1 //===-- x86AssemblyInspectionEngine.cpp -------------------------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "x86AssemblyInspectionEngine.h" 10 11 #include <memory> 12 13 #include "llvm-c/Disassembler.h" 14 15 #include "lldb/Core/Address.h" 16 #include "lldb/Symbol/UnwindPlan.h" 17 #include "lldb/Target/RegisterContext.h" 18 #include "lldb/Target/UnwindAssembly.h" 19 20 using namespace lldb_private; 21 using namespace lldb; 22 23 x86AssemblyInspectionEngine::x86AssemblyInspectionEngine(const ArchSpec &arch) 24 : m_cur_insn(nullptr), m_machine_ip_regnum(LLDB_INVALID_REGNUM), 25 m_machine_sp_regnum(LLDB_INVALID_REGNUM), 26 m_machine_fp_regnum(LLDB_INVALID_REGNUM), 27 m_lldb_ip_regnum(LLDB_INVALID_REGNUM), 28 m_lldb_sp_regnum(LLDB_INVALID_REGNUM), 29 m_lldb_fp_regnum(LLDB_INVALID_REGNUM), 30 31 m_reg_map(), m_arch(arch), m_cpu(k_cpu_unspecified), m_wordsize(-1), 32 m_register_map_initialized(false), m_disasm_context() { 33 m_disasm_context = 34 ::LLVMCreateDisasm(arch.GetTriple().getTriple().c_str(), nullptr, 35 /*TagType=*/1, nullptr, nullptr); 36 } 37 38 x86AssemblyInspectionEngine::~x86AssemblyInspectionEngine() { 39 ::LLVMDisasmDispose(m_disasm_context); 40 } 41 42 void x86AssemblyInspectionEngine::Initialize(RegisterContextSP ®_ctx) { 43 m_cpu = k_cpu_unspecified; 44 m_wordsize = -1; 45 m_register_map_initialized = false; 46 47 const llvm::Triple::ArchType cpu = m_arch.GetMachine(); 48 if (cpu == llvm::Triple::x86) 49 m_cpu = k_i386; 50 else if (cpu == llvm::Triple::x86_64) 51 m_cpu = k_x86_64; 52 53 if (m_cpu == k_cpu_unspecified) 54 return; 55 56 if (reg_ctx.get() == nullptr) 57 return; 58 59 if (m_cpu == k_i386) { 60 m_machine_ip_regnum = k_machine_eip; 61 m_machine_sp_regnum = k_machine_esp; 62 m_machine_fp_regnum = k_machine_ebp; 63 m_machine_alt_fp_regnum = k_machine_ebx; 64 m_wordsize = 4; 65 66 struct lldb_reg_info reginfo; 67 reginfo.name = "eax"; 68 m_reg_map[k_machine_eax] = reginfo; 69 reginfo.name = "edx"; 70 m_reg_map[k_machine_edx] = reginfo; 71 reginfo.name = "esp"; 72 m_reg_map[k_machine_esp] = reginfo; 73 reginfo.name = "esi"; 74 m_reg_map[k_machine_esi] = reginfo; 75 reginfo.name = "eip"; 76 m_reg_map[k_machine_eip] = reginfo; 77 reginfo.name = "ecx"; 78 m_reg_map[k_machine_ecx] = reginfo; 79 reginfo.name = "ebx"; 80 m_reg_map[k_machine_ebx] = reginfo; 81 reginfo.name = "ebp"; 82 m_reg_map[k_machine_ebp] = reginfo; 83 reginfo.name = "edi"; 84 m_reg_map[k_machine_edi] = reginfo; 85 } else { 86 m_machine_ip_regnum = k_machine_rip; 87 m_machine_sp_regnum = k_machine_rsp; 88 m_machine_fp_regnum = k_machine_rbp; 89 m_machine_alt_fp_regnum = k_machine_rbx; 90 m_wordsize = 8; 91 92 struct lldb_reg_info reginfo; 93 reginfo.name = "rax"; 94 m_reg_map[k_machine_rax] = reginfo; 95 reginfo.name = "rdx"; 96 m_reg_map[k_machine_rdx] = reginfo; 97 reginfo.name = "rsp"; 98 m_reg_map[k_machine_rsp] = reginfo; 99 reginfo.name = "rsi"; 100 m_reg_map[k_machine_rsi] = reginfo; 101 reginfo.name = "r8"; 102 m_reg_map[k_machine_r8] = reginfo; 103 reginfo.name = "r10"; 104 m_reg_map[k_machine_r10] = reginfo; 105 reginfo.name = "r12"; 106 m_reg_map[k_machine_r12] = reginfo; 107 reginfo.name = "r14"; 108 m_reg_map[k_machine_r14] = reginfo; 109 reginfo.name = "rip"; 110 m_reg_map[k_machine_rip] = reginfo; 111 reginfo.name = "rcx"; 112 m_reg_map[k_machine_rcx] = reginfo; 113 reginfo.name = "rbx"; 114 m_reg_map[k_machine_rbx] = reginfo; 115 reginfo.name = "rbp"; 116 m_reg_map[k_machine_rbp] = reginfo; 117 reginfo.name = "rdi"; 118 m_reg_map[k_machine_rdi] = reginfo; 119 reginfo.name = "r9"; 120 m_reg_map[k_machine_r9] = reginfo; 121 reginfo.name = "r11"; 122 m_reg_map[k_machine_r11] = reginfo; 123 reginfo.name = "r13"; 124 m_reg_map[k_machine_r13] = reginfo; 125 reginfo.name = "r15"; 126 m_reg_map[k_machine_r15] = reginfo; 127 } 128 129 for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin(); 130 it != m_reg_map.end(); ++it) { 131 const RegisterInfo *ri = reg_ctx->GetRegisterInfoByName(it->second.name); 132 if (ri) 133 it->second.lldb_regnum = ri->kinds[eRegisterKindLLDB]; 134 } 135 136 uint32_t lldb_regno; 137 if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno)) 138 m_lldb_sp_regnum = lldb_regno; 139 if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno)) 140 m_lldb_fp_regnum = lldb_regno; 141 if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno)) 142 m_lldb_alt_fp_regnum = lldb_regno; 143 if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno)) 144 m_lldb_ip_regnum = lldb_regno; 145 146 m_register_map_initialized = true; 147 } 148 149 void x86AssemblyInspectionEngine::Initialize( 150 std::vector<lldb_reg_info> ®_info) { 151 m_cpu = k_cpu_unspecified; 152 m_wordsize = -1; 153 m_register_map_initialized = false; 154 155 const llvm::Triple::ArchType cpu = m_arch.GetMachine(); 156 if (cpu == llvm::Triple::x86) 157 m_cpu = k_i386; 158 else if (cpu == llvm::Triple::x86_64) 159 m_cpu = k_x86_64; 160 161 if (m_cpu == k_cpu_unspecified) 162 return; 163 164 if (m_cpu == k_i386) { 165 m_machine_ip_regnum = k_machine_eip; 166 m_machine_sp_regnum = k_machine_esp; 167 m_machine_fp_regnum = k_machine_ebp; 168 m_machine_alt_fp_regnum = k_machine_ebx; 169 m_wordsize = 4; 170 171 struct lldb_reg_info reginfo; 172 reginfo.name = "eax"; 173 m_reg_map[k_machine_eax] = reginfo; 174 reginfo.name = "edx"; 175 m_reg_map[k_machine_edx] = reginfo; 176 reginfo.name = "esp"; 177 m_reg_map[k_machine_esp] = reginfo; 178 reginfo.name = "esi"; 179 m_reg_map[k_machine_esi] = reginfo; 180 reginfo.name = "eip"; 181 m_reg_map[k_machine_eip] = reginfo; 182 reginfo.name = "ecx"; 183 m_reg_map[k_machine_ecx] = reginfo; 184 reginfo.name = "ebx"; 185 m_reg_map[k_machine_ebx] = reginfo; 186 reginfo.name = "ebp"; 187 m_reg_map[k_machine_ebp] = reginfo; 188 reginfo.name = "edi"; 189 m_reg_map[k_machine_edi] = reginfo; 190 } else { 191 m_machine_ip_regnum = k_machine_rip; 192 m_machine_sp_regnum = k_machine_rsp; 193 m_machine_fp_regnum = k_machine_rbp; 194 m_machine_alt_fp_regnum = k_machine_rbx; 195 m_wordsize = 8; 196 197 struct lldb_reg_info reginfo; 198 reginfo.name = "rax"; 199 m_reg_map[k_machine_rax] = reginfo; 200 reginfo.name = "rdx"; 201 m_reg_map[k_machine_rdx] = reginfo; 202 reginfo.name = "rsp"; 203 m_reg_map[k_machine_rsp] = reginfo; 204 reginfo.name = "rsi"; 205 m_reg_map[k_machine_rsi] = reginfo; 206 reginfo.name = "r8"; 207 m_reg_map[k_machine_r8] = reginfo; 208 reginfo.name = "r10"; 209 m_reg_map[k_machine_r10] = reginfo; 210 reginfo.name = "r12"; 211 m_reg_map[k_machine_r12] = reginfo; 212 reginfo.name = "r14"; 213 m_reg_map[k_machine_r14] = reginfo; 214 reginfo.name = "rip"; 215 m_reg_map[k_machine_rip] = reginfo; 216 reginfo.name = "rcx"; 217 m_reg_map[k_machine_rcx] = reginfo; 218 reginfo.name = "rbx"; 219 m_reg_map[k_machine_rbx] = reginfo; 220 reginfo.name = "rbp"; 221 m_reg_map[k_machine_rbp] = reginfo; 222 reginfo.name = "rdi"; 223 m_reg_map[k_machine_rdi] = reginfo; 224 reginfo.name = "r9"; 225 m_reg_map[k_machine_r9] = reginfo; 226 reginfo.name = "r11"; 227 m_reg_map[k_machine_r11] = reginfo; 228 reginfo.name = "r13"; 229 m_reg_map[k_machine_r13] = reginfo; 230 reginfo.name = "r15"; 231 m_reg_map[k_machine_r15] = reginfo; 232 } 233 234 for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin(); 235 it != m_reg_map.end(); ++it) { 236 for (size_t i = 0; i < reg_info.size(); ++i) { 237 if (::strcmp(reg_info[i].name, it->second.name) == 0) { 238 it->second.lldb_regnum = reg_info[i].lldb_regnum; 239 break; 240 } 241 } 242 } 243 244 uint32_t lldb_regno; 245 if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno)) 246 m_lldb_sp_regnum = lldb_regno; 247 if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno)) 248 m_lldb_fp_regnum = lldb_regno; 249 if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno)) 250 m_lldb_alt_fp_regnum = lldb_regno; 251 if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno)) 252 m_lldb_ip_regnum = lldb_regno; 253 254 m_register_map_initialized = true; 255 } 256 257 // This function expects an x86 native register number (i.e. the bits stripped 258 // out of the actual instruction), not an lldb register number. 259 // 260 // FIXME: This is ABI dependent, it shouldn't be hardcoded here. 261 262 bool x86AssemblyInspectionEngine::nonvolatile_reg_p(int machine_regno) { 263 if (m_cpu == k_i386) { 264 switch (machine_regno) { 265 case k_machine_ebx: 266 case k_machine_ebp: // not actually a nonvolatile but often treated as such 267 // by convention 268 case k_machine_esi: 269 case k_machine_edi: 270 case k_machine_esp: 271 return true; 272 default: 273 return false; 274 } 275 } 276 if (m_cpu == k_x86_64) { 277 switch (machine_regno) { 278 case k_machine_rbx: 279 case k_machine_rsp: 280 case k_machine_rbp: // not actually a nonvolatile but often treated as such 281 // by convention 282 case k_machine_r12: 283 case k_machine_r13: 284 case k_machine_r14: 285 case k_machine_r15: 286 return true; 287 default: 288 return false; 289 } 290 } 291 return false; 292 } 293 294 // Macro to detect if this is a REX mode prefix byte. 295 #define REX_W_PREFIX_P(opcode) (((opcode) & (~0x5)) == 0x48) 296 297 // The high bit which should be added to the source register number (the "R" 298 // bit) 299 #define REX_W_SRCREG(opcode) (((opcode)&0x4) >> 2) 300 301 // The high bit which should be added to the destination register number (the 302 // "B" bit) 303 #define REX_W_DSTREG(opcode) ((opcode)&0x1) 304 305 // pushq %rbp [0x55] 306 bool x86AssemblyInspectionEngine::push_rbp_pattern_p() { 307 uint8_t *p = m_cur_insn; 308 return *p == 0x55; 309 } 310 311 // pushq $0 ; the first instruction in start() [0x6a 0x00] 312 bool x86AssemblyInspectionEngine::push_0_pattern_p() { 313 uint8_t *p = m_cur_insn; 314 return *p == 0x6a && *(p + 1) == 0x0; 315 } 316 317 // pushq $0 318 // pushl $0 319 bool x86AssemblyInspectionEngine::push_imm_pattern_p() { 320 uint8_t *p = m_cur_insn; 321 return *p == 0x68 || *p == 0x6a; 322 } 323 324 // pushl imm8(%esp) 325 // 326 // e.g. 0xff 0x74 0x24 0x20 - 'pushl 0x20(%esp)' (same byte pattern for 'pushq 327 // 0x20(%rsp)' in an x86_64 program) 328 // 329 // 0xff (with opcode bits '6' in next byte, PUSH r/m32) 0x74 (ModR/M byte with 330 // three bits used to specify the opcode) 331 // mod == b01, opcode == b110, R/M == b100 332 // "+disp8" 333 // 0x24 (SIB byte - scaled index = 0, r32 == esp) 0x20 imm8 value 334 335 bool x86AssemblyInspectionEngine::push_extended_pattern_p() { 336 if (*m_cur_insn == 0xff) { 337 // Get the 3 opcode bits from the ModR/M byte 338 uint8_t opcode = (*(m_cur_insn + 1) >> 3) & 7; 339 if (opcode == 6) { 340 // I'm only looking for 0xff /6 here - I 341 // don't really care what value is being pushed, just that we're pushing 342 // a 32/64 bit value on to the stack is enough. 343 return true; 344 } 345 } 346 return false; 347 } 348 349 // instructions only valid in 32-bit mode: 350 // 0x0e - push cs 351 // 0x16 - push ss 352 // 0x1e - push ds 353 // 0x06 - push es 354 bool x86AssemblyInspectionEngine::push_misc_reg_p() { 355 uint8_t p = *m_cur_insn; 356 if (m_wordsize == 4) { 357 if (p == 0x0e || p == 0x16 || p == 0x1e || p == 0x06) 358 return true; 359 } 360 return false; 361 } 362 363 // pushq %rbx 364 // pushl %ebx 365 bool x86AssemblyInspectionEngine::push_reg_p(int ®no) { 366 uint8_t *p = m_cur_insn; 367 int regno_prefix_bit = 0; 368 // If we have a rex prefix byte, check to see if a B bit is set 369 if (m_wordsize == 8 && (*p & 0xfe) == 0x40) { 370 regno_prefix_bit = (*p & 1) << 3; 371 p++; 372 } 373 if (*p >= 0x50 && *p <= 0x57) { 374 regno = (*p - 0x50) | regno_prefix_bit; 375 return true; 376 } 377 return false; 378 } 379 380 // movq %rsp, %rbp [0x48 0x8b 0xec] or [0x48 0x89 0xe5] movl %esp, %ebp [0x8b 381 // 0xec] or [0x89 0xe5] 382 bool x86AssemblyInspectionEngine::mov_rsp_rbp_pattern_p() { 383 uint8_t *p = m_cur_insn; 384 if (m_wordsize == 8 && *p == 0x48) 385 p++; 386 if (*(p) == 0x8b && *(p + 1) == 0xec) 387 return true; 388 if (*(p) == 0x89 && *(p + 1) == 0xe5) 389 return true; 390 return false; 391 } 392 393 // movq %rsp, %rbx [0x48 0x8b 0xdc] or [0x48 0x89 0xe3] 394 // movl %esp, %ebx [0x8b 0xdc] or [0x89 0xe3] 395 bool x86AssemblyInspectionEngine::mov_rsp_rbx_pattern_p() { 396 uint8_t *p = m_cur_insn; 397 if (m_wordsize == 8 && *p == 0x48) 398 p++; 399 if (*(p) == 0x8b && *(p + 1) == 0xdc) 400 return true; 401 if (*(p) == 0x89 && *(p + 1) == 0xe3) 402 return true; 403 return false; 404 } 405 406 // movq %rbp, %rsp [0x48 0x8b 0xe5] or [0x48 0x89 0xec] 407 // movl %ebp, %esp [0x8b 0xe5] or [0x89 0xec] 408 bool x86AssemblyInspectionEngine::mov_rbp_rsp_pattern_p() { 409 uint8_t *p = m_cur_insn; 410 if (m_wordsize == 8 && *p == 0x48) 411 p++; 412 if (*(p) == 0x8b && *(p + 1) == 0xe5) 413 return true; 414 if (*(p) == 0x89 && *(p + 1) == 0xec) 415 return true; 416 return false; 417 } 418 419 // movq %rbx, %rsp [0x48 0x8b 0xe3] or [0x48 0x89 0xdc] 420 // movl %ebx, %esp [0x8b 0xe3] or [0x89 0xdc] 421 bool x86AssemblyInspectionEngine::mov_rbx_rsp_pattern_p() { 422 uint8_t *p = m_cur_insn; 423 if (m_wordsize == 8 && *p == 0x48) 424 p++; 425 if (*(p) == 0x8b && *(p + 1) == 0xe3) 426 return true; 427 if (*(p) == 0x89 && *(p + 1) == 0xdc) 428 return true; 429 return false; 430 } 431 432 // subq $0x20, %rsp 433 bool x86AssemblyInspectionEngine::sub_rsp_pattern_p(int &amount) { 434 uint8_t *p = m_cur_insn; 435 if (m_wordsize == 8 && *p == 0x48) 436 p++; 437 // 8-bit immediate operand 438 if (*p == 0x83 && *(p + 1) == 0xec) { 439 amount = (int8_t) * (p + 2); 440 return true; 441 } 442 // 32-bit immediate operand 443 if (*p == 0x81 && *(p + 1) == 0xec) { 444 amount = (int32_t)extract_4(p + 2); 445 return true; 446 } 447 return false; 448 } 449 450 // addq $0x20, %rsp 451 bool x86AssemblyInspectionEngine::add_rsp_pattern_p(int &amount) { 452 uint8_t *p = m_cur_insn; 453 if (m_wordsize == 8 && *p == 0x48) 454 p++; 455 // 8-bit immediate operand 456 if (*p == 0x83 && *(p + 1) == 0xc4) { 457 amount = (int8_t) * (p + 2); 458 return true; 459 } 460 // 32-bit immediate operand 461 if (*p == 0x81 && *(p + 1) == 0xc4) { 462 amount = (int32_t)extract_4(p + 2); 463 return true; 464 } 465 return false; 466 } 467 468 // lea esp, [esp - 0x28] 469 // lea esp, [esp + 0x28] 470 bool x86AssemblyInspectionEngine::lea_rsp_pattern_p(int &amount) { 471 uint8_t *p = m_cur_insn; 472 if (m_wordsize == 8 && *p == 0x48) 473 p++; 474 475 // Check opcode 476 if (*p != 0x8d) 477 return false; 478 479 // 8 bit displacement 480 if (*(p + 1) == 0x64 && (*(p + 2) & 0x3f) == 0x24) { 481 amount = (int8_t) * (p + 3); 482 return true; 483 } 484 485 // 32 bit displacement 486 if (*(p + 1) == 0xa4 && (*(p + 2) & 0x3f) == 0x24) { 487 amount = (int32_t)extract_4(p + 3); 488 return true; 489 } 490 491 return false; 492 } 493 494 // lea -0x28(%ebp), %esp 495 // (32-bit and 64-bit variants, 8-bit and 32-bit displacement) 496 bool x86AssemblyInspectionEngine::lea_rbp_rsp_pattern_p(int &amount) { 497 uint8_t *p = m_cur_insn; 498 if (m_wordsize == 8 && *p == 0x48) 499 p++; 500 501 // Check opcode 502 if (*p != 0x8d) 503 return false; 504 ++p; 505 506 // 8 bit displacement 507 if (*p == 0x65) { 508 amount = (int8_t)p[1]; 509 return true; 510 } 511 512 // 32 bit displacement 513 if (*p == 0xa5) { 514 amount = (int32_t)extract_4(p + 1); 515 return true; 516 } 517 518 return false; 519 } 520 521 // lea -0x28(%ebx), %esp 522 // (32-bit and 64-bit variants, 8-bit and 32-bit displacement) 523 bool x86AssemblyInspectionEngine::lea_rbx_rsp_pattern_p(int &amount) { 524 uint8_t *p = m_cur_insn; 525 if (m_wordsize == 8 && *p == 0x48) 526 p++; 527 528 // Check opcode 529 if (*p != 0x8d) 530 return false; 531 ++p; 532 533 // 8 bit displacement 534 if (*p == 0x63) { 535 amount = (int8_t)p[1]; 536 return true; 537 } 538 539 // 32 bit displacement 540 if (*p == 0xa3) { 541 amount = (int32_t)extract_4(p + 1); 542 return true; 543 } 544 545 return false; 546 } 547 548 // and -0xfffffff0, %esp 549 // (32-bit and 64-bit variants, 8-bit and 32-bit displacement) 550 bool x86AssemblyInspectionEngine::and_rsp_pattern_p() { 551 uint8_t *p = m_cur_insn; 552 if (m_wordsize == 8 && *p == 0x48) 553 p++; 554 555 if (*p != 0x81 && *p != 0x83) 556 return false; 557 558 return *++p == 0xe4; 559 } 560 561 // popq %rbx 562 // popl %ebx 563 bool x86AssemblyInspectionEngine::pop_reg_p(int ®no) { 564 uint8_t *p = m_cur_insn; 565 int regno_prefix_bit = 0; 566 // If we have a rex prefix byte, check to see if a B bit is set 567 if (m_wordsize == 8 && (*p & 0xfe) == 0x40) { 568 regno_prefix_bit = (*p & 1) << 3; 569 p++; 570 } 571 if (*p >= 0x58 && *p <= 0x5f) { 572 regno = (*p - 0x58) | regno_prefix_bit; 573 return true; 574 } 575 return false; 576 } 577 578 // popq %rbp [0x5d] 579 // popl %ebp [0x5d] 580 bool x86AssemblyInspectionEngine::pop_rbp_pattern_p() { 581 uint8_t *p = m_cur_insn; 582 return (*p == 0x5d); 583 } 584 585 // instructions valid only in 32-bit mode: 586 // 0x1f - pop ds 587 // 0x07 - pop es 588 // 0x17 - pop ss 589 bool x86AssemblyInspectionEngine::pop_misc_reg_p() { 590 uint8_t p = *m_cur_insn; 591 if (m_wordsize == 4) { 592 if (p == 0x1f || p == 0x07 || p == 0x17) 593 return true; 594 } 595 return false; 596 } 597 598 // leave [0xc9] 599 bool x86AssemblyInspectionEngine::leave_pattern_p() { 600 uint8_t *p = m_cur_insn; 601 return (*p == 0xc9); 602 } 603 604 // call $0 [0xe8 0x0 0x0 0x0 0x0] 605 bool x86AssemblyInspectionEngine::call_next_insn_pattern_p() { 606 uint8_t *p = m_cur_insn; 607 return (*p == 0xe8) && (*(p + 1) == 0x0) && (*(p + 2) == 0x0) && 608 (*(p + 3) == 0x0) && (*(p + 4) == 0x0); 609 } 610 611 // Look for an instruction sequence storing a nonvolatile register on to the 612 // stack frame. 613 614 // movq %rax, -0x10(%rbp) [0x48 0x89 0x45 0xf0] 615 // movl %eax, -0xc(%ebp) [0x89 0x45 0xf4] 616 617 // The offset value returned in rbp_offset will be positive -- but it must be 618 // subtraced from the frame base register to get the actual location. The 619 // positive value returned for the offset is a convention used elsewhere for 620 // CFA offsets et al. 621 622 bool x86AssemblyInspectionEngine::mov_reg_to_local_stack_frame_p( 623 int ®no, int &rbp_offset) { 624 uint8_t *p = m_cur_insn; 625 int src_reg_prefix_bit = 0; 626 int target_reg_prefix_bit = 0; 627 628 if (m_wordsize == 8 && REX_W_PREFIX_P(*p)) { 629 src_reg_prefix_bit = REX_W_SRCREG(*p) << 3; 630 target_reg_prefix_bit = REX_W_DSTREG(*p) << 3; 631 if (target_reg_prefix_bit == 1) { 632 // rbp/ebp don't need a prefix bit - we know this isn't the reg we care 633 // about. 634 return false; 635 } 636 p++; 637 } 638 639 if (*p == 0x89) { 640 /* Mask off the 3-5 bits which indicate the destination register 641 if this is a ModR/M byte. */ 642 int opcode_destreg_masked_out = *(p + 1) & (~0x38); 643 644 /* Is this a ModR/M byte with Mod bits 01 and R/M bits 101 645 and three bits between them, e.g. 01nnn101 646 We're looking for a destination of ebp-disp8 or ebp-disp32. */ 647 int immsize; 648 if (opcode_destreg_masked_out == 0x45) 649 immsize = 2; 650 else if (opcode_destreg_masked_out == 0x85) 651 immsize = 4; 652 else 653 return false; 654 655 int offset = 0; 656 if (immsize == 2) 657 offset = (int8_t) * (p + 2); 658 if (immsize == 4) 659 offset = (uint32_t)extract_4(p + 2); 660 if (offset > 0) 661 return false; 662 663 regno = ((*(p + 1) >> 3) & 0x7) | src_reg_prefix_bit; 664 rbp_offset = offset > 0 ? offset : -offset; 665 return true; 666 } 667 return false; 668 } 669 670 // Returns true if this is a jmp instruction where we can't 671 // know the destination address statically. 672 // 673 // ff e0 jmpq *%rax 674 // ff e1 jmpq *%rcx 675 // ff 60 28 jmpq *0x28(%rax) 676 // ff 60 60 jmpq *0x60(%rax) 677 bool x86AssemblyInspectionEngine::jmp_to_reg_p() { 678 if (*m_cur_insn != 0xff) 679 return false; 680 681 // The second byte is a ModR/M /4 byte, strip off the registers 682 uint8_t second_byte_sans_reg = *(m_cur_insn + 1) & ~7; 683 684 // Don't handle 0x24 disp32, because the target address is 685 // knowable statically - pc_rel_branch_or_jump_p() will 686 // return the target address. 687 688 // [reg] 689 if (second_byte_sans_reg == 0x20) 690 return true; 691 692 // [reg]+disp8 693 if (second_byte_sans_reg == 0x60) 694 return true; 695 696 // [reg]+disp32 697 if (second_byte_sans_reg == 0xa0) 698 return true; 699 700 // reg 701 if (second_byte_sans_reg == 0xe0) 702 return true; 703 704 // disp32 705 // jumps to an address stored in memory, the value can't be cached 706 // in an unwind plan. 707 if (second_byte_sans_reg == 0x24) 708 return true; 709 710 // use SIB byte 711 // ff 24 fe jmpq *(%rsi,%rdi,8) 712 if (second_byte_sans_reg == 0x24) 713 return true; 714 715 return false; 716 } 717 718 // Detect branches to fixed pc-relative offsets. 719 // Returns the offset from the address of the next instruction 720 // that may be branch/jumped to. 721 // 722 // Cannot determine the offset of a JMP that jumps to the address in 723 // a register ("jmpq *%rax") or offset from a register value 724 // ("jmpq *0x28(%rax)"), this method will return false on those 725 // instructions. 726 // 727 // These instructions all end in either a relative 8/16/32 bit value 728 // depending on the instruction and the current execution mode of the 729 // inferior process. Once we know the size of the opcode instruction, 730 // we can use the total instruction length to determine the size of 731 // the relative offset without having to compute it correctly. 732 733 bool x86AssemblyInspectionEngine::pc_rel_branch_or_jump_p ( 734 const int instruction_length, int &offset) 735 { 736 int opcode_size = 0; 737 738 uint8_t b1 = m_cur_insn[0]; 739 740 switch (b1) { 741 case 0x77: // JA/JNBE rel8 742 case 0x73: // JAE/JNB/JNC rel8 743 case 0x72: // JB/JC/JNAE rel8 744 case 0x76: // JBE/JNA rel8 745 case 0xe3: // JCXZ/JECXZ/JRCXZ rel8 746 case 0x74: // JE/JZ rel8 747 case 0x7f: // JG/JNLE rel8 748 case 0x7d: // JGE/JNL rel8 749 case 0x7c: // JL/JNGE rel8 750 case 0x7e: // JNG/JLE rel8 751 case 0x71: // JNO rel8 752 case 0x7b: // JNP/JPO rel8 753 case 0x79: // JNS rel8 754 case 0x75: // JNE/JNZ rel8 755 case 0x70: // JO rel8 756 case 0x7a: // JP/JPE rel8 757 case 0x78: // JS rel8 758 case 0xeb: // JMP rel8 759 case 0xe9: // JMP rel16/rel32 760 opcode_size = 1; 761 break; 762 default: 763 break; 764 } 765 if (b1 == 0x0f && opcode_size == 0) { 766 uint8_t b2 = m_cur_insn[1]; 767 switch (b2) { 768 case 0x87: // JA/JNBE rel16/rel32 769 case 0x86: // JBE/JNA rel16/rel32 770 case 0x84: // JE/JZ rel16/rel32 771 case 0x8f: // JG/JNLE rel16/rel32 772 case 0x8d: // JNL/JGE rel16/rel32 773 case 0x8e: // JLE rel16/rel32 774 case 0x82: // JB/JC/JNAE rel16/rel32 775 case 0x83: // JAE/JNB/JNC rel16/rel32 776 case 0x85: // JNE/JNZ rel16/rel32 777 case 0x8c: // JL/JNGE rel16/rel32 778 case 0x81: // JNO rel16/rel32 779 case 0x8b: // JNP/JPO rel16/rel32 780 case 0x89: // JNS rel16/rel32 781 case 0x80: // JO rel16/rel32 782 case 0x8a: // JP rel16/rel32 783 case 0x88: // JS rel16/rel32 784 opcode_size = 2; 785 break; 786 default: 787 break; 788 } 789 } 790 791 if (opcode_size == 0) 792 return false; 793 794 offset = 0; 795 if (instruction_length - opcode_size == 1) { 796 int8_t rel8 = (int8_t) *(m_cur_insn + opcode_size); 797 offset = rel8; 798 } else if (instruction_length - opcode_size == 2) { 799 int16_t rel16 = extract_2_signed (m_cur_insn + opcode_size); 800 offset = rel16; 801 } else if (instruction_length - opcode_size == 4) { 802 int32_t rel32 = extract_4_signed (m_cur_insn + opcode_size); 803 offset = rel32; 804 } else { 805 return false; 806 } 807 return true; 808 } 809 810 // Returns true if this instruction is a intra-function branch or jump - 811 // a branch/jump within the bounds of this same function. 812 // Cannot predict where a jump through a register value ("jmpq *%rax") 813 // will go, so it will return false on that instruction. 814 bool x86AssemblyInspectionEngine::local_branch_p ( 815 const addr_t current_func_text_offset, 816 const AddressRange &func_range, 817 const int instruction_length, 818 addr_t &target_insn_offset) { 819 int offset; 820 if (pc_rel_branch_or_jump_p (instruction_length, offset) && offset != 0) { 821 addr_t next_pc_value = current_func_text_offset + instruction_length; 822 if (offset < 0 && addr_t(-offset) > current_func_text_offset) { 823 // Branch target is before the start of this function 824 return false; 825 } 826 if (offset + next_pc_value > func_range.GetByteSize()) { 827 // Branch targets outside this function's bounds 828 return false; 829 } 830 // This instruction branches to target_insn_offset (byte offset into the function) 831 target_insn_offset = next_pc_value + offset; 832 return true; 833 } 834 return false; 835 } 836 837 // Returns true if this instruction is a inter-function branch or jump - a 838 // branch/jump to another function. 839 // Cannot predict where a jump through a register value ("jmpq *%rax") 840 // will go, so it will return false on that instruction. 841 bool x86AssemblyInspectionEngine::non_local_branch_p ( 842 const addr_t current_func_text_offset, 843 const AddressRange &func_range, 844 const int instruction_length) { 845 int offset; 846 addr_t target_insn_offset; 847 if (pc_rel_branch_or_jump_p (instruction_length, offset)) { 848 return !local_branch_p(current_func_text_offset,func_range,instruction_length,target_insn_offset); 849 } 850 return false; 851 } 852 853 // ret [0xc3] or [0xcb] or [0xc2 imm16] or [0xca imm16] 854 bool x86AssemblyInspectionEngine::ret_pattern_p() { 855 uint8_t *p = m_cur_insn; 856 return *p == 0xc3 || *p == 0xc2 || *p == 0xca || *p == 0xcb; 857 } 858 859 uint16_t x86AssemblyInspectionEngine::extract_2(uint8_t *b) { 860 uint16_t v = 0; 861 for (int i = 1; i >= 0; i--) 862 v = (v << 8) | b[i]; 863 return v; 864 } 865 866 int16_t x86AssemblyInspectionEngine::extract_2_signed(uint8_t *b) { 867 int16_t v = 0; 868 for (int i = 1; i >= 0; i--) 869 v = (v << 8) | b[i]; 870 return v; 871 } 872 873 // movq $0x????????(%rip), $reg [(0x4c || 0x48) 0x8b ?? ?? ?? ?? ??] 874 // xorq $off(%rsp), $reg [(0x4c || 0x48) 0x33 ?? 0x24] 875 bool x86AssemblyInspectionEngine::retguard_prologue_p(size_t offset, int insn_len) { 876 uint8_t *p = m_cur_insn; 877 if (offset == 0 && insn_len == 7) 878 return (*p == 0x48 || *p == 0x4c) && (*(p + 1) == 0x8b); 879 else if (offset == 7 && insn_len == 4) 880 return (*p == 0x48 || *p == 0x4c) && (*(p + 1) == 0x33) && (*(p + 3) == 0x24); 881 882 return false; 883 } 884 885 uint32_t x86AssemblyInspectionEngine::extract_4(uint8_t *b) { 886 uint32_t v = 0; 887 for (int i = 3; i >= 0; i--) 888 v = (v << 8) | b[i]; 889 return v; 890 } 891 892 int32_t x86AssemblyInspectionEngine::extract_4_signed(uint8_t *b) { 893 int32_t v = 0; 894 for (int i = 3; i >= 0; i--) 895 v = (v << 8) | b[i]; 896 return v; 897 } 898 899 900 bool x86AssemblyInspectionEngine::instruction_length(uint8_t *insn_p, 901 int &length, 902 uint32_t buffer_remaining_bytes) { 903 904 uint32_t max_op_byte_size = std::min(buffer_remaining_bytes, m_arch.GetMaximumOpcodeByteSize()); 905 llvm::SmallVector<uint8_t, 32> opcode_data; 906 opcode_data.resize(max_op_byte_size); 907 908 char out_string[512]; 909 const size_t inst_size = 910 ::LLVMDisasmInstruction(m_disasm_context, insn_p, max_op_byte_size, 0, 911 out_string, sizeof(out_string)); 912 913 length = inst_size; 914 return true; 915 } 916 917 bool x86AssemblyInspectionEngine::machine_regno_to_lldb_regno( 918 int machine_regno, uint32_t &lldb_regno) { 919 MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.find(machine_regno); 920 if (it != m_reg_map.end()) { 921 lldb_regno = it->second.lldb_regnum; 922 return true; 923 } 924 return false; 925 } 926 927 bool x86AssemblyInspectionEngine::GetNonCallSiteUnwindPlanFromAssembly( 928 uint8_t *data, size_t size, AddressRange &func_range, 929 UnwindPlan &unwind_plan) { 930 unwind_plan.Clear(); 931 932 if (data == nullptr || size == 0) 933 return false; 934 935 if (!m_register_map_initialized) 936 return false; 937 938 addr_t current_func_text_offset = 0; 939 int current_sp_bytes_offset_from_fa = 0; 940 bool is_aligned = false; 941 UnwindPlan::Row::RegisterLocation initial_regloc; 942 UnwindPlan::RowSP row(new UnwindPlan::Row); 943 944 unwind_plan.SetPlanValidAddressRange(func_range); 945 unwind_plan.SetRegisterKind(eRegisterKindLLDB); 946 947 // At the start of the function, find the CFA by adding wordsize to the SP 948 // register 949 row->SetOffset(current_func_text_offset); 950 row->GetCFAValue().SetIsRegisterPlusOffset(m_lldb_sp_regnum, m_wordsize); 951 952 // caller's stack pointer value before the call insn is the CFA address 953 initial_regloc.SetIsCFAPlusOffset(0); 954 row->SetRegisterInfo(m_lldb_sp_regnum, initial_regloc); 955 956 // saved instruction pointer can be found at CFA - wordsize. 957 current_sp_bytes_offset_from_fa = m_wordsize; 958 initial_regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa); 959 row->SetRegisterInfo(m_lldb_ip_regnum, initial_regloc); 960 961 unwind_plan.AppendRow(row); 962 963 // Allocate a new Row, populate it with the existing Row contents. 964 UnwindPlan::Row *newrow = new UnwindPlan::Row; 965 *newrow = *row.get(); 966 row.reset(newrow); 967 968 // Track which registers have been saved so far in the prologue. If we see 969 // another push of that register, it's not part of the prologue. The register 970 // numbers used here are the machine register #'s (i386_register_numbers, 971 // x86_64_register_numbers). 972 std::vector<bool> saved_registers(32, false); 973 974 // Once the prologue has completed we'll save a copy of the unwind 975 // instructions If there is an epilogue in the middle of the function, after 976 // that epilogue we'll reinstate the unwind setup -- we assume that some code 977 // path jumps over the mid-function epilogue 978 979 UnwindPlan::RowSP prologue_completed_row; // copy of prologue row of CFI 980 int prologue_completed_sp_bytes_offset_from_cfa; // The sp value before the 981 // epilogue started executed 982 bool prologue_completed_is_aligned; 983 std::vector<bool> prologue_completed_saved_registers; 984 985 while (current_func_text_offset < size) { 986 int stack_offset, insn_len; 987 int machine_regno; // register numbers masked directly out of instructions 988 uint32_t lldb_regno; // register numbers in lldb's eRegisterKindLLDB 989 // numbering scheme 990 991 bool in_epilogue = false; // we're in the middle of an epilogue sequence 992 bool row_updated = false; // The UnwindPlan::Row 'row' has been updated 993 994 m_cur_insn = data + current_func_text_offset; 995 if (!instruction_length(m_cur_insn, insn_len, size - current_func_text_offset) 996 || insn_len == 0 997 || insn_len > kMaxInstructionByteSize) { 998 // An unrecognized/junk instruction 999 break; 1000 } 1001 1002 auto &cfa_value = row->GetCFAValue(); 1003 auto &afa_value = row->GetAFAValue(); 1004 auto fa_value_ptr = is_aligned ? &afa_value : &cfa_value; 1005 1006 if (mov_rsp_rbp_pattern_p()) { 1007 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1008 fa_value_ptr->SetIsRegisterPlusOffset( 1009 m_lldb_fp_regnum, fa_value_ptr->GetOffset()); 1010 row_updated = true; 1011 } 1012 } 1013 1014 else if (mov_rsp_rbx_pattern_p()) { 1015 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1016 fa_value_ptr->SetIsRegisterPlusOffset( 1017 m_lldb_alt_fp_regnum, fa_value_ptr->GetOffset()); 1018 row_updated = true; 1019 } 1020 } 1021 1022 else if (and_rsp_pattern_p()) { 1023 current_sp_bytes_offset_from_fa = 0; 1024 afa_value.SetIsRegisterPlusOffset( 1025 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa); 1026 fa_value_ptr = &afa_value; 1027 is_aligned = true; 1028 row_updated = true; 1029 } 1030 1031 else if (mov_rbp_rsp_pattern_p()) { 1032 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum) 1033 { 1034 is_aligned = false; 1035 fa_value_ptr = &cfa_value; 1036 afa_value.SetUnspecified(); 1037 row_updated = true; 1038 } 1039 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum) 1040 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset(); 1041 } 1042 1043 else if (mov_rbx_rsp_pattern_p()) { 1044 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum) 1045 { 1046 is_aligned = false; 1047 fa_value_ptr = &cfa_value; 1048 afa_value.SetUnspecified(); 1049 row_updated = true; 1050 } 1051 if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum) 1052 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset(); 1053 } 1054 1055 // This is the start() function (or a pthread equivalent), it starts with a 1056 // pushl $0x0 which puts the saved pc value of 0 on the stack. In this 1057 // case we want to pretend we didn't see a stack movement at all -- 1058 // normally the saved pc value is already on the stack by the time the 1059 // function starts executing. 1060 else if (push_0_pattern_p()) { 1061 } 1062 1063 else if (push_reg_p(machine_regno)) { 1064 current_sp_bytes_offset_from_fa += m_wordsize; 1065 // the PUSH instruction has moved the stack pointer - if the FA is set 1066 // in terms of the stack pointer, we need to add a new row of 1067 // instructions. 1068 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1069 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1070 row_updated = true; 1071 } 1072 // record where non-volatile (callee-saved, spilled) registers are saved 1073 // on the stack 1074 if (nonvolatile_reg_p(machine_regno) && 1075 machine_regno_to_lldb_regno(machine_regno, lldb_regno) && 1076 !saved_registers[machine_regno]) { 1077 UnwindPlan::Row::RegisterLocation regloc; 1078 if (is_aligned) 1079 regloc.SetAtAFAPlusOffset(-current_sp_bytes_offset_from_fa); 1080 else 1081 regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa); 1082 row->SetRegisterInfo(lldb_regno, regloc); 1083 saved_registers[machine_regno] = true; 1084 row_updated = true; 1085 } 1086 } 1087 1088 else if (pop_reg_p(machine_regno)) { 1089 current_sp_bytes_offset_from_fa -= m_wordsize; 1090 1091 if (nonvolatile_reg_p(machine_regno) && 1092 machine_regno_to_lldb_regno(machine_regno, lldb_regno) && 1093 saved_registers[machine_regno]) { 1094 saved_registers[machine_regno] = false; 1095 row->RemoveRegisterInfo(lldb_regno); 1096 1097 if (lldb_regno == fa_value_ptr->GetRegisterNumber()) { 1098 fa_value_ptr->SetIsRegisterPlusOffset( 1099 m_lldb_sp_regnum, fa_value_ptr->GetOffset()); 1100 } 1101 1102 in_epilogue = true; 1103 row_updated = true; 1104 } 1105 1106 // the POP instruction has moved the stack pointer - if the FA is set in 1107 // terms of the stack pointer, we need to add a new row of instructions. 1108 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1109 fa_value_ptr->SetIsRegisterPlusOffset( 1110 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa); 1111 row_updated = true; 1112 } 1113 } 1114 1115 else if (pop_misc_reg_p()) { 1116 current_sp_bytes_offset_from_fa -= m_wordsize; 1117 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1118 fa_value_ptr->SetIsRegisterPlusOffset( 1119 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa); 1120 row_updated = true; 1121 } 1122 } 1123 1124 // The LEAVE instruction moves the value from rbp into rsp and pops a value 1125 // off the stack into rbp (restoring the caller's rbp value). It is the 1126 // opposite of ENTER, or 'push rbp, mov rsp rbp'. 1127 else if (leave_pattern_p()) { 1128 if (saved_registers[m_machine_fp_regnum]) { 1129 saved_registers[m_machine_fp_regnum] = false; 1130 row->RemoveRegisterInfo(m_lldb_fp_regnum); 1131 1132 row_updated = true; 1133 } 1134 1135 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum) 1136 { 1137 is_aligned = false; 1138 fa_value_ptr = &cfa_value; 1139 afa_value.SetUnspecified(); 1140 row_updated = true; 1141 } 1142 1143 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum) 1144 { 1145 fa_value_ptr->SetIsRegisterPlusOffset( 1146 m_lldb_sp_regnum, fa_value_ptr->GetOffset()); 1147 1148 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset(); 1149 } 1150 1151 current_sp_bytes_offset_from_fa -= m_wordsize; 1152 1153 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1154 fa_value_ptr->SetIsRegisterPlusOffset( 1155 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa); 1156 row_updated = true; 1157 } 1158 1159 in_epilogue = true; 1160 } 1161 1162 else if (mov_reg_to_local_stack_frame_p(machine_regno, stack_offset) && 1163 nonvolatile_reg_p(machine_regno) && 1164 machine_regno_to_lldb_regno(machine_regno, lldb_regno) && 1165 !saved_registers[machine_regno]) { 1166 saved_registers[machine_regno] = true; 1167 1168 UnwindPlan::Row::RegisterLocation regloc; 1169 1170 // stack_offset for 'movq %r15, -80(%rbp)' will be 80. In the Row, we 1171 // want to express this as the offset from the FA. If the frame base is 1172 // rbp (like the above instruction), the FA offset for rbp is probably 1173 // 16. So we want to say that the value is stored at the FA address - 1174 // 96. 1175 if (is_aligned) 1176 regloc.SetAtAFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset())); 1177 else 1178 regloc.SetAtCFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset())); 1179 1180 row->SetRegisterInfo(lldb_regno, regloc); 1181 1182 row_updated = true; 1183 } 1184 1185 else if (sub_rsp_pattern_p(stack_offset)) { 1186 current_sp_bytes_offset_from_fa += stack_offset; 1187 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1188 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1189 row_updated = true; 1190 } 1191 } 1192 1193 else if (add_rsp_pattern_p(stack_offset)) { 1194 current_sp_bytes_offset_from_fa -= stack_offset; 1195 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1196 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1197 row_updated = true; 1198 } 1199 in_epilogue = true; 1200 } 1201 1202 else if (push_extended_pattern_p() || push_imm_pattern_p() || 1203 push_misc_reg_p()) { 1204 current_sp_bytes_offset_from_fa += m_wordsize; 1205 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1206 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1207 row_updated = true; 1208 } 1209 } 1210 1211 else if (lea_rsp_pattern_p(stack_offset)) { 1212 current_sp_bytes_offset_from_fa -= stack_offset; 1213 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1214 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1215 row_updated = true; 1216 } 1217 if (stack_offset > 0) 1218 in_epilogue = true; 1219 } 1220 1221 else if (lea_rbp_rsp_pattern_p(stack_offset)) { 1222 if (is_aligned && 1223 cfa_value.GetRegisterNumber() == m_lldb_fp_regnum) { 1224 is_aligned = false; 1225 fa_value_ptr = &cfa_value; 1226 afa_value.SetUnspecified(); 1227 row_updated = true; 1228 } 1229 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum) { 1230 current_sp_bytes_offset_from_fa = 1231 fa_value_ptr->GetOffset() - stack_offset; 1232 } 1233 } 1234 1235 else if (lea_rbx_rsp_pattern_p(stack_offset)) { 1236 if (is_aligned && 1237 cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum) { 1238 is_aligned = false; 1239 fa_value_ptr = &cfa_value; 1240 afa_value.SetUnspecified(); 1241 row_updated = true; 1242 } 1243 if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum) { 1244 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset() - stack_offset; 1245 } 1246 } 1247 1248 else if (prologue_completed_row.get() && 1249 (ret_pattern_p() || 1250 non_local_branch_p (current_func_text_offset, func_range, insn_len) || 1251 jmp_to_reg_p())) { 1252 // Check if the current instruction is the end of an epilogue sequence, 1253 // and if so, re-instate the prologue-completed unwind state. 1254 1255 // The current instruction is a branch/jump outside this function, 1256 // a ret, or a jump through a register value which we cannot 1257 // determine the effcts of. Verify that the stack frame state 1258 // has been unwound to the same as it was at function entry to avoid 1259 // mis-identifying a JMP instruction as an epilogue. 1260 UnwindPlan::Row::RegisterLocation sp, pc; 1261 if (row->GetRegisterInfo(m_lldb_sp_regnum, sp) && 1262 row->GetRegisterInfo(m_lldb_ip_regnum, pc)) { 1263 // Any ret instruction variant is definitely indicative of an 1264 // epilogue; for other insn patterns verify that we're back to 1265 // the original unwind state. 1266 if (ret_pattern_p() || 1267 (sp.IsCFAPlusOffset() && sp.GetOffset() == 0 && 1268 pc.IsAtCFAPlusOffset() && pc.GetOffset() == -m_wordsize)) { 1269 // Reinstate the saved prologue setup for any instructions that come 1270 // after the epilogue 1271 1272 UnwindPlan::Row *newrow = new UnwindPlan::Row; 1273 *newrow = *prologue_completed_row.get(); 1274 row.reset(newrow); 1275 current_sp_bytes_offset_from_fa = 1276 prologue_completed_sp_bytes_offset_from_cfa; 1277 is_aligned = prologue_completed_is_aligned; 1278 1279 saved_registers.clear(); 1280 saved_registers.resize(prologue_completed_saved_registers.size(), false); 1281 for (size_t i = 0; i < prologue_completed_saved_registers.size(); ++i) { 1282 saved_registers[i] = prologue_completed_saved_registers[i]; 1283 } 1284 1285 in_epilogue = true; 1286 row_updated = true; 1287 } 1288 } 1289 } 1290 1291 // call next instruction 1292 // call 0 1293 // => pop %ebx 1294 // This is used in i386 programs to get the PIC base address for finding 1295 // global data 1296 else if (call_next_insn_pattern_p()) { 1297 current_sp_bytes_offset_from_fa += m_wordsize; 1298 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) { 1299 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa); 1300 row_updated = true; 1301 } 1302 } 1303 1304 if (row_updated) { 1305 if (current_func_text_offset + insn_len < size) { 1306 row->SetOffset(current_func_text_offset + insn_len); 1307 unwind_plan.AppendRow(row); 1308 // Allocate a new Row, populate it with the existing Row contents. 1309 newrow = new UnwindPlan::Row; 1310 *newrow = *row.get(); 1311 row.reset(newrow); 1312 } 1313 } 1314 1315 if (!in_epilogue && row_updated) { 1316 // If we're not in an epilogue sequence, save the updated Row 1317 UnwindPlan::Row *newrow = new UnwindPlan::Row; 1318 *newrow = *row.get(); 1319 prologue_completed_row.reset(newrow); 1320 1321 prologue_completed_saved_registers.clear(); 1322 prologue_completed_saved_registers.resize(saved_registers.size(), false); 1323 for (size_t i = 0; i < saved_registers.size(); ++i) { 1324 prologue_completed_saved_registers[i] = saved_registers[i]; 1325 } 1326 } 1327 1328 // We may change the sp value without adding a new Row necessarily -- keep 1329 // track of it either way. 1330 if (!in_epilogue) { 1331 prologue_completed_sp_bytes_offset_from_cfa = 1332 current_sp_bytes_offset_from_fa; 1333 prologue_completed_is_aligned = is_aligned; 1334 } 1335 1336 m_cur_insn = m_cur_insn + insn_len; 1337 current_func_text_offset += insn_len; 1338 } 1339 1340 unwind_plan.SetSourceName("assembly insn profiling"); 1341 unwind_plan.SetSourcedFromCompiler(eLazyBoolNo); 1342 unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes); 1343 unwind_plan.SetUnwindPlanForSignalTrap(eLazyBoolNo); 1344 1345 return true; 1346 } 1347 1348 bool x86AssemblyInspectionEngine::AugmentUnwindPlanFromCallSite( 1349 uint8_t *data, size_t size, AddressRange &func_range, 1350 UnwindPlan &unwind_plan, RegisterContextSP ®_ctx) { 1351 Address addr_start = func_range.GetBaseAddress(); 1352 if (!addr_start.IsValid()) 1353 return false; 1354 1355 // We either need a live RegisterContext, or we need the UnwindPlan to 1356 // already be in the lldb register numbering scheme. 1357 if (reg_ctx.get() == nullptr && 1358 unwind_plan.GetRegisterKind() != eRegisterKindLLDB) 1359 return false; 1360 1361 // Is original unwind_plan valid? 1362 // unwind_plan should have at least one row which is ABI-default (CFA 1363 // register is sp), and another row in mid-function. 1364 if (unwind_plan.GetRowCount() < 2) 1365 return false; 1366 1367 UnwindPlan::RowSP first_row = unwind_plan.GetRowAtIndex(0); 1368 if (first_row->GetOffset() != 0) 1369 return false; 1370 uint32_t cfa_reg = first_row->GetCFAValue().GetRegisterNumber(); 1371 if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) { 1372 cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber( 1373 unwind_plan.GetRegisterKind(), 1374 first_row->GetCFAValue().GetRegisterNumber()); 1375 } 1376 if (cfa_reg != m_lldb_sp_regnum || 1377 first_row->GetCFAValue().GetOffset() != m_wordsize) 1378 return false; 1379 1380 UnwindPlan::RowSP original_last_row = unwind_plan.GetRowForFunctionOffset(-1); 1381 1382 size_t offset = 0; 1383 int row_id = 1; 1384 bool unwind_plan_updated = false; 1385 UnwindPlan::RowSP row(new UnwindPlan::Row(*first_row)); 1386 1387 // After a mid-function epilogue we will need to re-insert the original 1388 // unwind rules so unwinds work for the remainder of the function. These 1389 // aren't common with clang/gcc on x86 but it is possible. 1390 bool reinstate_unwind_state = false; 1391 1392 while (offset < size) { 1393 m_cur_insn = data + offset; 1394 int insn_len; 1395 if (!instruction_length(m_cur_insn, insn_len, size - offset) || 1396 insn_len == 0 || insn_len > kMaxInstructionByteSize) { 1397 // An unrecognized/junk instruction. 1398 break; 1399 } 1400 1401 // Advance offsets. 1402 offset += insn_len; 1403 1404 // offset is pointing beyond the bounds of the function; stop looping. 1405 if (offset >= size) 1406 continue; 1407 1408 if (reinstate_unwind_state) { 1409 UnwindPlan::RowSP new_row(new UnwindPlan::Row()); 1410 *new_row = *original_last_row; 1411 new_row->SetOffset(offset); 1412 unwind_plan.AppendRow(new_row); 1413 row = std::make_shared<UnwindPlan::Row>(); 1414 *row = *new_row; 1415 reinstate_unwind_state = false; 1416 unwind_plan_updated = true; 1417 continue; 1418 } 1419 1420 // If we already have one row for this instruction, we can continue. 1421 while (row_id < unwind_plan.GetRowCount() && 1422 unwind_plan.GetRowAtIndex(row_id)->GetOffset() <= offset) { 1423 row_id++; 1424 } 1425 UnwindPlan::RowSP original_row = unwind_plan.GetRowAtIndex(row_id - 1); 1426 if (original_row->GetOffset() == offset) { 1427 *row = *original_row; 1428 continue; 1429 } 1430 1431 if (row_id == 0) { 1432 // If we are here, compiler didn't generate CFI for prologue. This won't 1433 // happen to GCC or clang. In this case, bail out directly. 1434 return false; 1435 } 1436 1437 // Inspect the instruction to check if we need a new row for it. 1438 cfa_reg = row->GetCFAValue().GetRegisterNumber(); 1439 if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) { 1440 cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber( 1441 unwind_plan.GetRegisterKind(), 1442 row->GetCFAValue().GetRegisterNumber()); 1443 } 1444 if (cfa_reg == m_lldb_sp_regnum) { 1445 // CFA register is sp. 1446 1447 // call next instruction 1448 // call 0 1449 // => pop %ebx 1450 if (call_next_insn_pattern_p()) { 1451 row->SetOffset(offset); 1452 row->GetCFAValue().IncOffset(m_wordsize); 1453 1454 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1455 unwind_plan.InsertRow(new_row); 1456 unwind_plan_updated = true; 1457 continue; 1458 } 1459 1460 // push/pop register 1461 int regno; 1462 if (push_reg_p(regno)) { 1463 row->SetOffset(offset); 1464 row->GetCFAValue().IncOffset(m_wordsize); 1465 1466 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1467 unwind_plan.InsertRow(new_row); 1468 unwind_plan_updated = true; 1469 continue; 1470 } 1471 if (pop_reg_p(regno)) { 1472 // Technically, this might be a nonvolatile register recover in 1473 // epilogue. We should reset RegisterInfo for the register. But in 1474 // practice, previous rule for the register is still valid... So we 1475 // ignore this case. 1476 1477 row->SetOffset(offset); 1478 row->GetCFAValue().IncOffset(-m_wordsize); 1479 1480 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1481 unwind_plan.InsertRow(new_row); 1482 unwind_plan_updated = true; 1483 continue; 1484 } 1485 1486 if (pop_misc_reg_p()) { 1487 row->SetOffset(offset); 1488 row->GetCFAValue().IncOffset(-m_wordsize); 1489 1490 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1491 unwind_plan.InsertRow(new_row); 1492 unwind_plan_updated = true; 1493 continue; 1494 } 1495 1496 // push imm 1497 if (push_imm_pattern_p()) { 1498 row->SetOffset(offset); 1499 row->GetCFAValue().IncOffset(m_wordsize); 1500 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1501 unwind_plan.InsertRow(new_row); 1502 unwind_plan_updated = true; 1503 continue; 1504 } 1505 1506 // push extended 1507 if (push_extended_pattern_p() || push_misc_reg_p()) { 1508 row->SetOffset(offset); 1509 row->GetCFAValue().IncOffset(m_wordsize); 1510 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1511 unwind_plan.InsertRow(new_row); 1512 unwind_plan_updated = true; 1513 continue; 1514 } 1515 1516 // add/sub %rsp/%esp 1517 int amount; 1518 if (add_rsp_pattern_p(amount)) { 1519 row->SetOffset(offset); 1520 row->GetCFAValue().IncOffset(-amount); 1521 1522 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1523 unwind_plan.InsertRow(new_row); 1524 unwind_plan_updated = true; 1525 continue; 1526 } 1527 if (sub_rsp_pattern_p(amount)) { 1528 row->SetOffset(offset); 1529 row->GetCFAValue().IncOffset(amount); 1530 1531 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1532 unwind_plan.InsertRow(new_row); 1533 unwind_plan_updated = true; 1534 continue; 1535 } 1536 1537 // lea %rsp, [%rsp + $offset] 1538 if (lea_rsp_pattern_p(amount)) { 1539 row->SetOffset(offset); 1540 row->GetCFAValue().IncOffset(-amount); 1541 1542 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1543 unwind_plan.InsertRow(new_row); 1544 unwind_plan_updated = true; 1545 continue; 1546 } 1547 1548 if (ret_pattern_p()) { 1549 reinstate_unwind_state = true; 1550 continue; 1551 } 1552 } else if (cfa_reg == m_lldb_fp_regnum) { 1553 // CFA register is fp. 1554 1555 // The only case we care about is epilogue: 1556 // [0x5d] pop %rbp/%ebp 1557 // => [0xc3] ret 1558 if (pop_rbp_pattern_p() || leave_pattern_p()) { 1559 m_cur_insn++; 1560 if (ret_pattern_p()) { 1561 row->SetOffset(offset); 1562 row->GetCFAValue().SetIsRegisterPlusOffset( 1563 first_row->GetCFAValue().GetRegisterNumber(), m_wordsize); 1564 1565 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row)); 1566 unwind_plan.InsertRow(new_row); 1567 unwind_plan_updated = true; 1568 reinstate_unwind_state = true; 1569 continue; 1570 } 1571 } 1572 } else { 1573 // CFA register is not sp or fp. 1574 1575 // This must be hand-written assembly. 1576 // Just trust eh_frame and assume we have finished. 1577 break; 1578 } 1579 } 1580 1581 unwind_plan.SetPlanValidAddressRange(func_range); 1582 if (unwind_plan_updated) { 1583 std::string unwind_plan_source(unwind_plan.GetSourceName().AsCString()); 1584 unwind_plan_source += " plus augmentation from assembly parsing"; 1585 unwind_plan.SetSourceName(unwind_plan_source.c_str()); 1586 unwind_plan.SetSourcedFromCompiler(eLazyBoolNo); 1587 unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes); 1588 } 1589 return true; 1590 } 1591 1592 bool x86AssemblyInspectionEngine::FindFirstNonPrologueInstruction( 1593 uint8_t *data, size_t size, size_t &offset) { 1594 offset = 0; 1595 1596 if (!m_register_map_initialized) 1597 return false; 1598 1599 while (offset < size) { 1600 int regno; 1601 int insn_len; 1602 int scratch; 1603 1604 m_cur_insn = data + offset; 1605 if (!instruction_length(m_cur_insn, insn_len, size - offset) 1606 || insn_len > kMaxInstructionByteSize 1607 || insn_len == 0) { 1608 // An error parsing the instruction, i.e. probably data/garbage - stop 1609 // scanning 1610 break; 1611 } 1612 1613 if (push_rbp_pattern_p() || mov_rsp_rbp_pattern_p() || 1614 sub_rsp_pattern_p(scratch) || push_reg_p(regno) || 1615 mov_reg_to_local_stack_frame_p(regno, scratch) || 1616 retguard_prologue_p(offset, insn_len) || 1617 (lea_rsp_pattern_p(scratch) && offset == 0)) { 1618 offset += insn_len; 1619 continue; 1620 } 1621 // 1622 // Unknown non-prologue instruction - stop scanning 1623 break; 1624 } 1625 1626 return true; 1627 } 1628