stackwalker_x86.cc
1 // Copyright 2010 Google LLC 2 // 3 // Redistribution and use in source and binary forms, with or without 4 // modification, are permitted provided that the following conditions are 5 // met: 6 // 7 // * Redistributions of source code must retain the above copyright 8 // notice, this list of conditions and the following disclaimer. 9 // * Redistributions in binary form must reproduce the above 10 // copyright notice, this list of conditions and the following disclaimer 11 // in the documentation and/or other materials provided with the 12 // distribution. 13 // * Neither the name of Google LLC nor the names of its 14 // contributors may be used to endorse or promote products derived from 15 // this software without specific prior written permission. 16 // 17 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 18 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 19 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 20 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 21 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 22 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 23 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 27 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 29 // stackwalker_x86.cc: x86-specific stackwalker. 30 // 31 // See stackwalker_x86.h for documentation. 32 // 33 // Author: Mark Mentovai 34 35 #ifdef HAVE_CONFIG_H 36 #include <config.h> // Must come first 37 #endif 38 39 #include <assert.h> 40 #include <string> 41 42 #include "common/scoped_ptr.h" 43 #include "google_breakpad/processor/call_stack.h" 44 #include "google_breakpad/processor/code_modules.h" 45 #include "google_breakpad/processor/memory_region.h" 46 #include "google_breakpad/processor/source_line_resolver_interface.h" 47 #include "google_breakpad/processor/stack_frame_cpu.h" 48 #include "processor/logging.h" 49 #include "processor/postfix_evaluator-inl.h" 50 #include "processor/stackwalker_x86.h" 51 #include "processor/windows_frame_info.h" 52 #include "processor/cfi_frame_info.h" 53 54 namespace google_breakpad { 55 56 // Max reasonable size for a single x86 frame is 128 KB. This value is used in 57 // a heuristic for recovering of the EBP chain after a scan for return address. 58 // This value is based on a stack frame size histogram built for a set of 59 // popular third party libraries which suggests that 99.5% of all frames are 60 // smaller than 128 KB. 61 static const uint32_t kMaxReasonableGapBetweenFrames = 128 * 1024; 62 63 const StackwalkerX86::CFIWalker::RegisterSet 64 StackwalkerX86::cfi_register_map_[] = { 65 // It may seem like $eip and $esp are callee-saves, because (with Unix or 66 // cdecl calling conventions) the callee is responsible for having them 67 // restored upon return. But the callee_saves flags here really means 68 // that the walker should assume they're unchanged if the CFI doesn't 69 // mention them, which is clearly wrong for $eip and $esp. 70 { "$eip", ".ra", false, 71 StackFrameX86::CONTEXT_VALID_EIP, &MDRawContextX86::eip }, 72 { "$esp", ".cfa", false, 73 StackFrameX86::CONTEXT_VALID_ESP, &MDRawContextX86::esp }, 74 { "$ebp", NULL, true, 75 StackFrameX86::CONTEXT_VALID_EBP, &MDRawContextX86::ebp }, 76 { "$eax", NULL, false, 77 StackFrameX86::CONTEXT_VALID_EAX, &MDRawContextX86::eax }, 78 { "$ebx", NULL, true, 79 StackFrameX86::CONTEXT_VALID_EBX, &MDRawContextX86::ebx }, 80 { "$ecx", NULL, false, 81 StackFrameX86::CONTEXT_VALID_ECX, &MDRawContextX86::ecx }, 82 { "$edx", NULL, false, 83 StackFrameX86::CONTEXT_VALID_EDX, &MDRawContextX86::edx }, 84 { "$esi", NULL, true, 85 StackFrameX86::CONTEXT_VALID_ESI, &MDRawContextX86::esi }, 86 { "$edi", NULL, true, 87 StackFrameX86::CONTEXT_VALID_EDI, &MDRawContextX86::edi }, 88 }; 89 90 StackwalkerX86::StackwalkerX86(const SystemInfo* system_info, 91 const MDRawContextX86* context, 92 MemoryRegion* memory, 93 const CodeModules* modules, 94 StackFrameSymbolizer* resolver_helper) 95 : Stackwalker(system_info, memory, modules, resolver_helper), 96 context_(context), 97 cfi_walker_(cfi_register_map_, 98 (sizeof(cfi_register_map_) / sizeof(cfi_register_map_[0]))) { 99 if (memory_ && memory_->GetBase() + memory_->GetSize() - 1 > 0xffffffff) { 100 // The x86 is a 32-bit CPU, the limits of the supplied stack are invalid. 101 // Mark memory_ = NULL, which will cause stackwalking to fail. 102 BPLOG(ERROR) << "Memory out of range for stackwalking: " << 103 HexString(memory_->GetBase()) << "+" << 104 HexString(memory_->GetSize()); 105 memory_ = NULL; 106 } 107 } 108 109 StackFrameX86::~StackFrameX86() { 110 if (windows_frame_info) 111 delete windows_frame_info; 112 windows_frame_info = NULL; 113 if (cfi_frame_info) 114 delete cfi_frame_info; 115 cfi_frame_info = NULL; 116 } 117 118 uint64_t StackFrameX86::ReturnAddress() const { 119 assert(context_validity & StackFrameX86::CONTEXT_VALID_EIP); 120 return context.eip; 121 } 122 123 StackFrame* StackwalkerX86::GetContextFrame() { 124 if (!context_) { 125 BPLOG(ERROR) << "Can't get context frame without context"; 126 return NULL; 127 } 128 129 StackFrameX86* frame = new StackFrameX86(); 130 131 // The instruction pointer is stored directly in a register, so pull it 132 // straight out of the CPU context structure. 133 frame->context = *context_; 134 frame->context_validity = StackFrameX86::CONTEXT_VALID_ALL; 135 frame->trust = StackFrame::FRAME_TRUST_CONTEXT; 136 frame->instruction = frame->context.eip; 137 138 return frame; 139 } 140 141 StackFrameX86* StackwalkerX86::GetCallerByWindowsFrameInfo( 142 const vector<StackFrame*>& frames, 143 WindowsFrameInfo* last_frame_info, 144 bool stack_scan_allowed) { 145 StackFrame::FrameTrust trust = StackFrame::FRAME_TRUST_NONE; 146 147 // The last frame can never be inline. A sequence of inline frames always 148 // finishes with a conventional frame. 149 assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE); 150 StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back()); 151 152 // Save the stack walking info we found, in case we need it later to 153 // find the callee of the frame we're constructing now. 154 last_frame->windows_frame_info = last_frame_info; 155 156 // This function only covers the full STACK WIN case. If 157 // last_frame_info is VALID_PARAMETER_SIZE-only, then we should 158 // assume the traditional frame format or use some other strategy. 159 if (last_frame_info->valid != WindowsFrameInfo::VALID_ALL) 160 return NULL; 161 162 // This stackwalker sets each frame's %esp to its value immediately prior 163 // to the CALL into the callee. This means that %esp points to the last 164 // callee argument pushed onto the stack, which may not be where %esp points 165 // after the callee returns. Specifically, the value is correct for the 166 // cdecl calling convention, but not other conventions. The cdecl 167 // convention requires a caller to pop its callee's arguments from the 168 // stack after the callee returns. This is usually accomplished by adding 169 // the known size of the arguments to %esp. Other calling conventions, 170 // including stdcall, thiscall, and fastcall, require the callee to pop any 171 // parameters stored on the stack before returning. This is usually 172 // accomplished by using the RET n instruction, which pops n bytes off 173 // the stack after popping the return address. 174 // 175 // Because each frame's %esp will point to a location on the stack after 176 // callee arguments have been PUSHed, when locating things in a stack frame 177 // relative to %esp, the size of the arguments to the callee need to be 178 // taken into account. This seems a little bit unclean, but it's better 179 // than the alternative, which would need to take these same things into 180 // account, but only for cdecl functions. With this implementation, we get 181 // to be agnostic about each function's calling convention. Furthermore, 182 // this is how Windows debugging tools work, so it means that the %esp 183 // values produced by this stackwalker directly correspond to the %esp 184 // values you'll see there. 185 // 186 // If the last frame has no callee (because it's the context frame), just 187 // set the callee parameter size to 0: the stack pointer can't point to 188 // callee arguments because there's no callee. This is correct as long 189 // as the context wasn't captured while arguments were being pushed for 190 // a function call. Note that there may be functions whose parameter sizes 191 // are unknown, 0 is also used in that case. When that happens, it should 192 // be possible to walk to the next frame without reference to %esp. 193 194 uint32_t last_frame_callee_parameter_size = 0; 195 int frames_already_walked = frames.size(); 196 for (int last_frame_callee_id = frames_already_walked - 2; 197 last_frame_callee_id >= 0; last_frame_callee_id--) { 198 // Searching for a real callee frame. Skipping inline frames since they 199 // cannot be downcasted to StackFrameX86. 200 if (frames[last_frame_callee_id]->trust == StackFrame::FRAME_TRUST_INLINE) { 201 continue; 202 } 203 const StackFrameX86* last_frame_callee 204 = static_cast<StackFrameX86*>(frames[last_frame_callee_id]); 205 WindowsFrameInfo* last_frame_callee_info 206 = last_frame_callee->windows_frame_info; 207 if (last_frame_callee_info && 208 (last_frame_callee_info->valid 209 & WindowsFrameInfo::VALID_PARAMETER_SIZE)) { 210 last_frame_callee_parameter_size = 211 last_frame_callee_info->parameter_size; 212 } 213 } 214 215 // Set up the dictionary for the PostfixEvaluator. %ebp, %esp, and sometimes 216 // %ebx are used in program strings, and their previous values are known, so 217 // set them here. 218 PostfixEvaluator<uint32_t>::DictionaryType dictionary; 219 // Provide the current register values. 220 dictionary["$ebp"] = last_frame->context.ebp; 221 dictionary["$esp"] = last_frame->context.esp; 222 if (last_frame->context_validity & StackFrameX86::CONTEXT_VALID_EBX) 223 dictionary["$ebx"] = last_frame->context.ebx; 224 // Provide constants from the debug info for last_frame and its callee. 225 // .cbCalleeParams is a Breakpad extension that allows us to use the 226 // PostfixEvaluator engine when certain types of debugging information 227 // are present without having to write the constants into the program 228 // string as literals. 229 dictionary[".cbCalleeParams"] = last_frame_callee_parameter_size; 230 dictionary[".cbSavedRegs"] = last_frame_info->saved_register_size; 231 dictionary[".cbLocals"] = last_frame_info->local_size; 232 233 uint32_t raSearchStart = last_frame->context.esp + 234 last_frame_callee_parameter_size + 235 last_frame_info->local_size + 236 last_frame_info->saved_register_size; 237 238 uint32_t raSearchStartOld = raSearchStart; 239 uint32_t found = 0; // dummy value 240 // Scan up to three words above the calculated search value, in case 241 // the stack was aligned to a quadword boundary. 242 // 243 // TODO(ivan.penkov): Consider cleaning up the scan for return address that 244 // follows. The purpose of this scan is to adjust the .raSearchStart 245 // calculation (which is based on register %esp) in the cases where register 246 // %esp may have been aligned (up to a quadword). There are two problems 247 // with this approach: 248 // 1) In practice, 64 byte boundary alignment is seen which clearly can not 249 // be handled by a three word scan. 250 // 2) A search for a return address is "guesswork" by definition because 251 // the results will be different depending on what is left on the stack 252 // from previous executions. 253 // So, basically, the results from this scan should be ignored if other means 254 // for calculation of the value of .raSearchStart are available. 255 if (ScanForReturnAddress(raSearchStart, &raSearchStart, &found, 3) && 256 last_frame->trust == StackFrame::FRAME_TRUST_CONTEXT && 257 last_frame->windows_frame_info != NULL && 258 last_frame_info->type_ == WindowsFrameInfo::STACK_INFO_FPO && 259 raSearchStartOld == raSearchStart && 260 found == last_frame->context.eip) { 261 // The context frame represents an FPO-optimized Windows system call. 262 // On the top of the stack we have a pointer to the current instruction. 263 // This means that the callee has returned but the return address is still 264 // on the top of the stack which is very atypical situaltion. 265 // Skip one slot from the stack and do another scan in order to get the 266 // actual return address. 267 raSearchStart += 4; 268 ScanForReturnAddress(raSearchStart, &raSearchStart, &found, 3); 269 } 270 271 dictionary[".cbParams"] = last_frame_info->parameter_size; 272 273 // Decide what type of program string to use. The program string is in 274 // postfix notation and will be passed to PostfixEvaluator::Evaluate. 275 // Given the dictionary and the program string, it is possible to compute 276 // the return address and the values of other registers in the calling 277 // function. Because of bugs described below, the stack may need to be 278 // scanned for these values. The results of program string evaluation 279 // will be used to determine whether to scan for better values. 280 string program_string; 281 bool recover_ebp = true; 282 283 trust = StackFrame::FRAME_TRUST_CFI; 284 if (!last_frame_info->program_string.empty()) { 285 // The FPO data has its own program string, which will tell us how to 286 // get to the caller frame, and may even fill in the values of 287 // nonvolatile registers and provide pointers to local variables and 288 // parameters. In some cases, particularly with program strings that use 289 // .raSearchStart, the stack may need to be scanned afterward. 290 program_string = last_frame_info->program_string; 291 } else if (last_frame_info->allocates_base_pointer) { 292 // The function corresponding to the last frame doesn't use the frame 293 // pointer for conventional purposes, but it does allocate a new 294 // frame pointer and use it for its own purposes. Its callee's 295 // information is still accessed relative to %esp, and the previous 296 // value of %ebp can be recovered from a location in its stack frame, 297 // within the saved-register area. 298 // 299 // Functions that fall into this category use the %ebp register for 300 // a purpose other than the frame pointer. They restore the caller's 301 // %ebp before returning. These functions create their stack frame 302 // after a CALL by decrementing the stack pointer in an amount 303 // sufficient to store local variables, and then PUSHing saved 304 // registers onto the stack. Arguments to a callee function, if any, 305 // are PUSHed after that. Walking up to the caller, therefore, 306 // can be done solely with calculations relative to the stack pointer 307 // (%esp). The return address is recovered from the memory location 308 // above the known sizes of the callee's parameters, saved registers, 309 // and locals. The caller's stack pointer (the value of %esp when 310 // the caller executed CALL) is the location immediately above the 311 // saved return address. The saved value of %ebp to be restored for 312 // the caller is at a known location in the saved-register area of 313 // the stack frame. 314 // 315 // For this type of frame, MSVC 14 (from Visual Studio 8/2005) in 316 // link-time code generation mode (/LTCG and /GL) can generate erroneous 317 // debugging data. The reported size of saved registers can be 0, 318 // which is clearly an error because these frames must, at the very 319 // least, save %ebp. For this reason, in addition to those given above 320 // about the use of .raSearchStart, the stack may need to be scanned 321 // for a better return address and a better frame pointer after the 322 // program string is evaluated. 323 // 324 // %eip_new = *(%esp_old + callee_params + saved_regs + locals) 325 // %ebp_new = *(%esp_old + callee_params + saved_regs - 8) 326 // %esp_new = %esp_old + callee_params + saved_regs + locals + 4 327 program_string = "$eip .raSearchStart ^ = " 328 "$ebp $esp .cbCalleeParams + .cbSavedRegs + 8 - ^ = " 329 "$esp .raSearchStart 4 + ="; 330 } else { 331 // The function corresponding to the last frame doesn't use %ebp at 332 // all. The callee frame is located relative to %esp. 333 // 334 // The called procedure's instruction pointer and stack pointer are 335 // recovered in the same way as the case above, except that no 336 // frame pointer (%ebp) is used at all, so it is not saved anywhere 337 // in the callee's stack frame and does not need to be recovered. 338 // Because %ebp wasn't used in the callee, whatever value it has 339 // is the value that it had in the caller, so it can be carried 340 // straight through without bringing its validity into question. 341 // 342 // Because of the use of .raSearchStart, the stack will possibly be 343 // examined to locate a better return address after program string 344 // evaluation. The stack will not be examined to locate a saved 345 // %ebp value, because these frames do not save (or use) %ebp. 346 // 347 // We also propagate %ebx through, as it is commonly unmodifed after 348 // calling simple forwarding functions in ntdll (that are this non-EBP 349 // using type). It's not clear that this is always correct, but it is 350 // important for some functions to get a correct walk. 351 // 352 // %eip_new = *(%esp_old + callee_params + saved_regs + locals) 353 // %esp_new = %esp_old + callee_params + saved_regs + locals + 4 354 // %ebp_new = %ebp_old 355 // %ebx_new = %ebx_old // If available. 356 program_string = "$eip .raSearchStart ^ = " 357 "$esp .raSearchStart 4 + ="; 358 if (last_frame->context_validity & StackFrameX86::CONTEXT_VALID_EBX) 359 program_string += " $ebx $ebx ="; 360 recover_ebp = false; 361 } 362 363 // Check for alignment operators in the program string. If alignment 364 // operators are found, then current %ebp must be valid and it is the only 365 // reliable data point that can be used for getting to the previous frame. 366 // E.g. the .raSearchStart calculation (above) is based on %esp and since 367 // %esp was aligned in the current frame (which is a lossy operation) the 368 // calculated value of .raSearchStart cannot be correct and should not be 369 // used. Instead .raSearchStart must be calculated based on %ebp. 370 // The code that follows assumes that .raSearchStart is supposed to point 371 // at the saved return address (ebp + 4). 372 // For some more details on this topic, take a look at the following thread: 373 // https://groups.google.com/forum/#!topic/google-breakpad-dev/ZP1FA9B1JjM 374 if ((StackFrameX86::CONTEXT_VALID_EBP & last_frame->context_validity) != 0 && 375 program_string.find('@') != string::npos) { 376 raSearchStart = last_frame->context.ebp + 4; 377 } 378 379 // The difference between raSearch and raSearchStart is unknown, 380 // but making them the same seems to work well in practice. 381 dictionary[".raSearchStart"] = raSearchStart; 382 dictionary[".raSearch"] = raSearchStart; 383 384 // Now crank it out, making sure that the program string set at least the 385 // two required variables. 386 PostfixEvaluator<uint32_t> evaluator = 387 PostfixEvaluator<uint32_t>(&dictionary, memory_); 388 PostfixEvaluator<uint32_t>::DictionaryValidityType dictionary_validity; 389 if (!evaluator.Evaluate(program_string, &dictionary_validity) || 390 dictionary_validity.find("$eip") == dictionary_validity.end() || 391 dictionary_validity.find("$esp") == dictionary_validity.end()) { 392 // Program string evaluation failed. It may be that %eip is not somewhere 393 // with stack frame info, and %ebp is pointing to non-stack memory, so 394 // our evaluation couldn't succeed. We'll scan the stack for a return 395 // address. This can happen if the stack is in a module for which 396 // we don't have symbols, and that module is compiled without a 397 // frame pointer. 398 uint32_t location_start = last_frame->context.esp; 399 uint32_t location, eip; 400 if (!stack_scan_allowed || 401 !ScanForReturnAddress(location_start, &location, &eip, 402 /*is_context_frame=*/last_frame->trust == 403 StackFrame::FRAME_TRUST_CONTEXT)) { 404 // if we can't find an instruction pointer even with stack scanning, 405 // give up. 406 return NULL; 407 } 408 409 // This seems like a reasonable return address. Since program string 410 // evaluation failed, use it and set %esp to the location above the 411 // one where the return address was found. 412 dictionary["$eip"] = eip; 413 dictionary["$esp"] = location + 4; 414 trust = StackFrame::FRAME_TRUST_SCAN; 415 } 416 417 // Since this stack frame did not use %ebp in a traditional way, 418 // locating the return address isn't entirely deterministic. In that 419 // case, the stack can be scanned to locate the return address. 420 // 421 // However, if program string evaluation resulted in both %eip and 422 // %ebp values of 0, trust that the end of the stack has been 423 // reached and don't scan for anything else. 424 if (dictionary["$eip"] != 0 || dictionary["$ebp"] != 0) { 425 int offset = 0; 426 427 // This scan can only be done if a CodeModules object is available, to 428 // check that candidate return addresses are in fact inside a module. 429 // 430 // TODO(mmentovai): This ignores dynamically-generated code. One possible 431 // solution is to check the minidump's memory map to see if the candidate 432 // %eip value comes from a mapped executable page, although this would 433 // require dumps that contain MINIDUMP_MEMORY_INFO, which the Breakpad 434 // client doesn't currently write (it would need to call MiniDumpWriteDump 435 // with the MiniDumpWithFullMemoryInfo type bit set). Even given this 436 // ability, older OSes (pre-XP SP2) and CPUs (pre-P4) don't enforce 437 // an independent execute privilege on memory pages. 438 439 uint32_t eip = dictionary["$eip"]; 440 if (modules_ && !modules_->GetModuleForAddress(eip)) { 441 // The instruction pointer at .raSearchStart was invalid, so start 442 // looking one 32-bit word above that location. 443 uint32_t location_start = dictionary[".raSearchStart"] + 4; 444 uint32_t location; 445 if (stack_scan_allowed && 446 ScanForReturnAddress(location_start, &location, &eip, 447 /*is_context_frame=*/last_frame->trust == 448 StackFrame::FRAME_TRUST_CONTEXT)) { 449 // This is a better return address that what program string 450 // evaluation found. Use it, and set %esp to the location above the 451 // one where the return address was found. 452 dictionary["$eip"] = eip; 453 dictionary["$esp"] = location + 4; 454 offset = location - location_start; 455 trust = StackFrame::FRAME_TRUST_CFI_SCAN; 456 } 457 } 458 459 if (recover_ebp) { 460 // When trying to recover the previous value of the frame pointer (%ebp), 461 // start looking at the lowest possible address in the saved-register 462 // area, and look at the entire saved register area, increased by the 463 // size of |offset| to account for additional data that may be on the 464 // stack. The scan is performed from the highest possible address to 465 // the lowest, because the expectation is that the function's prolog 466 // would have saved %ebp early. 467 uint32_t ebp = dictionary["$ebp"]; 468 469 // When a scan for return address is used, it is possible to skip one or 470 // more frames (when return address is not in a known module). One 471 // indication for skipped frames is when the value of %ebp is lower than 472 // the location of the return address on the stack 473 bool has_skipped_frames = 474 (trust != StackFrame::FRAME_TRUST_CFI && ebp <= raSearchStart + offset); 475 476 uint32_t value; // throwaway variable to check pointer validity 477 if (has_skipped_frames || !memory_->GetMemoryAtAddress(ebp, &value)) { 478 int fp_search_bytes = last_frame_info->saved_register_size + offset; 479 uint32_t location_end = last_frame->context.esp + 480 last_frame_callee_parameter_size; 481 482 for (uint32_t location = location_end + fp_search_bytes; 483 location >= location_end; 484 location -= 4) { 485 if (!memory_->GetMemoryAtAddress(location, &ebp)) 486 break; 487 488 if (memory_->GetMemoryAtAddress(ebp, &value)) { 489 // The candidate value is a pointer to the same memory region 490 // (the stack). Prefer it as a recovered %ebp result. 491 dictionary["$ebp"] = ebp; 492 break; 493 } 494 } 495 } 496 } 497 } 498 499 // Create a new stack frame (ownership will be transferred to the caller) 500 // and fill it in. 501 StackFrameX86* frame = new StackFrameX86(); 502 503 frame->trust = trust; 504 frame->context = last_frame->context; 505 frame->context.eip = dictionary["$eip"]; 506 frame->context.esp = dictionary["$esp"]; 507 frame->context.ebp = dictionary["$ebp"]; 508 frame->context_validity = StackFrameX86::CONTEXT_VALID_EIP | 509 StackFrameX86::CONTEXT_VALID_ESP | 510 StackFrameX86::CONTEXT_VALID_EBP; 511 512 // These are nonvolatile (callee-save) registers, and the program string 513 // may have filled them in. 514 if (dictionary_validity.find("$ebx") != dictionary_validity.end()) { 515 frame->context.ebx = dictionary["$ebx"]; 516 frame->context_validity |= StackFrameX86::CONTEXT_VALID_EBX; 517 } 518 if (dictionary_validity.find("$esi") != dictionary_validity.end()) { 519 frame->context.esi = dictionary["$esi"]; 520 frame->context_validity |= StackFrameX86::CONTEXT_VALID_ESI; 521 } 522 if (dictionary_validity.find("$edi") != dictionary_validity.end()) { 523 frame->context.edi = dictionary["$edi"]; 524 frame->context_validity |= StackFrameX86::CONTEXT_VALID_EDI; 525 } 526 527 return frame; 528 } 529 530 StackFrameX86* StackwalkerX86::GetCallerByCFIFrameInfo( 531 const vector<StackFrame*>& frames, 532 CFIFrameInfo* cfi_frame_info) { 533 // The last frame can never be inline. A sequence of inline frames always 534 // finishes with a conventional frame. 535 assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE); 536 StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back()); 537 last_frame->cfi_frame_info = cfi_frame_info; 538 539 scoped_ptr<StackFrameX86> frame(new StackFrameX86()); 540 if (!cfi_walker_ 541 .FindCallerRegisters(*memory_, *cfi_frame_info, 542 last_frame->context, last_frame->context_validity, 543 &frame->context, &frame->context_validity)) 544 return NULL; 545 546 // Make sure we recovered all the essentials. 547 static const int essentials = (StackFrameX86::CONTEXT_VALID_EIP 548 | StackFrameX86::CONTEXT_VALID_ESP 549 | StackFrameX86::CONTEXT_VALID_EBP); 550 if ((frame->context_validity & essentials) != essentials) 551 return NULL; 552 553 frame->trust = StackFrame::FRAME_TRUST_CFI; 554 555 return frame.release(); 556 } 557 558 StackFrameX86* StackwalkerX86::GetCallerByEBPAtBase( 559 const vector<StackFrame*>& frames, 560 bool stack_scan_allowed) { 561 StackFrame::FrameTrust trust; 562 // The last frame can never be inline. A sequence of inline frames always 563 // finishes with a conventional frame. 564 assert(frames.back()->trust != StackFrame::FRAME_TRUST_INLINE); 565 StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back()); 566 uint32_t last_esp = last_frame->context.esp; 567 uint32_t last_ebp = last_frame->context.ebp; 568 569 // Assume that the standard %ebp-using x86 calling convention is in 570 // use. 571 // 572 // The typical x86 calling convention, when frame pointers are present, 573 // is for the calling procedure to use CALL, which pushes the return 574 // address onto the stack and sets the instruction pointer (%eip) to 575 // the entry point of the called routine. The called routine then 576 // PUSHes the calling routine's frame pointer (%ebp) onto the stack 577 // before copying the stack pointer (%esp) to the frame pointer (%ebp). 578 // Therefore, the calling procedure's frame pointer is always available 579 // by dereferencing the called procedure's frame pointer, and the return 580 // address is always available at the memory location immediately above 581 // the address pointed to by the called procedure's frame pointer. The 582 // calling procedure's stack pointer (%esp) is 8 higher than the value 583 // of the called procedure's frame pointer at the time the calling 584 // procedure made the CALL: 4 bytes for the return address pushed by the 585 // CALL itself, and 4 bytes for the callee's PUSH of the caller's frame 586 // pointer. 587 // 588 // %eip_new = *(%ebp_old + 4) 589 // %esp_new = %ebp_old + 8 590 // %ebp_new = *(%ebp_old) 591 592 uint32_t caller_eip, caller_esp, caller_ebp; 593 594 if (memory_->GetMemoryAtAddress(last_ebp + 4, &caller_eip) && 595 memory_->GetMemoryAtAddress(last_ebp, &caller_ebp)) { 596 caller_esp = last_ebp + 8; 597 trust = StackFrame::FRAME_TRUST_FP; 598 } else { 599 // We couldn't read the memory %ebp refers to. It may be that %ebp 600 // is pointing to non-stack memory. We'll scan the stack for a 601 // return address. This can happen if last_frame is executing code 602 // for a module for which we don't have symbols, and that module 603 // is compiled without a frame pointer. 604 if (!stack_scan_allowed || 605 !ScanForReturnAddress(last_esp, &caller_esp, &caller_eip, 606 /*is_context_frame=*/last_frame->trust == 607 StackFrame::FRAME_TRUST_CONTEXT)) { 608 // if we can't find an instruction pointer even with stack scanning, 609 // give up. 610 return NULL; 611 } 612 613 // ScanForReturnAddress found a reasonable return address. Advance %esp to 614 // the location immediately above the one where the return address was 615 // found. 616 caller_esp += 4; 617 // Try to restore the %ebp chain. The caller %ebp should be stored at a 618 // location immediately below the one where the return address was found. 619 // A valid caller %ebp must be greater than the address where it is stored 620 // and the gap between the two adjacent frames should be reasonable. 621 uint32_t restored_ebp_chain = caller_esp - 8; 622 if (!memory_->GetMemoryAtAddress(restored_ebp_chain, &caller_ebp) || 623 caller_ebp <= restored_ebp_chain || 624 caller_ebp - restored_ebp_chain > kMaxReasonableGapBetweenFrames) { 625 // The restored %ebp chain doesn't appear to be valid. 626 // Assume that %ebp is unchanged. 627 caller_ebp = last_ebp; 628 } 629 630 trust = StackFrame::FRAME_TRUST_SCAN; 631 } 632 633 // Create a new stack frame (ownership will be transferred to the caller) 634 // and fill it in. 635 StackFrameX86* frame = new StackFrameX86(); 636 637 frame->trust = trust; 638 frame->context = last_frame->context; 639 frame->context.eip = caller_eip; 640 frame->context.esp = caller_esp; 641 frame->context.ebp = caller_ebp; 642 frame->context_validity = StackFrameX86::CONTEXT_VALID_EIP | 643 StackFrameX86::CONTEXT_VALID_ESP | 644 StackFrameX86::CONTEXT_VALID_EBP; 645 646 return frame; 647 } 648 649 StackFrame* StackwalkerX86::GetCallerFrame(const CallStack* stack, 650 bool stack_scan_allowed) { 651 if (!memory_ || !stack) { 652 BPLOG(ERROR) << "Can't get caller frame without memory or stack"; 653 return NULL; 654 } 655 656 const vector<StackFrame*>& frames = *stack->frames(); 657 StackFrameX86* last_frame = static_cast<StackFrameX86*>(frames.back()); 658 // The last frame can never be inline. A sequence of inline frames always 659 // finishes with a conventional frame. 660 assert(last_frame->trust != StackFrame::FRAME_TRUST_INLINE); 661 scoped_ptr<StackFrameX86> new_frame; 662 663 // If the resolver has Windows stack walking information, use that. 664 WindowsFrameInfo* windows_frame_info 665 = frame_symbolizer_->FindWindowsFrameInfo(last_frame); 666 if (windows_frame_info) 667 new_frame.reset(GetCallerByWindowsFrameInfo(frames, windows_frame_info, 668 stack_scan_allowed)); 669 670 // If the resolver has DWARF CFI information, use that. 671 if (!new_frame.get()) { 672 CFIFrameInfo* cfi_frame_info = 673 frame_symbolizer_->FindCFIFrameInfo(last_frame); 674 if (cfi_frame_info) 675 new_frame.reset(GetCallerByCFIFrameInfo(frames, cfi_frame_info)); 676 } 677 678 // Otherwise, hope that the program was using a traditional frame structure. 679 if (!new_frame.get()) 680 new_frame.reset(GetCallerByEBPAtBase(frames, stack_scan_allowed)); 681 682 // If nothing worked, tell the caller. 683 if (!new_frame.get()) 684 return NULL; 685 686 // Should we terminate the stack walk? (end-of-stack or broken invariant) 687 if (TerminateWalk(new_frame->context.eip, new_frame->context.esp, 688 last_frame->context.esp, 689 /*first_unwind=*/last_frame->trust == 690 StackFrame::FRAME_TRUST_CONTEXT)) { 691 return NULL; 692 } 693 694 // new_frame->context.eip is the return address, which is the instruction 695 // after the CALL that caused us to arrive at the callee. Set 696 // new_frame->instruction to one less than that, so it points within the 697 // CALL instruction. See StackFrame::instruction for details, and 698 // StackFrameAMD64::ReturnAddress. 699 new_frame->instruction = new_frame->context.eip - 1; 700 701 return new_frame.release(); 702 } 703 704 } // namespace google_breakpad