1 /*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "fault_handler.h"
18
19 #include <sys/ucontext.h>
20
21 #include "arch/instruction_set.h"
22 #include "art_method.h"
23 #include "base/enums.h"
24 #include "base/hex_dump.h"
25 #include "base/logging.h" // For VLOG.
26 #include "base/macros.h"
27 #include "base/safe_copy.h"
28 #include "oat_quick_method_header.h"
29 #include "runtime_globals.h"
30 #include "thread-current-inl.h"
31
32 #if defined(__APPLE__)
33 #define ucontext __darwin_ucontext
34
35 #if defined(__x86_64__)
36 // 64 bit mac build.
37 #define CTX_ESP uc_mcontext->__ss.__rsp
38 #define CTX_EIP uc_mcontext->__ss.__rip
39 #define CTX_EAX uc_mcontext->__ss.__rax
40 #define CTX_METHOD uc_mcontext->__ss.__rdi
41 #define CTX_RDI uc_mcontext->__ss.__rdi
42 #define CTX_JMP_BUF uc_mcontext->__ss.__rdi
43 #else
44 // 32 bit mac build.
45 #define CTX_ESP uc_mcontext->__ss.__esp
46 #define CTX_EIP uc_mcontext->__ss.__eip
47 #define CTX_EAX uc_mcontext->__ss.__eax
48 #define CTX_METHOD uc_mcontext->__ss.__eax
49 #define CTX_JMP_BUF uc_mcontext->__ss.__eax
50 #endif
51
52 #elif defined(__x86_64__)
53 // 64 bit linux build.
54 #define CTX_ESP uc_mcontext.gregs[REG_RSP]
55 #define CTX_EIP uc_mcontext.gregs[REG_RIP]
56 #define CTX_EAX uc_mcontext.gregs[REG_RAX]
57 #define CTX_METHOD uc_mcontext.gregs[REG_RDI]
58 #define CTX_RDI uc_mcontext.gregs[REG_RDI]
59 #define CTX_JMP_BUF uc_mcontext.gregs[REG_RDI]
60 #else
61 // 32 bit linux build.
62 #define CTX_ESP uc_mcontext.gregs[REG_ESP]
63 #define CTX_EIP uc_mcontext.gregs[REG_EIP]
64 #define CTX_EAX uc_mcontext.gregs[REG_EAX]
65 #define CTX_METHOD uc_mcontext.gregs[REG_EAX]
66 #define CTX_JMP_BUF uc_mcontext.gregs[REG_EAX]
67 #endif
68
69 //
70 // X86 (and X86_64) specific fault handler functions.
71 //
72
73 namespace art {
74
75 extern "C" void art_quick_throw_null_pointer_exception_from_signal();
76 extern "C" void art_quick_throw_stack_overflow();
77 extern "C" void art_quick_test_suspend();
78
79 // Get the size of an instruction in bytes.
80 // Return 0 if the instruction is not handled.
GetInstructionSize(const uint8_t * pc,size_t bytes)81 static uint32_t GetInstructionSize(const uint8_t* pc, size_t bytes) {
82 #define FETCH_OR_SKIP_BYTE(assignment) \
83 do { \
84 if (bytes == 0u) { \
85 return 0u; \
86 } \
87 (assignment); \
88 ++pc; \
89 --bytes; \
90 } while (0)
91 #define FETCH_BYTE(var) FETCH_OR_SKIP_BYTE((var) = *pc)
92 #define SKIP_BYTE() FETCH_OR_SKIP_BYTE((void)0)
93
94 #if defined(__x86_64)
95 const bool x86_64 = true;
96 #else
97 const bool x86_64 = false;
98 #endif
99
100 const uint8_t* startpc = pc;
101
102 uint8_t opcode;
103 FETCH_BYTE(opcode);
104 uint8_t modrm;
105 bool has_modrm = false;
106 bool two_byte = false;
107 uint32_t displacement_size = 0;
108 uint32_t immediate_size = 0;
109 bool operand_size_prefix = false;
110
111 // Prefixes.
112 while (true) {
113 bool prefix_present = false;
114 switch (opcode) {
115 // Group 3
116 case 0x66:
117 operand_size_prefix = true;
118 FALLTHROUGH_INTENDED;
119
120 // Group 1
121 case 0xf0:
122 case 0xf2:
123 case 0xf3:
124
125 // Group 2
126 case 0x2e:
127 case 0x36:
128 case 0x3e:
129 case 0x26:
130 case 0x64:
131 case 0x65:
132
133 // Group 4
134 case 0x67:
135 FETCH_BYTE(opcode);
136 prefix_present = true;
137 break;
138 }
139 if (!prefix_present) {
140 break;
141 }
142 }
143
144 if (x86_64 && opcode >= 0x40 && opcode <= 0x4f) {
145 FETCH_BYTE(opcode);
146 }
147
148 if (opcode == 0x0f) {
149 // Two byte opcode
150 two_byte = true;
151 FETCH_BYTE(opcode);
152 }
153
154 bool unhandled_instruction = false;
155
156 if (two_byte) {
157 switch (opcode) {
158 case 0x10: // vmovsd/ss
159 case 0x11: // vmovsd/ss
160 case 0xb6: // movzx
161 case 0xb7:
162 case 0xbe: // movsx
163 case 0xbf:
164 FETCH_BYTE(modrm);
165 has_modrm = true;
166 break;
167 default:
168 unhandled_instruction = true;
169 break;
170 }
171 } else {
172 switch (opcode) {
173 case 0x88: // mov byte
174 case 0x89: // mov
175 case 0x8b:
176 case 0x38: // cmp with memory.
177 case 0x39:
178 case 0x3a:
179 case 0x3b:
180 case 0x3c:
181 case 0x3d:
182 case 0x85: // test.
183 FETCH_BYTE(modrm);
184 has_modrm = true;
185 break;
186
187 case 0x80: // group 1, byte immediate.
188 case 0x83:
189 case 0xc6:
190 FETCH_BYTE(modrm);
191 has_modrm = true;
192 immediate_size = 1;
193 break;
194
195 case 0x81: // group 1, word immediate.
196 case 0xc7: // mov
197 FETCH_BYTE(modrm);
198 has_modrm = true;
199 immediate_size = operand_size_prefix ? 2 : 4;
200 break;
201
202 case 0xf6:
203 case 0xf7:
204 FETCH_BYTE(modrm);
205 has_modrm = true;
206 switch ((modrm >> 3) & 7) { // Extract "reg/opcode" from "modr/m".
207 case 0: // test
208 immediate_size = (opcode == 0xf6) ? 1 : (operand_size_prefix ? 2 : 4);
209 break;
210 case 2: // not
211 case 3: // neg
212 case 4: // mul
213 case 5: // imul
214 case 6: // div
215 case 7: // idiv
216 break;
217 default:
218 unhandled_instruction = true;
219 break;
220 }
221 break;
222
223 default:
224 unhandled_instruction = true;
225 break;
226 }
227 }
228
229 if (unhandled_instruction) {
230 VLOG(signals) << "Unhandled x86 instruction with opcode " << static_cast<int>(opcode);
231 return 0;
232 }
233
234 if (has_modrm) {
235 uint8_t mod = (modrm >> 6) & 3U /* 0b11 */;
236
237 // Check for SIB.
238 if (mod != 3U /* 0b11 */ && (modrm & 7U /* 0b111 */) == 4) {
239 SKIP_BYTE(); // SIB
240 }
241
242 switch (mod) {
243 case 0U /* 0b00 */: break;
244 case 1U /* 0b01 */: displacement_size = 1; break;
245 case 2U /* 0b10 */: displacement_size = 4; break;
246 case 3U /* 0b11 */:
247 break;
248 }
249 }
250
251 // Skip displacement and immediate.
252 pc += displacement_size + immediate_size;
253
254 VLOG(signals) << "x86 instruction length calculated as " << (pc - startpc);
255 return pc - startpc;
256
257 #undef SKIP_BYTE
258 #undef FETCH_BYTE
259 #undef FETCH_OR_SKIP_BYTE
260 }
261
GetFaultPc(siginfo_t * siginfo ATTRIBUTE_UNUSED,void * context)262 uintptr_t FaultManager::GetFaultPc(siginfo_t* siginfo ATTRIBUTE_UNUSED, void* context) {
263 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
264 if (uc->CTX_ESP == 0) {
265 VLOG(signals) << "Missing SP";
266 return 0u;
267 }
268 return uc->CTX_EIP;
269 }
270
GetFaultSp(void * context)271 uintptr_t FaultManager::GetFaultSp(void* context) {
272 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
273 return uc->CTX_ESP;
274 }
275
Action(int,siginfo_t * sig,void * context)276 bool NullPointerHandler::Action(int, siginfo_t* sig, void* context) {
277 uintptr_t fault_address = reinterpret_cast<uintptr_t>(sig->si_addr);
278 if (!IsValidFaultAddress(fault_address)) {
279 return false;
280 }
281
282 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
283 ArtMethod** sp = reinterpret_cast<ArtMethod**>(uc->CTX_ESP);
284 ArtMethod* method = *sp;
285 if (!IsValidMethod(method)) {
286 return false;
287 }
288
289 // For null checks in compiled code we insert a stack map that is immediately
290 // after the load/store instruction that might cause the fault and we need to
291 // pass the return PC to the handler. For null checks in Nterp, we similarly
292 // need the return PC to recognize that this was a null check in Nterp, so
293 // that the handler can get the needed data from the Nterp frame.
294
295 // Note: Allowing nested faults if `IsValidMethod()` returned a false positive.
296 // Note: The `ArtMethod::GetOatQuickMethodHeader()` can acquire locks, which is
297 // essentially unsafe in a signal handler, but we allow that here just like in
298 // `NullPointerHandler::IsValidReturnPc()`. For more details see comments there.
299 uintptr_t pc = uc->CTX_EIP;
300 const OatQuickMethodHeader* method_header = method->GetOatQuickMethodHeader(pc);
301 if (method_header == nullptr) {
302 VLOG(signals) << "No method header.";
303 return false;
304 }
305 const uint8_t* pc_ptr = reinterpret_cast<const uint8_t*>(pc);
306 size_t offset = pc_ptr - method_header->GetCode();
307 size_t code_size = method_header->GetCodeSize();
308 CHECK_LT(offset, code_size);
309 size_t max_instr_size = code_size - offset;
310 uint32_t instr_size = GetInstructionSize(pc_ptr, max_instr_size);
311 if (instr_size == 0u) {
312 // Unknown instruction (can't really happen) or not enough bytes until end of method code.
313 return false;
314 }
315
316 uintptr_t return_pc = reinterpret_cast<uintptr_t>(pc + instr_size);
317 if (!IsValidReturnPc(sp, return_pc)) {
318 return false;
319 }
320
321 // Push the return PC and fault address onto the stack.
322 uintptr_t* next_sp = reinterpret_cast<uintptr_t*>(sp) - 2;
323 next_sp[1] = return_pc;
324 next_sp[0] = fault_address;
325 uc->CTX_ESP = reinterpret_cast<uintptr_t>(next_sp);
326
327 // Arrange for the signal handler to return to the NPE entrypoint.
328 uc->CTX_EIP = reinterpret_cast<uintptr_t>(
329 art_quick_throw_null_pointer_exception_from_signal);
330 VLOG(signals) << "Generating null pointer exception";
331 return true;
332 }
333
334 // A suspend check is done using the following instruction sequence:
335 // (x86)
336 // 0xf720f1df: 648B058C000000 mov eax, fs:[0x8c] ; suspend_trigger
337 // .. some intervening instructions.
338 // 0xf720f1e6: 8500 test eax, [eax]
339 // (x86_64)
340 // 0x7f579de45d9e: 65488B0425A8000000 movq rax, gs:[0xa8] ; suspend_trigger
341 // .. some intervening instructions.
342 // 0x7f579de45da7: 8500 test eax, [eax]
343
344 // The offset from fs is Thread::ThreadSuspendTriggerOffset().
345 // To check for a suspend check, we examine the instructions that caused
346 // the fault.
Action(int,siginfo_t *,void * context)347 bool SuspensionHandler::Action(int, siginfo_t*, void* context) {
348 // These are the instructions to check for. The first one is the mov eax, fs:[xxx]
349 // where xxx is the offset of the suspend trigger.
350 uint32_t trigger = Thread::ThreadSuspendTriggerOffset<kRuntimePointerSize>().Int32Value();
351
352 VLOG(signals) << "Checking for suspension point";
353 #if defined(__x86_64__)
354 uint8_t checkinst1[] = {0x65, 0x48, 0x8b, 0x04, 0x25, static_cast<uint8_t>(trigger & 0xff),
355 static_cast<uint8_t>((trigger >> 8) & 0xff), 0, 0};
356 #else
357 uint8_t checkinst1[] = {0x64, 0x8b, 0x05, static_cast<uint8_t>(trigger & 0xff),
358 static_cast<uint8_t>((trigger >> 8) & 0xff), 0, 0};
359 #endif
360 uint8_t checkinst2[] = {0x85, 0x00};
361
362 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
363 uint8_t* pc = reinterpret_cast<uint8_t*>(uc->CTX_EIP);
364 uint8_t* sp = reinterpret_cast<uint8_t*>(uc->CTX_ESP);
365
366 if (pc[0] != checkinst2[0] || pc[1] != checkinst2[1]) {
367 // Second instruction is not correct (test eax,[eax]).
368 VLOG(signals) << "Not a suspension point";
369 return false;
370 }
371
372 // The first instruction can a little bit up the stream due to load hoisting
373 // in the compiler.
374 uint8_t* limit = pc - 100; // Compiler will hoist to a max of 20 instructions.
375 uint8_t* ptr = pc - sizeof(checkinst1);
376 bool found = false;
377 while (ptr > limit) {
378 if (memcmp(ptr, checkinst1, sizeof(checkinst1)) == 0) {
379 found = true;
380 break;
381 }
382 ptr -= 1;
383 }
384
385 if (found) {
386 VLOG(signals) << "suspend check match";
387
388 // We need to arrange for the signal handler to return to the null pointer
389 // exception generator. The return address must be the address of the
390 // next instruction (this instruction + 2). The return address
391 // is on the stack at the top address of the current frame.
392
393 // Push the return address onto the stack.
394 uintptr_t retaddr = reinterpret_cast<uintptr_t>(pc + 2);
395 uintptr_t* next_sp = reinterpret_cast<uintptr_t*>(sp - sizeof(uintptr_t));
396 *next_sp = retaddr;
397 uc->CTX_ESP = reinterpret_cast<uintptr_t>(next_sp);
398
399 uc->CTX_EIP = reinterpret_cast<uintptr_t>(art_quick_test_suspend);
400
401 // Now remove the suspend trigger that caused this fault.
402 Thread::Current()->RemoveSuspendTrigger();
403 VLOG(signals) << "removed suspend trigger invoking test suspend";
404 return true;
405 }
406 VLOG(signals) << "Not a suspend check match, first instruction mismatch";
407 return false;
408 }
409
410 // The stack overflow check is done using the following instruction:
411 // test eax, [esp+ -xxx]
412 // where 'xxx' is the size of the overflow area.
413 //
414 // This is done before any frame is established in the method. The return
415 // address for the previous method is on the stack at ESP.
416
Action(int,siginfo_t * info,void * context)417 bool StackOverflowHandler::Action(int, siginfo_t* info, void* context) {
418 ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
419 uintptr_t sp = static_cast<uintptr_t>(uc->CTX_ESP);
420
421 uintptr_t fault_addr = reinterpret_cast<uintptr_t>(info->si_addr);
422 VLOG(signals) << "fault_addr: " << std::hex << fault_addr;
423 VLOG(signals) << "checking for stack overflow, sp: " << std::hex << sp <<
424 ", fault_addr: " << fault_addr;
425
426 #if defined(__x86_64__)
427 uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(InstructionSet::kX86_64);
428 #else
429 uintptr_t overflow_addr = sp - GetStackOverflowReservedBytes(InstructionSet::kX86);
430 #endif
431
432 // Check that the fault address is the value expected for a stack overflow.
433 if (fault_addr != overflow_addr) {
434 VLOG(signals) << "Not a stack overflow";
435 return false;
436 }
437
438 VLOG(signals) << "Stack overflow found";
439
440 // Since the compiler puts the implicit overflow
441 // check before the callee save instructions, the SP is already pointing to
442 // the previous frame.
443
444 // Now arrange for the signal handler to return to art_quick_throw_stack_overflow.
445 uc->CTX_EIP = reinterpret_cast<uintptr_t>(art_quick_throw_stack_overflow);
446
447 return true;
448 }
449 } // namespace art
450