Add ehcont section support

[arlosi]

Summary

In the future Windows will enable Control-flow Enforcement Technology (CET aka shadow stacks). To protect the path where the context is updated during exception handling, the binary is required to enumerate valid unwind entrypoints in a dedicated section which is validated when the context is being set during exception handling.

This change allows llvm to generate the section that contains the appropriate symbol references in the form expected by the msvc linker.

This feature is enabled through a new module flag, ehcontguard, which was modelled on the cfguard flag.

The change includes a test that when the module flag is enabled the section is correctly generated.

The set of exception continuation information includes returns from exceptional control flow (catchret in llvm).

In order to collect catchret we:

1. Includes an additional flag on machine basic blocks to indicate that the given block is the target of a catchret operation,
2. Introduces a new machine function pass to insert and collect symbols at the start of each of each block, and
3. Combines these targets with the other EHCont targets that were already being collected.

Change originally authored by Daniel Frampton <[e-mail]>

For more details, see MSVC documentation for /guard:ehcont

https://docs.microsoft.com/en-us/cpp/build/reference/guard-enable-eh-continuation-metadata

[rnk]

llvm/lib/CodeGen/EHContGuardCatchret.cpp

80

If we do use this name, I would prefer to use as short a name as possible. C++ names are long enough that they significantly contribute to object file size. Let's use getFunctionNumber() here instead, so we get names like $ehgcr_2_42. You'll need a non-digit separator to ensure the names are unique (consider function 5 bb 55 and function 55 bb 5).

This wasn't as much of a concern for longjmp tables, since setjmp is less common and mostly appears in C code.

82

This could be unreliable if some later pass reorders instructions or deletes the first instruction. I think it would be more reliable to take the address of the basic block. You can do this with MBB->setHasAddressTaken and MachineModuleInfo::getAddrLabelSymbol.

[arlosi]

llvm/lib/CodeGen/EHContGuardCatchret.cpp

82

MachineModuleInfo::getAddrLabelSymbol works on BasicBlocks rather than MachineBasicBlocks. So even if I setHasAddressTaken on the MBB, the associated BB might still not have it's address taken, which causes an assert failure in getAddrLabelSymbolToEmit.

I also tried using MBB.setLabelMustBeEmitted() and MBB.getSymbol(), but that produces a symbol name that doesn't end up in the symbol table.

We could add an additional field to MachineBasicBlock to store this special symbol, then emit it in the AsmPrinter in emitBasicBlockStart.

Do you have a preference, or another better solution?

[arlosi]

Use a new field in MachineBasicBlock to store the symbol for ehcont; then emit it in the AsmPrinter.

[arlosi]

Run clang-format

[arlosi]

Include both commits.

[arlosi]

Ping

[pengfei]

The changes LGTM, but I'd let @rnk sign off as well.

[arlosi]

@rnk if you could take a look that would be great.

Also, I do not have commit access.

[pengfei]

In D94835#2549120, @arlosi wrote:

@rnk if you could take a look that would be great.

Also, I do not have commit access.

I can commit it, but let's wait one or two days to see if there're objections from other people.

[arlosi]

I'm looking through this again today, and I don't think we need both IsEHCatchRetTarget and isEHFuncletEntry to be added to MBB. I'll simplify this and post an update later today.

[arlosi]

Remove redundant field IsEHContTarget on MachineBasicBlock

[rnk]

Sorry for the delay, thanks for implementing this.

llvm/include/llvm/CodeGen/MachineBasicBlock.h

private:
   /// whether the flow just falls-through to it.
   bool LabelMustBeEmitted = false;
 
   /// Indicate that this basic block is the entry block of an EH scope, i.e.,
   /// the block that used to have a catchpad or cleanuppad instruction in the
   /// LLVM IR.
   bool IsEHScopeEntry = false;
 
+  /// Indicates if this is a target block of a catchret.
+  bool IsEHCatchRetTarget = false;
+
   /// Indicate that this basic block is the entry block of an EH funclet.
   bool IsEHFuncletEntry = false;
 
   /// Indicate that this basic block is the entry block of a cleanup funclet.
   bool IsCleanupFuncletEntry = false;
 
   /// With basic block sections, this stores the Section ID of the basic block.
   MBBSectionID SectionID{0};
#endif
   /// Returns true if this is the entry block of an EH scope, i.e., the block
   /// that used to have a catchpad or cleanuppad instruction in the LLVM IR.
   bool isEHScopeEntry() const { return IsEHScopeEntry; }
 
   /// Indicates if this is the entry block of an EH scope, i.e., the block that
   /// that used to have a catchpad or cleanuppad instruction in the LLVM IR.
   void setIsEHScopeEntry(bool V = true) { IsEHScopeEntry = V; }
 
+  /// Returns true if this is a target block of a catchret.
+  bool isEHCatchRetTarget() const { return IsEHCatchRetTarget; }
+
+  /// Indicates if this is a target block of a catchret.
+  void setIsEHCatchRetTarget(bool V = true) { IsEHCatchRetTarget = V; }
+
   /// Returns true if this is the entry block of an EH funclet.
   bool isEHFuncletEntry() const { return IsEHFuncletEntry; }
 
   /// Indicates if this is the entry block of an EH funclet.
   void setIsEHFuncletEntry(bool V = true) { IsEHFuncletEntry = V; }
 
   /// Returns true if this is the entry block of a cleanup funclet.
   bool isCleanupFuncletEntry() const { return IsCleanupFuncletEntry; }

llvm/include/llvm/CodeGen/MachineFunction.h

class MachineFunction {
   /// List of moves done by a function's prolog.  Used to construct frame maps
   /// by debug and exception handling consumers.
   std::vector<MCCFIInstruction> FrameInstructions;
 
   /// List of basic blocks immediately following calls to _setjmp. Used to
   /// construct a table of valid longjmp targets for Windows Control Flow Guard.
   std::vector<MCSymbol *> LongjmpTargets;
 
+  /// List of basic blocks that are the target of catchrets. Used to construct
+  /// a table of valid targets for Windows EHCont Guard.
+  std::vector<MCSymbol *> CatchretTargets;
+
   /// \name Exception Handling
   /// \{
 
   /// List of LandingPadInfo describing the landing pad information.
   std::vector<LandingPadInfo> LandingPads;
 
   /// Map a landing pad's EH symbol to the call site indexes.
   DenseMap<MCSymbol*, SmallVector<unsigned, 4>> LPadToCallSiteMap;
 
   /// Map a landing pad to its index.
   DenseMap<const MachineBasicBlock *, unsigned> WasmLPadToIndexMap;
 
   /// Map of invoke call site index values to associated begin EH_LABEL.
   DenseMap<MCSymbol*, unsigned> CallSiteMap;
 
   /// CodeView label annotations.
   std::vector<std::pair<MCSymbol *, MDNode *>> CodeViewAnnotations;
 
   bool CallsEHReturn = false;
   bool CallsUnwindInit = false;
+  bool HasEHCatchRet = false;
   bool HasEHScopes = false;
   bool HasEHFunclets = false;
 
   /// Section Type for basic blocks, only relevant with basic block sections.
   BasicBlockSection BBSectionsType = BasicBlockSection::None;
 
   /// List of C++ TypeInfo used.
   std::vector<const GlobalValue *> TypeInfos;
public:
   const std::vector<MCSymbol *> &getLongjmpTargets() const {
     return LongjmpTargets;
   }
 
   /// Add the specified symbol to the list of valid longjmp targets for Windows
   /// Control Flow Guard.
   void addLongjmpTarget(MCSymbol *Target) { LongjmpTargets.push_back(Target); }
 
+  /// Returns a reference to a list of symbols that we have catchrets.
+  /// Used to construct the longjmp target table used by Windows EHCont Guard.
+  const std::vector<MCSymbol *> &getCatchretTargets() const {
+    return CatchretTargets;
+  }
+
+  /// Add the specified symbol to the list of valid catchret targets for Windows
+  /// EHCont Guard.
+  void addCatchretTarget(MCSymbol *Target) {
+    CatchretTargets.push_back(Target);
+  }
+
   /// \name Exception Handling
   /// \{
 
   bool callsEHReturn() const { return CallsEHReturn; }
   void setCallsEHReturn(bool b) { CallsEHReturn = b; }
 
   bool callsUnwindInit() const { return CallsUnwindInit; }
   void setCallsUnwindInit(bool b) { CallsUnwindInit = b; }
 
+  bool hasEHCatchRet() const { return HasEHCatchRet; }
+  void setHasEHCatchRet(bool V) { HasEHCatchRet = V; }
+
   bool hasEHScopes() const { return HasEHScopes; }
   void setHasEHScopes(bool V) { HasEHScopes = V; }
 
   bool hasEHFunclets() const { return HasEHFunclets; }
   void setHasEHFunclets(bool V) { HasEHFunclets = V; }
 
   /// Find or create an LandingPadInfo for the specified MachineBasicBlock.
   LandingPadInfo &getOrCreateLandingPadInfo(MachineBasicBlock *LandingPad);

llvm/include/llvm/CodeGen/Passes.h

/// MachineDominanaceFrontier - This pass is a machine dominators analysis pass.
 
   /// Creates CFI Instruction Inserter pass. \see CFIInstrInserter.cpp
   FunctionPass *createCFIInstrInserter();
 
   /// Creates CFGuard longjmp target identification pass.
   /// \see CFGuardLongjmp.cpp
   FunctionPass *createCFGuardLongjmpPass();
 
+  /// Creates EHContGuard catchret target identification pass.
+  /// \see EHContGuardCatchret.cpp
+  FunctionPass *createEHContGuardCatchretPass();
+
   /// Create Hardware Loop pass. \see HardwareLoops.cpp
   FunctionPass *createHardwareLoopsPass();
 
   /// This pass inserts pseudo probe annotation for callsite profiling.
   FunctionPass *createPseudoProbeInserter();
 
   /// Create IR Type Promotion pass. \see TypePromotion.cpp
   FunctionPass *createTypePromotionPass();

llvm/include/llvm/InitializePasses.h

 void initializeDwarfEHPrepareLegacyPassPass(PassRegistry &);
 void initializeEarlyCSELegacyPassPass(PassRegistry&);
 void initializeEarlyCSEMemSSALegacyPassPass(PassRegistry&);
 void initializeEarlyIfConverterPass(PassRegistry&);
 void initializeEarlyIfPredicatorPass(PassRegistry &);
 void initializeEarlyMachineLICMPass(PassRegistry&);
 void initializeEarlyTailDuplicatePass(PassRegistry&);
 void initializeEdgeBundlesPass(PassRegistry&);
+void initializeEHContGuardCatchretPass(PassRegistry &);
 void initializeEliminateAvailableExternallyLegacyPassPass(PassRegistry&);
 void initializeEntryExitInstrumenterPass(PassRegistry&);
 void initializeExpandMemCmpPassPass(PassRegistry&);
 void initializeExpandPostRAPass(PassRegistry&);
 void initializeExpandReductionsPass(PassRegistry&);
 void initializeMakeGuardsExplicitLegacyPassPass(PassRegistry&);
 void initializeExternalAAWrapperPassPass(PassRegistry&);
 void initializeFEntryInserterPass(PassRegistry&);

llvm/include/llvm/MC/MCObjectFileInfo.h

protected:
   MCSection *NonLazySymbolPointerSection = nullptr;
   MCSection *ThreadLocalPointerSection = nullptr;
 
   /// COFF specific sections.
   MCSection *DrectveSection = nullptr;
   MCSection *PDataSection = nullptr;
   MCSection *XDataSection = nullptr;
   MCSection *SXDataSection = nullptr;
+  MCSection *GEHContSection = nullptr;
   MCSection *GFIDsSection = nullptr;
   MCSection *GIATsSection = nullptr;
   MCSection *GLJMPSection = nullptr;
 
   // XCOFF specific sections
   MCSection *TOCBaseSection = nullptr;
 
 public:
MCSection *getThreadLocalPointerSection() const {
     return ThreadLocalPointerSection;
   }
 
   // COFF specific sections.
   MCSection *getDrectveSection() const { return DrectveSection; }
   MCSection *getPDataSection() const { return PDataSection; }
   MCSection *getXDataSection() const { return XDataSection; }
   MCSection *getSXDataSection() const { return SXDataSection; }
+  MCSection *getGEHContSection() const { return GEHContSection; }
   MCSection *getGFIDsSection() const { return GFIDsSection; }
   MCSection *getGIATsSection() const { return GIATsSection; }
   MCSection *getGLJMPSection() const { return GLJMPSection; }
 
   // XCOFF specific sections
   MCSection *getTOCBaseSection() const { return TOCBaseSection; }
 
   MCSection *getEHFrameSection() const { return EHFrameSection; }

llvm/lib/CodeGen/AsmPrinter/WinException.h

class LLVM_LIBRARY_VISIBILITY WinException : public EHStreamer {
   bool isAArch64 = false;
 
   /// Pointer to the current funclet entry BB.
   const MachineBasicBlock *CurrentFuncletEntry = nullptr;
 
   /// The section of the last funclet start.
   MCSection *CurrentFuncletTextSection = nullptr;
 
+  /// The list of symbols to add to the ehcont section
+  std::vector<const MCSymbol *> EHContTargets;
+
   void emitCSpecificHandlerTable(const MachineFunction *MF);
 
   void emitSEHActionsForRange(const WinEHFuncInfo &FuncInfo,
                               const MCSymbol *BeginLabel,
                               const MCSymbol *EndLabel, int State);
 
   /// Emit the EH table data for 32-bit and 64-bit functions using
   /// the __CxxFrameHandler3 personality.

llvm/lib/CodeGen/AsmPrinter/WinException.cpp

 /// endModule - Emit all exception information that should come after the
 /// content.
 void WinException::endModule() {
   auto &OS = *Asm->OutStreamer;
   const Module *M = MMI->getModule();
   for (const Function &F : *M)
     if (F.hasFnAttribute("safeseh"))
       OS.EmitCOFFSafeSEH(Asm->getSymbol(&F));
+
+  if (M->getModuleFlag("ehcontguard") && !EHContTargets.empty()) {
+    // Emit the symbol index of each ehcont target.
+    OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGEHContSection());
+    for (const MCSymbol *S : EHContTargets) {
+      OS.EmitCOFFSymbolIndex(S);
+    }
+  }
 }
 
 void WinException::beginFunction(const MachineFunction *MF) {
   shouldEmitMoves = shouldEmitPersonality = shouldEmitLSDA = false;
 
   // If any landing pads survive, we need an EH table.
   bool hasLandingPads = !MF->getLandingPads().empty();
   bool hasEHFunclets = MF->hasEHFunclets();
else if (Per == EHPersonality::MSVC_CXX)
       emitCXXFrameHandler3Table(MF);
     else if (Per == EHPersonality::CoreCLR)
       emitCLRExceptionTable(MF);
     else
       emitExceptionTable();
 
     Asm->OutStreamer->PopSection();
   }
+
+  if (!MF->getCatchretTargets().empty()) {
+    // Copy the function's catchret targets to a module-level list.
+    EHContTargets.insert(EHContTargets.end(), MF->getCatchretTargets().begin(),
+                         MF->getCatchretTargets().end());
+  }
 }
 
 /// Retrieve the MCSymbol for a GlobalValue or MachineBasicBlock.
 static MCSymbol *getMCSymbolForMBB(AsmPrinter *Asm,
                                    const MachineBasicBlock *MBB) {
   if (!MBB)
     return nullptr;
 
void WinException::beginFunclet(const MachineBasicBlock &MBB,
   }
 
   // Mark 'Sym' as starting our funclet.
   if (shouldEmitMoves || shouldEmitPersonality) {
     CurrentFuncletTextSection = Asm->OutStreamer->getCurrentSectionOnly();
     Asm->OutStreamer->EmitWinCFIStartProc(Sym);
   }
 
+  // Add 'Sym' as an ehcont target
+  if (CurrentFuncletEntry->isEHFuncletEntry())
+    EHContTargets.push_back(Sym);
+
   if (shouldEmitPersonality) {
     const TargetLoweringObjectFile &TLOF = Asm->getObjFileLowering();
     const Function *PerFn = nullptr;
 
     // Determine which personality routine we are using for this funclet.
     if (F.hasPersonalityFn())
       PerFn = dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
     const MCSymbol *PersHandlerSym =

llvm/lib/CodeGen/CMakeLists.txt

add_llvm_component_library(LLVMCodeGen
   CommandFlags.cpp
   CriticalAntiDepBreaker.cpp
   DeadMachineInstructionElim.cpp
   DetectDeadLanes.cpp
   DFAPacketizer.cpp
   DwarfEHPrepare.cpp
   EarlyIfConversion.cpp
   EdgeBundles.cpp
+  EHContGuardCatchret.cpp
   ExecutionDomainFix.cpp
   ExpandMemCmp.cpp
   ExpandPostRAPseudos.cpp
   ExpandReductions.cpp
   FaultMaps.cpp
   FEntryInserter.cpp
   FinalizeISel.cpp
   FixupStatepointCallerSaved.cpp

llvm/lib/CodeGen/EHContGuardCatchret.cpp

+//===-- EHContGuardCatchret.cpp - Catchret target symbols -------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// This file contains a machine function pass to insert a symbol before each
+/// valid catchret target and store this in the MachineFunction's
+/// CatchRetTargets vector. This will be used to emit the table of valid targets
+/// used by EHCont Guard.
+///
+//===----------------------------------------------------------------------===//
+
+#include "llvm/ADT/Statistic.h"
+#include "llvm/CodeGen/MachineBasicBlock.h"
+#include "llvm/CodeGen/MachineFunctionPass.h"
+#include "llvm/CodeGen/MachineInstr.h"
+#include "llvm/CodeGen/MachineModuleInfo.h"
+#include "llvm/CodeGen/MachineOperand.h"
+#include "llvm/CodeGen/Passes.h"
+#include "llvm/InitializePasses.h"
+
+using namespace llvm;
+
+#define DEBUG_TYPE "ehcontguard-catchret"
+
+STATISTIC(EHContGuardCatchretTargets,
+          "Number of EHCont Guard catchret targets");
+
+namespace {
+
+/// MachineFunction pass to insert a symbol before each valid catchret target
+/// and store these in the MachineFunction's CatchRetTargets vector.
+class EHContGuardCatchret : public MachineFunctionPass {
+public:
+  static char ID;
+
+  EHContGuardCatchret() : MachineFunctionPass(ID) {
+    initializeEHContGuardCatchretPass(*PassRegistry::getPassRegistry());
+  }
+
+  StringRef getPassName() const override {
+    return "EH Cont Guard catchret targets";
+  }
+
+  bool runOnMachineFunction(MachineFunction &MF) override;
+};
+
+} // end anonymous namespace
+
+char EHContGuardCatchret::ID = 0;
+
+INITIALIZE_PASS(EHContGuardCatchret, "EHContGuardCatchret",
+                "Insert symbols at valid catchret targets for /guard:ehcont",
+                false, false)
+FunctionPass *llvm::createEHContGuardCatchretPass() {
+  return new EHContGuardCatchret();
+}
+
+bool EHContGuardCatchret::runOnMachineFunction(MachineFunction &MF) {
+
+  // Skip modules for which the ehcontguard flag is not set.
+  if (!MF.getMMI().getModule()->getModuleFlag("ehcontguard"))
+    return false;
+
+  // Skip functions that do not have catchret
+  if (!MF.hasEHCatchRet())
+    return false;
+
+  bool result = false;
+
+  for (MachineBasicBlock &MBB : MF) {
+    if (MBB.isEHCatchRetTarget() && !MBB.isEHFuncletEntry()) {
+      auto MBBI = MBB.begin();
+      SmallString<128> SymbolName;
+      raw_svector_ostream(SymbolName)
+          << "$ehgcr_" << MF.getName() << MBB.getNumber();
+      MCSymbol *CrSymbol = MF.getContext().getOrCreateSymbol(SymbolName);
+      MBBI->setPreInstrSymbol(MF, CrSymbol);
+      MF.addCatchretTarget(CrSymbol);
+      EHContGuardCatchretTargets++;
+      result = true;
+    }
+  }
+
+  return result;
+}

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

void SelectionDAGBuilder::visitCatchPad(const CatchPadInst &I) {
   if (IsMSVCCXX || IsCoreCLR)
     CatchPadMBB->setIsEHFuncletEntry();
 }
 
 void SelectionDAGBuilder::visitCatchRet(const CatchReturnInst &I) {
   // Update machine-CFG edge.
   MachineBasicBlock *TargetMBB = FuncInfo.MBBMap[I.getSuccessor()];
   FuncInfo.MBB->addSuccessor(TargetMBB);
+  TargetMBB->setIsEHCatchRetTarget(true);
+  DAG.getMachineFunction().setHasEHCatchRet(true);
 
   auto Pers = classifyEHPersonality(FuncInfo.Fn->getPersonalityFn());
   bool IsSEH = isAsynchronousEHPersonality(Pers);
   if (IsSEH) {
     // If this is not a fall-through branch or optimizations are switched off,
     // emit the branch.
     if (TargetMBB != NextBlock(FuncInfo.MBB) ||
         TM.getOptLevel() == CodeGenOpt::None)

llvm/lib/MC/MCObjectFileInfo.cpp

void MCObjectFileInfo::initCOFFMCObjectFileInfo(const Triple &T) {
 
   XDataSection = Ctx->getCOFFSection(
       ".xdata", COFF::IMAGE_SCN_CNT_INITIALIZED_DATA | COFF::IMAGE_SCN_MEM_READ,
       SectionKind::getData());
 
   SXDataSection = Ctx->getCOFFSection(".sxdata", COFF::IMAGE_SCN_LNK_INFO,
                                       SectionKind::getMetadata());
 
+  GEHContSection = Ctx->getCOFFSection(".gehcont$y",
+                                       COFF::IMAGE_SCN_CNT_INITIALIZED_DATA |
+                                           COFF::IMAGE_SCN_MEM_READ,
+                                       SectionKind::getMetadata());
+
   GFIDsSection = Ctx->getCOFFSection(".gfids$y",
                                      COFF::IMAGE_SCN_CNT_INITIALIZED_DATA |
                                          COFF::IMAGE_SCN_MEM_READ,
                                      SectionKind::getMetadata());
 
   GIATsSection = Ctx->getCOFFSection(".giats$y",
                                      COFF::IMAGE_SCN_CNT_INITIALIZED_DATA |
                                          COFF::IMAGE_SCN_MEM_READ,

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

private:
   using MInstToMCSymbol = std::map<const MachineInstr *, MCSymbol *>;
 
   MInstToMCSymbol LOHInstToLabel;
 };
 
 } // end anonymous namespace
 
 void AArch64AsmPrinter::emitStartOfAsmFile(Module &M) {
-  if (!TM.getTargetTriple().isOSBinFormatELF())
+  const Triple &TT = TM.getTargetTriple();
+
+  if (TT.isOSBinFormatCOFF()) {
+    // Emit an absolute @feat.00 symbol.  This appears to be some kind of
+    // compiler features bitfield read by link.exe.
+    MCSymbol *S = MMI->getContext().getOrCreateSymbol(StringRef("@feat.00"));
+    OutStreamer->BeginCOFFSymbolDef(S);
+    OutStreamer->EmitCOFFSymbolStorageClass(COFF::IMAGE_SYM_CLASS_STATIC);
+    OutStreamer->EmitCOFFSymbolType(COFF::IMAGE_SYM_DTYPE_NULL);
+    OutStreamer->EndCOFFSymbolDef();
+    int64_t Feat00Flags = 0;
+
+    if (M.getModuleFlag("cfguard")) {
+      Feat00Flags |= 0x800; // Object is CFG-aware.
+    }
+
+    if (M.getModuleFlag("ehcontguard")) {
+      Feat00Flags |= 0x4000; // Object also has EHCont.
+    }
+
+    OutStreamer->emitSymbolAttribute(S, MCSA_Global);
+    OutStreamer->emitAssignment(
+        S, MCConstantExpr::create(Feat00Flags, MMI->getContext()));
+  }
+
+  if (!TT.isOSBinFormatELF())
     return;
 
   // Assemble feature flags that may require creation of a note section.
   unsigned Flags = 0;
   if (const auto *BTE = mdconst::extract_or_null<ConstantInt>(
           M.getModuleFlag("branch-target-enforcement")))
     if (BTE->getZExtValue())
       Flags |= ELF::GNU_PROPERTY_AARCH64_FEATURE_1_BTI;

llvm/lib/Target/AArch64/AArch64TargetMachine.cpp

void AArch64PassConfig::addPreEmitPass() {
   if (EnableBranchTargets)
     addPass(createAArch64BranchTargetsPass());
 
   // Relax conditional branch instructions if they're otherwise out of
   // range of their destination.
   if (BranchRelaxation)
     addPass(&BranchRelaxationPassID);
 
+  if (TM->getTargetTriple().isOSWindows()) {
     // Identify valid longjmp targets for Windows Control Flow Guard.
-  if (TM->getTargetTriple().isOSWindows())
     addPass(createCFGuardLongjmpPass());
+    // Identify valid eh continuation targets for Windows EHCont Guard.
+    addPass(createEHContGuardCatchretPass());
+  }
 
   if (TM->getOptLevel() != CodeGenOpt::None && EnableCompressJumpTables)
     addPass(createAArch64CompressJumpTablesPass());
 
   if (TM->getOptLevel() != CodeGenOpt::None && EnableCollectLOH &&
       TM->getTargetTriple().isOSBinFormatMachO())
     addPass(createAArch64CollectLOHPass());
 

llvm/lib/Target/ARM/ARMTargetMachine.cpp

if (getOptLevel() != CodeGenOpt::None) {
     addPass(createARMOptimizeBarriersPass());
   }
 }
 
 void ARMPassConfig::addPreEmitPass2() {
   addPass(createARMConstantIslandPass());
   addPass(createARMLowOverheadLoopsPass());
 
+  if (TM->getTargetTriple().isOSWindows()) {
     // Identify valid longjmp targets for Windows Control Flow Guard.
-  if (TM->getTargetTriple().isOSWindows())
     addPass(createCFGuardLongjmpPass());
+    // Identify valid eh continuation targets for Windows EHCont Guard.
+    addPass(createEHContGuardCatchretPass());
+  }
 }

llvm/lib/Target/X86/X86AsmPrinter.cpp

if (TT.getArch() == Triple::x86) {
       // According to the PE-COFF spec, the LSB of this value marks the object
       // for "registered SEH".  This means that all SEH handler entry points
       // must be registered in .sxdata.  Use of any unregistered handlers will
       // cause the process to terminate immediately.  LLVM does not know how to
       // register any SEH handlers, so its object files should be safe.
       Feat00Flags |= 1;
     }
 
-    if (M.getModuleFlag("cfguard"))
+    if (M.getModuleFlag("cfguard")) {
       Feat00Flags |= 0x800; // Object is CFG-aware.
+    }
+
+    if (M.getModuleFlag("ehcontguard")) {
+      Feat00Flags |= 0x4000; // Object also has EHCont.
+    }
 
     OutStreamer->emitSymbolAttribute(S, MCSA_Global);
     OutStreamer->emitAssignment(
         S, MCConstantExpr::create(Feat00Flags, MMI->getContext()));
   }
   OutStreamer->emitSyntaxDirective();
 
   // If this is not inline asm and we're in 16-bit

llvm/lib/Target/X86/X86TargetMachine.cpp

void X86PassConfig::addPreEmitPass2() {
 
   // Verify basic block incoming and outgoing cfa offset and register values and
   // correct CFA calculation rule where needed by inserting appropriate CFI
   // instructions.
   if (!TT.isOSDarwin() &&
       (!TT.isOSWindows() ||
        MAI->getExceptionHandlingType() == ExceptionHandling::DwarfCFI))
     addPass(createCFIInstrInserter());
+
+  if (TT.isOSWindows()) {
     // Identify valid longjmp targets for Windows Control Flow Guard.
-  if (TT.isOSWindows())
     addPass(createCFGuardLongjmpPass());
+    // Identify valid eh continuation targets for Windows EHCont Guard.
+    addPass(createEHContGuardCatchretPass());
+  }
   addPass(createX86LoadValueInjectionRetHardeningPass());
 }
 
 bool X86PassConfig::addPreRewrite() {
   addPass(createX86TileConfigPass());
   return true;
 }
 
 std::unique_ptr<CSEConfigBase> X86PassConfig::getCSEConfig() const {
   return getStandardCSEConfigForOpt(TM->getOptLevel());
 }

llvm/test/CodeGen/AArch64/ehcontguard.ll

+; RUN: llc < %s -mtriple=aarch64-windows | FileCheck %s
+; EHCont Guard is currently only available on Windows
+
+; CHECK: .set @feat.00, 16384
+
+; CHECK: .section .gehcont$y
+
+; // struct with dtor
+; struct A
+; {
+;     ~A();
+; };
+;
+; // function we call that might raise an exception
+; void func2();
+;
+; // function which has to call the dtor on unwind
+; void func1()
+; {
+;     A a;
+;     func2();
+; }
+
+%struct.A = type { [4 x i32], [16 x i8] }
+declare dso_local %struct.A* @"??0A@@QEAA@XZ"(%struct.A* returned %0)
+declare dso_local void @"??1A@@QEAA@XZ"(%struct.A* %0)
+declare dso_local i32 @__CxxFrameHandler3(...)
+declare dso_local void @"?func2@@YAXXZ"()
+
+; Function Attrs: noinline optnone uwtable
+define dso_local void @"?func1@@YAXXZ"() #0 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+  %1 = alloca %struct.A
+  %2 = call %struct.A* @"??0A@@QEAA@XZ"(%struct.A* %1) #3
+  invoke void @"?func2@@YAXXZ"()
+          to label %3 unwind label %4
+
+3:                                                ; preds = %0
+  call void @"??1A@@QEAA@XZ"(%struct.A* %1) #3
+  ret void
+
+4:                                                ; preds = %0
+  %5 = cleanuppad within none []
+  call void @"??1A@@QEAA@XZ"(%struct.A* %1) #3 [ "funclet"(token %5) ]
+  cleanupret from %5 unwind to caller
+}
+
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"ehcontguard", i32 1}
 No newline at end of file

llvm/test/CodeGen/X86/ehcontguard.ll

+; RUN: llc < %s -mtriple=x86_64-pc-windows-msvc | FileCheck %s
+; EHCont Guard is currently only available on Windows
+
+; CHECK: .set @feat.00, 16384
+
+; CHECK: .section .gehcont$y
+
+; // struct with dtor
+; struct A
+; {
+;     ~A();
+; };
+;
+; // function we call that might raise an exception
+; void func2();
+;
+; // function which has to call the dtor on unwind
+; void func1()
+; {
+;     A a;
+;     func2();
+; }
+
+%struct.A = type { [4 x i32], [16 x i8] }
+declare dso_local %struct.A* @"??0A@@QEAA@XZ"(%struct.A* returned %0)
+declare dso_local void @"??1A@@QEAA@XZ"(%struct.A* %0)
+declare dso_local i32 @__CxxFrameHandler3(...)
+declare dso_local void @"?func2@@YAXXZ"()
+
+; Function Attrs: noinline optnone uwtable
+define dso_local void @"?func1@@YAXXZ"() #0 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+  %1 = alloca %struct.A
+  %2 = call %struct.A* @"??0A@@QEAA@XZ"(%struct.A* %1) #3
+  invoke void @"?func2@@YAXXZ"()
+          to label %3 unwind label %4
+
+3:                                                ; preds = %0
+  call void @"??1A@@QEAA@XZ"(%struct.A* %1) #3
+  ret void
+
+4:                                                ; preds = %0
+  %5 = cleanuppad within none []
+  call void @"??1A@@QEAA@XZ"(%struct.A* %1) #3 [ "funclet"(token %5) ]
+  cleanupret from %5 unwind to caller
+}
+
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"ehcontguard", i32 1}
 No newline at end of file

llvm/utils/gn/secondary/llvm/lib/CodeGen/BUILD.gn

sources = [
     "CommandFlags.cpp",
     "CriticalAntiDepBreaker.cpp",
     "DFAPacketizer.cpp",
     "DeadMachineInstructionElim.cpp",
     "DetectDeadLanes.cpp",
     "DwarfEHPrepare.cpp",
     "EarlyIfConversion.cpp",
     "EdgeBundles.cpp",
+    "EHContGuardCatchret.cpp",
     "ExecutionDomainFix.cpp",
     "ExpandMemCmp.cpp",
     "ExpandPostRAPseudos.cpp",
     "ExpandReductions.cpp",
     "FEntryInserter.cpp",
     "FaultMaps.cpp",
     "FinalizeISel.cpp",
     "FixupStatepointCallerSaved.cpp",