Re: [PATCHv3 1/3] fix matching errors for overwritten registers in x86 CFI generation script

[Rich Felker <dalias@libc.org>]

On Wed, Oct 14, 2015 at 12:21:05PM +0200, Alex wrote:
> On Wed, Oct 14, 2015 at 12:42 AM, Rich Felker <dalias@libc.org> wrote:
> 
> > On Tue, Oct 13, 2015 at 01:28:50PM +0200, Alex Dowad wrote:
> > > Here is the latest iteration. I have merged 2 previously separate
> > commits, and
> > > fixed up the matching of registers (for the purpose of identifying
> > overwritten
> > > registers).
> > >
> > > As usual, thanks for the feedback. AD
> >
> > Thanks! I'm committing them all now. I'm sorry for not catching this
> > before -- I realized that the index register thing was also an
> > existing bug in mov handling, not just a new bug added in the operand
> > order patch, so I split it out into a separate commit. I did basic
> > regression testing on i386 (making sure gdb backtrace from syscalls
> > still works) and tested that the x86_64 also seems to work (it does).
> 
> Thanks!
> 
> This has been an interesting exercise so far. Is there any other arch which
> you think it would be worthwhile to develop a CFI generation script for? It
> should be something which has enough users to avoid problems with bitrot.

CFI is probably a lot less interesting on archs where you have a
plenty registers not to need to manipulate stack frames in asm
functions, since in that case the debugger mostly works fine without
CFI. I don't know right off which of the other archs have significant
amounts of asm that adjusts the stack pointer, but you could go
through and check them. Having ABI info for them all would be helpful;
I'm pasting my draft ABI reference (which might have errors) below.

Rich




aarch64
...
x30 lr
x31 zr or pc

arm
r0-r3 args/ret
r4-r11 saved
r12 temp (ip scratch)
r13 sp
r14 lr
r15 pc

microblaze
r0 zero
r1 sp
r2 ro sda
r3-r4 ret
r5-r10 args
r11-12 temp
r13 rw sda
r14 syscall ret addr
r15 function ret addr
r16 break ret addr
r17 exception ret addr
r18 assembler temp
r19-r20 saved
r21 thread pointer
r21-r31 saved

mips (http://www.inf.ed.ac.uk/teaching/courses/car/Notes/slide03.pdf)
$0 zero
$1 at (assembler temp)
$2-$3 ret (aka v0-v1)
$4-$7 args (aka a0-a3)
$8-$15 temp (aka t0-t7)
$16-$23 saved (aka s0-s7
$24 temp (aka t8)
$25 function call addr (aka t9)
$26-$27 kernel use
$28 gp, call-clobbered
$29 sp
$30 fp
$31 ra

or1k (openrisc-arch-1.1-rev0.pdf p.335)
r0 zero
r1 sp
r2 fp
r3-r8 args
r9 lr
r11,r12 retval (lo,hi)
r10 thread pointer
r14-r30(even) saved
r13-r31(odd) temp

powerpc (http://www.csd.uwo.ca/~mburrel/stuff/ppc-asm.html http://devpit.org/wiki/Debugging_PowerPC_ELF_Binaries)
0 temp
1 sp
2 toc (thread pointer)
3 ret, arg0
4-10 args
11-12 temp
13-31 saved
lr (not gpr; use mtlr/mflr)
30 got
11 plt temp
ctr plt temp

superh (http://www.st.com/st-web-ui/static/active/en/resource/technical/document/reference_manual/CD17839242.pdf p.9)
(http://shared-ptr.com/sh_insns.html)
r0-r3 ret
r2 struct ret addr
r4-r7 args
r8-r13 saved
r12 gp (saved)
r14 fp (saved)
r15 sp
pr lr
gbr thread ptr