1 //===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // All functions using an MSVC EH personality use an explicitly updated state
11 // number stored in an exception registration stack object. The registration
12 // object is linked into a thread-local chain of registrations stored at fs:00.
13 // This pass adds the registration object and EH state updates.
15 //===----------------------------------------------------------------------===//
18 #include "llvm/Analysis/LibCallSemantics.h"
19 #include "llvm/CodeGen/MachineModuleInfo.h"
20 #include "llvm/CodeGen/Passes.h"
21 #include "llvm/CodeGen/WinEHFuncInfo.h"
22 #include "llvm/IR/Dominators.h"
23 #include "llvm/IR/Function.h"
24 #include "llvm/IR/IRBuilder.h"
25 #include "llvm/IR/Instructions.h"
26 #include "llvm/IR/IntrinsicInst.h"
27 #include "llvm/IR/Module.h"
28 #include "llvm/IR/PatternMatch.h"
29 #include "llvm/Pass.h"
30 #include "llvm/Support/Debug.h"
31 #include "llvm/Support/raw_ostream.h"
32 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
33 #include "llvm/Transforms/Utils/Cloning.h"
34 #include "llvm/Transforms/Utils/Local.h"
37 using namespace llvm::PatternMatch;
39 #define DEBUG_TYPE "winehstate"
42 class WinEHStatePass : public FunctionPass {
44 static char ID; // Pass identification, replacement for typeid.
46 WinEHStatePass() : FunctionPass(ID) {}
48 bool runOnFunction(Function &Fn) override;
50 bool doInitialization(Module &M) override;
52 bool doFinalization(Module &M) override;
54 void getAnalysisUsage(AnalysisUsage &AU) const override;
56 const char *getPassName() const override {
57 return "Windows 32-bit x86 EH state insertion";
61 void emitExceptionRegistrationRecord(Function *F);
63 void linkExceptionRegistration(IRBuilder<> &Builder, Value *Handler);
64 void unlinkExceptionRegistration(IRBuilder<> &Builder);
65 void addCXXStateStores(Function &F, MachineModuleInfo &MMI);
66 void addCXXStateStoresToFunclet(Value *ParentRegNode, WinEHFuncInfo &FuncInfo,
67 Function &F, int BaseState);
68 void insertStateNumberStore(Value *ParentRegNode, Instruction *IP, int State);
70 Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
72 Function *generateLSDAInEAXThunk(Function *ParentFunc);
74 int escapeRegNode(Function &F);
76 // Module-level type getters.
77 Type *getEHRegistrationType();
78 Type *getSEH3RegistrationType();
79 Type *getSEH4RegistrationType();
80 Type *getCXXEH3RegistrationType();
83 Module *TheModule = nullptr;
84 StructType *EHRegistrationTy = nullptr;
85 StructType *CXXEH3RegistrationTy = nullptr;
86 StructType *SEH3RegistrationTy = nullptr;
87 StructType *SEH4RegistrationTy = nullptr;
90 EHPersonality Personality = EHPersonality::Unknown;
91 Function *PersonalityFn = nullptr;
93 /// The stack allocation containing all EH data, including the link in the
94 /// fs:00 chain and the current state.
95 AllocaInst *RegNode = nullptr;
97 /// Struct type of RegNode. Used for GEPing.
98 Type *RegNodeTy = nullptr;
100 /// The index of the state field of RegNode.
101 int StateFieldIndex = ~0U;
103 /// The linked list node subobject inside of RegNode.
104 Value *Link = nullptr;
108 FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
110 char WinEHStatePass::ID = 0;
112 bool WinEHStatePass::doInitialization(Module &M) {
117 bool WinEHStatePass::doFinalization(Module &M) {
118 assert(TheModule == &M);
120 EHRegistrationTy = nullptr;
121 CXXEH3RegistrationTy = nullptr;
122 SEH3RegistrationTy = nullptr;
123 SEH4RegistrationTy = nullptr;
127 void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
128 // This pass should only insert a stack allocation, memory accesses, and
130 AU.setPreservesCFG();
133 bool WinEHStatePass::runOnFunction(Function &F) {
134 // If this is an outlined handler, don't do anything. We'll do state insertion
135 // for it in the parent.
136 StringRef WinEHParentName =
137 F.getFnAttribute("wineh-parent").getValueAsString();
138 if (WinEHParentName != F.getName() && !WinEHParentName.empty())
141 // Check the personality. Do nothing if this is not an MSVC personality.
142 LandingPadInst *LP = nullptr;
143 for (BasicBlock &BB : F) {
144 LP = BB.getLandingPadInst();
151 dyn_cast<Function>(LP->getPersonalityFn()->stripPointerCasts());
154 Personality = classifyEHPersonality(PersonalityFn);
155 if (!isMSVCEHPersonality(Personality))
158 // Disable frame pointer elimination in this function.
159 // FIXME: Do the nested handlers need to keep the parent ebp in ebp, or can we
160 // use an arbitrary register?
161 F.addFnAttr("no-frame-pointer-elim", "true");
163 emitExceptionRegistrationRecord(&F);
165 auto *MMIPtr = getAnalysisIfAvailable<MachineModuleInfo>();
166 assert(MMIPtr && "MachineModuleInfo should always be available");
167 MachineModuleInfo &MMI = *MMIPtr;
168 if (Personality == EHPersonality::MSVC_CXX) {
169 addCXXStateStores(F, MMI);
172 // Reset per-function state.
173 PersonalityFn = nullptr;
174 Personality = EHPersonality::Unknown;
178 /// Get the common EH registration subobject:
179 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
180 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
181 /// struct EHRegistrationNode {
182 /// EHRegistrationNode *Next;
183 /// PEXCEPTION_ROUTINE Handler;
185 Type *WinEHStatePass::getEHRegistrationType() {
186 if (EHRegistrationTy)
187 return EHRegistrationTy;
188 LLVMContext &Context = TheModule->getContext();
189 EHRegistrationTy = StructType::create(Context, "EHRegistrationNode");
191 EHRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
192 Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
194 EHRegistrationTy->setBody(FieldTys, false);
195 return EHRegistrationTy;
198 /// The __CxxFrameHandler3 registration node:
199 /// struct CXXExceptionRegistration {
201 /// EHRegistrationNode SubRecord;
202 /// int32_t TryLevel;
204 Type *WinEHStatePass::getCXXEH3RegistrationType() {
205 if (CXXEH3RegistrationTy)
206 return CXXEH3RegistrationTy;
207 LLVMContext &Context = TheModule->getContext();
209 Type::getInt8PtrTy(Context), // void *SavedESP
210 getEHRegistrationType(), // EHRegistrationNode SubRecord
211 Type::getInt32Ty(Context) // int32_t TryLevel
213 CXXEH3RegistrationTy =
214 StructType::create(FieldTys, "CXXExceptionRegistration");
215 return CXXEH3RegistrationTy;
218 /// The _except_handler3 registration node:
219 /// struct EH3ExceptionRegistration {
220 /// EHRegistrationNode SubRecord;
221 /// void *ScopeTable;
222 /// int32_t TryLevel;
224 Type *WinEHStatePass::getSEH3RegistrationType() {
225 if (SEH3RegistrationTy)
226 return SEH3RegistrationTy;
227 LLVMContext &Context = TheModule->getContext();
229 getEHRegistrationType(), // EHRegistrationNode SubRecord
230 Type::getInt8PtrTy(Context), // void *ScopeTable
231 Type::getInt32Ty(Context) // int32_t TryLevel
233 SEH3RegistrationTy = StructType::create(FieldTys, "EH3ExceptionRegistration");
234 return SEH3RegistrationTy;
237 /// The _except_handler4 registration node:
238 /// struct EH4ExceptionRegistration {
240 /// _EXCEPTION_POINTERS *ExceptionPointers;
241 /// EHRegistrationNode SubRecord;
242 /// int32_t EncodedScopeTable;
243 /// int32_t TryLevel;
245 Type *WinEHStatePass::getSEH4RegistrationType() {
246 if (SEH4RegistrationTy)
247 return SEH4RegistrationTy;
248 LLVMContext &Context = TheModule->getContext();
250 Type::getInt8PtrTy(Context), // void *SavedESP
251 Type::getInt8PtrTy(Context), // void *ExceptionPointers
252 getEHRegistrationType(), // EHRegistrationNode SubRecord
253 Type::getInt32Ty(Context), // int32_t EncodedScopeTable
254 Type::getInt32Ty(Context) // int32_t TryLevel
256 SEH4RegistrationTy = StructType::create(FieldTys, "EH4ExceptionRegistration");
257 return SEH4RegistrationTy;
260 // Emit an exception registration record. These are stack allocations with the
261 // common subobject of two pointers: the previous registration record (the old
262 // fs:00) and the personality function for the current frame. The data before
263 // and after that is personality function specific.
264 void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
265 assert(Personality == EHPersonality::MSVC_CXX ||
266 Personality == EHPersonality::MSVC_X86SEH);
268 StringRef PersonalityName = PersonalityFn->getName();
269 IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
270 Type *Int8PtrType = Builder.getInt8PtrTy();
271 if (PersonalityName == "__CxxFrameHandler3") {
272 RegNodeTy = getCXXEH3RegistrationType();
273 RegNode = Builder.CreateAlloca(RegNodeTy);
274 // FIXME: We can skip this in -GS- mode, when we figure that out.
275 // SavedESP = llvm.stacksave()
276 Value *SP = Builder.CreateCall(
277 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
278 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
281 insertStateNumberStore(RegNode, Builder.GetInsertPoint(), -1);
282 // Handler = __ehhandler$F
283 Function *Trampoline = generateLSDAInEAXThunk(F);
284 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
285 linkExceptionRegistration(Builder, Trampoline);
286 } else if (PersonalityName == "_except_handler3") {
287 RegNodeTy = getSEH3RegistrationType();
288 RegNode = Builder.CreateAlloca(RegNodeTy);
291 insertStateNumberStore(RegNode, Builder.GetInsertPoint(), -1);
292 // ScopeTable = llvm.x86.seh.lsda(F)
293 Value *LSDA = emitEHLSDA(Builder, F);
294 Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 1));
295 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 0);
296 linkExceptionRegistration(Builder, PersonalityFn);
297 } else if (PersonalityName == "_except_handler4") {
298 RegNodeTy = getSEH4RegistrationType();
299 RegNode = Builder.CreateAlloca(RegNodeTy);
300 // SavedESP = llvm.stacksave()
301 Value *SP = Builder.CreateCall(
302 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
303 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
306 insertStateNumberStore(RegNode, Builder.GetInsertPoint(), -1);
307 // FIXME: XOR the LSDA with __security_cookie.
308 // ScopeTable = llvm.x86.seh.lsda(F)
309 Value *FI8 = Builder.CreateBitCast(F, Int8PtrType);
310 Value *LSDA = Builder.CreateCall(
311 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
312 Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 1));
313 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
314 linkExceptionRegistration(Builder, PersonalityFn);
316 llvm_unreachable("unexpected personality function");
319 // Insert an unlink before all returns.
320 for (BasicBlock &BB : *F) {
321 TerminatorInst *T = BB.getTerminator();
322 if (!isa<ReturnInst>(T))
324 Builder.SetInsertPoint(T);
325 unlinkExceptionRegistration(Builder);
329 Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
330 Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
331 return Builder.CreateCall(
332 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
335 /// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
336 /// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
337 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
338 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
339 /// We essentially want this code:
341 /// jmpl ___CxxFrameHandler3
342 Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
343 LLVMContext &Context = ParentFunc->getContext();
344 Type *Int32Ty = Type::getInt32Ty(Context);
345 Type *Int8PtrType = Type::getInt8PtrTy(Context);
346 Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
348 FunctionType *TrampolineTy =
349 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
351 FunctionType *TargetFuncTy =
352 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
354 Function *Trampoline = Function::Create(
355 TrampolineTy, GlobalValue::InternalLinkage,
356 Twine("__ehhandler$") + ParentFunc->getName(), TheModule);
357 BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
358 IRBuilder<> Builder(EntryBB);
359 Value *LSDA = emitEHLSDA(Builder, ParentFunc);
360 Value *CastPersonality =
361 Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
362 auto AI = Trampoline->arg_begin();
363 Value *Args[5] = {LSDA, AI++, AI++, AI++, AI++};
364 CallInst *Call = Builder.CreateCall(CastPersonality, Args);
365 // Can't use musttail due to prototype mismatch, but we can use tail.
366 Call->setTailCall(true);
367 // Set inreg so we pass it in EAX.
368 Call->addAttribute(1, Attribute::InReg);
369 Builder.CreateRet(Call);
373 void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
375 Type *LinkTy = getEHRegistrationType();
377 Handler = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
378 Builder.CreateStore(Handler, Builder.CreateStructGEP(LinkTy, Link, 1));
381 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
382 Value *Next = Builder.CreateLoad(FSZero);
383 Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
385 Builder.CreateStore(Link, FSZero);
388 void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
389 // Clone Link into the current BB for better address mode folding.
390 if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
391 GEP = cast<GetElementPtrInst>(GEP->clone());
395 Type *LinkTy = getEHRegistrationType();
396 // [fs:00] = Link->Next
398 Builder.CreateLoad(Builder.CreateStructGEP(LinkTy, Link, 0));
400 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
401 Builder.CreateStore(Next, FSZero);
404 void WinEHStatePass::addCXXStateStores(Function &F, MachineModuleInfo &MMI) {
405 WinEHFuncInfo &FuncInfo = MMI.getWinEHFuncInfo(&F);
406 calculateWinCXXEHStateNumbers(&F, FuncInfo);
408 // The base state for the parent is -1.
409 addCXXStateStoresToFunclet(RegNode, FuncInfo, F, -1);
411 // Set up RegNodeEscapeIndex
412 int RegNodeEscapeIndex = escapeRegNode(F);
414 // Only insert stores in catch handlers.
415 Function *FrameRecover =
416 Intrinsic::getDeclaration(TheModule, Intrinsic::framerecover);
417 Function *FrameAddress =
418 Intrinsic::getDeclaration(TheModule, Intrinsic::frameaddress);
420 ConstantExpr::getBitCast(&F, Type::getInt8PtrTy(TheModule->getContext()));
421 for (auto P : FuncInfo.HandlerBaseState) {
422 Function *Handler = const_cast<Function *>(P.first);
423 int BaseState = P.second;
424 IRBuilder<> Builder(&Handler->getEntryBlock(),
425 Handler->getEntryBlock().begin());
426 // FIXME: Find and reuse such a call if present.
427 Value *ParentFP = Builder.CreateCall(FrameAddress, {Builder.getInt32(1)});
428 Value *RecoveredRegNode = Builder.CreateCall(
429 FrameRecover, {FI8, ParentFP, Builder.getInt32(RegNodeEscapeIndex)});
431 Builder.CreateBitCast(RecoveredRegNode, RegNodeTy->getPointerTo(0));
432 addCXXStateStoresToFunclet(RecoveredRegNode, FuncInfo, *Handler, BaseState);
436 /// Escape RegNode so that we can access it from child handlers. Find the call
437 /// to frameescape, if any, in the entry block and append RegNode to the list
439 int WinEHStatePass::escapeRegNode(Function &F) {
440 // Find the call to frameescape and extract its arguments.
441 IntrinsicInst *EscapeCall = nullptr;
442 for (Instruction &I : F.getEntryBlock()) {
443 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I);
444 if (II && II->getIntrinsicID() == Intrinsic::frameescape) {
449 SmallVector<Value *, 8> Args;
451 auto Ops = EscapeCall->arg_operands();
452 Args.append(Ops.begin(), Ops.end());
454 Args.push_back(RegNode);
456 // Replace the call (if it exists) with new one. Otherwise, insert at the end
457 // of the entry block.
458 IRBuilder<> Builder(&F.getEntryBlock(),
459 EscapeCall ? EscapeCall : F.getEntryBlock().end());
461 Intrinsic::getDeclaration(TheModule, Intrinsic::frameescape), Args);
463 EscapeCall->eraseFromParent();
464 return Args.size() - 1;
467 void WinEHStatePass::addCXXStateStoresToFunclet(Value *ParentRegNode,
468 WinEHFuncInfo &FuncInfo,
469 Function &F, int BaseState) {
470 // Iterate all the instructions and emit state number stores.
471 for (BasicBlock &BB : F) {
472 for (Instruction &I : BB) {
473 if (auto *CI = dyn_cast<CallInst>(&I)) {
474 // Possibly throwing call instructions have no actions to take after
475 // an unwind. Ensure they are in the -1 state.
476 if (CI->doesNotThrow())
478 insertStateNumberStore(ParentRegNode, CI, BaseState);
479 } else if (auto *II = dyn_cast<InvokeInst>(&I)) {
480 // Look up the state number of the landingpad this unwinds to.
481 LandingPadInst *LPI = II->getUnwindDest()->getLandingPadInst();
482 // FIXME: Why does this assertion fail?
483 //assert(FuncInfo.LandingPadStateMap.count(LPI) && "LP has no state!");
484 int State = FuncInfo.LandingPadStateMap[LPI];
485 insertStateNumberStore(ParentRegNode, II, State);
491 void WinEHStatePass::insertStateNumberStore(Value *ParentRegNode,
492 Instruction *IP, int State) {
493 IRBuilder<> Builder(IP);
495 Builder.CreateStructGEP(RegNodeTy, ParentRegNode, StateFieldIndex);
496 Builder.CreateStore(Builder.getInt32(State), StateField);