[ARM] Generate consistent frame records for Thumb2

[olista01]

Summary

There is not an official documented ABI for frame pointers in Thumb2,
but we should try to emit something which is useful.

We use r7 as the frame pointer for Thumb code, which currently means
that if a function needs to save a high register (r8-r11), it will get
pushed to the stack between the frame pointer (r7) and link register
(r14). This means that while a stack unwinder can follow the chain of
frame pointers up the stack, it cannot know the offset to lr, so does
not know which functions correspond to the stack frames.

To fix this, we need to push the callee-saved registers in two batches,
with the first push saving the low registers, fp and lr, and the second
push saving the high registers. This is already implemented, but
previously only used for iOS. This patch turns it on for all Thumb2
targets when frame pointers are required by the ABI, and the frame
pointer is r7 (Windows uses r11, so this isn't a problem there). If
frame pointer elimination is enabled we still emit a single push/pop
even if we need a frame pointer for other reasons, to avoid increasing
code size.

We must also ensure that lr is pushed to the stack when using a frame
pointer, so that we end up with a complete frame record. Situations that
could cause this were rare, because we already push lr in most
situations so that we can return using the pop instruction.

@Tim, or anyone who knows about the Apple ARM calling convention:
There is existing code to force a frame pointer and enable split push/pop when
using the Apple ABI (documented at
https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html).
However, the code to do this is spread across several functions, and the exact
conditions under which is enabled are different. I've found these different
conditions:

• isTargetIOS() || isTargetWatchOS() // In ARMFrameLowering::hasFP
• isTargetMachO() // In ARMSubtarget::splitFramePushPop
• isTargetDarwin() // In ARMBaseRegisterInfo::getCalleeSavedRegs

Which of these conditions is correct? I've left these as they are for now, but
we should probably clear this up. I found one test, ifcvt-iter-indbr.ll, which
used a thumbv7s-apple-darwin triple, which currently (before and after this
patch) causes the split push/pop to be used, but does still allow the frame
pointer to be optimised out.

[t.p.northover]

I've found these different conditions:

• isTargetIOS() || isTargetWatchOS() // In ARMFrameLowering::hasFP
• isTargetMachO() // In ARMSubtarget::splitFramePushPop
• isTargetDarwin() // In ARMBaseRegisterInfo::getCalleeSavedRegs

Oh dear, that is a bit of a mess! I think we might be trying too hard to support the current situation.

The iOS special snowflake code seems to be basically a hack to ignore -fomit-frame-pointer (I spoke to Jim about this, and the best we could work out was that it might have been a workaround for an llvm-gcc limitation, never revisited since Clang came along).

With that removed, we seem to be left with something that's basically a duplicate of noFramePointerElim (just above your hasABIFP). If you simplify this, I'll put together a Clang patch to ignore and warn about -fomit-frame-pointer on iOS & watchOS.

[olista01]

I can remove the iOS || WatchOS check in ARMFrameLowering::hasFP (and add the "no-frame-pointer-elim" attribute to all the iOS/WatchOS tests).

However, what about the checks that enable the split push/pop, in ARMSubtarget::splitFramePushPop and ARMBaseRegisterInfo::getCalleeSavedRegs? These currently check a mixture of isMachO and isDarwin, but the comments and name of the callee-saved reg list mention iOS. Which of these is correct?

[olista01]

• Removed hasABIFP, use DisableFramePointerElim instead.
• Removed special cases for iOS and WatchOS, the "no-frame-pointer-elim" attribute should be set by the frontend instead.
• R7 is now the frame pointer for Darwin, rather than MachO, and split stacks are enabled iff the frame pointer is r7.
• Fix up a lot of tests affected by the iOS/WatchOS change. Most of these were just a case of adding the "no-frame-pointer-elim" attribute, but there were a few cases testing the codegen differences with/without frame pointers, which needed changing.
• Rolled D23517 into this patch, as that was the original behaviour on iOS/WatchOS, and it wouldn't be possible to replicate the original iOS behaviour without D23517.

[t.p.northover]

Thanks Oliver. Looks nice and neat to me now! I'll work on making Clang ignore -fomit-frame-pointer for Darwin.

lib/Target/ARM/ARMBaseRegisterInfo.cpp

 #include "ARMGenRegisterInfo.inc"
 
 using namespace llvm;
 
 ARMBaseRegisterInfo::ARMBaseRegisterInfo()
     : ARMGenRegisterInfo(ARM::LR, 0, 0, ARM::PC), BasePtr(ARM::R6) {}
 
 static unsigned getFramePointerReg(const ARMSubtarget &STI) {
-  if (STI.isTargetMachO())
-    return ARM::R7;
-  else if (STI.isTargetWindows())
-    return ARM::R11;
-  else // ARM EABI
-    return STI.isThumb() ? ARM::R7 : ARM::R11;
+  return STI.useR7AsFramePointer() ? ARM::R7 : ARM::R11;
 }
 
 const MCPhysReg*
 ARMBaseRegisterInfo::getCalleeSavedRegs(const MachineFunction *MF) const {
   const ARMSubtarget &STI = MF->getSubtarget<ARMSubtarget>();
-  bool UseSplitPush = STI.splitFramePushPop();
+  bool UseSplitPush = STI.splitFramePushPop(*MF);
   const MCPhysReg *RegList =
       STI.isTargetDarwin()
           ? CSR_iOS_SaveList
           : (UseSplitPush ? CSR_AAPCS_SplitPush_SaveList : CSR_AAPCS_SaveList);
 
   const Function *F = MF->getFunction();
   if (F->getCallingConv() == CallingConv::GHC) {
     // GHC set of callee saved regs is empty as all those regs are

lib/Target/ARM/ARMFrameLowering.h

public:
 
   bool restoreCalleeSavedRegisters(MachineBasicBlock &MBB,
                                   MachineBasicBlock::iterator MI,
                                   const std::vector<CalleeSavedInfo> &CSI,
                                   const TargetRegisterInfo *TRI) const override;
 
   bool noFramePointerElim(const MachineFunction &MF) const override;
 
+  bool hasABIFP(const MachineFunction &MF) const;
   bool hasFP(const MachineFunction &MF) const override;
   bool hasReservedCallFrame(const MachineFunction &MF) const override;
   bool canSimplifyCallFramePseudos(const MachineFunction &MF) const override;
   int getFrameIndexReference(const MachineFunction &MF, int FI,
                              unsigned &FrameReg) const override;
   int ResolveFrameIndexReference(const MachineFunction &MF, int FI,
                                  unsigned &FrameReg, int SPAdj) const;
 

lib/Target/ARM/ARMFrameLowering.cpp

 bool ARMFrameLowering::noFramePointerElim(const MachineFunction &MF) const {
   // iOS always has a FP for backtracking, force other targets to keep their FP
   // when doing FastISel. The emitted code is currently superior, and in cases
   // like test-suite's lencod FastISel isn't quite correct when FP is eliminated.
   return TargetFrameLowering::noFramePointerElim(MF) ||
          MF.getSubtarget<ARMSubtarget>().useFastISel();
 }
 
+/// hasABIFP - Return true if the specified function should have a dedicated
+/// frame pointer register, which must be compliant with the ABI. This is
+/// true if frame pointer elimination is disabled for this function, and means
+/// that the compiler may not change the layout of the frame record, and must
+/// ensure that the frame pointer register is always valid.
+bool ARMFrameLowering::hasABIFP(const MachineFunction &MF) const {
+  // iOS requires FP not to be clobbered for backtracing purpose.
+  return (STI.isTargetIOS() ||
+          STI.isTargetWatchOS() ||
+          MF.getTarget().Options.DisableFramePointerElim(MF));
+}
+
 /// hasFP - Return true if the specified function should have a dedicated frame
 /// pointer register.  This is true if the function has variable sized allocas
 /// or if frame pointer elimination is disabled.
 bool ARMFrameLowering::hasFP(const MachineFunction &MF) const {
   const TargetRegisterInfo *RegInfo = MF.getSubtarget().getRegisterInfo();
 
-  // iOS requires FP not to be clobbered for backtracing purpose.
-  if (STI.isTargetIOS() || STI.isTargetWatchOS())
+  // ABI-required frame pointer.
+  if (hasABIFP(MF))
     return true;
 
   const MachineFrameInfo &MFI = MF.getFrameInfo();
   // Always eliminate non-leaf frame pointers.
   return ((MF.getTarget().Options.DisableFramePointerElim(MF) &&
            MFI.hasCalls()) ||
           RegInfo->needsStackRealignment(MF) ||
           MFI.hasVarSizedObjects() ||
for (unsigned i = 0, e = CSI.size(); i != e; ++i) {
     unsigned Reg = CSI[i].getReg();
     int FI = CSI[i].getFrameIdx();
     switch (Reg) {
     case ARM::R8:
     case ARM::R9:
     case ARM::R10:
     case ARM::R11:
     case ARM::R12:
-      if (STI.splitFramePushPop()) {
+      if (STI.splitFramePushPop(MF)) {
         GPRCS2Size += 4;
         break;
       }
       // fallthrough
     case ARM::R0:
     case ARM::R1:
     case ARM::R2:
     case ARM::R3:
for (const auto &Entry : CSI) {
       unsigned Reg = Entry.getReg();
       int FI = Entry.getFrameIdx();
       switch (Reg) {
       case ARM::R8:
       case ARM::R9:
       case ARM::R10:
       case ARM::R11:
       case ARM::R12:
-        if (STI.splitFramePushPop())
+        if (STI.splitFramePushPop(MF))
           break;
         // fallthrough
       case ARM::R0:
       case ARM::R1:
       case ARM::R2:
       case ARM::R3:
       case ARM::R4:
       case ARM::R5:
for (const auto &Entry : CSI) {
       unsigned Reg = Entry.getReg();
       int FI = Entry.getFrameIdx();
       switch (Reg) {
       case ARM::R8:
       case ARM::R9:
       case ARM::R10:
       case ARM::R11:
       case ARM::R12:
-        if (STI.splitFramePushPop()) {
+        if (STI.splitFramePushPop(MF)) {
           unsigned DwarfReg =  MRI->getDwarfRegNum(Reg, true);
           unsigned Offset = MFI.getObjectOffset(FI);
           unsigned CFIIndex = MMI.addFrameInst(
               MCCFIInstruction::createOffset(nullptr, DwarfReg, Offset));
           BuildMI(MBB, Pos, dl, TII.get(TargetOpcode::CFI_INSTRUCTION))
               .addCFIIndex(CFIIndex)
               .setMIFlags(MachineInstr::FrameSetup);
         }
void ARMFrameLowering::emitPushInst(MachineBasicBlock &MBB,
   DebugLoc DL;
 
   SmallVector<std::pair<unsigned,bool>, 4> Regs;
   unsigned i = CSI.size();
   while (i != 0) {
     unsigned LastReg = 0;
     for (; i != 0; --i) {
       unsigned Reg = CSI[i-1].getReg();
-      if (!(Func)(Reg, STI.splitFramePushPop())) continue;
+      if (!(Func)(Reg, STI.splitFramePushPop(MF))) continue;
 
       // D-registers in the aligned area DPRCS2 are NOT spilled here.
       if (Reg >= ARM::D8 && Reg < ARM::D8 + NumAlignedDPRCS2Regs)
         continue;
 
       bool isLiveIn = MF.getRegInfo().isLiveIn(Reg);
       if (!isLiveIn)
         MBB.addLiveIn(Reg);
void ARMFrameLowering::emitPopInst(MachineBasicBlock &MBB,
 
   SmallVector<unsigned, 4> Regs;
   unsigned i = CSI.size();
   while (i != 0) {
     unsigned LastReg = 0;
     bool DeleteRet = false;
     for (; i != 0; --i) {
       unsigned Reg = CSI[i-1].getReg();
-      if (!(Func)(Reg, STI.splitFramePushPop())) continue;
+      if (!(Func)(Reg, STI.splitFramePushPop(MF))) continue;
 
       // The aligned reloads from area DPRCS2 are not inserted here.
       if (Reg >= ARM::D8 && Reg < ARM::D8 + NumAlignedDPRCS2Regs)
         continue;
 
       if (Reg == ARM::LR && !isTailCall && !isVarArg && !isInterrupt &&
           !isTrap && STI.hasV5TOps()) {
         if (MBB.succ_empty()) {
if (!ARM::GPRRegClass.contains(Reg)) {
           NumFPRSpills += 4;
       }
       continue;
     }
 
     if (Spilled) {
       NumGPRSpills++;
 
-      if (!STI.splitFramePushPop()) {
+      if (!STI.splitFramePushPop(MF)) {
         if (Reg == ARM::LR)
           LRSpilled = true;
         CS1Spilled = true;
         continue;
       }
 
       // Keep track if LR and any of R4, R5, R6, and R7 is spilled.
       switch (Reg) {
       case ARM::LR:
         LRSpilled = true;
         // Fallthrough
       case ARM::R0: case ARM::R1:
       case ARM::R2: case ARM::R3:
       case ARM::R4: case ARM::R5:
       case ARM::R6: case ARM::R7:
         CS1Spilled = true;
         break;
       default:
         break;
       }
     } else {
-      if (!STI.splitFramePushPop()) {
+      if (!STI.splitFramePushPop(MF)) {
         UnspilledCS1GPRs.push_back(Reg);
         continue;
       }
 
       switch (Reg) {
       case ARM::R0: case ARM::R1:
       case ARM::R2: case ARM::R3:
       case ARM::R4: case ARM::R5:
void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
 
   bool BigStack = EstimatedStackSize >= estimateRSStackSizeLimit(MF, this) ||
                   MFI.hasVarSizedObjects() ||
                   (MFI.adjustsStack() && !canSimplifyCallFramePseudos(MF));
   bool ExtraCSSpill = false;
   if (BigStack || !CanEliminateFrame || RegInfo->cannotEliminateFrame(MF)) {
     AFI->setHasStackFrame(true);
 
+    if (hasFP(MF)) {
+      SavedRegs.set(FramePtr);
+      // If the frame pointer is required by the ABI, also spill LR so that we
+      // emit a complete frame record.
+      if (hasABIFP(MF) && !LRSpilled) {
+        SavedRegs.set(ARM::LR);
+        LRSpilled = true;
+        NumGPRSpills++;
+      }
+      auto FPPos = find(UnspilledCS1GPRs, FramePtr);
+      if (FPPos != UnspilledCS1GPRs.end())
+        UnspilledCS1GPRs.erase(FPPos);
+      NumGPRSpills++;
+      if (FramePtr == ARM::R7)
+        CS1Spilled = true;
+    }
+
     // If LR is not spilled, but at least one of R4, R5, R6, and R7 is spilled.
     // Spill LR as well so we can fold BX_RET to the registers restore (LDM).
     if (!LRSpilled && CS1Spilled) {
       SavedRegs.set(ARM::LR);
       NumGPRSpills++;
       SmallVectorImpl<unsigned>::iterator LRPos;
       LRPos = find(UnspilledCS1GPRs, (unsigned)ARM::LR);
       if (LRPos != UnspilledCS1GPRs.end())
         UnspilledCS1GPRs.erase(LRPos);
 
       ForceLRSpill = false;
       ExtraCSSpill = true;
     }
 
-    if (hasFP(MF)) {
-      SavedRegs.set(FramePtr);
-      auto FPPos = find(UnspilledCS1GPRs, FramePtr);
-      if (FPPos != UnspilledCS1GPRs.end())
-        UnspilledCS1GPRs.erase(FPPos);
-      NumGPRSpills++;
-    }
-
     // If stack and double are 8-byte aligned and we are spilling an odd number
     // of GPRs, spill one extra callee save GPR so we won't have to pad between
     // the integer and double callee save areas.
     unsigned TargetAlign = getStackAlignment();
     if (TargetAlign >= 8 && (NumGPRSpills & 1)) {
       if (CS1Spilled && !UnspilledCS1GPRs.empty()) {
         for (unsigned i = 0, e = UnspilledCS1GPRs.size(); i != e; ++i) {
           unsigned Reg = UnspilledCS1GPRs[i];

lib/Target/ARM/ARMSubtarget.h

public:
   bool isMClass() const { return ARMProcClass == MClass; }
   bool isRClass() const { return ARMProcClass == RClass; }
   bool isAClass() const { return ARMProcClass == AClass; }
 
   bool isR9Reserved() const {
     return isTargetMachO() ? (ReserveR9 || !HasV6Ops) : ReserveR9;
   }
 
+  bool useR7AsFramePointer() const {
+    return isTargetMachO() || (!isTargetWindows() && isThumb());
+  }
   /// Returns true if the frame setup is split into two separate pushes (first
   /// r0-r7,lr then r8-r11), principally so that the frame pointer is adjacent
   /// to lr.
-  bool splitFramePushPop() const {
-    return isTargetMachO();
+  bool splitFramePushPop(const MachineFunction &MF) const {
+    // iOS always uses split push/pop
+    if (isTargetMachO())
+      return true;
+
+    // For other targets, we use split push/pop if the frame pointer is r7, and
+    // we are required to emit an ABI-compliant frame record.
+    return useR7AsFramePointer() && getFrameLowering()->hasABIFP(MF);
   }
 
   bool useStride4VFPs(const MachineFunction &MF) const;
 
   bool useMovt(const MachineFunction &MF) const;
 
   bool supportsTailCall() const { return SupportsTailCall; }
 

lib/Target/ARM/Thumb1FrameLowering.cpp

void Thumb1FrameLowering::emitPrologue(MachineFunction &MF,
   for (unsigned i = 0, e = CSI.size(); i != e; ++i) {
     unsigned Reg = CSI[i].getReg();
     int FI = CSI[i].getFrameIdx();
     switch (Reg) {
     case ARM::R8:
     case ARM::R9:
     case ARM::R10:
     case ARM::R11:
-      if (STI.splitFramePushPop()) {
+      if (STI.splitFramePushPop(MF)) {
         GPRCS2Size += 4;
         break;
       }
       // fallthrough
     case ARM::R4:
     case ARM::R5:
     case ARM::R6:
     case ARM::R7:
for (std::vector<CalleeSavedInfo>::const_iterator I = CSI.begin(),
     unsigned Reg = I->getReg();
     int FI = I->getFrameIdx();
     switch (Reg) {
     case ARM::R8:
     case ARM::R9:
     case ARM::R10:
     case ARM::R11:
     case ARM::R12:
-      if (STI.splitFramePushPop())
+      if (STI.splitFramePushPop(MF))
         break;
       // fallthough
     case ARM::R0:
     case ARM::R1:
     case ARM::R2:
     case ARM::R3:
     case ARM::R4:
     case ARM::R5:

test/CodeGen/ARM/debug-frame-large-stack.ll

 
 define void @test2() {
     %tmp = alloca [ 4168 x i8 ] , align 4
     ret void
 }
 
 ; CHECK-ARM-LABEL: test2:
 ; CHECK-ARM: .cfi_startproc
-; CHECK-ARM: push    {r4, r5}
-; CHECK-ARM: .cfi_def_cfa_offset 8
-; CHECK-ARM: .cfi_offset r5, -4
-; CHECK-ARM: .cfi_offset r4, -8
+; CHECK-ARM: push    {r4, r5, r11, lr}
+; CHECK-ARM: .cfi_def_cfa_offset 16
+; CHECK-ARM: .cfi_offset lr, -4
+; CHECK-ARM: .cfi_offset r11, -8
+; CHECK-ARM: .cfi_offset r5, -12
+; CHECK-ARM: .cfi_offset r4, -16
+; CHECK-ARM: add    r11, sp, #8
+; CHECK-ARM: .cfi_def_cfa r11, 8
 ; CHECK-ARM: sub    sp, sp, #72
 ; CHECK-ARM: sub    sp, sp, #4096
-; CHECK-ARM: .cfi_def_cfa_offset 4176
 ; CHECK-ARM: .cfi_endproc
 
 ; CHECK-ARM-FP_ELIM-LABEL: test2:
 ; CHECK-ARM-FP_ELIM: .cfi_startproc
 ; CHECK-ARM-FP_ELIM: push    {r4, r5}
 ; CHECK-ARM-FP_ELIM: .cfi_def_cfa_offset 8
 ; CHECK-ARM-FP_ELIM: .cfi_offset 54, -4
 ; CHECK-ARM-FP_ELIM: .cfi_offset r4, -8
 ; CHECK-ARM-FP_ELIM: sub    sp, sp, #72
 ; CHECK-ARM-FP_ELIM: sub    sp, sp, #4096
 ; CHECK-ARM-FP_ELIM: .cfi_def_cfa_offset 4176
 ; CHECK-ARM-FP_ELIM: .cfi_endproc
 
 define i32 @test3() {
   %retval = alloca i32, align 4
   %tmp = alloca i32, align 4
   %a = alloca [805306369 x i8], align 16
   store i32 0, i32* %tmp
   %tmp1 = load i32, i32* %tmp
         ret i32 %tmp1
 }
 
 ; CHECK-ARM-LABEL: test3:
 ; CHECK-ARM: .cfi_startproc
-; CHECK-ARM: push    {r4, r5, r11}
-; CHECK-ARM: .cfi_def_cfa_offset 12
-; CHECK-ARM: .cfi_offset r11, -4
-; CHECK-ARM: .cfi_offset r5, -8
-; CHECK-ARM: .cfi_offset r4, -12
+; CHECK-ARM: push    {r4, r5, r11, lr}
+; CHECK-ARM: .cfi_def_cfa_offset 16
+; CHECK-ARM: .cfi_offset lr, -4
+; CHECK-ARM: .cfi_offset r11, -8
+; CHECK-ARM: .cfi_offset r5, -12
+; CHECK-ARM: .cfi_offset r4, -16
 ; CHECK-ARM: add    r11, sp, #8
-; CHECK-ARM: .cfi_def_cfa r11, 4
-; CHECK-ARM: sub    sp, sp, #20
+; CHECK-ARM: .cfi_def_cfa r11, 8
+; CHECK-ARM: sub    sp, sp, #16
 ; CHECK-ARM: sub    sp, sp, #805306368
 ; CHECK-ARM: bic    sp, sp, #15
 ; CHECK-ARM: .cfi_endproc
 
 ; CHECK-ARM-FP-ELIM-LABEL: test3:
 ; CHECK-ARM-FP-ELIM: .cfi_startproc
 ; CHECK-ARM-FP-ELIM: push    {r4, r5, r11}
 ; CHECK-ARM-FP-ELIM: .cfi_def_cfa_offset 12

test/CodeGen/ARM/dwarf-unwind.ll

; CHECK: pop.w {r4, r5, r6, r7, r8, r9, r10, r11, pc}
   alloca i64
   call void asm sideeffect "", "~{r4},~{r5},~{r6},~{r7},~{r8},~{r9},~{r10},~{r11}"()
   call void @bar()
   ret void
 }
 
 define void @test_frame_pointer_offset() minsize "no-frame-pointer-elim"="true" {
 ; CHECK-LABEL: test_frame_pointer_offset:
-; CHECK: push.w {r3, r4, r5, r6, r7, r8, r9, r10, r11, lr}
-; CHECK: .cfi_def_cfa_offset 40
-; CHECK: add r7, sp, #16
-; CHECK: .cfi_def_cfa r7, 24
+; CHECK: push {r4, r5, r6, r7, lr}
+; CHECK: .cfi_def_cfa_offset 20
+; CHECK: add r7, sp, #12
+; CHECK: .cfi_def_cfa r7, 8
+; CHECK-NOT: .cfi_def_cfa_offset
+; CHECK: push.w {r7, r8, r9, r10, r11}
 ; CHECK-NOT: .cfi_def_cfa_offset
   call void asm sideeffect "", "~{r4},~{r5},~{r6},~{r7},~{r8},~{r9},~{r10},~{r11},~{d8}"()
   call void @bar()
   ret void
-}
+}
 

test/CodeGen/ARM/fast-isel-frameaddr.ll

 ; RUN: llc < %s -O0 -verify-machineinstrs -fast-isel-abort=1 -mtriple=armv7-apple-ios | FileCheck %s --check-prefix=DARWIN-ARM
 ; RUN: llc < %s -O0 -verify-machineinstrs -fast-isel-abort=1 -mtriple=armv7-linux-gnueabi | FileCheck %s --check-prefix=LINUX-ARM
 ; RUN: llc < %s -O0 -verify-machineinstrs -fast-isel-abort=1 -mtriple=thumbv7-apple-ios | FileCheck %s --check-prefix=DARWIN-THUMB2
 ; RUN: llc < %s -O0 -verify-machineinstrs -fast-isel-abort=1 -mtriple=thumbv7-linux-gnueabi | FileCheck %s --check-prefix=LINUX-THUMB2
 
 define i8* @frameaddr_index0() nounwind {
 entry:
 ; DARWIN-ARM-LABEL: frameaddr_index0:
-; DARWIN-ARM: push {r7}
+; DARWIN-ARM: push {r7, lr}
 ; DARWIN-ARM: mov r7, sp
 ; DARWIN-ARM: mov r0, r7
 
 ; DARWIN-THUMB2-LABEL: frameaddr_index0:
-; DARWIN-THUMB2: str r7, [sp, #-4]!
+; DARWIN-THUMB2: push {r7, lr}
 ; DARWIN-THUMB2: mov r7, sp
 ; DARWIN-THUMB2: mov r0, r7
 
 ; LINUX-ARM-LABEL: frameaddr_index0:
-; LINUX-ARM: push {r11}
+; LINUX-ARM: push {r11, lr}
 ; LINUX-ARM: mov r11, sp
 ; LINUX-ARM: mov r0, r11
 
 ; LINUX-THUMB2-LABEL: frameaddr_index0:
-; LINUX-THUMB2: str r7, [sp, #-4]!
+; LINUX-THUMB2: push {r7, lr}
 ; LINUX-THUMB2: mov r7, sp
 ; LINUX-THUMB2: mov r0, r7
 
   %0 = call i8* @llvm.frameaddress(i32 0)
   ret i8* %0
 }
 
 define i8* @frameaddr_index1() nounwind {
 entry:
 ; DARWIN-ARM-LABEL: frameaddr_index1:
-; DARWIN-ARM: push {r7}
+; DARWIN-ARM: push {r7, lr}
 ; DARWIN-ARM: mov r7, sp
 ; DARWIN-ARM: ldr r0, [r7]
 
 ; DARWIN-THUMB2-LABEL: frameaddr_index1:
-; DARWIN-THUMB2: str r7, [sp, #-4]!
+; DARWIN-THUMB2: push {r7, lr}
 ; DARWIN-THUMB2: mov r7, sp
 ; DARWIN-THUMB2: ldr r0, [r7]
 
 ; LINUX-ARM-LABEL: frameaddr_index1:
-; LINUX-ARM: push {r11}
+; LINUX-ARM: push {r11, lr}
 ; LINUX-ARM: mov r11, sp
 ; LINUX-ARM: ldr r0, [r11]
 
 ; LINUX-THUMB2-LABEL: frameaddr_index1:
-; LINUX-THUMB2: str r7, [sp, #-4]!
+; LINUX-THUMB2: push {r7, lr}
 ; LINUX-THUMB2: mov r7, sp
 ; LINUX-THUMB2: mov r0, r7
 ; LINUX-THUMB2: ldr r0, [r0]
 
   %0 = call i8* @llvm.frameaddress(i32 1)
   ret i8* %0
 }
 
 define i8* @frameaddr_index3() nounwind {
 entry:
 ; DARWIN-ARM-LABEL: frameaddr_index3:
-; DARWIN-ARM: push {r7}
+; DARWIN-ARM: push {r7, lr}
 ; DARWIN-ARM: mov r7, sp
 ; DARWIN-ARM: ldr r0, [r7]
 ; DARWIN-ARM: ldr r0, [r0]
 ; DARWIN-ARM: ldr r0, [r0]
 
 ; DARWIN-THUMB2-LABEL: frameaddr_index3:
-; DARWIN-THUMB2: str r7, [sp, #-4]!
+; DARWIN-THUMB2: push {r7, lr}
 ; DARWIN-THUMB2: mov r7, sp
 ; DARWIN-THUMB2: ldr r0, [r7]
 ; DARWIN-THUMB2: ldr r0, [r0]
 ; DARWIN-THUMB2: ldr r0, [r0]
 
 ; LINUX-ARM-LABEL: frameaddr_index3:
-; LINUX-ARM: push {r11}
+; LINUX-ARM: push {r11, lr}
 ; LINUX-ARM: mov r11, sp
 ; LINUX-ARM: ldr r0, [r11]
 ; LINUX-ARM: ldr r0, [r0]
 ; LINUX-ARM: ldr r0, [r0]
 
 ; LINUX-THUMB2-LABEL: frameaddr_index3:
-; LINUX-THUMB2: str r7, [sp, #-4]!
+; LINUX-THUMB2: push {r7, lr}
 ; LINUX-THUMB2: mov r7, sp
 ; LINUX-THUMB2: mov r0, r7
 ; LINUX-THUMB2: ldr r0, [r0]
 ; LINUX-THUMB2: ldr r0, [r0]
 ; LINUX-THUMB2: ldr r0, [r0]
 
   %0 = call i8* @llvm.frameaddress(i32 3)
   ret i8* %0
 }
 
 declare i8* @llvm.frameaddress(i32) nounwind readnone

test/CodeGen/Thumb/push.ll

 ; RUN: llc < %s -mtriple=thumb-apple-darwin -disable-fp-elim | FileCheck %s
 ; rdar://7268481
 
 define void @t() nounwind {
 ; CHECK-LABEL: t:
-; CHECK: push {r7}
+; CHECK: push {r7, lr}
 entry:
   call void asm sideeffect alignstack ".long 0xe7ffdefe", ""() nounwind
   ret void
 }

test/CodeGen/Thumb2/frame-pointer.ll

+; RUN: llc -mtriple=thumbv7m-none-eabi -o - %s | FileCheck %s
+
+declare void @foo()
+
+; Has a call, but no need for a frame pointer.
+define void @call() {
+; CHECK-LABEL: call:
+; CHECK: push {[[DUMMYREG:r[0-9]+]], lr}
+; CHECK-NOT: sp
+; CHECK: bl foo
+; CHECK: pop {[[DUMMYREG]], pc}
+  call void @foo()
+  ret void
+}
+
+; Has a call, and frame pointer requested.
+define void @call_nofpelim() "no-frame-pointer-elim"="true" {
+; CHECK-LABEL: call_nofpelim:
+; CHECK: push {r7, lr}
+; CHECK: mov r7, sp
+; CHECK: bl foo
+; CHECK: pop {r7, pc}
+  call void @foo()
+  ret void
+}
+
+; Has a high register clobbered, no need for a frame pointer.
+define void @highreg() {
+; CHECK-LABEL: highreg:
+; CHECK: push.w {r8, lr}
+; CHECK-NOT: sp
+; CHECK: bl foo
+; CHECK: pop.w {r8, pc}
+  call void asm sideeffect "", "~{r8}" ()
+  call void @foo()
+  ret void
+}
+
+; Has a high register clobbered, frame pointer requested. We need to split the
+; push into two, to ensure that r7 and sp are adjacent on the stack.
+define void @highreg_nofpelim() "no-frame-pointer-elim"="true" {
+; CHECK-LABEL: highreg_nofpelim:
+; CHECK: push {[[DUMMYREG:r[0-9]+]], r7, lr}
+; CHECK: add r7, sp, #4
+; CHECK: str r8, [sp, #-4]!
+; CHECK: bl foo
+; CHECK: ldr r8, [sp], #4
+; CHECK: pop {[[DUMMYREG]], r7, pc}
+  call void asm sideeffect "", "~{r8}" ()
+  call void @foo()
+  ret void
+}
+
+; Has a high register clobbered, frame required due to variable-sized alloca.
+; We need a frame pointer to correctly restore the stack, but don't need to
+; split the push/pop here, because the frame pointer not required by the ABI.
+define void @highreg_alloca(i32 %a) {
+; CHECK-LABEL: highreg_alloca:
+; CHECK: push.w {[[SOMEREGS:.*]], r7, r8, lr}
+; CHECK: add r7, sp, #{{[0-9]+}}
+; CHECK: bl foo
+; CHECK: pop.w {[[SOMEREGS]], r7, r8, pc}
+  %alloca = alloca i32, i32 %a, align 4
+  call void @foo()
+  call void asm sideeffect "", "~{r8}" ()
+  ret void
+}
+
+; Has a high register clobbered, frame required due to both variable-sized
+; alloca and ABI. We do need to split the push/pop here.
+define void @highreg_alloca_nofpelim(i32 %a) "no-frame-pointer-elim"="true" {
+; CHECK-LABEL: highreg_alloca_nofpelim:
+; CHECK: push {[[SOMEREGS:.*]], r7, lr}
+; CHECK: add r7, sp, #{{[0-9]+}}
+; CHECK: str r8, [sp, #-4]!
+; CHECK: bl foo
+; CHECK: ldr r8, [sp], #4
+; CHECK: pop {[[SOMEREGS]], r7, pc}
+  %alloca = alloca i32, i32 %a, align 4
+  call void @foo()
+  call void asm sideeffect "", "~{r8}" ()
+  ret void
+}