1 /* Fallback frame-state unwinder for Darwin.
2 Copyright (C) 2004, 2005, 2007 Free Software Foundation, Inc.
4 This file is part of GCC.
6 GCC is free software; you can redistribute it and/or modify it
7 under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2, or (at your option)
11 In addition to the permissions in the GNU General Public License, the
12 Free Software Foundation gives you unlimited permission to link the
13 compiled version of this file into combinations with other programs,
14 and to distribute those combinations without any restriction coming
15 from the use of this file. (The General Public License restrictions
16 do apply in other respects; for example, they cover modification of
17 the file, and distribution when not linked into a combined
20 GCC is distributed in the hope that it will be useful, but WITHOUT
21 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
22 or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
23 License for more details.
25 You should have received a copy of the GNU General Public License
26 along with GCC; see the file COPYING. If not, write to the Free
27 Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
34 #include "coretypes.h"
38 #include "unwind-dw2.h"
41 #include <sys/types.h>
53 typedef unsigned long reg_unit;
55 /* Place in GPRS the parameters to the first 'sc' instruction that would
56 have been executed if we were returning from this CONTEXT, or
57 return false if an unexpected instruction is encountered. */
60 interpret_libc (reg_unit gprs[32], struct _Unwind_Context *context)
62 uint32_t *pc = (uint32_t *)_Unwind_GetIP (context);
64 reg_unit lr = (reg_unit) pc;
66 uint32_t *invalid_address = NULL;
70 for (i = 0; i < 13; i++)
72 gprs[1] = _Unwind_GetCFA (context);
74 gprs[i] = _Unwind_GetGR (context, i);
75 cr = _Unwind_GetGR (context, R_CR2);
77 /* For each supported Libc, we have to track the code flow
78 all the way back into the kernel.
80 This code is believed to support all released Libc/Libsystem builds since
81 Jaguar 6C115, including all the security updates. To be precise,
83 Libc Libsystem Build(s)
90 262.4.1~1 63~84 6L123-6R172
92 320~1 71~101 7B85-7D28
93 320~1 71~266 7F54-7F56
96 320.1.3~1 71.1.1~29 7H60-7H105
97 320.1.3~1 71.1.1~30 7H110-7H113
98 320.1.3~1 71.1.1~31 7H114
100 That's a big table! It would be insane to try to keep track of
101 every little detail, so we just read the code itself and do what
107 uint32_t ins = *pc++;
109 if ((ins & 0xFC000003) == 0x48000000) /* b instruction */
111 pc += ((((int32_t) ins & 0x3FFFFFC) ^ 0x2000000) - 0x2000004) / 4;
114 if ((ins & 0xFC600000) == 0x2C000000) /* cmpwi */
116 int32_t val1 = (int16_t) ins;
117 int32_t val2 = gprs[ins >> 16 & 0x1F];
118 /* Only beq and bne instructions are supported, so we only
119 need to set the EQ bit. */
120 uint32_t mask = 0xF << ((ins >> 21 & 0x1C) ^ 0x1C);
127 if ((ins & 0xFEC38003) == 0x40820000) /* forwards beq/bne */
129 if ((cr >> ((ins >> 16 & 0x1F) ^ 0x1F) & 1) == (ins >> 24 & 1))
130 pc += (ins & 0x7FFC) / 4 - 1;
133 if ((ins & 0xFC0007FF) == 0x7C000378) /* or, including mr */
135 gprs [ins >> 16 & 0x1F] = (gprs [ins >> 11 & 0x1F]
136 | gprs [ins >> 21 & 0x1F]);
139 if (ins >> 26 == 0x0E) /* addi, including li */
141 reg_unit src = (ins >> 16 & 0x1F) == 0 ? 0 : gprs [ins >> 16 & 0x1F];
142 gprs [ins >> 21 & 0x1F] = src + (int16_t) ins;
145 if (ins >> 26 == 0x0F) /* addis, including lis */
147 reg_unit src = (ins >> 16 & 0x1F) == 0 ? 0 : gprs [ins >> 16 & 0x1F];
148 gprs [ins >> 21 & 0x1F] = src + ((int16_t) ins << 16);
151 if (ins >> 26 == 0x20) /* lwz */
153 reg_unit src = (ins >> 16 & 0x1F) == 0 ? 0 : gprs [ins >> 16 & 0x1F];
154 uint32_t *p = (uint32_t *)(src + (int16_t) ins);
155 if (p == invalid_address)
157 gprs [ins >> 21 & 0x1F] = *p;
160 if (ins >> 26 == 0x21) /* lwzu */
162 uint32_t *p = (uint32_t *)(gprs [ins >> 16 & 0x1F] += (int16_t) ins);
163 if (p == invalid_address)
165 gprs [ins >> 21 & 0x1F] = *p;
168 if (ins >> 26 == 0x24) /* stw */
169 /* What we hope this is doing is '--in_sigtramp'. We don't want
170 to actually store to memory, so just make a note of the
171 address and refuse to load from it. */
173 reg_unit src = (ins >> 16 & 0x1F) == 0 ? 0 : gprs [ins >> 16 & 0x1F];
174 uint32_t *p = (uint32_t *)(src + (int16_t) ins);
175 if (p == NULL || invalid_address != NULL)
180 if (ins >> 26 == 0x2E) /* lmw */
182 reg_unit src = (ins >> 16 & 0x1F) == 0 ? 0 : gprs [ins >> 16 & 0x1F];
183 uint32_t *p = (uint32_t *)(src + (int16_t) ins);
186 for (i = (ins >> 21 & 0x1F); i < 32; i++)
188 if (p == invalid_address)
194 if ((ins & 0xFC1FFFFF) == 0x7c0803a6) /* mtlr */
196 lr = gprs [ins >> 21 & 0x1F];
199 if ((ins & 0xFC1FFFFF) == 0x7c0802a6) /* mflr */
201 gprs [ins >> 21 & 0x1F] = lr;
204 if ((ins & 0xFC1FFFFF) == 0x7c0903a6) /* mtctr */
206 ctr = gprs [ins >> 21 & 0x1F];
209 /* The PowerPC User's Manual says that bit 11 of the mtcrf
210 instruction is reserved and should be set to zero, but it
211 looks like the Darwin assembler doesn't do that... */
212 if ((ins & 0xFC000FFF) == 0x7c000120) /* mtcrf */
216 for (i = 0; i < 8; i++)
217 mask |= ((-(ins >> (12 + i) & 1)) & 0xF) << 4 * i;
218 cr = (cr & ~mask) | (gprs [ins >> 21 & 0x1F] & mask);
221 if (ins == 0x429f0005) /* bcl- 20,4*cr7+so,.+4, loads pc into LR */
226 if (ins == 0x4e800420) /* bctr */
228 pc = (uint32_t *) ctr;
231 if (ins == 0x44000002) /* sc */
238 /* We used to include <ucontext.h> and <mach/thread_status.h>,
239 but they change so much between different Darwin system versions
240 that it's much easier to just write the structures involved here
243 /* These defines are from the kernel's bsd/dev/ppc/unix_signal.c. */
245 #define UC_TRAD_VEC 6
247 #define UC_TRAD64_VEC 25
249 #define UC_FLAVOR_VEC 35
250 #define UC_FLAVOR64 40
251 #define UC_FLAVOR64_VEC 45
253 #define UC_DUAL_VEC 55
262 struct gcc_ucontext *link;
264 struct gcc_mcontext32 *mcontext;
267 struct gcc_float_vector_state
272 uint32_t save_vr[32][4];
273 uint32_t save_vscr[4];
276 struct gcc_mcontext32 {
280 uint32_t padding1[5];
290 struct gcc_float_vector_state fvs;
293 /* These are based on /usr/include/ppc/ucontext.h and
294 /usr/include/mach/ppc/thread_status.h, but rewritten to be more
295 convenient, to compile on Jaguar, and to work around Radar 3712064
296 on Panther, which is that the 'es' field of 'struct mcontext64' has
297 the wrong type (doh!). */
299 struct gcc_mcontext64 {
303 uint32_t padding1[4];
308 uint32_t xer[2]; /* These are arrays because the original structure has them misaligned. */
312 struct gcc_float_vector_state fvs;
315 #define UC_FLAVOR_SIZE \
316 (sizeof (struct gcc_mcontext32) - 33*16)
318 #define UC_FLAVOR_VEC_SIZE (sizeof (struct gcc_mcontext32))
320 #define UC_FLAVOR64_SIZE \
321 (sizeof (struct gcc_mcontext64) - 33*16)
323 #define UC_FLAVOR64_VEC_SIZE (sizeof (struct gcc_mcontext64))
325 /* Given GPRS as input to a 'sc' instruction, and OLD_CFA, update FS
326 to represent the execution of a signal return; or, if not a signal
327 return, return false. */
330 handle_syscall (_Unwind_FrameState *fs, const reg_unit gprs[32],
333 struct gcc_ucontext *uctx;
334 bool is_64, is_vector;
335 struct gcc_float_vector_state * float_vector_state;
338 static _Unwind_Ptr return_addr;
340 /* Yay! We're in a Libc that we understand, and it's made a
341 system call. In Jaguar, this is a direct system call with value 103;
342 in Panther and Tiger it is a SYS_syscall call for system call number 184,
343 and in Leopard it is a direct syscall with number 184. */
345 if (gprs[0] == 0x67 /* SYS_SIGRETURN */)
347 uctx = (struct gcc_ucontext *) gprs[3];
348 is_vector = (uctx->mcsize == UC_FLAVOR64_VEC_SIZE
349 || uctx->mcsize == UC_FLAVOR_VEC_SIZE);
350 is_64 = (uctx->mcsize == UC_FLAVOR64_VEC_SIZE
351 || uctx->mcsize == UC_FLAVOR64_SIZE);
353 else if (gprs[0] == 0 /* SYS_syscall */ && gprs[3] == 184)
355 int ctxstyle = gprs[5];
356 uctx = (struct gcc_ucontext *) gprs[4];
357 is_vector = (ctxstyle == UC_FLAVOR_VEC || ctxstyle == UC_FLAVOR64_VEC
358 || ctxstyle == UC_TRAD_VEC || ctxstyle == UC_TRAD64_VEC);
359 is_64 = (ctxstyle == UC_FLAVOR64_VEC || ctxstyle == UC_TRAD64_VEC
360 || ctxstyle == UC_FLAVOR64 || ctxstyle == UC_TRAD64);
362 else if (gprs[0] == 184 /* SYS_sigreturn */)
364 int ctxstyle = gprs[4];
365 uctx = (struct gcc_ucontext *) gprs[3];
366 is_vector = (ctxstyle == UC_FLAVOR_VEC || ctxstyle == UC_FLAVOR64_VEC
367 || ctxstyle == UC_TRAD_VEC || ctxstyle == UC_TRAD64_VEC);
368 is_64 = (ctxstyle == UC_FLAVOR64_VEC || ctxstyle == UC_TRAD64_VEC
369 || ctxstyle == UC_FLAVOR64 || ctxstyle == UC_TRAD64);
374 #define set_offset(r, addr) \
375 (fs->regs.reg[r].how = REG_SAVED_OFFSET, \
376 fs->regs.reg[r].loc.offset = (_Unwind_Ptr)(addr) - new_cfa)
378 /* Restore even the registers that are not call-saved, since they
379 might be being used in the prologue to save other registers,
380 for instance GPR0 is sometimes used to save LR. */
382 /* Handle the GPRs, and produce the information needed to do the rest. */
385 /* The context is 64-bit, but it doesn't carry any extra information
386 for us because only the low 32 bits of the registers are
388 struct gcc_mcontext64 *m64 = (struct gcc_mcontext64 *)uctx->mcontext;
391 float_vector_state = &m64->fvs;
393 new_cfa = m64->gpr[1][1];
395 set_offset (R_CR2, &m64->cr);
396 for (i = 0; i < 32; i++)
397 set_offset (i, m64->gpr[i] + 1);
398 set_offset (R_XER, m64->xer + 1);
399 set_offset (R_LR, m64->lr + 1);
400 set_offset (R_CTR, m64->ctr + 1);
402 set_offset (R_VRSAVE, &m64->vrsave);
404 /* Sometimes, srr0 points to the instruction that caused the exception,
405 and sometimes to the next instruction to be executed; we want
407 if (m64->exception == 3 || m64->exception == 4
408 || m64->exception == 6
409 || (m64->exception == 7 && !(m64->srr1 & 0x10000)))
410 return_addr = m64->srr0 + 4;
412 return_addr = m64->srr0;
416 struct gcc_mcontext32 *m = uctx->mcontext;
419 float_vector_state = &m->fvs;
423 set_offset (R_CR2, &m->cr);
424 for (i = 0; i < 32; i++)
425 set_offset (i, m->gpr + i);
426 set_offset (R_XER, &m->xer);
427 set_offset (R_LR, &m->lr);
428 set_offset (R_CTR, &m->ctr);
431 set_offset (R_VRSAVE, &m->vrsave);
433 /* Sometimes, srr0 points to the instruction that caused the exception,
434 and sometimes to the next instruction to be executed; we want
436 if (m->exception == 3 || m->exception == 4
438 || (m->exception == 7 && !(m->srr1 & 0x10000)))
439 return_addr = m->srr0 + 4;
441 return_addr = m->srr0;
444 fs->regs.cfa_how = CFA_REG_OFFSET;
445 fs->regs.cfa_reg = STACK_POINTER_REGNUM;
446 fs->regs.cfa_offset = new_cfa - old_cfa;;
448 /* The choice of column for the return address is somewhat tricky.
449 Fortunately, the actual choice is private to this file, and
450 the space it's reserved from is the GCC register space, not the
451 DWARF2 numbering. So any free element of the right size is an OK
453 fs->retaddr_column = ARG_POINTER_REGNUM;
454 /* FIXME: this should really be done using a DWARF2 location expression,
455 not using a static variable. In fact, this entire file should
456 be implemented in DWARF2 expressions. */
457 set_offset (ARG_POINTER_REGNUM, &return_addr);
459 for (i = 0; i < 32; i++)
460 set_offset (32 + i, float_vector_state->fpregs + i);
461 set_offset (R_SPEFSCR, &float_vector_state->fpscr);
465 for (i = 0; i < 32; i++)
466 set_offset (R_VR0 + i, float_vector_state->save_vr + i);
467 set_offset (R_VSCR, float_vector_state->save_vscr);
473 /* This is also prototyped in rs6000/darwin.h, inside the
474 MD_FALLBACK_FRAME_STATE_FOR macro. */
475 extern bool _Unwind_fallback_frame_state_for (struct _Unwind_Context *context,
476 _Unwind_FrameState *fs);
478 /* Implement the MD_FALLBACK_FRAME_STATE_FOR macro,
479 returning true iff the frame was a sigreturn() frame that we
483 _Unwind_fallback_frame_state_for (struct _Unwind_Context *context,
484 _Unwind_FrameState *fs)
488 if (!interpret_libc (gprs, context))
490 return handle_syscall (fs, gprs, _Unwind_GetCFA (context));