[PATCH] D54896: Introduce control flow speculation tracking pass for AArch64.

[Oliver Stannard via Phabricator via llvm-commits]

olista01 added a comment.

> There currently isn't even a user interface to reserve X16.

X16 can be reserved by the user using inline assembly, either with a clobber or named register variable. I can think of a few cases where this might happen in real code:

- D51432 <https://reviews.llvm.org/D51432> uses it in libunwind to implement unwinding through functions using return-address signing.
- Inline assembly which contains a function call will need to clobber X16 and X17.

If moving this pass to before register allocation would add a lot of extra complexity, maybe this could also be solved by copying the taint into SP before each inline asm block, and back out afterwards, like we currently do for calls?



================
Comment at: lib/Target/AArch64/AArch64SpeculationHardening.cpp:116
+private:
+  unsigned MisspeculatingTaintVR;
+  unsigned MisspeculatingTaintVR32Bit;
----------------
What does VR stand for here? I'd assume Virtual Register, but these are only ever physical registers.


================
Comment at: lib/Target/AArch64/AArch64SpeculationHardening.cpp:117
+  unsigned MisspeculatingTaintVR;
+  unsigned MisspeculatingTaintVR32Bit;
+
----------------
Unused variable.


================
Comment at: test/CodeGen/AArch64/speculation-hardening.ll:11
+entry:
+; SLH:  cmp sp, #0
+; SLH:  csetm x16, ne
----------------
Should we also check that these instructions are not emitted when SLH is disabled?


================
Comment at: test/CodeGen/AArch64/speculation-hardening.mir:11
+# - (4) one conditional branch + one unconditional branch
+# - other direct branches don't seem to be generated by the AArch64 codegen
+--- |
----------------
I think it would also be worth testing blocks ending in indirect branches, to make sure we ignore them for now.


CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D54896/new/

https://reviews.llvm.org/D54896