1//===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// All functions using an MSVC EH personality use an explicitly updated state
10// number stored in an exception registration stack object. The registration
11// object is linked into a thread-local chain of registrations stored at fs:00.
12// This pass adds the registration object and EH state updates.
13//
14//===----------------------------------------------------------------------===//
15
16#include "X86.h"
17#include "llvm/ADT/PostOrderIterator.h"
18#include "llvm/Analysis/CFG.h"
19#include "llvm/Analysis/EHPersonalities.h"
20#include "llvm/CodeGen/MachineModuleInfo.h"
21#include "llvm/CodeGen/WinEHFuncInfo.h"
22#include "llvm/IR/CFG.h"
23#include "llvm/IR/Function.h"
24#include "llvm/IR/IRBuilder.h"
25#include "llvm/IR/Instructions.h"
26#include "llvm/IR/Intrinsics.h"
27#include "llvm/IR/IntrinsicsX86.h"
28#include "llvm/IR/Module.h"
29#include "llvm/Pass.h"
30#include "llvm/Support/Debug.h"
31#include <deque>
32
33using namespace llvm;
34
35#define DEBUG_TYPE "winehstate"
36
37namespace {
38const int OverdefinedState = INT_MIN;
39
40class WinEHStatePass : public FunctionPass {
41public:
42  static char ID; // Pass identification, replacement for typeid.
43
44  WinEHStatePass() : FunctionPass(ID) { }
45
46  bool runOnFunction(Function &Fn) override;
47
48  bool doInitialization(Module &M) override;
49
50  bool doFinalization(Module &M) override;
51
52  void getAnalysisUsage(AnalysisUsage &AU) const override;
53
54  StringRef getPassName() const override {
55    return "Windows 32-bit x86 EH state insertion";
56  }
57
58private:
59  void emitExceptionRegistrationRecord(Function *F);
60
61  void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
62  void unlinkExceptionRegistration(IRBuilder<> &Builder);
63  void addStateStores(Function &F, WinEHFuncInfo &FuncInfo);
64  void insertStateNumberStore(Instruction *IP, int State);
65
66  Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
67
68  Function *generateLSDAInEAXThunk(Function *ParentFunc);
69
70  bool isStateStoreNeeded(EHPersonality Personality, CallBase &Call);
71  void rewriteSetJmpCall(IRBuilder<> &Builder, Function &F, CallBase &Call,
72                         Value *State);
73  int getBaseStateForBB(DenseMap<BasicBlock *, ColorVector> &BlockColors,
74                        WinEHFuncInfo &FuncInfo, BasicBlock *BB);
75  int getStateForCall(DenseMap<BasicBlock *, ColorVector> &BlockColors,
76                      WinEHFuncInfo &FuncInfo, CallBase &Call);
77
78  // Module-level type getters.
79  Type *getEHLinkRegistrationType();
80  Type *getSEHRegistrationType();
81  Type *getCXXEHRegistrationType();
82
83  // Per-module data.
84  Module *TheModule = nullptr;
85  StructType *EHLinkRegistrationTy = nullptr;
86  StructType *CXXEHRegistrationTy = nullptr;
87  StructType *SEHRegistrationTy = nullptr;
88  FunctionCallee SetJmp3 = nullptr;
89  FunctionCallee CxxLongjmpUnwind = nullptr;
90
91  // Per-function state
92  EHPersonality Personality = EHPersonality::Unknown;
93  Function *PersonalityFn = nullptr;
94  bool UseStackGuard = false;
95  int ParentBaseState = 0;
96  FunctionCallee SehLongjmpUnwind = nullptr;
97  Constant *Cookie = nullptr;
98
99  /// The stack allocation containing all EH data, including the link in the
100  /// fs:00 chain and the current state.
101  AllocaInst *RegNode = nullptr;
102
103  // The allocation containing the EH security guard.
104  AllocaInst *EHGuardNode = nullptr;
105
106  /// The index of the state field of RegNode.
107  int StateFieldIndex = ~0U;
108
109  /// The linked list node subobject inside of RegNode.
110  Value *Link = nullptr;
111};
112}
113
114FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
115
116char WinEHStatePass::ID = 0;
117
118INITIALIZE_PASS(WinEHStatePass, "x86-winehstate",
119                "Insert stores for EH state numbers", false, false)
120
121bool WinEHStatePass::doInitialization(Module &M) {
122  TheModule = &M;
123  return false;
124}
125
126bool WinEHStatePass::doFinalization(Module &M) {
127  assert(TheModule == &M);
128  TheModule = nullptr;
129  EHLinkRegistrationTy = nullptr;
130  CXXEHRegistrationTy = nullptr;
131  SEHRegistrationTy = nullptr;
132  SetJmp3 = nullptr;
133  CxxLongjmpUnwind = nullptr;
134  SehLongjmpUnwind = nullptr;
135  Cookie = nullptr;
136  return false;
137}
138
139void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
140  // This pass should only insert a stack allocation, memory accesses, and
141  // localrecovers.
142  AU.setPreservesCFG();
143}
144
145bool WinEHStatePass::runOnFunction(Function &F) {
146  // Don't insert state stores or exception handler thunks for
147  // available_externally functions. The handler needs to reference the LSDA,
148  // which will not be emitted in this case.
149  if (F.hasAvailableExternallyLinkage())
150    return false;
151
152  // Check the personality. Do nothing if this personality doesn't use funclets.
153  if (!F.hasPersonalityFn())
154    return false;
155  PersonalityFn =
156      dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
157  if (!PersonalityFn)
158    return false;
159  Personality = classifyEHPersonality(PersonalityFn);
160  if (!isFuncletEHPersonality(Personality))
161    return false;
162
163  // Skip this function if there are no EH pads and we aren't using IR-level
164  // outlining.
165  bool HasPads = false;
166  for (BasicBlock &BB : F) {
167    if (BB.isEHPad()) {
168      HasPads = true;
169      break;
170    }
171  }
172  if (!HasPads)
173    return false;
174
175  Type *Int8PtrType = Type::getInt8PtrTy(TheModule->getContext());
176  SetJmp3 = TheModule->getOrInsertFunction(
177      "_setjmp3", FunctionType::get(
178                      Type::getInt32Ty(TheModule->getContext()),
179                      {Int8PtrType, Type::getInt32Ty(TheModule->getContext())},
180                      /*isVarArg=*/true));
181
182  emitExceptionRegistrationRecord(&F);
183
184  // The state numbers calculated here in IR must agree with what we calculate
185  // later on for the MachineFunction. In particular, if an IR pass deletes an
186  // unreachable EH pad after this point before machine CFG construction, we
187  // will be in trouble. If this assumption is ever broken, we should turn the
188  // numbers into an immutable analysis pass.
189  WinEHFuncInfo FuncInfo;
190  addStateStores(F, FuncInfo);
191
192  // Reset per-function state.
193  PersonalityFn = nullptr;
194  Personality = EHPersonality::Unknown;
195  UseStackGuard = false;
196  RegNode = nullptr;
197  EHGuardNode = nullptr;
198
199  return true;
200}
201
202/// Get the common EH registration subobject:
203///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
204///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
205///   struct EHRegistrationNode {
206///     EHRegistrationNode *Next;
207///     PEXCEPTION_ROUTINE Handler;
208///   };
209Type *WinEHStatePass::getEHLinkRegistrationType() {
210  if (EHLinkRegistrationTy)
211    return EHLinkRegistrationTy;
212  LLVMContext &Context = TheModule->getContext();
213  EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
214  Type *FieldTys[] = {
215      EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
216      Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
217  };
218  EHLinkRegistrationTy->setBody(FieldTys, false);
219  return EHLinkRegistrationTy;
220}
221
222/// The __CxxFrameHandler3 registration node:
223///   struct CXXExceptionRegistration {
224///     void *SavedESP;
225///     EHRegistrationNode SubRecord;
226///     int32_t TryLevel;
227///   };
228Type *WinEHStatePass::getCXXEHRegistrationType() {
229  if (CXXEHRegistrationTy)
230    return CXXEHRegistrationTy;
231  LLVMContext &Context = TheModule->getContext();
232  Type *FieldTys[] = {
233      Type::getInt8PtrTy(Context), // void *SavedESP
234      getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
235      Type::getInt32Ty(Context)    // int32_t TryLevel
236  };
237  CXXEHRegistrationTy =
238      StructType::create(FieldTys, "CXXExceptionRegistration");
239  return CXXEHRegistrationTy;
240}
241
242/// The _except_handler3/4 registration node:
243///   struct EH4ExceptionRegistration {
244///     void *SavedESP;
245///     _EXCEPTION_POINTERS *ExceptionPointers;
246///     EHRegistrationNode SubRecord;
247///     int32_t EncodedScopeTable;
248///     int32_t TryLevel;
249///   };
250Type *WinEHStatePass::getSEHRegistrationType() {
251  if (SEHRegistrationTy)
252    return SEHRegistrationTy;
253  LLVMContext &Context = TheModule->getContext();
254  Type *FieldTys[] = {
255      Type::getInt8PtrTy(Context), // void *SavedESP
256      Type::getInt8PtrTy(Context), // void *ExceptionPointers
257      getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
258      Type::getInt32Ty(Context),   // int32_t EncodedScopeTable
259      Type::getInt32Ty(Context)    // int32_t TryLevel
260  };
261  SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
262  return SEHRegistrationTy;
263}
264
265// Emit an exception registration record. These are stack allocations with the
266// common subobject of two pointers: the previous registration record (the old
267// fs:00) and the personality function for the current frame. The data before
268// and after that is personality function specific.
269void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
270  assert(Personality == EHPersonality::MSVC_CXX ||
271         Personality == EHPersonality::MSVC_X86SEH);
272
273  // Struct type of RegNode. Used for GEPing.
274  Type *RegNodeTy;
275
276  IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
277  Type *Int8PtrType = Builder.getInt8PtrTy();
278  Type *Int32Ty = Builder.getInt32Ty();
279  Type *VoidTy = Builder.getVoidTy();
280
281  if (Personality == EHPersonality::MSVC_CXX) {
282    RegNodeTy = getCXXEHRegistrationType();
283    RegNode = Builder.CreateAlloca(RegNodeTy);
284    // SavedESP = llvm.stacksave()
285    Value *SP = Builder.CreateCall(
286        Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
287    Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
288    // TryLevel = -1
289    StateFieldIndex = 2;
290    ParentBaseState = -1;
291    insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
292    // Handler = __ehhandler$F
293    Function *Trampoline = generateLSDAInEAXThunk(F);
294    Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
295    linkExceptionRegistration(Builder, Trampoline);
296
297    CxxLongjmpUnwind = TheModule->getOrInsertFunction(
298        "__CxxLongjmpUnwind",
299        FunctionType::get(VoidTy, Int8PtrType, /*isVarArg=*/false));
300    cast<Function>(CxxLongjmpUnwind.getCallee()->stripPointerCasts())
301        ->setCallingConv(CallingConv::X86_StdCall);
302  } else if (Personality == EHPersonality::MSVC_X86SEH) {
303    // If _except_handler4 is in use, some additional guard checks and prologue
304    // stuff is required.
305    StringRef PersonalityName = PersonalityFn->getName();
306    UseStackGuard = (PersonalityName == "_except_handler4");
307
308    // Allocate local structures.
309    RegNodeTy = getSEHRegistrationType();
310    RegNode = Builder.CreateAlloca(RegNodeTy);
311    if (UseStackGuard)
312      EHGuardNode = Builder.CreateAlloca(Int32Ty);
313
314    // SavedESP = llvm.stacksave()
315    Value *SP = Builder.CreateCall(
316        Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
317    Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
318    // TryLevel = -2 / -1
319    StateFieldIndex = 4;
320    ParentBaseState = UseStackGuard ? -2 : -1;
321    insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
322    // ScopeTable = llvm.x86.seh.lsda(F)
323    Value *LSDA = emitEHLSDA(Builder, F);
324    LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
325    // If using _except_handler4, xor the address of the table with
326    // __security_cookie.
327    if (UseStackGuard) {
328      Cookie = TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
329      Value *Val = Builder.CreateLoad(Int32Ty, Cookie, "cookie");
330      LSDA = Builder.CreateXor(LSDA, Val);
331    }
332    Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
333
334    // If using _except_handler4, the EHGuard contains: FramePtr xor Cookie.
335    if (UseStackGuard) {
336      Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
337      Value *FrameAddr = Builder.CreateCall(
338          Intrinsic::getDeclaration(
339              TheModule, Intrinsic::frameaddress,
340              Builder.getInt8PtrTy(
341                  TheModule->getDataLayout().getAllocaAddrSpace())),
342          Builder.getInt32(0), "frameaddr");
343      Value *FrameAddrI32 = Builder.CreatePtrToInt(FrameAddr, Int32Ty);
344      FrameAddrI32 = Builder.CreateXor(FrameAddrI32, Val);
345      Builder.CreateStore(FrameAddrI32, EHGuardNode);
346    }
347
348    // Register the exception handler.
349    Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
350    linkExceptionRegistration(Builder, PersonalityFn);
351
352    SehLongjmpUnwind = TheModule->getOrInsertFunction(
353        UseStackGuard ? "_seh_longjmp_unwind4" : "_seh_longjmp_unwind",
354        FunctionType::get(Type::getVoidTy(TheModule->getContext()), Int8PtrType,
355                          /*isVarArg=*/false));
356    cast<Function>(SehLongjmpUnwind.getCallee()->stripPointerCasts())
357        ->setCallingConv(CallingConv::X86_StdCall);
358  } else {
359    llvm_unreachable("unexpected personality function");
360  }
361
362  // Insert an unlink before all returns.
363  for (BasicBlock &BB : *F) {
364    Instruction *T = BB.getTerminator();
365    if (!isa<ReturnInst>(T))
366      continue;
367    Builder.SetInsertPoint(T);
368    unlinkExceptionRegistration(Builder);
369  }
370}
371
372Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
373  Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
374  return Builder.CreateCall(
375      Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
376}
377
378/// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
379/// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
380///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
381///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
382/// We essentially want this code:
383///   movl $lsda, %eax
384///   jmpl ___CxxFrameHandler3
385Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
386  LLVMContext &Context = ParentFunc->getContext();
387  Type *Int32Ty = Type::getInt32Ty(Context);
388  Type *Int8PtrType = Type::getInt8PtrTy(Context);
389  Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
390                     Int8PtrType};
391  FunctionType *TrampolineTy =
392      FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
393                        /*isVarArg=*/false);
394  FunctionType *TargetFuncTy =
395      FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
396                        /*isVarArg=*/false);
397  Function *Trampoline =
398      Function::Create(TrampolineTy, GlobalValue::InternalLinkage,
399                       Twine("__ehhandler$") + GlobalValue::dropLLVMManglingEscape(
400                                                   ParentFunc->getName()),
401                       TheModule);
402  if (auto *C = ParentFunc->getComdat())
403    Trampoline->setComdat(C);
404  BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
405  IRBuilder<> Builder(EntryBB);
406  Value *LSDA = emitEHLSDA(Builder, ParentFunc);
407  Value *CastPersonality =
408      Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
409  auto AI = Trampoline->arg_begin();
410  Value *Args[5] = {LSDA, &*AI++, &*AI++, &*AI++, &*AI++};
411  CallInst *Call = Builder.CreateCall(TargetFuncTy, CastPersonality, Args);
412  // Can't use musttail due to prototype mismatch, but we can use tail.
413  Call->setTailCall(true);
414  // Set inreg so we pass it in EAX.
415  Call->addParamAttr(0, Attribute::InReg);
416  Builder.CreateRet(Call);
417  return Trampoline;
418}
419
420void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
421                                               Function *Handler) {
422  // Emit the .safeseh directive for this function.
423  Handler->addFnAttr("safeseh");
424
425  Type *LinkTy = getEHLinkRegistrationType();
426  // Handler = Handler
427  Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
428  Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
429  // Next = [fs:00]
430  Constant *FSZero =
431      Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
432  Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(), FSZero);
433  Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
434  // [fs:00] = Link
435  Builder.CreateStore(Link, FSZero);
436}
437
438void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
439  // Clone Link into the current BB for better address mode folding.
440  if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
441    GEP = cast<GetElementPtrInst>(GEP->clone());
442    Builder.Insert(GEP);
443    Link = GEP;
444  }
445  Type *LinkTy = getEHLinkRegistrationType();
446  // [fs:00] = Link->Next
447  Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(),
448                                   Builder.CreateStructGEP(LinkTy, Link, 0));
449  Constant *FSZero =
450      Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
451  Builder.CreateStore(Next, FSZero);
452}
453
454// Calls to setjmp(p) are lowered to _setjmp3(p, 0) by the frontend.
455// The idea behind _setjmp3 is that it takes an optional number of personality
456// specific parameters to indicate how to restore the personality-specific frame
457// state when longjmp is initiated.  Typically, the current TryLevel is saved.
458void WinEHStatePass::rewriteSetJmpCall(IRBuilder<> &Builder, Function &F,
459                                       CallBase &Call, Value *State) {
460  // Don't rewrite calls with a weird number of arguments.
461  if (Call.getNumArgOperands() != 2)
462    return;
463
464  SmallVector<OperandBundleDef, 1> OpBundles;
465  Call.getOperandBundlesAsDefs(OpBundles);
466
467  SmallVector<Value *, 3> OptionalArgs;
468  if (Personality == EHPersonality::MSVC_CXX) {
469    OptionalArgs.push_back(CxxLongjmpUnwind.getCallee());
470    OptionalArgs.push_back(State);
471    OptionalArgs.push_back(emitEHLSDA(Builder, &F));
472  } else if (Personality == EHPersonality::MSVC_X86SEH) {
473    OptionalArgs.push_back(SehLongjmpUnwind.getCallee());
474    OptionalArgs.push_back(State);
475    if (UseStackGuard)
476      OptionalArgs.push_back(Cookie);
477  } else {
478    llvm_unreachable("unhandled personality!");
479  }
480
481  SmallVector<Value *, 5> Args;
482  Args.push_back(
483      Builder.CreateBitCast(Call.getArgOperand(0), Builder.getInt8PtrTy()));
484  Args.push_back(Builder.getInt32(OptionalArgs.size()));
485  Args.append(OptionalArgs.begin(), OptionalArgs.end());
486
487  CallBase *NewCall;
488  if (auto *CI = dyn_cast<CallInst>(&Call)) {
489    CallInst *NewCI = Builder.CreateCall(SetJmp3, Args, OpBundles);
490    NewCI->setTailCallKind(CI->getTailCallKind());
491    NewCall = NewCI;
492  } else {
493    auto *II = cast<InvokeInst>(&Call);
494    NewCall = Builder.CreateInvoke(
495        SetJmp3, II->getNormalDest(), II->getUnwindDest(), Args, OpBundles);
496  }
497  NewCall->setCallingConv(Call.getCallingConv());
498  NewCall->setAttributes(Call.getAttributes());
499  NewCall->setDebugLoc(Call.getDebugLoc());
500
501  NewCall->takeName(&Call);
502  Call.replaceAllUsesWith(NewCall);
503  Call.eraseFromParent();
504}
505
506// Figure out what state we should assign calls in this block.
507int WinEHStatePass::getBaseStateForBB(
508    DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
509    BasicBlock *BB) {
510  int BaseState = ParentBaseState;
511  auto &BBColors = BlockColors[BB];
512
513  assert(BBColors.size() == 1 && "multi-color BB not removed by preparation");
514  BasicBlock *FuncletEntryBB = BBColors.front();
515  if (auto *FuncletPad =
516          dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI())) {
517    auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
518    if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
519      BaseState = BaseStateI->second;
520  }
521
522  return BaseState;
523}
524
525// Calculate the state a call-site is in.
526int WinEHStatePass::getStateForCall(
527    DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
528    CallBase &Call) {
529  if (auto *II = dyn_cast<InvokeInst>(&Call)) {
530    // Look up the state number of the EH pad this unwinds to.
531    assert(FuncInfo.InvokeStateMap.count(II) && "invoke has no state!");
532    return FuncInfo.InvokeStateMap[II];
533  }
534  // Possibly throwing call instructions have no actions to take after
535  // an unwind. Ensure they are in the -1 state.
536  return getBaseStateForBB(BlockColors, FuncInfo, Call.getParent());
537}
538
539// Calculate the intersection of all the FinalStates for a BasicBlock's
540// predecessors.
541static int getPredState(DenseMap<BasicBlock *, int> &FinalStates, Function &F,
542                        int ParentBaseState, BasicBlock *BB) {
543  // The entry block has no predecessors but we know that the prologue always
544  // sets us up with a fixed state.
545  if (&F.getEntryBlock() == BB)
546    return ParentBaseState;
547
548  // This is an EH Pad, conservatively report this basic block as overdefined.
549  if (BB->isEHPad())
550    return OverdefinedState;
551
552  int CommonState = OverdefinedState;
553  for (BasicBlock *PredBB : predecessors(BB)) {
554    // We didn't manage to get a state for one of these predecessors,
555    // conservatively report this basic block as overdefined.
556    auto PredEndState = FinalStates.find(PredBB);
557    if (PredEndState == FinalStates.end())
558      return OverdefinedState;
559
560    // This code is reachable via exceptional control flow,
561    // conservatively report this basic block as overdefined.
562    if (isa<CatchReturnInst>(PredBB->getTerminator()))
563      return OverdefinedState;
564
565    int PredState = PredEndState->second;
566    assert(PredState != OverdefinedState &&
567           "overdefined BBs shouldn't be in FinalStates");
568    if (CommonState == OverdefinedState)
569      CommonState = PredState;
570
571    // At least two predecessors have different FinalStates,
572    // conservatively report this basic block as overdefined.
573    if (CommonState != PredState)
574      return OverdefinedState;
575  }
576
577  return CommonState;
578}
579
580// Calculate the intersection of all the InitialStates for a BasicBlock's
581// successors.
582static int getSuccState(DenseMap<BasicBlock *, int> &InitialStates, Function &F,
583                        int ParentBaseState, BasicBlock *BB) {
584  // This block rejoins normal control flow,
585  // conservatively report this basic block as overdefined.
586  if (isa<CatchReturnInst>(BB->getTerminator()))
587    return OverdefinedState;
588
589  int CommonState = OverdefinedState;
590  for (BasicBlock *SuccBB : successors(BB)) {
591    // We didn't manage to get a state for one of these predecessors,
592    // conservatively report this basic block as overdefined.
593    auto SuccStartState = InitialStates.find(SuccBB);
594    if (SuccStartState == InitialStates.end())
595      return OverdefinedState;
596
597    // This is an EH Pad, conservatively report this basic block as overdefined.
598    if (SuccBB->isEHPad())
599      return OverdefinedState;
600
601    int SuccState = SuccStartState->second;
602    assert(SuccState != OverdefinedState &&
603           "overdefined BBs shouldn't be in FinalStates");
604    if (CommonState == OverdefinedState)
605      CommonState = SuccState;
606
607    // At least two successors have different InitialStates,
608    // conservatively report this basic block as overdefined.
609    if (CommonState != SuccState)
610      return OverdefinedState;
611  }
612
613  return CommonState;
614}
615
616bool WinEHStatePass::isStateStoreNeeded(EHPersonality Personality,
617                                        CallBase &Call) {
618  // If the function touches memory, it needs a state store.
619  if (isAsynchronousEHPersonality(Personality))
620    return !Call.doesNotAccessMemory();
621
622  // If the function throws, it needs a state store.
623  return !Call.doesNotThrow();
624}
625
626void WinEHStatePass::addStateStores(Function &F, WinEHFuncInfo &FuncInfo) {
627  // Mark the registration node. The backend needs to know which alloca it is so
628  // that it can recover the original frame pointer.
629  IRBuilder<> Builder(RegNode->getNextNode());
630  Value *RegNodeI8 = Builder.CreateBitCast(RegNode, Builder.getInt8PtrTy());
631  Builder.CreateCall(
632      Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehregnode),
633      {RegNodeI8});
634
635  if (EHGuardNode) {
636    IRBuilder<> Builder(EHGuardNode->getNextNode());
637    Value *EHGuardNodeI8 =
638        Builder.CreateBitCast(EHGuardNode, Builder.getInt8PtrTy());
639    Builder.CreateCall(
640        Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehguard),
641        {EHGuardNodeI8});
642  }
643
644  // Calculate state numbers.
645  if (isAsynchronousEHPersonality(Personality))
646    calculateSEHStateNumbers(&F, FuncInfo);
647  else
648    calculateWinCXXEHStateNumbers(&F, FuncInfo);
649
650  // Iterate all the instructions and emit state number stores.
651  DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(F);
652  ReversePostOrderTraversal<Function *> RPOT(&F);
653
654  // InitialStates yields the state of the first call-site for a BasicBlock.
655  DenseMap<BasicBlock *, int> InitialStates;
656  // FinalStates yields the state of the last call-site for a BasicBlock.
657  DenseMap<BasicBlock *, int> FinalStates;
658  // Worklist used to revisit BasicBlocks with indeterminate
659  // Initial/Final-States.
660  std::deque<BasicBlock *> Worklist;
661  // Fill in InitialStates and FinalStates for BasicBlocks with call-sites.
662  for (BasicBlock *BB : RPOT) {
663    int InitialState = OverdefinedState;
664    int FinalState;
665    if (&F.getEntryBlock() == BB)
666      InitialState = FinalState = ParentBaseState;
667    for (Instruction &I : *BB) {
668      auto *Call = dyn_cast<CallBase>(&I);
669      if (!Call || !isStateStoreNeeded(Personality, *Call))
670        continue;
671
672      int State = getStateForCall(BlockColors, FuncInfo, *Call);
673      if (InitialState == OverdefinedState)
674        InitialState = State;
675      FinalState = State;
676    }
677    // No call-sites in this basic block? That's OK, we will come back to these
678    // in a later pass.
679    if (InitialState == OverdefinedState) {
680      Worklist.push_back(BB);
681      continue;
682    }
683    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
684                      << " InitialState=" << InitialState << '\n');
685    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
686                      << " FinalState=" << FinalState << '\n');
687    InitialStates.insert({BB, InitialState});
688    FinalStates.insert({BB, FinalState});
689  }
690
691  // Try to fill-in InitialStates and FinalStates which have no call-sites.
692  while (!Worklist.empty()) {
693    BasicBlock *BB = Worklist.front();
694    Worklist.pop_front();
695    // This BasicBlock has already been figured out, nothing more we can do.
696    if (InitialStates.count(BB) != 0)
697      continue;
698
699    int PredState = getPredState(FinalStates, F, ParentBaseState, BB);
700    if (PredState == OverdefinedState)
701      continue;
702
703    // We successfully inferred this BasicBlock's state via it's predecessors;
704    // enqueue it's successors to see if we can infer their states.
705    InitialStates.insert({BB, PredState});
706    FinalStates.insert({BB, PredState});
707    for (BasicBlock *SuccBB : successors(BB))
708      Worklist.push_back(SuccBB);
709  }
710
711  // Try to hoist stores from successors.
712  for (BasicBlock *BB : RPOT) {
713    int SuccState = getSuccState(InitialStates, F, ParentBaseState, BB);
714    if (SuccState == OverdefinedState)
715      continue;
716
717    // Update our FinalState to reflect the common InitialState of our
718    // successors.
719    FinalStates.insert({BB, SuccState});
720  }
721
722  // Finally, insert state stores before call-sites which transition us to a new
723  // state.
724  for (BasicBlock *BB : RPOT) {
725    auto &BBColors = BlockColors[BB];
726    BasicBlock *FuncletEntryBB = BBColors.front();
727    if (isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI()))
728      continue;
729
730    int PrevState = getPredState(FinalStates, F, ParentBaseState, BB);
731    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
732                      << " PrevState=" << PrevState << '\n');
733
734    for (Instruction &I : *BB) {
735      auto *Call = dyn_cast<CallBase>(&I);
736      if (!Call || !isStateStoreNeeded(Personality, *Call))
737        continue;
738
739      int State = getStateForCall(BlockColors, FuncInfo, *Call);
740      if (State != PrevState)
741        insertStateNumberStore(&I, State);
742      PrevState = State;
743    }
744
745    // We might have hoisted a state store into this block, emit it now.
746    auto EndState = FinalStates.find(BB);
747    if (EndState != FinalStates.end())
748      if (EndState->second != PrevState)
749        insertStateNumberStore(BB->getTerminator(), EndState->second);
750  }
751
752  SmallVector<CallBase *, 1> SetJmp3Calls;
753  for (BasicBlock *BB : RPOT) {
754    for (Instruction &I : *BB) {
755      auto *Call = dyn_cast<CallBase>(&I);
756      if (!Call)
757        continue;
758      if (Call->getCalledOperand()->stripPointerCasts() !=
759          SetJmp3.getCallee()->stripPointerCasts())
760        continue;
761
762      SetJmp3Calls.push_back(Call);
763    }
764  }
765
766  for (CallBase *Call : SetJmp3Calls) {
767    auto &BBColors = BlockColors[Call->getParent()];
768    BasicBlock *FuncletEntryBB = BBColors.front();
769    bool InCleanup = isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI());
770
771    IRBuilder<> Builder(Call);
772    Value *State;
773    if (InCleanup) {
774      Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
775                                                  RegNode, StateFieldIndex);
776      State = Builder.CreateLoad(Builder.getInt32Ty(), StateField);
777    } else {
778      State = Builder.getInt32(getStateForCall(BlockColors, FuncInfo, *Call));
779    }
780    rewriteSetJmpCall(Builder, F, *Call, State);
781  }
782}
783
784void WinEHStatePass::insertStateNumberStore(Instruction *IP, int State) {
785  IRBuilder<> Builder(IP);
786  Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
787                                              RegNode, StateFieldIndex);
788  Builder.CreateStore(Builder.getInt32(State), StateField);
789}
790