1 // Copyright (c) 2010, Google Inc.
2 // All rights reserved.
4 // Redistribution and use in source and binary forms, with or without
5 // modification, are permitted provided that the following conditions are
8 // * Redistributions of source code must retain the above copyright
9 // notice, this list of conditions and the following disclaimer.
10 // * Redistributions in binary form must reproduce the above
11 // copyright notice, this list of conditions and the following disclaimer
12 // in the documentation and/or other materials provided with the
14 // * Neither the name of Google Inc. nor the names of its
15 // contributors may be used to endorse or promote products derived from
16 // this software without specific prior written permission.
18 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 // linux_dumper.cc: Implement google_breakpad::LinuxDumper.
31 // See linux_dumper.h for details.
33 // This code deals with the mechanics of getting information about a crashed
34 // process. Since this code may run in a compromised address space, the same
35 // rules apply as detailed at the top of minidump_writer.h: no libc calls and
36 // use the alternative allocator.
38 #include "linux/minidump_writer/linux_dumper.h"
47 #include "linux/minidump_writer/line_reader.h"
48 #include "common/linux/elfutils.h"
49 #include "common/linux/file_id.h"
50 #include "common/linux/linux_libc_support.h"
51 #include "common/linux/memory_mapped_file.h"
52 #include "common/linux/safe_readlink.h"
53 #include "google_breakpad/common/minidump_exception_linux.h"
54 #include "third_party/lss/linux_syscall_support.h"
56 #if defined(__ANDROID__)
58 // Android packed relocations definitions are not yet available from the
59 // NDK header files, so we have to provide them manually here.
61 #define DT_LOOS 0x6000000d
63 #ifndef DT_ANDROID_REL
64 static const int DT_ANDROID_REL
= DT_LOOS
+ 2;
66 #ifndef DT_ANDROID_RELA
67 static const int DT_ANDROID_RELA
= DT_LOOS
+ 4;
70 #endif // __ANDROID __
72 static const char kMappedFileUnsafePrefix
[] = "/dev/";
73 static const char kDeletedSuffix
[] = " (deleted)";
74 static const char kReservedFlags
[] = " ---p";
75 static const char kMozillaIpcPrefix
[] = "org.mozilla.ipc.";
77 inline static bool IsMappedFileOpenUnsafe(
78 const google_breakpad::MappingInfo
& mapping
) {
79 // It is unsafe to attempt to open a mapped file that lives under /dev,
80 // because the semantics of the open may be driver-specific so we'd risk
81 // hanging the crash dumper. And a file in /dev/ almost certainly has no
82 // ELF file identifier anyways.
83 return my_strncmp(mapping
.name
,
84 kMappedFileUnsafePrefix
,
85 sizeof(kMappedFileUnsafePrefix
) - 1) == 0;
88 namespace google_breakpad
{
92 bool MappingContainsAddress(const MappingInfo
& mapping
, uintptr_t address
) {
93 return mapping
.system_mapping_info
.start_addr
<= address
&&
94 address
< mapping
.system_mapping_info
.end_addr
;
97 #if defined(__CHROMEOS__)
99 // Recover memory mappings before writing dump on ChromeOS
101 // On Linux, breakpad relies on /proc/[pid]/maps to associate symbols from
102 // addresses. ChromeOS' hugepage implementation replaces some segments with
103 // anonymous private pages, which is a restriction of current implementation
104 // in Linux kernel at the time of writing. Thus, breakpad can no longer
105 // symbolize addresses from those text segments replaced with hugepages.
107 // This postprocess tries to recover the mappings. Because hugepages are always
108 // inserted in between some .text sections, it tries to infer the names and
109 // offsets of the segments, by looking at segments immediately precede and
112 // For example, a text segment before hugepage optimization
113 // 02001000-03002000 r-xp /opt/google/chrome/chrome
115 // can be broken into
116 // 02001000-02200000 r-xp /opt/google/chrome/chrome
117 // 02200000-03000000 r-xp
118 // 03000000-03002000 r-xp /opt/google/chrome/chrome
120 // For more details, see:
121 // crbug.com/628040 ChromeOS' use of hugepages confuses crash symbolization
123 // Copied from CrOS' hugepage implementation, which is unlikely to change.
124 // The hugepage size is 2M.
125 const unsigned int kHpageShift
= 21;
126 const size_t kHpageSize
= (1 << kHpageShift
);
127 const size_t kHpageMask
= (~(kHpageSize
- 1));
129 // Find and merge anonymous r-xp segments with surrounding named segments.
130 // There are two cases:
132 // Case 1: curr, next
136 // curr.size is a multiple of 2M.
137 // next is backed by some file.
138 // curr and next are contiguous.
139 // offset(next) == sizeof(curr)
140 void TryRecoverMappings(MappingInfo
*curr
, MappingInfo
*next
) {
141 // Merged segments are marked with size = 0.
142 if (curr
->size
== 0 || next
->size
== 0)
145 if (curr
->size
>= kHpageSize
&&
147 (curr
->size
& kHpageMask
) == curr
->size
&&
148 (curr
->start_addr
& kHpageMask
) == curr
->start_addr
&&
149 curr
->name
[0] == '\0' &&
150 next
->name
[0] != '\0' &&
151 curr
->start_addr
+ curr
->size
== next
->start_addr
&&
152 curr
->size
== next
->offset
) {
155 my_strlcpy(curr
->name
, next
->name
, NAME_MAX
);
158 curr
->size
+= next
->size
;
164 // Case 2: prev, curr, next
168 // curr.size is a multiple of 2M.
169 // next and prev are backed by the same file.
170 // prev, curr and next are contiguous.
171 // offset(next) == offset(prev) + sizeof(prev) + sizeof(curr)
172 void TryRecoverMappings(MappingInfo
*prev
, MappingInfo
*curr
,
174 // Merged segments are marked with size = 0.
175 if (prev
->size
== 0 || curr
->size
== 0 || next
->size
== 0)
178 if (curr
->size
>= kHpageSize
&&
180 (curr
->size
& kHpageMask
) == curr
->size
&&
181 (curr
->start_addr
& kHpageMask
) == curr
->start_addr
&&
182 curr
->name
[0] == '\0' &&
183 next
->name
[0] != '\0' &&
184 curr
->start_addr
+ curr
->size
== next
->start_addr
&&
185 prev
->start_addr
+ prev
->size
== curr
->start_addr
&&
186 my_strncmp(prev
->name
, next
->name
, NAME_MAX
) == 0 &&
187 next
->offset
== prev
->offset
+ prev
->size
+ curr
->size
) {
190 my_strlcpy(curr
->name
, prev
->name
, NAME_MAX
);
192 curr
->offset
= prev
->offset
;
193 curr
->start_addr
= prev
->start_addr
;
195 // (prev, curr, next)
196 curr
->size
+= prev
->size
+ next
->size
;
200 // (prev, curr), next
201 curr
->size
+= prev
->size
;
205 curr
->offset
= prev
->offset
+ prev
->size
;
207 // prev, (curr, next)
208 curr
->size
+= next
->size
;
217 // mappings_ is sorted excepted for the first entry.
218 // This function tries to merge segemnts into the first entry,
219 // then check for other sorted entries.
220 // See LinuxDumper::EnumerateMappings().
221 void CrOSPostProcessMappings(wasteful_vector
<MappingInfo
*>& mappings
) {
222 // Find the candidate "next" to first segment, which is the only one that
223 // could be out-of-order.
225 size_t r
= mappings
.size();
226 size_t next
= mappings
.size();
229 if (mappings
[m
]->start_addr
> mappings
[0]->start_addr
)
235 // Shows the range that contains the entry point is
236 // [first_start_addr, first_end_addr)
237 size_t first_start_addr
= mappings
[0]->start_addr
;
238 size_t first_end_addr
= mappings
[0]->start_addr
+ mappings
[0]->size
;
240 // Put the out-of-order segment in order.
241 std::rotate(mappings
.begin(), mappings
.begin() + 1, mappings
.begin() + next
);
243 // Iterate through normal, sorted cases.
245 for (size_t i
= 0; i
< mappings
.size() - 1; i
++)
246 TryRecoverMappings(mappings
[i
], mappings
[i
+ 1]);
249 for (size_t i
= 0; i
< mappings
.size() - 2; i
++)
250 TryRecoverMappings(mappings
[i
], mappings
[i
+ 1], mappings
[i
+ 2]);
252 // Collect merged (size == 0) segments.
254 for (f
= e
= 0; e
< mappings
.size(); e
++)
255 if (mappings
[e
]->size
> 0)
256 mappings
[f
++] = mappings
[e
];
259 // The entry point is in the first mapping. We want to find the location
260 // of the entry point after merging segment. To do this, we want to find
261 // the mapping that covers the first mapping from the original mapping list.
262 // If the mapping is not in the beginning, we move it to the begining via
263 // a right rotate by using reverse iterators.
264 for (l
= 0; l
< mappings
.size(); l
++) {
265 if (mappings
[l
]->start_addr
<= first_start_addr
266 && (mappings
[l
]->start_addr
+ mappings
[l
]->size
>= first_end_addr
))
271 std::rotate(mappings
.rbegin() + r
- l
- 1, mappings
.rbegin() + r
- l
,
276 #endif // __CHROMEOS__
280 // All interesting auvx entry types are below AT_SYSINFO_EHDR
281 #define AT_MAX AT_SYSINFO_EHDR
283 LinuxDumper::LinuxDumper(pid_t pid
, const char* root_prefix
)
285 root_prefix_(root_prefix
),
288 crash_signal_code_(0),
290 threads_(&allocator_
, 8),
291 mappings_(&allocator_
),
292 auxv_(&allocator_
, AT_MAX
+ 1) {
293 assert(root_prefix_
&& my_strlen(root_prefix_
) < PATH_MAX
);
294 // The passed-in size to the constructor (above) is only a hint.
295 // Must call .resize() to do actual initialization of the elements.
296 auxv_
.resize(AT_MAX
+ 1);
299 LinuxDumper::~LinuxDumper() {
302 bool LinuxDumper::Init() {
303 return ReadAuxv() && EnumerateThreads() && EnumerateMappings();
306 bool LinuxDumper::LateInit() {
307 #if defined(__ANDROID__)
308 LatePostprocessMappings();
311 #if defined(__CHROMEOS__)
312 CrOSPostProcessMappings(mappings_
);
319 LinuxDumper::ElfFileIdentifierForMapping(const MappingInfo
& mapping
,
321 unsigned int mapping_id
,
322 wasteful_vector
<uint8_t>& identifier
) {
323 assert(!member
|| mapping_id
< mappings_
.size());
324 if (IsMappedFileOpenUnsafe(mapping
))
327 // Special-case linux-gate because it's not a real file.
328 if (my_strcmp(mapping
.name
, kLinuxGateLibraryName
) == 0) {
329 void* linux_gate
= NULL
;
330 if (pid_
== sys_getpid()) {
331 linux_gate
= reinterpret_cast<void*>(mapping
.start_addr
);
333 linux_gate
= allocator_
.Alloc(mapping
.size
);
334 CopyFromProcess(linux_gate
, pid_
,
335 reinterpret_cast<const void*>(mapping
.start_addr
),
338 return FileID::ElfFileIdentifierFromMappedFile(linux_gate
, identifier
);
341 char filename
[PATH_MAX
];
342 if (!GetMappingAbsolutePath(mapping
, filename
))
344 bool filename_modified
= HandleDeletedFileInMapping(filename
);
346 MemoryMappedFile
mapped_file(filename
, mapping
.offset
);
347 if (!mapped_file
.data() || mapped_file
.size() < SELFMAG
)
351 FileID::ElfFileIdentifierFromMappedFile(mapped_file
.data(), identifier
);
352 if (success
&& member
&& filename_modified
) {
353 mappings_
[mapping_id
]->name
[my_strlen(mapping
.name
) -
354 sizeof(kDeletedSuffix
) + 1] = '\0';
360 void LinuxDumper::SetCrashInfoFromSigInfo(const siginfo_t
& siginfo
) {
361 set_crash_address(reinterpret_cast<uintptr_t>(siginfo
.si_addr
));
362 set_crash_signal(siginfo
.si_signo
);
363 set_crash_signal_code(siginfo
.si_code
);
366 const char* LinuxDumper::GetCrashSignalString() const {
367 switch (static_cast<unsigned int>(crash_signal_
)) {
368 case MD_EXCEPTION_CODE_LIN_SIGHUP
:
370 case MD_EXCEPTION_CODE_LIN_SIGINT
:
372 case MD_EXCEPTION_CODE_LIN_SIGQUIT
:
374 case MD_EXCEPTION_CODE_LIN_SIGILL
:
376 case MD_EXCEPTION_CODE_LIN_SIGTRAP
:
378 case MD_EXCEPTION_CODE_LIN_SIGABRT
:
380 case MD_EXCEPTION_CODE_LIN_SIGBUS
:
382 case MD_EXCEPTION_CODE_LIN_SIGFPE
:
384 case MD_EXCEPTION_CODE_LIN_SIGKILL
:
386 case MD_EXCEPTION_CODE_LIN_SIGUSR1
:
388 case MD_EXCEPTION_CODE_LIN_SIGSEGV
:
390 case MD_EXCEPTION_CODE_LIN_SIGUSR2
:
392 case MD_EXCEPTION_CODE_LIN_SIGPIPE
:
394 case MD_EXCEPTION_CODE_LIN_SIGALRM
:
396 case MD_EXCEPTION_CODE_LIN_SIGTERM
:
398 case MD_EXCEPTION_CODE_LIN_SIGSTKFLT
:
400 case MD_EXCEPTION_CODE_LIN_SIGCHLD
:
402 case MD_EXCEPTION_CODE_LIN_SIGCONT
:
404 case MD_EXCEPTION_CODE_LIN_SIGSTOP
:
406 case MD_EXCEPTION_CODE_LIN_SIGTSTP
:
408 case MD_EXCEPTION_CODE_LIN_SIGTTIN
:
410 case MD_EXCEPTION_CODE_LIN_SIGTTOU
:
412 case MD_EXCEPTION_CODE_LIN_SIGURG
:
414 case MD_EXCEPTION_CODE_LIN_SIGXCPU
:
416 case MD_EXCEPTION_CODE_LIN_SIGXFSZ
:
418 case MD_EXCEPTION_CODE_LIN_SIGVTALRM
:
420 case MD_EXCEPTION_CODE_LIN_SIGPROF
:
422 case MD_EXCEPTION_CODE_LIN_SIGWINCH
:
424 case MD_EXCEPTION_CODE_LIN_SIGIO
:
426 case MD_EXCEPTION_CODE_LIN_SIGPWR
:
428 case MD_EXCEPTION_CODE_LIN_SIGSYS
:
430 case MD_EXCEPTION_CODE_LIN_DUMP_REQUESTED
:
431 return "DUMP_REQUESTED";
437 bool LinuxDumper::GetMappingAbsolutePath(const MappingInfo
& mapping
,
438 char path
[PATH_MAX
]) const {
439 return my_strlcpy(path
, root_prefix_
, PATH_MAX
) < PATH_MAX
&&
440 my_strlcat(path
, mapping
.name
, PATH_MAX
) < PATH_MAX
;
444 // Find the shared object name (SONAME) by examining the ELF information
445 // for |mapping|. If the SONAME is found copy it into the passed buffer
446 // |soname| and return true. The size of the buffer is |soname_size|.
447 // The SONAME will be truncated if it is too long to fit in the buffer.
448 bool ElfFileSoName(const LinuxDumper
& dumper
,
449 const MappingInfo
& mapping
, char* soname
, size_t soname_size
) {
450 if (IsMappedFileOpenUnsafe(mapping
)) {
455 char filename
[PATH_MAX
];
456 if (!dumper
.GetMappingAbsolutePath(mapping
, filename
))
459 MemoryMappedFile
mapped_file(filename
, mapping
.offset
);
460 if (!mapped_file
.data() || mapped_file
.size() < SELFMAG
) {
465 return ElfFileSoNameFromMappedFile(mapped_file
.data(), soname
, soname_size
);
471 void LinuxDumper::GetMappingEffectiveNamePathAndVersion(const MappingInfo
& mapping
,
473 size_t file_path_size
,
475 size_t file_name_size
,
477 my_strlcpy(file_path
, mapping
.name
, file_path_size
);
479 // Tools such as minidump_stackwalk use the name of the module to look up
480 // symbols produced by dump_syms. dump_syms will prefer to use a module's
481 // DT_SONAME as the module name, if one exists, and will fall back to the
482 // filesystem name of the module.
484 // Just use the filesystem name if no SONAME is present.
485 if (!ElfFileSoName(*this, mapping
, file_name
, file_name_size
)) {
486 // file_path := /path/to/libname.so
487 // file_name := libname.so
488 const char* basename
= my_strrchr(file_path
, '/');
489 basename
= basename
== NULL
? file_path
: (basename
+ 1);
490 my_strlcpy(file_name
, basename
, file_name_size
);
492 ElfFileSoVersion(mapping
.name
, version
);
497 if (mapping
.exec
&& mapping
.offset
!= 0) {
498 // If an executable is mapped from a non-zero offset, this is likely because
499 // the executable was loaded directly from inside an archive file (e.g., an
501 // In this case, we append the file_name to the mapped archive path:
502 // file_name := libname.so
503 // file_path := /path/to/ARCHIVE.APK/libname.so
504 if (my_strlen(file_path
) + 1 + my_strlen(file_name
) < file_path_size
) {
505 my_strlcat(file_path
, "/", file_path_size
);
506 my_strlcat(file_path
, file_name
, file_path_size
);
509 // Otherwise, replace the basename with the SONAME.
510 char* basename
= const_cast<char*>(my_strrchr(file_path
, '/'));
512 my_strlcpy(basename
+ 1, file_name
,
513 file_path_size
- my_strlen(file_path
) +
514 my_strlen(basename
+ 1));
516 my_strlcpy(file_path
, file_name
, file_path_size
);
521 ElfFileSoVersion(mapping
.name
, version
);
525 bool LinuxDumper::ReadAuxv() {
526 char auxv_path
[NAME_MAX
];
527 if (!BuildProcPath(auxv_path
, pid_
, "auxv")) {
531 int fd
= sys_open(auxv_path
, O_RDONLY
, 0);
536 elf_aux_entry one_aux_entry
;
540 sizeof(elf_aux_entry
)) == sizeof(elf_aux_entry
) &&
541 one_aux_entry
.a_type
!= AT_NULL
) {
542 if (one_aux_entry
.a_type
<= AT_MAX
) {
543 auxv_
[one_aux_entry
.a_type
] = one_aux_entry
.a_un
.a_val
;
551 bool LinuxDumper::IsIPCSharedMemorySegment(const char* name
) {
552 if (my_strstr(name
, kMozillaIpcPrefix
) &&
553 my_strstr(name
, kDeletedSuffix
)) {
560 bool LinuxDumper::EnumerateMappings() {
561 char maps_path
[NAME_MAX
];
562 if (!BuildProcPath(maps_path
, pid_
, "maps"))
565 // linux_gate_loc is the beginning of the kernel's mapping of
566 // linux-gate.so in the process. It doesn't actually show up in the
567 // maps list as a filename, but it can be found using the AT_SYSINFO_EHDR
568 // aux vector entry, which gives the information necessary to special
569 // case its entry when creating the list of mappings.
570 // See http://www.trilithium.com/johan/2005/08/linux-gate/ for more
572 const void* linux_gate_loc
=
573 reinterpret_cast<void *>(auxv_
[AT_SYSINFO_EHDR
]);
574 // Although the initial executable is usually the first mapping, it's not
575 // guaranteed (see http://crosbug.com/25355); therefore, try to use the
576 // actual entry point to find the mapping.
577 const void* entry_point_loc
= reinterpret_cast<void *>(auxv_
[AT_ENTRY
]);
579 const int fd
= sys_open(maps_path
, O_RDONLY
, 0);
582 LineReader
* const line_reader
= new(allocator_
) LineReader(fd
);
586 while (line_reader
->GetNextLine(&line
, &line_len
)) {
587 uintptr_t start_addr
, end_addr
, offset
;
589 const char* i1
= my_read_hex_ptr(&start_addr
, line
);
591 const char* i2
= my_read_hex_ptr(&end_addr
, i1
+ 1);
593 bool exec
= (*(i2
+ 3) == 'x');
594 const char* i3
= my_read_hex_ptr(&offset
, i2
+ 6 /* skip ' rwxp ' */);
596 const char* name
= NULL
;
597 // Only copy name if the name is a valid path name, or if
598 // it's the VDSO image.
599 if (((name
= my_strchr(line
, '/')) == NULL
) &&
601 reinterpret_cast<void*>(start_addr
) == linux_gate_loc
) {
602 name
= kLinuxGateLibraryName
;
605 // Skip shared memory segments used for IPC
606 if (name
&& IsIPCSharedMemorySegment(name
)) {
607 line_reader
->PopLine(line_len
);
610 // Merge adjacent mappings into one module, assuming they're a single
611 // library mapped by the dynamic linker.
612 if (name
&& !mappings_
.empty()) {
613 MappingInfo
* module
= mappings_
.back();
614 if ((start_addr
== module
->start_addr
+ module
->size
) &&
615 (my_strlen(name
) == my_strlen(module
->name
)) &&
616 (my_strncmp(name
, module
->name
, my_strlen(name
)) == 0)) {
617 module
->system_mapping_info
.end_addr
= end_addr
;
618 module
->size
= end_addr
- module
->start_addr
;
619 module
->exec
|= exec
;
620 line_reader
->PopLine(line_len
);
624 // Also merge mappings that result from address ranges that the
625 // linker reserved but which a loaded library did not use. These
626 // appear as an anonymous private mapping with no access flags set
627 // and which directly follow an executable mapping.
628 if (!name
&& !mappings_
.empty()) {
629 MappingInfo
* module
= mappings_
.back();
630 uintptr_t module_end_addr
= module
->start_addr
+ module
->size
;
631 if ((start_addr
== module_end_addr
) &&
633 module
->name
[0] == '/' &&
634 ((offset
== 0) || (offset
== module_end_addr
)) &&
635 my_strncmp(i2
, kReservedFlags
,
636 sizeof(kReservedFlags
) - 1) == 0) {
637 module
->size
= end_addr
- module
->start_addr
;
638 line_reader
->PopLine(line_len
);
642 MappingInfo
* const module
= new(allocator_
) MappingInfo
;
643 mappings_
.push_back(module
);
644 my_memset(module
, 0, sizeof(MappingInfo
));
645 module
->system_mapping_info
.start_addr
= start_addr
;
646 module
->system_mapping_info
.end_addr
= end_addr
;
647 module
->start_addr
= start_addr
;
648 module
->size
= end_addr
- start_addr
;
649 module
->offset
= offset
;
652 const unsigned l
= my_strlen(name
);
653 if (l
< sizeof(module
->name
))
654 my_memcpy(module
->name
, name
, l
);
659 line_reader
->PopLine(line_len
);
662 if (entry_point_loc
) {
663 for (size_t i
= 0; i
< mappings_
.size(); ++i
) {
664 MappingInfo
* module
= mappings_
[i
];
666 // If this module contains the entry-point, and it's not already the first
667 // one, then we need to make it be first. This is because the minidump
668 // format assumes the first module is the one that corresponds to the main
669 // executable (as codified in
670 // processor/minidump.cc:MinidumpModuleList::GetMainModule()).
671 if ((entry_point_loc
>= reinterpret_cast<void*>(module
->start_addr
)) &&
673 reinterpret_cast<void*>(module
->start_addr
+ module
->size
))) {
674 for (size_t j
= i
; j
> 0; j
--)
675 mappings_
[j
] = mappings_
[j
- 1];
676 mappings_
[0] = module
;
684 return !mappings_
.empty();
687 #if defined(__ANDROID__)
689 bool LinuxDumper::GetLoadedElfHeader(uintptr_t start_addr
, ElfW(Ehdr
)* ehdr
) {
690 CopyFromProcess(ehdr
, pid_
,
691 reinterpret_cast<const void*>(start_addr
),
693 return my_memcmp(&ehdr
->e_ident
, ELFMAG
, SELFMAG
) == 0;
696 void LinuxDumper::ParseLoadedElfProgramHeaders(ElfW(Ehdr
)* ehdr
,
697 uintptr_t start_addr
,
698 uintptr_t* min_vaddr_ptr
,
699 uintptr_t* dyn_vaddr_ptr
,
700 size_t* dyn_count_ptr
) {
701 uintptr_t phdr_addr
= start_addr
+ ehdr
->e_phoff
;
703 const uintptr_t max_addr
= UINTPTR_MAX
;
704 uintptr_t min_vaddr
= max_addr
;
705 uintptr_t dyn_vaddr
= 0;
706 size_t dyn_count
= 0;
708 for (size_t i
= 0; i
< ehdr
->e_phnum
; ++i
) {
710 CopyFromProcess(&phdr
, pid_
,
711 reinterpret_cast<const void*>(phdr_addr
),
713 if (phdr
.p_type
== PT_LOAD
&& phdr
.p_vaddr
< min_vaddr
) {
714 min_vaddr
= phdr
.p_vaddr
;
716 if (phdr
.p_type
== PT_DYNAMIC
) {
717 dyn_vaddr
= phdr
.p_vaddr
;
718 dyn_count
= phdr
.p_memsz
/ sizeof(ElfW(Dyn
));
720 phdr_addr
+= sizeof(phdr
);
723 *min_vaddr_ptr
= min_vaddr
;
724 *dyn_vaddr_ptr
= dyn_vaddr
;
725 *dyn_count_ptr
= dyn_count
;
728 bool LinuxDumper::HasAndroidPackedRelocations(uintptr_t load_bias
,
731 uintptr_t dyn_addr
= load_bias
+ dyn_vaddr
;
732 for (size_t i
= 0; i
< dyn_count
; ++i
) {
734 CopyFromProcess(&dyn
, pid_
,
735 reinterpret_cast<const void*>(dyn_addr
),
737 if (dyn
.d_tag
== DT_ANDROID_REL
|| dyn
.d_tag
== DT_ANDROID_RELA
) {
740 dyn_addr
+= sizeof(dyn
);
745 uintptr_t LinuxDumper::GetEffectiveLoadBias(ElfW(Ehdr
)* ehdr
,
746 uintptr_t start_addr
) {
747 uintptr_t min_vaddr
= 0;
748 uintptr_t dyn_vaddr
= 0;
749 size_t dyn_count
= 0;
750 ParseLoadedElfProgramHeaders(ehdr
, start_addr
,
751 &min_vaddr
, &dyn_vaddr
, &dyn_count
);
752 // If |min_vaddr| is non-zero and we find Android packed relocation tags,
753 // return the effective load bias.
754 if (min_vaddr
!= 0) {
755 const uintptr_t load_bias
= start_addr
- min_vaddr
;
756 if (HasAndroidPackedRelocations(load_bias
, dyn_vaddr
, dyn_count
)) {
760 // Either |min_vaddr| is zero, or it is non-zero but we did not find the
761 // expected Android packed relocations tags.
765 void LinuxDumper::LatePostprocessMappings() {
766 for (size_t i
= 0; i
< mappings_
.size(); ++i
) {
767 // Only consider exec mappings that indicate a file path was mapped, and
768 // where the ELF header indicates a mapped shared library.
769 MappingInfo
* mapping
= mappings_
[i
];
770 if (!(mapping
->exec
&& mapping
->name
[0] == '/')) {
774 if (!GetLoadedElfHeader(mapping
->start_addr
, &ehdr
)) {
777 if (ehdr
.e_type
== ET_DYN
) {
778 // Compute the effective load bias for this mapped library, and update
779 // the mapping to hold that rather than |start_addr|, at the same time
780 // adjusting |size| to account for the change in |start_addr|. Where
781 // the library does not contain Android packed relocations,
782 // GetEffectiveLoadBias() returns |start_addr| and the mapping entry
784 const uintptr_t load_bias
= GetEffectiveLoadBias(&ehdr
,
785 mapping
->start_addr
);
786 mapping
->size
+= mapping
->start_addr
- load_bias
;
787 mapping
->start_addr
= load_bias
;
792 #endif // __ANDROID__
794 // Get information about the stack, given the stack pointer. We don't try to
795 // walk the stack since we might not have all the information needed to do
796 // unwind. So we just grab, up to, 32k of stack.
797 bool LinuxDumper::GetStackInfo(const void** stack
, size_t* stack_len
,
798 uintptr_t int_stack_pointer
) {
799 // Move the stack pointer to the bottom of the page that it's in.
800 const uintptr_t page_size
= getpagesize();
802 uint8_t* const stack_pointer
=
803 reinterpret_cast<uint8_t*>(int_stack_pointer
& ~(page_size
- 1));
805 // The number of bytes of stack which we try to capture.
806 static const ptrdiff_t kStackToCapture
= 32 * 1024;
808 const MappingInfo
* mapping
= FindMapping(stack_pointer
);
811 const ptrdiff_t offset
= stack_pointer
-
812 reinterpret_cast<uint8_t*>(mapping
->start_addr
);
813 const ptrdiff_t distance_to_end
=
814 static_cast<ptrdiff_t>(mapping
->size
) - offset
;
815 *stack_len
= distance_to_end
> kStackToCapture
?
816 kStackToCapture
: distance_to_end
;
817 *stack
= stack_pointer
;
821 void LinuxDumper::SanitizeStackCopy(uint8_t* stack_copy
, size_t stack_len
,
822 uintptr_t stack_pointer
,
823 uintptr_t sp_offset
) {
824 // We optimize the search for containing mappings in three ways:
825 // 1) We expect that pointers into the stack mapping will be common, so
826 // we cache that address range.
827 // 2) The last referenced mapping is a reasonable predictor for the next
828 // referenced mapping, so we test that first.
829 // 3) We precompute a bitfield based upon bits 32:32-n of the start and
830 // stop addresses, and use that to short circuit any values that can
831 // not be pointers. (n=11)
832 const uintptr_t defaced
=
833 #if defined(__LP64__)
838 // the bitfield length is 2^test_bits long.
839 const unsigned int test_bits
= 11;
840 // byte length of the corresponding array.
841 const unsigned int array_size
= 1 << (test_bits
- 3);
842 const unsigned int array_mask
= array_size
- 1;
843 // The amount to right shift pointers by. This captures the top bits
844 // on 32 bit architectures. On 64 bit architectures this would be
845 // uninformative so we take the same range of bits.
846 const unsigned int shift
= 32 - 11;
847 const MappingInfo
* last_hit_mapping
= nullptr;
848 const MappingInfo
* hit_mapping
= nullptr;
849 const MappingInfo
* stack_mapping
= FindMappingNoBias(stack_pointer
);
850 // The magnitude below which integers are considered to be to be
851 // 'small', and not constitute a PII risk. These are included to
852 // avoid eliding useful register values.
853 const ssize_t small_int_magnitude
= 4096;
855 char could_hit_mapping
[array_size
];
856 my_memset(could_hit_mapping
, 0, array_size
);
858 // Initialize the bitfield such that if the (pointer >> shift)'th
859 // bit, modulo the bitfield size, is not set then there does not
860 // exist a mapping in mappings_ that would contain that pointer.
861 for (size_t i
= 0; i
< mappings_
.size(); ++i
) {
862 if (!mappings_
[i
]->exec
) continue;
863 // For each mapping, work out the (unmodulo'ed) range of bits to
865 uintptr_t start
= mappings_
[i
]->start_addr
;
866 uintptr_t end
= start
+ mappings_
[i
]->size
;
869 for (size_t bit
= start
; bit
<= end
; ++bit
) {
870 // Set each bit in the range, applying the modulus.
871 could_hit_mapping
[(bit
>> 3) & array_mask
] |= 1 << (bit
& 7);
875 // Zero memory that is below the current stack pointer.
876 const uintptr_t offset
=
877 (sp_offset
+ sizeof(uintptr_t) - 1) & ~(sizeof(uintptr_t) - 1);
879 my_memset(stack_copy
, 0, offset
);
882 // Apply sanitization to each complete pointer-aligned word in the
885 for (sp
= stack_copy
+ offset
;
886 sp
<= stack_copy
+ stack_len
- sizeof(uintptr_t);
887 sp
+= sizeof(uintptr_t)) {
889 my_memcpy(&addr
, sp
, sizeof(uintptr_t));
890 if (static_cast<intptr_t>(addr
) <= small_int_magnitude
&&
891 static_cast<intptr_t>(addr
) >= -small_int_magnitude
) {
894 if (stack_mapping
&& MappingContainsAddress(*stack_mapping
, addr
)) {
897 if (last_hit_mapping
&& MappingContainsAddress(*last_hit_mapping
, addr
)) {
900 uintptr_t test
= addr
>> shift
;
901 if (could_hit_mapping
[(test
>> 3) & array_mask
] & (1 << (test
& 7)) &&
902 (hit_mapping
= FindMappingNoBias(addr
)) != nullptr &&
904 last_hit_mapping
= hit_mapping
;
907 my_memcpy(sp
, &defaced
, sizeof(uintptr_t));
909 // Zero any partial word at the top of the stack, if alignment is
910 // such that that is required.
911 if (sp
< stack_copy
+ stack_len
) {
912 my_memset(sp
, 0, stack_copy
+ stack_len
- sp
);
916 bool LinuxDumper::StackHasPointerToMapping(const uint8_t* stack_copy
,
919 const MappingInfo
& mapping
) {
920 // Loop over all stack words that would have been on the stack in
921 // the target process (i.e. are word aligned, and at addresses >=
922 // the stack pointer). Regardless of the alignment of |stack_copy|,
923 // the memory starting at |stack_copy| + |offset| represents an
924 // aligned word in the target process.
925 const uintptr_t low_addr
= mapping
.system_mapping_info
.start_addr
;
926 const uintptr_t high_addr
= mapping
.system_mapping_info
.end_addr
;
927 const uintptr_t offset
=
928 (sp_offset
+ sizeof(uintptr_t) - 1) & ~(sizeof(uintptr_t) - 1);
930 for (const uint8_t* sp
= stack_copy
+ offset
;
931 sp
<= stack_copy
+ stack_len
- sizeof(uintptr_t);
932 sp
+= sizeof(uintptr_t)) {
934 my_memcpy(&addr
, sp
, sizeof(uintptr_t));
935 if (low_addr
<= addr
&& addr
<= high_addr
)
941 // Find the mapping which the given memory address falls in.
942 const MappingInfo
* LinuxDumper::FindMapping(const void* address
) const {
943 const uintptr_t addr
= (uintptr_t) address
;
945 for (size_t i
= 0; i
< mappings_
.size(); ++i
) {
946 const uintptr_t start
= static_cast<uintptr_t>(mappings_
[i
]->start_addr
);
947 if (addr
>= start
&& addr
- start
< mappings_
[i
]->size
)
954 // Find the mapping which the given memory address falls in. Uses the
955 // unadjusted mapping address range from the kernel, rather than the
957 const MappingInfo
* LinuxDumper::FindMappingNoBias(uintptr_t address
) const {
958 for (size_t i
= 0; i
< mappings_
.size(); ++i
) {
959 if (address
>= mappings_
[i
]->system_mapping_info
.start_addr
&&
960 address
< mappings_
[i
]->system_mapping_info
.end_addr
) {
967 bool LinuxDumper::HandleDeletedFileInMapping(char* path
) const {
968 static const size_t kDeletedSuffixLen
= sizeof(kDeletedSuffix
) - 1;
970 // Check for ' (deleted)' in |path|.
971 // |path| has to be at least as long as "/x (deleted)".
972 const size_t path_len
= my_strlen(path
);
973 if (path_len
< kDeletedSuffixLen
+ 2)
975 if (my_strncmp(path
+ path_len
- kDeletedSuffixLen
, kDeletedSuffix
,
976 kDeletedSuffixLen
) != 0) {
980 // Check |path| against the /proc/pid/exe 'symlink'.
981 char exe_link
[NAME_MAX
];
982 if (!BuildProcPath(exe_link
, pid_
, "exe"))
984 MappingInfo new_mapping
= {0};
985 if (!SafeReadLink(exe_link
, new_mapping
.name
))
987 char new_path
[PATH_MAX
];
988 if (!GetMappingAbsolutePath(new_mapping
, new_path
))
990 if (my_strcmp(path
, new_path
) != 0)
993 // Check to see if someone actually named their executable 'foo (deleted)'.
994 struct kernel_stat exe_stat
;
995 struct kernel_stat new_path_stat
;
996 if (sys_stat(exe_link
, &exe_stat
) == 0 &&
997 sys_stat(new_path
, &new_path_stat
) == 0 &&
998 exe_stat
.st_dev
== new_path_stat
.st_dev
&&
999 exe_stat
.st_ino
== new_path_stat
.st_ino
) {
1003 my_memcpy(path
, exe_link
, NAME_MAX
);
1007 } // namespace google_breakpad