[PATCH] D56717: [SLH] AArch64: correctly pick temporary register to mask SP

[Kristof Beyls via Phabricator via llvm-commits]

kristof.beyls created this revision.
kristof.beyls added a reviewer: olista01.
Herald added subscribers: hiraditya, javed.absar.

As part of speculation hardening, the stack pointer gets masked with the
taint register (X16) before a function call or before a function return.
Since there are no instructions that can directly mask writing to the
stack pointer, the stack pointer must first be transferred to a temporary
register, where it can be masked, before that value is transferred back
to the stack pointer.
Before, that temporary register was always picked to be x17, since the
ABI allows clobbering x17 on any function call, resulting in the
following instruction pattern being inserted before function calls and
returns/tail calls:

  mov x17, sp
  and x17, x17, x16
  mov sp, x17

However, x17 can be live in those locations, for example when the call
is an indirect call, using x17 as the target address (blr x17).

To fix this, this patch looks for an available dead register just before
the call or terminator instruction and uses that.

In order to have a bit more stability in code generation and e.g. be
able to more easily spot the injected sequences in an assembly dump,
lr/x30 is the preferred temporary register just before a call and x17 is
the preferred temporary register just before a terminator.


Repository:
  rL LLVM

https://reviews.llvm.org/D56717

Files:
  llvm/lib/Target/AArch64/AArch64SpeculationHardening.cpp
  llvm/test/CodeGen/AArch64/speculation-hardening.ll
  llvm/test/CodeGen/AArch64/speculation-hardening.mir

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D56717.181773.patch
Type: text/x-patch
Size: 9075 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190115/20b308b3/attachment.bin>