[ARM][KCFI] Fix bundle sizes to reflect worst-case expansion #164917
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout. Update the Size field for each ARM sub-architecture: - ARM: 28 → 40 bytes (10 instructions @ 4 bytes when r3 spill needed) - Thumb2: 32 → 34 bytes (mixed 16/32-bit instructions with r3 spill) - Thumb1: 50 → 38 bytes (19 instructions @ 2 bytes with r2+r3 spills) The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions.
|
@llvm/pr-subscribers-backend-arm Author: Kees Cook (kees) ChangesThe KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout. Update the Size field for each ARM sub-architecture:
The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions. cc @nathanchance Full diff: https://github.com/llvm/llvm-project/pull/164917.diff 1 Files Affected:
diff --git a/llvm/lib/Target/ARM/ARMInstrInfo.td b/llvm/lib/Target/ARM/ARMInstrInfo.td
index 53be1677b96e3..ce79029b17d12 100644
--- a/llvm/lib/Target/ARM/ARMInstrInfo.td
+++ b/llvm/lib/Target/ARM/ARMInstrInfo.td
@@ -6546,7 +6546,8 @@ def KCFI_CHECK_ARM
: PseudoInst<(outs), (ins GPR:$ptr, i32imm:$type), NoItinerary, []>,
Sched<[]>,
Requires<[IsARM]> {
- let Size = 28; // 7 instructions (bic, ldr, 4x eor, beq, udf)
+ let Size = 40; // worst-case 10 instructions @ 4 bytes each
+ // (push, bic, ldr, 4x eor, pop, beq, udf)
}
def KCFI_CHECK_Thumb2
@@ -6554,15 +6555,15 @@ def KCFI_CHECK_Thumb2
Sched<[]>,
Requires<[IsThumb2]> {
let Size =
- 32; // worst-case 9 instructions (push, bic, ldr, 4x eor, pop, beq.w, udf)
+ 34; // worst-case (push.w[2], bic[4], ldr[4], 4x eor[16], pop.w[2], beq.w[4], udf[2])
}
def KCFI_CHECK_Thumb1
: PseudoInst<(outs), (ins GPR:$ptr, i32imm:$type), NoItinerary, []>,
Sched<[]>,
Requires<[IsThumb1Only]> {
- let Size = 50; // worst-case 25 instructions (pushes, bic helper, type
- // building, cmp, pops)
+ let Size = 38; // worst-case 19 instructions @ 2 bytes each
+ // (2x push, 3x bic-helper, subs+ldr, 13x type-building, cmp, 2x pop, beq, bkpt)
}
//===----------------------------------------------------------------------===//
|
|
Thanks, this survives |
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/116/builds/20148 Here is the relevant piece of the build log for the reference |
|
LLVM Buildbot has detected a new failure on builder Full details are available at: https://lab.llvm.org/buildbot/#/builders/186/builds/13441 Here is the relevant piece of the build log for the reference |
dvbuka
pushed a commit
to dvbuka/llvm-project
that referenced
this pull request
Oct 27, 2025
…4917) The KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout. Update the Size field for each ARM sub-architecture: - ARM: 28 → 40 bytes (10 instructions @ 4 bytes when r3 spill needed) - Thumb2: 32 → 34 bytes (mixed 16/32-bit instructions with r3 spill) - Thumb1: 50 → 38 bytes (19 instructions @ 2 bytes with r2+r3 spills) The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions.
Lukacma
pushed a commit
to Lukacma/llvm-project
that referenced
this pull request
Oct 29, 2025
…4917) The KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout. Update the Size field for each ARM sub-architecture: - ARM: 28 → 40 bytes (10 instructions @ 4 bytes when r3 spill needed) - Thumb2: 32 → 34 bytes (mixed 16/32-bit instructions with r3 spill) - Thumb1: 50 → 38 bytes (19 instructions @ 2 bytes with r2+r3 spills) The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions.
aokblast
pushed a commit
to aokblast/llvm-project
that referenced
this pull request
Oct 30, 2025
…4917) The KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout. Update the Size field for each ARM sub-architecture: - ARM: 28 → 40 bytes (10 instructions @ 4 bytes when r3 spill needed) - Thumb2: 32 → 34 bytes (mixed 16/32-bit instructions with r3 spill) - Thumb1: 50 → 38 bytes (19 instructions @ 2 bytes with r2+r3 spills) The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The KCFI_CHECK pseudo-instruction size for ARM got miscalculated. These should represent worst-case expansion to ensure correct branch range calculations and code layout.
Update the Size field for each ARM sub-architecture:
The ARM and Thumb2 sizes were underestimating the case where the target register is r12, requiring r3 to be used as scratch and spilled/restored. The Thumb1 size was overestimated and has been corrected to the actual worst-case of 19 instructions.
cc @nathanchance