[ARM] harden-sls-blr: avoid r12 and lr in indirect calls

[kristof.beyls]

Summary

As a linker is allowed to clobber r12 on function calls, the
code transformation that hardens indirect calls is not correct in case a
linker does so. Similarly, the transformation is not correct when
register lr is used.

This patch makes sure that r12 or lr are not used for indirect calls
when harden-sls-blr is enabled.

[ostannard]

llvm/lib/Target/ARM/ARMInstrInfo.td

2498

Wouldn't this also prevent use of the BLX instructions in inline assembly? I think it would be better to leave the requirements on the instructions as they are, and move the isel patterns out into separate Pattern records, which can have their own target requirements. I looks like that is already how the AArch64 backend does this.

llvm/test/CodeGen/ARM/speculation-hardening-sls.ll

195

A slightly less fragile way to do this would be to pass the function pointer into and out an inline asm statement, with an output constraint which forces it into r12/lr. The compiler can still move it to a different register (and will need to do that with slsblr enabled), but it won't be dependent on register allocation order.

[kristof.beyls]

Updated patch based on review comments + rebased to ToT

[kristof.beyls]

llvm/lib/Target/ARM/ARMInstrInfo.td

2498

Agreed, I have separated out the patterns here and also in the Thumb instruction variants.
I also added a test to the test file that checks that "blx r12" is accepted if used in inline assembly.

llvm/test/CodeGen/ARM/speculation-hardening-sls.ll

195

Thanks for the suggestion, that is indeed better.
Now implemented.

[ostannard]

LGTM

llvm/lib/Target/ARM/ARMBaseInstrInfo.h

bool isIndirectBranchOpcode(int Opc) {
   return Opc == ARM::BX || Opc == ARM::MOVPCRX || Opc == ARM::tBRIND;
 }
 
 static inline bool isIndirectCall(const MachineInstr &MI) {
   int Opc = MI.getOpcode();
   switch (Opc) {
     // indirect calls:
   case ARM::BLX:
+  case ARM::BLX_noip:
   case ARM::BLX_pred:
+  case ARM::BLX_pred_noip:
   case ARM::BX_CALL:
   case ARM::BMOVPCRX_CALL:
   case ARM::TCRETURNri:
   case ARM::TAILJMPr:
   case ARM::TAILJMPr4:
   case ARM::tBLXr:
+  case ARM::tBLXr_noip:
   case ARM::tBLXNSr:
   case ARM::tBLXNS_CALL:
   case ARM::tBX_CALL:
   case ARM::tTAILJMPr:
     assert(MI.isCall(MachineInstr::IgnoreBundle));
     return true;
     // direct calls:
   case ARM::BL:

 
 // Return true if the given intrinsic is a gather or scatter
 inline bool isGatherScatter(IntrinsicInst *IntInst) {
   if (IntInst == nullptr)
     return false;
   return isGather(IntInst) || isScatter(IntInst);
 }
 
+unsigned getBLXOpcode(const MachineFunction &MF);
+unsigned gettBLXrOpcode(const MachineFunction &MF);
+unsigned getBLXpredOpcode(const MachineFunction &MF);
+
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARMBASEINSTRINFO_H

llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp

outliner::OutlinedFunction ARMBaseInstrInfo::getOutliningCandidateInfo(
 
   // If the last instruction in any candidate is a terminator, then we should
   // tail call all of the candidates.
   if (RepeatedSequenceLocs[0].back()->isTerminator()) {
     FrameID = MachineOutlinerTailCall;
     NumBytesToCreateFrame = Costs.FrameTailCall;
     SetCandidateCallInfo(MachineOutlinerTailCall, Costs.CallTailCall);
   } else if (LastInstrOpcode == ARM::BL || LastInstrOpcode == ARM::BLX ||
-             LastInstrOpcode == ARM::tBL || LastInstrOpcode == ARM::tBLXr ||
+             LastInstrOpcode == ARM::BLX_noip || LastInstrOpcode == ARM::tBL ||
+             LastInstrOpcode == ARM::tBLXr ||
+             LastInstrOpcode == ARM::tBLXr_noip ||
              LastInstrOpcode == ARM::tBLXi) {
     FrameID = MachineOutlinerThunk;
     NumBytesToCreateFrame = Costs.FrameThunk;
     SetCandidateCallInfo(MachineOutlinerThunk, Costs.CallThunk);
   } else {
     // We need to decide how to emit calls + frames. We can always emit the same
     // frame if we don't need to save to the stack. If we have to save to the
     // stack, then we need a different frame.
if (Callee &&
       return outliner::InstrType::Illegal;
 
     // If we don't know anything about the callee, assume it depends on the
     // stack layout of the caller. In that case, it's only legal to outline
     // as a tail-call. Explicitly list the call instructions we know about so
     // we don't get unexpected results with call pseudo-instructions.
     auto UnknownCallOutlineType = outliner::InstrType::Illegal;
     if (Opc == ARM::BL || Opc == ARM::tBL || Opc == ARM::BLX ||
-        Opc == ARM::tBLXr || Opc == ARM::tBLXi)
+        Opc == ARM::BLX_noip || Opc == ARM::tBLXr || Opc == ARM::tBLXr_noip ||
+        Opc == ARM::tBLXi)
       UnknownCallOutlineType = outliner::InstrType::LegalTerminator;
 
     if (!Callee)
       return UnknownCallOutlineType;
 
     // We have a function we have information about.  Check if it's something we
     // can safely outline.
     MachineFunction *MF = MI.getParent()->getParent();

 bool ARMBaseInstrInfo::isReallyTriviallyReMaterializable(const MachineInstr &MI,
                                                          AAResults *AA) const {
   // Try hard to rematerialize any VCTPs because if we spill P0, it will block
   // the tail predication conversion. This means that the element count
   // register has to be live for longer, but that has to be better than
   // spill/restore and VPT predication.
   return isVCTP(&MI) && !isPredicated(MI);
 }
+
+unsigned llvm::getBLXOpcode(const MachineFunction &MF) {
+  return (MF.getSubtarget<ARMSubtarget>().hardenSlsBlr()) ? ARM::BLX_noip
+                                                          : ARM::BLX;
+}
+
+unsigned llvm::gettBLXrOpcode(const MachineFunction &MF) {
+  return (MF.getSubtarget<ARMSubtarget>().hardenSlsBlr()) ? ARM::tBLXr_noip
+                                                          : ARM::tBLXr;
+}
+
+unsigned llvm::getBLXpredOpcode(const MachineFunction &MF) {
+  return (MF.getSubtarget<ARMSubtarget>().hardenSlsBlr()) ? ARM::BLX_pred_noip
+                                                          : ARM::BLX_pred;
+}
+

llvm/lib/Target/ARM/ARMCallLowering.cpp

struct CallReturnHandler : public ARMIncomingValueHandler {
   void markPhysRegUsed(unsigned PhysReg) override {
     MIB.addDef(PhysReg, RegState::Implicit);
   }
 
   MachineInstrBuilder MIB;
 };
 
 // FIXME: This should move to the ARMSubtarget when it supports all the opcodes.
-unsigned getCallOpcode(const ARMSubtarget &STI, bool isDirect) {
+unsigned getCallOpcode(const MachineFunction &MF, const ARMSubtarget &STI,
+                       bool isDirect) {
   if (isDirect)
     return STI.isThumb() ? ARM::tBL : ARM::BL;
 
   if (STI.isThumb())
-    return ARM::tBLXr;
+    return gettBLXrOpcode(MF);
 
   if (STI.hasV5TOps())
-    return ARM::BLX;
+    return getBLXOpcode(MF);
 
   if (STI.hasV4TOps())
     return ARM::BX_CALL;
 
   return ARM::BMOVPCRX_CALL;
 }
 } // end anonymous namespace
 
bool ARMCallLowering::lowerCall(MachineIRBuilder &MIRBuilder, CallLoweringInfo &Info) const {
   if (STI.isThumb1Only())
     return false;
 
   auto CallSeqStart = MIRBuilder.buildInstr(ARM::ADJCALLSTACKDOWN);
 
   // Create the call instruction so we can add the implicit uses of arg
   // registers, but don't insert it yet.
   bool IsDirect = !Info.Callee.isReg();
-  auto CallOpcode = getCallOpcode(STI, IsDirect);
+  auto CallOpcode = getCallOpcode(MF, STI, IsDirect);
   auto MIB = MIRBuilder.buildInstrNoInsert(CallOpcode);
 
   bool IsThumb = STI.isThumb();
   if (IsThumb)
     MIB.add(predOps(ARMCC::AL));
 
   MIB.add(Info.Callee);
   if (!IsDirect) {

llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp

case ARM::TPsoft: {
         MIB =
             BuildMI(MBB, MBBI, MI.getDebugLoc(),
                     TII->get(Thumb ? ARM::tLDRpci : ARM::LDRi12), Reg)
                 .addConstantPoolIndex(MCP->getConstantPoolIndex(CPV, Align(4)));
         if (!Thumb)
           MIB.addImm(0);
         MIB.add(predOps(ARMCC::AL));
 
-        MIB = BuildMI(MBB, MBBI, MI.getDebugLoc(),
-                      TII->get(Thumb ? ARM::tBLXr : ARM::BLX));
+        MIB =
+            BuildMI(MBB, MBBI, MI.getDebugLoc(),
+                    TII->get(Thumb ? gettBLXrOpcode(*MF) : getBLXOpcode(*MF)));
         if (Thumb)
           MIB.add(predOps(ARMCC::AL));
         MIB.addReg(Reg, RegState::Kill);
       } else {
         MIB = BuildMI(MBB, MBBI, MI.getDebugLoc(),
                       TII->get(Thumb ? ARM::tBL : ARM::BL));
         if (Thumb)
           MIB.add(predOps(ARMCC::AL));

llvm/lib/Target/ARM/ARMFastISel.cpp

bool ARMFastISel::SelectRet(const Instruction *I) {
   AddOptionalDefs(MIB);
   for (unsigned R : RetRegs)
     MIB.addReg(R, RegState::Implicit);
   return true;
 }
 
 unsigned ARMFastISel::ARMSelectCallOp(bool UseReg) {
   if (UseReg)
-    return isThumb2 ? ARM::tBLXr : ARM::BLX;
+    return isThumb2 ? gettBLXrOpcode(*MF) : getBLXOpcode(*MF);
   else
     return isThumb2 ? ARM::tBL : ARM::BL;
 }
 
 unsigned ARMFastISel::getLibcallReg(const Twine &Name) {
   // Manually compute the global's type to avoid building it when unnecessary.
   Type *GVTy = Type::getInt32PtrTy(*Context, /*AS=*/0);
   EVT LCREVT = TLI.getValueType(DL, GVTy);
bool ARMFastISel::ARMEmitLibcall(const Instruction *I, RTLIB::Libcall Call) {
 
   // Issue the call.
   unsigned CallOpc = ARMSelectCallOp(Subtarget->genLongCalls());
   MachineInstrBuilder MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt,
                                     DbgLoc, TII.get(CallOpc));
   // BL / BLX don't take a predicate, but tBL / tBLX do.
   if (isThumb2)
     MIB.add(predOps(ARMCC::AL));
-  if (Subtarget->genLongCalls())
+  if (Subtarget->genLongCalls()) {
+    CalleeReg =
+        constrainOperandRegClass(TII.get(CallOpc), CalleeReg, isThumb2 ? 2 : 0);
     MIB.addReg(CalleeReg);
-  else
+  } else
     MIB.addExternalSymbol(TLI.getLibcallName(Call));
 
   // Add implicit physical register uses to the call.
   for (Register R : RegArgs)
     MIB.addReg(R, RegState::Implicit);
 
   // Add a register mask with the call-preserved registers.
   // Proper defs for return values will be added by setPhysRegsDeadExcept().
bool ARMFastISel::SelectCall(const Instruction *I,
   // Issue the call.
   unsigned CallOpc = ARMSelectCallOp(UseReg);
   MachineInstrBuilder MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt,
                                     DbgLoc, TII.get(CallOpc));
 
   // ARM calls don't take a predicate, but tBL / tBLX do.
   if(isThumb2)
     MIB.add(predOps(ARMCC::AL));
-  if (UseReg)
+  if (UseReg) {
+    CalleeReg =
+        constrainOperandRegClass(TII.get(CallOpc), CalleeReg, isThumb2 ? 2 : 0);
     MIB.addReg(CalleeReg);
-  else if (!IntrMemName)
+  } else if (!IntrMemName)
     MIB.addGlobalAddress(GV, 0, 0);
   else
     MIB.addExternalSymbol(IntrMemName, 0);
 
   // Add implicit physical register uses to the call.
   for (Register R : RegArgs)
     MIB.addReg(R, RegState::Implicit);
 

llvm/lib/Target/ARM/ARMFeatures.h

inline bool isV8EligibleForIT(const InstrType *Instr) {
   case ARM::tSTRi:
   case ARM::tSTRr:
   case ARM::tSTRspi:
   case ARM::tTST:
     return true;
 // there are some "conditionally deprecated" opcodes
   case ARM::tADDspr:
   case ARM::tBLXr:
+  case ARM::tBLXr_noip:
     return Instr->getOperand(2).getReg() != ARM::PC;
   // ADD PC, SP and BLX PC were always unpredictable,
   // now on top of it they're deprecated
   case ARM::tADDrSP:
   case ARM::tBX:
     return Instr->getOperand(0).getReg() != ARM::PC;
   case ARM::tADDhirr:
     return Instr->getOperand(0).getReg() != ARM::PC &&

llvm/lib/Target/ARM/ARMISelLowering.cpp

                 RegState::Implicit | RegState::Define | RegState::Dead);
     break;
   case CodeModel::Large: {
     MachineRegisterInfo &MRI = MBB->getParent()->getRegInfo();
     Register Reg = MRI.createVirtualRegister(&ARM::rGPRRegClass);
 
     BuildMI(*MBB, MI, DL, TII.get(ARM::t2MOVi32imm), Reg)
       .addExternalSymbol("__chkstk");
-    BuildMI(*MBB, MI, DL, TII.get(ARM::tBLXr))
+    BuildMI(*MBB, MI, DL, TII.get(gettBLXrOpcode(*MBB->getParent())))
         .add(predOps(ARMCC::AL))
         .addReg(Reg, RegState::Kill)
         .addReg(ARM::R4, RegState::Implicit | RegState::Kill)
         .addReg(ARM::R4, RegState::Implicit | RegState::Define)
         .addReg(ARM::R12,
                 RegState::Implicit | RegState::Define | RegState::Dead)
         .addReg(ARM::CPSR,
                 RegState::Implicit | RegState::Define | RegState::Dead);

llvm/lib/Target/ARM/ARMInstrInfo.td

def BL_pred : ABI<0b1011, (outs), (ins arm_bl_target:$func),
     let Inst{23-0} = func;
     let DecoderMethod = "DecodeBranchImmInstruction";
   }
 
   // ARMv5T and above
   def BLX : AXI<(outs), (ins GPR:$func), BrMiscFrm,
                 IIC_Br, "blx\t$func",
                 [(ARMcall GPR:$func)]>,
-            Requires<[IsARM, HasV5T]>, Sched<[WriteBrL]> {
+            Requires<[IsARM, HasV5T, NoSLSBLRMitigation]>, Sched<[WriteBrL]> {
     bits<4> func;
     let Inst{31-4} = 0b1110000100101111111111110011;
     let Inst{3-0}  = func;
   }
+  def BLX_noip :  ARMPseudoExpand<(outs), (ins GPRnoip:$func),
+                   4, IIC_Br, [(ARMcall GPRnoip:$func)],
+                   (BLX GPR:$func)>,
+                   Requires<[IsARM, HasV5T, SLSBLRMitigation]>,
+                   Sched<[WriteBrL]>;
+
 
   def BLX_pred : AI<(outs), (ins GPR:$func), BrMiscFrm,
                     IIC_Br, "blx", "\t$func",
                     [(ARMcall_pred GPR:$func)]>,
-                 Requires<[IsARM, HasV5T]>, Sched<[WriteBrL]> {
+                 Requires<[IsARM, HasV5T, NoSLSBLRMitigation]>,
+                 Sched<[WriteBrL]> {
     bits<4> func;
     let Inst{27-4} = 0b000100101111111111110011;
     let Inst{3-0}  = func;
   }
+  def BLX_pred_noip :  ARMPseudoExpand<(outs), (ins GPRnoip:$func),
+                   4, IIC_Br, [(ARMcall_pred GPRnoip:$func)],
+                   (BLX_pred GPR:$func, (ops 14, zero_reg))>,
+                   Requires<[IsARM, HasV5T, SLSBLRMitigation]>,
+                   Sched<[WriteBrL]>;
+
 
   // ARMv4T
   // Note: Restrict $func to the tGPR regclass to prevent it being in LR.
   def BX_CALL : ARMPseudoInst<(outs), (ins tGPR:$func),
                    8, IIC_Br, [(ARMcall_nolink tGPR:$func)]>,
                    Requires<[IsARM, HasV4T]>, Sched<[WriteBr]>;
 
   // ARMv4

llvm/lib/Target/ARM/ARMInstrThumb.td

def tBLXi : TIx2<0b11110, 0b11, 0,
     let Inst{10-1} = func{10-1};
     let Inst{0} = 0; // func{0} is assumed zero
   }
 
   // Also used for Thumb2
   def tBLXr : TI<(outs), (ins pred:$p, GPR:$func), IIC_Br,
                   "blx${p}\t$func",
                   [(ARMcall GPR:$func)]>,
-              Requires<[IsThumb, HasV5T]>,
+              Requires<[IsThumb, HasV5T, NoSLSBLRMitigation]>,
               T1Special<{1,1,1,?}>, Sched<[WriteBrL]> { // A6.2.3 & A8.6.24;
     bits<4> func;
     let Inst{6-3} = func;
     let Inst{2-0} = 0b000;
   }
+  def tBLXr_noip :  ARMPseudoExpand<(outs), (ins pred:$p, GPRnoip:$func),
+                   2,
+                   IIC_Br, [(ARMcall GPRnoip:$func)],
+                   (tBLXr pred:$p, GPR:$func)>,
+                   Requires<[IsThumb, HasV5T, SLSBLRMitigation]>,
+                   Sched<[WriteBrL]>;
+
 
   // ARMv8-M Security Extensions
   def tBLXNSr : TI<(outs), (ins pred:$p, GPRnopc:$func), IIC_Br,
                    "blxns${p}\t$func", []>,
                 Requires<[IsThumb, Has8MSecExt]>,
                 T1Special<{1,1,1,?}>, Sched<[WriteBrL]> {
     bits<4> func;
     let Inst{6-3} = func;

llvm/lib/Target/ARM/ARMPredicates.td

let RecomputePerFunction = 1 in {
   def UseMovt          : Predicate<"Subtarget->useMovt()">;
   def DontUseMovt      : Predicate<"!Subtarget->useMovt()">;
   def UseMovtInPic     : Predicate<"Subtarget->useMovt() && Subtarget->allowPositionIndependentMovt()">;
   def DontUseMovtInPic : Predicate<"!Subtarget->useMovt() || !Subtarget->allowPositionIndependentMovt()">;
 
   def UseFPVMLx: Predicate<"((Subtarget->useFPVMLx() &&"
                            "  TM.Options.AllowFPOpFusion != FPOpFusion::Fast) ||"
                            "Subtarget->hasMinSize())">;
+  def SLSBLRMitigation : Predicate<[{ MF->getSubtarget<ARMSubtarget>().hardenSlsBlr() }]>;
+  def NoSLSBLRMitigation : Predicate<[{ !MF->getSubtarget<ARMSubtarget>().hardenSlsBlr() }]>;
+
 }
 def UseMulOps        : Predicate<"Subtarget->useMulOps()">;
 
 // Prefer fused MAC for fp mul + add over fp VMLA / VMLS if they are available.
 // But only select them if more precision in FP computation is allowed, and when
 // they are not slower than a mul + add sequence.
 // Do not use them for Darwin platforms.
 def UseFusedMAC      : Predicate<"TM.Options.AllowFPOpFusion =="

llvm/lib/Target/ARM/ARMRegisterBankInfo.cpp

static auto InitializeRegisterBankOnce = [&]() {
     assert(RBGPR.covers(*TRI.getRegClass(ARM::GPRnopcRegClassID)) &&
            "Subclass not added?");
     assert(RBGPR.covers(*TRI.getRegClass(ARM::rGPRRegClassID)) &&
            "Subclass not added?");
     assert(RBGPR.covers(*TRI.getRegClass(ARM::tGPRRegClassID)) &&
            "Subclass not added?");
     assert(RBGPR.covers(*TRI.getRegClass(ARM::tcGPRRegClassID)) &&
            "Subclass not added?");
-    assert(RBGPR.covers(*TRI.getRegClass(ARM::tGPR_and_tcGPRRegClassID)) &&
+    assert(RBGPR.covers(*TRI.getRegClass(ARM::GPRnoip_and_tcGPRRegClassID)) &&
            "Subclass not added?");
-    assert(RBGPR.covers(
-               *TRI.getRegClass(ARM::tGPREven_and_tGPR_and_tcGPRRegClassID)) &&
+    assert(RBGPR.covers(*TRI.getRegClass(
+               ARM::tGPREven_and_GPRnoip_and_tcGPRRegClassID)) &&
            "Subclass not added?");
     assert(RBGPR.covers(*TRI.getRegClass(ARM::tGPROdd_and_tcGPRRegClassID)) &&
            "Subclass not added?");
     assert(RBGPR.getSize() == 32 && "GPRs should hold up to 32-bit");
 
 #ifndef NDEBUG
     ARM::checkPartialMappings();
     ARM::checkValueMappings();
 #endif
   };
 
   llvm::call_once(InitializeRegisterBankFlag, InitializeRegisterBankOnce);
 }
 
 const RegisterBank &
 ARMRegisterBankInfo::getRegBankFromRegClass(const TargetRegisterClass &RC,
                                             LLT) const {
   using namespace ARM;
 
   switch (RC.getID()) {
   case GPRRegClassID:
   case GPRwithAPSRRegClassID:
+  case GPRnoipRegClassID:
   case GPRnopcRegClassID:
+  case GPRnoip_and_GPRnopcRegClassID:
   case rGPRRegClassID:
   case GPRspRegClassID:
-  case tGPR_and_tcGPRRegClassID:
+  case GPRnoip_and_tcGPRRegClassID:
   case tcGPRRegClassID:
   case tGPRRegClassID:
   case tGPREvenRegClassID:
   case tGPROddRegClassID:
   case tGPR_and_tGPREvenRegClassID:
   case tGPR_and_tGPROddRegClassID:
   case tGPREven_and_tcGPRRegClassID:
-  case tGPREven_and_tGPR_and_tcGPRRegClassID:
+  case tGPREven_and_GPRnoip_and_tcGPRRegClassID:
   case tGPROdd_and_tcGPRRegClassID:
     return getRegBank(ARM::GPRRegBankID);
   case HPRRegClassID:
   case SPR_8RegClassID:
   case SPRRegClassID:
   case DPR_8RegClassID:
   case DPRRegClassID:
   case QPRRegClassID:

llvm/lib/Target/ARM/ARMRegisterInfo.td

def GPR : RegisterClass<"ARM", [i32], 32, (add (sequence "R%u", 0, 12),
   let AltOrders = [(add LR, GPR), (trunc GPR, 8),
                    (add (trunc GPR, 8), R12, LR, (shl GPR, 8))];
   let AltOrderSelect = [{
       return MF.getSubtarget<ARMSubtarget>().getGPRAllocationOrder(MF);
   }];
   let DiagnosticString = "operand must be a register in range [r0, r15]";
 }
 
+// Register set that excludes registers that are reserved for procedure calls.
+// This is used for pseudo-instructions that are actually implemented using a
+// procedure call.
+def GPRnoip : RegisterClass<"ARM", [i32], 32, (sub GPR, R12, LR)> {
+  // Allocate LR as the first CSR since it is always saved anyway.
+  // For Thumb1 mode, we don't want to allocate hi regs at all, as we don't
+  // know how to spill them. If we make our prologue/epilogue code smarter at
+  // some point, we can go back to using the above allocation orders for the
+  // Thumb1 instructions that know how to use hi regs.
+  let AltOrders = [(add GPRnoip, GPRnoip), (trunc GPRnoip, 8),
+                   (add (trunc GPRnoip, 8), (shl GPRnoip, 8))];
+  let AltOrderSelect = [{
+      return MF.getSubtarget<ARMSubtarget>().getGPRAllocationOrder(MF);
+  }];
+  let DiagnosticString = "operand must be a register in range [r0, r14]";
+}
+
 // GPRs without the PC.  Some ARM instructions do not allow the PC in
 // certain operand slots, particularly as the destination.  Primarily
 // useful for disassembly.
 def GPRnopc : RegisterClass<"ARM", [i32], 32, (sub GPR, PC)> {
   let AltOrders = [(add LR, GPRnopc), (trunc GPRnopc, 8),
                    (add (trunc GPRnopc, 8), R12, LR, (shl GPRnopc, 8))];
   let AltOrderSelect = [{
       return MF.getSubtarget<ARMSubtarget>().getGPRAllocationOrder(MF);

llvm/lib/Target/ARM/ARMSLSHardening.cpp

bool isThumb;
     {"__llvm_slsblr_thunk_arm_r4", ARM::R4, false},
     {"__llvm_slsblr_thunk_arm_r5", ARM::R5, false},
     {"__llvm_slsblr_thunk_arm_r6", ARM::R6, false},
     {"__llvm_slsblr_thunk_arm_r7", ARM::R7, false},
     {"__llvm_slsblr_thunk_arm_r8", ARM::R8, false},
     {"__llvm_slsblr_thunk_arm_r9", ARM::R9, false},
     {"__llvm_slsblr_thunk_arm_r10", ARM::R10, false},
     {"__llvm_slsblr_thunk_arm_r11", ARM::R11, false},
-    {"__llvm_slsblr_thunk_arm_r12", ARM::R12, false},
     {"__llvm_slsblr_thunk_arm_sp", ARM::SP, false},
-    {"__llvm_slsblr_thunk_arm_lr", ARM::LR, false},
     {"__llvm_slsblr_thunk_arm_pc", ARM::PC, false},
     {"__llvm_slsblr_thunk_thumb_r0", ARM::R0, true},
     {"__llvm_slsblr_thunk_thumb_r1", ARM::R1, true},
     {"__llvm_slsblr_thunk_thumb_r2", ARM::R2, true},
     {"__llvm_slsblr_thunk_thumb_r3", ARM::R3, true},
     {"__llvm_slsblr_thunk_thumb_r4", ARM::R4, true},
     {"__llvm_slsblr_thunk_thumb_r5", ARM::R5, true},
     {"__llvm_slsblr_thunk_thumb_r6", ARM::R6, true},
     {"__llvm_slsblr_thunk_thumb_r7", ARM::R7, true},
     {"__llvm_slsblr_thunk_thumb_r8", ARM::R8, true},
     {"__llvm_slsblr_thunk_thumb_r9", ARM::R9, true},
     {"__llvm_slsblr_thunk_thumb_r10", ARM::R10, true},
     {"__llvm_slsblr_thunk_thumb_r11", ARM::R11, true},
-    {"__llvm_slsblr_thunk_thumb_r12", ARM::R12, true},
     {"__llvm_slsblr_thunk_thumb_sp", ARM::SP, true},
-    {"__llvm_slsblr_thunk_thumb_lr", ARM::LR, true},
     {"__llvm_slsblr_thunk_thumb_pc", ARM::PC, true},
 };
 
 namespace {
 struct SLSBLRThunkInserter : ThunkInserter<SLSBLRThunkInserter> {
   const char *getThunkPrefix() { return SLSBLRNamePrefix; }
   bool mayUseThunk(const MachineFunction &MF) {
     // FIXME: This could also check if there are any indirect calls in the
MachineBasicBlock &ARMSLSHardening::ConvertIndirectCallToIndirectJump(
   //   |  BX rN                      |
   //   |  barrierInsts               |
   //   |-----------------------------|
   //
   // The __llvm_slsblr_thunk_mode_xN thunks are created by the
   // SLSBLRThunkInserter.
   // This function merely needs to transform an indirect call to a direct call
   // to __llvm_slsblr_thunk_xN.
-  //
-  // Since linkers are allowed to clobber R12 on function calls, the above
-  // mitigation only works if the original indirect call instruction was not
-  // using R12. Code generation before must make sure that no indirect call
-  // using R12 was produced if the mitigation is enabled.
-  // Also, the transformation is incorrect if the indirect call uses LR, so
-  // also have to avoid that.
-  // FIXME: that will be done in a follow-on patch.
-
   MachineInstr &IndirectCall = *MBBI;
   assert(isIndirectCall(IndirectCall) && !IndirectCall.isReturn());
   int RegOpIdxOnIndirectCall = -1;
   bool isThumb;
   switch (IndirectCall.getOpcode()) {
-  case ARM::BLX:      // !isThumb2
+  case ARM::BLX:   // !isThumb2
+  case ARM::BLX_noip:   // !isThumb2
     isThumb = false;
     RegOpIdxOnIndirectCall = 0;
     break;
   case ARM::tBLXr:      // isThumb2
+  case ARM::tBLXr_noip: // isThumb2
     isThumb = true;
     RegOpIdxOnIndirectCall = 2;
     break;
   default:
     llvm_unreachable("unhandled Indirect Call");
   }
 
   Register Reg = IndirectCall.getOperand(RegOpIdxOnIndirectCall).getReg();
+  // Since linkers are allowed to clobber R12 on function calls, the above
+  // mitigation only works if the original indirect call instruction was not
+  // using R12. Code generation before must make sure that no indirect call
+  // using R12 was produced if the mitigation is enabled.
+  // Also, the transformation is incorrect if the indirect call uses LR, so
+  // also have to avoid that.
   assert(Reg != ARM::R12 && Reg != ARM::LR);
   bool RegIsKilled = IndirectCall.getOperand(RegOpIdxOnIndirectCall).isKill();
 
   DebugLoc DL = IndirectCall.getDebugLoc();
 
   MachineFunction &MF = *MBBI->getMF();
   auto ThunkIt = llvm::find_if(SLSBLRThunks, [Reg, isThumb](auto T) {
     return T.Reg == Reg && T.isThumb == isThumb;

llvm/test/CodeGen/ARM/speculation-hardening-sls.ll

entry:
   %call = tail call i32 %0()  nounwind
 ; HARDENARM: bl {{__llvm_slsblr_thunk_arm_r[0-9]+$}}
 ; HARDENTHUMB: bl {{__llvm_slsblr_thunk_thumb_r[0-9]+$}}
   store i32 %call, i32* @b, align 4
   ret void
 ; CHECK: .Lfunc_end
 }
 
-; HARDEN-label: __llvm_slsblr_thunk_(arm|thumb)_r5:
+; Verify that neither r12 nor lr are used as registers in indirect call
+; instructions when the sls-hardening-blr mitigation is enabled, as
+; (a) a linker is allowed to clobber r12 on calls, and
+; (b) the hardening transformation isn't correct if lr is the register holding
+;     the address of the function called.
+; The below test carefully increases register pressure to persuade code
+; generation to produce an indirect call using r12 or lr. Yes, that is a bit
+; fragile.
+define i32 @check_r12(i32 (i32, i32, i32, i32)** %fp) {
+entry:
+; CHECK-LABEL: check_r12:
+  %f = load i32 (i32, i32, i32, i32)*, i32 (i32, i32, i32, i32)** %fp, align 4
+  tail call void asm sideeffect "nop", "r,r,~{r4},~{r5}"(i32 undef, i32 undef) nounwind
+  %call = call i32 %f(i32 0, i32 0, i32 0, i32 0)
+; NOHARDENARM:     blx r12
+; NOHARDENTHUMB:   blx r12
+; HARDEN-NOT: bl {{__llvm_slsblr_thunk_(arm|thumb)_r12}}
+  ret i32 %call; %add8
+; CHECK: .Lfunc_end
+}
+
+define i32 @check_lr(i32 (i32, i32, i32, i32)** %fp) {
+entry:
+; CHECK-LABEL: check_lr:
+  %f = load i32 (i32, i32, i32, i32)*, i32 (i32, i32, i32, i32)** %fp, align 4
+  tail call void asm sideeffect "nop", "r,r,r,~{r4},~{r5},~{r12}"(i32 undef, i32 undef, i32 undef) nounwind
+  %call = call i32 %f(i32 0, i32 0, i32 0, i32 0)
+; NOHARDENARM:     blx lr
+; NOHARDENTHUMB:   blx lr
+; HARDEN-NOT: bl {{__llvm_slsblr_thunk_(arm|thumb)_lr}}
+  ret i32 %call; %add8
+; CHECK: .Lfunc_end
+}
+
+
+; HARDEN-label: {{__llvm_slsblr_thunk_(arm|thumb)_r5}}:
 ; HARDEN:    bx r5
 ; ISBDSB-NEXT: dsb sy
 ; ISBDSB-NEXT: isb
 ; SB-NEXT:     dsb sy
 ; SB-NEXT:     isb
 ; HARDEN-NEXT: .Lfunc_end
+
+