203 lines · plain
1# RUN: llc -verify-machineinstrs -mtriple=aarch64-none-linux-gnu \2# RUN: -start-before aarch64-speculation-hardening -o - %s \3# RUN: | FileCheck %s4 5# Check that the speculation hardening pass generates code as expected for6# basic blocks ending with a variety of branch patterns:7# - (1) no branches (fallthrough)8# - (2) one unconditional branch9# - (3) one conditional branch + fall-through10# - (4) one conditional branch + one unconditional branch11# - other direct branches don't seem to be generated by the AArch64 codegen12--- |13 define void @nobranch_fallthrough(i32 %a, i32 %b) speculative_load_hardening {14 ret void15 }16 define void @uncondbranch(i32 %a, i32 %b) speculative_load_hardening {17 ret void18 }19 define void @condbranch_fallthrough(i32 %a, i32 %b) speculative_load_hardening {20 ret void21 }22 define void @condbranch_uncondbranch(i32 %a, i32 %b) speculative_load_hardening {23 ret void24 }25 define void @indirectbranch(i32 %a, i32 %b) speculative_load_hardening {26 ret void27 }28 ; Also check that a non-default temporary register gets picked correctly to29 ; transfer the SP to to and it with the taint register when the default30 ; temporary isn't available.31 define void @indirect_call_x17(i32 %a, i32 %b) speculative_load_hardening {32 ret void33 }34 @g = common dso_local local_unnamed_addr global ptr null, align 835 define void @indirect_tailcall_x17(i32 %a, i32 %b) speculative_load_hardening {36 ret void37 }38 define void @indirect_call_lr(i32 %a, i32 %b) speculative_load_hardening {39 ret void40 }41 define void @RS_cannot_find_available_regs() speculative_load_hardening {42 ret void43 }44...45---46name: nobranch_fallthrough47tracksRegLiveness: true48body: |49 ; CHECK-LABEL: nobranch_fallthrough50 bb.0:51 successors: %bb.152 liveins: $w0, $w153 ; CHECK-NOT: csel54 bb.1:55 liveins: $w056 RET undef $lr, implicit $w057...58---59name: uncondbranch60tracksRegLiveness: true61body: |62 ; CHECK-LABEL: uncondbranch63 bb.0:64 successors: %bb.165 liveins: $w0, $w166 B %bb.167 ; CHECK-NOT: csel68 bb.1:69 liveins: $w070 RET undef $lr, implicit $w071...72---73name: condbranch_fallthrough74tracksRegLiveness: true75body: |76 ; CHECK-LABEL: condbranch_fallthrough77 bb.0:78 successors: %bb.1, %bb.279 liveins: $w0, $w180 $wzr = SUBSWrs renamable $w0, renamable $w1, 0, implicit-def $nzcv, implicit-def $nzcv81 Bcc 11, %bb.2, implicit $nzcv82 ; CHECK: b.lt [[BB_LT_T:\.LBB[0-9_]+]]83 84 bb.1:85 liveins: $nzcv, $w086 ; CHECK: csel x16, x16, xzr, ge87 RET undef $lr, implicit $w088 bb.2:89 liveins: $nzcv, $w090 ; CHECK: csel x16, x16, xzr, lt91 RET undef $lr, implicit $w092...93---94name: condbranch_uncondbranch95tracksRegLiveness: true96body: |97 ; CHECK-LABEL: condbranch_uncondbranch98 bb.0:99 successors: %bb.1, %bb.2100 liveins: $w0, $w1101 $wzr = SUBSWrs renamable $w0, renamable $w1, 0, implicit-def $nzcv, implicit-def $nzcv102 Bcc 11, %bb.2, implicit $nzcv103 B %bb.1, implicit $nzcv104 ; CHECK: b.lt [[BB_LT_T:\.LBB[0-9_]+]]105 106 bb.1:107 liveins: $nzcv, $w0108 ; CHECK: csel x16, x16, xzr, ge109 RET undef $lr, implicit $w0110 bb.2:111 liveins: $nzcv, $w0112 ; CHECK: csel x16, x16, xzr, lt113 RET undef $lr, implicit $w0114...115---116name: indirectbranch117tracksRegLiveness: true118body: |119 ; Check that no instrumentation is done on indirect branches (for now).120 ; CHECK-LABEL: indirectbranch121 bb.0:122 successors: %bb.1, %bb.2123 liveins: $x0124 BR $x0125 bb.1:126 liveins: $x0127 ; CHECK-NOT: csel128 RET undef $lr, implicit $x0129 bb.2:130 liveins: $x0131 ; CHECK-NOT: csel132 RET undef $lr, implicit $x0133...134---135name: indirect_call_x17136tracksRegLiveness: true137body: |138 bb.0:139 liveins: $x17140 ; CHECK-LABEL: indirect_call_x17141 ; CHECK: mov x0, sp142 ; CHECK: and x0, x0, x16143 ; CHECK: mov sp, x0144 ; CHECK: blr x17145 BLR killed renamable $x17, implicit-def dead $lr, implicit $sp146 RET undef $lr, implicit undef $w0147...148---149name: indirect_tailcall_x17150tracksRegLiveness: true151body: |152 bb.0:153 liveins: $x0154 ; CHECK-LABEL: indirect_tailcall_x17155 ; CHECK: mov x1, sp156 ; CHECK: and x1, x1, x16157 ; CHECK: mov sp, x1158 ; CHECK: br x17159 $x8 = ADRP target-flags(aarch64-page) @g160 $x17 = LDRXui killed $x8, target-flags(aarch64-pageoff, aarch64-nc) @g161 TCRETURNri killed $x17, 0, implicit $sp, implicit $x0162...163---164name: indirect_call_lr165tracksRegLiveness: true166body: |167 bb.0:168 ; CHECK-LABEL: indirect_call_lr169 ; CHECK: mov x1, sp170 ; CHECK: and x1, x1, x16171 ; CHECK-NEXT: mov sp, x1172 ; CHECK-NEXT: blr x30173 liveins: $x0, $lr174 BLR killed renamable $lr, implicit-def dead $lr, implicit $sp, implicit-def $sp, implicit-def $w0, implicit $x0175 $w0 = nsw ADDWri killed $w0, 1, 0176 RET undef $lr, implicit $w0177...178---179name: RS_cannot_find_available_regs180tracksRegLiveness: true181body: |182 bb.0:183 ; In the rare case when no free temporary register is available for the184 ; propagate taint-to-sp operation, just put in a full speculation barrier185 ; (isb+dsb sy) at the start of the basic block. And don't put masks on186 ; instructions for the rest of the basic block, since speculation in that187 ; basic block was already done, so no need to do masking.188 ; CHECK-LABEL: RS_cannot_find_available_regs189 ; CHECK: dsb sy190 ; CHECK-NEXT: isb191 ; CHECK-NEXT: ldr x0, [x0]192 ; The following 2 instructions come from propagating the taint encoded in193 ; sp at function entry to x16. It turns out the taint info in x16 is not194 ; used in this function, so those instructions could be optimized away. An195 ; optimization for later if it turns out this situation occurs often enough.196 ; CHECK-NEXT: cmp sp, #0197 ; CHECK-NEXT: csetm x16, ne198 ; CHECK-NEXT: ret199 liveins: $x0, $x1, $x2, $x3, $x4, $x5, $x6, $x7, $x8, $x9, $x10, $x11, $x12, $x13, $x14, $x15, $x17, $x18, $x19, $x20, $x21, $x22, $x23, $x24, $x25, $x26, $x27, $x28, $fp, $lr200 $x0 = LDRXui killed $x0, 0201 RET $lr, implicit $x0, implicit $x1, implicit $x2, implicit $x3, implicit $x4, implicit $x5, implicit $x6, implicit $x7, implicit $x8, implicit $x9, implicit $x10, implicit $x11, implicit $x12, implicit $x13, implicit $x14, implicit $x15, implicit $x17, implicit $x18, implicit $x19, implicit $x20, implicit $x21, implicit $x22, implicit $x23, implicit $x24, implicit $x25, implicit $x26, implicit $x27, implicit $x28202...203