Coverage Report

Created: 2026-02-26 06:31

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libunwind/src/x86_64/Gstep.c
Line
Count
Source
1
/* libunwind - a platform-independent unwind library
2
   Copyright (C) 2002-2004 Hewlett-Packard Co
3
        Contributed by David Mosberger-Tang <davidm@hpl.hp.com>
4
5
   Modified for x86_64 by Max Asbock <masbock@us.ibm.com>
6
7
This file is part of libunwind.
8
9
Permission is hereby granted, free of charge, to any person obtaining
10
a copy of this software and associated documentation files (the
11
"Software"), to deal in the Software without restriction, including
12
without limitation the rights to use, copy, modify, merge, publish,
13
distribute, sublicense, and/or sell copies of the Software, and to
14
permit persons to whom the Software is furnished to do so, subject to
15
the following conditions:
16
17
The above copyright notice and this permission notice shall be
18
included in all copies or substantial portions of the Software.
19
20
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
21
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
22
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
23
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
24
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
25
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
26
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  */
27
28
#include "libunwind_i.h"
29
#include "unwind_i.h"
30
#include <signal.h>
31
32
/* Recognise PLT entries such as:
33
     3bdf0: ff 25 e2 49 13 00 jmpq   *0x1349e2(%rip)
34
     3bdf6: 68 ae 03 00 00    pushq  $0x3ae
35
     3bdfb: e9 00 c5 ff ff    jmpq   38300 <_init+0x18> */
36
static int
37
_is_plt_entry (struct dwarf_cursor *c)
38
0
{
39
0
  unw_word_t w0, w1;
40
0
  unw_accessors_t *a;
41
0
  int ret;
42
43
0
  a = unw_get_accessors_int (c->as);
44
0
  if ((ret = (*a->access_mem) (c->as, c->ip, &w0, 0, c->as_arg)) < 0
45
0
      || (ret = (*a->access_mem) (c->as, c->ip + 8, &w1, 0, c->as_arg)) < 0)
46
0
    return 0;
47
48
0
  ret = (((w0 & 0xffff) == 0x25ff)
49
0
         && (((w0 >> 48) & 0xff) == 0x68)
50
0
         && (((w1 >> 24) & 0xff) == 0xe9));
51
52
0
  Debug (14, "ip=0x%lx => 0x%016lx 0x%016lx, ret = %d\n", c->ip, w0, w1, ret);
53
0
  return ret;
54
0
}
55
56
int
57
unw_is_plt_entry (unw_cursor_t *uc)
58
0
{
59
0
  return _is_plt_entry (&((struct cursor *)uc)->dwarf);
60
0
}
61
62
int
63
unw_step (unw_cursor_t *cursor)
64
57.6k
{
65
57.6k
  struct cursor *c = (struct cursor *) cursor;
66
57.6k
  int ret, i;
67
68
57.6k
#if CONSERVATIVE_CHECKS
69
57.6k
  int val = 0;
70
57.6k
  if (c->dwarf.as == unw_local_addr_space) {
71
57.6k
    val = dwarf_get_validate(&c->dwarf);
72
57.6k
    dwarf_set_validate(&c->dwarf, 1);
73
57.6k
  }
74
57.6k
#endif
75
76
57.6k
  Debug (1, "(cursor=%p, ip=0x%016lx, cfa=0x%016lx)\n",
77
57.6k
         c, c->dwarf.ip, c->dwarf.cfa);
78
79
  /* Try DWARF-based unwinding... */
80
57.6k
  c->sigcontext_format = X86_64_SCF_NONE;
81
57.6k
  ret = dwarf_step (&c->dwarf);
82
83
57.6k
#if CONSERVATIVE_CHECKS
84
57.6k
  if (c->dwarf.as == unw_local_addr_space) {
85
57.6k
    dwarf_set_validate(&c->dwarf, val);
86
57.6k
  }
87
57.6k
#endif
88
89
57.6k
  if (ret < 0 && ret != -UNW_ENOINFO)
90
0
    {
91
0
      Debug (2, "returning %d\n", ret);
92
0
      return ret;
93
0
    }
94
95
57.6k
  c->frames++;
96
97
57.6k
  if (likely (ret >= 0))
98
57.6k
    {
99
      /* x86_64 ABI specifies that end of call-chain is marked with a
100
         NULL RBP or undefined return address  */
101
57.6k
      if (DWARF_IS_NULL_LOC (c->dwarf.loc[RBP]))
102
0
          {
103
0
            c->dwarf.ip = 0;
104
0
            ret = 0;
105
0
          }
106
57.6k
    }
107
0
  else
108
0
    {
109
      /* DWARF failed.  There isn't much of a usable frame-chain on x86-64,
110
         but we do need to handle two special-cases:
111
112
          (i) signal trampoline: Old kernels and older libcs don't
113
              export the vDSO needed to get proper unwind info for the
114
              trampoline.  Recognize that case by looking at the code
115
              and filling in things by hand.
116
117
          (ii) PLT (shared-library) call-stubs: PLT stubs are invoked
118
              via CALLQ.  Try this for all non-signal trampoline
119
              code.  */
120
121
0
      unw_word_t invalid_prev_rip = 0;
122
0
      unw_word_t prev_ip = c->dwarf.ip;
123
0
      unw_word_t prev_cfa = c->dwarf.cfa;
124
0
      struct dwarf_loc rbp_loc = DWARF_NULL_LOC, rsp_loc = DWARF_NULL_LOC, rip_loc = DWARF_NULL_LOC;
125
126
      /* We could get here because of missing/bad unwind information.
127
         Validate all addresses before dereferencing. */
128
0
      if (c->dwarf.as == unw_local_addr_space) {
129
0
          dwarf_set_validate(&c->dwarf, 1);
130
0
      }
131
132
0
      Debug (13, "dwarf_step() failed (ret=%d), trying frame-chain\n", ret);
133
134
0
      if ((ret = x86_64_os_step (c)) != 0)
135
0
        {
136
0
          if (ret < 0)
137
0
            {
138
0
              Debug (2, "returning 0\n");
139
0
              return 0;
140
0
            }
141
0
        }
142
0
      else if (unw_is_signal_frame (cursor) > 0)
143
0
        {
144
0
          ret = x86_64_handle_signal_frame(cursor);
145
0
          if (ret < 0)
146
0
            {
147
0
              Debug (2, "returning 0\n");
148
0
              return 0;
149
0
            }
150
0
        }
151
0
      else if (_is_plt_entry (&c->dwarf))
152
0
        {
153
          /* Like regular frame, CFA = RSP+8, RA = [CFA-8], no regs saved. */
154
0
          Debug (2, "found plt entry\n");
155
0
          c->frame_info.cfa_reg_offset = 8;
156
0
          c->frame_info.cfa_reg_rsp = -1;
157
0
          c->frame_info.frame_type = UNW_X86_64_FRAME_STANDARD;
158
0
          c->dwarf.loc[RIP] = DWARF_LOC (c->dwarf.cfa, 0);
159
0
          c->dwarf.cfa += 8;
160
0
        }
161
0
      else if (prev_ip == 0 || (DWARF_IS_NULL_LOC (c->dwarf.loc[RBP])))
162
0
        {
163
0
          Debug (2, "End of call chain detected\n");
164
0
          for (i = 0; i < DWARF_NUM_PRESERVED_REGS; ++i)
165
0
            c->dwarf.loc[i] = DWARF_NULL_LOC;
166
0
        }
167
0
      else
168
0
        {
169
0
          unw_word_t rbp;
170
171
0
          ret = dwarf_get (&c->dwarf, c->dwarf.loc[RBP], &rbp);
172
0
          if (ret < 0)
173
0
            {
174
0
              Debug (2, "returning %d [RBP=0x%lx]\n", ret,
175
0
                     DWARF_GET_LOC (c->dwarf.loc[RBP]));
176
0
              return ret;
177
0
            }
178
179
0
          unw_word_t not_used;
180
0
          invalid_prev_rip = dwarf_get (&c->dwarf,  DWARF_MEM_LOC (c->dwarf, prev_ip), &not_used);
181
182
0
          if (!rbp && invalid_prev_rip == 0)
183
0
            {
184
              /* Looks like we may have reached the end of the call-chain.  */
185
0
              rbp_loc = DWARF_NULL_LOC;
186
0
              rsp_loc = DWARF_NULL_LOC;
187
0
              rip_loc = DWARF_NULL_LOC;
188
0
            }
189
0
          else
190
0
            {
191
              /*
192
               * Check if previous RIP was invalid
193
               * This could happen if a bad function pointer was
194
               * followed and so the stack wasn't updated by the
195
               * preamble
196
               */
197
0
              int rip_fixup_success = 0;
198
0
              if (invalid_prev_rip != 0)
199
0
                {
200
0
                    Debug (2, "Previous RIP %#010lx was invalid, attempting fixup\n", prev_ip);
201
0
                    unw_word_t rsp;
202
0
                    ret = dwarf_get (&c->dwarf, c->dwarf.loc[RSP], &rsp);
203
0
                    Debug (2, "get rsp %#010lx returned %d\n", rsp, ret);
204
205
                    /*Test to see if what we think is the previous RIP is valid*/
206
0
                    unw_word_t new_ip = 0;
207
0
                    if (dwarf_get(&c->dwarf, DWARF_MEM_LOC(c->dwarf, rsp), &new_ip) == 0)
208
0
                      {
209
0
                        Debug (2, "RSP %#010lx (%#010lx) looks valid\n", rsp, new_ip);
210
0
                        if (new_ip == 0x00000000)
211
0
                          {
212
0
                            Debug (2, "End of call chain detected\n");
213
0
                            rip_fixup_success = 1;
214
0
                            rbp_loc = DWARF_NULL_LOC;
215
0
                            rsp_loc = DWARF_NULL_LOC;
216
0
                            rip_loc = DWARF_NULL_LOC;
217
0
                          }
218
0
                        else
219
0
                          {
220
0
                            if ((ret = dwarf_get(&c->dwarf, DWARF_MEM_LOC(c->dwarf, new_ip), &not_used)) == 0)
221
0
                              {
222
0
                                Debug (2, "new_ip %#010lx looks valid\n", new_ip);
223
0
                                rip_fixup_success = 1;
224
0
                                c->frame_info.cfa_reg_offset = 8;
225
0
                                c->frame_info.cfa_reg_rsp = -1;
226
0
                                c->frame_info.rbp_cfa_offset = -1;
227
0
                                c->frame_info.rsp_cfa_offset = -1;
228
0
                                c->frame_info.frame_type = UNW_X86_64_FRAME_OTHER;
229
                                /*
230
                                 * The call should have pushed RIP to the stack
231
                                 * and since there was no preamble RSP hasn't been
232
                                 * touched so RIP should be at RSP.
233
                                 */
234
0
                                c->dwarf.cfa += 8;
235
                                /* Optimised x64 binaries don't use RBP it seems? */
236
0
                                rbp_loc = c->dwarf.loc[RBP];
237
0
                                rsp_loc = DWARF_VAL_LOC (c, rsp + 8);
238
0
                                rip_loc = DWARF_LOC (rsp, 0);
239
0
                              }
240
0
                            else
241
0
                              {
242
0
                                Debug (2, "new_ip %#010lx dwarf_get(&c->dwarf, DWARF_MEM_LOC(c->dwarf, new_ip_addr), &new_ip) != 0\n", new_ip);
243
0
                              }
244
0
                          }
245
0
                      }
246
0
                    else
247
0
                      {
248
0
                        Debug (2, "rsp %#010lx dwarf_get(&c->dwarf, DWARF_MEM_LOC(c->dwarf, rsp), &new_ip_addr) != 0\n", rsp);
249
0
                      }
250
0
                  }
251
              /*
252
               * If the previous rip we found on the stack didn't look valid fall back
253
               * to the previous method for finding a valid stack frame
254
               */
255
0
              if (!rip_fixup_success)
256
0
                {
257
0
                  Debug (2, "RIP fixup didn't work, falling back\n");
258
0
                  unw_word_t rbp1 = 0;
259
0
                  rbp_loc = DWARF_LOC(rbp, 0);
260
0
                  rsp_loc = DWARF_VAL_LOC(c, rbp + 16);
261
0
                  rip_loc = DWARF_LOC (rbp + 8, 0);
262
0
                  ret = dwarf_get (&c->dwarf, rbp_loc, &rbp1);
263
0
                  Debug (1, "[RBP=0x%lx] = 0x%lx (cfa = 0x%lx) -> 0x%lx\n",
264
0
                         (unsigned long) DWARF_GET_LOC (c->dwarf.loc[RBP]),
265
0
                         rbp, c->dwarf.cfa, rbp1);
266
267
                  /* Heuristic to determine incorrect guess.  For RBP to be a
268
                     valid frame it needs to be above current CFA, but don't
269
                     let it go more than a little.  Note that we can't deduce
270
                     anything about new RBP (rbp1) since it may not be a frame
271
                     pointer in the frame above.  Just check we get the value. */
272
0
                  if (ret < 0
273
0
                      || rbp < c->dwarf.cfa
274
0
                      || (rbp - c->dwarf.cfa) > 0x4000)
275
0
                    {
276
0
                      rip_loc = DWARF_NULL_LOC;
277
0
                      rbp_loc = DWARF_NULL_LOC;
278
0
                    }
279
280
0
                  c->frame_info.frame_type = UNW_X86_64_FRAME_GUESSED;
281
0
                  c->frame_info.cfa_reg_rsp = 0;
282
0
                  c->frame_info.cfa_reg_offset = 16;
283
0
                  c->frame_info.rbp_cfa_offset = -16;
284
0
                  c->dwarf.cfa += 16;
285
0
                }
286
0
            }
287
          /* Mark all registers unsaved */
288
0
          for (i = 0; i < DWARF_NUM_PRESERVED_REGS; ++i)
289
0
            c->dwarf.loc[i] = DWARF_NULL_LOC;
290
291
0
          c->dwarf.loc[RBP] = rbp_loc;
292
0
          c->dwarf.loc[RSP] = rsp_loc;
293
0
          c->dwarf.loc[RIP] = rip_loc;
294
0
          c->dwarf.use_prev_instr = 1;
295
0
        }
296
297
0
      if (DWARF_IS_NULL_LOC (c->dwarf.loc[RBP]) && invalid_prev_rip == 0)
298
0
        {
299
0
          ret = 0;
300
0
          Debug (2, "NULL %%rbp loc, returning %d\n", ret);
301
0
          return ret;
302
0
        }
303
0
      if (!DWARF_IS_NULL_LOC (c->dwarf.loc[RIP]))
304
0
        {
305
0
          ret = dwarf_get (&c->dwarf, c->dwarf.loc[RIP], &c->dwarf.ip);
306
0
          Debug (1, "Frame Chain [RIP=0x%Lx] = 0x%Lx\n",
307
0
                     (unsigned long long) DWARF_GET_LOC (c->dwarf.loc[RIP]),
308
0
                     (unsigned long long) c->dwarf.ip);
309
0
          if (ret < 0)
310
0
            {
311
0
              Debug (2, "returning %d\n", ret);
312
0
              return ret;
313
0
            }
314
#if __sun
315
          if (c->dwarf.ip == 0)
316
            {
317
              Debug (2, "returning 0\n");
318
              return ret;
319
            }
320
#endif
321
0
          ret = 1;
322
0
        }
323
0
      else
324
0
        c->dwarf.ip = 0;
325
326
0
      if (c->dwarf.ip == prev_ip && c->dwarf.cfa == prev_cfa)
327
0
        return -UNW_EBADFRAME;
328
0
    }
329
57.6k
  Debug (2, "returning %d\n", ret);
330
57.6k
  return ret;
331
57.6k
}