1258065Spjd//===-- x86AssemblyInspectionEngine.cpp -----------------------------------===//
2258065Spjd//
3286796Soshogbo// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4258065Spjd// See https://llvm.org/LICENSE.txt for license information.
5258065Spjd// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6258065Spjd//
7258065Spjd//===----------------------------------------------------------------------===//
8258065Spjd
9258065Spjd#include "x86AssemblyInspectionEngine.h"
10258065Spjd
11258065Spjd#include <memory>
12258065Spjd
13258065Spjd#include "llvm-c/Disassembler.h"
14258065Spjd
15258065Spjd#include "lldb/Core/Address.h"
16258065Spjd#include "lldb/Symbol/UnwindPlan.h"
17258065Spjd#include "lldb/Target/RegisterContext.h"
18258065Spjd#include "lldb/Target/UnwindAssembly.h"
19258065Spjd
20258065Spjdusing namespace lldb_private;
21258065Spjdusing namespace lldb;
22258065Spjd
23258065Spjdx86AssemblyInspectionEngine::x86AssemblyInspectionEngine(const ArchSpec &arch)
24258065Spjd    : m_cur_insn(nullptr), m_machine_ip_regnum(LLDB_INVALID_REGNUM),
25258065Spjd      m_machine_sp_regnum(LLDB_INVALID_REGNUM),
26258065Spjd      m_machine_fp_regnum(LLDB_INVALID_REGNUM),
27258065Spjd      m_machine_alt_fp_regnum(LLDB_INVALID_REGNUM),
28258065Spjd      m_lldb_ip_regnum(LLDB_INVALID_REGNUM),
29258065Spjd      m_lldb_sp_regnum(LLDB_INVALID_REGNUM),
30258065Spjd      m_lldb_fp_regnum(LLDB_INVALID_REGNUM),
31258065Spjd      m_lldb_alt_fp_regnum(LLDB_INVALID_REGNUM), m_reg_map(), m_arch(arch),
32258065Spjd      m_cpu(k_cpu_unspecified), m_wordsize(-1),
33258065Spjd      m_register_map_initialized(false), m_disasm_context() {
34258065Spjd  m_disasm_context =
35258065Spjd      ::LLVMCreateDisasm(arch.GetTriple().getTriple().c_str(), nullptr,
36285139Soshogbo                         /*TagType=*/1, nullptr, nullptr);
37285139Soshogbo}
38279438Srstone
39258065Spjdx86AssemblyInspectionEngine::~x86AssemblyInspectionEngine() {
40279438Srstone  ::LLVMDisasmDispose(m_disasm_context);
41258065Spjd}
42271579Spjd
43271579Spjdvoid x86AssemblyInspectionEngine::Initialize(RegisterContextSP &reg_ctx) {
44272843Spjd  m_cpu = k_cpu_unspecified;
45271579Spjd  m_wordsize = -1;
46258065Spjd  m_register_map_initialized = false;
47
48  const llvm::Triple::ArchType cpu = m_arch.GetMachine();
49  if (cpu == llvm::Triple::x86)
50    m_cpu = k_i386;
51  else if (cpu == llvm::Triple::x86_64)
52    m_cpu = k_x86_64;
53
54  if (m_cpu == k_cpu_unspecified)
55    return;
56
57  if (reg_ctx.get() == nullptr)
58    return;
59
60  if (m_cpu == k_i386) {
61    m_machine_ip_regnum = k_machine_eip;
62    m_machine_sp_regnum = k_machine_esp;
63    m_machine_fp_regnum = k_machine_ebp;
64    m_machine_alt_fp_regnum = k_machine_ebx;
65    m_wordsize = 4;
66
67    struct lldb_reg_info reginfo;
68    reginfo.name = "eax";
69    m_reg_map[k_machine_eax] = reginfo;
70    reginfo.name = "edx";
71    m_reg_map[k_machine_edx] = reginfo;
72    reginfo.name = "esp";
73    m_reg_map[k_machine_esp] = reginfo;
74    reginfo.name = "esi";
75    m_reg_map[k_machine_esi] = reginfo;
76    reginfo.name = "eip";
77    m_reg_map[k_machine_eip] = reginfo;
78    reginfo.name = "ecx";
79    m_reg_map[k_machine_ecx] = reginfo;
80    reginfo.name = "ebx";
81    m_reg_map[k_machine_ebx] = reginfo;
82    reginfo.name = "ebp";
83    m_reg_map[k_machine_ebp] = reginfo;
84    reginfo.name = "edi";
85    m_reg_map[k_machine_edi] = reginfo;
86  } else {
87    m_machine_ip_regnum = k_machine_rip;
88    m_machine_sp_regnum = k_machine_rsp;
89    m_machine_fp_regnum = k_machine_rbp;
90    m_machine_alt_fp_regnum = k_machine_rbx;
91    m_wordsize = 8;
92
93    struct lldb_reg_info reginfo;
94    reginfo.name = "rax";
95    m_reg_map[k_machine_rax] = reginfo;
96    reginfo.name = "rdx";
97    m_reg_map[k_machine_rdx] = reginfo;
98    reginfo.name = "rsp";
99    m_reg_map[k_machine_rsp] = reginfo;
100    reginfo.name = "rsi";
101    m_reg_map[k_machine_rsi] = reginfo;
102    reginfo.name = "r8";
103    m_reg_map[k_machine_r8] = reginfo;
104    reginfo.name = "r10";
105    m_reg_map[k_machine_r10] = reginfo;
106    reginfo.name = "r12";
107    m_reg_map[k_machine_r12] = reginfo;
108    reginfo.name = "r14";
109    m_reg_map[k_machine_r14] = reginfo;
110    reginfo.name = "rip";
111    m_reg_map[k_machine_rip] = reginfo;
112    reginfo.name = "rcx";
113    m_reg_map[k_machine_rcx] = reginfo;
114    reginfo.name = "rbx";
115    m_reg_map[k_machine_rbx] = reginfo;
116    reginfo.name = "rbp";
117    m_reg_map[k_machine_rbp] = reginfo;
118    reginfo.name = "rdi";
119    m_reg_map[k_machine_rdi] = reginfo;
120    reginfo.name = "r9";
121    m_reg_map[k_machine_r9] = reginfo;
122    reginfo.name = "r11";
123    m_reg_map[k_machine_r11] = reginfo;
124    reginfo.name = "r13";
125    m_reg_map[k_machine_r13] = reginfo;
126    reginfo.name = "r15";
127    m_reg_map[k_machine_r15] = reginfo;
128  }
129
130  for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin();
131       it != m_reg_map.end(); ++it) {
132    const RegisterInfo *ri = reg_ctx->GetRegisterInfoByName(it->second.name);
133    if (ri)
134      it->second.lldb_regnum = ri->kinds[eRegisterKindLLDB];
135  }
136
137  uint32_t lldb_regno;
138  if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno))
139    m_lldb_sp_regnum = lldb_regno;
140  if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno))
141    m_lldb_fp_regnum = lldb_regno;
142  if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno))
143    m_lldb_alt_fp_regnum = lldb_regno;
144  if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno))
145    m_lldb_ip_regnum = lldb_regno;
146
147  m_register_map_initialized = true;
148}
149
150void x86AssemblyInspectionEngine::Initialize(
151    std::vector<lldb_reg_info> &reg_info) {
152  m_cpu = k_cpu_unspecified;
153  m_wordsize = -1;
154  m_register_map_initialized = false;
155
156  const llvm::Triple::ArchType cpu = m_arch.GetMachine();
157  if (cpu == llvm::Triple::x86)
158    m_cpu = k_i386;
159  else if (cpu == llvm::Triple::x86_64)
160    m_cpu = k_x86_64;
161
162  if (m_cpu == k_cpu_unspecified)
163    return;
164
165  if (m_cpu == k_i386) {
166    m_machine_ip_regnum = k_machine_eip;
167    m_machine_sp_regnum = k_machine_esp;
168    m_machine_fp_regnum = k_machine_ebp;
169    m_machine_alt_fp_regnum = k_machine_ebx;
170    m_wordsize = 4;
171
172    struct lldb_reg_info reginfo;
173    reginfo.name = "eax";
174    m_reg_map[k_machine_eax] = reginfo;
175    reginfo.name = "edx";
176    m_reg_map[k_machine_edx] = reginfo;
177    reginfo.name = "esp";
178    m_reg_map[k_machine_esp] = reginfo;
179    reginfo.name = "esi";
180    m_reg_map[k_machine_esi] = reginfo;
181    reginfo.name = "eip";
182    m_reg_map[k_machine_eip] = reginfo;
183    reginfo.name = "ecx";
184    m_reg_map[k_machine_ecx] = reginfo;
185    reginfo.name = "ebx";
186    m_reg_map[k_machine_ebx] = reginfo;
187    reginfo.name = "ebp";
188    m_reg_map[k_machine_ebp] = reginfo;
189    reginfo.name = "edi";
190    m_reg_map[k_machine_edi] = reginfo;
191  } else {
192    m_machine_ip_regnum = k_machine_rip;
193    m_machine_sp_regnum = k_machine_rsp;
194    m_machine_fp_regnum = k_machine_rbp;
195    m_machine_alt_fp_regnum = k_machine_rbx;
196    m_wordsize = 8;
197
198    struct lldb_reg_info reginfo;
199    reginfo.name = "rax";
200    m_reg_map[k_machine_rax] = reginfo;
201    reginfo.name = "rdx";
202    m_reg_map[k_machine_rdx] = reginfo;
203    reginfo.name = "rsp";
204    m_reg_map[k_machine_rsp] = reginfo;
205    reginfo.name = "rsi";
206    m_reg_map[k_machine_rsi] = reginfo;
207    reginfo.name = "r8";
208    m_reg_map[k_machine_r8] = reginfo;
209    reginfo.name = "r10";
210    m_reg_map[k_machine_r10] = reginfo;
211    reginfo.name = "r12";
212    m_reg_map[k_machine_r12] = reginfo;
213    reginfo.name = "r14";
214    m_reg_map[k_machine_r14] = reginfo;
215    reginfo.name = "rip";
216    m_reg_map[k_machine_rip] = reginfo;
217    reginfo.name = "rcx";
218    m_reg_map[k_machine_rcx] = reginfo;
219    reginfo.name = "rbx";
220    m_reg_map[k_machine_rbx] = reginfo;
221    reginfo.name = "rbp";
222    m_reg_map[k_machine_rbp] = reginfo;
223    reginfo.name = "rdi";
224    m_reg_map[k_machine_rdi] = reginfo;
225    reginfo.name = "r9";
226    m_reg_map[k_machine_r9] = reginfo;
227    reginfo.name = "r11";
228    m_reg_map[k_machine_r11] = reginfo;
229    reginfo.name = "r13";
230    m_reg_map[k_machine_r13] = reginfo;
231    reginfo.name = "r15";
232    m_reg_map[k_machine_r15] = reginfo;
233  }
234
235  for (MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.begin();
236       it != m_reg_map.end(); ++it) {
237    for (size_t i = 0; i < reg_info.size(); ++i) {
238      if (::strcmp(reg_info[i].name, it->second.name) == 0) {
239        it->second.lldb_regnum = reg_info[i].lldb_regnum;
240        break;
241      }
242    }
243  }
244
245  uint32_t lldb_regno;
246  if (machine_regno_to_lldb_regno(m_machine_sp_regnum, lldb_regno))
247    m_lldb_sp_regnum = lldb_regno;
248  if (machine_regno_to_lldb_regno(m_machine_fp_regnum, lldb_regno))
249    m_lldb_fp_regnum = lldb_regno;
250  if (machine_regno_to_lldb_regno(m_machine_alt_fp_regnum, lldb_regno))
251    m_lldb_alt_fp_regnum = lldb_regno;
252  if (machine_regno_to_lldb_regno(m_machine_ip_regnum, lldb_regno))
253    m_lldb_ip_regnum = lldb_regno;
254
255  m_register_map_initialized = true;
256}
257
258// This function expects an x86 native register number (i.e. the bits stripped
259// out of the actual instruction), not an lldb register number.
260//
261// FIXME: This is ABI dependent, it shouldn't be hardcoded here.
262
263bool x86AssemblyInspectionEngine::nonvolatile_reg_p(int machine_regno) {
264  if (m_cpu == k_i386) {
265    switch (machine_regno) {
266    case k_machine_ebx:
267    case k_machine_ebp: // not actually a nonvolatile but often treated as such
268                        // by convention
269    case k_machine_esi:
270    case k_machine_edi:
271    case k_machine_esp:
272      return true;
273    default:
274      return false;
275    }
276  }
277  if (m_cpu == k_x86_64) {
278    switch (machine_regno) {
279    case k_machine_rbx:
280    case k_machine_rsp:
281    case k_machine_rbp: // not actually a nonvolatile but often treated as such
282                        // by convention
283    case k_machine_r12:
284    case k_machine_r13:
285    case k_machine_r14:
286    case k_machine_r15:
287      return true;
288    default:
289      return false;
290    }
291  }
292  return false;
293}
294
295// Macro to detect if this is a REX mode prefix byte.
296#define REX_W_PREFIX_P(opcode) (((opcode) & (~0x5)) == 0x48)
297
298// The high bit which should be added to the source register number (the "R"
299// bit)
300#define REX_W_SRCREG(opcode) (((opcode)&0x4) >> 2)
301
302// The high bit which should be added to the destination register number (the
303// "B" bit)
304#define REX_W_DSTREG(opcode) ((opcode)&0x1)
305
306// pushq %rbp [0x55]
307bool x86AssemblyInspectionEngine::push_rbp_pattern_p() {
308  uint8_t *p = m_cur_insn;
309  return *p == 0x55;
310}
311
312// pushq $0 ; the first instruction in start() [0x6a 0x00]
313bool x86AssemblyInspectionEngine::push_0_pattern_p() {
314  uint8_t *p = m_cur_insn;
315  return *p == 0x6a && *(p + 1) == 0x0;
316}
317
318// pushq $0
319// pushl $0
320bool x86AssemblyInspectionEngine::push_imm_pattern_p() {
321  uint8_t *p = m_cur_insn;
322  return *p == 0x68 || *p == 0x6a;
323}
324
325// pushl imm8(%esp)
326//
327// e.g. 0xff 0x74 0x24 0x20 - 'pushl 0x20(%esp)' (same byte pattern for 'pushq
328// 0x20(%rsp)' in an x86_64 program)
329//
330// 0xff (with opcode bits '6' in next byte, PUSH r/m32) 0x74 (ModR/M byte with
331// three bits used to specify the opcode)
332//      mod == b01, opcode == b110, R/M == b100
333//      "+disp8"
334// 0x24 (SIB byte - scaled index = 0, r32 == esp) 0x20 imm8 value
335
336bool x86AssemblyInspectionEngine::push_extended_pattern_p() {
337  if (*m_cur_insn == 0xff) {
338    // Get the 3 opcode bits from the ModR/M byte
339    uint8_t opcode = (*(m_cur_insn + 1) >> 3) & 7;
340    if (opcode == 6) {
341      // I'm only looking for 0xff /6 here - I
342      // don't really care what value is being pushed, just that we're pushing
343      // a 32/64 bit value on to the stack is enough.
344      return true;
345    }
346  }
347  return false;
348}
349
350// instructions only valid in 32-bit mode:
351// 0x0e - push cs
352// 0x16 - push ss
353// 0x1e - push ds
354// 0x06 - push es
355bool x86AssemblyInspectionEngine::push_misc_reg_p() {
356  uint8_t p = *m_cur_insn;
357  if (m_wordsize == 4) {
358    if (p == 0x0e || p == 0x16 || p == 0x1e || p == 0x06)
359      return true;
360  }
361  return false;
362}
363
364// pushq %rbx
365// pushl %ebx
366bool x86AssemblyInspectionEngine::push_reg_p(int &regno) {
367  uint8_t *p = m_cur_insn;
368  int regno_prefix_bit = 0;
369  // If we have a rex prefix byte, check to see if a B bit is set
370  if (m_wordsize == 8 && (*p & 0xfe) == 0x40) {
371    regno_prefix_bit = (*p & 1) << 3;
372    p++;
373  }
374  if (*p >= 0x50 && *p <= 0x57) {
375    regno = (*p - 0x50) | regno_prefix_bit;
376    return true;
377  }
378  return false;
379}
380
381// movq %rsp, %rbp [0x48 0x8b 0xec] or [0x48 0x89 0xe5] movl %esp, %ebp [0x8b
382// 0xec] or [0x89 0xe5]
383bool x86AssemblyInspectionEngine::mov_rsp_rbp_pattern_p() {
384  uint8_t *p = m_cur_insn;
385  if (m_wordsize == 8 && *p == 0x48)
386    p++;
387  if (*(p) == 0x8b && *(p + 1) == 0xec)
388    return true;
389  if (*(p) == 0x89 && *(p + 1) == 0xe5)
390    return true;
391  return false;
392}
393
394// movq %rsp, %rbx [0x48 0x8b 0xdc] or [0x48 0x89 0xe3]
395// movl %esp, %ebx [0x8b 0xdc] or [0x89 0xe3]
396bool x86AssemblyInspectionEngine::mov_rsp_rbx_pattern_p() {
397  uint8_t *p = m_cur_insn;
398  if (m_wordsize == 8 && *p == 0x48)
399    p++;
400  if (*(p) == 0x8b && *(p + 1) == 0xdc)
401    return true;
402  if (*(p) == 0x89 && *(p + 1) == 0xe3)
403    return true;
404  return false;
405}
406
407// movq %rbp, %rsp [0x48 0x8b 0xe5] or [0x48 0x89 0xec]
408// movl %ebp, %esp [0x8b 0xe5] or [0x89 0xec]
409bool x86AssemblyInspectionEngine::mov_rbp_rsp_pattern_p() {
410  uint8_t *p = m_cur_insn;
411  if (m_wordsize == 8 && *p == 0x48)
412    p++;
413  if (*(p) == 0x8b && *(p + 1) == 0xe5)
414    return true;
415  if (*(p) == 0x89 && *(p + 1) == 0xec)
416    return true;
417  return false;
418}
419
420// movq %rbx, %rsp [0x48 0x8b 0xe3] or [0x48 0x89 0xdc]
421// movl %ebx, %esp [0x8b 0xe3] or [0x89 0xdc]
422bool x86AssemblyInspectionEngine::mov_rbx_rsp_pattern_p() {
423  uint8_t *p = m_cur_insn;
424  if (m_wordsize == 8 && *p == 0x48)
425    p++;
426  if (*(p) == 0x8b && *(p + 1) == 0xe3)
427    return true;
428  if (*(p) == 0x89 && *(p + 1) == 0xdc)
429    return true;
430  return false;
431}
432
433// subq $0x20, %rsp
434bool x86AssemblyInspectionEngine::sub_rsp_pattern_p(int &amount) {
435  uint8_t *p = m_cur_insn;
436  if (m_wordsize == 8 && *p == 0x48)
437    p++;
438  // 8-bit immediate operand
439  if (*p == 0x83 && *(p + 1) == 0xec) {
440    amount = (int8_t) * (p + 2);
441    return true;
442  }
443  // 32-bit immediate operand
444  if (*p == 0x81 && *(p + 1) == 0xec) {
445    amount = (int32_t)extract_4(p + 2);
446    return true;
447  }
448  return false;
449}
450
451// addq $0x20, %rsp
452bool x86AssemblyInspectionEngine::add_rsp_pattern_p(int &amount) {
453  uint8_t *p = m_cur_insn;
454  if (m_wordsize == 8 && *p == 0x48)
455    p++;
456  // 8-bit immediate operand
457  if (*p == 0x83 && *(p + 1) == 0xc4) {
458    amount = (int8_t) * (p + 2);
459    return true;
460  }
461  // 32-bit immediate operand
462  if (*p == 0x81 && *(p + 1) == 0xc4) {
463    amount = (int32_t)extract_4(p + 2);
464    return true;
465  }
466  return false;
467}
468
469// lea esp, [esp - 0x28]
470// lea esp, [esp + 0x28]
471bool x86AssemblyInspectionEngine::lea_rsp_pattern_p(int &amount) {
472  uint8_t *p = m_cur_insn;
473  if (m_wordsize == 8 && *p == 0x48)
474    p++;
475
476  // Check opcode
477  if (*p != 0x8d)
478    return false;
479
480  // 8 bit displacement
481  if (*(p + 1) == 0x64 && (*(p + 2) & 0x3f) == 0x24) {
482    amount = (int8_t) * (p + 3);
483    return true;
484  }
485
486  // 32 bit displacement
487  if (*(p + 1) == 0xa4 && (*(p + 2) & 0x3f) == 0x24) {
488    amount = (int32_t)extract_4(p + 3);
489    return true;
490  }
491
492  return false;
493}
494
495// lea -0x28(%ebp), %esp
496// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
497bool x86AssemblyInspectionEngine::lea_rbp_rsp_pattern_p(int &amount) {
498  uint8_t *p = m_cur_insn;
499  if (m_wordsize == 8 && *p == 0x48)
500    p++;
501
502  // Check opcode
503  if (*p != 0x8d)
504    return false;
505  ++p;
506
507  // 8 bit displacement
508  if (*p == 0x65) {
509    amount = (int8_t)p[1];
510    return true;
511  }
512
513  // 32 bit displacement
514  if (*p == 0xa5) {
515    amount = (int32_t)extract_4(p + 1);
516    return true;
517  }
518
519  return false;
520}
521
522// lea -0x28(%ebx), %esp
523// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
524bool x86AssemblyInspectionEngine::lea_rbx_rsp_pattern_p(int &amount) {
525  uint8_t *p = m_cur_insn;
526  if (m_wordsize == 8 && *p == 0x48)
527    p++;
528
529  // Check opcode
530  if (*p != 0x8d)
531    return false;
532  ++p;
533
534  // 8 bit displacement
535  if (*p == 0x63) {
536    amount = (int8_t)p[1];
537    return true;
538  }
539
540  // 32 bit displacement
541  if (*p == 0xa3) {
542    amount = (int32_t)extract_4(p + 1);
543    return true;
544  }
545
546  return false;
547}
548
549// and -0xfffffff0, %esp
550// (32-bit and 64-bit variants, 8-bit and 32-bit displacement)
551bool x86AssemblyInspectionEngine::and_rsp_pattern_p() {
552  uint8_t *p = m_cur_insn;
553  if (m_wordsize == 8 && *p == 0x48)
554    p++;
555
556  if (*p != 0x81 && *p != 0x83)
557    return false;
558
559  return *++p == 0xe4;
560}
561
562// popq %rbx
563// popl %ebx
564bool x86AssemblyInspectionEngine::pop_reg_p(int &regno) {
565  uint8_t *p = m_cur_insn;
566  int regno_prefix_bit = 0;
567  // If we have a rex prefix byte, check to see if a B bit is set
568  if (m_wordsize == 8 && (*p & 0xfe) == 0x40) {
569    regno_prefix_bit = (*p & 1) << 3;
570    p++;
571  }
572  if (*p >= 0x58 && *p <= 0x5f) {
573    regno = (*p - 0x58) | regno_prefix_bit;
574    return true;
575  }
576  return false;
577}
578
579// popq %rbp [0x5d]
580// popl %ebp [0x5d]
581bool x86AssemblyInspectionEngine::pop_rbp_pattern_p() {
582  uint8_t *p = m_cur_insn;
583  return (*p == 0x5d);
584}
585
586// instructions valid only in 32-bit mode:
587// 0x1f - pop ds
588// 0x07 - pop es
589// 0x17 - pop ss
590bool x86AssemblyInspectionEngine::pop_misc_reg_p() {
591  uint8_t p = *m_cur_insn;
592  if (m_wordsize == 4) {
593    if (p == 0x1f || p == 0x07 || p == 0x17)
594      return true;
595  }
596  return false;
597}
598
599// leave [0xc9]
600bool x86AssemblyInspectionEngine::leave_pattern_p() {
601  uint8_t *p = m_cur_insn;
602  return (*p == 0xc9);
603}
604
605// call $0 [0xe8 0x0 0x0 0x0 0x0]
606bool x86AssemblyInspectionEngine::call_next_insn_pattern_p() {
607  uint8_t *p = m_cur_insn;
608  return (*p == 0xe8) && (*(p + 1) == 0x0) && (*(p + 2) == 0x0) &&
609         (*(p + 3) == 0x0) && (*(p + 4) == 0x0);
610}
611
612// Look for an instruction sequence storing a nonvolatile register on to the
613// stack frame.
614
615//  movq %rax, -0x10(%rbp) [0x48 0x89 0x45 0xf0]
616//  movl %eax, -0xc(%ebp)  [0x89 0x45 0xf4]
617
618// The offset value returned in rbp_offset will be positive -- but it must be
619// subtraced from the frame base register to get the actual location.  The
620// positive value returned for the offset is a convention used elsewhere for
621// CFA offsets et al.
622
623bool x86AssemblyInspectionEngine::mov_reg_to_local_stack_frame_p(
624    int &regno, int &rbp_offset) {
625  uint8_t *p = m_cur_insn;
626  int src_reg_prefix_bit = 0;
627  int target_reg_prefix_bit = 0;
628
629  if (m_wordsize == 8 && REX_W_PREFIX_P(*p)) {
630    src_reg_prefix_bit = REX_W_SRCREG(*p) << 3;
631    target_reg_prefix_bit = REX_W_DSTREG(*p) << 3;
632    if (target_reg_prefix_bit == 1) {
633      // rbp/ebp don't need a prefix bit - we know this isn't the reg we care
634      // about.
635      return false;
636    }
637    p++;
638  }
639
640  if (*p == 0x89) {
641    /* Mask off the 3-5 bits which indicate the destination register
642       if this is a ModR/M byte.  */
643    int opcode_destreg_masked_out = *(p + 1) & (~0x38);
644
645    /* Is this a ModR/M byte with Mod bits 01 and R/M bits 101
646       and three bits between them, e.g. 01nnn101
647       We're looking for a destination of ebp-disp8 or ebp-disp32.   */
648    int immsize;
649    if (opcode_destreg_masked_out == 0x45)
650      immsize = 2;
651    else if (opcode_destreg_masked_out == 0x85)
652      immsize = 4;
653    else
654      return false;
655
656    int offset = 0;
657    if (immsize == 2)
658      offset = (int8_t) * (p + 2);
659    if (immsize == 4)
660      offset = (uint32_t)extract_4(p + 2);
661    if (offset > 0)
662      return false;
663
664    regno = ((*(p + 1) >> 3) & 0x7) | src_reg_prefix_bit;
665    rbp_offset = offset > 0 ? offset : -offset;
666    return true;
667  }
668  return false;
669}
670
671// Returns true if this is a jmp instruction where we can't
672// know the destination address statically.
673//
674// ff e0                                   jmpq   *%rax
675// ff e1                                   jmpq   *%rcx
676// ff 60 28                                jmpq   *0x28(%rax)
677// ff 60 60                                jmpq   *0x60(%rax)
678bool x86AssemblyInspectionEngine::jmp_to_reg_p() {
679  if (*m_cur_insn != 0xff)
680    return false;
681
682  // The second byte is a ModR/M /4 byte, strip off the registers
683  uint8_t second_byte_sans_reg = *(m_cur_insn + 1) & ~7;
684
685  // [reg]
686  if (second_byte_sans_reg == 0x20)
687    return true;
688
689  // [reg]+disp8
690  if (second_byte_sans_reg == 0x60)
691    return true;
692
693  // [reg]+disp32
694  if (second_byte_sans_reg == 0xa0)
695    return true;
696
697  // reg
698  if (second_byte_sans_reg == 0xe0)
699    return true;
700
701  return false;
702}
703
704// Detect branches to fixed pc-relative offsets.
705// Returns the offset from the address of the next instruction
706// that may be branch/jumped to.
707//
708// Cannot determine the offset of a JMP that jumps to the address in
709// a register ("jmpq *%rax") or offset from a register value
710// ("jmpq *0x28(%rax)"), this method will return false on those
711// instructions.
712//
713// These instructions all end in either a relative 8/16/32 bit value
714// depending on the instruction and the current execution mode of the
715// inferior process.  Once we know the size of the opcode instruction,
716// we can use the total instruction length to determine the size of
717// the relative offset without having to compute it correctly.
718
719bool x86AssemblyInspectionEngine::pc_rel_branch_or_jump_p (
720    const int instruction_length, int &offset)
721{
722  int opcode_size = 0;
723
724  uint8_t b1 = m_cur_insn[0];
725
726  switch (b1) {
727    case 0x77: // JA/JNBE rel8
728    case 0x73: // JAE/JNB/JNC rel8
729    case 0x72: // JB/JC/JNAE rel8
730    case 0x76: // JBE/JNA rel8
731    case 0xe3: // JCXZ/JECXZ/JRCXZ rel8
732    case 0x74: // JE/JZ rel8
733    case 0x7f: // JG/JNLE rel8
734    case 0x7d: // JGE/JNL rel8
735    case 0x7c: // JL/JNGE rel8
736    case 0x7e: // JNG/JLE rel8
737    case 0x71: // JNO rel8
738    case 0x7b: // JNP/JPO rel8
739    case 0x79: // JNS rel8
740    case 0x75: // JNE/JNZ rel8
741    case 0x70: // JO rel8
742    case 0x7a: // JP/JPE rel8
743    case 0x78: // JS rel8
744    case 0xeb: // JMP rel8
745    case 0xe9: // JMP rel16/rel32
746      opcode_size = 1;
747      break;
748    default:
749      break;
750  }
751  if (b1 == 0x0f && opcode_size == 0) {
752    uint8_t b2 = m_cur_insn[1];
753    switch (b2) {
754      case 0x87: // JA/JNBE rel16/rel32
755      case 0x86: // JBE/JNA rel16/rel32
756      case 0x84: // JE/JZ rel16/rel32
757      case 0x8f: // JG/JNLE rel16/rel32
758      case 0x8d: // JNL/JGE rel16/rel32
759      case 0x8e: // JLE rel16/rel32
760      case 0x82: // JB/JC/JNAE rel16/rel32
761      case 0x83: // JAE/JNB/JNC rel16/rel32
762      case 0x85: // JNE/JNZ rel16/rel32
763      case 0x8c: // JL/JNGE rel16/rel32
764      case 0x81: // JNO rel16/rel32
765      case 0x8b: // JNP/JPO rel16/rel32
766      case 0x89: // JNS rel16/rel32
767      case 0x80: // JO rel16/rel32
768      case 0x8a: // JP rel16/rel32
769      case 0x88: // JS rel16/rel32
770        opcode_size = 2;
771        break;
772      default:
773        break;
774    }
775  }
776
777  if (opcode_size == 0)
778    return false;
779
780  offset = 0;
781  if (instruction_length - opcode_size == 1) {
782    int8_t rel8 = (int8_t) *(m_cur_insn + opcode_size);
783    offset = rel8;
784  } else if (instruction_length - opcode_size == 2) {
785    int16_t rel16 = extract_2_signed (m_cur_insn + opcode_size);
786    offset = rel16;
787  } else if (instruction_length - opcode_size == 4) {
788    int32_t rel32 = extract_4_signed (m_cur_insn + opcode_size);
789    offset = rel32;
790  } else {
791    return false;
792  }
793  return true;
794}
795
796// Returns true if this instruction is a intra-function branch or jump -
797// a branch/jump within the bounds of this same function.
798// Cannot predict where a jump through a register value ("jmpq *%rax")
799// will go, so it will return false on that instruction.
800bool x86AssemblyInspectionEngine::local_branch_p (
801    const addr_t current_func_text_offset,
802    const AddressRange &func_range,
803    const int instruction_length,
804    addr_t &target_insn_offset) {
805  int offset;
806  if (pc_rel_branch_or_jump_p (instruction_length, offset) && offset != 0) {
807    addr_t next_pc_value = current_func_text_offset + instruction_length;
808    if (offset < 0 && addr_t(-offset) > current_func_text_offset) {
809      // Branch target is before the start of this function
810      return false;
811    }
812    if (offset + next_pc_value > func_range.GetByteSize()) {
813      // Branch targets outside this function's bounds
814      return false;
815    }
816    // This instruction branches to target_insn_offset (byte offset into the function)
817    target_insn_offset = next_pc_value + offset;
818    return true;
819  }
820  return false;
821}
822
823// Returns true if this instruction is a inter-function branch or jump - a
824// branch/jump to another function.
825// Cannot predict where a jump through a register value ("jmpq *%rax")
826// will go, so it will return false on that instruction.
827bool x86AssemblyInspectionEngine::non_local_branch_p (
828    const addr_t current_func_text_offset,
829    const AddressRange &func_range,
830    const int instruction_length) {
831  int offset;
832  addr_t target_insn_offset;
833  if (pc_rel_branch_or_jump_p (instruction_length, offset)) {
834    return !local_branch_p(current_func_text_offset,func_range,instruction_length,target_insn_offset);
835  }
836  return false;
837}
838
839// ret [0xc3] or [0xcb] or [0xc2 imm16] or [0xca imm16]
840bool x86AssemblyInspectionEngine::ret_pattern_p() {
841  uint8_t *p = m_cur_insn;
842  return *p == 0xc3 || *p == 0xc2 || *p == 0xca || *p == 0xcb;
843}
844
845uint16_t x86AssemblyInspectionEngine::extract_2(uint8_t *b) {
846  uint16_t v = 0;
847  for (int i = 1; i >= 0; i--)
848    v = (v << 8) | b[i];
849  return v;
850}
851
852int16_t x86AssemblyInspectionEngine::extract_2_signed(uint8_t *b) {
853  int16_t v = 0;
854  for (int i = 1; i >= 0; i--)
855    v = (v << 8) | b[i];
856  return v;
857}
858
859uint32_t x86AssemblyInspectionEngine::extract_4(uint8_t *b) {
860  uint32_t v = 0;
861  for (int i = 3; i >= 0; i--)
862    v = (v << 8) | b[i];
863  return v;
864}
865
866int32_t x86AssemblyInspectionEngine::extract_4_signed(uint8_t *b) {
867  int32_t v = 0;
868  for (int i = 3; i >= 0; i--)
869    v = (v << 8) | b[i];
870  return v;
871}
872
873
874bool x86AssemblyInspectionEngine::instruction_length(uint8_t *insn_p,
875                                                     int &length,
876                                                     uint32_t buffer_remaining_bytes) {
877
878  uint32_t max_op_byte_size = std::min(buffer_remaining_bytes, m_arch.GetMaximumOpcodeByteSize());
879  llvm::SmallVector<uint8_t, 32> opcode_data;
880  opcode_data.resize(max_op_byte_size);
881
882  char out_string[512];
883  const size_t inst_size =
884      ::LLVMDisasmInstruction(m_disasm_context, insn_p, max_op_byte_size, 0,
885                              out_string, sizeof(out_string));
886
887  length = inst_size;
888  return true;
889}
890
891bool x86AssemblyInspectionEngine::machine_regno_to_lldb_regno(
892    int machine_regno, uint32_t &lldb_regno) {
893  MachineRegnumToNameAndLLDBRegnum::iterator it = m_reg_map.find(machine_regno);
894  if (it != m_reg_map.end()) {
895    lldb_regno = it->second.lldb_regnum;
896    return true;
897  }
898  return false;
899}
900
901bool x86AssemblyInspectionEngine::GetNonCallSiteUnwindPlanFromAssembly(
902    uint8_t *data, size_t size, AddressRange &func_range,
903    UnwindPlan &unwind_plan) {
904  unwind_plan.Clear();
905
906  if (data == nullptr || size == 0)
907    return false;
908
909  if (!m_register_map_initialized)
910    return false;
911
912  addr_t current_func_text_offset = 0;
913  int current_sp_bytes_offset_from_fa = 0;
914  bool is_aligned = false;
915  UnwindPlan::Row::RegisterLocation initial_regloc;
916  UnwindPlan::RowSP row(new UnwindPlan::Row);
917
918  unwind_plan.SetPlanValidAddressRange(func_range);
919  unwind_plan.SetRegisterKind(eRegisterKindLLDB);
920
921  // At the start of the function, find the CFA by adding wordsize to the SP
922  // register
923  row->SetOffset(current_func_text_offset);
924  row->GetCFAValue().SetIsRegisterPlusOffset(m_lldb_sp_regnum, m_wordsize);
925
926  // caller's stack pointer value before the call insn is the CFA address
927  initial_regloc.SetIsCFAPlusOffset(0);
928  row->SetRegisterInfo(m_lldb_sp_regnum, initial_regloc);
929
930  // saved instruction pointer can be found at CFA - wordsize.
931  current_sp_bytes_offset_from_fa = m_wordsize;
932  initial_regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa);
933  row->SetRegisterInfo(m_lldb_ip_regnum, initial_regloc);
934
935  unwind_plan.AppendRow(row);
936
937  // Allocate a new Row, populate it with the existing Row contents.
938  UnwindPlan::Row *newrow = new UnwindPlan::Row;
939  *newrow = *row.get();
940  row.reset(newrow);
941
942  // Track which registers have been saved so far in the prologue. If we see
943  // another push of that register, it's not part of the prologue. The register
944  // numbers used here are the machine register #'s (i386_register_numbers,
945  // x86_64_register_numbers).
946  std::vector<bool> saved_registers(32, false);
947
948  // Once the prologue has completed we'll save a copy of the unwind
949  // instructions If there is an epilogue in the middle of the function, after
950  // that epilogue we'll reinstate the unwind setup -- we assume that some code
951  // path jumps over the mid-function epilogue
952
953  UnwindPlan::RowSP prologue_completed_row; // copy of prologue row of CFI
954  int prologue_completed_sp_bytes_offset_from_cfa = 0; // The sp value before the
955                                                   // epilogue started executed
956  bool prologue_completed_is_aligned = false;
957  std::vector<bool> prologue_completed_saved_registers;
958
959  while (current_func_text_offset < size) {
960    int stack_offset, insn_len;
961    int machine_regno;   // register numbers masked directly out of instructions
962    uint32_t lldb_regno; // register numbers in lldb's eRegisterKindLLDB
963                         // numbering scheme
964
965    bool in_epilogue = false; // we're in the middle of an epilogue sequence
966    bool row_updated = false; // The UnwindPlan::Row 'row' has been updated
967
968    m_cur_insn = data + current_func_text_offset;
969    if (!instruction_length(m_cur_insn, insn_len, size - current_func_text_offset)
970        || insn_len == 0
971        || insn_len > kMaxInstructionByteSize) {
972      // An unrecognized/junk instruction
973      break;
974    }
975
976    auto &cfa_value = row->GetCFAValue();
977    auto &afa_value = row->GetAFAValue();
978    auto fa_value_ptr = is_aligned ? &afa_value : &cfa_value;
979
980    if (mov_rsp_rbp_pattern_p()) {
981      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
982        fa_value_ptr->SetIsRegisterPlusOffset(
983            m_lldb_fp_regnum, fa_value_ptr->GetOffset());
984        row_updated = true;
985      }
986    }
987
988    else if (mov_rsp_rbx_pattern_p()) {
989      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
990        fa_value_ptr->SetIsRegisterPlusOffset(
991            m_lldb_alt_fp_regnum, fa_value_ptr->GetOffset());
992        row_updated = true;
993      }
994    }
995
996    else if (and_rsp_pattern_p()) {
997      current_sp_bytes_offset_from_fa = 0;
998      afa_value.SetIsRegisterPlusOffset(
999          m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1000      fa_value_ptr = &afa_value;
1001      is_aligned = true;
1002      row_updated = true;
1003    }
1004
1005    else if (mov_rbp_rsp_pattern_p()) {
1006      if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum)
1007      {
1008        is_aligned = false;
1009        fa_value_ptr = &cfa_value;
1010        afa_value.SetUnspecified();
1011        row_updated = true;
1012      }
1013      if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum)
1014        current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1015    }
1016
1017    else if (mov_rbx_rsp_pattern_p()) {
1018      if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum)
1019      {
1020        is_aligned = false;
1021        fa_value_ptr = &cfa_value;
1022        afa_value.SetUnspecified();
1023        row_updated = true;
1024      }
1025      if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum)
1026        current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1027    }
1028
1029    // This is the start() function (or a pthread equivalent), it starts with a
1030    // pushl $0x0 which puts the saved pc value of 0 on the stack.  In this
1031    // case we want to pretend we didn't see a stack movement at all --
1032    // normally the saved pc value is already on the stack by the time the
1033    // function starts executing.
1034    else if (push_0_pattern_p()) {
1035    }
1036
1037    else if (push_reg_p(machine_regno)) {
1038      current_sp_bytes_offset_from_fa += m_wordsize;
1039      // the PUSH instruction has moved the stack pointer - if the FA is set
1040      // in terms of the stack pointer, we need to add a new row of
1041      // instructions.
1042      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1043        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1044        row_updated = true;
1045      }
1046      // record where non-volatile (callee-saved, spilled) registers are saved
1047      // on the stack
1048      if (nonvolatile_reg_p(machine_regno) &&
1049          machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1050          !saved_registers[machine_regno]) {
1051        UnwindPlan::Row::RegisterLocation regloc;
1052        if (is_aligned)
1053            regloc.SetAtAFAPlusOffset(-current_sp_bytes_offset_from_fa);
1054        else
1055            regloc.SetAtCFAPlusOffset(-current_sp_bytes_offset_from_fa);
1056        row->SetRegisterInfo(lldb_regno, regloc);
1057        saved_registers[machine_regno] = true;
1058        row_updated = true;
1059      }
1060    }
1061
1062    else if (pop_reg_p(machine_regno)) {
1063      current_sp_bytes_offset_from_fa -= m_wordsize;
1064
1065      if (nonvolatile_reg_p(machine_regno) &&
1066          machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1067          saved_registers[machine_regno]) {
1068        saved_registers[machine_regno] = false;
1069        row->RemoveRegisterInfo(lldb_regno);
1070
1071        if (lldb_regno == fa_value_ptr->GetRegisterNumber()) {
1072          fa_value_ptr->SetIsRegisterPlusOffset(
1073              m_lldb_sp_regnum, fa_value_ptr->GetOffset());
1074        }
1075
1076        in_epilogue = true;
1077        row_updated = true;
1078      }
1079
1080      // the POP instruction has moved the stack pointer - if the FA is set in
1081      // terms of the stack pointer, we need to add a new row of instructions.
1082      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1083        fa_value_ptr->SetIsRegisterPlusOffset(
1084            m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1085        row_updated = true;
1086      }
1087    }
1088
1089    else if (pop_misc_reg_p()) {
1090      current_sp_bytes_offset_from_fa -= m_wordsize;
1091      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1092        fa_value_ptr->SetIsRegisterPlusOffset(
1093            m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1094        row_updated = true;
1095      }
1096    }
1097
1098    // The LEAVE instruction moves the value from rbp into rsp and pops a value
1099    // off the stack into rbp (restoring the caller's rbp value). It is the
1100    // opposite of ENTER, or 'push rbp, mov rsp rbp'.
1101    else if (leave_pattern_p()) {
1102      if (saved_registers[m_machine_fp_regnum]) {
1103        saved_registers[m_machine_fp_regnum] = false;
1104        row->RemoveRegisterInfo(m_lldb_fp_regnum);
1105
1106        row_updated = true;
1107      }
1108
1109      if (is_aligned && cfa_value.GetRegisterNumber() == m_lldb_fp_regnum)
1110      {
1111        is_aligned = false;
1112        fa_value_ptr = &cfa_value;
1113        afa_value.SetUnspecified();
1114        row_updated = true;
1115      }
1116
1117      if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum)
1118      {
1119        fa_value_ptr->SetIsRegisterPlusOffset(
1120            m_lldb_sp_regnum, fa_value_ptr->GetOffset());
1121
1122        current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset();
1123      }
1124
1125      current_sp_bytes_offset_from_fa -= m_wordsize;
1126
1127      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1128        fa_value_ptr->SetIsRegisterPlusOffset(
1129            m_lldb_sp_regnum, current_sp_bytes_offset_from_fa);
1130        row_updated = true;
1131      }
1132
1133      in_epilogue = true;
1134    }
1135
1136    else if (mov_reg_to_local_stack_frame_p(machine_regno, stack_offset) &&
1137             nonvolatile_reg_p(machine_regno) &&
1138             machine_regno_to_lldb_regno(machine_regno, lldb_regno) &&
1139             !saved_registers[machine_regno]) {
1140      saved_registers[machine_regno] = true;
1141
1142      UnwindPlan::Row::RegisterLocation regloc;
1143
1144      // stack_offset for 'movq %r15, -80(%rbp)' will be 80. In the Row, we
1145      // want to express this as the offset from the FA.  If the frame base is
1146      // rbp (like the above instruction), the FA offset for rbp is probably
1147      // 16.  So we want to say that the value is stored at the FA address -
1148      // 96.
1149      if (is_aligned)
1150          regloc.SetAtAFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset()));
1151      else
1152          regloc.SetAtCFAPlusOffset(-(stack_offset + fa_value_ptr->GetOffset()));
1153
1154      row->SetRegisterInfo(lldb_regno, regloc);
1155
1156      row_updated = true;
1157    }
1158
1159    else if (sub_rsp_pattern_p(stack_offset)) {
1160      current_sp_bytes_offset_from_fa += stack_offset;
1161      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1162        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1163        row_updated = true;
1164      }
1165    }
1166
1167    else if (add_rsp_pattern_p(stack_offset)) {
1168      current_sp_bytes_offset_from_fa -= stack_offset;
1169      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1170        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1171        row_updated = true;
1172      }
1173      in_epilogue = true;
1174    }
1175
1176    else if (push_extended_pattern_p() || push_imm_pattern_p() ||
1177             push_misc_reg_p()) {
1178      current_sp_bytes_offset_from_fa += m_wordsize;
1179      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1180        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1181        row_updated = true;
1182      }
1183    }
1184
1185    else if (lea_rsp_pattern_p(stack_offset)) {
1186      current_sp_bytes_offset_from_fa -= stack_offset;
1187      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1188        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1189        row_updated = true;
1190      }
1191      if (stack_offset > 0)
1192        in_epilogue = true;
1193    }
1194
1195    else if (lea_rbp_rsp_pattern_p(stack_offset)) {
1196      if (is_aligned &&
1197          cfa_value.GetRegisterNumber() == m_lldb_fp_regnum) {
1198        is_aligned = false;
1199        fa_value_ptr = &cfa_value;
1200        afa_value.SetUnspecified();
1201        row_updated = true;
1202      }
1203      if (fa_value_ptr->GetRegisterNumber() == m_lldb_fp_regnum) {
1204        current_sp_bytes_offset_from_fa =
1205          fa_value_ptr->GetOffset() - stack_offset;
1206      }
1207    }
1208
1209    else if (lea_rbx_rsp_pattern_p(stack_offset)) {
1210      if (is_aligned &&
1211          cfa_value.GetRegisterNumber() == m_lldb_alt_fp_regnum) {
1212        is_aligned = false;
1213        fa_value_ptr = &cfa_value;
1214        afa_value.SetUnspecified();
1215        row_updated = true;
1216      }
1217      if (fa_value_ptr->GetRegisterNumber() == m_lldb_alt_fp_regnum) {
1218        current_sp_bytes_offset_from_fa = fa_value_ptr->GetOffset() - stack_offset;
1219      }
1220    }
1221
1222    else if (prologue_completed_row.get() &&
1223             (ret_pattern_p() ||
1224              non_local_branch_p (current_func_text_offset, func_range, insn_len) ||
1225              jmp_to_reg_p())) {
1226      // Check if the current instruction is the end of an epilogue sequence,
1227      // and if so, re-instate the prologue-completed unwind state.
1228
1229      // The current instruction is a branch/jump outside this function,
1230      // a ret, or a jump through a register value which we cannot
1231      // determine the effcts of.  Verify that the stack frame state
1232      // has been unwound to the same as it was at function entry to avoid
1233      // mis-identifying a JMP instruction as an epilogue.
1234      UnwindPlan::Row::RegisterLocation sp, pc;
1235      if (row->GetRegisterInfo(m_lldb_sp_regnum, sp) &&
1236          row->GetRegisterInfo(m_lldb_ip_regnum, pc)) {
1237        // Any ret instruction variant is definitely indicative of an
1238        // epilogue; for other insn patterns verify that we're back to
1239        // the original unwind state.
1240        if (ret_pattern_p() ||
1241            (sp.IsCFAPlusOffset() && sp.GetOffset() == 0 &&
1242            pc.IsAtCFAPlusOffset() && pc.GetOffset() == -m_wordsize)) {
1243          // Reinstate the saved prologue setup for any instructions that come
1244          // after the epilogue
1245
1246          UnwindPlan::Row *newrow = new UnwindPlan::Row;
1247          *newrow = *prologue_completed_row.get();
1248          row.reset(newrow);
1249          current_sp_bytes_offset_from_fa =
1250              prologue_completed_sp_bytes_offset_from_cfa;
1251          is_aligned = prologue_completed_is_aligned;
1252
1253          saved_registers.clear();
1254          saved_registers.resize(prologue_completed_saved_registers.size(), false);
1255          for (size_t i = 0; i < prologue_completed_saved_registers.size(); ++i) {
1256            saved_registers[i] = prologue_completed_saved_registers[i];
1257          }
1258
1259          in_epilogue = true;
1260          row_updated = true;
1261        }
1262      }
1263    }
1264
1265    // call next instruction
1266    //     call 0
1267    //  => pop  %ebx
1268    // This is used in i386 programs to get the PIC base address for finding
1269    // global data
1270    else if (call_next_insn_pattern_p()) {
1271      current_sp_bytes_offset_from_fa += m_wordsize;
1272      if (fa_value_ptr->GetRegisterNumber() == m_lldb_sp_regnum) {
1273        fa_value_ptr->SetOffset(current_sp_bytes_offset_from_fa);
1274        row_updated = true;
1275      }
1276    }
1277
1278    if (row_updated) {
1279      if (current_func_text_offset + insn_len < size) {
1280        row->SetOffset(current_func_text_offset + insn_len);
1281        unwind_plan.AppendRow(row);
1282        // Allocate a new Row, populate it with the existing Row contents.
1283        newrow = new UnwindPlan::Row;
1284        *newrow = *row.get();
1285        row.reset(newrow);
1286      }
1287    }
1288
1289    if (!in_epilogue && row_updated) {
1290      // If we're not in an epilogue sequence, save the updated Row
1291      UnwindPlan::Row *newrow = new UnwindPlan::Row;
1292      *newrow = *row.get();
1293      prologue_completed_row.reset(newrow);
1294
1295      prologue_completed_saved_registers.clear();
1296      prologue_completed_saved_registers.resize(saved_registers.size(), false);
1297      for (size_t i = 0; i < saved_registers.size(); ++i) {
1298        prologue_completed_saved_registers[i] = saved_registers[i];
1299      }
1300    }
1301
1302    // We may change the sp value without adding a new Row necessarily -- keep
1303    // track of it either way.
1304    if (!in_epilogue) {
1305      prologue_completed_sp_bytes_offset_from_cfa =
1306          current_sp_bytes_offset_from_fa;
1307      prologue_completed_is_aligned = is_aligned;
1308    }
1309
1310    m_cur_insn = m_cur_insn + insn_len;
1311    current_func_text_offset += insn_len;
1312  }
1313
1314  unwind_plan.SetSourceName("assembly insn profiling");
1315  unwind_plan.SetSourcedFromCompiler(eLazyBoolNo);
1316  unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes);
1317  unwind_plan.SetUnwindPlanForSignalTrap(eLazyBoolNo);
1318
1319  return true;
1320}
1321
1322bool x86AssemblyInspectionEngine::AugmentUnwindPlanFromCallSite(
1323    uint8_t *data, size_t size, AddressRange &func_range,
1324    UnwindPlan &unwind_plan, RegisterContextSP &reg_ctx) {
1325  Address addr_start = func_range.GetBaseAddress();
1326  if (!addr_start.IsValid())
1327    return false;
1328
1329  // We either need a live RegisterContext, or we need the UnwindPlan to
1330  // already be in the lldb register numbering scheme.
1331  if (reg_ctx.get() == nullptr &&
1332      unwind_plan.GetRegisterKind() != eRegisterKindLLDB)
1333    return false;
1334
1335  // Is original unwind_plan valid?
1336  // unwind_plan should have at least one row which is ABI-default (CFA
1337  // register is sp), and another row in mid-function.
1338  if (unwind_plan.GetRowCount() < 2)
1339    return false;
1340
1341  UnwindPlan::RowSP first_row = unwind_plan.GetRowAtIndex(0);
1342  if (first_row->GetOffset() != 0)
1343    return false;
1344  uint32_t cfa_reg = first_row->GetCFAValue().GetRegisterNumber();
1345  if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) {
1346    cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber(
1347        unwind_plan.GetRegisterKind(),
1348        first_row->GetCFAValue().GetRegisterNumber());
1349  }
1350  if (cfa_reg != m_lldb_sp_regnum ||
1351      first_row->GetCFAValue().GetOffset() != m_wordsize)
1352    return false;
1353
1354  UnwindPlan::RowSP original_last_row = unwind_plan.GetRowForFunctionOffset(-1);
1355
1356  size_t offset = 0;
1357  int row_id = 1;
1358  bool unwind_plan_updated = false;
1359  UnwindPlan::RowSP row(new UnwindPlan::Row(*first_row));
1360
1361  // After a mid-function epilogue we will need to re-insert the original
1362  // unwind rules so unwinds work for the remainder of the function.  These
1363  // aren't common with clang/gcc on x86 but it is possible.
1364  bool reinstate_unwind_state = false;
1365
1366  while (offset < size) {
1367    m_cur_insn = data + offset;
1368    int insn_len;
1369    if (!instruction_length(m_cur_insn, insn_len, size - offset) ||
1370        insn_len == 0 || insn_len > kMaxInstructionByteSize) {
1371      // An unrecognized/junk instruction.
1372      break;
1373    }
1374
1375    // Advance offsets.
1376    offset += insn_len;
1377
1378    // offset is pointing beyond the bounds of the function; stop looping.
1379    if (offset >= size)
1380      continue;
1381
1382    if (reinstate_unwind_state) {
1383      UnwindPlan::RowSP new_row(new UnwindPlan::Row());
1384      *new_row = *original_last_row;
1385      new_row->SetOffset(offset);
1386      unwind_plan.AppendRow(new_row);
1387      row = std::make_shared<UnwindPlan::Row>();
1388      *row = *new_row;
1389      reinstate_unwind_state = false;
1390      unwind_plan_updated = true;
1391      continue;
1392    }
1393
1394    // If we already have one row for this instruction, we can continue.
1395    while (row_id < unwind_plan.GetRowCount() &&
1396           unwind_plan.GetRowAtIndex(row_id)->GetOffset() <= offset) {
1397      row_id++;
1398    }
1399    UnwindPlan::RowSP original_row = unwind_plan.GetRowAtIndex(row_id - 1);
1400    if (original_row->GetOffset() == offset) {
1401      *row = *original_row;
1402      continue;
1403    }
1404
1405    if (row_id == 0) {
1406      // If we are here, compiler didn't generate CFI for prologue. This won't
1407      // happen to GCC or clang. In this case, bail out directly.
1408      return false;
1409    }
1410
1411    // Inspect the instruction to check if we need a new row for it.
1412    cfa_reg = row->GetCFAValue().GetRegisterNumber();
1413    if (unwind_plan.GetRegisterKind() != eRegisterKindLLDB) {
1414      cfa_reg = reg_ctx->ConvertRegisterKindToRegisterNumber(
1415          unwind_plan.GetRegisterKind(),
1416          row->GetCFAValue().GetRegisterNumber());
1417    }
1418    if (cfa_reg == m_lldb_sp_regnum) {
1419      // CFA register is sp.
1420
1421      // call next instruction
1422      //     call 0
1423      //  => pop  %ebx
1424      if (call_next_insn_pattern_p()) {
1425        row->SetOffset(offset);
1426        row->GetCFAValue().IncOffset(m_wordsize);
1427
1428        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1429        unwind_plan.InsertRow(new_row);
1430        unwind_plan_updated = true;
1431        continue;
1432      }
1433
1434      // push/pop register
1435      int regno;
1436      if (push_reg_p(regno)) {
1437        row->SetOffset(offset);
1438        row->GetCFAValue().IncOffset(m_wordsize);
1439
1440        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1441        unwind_plan.InsertRow(new_row);
1442        unwind_plan_updated = true;
1443        continue;
1444      }
1445      if (pop_reg_p(regno)) {
1446        // Technically, this might be a nonvolatile register recover in
1447        // epilogue. We should reset RegisterInfo for the register. But in
1448        // practice, previous rule for the register is still valid... So we
1449        // ignore this case.
1450
1451        row->SetOffset(offset);
1452        row->GetCFAValue().IncOffset(-m_wordsize);
1453
1454        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1455        unwind_plan.InsertRow(new_row);
1456        unwind_plan_updated = true;
1457        continue;
1458      }
1459
1460      if (pop_misc_reg_p()) {
1461        row->SetOffset(offset);
1462        row->GetCFAValue().IncOffset(-m_wordsize);
1463
1464        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1465        unwind_plan.InsertRow(new_row);
1466        unwind_plan_updated = true;
1467        continue;
1468      }
1469
1470      // push imm
1471      if (push_imm_pattern_p()) {
1472        row->SetOffset(offset);
1473        row->GetCFAValue().IncOffset(m_wordsize);
1474        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1475        unwind_plan.InsertRow(new_row);
1476        unwind_plan_updated = true;
1477        continue;
1478      }
1479
1480      // push extended
1481      if (push_extended_pattern_p() || push_misc_reg_p()) {
1482        row->SetOffset(offset);
1483        row->GetCFAValue().IncOffset(m_wordsize);
1484        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1485        unwind_plan.InsertRow(new_row);
1486        unwind_plan_updated = true;
1487        continue;
1488      }
1489
1490      // add/sub %rsp/%esp
1491      int amount;
1492      if (add_rsp_pattern_p(amount)) {
1493        row->SetOffset(offset);
1494        row->GetCFAValue().IncOffset(-amount);
1495
1496        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1497        unwind_plan.InsertRow(new_row);
1498        unwind_plan_updated = true;
1499        continue;
1500      }
1501      if (sub_rsp_pattern_p(amount)) {
1502        row->SetOffset(offset);
1503        row->GetCFAValue().IncOffset(amount);
1504
1505        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1506        unwind_plan.InsertRow(new_row);
1507        unwind_plan_updated = true;
1508        continue;
1509      }
1510
1511      // lea %rsp, [%rsp + $offset]
1512      if (lea_rsp_pattern_p(amount)) {
1513        row->SetOffset(offset);
1514        row->GetCFAValue().IncOffset(-amount);
1515
1516        UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1517        unwind_plan.InsertRow(new_row);
1518        unwind_plan_updated = true;
1519        continue;
1520      }
1521
1522      if (ret_pattern_p()) {
1523        reinstate_unwind_state = true;
1524        continue;
1525      }
1526    } else if (cfa_reg == m_lldb_fp_regnum) {
1527      // CFA register is fp.
1528
1529      // The only case we care about is epilogue:
1530      //     [0x5d] pop %rbp/%ebp
1531      //  => [0xc3] ret
1532      if (pop_rbp_pattern_p() || leave_pattern_p()) {
1533        m_cur_insn++;
1534        if (ret_pattern_p()) {
1535          row->SetOffset(offset);
1536          row->GetCFAValue().SetIsRegisterPlusOffset(
1537              first_row->GetCFAValue().GetRegisterNumber(), m_wordsize);
1538
1539          UnwindPlan::RowSP new_row(new UnwindPlan::Row(*row));
1540          unwind_plan.InsertRow(new_row);
1541          unwind_plan_updated = true;
1542          reinstate_unwind_state = true;
1543          continue;
1544        }
1545      }
1546    } else {
1547      // CFA register is not sp or fp.
1548
1549      // This must be hand-written assembly.
1550      // Just trust eh_frame and assume we have finished.
1551      break;
1552    }
1553  }
1554
1555  unwind_plan.SetPlanValidAddressRange(func_range);
1556  if (unwind_plan_updated) {
1557    std::string unwind_plan_source(unwind_plan.GetSourceName().AsCString());
1558    unwind_plan_source += " plus augmentation from assembly parsing";
1559    unwind_plan.SetSourceName(unwind_plan_source.c_str());
1560    unwind_plan.SetSourcedFromCompiler(eLazyBoolNo);
1561    unwind_plan.SetUnwindPlanValidAtAllInstructions(eLazyBoolYes);
1562  }
1563  return true;
1564}
1565
1566bool x86AssemblyInspectionEngine::FindFirstNonPrologueInstruction(
1567    uint8_t *data, size_t size, size_t &offset) {
1568  offset = 0;
1569
1570  if (!m_register_map_initialized)
1571    return false;
1572
1573  while (offset < size) {
1574    int regno;
1575    int insn_len;
1576    int scratch;
1577
1578    m_cur_insn = data + offset;
1579    if (!instruction_length(m_cur_insn, insn_len, size - offset)
1580        || insn_len > kMaxInstructionByteSize
1581        || insn_len == 0) {
1582      // An error parsing the instruction, i.e. probably data/garbage - stop
1583      // scanning
1584      break;
1585    }
1586
1587    if (push_rbp_pattern_p() || mov_rsp_rbp_pattern_p() ||
1588        sub_rsp_pattern_p(scratch) || push_reg_p(regno) ||
1589        mov_reg_to_local_stack_frame_p(regno, scratch) ||
1590        (lea_rsp_pattern_p(scratch) && offset == 0)) {
1591      offset += insn_len;
1592      continue;
1593    }
1594    //
1595    // Unknown non-prologue instruction - stop scanning
1596    break;
1597  }
1598
1599  return true;
1600}
1601