Skip to content

Conversation

@KamranYousafzai
Copy link

@KamranYousafzai KamranYousafzai commented Oct 1, 2024

The code generated for calls with FPCC eligible structs as arguments doesn't consider the bitfield, which results in a store crossing the boundary of the memory allocated using alloca, e.g.
For the code:

struct __attribute__((packed, aligned(1))) S { const float f0; unsigned f1 : 1; }; unsigned func(struct S arg) { return arg.f1; } 

The generated IR is:

 define dso_local signext i32 @func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] [[ARG:%.*]] = alloca [[STRUCT_S:%.*]], align 1 [[TMP2:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 0 store float [[TMP0]], ptr [[TMP2]], align 1 [[TMP3:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 1 store i32 [[TMP1]], ptr [[TMP3]], align 1 [[F1:%.*]] = getelementptr inbounds nuw [[STRUCT_S]], ptr [[ARG]], i32 0, i32 1 [[BF_LOAD:%.*]] = load i8, ptr [[F1]], align 1 [[BF_CLEAR:%.*]] = and i8 [[BF_LOAD]], 1 [[BF_CAST:%.*]] = zext i8 [[BF_CLEAR]] to i32 ret i32 [[BF_CAST]] 

Where, store i32 [[TMP1]], ptr [[TMP3]], align 1 can be seen crossing the boundary of the allocated memory. If, the IR is seen after optimizations (EarlyCSEPass), the IR left is:

 define dso_local noundef signext i32 @func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] ret i32 0 

The patch trims the second member of the struct after taking into consideration the bitwidth to decide the appropriate integer type and the test shows the results of this patch.

Note that the bug is seen only when f extension is enabled for FPCC eligibility.

@github-actions
Copy link

github-actions bot commented Oct 1, 2024

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

@llvmbot llvmbot added clang Clang issues not falling into any other category backend:RISC-V clang:codegen IR generation bugs: mangling, exceptions, etc. labels Oct 1, 2024
@llvmbot
Copy link
Member

llvmbot commented Oct 1, 2024

@llvm/pr-subscribers-clang

Author: Kamran Yousafzai (KamranYousafzai)

Changes

The code generated for calls with FPCC eligible structs as arguments doesn't consider the alignment with a bitfield, which results in a store crossing the boundary of the memory allocated using alloca, e.g.
For the code:

struct __attribute__((packed, aligned(1))) S { const float f0; unsigned f1 : 1; }; unsigned func(struct S arg) { return arg.f1; } 

The generated IR is:

 define dso_local signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] [[ARG:%.*]] = alloca [[STRUCT_S:%.*]], align 1 [[TMP2:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 0 store float [[TMP0]], ptr [[TMP2]], align 1 [[TMP3:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 1 store i32 [[TMP1]], ptr [[TMP3]], align 1 [[F1:%.*]] = getelementptr inbounds nuw [[STRUCT_S]], ptr [[ARG]], i32 0, i32 1 [[BF_LOAD:%.*]] = load i8, ptr [[F1]], align 1 [[BF_CLEAR:%.*]] = and i8 [[BF_LOAD]], 1 [[BF_CAST:%.*]] = zext i8 [[BF_CLEAR]] to i32 ret i32 [[BF_CAST]] 

Where, store i32 [[TMP1]], ptr [[TMP3]], align 1 can be seen to crossing the boundary of the allocated memory. If, the IR is seen after optimizations, the IR left is:

 define dso_local noundef signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] ret i32 0 

The patch trims the second member of the struct after taking into consideration the alignment and bitwidth to decide the appropriate integer type and the test shows the results of this patch.

Note that the bug is seen only when f extension is enabled.


Full diff: https://github.com/llvm/llvm-project/pull/110690.diff

2 Files Affected:

  • (modified) clang/lib/CodeGen/Targets/RISCV.cpp (+11)
  • (added) clang/test/CodeGen/RISCV/riscv-fpcc-struct.c (+21)
diff --git a/clang/lib/CodeGen/Targets/RISCV.cpp b/clang/lib/CodeGen/Targets/RISCV.cpp index fd72fe673b9b14..142371ffe27e54 100644 --- a/clang/lib/CodeGen/Targets/RISCV.cpp +++ b/clang/lib/CodeGen/Targets/RISCV.cpp @@ -224,6 +224,8 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, if (isEmptyRecord(getContext(), Ty, true, true)) return true; const RecordDecl *RD = RTy->getDecl(); + const Type *RT = RD->getTypeForDecl(); + unsigned Alignment = getContext().getTypeAlign(RT); // Unions aren't eligible unless they're empty (which is caught above). if (RD->isUnion()) return false; @@ -251,6 +253,15 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, // bitwidth is XLen or less. if (getContext().getTypeSize(QTy) > XLen && BitWidth <= XLen) QTy = getContext().getIntTypeForBitwidth(XLen, false); + // Trim type to alignment/bitwidth if that is possible + else if (getContext().getTypeSize(QTy) > Alignment && + getContext().getTypeSize(QTy) > BitWidth) { + bool isSigned = + FD->getType().getTypePtr()->hasSignedIntegerRepresentation(); + unsigned bits = + std::max(Alignment, (unsigned)llvm::PowerOf2Ceil(BitWidth)); + QTy = getContext().getIntTypeForBitwidth(bits, isSigned); + } if (BitWidth == 0) { ZeroWidthBitFieldCount++; continue; diff --git a/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c new file mode 100644 index 00000000000000..5d813aa05e60c6 --- /dev/null +++ b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c @@ -0,0 +1,21 @@ +// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 5 +// RUN: %clang_cc1 -triple riscv64 -target-feature +f -emit-llvm -O3 %s -o - \ +// RUN: | FileCheck %s + + +struct __attribute__((packed, aligned(1))) S { + const float f0; + unsigned f1 : 1; +}; + +// CHECK-LABEL: define dso_local signext range(i32 0, 2) i32 @func( +// CHECK-SAME: float [[TMP0:%.*]], i8 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { +// CHECK-NEXT: [[ENTRY:.*:]] +// CHECK-NEXT: [[BF_CLEAR:%.*]] = and i8 [[TMP1]], 1 +// CHECK-NEXT: [[BF_CAST:%.*]] = zext nneg i8 [[BF_CLEAR]] to i32 +// CHECK-NEXT: ret i32 [[BF_CAST]] +// +unsigned func(struct S arg) +{ + return arg.f1; +} 
@llvmbot
Copy link
Member

llvmbot commented Oct 1, 2024

@llvm/pr-subscribers-backend-risc-v

Author: Kamran Yousafzai (KamranYousafzai)

Changes

The code generated for calls with FPCC eligible structs as arguments doesn't consider the alignment with a bitfield, which results in a store crossing the boundary of the memory allocated using alloca, e.g.
For the code:

struct __attribute__((packed, aligned(1))) S { const float f0; unsigned f1 : 1; }; unsigned func(struct S arg) { return arg.f1; } 

The generated IR is:

 define dso_local signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] [[ARG:%.*]] = alloca [[STRUCT_S:%.*]], align 1 [[TMP2:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 0 store float [[TMP0]], ptr [[TMP2]], align 1 [[TMP3:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 1 store i32 [[TMP1]], ptr [[TMP3]], align 1 [[F1:%.*]] = getelementptr inbounds nuw [[STRUCT_S]], ptr [[ARG]], i32 0, i32 1 [[BF_LOAD:%.*]] = load i8, ptr [[F1]], align 1 [[BF_CLEAR:%.*]] = and i8 [[BF_LOAD]], 1 [[BF_CAST:%.*]] = zext i8 [[BF_CLEAR]] to i32 ret i32 [[BF_CAST]] 

Where, store i32 [[TMP1]], ptr [[TMP3]], align 1 can be seen to crossing the boundary of the allocated memory. If, the IR is seen after optimizations, the IR left is:

 define dso_local noundef signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] ret i32 0 

The patch trims the second member of the struct after taking into consideration the alignment and bitwidth to decide the appropriate integer type and the test shows the results of this patch.

Note that the bug is seen only when f extension is enabled.


Full diff: https://github.com/llvm/llvm-project/pull/110690.diff

2 Files Affected:

  • (modified) clang/lib/CodeGen/Targets/RISCV.cpp (+11)
  • (added) clang/test/CodeGen/RISCV/riscv-fpcc-struct.c (+21)
diff --git a/clang/lib/CodeGen/Targets/RISCV.cpp b/clang/lib/CodeGen/Targets/RISCV.cpp index fd72fe673b9b14..142371ffe27e54 100644 --- a/clang/lib/CodeGen/Targets/RISCV.cpp +++ b/clang/lib/CodeGen/Targets/RISCV.cpp @@ -224,6 +224,8 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, if (isEmptyRecord(getContext(), Ty, true, true)) return true; const RecordDecl *RD = RTy->getDecl(); + const Type *RT = RD->getTypeForDecl(); + unsigned Alignment = getContext().getTypeAlign(RT); // Unions aren't eligible unless they're empty (which is caught above). if (RD->isUnion()) return false; @@ -251,6 +253,15 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, // bitwidth is XLen or less. if (getContext().getTypeSize(QTy) > XLen && BitWidth <= XLen) QTy = getContext().getIntTypeForBitwidth(XLen, false); + // Trim type to alignment/bitwidth if that is possible + else if (getContext().getTypeSize(QTy) > Alignment && + getContext().getTypeSize(QTy) > BitWidth) { + bool isSigned = + FD->getType().getTypePtr()->hasSignedIntegerRepresentation(); + unsigned bits = + std::max(Alignment, (unsigned)llvm::PowerOf2Ceil(BitWidth)); + QTy = getContext().getIntTypeForBitwidth(bits, isSigned); + } if (BitWidth == 0) { ZeroWidthBitFieldCount++; continue; diff --git a/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c new file mode 100644 index 00000000000000..5d813aa05e60c6 --- /dev/null +++ b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c @@ -0,0 +1,21 @@ +// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 5 +// RUN: %clang_cc1 -triple riscv64 -target-feature +f -emit-llvm -O3 %s -o - \ +// RUN: | FileCheck %s + + +struct __attribute__((packed, aligned(1))) S { + const float f0; + unsigned f1 : 1; +}; + +// CHECK-LABEL: define dso_local signext range(i32 0, 2) i32 @func( +// CHECK-SAME: float [[TMP0:%.*]], i8 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { +// CHECK-NEXT: [[ENTRY:.*:]] +// CHECK-NEXT: [[BF_CLEAR:%.*]] = and i8 [[TMP1]], 1 +// CHECK-NEXT: [[BF_CAST:%.*]] = zext nneg i8 [[BF_CLEAR]] to i32 +// CHECK-NEXT: ret i32 [[BF_CAST]] +// +unsigned func(struct S arg) +{ + return arg.f1; +} 
@llvmbot
Copy link
Member

llvmbot commented Oct 1, 2024

@llvm/pr-subscribers-clang-codegen

Author: Kamran Yousafzai (KamranYousafzai)

Changes

The code generated for calls with FPCC eligible structs as arguments doesn't consider the alignment with a bitfield, which results in a store crossing the boundary of the memory allocated using alloca, e.g.
For the code:

struct __attribute__((packed, aligned(1))) S { const float f0; unsigned f1 : 1; }; unsigned func(struct S arg) { return arg.f1; } 

The generated IR is:

 define dso_local signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] [[ARG:%.*]] = alloca [[STRUCT_S:%.*]], align 1 [[TMP2:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 0 store float [[TMP0]], ptr [[TMP2]], align 1 [[TMP3:%.*]] = getelementptr inbounds nuw { float, i32 }, ptr [[ARG]], i32 0, i32 1 store i32 [[TMP1]], ptr [[TMP3]], align 1 [[F1:%.*]] = getelementptr inbounds nuw [[STRUCT_S]], ptr [[ARG]], i32 0, i32 1 [[BF_LOAD:%.*]] = load i8, ptr [[F1]], align 1 [[BF_CLEAR:%.*]] = and i8 [[BF_LOAD]], 1 [[BF_CAST:%.*]] = zext i8 [[BF_CLEAR]] to i32 ret i32 [[BF_CAST]] 

Where, store i32 [[TMP1]], ptr [[TMP3]], align 1 can be seen to crossing the boundary of the allocated memory. If, the IR is seen after optimizations, the IR left is:

 define dso_local noundef signext i32 @<!-- -->func( float [[TMP0:%.*]], i32 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { [[ENTRY:.*:]] ret i32 0 

The patch trims the second member of the struct after taking into consideration the alignment and bitwidth to decide the appropriate integer type and the test shows the results of this patch.

Note that the bug is seen only when f extension is enabled.


Full diff: https://github.com/llvm/llvm-project/pull/110690.diff

2 Files Affected:

  • (modified) clang/lib/CodeGen/Targets/RISCV.cpp (+11)
  • (added) clang/test/CodeGen/RISCV/riscv-fpcc-struct.c (+21)
diff --git a/clang/lib/CodeGen/Targets/RISCV.cpp b/clang/lib/CodeGen/Targets/RISCV.cpp index fd72fe673b9b14..142371ffe27e54 100644 --- a/clang/lib/CodeGen/Targets/RISCV.cpp +++ b/clang/lib/CodeGen/Targets/RISCV.cpp @@ -224,6 +224,8 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, if (isEmptyRecord(getContext(), Ty, true, true)) return true; const RecordDecl *RD = RTy->getDecl(); + const Type *RT = RD->getTypeForDecl(); + unsigned Alignment = getContext().getTypeAlign(RT); // Unions aren't eligible unless they're empty (which is caught above). if (RD->isUnion()) return false; @@ -251,6 +253,15 @@ bool RISCVABIInfo::detectFPCCEligibleStructHelper(QualType Ty, CharUnits CurOff, // bitwidth is XLen or less. if (getContext().getTypeSize(QTy) > XLen && BitWidth <= XLen) QTy = getContext().getIntTypeForBitwidth(XLen, false); + // Trim type to alignment/bitwidth if that is possible + else if (getContext().getTypeSize(QTy) > Alignment && + getContext().getTypeSize(QTy) > BitWidth) { + bool isSigned = + FD->getType().getTypePtr()->hasSignedIntegerRepresentation(); + unsigned bits = + std::max(Alignment, (unsigned)llvm::PowerOf2Ceil(BitWidth)); + QTy = getContext().getIntTypeForBitwidth(bits, isSigned); + } if (BitWidth == 0) { ZeroWidthBitFieldCount++; continue; diff --git a/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c new file mode 100644 index 00000000000000..5d813aa05e60c6 --- /dev/null +++ b/clang/test/CodeGen/RISCV/riscv-fpcc-struct.c @@ -0,0 +1,21 @@ +// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 5 +// RUN: %clang_cc1 -triple riscv64 -target-feature +f -emit-llvm -O3 %s -o - \ +// RUN: | FileCheck %s + + +struct __attribute__((packed, aligned(1))) S { + const float f0; + unsigned f1 : 1; +}; + +// CHECK-LABEL: define dso_local signext range(i32 0, 2) i32 @func( +// CHECK-SAME: float [[TMP0:%.*]], i8 [[TMP1:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { +// CHECK-NEXT: [[ENTRY:.*:]] +// CHECK-NEXT: [[BF_CLEAR:%.*]] = and i8 [[TMP1]], 1 +// CHECK-NEXT: [[BF_CAST:%.*]] = zext nneg i8 [[BF_CLEAR]] to i32 +// CHECK-NEXT: ret i32 [[BF_CAST]] +// +unsigned func(struct S arg) +{ + return arg.f1; +} 
@KamranYousafzai KamranYousafzai force-pushed the mkamran/fpcc-eligible-structs branch from b751fd8 to 69d04c6 Compare October 1, 2024 15:44
@KamranYousafzai KamranYousafzai changed the title fixed fp calling convention for fpcc eligible structs for risc-v [clang][RISC-V] fixed fp calling convention for fpcc eligible structs for risc-v Oct 1, 2024
@topperc topperc requested a review from asb October 1, 2024 17:01
if (getContext().getTypeSize(QTy) > XLen && BitWidth <= XLen)
QTy = getContext().getIntTypeForBitwidth(XLen, false);
// Trim type to alignment/bitwidth if that is possible
else if (getContext().getTypeSize(QTy) > Alignment &&
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the alignment relevant? Should we just round the bitfield size to the smallest power of 2 always? Even without the packed attribute, gcc -O0 emits sb while clang emits sw.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, the latest push reflects the change suggested. It now just checks against size of a byte to ensure the size at the very minimum is 8 bits.

@KamranYousafzai KamranYousafzai force-pushed the mkamran/fpcc-eligible-structs branch 2 times, most recently from 8ca2d40 to f1da56e Compare October 2, 2024 11:55
@KamranYousafzai KamranYousafzai force-pushed the mkamran/fpcc-eligible-structs branch from f1da56e to 2a41d57 Compare October 3, 2024 10:06
// LP64: entry:
//
// LP64F-LP64D-LABEL: define dso_local void @f_float16_int64bf_s_arg
// LP64F-LP64D-SAME: (half [[TMP0:%.*]], i64 [[TMP1:%.*]]) #[[ATTR0]] {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I looked at the current IR for this.

We have

%struct.float16_int64bf_s = type <{ half, i32, [2 x i8] }> define dso_local void @f_float16_int64bf_s_arg(half %0, i64 %1) #0 !dbg !1528 { %3 = alloca %struct.float16_int64bf_s, align 8 %4 = getelementptr inbounds nuw <{ half, i64 }>, ptr %3, i32 0, i32 0 store half %0, ptr %4, align 8 %5 = getelementptr inbounds nuw <{ half, i64 }>, ptr %3, i32 0, i32 1 store i64 %1, ptr %5, align 2 #dbg_declare(ptr %3, !1535, !DIExpression(), !1536) ret void, !dbg !1537 } 

The struct type for the alloca is packed so it takes 8 bytes. Then we treat it as a packed struct of 10 bytes when we do the stores. So the i64 store went past the allocated memory.

Copy link
Collaborator

@topperc topperc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@KamranYousafzai
Copy link
Author

Hi @asb , could you please have a look and review the proposed changes?

@KamranYousafzai
Copy link
Author

Hi @asb @topperc , do you think we can merge it?

@efriedma-quic efriedma-quic requested a review from lenary November 26, 2025 00:03
Copy link
Member

@lenary lenary left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lenary
Copy link
Member

lenary commented Nov 26, 2025

@KamranYousafzai please can you follow the instructions about your email here: https://llvm.org/docs/DeveloperPolicy.html#github-email-address

Then I will ensure this is merged. Sorry for this taking so long.

@KamranYousafzai
Copy link
Author

@KamranYousafzai please can you follow the instructions about your email here: https://llvm.org/docs/DeveloperPolicy.html#github-email-address

Then I will ensure this is merged. Sorry for this taking so long.

Hi @lenary, I did change the email from private to public. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend:RISC-V clang:codegen IR generation bugs: mangling, exceptions, etc. clang Clang issues not falling into any other category

4 participants