[InlineAsm][bugfix] Correct function addressing in inline asm

[xiangzhangllvm]

Summary

In Linux PIC model, there are 4 cases about value/label addressing:

Case 1: Function call or Label jmp inside the module.
Case 2: Data access (such as global variable, static variable) inside the module.
Case 3: Function call or Label jmp outside the module.
Case 4: Data access (such as global variable) outside the module.

Due to current llvm inline asm architecture designed to not "recognize" the asm
code, there are quite troubles for us to treat mem addressing differently for
same value/adress used in different instuctions.
For example, in pic model, call a func may in plt way or direclty pc-related,
but lea/mov a function adress may use got.

This patch fix/refine the case 1 and case 3 in inline asm.
(I prefer to fix/refine case 2 and case 4 problems later, in another patch)
Due to currently inline asm didn't support jmp the outsider lable, this patch
mainly focus on fix the function call addressing bugs in inline asm.

Example:
Before this fix we can't successfully/correctly build the test https://godbolt.org/z/jGvEET3q3 with clang
(The test is the source file of lit test llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll )

[xiangzhangllvm]

llvm/test/CodeGen/X86/inline-asm-p-constraint.ll

14

@jonpa I think here you may mis-understand lea, so I updated here.
And I think the mov (%rdi) should be mov %rdi in constrain of "p" you add before.

At first I updated the 'p' action to "direct action" (without load: mov %rdi), but it affect systemZ tests which I am not familiar with. So I want to discuss with you about the action of "p" here.

"p" should be address which equal with "direct mem (without load)".
So in DAG build (pls refer the change in SelectionDAGBuilder.cpp) the OpInfo.isIndirect should always be false;

[xiangzhangllvm]

Update comments

[jonpa]

llvm/test/CodeGen/X86/inline-asm-p-constraint.ll

14

Yes, as far as I understand "p" (address) is not "indirect" - the address is specified at the source level and not used to access memory. It's when you pass an address to a memory operand the "indirect" flag is added.

[RKSimon]

a few style comments

llvm/include/llvm/CodeGen/TargetLowering.h

3533

Add a description comment

3533

Add a description comment

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

Add a description comment

llvm/include/llvm/IR/InlineAsm.h

337

update assertion message?

354–355

add an assertion message

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

1325

auto *TGA = dyn_cast<>

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8884

isa_and_nonnull<Function> ?

[pengfei]

+ @nickdesaulniers who once worked for branch issue of inline asm.

clang/test/CodeGen/ms-inline-asm-functions.c

25 ↗

(On Diff #460309)

Why is it affected? Is missing a * before the label?

35 ↗

(On Diff #460309)

Due to currently inline asm didn't support jmp the outsider lable, this patch
mainly focus on fix the function call addressing bugs in inline asm.

This seems a counter example.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8839

No need to define function that only called once.

8889

Can we just pass the string and handle it in the function?

[xiangzhangllvm]

clang/test/CodeGen/ms-inline-asm-functions.c

25 ↗

(On Diff #460309)

The dllimport mark it is a inter linkage, so we can directly call this function.

llvm/test/CodeGen/X86/inline-asm-p-constraint.ll

14

Yes, but now I pass 'p' for "ptr %Ptr" in ""mov $1", it still load the context of "ptr %Ptr".
So this is a problem.
I prefer to fix it.

[xiangzhangllvm]

clang/test/CodeGen/ms-inline-asm-functions.c

35 ↗

(On Diff #460309)

This will be bug in pic model.

llvm/include/llvm/CodeGen/TargetLowering.h

3533

Sure, I'll add it, thanks.

llvm/include/llvm/IR/InlineAsm.h

337

Ok, let me update it. Before this patch the function is belong to Mem kind.
Currently we split them.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8839

The other target must have some bugs, so I create this function for further use.

8884

OK, good style!

8889

Yes, fold upper code into a function call is better!

[LuoYuanke]

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

It seems each target has it's own defintion for the return value. Is it interpreted by target when it is used?

llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll

13

Remove the original line number of the source code?

[LuoYuanke]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8892

What's the difference between C_Address and C_Memory?

llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll

72

Do we need these attribute for the test case?

[xiangzhangllvm]

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

Yes, Each target has it's own definition of this function to handle call instruction. This is a virtual function on the base class TargetSubtargetInfo. The target will call their self's classifyGlobalFunctionReference for handle function.

315

Sure

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8892

This is added by jonpa, It mean address (mem without load), I think the implement of it is still need to refine, pls refer our discussion on test llvm/test/CodeGen/X86/inline-asm-p-constraint.ll.

llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll

72

Let me update it.

[xiangzhangllvm]

clang/test/CodeGen/ms-inline-asm-functions.c

25 ↗

(On Diff #460309)

typo: inter linkage --> internal linkage

[RKSimon]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8754

Pass SDValue by value not reference

[xiangzhangllvm]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8754

Make sense! Here we not change the Op, thanks for reviewing!

[pengfei]

clang/test/CodeGen/ms-inline-asm-functions.c

25 ↗

(On Diff #460309)

I understand it on the opposite side, the dllimport means it is always an external function, so it must be an indirect call here.
https://github.com/MicrosoftDocs/cpp-docs/blob/main/docs/build/importing-into-an-application-using-declspec-dllimport.md

llvm/lib/IR/InlineAsm.cpp

65

The inline asm is not always split by "\n\t" e.g., https://github.com/llvm/llvm-project/blob/main/llvm/test/CodeGen/ARM/inlineasm-64bit.ll#L37
And we can even use ; https://godbolt.org/z/eb8n9d364

[xiangzhangllvm]

clang/test/CodeGen/ms-inline-asm-functions.c

25 ↗

(On Diff #460309)

Thank you point out it! Seems I mix it with "dllexport", the dllexport mean this is self module symbol. let me check here.

llvm/lib/IR/InlineAsm.cpp

65

Good catch! let's enhance here. Thank you so much!

[xiangzhangllvm]

escape dllimport function call

[xiangzhangllvm]

ping, our customer are waiting for this fix. thanks.

[pengfei]

llvm/include/llvm/CodeGen/TargetLowering.h

3536

How about the target branch is used by other instructions? E.g.
call void asm "lea r8, $0\0A\09call qword ptr ${0:P}\0A\09ret"

3540

tranch -> branch

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

Where's X86 implementation? I didn't find it.

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

411

This change seems not related. Better not to modify it.

1321–1322

This seems need re-format?

1324

Didn't see we check AdjustFlag here.

1325

Comment not addressed.

llvm/lib/Target/X86/X86ISelLowering.cpp

32291

I don't think we have call $1,... in all case.

32301–32306

The code seems fragile. How about using regex:

std::string Call = formatv("call.*\\${?{0}", OpNo);
for (auto &AsmStr : AsmStrs)
  if (Regex(Call).match(AsmStr))
    return true;
return false;

llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll

32

The comments don't match with actual one, please remove it.

63

ditto.

[xiangzhangllvm]

llvm/include/llvm/CodeGen/TargetLowering.h

3536

We shouldn't generate the different kind uses (target branch use and data use) with same operand index. Even they are some value.
For example the intel inline asm will generate different index for different uses (even same value).
For user who manually write the index should appoint different index (with different constraints) for different kind uses.

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

Exist code, Not in the patch:
Target/X86/X86Subtarget.cpp: X86Subtarget::classifyGlobalFunctionReference

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

411

Sorry, this refine should be at line 1325

1321–1322

Clang format ?

llvm/lib/Target/X86/X86ISelLowering.cpp

32291

here handle 3 case: $1, ${1: and $1 in the end of string.

32301–32306

good idea! Let me have a try, thanks a lot!

[pengfei]

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

315

Got it, thanks!

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

1321–1322

Yes.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8843

I see the GlobalISel handles argument and result separately https://github.com/llvm/llvm-project/blob/main/llvm/lib/CodeGen/GlobalISel/InlineAsmLowering.cpp#L289-L290. No sure if there's problem to handle together here, e.g., a constrain is both argument and output https://godbolt.org/z/98sne5h4x or other corner cases?

[xiangzhangllvm]

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8843

Here ArgNo is different conception with the "ArgNo" in https://github.com/llvm/llvm-project/blob/main/llvm/lib/CodeGen/GlobalISel/InlineAsmLowering.cpp#L289-L290.
It mean the index of OpInfo, it both work for GlobalISel and non-GlobalISel.
Maybe "OpNo" is more clear. Let me rename it .

[RKSimon]

llvm/include/llvm/CodeGen/TargetLowering.h

3543

Why not ArrayRef<StringRef> ?

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8755

SDValue has a bool operator so we don't need to use getNode()

if (Op && Op.getOpcode() == ISD::GlobalAddress) {

[xiangzhangllvm]

llvm/include/llvm/CodeGen/TargetLowering.h

3543

Because we collect SmallVector<StringRef> AsmStrs in
SelectionDAGBuilder.cpp: (line 8808)

IA->collectAsmStrs(AsmStrs);

So here we keep use the same type for AsmStrs.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

8755

That is better, let me try, thanks so much!

[xiangzhangllvm]

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

1321–1322

Do clang format. No change.

llvm/lib/Target/X86/X86ISelLowering.cpp

32301–32306

Enhance in getInstrStrFromOpNo.

[xiangzhangllvm]

llvm/lib/IR/InlineAsm.cpp

65

The StringRef has bug about do split for empty string. So I handle the empty case.

llvm/lib/Target/X86/X86ISelLowering.cpp

32301–32306

Enhance in getInstrStrFromOpNo.

32301–32306

The regex can't handle the "$1" from "$12", and not clear for readability, So I choose to enhance in getInstrStrFromOpNo (remove the label affect too).

[pengfei]

llvm/lib/IR/InlineAsm.cpp

72

When split failed, the size of AsmStrs is 1 rather than empty.

[xiangzhangllvm]

llvm/lib/IR/InlineAsm.cpp

72

That is really a defect for inline asm use various delimiters : (
Let me update here, thanks.

[xiangzhangllvm]

I think there is no big problem after so long time reviews.
Currently only X86 backend implement TLI.isInlineAsmTargetBranch(AsmStrs, OpNo).
It is safe for other targets to go the old way (however, it is not suggested to keep the bug) if they do not implement TLI.isInlineAsmTargetBranch.

[pengfei]

LGTM :)

[xiangzhangllvm]

In D133914#3854632, @pengfei wrote:

LGTM :)

Thank you so much!!
And also thanks for all the review !!

[uabelho]

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

317

Shouldn't the already existing X86 version of this method be marked with "override" now that it exist in the base class?

Same with the version you added in AArch64 in
https://reviews.llvm.org/rGd0269dd059b7a9f080f76e1c54285fe58c8c938e
?

Bots currently fail:
https://lab.llvm.org/buildbot/#/builders/57/builds/22874

[xiangzhangllvm]

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

317

Yes, thank you, sorry for not see this warning in time.

llvm/include/llvm/CodeGen/TargetLowering.h

public:
   virtual const MCExpr *
   getPICJumpTableRelocBaseExpr(const MachineFunction *MF,
                                unsigned JTI, MCContext &Ctx) const;
 
   /// Return true if folding a constant offset with the given GlobalAddress is
   /// legal.  It is frequently not legal in PIC relocation models.
   virtual bool isOffsetFoldingLegal(const GlobalAddressSDNode *GA) const;
 
+  /// Return true if the operand with index OpNo corresponding to a target
+  /// branch, for example, in following case
+  ///
+  /// call void asm "lea r8, $0\0A\09call qword ptr ${1:P}\0A\09ret",
+  ///               "*m,*m,~{r8},~{dirflag},~{fpsr},~{flags}"
+  ///                ([9 x i32]* @Arr), void (...)* @sincos_asm)
+  ///
+  /// the operand $1 (sincos_asm) is target branch in inline asm, but the
+  /// operand $0 (Arr) is not.
+  virtual bool
+  isInlineAsmTargetBranch(const SmallVectorImpl<StringRef> &AsmStrs,
+                          unsigned OpNo) const {
+    return false;
+  }
+
   bool isInTailCallPosition(SelectionDAG &DAG, SDNode *Node,
                             SDValue &Chain) const;
 
   void softenSetCCOperands(SelectionDAG &DAG, EVT VT, SDValue &NewLHS,
                            SDValue &NewRHS, ISD::CondCode &CCCode,
                            const SDLoc &DL, const SDValue OldLHS,
                            const SDValue OldRHS) const;
 

llvm/include/llvm/CodeGen/TargetSubtargetInfo.h

 #ifndef LLVM_CODEGEN_TARGETSUBTARGETINFO_H
 #define LLVM_CODEGEN_TARGETSUBTARGETINFO_H
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/CodeGen/PBQPRAConstraint.h"
 #include "llvm/CodeGen/SchedulerRegistry.h"
+#include "llvm/IR/GlobalValue.h"
 #include "llvm/MC/MCSubtargetInfo.h"
 #include "llvm/Support/CodeGen.h"
 #include <memory>
 #include <vector>
 
 namespace llvm {
 
 class APInt;
 class MachineFunction;
 class ScheduleDAGMutation;
 class CallLowering;
+class GlobalValue;
 class InlineAsmLowering;
 class InstrItineraryData;
 struct InstrStage;
 class InstructionSelector;
 class LegalizerInfo;
 class MachineInstr;
 struct MachineSchedPolicy;
 struct MCReadAdvanceEntry;
public:
 
   /// True if the register allocator should use the allocation orders exactly as
   /// written in the tablegen descriptions, false if it should allocate
   /// the specified physical register later if is it callee-saved.
   virtual bool ignoreCSRForAllocationOrder(const MachineFunction &MF,
                                            unsigned PhysReg) const {
     return false;
   }
+
+  /// Classify a global function reference. This mainly used to fetch target
+  /// special flags for lowering a function address. For example mark a function
+  /// call should be plt or pc-related addressing.
+  virtual unsigned char
+  classifyGlobalFunctionReference(const GlobalValue *GV) const {
+    return 0;
+  }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_CODEGEN_TARGETSUBTARGETINFO_H

llvm/include/llvm/IR/InlineAsm.h

 // used as the callee operand of call instructions.  InlineAsm's are uniqued
 // like constants, and created via InlineAsm::get(...).
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_IR_INLINEASM_H
 #define LLVM_IR_INLINEASM_H
 
+#include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/IR/Value.h"
 #include "llvm/Support/ErrorHandling.h"
 #include <cassert>
 #include <string>
 #include <vector>
 
 namespace llvm {
public:
   }
 
   /// getFunctionType - InlineAsm's are always pointers to functions.
   ///
   FunctionType *getFunctionType() const;
 
   const std::string &getAsmString() const { return AsmString; }
   const std::string &getConstraintString() const { return Constraints; }
+  void collectAsmStrs(SmallVectorImpl<StringRef> &AsmStrs) const;
 
   /// This static method can be used by the parser to check to see if the
   /// specified constraint string is legal for the type.
   static Error verify(FunctionType *Ty, StringRef Constraints);
 
   // Constraint String Parsing
   enum ConstraintPrefix {
     isInput,            // 'x'
enum : uint32_t {
     // The first operand is an immediate describing the asm operand, the low
     // bits is the kind:
     Kind_RegUse = 1,             // Input register, "r".
     Kind_RegDef = 2,             // Output register, "=r".
     Kind_RegDefEarlyClobber = 3, // Early-clobber output register, "=&r".
     Kind_Clobber = 4,            // Clobbered register, "~r".
     Kind_Imm = 5,                // Immediate.
     Kind_Mem = 6,                // Memory operand, "m", or an address, "p".
+    Kind_Func = 7,               // Address operand of function call
 
     // Memory constraint codes.
     // These could be tablegenerated but there's little need to do that since
     // there's plenty of space in the encoding to support the union of all
     // constraint codes for all targets.
     // Addresses are included here as they need to be treated the same by the
     // backend, the only difference is that they are not used to actaully
     // access memory by the instruction.
enum : uint32_t {
     Constraints_Max = Constraint_ZT,
     Constraints_ShiftAmount = 16,
 
     Flag_MatchingOperand = 0x80000000
   };
 
   static unsigned getFlagWord(unsigned Kind, unsigned NumOps) {
     assert(((NumOps << 3) & ~0xffff) == 0 && "Too many inline asm operands!");
-    assert(Kind >= Kind_RegUse && Kind <= Kind_Mem && "Invalid Kind");
+    assert(Kind >= Kind_RegUse && Kind <= Kind_Func && "Invalid Kind");
     return Kind | (NumOps << 3);
   }
 
   static bool isRegDefKind(unsigned Flag){ return getKind(Flag) == Kind_RegDef;}
   static bool isImmKind(unsigned Flag) { return getKind(Flag) == Kind_Imm; }
   static bool isMemKind(unsigned Flag) { return getKind(Flag) == Kind_Mem; }
+  static bool isFuncKind(unsigned Flag) { return getKind(Flag) == Kind_Func; }
   static bool isRegDefEarlyClobberKind(unsigned Flag) {
     return getKind(Flag) == Kind_RegDefEarlyClobber;
   }
   static bool isClobberKind(unsigned Flag) {
     return getKind(Flag) == Kind_Clobber;
   }
 
   /// getFlagWordForMatchingOp - Augment an existing flag word returned by
static unsigned getFlagWordForRegClass(unsigned InputFlag, unsigned RC) {
     assert(RC <= 0x7fff && "Too large register class ID");
     assert((InputFlag & ~0xffff) == 0 && "High bits already contain data");
     return InputFlag | (RC << 16);
   }
 
   /// Augment an existing flag word returned by getFlagWord with the constraint
   /// code for a memory constraint.
   static unsigned getFlagWordForMem(unsigned InputFlag, unsigned Constraint) {
-    assert(isMemKind(InputFlag) && "InputFlag is not a memory constraint!");
+    assert((isMemKind(InputFlag) || isFuncKind(InputFlag)) &&
+           "InputFlag is not a memory (include function) constraint!");
     assert(Constraint <= 0x7fff && "Too large a memory constraint ID");
     assert(Constraint <= Constraints_Max && "Unknown constraint ID");
     assert((InputFlag & ~0xffff) == 0 && "High bits already contain data");
     return InputFlag | (Constraint << Constraints_ShiftAmount);
   }
 
   static unsigned convertMemFlagWordToMatchingFlagWord(unsigned InputFlag) {
     assert(isMemKind(InputFlag));
     return InputFlag & ~(0x7fff << Constraints_ShiftAmount);
   }
 
   static unsigned getKind(unsigned Flags) {
     return Flags & 7;
   }
 
   static unsigned getMemoryConstraintID(unsigned Flag) {
-    assert(isMemKind(Flag));
+    assert((isMemKind(Flag) || isFuncKind(Flag)) &&
+           "Not expected mem or function flang!");
     return (Flag >> Constraints_ShiftAmount) & 0x7fff;
   }
 
   /// getNumOperandRegisters - Extract the number of registers field from the
   /// inline asm operand flag.
   static unsigned getNumOperandRegisters(unsigned Flag) {
     return (Flag & 0xffff) >> 3;
   }
case InlineAsm::Kind_RegDef:
       return "regdef";
     case InlineAsm::Kind_RegDefEarlyClobber:
       return "regdef-ec";
     case InlineAsm::Kind_Clobber:
       return "clobber";
     case InlineAsm::Kind_Imm:
       return "imm";
     case InlineAsm::Kind_Mem:
+    case InlineAsm::Kind_Func:
       return "mem";
     default:
       llvm_unreachable("Unknown operand kind");
     }
   }
 
   static StringRef getMemConstraintName(unsigned Constraint) {
     switch (Constraint) {

llvm/lib/CodeGen/SelectionDAG/InstrEmitter.cpp

if (Op.isMachineOpcode()) {
     }
     // Turn additional physreg operands into implicit uses on non-variadic
     // instructions. This is used by call and return instructions passing
     // arguments in registers.
     bool Imp = II && (IIOpNum >= II->getNumOperands() && !II->isVariadic());
     MIB.addReg(VReg, getImplRegState(Imp));
   } else if (RegisterMaskSDNode *RM = dyn_cast<RegisterMaskSDNode>(Op)) {
     MIB.addRegMask(RM->getRegMask());
   } else if (GlobalAddressSDNode *TGA = dyn_cast<GlobalAddressSDNode>(Op)) {
     MIB.addGlobalAddress(TGA->getGlobal(), TGA->getOffset(),
                          TGA->getTargetFlags());
   } else if (BasicBlockSDNode *BBNode = dyn_cast<BasicBlockSDNode>(Op)) {
     MIB.addMBB(BBNode->getBasicBlock());
   } else if (FrameIndexSDNode *FI = dyn_cast<FrameIndexSDNode>(Op)) {
     MIB.addFrameIndex(FI->getIndex());
   } else if (JumpTableSDNode *JT = dyn_cast<JumpTableSDNode>(Op)) {
     MIB.addJumpTableIndex(JT->getIndex(), JT->getTargetFlags());
for (unsigned i = InlineAsm::Op_FirstOperand; i != NumOps;) {
           MIB.addReg(Reg,
                      RegState::Define | RegState::EarlyClobber |
                          getImplRegState(Register::isPhysicalRegister(Reg)));
           ECRegs.push_back(Reg);
         }
         break;
       case InlineAsm::Kind_RegUse:  // Use of register.
       case InlineAsm::Kind_Imm:  // Immediate.
-      case InlineAsm::Kind_Mem:  // Addressing mode.
+      case InlineAsm::Kind_Mem:  // Non-function addressing mode.
         // The addressing mode has been selected, just add all of the
         // operands to the machine instruction.
         for (unsigned j = 0; j != NumVals; ++j, ++i)
           AddOperand(MIB, Node->getOperand(i), 0, nullptr, VRBaseMap,
                      /*IsDebug=*/false, IsClone, IsCloned);
 
         // Manually set isTied bits.
         if (InlineAsm::getKind(Flags) == InlineAsm::Kind_RegUse) {
           unsigned DefGroup = 0;
           if (InlineAsm::isUseOperandTiedToDef(Flags, DefGroup)) {
             unsigned DefIdx = GroupIdx[DefGroup] + 1;
             unsigned UseIdx = GroupIdx.back() + 1;
             for (unsigned j = 0; j != NumVals; ++j)
               MIB->tieOperands(DefIdx + j, UseIdx + j);
           }
         }
         break;
+      case InlineAsm::Kind_Func: // Function addressing mode.
+        for (unsigned j = 0; j != NumVals; ++j, ++i) {
+          SDValue Op = Node->getOperand(i);
+          AddOperand(MIB, Op, 0, nullptr, VRBaseMap,
+                     /*IsDebug=*/false, IsClone, IsCloned);
+
+          // Adjust Target Flags for function reference.
+          if (auto *TGA = dyn_cast<GlobalAddressSDNode>(Op)) {
+            unsigned NewFlags =
+                MF->getSubtarget().classifyGlobalFunctionReference(
+                    TGA->getGlobal());
+            unsigned LastIdx = MIB.getInstr()->getNumOperands() - 1;
+            MIB.getInstr()->getOperand(LastIdx).setTargetFlags(NewFlags);
+          }
+        }
       }
     }
 
     // GCC inline assembly allows input operands to also be early-clobber
     // output operands (so long as the operand is written only after it's
     // used), but this does not match the semantics of our early-clobber flag.
     // If an early-clobber operand register is also an input operand register,
     // then remove the early-clobber flag.

llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

void update(const TargetLowering::AsmOperandInfo &OpInfo) {
     }
   }
 
   unsigned get() const { return Flags; }
 };
 
 } // end anonymous namespace
 
+static bool isFunction(SDValue Op) {
+  if (Op && Op.getOpcode() == ISD::GlobalAddress) {
+    if (auto *GA = dyn_cast<GlobalAddressSDNode>(Op)) {
+      auto Fn = dyn_cast_or_null<Function>(GA->getGlobal());
+
+      // In normal "call dllimport func" instruction (non-inlineasm) it force
+      // indirect access by specifing call opcode. And usually specially print
+      // asm with indirect symbol (i.g: "*") according to opcode. Inline asm can
+      // not do in this way now. (In fact, this is similar with "Data Access"
+      // action). So here we ignore dllimport function.
+      if (Fn && !Fn->hasDLLImportStorageClass())
+        return true;
+    }
+  }
+  return false;
+}
+
 /// visitInlineAsm - Handle a call to an InlineAsm object.
 void SelectionDAGBuilder::visitInlineAsm(const CallBase &Call,
                                          const BasicBlock *EHPadBB) {
   const InlineAsm *IA = cast<InlineAsm>(Call.getCalledOperand());
 
   /// ConstraintOperands - Information about all of the constraints.
   SmallVector<SDISelAsmOperandInfo, 16> ConstraintOperands;
 
if (IsCallBr || EmitEHLabels) {
     Chain = getControlRoot();
   }
 
   MCSymbol *BeginLabel = nullptr;
   if (EmitEHLabels) {
     Chain = lowerStartEH(Chain, EHPadBB, BeginLabel);
   }
 
+  int OpNo = -1;
+  SmallVector<StringRef> AsmStrs;
+  IA->collectAsmStrs(AsmStrs);
+
   // Second pass over the constraints: compute which constraint option to use.
   for (SDISelAsmOperandInfo &OpInfo : ConstraintOperands) {
+    if (OpInfo.hasArg() || OpInfo.Type == InlineAsm::isOutput)
+      OpNo++;
+
     // If this is an output operand with a matching input operand, look up the
     // matching input. If their types mismatch, e.g. one is an integer, the
     // other is floating point, or their sizes are different, flag it as an
     // error.
     if (OpInfo.hasMatchingInput()) {
       SDISelAsmOperandInfo &Input = ConstraintOperands[OpInfo.MatchingInput];
       patchMatchingInput(OpInfo, Input, DAG);
     }
 
     // Compute the constraint code and ConstraintType to use.
     TLI.ComputeConstraintToUse(OpInfo, OpInfo.CallOperand, &DAG);
 
     if ((OpInfo.ConstraintType == TargetLowering::C_Memory &&
          OpInfo.Type == InlineAsm::isClobber) ||
         OpInfo.ConstraintType == TargetLowering::C_Address)
       continue;
 
+    // In Linux PIC model, there are 4 cases about value/label addressing:
+    //
+    // 1: Function call or Label jmp inside the module.
+    // 2: Data access (such as global variable, static variable) inside module.
+    // 3: Function call or Label jmp outside the module.
+    // 4: Data access (such as global variable) outside the module.
+    //
+    // Due to current llvm inline asm architecture designed to not "recognize"
+    // the asm code, there are quite troubles for us to treat mem addressing
+    // differently for same value/adress used in different instuctions.
+    // For example, in pic model, call a func may in plt way or direclty
+    // pc-related, but lea/mov a function adress may use got.
+    //
+    // Here we try to "recognize" function call for the case 1 and case 3 in
+    // inline asm. And try to adjust the constraint for them.
+    //
+    // TODO: Due to current inline asm didn't encourage to jmp to the outsider
+    // label, so here we don't handle jmp function label now, but we need to
+    // enhance it (especilly in PIC model) if we meet meaningful requirements.
+    if (OpInfo.isIndirect && isFunction(OpInfo.CallOperand) &&
+        TLI.isInlineAsmTargetBranch(AsmStrs, OpNo) &&
+        TM.getCodeModel() != CodeModel::Large) {
+      OpInfo.isIndirect = false;
+      OpInfo.ConstraintType = TargetLowering::C_Address;
+    }
+
     // If this is a memory input, and if the operand is not indirect, do what we
     // need to provide an address for the memory input.
     if (OpInfo.ConstraintType == TargetLowering::C_Memory &&
         !OpInfo.isIndirect) {
       assert((OpInfo.isMultipleAlternative ||
               (OpInfo.Type == InlineAsm::isInput)) &&
              "Can only indirectify direct input operands!");
 
       // Memory operands really want the address of the value.
       Chain = getAddressForMemoryInput(Chain, getCurSDLoc(), OpInfo, DAG);
 
       // There is no longer a Value* corresponding to this operand.
case InlineAsm::isLabel: {
         unsigned ResOpType =
           InlineAsm::getFlagWord(InlineAsm::Kind_Imm, Ops.size());
         AsmNodeOperands.push_back(DAG.getTargetConstant(
             ResOpType, getCurSDLoc(), TLI.getPointerTy(DAG.getDataLayout())));
         llvm::append_range(AsmNodeOperands, Ops);
         break;
       }
 
-      if (OpInfo.ConstraintType == TargetLowering::C_Memory ||
-          OpInfo.ConstraintType == TargetLowering::C_Address) {
+      if (OpInfo.ConstraintType == TargetLowering::C_Memory) {
         assert((OpInfo.isIndirect ||
                 OpInfo.ConstraintType != TargetLowering::C_Memory) &&
                "Operand must be indirect to be a mem!");
         assert(InOperandVal.getValueType() ==
                    TLI.getPointerTy(DAG.getDataLayout()) &&
                "Memory operands expect pointer values");
 
         unsigned ConstraintID =
             TLI.getInlineAsmMemConstraint(OpInfo.ConstraintCode);
         assert(ConstraintID != InlineAsm::Constraint_Unknown &&
                "Failed to convert memory constraint code to constraint id.");
 
         // Add information to the INLINEASM node to know about this input.
         unsigned ResOpType = InlineAsm::getFlagWord(InlineAsm::Kind_Mem, 1);
         ResOpType = InlineAsm::getFlagWordForMem(ResOpType, ConstraintID);
         AsmNodeOperands.push_back(DAG.getTargetConstant(ResOpType,
                                                         getCurSDLoc(),
                                                         MVT::i32));
         AsmNodeOperands.push_back(InOperandVal);
         break;
       }
 
+      if (OpInfo.ConstraintType == TargetLowering::C_Address) {
+        assert(InOperandVal.getValueType() ==
+                   TLI.getPointerTy(DAG.getDataLayout()) &&
+               "Address operands expect pointer values");
+
+        unsigned ConstraintID =
+            TLI.getInlineAsmMemConstraint(OpInfo.ConstraintCode);
+        assert(ConstraintID != InlineAsm::Constraint_Unknown &&
+               "Failed to convert memory constraint code to constraint id.");
+
+        unsigned ResOpType = InlineAsm::getFlagWord(InlineAsm::Kind_Mem, 1);
+
+        SDValue AsmOp = InOperandVal;
+        if (isFunction(InOperandVal)) {
+          auto *GA = dyn_cast<GlobalAddressSDNode>(InOperandVal);
+          ResOpType = InlineAsm::getFlagWord(InlineAsm::Kind_Func, 1);
+          AsmOp = DAG.getTargetGlobalAddress(GA->getGlobal(), getCurSDLoc(),
+                                             InOperandVal.getValueType(),
+                                             GA->getOffset());
+        }
+
+        // Add information to the INLINEASM node to know about this input.
+        ResOpType = InlineAsm::getFlagWordForMem(ResOpType, ConstraintID);
+
+        AsmNodeOperands.push_back(
+            DAG.getTargetConstant(ResOpType, getCurSDLoc(), MVT::i32));
+
+        AsmNodeOperands.push_back(AsmOp);
+        break;
+      }
+
       assert((OpInfo.ConstraintType == TargetLowering::C_RegisterClass ||
               OpInfo.ConstraintType == TargetLowering::C_Register) &&
              "Unknown constraint type!");
 
       // TODO: Support this.
       if (OpInfo.isIndirect) {
         emitInlineAsmError(
             Call, "Don't know how to handle indirect register inputs yet "

llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp

void SelectionDAGISel::SelectInlineAsmMemoryOperands(std::vector<SDValue> &Ops,
   Ops.push_back(InOps[InlineAsm::Op_ExtraInfo]);  // 3 (SideEffect, AlignStack)
 
   unsigned i = InlineAsm::Op_FirstOperand, e = InOps.size();
   if (InOps[e-1].getValueType() == MVT::Glue)
     --e;  // Don't process a glue operand if it is here.
 
   while (i != e) {
     unsigned Flags = cast<ConstantSDNode>(InOps[i])->getZExtValue();
-    if (!InlineAsm::isMemKind(Flags)) {
+    if (!InlineAsm::isMemKind(Flags) && !InlineAsm::isFuncKind(Flags)) {
       // Just skip over this operand, copying the operands verbatim.
       Ops.insert(Ops.end(), InOps.begin()+i,
                  InOps.begin()+i+InlineAsm::getNumOperandRegisters(Flags) + 1);
       i += InlineAsm::getNumOperandRegisters(Flags) + 1;
     } else {
       assert(InlineAsm::getNumOperandRegisters(Flags) == 1 &&
              "Memory operand with multiple values?");
 
if (!InlineAsm::isMemKind(Flags) && !InlineAsm::isFuncKind(Flags)) {
       std::vector<SDValue> SelOps;
       unsigned ConstraintID = InlineAsm::getMemoryConstraintID(Flags);
       if (SelectInlineAsmMemoryOperand(InOps[i+1], ConstraintID, SelOps))
         report_fatal_error("Could not match memory address.  Inline asm"
                            " failure!");
 
       // Add this to the output node.
       unsigned NewFlags =
-        InlineAsm::getFlagWord(InlineAsm::Kind_Mem, SelOps.size());
+          InlineAsm::isMemKind(Flags)
+              ? InlineAsm::getFlagWord(InlineAsm::Kind_Mem, SelOps.size())
+              : InlineAsm::getFlagWord(InlineAsm::Kind_Func, SelOps.size());
       NewFlags = InlineAsm::getFlagWordForMem(NewFlags, ConstraintID);
       Ops.push_back(CurDAG->getTargetConstant(NewFlags, DL, MVT::i32));
       llvm::append_range(Ops, SelOps);
       i += 2;
     }
   }
 
   // Add the glue input back if present.

llvm/lib/IR/InlineAsm.cpp

void InlineAsm::destroyConstant() {
   getType()->getContext().pImpl->InlineAsms.remove(this);
   delete this;
 }
 
 FunctionType *InlineAsm::getFunctionType() const {
   return FTy;
 }
 
+void InlineAsm::collectAsmStrs(SmallVectorImpl<StringRef> &AsmStrs) const {
+  StringRef AsmStr(AsmString);
+  AsmStrs.clear();
+  if (AsmStr.empty())
+    return;
+
+  AsmStr.split(AsmStrs, "\n\t", -1, false);
+
+  // Case which use "\0A" as delimiter.
+  // TODO: refine me, unify the delimiter or handle all cases.
+  if (AsmStrs.empty())
+    AsmStr.split(AsmStrs, "\0A", -1, false);
+}
+
 /// Parse - Analyze the specified string (e.g. "==&{eax}") and fill in the
 /// fields in this structure.  If the constraint string is not understood,
 /// return true, otherwise return false.
 bool InlineAsm::ConstraintInfo::Parse(StringRef Str,
                      InlineAsm::ConstraintInfoVector &ConstraintsSoFar) {
   StringRef::iterator I = Str.begin(), E = Str.end();
   unsigned multipleAlternativeCount = Str.count('|') + 1;
   unsigned multipleAlternativeIndex = 0;

llvm/lib/Target/X86/X86ISelLowering.h

public:
     StringRef getStackProbeSymbolName(const MachineFunction &MF) const override;
 
     unsigned getStackProbeSize(const MachineFunction &MF) const;
 
     bool hasVectorBlend() const override { return true; }
 
     unsigned getMaxSupportedInterleaveFactor() const override { return 4; }
 
+    bool isInlineAsmTargetBranch(const SmallVectorImpl<StringRef> &AsmStrs,
+                                 unsigned OpNo) const override;
+
     /// Lower interleaved load(s) into target specific
     /// instructions/intrinsics.
     bool lowerInterleavedLoad(LoadInst *LI,
                               ArrayRef<ShuffleVectorInst *> Shuffles,
                               ArrayRef<unsigned> Indices,
                               unsigned Factor) const override;
 
     /// Lower interleaved store(s) into target specific

llvm/lib/Target/X86/X86ISelLowering.cpp

static SDValue LowerCVTPS2PH(SDValue Op, SelectionDAG &DAG) {
   EVT LoVT, HiVT;
   std::tie(LoVT, HiVT) = DAG.GetSplitDestVTs(VT);
   SDValue RC = Op.getOperand(1);
   Lo = DAG.getNode(X86ISD::CVTPS2PH, dl, LoVT, Lo, RC);
   Hi = DAG.getNode(X86ISD::CVTPS2PH, dl, HiVT, Hi, RC);
   return DAG.getNode(ISD::CONCAT_VECTORS, dl, VT, Lo, Hi);
 }
 
+static StringRef getInstrStrFromOpNo(const SmallVectorImpl<StringRef> &AsmStrs,
+                                     unsigned OpNo) {
+  const APInt Operand(32, OpNo);
+  std::string OpNoStr = llvm::toString(Operand, 10, false);
+  std::string Str(" $");
+
+  std::string OpNoStr1(Str + OpNoStr);             // e.g. " $1" (OpNo=1)
+  std::string OpNoStr2(Str + "{" + OpNoStr + ":"); // With modifier, e.g. ${1:P}
+
+  auto I = StringRef::npos;
+  for (auto &AsmStr : AsmStrs) {
+    // Match the OpNo string. We should match exactly to exclude match
+    // sub-string, e.g. "$12" contain "$1"
+    if (AsmStr.endswith(OpNoStr1))
+      I = AsmStr.size() - OpNoStr1.size();
+
+    // Get the index of operand in AsmStr.
+    if (I == StringRef::npos)
+      I = AsmStr.find(OpNoStr1 + ",");
+    if (I == StringRef::npos)
+      I = AsmStr.find(OpNoStr2);
+
+    if (I == StringRef::npos)
+      continue;
+
+    assert(I > 0 && "Unexpected inline asm string!");
+    // Remove the operand string and label (if exsit).
+    // For example:
+    // ".L__MSASMLABEL_.${:uid}__l:call dword ptr ${0:P}"
+    // ==>
+    // ".L__MSASMLABEL_.${:uid}__l:call dword ptr "
+    // ==>
+    // "call dword ptr "
+    auto TmpStr = AsmStr.substr(0, I);
+    I = TmpStr.rfind(':');
+    if (I == StringRef::npos)
+      return TmpStr;
+
+    assert(I < TmpStr.size() && "Unexpected inline asm string!");
+    auto Asm = TmpStr.drop_front(I + 1);
+    return Asm;
+  }
+
+  return StringRef();
+}
+
+bool X86TargetLowering::isInlineAsmTargetBranch(
+    const SmallVectorImpl<StringRef> &AsmStrs, unsigned OpNo) const {
+  StringRef InstrStr = getInstrStrFromOpNo(AsmStrs, OpNo);
+
+  if (InstrStr.contains("call"))
+    return true;
+
+  return false;
+}
+
 /// Provide custom lowering hooks for some operations.
 SDValue X86TargetLowering::LowerOperation(SDValue Op, SelectionDAG &DAG) const {
   switch (Op.getOpcode()) {
   default: llvm_unreachable("Should not custom lower this!");
   case ISD::ATOMIC_FENCE:       return LowerATOMIC_FENCE(Op, Subtarget, DAG);
   case ISD::ATOMIC_CMP_SWAP_WITH_SUCCESS:
     return LowerCMP_SWAP(Op, Subtarget, DAG);
   case ISD::CTPOP:              return LowerCTPOP(Op, Subtarget, DAG);

llvm/test/CodeGen/X86/inline-asm-function-call-pic.ll

+; RUN: llc -O2 --relocation-model=pic -mtriple=i386-unknown-linux-gnu < %s 2>&1 | FileCheck %s
+
+; List the source code:
+; // clang  -m32 -fasm-blocks -S t.c -O2  -fpic -emit-llvm
+; int GV = 17;
+;
+; extern unsigned int extern_func();
+; static unsigned int static_func()  __attribute__((noinline));
+; static unsigned int static_func() {
+;   return GV++;
+; }
+;
+; void func() {
+;   static_func();
+;   __asm {
+;           call static_func
+;           call extern_func
+;           shr eax, 0
+;           shr ebx, 0
+;           shr ecx, 0
+;           shr edx, 0
+;           shr edi, 0
+;           shr esi, 0
+;           shr ebp, 0
+;           shr esp, 0
+;         }
+; }
+
+@GV = local_unnamed_addr global i32 17, align 4
+
+define void @func() local_unnamed_addr #0 {
+; CHECK-LABEL: func:
+; CHECK:         calll .L0$pb
+; CHECK-NEXT:  .L0$pb:
+; CHECK-NEXT:    popl %ebx
+; CHECK-NEXT:  .Ltmp0:
+; CHECK-NEXT:    addl $_GLOBAL_OFFSET_TABLE_+(.Ltmp0-.L0$pb), %ebx
+; CHECK-NEXT:    calll static_func
+; CHECK-NEXT:    #APP
+; CHECK-EMPTY:
+; CHECK-NEXT:    calll static_func
+; CHECK-NEXT:    calll extern_func@PLT
+; CHECK-NEXT:    shrl $0, %eax
+; CHECK-NEXT:    shrl $0, %ebx
+; CHECK-NEXT:    shrl $0, %ecx
+; CHECK-NEXT:    shrl $0, %edx
+; CHECK-NEXT:    shrl $0, %edi
+; CHECK-NEXT:    shrl $0, %esi
+; CHECK-NEXT:    shrl $0, %ebp
+; CHECK-NEXT:    shrl $0, %esp
+; CHECK-EMPTY:
+; CHECK-NEXT:    #NO_APP
+entry:
+  %call = tail call i32 @static_func()
+  tail call void asm sideeffect inteldialect "call dword ptr ${0:P}\0A\09call dword ptr ${1:P}\0A\09shr eax, $$0\0A\09shr ebx, $$0\0A\09shr ecx, $$0\0A\09shr edx, $$0\0A\09shr edi, $$0\0A\09shr esi, $$0\0A\09shr ebp, $$0\0A\09shr esp, $$0", "*m,*m,~{eax},~{ebp},~{ebx},~{ecx},~{edi},~{edx},~{flags},~{esi},~{esp},~{dirflag},~{fpsr},~{flags}"(ptr nonnull elementtype(i32 (...)) @static_func, ptr nonnull elementtype(i32 (...)) @extern_func) #0
+  ret void
+}
+
+declare i32 @extern_func(...) #0
+
+define internal i32 @static_func() #0 {
+entry:
+  %0 = load i32, ptr @GV, align 4
+  %inc = add nsw i32 %0, 1
+  store i32 %inc, ptr @GV, align 4
+  ret i32 %0
+}
+
+attributes #0 = { nounwind }

llvm/test/CodeGen/X86/inline-asm-p-constraint.ll

 ; RUN: llc -mtriple=x86_64-unknown-unknown -no-integrated-as < %s 2>&1 | FileCheck %s
 
-define ptr @foo(ptr %ptr) {
+define ptr @foo(ptr %Ptr) {
 ; CHECK-LABEL: foo:
-  %1 = tail call ptr asm "lea $1, $0", "=r,p,~{dirflag},~{fpsr},~{flags}"(ptr %ptr)
-; CHECK:      #APP
-; CHECK-NEXT: lea (%rdi), %rax
+; asm {mov rax, Pointer; lea rax, Pointer}
+; LEA: Computes the effective address of the second operand and stores it in the first operand
+  %Ptr.addr = alloca ptr, align 8
+  store ptr %Ptr, ptr %Ptr.addr, align 8
+; CHECK: movq    %rdi, -8(%rsp)
+  %1 = tail call ptr asm "mov $1, $0\0A\09lea $2, $0", "=r,p,*m,~{dirflag},~{fpsr},~{flags}"(ptr %Ptr, ptr elementtype(ptr) %Ptr.addr)
+; CHECK-NEXT: #APP
+; CHECK-NEXT: mov (%rdi), %rax
+; CHECK-NEXT: lea -8(%rsp), %rax
 ; CHECK-NEXT: #NO_APP
   ret ptr %1
 ; CHECK-NEXT: retq
 }