1 /* Target-dependent code for GDB, the GNU debugger.
2 Copyright (C) 1986, 1987, 1989, 1991 Free Software Foundation, Inc.
4 This file is part of GDB.
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
29 #include <sys/param.h>
33 #include <sys/ioctl.h>
36 #include <sys/ptrace.h>
45 extern int attach_flag;
47 /* Nonzero if we just simulated a single step break. */
52 /* This is Damon's implementation of single step simulation. It suffers the
58 4 strcmp (buf, "test"); puts ("test");
62 You cannot `next' on line 4 in the above program. gdb puts a breakpoint
63 to the return address of `strcmp', and when execution arrives that point,
64 it is still in the line range and gdb attemps to resume it with single
65 steps. At that point the breakpoint at step_resume_break_address (return
66 address of strcmp) and single step's breakpoint mixes up and we end up
67 with a breakpoint which its shadow and itself are identical.
69 Fix that problem and use this version. FIXMEmgo.
73 static struct sstep_breaks {
80 * branch_dest - calculate all places the current instruction may go
84 register struct sstep_breaks *tb;
86 register ulong opcode, iar;
88 int immediate, absolute;;
90 iar = read_pc(); /* current IAR */
91 target_read_memory(iar, &instr, sizeof (instr)); /* current inst */
99 case 0x10: /* branch conditional */
100 immediate = ((instr & ~3) << 16) >> 16;
103 * two possible locations for next instruction
105 tb[0].address = iar + 4;
106 tb[1].address = immediate + (absolute ? 0 : iar);
110 case 0x12: /* branch unconditional */
111 immediate = ((instr & ~3) << 6) >> 6;
114 * only one possible location for next instr
116 tb[0].address = immediate + (absolute ? 0 : iar);
120 case 0x13: /* branch conditional register */
122 * WE NEED TO CHECK THE CR HERE, TO SEE IF THIS IS
123 * REALLY UNCONDITIONAL.
125 tb++->address = iar + 4;
127 switch ((instr >> 1) & 0x3ff) {
128 case 0x10: /* branch conditional register */
129 tb->address = read_register(LR_REGNUM) & ~3;
130 sigtramp_chk(tb); /* return from sig handler? */
133 case 0x210: /* branch cond to CTR */
134 tb->address = read_register(CTR_REGNUM) & ~3;
135 sigtramp_chk(tb); /* return from sig handler? */
142 tb->address = iar + 4;
149 * not a branch, flow proceeds normally
151 tb->address = iar + 4;
157 * sigtramp_chk - heuristic check to see if we think we are returning
158 * from a signal handler.
161 * tb - ^ to a single step branch location
164 * When we are at the "br" instruction returning to a signal handler,
165 * we return in user mode to an address in the kernel. If the
166 * segment of the branch target is 0, we may very well be in a
167 * signal handler. From scrounging through this code, we note that
168 * register 29 has the signal context pointer, from which we can
169 * determine where we will end up next.
172 register struct sstep_breaks *tb; {
173 struct sigcontext sc;
175 if (tb->address & 0xf0000000)
176 return; /* can't have been sigtramp */
178 if (target_read_memory(read_register(GPR29), &sc, sizeof (sc)))
179 return; /* read fails, heuristic fails */
181 if ((sc.sc_jmpbuf.jmp_context.iar & 0xf0000000) == 0x10000000) {
183 * looks like it might be ok.....
185 tb->address = sc.sc_jmpbuf.jmp_context.iar;
191 * single_step - no trace mode harware support, or software support.
194 single_step(signal) {
199 * need to set breakpoints for single step.
200 * figure out all places the current instruction could go.
202 branch_dest(&tbreak[0]);
205 * always at least one place to go to
207 target_insert_breakpoint(tbreak[0].address, &tbreak[0].data);
210 * if there is another possible location, set a breakpoint there
213 if (tbreak[1].address != -1)
214 target_insert_breakpoint(tbreak[1].address, &tbreak[1].data);
217 ptrace(PT_CONTINUE, inferior_pid, 1, signal, 0);
220 * need to clear the breakpoints.
222 for (i = 0; i < 2; ++i)
223 if (tbreak[i].address != -1)
224 target_remove_breakpoint(tbreak[i].address, &tbreak[i].data);
232 #else /* !DAMON'S VERSION */
234 /* Breakpoint shadows for the single step instructions will be kept here. */
236 static struct sstep_breaks {
243 * Calculate the destination of a branch/jump. Return -1 if not a branch.
246 branch_dest (opcode, instr, pc, safety)
247 int opcode, instr, pc, safety;
249 register long offset;
255 absolute = (int) ((instr >> 1) & 1);
259 immediate = ((instr & ~3) << 6) >> 6; /* br unconditionl */
262 if (opcode != 18) /* br conditional */
263 immediate = ((instr & ~3) << 16) >> 16;
267 dest = pc + immediate;
271 ext_op = (instr>>1) & 0x3ff;
273 if (ext_op == 16) /* br conditional register */
274 dest = read_register (LR_REGNUM) & ~3;
276 else if (ext_op == 528) /* br cond to count reg */
277 dest = read_register (CTR_REGNUM) & ~3;
284 return (dest < 0x10000000) ? safety : dest;
289 /* AIX does not support PT_STEP. Simulate it. */
295 #define INSNLEN(OPCODE) 4
297 static char breakp[] = BREAKPOINT;
298 int ii, insn, ret, loc;
299 int breaks[2], opcode;
302 extern CORE_ADDR text_start;
305 ret = read_memory (loc, &insn, sizeof (int));
307 printf ("Error in single_step()!!\n");
309 breaks[0] = loc + INSNLEN(insn);
311 breaks[1] = branch_dest (opcode, insn, loc, breaks[0]);
313 stepBreaks[1].address = -1;
315 for (ii=0; ii < 2; ++ii) {
317 /* ignore invalid breakpoint. */
318 if ( breaks[ii] == -1)
321 read_memory (breaks[ii], &(stepBreaks[ii].data), sizeof(int));
323 ret = write_memory (breaks[ii], breakp, sizeof(int));
324 stepBreaks[ii].address = breaks[ii];
328 ptrace (PT_CONTINUE, inferior_pid, 1, signal);
332 /* remove step breakpoints. */
333 for (ii=0; ii < 2; ++ii)
334 if (stepBreaks[ii].address != -1)
336 (stepBreaks[ii].address, &(stepBreaks[ii].data), sizeof(int));
342 #endif /* !DAMON's version of single step. */
346 /* return pc value after skipping a function prologue. */
354 if (target_read_memory (pc, (char *)&op, sizeof (op)))
355 return pc; /* Can't access it -- assume no prologue. */
356 SWAP_TARGET_AND_HOST (&op, sizeof (op));
358 /* Assume that subsequent fetches can fail with low probability. */
360 if (op == 0x7c0802a6) { /* mflr r0 */
362 op = read_memory_integer (pc, 4);
364 else /* else, this is a frameless invocation */
367 if ((op & 0xfc00003e) == 0x7c000026) { /* mfcr Rx */
369 op = read_memory_integer (pc, 4);
372 if ((op & 0xfc000000) == 0x48000000) { /* bl foo, to save fprs??? */
374 op = read_memory_integer (pc, 4);
377 if ((op & 0xfc1f0000) == 0xd8010000) { /* stfd Rx,NUM(r1) */
378 pc += 4; /* store floating register double */
379 op = read_memory_integer (pc, 4);
382 if ((op & 0xfc1f0000) == 0xbc010000) { /* stm Rx, NUM(r1) */
384 op = read_memory_integer (pc, 4);
387 while (((tmp = op >> 16) == 0x9001) || /* st r0, NUM(r1) */
388 (tmp == 0x9421) || /* stu r1, NUM(r1) */
389 (op == 0x93e1fffc)) /* st r31,-4(r1) */
392 op = read_memory_integer (pc, 4);
395 while ((tmp = (op >> 22)) == 0x20f) { /* l r31, ... or */
396 pc += 4; /* l r30, ... */
397 op = read_memory_integer (pc, 4);
400 while ((op & 0xfc1f0000) == 0x90010000) { /* st r?, NUM(r1) */
402 op = read_memory_integer (pc, 4);
405 if (op == 0x603f0000) { /* oril r31, r1, 0x0 */
406 pc += 4; /* this happens if r31 is used as */
407 op = read_memory_integer (pc, 4); /* frame ptr. (gcc does that) */
409 if ((op >> 16) == 0x907f) { /* st r3, NUM(r31) */
411 op = read_memory_integer (pc, 4);
417 /* text start and end addresses in virtual memory. */
419 CORE_ADDR text_start;
423 /*************************************************************************
424 Support for creating pushind a dummy frame into the stack, and popping
426 *************************************************************************/
428 #define DUMMY_FRAME_ADDR_SIZE 10
430 /* Make sure you initialize these in somewhere, in case gdb gives up what it
431 was debugging and starts debugging something else. FIXMEmgo */
433 static int dummy_frame_count = 0;
434 static int dummy_frame_size = 0;
435 static CORE_ADDR *dummy_frame_addr = 0;
437 extern int stop_stack_dummy;
439 /* push a dummy frame into stack, save all register. Currently we are saving
440 only gpr's and fpr's, which is not good enough! FIXMEmgo */
444 int sp, pc; /* stack pointer and link register */
447 if (dummy_frame_count >= dummy_frame_size) {
448 dummy_frame_size += DUMMY_FRAME_ADDR_SIZE;
449 if (dummy_frame_addr)
450 dummy_frame_addr = (CORE_ADDR*) xrealloc
451 (dummy_frame_addr, sizeof(CORE_ADDR) * (dummy_frame_size));
453 dummy_frame_addr = (CORE_ADDR*)
454 xmalloc (sizeof(CORE_ADDR) * (dummy_frame_size));
457 sp = read_register(SP_REGNUM);
458 pc = read_register(PC_REGNUM);
460 dummy_frame_addr [dummy_frame_count++] = sp;
462 /* Be careful! If the stack pointer is not decremented first, then kernel
463 thinks he is free to use the sapce underneath it. And kernel actually
464 uses that area for IPC purposes when executing ptrace(2) calls. So
465 before writing register values into the new frame, decrement and update
466 %sp first in order to secure your frame. */
468 write_register (SP_REGNUM, sp-408);
471 /* gdb relies on the state of current_frame. We'd better update it,
472 otherwise things like do_registers_info() wouldn't work properly! */
474 flush_cached_frames ();
475 set_current_frame (create_new_frame (sp-408, pc));
478 /* save program counter in link register's space. */
479 write_memory (sp+8, &pc, 4);
481 /* save full floating point registers here. They will be from F14..F31
482 for know. I am not sure if we need to save everything here! */
485 for (ii = 0; ii < 32; ++ii)
486 write_memory (sp-8-(ii*8), ®isters[REGISTER_BYTE (31-ii+FP0_REGNUM)], 8);
489 for (ii=1; ii <=32; ++ii)
490 write_memory (sp-256-(ii*4), ®isters[REGISTER_BYTE (32-ii)], 4);
492 /* so far, 32*2 + 32 words = 384 bytes have been written. We need 6 words
493 (24 bytes) for the rest of the registers. It brings the total to 408
495 save sp or so call back chain right here. */
496 write_memory (sp-408, &sp, 4);
499 /* And finally, this is the back chain. */
500 write_memory (sp+8, &pc, 4);
504 /* Pop a dummy frame.
506 In rs6000 when we push a dummy frame, we save all of the registers. This
507 is usually done before user calls a function explicitly.
509 After a dummy frame is pushed, some instructions are copied into stack, and
510 stack pointer is decremented even more. Since we don't have a frame pointer to
511 get back to the parent frame of the dummy, we start having trouble poping it.
512 Therefore, we keep a dummy frame stack, keeping addresses of dummy frames as
513 such. When poping happens and when we detect that was a dummy frame, we pop
514 it back to its parent by using dummy frame stack (`dummy_frame_addr' array).
521 sp = dummy_frame_addr [--dummy_frame_count];
523 /* restore all fpr's. */
524 for (ii = 1; ii <= 32; ++ii)
525 read_memory (sp-(ii*8), ®isters[REGISTER_BYTE (32-ii+FP0_REGNUM)], 8);
527 /* restore all gpr's */
528 for (ii=1; ii <= 32; ++ii) {
529 read_memory (sp-256-(ii*4), ®isters[REGISTER_BYTE (32-ii)], 4);
532 read_memory (sp-400, ®isters [REGISTER_BYTE(PC_REGNUM)], 4);
534 /* when a dummy frame was being pushed, we had to decrement %sp first, in
535 order to secure astack space. Thus, saved %sp (or %r1) value, is not the
536 one we should restore. Change it with the one we need. */
538 *(int*)®isters [REGISTER_BYTE(FP_REGNUM)] = sp;
540 /* Now we can restore all registers. */
542 store_inferior_registers (-1);
544 flush_cached_frames ();
545 set_current_frame (create_new_frame (sp, pc));
549 /* pop the innermost frame, go back to the caller. */
553 int pc, lr, sp, prev_sp; /* %pc, %lr, %sp */
554 FRAME fr = get_current_frame ();
556 int frameless = 0; /* TRUE if function is frameless */
558 int saved_gpr, saved_fpr; /* # of saved gpr's and fpr's */
563 if (stop_stack_dummy && dummy_frame_count) {
568 /* figure out previous %pc value. If the function is frameless, it is
569 still in the link register, otherwise walk the frames and retrieve the
570 saved %pc value in the previous frame. */
572 addr = get_pc_function_start (fr->pc) + FUNCTION_START_OFFSET;
573 function_frame_info (addr, &frameless, &offset, &saved_gpr, &saved_fpr);
575 read_memory (sp, &prev_sp, 4);
577 lr = read_register (LR_REGNUM);
579 read_memory (prev_sp+8, &lr, 4);
581 /* reset %pc value. */
582 write_register (PC_REGNUM, lr);
584 /* reset register values if any was saved earlier. */
585 addr = prev_sp - offset;
588 for (ii=saved_gpr; ii <= 31; ++ii) {
589 read_memory (addr, ®isters [REGISTER_BYTE (ii)], 4);
590 addr += sizeof (int);
594 for (ii=saved_fpr; ii <= 31; ++ii) {
595 read_memory (addr, ®isters [REGISTER_BYTE (ii+FP0_REGNUM)], 8);
599 write_register (SP_REGNUM, prev_sp);
600 store_inferior_registers (-1);
601 flush_cached_frames ();
602 set_current_frame (create_new_frame (prev_sp, lr));
606 /* fixup the call sequence of a dummy function, with the real function address.
607 its argumets will be passed by gdb. */
609 fix_call_dummy(dummyname, pc, fun, nargs, type)
613 int nargs; /* not used */
614 int type; /* not used */
617 #define TOC_ADDR_OFFSET 20
618 #define TARGET_ADDR_OFFSET 28
621 unsigned long target_addr;
622 unsigned long tocvalue;
625 tocvalue = find_toc_address (target_addr);
627 ii = *(int*)((char*)dummyname + TOC_ADDR_OFFSET);
628 ii = (ii & 0xffff0000) | (tocvalue >> 16);
629 *(int*)((char*)dummyname + TOC_ADDR_OFFSET) = ii;
631 ii = *(int*)((char*)dummyname + TOC_ADDR_OFFSET+4);
632 ii = (ii & 0xffff0000) | (tocvalue & 0x0000ffff);
633 *(int*)((char*)dummyname + TOC_ADDR_OFFSET+4) = ii;
635 ii = *(int*)((char*)dummyname + TARGET_ADDR_OFFSET);
636 ii = (ii & 0xffff0000) | (target_addr >> 16);
637 *(int*)((char*)dummyname + TARGET_ADDR_OFFSET) = ii;
639 ii = *(int*)((char*)dummyname + TARGET_ADDR_OFFSET+4);
640 ii = (ii & 0xffff0000) | (target_addr & 0x0000ffff);
641 *(int*)((char*)dummyname + TARGET_ADDR_OFFSET+4) = ii;
646 /* return information about a function frame.
647 - frameless is TRUE, if function does not save %pc value in its frame.
648 - offset is the number of bytes used in the frame to save registers.
649 - saved_gpr is the number of the first saved gpr.
650 - saved_fpr is the number of the first saved fpr.
652 function_frame_info (pc, frameless, offset, saved_gpr, saved_fpr)
654 int *frameless, *offset, *saved_gpr, *saved_fpr;
657 register unsigned int op;
660 *saved_gpr = *saved_fpr = -1;
665 op = read_memory_integer (pc, 4);
666 if (op == 0x7c0802a6) { /* mflr r0 */
668 op = read_memory_integer (pc, 4);
671 else /* else, this is a frameless invocation */
675 if ((op & 0xfc00003e) == 0x7c000026) { /* mfcr Rx */
677 op = read_memory_integer (pc, 4);
680 if ((op & 0xfc000000) == 0x48000000) { /* bl foo, to save fprs??? */
682 op = read_memory_integer (pc, 4);
685 if ((op & 0xfc1f0000) == 0xd8010000) { /* stfd Rx,NUM(r1) */
686 pc += 4; /* store floating register double */
687 op = read_memory_integer (pc, 4);
690 if ((op & 0xfc1f0000) == 0xbc010000) { /* stm Rx, NUM(r1) */
692 *saved_gpr = (op >> 21) & 0x1f;
695 tmp2 = 0xffff0000 | tmp2;
699 *saved_fpr = (tmp2 - ((32 - *saved_gpr) * 4)) / 8;
701 *saved_fpr = 32 - *saved_fpr;
710 /* Pass the arguments in either registers, or in the stack. In RS6000, the first
711 eight words of the argument list (that might be less than eight parameters if
712 some parameters occupy more than one word) are passed in r3..r11 registers.
713 float and double parameters are passed in fpr's, in addition to that. Rest of
714 the parameters if any are passed in user stack. There might be cases in which
715 half of the parameter is copied into registers, the other half is pushed into
718 If the function is returning a structure, then the return address is passed
719 in r3, then the first 7 words of the parametes can be passed in registers,
723 push_arguments (nargs, args, sp, struct_return, struct_addr)
728 CORE_ADDR struct_addr;
731 int argno; /* current argument number */
732 int argbytes; /* current argument byte */
733 char tmp_buffer [50];
735 int f_argno = 0; /* current floating point argno */
737 CORE_ADDR saved_sp, pc;
739 if ( dummy_frame_count <= 0)
740 printf ("FATAL ERROR -push_arguments()! frame not found!!\n");
742 /* The first eight words of ther arguments are passed in registers. Copy
745 If the function is returning a `struct', then the first word (which
746 will be passed in r3) is used for struct return address. In that
747 case we should advance one word and start from r4 register to copy
750 ii = struct_return ? 1 : 0;
752 for (argno=0, argbytes=0; argno < nargs && ii<8; ++ii) {
754 arg = value_arg_coerce (args[argno]);
755 len = TYPE_LENGTH (VALUE_TYPE (arg));
757 if (TYPE_CODE (VALUE_TYPE (arg)) == TYPE_CODE_FLT) {
759 /* floating point arguments are passed in fpr's, as well as gpr's.
760 There are 13 fpr's reserved for passing parameters. At this point
761 there is no way we would run out of them. */
765 "Fatal Error: a floating point parameter #%d with a size > 8 is found!\n", argno);
767 bcopy (VALUE_CONTENTS (arg),
768 ®isters[REGISTER_BYTE(FP0_REGNUM + 1 + f_argno)], len);
774 /* Argument takes more than one register. */
775 while (argbytes < len) {
777 *(int*)®isters[REGISTER_BYTE(ii+3)] = 0;
778 bcopy ( ((char*)VALUE_CONTENTS (arg))+argbytes,
779 ®isters[REGISTER_BYTE(ii+3)],
780 (len - argbytes) > 4 ? 4 : len - argbytes);
784 goto ran_out_of_registers_for_arguments;
789 else { /* Argument can fit in one register. No problem. */
790 *(int*)®isters[REGISTER_BYTE(ii+3)] = 0;
791 bcopy (VALUE_CONTENTS (arg), ®isters[REGISTER_BYTE(ii+3)], len);
796 ran_out_of_registers_for_arguments:
798 /* location for 8 parameters are always reserved. */
801 /* another six words for back chain, TOC register, link register, etc. */
804 /* if there are more arguments, allocate space for them in
805 the stack, then push them starting from the ninth one. */
807 if ((argno < nargs) || argbytes) {
812 space += ((len - argbytes + 3) & -4);
818 for (; jj < nargs; ++jj) {
819 val = value_arg_coerce (args[jj]);
820 space += ((TYPE_LENGTH (VALUE_TYPE (val))) + 3) & -4;
823 /* add location required for the rest of the parameters */
824 space = (space + 7) & -8;
827 /* This is another instance we need to be concerned about securing our
828 stack space. If we write anything underneath %sp (r1), we might conflict
829 with the kernel who thinks he is free to use this area. So, update %sp
830 first before doing anything else. */
832 write_register (SP_REGNUM, sp);
836 flush_cached_frames ();
837 set_current_frame (create_new_frame (sp, pc));
840 /* if the last argument copied into the registers didn't fit there
841 completely, push the rest of it into stack. */
845 sp+24+(ii*4), ((char*)VALUE_CONTENTS (arg))+argbytes, len - argbytes);
847 ii += ((len - argbytes + 3) & -4) / 4;
850 /* push the rest of the arguments into stack. */
851 for (; argno < nargs; ++argno) {
853 arg = value_arg_coerce (args[argno]);
854 len = TYPE_LENGTH (VALUE_TYPE (arg));
857 /* float types should be passed in fpr's, as well as in the stack. */
858 if (TYPE_CODE (VALUE_TYPE (arg)) == TYPE_CODE_FLT && f_argno < 13) {
862 "Fatal Error: a floating point parameter #%d with a size > 8 is found!\n", argno);
864 bcopy (VALUE_CONTENTS (arg),
865 ®isters[REGISTER_BYTE(FP0_REGNUM + 1 + f_argno)], len);
869 write_memory (sp+24+(ii*4), VALUE_CONTENTS (arg), len);
870 ii += ((len + 3) & -4) / 4;
875 /* Secure stack areas first, before doing anything else. */
876 write_register (SP_REGNUM, sp);
880 flush_cached_frames ();
881 set_current_frame (create_new_frame (sp, pc));
885 saved_sp = dummy_frame_addr [dummy_frame_count - 1];
886 read_memory (saved_sp, tmp_buffer, 24);
887 write_memory (sp, tmp_buffer, 24);
889 write_memory (sp, &saved_sp, 4); /* set back chain properly */
891 store_inferior_registers (-1);
895 /* a given return value in `regbuf' with a type `valtype', extract and copy its
896 value into `valbuf' */
898 extract_return_value (valtype, regbuf, valbuf)
899 struct type *valtype;
900 char regbuf[REGISTER_BYTES];
904 if (TYPE_CODE (valtype) == TYPE_CODE_FLT) {
907 /* floats and doubles are returned in fpr1. fpr's have a size of 8 bytes.
908 We need to truncate the return value into float size (4 byte) if
911 if (TYPE_LENGTH (valtype) > 4) /* this is a double */
912 bcopy (®buf[REGISTER_BYTE (FP0_REGNUM + 1)], valbuf,
913 TYPE_LENGTH (valtype));
915 bcopy (®buf[REGISTER_BYTE (FP0_REGNUM + 1)], &dd, 8);
917 bcopy (&ff, valbuf, sizeof(float));
921 /* return value is copied starting from r3. */
922 bcopy (®buf[REGISTER_BYTE (3)], valbuf, TYPE_LENGTH (valtype));
926 /* keep keep structure return address in this variable. */
928 CORE_ADDR rs6000_struct_return_address;
931 /* Throw away this debugging code. FIXMEmgo. */
936 for (ii=0; ii<40; ++ii) {
939 val = read_memory_integer (fram + ii * 4, 4);
940 printf ("0x%08x\t", val);
947 /* Indirect function calls use a piece of trampoline code do co context switching,
948 i.e. to set the new TOC table. Skip such code if exists. */
950 skip_trampoline_code (pc)
953 register unsigned int ii, op;
955 static unsigned trampoline_code[] = {
956 0x800b0000, /* l r0,0x0(r11) */
957 0x90410014, /* st r2,0x14(r1) */
958 0x7c0903a6, /* mtctr r0 */
959 0x804b0004, /* l r2,0x4(r11) */
960 0x816b0008, /* l r11,0x8(r11) */
961 0x4e800420, /* bctr */
966 for (ii=0; trampoline_code[ii]; ++ii) {
967 op = read_memory_integer (pc + (ii*4), 4);
968 if (op != trampoline_code [ii])
971 ii = read_register (11); /* r11 holds destination addr */
972 pc = read_memory_integer (ii, 4); /* (r11) value */