/ src / processor / stackwalker_x86.cc
stackwalker_x86.cc
  1  // Copyright 2010 Google LLC
  2  //
  3  // Redistribution and use in source and binary forms, with or without
  4  // modification, are permitted provided that the following conditions are
  5  // met:
  6  //
  7  //     * Redistributions of source code must retain the above copyright
  8  // notice, this list of conditions and the following disclaimer.
  9  //     * Redistributions in binary form must reproduce the above
 10  // copyright notice, this list of conditions and the following disclaimer
 11  // in the documentation and/or other materials provided with the
 12  // distribution.
 13  //     * Neither the name of Google LLC nor the names of its
 14  // contributors may be used to endorse or promote products derived from
 15  // this software without specific prior written permission.
 16  //
 17  // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 18  // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 19  // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 20  // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 21  // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 22  // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 23  // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 24  // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 25  // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 26  // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 27  // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 28  
 29  // stackwalker_x86.cc: x86-specific stackwalker.
 30  //
 31  // See stackwalker_x86.h for documentation.
 32  //
 33  // Author: Mark Mentovai
 34  
 35  #ifdef HAVE_CONFIG_H
 36  #include <config.h>  // Must come first
 37  #endif
 38  
 39  #include <assert.h>
 40  #include <string>
 41  
 42  #include "common/scoped_ptr.h"
 43  #include "google_breakpad/processor/call_stack.h"
 44  #include "google_breakpad/processor/code_modules.h"
 45  #include "google_breakpad/processor/memory_region.h"
 46  #include "google_breakpad/processor/source_line_resolver_interface.h"
 47  #include "google_breakpad/processor/stack_frame_cpu.h"
 48  #include "processor/logging.h"
 49  #include "processor/postfix_evaluator-inl.h"
 50  #include "processor/stackwalker_x86.h"
 51  #include "processor/windows_frame_info.h"
 52  #include "processor/cfi_frame_info.h"
 53  
 54  namespace google_breakpad {
 55  
 56  // Max reasonable size for a single x86 frame is 128 KB.  This value is used in
 57  // a heuristic for recovering of the EBP chain after a scan for return address.
 58  // This value is based on a stack frame size histogram built for a set of
 59  // popular third party libraries which suggests that 99.5% of all frames are
 60  // smaller than 128 KB.
 61  static const uint32_t kMaxReasonableGapBetweenFrames = 128 * 1024;
 62  
 63  const StackwalkerX86::CFIWalker::RegisterSet
 64  StackwalkerX86::cfi_register_map_[] = {
 65    // It may seem like $eip and $esp are callee-saves, because (with Unix or
 66    // cdecl calling conventions) the callee is responsible for having them
 67    // restored upon return. But the callee_saves flags here really means
 68    // that the walker should assume they're unchanged if the CFI doesn't
 69    // mention them, which is clearly wrong for $eip and $esp.
 70    { "$eip", ".ra",  false,
 71      StackFrameX86::CONTEXT_VALID_EIP, &MDRawContextX86::eip },
 72    { "$esp", ".cfa", false,
 73      StackFrameX86::CONTEXT_VALID_ESP, &MDRawContextX86::esp },
 74    { "$ebp", NULL,   true,
 75      StackFrameX86::CONTEXT_VALID_EBP, &MDRawContextX86::ebp },
 76    { "$eax", NULL,   false,
 77      StackFrameX86::CONTEXT_VALID_EAX, &MDRawContextX86::eax },
 78    { "$ebx", NULL,   true,
 79      StackFrameX86::CONTEXT_VALID_EBX, &MDRawContextX86::ebx },
 80    { "$ecx", NULL,   false,
 81      StackFrameX86::CONTEXT_VALID_ECX, &MDRawContextX86::ecx },
 82    { "$edx", NULL,   false,
 83      StackFrameX86::CONTEXT_VALID_EDX, &MDRawContextX86::edx },
 84    { "$esi", NULL,   true,
 85      StackFrameX86::CONTEXT_VALID_ESI, &MDRawContextX86::esi },
 86    { "$edi", NULL,   true,
 87      StackFrameX86::CONTEXT_VALID_EDI, &MDRawContextX86::edi },
 88  };
 89  
 90  StackwalkerX86::StackwalkerX86(const SystemInfo* system_info,
 91                                 const MDRawContextX86* context,
 92                                 MemoryRegion* memory,
 93                                 const CodeModules* modules,
 94                                 StackFrameSymbolizer* resolver_helper)
 95      : Stackwalker(system_info, memory, modules, resolver_helper),
 96        context_(context),
 97        cfi_walker_(cfi_register_map_,
 98                    (sizeof(cfi_register_map_) / sizeof(cfi_register_map_[0]))) {
 99    if (memory_ && memory_->GetBase() + memory_->GetSize() - 1 > 0xffffffff) {
100      // The x86 is a 32-bit CPU, the limits of the supplied stack are invalid.
101      // Mark memory_ = NULL, which will cause stackwalking to fail.
102      BPLOG(ERROR) << "Memory out of range for stackwalking: " <<
103                      HexString(memory_->GetBase()) << "+" <<
104                      HexString(memory_->GetSize());
105      memory_ = NULL;
106    }
107  }
108  
109  StackFrameX86::~StackFrameX86() {
110    if (windows_frame_info)
111      delete windows_frame_info;
112    windows_frame_info = NULL;
113    if (cfi_frame_info)
114      delete cfi_frame_info;
115    cfi_frame_info = NULL;
116  }
117  
118  uint64_t StackFrameX86::ReturnAddress() const {
119    assert(context_validity & StackFrameX86::CONTEXT_VALID_EIP);
120    return context.eip;
121  }
122  
123  StackFrame* StackwalkerX86::GetContextFrame() {
124    if (!context_) {
125      BPLOG(ERROR) << "Can't get context frame without context";
126      return NULL;
127    }
128  
129    StackFrameX86* frame = new StackFrameX86();
130  
131    // The instruction pointer is stored directly in a register, so pull it
132    // straight out of the CPU context structure.
133    frame->context = *context_;
134    frame->context_validity = StackFrameX86::CONTEXT_VALID_ALL;
135    frame->trust = StackFrame::FRAME_TRUST_CONTEXT;
136    frame->instruction = frame->context.eip;
137  
138    return frame;
139  }
140  
141  StackFrameX86* StackwalkerX86::GetCallerByWindowsFrameInfo(
142      const vector<StackFrame*>& frames,
143      WindowsFrameInfo* last_frame_info,
144      bool stack_scan_allowed) {
145    StackFrame::FrameTrust trust = StackFrame::FRAME_TRUST_NONE;
146  
147    // The last frame can never be inline. A sequence of inline frames always
148    // finishes with a conventional frame.
149    assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE);
150    StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back());
151  
152    // Save the stack walking info we found, in case we need it later to
153    // find the callee of the frame we're constructing now.
154    last_frame->windows_frame_info = last_frame_info;
155  
156    // This function only covers the full STACK WIN case. If
157    // last_frame_info is VALID_PARAMETER_SIZE-only, then we should
158    // assume the traditional frame format or use some other strategy.
159    if (last_frame_info->valid != WindowsFrameInfo::VALID_ALL)
160      return NULL;
161  
162    // This stackwalker sets each frame's %esp to its value immediately prior
163    // to the CALL into the callee.  This means that %esp points to the last
164    // callee argument pushed onto the stack, which may not be where %esp points
165    // after the callee returns.  Specifically, the value is correct for the
166    // cdecl calling convention, but not other conventions.  The cdecl
167    // convention requires a caller to pop its callee's arguments from the
168    // stack after the callee returns.  This is usually accomplished by adding
169    // the known size of the arguments to %esp.  Other calling conventions,
170    // including stdcall, thiscall, and fastcall, require the callee to pop any
171    // parameters stored on the stack before returning.  This is usually
172    // accomplished by using the RET n instruction, which pops n bytes off
173    // the stack after popping the return address.
174    //
175    // Because each frame's %esp will point to a location on the stack after
176    // callee arguments have been PUSHed, when locating things in a stack frame
177    // relative to %esp, the size of the arguments to the callee need to be
178    // taken into account.  This seems a little bit unclean, but it's better
179    // than the alternative, which would need to take these same things into
180    // account, but only for cdecl functions.  With this implementation, we get
181    // to be agnostic about each function's calling convention.  Furthermore,
182    // this is how Windows debugging tools work, so it means that the %esp
183    // values produced by this stackwalker directly correspond to the %esp
184    // values you'll see there.
185    //
186    // If the last frame has no callee (because it's the context frame), just
187    // set the callee parameter size to 0: the stack pointer can't point to
188    // callee arguments because there's no callee.  This is correct as long
189    // as the context wasn't captured while arguments were being pushed for
190    // a function call.  Note that there may be functions whose parameter sizes
191    // are unknown, 0 is also used in that case.  When that happens, it should
192    // be possible to walk to the next frame without reference to %esp.
193  
194    uint32_t last_frame_callee_parameter_size = 0;
195    int frames_already_walked = frames.size();
196    for (int last_frame_callee_id = frames_already_walked - 2;
197         last_frame_callee_id >= 0; last_frame_callee_id--) {
198      // Searching for a real callee frame. Skipping inline frames since they
199      // cannot be downcasted to StackFrameX86.
200      if (frames[last_frame_callee_id]->trust == StackFrame::FRAME_TRUST_INLINE) {
201        continue;
202      }
203      const StackFrameX86* last_frame_callee
204          = static_cast<StackFrameX86*>(frames[last_frame_callee_id]);
205      WindowsFrameInfo* last_frame_callee_info
206          = last_frame_callee->windows_frame_info;
207      if (last_frame_callee_info &&
208          (last_frame_callee_info->valid
209           & WindowsFrameInfo::VALID_PARAMETER_SIZE)) {
210        last_frame_callee_parameter_size =
211            last_frame_callee_info->parameter_size;
212      }
213    }
214  
215    // Set up the dictionary for the PostfixEvaluator.  %ebp, %esp, and sometimes
216    // %ebx are used in program strings, and their previous values are known, so
217    // set them here.
218    PostfixEvaluator<uint32_t>::DictionaryType dictionary;
219    // Provide the current register values.
220    dictionary["$ebp"] = last_frame->context.ebp;
221    dictionary["$esp"] = last_frame->context.esp;
222    if (last_frame->context_validity & StackFrameX86::CONTEXT_VALID_EBX)
223      dictionary["$ebx"] = last_frame->context.ebx;
224    // Provide constants from the debug info for last_frame and its callee.
225    // .cbCalleeParams is a Breakpad extension that allows us to use the
226    // PostfixEvaluator engine when certain types of debugging information
227    // are present without having to write the constants into the program
228    // string as literals.
229    dictionary[".cbCalleeParams"] = last_frame_callee_parameter_size;
230    dictionary[".cbSavedRegs"] = last_frame_info->saved_register_size;
231    dictionary[".cbLocals"] = last_frame_info->local_size;
232  
233    uint32_t raSearchStart = last_frame->context.esp +
234                             last_frame_callee_parameter_size +
235                             last_frame_info->local_size +
236                             last_frame_info->saved_register_size;
237  
238    uint32_t raSearchStartOld = raSearchStart;
239    uint32_t found = 0;  // dummy value
240    // Scan up to three words above the calculated search value, in case
241    // the stack was aligned to a quadword boundary.
242    //
243    // TODO(ivan.penkov): Consider cleaning up the scan for return address that
244    // follows.  The purpose of this scan is to adjust the .raSearchStart
245    // calculation (which is based on register %esp) in the cases where register
246    // %esp may have been aligned (up to a quadword).  There are two problems
247    // with this approach:
248    //  1) In practice, 64 byte boundary alignment is seen which clearly can not
249    //     be handled by a three word scan.
250    //  2) A search for a return address is "guesswork" by definition because
251    //     the results will be different depending on what is left on the stack
252    //     from previous executions.
253    // So, basically, the results from this scan should be ignored if other means
254    // for calculation of the value of .raSearchStart are available.
255    if (ScanForReturnAddress(raSearchStart, &raSearchStart, &found, 3) &&
256        last_frame->trust == StackFrame::FRAME_TRUST_CONTEXT &&
257        last_frame->windows_frame_info != NULL &&
258        last_frame_info->type_ == WindowsFrameInfo::STACK_INFO_FPO &&
259        raSearchStartOld == raSearchStart &&
260        found == last_frame->context.eip) {
261      // The context frame represents an FPO-optimized Windows system call.
262      // On the top of the stack we have a pointer to the current instruction.
263      // This means that the callee has returned but the return address is still
264      // on the top of the stack which is very atypical situaltion.
265      // Skip one slot from the stack and do another scan in order to get the
266      // actual return address.
267      raSearchStart += 4;
268      ScanForReturnAddress(raSearchStart, &raSearchStart, &found, 3);
269    }
270  
271    dictionary[".cbParams"] = last_frame_info->parameter_size;
272  
273    // Decide what type of program string to use. The program string is in
274    // postfix notation and will be passed to PostfixEvaluator::Evaluate.
275    // Given the dictionary and the program string, it is possible to compute
276    // the return address and the values of other registers in the calling
277    // function. Because of bugs described below, the stack may need to be
278    // scanned for these values. The results of program string evaluation
279    // will be used to determine whether to scan for better values.
280    string program_string;
281    bool recover_ebp = true;
282  
283    trust = StackFrame::FRAME_TRUST_CFI;
284    if (!last_frame_info->program_string.empty()) {
285      // The FPO data has its own program string, which will tell us how to
286      // get to the caller frame, and may even fill in the values of
287      // nonvolatile registers and provide pointers to local variables and
288      // parameters.  In some cases, particularly with program strings that use
289      // .raSearchStart, the stack may need to be scanned afterward.
290      program_string = last_frame_info->program_string;
291    } else if (last_frame_info->allocates_base_pointer) {
292      // The function corresponding to the last frame doesn't use the frame
293      // pointer for conventional purposes, but it does allocate a new
294      // frame pointer and use it for its own purposes.  Its callee's
295      // information is still accessed relative to %esp, and the previous
296      // value of %ebp can be recovered from a location in its stack frame,
297      // within the saved-register area.
298      //
299      // Functions that fall into this category use the %ebp register for
300      // a purpose other than the frame pointer.  They restore the caller's
301      // %ebp before returning.  These functions create their stack frame
302      // after a CALL by decrementing the stack pointer in an amount
303      // sufficient to store local variables, and then PUSHing saved
304      // registers onto the stack.  Arguments to a callee function, if any,
305      // are PUSHed after that.  Walking up to the caller, therefore,
306      // can be done solely with calculations relative to the stack pointer
307      // (%esp).  The return address is recovered from the memory location
308      // above the known sizes of the callee's parameters, saved registers,
309      // and locals.  The caller's stack pointer (the value of %esp when
310      // the caller executed CALL) is the location immediately above the
311      // saved return address.  The saved value of %ebp to be restored for
312      // the caller is at a known location in the saved-register area of
313      // the stack frame.
314      //
315      // For this type of frame, MSVC 14 (from Visual Studio 8/2005) in
316      // link-time code generation mode (/LTCG and /GL) can generate erroneous
317      // debugging data.  The reported size of saved registers can be 0,
318      // which is clearly an error because these frames must, at the very
319      // least, save %ebp.  For this reason, in addition to those given above
320      // about the use of .raSearchStart, the stack may need to be scanned
321      // for a better return address and a better frame pointer after the
322      // program string is evaluated.
323      //
324      // %eip_new = *(%esp_old + callee_params + saved_regs + locals)
325      // %ebp_new = *(%esp_old + callee_params + saved_regs - 8)
326      // %esp_new = %esp_old + callee_params + saved_regs + locals + 4
327      program_string = "$eip .raSearchStart ^ = "
328          "$ebp $esp .cbCalleeParams + .cbSavedRegs + 8 - ^ = "
329          "$esp .raSearchStart 4 + =";
330    } else {
331      // The function corresponding to the last frame doesn't use %ebp at
332      // all.  The callee frame is located relative to %esp.
333      //
334      // The called procedure's instruction pointer and stack pointer are
335      // recovered in the same way as the case above, except that no
336      // frame pointer (%ebp) is used at all, so it is not saved anywhere
337      // in the callee's stack frame and does not need to be recovered.
338      // Because %ebp wasn't used in the callee, whatever value it has
339      // is the value that it had in the caller, so it can be carried
340      // straight through without bringing its validity into question.
341      //
342      // Because of the use of .raSearchStart, the stack will possibly be
343      // examined to locate a better return address after program string
344      // evaluation.  The stack will not be examined to locate a saved
345      // %ebp value, because these frames do not save (or use) %ebp.
346      //
347      // We also propagate %ebx through, as it is commonly unmodifed after
348      // calling simple forwarding functions in ntdll (that are this non-EBP
349      // using type). It's not clear that this is always correct, but it is
350      // important for some functions to get a correct walk.
351      //
352      // %eip_new = *(%esp_old + callee_params + saved_regs + locals)
353      // %esp_new = %esp_old + callee_params + saved_regs + locals + 4
354      // %ebp_new = %ebp_old
355      // %ebx_new = %ebx_old  // If available.
356      program_string = "$eip .raSearchStart ^ = "
357                       "$esp .raSearchStart 4 + =";
358      if (last_frame->context_validity & StackFrameX86::CONTEXT_VALID_EBX)
359        program_string += " $ebx $ebx =";
360      recover_ebp = false;
361    }
362  
363    // Check for alignment operators in the program string.  If alignment
364    // operators are found, then current %ebp must be valid and it is the only
365    // reliable data point that can be used for getting to the previous frame.
366    // E.g. the .raSearchStart calculation (above) is based on %esp and since
367    // %esp was aligned in the current frame (which is a lossy operation) the
368    // calculated value of .raSearchStart cannot be correct and should not be
369    // used.  Instead .raSearchStart must be calculated based on %ebp.
370    // The code that follows assumes that .raSearchStart is supposed to point
371    // at the saved return address (ebp + 4).
372    // For some more details on this topic, take a look at the following thread:
373    // https://groups.google.com/forum/#!topic/google-breakpad-dev/ZP1FA9B1JjM
374    if ((StackFrameX86::CONTEXT_VALID_EBP & last_frame->context_validity) != 0 &&
375        program_string.find('@') != string::npos) {
376      raSearchStart = last_frame->context.ebp + 4;
377    }
378  
379    // The difference between raSearch and raSearchStart is unknown,
380    // but making them the same seems to work well in practice.
381    dictionary[".raSearchStart"] = raSearchStart;
382    dictionary[".raSearch"] = raSearchStart;
383  
384    // Now crank it out, making sure that the program string set at least the
385    // two required variables.
386    PostfixEvaluator<uint32_t> evaluator =
387        PostfixEvaluator<uint32_t>(&dictionary, memory_);
388    PostfixEvaluator<uint32_t>::DictionaryValidityType dictionary_validity;
389    if (!evaluator.Evaluate(program_string, &dictionary_validity) ||
390        dictionary_validity.find("$eip") == dictionary_validity.end() ||
391        dictionary_validity.find("$esp") == dictionary_validity.end()) {
392      // Program string evaluation failed. It may be that %eip is not somewhere
393      // with stack frame info, and %ebp is pointing to non-stack memory, so
394      // our evaluation couldn't succeed. We'll scan the stack for a return
395      // address. This can happen if the stack is in a module for which
396      // we don't have symbols, and that module is compiled without a
397      // frame pointer.
398      uint32_t location_start = last_frame->context.esp;
399      uint32_t location, eip;
400      if (!stack_scan_allowed ||
401          !ScanForReturnAddress(location_start, &location, &eip,
402                                /*is_context_frame=*/last_frame->trust ==
403                                    StackFrame::FRAME_TRUST_CONTEXT)) {
404        // if we can't find an instruction pointer even with stack scanning,
405        // give up.
406        return NULL;
407      }
408  
409      // This seems like a reasonable return address. Since program string
410      // evaluation failed, use it and set %esp to the location above the
411      // one where the return address was found.
412      dictionary["$eip"] = eip;
413      dictionary["$esp"] = location + 4;
414      trust = StackFrame::FRAME_TRUST_SCAN;
415    }
416  
417    // Since this stack frame did not use %ebp in a traditional way,
418    // locating the return address isn't entirely deterministic. In that
419    // case, the stack can be scanned to locate the return address.
420    //
421    // However, if program string evaluation resulted in both %eip and
422    // %ebp values of 0, trust that the end of the stack has been
423    // reached and don't scan for anything else.
424    if (dictionary["$eip"] != 0 || dictionary["$ebp"] != 0) {
425      int offset = 0;
426  
427      // This scan can only be done if a CodeModules object is available, to
428      // check that candidate return addresses are in fact inside a module.
429      //
430      // TODO(mmentovai): This ignores dynamically-generated code.  One possible
431      // solution is to check the minidump's memory map to see if the candidate
432      // %eip value comes from a mapped executable page, although this would
433      // require dumps that contain MINIDUMP_MEMORY_INFO, which the Breakpad
434      // client doesn't currently write (it would need to call MiniDumpWriteDump
435      // with the MiniDumpWithFullMemoryInfo type bit set).  Even given this
436      // ability, older OSes (pre-XP SP2) and CPUs (pre-P4) don't enforce
437      // an independent execute privilege on memory pages.
438  
439      uint32_t eip = dictionary["$eip"];
440      if (modules_ && !modules_->GetModuleForAddress(eip)) {
441        // The instruction pointer at .raSearchStart was invalid, so start
442        // looking one 32-bit word above that location.
443        uint32_t location_start = dictionary[".raSearchStart"] + 4;
444        uint32_t location;
445        if (stack_scan_allowed &&
446            ScanForReturnAddress(location_start, &location, &eip,
447                                 /*is_context_frame=*/last_frame->trust ==
448                                     StackFrame::FRAME_TRUST_CONTEXT)) {
449          // This is a better return address that what program string
450          // evaluation found.  Use it, and set %esp to the location above the
451          // one where the return address was found.
452          dictionary["$eip"] = eip;
453          dictionary["$esp"] = location + 4;
454          offset = location - location_start;
455          trust = StackFrame::FRAME_TRUST_CFI_SCAN;
456        }
457      }
458  
459      if (recover_ebp) {
460        // When trying to recover the previous value of the frame pointer (%ebp),
461        // start looking at the lowest possible address in the saved-register
462        // area, and look at the entire saved register area, increased by the
463        // size of |offset| to account for additional data that may be on the
464        // stack.  The scan is performed from the highest possible address to
465        // the lowest, because the expectation is that the function's prolog
466        // would have saved %ebp early.
467        uint32_t ebp = dictionary["$ebp"];
468  
469        // When a scan for return address is used, it is possible to skip one or
470        // more frames (when return address is not in a known module).  One
471        // indication for skipped frames is when the value of %ebp is lower than
472        // the location of the return address on the stack
473        bool has_skipped_frames =
474          (trust != StackFrame::FRAME_TRUST_CFI && ebp <= raSearchStart + offset);
475  
476        uint32_t value;  // throwaway variable to check pointer validity
477        if (has_skipped_frames || !memory_->GetMemoryAtAddress(ebp, &value)) {
478          int fp_search_bytes = last_frame_info->saved_register_size + offset;
479          uint32_t location_end = last_frame->context.esp +
480                                   last_frame_callee_parameter_size;
481  
482          for (uint32_t location = location_end + fp_search_bytes;
483               location >= location_end;
484               location -= 4) {
485            if (!memory_->GetMemoryAtAddress(location, &ebp))
486              break;
487  
488            if (memory_->GetMemoryAtAddress(ebp, &value)) {
489              // The candidate value is a pointer to the same memory region
490              // (the stack).  Prefer it as a recovered %ebp result.
491              dictionary["$ebp"] = ebp;
492              break;
493            }
494          }
495        }
496      }
497    }
498  
499    // Create a new stack frame (ownership will be transferred to the caller)
500    // and fill it in.
501    StackFrameX86* frame = new StackFrameX86();
502  
503    frame->trust = trust;
504    frame->context = last_frame->context;
505    frame->context.eip = dictionary["$eip"];
506    frame->context.esp = dictionary["$esp"];
507    frame->context.ebp = dictionary["$ebp"];
508    frame->context_validity = StackFrameX86::CONTEXT_VALID_EIP |
509                                  StackFrameX86::CONTEXT_VALID_ESP |
510                                  StackFrameX86::CONTEXT_VALID_EBP;
511  
512    // These are nonvolatile (callee-save) registers, and the program string
513    // may have filled them in.
514    if (dictionary_validity.find("$ebx") != dictionary_validity.end()) {
515      frame->context.ebx = dictionary["$ebx"];
516      frame->context_validity |= StackFrameX86::CONTEXT_VALID_EBX;
517    }
518    if (dictionary_validity.find("$esi") != dictionary_validity.end()) {
519      frame->context.esi = dictionary["$esi"];
520      frame->context_validity |= StackFrameX86::CONTEXT_VALID_ESI;
521    }
522    if (dictionary_validity.find("$edi") != dictionary_validity.end()) {
523      frame->context.edi = dictionary["$edi"];
524      frame->context_validity |= StackFrameX86::CONTEXT_VALID_EDI;
525    }
526  
527    return frame;
528  }
529  
530  StackFrameX86* StackwalkerX86::GetCallerByCFIFrameInfo(
531      const vector<StackFrame*>& frames,
532      CFIFrameInfo* cfi_frame_info) {
533    // The last frame can never be inline. A sequence of inline frames always
534    // finishes with a conventional frame.
535    assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE);
536    StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back());
537    last_frame->cfi_frame_info = cfi_frame_info;
538  
539    scoped_ptr<StackFrameX86> frame(new StackFrameX86());
540    if (!cfi_walker_
541        .FindCallerRegisters(*memory_, *cfi_frame_info,
542                             last_frame->context, last_frame->context_validity,
543                             &frame->context, &frame->context_validity))
544      return NULL;
545  
546    // Make sure we recovered all the essentials.
547    static const int essentials = (StackFrameX86::CONTEXT_VALID_EIP
548                                   | StackFrameX86::CONTEXT_VALID_ESP
549                                   | StackFrameX86::CONTEXT_VALID_EBP);
550    if ((frame->context_validity & essentials) != essentials)
551      return NULL;
552  
553    frame->trust = StackFrame::FRAME_TRUST_CFI;
554  
555    return frame.release();
556  }
557  
558  StackFrameX86* StackwalkerX86::GetCallerByEBPAtBase(
559      const vector<StackFrame*>& frames,
560      bool stack_scan_allowed) {
561    StackFrame::FrameTrust trust;
562    // The last frame can never be inline. A sequence of inline frames always
563    // finishes with a conventional frame.
564    assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE);
565    StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back());
566    uint32_t last_esp = last_frame->context.esp;
567    uint32_t last_ebp = last_frame->context.ebp;
568  
569    // Assume that the standard %ebp-using x86 calling convention is in
570    // use.
571    //
572    // The typical x86 calling convention, when frame pointers are present,
573    // is for the calling procedure to use CALL, which pushes the return
574    // address onto the stack and sets the instruction pointer (%eip) to
575    // the entry point of the called routine.  The called routine then
576    // PUSHes the calling routine's frame pointer (%ebp) onto the stack
577    // before copying the stack pointer (%esp) to the frame pointer (%ebp).
578    // Therefore, the calling procedure's frame pointer is always available
579    // by dereferencing the called procedure's frame pointer, and the return
580    // address is always available at the memory location immediately above
581    // the address pointed to by the called procedure's frame pointer.  The
582    // calling procedure's stack pointer (%esp) is 8 higher than the value
583    // of the called procedure's frame pointer at the time the calling
584    // procedure made the CALL: 4 bytes for the return address pushed by the
585    // CALL itself, and 4 bytes for the callee's PUSH of the caller's frame
586    // pointer.
587    //
588    // %eip_new = *(%ebp_old + 4)
589    // %esp_new = %ebp_old + 8
590    // %ebp_new = *(%ebp_old)
591  
592    uint32_t caller_eip, caller_esp, caller_ebp;
593  
594    if (memory_->GetMemoryAtAddress(last_ebp + 4, &caller_eip) &&
595        memory_->GetMemoryAtAddress(last_ebp, &caller_ebp)) {
596      caller_esp = last_ebp + 8;
597      trust = StackFrame::FRAME_TRUST_FP;
598    } else {
599      // We couldn't read the memory %ebp refers to. It may be that %ebp
600      // is pointing to non-stack memory. We'll scan the stack for a
601      // return address. This can happen if last_frame is executing code
602      // for a module for which we don't have symbols, and that module
603      // is compiled without a frame pointer.
604      if (!stack_scan_allowed ||
605          !ScanForReturnAddress(last_esp, &caller_esp, &caller_eip,
606                                /*is_context_frame=*/last_frame->trust ==
607                                    StackFrame::FRAME_TRUST_CONTEXT)) {
608        // if we can't find an instruction pointer even with stack scanning,
609        // give up.
610        return NULL;
611      }
612  
613      // ScanForReturnAddress found a reasonable return address. Advance %esp to
614      // the location immediately above the one where the return address was
615      // found.
616      caller_esp += 4;
617      // Try to restore the %ebp chain.  The caller %ebp should be stored at a
618      // location immediately below the one where the return address was found.
619      // A valid caller %ebp must be greater than the address where it is stored
620      // and the gap between the two adjacent frames should be reasonable.
621      uint32_t restored_ebp_chain = caller_esp - 8;
622      if (!memory_->GetMemoryAtAddress(restored_ebp_chain, &caller_ebp) ||
623          caller_ebp <= restored_ebp_chain ||
624          caller_ebp - restored_ebp_chain > kMaxReasonableGapBetweenFrames) {
625        // The restored %ebp chain doesn't appear to be valid.
626        // Assume that %ebp is unchanged.
627        caller_ebp = last_ebp;
628      }
629  
630      trust = StackFrame::FRAME_TRUST_SCAN;
631    }
632  
633    // Create a new stack frame (ownership will be transferred to the caller)
634    // and fill it in.
635    StackFrameX86* frame = new StackFrameX86();
636  
637    frame->trust = trust;
638    frame->context = last_frame->context;
639    frame->context.eip = caller_eip;
640    frame->context.esp = caller_esp;
641    frame->context.ebp = caller_ebp;
642    frame->context_validity = StackFrameX86::CONTEXT_VALID_EIP |
643                              StackFrameX86::CONTEXT_VALID_ESP |
644                              StackFrameX86::CONTEXT_VALID_EBP;
645  
646    return frame;
647  }
648  
649  StackFrame* StackwalkerX86::GetCallerFrame(const CallStack* stack,
650                                             bool stack_scan_allowed) {
651    if (!memory_ || !stack) {
652      BPLOG(ERROR) << "Can't get caller frame without memory or stack";
653      return NULL;
654    }
655  
656    const vector<StackFrame*>& frames = *stack->frames();
657    StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back());
658    // The last frame can never be inline. A sequence of inline frames always
659    // finishes with a conventional frame.
660    assert(last_frame->trust != StackFrame::FRAME_TRUST_INLINE);
661    scoped_ptr<StackFrameX86> new_frame;
662  
663    // If the resolver has Windows stack walking information, use that.
664    WindowsFrameInfo* windows_frame_info
665        = frame_symbolizer_->FindWindowsFrameInfo(last_frame);
666    if (windows_frame_info)
667      new_frame.reset(GetCallerByWindowsFrameInfo(frames, windows_frame_info,
668                                                  stack_scan_allowed));
669  
670    // If the resolver has DWARF CFI information, use that.
671    if (!new_frame.get()) {
672      CFIFrameInfo* cfi_frame_info =
673          frame_symbolizer_->FindCFIFrameInfo(last_frame);
674      if (cfi_frame_info)
675        new_frame.reset(GetCallerByCFIFrameInfo(frames, cfi_frame_info));
676    }
677  
678    // Otherwise, hope that the program was using a traditional frame structure.
679    if (!new_frame.get())
680      new_frame.reset(GetCallerByEBPAtBase(frames, stack_scan_allowed));
681  
682    // If nothing worked, tell the caller.
683    if (!new_frame.get())
684      return NULL;
685  
686    // Should we terminate the stack walk? (end-of-stack or broken invariant)
687    if (TerminateWalk(new_frame->context.eip, new_frame->context.esp,
688                      last_frame->context.esp,
689                      /*first_unwind=*/last_frame->trust ==
690                          StackFrame::FRAME_TRUST_CONTEXT)) {
691      return NULL;
692    }
693  
694    // new_frame->context.eip is the return address, which is the instruction
695    // after the CALL that caused us to arrive at the callee. Set
696    // new_frame->instruction to one less than that, so it points within the
697    // CALL instruction. See StackFrame::instruction for details, and
698    // StackFrameAMD64::ReturnAddress.
699    new_frame->instruction = new_frame->context.eip - 1;
700  
701    return new_frame.release();
702  }
703  
704  }  // namespace google_breakpad