Index: snapshot/win/process_reader_win.cc |
diff --git a/snapshot/win/process_reader_win.cc b/snapshot/win/process_reader_win.cc |
index 84e176b8739dcdee035210dcdeb6850d44d12db6..97fc5f89828db63dcbef3cdcb6370eb1a4cc045b 100644 |
--- a/snapshot/win/process_reader_win.cc |
+++ b/snapshot/win/process_reader_win.cc |
@@ -14,15 +14,132 @@ |
#include "snapshot/win/process_reader_win.h" |
+#include <winternl.h> |
+ |
+#include "base/memory/scoped_ptr.h" |
#include "base/numerics/safe_conversions.h" |
+#include "util/win/process_structs.h" |
#include "util/win/time.h" |
namespace crashpad { |
+namespace { |
+ |
+NTSTATUS NtQuerySystemInformation( |
+ SYSTEM_INFORMATION_CLASS system_information_class, |
+ PVOID system_information, |
+ ULONG system_information_length, |
+ PULONG return_length) { |
+ static decltype(::NtQuerySystemInformation)* nt_query_system_information = |
+ reinterpret_cast<decltype(::NtQuerySystemInformation)*>(GetProcAddress( |
+ LoadLibrary(L"ntdll.dll"), "NtQuerySystemInformation")); |
+ DCHECK(nt_query_system_information); |
+ return nt_query_system_information(system_information_class, |
+ system_information, |
+ system_information_length, |
+ return_length); |
+} |
+ |
+// Copied from ntstatus.h because um/winnt.h conflicts with general inclusion of |
+// ntstatus.h. |
+#define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L) |
+#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) |
+ |
+// Kernel mode enumerations for thread state. |
+// See http://www.nirsoft.net/kernel_struct/vista/KTHREAD_STATE.html and |
+// https://msdn.microsoft.com/en-us/library/system.diagnostics.threadstate(v=vs.110).aspx |
+enum class KTHREAD_STATE : uint32_t { |
Mark Mentovai
2015/05/08 20:30:21
KTHREAD_STATE intentional instead of KThreadState?
scottmg
2015/05/08 21:05:44
That was to match the standard kernel/ntinternals
|
+ kkInitialized, |
+ kReady, |
+ kRunning, |
+ kStandby, |
+ kTerminated, |
+ kWaiting, |
+ kTransition, |
+ kDeferredReady, |
+ kGateWait, |
+}; |
+ |
+// Gets a pointer to the process information structure after a given one, or |
+// null when iteration is complete, assuming they've been retrieved in a block |
+// via NtQuerySystemInformation(). |
+template <class Traits> |
+process_types::SYSTEM_PROCESS_INFORMATION<Traits>* NextProcess( |
+ process_types::SYSTEM_PROCESS_INFORMATION<Traits>* process) { |
+ ULONG offset = process->NextEntryOffset; |
+ if (offset == 0) |
+ return nullptr; |
+ return reinterpret_cast<process_types::SYSTEM_PROCESS_INFORMATION<Traits>*>( |
+ reinterpret_cast<uint8_t*>(process) + offset); |
+} |
+ |
+//! \brief Retrieves the SYSTEM_PROCESS_INFORMATION for a given process. |
+//! |
+//! The returned pointer points into the memory block stored by \a buffer. |
+//! Ownership of \a buffer is transferred to the caller. |
+//! |
+//! \return Pointer to the process' data, or nullptr if it was not found or on |
+//! error. On error, a message will be logged. |
+template <class Traits> |
+process_types::SYSTEM_PROCESS_INFORMATION<Traits>* GetProcessInformation( |
+ HANDLE process_handle, |
+ scoped_ptr<uint8_t[]>* buffer) { |
+ ULONG buffer_size = 16384; |
+ buffer->reset(new uint8_t[buffer_size]); |
+ NTSTATUS status; |
+ // This must be in retry loop, as we're racing with process creation on the |
+ // system to find a buffer large enough to hold all process information. |
+ for (int tries = 0; tries < 20; ++tries) { |
+ const int kSystemExtendedProcessInformation = 57; |
+ status = crashpad::NtQuerySystemInformation( |
+ static_cast<SYSTEM_INFORMATION_CLASS>( |
+ kSystemExtendedProcessInformation), |
+ reinterpret_cast<void*>(buffer->get()), |
+ buffer_size, |
+ &buffer_size); |
+ if (status == STATUS_BUFFER_TOO_SMALL || |
+ status == STATUS_INFO_LENGTH_MISMATCH) { |
+ buffer->reset(new uint8_t[buffer_size]); |
Mark Mentovai
2015/05/08 20:30:21
No slop? (It’s OK if you’re against doing it, but
scottmg
2015/05/08 21:05:44
Oops, I did it, then undid it when I added the ran
|
+ } else { |
+ break; |
+ } |
+ } |
+ |
+ if (!NT_SUCCESS(status)) { |
+ LOG(ERROR) << "NtQuerySystemInformation failed: " << std::hex << status; |
+ return nullptr; |
+ } |
+ |
+ process_types::SYSTEM_PROCESS_INFORMATION<Traits>* process = |
+ reinterpret_cast<process_types::SYSTEM_PROCESS_INFORMATION<Traits>*>( |
+ buffer->get()); |
+ DWORD process_id = GetProcessId(process_handle); |
+ do { |
+ if (process->UniqueProcessId == process_id) |
+ return process; |
+ } while (process = NextProcess(process)); |
+ |
+ LOG(ERROR) << "process " << process_id << " not found"; |
+ return nullptr; |
+} |
+ |
+} // namespace |
+ |
+ProcessReaderWin::Thread::Thread() |
+ : id(0), |
+ teb(0), |
+ stack_region_address(0), |
+ stack_region_size(0), |
+ suspend_count(0), |
+ priority_class(0), |
+ priority(0) { |
+} |
+ |
ProcessReaderWin::ProcessReaderWin() |
: process_(INVALID_HANDLE_VALUE), |
process_info_(), |
modules_(), |
Mark Mentovai
2015/05/08 20:30:21
threads_(),
scottmg
2015/05/08 21:05:44
Done.
|
+ initialized_threads_(false), |
initialized_() { |
} |
@@ -77,6 +194,66 @@ bool ProcessReaderWin::CPUTimes(timeval* user_time, |
return true; |
} |
+const std::vector<ProcessReaderWin::Thread>& ProcessReaderWin::Threads() { |
+ INITIALIZATION_STATE_DCHECK_VALID(initialized_); |
+ |
+ if (initialized_threads_) |
+ return threads_; |
+ |
Mark Mentovai
2015/05/08 20:30:21
Set initialized_threads_ to true here, so that if
scottmg
2015/05/08 21:05:44
Done.
|
+ DCHECK(threads_.empty()); |
+ |
+#if ARCH_CPU_32_BITS |
+ using SizeTraits = process_types::internal::Traits32; |
+#else |
+ using SizeTraits = process_types::internal::Traits64; |
+#endif |
+ process_types::SYSTEM_PROCESS_INFORMATION<SizeTraits>* process_information; |
Mark Mentovai
2015/05/08 20:30:21
No need to declare this until you initialize it, a
scottmg
2015/05/08 21:05:45
Done.
|
+ scoped_ptr<uint8_t[]> buffer; |
+ process_information = GetProcessInformation<SizeTraits>(process_, &buffer); |
+ if (!process_information) |
+ return threads_; |
+ |
+ for (unsigned i = 0; i < process_information->NumberOfThreads; ++i) { |
Mark Mentovai
2015/05/08 20:30:21
“unsigned long” to match decltype(process_informat
scottmg
2015/05/08 21:05:44
Done.
|
+ const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION<SizeTraits>& |
+ thread_info = process_information->Threads[i]; |
+ Thread thread; |
+ thread.id = thread_info.ClientId.UniqueThread; |
+ |
+ // TODO(scottmg): I'm not sure how to get SuspendCount. A rough version is |
+ // to set a suspended count if if's currently waiting. |
+ thread.suspend_count = |
+ thread_info.ThreadState == static_cast<ULONG>(KTHREAD_STATE::kGateWait) |
Mark Mentovai
2015/05/08 20:30:21
Not that Stack Overflow is known for correctness,
scottmg
2015/05/08 21:05:45
I think that's "sort of" right, in that that is wh
Mark Mentovai
2015/05/08 21:15:00
scottmg wrote:
scottmg
2015/05/09 02:46:15
I see, my mistake.
I created a thread with CREATE
|
+ ? 1 |
+ : 0; |
+ |
+ // TODO(scottmg): I believe we could reverse engineer the PriorityClass from |
+ // the Priority, BasePriority, and |
+ // https://msdn.microsoft.com/en-us/library/windows/desktop/ms685100 . |
+ // MinidumpThreadWriter doesn't handle it yet in any case, so investigate |
+ // both of those at the same time if it's useful. |
+ thread.priority_class = NORMAL_PRIORITY_CLASS; |
+ |
+ thread.priority = thread_info.Priority; |
+ thread.teb = thread_info.TebBase; |
+ |
+ // While there are semi-documented fields in the thread structure called |
+ // StackBase and StackLimit, they don't appear to be correct in practice (or |
+ // at least, I don't know how to interpret them). Instead, read the TIB |
+ // (Thread Information Block) which is the first element of the TEB, and use |
+ // its stack fields. |
+ process_types::NT_TIB<SizeTraits> tib; |
+ if (ReadMemory(thread_info.TebBase, sizeof(tib), &tib)) { |
+ thread.stack_region_address = tib.StackBase; |
+ // Note, "backwards" because of direction of stack growth. |
+ thread.stack_region_size = tib.StackBase - tib.StackLimit; |
+ } |
+ threads_.push_back(thread); |
+ } |
+ |
+ initialized_threads_ = true; |
+ return threads_; |
+} |
+ |
const std::vector<ProcessInfo::Module>& ProcessReaderWin::Modules() { |
INITIALIZATION_STATE_DCHECK_VALID(initialized_); |