[RV64Y] Bounded variadic/memory argument should not be used under FastCC

[dpgao]

In the CC_RISCV_FastCC calling convention uses temporary registers to pass arguments. When this calling convention is used, all memory arguments are still implicitly passed via the stack even when bounded variadic/memory arguments are enabled.

However, the current implementation incorrectly clobbers a temporary register to hold the bounded variadic/memory arguments buffer when calling another function with fastcc.

[veselypeta]

I haven't looked at the fast_cc calling convention yet, so I'm not surprised this is broken. Do you have an example of this?

[dpgao]

The fastcc calling convention is used automatically for certain static functions. I found this in the wild when extent_split_interior is called from extent_grow_retained in contrib/jemalloc/src/extent.c.

Do you have an example of this?

Sure. It is more straightforward to directly trigger fastcc in LLVM, whereas it is more opaque in C.

define fastcc i32 @y(i32 %a0, i32 %a1, i32 %a2, i32 %a3, i32 %a4, i32 %a5, i32 %a6, i32 %a7,
                     i32 %t2,
                     i32 %t3,
                     i32 %t4,
                     i32 %t5,
                     i32 %t6,
                     i32 %m0) {
  %call = call i32 @x(i32 %t2, i32 %t3, i32 %t4, i32 %t5, i32 %t6, i32 %m0)
  ret i32 %call
}

declare i32 @x(i32, i32, i32, i32, i32, i32)

Note that in the generated code below, argument m0 is loaded from the bounded memory argument buffer, which I have set to ct6 rather than the current ct2 to avoid conflicting with the PLT (as we discussed on Slack previously). However, fastcc should not be using bounded memory arguments at all, as all memory arguments are still passed via the stack.

y:
        ld      a5, 0(ct6)
        mv      a4, t6
        mv      a3, t5
        mv      a2, t4
        mv      a1, t3
        mv      a0, t2
        tail    x

[dpgao]

A quick fix is to manually check for CallConv != CallingConv::Fast when deciding whether to use bounded vararg/memargs. This does look a bit messy though.

diff --git a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
index 8951799d1f..457087c2b3 100644
--- a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
+++ b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
@@ -15683,8 +15683,7 @@ static SDValue unpackFromMemLoc(SelectionDAG &DAG, SDValue Chain,
   MachineFrameInfo &MFI = MF.getFrameInfo();
   const RISCVSubtarget &STI = MF.getSubtarget<RISCVSubtarget>();
   const bool IsPureCapABI = RISCVABI::isCheriPureCapABI(STI.getTargetABI());
-  const bool UseBoundedMemArgsCallee =
-      IsPureCapABI && STI.hasCheriBoundMemArgCallee();
+  const bool UseBoundedMemArgsCallee = ArgRegArgs != SDValue();
 
   EVT LocVT = VA.getLocVT();
   EVT ValVT = VA.getValVT();
@@ -16027,10 +16026,10 @@ SDValue RISCVTargetLowering::LowerFormalArguments(
   const bool IsCheriPureCapABI =
       RISCVABI::isCheriPureCapABI(Subtarget.getTargetABI());
   const bool UseBoundedMemArgsCallee =
-      IsCheriPureCapABI && Subtarget.hasCheriBoundMemArgCallee();
+      IsCheriPureCapABI && Subtarget.hasCheriBoundMemArgCallee() && CallConv != CallingConv::Fast;
   const bool UseBoundedMemArgsCaller =
-      IsCheriPureCapABI && Subtarget.hasCheriBoundMemArgCaller();
-  const bool UseBoundedVarArgs = IsCheriPureCapABI && Subtarget.hasCheriBoundVarArg();
+      IsCheriPureCapABI && Subtarget.hasCheriBoundMemArgCaller() && CallConv != CallingConv::Fast;
+  const bool UseBoundedVarArgs = IsCheriPureCapABI && Subtarget.hasCheriBoundVarArg() && CallConv != CallingConv::Fast;
   if (UseBoundedMemArgsCallee) {
     for (size_t I = 0; I < Ins.size(); I++) {
       CCValAssign &VA = ArgLocs[I];
@@ -16272,11 +16271,11 @@ SDValue RISCVTargetLowering::LowerCall(CallLoweringInfo &CLI,
 
   MachineFunction &MF = DAG.getMachineFunction();
   bool PureCapABI = RISCVABI::isCheriPureCapABI(Subtarget.getTargetABI());
-  bool UseBoundedVarArgs = PureCapABI && Subtarget.hasCheriBoundVarArg();
+  bool UseBoundedVarArgs = PureCapABI && Subtarget.hasCheriBoundVarArg() && CallConv != CallingConv::Fast;
   bool UseBoundeMemArgsCaller =
-      PureCapABI && Subtarget.hasCheriBoundMemArgCaller();
+      PureCapABI && Subtarget.hasCheriBoundMemArgCaller() && CallConv != CallingConv::Fast;
   bool UseBoundeMemArgsCallee =
-      PureCapABI && Subtarget.hasCheriBoundMemArgCallee();
+      PureCapABI && Subtarget.hasCheriBoundMemArgCallee() && CallConv != CallingConv::Fast;
 
   // Analyze the operands of the call, assigning locations to each operand.
   SmallVector<CCValAssign, 16> ArgLocs;