test/CodeGen/ARM/kcfi-thumb2.ll

; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 6
; RUN: llc -mtriple=thumbv7-linux-gnueabi -verify-machineinstrs < %s | FileCheck %s --check-prefix=ASM
; RUN: llc -mtriple=thumbv7-linux-gnueabi -verify-machineinstrs -stop-after=finalize-isel < %s | FileCheck %s --check-prefixes=MIR,ISEL
; RUN: llc -mtriple=thumbv7-linux-gnueabi -verify-machineinstrs -stop-after=kcfi < %s | FileCheck %s --check-prefixes=MIR,KCFI

; MIR checks for all functions (grouped here to prevent update_llc_test_checks.py from removing them)

; MIR-LABEL: name: f1
; MIR: body:

; ISEL:     tBLXr 14 /* CC::al */, $noreg, %0, csr_aapcs,{{.*}} cfi-type 12345678

; KCFI:       BUNDLE{{.*}} {
; KCFI-NEXT:    KCFI_CHECK_Thumb2 $r0, 12345678
; KCFI-NEXT:    tBLXr 14 /* CC::al */, $noreg, {{(killed )?}}$r0, csr_aapcs,{{.*}}
; KCFI-NEXT:  }

; MIR-LABEL: name: f2
; MIR: body:

; ISEL:     TCRETURNri %0, 0, csr_aapcs, implicit $sp, cfi-type 12345678

; KCFI:       BUNDLE{{.*}} {
; KCFI-NEXT:    KCFI_CHECK_Thumb2 $r0, 12345678
; KCFI-NEXT:    tTAILJMPr {{(killed )?}}$r0, csr_aapcs, implicit $sp, implicit $sp
; KCFI-NEXT:  }

; Test function without KCFI annotation
; ASM-LABEL: .globl nosan
; ASM-NEXT:  .p2align 1
; ASM-NEXT:  .type nosan,%function
; ASM-NEXT:  .code 16
; ASM-NEXT:  .thumb_func
define dso_local void @nosan() nounwind {
; ASM-LABEL: nosan:
; ASM:       @ %bb.0:
; ASM-NEXT:    bx lr
  ret void
}

; Test function with KCFI annotation - verifies type hash emission
;; The alignment is at least 4 to avoid unaligned type hash loads when this
;; instrumented function is indirectly called.
; ASM-LABEL: .globl target_func
; ASM-NEXT:  .p2align 2
; ASM-NEXT:  .type target_func,%function
; ASM-NEXT:  .long 12345678
; ASM-NEXT:  .code 16
; ASM-NEXT:  .thumb_func
define void @target_func() !kcfi_type !1 {
; ASM-LABEL: target_func:
; ASM:       @ %bb.0:
; ASM-NEXT:    bx lr
  ret void
}

; Test indirect call with KCFI check
; ASM:       .long 12345678
define void @f1(ptr noundef %x) !kcfi_type !1 {
; ASM-LABEL: f1:
; ASM:       @ %bb.0:
; ASM-NEXT:    .save {r7, lr}
; ASM-NEXT:    push {r7, lr}
; ASM-NEXT:    bic r12, r0, #1
; ASM-NEXT:    ldr r12, [r12, #-4]
; ASM-NEXT:    eor r12, r12, #78
; ASM-NEXT:    eor r12, r12, #24832
; ASM-NEXT:    eor r12, r12, #12320768
; ASM-NEXT:    eors r12, r12, #0
; ASM-NEXT:    beq.w .Ltmp0
; ASM-NEXT:    udf #128
; ASM-NEXT:  .Ltmp0:
; ASM-NEXT:    blx r0
; ASM-NEXT:    pop {r7, pc}

  call void %x() [ "kcfi"(i32 12345678) ]
  ret void
}

; Test with tail call
define void @f2(ptr noundef %x) !kcfi_type !1 {
; ASM-LABEL: f2:
; ASM:       @ %bb.0:
; ASM-NEXT:    bic r12, r0, #1
; ASM-NEXT:    ldr r12, [r12, #-4]
; ASM-NEXT:    eor r12, r12, #78
; ASM-NEXT:    eor r12, r12, #24832
; ASM-NEXT:    eor r12, r12, #12320768
; ASM-NEXT:    eors r12, r12, #0
; ASM-NEXT:    beq.w .Ltmp1
; ASM-NEXT:    udf #128
; ASM-NEXT:  .Ltmp1:
; ASM-NEXT:    bx r0

  tail call void %x() [ "kcfi"(i32 12345678) ]
  ret void
}

; Test r3 spill/reload when target is r12 and r3 is a call argument (Thumb2)
define void @f3_r3_spill(ptr noundef %target, i32 %a, i32 %b, i32 %c, i32 %d) !kcfi_type !1 {
; ASM-LABEL: f3_r3_spill:
; ASM:       @ %bb.0:
; ASM-NEXT:    .save {r7, lr}
; ASM-NEXT:    push {r7, lr}
; ASM-NEXT:    mov lr, r3
; ASM-NEXT:    ldr r3, [sp, #8]
; ASM-NEXT:    mov r12, r0
; ASM-NEXT:    mov r0, r1
; ASM-NEXT:    mov r1, r2
; ASM-NEXT:    mov r2, lr
; ASM-NEXT:    push {r3}
; ASM-NEXT:    bic r3, r12, #1
; ASM-NEXT:    ldr r3, [r3, #-4]
; ASM-NEXT:    eor r3, r3, #78
; ASM-NEXT:    eor r3, r3, #24832
; ASM-NEXT:    eor r3, r3, #12320768
; ASM-NEXT:    eors r3, r3, #0
; ASM-NEXT:    pop {r3}
; ASM-NEXT:    beq.w .Ltmp2
; ASM-NEXT:    udf #140
; ASM-NEXT:  .Ltmp2:
; ASM-NEXT:    blx r12
; ASM-NEXT:    pop {r7, pc}
; Arguments: r0=%target, r1=%a, r2=%b, r3=%c, [sp+8]=%d
; Call needs: r0=%a, r1=%b, r2=%c, r3=%d, target in r12
; r3 is live as 4th argument, so push it before KCFI check
  call void %target(i32 %a, i32 %b, i32 %c, i32 %d) [ "kcfi"(i32 12345678) ]
  ret void
}

; Test with 3 arguments - r3 not live, target in r12 or elsewhere, r12 used as scratch
define void @f4_r3_unused(ptr noundef %target, i32 %a, i32 %b) !kcfi_type !1 {
; ASM-LABEL: f4_r3_unused:
; ASM:       @ %bb.0:
; ASM-NEXT:    .save {r7, lr}
; ASM-NEXT:    push {r7, lr}
; ASM-NEXT:    mov r3, r0
; ASM-NEXT:    mov r0, r1
; ASM-NEXT:    mov r1, r2
; ASM-NEXT:    bic r12, r3, #1
; ASM-NEXT:    ldr r12, [r12, #-4]
; ASM-NEXT:    eor r12, r12, #78
; ASM-NEXT:    eor r12, r12, #24832
; ASM-NEXT:    eor r12, r12, #12320768
; ASM-NEXT:    eors r12, r12, #0
; ASM-NEXT:    beq.w .Ltmp3
; ASM-NEXT:    udf #131
; ASM-NEXT:  .Ltmp3:
; ASM-NEXT:    blx r3
; ASM-NEXT:    pop {r7, pc}
; Only 3 arguments total, so r3 is not used as call argument
; Target might be in r3, using r12 as scratch (no spill needed)
  call void %target(i32 %a, i32 %b) [ "kcfi"(i32 12345678) ]
  ret void
}

!llvm.module.flags = !{!0}
!0 = !{i32 4, !"kcfi", i32 1}
!1 = !{i32 12345678}
;; NOTE: These prefixes are unused and the list is autogenerated. Do not add tests below this line:
; ISEL: {{.*}}
; KCFI: {{.*}}
; MIR: {{.*}}