1 //===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // All functions using an MSVC EH personality use an explicitly updated state
11 // number stored in an exception registration stack object. The registration
12 // object is linked into a thread-local chain of registrations stored at fs:00.
13 // This pass adds the registration object and EH state updates.
15 //===----------------------------------------------------------------------===//
18 #include "llvm/Analysis/LibCallSemantics.h"
19 #include "llvm/CodeGen/MachineModuleInfo.h"
20 #include "llvm/CodeGen/Passes.h"
21 #include "llvm/CodeGen/WinEHFuncInfo.h"
22 #include "llvm/IR/Dominators.h"
23 #include "llvm/IR/Function.h"
24 #include "llvm/IR/IRBuilder.h"
25 #include "llvm/IR/Instructions.h"
26 #include "llvm/IR/IntrinsicInst.h"
27 #include "llvm/IR/Module.h"
28 #include "llvm/IR/PatternMatch.h"
29 #include "llvm/Pass.h"
30 #include "llvm/Support/Debug.h"
31 #include "llvm/Support/raw_ostream.h"
32 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
33 #include "llvm/Transforms/Utils/Cloning.h"
34 #include "llvm/Transforms/Utils/Local.h"
37 using namespace llvm::PatternMatch;
39 #define DEBUG_TYPE "winehstate"
42 class WinEHStatePass : public FunctionPass {
44 static char ID; // Pass identification, replacement for typeid.
46 WinEHStatePass() : FunctionPass(ID) {}
48 bool runOnFunction(Function &Fn) override;
50 bool doInitialization(Module &M) override;
52 bool doFinalization(Module &M) override;
54 void getAnalysisUsage(AnalysisUsage &AU) const override;
56 const char *getPassName() const override {
57 return "Windows 32-bit x86 EH state insertion";
61 void emitExceptionRegistrationRecord(Function *F);
63 void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
64 void unlinkExceptionRegistration(IRBuilder<> &Builder);
65 void addCXXStateStores(Function &F, MachineModuleInfo &MMI);
66 void addSEHStateStores(Function &F, MachineModuleInfo &MMI);
67 void addCXXStateStoresToFunclet(Value *ParentRegNode, WinEHFuncInfo &FuncInfo,
68 Function &F, int BaseState);
69 void insertStateNumberStore(Value *ParentRegNode, Instruction *IP, int State);
70 iplist<Instruction>::iterator
71 rewriteExceptionInfoIntrinsics(IntrinsicInst *Intrin);
73 Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
75 Function *generateLSDAInEAXThunk(Function *ParentFunc);
77 int escapeRegNode(Function &F);
79 // Module-level type getters.
80 Type *getEHLinkRegistrationType();
81 Type *getSEHRegistrationType();
82 Type *getCXXEHRegistrationType();
85 Module *TheModule = nullptr;
86 StructType *EHLinkRegistrationTy = nullptr;
87 StructType *CXXEHRegistrationTy = nullptr;
88 StructType *SEHRegistrationTy = nullptr;
89 Function *FrameRecover = nullptr;
90 Function *FrameAddress = nullptr;
91 Function *FrameEscape = nullptr;
94 EHPersonality Personality = EHPersonality::Unknown;
95 Function *PersonalityFn = nullptr;
97 /// The stack allocation containing all EH data, including the link in the
98 /// fs:00 chain and the current state.
99 AllocaInst *RegNode = nullptr;
101 /// Struct type of RegNode. Used for GEPing.
102 Type *RegNodeTy = nullptr;
104 /// The index of the state field of RegNode.
105 int StateFieldIndex = ~0U;
107 /// The linked list node subobject inside of RegNode.
108 Value *Link = nullptr;
112 FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
114 char WinEHStatePass::ID = 0;
116 bool WinEHStatePass::doInitialization(Module &M) {
118 FrameEscape = Intrinsic::getDeclaration(TheModule, Intrinsic::frameescape);
119 FrameRecover = Intrinsic::getDeclaration(TheModule, Intrinsic::framerecover);
120 FrameAddress = Intrinsic::getDeclaration(TheModule, Intrinsic::frameaddress);
124 bool WinEHStatePass::doFinalization(Module &M) {
125 assert(TheModule == &M);
127 EHLinkRegistrationTy = nullptr;
128 CXXEHRegistrationTy = nullptr;
129 SEHRegistrationTy = nullptr;
130 FrameEscape = nullptr;
131 FrameRecover = nullptr;
132 FrameAddress = nullptr;
136 void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
137 // This pass should only insert a stack allocation, memory accesses, and
139 AU.setPreservesCFG();
142 bool WinEHStatePass::runOnFunction(Function &F) {
143 // If this is an outlined handler, don't do anything. We'll do state insertion
144 // for it in the parent.
145 StringRef WinEHParentName =
146 F.getFnAttribute("wineh-parent").getValueAsString();
147 if (WinEHParentName != F.getName() && !WinEHParentName.empty())
150 // Check the personality. Do nothing if this is not an MSVC personality.
151 LandingPadInst *LP = nullptr;
152 for (BasicBlock &BB : F) {
153 LP = BB.getLandingPadInst();
160 dyn_cast<Function>(LP->getPersonalityFn()->stripPointerCasts());
163 Personality = classifyEHPersonality(PersonalityFn);
164 if (!isMSVCEHPersonality(Personality))
167 // Disable frame pointer elimination in this function.
168 // FIXME: Do the nested handlers need to keep the parent ebp in ebp, or can we
169 // use an arbitrary register?
170 F.addFnAttr("no-frame-pointer-elim", "true");
172 emitExceptionRegistrationRecord(&F);
174 auto *MMIPtr = getAnalysisIfAvailable<MachineModuleInfo>();
175 assert(MMIPtr && "MachineModuleInfo should always be available");
176 MachineModuleInfo &MMI = *MMIPtr;
177 switch (Personality) {
178 default: llvm_unreachable("unexpected personality function");
179 case EHPersonality::MSVC_CXX: addCXXStateStores(F, MMI); break;
180 case EHPersonality::MSVC_X86SEH: addSEHStateStores(F, MMI); break;
183 // Reset per-function state.
184 PersonalityFn = nullptr;
185 Personality = EHPersonality::Unknown;
189 /// Get the common EH registration subobject:
190 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
191 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
192 /// struct EHRegistrationNode {
193 /// EHRegistrationNode *Next;
194 /// PEXCEPTION_ROUTINE Handler;
196 Type *WinEHStatePass::getEHLinkRegistrationType() {
197 if (EHLinkRegistrationTy)
198 return EHLinkRegistrationTy;
199 LLVMContext &Context = TheModule->getContext();
200 EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
202 EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
203 Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
205 EHLinkRegistrationTy->setBody(FieldTys, false);
206 return EHLinkRegistrationTy;
209 /// The __CxxFrameHandler3 registration node:
210 /// struct CXXExceptionRegistration {
212 /// EHRegistrationNode SubRecord;
213 /// int32_t TryLevel;
215 Type *WinEHStatePass::getCXXEHRegistrationType() {
216 if (CXXEHRegistrationTy)
217 return CXXEHRegistrationTy;
218 LLVMContext &Context = TheModule->getContext();
220 Type::getInt8PtrTy(Context), // void *SavedESP
221 getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
222 Type::getInt32Ty(Context) // int32_t TryLevel
224 CXXEHRegistrationTy =
225 StructType::create(FieldTys, "CXXExceptionRegistration");
226 return CXXEHRegistrationTy;
229 /// The _except_handler3/4 registration node:
230 /// struct EH4ExceptionRegistration {
232 /// _EXCEPTION_POINTERS *ExceptionPointers;
233 /// EHRegistrationNode SubRecord;
234 /// int32_t EncodedScopeTable;
235 /// int32_t TryLevel;
237 Type *WinEHStatePass::getSEHRegistrationType() {
238 if (SEHRegistrationTy)
239 return SEHRegistrationTy;
240 LLVMContext &Context = TheModule->getContext();
242 Type::getInt8PtrTy(Context), // void *SavedESP
243 Type::getInt8PtrTy(Context), // void *ExceptionPointers
244 getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
245 Type::getInt32Ty(Context), // int32_t EncodedScopeTable
246 Type::getInt32Ty(Context) // int32_t TryLevel
248 SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
249 return SEHRegistrationTy;
252 // Emit an exception registration record. These are stack allocations with the
253 // common subobject of two pointers: the previous registration record (the old
254 // fs:00) and the personality function for the current frame. The data before
255 // and after that is personality function specific.
256 void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
257 assert(Personality == EHPersonality::MSVC_CXX ||
258 Personality == EHPersonality::MSVC_X86SEH);
260 StringRef PersonalityName = PersonalityFn->getName();
261 IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
262 Type *Int8PtrType = Builder.getInt8PtrTy();
263 if (Personality == EHPersonality::MSVC_CXX) {
264 RegNodeTy = getCXXEHRegistrationType();
265 RegNode = Builder.CreateAlloca(RegNodeTy);
266 // SavedESP = llvm.stacksave()
267 Value *SP = Builder.CreateCall(
268 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
269 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
272 insertStateNumberStore(RegNode, Builder.GetInsertPoint(), -1);
273 // Handler = __ehhandler$F
274 Function *Trampoline = generateLSDAInEAXThunk(F);
275 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
276 linkExceptionRegistration(Builder, Trampoline);
277 } else if (Personality == EHPersonality::MSVC_X86SEH) {
278 // If _except_handler4 is in use, some additional guard checks and prologue
279 // stuff is required.
280 bool UseStackGuard = (PersonalityName == "_except_handler4");
281 RegNodeTy = getSEHRegistrationType();
282 RegNode = Builder.CreateAlloca(RegNodeTy);
283 // SavedESP = llvm.stacksave()
284 Value *SP = Builder.CreateCall(
285 Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
286 Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
287 // TryLevel = -2 / -1
289 insertStateNumberStore(RegNode, Builder.GetInsertPoint(),
290 UseStackGuard ? -2 : -1);
291 // ScopeTable = llvm.x86.seh.lsda(F)
292 Value *FI8 = Builder.CreateBitCast(F, Int8PtrType);
293 Value *LSDA = Builder.CreateCall(
294 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
295 Type *Int32Ty = Type::getInt32Ty(TheModule->getContext());
296 LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
297 // If using _except_handler4, xor the address of the table with
298 // __security_cookie.
301 TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
302 Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
303 LSDA = Builder.CreateXor(LSDA, Val);
305 Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
306 Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
307 linkExceptionRegistration(Builder, PersonalityFn);
309 llvm_unreachable("unexpected personality function");
312 // Insert an unlink before all returns.
313 for (BasicBlock &BB : *F) {
314 TerminatorInst *T = BB.getTerminator();
315 if (!isa<ReturnInst>(T))
317 Builder.SetInsertPoint(T);
318 unlinkExceptionRegistration(Builder);
322 Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
323 Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
324 return Builder.CreateCall(
325 Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
328 /// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
329 /// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
330 /// typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
331 /// _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
332 /// We essentially want this code:
334 /// jmpl ___CxxFrameHandler3
335 Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
336 LLVMContext &Context = ParentFunc->getContext();
337 Type *Int32Ty = Type::getInt32Ty(Context);
338 Type *Int8PtrType = Type::getInt8PtrTy(Context);
339 Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
341 FunctionType *TrampolineTy =
342 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
344 FunctionType *TargetFuncTy =
345 FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
347 Function *Trampoline = Function::Create(
348 TrampolineTy, GlobalValue::InternalLinkage,
349 Twine("__ehhandler$") + ParentFunc->getName(), TheModule);
350 BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
351 IRBuilder<> Builder(EntryBB);
352 Value *LSDA = emitEHLSDA(Builder, ParentFunc);
353 Value *CastPersonality =
354 Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
355 auto AI = Trampoline->arg_begin();
356 Value *Args[5] = {LSDA, AI++, AI++, AI++, AI++};
357 CallInst *Call = Builder.CreateCall(CastPersonality, Args);
358 // Can't use musttail due to prototype mismatch, but we can use tail.
359 Call->setTailCall(true);
360 // Set inreg so we pass it in EAX.
361 Call->addAttribute(1, Attribute::InReg);
362 Builder.CreateRet(Call);
366 void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
368 // Emit the .safeseh directive for this function.
369 Handler->addFnAttr("safeseh");
371 Type *LinkTy = getEHLinkRegistrationType();
373 Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
374 Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
377 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
378 Value *Next = Builder.CreateLoad(FSZero);
379 Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
381 Builder.CreateStore(Link, FSZero);
384 void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
385 // Clone Link into the current BB for better address mode folding.
386 if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
387 GEP = cast<GetElementPtrInst>(GEP->clone());
391 Type *LinkTy = getEHLinkRegistrationType();
392 // [fs:00] = Link->Next
394 Builder.CreateLoad(Builder.CreateStructGEP(LinkTy, Link, 0));
396 Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
397 Builder.CreateStore(Next, FSZero);
400 void WinEHStatePass::addCXXStateStores(Function &F, MachineModuleInfo &MMI) {
401 WinEHFuncInfo &FuncInfo = MMI.getWinEHFuncInfo(&F);
402 calculateWinCXXEHStateNumbers(&F, FuncInfo);
404 // The base state for the parent is -1.
405 addCXXStateStoresToFunclet(RegNode, FuncInfo, F, -1);
407 // Set up RegNodeEscapeIndex
408 int RegNodeEscapeIndex = escapeRegNode(F);
410 // Only insert stores in catch handlers.
412 ConstantExpr::getBitCast(&F, Type::getInt8PtrTy(TheModule->getContext()));
413 for (auto P : FuncInfo.HandlerBaseState) {
414 Function *Handler = const_cast<Function *>(P.first);
415 int BaseState = P.second;
416 IRBuilder<> Builder(&Handler->getEntryBlock(),
417 Handler->getEntryBlock().begin());
418 // FIXME: Find and reuse such a call if present.
419 Value *ParentFP = Builder.CreateCall(FrameAddress, {Builder.getInt32(1)});
420 Value *RecoveredRegNode = Builder.CreateCall(
421 FrameRecover, {FI8, ParentFP, Builder.getInt32(RegNodeEscapeIndex)});
423 Builder.CreateBitCast(RecoveredRegNode, RegNodeTy->getPointerTo(0));
424 addCXXStateStoresToFunclet(RecoveredRegNode, FuncInfo, *Handler, BaseState);
428 /// Escape RegNode so that we can access it from child handlers. Find the call
429 /// to frameescape, if any, in the entry block and append RegNode to the list
431 int WinEHStatePass::escapeRegNode(Function &F) {
432 // Find the call to frameescape and extract its arguments.
433 IntrinsicInst *EscapeCall = nullptr;
434 for (Instruction &I : F.getEntryBlock()) {
435 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I);
436 if (II && II->getIntrinsicID() == Intrinsic::frameescape) {
441 SmallVector<Value *, 8> Args;
443 auto Ops = EscapeCall->arg_operands();
444 Args.append(Ops.begin(), Ops.end());
446 Args.push_back(RegNode);
448 // Replace the call (if it exists) with new one. Otherwise, insert at the end
449 // of the entry block.
450 IRBuilder<> Builder(&F.getEntryBlock(),
451 EscapeCall ? EscapeCall : F.getEntryBlock().end());
452 Builder.CreateCall(FrameEscape, Args);
454 EscapeCall->eraseFromParent();
455 return Args.size() - 1;
458 void WinEHStatePass::addCXXStateStoresToFunclet(Value *ParentRegNode,
459 WinEHFuncInfo &FuncInfo,
460 Function &F, int BaseState) {
461 // Iterate all the instructions and emit state number stores.
462 for (BasicBlock &BB : F) {
463 for (Instruction &I : BB) {
464 if (auto *CI = dyn_cast<CallInst>(&I)) {
465 // Possibly throwing call instructions have no actions to take after
466 // an unwind. Ensure they are in the -1 state.
467 if (CI->doesNotThrow())
469 insertStateNumberStore(ParentRegNode, CI, BaseState);
470 } else if (auto *II = dyn_cast<InvokeInst>(&I)) {
471 // Look up the state number of the landingpad this unwinds to.
472 LandingPadInst *LPI = II->getUnwindDest()->getLandingPadInst();
473 // FIXME: Why does this assertion fail?
474 //assert(FuncInfo.LandingPadStateMap.count(LPI) && "LP has no state!");
475 int State = FuncInfo.LandingPadStateMap[LPI];
476 insertStateNumberStore(ParentRegNode, II, State);
482 /// Assign every distinct landingpad a unique state number for SEH. Unlike C++
483 /// EH, we can use this very simple algorithm while C++ EH cannot because catch
484 /// handlers aren't outlined and the runtime doesn't have to figure out which
485 /// catch handler frame to unwind to.
486 /// FIXME: __finally blocks are outlined, so this approach may break down there.
487 void WinEHStatePass::addSEHStateStores(Function &F, MachineModuleInfo &MMI) {
488 WinEHFuncInfo &FuncInfo = MMI.getWinEHFuncInfo(&F);
490 // Iterate all the instructions and emit state number stores.
492 SmallPtrSet<BasicBlock *, 4> ExceptBlocks;
493 for (BasicBlock &BB : F) {
494 for (auto I = BB.begin(), E = BB.end(); I != E; ++I) {
495 if (auto *CI = dyn_cast<CallInst>(I)) {
496 auto *Intrin = dyn_cast<IntrinsicInst>(CI);
498 I = rewriteExceptionInfoIntrinsics(Intrin);
499 // Calls that "don't throw" are considered to be able to throw asynch
500 // exceptions, but intrinsics cannot.
503 insertStateNumberStore(RegNode, CI, -1);
504 } else if (auto *II = dyn_cast<InvokeInst>(I)) {
505 // Look up the state number of the landingpad this unwinds to.
506 LandingPadInst *LPI = II->getUnwindDest()->getLandingPadInst();
508 FuncInfo.LandingPadStateMap.insert(std::make_pair(LPI, 0));
509 auto Iter = InsertionPair.first;
510 int &State = Iter->second;
511 bool Inserted = InsertionPair.second;
513 // Each action consumes a state number.
514 auto *EHActions = cast<IntrinsicInst>(LPI->getNextNode());
515 SmallVector<std::unique_ptr<ActionHandler>, 4> ActionList;
516 parseEHActions(EHActions, ActionList);
517 assert(!ActionList.empty());
518 CurState += ActionList.size();
519 State += ActionList.size() - 1;
521 // Remember all the __except block targets.
522 for (auto &Handler : ActionList) {
523 if (auto *CH = dyn_cast<CatchHandler>(Handler.get())) {
524 auto *BA = cast<BlockAddress>(CH->getHandlerBlockOrFunc());
525 ExceptBlocks.insert(BA->getBasicBlock());
529 insertStateNumberStore(RegNode, II, State);
534 // Insert llvm.stackrestore into each __except block.
535 Function *StackRestore =
536 Intrinsic::getDeclaration(TheModule, Intrinsic::stackrestore);
537 for (BasicBlock *ExceptBB : ExceptBlocks) {
538 IRBuilder<> Builder(ExceptBB->begin());
540 Builder.CreateLoad(Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
541 Builder.CreateCall(StackRestore, {SP});
545 /// Rewrite llvm.eh.exceptioncode and llvm.eh.exceptioninfo to memory loads in
547 iplist<Instruction>::iterator
548 WinEHStatePass::rewriteExceptionInfoIntrinsics(IntrinsicInst *Intrin) {
549 Intrinsic::ID ID = Intrin->getIntrinsicID();
550 if (ID != Intrinsic::eh_exceptioncode && ID != Intrinsic::eh_exceptioninfo)
553 // RegNode->ExceptionPointers
554 IRBuilder<> Builder(Intrin);
556 Builder.CreateLoad(Builder.CreateStructGEP(RegNodeTy, RegNode, 1));
558 if (ID == Intrinsic::eh_exceptioncode) {
559 // Ptrs->ExceptionRecord->Code
560 Ptrs = Builder.CreateBitCast(
561 Ptrs, Builder.getInt32Ty()->getPointerTo()->getPointerTo());
562 Value *Rec = Builder.CreateLoad(Ptrs);
563 Res = Builder.CreateLoad(Rec);
567 Intrin->replaceAllUsesWith(Res);
568 return Intrin->eraseFromParent();
571 void WinEHStatePass::insertStateNumberStore(Value *ParentRegNode,
572 Instruction *IP, int State) {
573 IRBuilder<> Builder(IP);
575 Builder.CreateStructGEP(RegNodeTy, ParentRegNode, StateFieldIndex);
576 Builder.CreateStore(Builder.getInt32(State), StateField);