[Mips] Fix mfhi/mflo hazard miscompilation about div and mult

Fix issue1: In mips1-4, require a minimum of 2 instructions between
a mflo/mfhi and the next mul/dmult/div/ddiv/divu/ddivu instruction.
Fix issue2: In mips1-4, should not put mflo into the delay slot for
the return.

Fix #81291

Author: yingopq

llvm/lib/Target/Mips/Mips.h

@@ -17,6 +17,17 @@
 #include "MCTargetDesc/MipsMCTargetDesc.h"
 #include "llvm/Target/TargetMachine.h"
 
+#define IsMFLOMFHI(instr)                                                      \
+  (instr == Mips::MFLO || instr == Mips::MFLO64 || instr == Mips::MFHI ||      \
+   instr == Mips::MFHI64)
+#define IsDIVMULT(instr)                                                       \
+  (instr == Mips::SDIV || instr == Mips::PseudoSDIV || instr == Mips::DSDIV || \
+   instr == Mips::PseudoDSDIV || instr == Mips::UDIV ||                        \
+   instr == Mips::PseudoUDIV || instr == Mips::DUDIV ||                        \
+   instr == Mips::PseudoDUDIV || instr == Mips::MULT ||                        \
+   instr == Mips::PseudoMULT || instr == Mips::DMULT ||                        \
+   instr == Mips::PseudoDMULT)
+
 namespace llvm {
 class FunctionPass;
 class InstructionSelector;

llvm/lib/Target/Mips/MipsBranchExpansion.cpp

@@ -167,6 +167,7 @@ class MipsBranchExpansion : public MachineFunctionPass {
   bool handleFPUDelaySlot();
   bool handleLoadDelaySlot();
   bool handlePossibleLongBranch();
+  bool handleMFLO();
 
   const MipsSubtarget *STI;
   const MipsInstrInfo *TII;
@@ -744,13 +745,15 @@ static void emitGPDisp(MachineFunction &F, const MipsInstrInfo *TII) {
 template <typename Pred, typename Safe>
 bool MipsBranchExpansion::handleSlot(Pred Predicate, Safe SafeInSlot) {
   bool Changed = false;
+  bool hasPendingMFLO = false;
 
   for (MachineFunction::iterator FI = MFp->begin(); FI != MFp->end(); ++FI) {
     for (Iter I = FI->begin(); I != FI->end(); ++I) {
 
       // Delay slot hazard handling. Use lookahead over state.
-      if (!Predicate(*I))
+      if (!Predicate(*I) && !hasPendingMFLO) {
         continue;
+      }
 
       Iter IInSlot;
       bool LastInstInFunction =
@@ -766,17 +769,40 @@ bool MipsBranchExpansion::handleSlot(Pred Predicate, Safe SafeInSlot) {
         if (std::next(Iit) == FI->end() ||
             std::next(Iit)->getOpcode() != Mips::NOP) {
           Changed = true;
-          TII->insertNop(*(I->getParent()), std::next(I), I->getDebugLoc())
-              ->bundleWithPred();
-          NumInsertedNops++;
+          if (Predicate(*I) ||
+              (!LastInstInFunction && !SafeInSlot(*IInSlot, *I))) {
+            TII->insertNop(*(I->getParent()), std::next(I), I->getDebugLoc())
+                ->bundleWithPred();
+            NumInsertedNops++;
+          }
+          if (IsMFLOMFHI(I->getOpcode()) && !LastInstInFunction &&
+              IsDIVMULT(IInSlot->getOpcode())) {
+            TII->insertNop(*(I->getParent()), std::next(I), I->getDebugLoc())
+                ->bundleWithPred();
+            NumInsertedNops++;
+          }
         }
+      } else if (IsMFLOMFHI(I->getOpcode())) {
+        hasPendingMFLO = true;
       }
     }
   }
 
   return Changed;
 }
 
+bool MipsBranchExpansion::handleMFLO() {
+  // mips1-4 require a minimum of 2 instructions between a mflo/mfhi
+  // and the next mul/div instruction.
+  if (STI->hasMips32() || STI->hasMips5())
+    return false;
+
+  return handleSlot([this](auto &I) -> bool { return TII->IsMfloOrMfhi(I); },
+                    [this](auto &IInSlot, auto &I) -> bool {
+                      return TII->SafeAfterMflo(IInSlot);
+                    });
+}
+
 bool MipsBranchExpansion::handleForbiddenSlot() {
   // Forbidden slot hazards are only defined for MIPSR6 but not microMIPSR6.
   if (!STI->hasMips32r6() || STI->inMicroMipsMode())
@@ -893,16 +919,19 @@ bool MipsBranchExpansion::runOnMachineFunction(MachineFunction &MF) {
   bool forbiddenSlotChanged = handleForbiddenSlot();
   bool fpuDelaySlotChanged = handleFPUDelaySlot();
   bool loadDelaySlotChanged = handleLoadDelaySlot();
+  bool MfloChanged = handleMFLO();
 
   bool Changed = longBranchChanged || forbiddenSlotChanged ||
-                 fpuDelaySlotChanged || loadDelaySlotChanged;
+                 fpuDelaySlotChanged || loadDelaySlotChanged || MfloChanged;
 
   // Then run them alternatively while there are changes.
   while (forbiddenSlotChanged) {
     longBranchChanged = handlePossibleLongBranch();
     fpuDelaySlotChanged = handleFPUDelaySlot();
     loadDelaySlotChanged = handleLoadDelaySlot();
-    if (!longBranchChanged && !fpuDelaySlotChanged && !loadDelaySlotChanged)
+    MfloChanged = handleMFLO();
+    if (!longBranchChanged && !fpuDelaySlotChanged && !loadDelaySlotChanged &&
+        !MfloChanged)
       break;
     forbiddenSlotChanged = handleForbiddenSlot();
   }

llvm/lib/Target/Mips/MipsDelaySlotFiller.cpp

@@ -743,6 +743,12 @@ bool MipsDelaySlotFiller::searchRange(MachineBasicBlock &MBB, IterTy Begin,
     bool InMicroMipsMode = STI.inMicroMipsMode();
     const MipsInstrInfo *TII = STI.getInstrInfo();
     unsigned Opcode = (*Slot).getOpcode();
+
+    if ((CurrI->getOpcode() == Mips::MFLO ||
+         CurrI->getOpcode() == Mips::MFLO64) &&
+        (!STI.hasMips32() && !STI.hasMips5()))
+      continue;
+
     // This is complicated by the tail call optimization. For non-PIC code
     // there is only a 32bit sized unconditional branch which can be assumed
     // to be able to reach the target. b16 only has a range of +/- 1 KB.

llvm/lib/Target/Mips/MipsInstrInfo.cpp

@@ -13,6 +13,7 @@
 #include "MipsInstrInfo.h"
 #include "MCTargetDesc/MipsBaseInfo.h"
 #include "MCTargetDesc/MipsMCTargetDesc.h"
+#include "Mips.h"
 #include "MipsSubtarget.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/CodeGen/MachineBasicBlock.h"
@@ -571,6 +572,13 @@ unsigned MipsInstrInfo::getEquivalentCompactForm(
   return 0;
 }
 
+bool MipsInstrInfo::SafeAfterMflo(const MachineInstr &MI) const {
+  if (IsDIVMULT(MI.getOpcode()))
+    return false;
+
+  return true;
+}
+
 /// Predicate for distingushing between control transfer instructions and all
 /// other instructions for handling forbidden slots. Consider inline assembly
 /// as unsafe as well.
@@ -623,6 +631,13 @@ bool MipsInstrInfo::SafeInLoadDelaySlot(const MachineInstr &MIInSlot,
   });
 }
 
+bool MipsInstrInfo::IsMfloOrMfhi(const MachineInstr &MI) const {
+  if (IsMFLOMFHI(MI.getOpcode()))
+    return true;
+
+  return false;
+}
+
 /// Predicate for distingushing instructions that have forbidden slots.
 bool MipsInstrInfo::HasForbiddenSlot(const MachineInstr &MI) const {
   return (MI.getDesc().TSFlags & MipsII::HasForbiddenSlot) != 0;

llvm/lib/Target/Mips/MipsInstrInfo.h

@@ -89,6 +89,8 @@ class MipsInstrInfo : public MipsGenInstrInfo {
   bool isBranchOffsetInRange(unsigned BranchOpc,
                              int64_t BrOffset) const override;
 
+  bool SafeAfterMflo(const MachineInstr &MI) const;
+
   /// Predicate to determine if an instruction can go in a forbidden slot.
   bool SafeInForbiddenSlot(const MachineInstr &MI) const;
 
@@ -100,6 +102,8 @@ class MipsInstrInfo : public MipsGenInstrInfo {
   bool SafeInLoadDelaySlot(const MachineInstr &MIInSlot,
                            const MachineInstr &LoadMI) const;
 
+  bool IsMfloOrMfhi(const MachineInstr &MI) const;
+
   /// Predicate to determine if an instruction has a forbidden slot.
   bool HasForbiddenSlot(const MachineInstr &MI) const;