Skip to content

Commit 64778dc

Browse files
author
Simon Dardis
committed
Backporting r325653:
------------------------------------------------------------------------ r325653 | sdardis | 2018-02-21 00:06:53 +0000 (Wed, 21 Feb 2018) | 31 lines [mips] Spectre variant two mitigation for MIPSR2 This patch provides mitigation for CVE-2017-5715, Spectre variant two, which affects the P5600 and P6600. It implements the LLVM part of -mindirect-jump=hazard. It is _not_ enabled by default for the P5600. The migitation strategy suggested by MIPS for these processors is to use hazard barrier instructions. 'jalr.hb' and 'jr.hb' are hazard barrier variants of the 'jalr' and 'jr' instructions respectively. These instructions impede the execution of instruction stream until architecturally defined hazards (changes to the instruction stream, privileged registers which may affect execution) are cleared. These instructions in MIPS' designs are not speculated past. These instructions are used with the attribute +use-indirect-jump-hazard when branching indirectly and for indirect function calls. These instructions are defined by the MIPS32R2 ISA, so this mitigation method is not compatible with processors which implement an earlier revision of the MIPS ISA. Performance benchmarking of this option with -fpic and lld using -z hazardplt shows a difference of overall 10%~ time increase for the LLVM testsuite. Certain benchmarks such as methcall show a substantially larger increase in time due to their nature. Reviewers: atanasyan, zoran.jovanovic Differential Revision: https://reviews.llvm.org/D43486 ------------------------------------------------------------------------ llvm-svn: 327751
1 parent 0d40472 commit 64778dc

25 files changed

+1474
-40
lines changed

‎llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5133,6 +5133,7 @@ unsigned MipsAsmParser::checkTargetMatchPredicate(MCInst &Inst) {
51335133
// It also applies for registers Rt and Rs of microMIPSr6 jalrc.hb instruction
51345134
// and registers Rd and Base for microMIPS lwp instruction
51355135
case Mips::JALR_HB:
5136+
case Mips::JALR_HB64:
51365137
case Mips::JALRC_HB_MMR6:
51375138
case Mips::JALRC_MMR6:
51385139
if (Inst.getOperand(0).getReg() == Inst.getOperand(1).getReg())

‎llvm/lib/Target/Mips/MicroMips32r6InstrInfo.td

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1878,4 +1878,16 @@ let AddedComplexity = 41 in {
18781878
def : StoreRegImmPat<SDC1_D64_MMR6, f64>, FGR_64, ISA_MICROMIPS32R6;
18791879
}
18801880

1881-
def TAILCALL_MMR6 : TailCall<BC_MMR6, brtarget26_mm>, ISA_MICROMIPS32R6;
1881+
def TAILCALL_MMR6 : TailCall<BC_MMR6, brtarget26_mm>, ISA_MICROMIPS64R6;
1882+
1883+
def TAILCALLREG_MMR6 : TailCallReg<JRC16_MM, GPR32Opnd>, ISA_MICROMIPS32R6;
1884+
1885+
def PseudoIndirectBranch_MMR6 : PseudoIndirectBranchBase<JRC16_MMR6,
1886+
GPR32Opnd>,
1887+
ISA_MICROMIPS32R6;
1888+
1889+
def : MipsPat<(MipsTailCall (iPTR tglobaladdr:$dst)),
1890+
(TAILCALL_MMR6 tglobaladdr:$dst)>, ISA_MICROMIPS32R6;
1891+
1892+
def : MipsPat<(MipsTailCall (iPTR texternalsym:$dst)),
1893+
(TAILCALL_MMR6 texternalsym:$dst)>, ISA_MICROMIPS32R6;

‎llvm/lib/Target/Mips/MicroMips64r6InstrInfo.td

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,8 @@ class LWUPC_MM64R6_DESC {
352352
bit IsPCRelativeLoad = 1;
353353
}
354354

355+
class JRC16_64_MMR6_DESC : JRC16_MMR6_DESC_BASE<"jrc16", GPR64Opnd>;
356+
355357
//===----------------------------------------------------------------------===//
356358
//
357359
// Instruction Definitions
@@ -465,6 +467,9 @@ let DecoderNamespace = "MicroMipsR6" in {
465467
def LWUPC_MM64R6 : R6MMR6Rel, LWUPC_MM64R6_ENC, LWUPC_MM64R6_DESC,
466468
ISA_MICROMIPS64R6;
467469
}
470+
let DecoderNamespace = "MicroMips64r6" in
471+
def JRC16_64_MMR6 : R6MMR6Rel, JRC16_64_MMR6_DESC, JRC16_MMR6_ENC,
472+
ISA_MICROMIPS64R6;
468473

469474
let AdditionalPredicates = [InMicroMips] in
470475
defm : MaterializeImms<i64, ZERO_64, DADDIU_MM64R6, LUi64, ORi64>;
@@ -505,6 +510,9 @@ def : MipsPat<(subc GPR64:$lhs, GPR64:$rhs),
505510

506511
def : MipsPat<(atomic_load_64 addr:$a), (LD_MM64R6 addr:$a)>, ISA_MICROMIPS64R6;
507512

513+
def TAILCALLREG64_MMR6 : TailCallReg<JRC16_64_MMR6, GPR64Opnd>,
514+
ISA_MICROMIPS64R6;
515+
508516
//===----------------------------------------------------------------------===//
509517
//
510518
// Instruction aliases

‎llvm/lib/Target/Mips/MicroMipsInstrInfo.td

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -993,6 +993,12 @@ let DecoderNamespace = "MicroMips", Predicates = [InMicroMips] in {
993993

994994
def TAILCALL_MM : TailCall<J_MM, jmptarget_mm>, ISA_MIPS1_NOT_32R6_64R6;
995995

996+
def TAILCALLREG_MM : TailCallReg<JRC16_MM, GPR32Opnd>,
997+
ISA_MICROMIPS32_NOT_MIPS32R6;
998+
999+
def PseudoIndirectBranch_MM : PseudoIndirectBranchBase<JR_MM, GPR32Opnd>,
1000+
ISA_MICROMIPS32_NOT_MIPS32R6;
1001+
9961002
let DecoderNamespace = "MicroMips" in {
9971003
def RDHWR_MM : MMRel, R6MMR6Rel, ReadHardware<GPR32Opnd, HWRegsOpnd>,
9981004
RDHWR_FM_MM, ISA_MICROMIPS32_NOT_MIPS32R6;

‎llvm/lib/Target/Mips/Mips.td

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,10 @@ def FeatureMT : SubtargetFeature<"mt", "HasMT", "true", "Mips MT ASE">;
193193
def FeatureLongCalls : SubtargetFeature<"long-calls", "UseLongCalls", "true",
194194
"Disable use of the jal instruction">;
195195

196+
def FeatureUseIndirectJumpsHazard : SubtargetFeature<"use-indirect-jump-hazard",
197+
"UseIndirectJumpsHazard",
198+
"true", "Use indirect jump"
199+
" guards to prevent certain speculation based attacks">;
196200
//===----------------------------------------------------------------------===//
197201
// Mips processors supported.
198202
//===----------------------------------------------------------------------===//

‎llvm/lib/Target/Mips/Mips32r6InstrInfo.td

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1008,3 +1008,42 @@ def : MipsPat<(select i32:$cond, immz, i32:$f),
10081008
(SELEQZ i32:$f, i32:$cond)>,
10091009
ISA_MIPS32R6;
10101010
}
1011+
1012+
// Pseudo instructions
1013+
let isCall = 1, isTerminator = 1, isReturn = 1, isBarrier = 1, hasDelaySlot = 1,
1014+
hasExtraSrcRegAllocReq = 1, isCTI = 1, Defs = [AT] in {
1015+
class TailCallRegR6<Instruction JumpInst, Register RT, RegisterOperand RO> :
1016+
PseudoSE<(outs), (ins RO:$rs), [(MipsTailCall RO:$rs)], II_JR>,
1017+
PseudoInstExpansion<(JumpInst RT:$rt, RO:$rs)>;
1018+
}
1019+
1020+
class PseudoIndirectBranchBaseR6<Instruction JumpInst, Register RT,
1021+
RegisterOperand RO> :
1022+
MipsPseudo<(outs), (ins RO:$rs), [(brind RO:$rs)],
1023+
II_IndirectBranchPseudo>,
1024+
PseudoInstExpansion<(JumpInst RT:$rt, RO:$rs)> {
1025+
let isTerminator=1;
1026+
let isBarrier=1;
1027+
let hasDelaySlot = 1;
1028+
let isBranch = 1;
1029+
let isIndirectBranch = 1;
1030+
bit isCTI = 1;
1031+
}
1032+
1033+
1034+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
1035+
NoIndirectJumpGuards] in {
1036+
def TAILCALLR6REG : TailCallRegR6<JALR, ZERO, GPR32Opnd>, ISA_MIPS32R6;
1037+
def PseudoIndirectBranchR6 : PseudoIndirectBranchBaseR6<JALR, ZERO,
1038+
GPR32Opnd>,
1039+
ISA_MIPS32R6;
1040+
}
1041+
1042+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
1043+
UseIndirectJumpsHazard] in {
1044+
def TAILCALLHBR6REG : TailCallReg<JR_HB_R6, GPR32Opnd>, ISA_MIPS32R6;
1045+
def PseudoIndrectHazardBranchR6 : PseudoIndirectBranchBase<JR_HB_R6,
1046+
GPR32Opnd>,
1047+
ISA_MIPS32R6;
1048+
}
1049+

‎llvm/lib/Target/Mips/Mips64InstrInfo.td

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -236,13 +236,32 @@ let isCodeGenOnly = 1 in {
236236
def BGTZ64 : CBranchZero<"bgtz", brtarget, setgt, GPR64Opnd>, BGEZ_FM<7, 0>;
237237
def BLEZ64 : CBranchZero<"blez", brtarget, setle, GPR64Opnd>, BGEZ_FM<6, 0>;
238238
def BLTZ64 : CBranchZero<"bltz", brtarget, setlt, GPR64Opnd>, BGEZ_FM<1, 0>;
239-
def JALR64Pseudo : JumpLinkRegPseudo<GPR64Opnd, JALR, RA, GPR32Opnd>;
239+
let AdditionalPredicates = [NoIndirectJumpGuards] in
240+
def JALR64Pseudo : JumpLinkRegPseudo<GPR64Opnd, JALR, RA, GPR32Opnd>;
240241
}
242+
let AdditionalPredicates = [NotInMicroMips],
243+
DecoderNamespace = "Mips64" in {
244+
def JR_HB64 : JR_HB_DESC<GPR64Opnd>, JR_HB_ENC, ISA_MIPS32_NOT_32R6_64R6;
245+
def JALR_HB64 : JALR_HB_DESC<GPR64Opnd>, JALR_HB_ENC, ISA_MIPS32R2;
246+
}
247+
def PseudoReturn64 : PseudoReturnBase<GPR64Opnd>;
241248

242-
def TAILCALLREG64 : TailCallReg<GPR64Opnd>;
249+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
250+
NoIndirectJumpGuards] in {
251+
def TAILCALLREG64 : TailCallReg<JR64, GPR64Opnd>, ISA_MIPS3_NOT_32R6_64R6,
252+
PTR_64;
253+
def PseudoIndirectBranch64 : PseudoIndirectBranchBase<JR64, GPR64Opnd>,
254+
ISA_MIPS3_NOT_32R6_64R6;
255+
}
243256

244-
def PseudoReturn64 : PseudoReturnBase<GPR64Opnd>;
245-
def PseudoIndirectBranch64 : PseudoIndirectBranchBase<GPR64Opnd>;
257+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
258+
UseIndirectJumpsHazard] in {
259+
def TAILCALLREGHB64 : TailCallReg<JR_HB64, GPR64Opnd>,
260+
ISA_MIPS32R2_NOT_32R6_64R6, PTR_64;
261+
def PseudoIndirectHazardBranch64 : PseudoIndirectBranchBase<JR_HB64,
262+
GPR64Opnd>,
263+
ISA_MIPS32R2_NOT_32R6_64R6;
264+
}
246265

247266
/// Multiply and Divide Instructions.
248267
let AdditionalPredicates = [NotInMicroMips] in {
@@ -515,6 +534,10 @@ def DMTC2 : MTC3OP<"dmtc2", COP2Opnd, GPR64Opnd, II_DMTC2>, MFC3OP_FM<0x12, 5>,
515534
ISA_MIPS3;
516535
}
517536

537+
538+
let AdditionalPredicates = [UseIndirectJumpsHazard] in
539+
def JALRHB64Pseudo : JumpLinkRegPseudo<GPR64Opnd, JALR_HB64, RA_64>;
540+
518541
//===----------------------------------------------------------------------===//
519542
// Arbitrary patterns that map to one or more instructions
520543
//===----------------------------------------------------------------------===//
@@ -803,6 +826,8 @@ let AdditionalPredicates = [NotInMicroMips] in {
803826
(DSLLV GPR64Opnd:$rd, GPR64Opnd:$rd, GPR32Opnd:$rt), 0>,
804827
ISA_MIPS3;
805828

829+
def : MipsInstAlias<"jalr.hb $rs", (JALR_HB64 RA_64, GPR64Opnd:$rs), 1>,
830+
ISA_MIPS64;
806831
// Two operand (implicit 0 selector) versions:
807832
def : MipsInstAlias<"dmtc0 $rt, $rd",
808833
(DMTC0 COP0Opnd:$rd, GPR64Opnd:$rt, 0), 0>;

‎llvm/lib/Target/Mips/Mips64r6InstrInfo.td

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,16 @@ class JIC64_DESC : JMP_IDX_COMPACT_DESC_BASE<"jic", jmpoffset16, GPR64Opnd,
104104

105105
class LL64_R6_DESC : LL_R6_DESC_BASE<"ll", GPR32Opnd, mem_simm9, II_LL>;
106106
class SC64_R6_DESC : SC_R6_DESC_BASE<"sc", GPR32Opnd, II_SC>;
107+
108+
class JR_HB64_R6_DESC : JR_HB_DESC_BASE<"jr.hb", GPR64Opnd> {
109+
bit isBranch = 1;
110+
bit isIndirectBranch = 1;
111+
bit hasDelaySlot = 1;
112+
bit isTerminator=1;
113+
bit isBarrier=1;
114+
bit isCTI = 1;
115+
InstrItinClass Itinerary = II_JR_HB;
116+
}
107117
//===----------------------------------------------------------------------===//
108118
//
109119
// Instruction Definitions
@@ -136,6 +146,7 @@ def SCD_R6 : SCD_R6_ENC, SCD_R6_DESC, ISA_MIPS32R6;
136146
let DecoderNamespace = "Mips32r6_64r6_GP64" in {
137147
def SELEQZ64 : SELEQZ_ENC, SELEQZ64_DESC, ISA_MIPS32R6, GPR_64;
138148
def SELNEZ64 : SELNEZ_ENC, SELNEZ64_DESC, ISA_MIPS32R6, GPR_64;
149+
def JR_HB64_R6 : JR_HB_R6_ENC, JR_HB64_R6_DESC, ISA_MIPS32R6;
139150
}
140151
let AdditionalPredicates = [NotInMicroMips],
141152
DecoderNamespace = "Mips32r6_64r6_PTR64" in {
@@ -277,3 +288,22 @@ def : MipsPat<(select (i32 (setne i32:$cond, immz)), immz, i64:$f),
277288
def : MipsPat<(select (i32 (seteq i32:$cond, immz)), immz, i64:$f),
278289
(SELNEZ64 i64:$f, (SLL64_32 i32:$cond))>,
279290
ISA_MIPS64R6;
291+
292+
// Pseudo instructions
293+
294+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
295+
NoIndirectJumpGuards] in {
296+
def TAILCALL64R6REG : TailCallRegR6<JALR64, ZERO_64, GPR64Opnd>, ISA_MIPS64R6;
297+
def PseudoIndirectBranch64R6 : PseudoIndirectBranchBaseR6<JALR64, ZERO_64,
298+
GPR64Opnd>,
299+
ISA_MIPS64R6;
300+
}
301+
302+
let AdditionalPredicates = [NotInMips16Mode, NotInMicroMips,
303+
UseIndirectJumpsHazard] in {
304+
def TAILCALLHB64R6REG : TailCallReg<JR_HB64_R6, GPR64Opnd>,
305+
ISA_MIPS64R6;
306+
def PseudoIndrectHazardBranch64R6 : PseudoIndirectBranchBase<JR_HB64_R6,
307+
GPR64Opnd>,
308+
ISA_MIPS64R6;
309+
}

‎llvm/lib/Target/Mips/MipsDSPInstrFormats.td

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class DSPInst<string opstr = "">
5353

5454
class PseudoDSP<dag outs, dag ins, list<dag> pattern,
5555
InstrItinClass itin = IIPseudo>
56-
: MipsPseudo<outs, ins, pattern, itin>, PredicateControl {
56+
: MipsPseudo<outs, ins, pattern, itin> {
5757
let InsnPredicates = [HasDSP];
5858
}
5959

‎llvm/lib/Target/Mips/MipsInstrFormats.td

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,15 +128,15 @@ class InstSE<dag outs, dag ins, string asmstr, list<dag> pattern,
128128
// Mips Pseudo Instructions Format
129129
class MipsPseudo<dag outs, dag ins, list<dag> pattern,
130130
InstrItinClass itin = IIPseudo> :
131-
MipsInst<outs, ins, "", pattern, itin, Pseudo> {
131+
MipsInst<outs, ins, "", pattern, itin, Pseudo>, PredicateControl {
132132
let isCodeGenOnly = 1;
133133
let isPseudo = 1;
134134
}
135135

136136
// Mips32/64 Pseudo Instruction Format
137137
class PseudoSE<dag outs, dag ins, list<dag> pattern,
138138
InstrItinClass itin = IIPseudo> :
139-
MipsPseudo<outs, ins, pattern, itin>, PredicateControl {
139+
MipsPseudo<outs, ins, pattern, itin> {
140140
let EncodingPredicates = [HasStdEnc];
141141
}
142142

‎llvm/lib/Target/Mips/MipsInstrInfo.cpp

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ unsigned MipsInstrInfo::getEquivalentCompactForm(
286286
case Mips::JR:
287287
case Mips::PseudoReturn:
288288
case Mips::PseudoIndirectBranch:
289-
case Mips::TAILCALLREG:
289+
case Mips::PseudoIndirectBranch_MM:
290290
canUseShortMicroMipsCTI = true;
291291
break;
292292
}
@@ -365,18 +365,19 @@ unsigned MipsInstrInfo::getEquivalentCompactForm(
365365
// For MIPSR6, the instruction 'jic' can be used for these cases. Some
366366
// tools will accept 'jrc reg' as an alias for 'jic 0, $reg'.
367367
case Mips::JR:
368+
case Mips::PseudoIndirectBranchR6:
369+
case Mips::PseudoIndirectBranch_MM:
368370
case Mips::PseudoReturn:
369-
case Mips::PseudoIndirectBranch:
370-
case Mips::TAILCALLREG:
371+
case Mips::TAILCALLR6REG:
371372
if (canUseShortMicroMipsCTI)
372373
return Mips::JRC16_MM;
373374
return Mips::JIC;
374375
case Mips::JALRPseudo:
375376
return Mips::JIALC;
376377
case Mips::JR64:
378+
case Mips::PseudoIndirectBranch64R6:
377379
case Mips::PseudoReturn64:
378-
case Mips::PseudoIndirectBranch64:
379-
case Mips::TAILCALLREG64:
380+
case Mips::TAILCALL64R6REG:
380381
return Mips::JIC64;
381382
case Mips::JALR64Pseudo:
382383
return Mips::JIALC64;
@@ -526,3 +527,26 @@ bool MipsInstrInfo::findCommutedOpIndices(MachineInstr &MI, unsigned &SrcOpIdx1,
526527
}
527528
return TargetInstrInfo::findCommutedOpIndices(MI, SrcOpIdx1, SrcOpIdx2);
528529
}
530+
531+
// Perform target specific instruction verification.
532+
bool MipsInstrInfo::verifyInstruction(const MachineInstr &MI,
533+
StringRef &ErrInfo) const {
534+
switch (MI.getOpcode()) {
535+
case Mips::TAILCALLREG:
536+
case Mips::PseudoIndirectBranch:
537+
case Mips::JR:
538+
case Mips::JR64:
539+
case Mips::JALR:
540+
case Mips::JALR64:
541+
case Mips::JALRPseudo:
542+
if (!Subtarget.useIndirectJumpsHazard())
543+
return true;
544+
545+
ErrInfo = "invalid instruction when using jump guards!";
546+
return false;
547+
default:
548+
return true;
549+
}
550+
551+
return true;
552+
}

‎llvm/lib/Target/Mips/MipsInstrInfo.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,10 @@ class MipsInstrInfo : public MipsGenInstrInfo {
138138
bool findCommutedOpIndices(MachineInstr &MI, unsigned &SrcOpIdx1,
139139
unsigned &SrcOpIdx2) const override;
140140

141+
/// Perform target specific instruction verification.
142+
bool verifyInstruction(const MachineInstr &MI,
143+
StringRef &ErrInfo) const override;
144+
141145
protected:
142146
bool isZeroImm(const MachineOperand &op) const;
143147

0 commit comments

Comments
 (0)