[RISCV] Expand PseudoTAIL with t2 instead of t1 for Zicfilp.

[fakepaper56]

Summary

PseudoTail should be a software guarded branch in Ziciflp, since its branch
target is known in link time. JALR/C.JR/C.JALR with rs1 as t2 is termed a
software guarded branch. Such branches do not need to land on a lpad instruction.

[jrtc27]

https://github.com/riscv-non-isa/riscv-asm-manual/blob/master/riscv-asm.md#-a-listing-of-standard-risc-v-pseudoinstructions very clearly states that x6 is the register used. What's wrong with t1? x1 and x5 are special as the registers for microarchitectural push/pop hints and, with Zicfilp, repurposed for shadow stack push/pop (somewhat ew), but neither x6 nor x7 are mentioned in the CFI spec that I can see.

[jrtc27]

Oh I see, https://github.com/riscv/riscv-cfi/blob/main/cfi_forward.adoc does. Why on earth did they pick x7 for tail when x6 is the register defined for tail?

[jrtc27]

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1681520704

[craig.topper]

In D158138#4593972, @jrtc27 wrote:

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1681520704

Is it because x7 is the landing pad label? So if the call used x7 as the address then its clearly does not contain a landing pad label? I'm just guessing.

[jrtc27]

In D158138#4593975, @craig.topper wrote:

In D158138#4593972, @jrtc27 wrote:

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1681520704

Is it because x7 is the landing pad label? So if the call used x7 as the address then its clearly does not contain a landing pad label? I'm just guessing.

So why not make x6 the landing pad label if they want everything to be in one register...

[craig.topper]

In D158138#4593976, @jrtc27 wrote:

In D158138#4593975, @craig.topper wrote:

In D158138#4593972, @jrtc27 wrote:

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1681520704

Is it because x7 is the landing pad label? So if the call used x7 as the address then its clearly does not contain a landing pad label? I'm just guessing.

So why not make x6 the landing pad label if they want everything to be in one register...

Software guarded branches changed to x6 here https://github.com/riscv/riscv-cfi/commit/aaea3077bc4256dd56b07403cd1b88ca46b83c27 but then changed back https://github.com/riscv/riscv-cfi/commit/afbc2d5544f8ceda4a69d4c1ba17efc7c2c639d3

[jrtc27]

In D158138#4593982, @craig.topper wrote:

In D158138#4593976, @jrtc27 wrote:

In D158138#4593975, @craig.topper wrote:

In D158138#4593972, @jrtc27 wrote:

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1681520704

Is it because x7 is the landing pad label? So if the call used x7 as the address then its clearly does not contain a landing pad label? I'm just guessing.

So why not make x6 the landing pad label if they want everything to be in one register...

Software guarded branches changed to x6 here https://github.com/riscv/riscv-cfi/commit/aaea3077bc4256dd56b07403cd1b88ca46b83c27 but then changed back https://github.com/riscv/riscv-cfi/commit/afbc2d5544f8ceda4a69d4c1ba17efc7c2c639d3

I found as much, but not any justification for these changes anywhere, just unhelpful commits that don't document any rationale.

[fakepaper56]

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1686258580
In this comment, Ved says that x6/t1 plays an ABI role in passing information between the PLT header and the dynamic linker.

[jrtc27]

In D158138#4616083, @fakepaper56 wrote:

https://github.com/riscv/riscv-cfi/issues/125#issuecomment-1686258580
In this comment, Ved says that x6/t1 plays an ABI role in passing information between the PLT header and the dynamic linker.

Which is irrelevant for the register to jump via

[fakepaper56]

Ping.

llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp

void RISCVMCCodeEmitter::expandFunctionCall(const MCInst &MI,
                                             SmallVectorImpl<MCFixup> &Fixups,
                                             const MCSubtargetInfo &STI) const {
   MCInst TmpInst;
   MCOperand Func;
   MCRegister Ra;
   if (MI.getOpcode() == RISCV::PseudoTAIL) {
     Func = MI.getOperand(0);
     Ra = RISCV::X6;
+    // For Zicfilp, PseudoTAIL should be expanded to a software guarded branch.
+    // It means to use t2(x7) as rs1 of JALR to expand PseudoTAIL.
+    // NOTE: Should we use X7 without Zicfilp after Zicfilp ratified?
+    if (STI.hasFeature(RISCV::FeatureStdExtZicfilp))
+      Ra = RISCV::X7;
   } else if (MI.getOpcode() == RISCV::PseudoCALLReg) {
     Func = MI.getOperand(1);
     Ra = MI.getOperand(0).getReg();
   } else if (MI.getOpcode() == RISCV::PseudoCALL) {
     Func = MI.getOperand(0);
     Ra = RISCV::X1;
   } else if (MI.getOpcode() == RISCV::PseudoJump) {
     Func = MI.getOperand(1);

llvm/test/MC/RISCV/tail-call.s

 # RUN: llvm-mc -filetype=obj -triple riscv32 < %s \
 # RUN:   | llvm-objdump -d - | FileCheck --check-prefix=INSTR %s
 # RUN: llvm-mc -filetype=obj -triple riscv32 < %s \
 # RUN:   | llvm-readobj -r - | FileCheck -check-prefix=RELOC %s
 # RUN: llvm-mc -triple riscv32 < %s -show-encoding \
 # RUN:   | FileCheck -check-prefix=FIXUP %s
 
 # RUN: llvm-mc -filetype=obj -triple riscv64 < %s \
 # RUN:   | llvm-objdump -d - | FileCheck --check-prefix=INSTR %s
 # RUN: llvm-mc -filetype=obj -triple riscv64 < %s \
 # RUN:   | llvm-readobj -r - | FileCheck -check-prefix=RELOC %s
 # RUN: llvm-mc -triple riscv64 < %s -show-encoding \
 # RUN:   | FileCheck -check-prefix=FIXUP %s
 
+# RUN: llvm-mc -filetype=obj -triple riscv32 -mattr=+experimental-zicfilp < %s \
+# RUN:   | llvm-objdump -d - | FileCheck --check-prefix=INSTR-ZICFILP %s
+# RUN: llvm-mc -filetype=obj -triple riscv32 -mattr=+experimental-zicfilp < %s \
+# RUN:   | llvm-readobj -r - | FileCheck -check-prefix=RELOC %s
+# RUN: llvm-mc -triple riscv32 -mattr=+experimental-zicfilp < %s -show-encoding \
+# RUN:   | FileCheck -check-prefix=FIXUP %s
+
+# RUN: llvm-mc -filetype=obj -triple riscv64 -mattr=+experimental-zicfilp < %s \
+# RUN:   | llvm-objdump -d - | FileCheck --check-prefix=INSTR-ZICFILP %s
+# RUN: llvm-mc -filetype=obj -triple riscv64 -mattr=+experimental-zicfilp < %s \
+# RUN:   | llvm-readobj -r - | FileCheck -check-prefix=RELOC %s
+# RUN: llvm-mc -triple riscv64 -mattr=+experimental-zicfilp < %s -show-encoding \
+# RUN:   | FileCheck -check-prefix=FIXUP %s
+
 .long foo
 
 tail foo
 # RELOC: R_RISCV_CALL_PLT foo 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: foo, kind:
+
 tail bar
 # RELOC: R_RISCV_CALL_PLT bar 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: bar, kind:
 
 # Ensure that tail calls to functions whose names coincide with register names
 # work.
 
 tail zero
 # RELOC: R_RISCV_CALL_PLT zero 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: zero, kind:
 
 tail f1
 # RELOC: R_RISCV_CALL_PLT f1 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: f1, kind:
 
 tail ra
 # RELOC: R_RISCV_CALL_PLT ra 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: ra, kind:
 
 tail foo@plt
 # RELOC: R_RISCV_CALL_PLT foo 0x0
 # INSTR: auipc t1, 0
 # INSTR: jr  t1
+# INSTR-ZICFILP: auipc t2, 0
+# INSTR-ZICFILP: jr  t2
 # FIXUP: fixup A - offset: 0, value: foo@plt, kind: