Commit 64778dce authored by Simon Dardis's avatar Simon Dardis
Browse files

Backporting r325653: 

------------------------------------------------------------------------
r325653 | sdardis | 2018-02-21 00:06:53 +0000 (Wed, 21 Feb 2018) | 31 lines

[mips] Spectre variant two mitigation for MIPSR2

This patch provides mitigation for CVE-2017-5715, Spectre variant two,
which affects the P5600 and P6600. It implements the LLVM part of
-mindirect-jump=hazard. It is _not_ enabled by default for the P5600.

The migitation strategy suggested by MIPS for these processors is to use
hazard barrier instructions. 'jalr.hb' and 'jr.hb' are hazard
barrier variants of the 'jalr' and 'jr' instructions respectively.

These instructions impede the execution of instruction stream until
architecturally defined hazards (changes to the instruction stream,
privileged registers which may affect execution) are cleared. These
instructions in MIPS' designs are not speculated past.

These instructions are used with the attribute +use-indirect-jump-hazard
when branching indirectly and for indirect function calls.

These instructions are defined by the MIPS32R2 ISA, so this mitigation
method is not compatible with processors which implement an earlier
revision of the MIPS ISA.

Performance benchmarking of this option with -fpic and lld using
-z hazardplt shows a difference of overall 10%~ time increase
for the LLVM testsuite. Certain benchmarks such as methcall show a
substantially larger increase in time due to their nature.

Reviewers: atanasyan, zoran.jovanovic

Differential Revision: https://reviews.llvm.org/D43486

------------------------------------------------------------------------

llvm-svn: 327751
parent 0d404721

llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp

+1 −0
Original line number Diff line number Diff line
@@ -5133,6 +5133,7 @@ unsigned MipsAsmParser::checkTargetMatchPredicate(MCInst &Inst) { 
  // It also applies for registers Rt and Rs of microMIPSr6 jalrc.hb instruction

  // and registers Rd and Base for microMIPS lwp instruction

  case Mips::JALR_HB:

  case Mips::JALR_HB64:

  case Mips::JALRC_HB_MMR6:

  case Mips::JALRC_MMR6:

    if (Inst.getOperand(0).getReg() == Inst.getOperand(1).getReg())

llvm/lib/Target/Mips/MicroMips32r6InstrInfo.td

+13 −1
Original line number Diff line number Diff line
@@ -1878,4 +1878,16 @@ let AddedComplexity = 41 in { 
  def : StoreRegImmPat<SDC1_D64_MMR6, f64>, FGR_64, ISA_MICROMIPS32R6;

}



def TAILCALL_MMR6 : TailCall<BC_MMR6, brtarget26_mm>, ISA_MICROMIPS32R6;
 
def TAILCALL_MMR6 : TailCall<BC_MMR6, brtarget26_mm>, ISA_MICROMIPS64R6;



def TAILCALLREG_MMR6 : TailCallReg<JRC16_MM, GPR32Opnd>, ISA_MICROMIPS32R6;



def PseudoIndirectBranch_MMR6 : PseudoIndirectBranchBase<JRC16_MMR6,

                                                         GPR32Opnd>,

                                ISA_MICROMIPS32R6;



def : MipsPat<(MipsTailCall (iPTR tglobaladdr:$dst)),

              (TAILCALL_MMR6 tglobaladdr:$dst)>, ISA_MICROMIPS32R6;



def : MipsPat<(MipsTailCall (iPTR texternalsym:$dst)),

              (TAILCALL_MMR6 texternalsym:$dst)>, ISA_MICROMIPS32R6;

llvm/lib/Target/Mips/MicroMips64r6InstrInfo.td

+8 −0
Original line number Diff line number Diff line
@@ -352,6 +352,8 @@ class LWUPC_MM64R6_DESC { 
  bit IsPCRelativeLoad = 1;

}



class JRC16_64_MMR6_DESC : JRC16_MMR6_DESC_BASE<"jrc16", GPR64Opnd>;



//===----------------------------------------------------------------------===//

//

// Instruction Definitions
@@ -465,6 +467,9 @@ let DecoderNamespace = "MicroMipsR6" in { 
  def LWUPC_MM64R6 : R6MMR6Rel, LWUPC_MM64R6_ENC, LWUPC_MM64R6_DESC,

                     ISA_MICROMIPS64R6;

}

let DecoderNamespace = "MicroMips64r6" in

  def JRC16_64_MMR6 : R6MMR6Rel, JRC16_64_MMR6_DESC, JRC16_MMR6_ENC,

                      ISA_MICROMIPS64R6;



let AdditionalPredicates = [InMicroMips] in

defm : MaterializeImms<i64, ZERO_64, DADDIU_MM64R6, LUi64, ORi64>;
@@ -505,6 +510,9 @@ def : MipsPat<(subc GPR64:$lhs, GPR64:$rhs), 


def : MipsPat<(atomic_load_64 addr:$a), (LD_MM64R6 addr:$a)>, ISA_MICROMIPS64R6;



def TAILCALLREG64_MMR6 : TailCallReg<JRC16_64_MMR6, GPR64Opnd>,

                         ISA_MICROMIPS64R6;



//===----------------------------------------------------------------------===//

//

// Instruction aliases

llvm/lib/Target/Mips/MicroMipsInstrInfo.td

+6 −0
Original line number Diff line number Diff line
@@ -993,6 +993,12 @@ let DecoderNamespace = "MicroMips", Predicates = [InMicroMips] in { 


def TAILCALL_MM : TailCall<J_MM, jmptarget_mm>, ISA_MIPS1_NOT_32R6_64R6;



def TAILCALLREG_MM  : TailCallReg<JRC16_MM, GPR32Opnd>,

                      ISA_MICROMIPS32_NOT_MIPS32R6;



def PseudoIndirectBranch_MM : PseudoIndirectBranchBase<JR_MM, GPR32Opnd>,

                              ISA_MICROMIPS32_NOT_MIPS32R6;



let DecoderNamespace = "MicroMips" in {

  def RDHWR_MM : MMRel, R6MMR6Rel, ReadHardware<GPR32Opnd, HWRegsOpnd>,

                 RDHWR_FM_MM, ISA_MICROMIPS32_NOT_MIPS32R6;

llvm/lib/Target/Mips/Mips.td

+4 −0
Original line number Diff line number Diff line
@@ -193,6 +193,10 @@ def FeatureMT : SubtargetFeature<"mt", "HasMT", "true", "Mips MT ASE">; 
def FeatureLongCalls : SubtargetFeature<"long-calls", "UseLongCalls", "true",

                                        "Disable use of the jal instruction">;



def FeatureUseIndirectJumpsHazard : SubtargetFeature<"use-indirect-jump-hazard",

                                                    "UseIndirectJumpsHazard",

                                                    "true", "Use indirect jump"

                        " guards to prevent certain speculation based attacks">;

//===----------------------------------------------------------------------===//

// Mips processors supported.

//===----------------------------------------------------------------------===//