; RUN: llc -verify-machineinstrs -mtriple=x86_64-unknown -mattr=+lvi-cfi < %s | FileCheck %s --check-prefix=X64
; RUN: llc -verify-machineinstrs -mtriple=x86_64-unknown -mattr=+lvi-cfi -O0 < %s | FileCheck %s --check-prefix=X64FAST
;
; Note that a lot of this code was lifted from retpoline.ll.
declare dso_local void @bar(i32)
; Test a simple indirect call and tail call.
define void @icall_reg(ptr %fp, i32 %x) {
entry:
tail call void @bar(i32 %x)
tail call void %fp(i32 %x)
tail call void @bar(i32 %x)
tail call void %fp(i32 %x)
ret void
}
; X64-LABEL: icall_reg:
; X64-DAG: movq %rdi, %[[fp:[^ ]*]]
; X64-DAG: movl %esi, %[[x:[^ ]*]]
; X64: movl %esi, %edi
; X64: callq bar
; X64-DAG: movl %[[x]], %edi
; X64-DAG: movq %[[fp]], %r11
; X64: cs
; X64-NEXT: callq __llvm_lvi_thunk_r11
; X64: movl %[[x]], %edi
; X64: callq bar
; X64-DAG: movl %[[x]], %edi
; X64-DAG: movq %[[fp]], %r11
; X64: cs
; X64-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
; X64FAST-LABEL: icall_reg:
; X64FAST: callq bar
; X64FAST: cs
; X64FAST-NEXT: callq __llvm_lvi_thunk_r11
; X64FAST: callq bar
; X64FAST: cs
; X64FAST-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
@global_fp = external dso_local global ptr
; Test an indirect call through a global variable.
define void @icall_global_fp(i32 %x, ptr %fpp) #0 {
%fp1 = load ptr, ptr @global_fp
call void %fp1(i32 %x)
%fp2 = load ptr, ptr @global_fp
tail call void %fp2(i32 %x)
ret void
}
; X64-LABEL: icall_global_fp:
; X64-DAG: movl %edi, %[[x:[^ ]*]]
; X64-DAG: movq global_fp(%rip), %r11
; X64: cs
; X64-NEXT: callq __llvm_lvi_thunk_r11
; X64-DAG: movl %[[x]], %edi
; X64-DAG: movq global_fp(%rip), %r11
; X64: cs
; X64-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
; X64FAST-LABEL: icall_global_fp:
; X64FAST: movq global_fp(%rip), %r11
; X64FAST: cs
; X64FAST-NEXT: callq __llvm_lvi_thunk_r11
; X64FAST: movq global_fp(%rip), %r11
; X64FAST: cs
; X64FAST-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
%struct.Foo = type { ptr }
; Test an indirect call through a vtable.
define void @vcall(ptr %obj) #0 {
%vptr = load ptr, ptr %obj
%vslot = getelementptr ptr, ptr %vptr, i32 1
%fp = load ptr, ptr %vslot
tail call void %fp(ptr %obj)
tail call void %fp(ptr %obj)
ret void
}
; X64-LABEL: vcall:
; X64: movq %rdi, %[[obj:[^ ]*]]
; X64: movq (%rdi), %[[vptr:[^ ]*]]
; X64: movq 8(%[[vptr]]), %[[fp:[^ ]*]]
; X64: movq %[[fp]], %r11
; X64: cs
; X64-NEXT: callq __llvm_lvi_thunk_r11
; X64-DAG: movq %[[obj]], %rdi
; X64-DAG: movq %[[fp]], %r11
; X64: cs
; X64-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
; X64FAST-LABEL: vcall:
; X64FAST: cs
; X64FAST-NEXT: callq __llvm_lvi_thunk_r11
; X64FAST: cs
; X64FAST-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
declare dso_local void @direct_callee()
define void @direct_tail() #0 {
tail call void @direct_callee()
ret void
}
; X64-LABEL: direct_tail:
; X64: jmp direct_callee # TAILCALL
; X64FAST-LABEL: direct_tail:
; X64FAST: jmp direct_callee # TAILCALL
declare void @nonlazybind_callee() #1
define void @nonlazybind_caller() #0 {
call void @nonlazybind_callee()
tail call void @nonlazybind_callee()
ret void
}
; X64-LABEL: nonlazybind_caller:
; X64: movq nonlazybind_callee@GOTPCREL(%rip), %[[REG:.*]]
; X64: movq %[[REG]], %r11
; X64: cs
; X64-NEXT: callq __llvm_lvi_thunk_r11
; X64: movq %[[REG]], %r11
; X64: cs
; X64-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
; X64FAST-LABEL: nonlazybind_caller:
; X64FAST: movq nonlazybind_callee@GOTPCREL(%rip), %r11
; X64FAST: cs
; X64FAST-NEXT: callq __llvm_lvi_thunk_r11
; X64FAST: movq nonlazybind_callee@GOTPCREL(%rip), %r11
; X64FAST: cs
; X64FAST-NEXT: jmp __llvm_lvi_thunk_r11 # TAILCALL
; Check that a switch gets lowered using a jump table
define void @switch_jumptable(ptr %ptr, ptr %sink) #0 {
; X64-LABEL: switch_jumptable:
; X64-NOT: jmpq *
entry:
br label %header
header:
%i = load volatile i32, ptr %ptr
switch i32 %i, label %bb0 [
i32 1, label %bb1
i32 2, label %bb2
i32 3, label %bb3
i32 4, label %bb4
i32 5, label %bb5
i32 6, label %bb6
i32 7, label %bb7
i32 8, label %bb8
i32 9, label %bb9
]
bb0:
store volatile i64 0, ptr %sink
br label %header
bb1:
store volatile i64 1, ptr %sink
br label %header
bb2:
store volatile i64 2, ptr %sink
br label %header
bb3:
store volatile i64 3, ptr %sink
br label %header
bb4:
store volatile i64 4, ptr %sink
br label %header
bb5:
store volatile i64 5, ptr %sink
br label %header
bb6:
store volatile i64 6, ptr %sink
br label %header
bb7:
store volatile i64 7, ptr %sink
br label %header
bb8:
store volatile i64 8, ptr %sink
br label %header
bb9:
store volatile i64 9, ptr %sink
br label %header
}
@indirectbr_rewrite.targets = constant [10 x ptr] [ptr blockaddress(@indirectbr_rewrite, %bb0),
ptr blockaddress(@indirectbr_rewrite, %bb1),
ptr blockaddress(@indirectbr_rewrite, %bb2),
ptr blockaddress(@indirectbr_rewrite, %bb3),
ptr blockaddress(@indirectbr_rewrite, %bb4),
ptr blockaddress(@indirectbr_rewrite, %bb5),
ptr blockaddress(@indirectbr_rewrite, %bb6),
ptr blockaddress(@indirectbr_rewrite, %bb7),
ptr blockaddress(@indirectbr_rewrite, %bb8),
ptr blockaddress(@indirectbr_rewrite, %bb9)]
; Check that when thunks are enabled the indirectbr instruction gets
; rewritten to use switch, and that in turn doesn't get lowered as a jump
; table.
define void @indirectbr_rewrite(ptr readonly %p, ptr %sink) #0 {
; X64-LABEL: indirectbr_rewrite:
; X64-NOT: jmpq *
entry:
%i0 = load i64, ptr %p
%target.i0 = getelementptr [10 x ptr], ptr @indirectbr_rewrite.targets, i64 0, i64 %i0
%target0 = load ptr, ptr %target.i0
indirectbr ptr %target0, [label %bb1, label %bb3]
bb0:
store volatile i64 0, ptr %sink
br label %latch
bb1:
store volatile i64 1, ptr %sink
br label %latch
bb2:
store volatile i64 2, ptr %sink
br label %latch
bb3:
store volatile i64 3, ptr %sink
br label %latch
bb4:
store volatile i64 4, ptr %sink
br label %latch
bb5:
store volatile i64 5, ptr %sink
br label %latch
bb6:
store volatile i64 6, ptr %sink
br label %latch
bb7:
store volatile i64 7, ptr %sink
br label %latch
bb8:
store volatile i64 8, ptr %sink
br label %latch
bb9:
store volatile i64 9, ptr %sink
br label %latch
latch:
%i.next = load i64, ptr %p
%target.i.next = getelementptr [10 x ptr], ptr @indirectbr_rewrite.targets, i64 0, i64 %i.next
%target.next = load ptr, ptr %target.i.next
; Potentially hit a full 10 successors here so that even if we rewrite as
; a switch it will try to be lowered with a jump table.
indirectbr ptr %target.next, [label %bb0,
label %bb1,
label %bb2,
label %bb3,
label %bb4,
label %bb5,
label %bb6,
label %bb7,
label %bb8,
label %bb9]
}
; Lastly check that the necessary thunks were emitted.
;
; X64-LABEL: .section .text.__llvm_lvi_thunk_r11,{{.*}},__llvm_lvi_thunk_r11,comdat
; X64-NEXT: .hidden __llvm_lvi_thunk_r11
; X64-NEXT: .weak __llvm_lvi_thunk_r11
; X64: __llvm_lvi_thunk_r11:
; X64-NEXT: # {{.*}} # %entry
; X64-NEXT: lfence
; X64-NEXT: jmpq *%r11
attributes #1 = { nonlazybind }
!llvm.module.flags = !{!0}
!0 = !{i32 4, !"indirect_branch_cs_prefix", i32 1}
Codebase Browser
llvm