<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/78174>78174</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Miscompilation with -mbranch-protection=pac-ret+pc and -mspeculative-load-hardening
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            backend:AArch64,
            miscompilation
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          ostannard
      </td>
    </tr>
</table>

<pre>
    This code is miscompiled when built with the -mbranch-protection=pac-ret+pc and -mspeculative-load-hardening options:

```c
int main() {
  asm volatile("" : : "r"(__builtin_return_address(0)));
  return 0;
}
```

Generated code:
```
$ /work/llvm/build/bin/clang --target=aarch64-none-elf -c test.c -O1 -mbranch-protection=pac-ret+pc -mspeculative-load-hardening -o - -S | sed -n '/main:/,/func_end/p'
main: // @main
// %bb.0: // %entry
        cmp     sp, #0
        csetm   x16, ne // Set x16 to all-1s
        hint    #39
.Ltmp0:
        hint #25
        str     x30, [sp, #-16]!                // 8-byte Folded Spill
        hint    #7
        mov     w0, wzr
        //APP
 //NO_APP
        ldr     x30, [sp], #16                  // 8-byte Folded Reload
        and     x30, x30, x16
        csdb
        mov x1, sp
        adr     x16, .Ltmp0     // Set x16 to address of PAC instruction
        hint    #39
        hint    #29             // Use x16 if on 9.5-A hardware, NOP otherwise
        and     x1, x1, x16     // And x16 into SP (to prevent speculation)
        mov     sp, x1
 ret
.Lfunc_end0:
```

The problem is that both the v9.5-A PAC codegen and speculative load hardening assume that they can use x16, so they over-write each other's values.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJysVc-S4jYTfxpx6TJlt23ABw7MUP4uX3anMpszJdsNVlaWXJIMM3n6lCRggMwkOURlW-XuVuvX_7m14qCI1qx8YuV2xifXa7PW1nGluOlmje7e1z96YaHVHYGwMAjb6mEUkjo49aSgmYR0cBKuB9cTJENjuGr7ZDTaUeuEVizfjrxNDDmGT2MLXHWQDHakdpLciSMlUvMu6bnpSAl1AD36Y5blG5ZuWXr5LtL4tPFfKAcDF4rhimEFbPkU6QDcDnDUXrekwEWGCCzfxBfRBNJqtwvghdoZcpNRO951hqxluEoZVucnv-qNUpBeSWy5fcB2C_h_pMhwR11w3oc1D7JYAMP6pM1PhrWUx4Fh7XF1fvfm1a3k6gBJ4rg5kGP5lnPT9osiUVpRQnIPSQuOrJu3kHzP_k0M_tb_iYYEkldgy2ew1EGigOGSYR3cnW8Y1gyfGdb7SbU7Uh7p6CWCQWchCFI1sCINlLOxkYZl08zTWyksSTnzfnF1XO0wht2ODJ-BYZ4-8C25AQDesoUXUHRR90rOE8Fp4FImmb0_1_vcAfAa8yqy5v93w5heg3QnyTDH8p5unQn7W54GaOXTFWOSLVi5ZZjBwzpjWyXNuyOoteyog9dRSPkluuU9Z9DHsJ_Cpac_zD07XrB5eTmT4_-377sP0nnJ7hP4HnSwIFs8Qv8C_K_kM-deta_uG9WXLVs8hq5r_mrcW-aF7fig8oI2hjmG6hbVbbhjCYPew8vmGYSyzkyxBP4pBT5hYfWZE36zFK4Te9AKqnmZbMBXz4kb8gC_fX8B7XoyJ2HpC-9k0Stn39xq36gualdOw-sLMFw5DaOhIykH17LVyjenT9MjpuJbdub6oj_n-KVg0y-7Ufj-6AlGoxtJg-_5rucOGn3u8MdosPeu72sHUsGqm34CPivgo59wa6eBohrX0zu0XMEUnRjirSNZH8kkJyMcAfG2jz5kuLRw5HIiO59167yr8orPaJ0t0zLP83yBs369T6umrIh4V-SrHLuyKIou26f7Alf7FeJMrDHFIs2yMisLLHBeLaqG2jZbVKumRaxYkdLAhZz7DjzX5jAT1k60Xq6yZTGTvCFpw5hEbHj70ze9fLPZhD4cpskzQ7wOx3N80A9Vs_Yqk2Y6WFakUlhnPy5xwkla_3J3Lg7T_2CQziYj171zo7007fogXD8181YPH8MmwBuN_p1ax7AOdluGdTD9zwAAAP__5SFOTQ">