Enabling fstack_clash_protection for arm32 bit, thumb and thumb2 mode

[varunkumare99]

Summary

adds stack probing instruction sequence for dynamic stack allocations, VLA's and constant arrays to protect against stack clash attacks.

Depending on the size of the stack allocation, various probing sequences are generated:

• straight line sequence of subtracts and stores
• A loop allocating and probing one page size per iteration, plus a single probe to deal with the remainder.
• A loop which moves the SP down to the target value held in a register, used when the allocation size is not known at compile-time

reference: https://reviews.llvm.org/D96004

[efriedma]

clang/lib/Driver/ToolChains/Clang.cpp

3460

Why 1024?

llvm/lib/Target/ARM/ARMFrameLowering.cpp

780

Is this relevant? Are the other unmodified uses of emitSPUpdate() relevant?

979

Can we try to unify the Windows/non-Windows codepaths to some extent? Having two independent codepaths each trying to decide when probing is necessary seems likely to lead to bugs.

llvm/test/CodeGen/ARM/stackProbing_arm.ll

19

Going straight from the function entry to here, you've decremented the stack by a total of 6276 bytes; this can jump over a 4kb guard page.

21

From a security perspective, scattering pointers to the stack onto the stack is maybe not the best idea.

95

Again, this is too many bytes. (At least, ignoring the stores before the loop, which don't appear to be intentionally inserted checks.)

llvm/test/CodeGen/ARM/stackProbing_thumb.ll

12

This is a very fancy way of setting a register to zero.

Have you done any testing that the generated code actually works?

[tnfchris]

clang/lib/Driver/ToolChains/Clang.cpp

3460

1024 was experimentally determined by Arm and is part of the ABI for stack clash (which has not yet been published). It was determined by examining a large number of programs and looking at the function stack usages. 1024 covers 80-90% of programs such that we can minimize the number of probes required in the average cases.

[efriedma]

clang/lib/Driver/ToolChains/Clang.cpp

3460

There are actually multiple numbers involved here, no? One is the spacing of probes, i.e. if allocating a large amount of stack, how many times you need to probe; this is basically the page size of the target. the other is how much unprobed space a function is allowed to allocate before calling another function. Referring to the the AArch64 patch, -mstack-probe-size is the former, the hardcoded "1024" is the latter.

[tnfchris]

clang/lib/Driver/ToolChains/Clang.cpp

3460

I hadn't looked at the patch in detail yet, I thought this was the probing offset. But you're right, what I thought of was StackClashCallerGuard, if stack-probe-size indeed the guard size itself, then yeah this would be wrong. It seems incorrect to allow it smaller than the page size.

clang/lib/CodeGen/CodeGenModule.cpp

 
 void CodeGenModule::SetLLVMFunctionAttributesForDefinition(const Decl *D,
                                                            llvm::Function *F) {
   llvm::AttrBuilder B(F->getContext());
 
   if ((!D || !D->hasAttr<NoUwtableAttr>()) && CodeGenOpts.UnwindTables)
     B.addUWTableAttr(llvm::UWTableKind(CodeGenOpts.UnwindTables));
 
-  if (CodeGenOpts.StackClashProtector)
+  if (CodeGenOpts.StackClashProtector) {
     B.addAttribute("probe-stack", "inline-asm");
+    if (CodeGenOpts.StackProbeSize != 4096)
+      B.addAttribute("stack-probe-size",
+                     llvm::utostr(CodeGenOpts.StackProbeSize));
+  }
 
   if (!hasUnwindExceptions(LangOpts))
     B.addAttribute(llvm::Attribute::NoUnwind);
 
   if (D && D->hasAttr<NoStackProtectorAttr>())
     ; // Do nothing.
   else if (D && D->hasAttr<StrictGuardStackCheckAttr>() &&
            LangOpts.getStackProtector() == LangOptions::SSPOn)

clang/lib/Driver/ToolChains/Clang.cpp

 static void RenderSCPOptions(const ToolChain &TC, const ArgList &Args,
                              ArgStringList &CmdArgs) {
   const llvm::Triple &EffectiveTriple = TC.getEffectiveTriple();
 
   if (!EffectiveTriple.isOSFreeBSD() && !EffectiveTriple.isOSLinux())
     return;
 
   if (!EffectiveTriple.isX86() && !EffectiveTriple.isSystemZ() &&
-      !EffectiveTriple.isPPC64())
+      !EffectiveTriple.isPPC64() && !EffectiveTriple.isARM() &&
+      !EffectiveTriple.isThumb())
     return;
 
   Args.addOptInFlag(CmdArgs, options::OPT_fstack_clash_protection,
                     options::OPT_fno_stack_clash_protection);
+  if (Args.hasArg(options::OPT_mstack_probe_size)) {
+    StringRef Size = Args.getLastArgValue(options::OPT_mstack_probe_size);
+    CmdArgs.push_back(Args.MakeArgString("-mstack-probe-size=" + Size));
+  } else if (EffectiveTriple.isArm() || EffectiveTriple.isThumb()) {
+    CmdArgs.push_back("-mstack-probe-size=1024");
+  }
 }
 
 static void RenderTrivialAutoVarInitOptions(const Driver &D,
                                             const ToolChain &TC,
                                             const ArgList &Args,
                                             ArgStringList &CmdArgs) {
   auto DefaultTrivialAutoVarInit = TC.GetDefaultTrivialAutoVarInit();
   StringRef TrivialAutoVarInit = "";

llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp

MachineInstrBuilder PopMIB =
         BuildMI(MBB, MBBI, DL, TII.get(ARM::t2LDMIA_UPD), ARM::SP)
             .addReg(ARM::SP)
             .add(predOps(ARMCC::AL));
     for (int Reg = ARM::R4; Reg < ARM::R12; ++Reg)
       PopMIB.addReg(Reg, RegState::Define);
   }
 }
 
+static void EmitDynamicProbedAlloc(MachineInstr &MI, MachineBasicBlock *MBB) {
+  Register TargetReg = MI.getOperand(0).getReg();
+  MachineFunction *MF = MBB->getParent();
+  const ARMFrameLowering *TFI =
+      MF->getSubtarget<ARMSubtarget>().getFrameLowering();
+  TFI->insertStackProbingLoop(MI, TargetReg);
+  MI.eraseFromParent();
+}
+
 bool ARMExpandPseudo::ExpandMI(MachineBasicBlock &MBB,
                                MachineBasicBlock::iterator MBBI,
                                MachineBasicBlock::iterator &NextMBBI) {
   MachineInstr &MI = *MBBI;
   unsigned Opcode = MI.getOpcode();
   switch (Opcode) {
     default:
       return false;
-
+    case ARM::PROBED_STACKALLOC_DYN: {
+      EmitDynamicProbedAlloc(MI, &MBB);
+      NextMBBI = MBB.end();
+      return true;
+    }
     case ARM::VBSPd:
     case ARM::VBSPq: {
       Register DstReg = MI.getOperand(0).getReg();
       if (DstReg == MI.getOperand(3).getReg()) {
         // Expand to VBIT
         unsigned NewOpc = Opcode == ARM::VBSPd ? ARM::VBITd : ARM::VBITq;
         BuildMI(MBB, MBBI, MI.getDebugLoc(), TII->get(NewOpc))
             .add(MI.getOperand(0))

llvm/lib/Target/ARM/ARMFrameLowering.h

public:
   bool
   assignCalleeSavedSpillSlots(MachineFunction &MF,
                               const TargetRegisterInfo *TRI,
                               std::vector<CalleeSavedInfo> &CSI) const override;
 
   const SpillSlot *
   getCalleeSavedSpillSlots(unsigned &NumEntries) const override;
 
+  virtual MachineBasicBlock::iterator
+  insertStackProbingLoop(MachineBasicBlock::iterator MBBI,
+                         Register TargetReg) const ;
+
 private:
   void emitPushInst(MachineBasicBlock &MBB, MachineBasicBlock::iterator MI,
                     ArrayRef<CalleeSavedInfo> CSI, unsigned StmOpc,
                     unsigned StrOpc, bool NoGap, bool (*Func)(unsigned, bool),
                     unsigned NumAlignedDPRCS2Regs, unsigned MIFlags = 0) const;
   void emitPopInst(MachineBasicBlock &MBB, MachineBasicBlock::iterator MI,
                    MutableArrayRef<CalleeSavedInfo> CSI, unsigned LdmOpc,
                    unsigned LdrOpc, bool isVarArg, bool NoGap,
                    bool (*Func)(unsigned, bool),
                    unsigned NumAlignedDPRCS2Regs) const;
 
   MachineBasicBlock::iterator
   eliminateCallFramePseudoInstr(MachineFunction &MF,
                                 MachineBasicBlock &MBB,
                                 MachineBasicBlock::iterator MI) const override;
+  /// Replace a StackProbe stub (if any) with the actual probe code inline
+  void inlineStackProbe(MachineFunction &MF,
+                        MachineBasicBlock &PrologueMBB) const override;
+  MachineBasicBlock::iterator
+  inlineStackProbeFixed(MachineFunction &MF,
+                        MachineBasicBlock::iterator MBBI) const;
+  MachineBasicBlock::iterator
+  inlineStackProbeVar(MachineFunction &MF,
+                      MachineBasicBlock::iterator MBBI) const;
 };
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARMFRAMELOWERING_H

llvm/lib/Target/ARM/ARMFrameLowering.cpp

 #include "ARMSubtarget.h"
 #include "MCTargetDesc/ARMAddressingModes.h"
 #include "MCTargetDesc/ARMBaseInfo.h"
 #include "Utils/ARMBaseInfo.h"
 #include "llvm/ADT/BitVector.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/ADT/SmallVector.h"
+#include "llvm/CodeGen/LivePhysRegs.h"
 #include "llvm/CodeGen/MachineBasicBlock.h"
 #include "llvm/CodeGen/MachineConstantPool.h"
 #include "llvm/CodeGen/MachineFrameInfo.h"
 #include "llvm/CodeGen/MachineFunction.h"
 #include "llvm/CodeGen/MachineInstr.h"
 #include "llvm/CodeGen/MachineInstrBuilder.h"
 #include "llvm/CodeGen/MachineJumpTableInfo.h"
 #include "llvm/CodeGen/MachineModuleInfo.h"

 static cl::opt<bool>
 SpillAlignedNEONRegs("align-neon-spills", cl::Hidden, cl::init(true),
                      cl::desc("Align ARM NEON spills in prolog and epilog"));
 
 static MachineBasicBlock::iterator
 skipAlignedDPRCS2Spills(MachineBasicBlock::iterator MI,
                         unsigned NumAlignedDPRCS2Regs);
 
+static unsigned findScratchNonCalleeSaveRegister(MachineBasicBlock *MBB);
+
 ARMFrameLowering::ARMFrameLowering(const ARMSubtarget &sti)
     : TargetFrameLowering(StackGrowsDown, sti.getStackAlignment(), 0, Align(4)),
       STI(sti) {}
 
 bool ARMFrameLowering::keepFramePointer(const MachineFunction &MF) const {
   // iOS always has a FP for backtracking, force other targets to keep their FP
   // when doing FastISel. The emitted code is currently superior, and in cases
   // like test-suite's lencod FastISel isn't quite correct when FP is eliminated.
void ARMFrameLowering::emitPrologue(MachineFunction &MF,
   MachineFrameInfo  &MFI = MF.getFrameInfo();
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
   MachineModuleInfo &MMI = MF.getMMI();
   MCContext &Context = MMI.getContext();
   const TargetMachine &TM = MF.getTarget();
   const MCRegisterInfo *MRI = Context.getRegisterInfo();
   const ARMBaseRegisterInfo *RegInfo = STI.getRegisterInfo();
   const ARMBaseInstrInfo &TII = *STI.getInstrInfo();
+  const ARMTargetLowering &TLI = *STI.getTargetLowering();
   assert(!AFI->isThumb1OnlyFunction() &&
          "This emitPrologue does not support Thumb1!");
   bool isARM = !AFI->isThumbFunction();
   Align Alignment = STI.getFrameLowering()->getStackAlign();
   unsigned ArgRegsSaveSize = AFI->getArgRegsSaveSize();
-  unsigned NumBytes = MFI.getStackSize();
+  int NumBytes = MFI.getStackSize();
   const std::vector<CalleeSavedInfo> &CSI = MFI.getCalleeSavedInfo();
   int FPCXTSaveSize = 0;
   bool NeedsWinCFI = needsWinCFI(MF);
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc dl;
 
void ARMFrameLowering::emitPrologue(MachineFunction &MF,
 
   StackAdjustingInsts DefCFAOffsetCandidates;
   bool HasFP = hasFP(MF);
 
   if (!AFI->hasStackFrame() &&
       (!STI.isTargetWindows() || !WindowsRequiresStackProbe(MF, NumBytes))) {
     if (NumBytes != 0) {
       emitSPUpdate(isARM, MBB, MBBI, dl, TII, -NumBytes,
                    MachineInstr::FrameSetup);
       DefCFAOffsetCandidates.addInst(std::prev(MBBI), NumBytes, true);
     }
     if (!NeedsWinCFI)
       DefCFAOffsetCandidates.emitDefCFAOffsets(MBB, dl, TII, HasFP);
     if (NeedsWinCFI && MBBI != MBB.begin()) {
       insertSEHRange(MBB, {}, MBBI, TII, MachineInstr::FrameSetup);
       BuildMI(MBB, MBBI, dl, TII.get(ARM::SEH_PrologEnd))
           .setMIFlag(MachineInstr::FrameSetup);
if (GPRCS2Size > 0 && STI.splitFramePointerPush(MF)) {
     GPRCS2Push = LastPush = MBBI++;
     DefCFAOffsetCandidates.addInst(LastPush, GPRCS2Size);
   }
 
   bool NeedsWinCFIStackAlloc = NeedsWinCFI;
   if (STI.splitFramePointerPush(MF) && HasFP)
     NeedsWinCFIStackAlloc = false;
 
   if (STI.isTargetWindows() && WindowsRequiresStackProbe(MF, NumBytes)) {
     uint32_t NumWords = NumBytes >> 2;
 
     if (NumWords < 65536) {
       BuildMI(MBB, MBBI, dl, TII.get(ARM::t2MOVi16), ARM::R4)
           .addImm(NumWords)
           .setMIFlags(MachineInstr::FrameSetup)
           .add(predOps(ARMCC::AL));
     } else {
if (NeedsWinCFIStackAlloc) {
                 .addImm(/*Wide=*/1)
                 .setMIFlags(MachineInstr::FrameSetup);
       MBB.insertAfter(Instr, SEH);
     }
     NumBytes = 0;
   }
 
   if (NumBytes) {
+    bool NeedsStackProbe = TLI.hasInlineStackProbe(MF) &&
+                           (NumBytes >= TLI.getStackProbeMaxUnprobedStack(MF) ||
+                            MFI.hasVarSizedObjects());
+    bool NeedsRealignment = RegInfo->hasStackRealignment(MF);
     // Adjust SP after all the callee-save spills.
     if (AFI->getNumAlignedDPRCS2Regs() == 0 &&
         tryFoldSPUpdateIntoPushPop(STI, MF, &*LastPush, NumBytes))
       DefCFAOffsetCandidates.addExtraBytes(LastPush, NumBytes);
-    else {
+    else if (NeedsStackProbe && !NeedsRealignment) {
+      Register ScratchReg = findScratchNonCalleeSaveRegister(&MBB);
+      assert(ScratchReg != ARM::NoRegister);
+      BuildMI(MBB, MBBI, dl, TII.get(ARM::PROBED_STACKALLOC))
+          .addDef(ScratchReg)
+          .addImm(-NumBytes);
+    } else {
       emitSPUpdate(isARM, MBB, MBBI, dl, TII, -NumBytes,
                    MachineInstr::FrameSetup);
       DefCFAOffsetCandidates.addInst(std::prev(MBBI), NumBytes);
     }
 
     if (HasFP && isARM)
       // Restore from fp only in ARM mode: e.g. sub sp, r7, #24
       // Note it's not safe to do this in Thumb2 mode because it would have
void ARMFrameLowering::emitPrologue(MachineFunction &MF,
   // If we need dynamic stack realignment, do it here. Be paranoid and make
   // sure if we also have VLAs, we have a base pointer for frame access.
   // If aligned NEON registers were spilled, the stack has already been
   // realigned.
   if (!AFI->getNumAlignedDPRCS2Regs() && RegInfo->hasStackRealignment(MF)) {
     Align MaxAlign = MFI.getMaxAlign();
     assert(!AFI->isThumb1OnlyFunction());
     if (!AFI->isThumbFunction()) {
+      bool NeedsStackProbe = TLI.hasInlineStackProbe(MF) &&
+                             (NumBytes + MFI.getMaxAlign().value()) >=
+                                 TLI.getStackProbeMaxUnprobedStack(MF);
+      if (NeedsStackProbe) {
+        Register ScratchReg = findScratchNonCalleeSaveRegister(&MBB);
+        emitAligningInstructions(MF, AFI, TII, MBB, MBBI, dl, ScratchReg,
+                                 MaxAlign, false);
+        BuildMI(MBB, MBBI, dl, TII.get(ARM::PROBED_STACKALLOC_VAR))
+            .addUse(ScratchReg);
+      } else {
         emitAligningInstructions(MF, AFI, TII, MBB, MBBI, dl, ARM::SP, MaxAlign,
                                  false);
+      }
     } else {
       // We cannot use sp as source/dest register here, thus we're using r4 to
       // perform the calculations. We're emitting the following sequence:
       // mov r4, sp
       // -- use emitAligningInstructions to produce best sequence to zero
       // -- out lower bits in r4
       // mov sp, r4
       // FIXME: It will be better just to find spare register here.
+      bool NeedsStackProbe = TLI.hasInlineStackProbe(MF) &&
+                             (NumBytes + MFI.getMaxAlign().value()) >=
+                                 TLI.getStackProbeMaxUnprobedStack(MF);
+      if (NeedsStackProbe) {
+        BuildMI(MBB, MBBI, dl, TII.get(ARM::t2MOVr), ARM::R4)
+            .addReg(ARM::SP, RegState::Kill)
+            .add(predOps(ARMCC::AL))
+            .add(condCodeOp());
+
+        emitAligningInstructions(MF, AFI, TII, MBB, MBBI, dl, ARM::R4, MaxAlign,
+                                 false);
+        BuildMI(MBB, MBBI, dl, TII.get(ARM::PROBED_STACKALLOC_VAR))
+            .addUse(ARM::R4);
+      } else {
         BuildMI(MBB, MBBI, dl, TII.get(ARM::tMOVr), ARM::R4)
             .addReg(ARM::SP, RegState::Kill)
             .add(predOps(ARMCC::AL));
         emitAligningInstructions(MF, AFI, TII, MBB, MBBI, dl, ARM::R4, MaxAlign,
                                  false);
         BuildMI(MBB, MBBI, dl, TII.get(ARM::tMOVr), ARM::SP)
             .addReg(ARM::R4, RegState::Kill)
             .add(predOps(ARMCC::AL));
       }
+    }
 
     AFI->setShouldRestoreSPFromFP(true);
   }
 
   // If we need a base pointer, set it up here. It's whatever the value
   // of the stack pointer is at this point. Any variable size objects
   // will be allocated after this, so we can still use the base pointer
   // to reference locals.
void ARMFrameLowering::adjustForSegmentedStacks(
   McrMBB->addSuccessor(GetMBB);
 
   PrevStackMBB->addSuccessor(McrMBB);
 
 #ifdef EXPENSIVE_CHECKS
   MF.verify();
 #endif
 }
+
+/// Emit a loop to decrement SP until it is equal to TargetReg, with probes at
+///  least every NegProbeSize bytes. Returns an iterator of the first
+///  instruction after the loop. The difference between SP and TargetReg must be
+///  an exact multiple of NegProbeSize.
+
+static MachineBasicBlock::iterator inlineStackProbeLoopExactMultiple(
+    MachineFunction &MF, MachineBasicBlock::iterator MBBI, int64_t NegProbeSize,
+    Register TargetReg, bool NeedsWinCFI, bool *HasWinCFI, bool EmitCFI) {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
+  bool isARM = !AFI->isThumbFunction();
+  const ARMBaseInstrInfo &TII =
+      *static_cast<const ARMBaseInstrInfo *>(MF.getSubtarget().getInstrInfo());
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+
+  MachineFunction::iterator MBBInsertPoint = std::next(MBB.getIterator());
+  MachineBasicBlock *LoopMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopMBB);
+  MachineBasicBlock *ExitMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, ExitMBB);
+
+  if (isARM) {
+    // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not encodable
+    // in ADD).
+    auto loopMBBend = LoopMBB->end();
+    emitSPUpdate(true, *LoopMBB, loopMBBend, DL, TII, NegProbeSize,
+                 MachineInstr::FrameSetup);
+
+    // STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .addImm(ARMCC::AL)
+        .addImm(0);
+
+    // CMP SP, TargetReg
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::CMPrr))
+        .addReg(ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL));
+
+    // B.CC Loop
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::Bcc))
+        .addMBB(LoopMBB)
+        .addImm(ARMCC::NE)
+        .addReg(ARM::CPSR);
+  } else {
+    // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not encodable
+    // in ADD).
+    auto loopMBBend = LoopMBB->end();
+    emitSPUpdate(isARM, *LoopMBB, loopMBBend, DL, TII, NegProbeSize,
+                 MachineInstr::FrameSetup);
+
+    // STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::t2STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .add(predOps(ARMCC::AL));
+
+    // CMP SP, TargetReg
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::t2CMPrr))
+        .addReg(ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL));
+
+    // B.CC Loop
+    BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::t2Bcc))
+        .addMBB(LoopMBB)
+        .addImm(ARMCC::NE)
+        .addReg(ARM::CPSR);
+  }
+
+  LoopMBB->addSuccessor(ExitMBB);
+  LoopMBB->addSuccessor(LoopMBB);
+  // Synthesize the exit MBB.
+  ExitMBB->splice(ExitMBB->end(), &MBB, std::next(MBBI), MBB.end());
+  ExitMBB->transferSuccessorsAndUpdatePHIs(&MBB);
+  MBB.addSuccessor(LoopMBB);
+  // Update liveins.
+  recomputeLiveIns(*LoopMBB);
+  recomputeLiveIns(*ExitMBB);
+
+  return ExitMBB->begin();
+}
+
+MachineBasicBlock::iterator ARMFrameLowering::inlineStackProbeFixed(
+    MachineFunction &MF, MachineBasicBlock::iterator MBBI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  const ARMTargetLowering *TLI =
+      MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+  const ARMBaseInstrInfo &TII =
+      *static_cast<const ARMBaseInstrInfo *>(MF.getSubtarget().getInstrInfo());
+
+  ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
+  bool isARM = !AFI->isThumbFunction();
+  bool HasFP = hasFP(MF);
+  bool NeedsWinCFI = needsWinCFI(MF);
+  bool EmitCFI = !NeedsWinCFI;
+  bool HasWinCFI = false;
+
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+  Register ScratchReg = MBBI->getOperand(0).getReg();
+  int64_t NegFrameSize = MBBI->getOperand(1).getImm();
+  int64_t NegProbeSize = -(int64_t)TLI->getStackProbeSize(MF);
+  int64_t NumBlocks = NegFrameSize / NegProbeSize;
+  int64_t NegResidualSize = NegFrameSize % NegProbeSize;
+  bool NeedResidualProbe =
+      NegResidualSize <= -(int64_t)TLI->getStackProbeMaxUnprobedStack(MF);
+  bool UnrollProbeLoop = NumBlocks <= ARM::StackClashCallerMaxUnrollPage;
+  LLVM_DEBUG(dbgs() << "Stack probing (fixed): total " << NegFrameSize
+                    << " bytes, " << NumBlocks << " blocks of " << NegProbeSize
+                    << " bytes, " << NeedResidualProbe << " block of "
+                    << NegResidualSize << " bytes"
+                    << " (residual), Unroll: " << UnrollProbeLoop << ", "
+                    << "CFI: " << (EmitCFI && !HasFP) << "\n");
+
+  MachineBasicBlock::iterator NextInst;
+  if (UnrollProbeLoop) {
+    for (int i = 0; i < NumBlocks; ++i) {
+      if (isARM) {
+        // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not
+        // encodable in ADD).
+        emitSPUpdate(isARM, MBB, MBBI, DL, TII, NegProbeSize,
+                     MachineInstr::NoFlags);
+        // STR ScratchReg, [SP, #StackClashCallerGuard]
+        BuildMI(MBB, MBBI, DL, TII.get(ARM::STRi12))
+            .addReg(ScratchReg)
+            .addReg(ARM::SP)
+            .addImm(ARM::StackClashCallerGuard)
+            .addImm(ARMCC::AL)
+            .addImm(0);
+      } else {
+
+        emitSPUpdate(isARM, MBB, MBBI, DL, TII, NegProbeSize,
+                     MachineInstr::FrameSetup);
+
+        // STR ScratchReg, [SP, #StackClashCallerGuard]
+        BuildMI(MBB, MBBI, DL, TII.get(ARM::t2STRi12))
+            .addReg(ScratchReg)
+            .addReg(ARM::SP)
+            .addImm(ARM::StackClashCallerGuard)
+            .add(predOps(ARMCC::AL));
+      }
+    }
+    NextInst = std::next(MBBI);
+  } else if (NumBlocks != 0) {
+    // ADD ScratchReg, SP, #NegFrameSize (or equivalent if NegFrameSize is not
+    // encodable in ADD).
+    // TODO:
+    emitRegPlusImmediate(isARM, MBB, MBBI, DL, TII, ScratchReg, ARM::SP,
+                         NegFrameSize, MachineInstr::NoFlags, ARMCC::AL, 0);
+
+    NextInst = inlineStackProbeLoopExactMultiple(
+        MF, MBBI, NegProbeSize, ScratchReg, NeedsWinCFI, &HasWinCFI, EmitCFI);
+  }
+
+  if (NegResidualSize != 0) {
+    // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not encodable
+    // in ADD).
+    if (isARM) {
+      emitSPUpdate(isARM, MBB, MBBI, DL, TII, NegResidualSize,
+                   MachineInstr::FrameSetup);
+      if (NeedResidualProbe) {
+        // STR ScratchReg, [SP, #StackClashCallerGuard]
+        BuildMI(MBB, MBBI, DL, TII.get(ARM::STRi12))
+            .addReg(ScratchReg)
+            .addReg(ARM::SP)
+            .addImm(ARM::StackClashCallerGuard)
+            .addImm(ARMCC::AL)
+            .addImm(0);
+      }
+    } else {
+      emitSPUpdate(isARM, MBB, MBBI, DL, TII, NegResidualSize,
+                   MachineInstr::FrameSetup);
+      if (NeedResidualProbe) {
+        // STR ScratchReg, [SP, #StackClashCallerGuard]
+        BuildMI(MBB, MBBI, DL, TII.get(ARM::t2STRi12))
+            .addReg(ScratchReg)
+            .addReg(ARM::SP)
+            .addImm(ARM::StackClashCallerGuard)
+            .add(predOps(ARMCC::AL));
+      }
+    }
+  }
+
+  MBBI->eraseFromParent();
+  return NextInst;
+}
+
+MachineBasicBlock::iterator
+ARMFrameLowering::inlineStackProbeVar(MachineFunction &MF,
+                                      MachineBasicBlock::iterator MBBI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+  Register TargetReg = MBBI->getOperand(0).getReg();
+  MachineBasicBlock::iterator NextInst = std::next(MBBI);
+
+  NextInst = insertStackProbingLoop(MBBI, TargetReg);
+
+  MBBI->eraseFromParent();
+  return NextInst;
+}
+
+MachineBasicBlock::iterator
+ARMFrameLowering::insertStackProbingLoop(MachineBasicBlock::iterator MBBI,
+                                         Register TargetReg) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  MachineFunction &MF = *MBB.getParent();
+  ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
+  bool isARM = !AFI->isThumbFunction();
+  const ARMTargetLowering *TLI =
+      MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+  const ARMBaseInstrInfo &TII =
+      *static_cast<const ARMBaseInstrInfo *>(MF.getSubtarget().getInstrInfo());
+
+  int64_t NegProbeSize = -(int64_t)TLI->getStackProbeSize(MF);
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+
+  MachineFunction::iterator MBBInsertPoint = std::next(MBB.getIterator());
+  MachineBasicBlock *LoopTestMBB =
+      MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopTestMBB);
+  MachineBasicBlock *LoopBodyMBB =
+      MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopBodyMBB);
+  MachineBasicBlock *ExitMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, ExitMBB);
+
+  // LoopTest:
+  //   SUB SP, SP, #ProbeSize
+  if (isARM) {
+    MachineBasicBlock::iterator LoopTestMBBItr = LoopTestMBB->end();
+    emitSPUpdate(isARM, *LoopTestMBB, LoopTestMBBItr, DL, TII, NegProbeSize,
+                 MachineInstr::NoFlags);
+
+    //   CMP SP, TargetReg
+    BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::CMPrr))
+        .addReg(ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL));
+
+    //   B.LE LoopExit
+    BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::Bcc))
+        .addMBB(ExitMBB)
+        .addImm(ARMCC::LE)
+        .addReg(ARM::CPSR);
+
+    //   STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*LoopBodyMBB, LoopBodyMBB->end(), DL, TII.get(ARM::STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .addImm(ARMCC::AL)
+        .addImm(0);
+
+    //   B loop
+    BuildMI(*LoopBodyMBB, LoopBodyMBB->end(), DL, TII.get(ARM::B))
+        .addMBB(LoopTestMBB);
+
+    // LoopExit:
+    //   MOV SP, TargetReg
+    BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::MOVr), ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL))
+        .add(condCodeOp());
+
+    //   STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .addImm(ARMCC::AL)
+        .addImm(0);
+  } else {
+    MachineBasicBlock::iterator LoopTestMBBItr = LoopTestMBB->end();
+    emitSPUpdate(isARM, *LoopTestMBB, LoopTestMBBItr, DL, TII, NegProbeSize,
+                 MachineInstr::FrameSetup);
+
+    //   CMP SP, TargetReg
+    BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::t2CMPrr))
+        .addReg(ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL));
+
+    //   B.LE LoopExit
+    BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::t2Bcc))
+        .addMBB(ExitMBB)
+        .addImm(ARMCC::LE)
+        .addReg(ARM::CPSR);
+
+    //   STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*LoopBodyMBB, LoopBodyMBB->end(), DL, TII.get(ARM::t2STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .add(predOps(ARMCC::AL));
+
+    //   B loop
+    BuildMI(*LoopBodyMBB, LoopBodyMBB->end(), DL, TII.get(ARM::t2B))
+        .addMBB(LoopTestMBB)
+        .add(predOps(ARMCC::AL));
+
+    // LoopExit:
+    //   MOV SP, TargetReg
+    BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::t2MOVr), ARM::SP)
+        .addReg(TargetReg)
+        .add(predOps(ARMCC::AL))
+        .add(condCodeOp());
+
+    //   STR TargetReg, [SP, #StackClashCallerGuard]
+    BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::t2STRi12))
+        .addReg(TargetReg)
+        .addReg(ARM::SP)
+        .addImm(ARM::StackClashCallerGuard)
+        .add(predOps(ARMCC::AL));
+  }
+
+  LoopTestMBB->addSuccessor(ExitMBB);
+  LoopTestMBB->addSuccessor(LoopBodyMBB);
+  LoopBodyMBB->addSuccessor(LoopTestMBB);
+
+  // Synthesize the exit MBB.
+  ExitMBB->splice(ExitMBB->end(), &MBB, std::next(MBBI), MBB.end());
+  ExitMBB->transferSuccessorsAndUpdatePHIs(&MBB);
+  MBB.addSuccessor(LoopTestMBB);
+
+  // Update liveins.
+  if (MF.getRegInfo().reservedRegsFrozen()) {
+    recomputeLiveIns(*LoopTestMBB);
+    recomputeLiveIns(*LoopBodyMBB);
+    recomputeLiveIns(*ExitMBB);
+  }
+
+  return ExitMBB->begin();
+}
+
+void ARMFrameLowering::inlineStackProbe(MachineFunction &MF,
+                                        MachineBasicBlock &MBB) const {
+  for (auto MBBI = MBB.begin(), E = MBB.end(); MBBI != E;) {
+    if (MBBI->getOpcode() == ARM::PROBED_STACKALLOC) {
+      MBBI = inlineStackProbeFixed(MF, MBBI);
+      E = MBBI->getParent()->end();
+    } else if (MBBI->getOpcode() == ARM::PROBED_STACKALLOC_VAR) {
+      MBBI = inlineStackProbeVar(MF, MBBI);
+      E = MBBI->getParent()->end();
+    } else {
+      ++MBBI;
+    }
+  }
+}
+
+static unsigned findScratchNonCalleeSaveRegister(MachineBasicBlock *MBB) {
+  MachineFunction *MF = MBB->getParent();
+
+  const ARMSubtarget &Subtarget = MF->getSubtarget<ARMSubtarget>();
+  const ARMBaseRegisterInfo TRI = *Subtarget.getRegisterInfo();
+  LivePhysRegs LiveRegs(TRI);
+  LiveRegs.addLiveIns(*MBB);
+
+  // Mark callee saved registers as used so we will not choose them.
+  const MCPhysReg *CSRegs = MF->getRegInfo().getCalleeSavedRegs();
+  for (unsigned i = 0; CSRegs[i]; ++i)
+    LiveRegs.addReg(CSRegs[i]);
+
+  const MachineRegisterInfo &MRI = MF->getRegInfo();
+  const TargetRegisterClass &RC = ARM::GPRRegClass;
+  for (unsigned Reg : RC) {
+    if (LiveRegs.available(MRI, Reg))
+      return Reg;
+  }
+  return ARM::NoRegister;
+}

llvm/lib/Target/ARM/ARMISelLowering.h

enum NodeType : unsigned {
     RRX,      // V = RRX X, Flag     -> srl X, 1 + shift in carry flag.
 
     ADDC, // Add with carry
     ADDE, // Add using carry
     SUBC, // Sub with carry
     SUBE, // Sub using carry
     LSLS, // Shift left producing carry
 
+    // Dynamic stack allocation with stack clash protection, allocation is done
+    // by blocks and each block is probed with a zero store.
+    PROBED_ALLOCA,
+
     VMOVRRD, // double to two gprs.
     VMOVDRR, // Two gprs to double.
     VMOVSR,  // move gpr to single, used for f32 literal constructed in a gpr
 
     EH_SJLJ_SETJMP,         // SjLj exception handling setjmp.
     EH_SJLJ_LONGJMP,        // SjLj exception handling longjmp.
     EH_SJLJ_SETUP_DISPATCH, // SjLj exception handling setup_dispatch.
 
public:
     bool isComplexDeinterleavingOperationSupported(
         ComplexDeinterleavingOperation Operation, Type *Ty) const override;
 
     Value *createComplexDeinterleavingIR(
         IRBuilderBase &B, ComplexDeinterleavingOperation OperationType,
         ComplexDeinterleavingRotation Rotation, Value *InputA, Value *InputB,
         Value *Accumulator = nullptr) const override;
 
+    /// True if stack clash protection is enabled for this functions.
+    bool hasInlineStackProbe(const MachineFunction &MF) const override;
+
+    /// Get the interval between stack-clash probes, which is equal to the stack
+    /// guard size, in bytes.
+    unsigned getStackProbeSize(MachineFunction &MF) const;
+
+    /// Get the maximum allowed number of unprobed bytes above SP at an ABI
+    /// boundary.
+    unsigned getStackProbeMaxUnprobedStack(MachineFunction &MF) const;
+
   protected:
     std::pair<const TargetRegisterClass *, uint8_t>
     findRepresentativeClass(const TargetRegisterInfo *TRI,
                             MVT VT) const override;
 
   private:
     /// Subtarget - Keep a pointer to the ARMSubtarget around so that we can
     /// make the right decision when generating code for different targets.
private:
     void ExpandDIV_Windows(SDValue Op, SelectionDAG &DAG, bool Signed,
                            SmallVectorImpl<SDValue> &Results) const;
     SDValue ExpandBITCAST(SDNode *N, SelectionDAG &DAG,
                           const ARMSubtarget *Subtarget) const;
     SDValue LowerWindowsDIVLibCall(SDValue Op, SelectionDAG &DAG, bool Signed,
                                    SDValue &Chain) const;
     SDValue LowerREM(SDNode *N, SelectionDAG &DAG) const;
     SDValue LowerDYNAMIC_STACKALLOC(SDValue Op, SelectionDAG &DAG) const;
+    SDValue LowerWindowsDYNAMIC_STACKALLOC(SDValue Op, SelectionDAG &DAG) const;
+    SDValue LowerInlineDYNAMIC_STACKALLOC(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerFP_ROUND(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerFP_EXTEND(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerFP_TO_INT(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerINT_TO_FP(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerFSETCC(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerSPONENTRY(SDValue Op, SelectionDAG &DAG) const;
     void LowerLOAD(SDNode *N, SmallVectorImpl<SDValue> &Results,
                    SelectionDAG &DAG) const;
enum VMOVModImmType {
     MVEVMVNModImm,
     OtherModImm
   };
 
   namespace ARM {
 
     FastISel *createFastISel(FunctionLoweringInfo &funcInfo,
                              const TargetLibraryInfo *libInfo);
-
+    // The amount of bytes a caller is allowed update the stack before emit a
+    // probe required by stack clash protection.
+    static constexpr unsigned StackClashCallerGuard = 1024;
+    // How many time to unroll the loop for large outgoing argument during stack
+    // clash protection probing.
+    static constexpr unsigned StackClashCallerMaxUnrollPage = 4;
   } // end namespace ARM
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARMISELLOWERING_H

llvm/lib/Target/ARM/ARMISelLowering.cpp

ARMTargetLowering::ARMTargetLowering(const TargetMachine &TM,
   // Use the default implementation.
   setOperationAction(ISD::VASTART,            MVT::Other, Custom);
   setOperationAction(ISD::VAARG,              MVT::Other, Expand);
   setOperationAction(ISD::VACOPY,             MVT::Other, Expand);
   setOperationAction(ISD::VAEND,              MVT::Other, Expand);
   setOperationAction(ISD::STACKSAVE,          MVT::Other, Expand);
   setOperationAction(ISD::STACKRESTORE,       MVT::Other, Expand);
 
-  if (Subtarget->isTargetWindows())
-    setOperationAction(ISD::DYNAMIC_STACKALLOC, MVT::i32, Custom);
-  else
-    setOperationAction(ISD::DYNAMIC_STACKALLOC, MVT::i32, Expand);
 
   // ARMv6 Thumb1 (except for CPUs that support dmb / dsb) and earlier use
   // the default expansion.
   InsertFencesForAtomic = false;
   if (Subtarget->hasAnyDataBarrier() &&
       (!Subtarget->isThumb() || Subtarget->hasV8MBaselineOps())) {
     // ATOMIC_FENCE needs custom lowering; the others should have been expanded
     // to ldrex/strex loops already.
case ARMISD::FIRST_NUMBER:
     MAKE_CASE(ARMISD::VMOVrh)
     MAKE_CASE(ARMISD::VMOVSR)
     MAKE_CASE(ARMISD::EH_SJLJ_SETJMP)
     MAKE_CASE(ARMISD::EH_SJLJ_LONGJMP)
     MAKE_CASE(ARMISD::EH_SJLJ_SETUP_DISPATCH)
     MAKE_CASE(ARMISD::TC_RETURN)
     MAKE_CASE(ARMISD::THREAD_POINTER)
     MAKE_CASE(ARMISD::DYN_ALLOC)
+    MAKE_CASE(ARMISD::PROBED_ALLOCA)
     MAKE_CASE(ARMISD::MEMBARRIER_MCR)
     MAKE_CASE(ARMISD::PRELOAD)
     MAKE_CASE(ARMISD::LDRD)
     MAKE_CASE(ARMISD::STRD)
     MAKE_CASE(ARMISD::WIN__CHKSTK)
     MAKE_CASE(ARMISD::WIN__DBZCHK)
     MAKE_CASE(ARMISD::PREDICATE_CAST)
     MAKE_CASE(ARMISD::VECTOR_REG_CAST)
SDValue ARMTargetLowering::LowerOperation(SDValue Op, SelectionDAG &DAG) const {
   case ISD::VECREDUCE_SMAX:
     return LowerVecReduceMinMax(Op, DAG, Subtarget);
   case ISD::ATOMIC_LOAD:
   case ISD::ATOMIC_STORE:  return LowerAtomicLoadStore(Op, DAG);
   case ISD::FSINCOS:       return LowerFSINCOS(Op, DAG);
   case ISD::SDIVREM:
   case ISD::UDIVREM:       return LowerDivRem(Op, DAG);
   case ISD::DYNAMIC_STACKALLOC:
-    if (Subtarget->isTargetWindows())
-      return LowerDYNAMIC_STACKALLOC(Op, DAG);
-    llvm_unreachable("Don't know how to custom lower this!");
   case ISD::STRICT_FP_ROUND:
   case ISD::FP_ROUND: return LowerFP_ROUND(Op, DAG);
   case ISD::STRICT_FP_EXTEND:
   case ISD::FP_EXTEND: return LowerFP_EXTEND(Op, DAG);
   case ISD::STRICT_FSETCC:
   case ISD::STRICT_FSETCCS: return LowerFSETCC(Op, DAG);
   case ISD::SPONENTRY:
     return LowerSPONENTRY(Op, DAG);
SDValue ARMTargetLowering::LowerREM(SDNode *N, SelectionDAG &DAG) const {
 
   // Return second (rem) result operand (first contains div)
   SDNode *ResNode = CallResult.first.getNode();
   assert(ResNode->getNumOperands() == 2 && "divmod should return two operands");
   return ResNode->getOperand(1);
 }
 
 SDValue
-ARMTargetLowering::LowerDYNAMIC_STACKALLOC(SDValue Op, SelectionDAG &DAG) const {
+ARMTargetLowering::LowerWindowsDYNAMIC_STACKALLOC(SDValue Op, SelectionDAG &DAG) const {
   assert(Subtarget->isTargetWindows() && "unsupported target platform");
   SDLoc DL(Op);
 
   // Get the inputs.
   SDValue Chain = Op.getOperand(0);
   SDValue Size  = Op.getOperand(1);
 
   if (DAG.getMachineFunction().getFunction().hasFnAttribute(
if (!ConstRotation)
       return nullptr; // Invalid rotation for arm_mve_vcaddq
 
     return B.CreateIntrinsic(Intrinsic::arm_mve_vcaddq, Ty,
                              {ConstHalving, ConstRotation, InputA, InputB});
   }
 
   return nullptr;
 }
+
+bool ARMTargetLowering::hasInlineStackProbe(const MachineFunction &MF) const {
+  // If the function specifically requests inline stack probes, emit them.
+  if (MF.getFunction().hasFnAttribute("probe-stack")) {
+    if (MF.getFunction().getFnAttribute("probe-stack").getValueAsString() ==
+        "inline-asm")
+      return true;
+    else
+      llvm_unreachable("Unsupported stack probing method");
+  }
+
+  return false;
+}
+
+unsigned ARMTargetLowering::getStackProbeSize(MachineFunction &MF) const {
+  const TargetFrameLowering *TFI = Subtarget->getFrameLowering();
+  unsigned StackAlign = TFI->getStackAlignment();
+  assert(StackAlign >= 1 && isPowerOf2_32(StackAlign) &&
+         "Unexpected stack alignment");
+  // The default stack probe size is 4096 if the function has no
+  // stack-probe-size attribute. This is a safe default because it is the
+  // smallest possible guard page size.
+  unsigned StackProbeSize = 4096;
+  const Function &Fn = MF.getFunction();
+  if (Fn.hasFnAttribute("stack-probe-size"))
+    Fn.getFnAttribute("stack-probe-size")
+        .getValueAsString()
+        .getAsInteger(0, StackProbeSize);
+  // Round down to the stack alignment.
+  StackProbeSize &= ~(StackAlign - 1);
+  return StackProbeSize ? StackProbeSize : StackAlign;
+}
+
+unsigned
+ARMTargetLowering::getStackProbeMaxUnprobedStack(MachineFunction &MF) const {
+  // Since the ABI requires save FP/LR or just LR for leaf functions, it acts as
+  // an implict stack probe. Probing at StackClashCallerGuard means that the
+  // rest of the guard page (assumed to be stack-probe-size attribute) can be
+  // used without further probing.
+  return getStackProbeSize(MF) - ARM::StackClashCallerGuard;
+}
+
+SDValue
+ARMTargetLowering::LowerInlineDYNAMIC_STACKALLOC(SDValue Op,
+                                                 SelectionDAG &DAG) const {
+  SDLoc dl(Op);
+  // Get the inputs.
+  SDNode *Node = Op.getNode();
+  SDValue Chain = Op.getOperand(0);
+  SDValue Size = Op.getOperand(1);
+  MaybeAlign Align =
+      cast<ConstantSDNode>(Op.getOperand(2))->getMaybeAlignValue();
+  EVT VT = Node->getValueType(0);
+
+  // Construct the new SP value in a GPR.
+  SDValue SP = DAG.getCopyFromReg(Chain, dl, ARM::SP, MVT::i32);
+  Chain = SP.getValue(1);
+  SP = DAG.getNode(ISD::SUB, dl, MVT::i32, SP, Size);
+  if (Align)
+    SP = DAG.getNode(ISD::AND, dl, VT, SP.getValue(0),
+                     DAG.getConstant(-(uint64_t)Align->value(), dl, VT));
+
+  // Set the real SP to the new value with a probing loop.
+  Chain = DAG.getNode(ARMISD::PROBED_ALLOCA, dl, MVT::Other, Chain, SP);
+  SDValue Ops[2] = {SP, Chain};
+  return DAG.getMergeValues(Ops, dl);
+}
+
+SDValue ARMTargetLowering::LowerDYNAMIC_STACKALLOC(SDValue Op,
+                                                   SelectionDAG &DAG) const {
+  MachineFunction &MF = DAG.getMachineFunction();
+
+  if (Subtarget->isTargetWindows())
+    return LowerWindowsDYNAMIC_STACKALLOC(Op, DAG);
+  if (hasInlineStackProbe(MF)) {
+    return LowerInlineDYNAMIC_STACKALLOC(Op, DAG);
+  } else
+    return SDValue();
+}

llvm/lib/Target/ARM/ARMInstrInfo.td

 
 /// A jumptable consisting of 16-bit unsigned integers representing offsets from
 /// a TBH instruction.
 def JUMPTABLE_TBH :
 PseudoInst<(outs), (ins cpinst_operand:$instid, cpinst_operand:$cpidx,
                         i32imm:$size), NoItinerary, []>;
 
 
+def ARMprobedalloca
+    : SDNode<"ARMISD::PROBED_ALLOCA",
+             SDTypeProfile<0, 1, [SDTCisPtrTy<0>]>,
+             [SDNPHasChain]>;
 // FIXME: Marking these as hasSideEffects is necessary to prevent machine DCE
 // from removing one half of the matched pairs. That breaks PEI, which assumes
 // these will always be in pairs, and asserts if it finds otherwise. Better way?
 let Defs = [SP], Uses = [SP], hasSideEffects = 1 in {
 def ADJCALLSTACKUP :
 PseudoInst<(outs), (ins i32imm:$amt1, i32imm:$amt2, pred:$p), NoItinerary,
            [(ARMcallseq_end timm:$amt1, timm:$amt2)]>;
 
 def ADJCALLSTACKDOWN :
 PseudoInst<(outs), (ins i32imm:$amt, i32imm:$amt2, pred:$p), NoItinerary,
            [(ARMcallseq_start timm:$amt, timm:$amt2)]>;
+
+// Probed stack allocation of a constant size, used in function prologues when
+// stack-clash protection is enabled.
+def PROBED_STACKALLOC : PseudoInst<(outs GPR:$scratch),
+                               (ins i32imm:$stacksize),
+                               NoItinerary,
+                               []>,
+                               Sched<[]>;
+
+// Probed stack allocation of a variable size, used in function prologues when
+// stack-clash protection is enabled. The register input is the target SP,
+// which should be below the current value, and has no alignment requirements
+// beyond the usual 16-byte alignment for SP.
+def PROBED_STACKALLOC_VAR : PseudoInst<(outs),
+                                   (ins GPR:$target),
+                                   NoItinerary,
+                                   []>,
+                                   Sched<[]>;
+
+// Probed stack allocations of a variable size, used for allocas of unknown size
+// when stack-clash protection is enabled.
+def PROBED_STACKALLOC_DYN
+    : PseudoInst<(outs),
+             (ins GPR:$target),
+             NoItinerary,
+             [(ARMprobedalloca GPR:$target)]>,
+      Sched<[]>;
 }
 
 def HINT : AI<(outs), (ins imm0_239:$imm), MiscFrm, NoItinerary,
               "hint", "\t$imm", [(int_arm_hint imm0_239:$imm)]>,
            Requires<[IsARM, HasV6]> {
   bits<8> imm;
   let Inst{27-8} = 0b00110010000011110000;
   let Inst{7-0} = imm;

llvm/lib/Target/ARM/Thumb1FrameLowering.h

public:
 
   bool hasReservedCallFrame(const MachineFunction &MF) const override;
 
   MachineBasicBlock::iterator
   eliminateCallFramePseudoInstr(MachineFunction &MF,
                                 MachineBasicBlock &MBB,
                                 MachineBasicBlock::iterator MI) const override;
 
+  /// Replace a StackProbe stub (if any) with the actual probe code inline
+  void inlineStackProbe(MachineFunction &MF,
+                        MachineBasicBlock &PrologueMBB) const override;
+  MachineBasicBlock::iterator
+  inlineStackProbeFixed(MachineFunction &MF,
+                        MachineBasicBlock::iterator MBBI) const;
+  MachineBasicBlock::iterator
+  inlineStackProbeVar(MachineFunction &MF,
+                      MachineBasicBlock::iterator MBBI) const;
+
   /// Check whether or not the given \p MBB can be used as a epilogue
   /// for the target.
   /// The epilogue will be inserted before the first terminator of that block.
   /// This method is used by the shrink-wrapping pass to decide if
   /// \p MBB will be correctly handled by the target.
   bool canUseAsEpilogue(const MachineBasicBlock &MBB) const override;
 
   /// Disable shrink wrap as tBfar/BL will be used to adjust for long jumps.
   bool enableShrinkWrapping(const MachineFunction &MF) const override {
     return false;
   }
 
+  MachineBasicBlock::iterator
+  insertStackProbingLoop(MachineBasicBlock::iterator MBBI,
+                         Register TargetReg) const override;
+
 private:
   /// Check if the frame lowering of \p MF needs a special fixup
   /// code sequence for the epilogue.
   /// Unlike T2 and ARM mode, the T1 pop instruction cannot restore
   /// to LR, and we can't pop the value directly to the PC when
   /// we need to update the SP after popping the value. So instead
   /// we have to emit:
   ///   POP {r3}

llvm/lib/Target/ARM/Thumb1FrameLowering.cpp

bool Thumb1FrameLowering::hasReservedCallFrame(const MachineFunction &MF) const{
   // address the stack frame. So a large call frame can cause poor codegen
   // and may even makes it impossible to scavenge a register.
   if (CFSize >= ((1 << 8) - 1) * 4 / 2) // Half of imm8 * 4
     return false;
 
   return !MFI.hasVarSizedObjects();
 }
 
+static unsigned
+findScratchNonCalleeSaveRegister(MachineBasicBlock *MBB,
+                                 const ThumbRegisterInfo *RegInfo) {
+  MachineFunction *MF = MBB->getParent();
+
+  LivePhysRegs LiveRegs(*RegInfo);
+  LiveRegs.addLiveIns(*MBB);
+
+  // Mark callee saved registers as used so we will not choose them.
+  const MCPhysReg *CSRegs = MF->getRegInfo().getCalleeSavedRegs();
+  for (unsigned i = 0; CSRegs[i]; ++i)
+    LiveRegs.addReg(CSRegs[i]);
+
+  const MachineRegisterInfo &MRI = MF->getRegInfo();
+  const TargetRegisterClass &RC = ARM::GPRRegClass;
+  for (unsigned Reg : RC) {
+    if (LiveRegs.available(MRI, Reg))
+      return Reg;
+  }
+  return ARM::NoRegister;
+}
+
 static void
 emitPrologueEpilogueSPUpdate(MachineBasicBlock &MBB,
                              MachineBasicBlock::iterator &MBBI,
                              const TargetInstrInfo &TII, const DebugLoc &dl,
                              const ThumbRegisterInfo &MRI, int NumBytes,
                              unsigned ScratchReg, unsigned MIFlags) {
   // If it would take more than three instructions to adjust the stack pointer
   // using tADDspi/tSUBspi, load an immediate instead.
void Thumb1FrameLowering::emitPrologue(MachineFunction &MF,
   MachineModuleInfo &MMI = MF.getMMI();
   const MCRegisterInfo *MRI = MMI.getContext().getRegisterInfo();
   const ThumbRegisterInfo *RegInfo =
       static_cast<const ThumbRegisterInfo *>(STI.getRegisterInfo());
   const Thumb1InstrInfo &TII =
       *static_cast<const Thumb1InstrInfo *>(STI.getInstrInfo());
 
   unsigned ArgRegsSaveSize = AFI->getArgRegsSaveSize();
-  unsigned NumBytes = MFI.getStackSize();
+  int NumBytes = MFI.getStackSize();
   assert(NumBytes >= ArgRegsSaveSize &&
          "ArgRegsSaveSize is included in NumBytes");
   const std::vector<CalleeSavedInfo> &CSI = MFI.getCalleeSavedInfo();
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc dl;
 
for (auto &I : CSI) {
       }
       default:
         break;
       }
     }
   }
 
   if (NumBytes) {
+    const ARMTargetLowering *TLI =
+        MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+    bool NeedsStackProbe =
+        TLI->hasInlineStackProbe(MF) &&
+        (NumBytes >= TLI->getStackProbeMaxUnprobedStack(MF) ||
+         MFI.hasVarSizedObjects());
+    bool NeedsRelignment = RegInfo->hasStackRealignment(MF);
+    if (NeedsStackProbe && !NeedsRelignment) {
+      Register ScratchReg = findScratchNonCalleeSaveRegister(&MBB, RegInfo);
+      assert(ScratchReg != ARM::NoRegister);
+      BuildMI(MBB, MBBI, dl, TII.get(ARM::PROBED_STACKALLOC))
+          .addDef(ScratchReg)
+          .addImm(-NumBytes);
+    } else {
       // Insert it after all the callee-save spills.
       //
       // For a large stack frame, we might need a scratch register to store
       // the size of the frame.  We know all callee-save registers are free
       // at this point in the prologue, so pick one.
       unsigned ScratchRegister = ARM::NoRegister;
       for (auto &I : CSI) {
         Register Reg = I.getReg();
         if (isARMLowRegister(Reg) && !(HasFP && Reg == FramePtr)) {
           ScratchRegister = Reg;
           break;
         }
       }
       emitPrologueEpilogueSPUpdate(MBB, MBBI, TII, dl, *RegInfo, -NumBytes,
                                    ScratchRegister, MachineInstr::FrameSetup);
+    }
+
     if (!HasFP) {
       CFAOffset += NumBytes;
       unsigned CFIIndex = MF.addFrameInst(
           MCCFIInstruction::cfiDefCfaOffset(nullptr, CFAOffset));
       BuildMI(MBB, MBBI, dl, TII.get(TargetOpcode::CFI_INSTRUCTION))
           .addCFIIndex(CFIIndex)
           .setMIFlags(MachineInstr::FrameSetup);
     }
   }
 
   if (STI.isTargetELF() && HasFP)
     MFI.setOffsetAdjustment(MFI.getOffsetAdjustment() -
                             AFI->getFramePtrSpillOffset());
 
   AFI->setGPRCalleeSavedArea1Size(GPRCS1Size);
   AFI->setGPRCalleeSavedArea2Size(GPRCS2Size);
   AFI->setDPRCalleeSavedAreaSize(DPRCSSize);
 
   if (RegInfo->hasStackRealignment(MF)) {
     const unsigned NrBitsToZero = Log2(MFI.getMaxAlign());
+    const ARMTargetLowering *TLI =
+        MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+    bool NeedsStackProbe = TLI->hasInlineStackProbe(MF) &&
+                           (NumBytes + MFI.getMaxAlign().value()) >=
+                               TLI->getStackProbeMaxUnprobedStack(MF);
     // Emit the following sequence, using R4 as a temporary, since we cannot use
     // SP as a source or destination register for the shifts:
     // mov  r4, sp
     // lsrs r4, r4, #NrBitsToZero
     // lsls r4, r4, #NrBitsToZero
     // mov  sp, r4
     BuildMI(MBB, MBBI, dl, TII.get(ARM::tMOVr), ARM::R4)
       .addReg(ARM::SP, RegState::Kill)
       .add(predOps(ARMCC::AL));
 
     BuildMI(MBB, MBBI, dl, TII.get(ARM::tLSRri), ARM::R4)
       .addDef(ARM::CPSR)
       .addReg(ARM::R4, RegState::Kill)
       .addImm(NrBitsToZero)
       .add(predOps(ARMCC::AL));
 
     BuildMI(MBB, MBBI, dl, TII.get(ARM::tLSLri), ARM::R4)
       .addDef(ARM::CPSR)
       .addReg(ARM::R4, RegState::Kill)
       .addImm(NrBitsToZero)
       .add(predOps(ARMCC::AL));
 
+    if (NeedsStackProbe) {
+      BuildMI(MBB, MBBI, dl, TII.get(ARM::PROBED_STACKALLOC_VAR))
+          .addUse(ARM::R4);
+    } else {
       BuildMI(MBB, MBBI, dl, TII.get(ARM::tMOVr), ARM::SP)
           .addReg(ARM::R4, RegState::Kill)
           .add(predOps(ARMCC::AL));
+    }
 
     AFI->setShouldRestoreSPFromFP(true);
   }
 
   // If we need a base pointer, set it up here. It's whatever the value
   // of the stack pointer is at this point. Any variable size objects
   // will be allocated after this, so we can still use the base pointer
   // to reference locals.
bool Thumb1FrameLowering::restoreCalleeSavedRegisters(
 
   // Now pop Frame Record regs.
   // Only unused return registers can be used as copy regs at this point.
   popRegsFromStack(MBB, MI, TII, FrameRecord, UnusedReturnRegs, IsVarArg,
                    STI.hasV5TOps());
 
   return true;
 }
+
+/// Emit a loop to decrement SP until it is equal to TargetReg, with probes at
+///  least every NegProbeSize bytes. Returns an iterator of the first
+///  instruction after the loop. The difference between SP and TargetReg must be
+///  an exact multiple of NegProbeSize.
+
+static MachineBasicBlock::iterator inlineStackProbeLoopExactMultiple(
+    MachineFunction &MF, MachineBasicBlock::iterator MBBI, int64_t NegProbeSize,
+    Register TargetReg, const TargetInstrInfo &TII,
+    const ThumbRegisterInfo *RegInfo) {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+
+  MachineFunction::iterator MBBInsertPoint = std::next(MBB.getIterator());
+  MachineBasicBlock *LoopMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopMBB);
+  MachineBasicBlock *ExitMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, ExitMBB);
+
+  // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not encodable
+  // in ADD).
+  auto loopMBBend = LoopMBB->end();
+  emitCallSPUpdate(*LoopMBB, loopMBBend, TII, DL, *RegInfo, NegProbeSize);
+
+  // STR TargetReg, [SP, #StackClashCallerGuard]
+  BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::tSTRi))
+      .addReg(TargetReg)
+      .addReg(ARM::SP)
+      .addImm(ARM::StackClashCallerGuard / 4)
+      .add(predOps(ARMCC::AL));
+
+  // CMP SP, TargetReg
+  BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::tCMPr))
+      .addReg(ARM::SP)
+      .addReg(TargetReg)
+      .add(predOps(ARMCC::AL));
+
+  // B.CC Loop
+  BuildMI(*LoopMBB, LoopMBB->end(), DL, TII.get(ARM::tBcc))
+      .addMBB(LoopMBB)
+      .addImm(ARMCC::NE)
+      .addReg(ARM::CPSR);
+
+  LoopMBB->addSuccessor(ExitMBB);
+  LoopMBB->addSuccessor(LoopMBB);
+  // Synthesize the exit MBB.
+  ExitMBB->splice(ExitMBB->end(), &MBB, std::next(MBBI), MBB.end());
+  ExitMBB->transferSuccessorsAndUpdatePHIs(&MBB);
+  MBB.addSuccessor(LoopMBB);
+  // Update liveins.
+  recomputeLiveIns(*LoopMBB);
+  recomputeLiveIns(*ExitMBB);
+
+  return ExitMBB->begin();
+}
+
+MachineBasicBlock::iterator Thumb1FrameLowering::inlineStackProbeFixed(
+    MachineFunction &MF, MachineBasicBlock::iterator MBBI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  const ARMTargetLowering *TLI =
+      MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+  const Thumb1InstrInfo &TII =
+      *static_cast<const Thumb1InstrInfo *>(STI.getInstrInfo());
+  const ThumbRegisterInfo *RegInfo =
+      static_cast<const ThumbRegisterInfo *>(STI.getRegisterInfo());
+
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+  Register ScratchReg = MBBI->getOperand(0).getReg();
+  int64_t NegFrameSize = MBBI->getOperand(1).getImm();
+  int64_t NegProbeSize = -(int64_t)TLI->getStackProbeSize(MF);
+  int64_t NumBlocks = NegFrameSize / NegProbeSize;
+  int64_t NegResidualSize = NegFrameSize % NegProbeSize;
+  bool NeedResidualProbe =
+      NegResidualSize <= -(int64_t)TLI->getStackProbeMaxUnprobedStack(MF);
+  bool UnrollProbeLoop = NumBlocks <= ARM::StackClashCallerMaxUnrollPage;
+
+  MachineBasicBlock::iterator NextInst;
+  if (UnrollProbeLoop) {
+    for (int i = 0; i < NumBlocks; ++i) {
+      emitCallSPUpdate(MBB, MBBI, TII, DL, *RegInfo, NegProbeSize);
+      // STR ScratchReg, [SP, #StackClashCallerGuard]
+      BuildMI(MBB, MBBI, DL, TII.get(ARM::tSTRi))
+          .addReg(ScratchReg)
+          .addReg(ARM::SP)
+          .addImm(ARM::StackClashCallerGuard / 4)
+          .add(predOps(ARMCC::AL));
+    }
+    NextInst = std::next(MBBI);
+  } else if (NumBlocks != 0) {
+    // ADD ScratchReg, SP, #NegFrameSize (or equivalent if NegFrameSize is not
+    // encodable in ADD).
+    // ADD ScratchReg, SP, 0
+    // ADD ScratchReg, NegFrameSize
+
+    emitThumbRegPlusImmediate(MBB, MBBI, DL, ScratchReg, ARM::SP, 0, TII,
+                              *RegInfo, MachineInstr::NoFlags);
+    emitThumbRegPlusImmediate(MBB, MBBI, DL, ScratchReg, ScratchReg,
+                              NegFrameSize, TII, *RegInfo,
+                              MachineInstr::NoFlags);
+
+    NextInst = inlineStackProbeLoopExactMultiple(MF, MBBI, NegProbeSize,
+                                                 ScratchReg, TII, RegInfo);
+  }
+
+  if (NegResidualSize != 0) {
+    // ADD SP, SP, #NegFrameSize (or equivalent if NegFrameSize is not encodable
+    // in ADD).
+    emitCallSPUpdate(MBB, MBBI, TII, DL, *RegInfo, NegProbeSize);
+    if (NeedResidualProbe) {
+      // STR ScratchReg, [SP, #StackClashCallerGuard]
+      BuildMI(MBB, MBBI, DL, TII.get(ARM::tSTRi))
+          .addReg(ScratchReg)
+          .addReg(ARM::SP)
+          .addImm(ARM::StackClashCallerGuard / 4)
+          .add(predOps(ARMCC::AL));
+    }
+  }
+
+  MBBI->eraseFromParent();
+  return NextInst;
+}
+
+MachineBasicBlock::iterator
+Thumb1FrameLowering::insertStackProbingLoop(MachineBasicBlock::iterator MBBI,
+                                            Register TargetReg) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  MachineFunction &MF = *MBB.getParent();
+  const ARMTargetLowering *TLI =
+      MF.getSubtarget<ARMSubtarget>().getTargetLowering();
+  const Thumb1InstrInfo &TII =
+      *static_cast<const Thumb1InstrInfo *>(STI.getInstrInfo());
+  const ThumbRegisterInfo *RegInfo =
+      static_cast<const ThumbRegisterInfo *>(STI.getRegisterInfo());
+
+  int64_t NegProbeSize = -(int64_t)TLI->getStackProbeSize(MF);
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+
+  MachineFunction::iterator MBBInsertPoint = std::next(MBB.getIterator());
+  MachineBasicBlock *LoopTestMBB =
+      MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopTestMBB);
+  MachineBasicBlock *LoopBodyMBB =
+      MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, LoopBodyMBB);
+  MachineBasicBlock *ExitMBB = MF.CreateMachineBasicBlock(MBB.getBasicBlock());
+  MF.insert(MBBInsertPoint, ExitMBB);
+
+  auto loopTestMBBItr = LoopTestMBB->end();
+  unsigned ScratchRegister = ARM::NoRegister;
+  MachineFrameInfo &MFI = MF.getFrameInfo();
+  bool HasFP = hasFP(MF);
+  Register FramePtr = RegInfo->getFrameRegister(MF);
+  const std::vector<CalleeSavedInfo> &CSI = MFI.getCalleeSavedInfo();
+  for (auto &I : CSI) {
+    Register Reg = I.getReg();
+    if (isARMLowRegister(Reg) && !(HasFP && Reg == FramePtr)) {
+      ScratchRegister = Reg;
+      break;
+    }
+  }
+
+  // LoopTest:
+  //   SUB SP, SP, #ProbeSize
+  emitPrologueEpilogueSPUpdate(*LoopTestMBB, loopTestMBBItr, TII, DL, *RegInfo,
+                               NegProbeSize, ScratchRegister,
+                               MachineInstr::NoFlags);
+
+  //   CMP SP, TargetReg
+  BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::tCMPr))
+      .addReg(ARM::SP)
+      .addReg(TargetReg)
+      .add(predOps(ARMCC::AL));
+
+  //   B.LE LoopExit
+  BuildMI(*LoopTestMBB, LoopTestMBB->end(), DL, TII.get(ARM::tBcc))
+      .addMBB(ExitMBB)
+      .addImm(ARMCC::LE)
+      .addReg(ARM::CPSR);
+
+  //   STR TargetReg, [SP, #StackClashCallerGuard]
+  BuildMI(*LoopBodyMBB, LoopBodyMBB->end(), DL, TII.get(ARM::tSTRi))
+      .addReg(TargetReg)
+      .addReg(ARM::SP)
+      .addImm(ARM::StackClashCallerGuard / 4)
+      .add(predOps(ARMCC::AL));
+
+  //   B loop
+  BuildMI(LoopBodyMBB, DL, TII.get(ARM::tB))
+      .addMBB(LoopTestMBB)
+      .add(predOps(ARMCC::AL));
+
+  // LoopExit:
+  //   MOV SP, TargetReg
+  BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::tMOVr), ARM::SP)
+      .addReg(TargetReg)
+      .add(predOps(ARMCC::AL));
+
+  //   STR TargetReg, [SP, #StackClashCallerGuard]
+  BuildMI(*ExitMBB, ExitMBB->end(), DL, TII.get(ARM::tSTRi))
+      .addReg(TargetReg)
+      .addReg(ARM::SP)
+      .addImm(ARM::StackClashCallerGuard / 4)
+      .add(predOps(ARMCC::AL));
+
+  LoopTestMBB->addSuccessor(ExitMBB);
+  LoopTestMBB->addSuccessor(LoopBodyMBB);
+  LoopBodyMBB->addSuccessor(LoopTestMBB);
+
+  // Synthesize the exit MBB.
+  ExitMBB->splice(ExitMBB->end(), &MBB, std::next(MBBI), MBB.end());
+  ExitMBB->transferSuccessorsAndUpdatePHIs(&MBB);
+  MBB.addSuccessor(LoopTestMBB);
+
+  // Update liveins.
+  if (MF.getRegInfo().reservedRegsFrozen()) {
+    recomputeLiveIns(*LoopTestMBB);
+    recomputeLiveIns(*LoopBodyMBB);
+    recomputeLiveIns(*ExitMBB);
+  }
+
+  return ExitMBB->begin();
+}
+
+MachineBasicBlock::iterator Thumb1FrameLowering::inlineStackProbeVar(
+    MachineFunction &MF, MachineBasicBlock::iterator MBBI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+
+  DebugLoc DL = MBB.findDebugLoc(MBBI);
+  Register TargetReg = MBBI->getOperand(0).getReg();
+  MachineBasicBlock::iterator NextInst = std::next(MBBI);
+
+  NextInst = insertStackProbingLoop(MBBI, TargetReg);
+
+  MBBI->eraseFromParent();
+  return NextInst;
+}
+
+void Thumb1FrameLowering::inlineStackProbe(MachineFunction &MF,
+                                           MachineBasicBlock &MBB) const {
+  for (auto MBBI = MBB.begin(), E = MBB.end(); MBBI != E;) {
+    if (MBBI->getOpcode() == ARM::PROBED_STACKALLOC) {
+      MBBI = inlineStackProbeFixed(MF, MBBI);
+      E = MBBI->getParent()->end();
+    } else if (MBBI->getOpcode() == ARM::PROBED_STACKALLOC_VAR) {
+      MBBI = inlineStackProbeVar(MF, MBBI);
+      E = MBBI->getParent()->end();
+    } else {
+      ++MBBI;
+    }
+  }
+}

llvm/test/CodeGen/ARM/stackProbing_arm.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple arm-eabi-linux < %s -verify-machineinstrs | FileCheck %s
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @large_stack() "probe-stack"="inline-asm" "frame-pointer"="none"{
+; CHECK-LABEL: large_stack:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r5}
+; CHECK-NEXT:    push {r4, r5}
+; CHECK-NEXT:    sub r0, sp, #132
+; CHECK-NEXT:    sub r0, r0, #79872
+; CHECK-NEXT:    .pad #132
+; CHECK-NEXT:    sub sp, sp, #132
+; CHECK-NEXT:    .pad #2048
+; CHECK-NEXT:    sub sp, sp, #2048
+; CHECK-NEXT:  .LBB0_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    .pad #4096
+; CHECK-NEXT:    sub sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    bne .LBB0_1
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    mov r0, #0
+; CHECK-NEXT:    add r1, sp, #4
+; CHECK-NEXT:    str r0, [sp]
+; CHECK-NEXT:    mov r0, #31
+; CHECK-NEXT:    orr r0, r0, #19968
+; CHECK-NEXT:  .LBB0_3: @ %for.cond
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    cmp r2, r0
+; CHECK-NEXT:    bhi .LBB0_5
+; CHECK-NEXT:  @ %bb.4: @ %for.body
+; CHECK-NEXT:    @ in Loop: Header=BB0_3 Depth=1
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    ldr r3, [sp]
+; CHECK-NEXT:    str r2, [r1, r3, lsl #2]
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    add r2, r2, #1
+; CHECK-NEXT:    str r2, [sp]
+; CHECK-NEXT:    b .LBB0_3
+; CHECK-NEXT:  .LBB0_5: @ %for.end
+; CHECK-NEXT:    add sp, sp, #132
+; CHECK-NEXT:    add sp, sp, #79872
+; CHECK-NEXT:    pop {r4, r5}
+; CHECK-NEXT:    mov pc, lr
+entry:
+  %stack = alloca [20000 x i32], align 4
+  %i = alloca i32, align 4
+  store volatile i32 0, ptr %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load volatile i32, ptr %i, align 4
+  %cmp = icmp ult i32 %0, 20000
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  %1 = load volatile i32, ptr %i, align 4
+  %2 = load volatile i32, ptr %i, align 4
+  %arrayidx = getelementptr inbounds [20000 x i32], ptr %stack, i32 0, i32 %2
+  store volatile i32 %1, ptr %arrayidx, align 4
+  br label %for.inc
+
+for.inc:                                          ; preds = %for.body
+  %3 = load volatile i32, ptr %i, align 4
+  %inc = add nsw i32 %3, 1
+  store volatile i32 %inc, ptr %i, align 4
+  br label %for.cond, !llvm.loop !6
+
+for.end:                                          ; preds = %for.cond
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @vla(i32 noundef %n) "probe-stack"="inline-asm" "frame-pointer"="none"{
+; CHECK-LABEL: vla:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r5, r11}
+; CHECK-NEXT:    push {r4, r5, r11}
+; CHECK-NEXT:    .setfp r11, sp, #8
+; CHECK-NEXT:    add r11, sp, #8
+; CHECK-NEXT:    .pad #12
+; CHECK-NEXT:    sub sp, sp, #12
+; CHECK-NEXT:    mov r1, #7
+; CHECK-NEXT:    mov r2, sp
+; CHECK-NEXT:    add r1, r1, r0, lsl #2
+; CHECK-NEXT:    str r0, [r11, #-12]
+; CHECK-NEXT:    bic r1, r1, #7
+; CHECK-NEXT:    str sp, [r11, #-16]
+; CHECK-NEXT:    sub r3, r2, r1
+; CHECK-NEXT:  .LBB1_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    sub sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r3
+; CHECK-NEXT:    ble .LBB1_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB1_1 Depth=1
+; CHECK-NEXT:    str r3, [sp, #1024]
+; CHECK-NEXT:    b .LBB1_1
+; CHECK-NEXT:  .LBB1_3: @ %entry
+; CHECK-NEXT:    mov sp, r3
+; CHECK-NEXT:    str r3, [sp, #1024]
+; CHECK-NEXT:    mov r3, #0
+; CHECK-NEXT:    strb r3, [r2, -r1]
+; CHECK-NEXT:    str r0, [r11, #-20]
+; CHECK-NEXT:    ldr sp, [r11, #-16]
+; CHECK-NEXT:    sub sp, r11, #8
+; CHECK-NEXT:    pop {r4, r5, r11}
+; CHECK-NEXT:    mov pc, lr
+entry:
+  %n.addr = alloca i32, align 4
+  %saved_stack = alloca ptr, align 4
+  %__vla_expr0 = alloca i32, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = call ptr @llvm.stacksave()
+  store ptr %1, ptr %saved_stack, align 4
+  %vla = alloca i32, i32 %0, align 4
+  store i32 %0, ptr %__vla_expr0, align 4
+  %arrayidx = getelementptr inbounds i32, ptr %vla, i32 0
+  call void @llvm.memset.p0.i32(ptr align 4 %arrayidx, i8 0, i32 1, i1 false)
+  %2 = load ptr, ptr %saved_stack, align 4
+  call void @llvm.stackrestore(ptr %2)
+  ret void
+}
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare ptr @llvm.stacksave() #1
+
+; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
+declare void @llvm.memset.p0.i32(ptr nocapture writeonly, i8, i32, i1 immarg) #2
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare void @llvm.stackrestore(ptr) #1
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @builtin_alloca(i32 noundef %n)  "probe-stack"="inline-asm" "frame-pointer"="none"{
+; CHECK-LABEL: builtin_alloca:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r5, r11}
+; CHECK-NEXT:    push {r4, r5, r11}
+; CHECK-NEXT:    .setfp r11, sp, #8
+; CHECK-NEXT:    add r11, sp, #8
+; CHECK-NEXT:    .pad #12
+; CHECK-NEXT:    sub sp, sp, #12
+; CHECK-NEXT:    str r0, [r11, #-12]
+; CHECK-NEXT:    add r0, r0, #7
+; CHECK-NEXT:    bic r0, r0, #7
+; CHECK-NEXT:    sub r0, sp, r0
+; CHECK-NEXT:  .LBB2_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    sub sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    ble .LBB2_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB2_1 Depth=1
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    b .LBB2_1
+; CHECK-NEXT:  .LBB2_3: @ %entry
+; CHECK-NEXT:    mov sp, r0
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    str r0, [r11, #-16]
+; CHECK-NEXT:    sub sp, r11, #8
+; CHECK-NEXT:    pop {r4, r5, r11}
+; CHECK-NEXT:    mov pc, lr
+entry:
+  %n.addr = alloca i32, align 4
+  %mem = alloca ptr, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = alloca i8, i32 %0, align 8
+  store ptr %1, ptr %mem, align 4
+  ret void
+}
+
+attributes #1 = { nocallback nofree nosync nounwind willreturn }
+attributes #2 = { nocallback nofree nounwind willreturn memory(argmem: write) }
+
+!llvm.module.flags = !{!0, !1, !2, !3, !4}
+!llvm.ident = !{!5}
+
+!0 = !{i32 1, !"wchar_size", i32 4}
+!1 = !{i32 1, !"min_enum_size", i32 4}
+!2 = !{i32 8, !"PIC Level", i32 2}
+!3 = !{i32 7, !"PIE Level", i32 2}
+!4 = !{i32 7, !"frame-pointer", i32 2}
+!5 = !{!"clang version 17.0.0 (https://github.com/llvm/llvm-project a1677bda7975a0f690292587a04b9e053aacd1dc)"}
+!6 = distinct !{!6, !7}
+!7 = !{!"llvm.loop.mustprogress"}

llvm/test/CodeGen/ARM/stackProbing_thumb.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc < %s -mtriple=thumb-eabi -mcpu=cortex-m0 -o - | FileCheck %s
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @large_stack() "probe-stack"="inline-asm" "frame-pointer"="none" {
+; CHECK-LABEL: large_stack:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r5, r6, lr}
+; CHECK-NEXT:    push {r4, r5, r6, lr}
+; CHECK-NEXT:    mov r0, sp
+; CHECK-NEXT:    ldr r0, .LCPI0_1
+; CHECK-NEXT:    subs r0, r0, r0
+; CHECK-NEXT:    ldr r1, .LCPI0_2
+; CHECK-NEXT:    add sp, r1
+; CHECK-NEXT:  .LBB0_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r1, .LCPI0_2
+; CHECK-NEXT:    add sp, r1
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    bne .LBB0_1
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    movs r0, #0
+; CHECK-NEXT:    str r0, [sp]
+; CHECK-NEXT:    ldr r0, .LCPI0_0
+; CHECK-NEXT:  .LBB0_3: @ %for.cond
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r1, [sp]
+; CHECK-NEXT:    cmp r1, r0
+; CHECK-NEXT:    bhi .LBB0_5
+; CHECK-NEXT:  @ %bb.4: @ %for.body
+; CHECK-NEXT:    @ in Loop: Header=BB0_3 Depth=1
+; CHECK-NEXT:    ldr r1, [sp]
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    lsls r2, r2, #2
+; CHECK-NEXT:    add r3, sp, #4
+; CHECK-NEXT:    str r1, [r3, r2]
+; CHECK-NEXT:    ldr r1, [sp]
+; CHECK-NEXT:    adds r1, r1, #1
+; CHECK-NEXT:    str r1, [sp]
+; CHECK-NEXT:    b .LBB0_3
+; CHECK-NEXT:  .LBB0_5: @ %for.end
+; CHECK-NEXT:    ldr r6, .LCPI0_1
+; CHECK-NEXT:    add sp, r6
+; CHECK-NEXT:    pop {r4, r5, r6, pc}
+; CHECK-NEXT:    .p2align 2
+; CHECK-NEXT:  @ %bb.6:
+; CHECK-NEXT:  .LCPI0_0:
+; CHECK-NEXT:    .long 19999 @ 0x4e1f
+; CHECK-NEXT:  .LCPI0_1:
+; CHECK-NEXT:    .long 80004 @ 0x13884
+; CHECK-NEXT:  .LCPI0_2:
+; CHECK-NEXT:    .long 4294963200 @ 0xfffff000
+entry:
+  %stack = alloca [20000 x i32], align 4
+  %i = alloca i32, align 4
+  store volatile i32 0, ptr %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load volatile i32, ptr %i, align 4
+  %cmp = icmp ult i32 %0, 20000
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  %1 = load volatile i32, ptr %i, align 4
+  %2 = load volatile i32, ptr %i, align 4
+  %arrayidx = getelementptr inbounds [20000 x i32], ptr %stack, i32 0, i32 %2
+  store volatile i32 %1, ptr %arrayidx, align 4
+  br label %for.inc
+
+for.inc:                                          ; preds = %for.body
+  %3 = load volatile i32, ptr %i, align 4
+  %inc = add nsw i32 %3, 1
+  store volatile i32 %inc, ptr %i, align 4
+  br label %for.cond, !llvm.loop !4
+
+for.end:                                          ; preds = %for.cond
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @vla(i32 noundef %n) "probe-stack"="inline-asm" "frame-pointer"="none"{
+; CHECK-LABEL: vla:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r6, r7, lr}
+; CHECK-NEXT:    push {r4, r6, r7, lr}
+; CHECK-NEXT:    .setfp r7, sp, #8
+; CHECK-NEXT:    add r7, sp, #8
+; CHECK-NEXT:    ldr r1, .LCPI1_0
+; CHECK-NEXT:    add sp, r1
+; CHECK-NEXT:    mov r6, sp
+; CHECK-NEXT:    adds r1, r6, #4
+; CHECK-NEXT:    str r0, [r1, #8]
+; CHECK-NEXT:    mov r2, sp
+; CHECK-NEXT:    str r2, [r1, #4]
+; CHECK-NEXT:    lsls r2, r0, #2
+; CHECK-NEXT:    adds r2, r2, #7
+; CHECK-NEXT:    movs r3, #7
+; CHECK-NEXT:    bics r2, r3
+; CHECK-NEXT:    mov r3, sp
+; CHECK-NEXT:    subs r2, r3, r2
+; CHECK-NEXT:  .LBB1_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r6, .LCPI1_0
+; CHECK-NEXT:    add sp, r6
+; CHECK-NEXT:    cmp sp, r2
+; CHECK-NEXT:    ble .LBB1_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB1_1 Depth=1
+; CHECK-NEXT:    str r2, [sp, #1024]
+; CHECK-NEXT:    b .LBB1_1
+; CHECK-NEXT:  .LBB1_3: @ %entry
+; CHECK-NEXT:    mov sp, r2
+; CHECK-NEXT:    str r2, [sp, #1024]
+; CHECK-NEXT:    movs r3, #0
+; CHECK-NEXT:    strb r3, [r2]
+; CHECK-NEXT:    str r0, [r1]
+; CHECK-NEXT:    ldr r0, [r1, #4]
+; CHECK-NEXT:    mov sp, r0
+; CHECK-NEXT:    subs r4, r7, #7
+; CHECK-NEXT:    subs r4, #1
+; CHECK-NEXT:    mov sp, r4
+; CHECK-NEXT:    pop {r4, r6, r7, pc}
+; CHECK-NEXT:    .p2align 2
+; CHECK-NEXT:  @ %bb.4:
+; CHECK-NEXT:  .LCPI1_0:
+; CHECK-NEXT:    .long 4294963200 @ 0xfffff000
+entry:
+  %n.addr = alloca i32, align 4
+  %saved_stack = alloca ptr, align 4
+  %__vla_expr0 = alloca i32, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = call ptr @llvm.stacksave()
+  store ptr %1, ptr %saved_stack, align 4
+  %vla = alloca i32, i32 %0, align 4
+  store i32 %0, ptr %__vla_expr0, align 4
+  %arrayidx = getelementptr inbounds i32, ptr %vla, i32 0
+  call void @llvm.memset.p0.i32(ptr align 4 %arrayidx, i8 0, i32 1, i1 false)
+  %2 = load ptr, ptr %saved_stack, align 4
+  call void @llvm.stackrestore(ptr %2)
+  ret void
+}
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare ptr @llvm.stacksave() #1
+
+; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
+declare void @llvm.memset.p0.i32(ptr nocapture writeonly, i8, i32, i1 immarg) #2
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare void @llvm.stackrestore(ptr) #1
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @builtin_alloca(i32 noundef %n) "probe-stack"="inline-asm" "frame-pointer"="none"{
+; CHECK-LABEL: builtin_alloca:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r6, r7, lr}
+; CHECK-NEXT:    push {r4, r6, r7, lr}
+; CHECK-NEXT:    .setfp r7, sp, #8
+; CHECK-NEXT:    add r7, sp, #8
+; CHECK-NEXT:    ldr r1, .LCPI2_0
+; CHECK-NEXT:    add sp, r1
+; CHECK-NEXT:    mov r6, sp
+; CHECK-NEXT:    mov r1, r6
+; CHECK-NEXT:    str r0, [r1, #4]
+; CHECK-NEXT:    adds r0, r0, #7
+; CHECK-NEXT:    movs r2, #7
+; CHECK-NEXT:    bics r0, r2
+; CHECK-NEXT:    mov r2, sp
+; CHECK-NEXT:    subs r0, r2, r0
+; CHECK-NEXT:  .LBB2_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r6, .LCPI2_0
+; CHECK-NEXT:    add sp, r6
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    ble .LBB2_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB2_1 Depth=1
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    b .LBB2_1
+; CHECK-NEXT:  .LBB2_3: @ %entry
+; CHECK-NEXT:    mov sp, r0
+; CHECK-NEXT:    str r0, [sp, #1024]
+; CHECK-NEXT:    str r0, [r1]
+; CHECK-NEXT:    subs r4, r7, #7
+; CHECK-NEXT:    subs r4, #1
+; CHECK-NEXT:    mov sp, r4
+; CHECK-NEXT:    pop {r4, r6, r7, pc}
+; CHECK-NEXT:    .p2align 2
+; CHECK-NEXT:  @ %bb.4:
+; CHECK-NEXT:  .LCPI2_0:
+; CHECK-NEXT:    .long 4294963200 @ 0xfffff000
+entry:
+  %n.addr = alloca i32, align 4
+  %mem = alloca ptr, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = alloca i8, i32 %0, align 8
+  store ptr %1, ptr %mem, align 4
+  ret void
+}
+
+attributes #1 = { nocallback nofree nosync nounwind willreturn }
+attributes #2 = { nocallback nofree nounwind willreturn memory(argmem: write) }
+
+!llvm.module.flags = !{!0, !1, !2}
+!llvm.ident = !{!3}
+
+!0 = !{i32 1, !"wchar_size", i32 4}
+!1 = !{i32 1, !"min_enum_size", i32 4}
+!2 = !{i32 7, !"frame-pointer", i32 2}
+!3 = !{!"clang version 17.0.0 (https://github.com/llvm/llvm-project a1677bda7975a0f690292587a04b9e053aacd1dc)"}
+!4 = distinct !{!4, !5}
+!5 = !{!"llvm.loop.mustprogress"}

llvm/test/CodeGen/Thumb2/stackProbing_thumb2.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 2
+; RUN: llc -mtriple thumbv8.1m.main-none-linux-eabi < %s -verify-machineinstrs | FileCheck %s
+; Function Attrs: noinline nounwind optnone
+define dso_local void @large_stack() "probe-stack"="inline-asm" "frame-pointer"="none" {
+; CHECK-LABEL: large_stack:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r5}
+; CHECK-NEXT:    push {r4, r5}
+; CHECK-NEXT:    sub.w r0, sp, #79872
+; CHECK-NEXT:    subs r0, #132
+; CHECK-NEXT:    .pad #2180
+; CHECK-NEXT:    subw sp, sp, #2180
+; CHECK-NEXT:  .LBB0_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    .pad #4096
+; CHECK-NEXT:    sub.w sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    str.w r0, [sp, #1024]
+; CHECK-NEXT:    bne .LBB0_1
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    movs r0, #0
+; CHECK-NEXT:    add r1, sp, #4
+; CHECK-NEXT:    str r0, [sp]
+; CHECK-NEXT:    movw r0, #19999
+; CHECK-NEXT:  .LBB0_3: @ %for.cond
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    cmp r2, r0
+; CHECK-NEXT:    bhi .LBB0_5
+; CHECK-NEXT:  @ %bb.4: @ %for.body
+; CHECK-NEXT:    @ in Loop: Header=BB0_3 Depth=1
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    ldr r3, [sp]
+; CHECK-NEXT:    str.w r2, [r1, r3, lsl #2]
+; CHECK-NEXT:    ldr r2, [sp]
+; CHECK-NEXT:    adds r2, #1
+; CHECK-NEXT:    str r2, [sp]
+; CHECK-NEXT:    b .LBB0_3
+; CHECK-NEXT:  .LBB0_5: @ %for.end
+; CHECK-NEXT:    add.w sp, sp, #79872
+; CHECK-NEXT:    add sp, #132
+; CHECK-NEXT:    pop {r4, r5}
+; CHECK-NEXT:    bx lr
+entry:
+  %stack = alloca [20000 x i32], align 4
+  %i = alloca i32, align 4
+  store volatile i32 0, ptr %i, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %0 = load volatile i32, ptr %i, align 4
+  %cmp = icmp ult i32 %0, 20000
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  %1 = load volatile i32, ptr %i, align 4
+  %2 = load volatile i32, ptr %i, align 4
+  %arrayidx = getelementptr inbounds [20000 x i32], ptr %stack, i32 0, i32 %2
+  store volatile i32 %1, ptr %arrayidx, align 4
+  br label %for.inc
+
+for.inc:                                          ; preds = %for.body
+  %3 = load volatile i32, ptr %i, align 4
+  %inc = add nsw i32 %3, 1
+  store volatile i32 %inc, ptr %i, align 4
+  br label %for.cond, !llvm.loop !6
+
+for.end:                                          ; preds = %for.cond
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @vla(i32 noundef %n) "probe-stack"="inline-asm" "frame-pointer"="none" {
+; CHECK-LABEL: vla:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r6, r7, lr}
+; CHECK-NEXT:    push {r4, r6, r7, lr}
+; CHECK-NEXT:    .setfp r7, sp, #8
+; CHECK-NEXT:    add r7, sp, #8
+; CHECK-NEXT:    .pad #16
+; CHECK-NEXT:    sub sp, #16
+; CHECK-NEXT:    movs r1, #7
+; CHECK-NEXT:    str r0, [r7, #-12]
+; CHECK-NEXT:    add.w r1, r1, r0, lsl #2
+; CHECK-NEXT:    str sp, [r7, #-16]
+; CHECK-NEXT:    bic r1, r1, #7
+; CHECK-NEXT:    sub.w r1, sp, r1
+; CHECK-NEXT:  .LBB1_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    .pad #4096
+; CHECK-NEXT:    sub.w sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r1
+; CHECK-NEXT:    ble .LBB1_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB1_1 Depth=1
+; CHECK-NEXT:    str.w r1, [sp, #1024]
+; CHECK-NEXT:    b .LBB1_1
+; CHECK-NEXT:  .LBB1_3: @ %entry
+; CHECK-NEXT:    mov sp, r1
+; CHECK-NEXT:    movs r2, #0
+; CHECK-NEXT:    str.w r1, [sp, #1024]
+; CHECK-NEXT:    strb r2, [r1]
+; CHECK-NEXT:    str r0, [r7, #-20]
+; CHECK-NEXT:    ldr sp, [r7, #-16]
+; CHECK-NEXT:    sub.w r4, r7, #8
+; CHECK-NEXT:    mov sp, r4
+; CHECK-NEXT:    pop {r4, r6, r7, pc}
+entry:
+  %n.addr = alloca i32, align 4
+  %saved_stack = alloca ptr, align 4
+  %__vla_expr0 = alloca i32, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = call ptr @llvm.stacksave()
+  store ptr %1, ptr %saved_stack, align 4
+  %vla = alloca i32, i32 %0, align 4
+  store i32 %0, ptr %__vla_expr0, align 4
+  %arrayidx = getelementptr inbounds i32, ptr %vla, i32 0
+  call void @llvm.memset.p0.i32(ptr align 4 %arrayidx, i8 0, i32 1, i1 false)
+  %2 = load ptr, ptr %saved_stack, align 4
+  call void @llvm.stackrestore(ptr %2)
+  ret void
+}
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare ptr @llvm.stacksave() #1
+
+; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
+declare void @llvm.memset.p0.i32(ptr nocapture writeonly, i8, i32, i1 immarg) #2
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare void @llvm.stackrestore(ptr) #1
+
+; Function Attrs: noinline nounwind optnone
+define dso_local void @builtin_alloca(i32 noundef %n) "probe-stack"="inline-asm" "frame-pointer"="none" {
+; CHECK-LABEL: builtin_alloca:
+; CHECK:       @ %bb.0: @ %entry
+; CHECK-NEXT:    .save {r4, r6, r7, lr}
+; CHECK-NEXT:    push {r4, r6, r7, lr}
+; CHECK-NEXT:    .setfp r7, sp, #8
+; CHECK-NEXT:    add r7, sp, #8
+; CHECK-NEXT:    .pad #8
+; CHECK-NEXT:    sub sp, #8
+; CHECK-NEXT:    str r0, [r7, #-12]
+; CHECK-NEXT:    adds r0, #7
+; CHECK-NEXT:    bic r0, r0, #7
+; CHECK-NEXT:    sub.w r0, sp, r0
+; CHECK-NEXT:  .LBB2_1: @ %entry
+; CHECK-NEXT:    @ =>This Inner Loop Header: Depth=1
+; CHECK-NEXT:    .pad #4096
+; CHECK-NEXT:    sub.w sp, sp, #4096
+; CHECK-NEXT:    cmp sp, r0
+; CHECK-NEXT:    ble .LBB2_3
+; CHECK-NEXT:  @ %bb.2: @ %entry
+; CHECK-NEXT:    @ in Loop: Header=BB2_1 Depth=1
+; CHECK-NEXT:    str.w r0, [sp, #1024]
+; CHECK-NEXT:    b .LBB2_1
+; CHECK-NEXT:  .LBB2_3: @ %entry
+; CHECK-NEXT:    mov sp, r0
+; CHECK-NEXT:    sub.w r4, r7, #8
+; CHECK-NEXT:    str.w r0, [sp, #1024]
+; CHECK-NEXT:    str r0, [r7, #-16]
+; CHECK-NEXT:    mov sp, r4
+; CHECK-NEXT:    pop {r4, r6, r7, pc}
+entry:
+  %n.addr = alloca i32, align 4
+  %mem = alloca ptr, align 4
+  store i32 %n, ptr %n.addr, align 4
+  %0 = load i32, ptr %n.addr, align 4
+  %1 = alloca i8, i32 %0, align 8
+  store ptr %1, ptr %mem, align 4
+  ret void
+}
+
+attributes #1 = { nocallback nofree nosync nounwind willreturn }
+attributes #2 = { nocallback nofree nounwind willreturn memory(argmem: write) }
+
+!llvm.module.flags = !{!0, !1, !2, !3, !4}
+!llvm.ident = !{!5}
+
+!0 = !{i32 1, !"wchar_size", i32 4}
+!1 = !{i32 1, !"min_enum_size", i32 4}
+!2 = !{i32 8, !"PIC Level", i32 2}
+!3 = !{i32 7, !"PIE Level", i32 2}
+!4 = !{i32 7, !"frame-pointer", i32 2}
+!5 = !{!"clang version 17.0.0 (https://github.com/llvm/llvm-project a1677bda7975a0f690292587a04b9e053aacd1dc)"}
+!6 = distinct !{!6, !7}
+!7 = !{!"llvm.loop.mustprogress"}