Bug Summary

File:src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/lldb/source/Plugins/UnwindAssembly/x86/x86AssemblyInspectionEngine.cpp
Warning:line 1026, column 7
Value stored to 'fa_value_ptr' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name x86AssemblyInspectionEngine.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/llvm/include -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../include -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/obj -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/obj/../include -D NDEBUG -D __STDC_LIMIT_MACROS -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D LLVM_PREFIX="/usr" -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/lldb/include -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/lldb/source -I /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/clang/include -internal-isystem /usr/include/c++/v1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-comment -std=c++14 -fdeprecated-macro -fdebug-compilation-dir=/usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/obj -ferror-limit 19 -fvisibility-inlines-hidden -fwrapv -stack-protector 2 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c++ /usr/src/gnu/usr.bin/clang/liblldbPluginUnwindAssembly/../../../llvm/lldb/source/Plugins/UnwindAssembly/x86/x86AssemblyInspectionEngine.cpp
1//===-- x86AssemblyInspectionEngine.cpp -----------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "x86AssemblyInspectionEngine.h"
10
11#include <memory>
12
13#include "llvm-c/Disassembler.h"
14
15#include "lldb/Core/Address.h"
16#include "lldb/Symbol/UnwindPlan.h"
17#include "lldb/Target/RegisterContext.h"
18#include "lldb/Target/UnwindAssembly.h"
19
20using namespace lldb_private;
21using namespace lldb;
22
23x86AssemblyInspectionEngine::x86AssemblyInspectionEngine(const ArchSpec &arch)
24 : m_cur_insn(nullptr), m_machine_ip_regnum(LLDB_INVALID_REGNUM0xffffffffU),
25 m_machine_sp_regnum(LLDB_INVALID_REGNUM0xffffffffU),
26 m_machine_fp_regnum(LLDB_INVALID_REGNUM0xffffffffU),
27 m_lldb_ip_regnum(LLDB_INVALID_REGNUM0xffffffffU),
28 m_lldb_sp_regnum(LLDB_INVALID_REGNUM0xffffffffU),
29 m_lldb_fp_regnum(LLDB_INVALID_REGNUM0xffffffffU),
30
31 m_reg_map(), m_arch(arch), m_cpu(k_cpu_unspecified), m_wordsize(-1),
32 m_register_map_initialized(false), m_disasm_context() {
33 m_disasm_context =
34 ::LLVMCreateDisasm(arch.GetTriple().getTriple().c_str(), nullptr,
35 /*TagType=*/1, nullptr, nullptr);
36}
37
38x86AssemblyInspectionEngine::~x86AssemblyInspectionEngine() {
39 ::LLVMDisasmDispose(m_disasm_context);
40}
41
42void x86AssemblyInspectionEngine::Initialize(RegisterContextSP &reg_ctx) {
43 m_cpu = k_cpu_unspecified;
44 m_wordsize = -1;
45 m_register_map_initialized = false;
46
47 const llvm::Triple::ArchType cpu = m_arch.GetMachine();
48 if (cpu == llvm::Triple::x86)
49 m_cpu = k_i386;
50 else if (cpu == llvm::Triple::x86_64)
51 m_cpu = k_x86_64;
52
53 if (m_cpu == k_cpu_unspecified)
54 return;
55
56 if (reg_ctx.get() == nullptr)
57 return;
58
59 if (m_cpu == k_i386) {
60 m_machine_ip_regnum = k_machine_eip;
61 m_machine_sp_regnum = k_machine_esp;
62 m_machine_fp_regnum = k_machine_ebp;
63 m_machine_alt_fp_regnum = k_machine_ebx;
64 m_wordsize = 4;
65
66 struct lldb_reg_info reginfo;
67 reginfo.name = "eax";
68 m_reg_map[k_machine_eax] = reginfo;
69 reginfo.name = "edx";
70 m_reg_map[k_machine_edx] = reginfo;
71 reginfo.name = "esp";
72 m_reg_map[k_machine_esp] = reginfo;
73 reginfo.name = "esi";
74 m_reg_map[k_machine_esi] = reginfo;
75 reginfo.name = "eip";
76 m_reg_map[k_machine_eip] = reginfo;
77 reginfo.name = "ecx";
78 m_reg_map[k_machine_ecx] = reginfo;
79 reginfo.name = "ebx";
80 m_reg_map[k_machine_ebx] = reginfo;
81 reginfo.name = "ebp";
82 m_reg_map[k_machine_ebp] = reginfo;
83 reginfo.name = "edi";
84 m_reg_map[k_machine_edi] = reginfo;
85 } else {
86 m_machine_ip_regnum = k_machine_rip;
87 m_machine_sp_regnum = k_machine_rsp;
88 m_machine_fp_regnum = k_machine_rbp;
89 m_machine_alt_fp_regnum = k_machine_rbx;
90 m_wordsize = 8;
91
92 struct lldb_reg_info reginfo;
93 reginfo.name = "rax";
94 m_reg_map[k_machine_rax] = reginfo;
95 reginfo.name = "rdx";
96 m_reg_map[k_machine_rdx] = reginfo;
97 reginfo.name = "rsp";
98 m_reg_map[k_machine_rsp] = reginfo;
99 reginfo.name = "rsi";
100 m_reg_map[k_machine_rsi] = reginfo;
101 reginfo.name = "r8";
102 m_reg_map[k_machine_r8] = reginfo;
103 reginfo.name = "r10";
104 m_reg_map[k_machine_r10] = reginfo;
105 reginfo.name = "r12";
106 m_reg_map[k_machine_r12] = reginfo;
107 reginfo.name = "r14";
108 m_reg_map[k_machine_r14] = reginfo;
109 reginfo.name = "rip";
110 m_reg_map[k_machine_rip] = reginfo;
111 reginfo.name = "rcx";
112 m_reg_map[k_machine_rcx] = reginfo;
113 reginfo.name = "rbx";
114 m_reg_map[k_machine_rbx] = reginfo;
115 reginfo.name = "rbp";
116 m_reg_map[k_machine_rbp] = reginfo;
117 reginfo.name = "rdi";
118 m_reg_map[k_machine_rdi] = reginfo;
119 reginfo.name = "r9";
120 m_reg_map[k_machine_r9] = reginfo;
121 reginfo.name = "r11";
122 m_reg_map[k_machine_r11] = reginfo;
123 reginfo.name = "r13";
124 m_reg_map[k_machine_r13] = reginfo;
125 reginfo.name = "r15";
126 m_reg_map[k_machine_r15] = reginfo;
127 }
128
129 for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin();
130 it != m_reg_map.end(); ++it) {
131 const RegisterInfo *ri = reg_ctx->GetRegisterInfoByName(it->second.name);
132 if (ri)
133 it->second.lldb_regnum = ri->kinds[eRegisterKindLLDB];
134 }
135
136 uint32_t lldb_regno;
137 if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno))
138 m_lldb_sp_regnum = lldb_regno;
139 if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno))
140 m_lldb_fp_regnum = lldb_regno;
141 if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno))
142 m_lldb_alt_fp_regnum = lldb_regno;
143 if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno))
144 m_lldb_ip_regnum = lldb_regno;
145
146 m_register_map_initialized = true;
147}
148
149void x86AssemblyInspectionEngine::Initialize(
150 std::vector<lldb_reg_info> &reg_info) {
151 m_cpu = k_cpu_unspecified;
152 m_wordsize = -1;
153 m_register_map_initialized = false;
154
155 const llvm::Triple::ArchType cpu = m_arch.GetMachine();
156 if (cpu == llvm::Triple::x86)
157 m_cpu = k_i386;
158 else if (cpu == llvm::Triple::x86_64)
159 m_cpu = k_x86_64;
160
161 if (m_cpu == k_cpu_unspecified)
162 return;
163
164 if (m_cpu == k_i386) {
165 m_machine_ip_regnum = k_machine_eip;
166 m_machine_sp_regnum = k_machine_esp;
167 m_machine_fp_regnum = k_machine_ebp;
168 m_machine_alt_fp_regnum = k_machine_ebx;
169 m_wordsize = 4;
170
171 struct lldb_reg_info reginfo;
172 reginfo.name = "eax";
173 m_reg_map[k_machine_eax] = reginfo;
174 reginfo.name = "edx";
175 m_reg_map[k_machine_edx] = reginfo;
176 reginfo.name = "esp";
177 m_reg_map[k_machine_esp] = reginfo;
178 reginfo.name = "esi";
179 m_reg_map[k_machine_esi] = reginfo;
180 reginfo.name = "eip";
181 m_reg_map[k_machine_eip] = reginfo;
182 reginfo.name = "ecx";
183 m_reg_map[k_machine_ecx] = reginfo;
184 reginfo.name = "ebx";
185 m_reg_map[k_machine_ebx] = reginfo;
186 reginfo.name = "ebp";
187 m_reg_map[k_machine_ebp] = reginfo;
188 reginfo.name = "edi";
189 m_reg_map[k_machine_edi] = reginfo;
190 } else {
191 m_machine_ip_regnum = k_machine_rip;
192 m_machine_sp_regnum = k_machine_rsp;
193 m_machine_fp_regnum = k_machine_rbp;
194 m_machine_alt_fp_regnum = k_machine_rbx;
195 m_wordsize = 8;
196
197 struct lldb_reg_info reginfo;
198 reginfo.name = "rax";
199 m_reg_map[k_machine_rax] = reginfo;
200 reginfo.name = "rdx";
201 m_reg_map[k_machine_rdx] = reginfo;
202 reginfo.name = "rsp";
203 m_reg_map[k_machine_rsp] = reginfo;
204 reginfo.name = "rsi";
205 m_reg_map[k_machine_rsi] = reginfo;
206 reginfo.name = "r8";
207 m_reg_map[k_machine_r8] = reginfo;
208 reginfo.name = "r10";
209 m_reg_map[k_machine_r10] = reginfo;
210 reginfo.name = "r12";
211 m_reg_map[k_machine_r12] = reginfo;
212 reginfo.name = "r14";
213 m_reg_map[k_machine_r14] = reginfo;
214 reginfo.name = "rip";
215 m_reg_map[k_machine_rip] = reginfo;
216 reginfo.name = "rcx";
217 m_reg_map[k_machine_rcx] = reginfo;
218 reginfo.name = "rbx";
219 m_reg_map[k_machine_rbx] = reginfo;
220 reginfo.name = "rbp";
221 m_reg_map[k_machine_rbp] = reginfo;
222 reginfo.name = "rdi";
223 m_reg_map[k_machine_rdi] = reginfo;
224 reginfo.name = "r9";
225 m_reg_map[k_machine_r9] = reginfo;
226 reginfo.name = "r11";
227 m_reg_map[k_machine_r11] = reginfo;
228 reginfo.name = "r13";
229 m_reg_map[k_machine_r13] = reginfo;
230 reginfo.name = "r15";
231 m_reg_map[k_machine_r15] = reginfo;
232 }
233
234 for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin();
235 it != m_reg_map.end(); ++it) {
236 for (size_t i = 0; i < reg_info.size(); ++i) {
237 if (::strcmp(reg_info[i].name, it->second.name) == 0) {
238 it->second.lldb_regnum = reg_info[i].lldb_regnum;
239 break;
240 }
241 }
242 }
243
244 uint32_t lldb_regno;
245 if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno))
246 m_lldb_sp_regnum = lldb_regno;
247 if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno))
248 m_lldb_fp_regnum = lldb_regno;
249 if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno))
250 m_lldb_alt_fp_regnum = lldb_regno;
251 if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno))
252 m_lldb_ip_regnum = lldb_regno;
253
254 m_register_map_initialized = true;
255}
256
257// This function expects an x86 native register number (i.e. the bits stripped
258// out of the actual instruction), not an lldb register number.
259//
260// FIXME: This is ABI dependent, it shouldn't be hardcoded here.
261
262bool x86AssemblyInspectionEngine::nonvolatile_reg_p(int machine_regno) {
263 if (m_cpu == k_i386) {
264 switch (machine_regno) {
265 case k_machine_ebx:
266 case k_machine_ebp: // not actually a nonvolatile but often treated as such
267 // by convention
268 case k_machine_esi:
269 case k_machine_edi:
270 case k_machine_esp:
271 return true;
272 default:
273 return false;
274 }
275 }
276 if (m_cpu == k_x86_64) {
277 switch (machine_regno) {
278 case k_machine_rbx:
279 case k_machine_rsp:
280 case k_machine_rbp: // not actually a nonvolatile but often treated as such
281 // by convention
282 case k_machine_r12:
283 case k_machine_r13:
284 case k_machine_r14:
285 case k_machine_r15:
286 return true;
287 default:
288 return false;
289 }
290 }
291 return false;
292}
293
294// Macro to detect if this is a REX mode prefix byte.
295#define REX_W_PREFIX_P(opcode)(((opcode) & (~0x5)) == 0x48) (((opcode) & (~0x5)) == 0x48)
296
297// The high bit which should be added to the source register number (the "R"
298// bit)
299#define REX_W_SRCREG(opcode)(((opcode)&0x4) >> 2) (((opcode)&0x4) >> 2)
300
301// The high bit which should be added to the destination register number (the
302// "B" bit)
303#define REX_W_DSTREG(opcode)((opcode)&0x1) ((opcode)&0x1)
304
305// pushq %rbp [0x55]
306bool x86AssemblyInspectionEngine::push_rbp_pattern_p() {
307 uint8_t *p = m_cur_insn;
308 return *p == 0x55;
309}
310
311// pushq $0 ; the first instruction in start() [0x6a 0x00]
312bool x86AssemblyInspectionEngine::push_0_pattern_p() {
313 uint8_t *p = m_cur_insn;
314 return *p == 0x6a && *(p + 1) == 0x0;
315}
316
317// pushq $0
318// pushl $0
319bool x86AssemblyInspectionEngine::push_imm_pattern_p() {
320 uint8_t *p = m_cur_insn;
321 return *p == 0x68 || *p == 0x6a;
322}
323
324// pushl imm8(%esp)
325//
326// e.g. 0xff 0x74 0x24 0x20 - 'pushl 0x20(%esp)' (same byte pattern for 'pushq
327// 0x20(%rsp)' in an x86_64 program)
328//
329// 0xff (with opcode bits '6' in next byte, PUSH r/m32) 0x74 (ModR/M byte with
330// three bits used to specify the opcode)
331// mod == b01, opcode == b110, R/M == b100
332// "+disp8"
333// 0x24 (SIB byte - scaled index = 0, r32 == esp) 0x20 imm8 value
334
335bool x86AssemblyInspectionEngine::push_extended_pattern_p() {
336 if (*m_cur_insn == 0xff) {
337 // Get the 3 opcode bits from the ModR/M byte
338 uint8_t opcode = (*(m_cur_insn + 1) >> 3) & 7;
339 if (opcode == 6) {
340 // I'm only looking for 0xff /6 here - I
341 // don't really care what value is being pushed, just that we're pushing
342 // a 32/64 bit value on to the stack is enough.
343 return true;
344 }
345 }
346 return false;
347}
348
349// instructions only valid in 32-bit mode:
350// 0x0e - push cs
351// 0x16 - push ss
352// 0x1e - push ds
353// 0x06 - push es
354bool x86AssemblyInspectionEngine::push_misc_reg_p() {
355 uint8_t p = *m_cur_insn;
356 if (m_wordsize == 4) {
357 if (p == 0x0e || p == 0x16 || p == 0x1e || p == 0x06)
358 return true;
359 }
360 return false;
361}
362
363// pushq %rbx
364// pushl %ebx
365bool x86AssemblyInspectionEngine::push_reg_p(int &regno) {
366 uint8_t *p = m_cur_insn;
367 int regno_prefix_bit = 0;
368 // If we have a rex prefix byte, check to see if a B bit is set
369 if (m_wordsize == 8 && (*p & 0xfe) == 0x40) {
370 regno_prefix_bit = (*p & 1) << 3;
371 p++;
372 }
373 if (*p >= 0x50 && *p <= 0x57) {
374 regno = (*p - 0x50) | regno_prefix_bit;
375 return true;
376 }
377 return false;
378}
379
380// movq %rsp, %rbp [0x48 0x8b 0xec] or [0x48 0x89 0xe5] movl %esp, %ebp [0x8b
381// 0xec] or [0x89 0xe5]
382bool x86AssemblyInspectionEngine::mov_rsp_rbp_pattern_p() {
383 uint8_t *p = m_cur_insn;
384 if (m_wordsize == 8 && *p == 0x48)
385 p++;
386 if (*(p) == 0x8b && *(p + 1) == 0xec)
387 return true;
388 if (*(p) == 0x89 && *(p + 1) == 0xe5)
389 return true;
390 return false;
391}
392
393// movq %rsp, %rbx [0x48 0x8b 0xdc] or [0x48 0x89 0xe3]
394// movl %esp, %ebx [0x8b 0xdc] or [0x89 0xe3]
395bool x86AssemblyInspectionEngine::mov_rsp_rbx_pattern_p() {
396 uint8_t *p = m_cur_insn;
397 if (m_wordsize == 8 && *p == 0x48)
398 p++;
399 if (*(p) == 0x8b && *(p + 1) == 0xdc)
400 return true;
401 if (*(p) == 0x89 && *(p + 1) == 0xe3)
402 return true;
403 return false;
404}
405
406// movq %rbp, %rsp [0x48 0x8b 0xe5] or [0x48 0x89 0xec]
407// movl %ebp, %esp [0x8b 0xe5] or [0x89 0xec]
408bool x86AssemblyInspectionEngine::mov_rbp_rsp_pattern_p() {
409 uint8_t *p = m_cur_insn;
410 if (m_wordsize == 8 && *p == 0x48)
411 p++;
412 if (*(p) == 0x8b && *(p + 1) == 0xe5)
413 return true;
414 if (*(p) == 0x89 && *(p + 1) == 0xec)
415 return true;
416 return false;
417}
418
419// movq %rbx, %rsp [0x48 0x8b 0xe3] or [0x48 0x89 0xdc]
420// movl %ebx, %esp [0x8b 0xe3] or [0x89 0xdc]
421bool x86AssemblyInspectionEngine::mov_rbx_rsp_pattern_p() {
422 uint8_t *p = m_cur_insn;
423 if (m_wordsize == 8 && *p == 0x48)
424 p++;
425 if (*(p) == 0x8b && *(p + 1) == 0xe3)
426 return true;
427 if (*(p) == 0x89 && *(p + 1) == 0xdc)
428 return true;
429 return false;
430}
431
432// subq $0x20, %rsp
433bool x86AssemblyInspectionEngine::sub_rsp_pattern_p(int &amount) {
434 uint8_t *p = m_cur_insn;
435 if (m_wordsize == 8 && *p == 0x48)
436 p++;
437 // 8-bit immediate operand
438 if (*p == 0x83 && *(p + 1) == 0xec) {
439 amount = (int8_t) * (p + 2);
440 return true;
441 }
442 // 32-bit immediate operand
443 if (*p == 0x81 && *(p + 1) == 0xec) {
444 amount = (int32_t)extract_4(p + 2);
445 return true;
446 }
447 return false;
448}
449
450// addq $0x20, %rsp
451bool x86AssemblyInspectionEngine::add_rsp_pattern_p(int &amount) {
452 uint8_t *p = m_cur_insn;
453 if (m_wordsize == 8 && *p == 0x48)
454 p++;
455 // 8-bit immediate operand
456 if (*p == 0x83 && *(p + 1) == 0xc4) {
457 amount = (int8_t) * (p + 2);
458 return true;
459 }
460 // 32-bit immediate operand
461 if (*p == 0x81 && *(p + 1) == 0xc4) {
462 amount = (int32_t)extract_4(p + 2);
463 return true;
464 }
465 return false;
466}
467
468// lea esp, [esp - 0x28]
469// lea esp, [esp + 0x28]
470bool x86AssemblyInspectionEngine::lea_rsp_pattern_p(int &amount) {
471 uint8_t *p = m_cur_insn;
472 if (m_wordsize == 8 && *p == 0x48)
473 p++;
474
475 // Check opcode
476 if (*p != 0x8d)
477 return false;
478
479 // 8 bit displacement
480 if (*(p + 1) == 0x64 && (*(p + 2) & 0x3f) == 0x24) {
481 amount = (int8_t) * (p + 3);
482 return true;
483 }
484
485 // 32 bit displacement
486 if (*(p + 1) == 0xa4 && (*(p + 2) & 0x3f) == 0x24) {
487 amount = (int32_t)extract_4(p + 3);
488 return true;
489 }
490
491 return false;
492}
493
494// lea -0x28(%ebp), %esp
495// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
496bool x86AssemblyInspectionEngine::lea_rbp_rsp_pattern_p(int &amount) {
497 uint8_t *p = m_cur_insn;
498 if (m_wordsize == 8 && *p == 0x48)
499 p++;
500
501 // Check opcode
502 if (*p != 0x8d)
503 return false;
504 ++p;
505
506 // 8 bit displacement
507 if (*p == 0x65) {
508 amount = (int8_t)p[1];
509 return true;
510 }
511
512 // 32 bit displacement
513 if (*p == 0xa5) {
514 amount = (int32_t)extract_4(p + 1);
515 return true;
516 }
517
518 return false;
519}
520
521// lea -0x28(%ebx), %esp
522// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
523bool x86AssemblyInspectionEngine::lea_rbx_rsp_pattern_p(int &amount) {
524 uint8_t *p = m_cur_insn;
525 if (m_wordsize == 8 && *p == 0x48)
526 p++;
527
528 // Check opcode
529 if (*p != 0x8d)
530 return false;
531 ++p;
532
533 // 8 bit displacement
534 if (*p == 0x63) {
535 amount = (int8_t)p[1];
536 return true;
537 }
538
539 // 32 bit displacement
540 if (*p == 0xa3) {
541 amount = (int32_t)extract_4(p + 1);
542 return true;
543 }
544
545 return false;
546}
547
548// and -0xfffffff0, %esp
549// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
550bool x86AssemblyInspectionEngine::and_rsp_pattern_p() {
551 uint8_t *p = m_cur_insn;
552 if (m_wordsize == 8 && *p == 0x48)
553 p++;
554
555 if (*p != 0x81 && *p != 0x83)
556 return false;
557
558 return *++p == 0xe4;
559}
560
561// popq %rbx
562// popl %ebx
563bool x86AssemblyInspectionEngine::pop_reg_p(int &regno) {
564 uint8_t *p = m_cur_insn;
565 int regno_prefix_bit = 0;
566 // If we have a rex prefix byte, check to see if a B bit is set
567 if (m_wordsize == 8 && (*p & 0xfe) == 0x40) {
568 regno_prefix_bit = (*p & 1) << 3;
569 p++;
570 }
571 if (*p >= 0x58 && *p <= 0x5f) {
572 regno = (*p - 0x58) | regno_prefix_bit;
573 return true;
574 }
575 return false;
576}
577
578// popq %rbp [0x5d]
579// popl %ebp [0x5d]
580bool x86AssemblyInspectionEngine::pop_rbp_pattern_p() {
581 uint8_t *p = m_cur_insn;
582 return (*p == 0x5d);
583}
584
585// instructions valid only in 32-bit mode:
586// 0x1f - pop ds
587// 0x07 - pop es
588// 0x17 - pop ss
589bool x86AssemblyInspectionEngine::pop_misc_reg_p() {
590 uint8_t p = *m_cur_insn;
591 if (m_wordsize == 4) {
592 if (p == 0x1f || p == 0x07 || p == 0x17)
593 return true;
594 }
595 return false;
596}
597
598// leave [0xc9]
599bool x86AssemblyInspectionEngine::leave_pattern_p() {
600 uint8_t *p = m_cur_insn;
601 return (*p == 0xc9);
602}
603
604// call $0 [0xe8 0x0 0x0 0x0 0x0]
605bool x86AssemblyInspectionEngine::call_next_insn_pattern_p() {
606 uint8_t *p = m_cur_insn;
607 return (*p == 0xe8) && (*(p + 1) == 0x0) && (*(p + 2) == 0x0) &&
608 (*(p + 3) == 0x0) && (*(p + 4) == 0x0);
609}
610
611// Look for an instruction sequence storing a nonvolatile register on to the
612// stack frame.
613
614// movq %rax, -0x10(%rbp) [0x48 0x89 0x45 0xf0]
615// movl %eax, -0xc(%ebp) [0x89 0x45 0xf4]
616
617// The offset value returned in rbp_offset will be positive -- but it must be
618// subtraced from the frame base register to get the actual location. The
619// positive value returned for the offset is a convention used elsewhere for
620// CFA offsets et al.
621
622bool x86AssemblyInspectionEngine::mov_reg_to_local_stack_frame_p(
623 int &regno, int &rbp_offset) {
624 uint8_t *p = m_cur_insn;
625 int src_reg_prefix_bit = 0;
626 int target_reg_prefix_bit = 0;
627
628 if (m_wordsize == 8 && REX_W_PREFIX_P(*p)(((*p) & (~0x5)) == 0x48)) {
629 src_reg_prefix_bit = REX_W_SRCREG(*p)(((*p)&0x4) >> 2) << 3;
630 target_reg_prefix_bit = REX_W_DSTREG(*p)((*p)&0x1) << 3;
631 if (target_reg_prefix_bit == 1) {
632 // rbp/ebp don't need a prefix bit - we know this isn't the reg we care
633 // about.
634 return false;
635 }
636 p++;
637 }
638
639 if (*p == 0x89) {
640 /* Mask off the 3-5 bits which indicate the destination register
641 if this is a ModR/M byte. */
642 int opcode_destreg_masked_out = *(p + 1) & (~0x38);
643
644 /* Is this a ModR/M byte with Mod bits 01 and R/M bits 101
645 and three bits between them, e.g. 01nnn101
646 We're looking for a destination of ebp-disp8 or ebp-disp32. */
647 int immsize;
648 if (opcode_destreg_masked_out == 0x45)
649 immsize = 2;
650 else if (opcode_destreg_masked_out == 0x85)
651 immsize = 4;
652 else
653 return false;
654
655 int offset = 0;
656 if (immsize == 2)
657 offset = (int8_t) * (p + 2);
658 if (immsize == 4)
659 offset = (uint32_t)extract_4(p + 2);
660 if (offset > 0)
661 return false;
662
663 regno = ((*(p + 1) >> 3) & 0x7) | src_reg_prefix_bit;
664 rbp_offset = offset > 0 ? offset : -offset;
665 return true;
666 }
667 return false;
668}
669
670// Returns true if this is a jmp instruction where we can't
671// know the destination address statically.
672//
673// ff e0 jmpq *%rax
674// ff e1 jmpq *%rcx
675// ff 60 28 jmpq *0x28(%rax)
676// ff 60 60 jmpq *0x60(%rax)
677bool x86AssemblyInspectionEngine::jmp_to_reg_p() {
678 if (*m_cur_insn != 0xff)
679 return false;
680
681 // The second byte is a ModR/M /4 byte, strip off the registers
682 uint8_t second_byte_sans_reg = *(m_cur_insn + 1) & ~7;
683
684 // Don't handle 0x24 disp32, because the target address is
685 // knowable statically - pc_rel_branch_or_jump_p() will
686 // return the target address.
687
688 // [reg]
689 if (second_byte_sans_reg == 0x20)
690 return true;
691
692 // [reg]+disp8
693 if (second_byte_sans_reg == 0x60)
694 return true;
695
696 // [reg]+disp32
697 if (second_byte_sans_reg == 0xa0)
698 return true;
699
700 // reg
701 if (second_byte_sans_reg == 0xe0)
702 return true;
703
704 // disp32
705 // jumps to an address stored in memory, the value can't be cached
706 // in an unwind plan.
707 if (second_byte_sans_reg == 0x24)
708 return true;
709
710 // use SIB byte
711 // ff 24 fe jmpq *(%rsi,%rdi,8)
712 if (second_byte_sans_reg == 0x24)
713 return true;
714
715 return false;
716}
717
718// Detect branches to fixed pc-relative offsets.
719// Returns the offset from the address of the next instruction
720// that may be branch/jumped to.
721//
722// Cannot determine the offset of a JMP that jumps to the address in
723// a register ("jmpq *%rax") or offset from a register value
724// ("jmpq *0x28(%rax)"), this method will return false on those
725// instructions.
726//
727// These instructions all end in either a relative 8/16/32 bit value
728// depending on the instruction and the current execution mode of the
729// inferior process. Once we know the size of the opcode instruction,
730// we can use the total instruction length to determine the size of
731// the relative offset without having to compute it correctly.
732
733bool x86AssemblyInspectionEngine::pc_rel_branch_or_jump_p (
734 const int instruction_length, int &offset)
735{
736 int opcode_size = 0;
737
738 uint8_t b1 = m_cur_insn[0];
739
740 switch (b1) {
741 case 0x77: // JA/JNBE rel8
742 case 0x73: // JAE/JNB/JNC rel8
743 case 0x72: // JB/JC/JNAE rel8
744 case 0x76: // JBE/JNA rel8
745 case 0xe3: // JCXZ/JECXZ/JRCXZ rel8
746 case 0x74: // JE/JZ rel8
747 case 0x7f: // JG/JNLE rel8
748 case 0x7d: // JGE/JNL rel8
749 case 0x7c: // JL/JNGE rel8
750 case 0x7e: // JNG/JLE rel8
751 case 0x71: // JNO rel8
752 case 0x7b: // JNP/JPO rel8
753 case 0x79: // JNS rel8
754 case 0x75: // JNE/JNZ rel8
755 case 0x70: // JO rel8
756 case 0x7a: // JP/JPE rel8
757 case 0x78: // JS rel8
758 case 0xeb: // JMP rel8
759 case 0xe9: // JMP rel16/rel32
760 opcode_size = 1;
761 break;
762 default:
763 break;
764 }
765 if (b1 == 0x0f && opcode_size == 0) {
766 uint8_t b2 = m_cur_insn[1];
767 switch (b2) {
768 case 0x87: // JA/JNBE rel16/rel32
769 case 0x86: // JBE/JNA rel16/rel32
770 case 0x84: // JE/JZ rel16/rel32
771 case 0x8f: // JG/JNLE rel16/rel32
772 case 0x8d: // JNL/JGE rel16/rel32
773 case 0x8e: // JLE rel16/rel32
774 case 0x82: // JB/JC/JNAE rel16/rel32
775 case 0x83: // JAE/JNB/JNC rel16/rel32
776 case 0x85: // JNE/JNZ rel16/rel32
777 case 0x8c: // JL/JNGE rel16/rel32
778 case 0x81: // JNO rel16/rel32
779 case 0x8b: // JNP/JPO rel16/rel32
780 case 0x89: // JNS rel16/rel32
781 case 0x80: // JO rel16/rel32
782 case 0x8a: // JP rel16/rel32
783 case 0x88: // JS rel16/rel32
784 opcode_size = 2;
785 break;
786 default:
787 break;
788 }
789 }
790
791 if (opcode_size == 0)
792 return false;
793
794 offset = 0;
795 if (instruction_length - opcode_size == 1) {
796 int8_t rel8 = (int8_t) *(m_cur_insn + opcode_size);
797 offset = rel8;
798 } else if (instruction_length - opcode_size == 2) {
799 int16_t rel16 = extract_2_signed (m_cur_insn + opcode_size);
800 offset = rel16;
801 } else if (instruction_length - opcode_size == 4) {
802 int32_t rel32 = extract_4_signed (m_cur_insn + opcode_size);
803 offset = rel32;
804 } else {
805 return false;
806 }
807 return true;
808}
809
810// Returns true if this instruction is a intra-function branch or jump -
811// a branch/jump within the bounds of this same function.
812// Cannot predict where a jump through a register value ("jmpq *%rax")
813// will go, so it will return false on that instruction.
814bool x86AssemblyInspectionEngine::local_branch_p (
815 const addr_t current_func_text_offset,
816 const AddressRange &func_range,
817 const int instruction_length,
818 addr_t &target_insn_offset) {
819 int offset;
820 if (pc_rel_branch_or_jump_p (instruction_length, offset) && offset != 0) {
821 addr_t next_pc_value = current_func_text_offset + instruction_length;
822 if (offset < 0 && addr_t(-offset) > current_func_text_offset) {
823 // Branch target is before the start of this function
824 return false;
825 }
826 if (offset + next_pc_value > func_range.GetByteSize()) {
827 // Branch targets outside this function's bounds
828 return false;
829 }
830 // This instruction branches to target_insn_offset (byte offset into the function)
831 target_insn_offset = next_pc_value + offset;
832 return true;
833 }
834 return false;
835}
836
837// Returns true if this instruction is a inter-function branch or jump - a
838// branch/jump to another function.
839// Cannot predict where a jump through a register value ("jmpq *%rax")
840// will go, so it will return false on that instruction.
841bool x86AssemblyInspectionEngine::non_local_branch_p (
842 const addr_t current_func_text_offset,
843 const AddressRange &func_range,
844 const int instruction_length) {
845 int offset;
846 addr_t target_insn_offset;
847 if (pc_rel_branch_or_jump_p (instruction_length, offset)) {
848 return !local_branch_p(current_func_text_offset,func_range,instruction_length,target_insn_offset);
849 }
850 return false;
851}
852
853// ret [0xc3] or [0xcb] or [0xc2 imm16] or [0xca imm16]
854bool x86AssemblyInspectionEngine::ret_pattern_p() {
855 uint8_t *p = m_cur_insn;
856 return *p == 0xc3 || *p == 0xc2 || *p == 0xca || *p == 0xcb;
857}
858
859uint16_t x86AssemblyInspectionEngine::extract_2(uint8_t *b) {
860 uint16_t v = 0;
861 for (int i = 1; i >= 0; i--)
862 v = (v << 8) | b[i];
863 return v;
864}
865
866int16_t x86AssemblyInspectionEngine::extract_2_signed(uint8_t *b) {
867 int16_t v = 0;
868 for (int i = 1; i >= 0; i--)
869 v = (v << 8) | b[i];
870 return v;
871}
872
873// movq $0x????????(%rip), $reg [(0x4c || 0x48) 0x8b ?? ?? ?? ?? ??]
874// xorq $off(%rsp), $reg [(0x4c || 0x48) 0x33 ?? 0x24]
875bool x86AssemblyInspectionEngine::retguard_prologue_p(size_t offset, int insn_len) {
876 uint8_t *p = m_cur_insn;
877 if (offset == 0 && insn_len == 7)
878 return (*p == 0x48 || *p == 0x4c) && (*(p + 1) == 0x8b);
879 else if (offset == 7 && insn_len == 4)
880 return (*p == 0x48 || *p == 0x4c) && (*(p + 1) == 0x33) && (*(p + 3) == 0x24);
881
882 return false;
883}
884
885uint32_t x86AssemblyInspectionEngine::extract_4(uint8_t *b) {
886 uint32_t v = 0;
887 for (int i = 3; i >= 0; i--)
888 v = (v << 8) | b[i];
889 return v;
890}
891
892int32_t x86AssemblyInspectionEngine::extract_4_signed(uint8_t *b) {
893 int32_t v = 0;
894 for (int i = 3; i >= 0; i--)
895 v = (v << 8) | b[i];
896 return v;
897}
898
899
900bool x86AssemblyInspectionEngine::instruction_length(uint8_t *insn_p,
901 int &length,
902 uint32_t buffer_remaining_bytes) {
903
904 uint32_t max_op_byte_size = std::min(buffer_remaining_bytes, m_arch.GetMaximumOpcodeByteSize());
905 llvm::SmallVector<uint8_t, 32> opcode_data;
906 opcode_data.resize(max_op_byte_size);
907
908 char out_string[512];
909 const size_t inst_size =
910 ::LLVMDisasmInstruction(m_disasm_context, insn_p, max_op_byte_size, 0,
911 out_string, sizeof(out_string));
912
913 length = inst_size;
914 return true;
915}
916
917bool x86AssemblyInspectionEngine::machine_regno_to_lldb_regno(
918 int machine_regno, uint32_t &lldb_regno) {
919 MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.find(machine_regno);
920 if (it != m_reg_map.end()) {
921 lldb_regno = it->second.lldb_regnum;
922 return true;
923 }
924 return false;
925}
926
927bool x86AssemblyInspectionEngine::GetNonCallSiteUnwindPlanFromAssembly(
928 uint8_t *data, size_t size, AddressRange &func_range,
929 UnwindPlan &unwind_plan) {
930 unwind_plan.Clear();
931
932 if (data == nullptr || size == 0)
933 return false;
934
935 if (!m_register_map_initialized)
936 return false;
937
938 addr_t current_func_text_offset = 0;
939 int current_sp_bytes_offset_from_fa = 0;
940 bool is_aligned = false;
941 UnwindPlan::Row::RegisterLocation initial_regloc;
942 UnwindPlan::RowSP row(new UnwindPlan::Row);
943
944 unwind_plan.SetPlanValidAddressRange(func_range);
945 unwind_plan.SetRegisterKind(eRegisterKindLLDB);
946
947 // At the start of the function, find the CFA by adding wordsize to the SP
948 // register
949 row->SetOffset(current_func_text_offset);
950 row->GetCFAValue().SetIsRegisterPlusOffset(m_lldb_sp_regnum, m_wordsize);
951
952 // caller's stack pointer value before the call insn is the CFA address
953 initial_regloc.SetIsCFAPlusOffset(0);
954 row->SetRegisterInfo(m_lldb_sp_regnum, initial_regloc);
955
956 // saved instruction pointer can be found at CFA - wordsize.
957 current_sp_bytes_offset_from_fa = m_wordsize;
958 initial_regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa);
959 row->SetRegisterInfo(m_lldb_ip_regnum, initial_regloc);
960
961 unwind_plan.AppendRow(row);
962
963 // Allocate a new Row, populate it with the existing Row contents.
964 UnwindPlan::Row *newrow = new UnwindPlan::Row;
965 *newrow = *row.get();
966 row.reset(newrow);
967
968 // Track which registers have been saved so far in the prologue. If we see
969 // another push of that register, it's not part of the prologue. The register
970 // numbers used here are the machine register #'s (i386_register_numbers,
971 // x86_64_register_numbers).
972 std::vector<bool> saved_registers(32, false);
973
974 // Once the prologue has completed we'll save a copy of the unwind
975 // instructions If there is an epilogue in the middle of the function, after
976 // that epilogue we'll reinstate the unwind setup -- we assume that some code
977 // path jumps over the mid-function epilogue
978
979 UnwindPlan::RowSP prologue_completed_row; // copy of prologue row of CFI
980 int prologue_completed_sp_bytes_offset_from_cfa; // The sp value before the
981 // epilogue started executed
982 bool prologue_completed_is_aligned;
983 std::vector<bool> prologue_completed_saved_registers;
984
985 while (current_func_text_offset < size) {
986 int stack_offset, insn_len;
987 int machine_regno; // register numbers masked directly out of instructions
988 uint32_t lldb_regno; // register numbers in lldb's eRegisterKindLLDB
989 // numbering scheme
990
991 bool in_epilogue = false; // we're in the middle of an epilogue sequence
992 bool row_updated = false; // The UnwindPlan::Row 'row' has been updated
993
994 m_cur_insn = data + current_func_text_offset;
995 if (!instruction_length(m_cur_insn, insn_len, size - current_func_text_offset)
996 || insn_len == 0
997 || insn_len > kMaxInstructionByteSize) {
998 // An unrecognized/junk instruction
999 break;
1000 }
1001
1002 auto &cfa_value = row->GetCFAValue();
1003 auto &afa_value = row->GetAFAValue();
1004 auto fa_value_ptr = is_aligned ? &afa_value : &cfa_value;
1005
1006 if (mov_rsp_rbp_pattern_p()) {
1007 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1008 fa_value_ptr->SetIsRegisterPlusOffset(
1009 m_lldb_fp_regnum, fa_value_ptr->GetOffset());
1010 row_updated = true;
1011 }
1012 }
1013
1014 else if (mov_rsp_rbx_pattern_p()) {
1015 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1016 fa_value_ptr->SetIsRegisterPlusOffset(
1017 m_lldb_alt_fp_regnum, fa_value_ptr->GetOffset());
1018 row_updated = true;
1019 }
1020 }
1021
1022 else if (and_rsp_pattern_p()) {
1023 current_sp_bytes_offset_from_fa = 0;
1024 afa_value.SetIsRegisterPlusOffset(
1025 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1026 fa_value_ptr = &afa_value;
Value stored to 'fa_value_ptr' is never read
1027 is_aligned = true;
1028 row_updated = true;
1029 }
1030
1031 else if (mov_rbp_rsp_pattern_p()) {
1032 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum)
1033 {
1034 is_aligned = false;
1035 fa_value_ptr = &cfa_value;
1036 afa_value.SetUnspecified();
1037 row_updated = true;
1038 }
1039 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum)
1040 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1041 }
1042
1043 else if (mov_rbx_rsp_pattern_p()) {
1044 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum)
1045 {
1046 is_aligned = false;
1047 fa_value_ptr = &cfa_value;
1048 afa_value.SetUnspecified();
1049 row_updated = true;
1050 }
1051 if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum)
1052 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1053 }
1054
1055 // This is the start() function (or a pthread equivalent), it starts with a
1056 // pushl $0x0 which puts the saved pc value of 0 on the stack. In this
1057 // case we want to pretend we didn't see a stack movement at all --
1058 // normally the saved pc value is already on the stack by the time the
1059 // function starts executing.
1060 else if (push_0_pattern_p()) {
1061 }
1062
1063 else if (push_reg_p(machine_regno)) {
1064 current_sp_bytes_offset_from_fa += m_wordsize;
1065 // the PUSH instruction has moved the stack pointer - if the FA is set
1066 // in terms of the stack pointer, we need to add a new row of
1067 // instructions.
1068 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1069 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1070 row_updated = true;
1071 }
1072 // record where non-volatile (callee-saved, spilled) registers are saved
1073 // on the stack
1074 if (nonvolatile_reg_p(machine_regno) &&
1075 machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1076 !saved_registers[machine_regno]) {
1077 UnwindPlan::Row::RegisterLocation regloc;
1078 if (is_aligned)
1079 regloc.SetAtAFAPlusOffset(-current_sp_bytes_offset_from_fa);
1080 else
1081 regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa);
1082 row->SetRegisterInfo(lldb_regno, regloc);
1083 saved_registers[machine_regno] = true;
1084 row_updated = true;
1085 }
1086 }
1087
1088 else if (pop_reg_p(machine_regno)) {
1089 current_sp_bytes_offset_from_fa -= m_wordsize;
1090
1091 if (nonvolatile_reg_p(machine_regno) &&
1092 machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1093 saved_registers[machine_regno]) {
1094 saved_registers[machine_regno] = false;
1095 row->RemoveRegisterInfo(lldb_regno);
1096
1097 if (lldb_regno == fa_value_ptr->GetRegisterNumber()) {
1098 fa_value_ptr->SetIsRegisterPlusOffset(
1099 m_lldb_sp_regnum, fa_value_ptr->GetOffset());
1100 }
1101
1102 in_epilogue = true;
1103 row_updated = true;
1104 }
1105
1106 // the POP instruction has moved the stack pointer - if the FA is set in
1107 // terms of the stack pointer, we need to add a new row of instructions.
1108 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1109 fa_value_ptr->SetIsRegisterPlusOffset(
1110 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1111 row_updated = true;
1112 }
1113 }
1114
1115 else if (pop_misc_reg_p()) {
1116 current_sp_bytes_offset_from_fa -= m_wordsize;
1117 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1118 fa_value_ptr->SetIsRegisterPlusOffset(
1119 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1120 row_updated = true;
1121 }
1122 }
1123
1124 // The LEAVE instruction moves the value from rbp into rsp and pops a value
1125 // off the stack into rbp (restoring the caller's rbp value). It is the
1126 // opposite of ENTER, or 'push rbp, mov rsp rbp'.
1127 else if (leave_pattern_p()) {
1128 if (saved_registers[m_machine_fp_regnum]) {
1129 saved_registers[m_machine_fp_regnum] = false;
1130 row->RemoveRegisterInfo(m_lldb_fp_regnum);
1131
1132 row_updated = true;
1133 }
1134
1135 if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum)
1136 {
1137 is_aligned = false;
1138 fa_value_ptr = &cfa_value;
1139 afa_value.SetUnspecified();
1140 row_updated = true;
1141 }
1142
1143 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum)
1144 {
1145 fa_value_ptr->SetIsRegisterPlusOffset(
1146 m_lldb_sp_regnum, fa_value_ptr->GetOffset());
1147
1148 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1149 }
1150
1151 current_sp_bytes_offset_from_fa -= m_wordsize;
1152
1153 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1154 fa_value_ptr->SetIsRegisterPlusOffset(
1155 m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1156 row_updated = true;
1157 }
1158
1159 in_epilogue = true;
1160 }
1161
1162 else if (mov_reg_to_local_stack_frame_p(machine_regno, stack_offset) &&
1163 nonvolatile_reg_p(machine_regno) &&
1164 machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1165 !saved_registers[machine_regno]) {
1166 saved_registers[machine_regno] = true;
1167
1168 UnwindPlan::Row::RegisterLocation regloc;
1169
1170 // stack_offset for 'movq %r15, -80(%rbp)' will be 80. In the Row, we
1171 // want to express this as the offset from the FA. If the frame base is
1172 // rbp (like the above instruction), the FA offset for rbp is probably
1173 // 16. So we want to say that the value is stored at the FA address -
1174 // 96.
1175 if (is_aligned)
1176 regloc.SetAtAFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset()));
1177 else
1178 regloc.SetAtCFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset()));
1179
1180 row->SetRegisterInfo(lldb_regno, regloc);
1181
1182 row_updated = true;
1183 }
1184
1185 else if (sub_rsp_pattern_p(stack_offset)) {
1186 current_sp_bytes_offset_from_fa += stack_offset;
1187 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1188 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1189 row_updated = true;
1190 }
1191 }
1192
1193 else if (add_rsp_pattern_p(stack_offset)) {
1194 current_sp_bytes_offset_from_fa -= stack_offset;
1195 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1196 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1197 row_updated = true;
1198 }
1199 in_epilogue = true;
1200 }
1201
1202 else if (push_extended_pattern_p() || push_imm_pattern_p() ||
1203 push_misc_reg_p()) {
1204 current_sp_bytes_offset_from_fa += m_wordsize;
1205 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1206 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1207 row_updated = true;
1208 }
1209 }
1210
1211 else if (lea_rsp_pattern_p(stack_offset)) {
1212 current_sp_bytes_offset_from_fa -= stack_offset;
1213 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1214 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1215 row_updated = true;
1216 }
1217 if (stack_offset > 0)
1218 in_epilogue = true;
1219 }
1220
1221 else if (lea_rbp_rsp_pattern_p(stack_offset)) {
1222 if (is_aligned &&
1223 cfa_value.GetRegisterNumber() == m_lldb_fp_regnum) {
1224 is_aligned = false;
1225 fa_value_ptr = &cfa_value;
1226 afa_value.SetUnspecified();
1227 row_updated = true;
1228 }
1229 if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum) {
1230 current_sp_bytes_offset_from_fa =
1231 fa_value_ptr->GetOffset() - stack_offset;
1232 }
1233 }
1234
1235 else if (lea_rbx_rsp_pattern_p(stack_offset)) {
1236 if (is_aligned &&
1237 cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum) {
1238 is_aligned = false;
1239 fa_value_ptr = &cfa_value;
1240 afa_value.SetUnspecified();
1241 row_updated = true;
1242 }
1243 if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum) {
1244 current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset() - stack_offset;
1245 }
1246 }
1247
1248 else if (prologue_completed_row.get() &&
1249 (ret_pattern_p() ||
1250 non_local_branch_p (current_func_text_offset, func_range, insn_len) ||
1251 jmp_to_reg_p())) {
1252 // Check if the current instruction is the end of an epilogue sequence,
1253 // and if so, re-instate the prologue-completed unwind state.
1254
1255 // The current instruction is a branch/jump outside this function,
1256 // a ret, or a jump through a register value which we cannot
1257 // determine the effcts of. Verify that the stack frame state
1258 // has been unwound to the same as it was at function entry to avoid
1259 // mis-identifying a JMP instruction as an epilogue.
1260 UnwindPlan::Row::RegisterLocation sp, pc;
1261 if (row->GetRegisterInfo(m_lldb_sp_regnum, sp) &&
1262 row->GetRegisterInfo(m_lldb_ip_regnum, pc)) {
1263 // Any ret instruction variant is definitely indicative of an
1264 // epilogue; for other insn patterns verify that we're back to
1265 // the original unwind state.
1266 if (ret_pattern_p() ||
1267 (sp.IsCFAPlusOffset() && sp.GetOffset() == 0 &&
1268 pc.IsAtCFAPlusOffset() && pc.GetOffset() == -m_wordsize)) {
1269 // Reinstate the saved prologue setup for any instructions that come
1270 // after the epilogue
1271
1272 UnwindPlan::Row *newrow = new UnwindPlan::Row;
1273 *newrow = *prologue_completed_row.get();
1274 row.reset(newrow);
1275 current_sp_bytes_offset_from_fa =
1276 prologue_completed_sp_bytes_offset_from_cfa;
1277 is_aligned = prologue_completed_is_aligned;
1278
1279 saved_registers.clear();
1280 saved_registers.resize(prologue_completed_saved_registers.size(), false);
1281 for (size_t i = 0; i < prologue_completed_saved_registers.size(); ++i) {
1282 saved_registers[i] = prologue_completed_saved_registers[i];
1283 }
1284
1285 in_epilogue = true;
1286 row_updated = true;
1287 }
1288 }
1289 }
1290
1291 // call next instruction
1292 // call 0
1293 // => pop %ebx
1294 // This is used in i386 programs to get the PIC base address for finding
1295 // global data
1296 else if (call_next_insn_pattern_p()) {
1297 current_sp_bytes_offset_from_fa += m_wordsize;
1298 if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1299 fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1300 row_updated = true;
1301 }
1302 }
1303
1304 if (row_updated) {
1305 if (current_func_text_offset + insn_len < size) {
1306 row->SetOffset(current_func_text_offset + insn_len);
1307 unwind_plan.AppendRow(row);
1308 // Allocate a new Row, populate it with the existing Row contents.
1309 newrow = new UnwindPlan::Row;
1310 *newrow = *row.get();
1311 row.reset(newrow);
1312 }
1313 }
1314
1315 if (!in_epilogue && row_updated) {
1316 // If we're not in an epilogue sequence, save the updated Row
1317 UnwindPlan::Row *newrow = new UnwindPlan::Row;
1318 *newrow = *row.get();
1319 prologue_completed_row.reset(newrow);
1320
1321 prologue_completed_saved_registers.clear();
1322 prologue_completed_saved_registers.resize(saved_registers.size(), false);
1323 for (size_t i = 0; i < saved_registers.size(); ++i) {
1324 prologue_completed_saved_registers[i] = saved_registers[i];
1325 }
1326 }
1327
1328 // We may change the sp value without adding a new Row necessarily -- keep
1329 // track of it either way.
1330 if (!in_epilogue) {
1331 prologue_completed_sp_bytes_offset_from_cfa =
1332 current_sp_bytes_offset_from_fa;
1333 prologue_completed_is_aligned = is_aligned;
1334 }
1335
1336 m_cur_insn = m_cur_insn + insn_len;
1337 current_func_text_offset += insn_len;
1338 }
1339
1340 unwind_plan.SetSourceName("assembly insn profiling");
1341 unwind_plan.SetSourcedFromCompiler(eLazyBoolNo);
1342 unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes);
1343 unwind_plan.SetUnwindPlanForSignalTrap(eLazyBoolNo);
1344
1345 return true;
1346}
1347
1348bool x86AssemblyInspectionEngine::AugmentUnwindPlanFromCallSite(
1349 uint8_t *data, size_t size, AddressRange &func_range,
1350 UnwindPlan &unwind_plan, RegisterContextSP &reg_ctx) {
1351 Address addr_start = func_range.GetBaseAddress();
1352 if (!addr_start.IsValid())
1353 return false;
1354
1355 // We either need a live RegisterContext, or we need the UnwindPlan to
1356 // already be in the lldb register numbering scheme.
1357 if (reg_ctx.get() == nullptr &&
1358 unwind_plan.GetRegisterKind() != eRegisterKindLLDB)
1359 return false;
1360
1361 // Is original unwind_plan valid?
1362 // unwind_plan should have at least one row which is ABI-default (CFA
1363 // register is sp), and another row in mid-function.
1364 if (unwind_plan.GetRowCount() < 2)
1365 return false;
1366
1367 UnwindPlan::RowSP first_row = unwind_plan.GetRowAtIndex(0);
1368 if (first_row->GetOffset() != 0)
1369 return false;
1370 uint32_t cfa_reg = first_row->GetCFAValue().GetRegisterNumber();
1371 if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) {
1372 cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber(
1373 unwind_plan.GetRegisterKind(),
1374 first_row->GetCFAValue().GetRegisterNumber());
1375 }
1376 if (cfa_reg != m_lldb_sp_regnum ||
1377 first_row->GetCFAValue().GetOffset() != m_wordsize)
1378 return false;
1379
1380 UnwindPlan::RowSP original_last_row = unwind_plan.GetRowForFunctionOffset(-1);
1381
1382 size_t offset = 0;
1383 int row_id = 1;
1384 bool unwind_plan_updated = false;
1385 UnwindPlan::RowSP row(new UnwindPlan::Row(*first_row));
1386
1387 // After a mid-function epilogue we will need to re-insert the original
1388 // unwind rules so unwinds work for the remainder of the function. These
1389 // aren't common with clang/gcc on x86 but it is possible.
1390 bool reinstate_unwind_state = false;
1391
1392 while (offset < size) {
1393 m_cur_insn = data + offset;
1394 int insn_len;
1395 if (!instruction_length(m_cur_insn, insn_len, size - offset) ||
1396 insn_len == 0 || insn_len > kMaxInstructionByteSize) {
1397 // An unrecognized/junk instruction.
1398 break;
1399 }
1400
1401 // Advance offsets.
1402 offset += insn_len;
1403
1404 // offset is pointing beyond the bounds of the function; stop looping.
1405 if (offset >= size)
1406 continue;
1407
1408 if (reinstate_unwind_state) {
1409 UnwindPlan::RowSP new_row(new UnwindPlan::Row());
1410 *new_row = *original_last_row;
1411 new_row->SetOffset(offset);
1412 unwind_plan.AppendRow(new_row);
1413 row = std::make_shared<UnwindPlan::Row>();
1414 *row = *new_row;
1415 reinstate_unwind_state = false;
1416 unwind_plan_updated = true;
1417 continue;
1418 }
1419
1420 // If we already have one row for this instruction, we can continue.
1421 while (row_id < unwind_plan.GetRowCount() &&
1422 unwind_plan.GetRowAtIndex(row_id)->GetOffset() <= offset) {
1423 row_id++;
1424 }
1425 UnwindPlan::RowSP original_row = unwind_plan.GetRowAtIndex(row_id - 1);
1426 if (original_row->GetOffset() == offset) {
1427 *row = *original_row;
1428 continue;
1429 }
1430
1431 if (row_id == 0) {
1432 // If we are here, compiler didn't generate CFI for prologue. This won't
1433 // happen to GCC or clang. In this case, bail out directly.
1434 return false;
1435 }
1436
1437 // Inspect the instruction to check if we need a new row for it.
1438 cfa_reg = row->GetCFAValue().GetRegisterNumber();
1439 if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) {
1440 cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber(
1441 unwind_plan.GetRegisterKind(),
1442 row->GetCFAValue().GetRegisterNumber());
1443 }
1444 if (cfa_reg == m_lldb_sp_regnum) {
1445 // CFA register is sp.
1446
1447 // call next instruction
1448 // call 0
1449 // => pop %ebx
1450 if (call_next_insn_pattern_p()) {
1451 row->SetOffset(offset);
1452 row->GetCFAValue().IncOffset(m_wordsize);
1453
1454 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1455 unwind_plan.InsertRow(new_row);
1456 unwind_plan_updated = true;
1457 continue;
1458 }
1459
1460 // push/pop register
1461 int regno;
1462 if (push_reg_p(regno)) {
1463 row->SetOffset(offset);
1464 row->GetCFAValue().IncOffset(m_wordsize);
1465
1466 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1467 unwind_plan.InsertRow(new_row);
1468 unwind_plan_updated = true;
1469 continue;
1470 }
1471 if (pop_reg_p(regno)) {
1472 // Technically, this might be a nonvolatile register recover in
1473 // epilogue. We should reset RegisterInfo for the register. But in
1474 // practice, previous rule for the register is still valid... So we
1475 // ignore this case.
1476
1477 row->SetOffset(offset);
1478 row->GetCFAValue().IncOffset(-m_wordsize);
1479
1480 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1481 unwind_plan.InsertRow(new_row);
1482 unwind_plan_updated = true;
1483 continue;
1484 }
1485
1486 if (pop_misc_reg_p()) {
1487 row->SetOffset(offset);
1488 row->GetCFAValue().IncOffset(-m_wordsize);
1489
1490 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1491 unwind_plan.InsertRow(new_row);
1492 unwind_plan_updated = true;
1493 continue;
1494 }
1495
1496 // push imm
1497 if (push_imm_pattern_p()) {
1498 row->SetOffset(offset);
1499 row->GetCFAValue().IncOffset(m_wordsize);
1500 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1501 unwind_plan.InsertRow(new_row);
1502 unwind_plan_updated = true;
1503 continue;
1504 }
1505
1506 // push extended
1507 if (push_extended_pattern_p() || push_misc_reg_p()) {
1508 row->SetOffset(offset);
1509 row->GetCFAValue().IncOffset(m_wordsize);
1510 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1511 unwind_plan.InsertRow(new_row);
1512 unwind_plan_updated = true;
1513 continue;
1514 }
1515
1516 // add/sub %rsp/%esp
1517 int amount;
1518 if (add_rsp_pattern_p(amount)) {
1519 row->SetOffset(offset);
1520 row->GetCFAValue().IncOffset(-amount);
1521
1522 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1523 unwind_plan.InsertRow(new_row);
1524 unwind_plan_updated = true;
1525 continue;
1526 }
1527 if (sub_rsp_pattern_p(amount)) {
1528 row->SetOffset(offset);
1529 row->GetCFAValue().IncOffset(amount);
1530
1531 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1532 unwind_plan.InsertRow(new_row);
1533 unwind_plan_updated = true;
1534 continue;
1535 }
1536
1537 // lea %rsp, [%rsp + $offset]
1538 if (lea_rsp_pattern_p(amount)) {
1539 row->SetOffset(offset);
1540 row->GetCFAValue().IncOffset(-amount);
1541
1542 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1543 unwind_plan.InsertRow(new_row);
1544 unwind_plan_updated = true;
1545 continue;
1546 }
1547
1548 if (ret_pattern_p()) {
1549 reinstate_unwind_state = true;
1550 continue;
1551 }
1552 } else if (cfa_reg == m_lldb_fp_regnum) {
1553 // CFA register is fp.
1554
1555 // The only case we care about is epilogue:
1556 // [0x5d] pop %rbp/%ebp
1557 // => [0xc3] ret
1558 if (pop_rbp_pattern_p() || leave_pattern_p()) {
1559 m_cur_insn++;
1560 if (ret_pattern_p()) {
1561 row->SetOffset(offset);
1562 row->GetCFAValue().SetIsRegisterPlusOffset(
1563 first_row->GetCFAValue().GetRegisterNumber(), m_wordsize);
1564
1565 UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1566 unwind_plan.InsertRow(new_row);
1567 unwind_plan_updated = true;
1568 reinstate_unwind_state = true;
1569 continue;
1570 }
1571 }
1572 } else {
1573 // CFA register is not sp or fp.
1574
1575 // This must be hand-written assembly.
1576 // Just trust eh_frame and assume we have finished.
1577 break;
1578 }
1579 }
1580
1581 unwind_plan.SetPlanValidAddressRange(func_range);
1582 if (unwind_plan_updated) {
1583 std::string unwind_plan_source(unwind_plan.GetSourceName().AsCString());
1584 unwind_plan_source += " plus augmentation from assembly parsing";
1585 unwind_plan.SetSourceName(unwind_plan_source.c_str());
1586 unwind_plan.SetSourcedFromCompiler(eLazyBoolNo);
1587 unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes);
1588 }
1589 return true;
1590}
1591
1592bool x86AssemblyInspectionEngine::FindFirstNonPrologueInstruction(
1593 uint8_t *data, size_t size, size_t &offset) {
1594 offset = 0;
1595
1596 if (!m_register_map_initialized)
1597 return false;
1598
1599 while (offset < size) {
1600 int regno;
1601 int insn_len;
1602 int scratch;
1603
1604 m_cur_insn = data + offset;
1605 if (!instruction_length(m_cur_insn, insn_len, size - offset)
1606 || insn_len > kMaxInstructionByteSize
1607 || insn_len == 0) {
1608 // An error parsing the instruction, i.e. probably data/garbage - stop
1609 // scanning
1610 break;
1611 }
1612
1613 if (push_rbp_pattern_p() || mov_rsp_rbp_pattern_p() ||
1614 sub_rsp_pattern_p(scratch) || push_reg_p(regno) ||
1615 mov_reg_to_local_stack_frame_p(regno, scratch) ||
1616 retguard_prologue_p(offset, insn_len) ||
1617 (lea_rsp_pattern_p(scratch) && offset == 0)) {
1618 offset += insn_len;
1619 continue;
1620 }
1621 //
1622 // Unknown non-prologue instruction - stop scanning
1623 break;
1624 }
1625
1626 return true;
1627}