1 //===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // All functions using an MSVC EH personality use an explicitly updated state
10 // number stored in an exception registration stack object. The registration
11 // object is linked into a thread-local chain of registrations stored at fs:00.
12 // This pass adds the registration object and EH state updates.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "X86.h"
17 #include "llvm/ADT/PostOrderIterator.h"
18 #include "llvm/Analysis/CFG.h"
19 #include "llvm/Analysis/EHPersonalities.h"
20 #include "llvm/CodeGen/MachineModuleInfo.h"
21 #include "llvm/CodeGen/WinEHFuncInfo.h"
22 #include "llvm/IR/CallSite.h"
23 #include "llvm/IR/Function.h"
24 #include "llvm/IR/IRBuilder.h"
25 #include "llvm/IR/Instructions.h"
26 #include "llvm/IR/Intrinsics.h"
27 #include "llvm/IR/IntrinsicsX86.h"
28 #include "llvm/IR/Module.h"
29 #include "llvm/Pass.h"
30 #include "llvm/Support/Debug.h"
31 #include <deque>
32
33 using namespace llvm;
34
35 #define DEBUG_TYPE "winehstate"
36
37 namespace {
38 const int OverdefinedState = INT_MIN;
39
40 class WinEHStatePass : public FunctionPass {
41 public:
42 static char ID; // Pass identification, replacement for typeid.
43
WinEHStatePass()44 WinEHStatePass() : FunctionPass(ID) { }
45
46 bool runOnFunction(Function &Fn) override;
47
48 bool doInitialization(Module &M) override;
49
50 bool doFinalization(Module &M) override;
51
52 void getAnalysisUsage(AnalysisUsage &AU) const override;
53
getPassName() const54 StringRef getPassName() const override {
55 return "Windows 32-bit x86 EH state insertion";
56 }
57
58 private:
59 void emitExceptionRegistrationRecord(Function *F);
60
61 void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
62 void unlinkExceptionRegistration(IRBuilder<> &Builder);
63 void addStateStores(Function &F, WinEHFuncInfo &FuncInfo);
64 void insertStateNumberStore(Instruction *IP, int State);
65
66 Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
67
68 Function *generateLSDAInEAXThunk(Function *ParentFunc);
69
70 bool isStateStoreNeeded(EHPersonality Personality, CallSite CS);
71 void rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F, CallSite CS,
72 Value *State);
73 int getBaseStateForBB(DenseMap<BasicBlock *, ColorVector> &BlockColors,
74 WinEHFuncInfo &FuncInfo, BasicBlock *BB);
75 int getStateForCallSite(DenseMap<BasicBlock *, ColorVector> &BlockColors,
76 WinEHFuncInfo &FuncInfo, CallSite CS);
77
78 // Module-level type getters.
79 Type *getEHLinkRegistrationType();
80 Type *getSEHRegistrationType();
81 Type *getCXXEHRegistrationType();
82
83 // Per-module data.
84 Module *TheModule = nullptr;
85 StructType *EHLinkRegistrationTy = nullptr;
86 StructType *CXXEHRegistrationTy = nullptr;
87 StructType *SEHRegistrationTy = nullptr;
88 FunctionCallee SetJmp3 = nullptr;
89 FunctionCallee CxxLongjmpUnwind = nullptr;
90
91 // Per-function state
92 EHPersonality Personality = EHPersonality::Unknown;
93 Function *PersonalityFn = nullptr;
94 bool UseStackGuard = false;
95 int ParentBaseState = 0;
96 FunctionCallee SehLongjmpUnwind = nullptr;
97 Constant *Cookie = nullptr;
98
99 /// The stack allocation containing all EH data, including the link in the
100 /// fs:00 chain and the current state.
101 AllocaInst *RegNode = nullptr;
102
103 // The allocation containing the EH security guard.
104 AllocaInst *EHGuardNode = nullptr;
105
106 /// The index of the state field of RegNode.
107 int StateFieldIndex = ~0U;
108
109 /// The linked list node subobject inside of RegNode.
110 Value *Link = nullptr;
111 };
112 }
113
createX86WinEHStatePass()114 FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
115
116 char WinEHStatePass::ID = 0;
117
118 INITIALIZE_PASS(WinEHStatePass, "x86-winehstate",
119 "Insert stores for EH state numbers", false, false)
120
doInitialization(Module & M)121 bool WinEHStatePass::doInitialization(Module &M) {
122 TheModule = &M;
123 return false;
124 }
125
doFinalization(Module & M)126 bool WinEHStatePass::doFinalization(Module &M) {
127 assert(TheModule == &M);
128 TheModule = nullptr;
129 EHLinkRegistrationTy = nullptr;
130 CXXEHRegistrationTy = nullptr;
131 SEHRegistrationTy = nullptr;
132 SetJmp3 = nullptr;
133 CxxLongjmpUnwind = nullptr;
134 SehLongjmpUnwind = nullptr;
135 Cookie = nullptr;
136 return false;
137 }
138
getAnalysisUsage(AnalysisUsage & AU) const139 void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
140 // This pass should only insert a stack allocation, memory accesses, and
141 // localrecovers.
142 AU.setPreservesCFG();
143 }
144
runOnFunction(Function & F)145 bool WinEHStatePass::runOnFunction(Function &F) {
146 // Don't insert state stores or exception handler thunks for
147 // available_externally functions. The handler needs to reference the LSDA,
148 // which will not be emitted in this case.
149 if (F.hasAvailableExternallyLinkage())
150 return false;
151
152 // Check the personality. Do nothing if this personality doesn't use funclets.
153 if (!F.hasPersonalityFn())
154 return false;
155 PersonalityFn =
156 dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
157 if (!PersonalityFn)
158 return false;
159 Personality = classifyEHPersonality(PersonalityFn);
160 if (!isFuncletEHPersonality(Personality))
161 return false;
162
163 // Skip this function if there are no EH pads and we aren't using IR-level
164 // outlining.
165 bool HasPads = false;
166 for (BasicBlock &BB : F) {
167 if (BB.isEHPad()) {
168 HasPads = true;
169 break;
170 }
171 }
172 if (!HasPads)
173 return false;
174
175 Type *Int8PtrType = Type::getInt8PtrTy(TheModule->getContext());
176 SetJmp3 = TheModule->getOrInsertFunction(
177 "_setjmp3", FunctionType::get(
178 Type::getInt32Ty(TheModule->getContext()),
179 {Int8PtrType, Type::getInt32Ty(TheModule->getContext())},
180 /*isVarArg=*/true));
181
182 emitExceptionRegistrationRecord(&F);
183
184 // The state numbers calculated here in IR must agree with what we calculate
185 // later on for the MachineFunction. In particular, if an IR pass deletes an
186 // unreachable EH pad after this point before machine CFG construction, we
187 // will be in trouble. If this assumption is ever broken, we should turn the
188 // numbers into an immutable analysis pass.
189 WinEHFuncInfo FuncInfo;
190 addStateStores(F, FuncInfo);
191
192 // Reset per-function state.
193 PersonalityFn = nullptr;
194 Personality = EHPersonality::Unknown;
195 UseStackGuard = false;
196 RegNode = nullptr;
197 EHGuardNode = nullptr;
198
199 return true;
200 }
201
202 /// Get the common EH registration subobject:
203 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
204 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
205 /// struct EHRegistrationNode {
206 /// EHRegistrationNode *Next;
207 /// PEXCEPTION_ROUTINE Handler;
208 /// };
getEHLinkRegistrationType()209 Type *WinEHStatePass::getEHLinkRegistrationType() {
210 if (EHLinkRegistrationTy)
211 return EHLinkRegistrationTy;
212 LLVMContext &Context = TheModule->getContext();
213 EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
214 Type *FieldTys[] = {
215 EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
216 Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
217 };
218 EHLinkRegistrationTy->setBody(FieldTys, false);
219 return EHLinkRegistrationTy;
220 }
221
222 /// The __CxxFrameHandler3 registration node:
223 /// struct CXXExceptionRegistration {
224 /// void *SavedESP;
225 /// EHRegistrationNode SubRecord;
226 /// int32_t TryLevel;
227 /// };
getCXXEHRegistrationType()228 Type *WinEHStatePass::getCXXEHRegistrationType() {
229 if (CXXEHRegistrationTy)
230 return CXXEHRegistrationTy;
231 LLVMContext &Context = TheModule->getContext();
232 Type *FieldTys[] = {
233 Type::getInt8PtrTy(Context), // void *SavedESP
234 getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
235 Type::getInt32Ty(Context) // int32_t TryLevel
236 };
237 CXXEHRegistrationTy =
238 StructType::create(FieldTys, "CXXExceptionRegistration");
239 return CXXEHRegistrationTy;
240 }
241
242 /// The _except_handler3/4 registration node:
243 /// struct EH4ExceptionRegistration {
244 /// void *SavedESP;
245 /// _EXCEPTION_POINTERS *ExceptionPointers;
246 /// EHRegistrationNode SubRecord;
247 /// int32_t EncodedScopeTable;
248 /// int32_t TryLevel;
249 /// };
getSEHRegistrationType()250 Type *WinEHStatePass::getSEHRegistrationType() {
251 if (SEHRegistrationTy)
252 return SEHRegistrationTy;
253 LLVMContext &Context = TheModule->getContext();
254 Type *FieldTys[] = {
255 Type::getInt8PtrTy(Context), // void *SavedESP
256 Type::getInt8PtrTy(Context), // void *ExceptionPointers
257 getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
258 Type::getInt32Ty(Context), // int32_t EncodedScopeTable
259 Type::getInt32Ty(Context) // int32_t TryLevel
260 };
261 SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
262 return SEHRegistrationTy;
263 }
264
265 // Emit an exception registration record. These are stack allocations with the
266 // common subobject of two pointers: the previous registration record (the old
267 // fs:00) and the personality function for the current frame. The data before
268 // and after that is personality function specific.
emitExceptionRegistrationRecord(Function * F)269 void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
270 assert(Personality == EHPersonality::MSVC_CXX ||
271 Personality == EHPersonality::MSVC_X86SEH);
272
273 // Struct type of RegNode. Used for GEPing.
274 Type *RegNodeTy;
275
276 IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
277 Type *Int8PtrType = Builder.getInt8PtrTy();
278 Type *Int32Ty = Builder.getInt32Ty();
279 Type *VoidTy = Builder.getVoidTy();
280
281 if (Personality == EHPersonality::MSVC_CXX) {
282 RegNodeTy = getCXXEHRegistrationType();
283 RegNode = Builder.CreateAlloca(RegNodeTy);
284 // SavedESP = llvm.stacksave()
285 Value *SP = Builder.CreateCall(
286 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
287 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
288 // TryLevel = -1
289 StateFieldIndex = 2;
290 ParentBaseState = -1;
291 insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
292 // Handler = __ehhandler$F
293 Function *Trampoline = generateLSDAInEAXThunk(F);
294 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
295 linkExceptionRegistration(Builder, Trampoline);
296
297 CxxLongjmpUnwind = TheModule->getOrInsertFunction(
298 "__CxxLongjmpUnwind",
299 FunctionType::get(VoidTy, Int8PtrType, /*isVarArg=*/false));
300 cast<Function>(CxxLongjmpUnwind.getCallee()->stripPointerCasts())
301 ->setCallingConv(CallingConv::X86_StdCall);
302 } else if (Personality == EHPersonality::MSVC_X86SEH) {
303 // If _except_handler4 is in use, some additional guard checks and prologue
304 // stuff is required.
305 StringRef PersonalityName = PersonalityFn->getName();
306 UseStackGuard = (PersonalityName == "_except_handler4");
307
308 // Allocate local structures.
309 RegNodeTy = getSEHRegistrationType();
310 RegNode = Builder.CreateAlloca(RegNodeTy);
311 if (UseStackGuard)
312 EHGuardNode = Builder.CreateAlloca(Int32Ty);
313
314 // SavedESP = llvm.stacksave()
315 Value *SP = Builder.CreateCall(
316 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
317 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
318 // TryLevel = -2 / -1
319 StateFieldIndex = 4;
320 ParentBaseState = UseStackGuard ? -2 : -1;
321 insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
322 // ScopeTable = llvm.x86.seh.lsda(F)
323 Value *LSDA = emitEHLSDA(Builder, F);
324 LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
325 // If using _except_handler4, xor the address of the table with
326 // __security_cookie.
327 if (UseStackGuard) {
328 Cookie = TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
329 Value *Val = Builder.CreateLoad(Int32Ty, Cookie, "cookie");
330 LSDA = Builder.CreateXor(LSDA, Val);
331 }
332 Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
333
334 // If using _except_handler4, the EHGuard contains: FramePtr xor Cookie.
335 if (UseStackGuard) {
336 Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
337 Value *FrameAddr = Builder.CreateCall(
338 Intrinsic::getDeclaration(
339 TheModule, Intrinsic::frameaddress,
340 Builder.getInt8PtrTy(
341 TheModule->getDataLayout().getAllocaAddrSpace())),
342 Builder.getInt32(0), "frameaddr");
343 Value *FrameAddrI32 = Builder.CreatePtrToInt(FrameAddr, Int32Ty);
344 FrameAddrI32 = Builder.CreateXor(FrameAddrI32, Val);
345 Builder.CreateStore(FrameAddrI32, EHGuardNode);
346 }
347
348 // Register the exception handler.
349 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
350 linkExceptionRegistration(Builder, PersonalityFn);
351
352 SehLongjmpUnwind = TheModule->getOrInsertFunction(
353 UseStackGuard ? "_seh_longjmp_unwind4" : "_seh_longjmp_unwind",
354 FunctionType::get(Type::getVoidTy(TheModule->getContext()), Int8PtrType,
355 /*isVarArg=*/false));
356 cast<Function>(SehLongjmpUnwind.getCallee()->stripPointerCasts())
357 ->setCallingConv(CallingConv::X86_StdCall);
358 } else {
359 llvm_unreachable("unexpected personality function");
360 }
361
362 // Insert an unlink before all returns.
363 for (BasicBlock &BB : *F) {
364 Instruction *T = BB.getTerminator();
365 if (!isa<ReturnInst>(T))
366 continue;
367 Builder.SetInsertPoint(T);
368 unlinkExceptionRegistration(Builder);
369 }
370 }
371
emitEHLSDA(IRBuilder<> & Builder,Function * F)372 Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
373 Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
374 return Builder.CreateCall(
375 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
376 }
377
378 /// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
379 /// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
380 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
381 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
382 /// We essentially want this code:
383 /// movl $lsda, %eax
384 /// jmpl ___CxxFrameHandler3
generateLSDAInEAXThunk(Function * ParentFunc)385 Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
386 LLVMContext &Context = ParentFunc->getContext();
387 Type *Int32Ty = Type::getInt32Ty(Context);
388 Type *Int8PtrType = Type::getInt8PtrTy(Context);
389 Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
390 Int8PtrType};
391 FunctionType *TrampolineTy =
392 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
393 /*isVarArg=*/false);
394 FunctionType *TargetFuncTy =
395 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
396 /*isVarArg=*/false);
397 Function *Trampoline =
398 Function::Create(TrampolineTy, GlobalValue::InternalLinkage,
399 Twine("__ehhandler$") + GlobalValue::dropLLVMManglingEscape(
400 ParentFunc->getName()),
401 TheModule);
402 if (auto *C = ParentFunc->getComdat())
403 Trampoline->setComdat(C);
404 BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
405 IRBuilder<> Builder(EntryBB);
406 Value *LSDA = emitEHLSDA(Builder, ParentFunc);
407 Value *CastPersonality =
408 Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
409 auto AI = Trampoline->arg_begin();
410 Value *Args[5] = {LSDA, &*AI++, &*AI++, &*AI++, &*AI++};
411 CallInst *Call = Builder.CreateCall(TargetFuncTy, CastPersonality, Args);
412 // Can't use musttail due to prototype mismatch, but we can use tail.
413 Call->setTailCall(true);
414 // Set inreg so we pass it in EAX.
415 Call->addParamAttr(0, Attribute::InReg);
416 Builder.CreateRet(Call);
417 return Trampoline;
418 }
419
linkExceptionRegistration(IRBuilder<> & Builder,Function * Handler)420 void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
421 Function *Handler) {
422 // Emit the .safeseh directive for this function.
423 Handler->addFnAttr("safeseh");
424
425 Type *LinkTy = getEHLinkRegistrationType();
426 // Handler = Handler
427 Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
428 Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
429 // Next = [fs:00]
430 Constant *FSZero =
431 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
432 Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(), FSZero);
433 Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
434 // [fs:00] = Link
435 Builder.CreateStore(Link, FSZero);
436 }
437
unlinkExceptionRegistration(IRBuilder<> & Builder)438 void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
439 // Clone Link into the current BB for better address mode folding.
440 if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
441 GEP = cast<GetElementPtrInst>(GEP->clone());
442 Builder.Insert(GEP);
443 Link = GEP;
444 }
445 Type *LinkTy = getEHLinkRegistrationType();
446 // [fs:00] = Link->Next
447 Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(),
448 Builder.CreateStructGEP(LinkTy, Link, 0));
449 Constant *FSZero =
450 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
451 Builder.CreateStore(Next, FSZero);
452 }
453
454 // Calls to setjmp(p) are lowered to _setjmp3(p, 0) by the frontend.
455 // The idea behind _setjmp3 is that it takes an optional number of personality
456 // specific parameters to indicate how to restore the personality-specific frame
457 // state when longjmp is initiated. Typically, the current TryLevel is saved.
rewriteSetJmpCallSite(IRBuilder<> & Builder,Function & F,CallSite CS,Value * State)458 void WinEHStatePass::rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F,
459 CallSite CS, Value *State) {
460 // Don't rewrite calls with a weird number of arguments.
461 if (CS.getNumArgOperands() != 2)
462 return;
463
464 Instruction *Inst = CS.getInstruction();
465
466 SmallVector<OperandBundleDef, 1> OpBundles;
467 CS.getOperandBundlesAsDefs(OpBundles);
468
469 SmallVector<Value *, 3> OptionalArgs;
470 if (Personality == EHPersonality::MSVC_CXX) {
471 OptionalArgs.push_back(CxxLongjmpUnwind.getCallee());
472 OptionalArgs.push_back(State);
473 OptionalArgs.push_back(emitEHLSDA(Builder, &F));
474 } else if (Personality == EHPersonality::MSVC_X86SEH) {
475 OptionalArgs.push_back(SehLongjmpUnwind.getCallee());
476 OptionalArgs.push_back(State);
477 if (UseStackGuard)
478 OptionalArgs.push_back(Cookie);
479 } else {
480 llvm_unreachable("unhandled personality!");
481 }
482
483 SmallVector<Value *, 5> Args;
484 Args.push_back(
485 Builder.CreateBitCast(CS.getArgOperand(0), Builder.getInt8PtrTy()));
486 Args.push_back(Builder.getInt32(OptionalArgs.size()));
487 Args.append(OptionalArgs.begin(), OptionalArgs.end());
488
489 CallSite NewCS;
490 if (CS.isCall()) {
491 auto *CI = cast<CallInst>(Inst);
492 CallInst *NewCI = Builder.CreateCall(SetJmp3, Args, OpBundles);
493 NewCI->setTailCallKind(CI->getTailCallKind());
494 NewCS = NewCI;
495 } else {
496 auto *II = cast<InvokeInst>(Inst);
497 NewCS = Builder.CreateInvoke(
498 SetJmp3, II->getNormalDest(), II->getUnwindDest(), Args, OpBundles);
499 }
500 NewCS.setCallingConv(CS.getCallingConv());
501 NewCS.setAttributes(CS.getAttributes());
502 NewCS->setDebugLoc(CS->getDebugLoc());
503
504 Instruction *NewInst = NewCS.getInstruction();
505 NewInst->takeName(Inst);
506 Inst->replaceAllUsesWith(NewInst);
507 Inst->eraseFromParent();
508 }
509
510 // Figure out what state we should assign calls in this block.
getBaseStateForBB(DenseMap<BasicBlock *,ColorVector> & BlockColors,WinEHFuncInfo & FuncInfo,BasicBlock * BB)511 int WinEHStatePass::getBaseStateForBB(
512 DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
513 BasicBlock *BB) {
514 int BaseState = ParentBaseState;
515 auto &BBColors = BlockColors[BB];
516
517 assert(BBColors.size() == 1 && "multi-color BB not removed by preparation");
518 BasicBlock *FuncletEntryBB = BBColors.front();
519 if (auto *FuncletPad =
520 dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI())) {
521 auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
522 if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
523 BaseState = BaseStateI->second;
524 }
525
526 return BaseState;
527 }
528
529 // Calculate the state a call-site is in.
getStateForCallSite(DenseMap<BasicBlock *,ColorVector> & BlockColors,WinEHFuncInfo & FuncInfo,CallSite CS)530 int WinEHStatePass::getStateForCallSite(
531 DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
532 CallSite CS) {
533 if (auto *II = dyn_cast<InvokeInst>(CS.getInstruction())) {
534 // Look up the state number of the EH pad this unwinds to.
535 assert(FuncInfo.InvokeStateMap.count(II) && "invoke has no state!");
536 return FuncInfo.InvokeStateMap[II];
537 }
538 // Possibly throwing call instructions have no actions to take after
539 // an unwind. Ensure they are in the -1 state.
540 return getBaseStateForBB(BlockColors, FuncInfo, CS.getParent());
541 }
542
543 // Calculate the intersection of all the FinalStates for a BasicBlock's
544 // predecessors.
getPredState(DenseMap<BasicBlock *,int> & FinalStates,Function & F,int ParentBaseState,BasicBlock * BB)545 static int getPredState(DenseMap<BasicBlock *, int> &FinalStates, Function &F,
546 int ParentBaseState, BasicBlock *BB) {
547 // The entry block has no predecessors but we know that the prologue always
548 // sets us up with a fixed state.
549 if (&F.getEntryBlock() == BB)
550 return ParentBaseState;
551
552 // This is an EH Pad, conservatively report this basic block as overdefined.
553 if (BB->isEHPad())
554 return OverdefinedState;
555
556 int CommonState = OverdefinedState;
557 for (BasicBlock *PredBB : predecessors(BB)) {
558 // We didn't manage to get a state for one of these predecessors,
559 // conservatively report this basic block as overdefined.
560 auto PredEndState = FinalStates.find(PredBB);
561 if (PredEndState == FinalStates.end())
562 return OverdefinedState;
563
564 // This code is reachable via exceptional control flow,
565 // conservatively report this basic block as overdefined.
566 if (isa<CatchReturnInst>(PredBB->getTerminator()))
567 return OverdefinedState;
568
569 int PredState = PredEndState->second;
570 assert(PredState != OverdefinedState &&
571 "overdefined BBs shouldn't be in FinalStates");
572 if (CommonState == OverdefinedState)
573 CommonState = PredState;
574
575 // At least two predecessors have different FinalStates,
576 // conservatively report this basic block as overdefined.
577 if (CommonState != PredState)
578 return OverdefinedState;
579 }
580
581 return CommonState;
582 }
583
584 // Calculate the intersection of all the InitialStates for a BasicBlock's
585 // successors.
getSuccState(DenseMap<BasicBlock *,int> & InitialStates,Function & F,int ParentBaseState,BasicBlock * BB)586 static int getSuccState(DenseMap<BasicBlock *, int> &InitialStates, Function &F,
587 int ParentBaseState, BasicBlock *BB) {
588 // This block rejoins normal control flow,
589 // conservatively report this basic block as overdefined.
590 if (isa<CatchReturnInst>(BB->getTerminator()))
591 return OverdefinedState;
592
593 int CommonState = OverdefinedState;
594 for (BasicBlock *SuccBB : successors(BB)) {
595 // We didn't manage to get a state for one of these predecessors,
596 // conservatively report this basic block as overdefined.
597 auto SuccStartState = InitialStates.find(SuccBB);
598 if (SuccStartState == InitialStates.end())
599 return OverdefinedState;
600
601 // This is an EH Pad, conservatively report this basic block as overdefined.
602 if (SuccBB->isEHPad())
603 return OverdefinedState;
604
605 int SuccState = SuccStartState->second;
606 assert(SuccState != OverdefinedState &&
607 "overdefined BBs shouldn't be in FinalStates");
608 if (CommonState == OverdefinedState)
609 CommonState = SuccState;
610
611 // At least two successors have different InitialStates,
612 // conservatively report this basic block as overdefined.
613 if (CommonState != SuccState)
614 return OverdefinedState;
615 }
616
617 return CommonState;
618 }
619
isStateStoreNeeded(EHPersonality Personality,CallSite CS)620 bool WinEHStatePass::isStateStoreNeeded(EHPersonality Personality,
621 CallSite CS) {
622 if (!CS)
623 return false;
624
625 // If the function touches memory, it needs a state store.
626 if (isAsynchronousEHPersonality(Personality))
627 return !CS.doesNotAccessMemory();
628
629 // If the function throws, it needs a state store.
630 return !CS.doesNotThrow();
631 }
632
addStateStores(Function & F,WinEHFuncInfo & FuncInfo)633 void WinEHStatePass::addStateStores(Function &F, WinEHFuncInfo &FuncInfo) {
634 // Mark the registration node. The backend needs to know which alloca it is so
635 // that it can recover the original frame pointer.
636 IRBuilder<> Builder(RegNode->getNextNode());
637 Value *RegNodeI8 = Builder.CreateBitCast(RegNode, Builder.getInt8PtrTy());
638 Builder.CreateCall(
639 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehregnode),
640 {RegNodeI8});
641
642 if (EHGuardNode) {
643 IRBuilder<> Builder(EHGuardNode->getNextNode());
644 Value *EHGuardNodeI8 =
645 Builder.CreateBitCast(EHGuardNode, Builder.getInt8PtrTy());
646 Builder.CreateCall(
647 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehguard),
648 {EHGuardNodeI8});
649 }
650
651 // Calculate state numbers.
652 if (isAsynchronousEHPersonality(Personality))
653 calculateSEHStateNumbers(&F, FuncInfo);
654 else
655 calculateWinCXXEHStateNumbers(&F, FuncInfo);
656
657 // Iterate all the instructions and emit state number stores.
658 DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(F);
659 ReversePostOrderTraversal<Function *> RPOT(&F);
660
661 // InitialStates yields the state of the first call-site for a BasicBlock.
662 DenseMap<BasicBlock *, int> InitialStates;
663 // FinalStates yields the state of the last call-site for a BasicBlock.
664 DenseMap<BasicBlock *, int> FinalStates;
665 // Worklist used to revisit BasicBlocks with indeterminate
666 // Initial/Final-States.
667 std::deque<BasicBlock *> Worklist;
668 // Fill in InitialStates and FinalStates for BasicBlocks with call-sites.
669 for (BasicBlock *BB : RPOT) {
670 int InitialState = OverdefinedState;
671 int FinalState;
672 if (&F.getEntryBlock() == BB)
673 InitialState = FinalState = ParentBaseState;
674 for (Instruction &I : *BB) {
675 CallSite CS(&I);
676 if (!isStateStoreNeeded(Personality, CS))
677 continue;
678
679 int State = getStateForCallSite(BlockColors, FuncInfo, CS);
680 if (InitialState == OverdefinedState)
681 InitialState = State;
682 FinalState = State;
683 }
684 // No call-sites in this basic block? That's OK, we will come back to these
685 // in a later pass.
686 if (InitialState == OverdefinedState) {
687 Worklist.push_back(BB);
688 continue;
689 }
690 LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
691 << " InitialState=" << InitialState << '\n');
692 LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
693 << " FinalState=" << FinalState << '\n');
694 InitialStates.insert({BB, InitialState});
695 FinalStates.insert({BB, FinalState});
696 }
697
698 // Try to fill-in InitialStates and FinalStates which have no call-sites.
699 while (!Worklist.empty()) {
700 BasicBlock *BB = Worklist.front();
701 Worklist.pop_front();
702 // This BasicBlock has already been figured out, nothing more we can do.
703 if (InitialStates.count(BB) != 0)
704 continue;
705
706 int PredState = getPredState(FinalStates, F, ParentBaseState, BB);
707 if (PredState == OverdefinedState)
708 continue;
709
710 // We successfully inferred this BasicBlock's state via it's predecessors;
711 // enqueue it's successors to see if we can infer their states.
712 InitialStates.insert({BB, PredState});
713 FinalStates.insert({BB, PredState});
714 for (BasicBlock *SuccBB : successors(BB))
715 Worklist.push_back(SuccBB);
716 }
717
718 // Try to hoist stores from successors.
719 for (BasicBlock *BB : RPOT) {
720 int SuccState = getSuccState(InitialStates, F, ParentBaseState, BB);
721 if (SuccState == OverdefinedState)
722 continue;
723
724 // Update our FinalState to reflect the common InitialState of our
725 // successors.
726 FinalStates.insert({BB, SuccState});
727 }
728
729 // Finally, insert state stores before call-sites which transition us to a new
730 // state.
731 for (BasicBlock *BB : RPOT) {
732 auto &BBColors = BlockColors[BB];
733 BasicBlock *FuncletEntryBB = BBColors.front();
734 if (isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI()))
735 continue;
736
737 int PrevState = getPredState(FinalStates, F, ParentBaseState, BB);
738 LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
739 << " PrevState=" << PrevState << '\n');
740
741 for (Instruction &I : *BB) {
742 CallSite CS(&I);
743 if (!isStateStoreNeeded(Personality, CS))
744 continue;
745
746 int State = getStateForCallSite(BlockColors, FuncInfo, CS);
747 if (State != PrevState)
748 insertStateNumberStore(&I, State);
749 PrevState = State;
750 }
751
752 // We might have hoisted a state store into this block, emit it now.
753 auto EndState = FinalStates.find(BB);
754 if (EndState != FinalStates.end())
755 if (EndState->second != PrevState)
756 insertStateNumberStore(BB->getTerminator(), EndState->second);
757 }
758
759 SmallVector<CallSite, 1> SetJmp3CallSites;
760 for (BasicBlock *BB : RPOT) {
761 for (Instruction &I : *BB) {
762 CallSite CS(&I);
763 if (!CS)
764 continue;
765 if (CS.getCalledValue()->stripPointerCasts() !=
766 SetJmp3.getCallee()->stripPointerCasts())
767 continue;
768
769 SetJmp3CallSites.push_back(CS);
770 }
771 }
772
773 for (CallSite CS : SetJmp3CallSites) {
774 auto &BBColors = BlockColors[CS->getParent()];
775 BasicBlock *FuncletEntryBB = BBColors.front();
776 bool InCleanup = isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI());
777
778 IRBuilder<> Builder(CS.getInstruction());
779 Value *State;
780 if (InCleanup) {
781 Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
782 RegNode, StateFieldIndex);
783 State = Builder.CreateLoad(Builder.getInt32Ty(), StateField);
784 } else {
785 State = Builder.getInt32(getStateForCallSite(BlockColors, FuncInfo, CS));
786 }
787 rewriteSetJmpCallSite(Builder, F, CS, State);
788 }
789 }
790
insertStateNumberStore(Instruction * IP,int State)791 void WinEHStatePass::insertStateNumberStore(Instruction *IP, int State) {
792 IRBuilder<> Builder(IP);
793 Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
794 RegNode, StateFieldIndex);
795 Builder.CreateStore(Builder.getInt32(State), StateField);
796 }
797