SjLjEHPrepare.cpp revision 0bb61c56bcad7a738d50f705b5966be446ef06c1
1//===- SjLjEHPass.cpp - Eliminate Invoke & Unwind instructions -----------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This transformation is designed for use by code generators which use SjLj
11// based exception handling.
12//
13//===----------------------------------------------------------------------===//
14
15#define DEBUG_TYPE "sjljehprepare"
16#include "llvm/Transforms/Scalar.h"
17#include "llvm/Constants.h"
18#include "llvm/DerivedTypes.h"
19#include "llvm/Instructions.h"
20#include "llvm/Intrinsics.h"
21#include "llvm/LLVMContext.h"
22#include "llvm/Module.h"
23#include "llvm/Pass.h"
24#include "llvm/CodeGen/Passes.h"
25#include "llvm/Transforms/Utils/BasicBlockUtils.h"
26#include "llvm/Transforms/Utils/Local.h"
27#include "llvm/ADT/Statistic.h"
28#include "llvm/ADT/SmallVector.h"
29#include "llvm/Support/CommandLine.h"
30#include "llvm/Support/Compiler.h"
31#include "llvm/Support/Debug.h"
32#include "llvm/Support/raw_ostream.h"
33#include "llvm/Target/TargetLowering.h"
34using namespace llvm;
35
36STATISTIC(NumInvokes, "Number of invokes replaced");
37STATISTIC(NumUnwinds, "Number of unwinds replaced");
38STATISTIC(NumSpilled, "Number of registers live across unwind edges");
39
40namespace {
41  class VISIBILITY_HIDDEN SjLjEHPass : public FunctionPass {
42
43    const TargetLowering *TLI;
44
45    const Type *FunctionContextTy;
46    Constant *RegisterFn;
47    Constant *UnregisterFn;
48    Constant *ResumeFn;
49    Constant *BuiltinSetjmpFn;
50    Constant *FrameAddrFn;
51    Constant *LSDAAddrFn;
52    Value *PersonalityFn;
53    Constant *Selector32Fn;
54    Constant *Selector64Fn;
55    Constant *ExceptionFn;
56
57    Value *CallSite;
58  public:
59    static char ID; // Pass identification, replacement for typeid
60    explicit SjLjEHPass(const TargetLowering *tli = NULL)
61      : FunctionPass(&ID), TLI(tli) { }
62    bool doInitialization(Module &M);
63    bool runOnFunction(Function &F);
64
65    virtual void getAnalysisUsage(AnalysisUsage &AU) const { }
66    const char *getPassName() const {
67      return "SJLJ Exception Handling preparation";
68    }
69
70  private:
71    void markInvokeCallSite(InvokeInst *II, unsigned InvokeNo,
72                            Value *CallSite,
73                            SwitchInst *CatchSwitch);
74    void splitLiveRangesLiveAcrossInvokes(SmallVector<InvokeInst*,16> &Invokes);
75    bool insertSjLjEHSupport(Function &F);
76  };
77} // end anonymous namespace
78
79char SjLjEHPass::ID = 0;
80
81// Public Interface To the SjLjEHPass pass.
82FunctionPass *llvm::createSjLjEHPass(const TargetLowering *TLI) {
83  return new SjLjEHPass(TLI);
84}
85// doInitialization - Set up decalarations and types needed to process
86// exceptions.
87bool SjLjEHPass::doInitialization(Module &M) {
88  // Build the function context structure.
89  // builtin_setjmp uses a five word jbuf
90  const Type *VoidPtrTy =
91          PointerType::getUnqual(Type::getInt8Ty(M.getContext()));
92  const Type *Int32Ty = Type::getInt32Ty(M.getContext());
93  FunctionContextTy =
94    StructType::get(M.getContext(),
95                    VoidPtrTy,                        // __prev
96                    Int32Ty,                          // call_site
97                    ArrayType::get(Int32Ty, 4),       // __data
98                    VoidPtrTy,                        // __personality
99                    VoidPtrTy,                        // __lsda
100                    ArrayType::get(VoidPtrTy, 5),     // __jbuf
101                    NULL);
102  RegisterFn = M.getOrInsertFunction("_Unwind_SjLj_Register",
103                                     Type::getVoidTy(M.getContext()),
104                                     PointerType::getUnqual(FunctionContextTy),
105                                     (Type *)0);
106  UnregisterFn =
107    M.getOrInsertFunction("_Unwind_SjLj_Unregister",
108                          Type::getVoidTy(M.getContext()),
109                          PointerType::getUnqual(FunctionContextTy),
110                          (Type *)0);
111  ResumeFn =
112    M.getOrInsertFunction("_Unwind_SjLj_Resume",
113                          Type::getVoidTy(M.getContext()),
114                          VoidPtrTy,
115                          (Type *)0);
116  FrameAddrFn = Intrinsic::getDeclaration(&M, Intrinsic::frameaddress);
117  BuiltinSetjmpFn = Intrinsic::getDeclaration(&M, Intrinsic::eh_sjlj_setjmp);
118  LSDAAddrFn = Intrinsic::getDeclaration(&M, Intrinsic::eh_sjlj_lsda);
119  Selector32Fn = Intrinsic::getDeclaration(&M, Intrinsic::eh_selector_i32);
120  Selector64Fn = Intrinsic::getDeclaration(&M, Intrinsic::eh_selector_i64);
121  ExceptionFn = Intrinsic::getDeclaration(&M, Intrinsic::eh_exception);
122  PersonalityFn = 0;
123
124  return true;
125}
126
127/// markInvokeCallSite - Insert code to mark the call_site for this invoke
128void SjLjEHPass::markInvokeCallSite(InvokeInst *II, unsigned InvokeNo,
129                                    Value *CallSite,
130                                    SwitchInst *CatchSwitch) {
131  ConstantInt *CallSiteNoC= ConstantInt::get(Type::getInt32Ty(II->getContext()),
132                                            InvokeNo);
133  // The runtime comes back to the dispatcher with the call_site - 1 in
134  // the context. Odd, but there it is.
135  ConstantInt *SwitchValC = ConstantInt::get(Type::getInt32Ty(II->getContext()),
136                                            InvokeNo - 1);
137
138  // If the unwind edge has phi nodes, split the edge.
139  if (isa<PHINode>(II->getUnwindDest()->begin())) {
140    SplitCriticalEdge(II, 1, this);
141
142    // If there are any phi nodes left, they must have a single predecessor.
143    while (PHINode *PN = dyn_cast<PHINode>(II->getUnwindDest()->begin())) {
144      PN->replaceAllUsesWith(PN->getIncomingValue(0));
145      PN->eraseFromParent();
146    }
147  }
148
149  // Insert a store of the invoke num before the invoke and store zero into the
150  // location afterward.
151  new StoreInst(CallSiteNoC, CallSite, true, II);  // volatile
152
153  // Add a switch case to our unwind block.
154  CatchSwitch->addCase(SwitchValC, II->getUnwindDest());
155  // We still want this to look like an invoke so we emit the LSDA properly
156  // FIXME: ??? Or will this cause strangeness with mis-matched IDs like
157  //  when it was in the front end?
158}
159
160/// MarkBlocksLiveIn - Insert BB and all of its predescessors into LiveBBs until
161/// we reach blocks we've already seen.
162static void MarkBlocksLiveIn(BasicBlock *BB, std::set<BasicBlock*> &LiveBBs) {
163  if (!LiveBBs.insert(BB).second) return; // already been here.
164
165  for (pred_iterator PI = pred_begin(BB), E = pred_end(BB); PI != E; ++PI)
166    MarkBlocksLiveIn(*PI, LiveBBs);
167}
168
169/// splitLiveRangesAcrossInvokes - Each value that is live across an unwind edge
170/// we spill into a stack location, guaranteeing that there is nothing live
171/// across the unwind edge.  This process also splits all critical edges
172/// coming out of invoke's.
173void SjLjEHPass::
174splitLiveRangesLiveAcrossInvokes(SmallVector<InvokeInst*,16> &Invokes) {
175  // First step, split all critical edges from invoke instructions.
176  for (unsigned i = 0, e = Invokes.size(); i != e; ++i) {
177    InvokeInst *II = Invokes[i];
178    SplitCriticalEdge(II, 0, this);
179    SplitCriticalEdge(II, 1, this);
180    assert(!isa<PHINode>(II->getNormalDest()) &&
181           !isa<PHINode>(II->getUnwindDest()) &&
182           "critical edge splitting left single entry phi nodes?");
183  }
184
185  Function *F = Invokes.back()->getParent()->getParent();
186
187  // To avoid having to handle incoming arguments specially, we lower each arg
188  // to a copy instruction in the entry block.  This ensures that the argument
189  // value itself cannot be live across the entry block.
190  BasicBlock::iterator AfterAllocaInsertPt = F->begin()->begin();
191  while (isa<AllocaInst>(AfterAllocaInsertPt) &&
192        isa<ConstantInt>(cast<AllocaInst>(AfterAllocaInsertPt)->getArraySize()))
193    ++AfterAllocaInsertPt;
194  for (Function::arg_iterator AI = F->arg_begin(), E = F->arg_end();
195       AI != E; ++AI) {
196    // This is always a no-op cast because we're casting AI to AI->getType() so
197    // src and destination types are identical. BitCast is the only possibility.
198    CastInst *NC = new BitCastInst(
199      AI, AI->getType(), AI->getName()+".tmp", AfterAllocaInsertPt);
200    AI->replaceAllUsesWith(NC);
201    // Normally its is forbidden to replace a CastInst's operand because it
202    // could cause the opcode to reflect an illegal conversion. However, we're
203    // replacing it here with the same value it was constructed with to simply
204    // make NC its user.
205    NC->setOperand(0, AI);
206  }
207
208  // Finally, scan the code looking for instructions with bad live ranges.
209  for (Function::iterator BB = F->begin(), E = F->end(); BB != E; ++BB)
210    for (BasicBlock::iterator II = BB->begin(), E = BB->end(); II != E; ++II) {
211      // Ignore obvious cases we don't have to handle.  In particular, most
212      // instructions either have no uses or only have a single use inside the
213      // current block.  Ignore them quickly.
214      Instruction *Inst = II;
215      if (Inst->use_empty()) continue;
216      if (Inst->hasOneUse() &&
217          cast<Instruction>(Inst->use_back())->getParent() == BB &&
218          !isa<PHINode>(Inst->use_back())) continue;
219
220      // If this is an alloca in the entry block, it's not a real register
221      // value.
222      if (AllocaInst *AI = dyn_cast<AllocaInst>(Inst))
223        if (isa<ConstantInt>(AI->getArraySize()) && BB == F->begin())
224          continue;
225
226      // Avoid iterator invalidation by copying users to a temporary vector.
227      SmallVector<Instruction*,16> Users;
228      for (Value::use_iterator UI = Inst->use_begin(), E = Inst->use_end();
229           UI != E; ++UI) {
230        Instruction *User = cast<Instruction>(*UI);
231        if (User->getParent() != BB || isa<PHINode>(User))
232          Users.push_back(User);
233      }
234
235      // Find all of the blocks that this value is live in.
236      std::set<BasicBlock*> LiveBBs;
237      LiveBBs.insert(Inst->getParent());
238      while (!Users.empty()) {
239        Instruction *U = Users.back();
240        Users.pop_back();
241
242        if (!isa<PHINode>(U)) {
243          MarkBlocksLiveIn(U->getParent(), LiveBBs);
244        } else {
245          // Uses for a PHI node occur in their predecessor block.
246          PHINode *PN = cast<PHINode>(U);
247          for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i)
248            if (PN->getIncomingValue(i) == Inst)
249              MarkBlocksLiveIn(PN->getIncomingBlock(i), LiveBBs);
250        }
251      }
252
253      // Now that we know all of the blocks that this thing is live in, see if
254      // it includes any of the unwind locations.
255      bool NeedsSpill = false;
256      for (unsigned i = 0, e = Invokes.size(); i != e; ++i) {
257        BasicBlock *UnwindBlock = Invokes[i]->getUnwindDest();
258        if (UnwindBlock != BB && LiveBBs.count(UnwindBlock)) {
259          NeedsSpill = true;
260        }
261      }
262
263      // If we decided we need a spill, do it.
264      if (NeedsSpill) {
265        ++NumSpilled;
266        DemoteRegToStack(*Inst, true);
267      }
268    }
269}
270
271bool SjLjEHPass::insertSjLjEHSupport(Function &F) {
272  SmallVector<ReturnInst*,16> Returns;
273  SmallVector<UnwindInst*,16> Unwinds;
274  SmallVector<InvokeInst*,16> Invokes;
275
276  // Look through the terminators of the basic blocks to find invokes, returns
277  // and unwinds
278  for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB)
279    if (ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator())) {
280      // Remember all return instructions in case we insert an invoke into this
281      // function.
282      Returns.push_back(RI);
283    } else if (InvokeInst *II = dyn_cast<InvokeInst>(BB->getTerminator())) {
284      Invokes.push_back(II);
285    } else if (UnwindInst *UI = dyn_cast<UnwindInst>(BB->getTerminator())) {
286      Unwinds.push_back(UI);
287    }
288  // If we don't have any invokes or unwinds, there's nothing to do.
289  if (Unwinds.empty() && Invokes.empty()) return false;
290
291  // Find the eh.selector.*  and eh.exception calls. We'll use the first
292  // eh.selector to determine the right personality function to use. For
293  // SJLJ, we always use the same personality for the whole function,
294  // not on a per-selector basis.
295  // FIXME: That's a bit ugly. Better way?
296  SmallVector<CallInst*,16> EH_Selectors;
297  SmallVector<CallInst*,16> EH_Exceptions;
298  for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB) {
299    for (BasicBlock::iterator I = BB->begin(), E = BB->end(); I != E; ++I) {
300      if (CallInst *CI = dyn_cast<CallInst>(I)) {
301        if (CI->getCalledFunction() == Selector32Fn ||
302            CI->getCalledFunction() == Selector64Fn) {
303          if (!PersonalityFn) PersonalityFn = CI->getOperand(2);
304          EH_Selectors.push_back(CI);
305        } else if (CI->getCalledFunction() == ExceptionFn) {
306          EH_Exceptions.push_back(CI);
307        }
308      }
309    }
310  }
311  // If we don't have any eh.selector calls, we can't determine the personality
312  // function. Without a personality function, we can't process exceptions.
313  if (!PersonalityFn) return false;
314
315  NumInvokes += Invokes.size();
316  NumUnwinds += Unwinds.size();
317
318  if (!Invokes.empty()) {
319    // We have invokes, so we need to add register/unregister calls to get
320    // this function onto the global unwind stack.
321    //
322    // First thing we need to do is scan the whole function for values that are
323    // live across unwind edges.  Each value that is live across an unwind edge
324    // we spill into a stack location, guaranteeing that there is nothing live
325    // across the unwind edge.  This process also splits all critical edges
326    // coming out of invoke's.
327    splitLiveRangesLiveAcrossInvokes(Invokes);
328
329    BasicBlock *EntryBB = F.begin();
330    // Create an alloca for the incoming jump buffer ptr and the new jump buffer
331    // that needs to be restored on all exits from the function.  This is an
332    // alloca because the value needs to be added to the global context list.
333    unsigned Align = 4; // FIXME: Should be a TLI check?
334    AllocaInst *FunctionContext =
335      new AllocaInst(FunctionContextTy, 0, Align,
336                     "fcn_context", F.begin()->begin());
337
338    Value *Idxs[2];
339    const Type *Int32Ty = Type::getInt32Ty(F.getContext());
340    Value *Zero = ConstantInt::get(Int32Ty, 0);
341    // We need to also keep around a reference to the call_site field
342    Idxs[0] = Zero;
343    Idxs[1] = ConstantInt::get(Int32Ty, 1);
344    CallSite = GetElementPtrInst::Create(FunctionContext, Idxs, Idxs+2,
345                                         "call_site",
346                                         EntryBB->getTerminator());
347
348    // The exception selector comes back in context->data[1]
349    Idxs[1] = ConstantInt::get(Int32Ty, 2);
350    Value *FCData = GetElementPtrInst::Create(FunctionContext, Idxs, Idxs+2,
351                                              "fc_data",
352                                              EntryBB->getTerminator());
353    Idxs[1] = ConstantInt::get(Int32Ty, 1);
354    Value *SelectorAddr = GetElementPtrInst::Create(FCData, Idxs, Idxs+2,
355                                                    "exc_selector_gep",
356                                                    EntryBB->getTerminator());
357    // The exception value comes back in context->data[0]
358    Idxs[1] = Zero;
359    Value *ExceptionAddr = GetElementPtrInst::Create(FCData, Idxs, Idxs+2,
360                                                     "exception_gep",
361                                                     EntryBB->getTerminator());
362
363    // The result of the eh.selector call will be replaced with a
364    // a reference to the selector value returned in the function
365    // context. We leave the selector itself so the EH analysis later
366    // can use it.
367    for (int i = 0, e = EH_Selectors.size(); i < e; ++i) {
368      CallInst *I = EH_Selectors[i];
369      Value *SelectorVal = new LoadInst(SelectorAddr, "select_val", true, I);
370      I->replaceAllUsesWith(SelectorVal);
371    }
372    // eh.exception calls are replaced with references to the proper
373    // location in the context. Unlike eh.selector, the eh.exception
374    // calls are removed entirely.
375    for (int i = 0, e = EH_Exceptions.size(); i < e; ++i) {
376      CallInst *I = EH_Exceptions[i];
377      // Possible for there to be duplicates, so check to make sure
378      // the instruction hasn't already been removed.
379      if (!I->getParent()) continue;
380      Value *Val = new LoadInst(ExceptionAddr, "exception", true, I);
381      Type *Ty = PointerType::getUnqual(Type::getInt8Ty(F.getContext()));
382      Val = CastInst::Create(Instruction::IntToPtr, Val, Ty, "", I);
383
384      I->replaceAllUsesWith(Val);
385      I->eraseFromParent();
386    }
387
388
389
390
391    // The entry block changes to have the eh.sjlj.setjmp, with a conditional
392    // branch to a dispatch block for non-zero returns. If we return normally,
393    // we're not handling an exception and just register the function context
394    // and continue.
395
396    // Create the dispatch block.  The dispatch block is basically a big switch
397    // statement that goes to all of the invoke landing pads.
398    BasicBlock *DispatchBlock =
399            BasicBlock::Create(F.getContext(), "eh.sjlj.setjmp.catch", &F);
400
401    // Insert a load in the Catch block, and a switch on its value.  By default,
402    // we go to a block that just does an unwind (which is the correct action
403    // for a standard call).
404    BasicBlock *UnwindBlock = BasicBlock::Create(F.getContext(), "unwindbb", &F);
405    Unwinds.push_back(new UnwindInst(F.getContext(), UnwindBlock));
406
407    Value *DispatchLoad = new LoadInst(CallSite, "invoke.num", true,
408                                       DispatchBlock);
409    SwitchInst *DispatchSwitch =
410      SwitchInst::Create(DispatchLoad, UnwindBlock, Invokes.size(), DispatchBlock);
411    // Split the entry block to insert the conditional branch for the setjmp.
412    BasicBlock *ContBlock = EntryBB->splitBasicBlock(EntryBB->getTerminator(),
413                                                     "eh.sjlj.setjmp.cont");
414
415    // Populate the Function Context
416    //   1. LSDA address
417    //   2. Personality function address
418    //   3. jmpbuf (save FP and call eh.sjlj.setjmp)
419
420    // LSDA address
421    Idxs[0] = Zero;
422    Idxs[1] = ConstantInt::get(Int32Ty, 4);
423    Value *LSDAFieldPtr =
424      GetElementPtrInst::Create(FunctionContext, Idxs, Idxs+2,
425                                "lsda_gep",
426                                EntryBB->getTerminator());
427    Value *LSDA = CallInst::Create(LSDAAddrFn, "lsda_addr",
428                                   EntryBB->getTerminator());
429    new StoreInst(LSDA, LSDAFieldPtr, true, EntryBB->getTerminator());
430
431    Idxs[1] = ConstantInt::get(Int32Ty, 3);
432    Value *PersonalityFieldPtr =
433      GetElementPtrInst::Create(FunctionContext, Idxs, Idxs+2,
434                                "lsda_gep",
435                                EntryBB->getTerminator());
436    new StoreInst(PersonalityFn, PersonalityFieldPtr, true,
437                  EntryBB->getTerminator());
438
439    //   Save the frame pointer.
440    Idxs[1] = ConstantInt::get(Int32Ty, 5);
441    Value *FieldPtr
442      = GetElementPtrInst::Create(FunctionContext, Idxs, Idxs+2,
443                                  "jbuf_gep",
444                                  EntryBB->getTerminator());
445    Idxs[1] = ConstantInt::get(Int32Ty, 0);
446    Value *ElemPtr =
447      GetElementPtrInst::Create(FieldPtr, Idxs, Idxs+2, "jbuf_fp_gep",
448                                EntryBB->getTerminator());
449
450    Value *Val = CallInst::Create(FrameAddrFn,
451                                  ConstantInt::get(Int32Ty, 0),
452                                  "fp",
453                                  EntryBB->getTerminator());
454    new StoreInst(Val, ElemPtr, true, EntryBB->getTerminator());
455    // Call the setjmp instrinsic. It fills in the rest of the jmpbuf
456    Value *SetjmpArg =
457      CastInst::Create(Instruction::BitCast, FieldPtr,
458                        Type::getInt8Ty(F.getContext())->getPointerTo(), "",
459                        EntryBB->getTerminator());
460    Value *DispatchVal = CallInst::Create(BuiltinSetjmpFn, SetjmpArg,
461                                          "dispatch",
462                                          EntryBB->getTerminator());
463    // check the return value of the setjmp. non-zero goes to dispatcher
464    Value *IsNormal = new ICmpInst(EntryBB->getTerminator(),
465                                   ICmpInst::ICMP_EQ, DispatchVal, Zero,
466                                   "notunwind");
467    // Nuke the uncond branch.
468    EntryBB->getTerminator()->eraseFromParent();
469
470    // Put in a new condbranch in its place.
471    BranchInst::Create(ContBlock, DispatchBlock, IsNormal, EntryBB);
472
473    // Register the function context and make sure it's known to not throw
474    CallInst *Register =
475      CallInst::Create(RegisterFn, FunctionContext, "",
476                       ContBlock->getTerminator());
477    Register->setDoesNotThrow();
478
479    // At this point, we are all set up, update the invoke instructions
480    // to mark their call_site values, and fill in the dispatch switch
481    // accordingly.
482    for (unsigned i = 0, e = Invokes.size(); i != e; ++i)
483      markInvokeCallSite(Invokes[i], i+1, CallSite, DispatchSwitch);
484
485    // The front end has likely added calls to _Unwind_Resume. We need
486    // to find those calls and mark the call_site as -1 immediately prior.
487    // resume is a noreturn function, so any block that has a call to it
488    // should end in an 'unreachable' instruction with the call immediately
489    // prior. That's how we'll search.
490    // ??? There's got to be a better way. this is fugly.
491    for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB)
492      if ((dyn_cast<UnreachableInst>(BB->getTerminator()))) {
493        BasicBlock::iterator I = BB->getTerminator();
494        // Check the previous instruction and see if it's a resume call
495        if (I == BB->begin()) continue;
496        if (CallInst *CI = dyn_cast<CallInst>(--I)) {
497          if (CI->getCalledFunction() == ResumeFn) {
498            Value *NegativeOne = Constant::getAllOnesValue(Int32Ty);
499            new StoreInst(NegativeOne, CallSite, true, I);  // volatile
500          }
501        }
502      }
503
504    // Replace all unwinds with a branch to the unwind handler.
505    // ??? Should this ever happen with sjlj exceptions?
506    for (unsigned i = 0, e = Unwinds.size(); i != e; ++i) {
507      BranchInst::Create(UnwindBlock, Unwinds[i]);
508      Unwinds[i]->eraseFromParent();
509    }
510
511    // Finally, for any returns from this function, if this function contains an
512    // invoke, add a call to unregister the function context.
513    for (unsigned i = 0, e = Returns.size(); i != e; ++i)
514      CallInst::Create(UnregisterFn, FunctionContext, "", Returns[i]);
515  }
516
517  return true;
518}
519
520bool SjLjEHPass::runOnFunction(Function &F) {
521  bool Res = insertSjLjEHSupport(F);
522  return Res;
523}
524