[AArch64] Make stack tagging compatible with SLH

[kristof.beyls]

Summary

See https://github.com/llvm/llvm-project/issues/61830

Speculative Load Hardening (SLH) requires that conditional branches are
implemented using B.cc branches, not using {TC}B{N}Z branches.

Stack tagging was expanding one of the pseudo instructions it uses to
cbnz. This commit changes that to use b.ne instead.

Note that the added regression test was added to settag.ll rather than
speculation-hardening.ll. The speculation-hardening.ll tests also check
that all tests in the file work with global-isel. It seems that stack
tagging does not work yet with global-isel. Therefore, testing the
combination of stack tagging and SLH hard to be added to a test file
that doesn't test global-isel, i.e. settag.ll

[olista01]

LGTM

[eugenis]

LGTM, thanks!

llvm/lib/Target/AArch64/AArch64ExpandPseudoInsts.cpp

bool AArch64ExpandPseudo::expandSetTagLoop(
 
   BuildMI(LoopBB, DL, TII->get(OpCode2))
       .addDef(AddressReg)
       .addReg(AddressReg)
       .addReg(AddressReg)
       .addImm(2)
       .cloneMemRefs(MI)
       .setMIFlags(MI.getFlags());
-  BuildMI(LoopBB, DL, TII->get(AArch64::SUBXri))
+  BuildMI(LoopBB, DL, TII->get(AArch64::SUBSXri))
       .addDef(SizeReg)
       .addReg(SizeReg)
       .addImm(16 * 2)
       .addImm(0);
-  BuildMI(LoopBB, DL, TII->get(AArch64::CBNZX)).addUse(SizeReg).addMBB(LoopBB);
+  BuildMI(LoopBB, DL, TII->get(AArch64::Bcc))
+      .addImm(AArch64CC::NE)
+      .addMBB(LoopBB)
+      .addReg(AArch64::NZCV, RegState::Implicit | RegState::Kill);
 
   LoopBB->addSuccessor(LoopBB);
   LoopBB->addSuccessor(DoneBB);
 
   DoneBB->splice(DoneBB->end(), &MBB, MI, MBB.end());
   DoneBB->transferSuccessors(&MBB);
 
   MBB.addSuccessor(LoopBB);

llvm/test/CodeGen/AArch64/settag-merge-order.ll

 ; RUN: llc < %s -mtriple=aarch64 -mattr=+mte -aarch64-order-frame-objects=1 | FileCheck %s
 
 declare void @use(ptr %p)
 declare void @llvm.aarch64.settag(ptr %p, i64 %a)
 declare void @llvm.aarch64.settag.zero(ptr %p, i64 %a)
 
 ; Two loops of size 256; the second loop updates SP.
 ; After frame reordering, two loops can be merged into one.
 define void @stg128_128_gap_128_128() {
 entry:
 ; CHECK-LABEL: stg128_128_gap_128_128:
 ; CHECK: mov     x8, #512
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
 ; CHECK: ret
   %a = alloca i8, i32 128, align 16
   %a2 = alloca i8, i32 128, align 16
   %b = alloca i8, i32 32, align 16
   %c = alloca i8, i32 128, align 16
   %c2 = alloca i8, i32 128, align 16
   call void @use(ptr %b)
   call void @llvm.aarch64.settag(ptr %a, i64 128)
; CHECK-LABEL: stg2:
   %b = alloca i8, i32 32, align 16
   %c = alloca i8, i32 128, align 16
   %c2 = alloca i8, i32 128, align 16
   call void @use(ptr %b)
   br i1 %flag, label %if.then, label %if.else
 
 if.then:
 ; CHECK: mov     x8, #320
-; CHECK: sub     x8, x8, #32
+; CHECK: subs    x8, x8, #32
 ; CHECK: st2g    x9, [x9], #32
-; CHECK: cbnz    x8,
+; CHECK: b.ne
   call void @llvm.aarch64.settag(ptr %a, i64 160)
   call void @llvm.aarch64.settag(ptr %a2, i64 160)
   br label %if.end
 
 if.else:
 ; CHECK: mov     x8, #256
-; CHECK: sub     x8, x8, #32
+; CHECK: subs    x8, x8, #32
 ; CHECK: st2g    x9, [x9], #32
-; CHECK: cbnz    x8,
+; CHECK: b.ne
   call void @llvm.aarch64.settag(ptr %c, i64 128)
   call void @llvm.aarch64.settag(ptr %c2, i64 128)
   br label %if.end
 
 if.end:
 ; CHECK: mov     x8, #576
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
   call void @llvm.aarch64.settag(ptr %a, i64 160)
   call void @llvm.aarch64.settag(ptr %a2, i64 160)
   call void @llvm.aarch64.settag(ptr %c, i64 128)
   call void @llvm.aarch64.settag(ptr %c2, i64 128)
 
 ; CHECK: ret
   ret void
 }

llvm/test/CodeGen/AArch64/settag-merge.ll

; CHECK: ret
   ret void
 }
 
 define void @stg128_128_128_128() {
 entry:
 ; CHECK-LABEL: stg128_128_128_128:
 ; CHECK: mov     x8, #512
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
 ; CHECK: ret
   %a = alloca i8, i32 128, align 16
   %b = alloca i8, i32 128, align 16
   %c = alloca i8, i32 128, align 16
   %d = alloca i8, i32 128, align 16
   call void @llvm.aarch64.settag(ptr %a, i64 128)
   call void @llvm.aarch64.settag(ptr %b, i64 128)
   call void @llvm.aarch64.settag(ptr %c, i64 128)
   call void @llvm.aarch64.settag(ptr %d, i64 128)
   ret void
 }
 
 define void @stg16_512_16() {
 entry:
 ; CHECK-LABEL: stg16_512_16:
 ; CHECK: mov     x8, #544
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
 ; CHECK: ret
   %a = alloca i8, i32 16, align 16
   %b = alloca i8, i32 512, align 16
   %c = alloca i8, i32 16, align 16
   call void @llvm.aarch64.settag(ptr %a, i64 16)
   call void @llvm.aarch64.settag(ptr %b, i64 512)
   call void @llvm.aarch64.settag(ptr %c, i64 16)
   ret void
 }
 
 define void @stg512_512_512() {
 entry:
 ; CHECK-LABEL: stg512_512_512:
 ; CHECK: mov     x8, #1536
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
 ; CHECK: ret
   %a = alloca i8, i32 512, align 16
   %b = alloca i8, i32 512, align 16
   %c = alloca i8, i32 512, align 16
   call void @llvm.aarch64.settag(ptr %a, i64 512)
   call void @llvm.aarch64.settag(ptr %b, i64 512)
   call void @llvm.aarch64.settag(ptr %c, i64 512)
   ret void

 }
 
 define void @early_128_128(i1 %flag) {
 entry:
 ; CHECK-LABEL: early_128_128:
 ; CHECK: tbz   w0, #0, [[LABEL:.LBB.*]]
 ; CHECK: add   x9, sp, #
 ; CHECK: mov   x8, #256
-; CHECK: sub   x8, x8, #32
+; CHECK: subs  x8, x8, #32
 ; CHECK: st2g  x9, [x9], #32
-; CHECK: cbnz  x8,
+; CHECK: b.ne
 ; CHECK: [[LABEL]]:
 ; CHECK: stg     sp, [sp, #
 ; CHECK: st2g    sp, [sp], #
 ; CHECK: ret
   %a = alloca i8, i32 128, align 16
   %b = alloca i8, i32 128, align 16
   %c = alloca i8, i32 48, align 16
   br i1 %flag, label %if.then, label %if.end

 }
 
 define void @early_512_512(i1 %flag) {
 entry:
 ; CHECK-LABEL: early_512_512:
 ; CHECK: tbz   w0, #0, [[LABEL:.LBB.*]]
 ; CHECK: add   x9, sp, #
 ; CHECK: mov   x8, #1024
-; CHECK: sub   x8, x8, #32
+; CHECK: subs  x8, x8, #32
 ; CHECK: st2g  x9, [x9], #32
-; CHECK: cbnz  x8,
+; CHECK: b.ne
 ; CHECK: [[LABEL]]:
 ; CHECK: stg     sp, [sp, #
 ; CHECK: st2g    sp, [sp], #
 ; CHECK: ret
   %a = alloca i8, i32 512, align 16
   %b = alloca i8, i32 512, align 16
   %c = alloca i8, i32 48, align 16
   br i1 %flag, label %if.then, label %if.end

 }
 
 ; Two loops of size 256; the second loop updates SP.
 define void @stg128_128_gap_128_128() {
 entry:
 ; CHECK-LABEL: stg128_128_gap_128_128:
 ; CHECK: mov     x9, sp
 ; CHECK: mov     x8, #256
-; CHECK: sub     x8, x8, #32
+; CHECK: subs    x8, x8, #32
 ; CHECK: st2g    x9, [x9], #32
-; CHECK: cbnz    x8,
+; CHECK: b.ne
 ; CHECK: mov     x8, #256
 ; CHECK: st2g    sp, [sp], #32
-; CHECK: sub     x8, x8, #32
-; CHECK: cbnz    x8,
+; CHECK: subs    x8, x8, #32
+; CHECK: b.ne
 ; CHECK: ret
   %a = alloca i8, i32 128, align 16
   %a2 = alloca i8, i32 128, align 16
   %b = alloca i8, i32 32, align 16
   %c = alloca i8, i32 128, align 16
   %c2 = alloca i8, i32 128, align 16
   call void @use(ptr %b)
   call void @llvm.aarch64.settag(ptr %a, i64 128)
   call void @llvm.aarch64.settag(ptr %a2, i64 128)
   call void @llvm.aarch64.settag(ptr %c, i64 128)
   call void @llvm.aarch64.settag(ptr %c2, i64 128)
   ret void
 }

llvm/test/CodeGen/AArch64/settag.ll

 }
 
 define void @stg16(ptr %p) {
 ; CHECK-LABEL: stg16:
 ; CHECK:       // %bb.0: // %entry
 ; CHECK-NEXT:    mov x8, #256
 ; CHECK-NEXT:  .LBB5_1: // %entry
 ; CHECK-NEXT:    // =>This Inner Loop Header: Depth=1
-; CHECK-NEXT:    sub x8, x8, #32
+; CHECK-NEXT:    subs x8, x8, #32
 ; CHECK-NEXT:    st2g x0, [x0], #32
-; CHECK-NEXT:    cbnz x8, .LBB5_1
+; CHECK-NEXT:    b.ne .LBB5_1
 ; CHECK-NEXT:  // %bb.2: // %entry
 ; CHECK-NEXT:    ret
 entry:
   call void @llvm.aarch64.settag(ptr %p, i64 256)
   ret void
 }
 
 define void @stg17(ptr %p) {
 ; CHECK-LABEL: stg17:
 ; CHECK:       // %bb.0: // %entry
 ; CHECK-NEXT:    mov x8, #256
 ; CHECK-NEXT:    stg x0, [x0], #16
 ; CHECK-NEXT:  .LBB6_1: // %entry
 ; CHECK-NEXT:    // =>This Inner Loop Header: Depth=1
-; CHECK-NEXT:    sub x8, x8, #32
+; CHECK-NEXT:    subs x8, x8, #32
 ; CHECK-NEXT:    st2g x0, [x0], #32
-; CHECK-NEXT:    cbnz x8, .LBB6_1
+; CHECK-NEXT:    b.ne .LBB6_1
 ; CHECK-NEXT:  // %bb.2: // %entry
 ; CHECK-NEXT:    ret
 entry:
   call void @llvm.aarch64.settag(ptr %p, i64 272)
   ret void
 }
 
 define void @stzg3(ptr %p) {

 
 define void @stzg17(ptr %p) {
 ; CHECK-LABEL: stzg17:
 ; CHECK:       // %bb.0: // %entry
 ; CHECK-NEXT:    mov x8, #256
 ; CHECK-NEXT:    stzg x0, [x0], #16
 ; CHECK-NEXT:  .LBB8_1: // %entry
 ; CHECK-NEXT:    // =>This Inner Loop Header: Depth=1
-; CHECK-NEXT:    sub x8, x8, #32
+; CHECK-NEXT:    subs x8, x8, #32
 ; CHECK-NEXT:    stz2g x0, [x0], #32
-; CHECK-NEXT:    cbnz x8, .LBB8_1
+; CHECK-NEXT:    b.ne .LBB8_1
 ; CHECK-NEXT:  // %bb.2: // %entry
 ; CHECK-NEXT:    ret
 entry:
   call void @llvm.aarch64.settag.zero(ptr %p, i64 272)
   ret void
 }
 
 define void @stg_alloca1() uwtable {

 ; CHECK-LABEL: stg_alloca17:
 ; CHECK:       // %bb.0: // %entry
 ; CHECK-NEXT:    sub sp, sp, #288
 ; CHECK-NEXT:    mov x8, #256
 ; CHECK-NEXT:    str x29, [sp, #272] // 8-byte Folded Spill
 ; CHECK-NEXT:  .LBB11_1: // %entry
 ; CHECK-NEXT:    // =>This Inner Loop Header: Depth=1
 ; CHECK-NEXT:    st2g sp, [sp], #32
-; CHECK-NEXT:    sub x8, x8, #32
-; CHECK-NEXT:    cbnz x8, .LBB11_1
+; CHECK-NEXT:    subs x8, x8, #32
+; CHECK-NEXT:    b.ne .LBB11_1
 ; CHECK-NEXT:  // %bb.2: // %entry
 ; CHECK-NEXT:    stg sp, [sp], #16
 ; CHECK-NEXT:    ldr x29, [sp], #16 // 8-byte Folded Reload
 ; CHECK-NEXT:    ret
 entry:
   %a = alloca i8, i32 272, align 16
   call void @llvm.aarch64.settag(ptr %a, i64 272)
   ret void
 }
 
 define void @stg_alloca18() uwtable {
 ; CHECK-LABEL: stg_alloca18:
 ; CHECK:       // %bb.0: // %entry
 ; CHECK-NEXT:    sub sp, sp, #288
 ; CHECK-NEXT:    .cfi_def_cfa_offset 288
 ; CHECK-NEXT:    str x29, [sp, #272] // 8-byte Folded Spill
 ; CHECK-NEXT:    .cfi_offset w29, -16
 ; CHECK-NEXT:    mov x9, sp
 ; CHECK-NEXT:    mov x8, #256
 ; CHECK-NEXT:    stg x9, [x9], #16
 ; CHECK-NEXT:  .LBB12_1: // %entry
 ; CHECK-NEXT:    // =>This Inner Loop Header: Depth=1
-; CHECK-NEXT:    sub x8, x8, #32
+; CHECK-NEXT:    subs x8, x8, #32
 ; CHECK-NEXT:    st2g x9, [x9], #32
-; CHECK-NEXT:    cbnz x8, .LBB12_1
+; CHECK-NEXT:    b.ne .LBB12_1
 ; CHECK-NEXT:  // %bb.2: // %entry
 ; CHECK-NEXT:    add sp, sp, #272
 ; CHECK-NEXT:    .cfi_def_cfa_offset 16
 ; CHECK-NEXT:    ldr x29, [sp], #16 // 8-byte Folded Reload
 ; CHECK-NEXT:    .cfi_def_cfa_offset 0
 ; CHECK-NEXT:    .cfi_restore w29
 ; CHECK-NEXT:    ret
 entry:
   %a = alloca i8, i32 272, align 16
   call void @llvm.aarch64.settag(ptr %a, i64 272)
   ret void
 }
 
+; Verify that SLH works together with MTE stack tagging,
+; see issue https://github.com/llvm/llvm-project/issues/61830
+define void @test_slh() speculative_load_hardening {
+; CHECK-LABEL: test_slh
+; Verify that the memtag loop uses a b.cc conditional branch
+; rather than an cb[n]z branch.
+;CHECK-NOT:   cb{{n?}}z
+;CHECK:       b.
+  %d = alloca [48 x i32], align 4
+  call void @b(ptr %d)
+  ret void
+}
+declare void @b(ptr)
+
+
 declare void @llvm.aarch64.settag(ptr %p, i64 %a)
 declare void @llvm.aarch64.settag.zero(ptr %p, i64 %a)