| /* |
| * Copyright (C) 2011 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /* |
| * Backtracing functions for x86. |
| */ |
| |
| #define LOG_TAG "Corkscrew" |
| //#define LOG_NDEBUG 0 |
| |
| #include "../backtrace-arch.h" |
| #include "../backtrace-helper.h" |
| #include "../ptrace-arch.h" |
| #include <corkscrew/ptrace.h> |
| #include "dwarf.h" |
| |
| #include <stdlib.h> |
| #include <signal.h> |
| #include <stdbool.h> |
| #include <limits.h> |
| #include <errno.h> |
| #include <string.h> |
| #include <sys/ptrace.h> |
| #include <cutils/log.h> |
| |
| #if defined(__BIONIC__) |
| |
| #if defined(__BIONIC_HAVE_UCONTEXT_T) |
| |
| // Bionic offers the Linux kernel headers. |
| #include <asm/sigcontext.h> |
| #include <asm/ucontext.h> |
| typedef struct ucontext ucontext_t; |
| |
| #else /* __BIONIC_HAVE_UCONTEXT_T */ |
| |
| /* Old versions of the Android <signal.h> didn't define ucontext_t. */ |
| |
| typedef struct { |
| uint32_t gregs[32]; |
| void* fpregs; |
| uint32_t oldmask; |
| uint32_t cr2; |
| } mcontext_t; |
| |
| enum { |
| REG_GS = 0, REG_FS, REG_ES, REG_DS, |
| REG_EDI, REG_ESI, REG_EBP, REG_ESP, |
| REG_EBX, REG_EDX, REG_ECX, REG_EAX, |
| REG_TRAPNO, REG_ERR, REG_EIP, REG_CS, |
| REG_EFL, REG_UESP, REG_SS |
| }; |
| |
| /* Machine context at the time a signal was raised. */ |
| typedef struct ucontext { |
| uint32_t uc_flags; |
| struct ucontext* uc_link; |
| stack_t uc_stack; |
| mcontext_t uc_mcontext; |
| uint32_t uc_sigmask; |
| } ucontext_t; |
| |
| #endif /* __BIONIC_HAVE_UCONTEXT_T */ |
| |
| #else /* __BIONIC__ */ |
| |
| // glibc has its own renaming of the Linux kernel's structures. |
| #define __USE_GNU // For REG_EBP, REG_ESP, and REG_EIP. |
| #include <ucontext.h> |
| |
| #endif /* __ BIONIC__ */ |
| |
| /* Unwind state. */ |
| typedef struct { |
| uint32_t reg[DWARF_REGISTERS]; |
| } unwind_state_t; |
| |
| typedef struct { |
| backtrace_frame_t* backtrace; |
| size_t ignore_depth; |
| size_t max_depth; |
| size_t ignored_frames; |
| size_t returned_frames; |
| memory_t memory; |
| } backtrace_state_t; |
| |
| uintptr_t rewind_pc_arch(const memory_t* memory __attribute__((unused)), uintptr_t pc) { |
| /* TODO: x86 instructions are 1-16 bytes, to define exact size of previous instruction |
| we have to disassemble from the function entry point up to pc. |
| Returning pc-1 is probably enough for now, the only drawback is that |
| it points somewhere between the first byte of instruction we are looking for and |
| the first byte of the next instruction. */ |
| |
| return pc-1; |
| /* TODO: We should adjust that for the signal frames and return pc for them instead of pc-1. |
| To recognize signal frames we should read cie_info property. */ |
| } |
| |
| /* Read byte through 4 byte cache. Usually we read byte by byte and updating cursor. */ |
| static bool try_get_byte(const memory_t* memory, uintptr_t ptr, uint8_t* out_value, uint32_t* cursor) { |
| static uintptr_t lastptr; |
| static uint32_t buf; |
| |
| ptr += *cursor; |
| |
| if (ptr < lastptr || lastptr + 3 < ptr) { |
| lastptr = (ptr >> 2) << 2; |
| if (!try_get_word(memory, lastptr, &buf)) { |
| return false; |
| } |
| } |
| *out_value = (uint8_t)((buf >> ((ptr & 3) * 8)) & 0xff); |
| ++*cursor; |
| return true; |
| } |
| |
| /* Getting X bytes. 4 is maximum for now. */ |
| static bool try_get_xbytes(const memory_t* memory, uintptr_t ptr, uint32_t* out_value, uint8_t bytes, uint32_t* cursor) { |
| uint32_t data = 0; |
| if (bytes > 4) { |
| ALOGE("can't read more than 4 bytes, trying to read %d", bytes); |
| return false; |
| } |
| for (int i = 0; i < bytes; i++) { |
| uint8_t buf; |
| if (!try_get_byte(memory, ptr, &buf, cursor)) { |
| return false; |
| } |
| data |= (uint32_t)buf << (i * 8); |
| } |
| *out_value = data; |
| return true; |
| } |
| |
| /* Reads signed/unsigned LEB128 encoded data. From 1 to 4 bytes. */ |
| static bool try_get_leb128(const memory_t* memory, uintptr_t ptr, uint32_t* out_value, uint32_t* cursor, bool sign_extend) { |
| uint8_t buf = 0; |
| uint32_t val = 0; |
| uint8_t c = 0; |
| do { |
| if (!try_get_byte(memory, ptr, &buf, cursor)) { |
| return false; |
| } |
| val |= ((uint32_t)buf & 0x7f) << (c * 7); |
| c++; |
| } while (buf & 0x80 && (c * 7) <= 32); |
| if (c * 7 > 32) { |
| ALOGE("%s: data exceeds expected 4 bytes maximum", __FUNCTION__); |
| return false; |
| } |
| if (sign_extend) { |
| if (buf & 0x40) { |
| val |= ((uint32_t)-1 << (c * 7)); |
| } |
| } |
| *out_value = val; |
| return true; |
| } |
| |
| /* Reads signed LEB128 encoded data. From 1 to 4 bytes. */ |
| static bool try_get_sleb128(const memory_t* memory, uintptr_t ptr, uint32_t* out_value, uint32_t* cursor) { |
| return try_get_leb128(memory, ptr, out_value, cursor, true); |
| } |
| |
| /* Reads unsigned LEB128 encoded data. From 1 to 4 bytes. */ |
| static bool try_get_uleb128(const memory_t* memory, uintptr_t ptr, uint32_t* out_value, uint32_t* cursor) { |
| return try_get_leb128(memory, ptr, out_value, cursor, false); |
| } |
| |
| /* Getting data encoded by dwarf encodings. */ |
| static bool read_dwarf(const memory_t* memory, uintptr_t ptr, uint32_t* out_value, uint8_t encoding, uint32_t* cursor) { |
| uint32_t data = 0; |
| bool issigned = true; |
| uintptr_t addr = ptr + *cursor; |
| /* Lower 4 bits is data type/size */ |
| /* TODO: add more encodings if it becomes necessary */ |
| switch (encoding & 0xf) { |
| case DW_EH_PE_absptr: |
| if (!try_get_xbytes(memory, ptr, &data, 4, cursor)) { |
| return false; |
| } |
| *out_value = data; |
| return true; |
| case DW_EH_PE_udata4: |
| issigned = false; |
| case DW_EH_PE_sdata4: |
| if (!try_get_xbytes(memory, ptr, &data, 4, cursor)) { |
| return false; |
| } |
| break; |
| default: |
| ALOGE("unrecognized dwarf lower part encoding: 0x%x", encoding); |
| return false; |
| } |
| /* Higher 4 bits is modifier */ |
| /* TODO: add more encodings if it becomes necessary */ |
| switch (encoding & 0xf0) { |
| case 0: |
| *out_value = data; |
| break; |
| case DW_EH_PE_pcrel: |
| if (issigned) { |
| *out_value = addr + (int32_t)data; |
| } else { |
| *out_value = addr + data; |
| } |
| break; |
| /* Assuming ptr is correct base to calculate datarel */ |
| case DW_EH_PE_datarel: |
| if (issigned) { |
| *out_value = ptr + (int32_t)data; |
| } else { |
| *out_value = ptr + data; |
| } |
| break; |
| default: |
| ALOGE("unrecognized dwarf higher part encoding: 0x%x", encoding); |
| return false; |
| } |
| return true; |
| } |
| |
| /* Having PC find corresponding FDE by reading .eh_frame_hdr section data. */ |
| static uintptr_t find_fde(const memory_t* memory, |
| const map_info_t* map_info_list, uintptr_t pc) { |
| if (!pc) { |
| ALOGV("find_fde: pc is zero, no eh_frame"); |
| return 0; |
| } |
| const map_info_t* mi = find_map_info(map_info_list, pc); |
| if (!mi) { |
| ALOGV("find_fde: no map info for pc:0x%x", pc); |
| return 0; |
| } |
| const map_info_data_t* midata = mi->data; |
| if (!midata) { |
| ALOGV("find_fde: no eh_frame_hdr for map: start=0x%x, end=0x%x", mi->start, mi->end); |
| return 0; |
| } |
| |
| eh_frame_hdr_info_t eh_hdr_info; |
| memset(&eh_hdr_info, 0, sizeof(eh_frame_hdr_info_t)); |
| |
| /* Getting the first word of eh_frame_hdr: |
| 1st byte is version; |
| 2nd byte is encoding of pointer to eh_frames; |
| 3rd byte is encoding of count of FDEs in lookup table; |
| 4th byte is encoding of lookup table entries. |
| */ |
| uintptr_t eh_frame_hdr = midata->eh_frame_hdr; |
| uint32_t c = 0; |
| if (!try_get_byte(memory, eh_frame_hdr, &eh_hdr_info.version, &c)) return 0; |
| if (!try_get_byte(memory, eh_frame_hdr, &eh_hdr_info.eh_frame_ptr_enc, &c)) return 0; |
| if (!try_get_byte(memory, eh_frame_hdr, &eh_hdr_info.fde_count_enc, &c)) return 0; |
| if (!try_get_byte(memory, eh_frame_hdr, &eh_hdr_info.fde_table_enc, &c)) return 0; |
| |
| /* TODO: 3rd byte can be DW_EH_PE_omit, that means no lookup table available and we should |
| try to parse eh_frame instead. Not sure how often it may occur, skipping now. |
| */ |
| if (eh_hdr_info.version != 1) { |
| ALOGV("find_fde: eh_frame_hdr version %d is not supported", eh_hdr_info.version); |
| return 0; |
| } |
| /* Getting the data: |
| 2nd word is eh_frame pointer (normally not used, because lookup table has all we need); |
| 3rd word is count of FDEs in the lookup table; |
| starting from 4 word there is FDE lookup table (pairs of PC and FDE pointer) sorted by PC; |
| */ |
| if (!read_dwarf(memory, eh_frame_hdr, &eh_hdr_info.eh_frame_ptr, eh_hdr_info.eh_frame_ptr_enc, &c)) return 0; |
| if (!read_dwarf(memory, eh_frame_hdr, &eh_hdr_info.fde_count, eh_hdr_info.fde_count_enc, &c)) return 0; |
| ALOGV("find_fde: found %d FDEs", eh_hdr_info.fde_count); |
| |
| int32_t low = 0; |
| int32_t high = eh_hdr_info.fde_count; |
| uintptr_t start = 0; |
| uintptr_t fde = 0; |
| /* eh_frame_hdr + c points to lookup table at this point. */ |
| while (low <= high) { |
| uint32_t mid = (high + low)/2; |
| uint32_t entry = c + mid * 8; |
| if (!read_dwarf(memory, eh_frame_hdr, &start, eh_hdr_info.fde_table_enc, &entry)) return 0; |
| if (pc <= start) { |
| high = mid - 1; |
| } else { |
| low = mid + 1; |
| } |
| } |
| /* Value found is at high. */ |
| if (high < 0) { |
| ALOGV("find_fde: pc %x is out of FDE bounds: %x", pc, start); |
| return 0; |
| } |
| c += high * 8; |
| if (!read_dwarf(memory, eh_frame_hdr, &start, eh_hdr_info.fde_table_enc, &c)) return 0; |
| if (!read_dwarf(memory, eh_frame_hdr, &fde, eh_hdr_info.fde_table_enc, &c)) return 0; |
| ALOGV("pc 0x%x, ENTRY %d: start=0x%x, fde=0x%x", pc, high, start, fde); |
| return fde; |
| } |
| |
| /* Execute single dwarf instruction and update dwarf state accordingly. */ |
| static bool execute_dwarf(const memory_t* memory, uintptr_t ptr, cie_info_t* cie_info, |
| dwarf_state_t* dstate, uint32_t* cursor, |
| dwarf_state_t* stack, uint8_t* stack_ptr) { |
| uint8_t inst; |
| uint8_t op = 0; |
| |
| if (!try_get_byte(memory, ptr, &inst, cursor)) { |
| return false; |
| } |
| ALOGV("DW_CFA inst: 0x%x", inst); |
| |
| /* For some instructions upper 2 bits is opcode and lower 6 bits is operand. See dwarf-2.0 7.23. */ |
| if (inst & 0xc0) { |
| op = inst & 0x3f; |
| inst &= 0xc0; |
| } |
| |
| switch ((dwarf_CFA)inst) { |
| uint32_t reg = 0; |
| uint32_t offset = 0; |
| case DW_CFA_advance_loc: |
| dstate->loc += op * cie_info->code_align; |
| ALOGV("DW_CFA_advance_loc: %d to 0x%x", op, dstate->loc); |
| break; |
| case DW_CFA_offset: |
| if (!try_get_uleb128(memory, ptr, &offset, cursor)) return false; |
| dstate->regs[op].rule = 'o'; |
| dstate->regs[op].value = offset * cie_info->data_align; |
| ALOGV("DW_CFA_offset: r%d = o(%d)", op, dstate->regs[op].value); |
| break; |
| case DW_CFA_restore: |
| dstate->regs[op].rule = stack->regs[op].rule; |
| dstate->regs[op].value = stack->regs[op].value; |
| ALOGV("DW_CFA_restore: r%d = %c(%d)", op, dstate->regs[op].rule, dstate->regs[op].value); |
| break; |
| case DW_CFA_nop: |
| break; |
| case DW_CFA_set_loc: // probably we don't have it on x86. |
| if (!try_get_xbytes(memory, ptr, &offset, 4, cursor)) return false; |
| if (offset < dstate->loc) { |
| ALOGE("DW_CFA_set_loc: attempt to move location backward"); |
| return false; |
| } |
| dstate->loc = offset * cie_info->code_align; |
| ALOGV("DW_CFA_set_loc: %d to 0x%x", offset * cie_info->code_align, dstate->loc); |
| break; |
| case DW_CFA_advance_loc1: |
| if (!try_get_byte(memory, ptr, (uint8_t*)&offset, cursor)) return false; |
| dstate->loc += (uint8_t)offset * cie_info->code_align; |
| ALOGV("DW_CFA_advance_loc1: %d to 0x%x", (uint8_t)offset * cie_info->code_align, dstate->loc); |
| break; |
| case DW_CFA_advance_loc2: |
| if (!try_get_xbytes(memory, ptr, &offset, 2, cursor)) return false; |
| dstate->loc += (uint16_t)offset * cie_info->code_align; |
| ALOGV("DW_CFA_advance_loc2: %d to 0x%x", (uint16_t)offset * cie_info->code_align, dstate->loc); |
| break; |
| case DW_CFA_advance_loc4: |
| if (!try_get_xbytes(memory, ptr, &offset, 4, cursor)) return false; |
| dstate->loc += offset * cie_info->code_align; |
| ALOGV("DW_CFA_advance_loc4: %d to 0x%x", offset * cie_info->code_align, dstate->loc); |
| break; |
| case DW_CFA_offset_extended: // probably we don't have it on x86. |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| if (!try_get_uleb128(memory, ptr, &offset, cursor)) return false; |
| if (reg > DWARF_REGISTERS) { |
| ALOGE("DW_CFA_offset_extended: r%d exceeds supported number of registers (%d)", reg, DWARF_REGISTERS); |
| return false; |
| } |
| dstate->regs[reg].rule = 'o'; |
| dstate->regs[reg].value = offset * cie_info->data_align; |
| ALOGV("DW_CFA_offset_extended: r%d = o(%d)", reg, dstate->regs[reg].value); |
| break; |
| case DW_CFA_restore_extended: // probably we don't have it on x86. |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| dstate->regs[reg].rule = stack->regs[reg].rule; |
| dstate->regs[reg].value = stack->regs[reg].value; |
| if (reg > DWARF_REGISTERS) { |
| ALOGE("DW_CFA_restore_extended: r%d exceeds supported number of registers (%d)", reg, DWARF_REGISTERS); |
| return false; |
| } |
| ALOGV("DW_CFA_restore: r%d = %c(%d)", reg, dstate->regs[reg].rule, dstate->regs[reg].value); |
| break; |
| case DW_CFA_undefined: // probably we don't have it on x86. |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| dstate->regs[reg].rule = 'u'; |
| dstate->regs[reg].value = 0; |
| if (reg > DWARF_REGISTERS) { |
| ALOGE("DW_CFA_undefined: r%d exceeds supported number of registers (%d)", reg, DWARF_REGISTERS); |
| return false; |
| } |
| ALOGV("DW_CFA_undefined: r%d", reg); |
| break; |
| case DW_CFA_same_value: // probably we don't have it on x86. |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| dstate->regs[reg].rule = 's'; |
| dstate->regs[reg].value = 0; |
| if (reg > DWARF_REGISTERS) { |
| ALOGE("DW_CFA_undefined: r%d exceeds supported number of registers (%d)", reg, DWARF_REGISTERS); |
| return false; |
| } |
| ALOGV("DW_CFA_same_value: r%d", reg); |
| break; |
| case DW_CFA_register: // probably we don't have it on x86. |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| /* that's new register actually, not offset */ |
| if (!try_get_uleb128(memory, ptr, &offset, cursor)) return false; |
| if (reg > DWARF_REGISTERS || offset > DWARF_REGISTERS) { |
| ALOGE("DW_CFA_register: r%d or r%d exceeds supported number of registers (%d)", reg, offset, DWARF_REGISTERS); |
| return false; |
| } |
| dstate->regs[reg].rule = 'r'; |
| dstate->regs[reg].value = offset; |
| ALOGV("DW_CFA_register: r%d = r(%d)", reg, dstate->regs[reg].value); |
| break; |
| case DW_CFA_remember_state: |
| if (*stack_ptr == DWARF_STATES_STACK) { |
| ALOGE("DW_CFA_remember_state: states stack overflow %d", *stack_ptr); |
| return false; |
| } |
| stack[(*stack_ptr)++] = *dstate; |
| ALOGV("DW_CFA_remember_state: stacktop moves to %d", *stack_ptr); |
| break; |
| case DW_CFA_restore_state: |
| /* We have CIE state saved at 0 position. It's not supposed to be taken |
| by DW_CFA_restore_state. */ |
| if (*stack_ptr == 1) { |
| ALOGE("DW_CFA_restore_state: states stack is empty"); |
| return false; |
| } |
| /* Don't touch location on restore. */ |
| uintptr_t saveloc = dstate->loc; |
| *dstate = stack[--*stack_ptr]; |
| dstate->loc = saveloc; |
| ALOGV("DW_CFA_restore_state: stacktop moves to %d", *stack_ptr); |
| break; |
| case DW_CFA_def_cfa: |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) return false; |
| if (!try_get_uleb128(memory, ptr, &offset, cursor)) return false; |
| dstate->cfa_reg = reg; |
| dstate->cfa_off = offset; |
| ALOGV("DW_CFA_def_cfa: %x(r%d)", offset, reg); |
| break; |
| case DW_CFA_def_cfa_register: |
| if (!try_get_uleb128(memory, ptr, ®, cursor)) { |
| return false; |
| } |
| dstate->cfa_reg = reg; |
| ALOGV("DW_CFA_def_cfa_register: r%d", reg); |
| break; |
| case DW_CFA_def_cfa_offset: |
| if (!try_get_uleb128(memory, ptr, &offset, cursor)) { |
| return false; |
| } |
| dstate->cfa_off = offset; |
| ALOGV("DW_CFA_def_cfa_offset: %x", offset); |
| break; |
| default: |
| ALOGE("unrecognized DW_CFA_* instruction: 0x%x", inst); |
| return false; |
| } |
| return true; |
| } |
| |
| /* Restoring particular register value based on dwarf state. */ |
| static bool get_old_register_value(const memory_t* memory, uint32_t cfa, |
| dwarf_state_t* dstate, uint8_t reg, |
| unwind_state_t* state, unwind_state_t* newstate) { |
| uint32_t addr; |
| switch (dstate->regs[reg].rule) { |
| case 0: |
| /* We don't have dstate updated for this register, so assuming value kept the same. |
| Normally we should look into state and return current value as the old one |
| but we don't have all registers in state to handle this properly */ |
| ALOGV("get_old_register_value: value of r%d is the same", reg); |
| // for ESP if it's not updated by dwarf rule we assume it's equal to CFA |
| if (reg == DWARF_ESP) { |
| ALOGV("get_old_register_value: adjusting esp to CFA: 0x%x", cfa); |
| newstate->reg[reg] = cfa; |
| } else { |
| newstate->reg[reg] = state->reg[reg]; |
| } |
| break; |
| case 'o': |
| addr = cfa + (int32_t)dstate->regs[reg].value; |
| if (!try_get_word(memory, addr, &newstate->reg[reg])) { |
| ALOGE("get_old_register_value: can't read from 0x%x", addr); |
| return false; |
| } |
| ALOGV("get_old_register_value: r%d at 0x%x is 0x%x", reg, addr, newstate->reg[reg]); |
| break; |
| case 'r': |
| /* We don't have all registers in state so don't even try to look at 'r' */ |
| ALOGE("get_old_register_value: register lookup not implemented yet"); |
| break; |
| default: |
| ALOGE("get_old_register_value: unexpected rule:%c value:%d for register %d", |
| dstate->regs[reg].rule, (int32_t)dstate->regs[reg].value, reg); |
| return false; |
| } |
| return true; |
| } |
| |
| /* Updaing state based on dwarf state. */ |
| static bool update_state(const memory_t* memory, unwind_state_t* state, |
| dwarf_state_t* dstate, cie_info_t* cie_info) { |
| unwind_state_t newstate; |
| /* We can restore more registers here if we need them. Meanwile doing minimal work here. */ |
| /* Getting CFA. */ |
| uintptr_t cfa = 0; |
| if (dstate->cfa_reg == DWARF_ESP) { |
| cfa = state->reg[DWARF_ESP] + dstate->cfa_off; |
| } else if (dstate->cfa_reg == DWARF_EBP) { |
| cfa = state->reg[DWARF_EBP] + dstate->cfa_off; |
| } else { |
| ALOGE("update_state: unexpected CFA register: %d", dstate->cfa_reg); |
| return false; |
| } |
| ALOGV("update_state: new CFA: 0x%x", cfa); |
| /* Getting EIP. */ |
| if (!get_old_register_value(memory, cfa, dstate, DWARF_EIP, state, &newstate)) return false; |
| /* Getting EBP. */ |
| if (!get_old_register_value(memory, cfa, dstate, DWARF_EBP, state, &newstate)) return false; |
| /* Getting ESP. */ |
| if (!get_old_register_value(memory, cfa, dstate, DWARF_ESP, state, &newstate)) return false; |
| |
| ALOGV("update_state: IP: 0x%x; restore IP: 0x%x", state->reg[DWARF_EIP], newstate.reg[DWARF_EIP]); |
| ALOGV("update_state: EBP: 0x%x; restore EBP: 0x%x", state->reg[DWARF_EBP], newstate.reg[DWARF_EBP]); |
| ALOGV("update_state: ESP: 0x%x; restore ESP: 0x%x", state->reg[DWARF_ESP], newstate.reg[DWARF_ESP]); |
| *state = newstate; |
| return true; |
| } |
| |
| /* Execute CIE and FDE instructions for FDE found with find_fde. */ |
| static bool execute_fde(const memory_t* memory, |
| const map_info_t* map_info_list, |
| uintptr_t fde, |
| unwind_state_t* state) { |
| uint32_t fde_length = 0; |
| uint32_t cie_length = 0; |
| uintptr_t cie = 0; |
| uintptr_t cie_offset = 0; |
| cie_info_t cie_i; |
| cie_info_t* cie_info = &cie_i; |
| fde_info_t fde_i; |
| fde_info_t* fde_info = &fde_i; |
| dwarf_state_t dwarf_state; |
| dwarf_state_t* dstate = &dwarf_state; |
| dwarf_state_t stack[DWARF_STATES_STACK]; |
| uint8_t stack_ptr = 0; |
| |
| memset(dstate, 0, sizeof(dwarf_state_t)); |
| memset(cie_info, 0, sizeof(cie_info_t)); |
| memset(fde_info, 0, sizeof(fde_info_t)); |
| |
| /* Read common CIE or FDE area: |
| 1st word is length; |
| 2nd word is ID: 0 for CIE, CIE pointer for FDE. |
| */ |
| if (!try_get_word(memory, fde, &fde_length)) { |
| return false; |
| } |
| if ((int32_t)fde_length == -1) { |
| ALOGV("execute_fde: 64-bit dwarf detected, not implemented yet"); |
| return false; |
| } |
| if (!try_get_word(memory, fde + 4, &cie_offset)) { |
| return false; |
| } |
| if (cie_offset == 0) { |
| /* This is CIE. We shouldn't be here normally. */ |
| cie = fde; |
| cie_length = fde_length; |
| } else { |
| /* Find CIE. */ |
| /* Positive cie_offset goes backward from current field. */ |
| cie = fde + 4 - cie_offset; |
| if (!try_get_word(memory, cie, &cie_length)) { |
| return false; |
| } |
| if ((int32_t)cie_length == -1) { |
| ALOGV("execute_fde: 64-bit dwarf detected, not implemented yet"); |
| return false; |
| } |
| if (!try_get_word(memory, cie + 4, &cie_offset)) { |
| return false; |
| } |
| if (cie_offset != 0) { |
| ALOGV("execute_fde: can't find CIE"); |
| return false; |
| } |
| } |
| ALOGV("execute_fde: FDE length: %d", fde_length); |
| ALOGV("execute_fde: CIE pointer: %x", cie); |
| ALOGV("execute_fde: CIE length: %d", cie_length); |
| |
| /* Read CIE: |
| Augmentation independent: |
| 1st byte is version; |
| next x bytes is /0 terminated augmentation string; |
| next x bytes is unsigned LEB128 encoded code alignment factor; |
| next x bytes is signed LEB128 encoded data alignment factor; |
| next 1 (CIE version 1) or x (CIE version 3 unsigned LEB128) bytes is return register column; |
| Augmentation dependent: |
| if 'z' next x bytes is unsigned LEB128 encoded augmentation data size; |
| if 'L' next 1 byte is LSDA encoding; |
| if 'R' next 1 byte is FDE encoding; |
| if 'S' CIE represents signal handler stack frame; |
| if 'P' next 1 byte is personality encoding folowed by personality function pointer; |
| Next x bytes is CIE program. |
| */ |
| |
| uint32_t c = 8; |
| if (!try_get_byte(memory, cie, &cie_info->version, &c)) { |
| return false; |
| } |
| ALOGV("execute_fde: CIE version: %d", cie_info->version); |
| uint8_t ch; |
| do { |
| if (!try_get_byte(memory, cie, &ch, &c)) { |
| return false; |
| } |
| switch (ch) { |
| case '\0': break; |
| case 'z': cie_info->aug_z = 1; break; |
| case 'L': cie_info->aug_L = 1; break; |
| case 'R': cie_info->aug_R = 1; break; |
| case 'S': cie_info->aug_S = 1; break; |
| case 'P': cie_info->aug_P = 1; break; |
| default: |
| ALOGV("execute_fde: Unrecognized CIE augmentation char: '%c'", ch); |
| return false; |
| break; |
| } |
| } while (ch); |
| if (!try_get_uleb128(memory, cie, &cie_info->code_align, &c)) { |
| return false; |
| } |
| if (!try_get_sleb128(memory, cie, &cie_info->data_align, &c)) { |
| return false; |
| } |
| if (cie_info->version >= 3) { |
| if (!try_get_uleb128(memory, cie, &cie_info->reg, &c)) { |
| return false; |
| } |
| } else { |
| if (!try_get_byte(memory, cie, (uint8_t*)&cie_info->reg, &c)) { |
| return false; |
| } |
| } |
| ALOGV("execute_fde: CIE code alignment factor: %d", cie_info->code_align); |
| ALOGV("execute_fde: CIE data alignment factor: %d", cie_info->data_align); |
| if (cie_info->aug_z) { |
| if (!try_get_uleb128(memory, cie, &cie_info->aug_z, &c)) { |
| return false; |
| } |
| } |
| if (cie_info->aug_L) { |
| if (!try_get_byte(memory, cie, &cie_info->aug_L, &c)) { |
| return false; |
| } |
| } else { |
| /* Default encoding. */ |
| cie_info->aug_L = DW_EH_PE_absptr; |
| } |
| if (cie_info->aug_R) { |
| if (!try_get_byte(memory, cie, &cie_info->aug_R, &c)) { |
| return false; |
| } |
| } else { |
| /* Default encoding. */ |
| cie_info->aug_R = DW_EH_PE_absptr; |
| } |
| if (cie_info->aug_P) { |
| /* Get encoding of personality routine pointer. We don't use it now. */ |
| if (!try_get_byte(memory, cie, (uint8_t*)&cie_info->aug_P, &c)) { |
| return false; |
| } |
| /* Get routine pointer. */ |
| if (!read_dwarf(memory, cie, &cie_info->aug_P, (uint8_t)cie_info->aug_P, &c)) { |
| return false; |
| } |
| } |
| /* CIE program. */ |
| /* Length field itself (4 bytes) is not included into length. */ |
| stack[0] = *dstate; |
| stack_ptr = 1; |
| while (c < cie_length + 4) { |
| if (!execute_dwarf(memory, cie, cie_info, dstate, &c, stack, &stack_ptr)) { |
| return false; |
| } |
| } |
| |
| /* We went directly to CIE. Normally it shouldn't occur. */ |
| if (cie == fde) return true; |
| |
| /* Go back to FDE. */ |
| c = 8; |
| /* Read FDE: |
| Augmentation independent: |
| next x bytes (encoded as specified in CIE) is FDE starting address; |
| next x bytes (encoded as specified in CIE) is FDE number of instructions covered; |
| Augmentation dependent: |
| if 'z' next x bytes is unsigned LEB128 encoded augmentation data size; |
| if 'L' next x bytes is LSDA pointer (encoded as specified in CIE); |
| Next x bytes is FDE program. |
| */ |
| if (!read_dwarf(memory, fde, &fde_info->start, (uint8_t)cie_info->aug_R, &c)) { |
| return false; |
| } |
| dstate->loc = fde_info->start; |
| ALOGV("execute_fde: FDE start: %x", dstate->loc); |
| if (!read_dwarf(memory, fde, &fde_info->length, 0, &c)) { |
| return false; |
| } |
| ALOGV("execute_fde: FDE length: %x", fde_info->length); |
| if (cie_info->aug_z) { |
| if (!try_get_uleb128(memory, fde, &fde_info->aug_z, &c)) { |
| return false; |
| } |
| } |
| if (cie_info->aug_L && cie_info->aug_L != DW_EH_PE_omit) { |
| if (!read_dwarf(memory, fde, &fde_info->aug_L, cie_info->aug_L, &c)) { |
| return false; |
| } |
| } |
| /* FDE program. */ |
| /* Length field itself (4 bytes) is not included into length. */ |
| /* Save CIE state as 0 element of stack. Used by DW_CFA_restore. */ |
| stack[0] = *dstate; |
| stack_ptr = 1; |
| while (c < fde_length + 4 && state->reg[DWARF_EIP] >= dstate->loc) { |
| if (!execute_dwarf(memory, fde, cie_info, dstate, &c, stack, &stack_ptr)) { |
| return false; |
| } |
| ALOGV("IP: %x, LOC: %x", state->reg[DWARF_EIP], dstate->loc); |
| } |
| |
| return update_state(memory, state, dstate, cie_info); |
| } |
| |
| static ssize_t unwind_backtrace_common(const memory_t* memory, |
| const map_info_t* map_info_list, |
| unwind_state_t* state, backtrace_frame_t* backtrace, |
| size_t ignore_depth, size_t max_depth) { |
| |
| size_t ignored_frames = 0; |
| size_t returned_frames = 0; |
| |
| ALOGV("Unwinding tid: %d", memory->tid); |
| ALOGV("IP: %x", state->reg[DWARF_EIP]); |
| ALOGV("BP: %x", state->reg[DWARF_EBP]); |
| ALOGV("SP: %x", state->reg[DWARF_ESP]); |
| |
| for (size_t index = 0; returned_frames < max_depth; index++) { |
| uintptr_t fde = find_fde(memory, map_info_list, state->reg[DWARF_EIP]); |
| /* FDE is not found, it may happen if stack is corrupted or calling wrong adress. |
| Getting return address from stack. |
| */ |
| if (!fde) { |
| uint32_t ip; |
| ALOGV("trying to restore registers from stack"); |
| if (!try_get_word(memory, state->reg[DWARF_EBP] + 4, &ip) || |
| ip == state->reg[DWARF_EIP]) { |
| ALOGV("can't get IP from stack"); |
| break; |
| } |
| /* We've been able to get IP from stack so recording the frame before continue. */ |
| backtrace_frame_t* frame = add_backtrace_entry( |
| index ? rewind_pc_arch(memory, state->reg[DWARF_EIP]) : state->reg[DWARF_EIP], |
| backtrace, ignore_depth, max_depth, |
| &ignored_frames, &returned_frames); |
| state->reg[DWARF_EIP] = ip; |
| state->reg[DWARF_ESP] = state->reg[DWARF_EBP] + 8; |
| if (!try_get_word(memory, state->reg[DWARF_EBP], &state->reg[DWARF_EBP])) { |
| ALOGV("can't get EBP from stack"); |
| break; |
| } |
| ALOGV("restore IP: %x", state->reg[DWARF_EIP]); |
| ALOGV("restore BP: %x", state->reg[DWARF_EBP]); |
| ALOGV("restore SP: %x", state->reg[DWARF_ESP]); |
| continue; |
| } |
| backtrace_frame_t* frame = add_backtrace_entry( |
| index ? rewind_pc_arch(memory, state->reg[DWARF_EIP]) : state->reg[DWARF_EIP], |
| backtrace, ignore_depth, max_depth, |
| &ignored_frames, &returned_frames); |
| |
| uint32_t stack_top = state->reg[DWARF_ESP]; |
| |
| if (!execute_fde(memory, map_info_list, fde, state)) break; |
| |
| if (frame) { |
| frame->stack_top = stack_top; |
| if (stack_top < state->reg[DWARF_ESP]) { |
| frame->stack_size = state->reg[DWARF_ESP] - stack_top; |
| } |
| } |
| ALOGV("Stack: 0x%x ... 0x%x - %d bytes", frame->stack_top, state->reg[DWARF_ESP], frame->stack_size); |
| } |
| return returned_frames; |
| } |
| |
| ssize_t unwind_backtrace_signal_arch(siginfo_t* siginfo __attribute__((unused)), void* sigcontext, |
| const map_info_t* map_info_list, |
| backtrace_frame_t* backtrace, size_t ignore_depth, size_t max_depth) { |
| const ucontext_t* uc = (const ucontext_t*)sigcontext; |
| |
| unwind_state_t state; |
| state.reg[DWARF_EBP] = uc->uc_mcontext.gregs[REG_EBP]; |
| state.reg[DWARF_ESP] = uc->uc_mcontext.gregs[REG_ESP]; |
| state.reg[DWARF_EIP] = uc->uc_mcontext.gregs[REG_EIP]; |
| |
| memory_t memory; |
| init_memory(&memory, map_info_list); |
| return unwind_backtrace_common(&memory, map_info_list, |
| &state, backtrace, ignore_depth, max_depth); |
| } |
| |
| ssize_t unwind_backtrace_ptrace_arch(pid_t tid, const ptrace_context_t* context, |
| backtrace_frame_t* backtrace, size_t ignore_depth, size_t max_depth) { |
| pt_regs_x86_t regs; |
| if (ptrace(PTRACE_GETREGS, tid, 0, ®s)) { |
| return -1; |
| } |
| |
| unwind_state_t state; |
| state.reg[DWARF_EBP] = regs.ebp; |
| state.reg[DWARF_EIP] = regs.eip; |
| state.reg[DWARF_ESP] = regs.esp; |
| |
| memory_t memory; |
| init_memory_ptrace(&memory, tid); |
| return unwind_backtrace_common(&memory, context->map_info_list, |
| &state, backtrace, ignore_depth, max_depth); |
| } |
