6

I'm trying to understand exactly how the exception table (.arm.extab) works. I'm aware that this is compiler dependent, so I'll restrict myself to armcc (as I'm using Keil).

A typical entry in the table looks something like: b0aa0380 2a002c00 01000000 00000000

To my understanding, the first word encodes instructions for the personality routine, while the third word is a R_ARM_PREL31 relocation to the start of the catch block.

What baffles me is the second word - it appears to be split into 2 shorts, the second of which measures some distance from the start of the throwing function, but I'm not sure exactly to what (nor what the first short does).

Is there any place where the structure of these entries is documented?

I've found 2 relevant documents, but as far as I can see they have no compiler-dependent information, so they're not sufficient:

AJM
  • 1,317
  • 2
  • 15
  • 30
Tal Ben-Porath
  • 135
  • 1
  • 5
  • Are you sure you have the byte ordering correct. Ie, the first value is `0xb0aa0380` and not the litte-endian `0x8003aab0`? – artless noise Aug 11 '19 at 18:15
  • I found that both g++ and clang use the 'generic' method. For instance _Unwind_Control_Block.exception_class is "GNUCC++\0", "CLNGC++\0", or "ARM\0C++\0". [clang](https://github.com/llvm-mirror/libcxxabi/blob/master/src/cxa_exception.cpp), [gcc](https://github.com/gcc-mirror/gcc/blob/master/libstdc%2B%2B-v3/libsupc%2B%2B/unwind-cxx.h#L262) This allows operability. libgcc/libsupc++ have configuration to change the exception method, but it defaults to the one in the *ehabi* document. I can't see why keil would do something else, but it is possible. – artless noise Aug 12 '19 at 21:39
  • The links are out of date (both leading to a 404), but I'm not sure about editing newer ones in, because I don't think there are any URLs that always point to the "latest" versions of them. – AJM Aug 08 '22 at 12:14
  • The first one is a link to "ELF for the ARM Architecture." The current version can be found at https://github.com/ARM-software/abi-aa/releases/download/2022Q1/aaelf32.pdf - and it looks like there's always a link to the latest if you go to https://github.com/ARM-software/abi-aa/releases and do a Ctrl-F for the document title. – AJM Aug 08 '22 at 12:16
  • The second document is "Exception Handling ABI for the Arm®Architecture". Again, the latest download link can be found at https://github.com/ARM-software/abi-aa/releases - and the current version of the document is https://github.com/ARM-software/abi-aa/releases/download/2022Q1/ehabi32.pdf – AJM Aug 08 '22 at 12:22

1 Answers1

2

If you happen to have the byte ordering missed up, the below applies. Some information is probably useful even if the byte-order is correct in your original example.

extab and exidx are sections added by the AAPCS which is a newer ARM ABI.

For the older APCS, the frame pointer or fp is a root of a linked of the active routine back to the main routine (or _start). With AAPCS records are created and placed in the exidx and extab sections. These are needed to unwind stacks (and resources) when the fp is used as a generic register.

The exidx is an ordered table of routine start addresses and an extab index (or can't unwind). A PC (program counter) can be examined and search via the table to find the corresponding extab entry.

The ARM EHABI documentation has a section 7 on Exception-handling Table entries. These are extab entries and you can at least start from there to learn more. There are two defined,

  1. Generic (or C++)
  2. ARM compact

The compact model will be used for most 'C' code. There are no objects to be destroyed on the stack as with C++. The hex 8003aab0 gives,

  • 1000b for the leading nibble, so this is compact.
  • 0000b for the index. Su16—Short
  • 03h - pop 16 bytes, some locals or padding.
  • aah - pop r4-r6
  • b0h - finish

Table 4, ARM-defined frame-unwinding instructions gives the unwinding data of each byte.

The next is 0x002c002a which is an offset to the generic personality routine. The next four values should be the 8.2 Data Structures, which are a size and should be zero... Next would be stride and then a four byte object type info. The offset 0x2c002a would be to call the objects destructor or some sort of wrapper to do this.

I think all C++ code is intended to use this Generic method. Other methods are for different languages and NOT compilers.

Related Q/A and links:

AJM
  • 1,317
  • 2
  • 15
  • 30
artless noise
  • 21,212
  • 6
  • 68
  • 105