9,#xxx] |
| 147 | // where xxx is the offset of the suspend trigger. |
Andreas Gampe | 542451c | 2016-07-26 09:02:02 -0700 | [diff] [blame] | 148 | uint32_t checkinst1 = 0xf8d90000 |
| 149 | + Thread::ThreadSuspendTriggerOffset<PointerSize::k32>().Int32Value(); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 150 | uint16_t checkinst2 = 0x6800; |
| 151 | |
Dave Allison | 69dfe51 | 2014-07-11 17:11:58 +0000 | [diff] [blame] | 152 | struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 153 | struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); |
| 154 | uint8_t* ptr2 = reinterpret_cast<uint8_t*>(sc->arm_pc); |
| 155 | uint8_t* ptr1 = ptr2 - 4; |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 156 | VLOG(signals) << "checking suspend"; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 157 | |
| 158 | uint16_t inst2 = ptr2[0] | ptr2[1] << 8; |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 159 | VLOG(signals) << "inst2: " << std::hex << inst2 << " checkinst2: " << checkinst2; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 160 | if (inst2 != checkinst2) { |
| 161 | // Second instruction is not good, not ours. |
| 162 | return false; |
| 163 | } |
| 164 | |
| 165 | // The first instruction can a little bit up the stream due to load hoisting |
| 166 | // in the compiler. |
| 167 | uint8_t* limit = ptr1 - 40; // Compiler will hoist to a max of 20 instructions. |
| 168 | bool found = false; |
| 169 | while (ptr1 > limit) { |
| 170 | uint32_t inst1 = ((ptr1[0] | ptr1[1] << 8) << 16) | (ptr1[2] | ptr1[3] << 8); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 171 | VLOG(signals) << "inst1: " << std::hex << inst1 << " checkinst1: " << checkinst1; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 172 | if (inst1 == checkinst1) { |
| 173 | found = true; |
| 174 | break; |
| 175 | } |
| 176 | ptr1 -= 2; // Min instruction size is 2 bytes. |
| 177 | } |
| 178 | if (found) { |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 179 | VLOG(signals) << "suspend check match"; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 180 | // This is a suspend check. Arrange for the signal handler to return to |
Dave Allison | 8325296 | 2014-04-03 16:33:48 -0700 | [diff] [blame] | 181 | // art_quick_implicit_suspend. Also set LR so that after the suspend check it |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 182 | // will resume the instruction (current PC + 2). PC points to the |
| 183 | // ldr r0,[r0,#0] instruction (r0 will be 0, set by the trigger). |
| 184 | |
| 185 | // NB: remember that we need to set the bottom bit of the LR register |
| 186 | // to switch to thumb mode. |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 187 | VLOG(signals) << "arm lr: " << std::hex << sc->arm_lr; |
| 188 | VLOG(signals) << "arm pc: " << std::hex << sc->arm_pc; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 189 | sc->arm_lr = sc->arm_pc + 3; // +2 + 1 (for thumb) |
Dave Allison | 8325296 | 2014-04-03 16:33:48 -0700 | [diff] [blame] | 190 | sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_implicit_suspend); |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 191 | |
| 192 | // Now remove the suspend trigger that caused this fault. |
Dave Allison | d6ed642 | 2014-04-09 23:36:15 +0000 | [diff] [blame] | 193 | Thread::Current()->RemoveSuspendTrigger(); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 194 | VLOG(signals) << "removed suspend trigger invoking test suspend"; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 195 | return true; |
| 196 | } |
| 197 | return false; |
| 198 | } |
| 199 | |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 200 | // Stack overflow fault handler. |
| 201 | // |
| 202 | // This checks that the fault address is equal to the current stack pointer |
| 203 | // minus the overflow region size (16K typically). The instruction sequence |
| 204 | // that generates this signal is: |
| 205 | // |
| 206 | // sub r12,sp,#16384 |
| 207 | // ldr.w r12,[r12,#0] |
| 208 | // |
| 209 | // The second instruction will fault if r12 is inside the protected region |
| 210 | // on the stack. |
| 211 | // |
| 212 | // If we determine this is a stack overflow we need to move the stack pointer |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 213 | // to the overflow region below the protected region. |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 214 | |
Chih-Hung Hsieh | c4f990e | 2014-11-04 14:39:03 -0800 | [diff] [blame] | 215 | bool StackOverflowHandler::Action(int sig ATTRIBUTE_UNUSED, siginfo_t* info ATTRIBUTE_UNUSED, |
| 216 | void* context) { |
Dave Allison | 69dfe51 | 2014-07-11 17:11:58 +0000 | [diff] [blame] | 217 | struct ucontext* uc = reinterpret_cast<struct ucontext*>(context); |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 218 | struct sigcontext *sc = reinterpret_cast<struct sigcontext*>(&uc->uc_mcontext); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 219 | VLOG(signals) << "stack overflow handler with sp at " << std::hex << &uc; |
| 220 | VLOG(signals) << "sigcontext: " << std::hex << sc; |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 221 | |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 222 | uintptr_t sp = sc->arm_sp; |
| 223 | VLOG(signals) << "sp: " << std::hex << sp; |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 224 | |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 225 | uintptr_t fault_addr = sc->fault_address; |
| 226 | VLOG(signals) << "fault_addr: " << std::hex << fault_addr; |
| 227 | VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp << |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 228 | ", fault_addr: " << fault_addr; |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 229 | |
Andreas Gampe | 7ea6f79 | 2014-07-14 16:21:44 -0700 | [diff] [blame] | 230 | uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(kArm); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 231 | |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 232 | // Check that the fault address is the value expected for a stack overflow. |
| 233 | if (fault_addr != overflow_addr) { |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 234 | VLOG(signals) << "Not a stack overflow"; |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 235 | return false; |
| 236 | } |
| 237 | |
Dave Allison | 648d711 | 2014-07-25 16:15:27 -0700 | [diff] [blame] | 238 | VLOG(signals) << "Stack overflow found"; |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 239 | |
Dave Allison | 648d711 | 2014-07-25 16:15:27 -0700 | [diff] [blame] | 240 | // Now arrange for the signal handler to return to art_quick_throw_stack_overflow_from. |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 241 | // The value of LR must be the same as it was when we entered the code that |
| 242 | // caused this fault. This will be inserted into a callee save frame by |
Dave Allison | 648d711 | 2014-07-25 16:15:27 -0700 | [diff] [blame] | 243 | // the function to which this handler returns (art_quick_throw_stack_overflow). |
| 244 | sc->arm_pc = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow); |
Dave Allison | 5cd3375 | 2014-04-15 15:57:58 -0700 | [diff] [blame] | 245 | |
| 246 | // The kernel will now return to the address in sc->arm_pc. |
Dave Allison | f943914 | 2014-03-27 15:10:22 -0700 | [diff] [blame] | 247 | return true; |
Dave Allison | b373e09 | 2014-02-20 16:06:36 -0800 | [diff] [blame] | 248 | } |
| 249 | } // namespace art |