[llvm-dev] retpoline mitigation and 6.0

David Woodhouse via llvm-dev llvm-dev at lists.llvm.org
Sat Feb 10 02:37:51 PST 2018

> I arranged it this way because the x86 call instruction puts the intended
> return address on the top of the stack, and there's no easy way to put it
> anywhere else. We use this thunk when we want to make an indirect call and
> there are no available scratch registers, i.e. 32-bit -mregparm=3 and the
> call has three or more arguments, which happens in Linux. One way to avoid
> this would be to compile with -mregparm=2, but that would pessimize direct
> calls unnecessarily.

I appreciate that x86 is horribly register-starved but there *are* more
than three. For many of the cases where LLVM will emit its _push
retpoline, GCC would have just used another register trampoline like %ebx
or %esi that *isn't* one of the parameters.


More information about the llvm-dev mailing list