1 files changed, 81 insertions, 0 deletions
diff --git a/llvm/test/CodeGen/ARM/kcfi-cbz-range.ll b/llvm/test/CodeGen/ARM/kcfi-cbz-range.ll
new file mode 100644
index 0000000..8e71cae
--- /dev/null
+++ b/llvm/test/CodeGen/ARM/kcfi-cbz-range.ll
@@ -0,0 +1,81 @@
+; RUN: llc -mtriple=thumbv7-linux-gnueabi -filetype=obj < %s
+; RUN: llc -mtriple=thumbv7-linux-gnueabi < %s | FileCheck %s
+
+; This test verifies that KCFI instrumentation doesn't cause "out of range
+; pc-relative fixup value" errors when generating object files.
+;
+; The test creates a scenario with enough KCFI-instrumented indirect calls
+; (~32 bytes each) that would push a cbz/cbnz instruction out of its ±126 byte
+; range if the KCFI_CHECK pseudo-instruction size is not properly accounted for.
+;
+; Without the fix (KCFI_CHECK returns size 0):
+;   - Backend thinks KCFI checks take no space
+;   - Generates cbz to branch over the code
+;   - During assembly, cbz target is >126 bytes away
+;   - Assembly fails with "error: out of range pc-relative fixup value"
+;
+; With the fix (KCFI_CHECK returns size 32 for Thumb2):
+;   - Backend correctly accounts for KCFI check expansion
+;   - Avoids cbz or uses longer-range branch instructions
+;   - Assembly succeeds, object file is generated
+
+declare void @external_function(i32)
+
+; Test WITHOUT KCFI: should generate cbz since calls are small
+; CHECK-LABEL: test_without_kcfi:
+; CHECK: cbz
+; CHECK-NOT: bic{{.*}}#1
+define i32 @test_without_kcfi(ptr %callback, i32 %x) {
+entry:
+  %cmp = icmp eq i32 %x, 0
+  br i1 %cmp, label %if_zero, label %if_nonzero
+
+if_nonzero:
+  ; Regular (non-KCFI) indirect calls - much smaller
+  call void %callback()
+  call void %callback()
+  call void %callback()
+  call void %callback()
+  call void %callback()
+  call void %callback()
+
+  call void @external_function(i32 %x)
+  %add1 = add i32 %x, 1
+  ret i32 %add1
+
+if_zero:
+  call void @external_function(i32 0)
+  ret i32 0
+}
+
+; Test WITH KCFI: should NOT generate cbz due to large KCFI checks
+; CHECK-LABEL: test_with_kcfi:
+; CHECK-NOT: cbz
+; CHECK: bic{{.*}}#1
+define i32 @test_with_kcfi(ptr %callback, i32 %x) !kcfi_type !1 {
+entry:
+  %cmp = icmp eq i32 %x, 0
+  br i1 %cmp, label %if_zero, label %if_nonzero
+
+if_nonzero:
+  ; Six KCFI-instrumented indirect calls (~192 bytes total, exceeds cbz range)
+  call void %callback() [ "kcfi"(i32 12345678) ]
+  call void %callback() [ "kcfi"(i32 12345678) ]
+  call void %callback() [ "kcfi"(i32 12345678) ]
+  call void %callback() [ "kcfi"(i32 12345678) ]
+  call void %callback() [ "kcfi"(i32 12345678) ]
+  call void %callback() [ "kcfi"(i32 12345678) ]
+
+  ; Regular call to prevent optimization
+  call void @external_function(i32 %x)
+  %add1 = add i32 %x, 1
+  ret i32 %add1
+
+if_zero:
+  call void @external_function(i32 0)
+  ret i32 0
+}
+
+!llvm.module.flags = !{!0}
+!0 = !{i32 4, !"kcfi", i32 1}
+!1 = !{i32 12345678}