1 |
734 |
jeremybenn |
/* DWARF2 EH unwinding support for Alpha Tru64.
|
2 |
|
|
Copyright (C) 2010 Free Software Foundation, Inc.
|
3 |
|
|
|
4 |
|
|
This file is part of GCC.
|
5 |
|
|
|
6 |
|
|
GCC is free software; you can redistribute it and/or modify it under
|
7 |
|
|
the terms of the GNU General Public License as published by the Free
|
8 |
|
|
Software Foundation; either version 3, or (at your option) any later
|
9 |
|
|
version.
|
10 |
|
|
|
11 |
|
|
GCC is distributed in the hope that it will be useful, but WITHOUT ANY
|
12 |
|
|
WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
13 |
|
|
FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
14 |
|
|
for more details.
|
15 |
|
|
|
16 |
|
|
You should have received a copy of the GNU General Public License
|
17 |
|
|
along with GCC; see the file COPYING3. If not see
|
18 |
|
|
<http://www.gnu.org/licenses/>. */
|
19 |
|
|
|
20 |
|
|
/* This file implements the MD_FALLBACK_FRAME_STATE_FOR macro, triggered when
|
21 |
|
|
the GCC table based unwinding process hits a frame for which no unwind info
|
22 |
|
|
has been registered. This typically occurs when raising an exception from a
|
23 |
|
|
signal handler, because the handler is actually called from the OS kernel.
|
24 |
|
|
|
25 |
|
|
The basic idea is to detect that we are indeed trying to unwind past a
|
26 |
|
|
signal handler and to fill out the GCC internal unwinding structures for
|
27 |
|
|
the OS kernel frame as if it had been directly called from the interrupted
|
28 |
|
|
context.
|
29 |
|
|
|
30 |
|
|
This is all assuming that the code to set the handler asked the kernel to
|
31 |
|
|
pass a pointer to such context information. */
|
32 |
|
|
|
33 |
|
|
/* --------------------------------------------------------------------------
|
34 |
|
|
-- Basic principles of operation:
|
35 |
|
|
--------------------------------------------------------------------------
|
36 |
|
|
|
37 |
|
|
1/ We first need a way to detect if we are trying to unwind past a signal
|
38 |
|
|
handler.
|
39 |
|
|
|
40 |
|
|
The typical method that is used on most platforms is to look at the code
|
41 |
|
|
around the return address we have and check if it matches the OS code
|
42 |
|
|
calling a handler. To determine what this code is expected to be, get a
|
43 |
|
|
breakpoint into a real signal handler and look at the code around the
|
44 |
|
|
return address. Depending on the library versions the pattern of the
|
45 |
|
|
signal handler is different; this is the reason why we check against more
|
46 |
|
|
than one pattern.
|
47 |
|
|
|
48 |
|
|
On this target, the return address is right after the call and every
|
49 |
|
|
instruction is 4 bytes long. For the simple case of a null dereference in
|
50 |
|
|
a single-threaded app, it went like:
|
51 |
|
|
|
52 |
|
|
# Check that we indeed have something we expect: the instruction right
|
53 |
|
|
# before the return address is within a __sigtramp function and is a call.
|
54 |
|
|
|
55 |
|
|
[... run gdb and break at the signal handler entry ...]
|
56 |
|
|
|
57 |
|
|
(gdb) x /i $ra-4
|
58 |
|
|
<__sigtramp+160>: jsr ra,(a3),0x3ff800d0ed4 <_fpdata+36468>
|
59 |
|
|
|
60 |
|
|
# Look at the code around that return address, and eventually observe a
|
61 |
|
|
# significantly large chunk of *constant* code right before the call:
|
62 |
|
|
|
63 |
|
|
(gdb) x /10i $ra-44
|
64 |
|
|
<__sigtramp+120>: lda gp,-27988(gp)
|
65 |
|
|
<__sigtramp+124>: ldq at,-18968(gp)
|
66 |
|
|
<__sigtramp+128>: lda t0,-1
|
67 |
|
|
<__sigtramp+132>: stq t0,0(at)
|
68 |
|
|
<__sigtramp+136>: ldq at,-18960(gp)
|
69 |
|
|
<__sigtramp+140>: ldl t1,8(at)
|
70 |
|
|
<__sigtramp+144>: ldq at,-18960(gp)
|
71 |
|
|
<__sigtramp+148>: stl t1,12(at)
|
72 |
|
|
<__sigtramp+152>: ldq at,-18960(gp)
|
73 |
|
|
<__sigtramp+156>: stl t0,8(at)
|
74 |
|
|
|
75 |
|
|
# The hexadecimal equivalent that we will have to match is:
|
76 |
|
|
|
77 |
|
|
(gdb) x /10x $ra-44
|
78 |
|
|
<__sigtramp+120>: 0x23bd92ac 0xa79db5e8 0x203fffff 0xb43c0000
|
79 |
|
|
<__sigtramp+136>: 0xa79db5f0 0xa05c0008 0xa79db5f0 0xb05c000c
|
80 |
|
|
<__sigtramp+152>: 0xa79db5f0 0xb03c0008
|
81 |
|
|
|
82 |
|
|
The problem observed on this target with this approach is that although
|
83 |
|
|
we found a constant set of instruction patterns there were some
|
84 |
|
|
gp-related offsets that made the machine code to differ from one
|
85 |
|
|
installation to another. This problem could have been overcome by masking
|
86 |
|
|
these offsets, but we found that it would be simpler and more efficient to
|
87 |
|
|
check whether the return address was part of a signal handler, by comparing
|
88 |
|
|
it against some expected code offset from __sigtramp.
|
89 |
|
|
|
90 |
|
|
# Check that we indeed have something we expect: the instruction
|
91 |
|
|
# right before the return address is within a __sigtramp
|
92 |
|
|
# function and is a call. We also need to obtain the offset
|
93 |
|
|
# between the return address and the start address of __sigtramp.
|
94 |
|
|
|
95 |
|
|
[... run gdb and break at the signal handler entry ...]
|
96 |
|
|
|
97 |
|
|
(gdb) x /2i $ra-4
|
98 |
|
|
<__sigtramp+160>: jsr ra,(a3),0x3ff800d0ed4 <_fpdata+36468>
|
99 |
|
|
<__sigtramp+164>: ldah gp,16381(ra)
|
100 |
|
|
|
101 |
|
|
(gdb) p (long)$ra - (long)&__sigtramp
|
102 |
|
|
$2 = 164
|
103 |
|
|
|
104 |
|
|
--------------------------------------------------------------------------
|
105 |
|
|
|
106 |
|
|
2/ Once we know we are going through a signal handler, we need a way to
|
107 |
|
|
retrieve information about the interrupted run-time context.
|
108 |
|
|
|
109 |
|
|
On this platform, the third handler's argument is a pointer to a structure
|
110 |
|
|
describing this context (struct sigcontext *). We unfortunately have no
|
111 |
|
|
direct way to transfer this value here, so a couple of tricks are required
|
112 |
|
|
to compute it.
|
113 |
|
|
|
114 |
|
|
As documented at least in some header files (e.g. sys/machine/context.h),
|
115 |
|
|
the structure the handler gets a pointer to is located on the stack. As of
|
116 |
|
|
today, while writing this macro, we have unfortunately not been able to
|
117 |
|
|
find a detailed description of the full stack layout at handler entry time,
|
118 |
|
|
so we'll have to resort to empirism :)
|
119 |
|
|
|
120 |
|
|
When unwinding here, we have the handler's CFA at hand, as part of the
|
121 |
|
|
current unwinding context which is one of our arguments. We presume that
|
122 |
|
|
for each call to a signal handler by the same kernel routine, the context's
|
123 |
|
|
structure location on the stack is always at the same offset from the
|
124 |
|
|
handler's CFA, and we compute that offset from bare observation:
|
125 |
|
|
|
126 |
|
|
For the simple case of a bare null dereference in a single-threaded app,
|
127 |
|
|
computing the offset was done using GNAT like this:
|
128 |
|
|
|
129 |
|
|
# Break on the first handler's instruction, before the prologue to have the
|
130 |
|
|
# CFA in $sp, and get there:
|
131 |
|
|
|
132 |
|
|
(gdb) b *&__gnat_error_handler
|
133 |
|
|
Breakpoint 1 at 0x120016090: file init.c, line 378.
|
134 |
|
|
|
135 |
|
|
(gdb) r
|
136 |
|
|
Program received signal SIGSEGV, Segmentation fault.
|
137 |
|
|
|
138 |
|
|
(gdb) c
|
139 |
|
|
Breakpoint 1, __gnat_error_handler (sig=..., sip=..., context=...)
|
140 |
|
|
|
141 |
|
|
# The displayed argument value are meaningless because we stopped before
|
142 |
|
|
# their final "homing". We know they are passed through $a0, $a1 and $a2
|
143 |
|
|
# from the ABI, though, so ...
|
144 |
|
|
|
145 |
|
|
# Observe that $sp and the context pointer are in the same (stack) area,
|
146 |
|
|
# and compute the offset:
|
147 |
|
|
|
148 |
|
|
(gdb) p /x $sp
|
149 |
|
|
$2 = 0x11fffbc80
|
150 |
|
|
|
151 |
|
|
(gdb) p /x $a2
|
152 |
|
|
$3 = 0x11fffbcf8
|
153 |
|
|
|
154 |
|
|
(gdb) p /x (long)$a2 - (long)$sp
|
155 |
|
|
$4 = 0x78
|
156 |
|
|
|
157 |
|
|
--------------------------------------------------------------------------
|
158 |
|
|
|
159 |
|
|
3/ Once we know we are unwinding through a signal handler and have the
|
160 |
|
|
address of the structure describing the interrupted context at hand, we
|
161 |
|
|
have to fill the internal frame-state/unwind-context structures properly
|
162 |
|
|
to allow the unwinding process to proceed.
|
163 |
|
|
|
164 |
|
|
Roughly, we are provided with an *unwinding* CONTEXT, describing the state
|
165 |
|
|
of some point P in the call chain we are unwinding through. The macro we
|
166 |
|
|
implement has to fill a "frame state" structure FS that describe the P's
|
167 |
|
|
caller state, by way of *rules* to compute its CFA, return address, and
|
168 |
|
|
**saved** registers *locations*.
|
169 |
|
|
|
170 |
|
|
For the case we are going to deal with, the caller is some kernel code
|
171 |
|
|
calling a signal handler, and:
|
172 |
|
|
|
173 |
|
|
o The saved registers are all in the interrupted run-time context,
|
174 |
|
|
|
175 |
|
|
o The CFA is the stack pointer value when the kernel code is entered, that
|
176 |
|
|
is, the stack pointer value at the interruption point, also part of the
|
177 |
|
|
interrupted run-time context.
|
178 |
|
|
|
179 |
|
|
o We want the return address to appear as the address of the active
|
180 |
|
|
instruction at the interruption point, so that the unwinder proceeds as
|
181 |
|
|
if the interruption had been a regular call. This address is also part
|
182 |
|
|
of the interrupted run-time context.
|
183 |
|
|
|
184 |
|
|
--
|
185 |
|
|
|
186 |
|
|
Also, note that there is an important difference between the return address
|
187 |
|
|
we need to claim for the kernel frame and the value of the return address
|
188 |
|
|
register at the interruption point.
|
189 |
|
|
|
190 |
|
|
The latter might be required to be able to unwind past the interrupted
|
191 |
|
|
routine, for instance if it is interrupted before saving the incoming
|
192 |
|
|
register value in its own frame, which may typically happen during stack
|
193 |
|
|
probes for stack-checking purposes.
|
194 |
|
|
|
195 |
|
|
It is then essential that the rules stated to locate the kernel frame
|
196 |
|
|
return address don't clobber the rules describing where is saved the return
|
197 |
|
|
address register at the interruption point, so some scratch register state
|
198 |
|
|
entry should be used for the former. We have DWARF_ALT_FRAME_RETURN_COLUMN
|
199 |
|
|
at hand exactly for that purpose.
|
200 |
|
|
|
201 |
|
|
--------------------------------------------------------------------------
|
202 |
|
|
|
203 |
|
|
4/ Depending on the context (single-threaded or multi-threaded app, ...),
|
204 |
|
|
the code calling the handler and the handler-cfa to interrupted-context
|
205 |
|
|
offset might change, so we use a simple generic data structure to track
|
206 |
|
|
the possible variants. */
|
207 |
|
|
|
208 |
|
|
/* This is the structure to wrap information about each possible sighandler
|
209 |
|
|
caller we may have to identify. */
|
210 |
|
|
|
211 |
|
|
typedef struct {
|
212 |
|
|
/* Expected return address when being called from a sighandler. */
|
213 |
|
|
void *ra_value;
|
214 |
|
|
|
215 |
|
|
/* Offset to get to the sigcontext structure from the handler's CFA
|
216 |
|
|
when the pattern matches. */
|
217 |
|
|
int cfa_to_context_offset;
|
218 |
|
|
|
219 |
|
|
} sighandler_call_t;
|
220 |
|
|
|
221 |
|
|
/* Helper macro for MD_FALLBACK_FRAME_STATE_FOR below.
|
222 |
|
|
|
223 |
|
|
Look at RA to see if it matches within a sighandler caller.
|
224 |
|
|
Set SIGCTX to the corresponding sigcontext structure (computed from
|
225 |
|
|
CFA) if it does, or to 0 otherwise. */
|
226 |
|
|
|
227 |
|
|
#define COMPUTE_SIGCONTEXT_FOR(RA,CFA,SIGCTX) \
|
228 |
|
|
do { \
|
229 |
|
|
/* Define and register the applicable patterns. */ \
|
230 |
|
|
extern void __sigtramp (void); \
|
231 |
|
|
\
|
232 |
|
|
sighandler_call_t sighandler_calls [] = { \
|
233 |
|
|
{__sigtramp + 164, 0x78} \
|
234 |
|
|
}; \
|
235 |
|
|
\
|
236 |
|
|
int n_patterns_to_match \
|
237 |
|
|
= sizeof (sighandler_calls) / sizeof (sighandler_call_t); \
|
238 |
|
|
\
|
239 |
|
|
int pn; /* pattern number */ \
|
240 |
|
|
\
|
241 |
|
|
int match = 0; /* Did last pattern match ? */ \
|
242 |
|
|
\
|
243 |
|
|
/* Try to match each pattern in turn. */ \
|
244 |
|
|
for (pn = 0; !match && pn < n_patterns_to_match; pn ++) \
|
245 |
|
|
match = ((RA) == sighandler_calls[pn].ra_value); \
|
246 |
|
|
\
|
247 |
|
|
(SIGCTX) = (struct sigcontext *) \
|
248 |
|
|
(match ? ((CFA) + sighandler_calls[pn - 1].cfa_to_context_offset) : 0); \
|
249 |
|
|
} while (0);
|
250 |
|
|
|
251 |
|
|
#include <sys/context_t.h>
|
252 |
|
|
|
253 |
|
|
#define REG_SP 30 /* hard reg for stack pointer */
|
254 |
|
|
#define REG_RA 26 /* hard reg for return address */
|
255 |
|
|
|
256 |
|
|
#define MD_FALLBACK_FRAME_STATE_FOR alpha_fallback_frame_state
|
257 |
|
|
|
258 |
|
|
static _Unwind_Reason_Code
|
259 |
|
|
alpha_fallback_frame_state (struct _Unwind_Context *context,
|
260 |
|
|
_Unwind_FrameState *fs)
|
261 |
|
|
{
|
262 |
|
|
/* Return address and CFA of the frame we're attempting to unwind through,
|
263 |
|
|
possibly a signal handler. */
|
264 |
|
|
void *ctx_ra = (void *)context->ra;
|
265 |
|
|
void *ctx_cfa = (void *)context->cfa;
|
266 |
|
|
|
267 |
|
|
/* CFA of the intermediate abstract kernel frame between the interrupted
|
268 |
|
|
code and the signal handler, if we're indeed unwinding through a signal
|
269 |
|
|
handler. */
|
270 |
|
|
void *k_cfa;
|
271 |
|
|
|
272 |
|
|
/* Pointer to the sigcontext structure pushed by the kernel when we're
|
273 |
|
|
unwinding through a signal handler. */
|
274 |
|
|
struct sigcontext *sigctx;
|
275 |
|
|
int i;
|
276 |
|
|
|
277 |
|
|
COMPUTE_SIGCONTEXT_FOR (ctx_ra, ctx_cfa, sigctx);
|
278 |
|
|
|
279 |
|
|
if (sigctx == 0)
|
280 |
|
|
return _URC_END_OF_STACK;
|
281 |
|
|
|
282 |
|
|
/* The kernel frame's CFA is exactly the stack pointer value at the
|
283 |
|
|
interruption point. */
|
284 |
|
|
k_cfa = (void *) sigctx->sc_regs [REG_SP];
|
285 |
|
|
|
286 |
|
|
/* State the rules to compute the CFA we have the value of: use the
|
287 |
|
|
previous CFA and offset by the difference between the two. See
|
288 |
|
|
uw_update_context_1 for the supporting details. */
|
289 |
|
|
fs->regs.cfa_how = CFA_REG_OFFSET;
|
290 |
|
|
fs->regs.cfa_reg = __builtin_dwarf_sp_column ();
|
291 |
|
|
fs->regs.cfa_offset = k_cfa - ctx_cfa;
|
292 |
|
|
|
293 |
|
|
/* Fill the internal frame_state structure with information stating
|
294 |
|
|
where each register of interest in the saved context can be found
|
295 |
|
|
from the CFA. */
|
296 |
|
|
|
297 |
|
|
/* The general registers are in sigctx->sc_regs. Leave out r31, which
|
298 |
|
|
is read-as-zero. It makes no sense restoring it, and we are going to
|
299 |
|
|
use the state entry for the kernel return address rule below.
|
300 |
|
|
|
301 |
|
|
This loop must cover at least all the callee-saved registers, and
|
302 |
|
|
we just don't bother specializing the set here. */
|
303 |
|
|
for (i = 0; i <= 30; i ++)
|
304 |
|
|
{
|
305 |
|
|
fs->regs.reg[i].how = REG_SAVED_OFFSET;
|
306 |
|
|
fs->regs.reg[i].loc.offset
|
307 |
|
|
= (void *) &sigctx->sc_regs[i] - (void *) k_cfa;
|
308 |
|
|
}
|
309 |
|
|
|
310 |
|
|
/* Ditto for the floating point registers in sigctx->sc_fpregs. */
|
311 |
|
|
for (i = 0; i <= 31; i ++)
|
312 |
|
|
{
|
313 |
|
|
fs->regs.reg[32+i].how = REG_SAVED_OFFSET;
|
314 |
|
|
fs->regs.reg[32+i].loc.offset
|
315 |
|
|
= (void *) &sigctx->sc_fpregs[i] - (void *) k_cfa;
|
316 |
|
|
}
|
317 |
|
|
|
318 |
|
|
/* State the rules to find the kernel's code "return address", which
|
319 |
|
|
is the address of the active instruction when the signal was caught,
|
320 |
|
|
in sigctx->sc_pc. Use DWARF_ALT_FRAME_RETURN_COLUMN since the return
|
321 |
|
|
address register is a general register and should be left alone. */
|
322 |
|
|
fs->retaddr_column = DWARF_ALT_FRAME_RETURN_COLUMN;
|
323 |
|
|
fs->regs.reg[DWARF_ALT_FRAME_RETURN_COLUMN].how = REG_SAVED_OFFSET;
|
324 |
|
|
fs->regs.reg[DWARF_ALT_FRAME_RETURN_COLUMN].loc.offset
|
325 |
|
|
= (void *) &sigctx->sc_pc - (void *) k_cfa;
|
326 |
|
|
fs->signal_frame = 1;
|
327 |
|
|
|
328 |
|
|
return _URC_NO_REASON;
|
329 |
|
|
}
|