[mips][lld] Spectre variant two mitigation for MIPSR2

[sdardis]

Summary

This patch provides migitation for CVE-2017-5715, Spectre variant two,
which affects the P5600 and P6600. It implements the LLD part of
-z hazardplt. Like the Clang part of this patch, I have opted for that
specific option name in case alternative migitation methods are required
in the future.

The migitation strategy suggested by MIPS for these processors is to use
hazard barrier instructions. 'jalr.hb' and 'jr.hb' are hazard
barrier variants of the 'jalr' and 'jr' instructions respectively.

These instructions impede the execution of instruction stream until
architecturally defined hazards (changes to the instruction stream,
privileged registers which may affect execution) are cleared. These
instructions in MIPS' designs are not speculated past.

These instructions are defined by the MIPS32R2 ISA, so this mitigation
method is not compatible with processors which implement an earlier
revision of the MIPS ISA.

For LLD, this changes PLT stubs to use 'jalr.hb' and 'jr.hb'.

[atanasyan]

LGTM

[ruiu]

LGTM

ELF/Arch/Mips.cpp

334 ↗

(On Diff #135158)

It's better to use uint32_t if it is intended to be unsigned 32-bit integer.

[sdardis]

ELF/Arch/Mips.cpp

334 ↗

(On Diff #135158)

Thanks, rL325713.

lld/trunk/ELF/Arch/Mips.cpp

if (Config->MipsN32Abi) {
     write32<E>(Buf, 0x3c1c0000);      // lui   $28, %hi(&GOTPLT[0])
     write32<E>(Buf + 4, 0x8f990000);  // lw    $25, %lo(&GOTPLT[0])($28)
     write32<E>(Buf + 8, 0x279c0000);  // addiu $28, $28, %lo(&GOTPLT[0])
     write32<E>(Buf + 12, 0x031cc023); // subu  $24, $24, $28
     write32<E>(Buf + 16, 0x03e07825); // move  $15, $31
     write32<E>(Buf + 20, 0x0018c082); // srl   $24, $24, 2
   }
 
-  write32<E>(Buf + 24, 0x0320f809); // jalr  $25
+  uint32_t JalrInst = Config->ZHazardplt ? 0x0320fc09 : 0x0320f809;
+  write32<E>(Buf + 24, JalrInst); // jalr.hb $25 or jalr $25
   write32<E>(Buf + 28, 0x2718fffe); // subu  $24, $24, 2
 
   uint64_t GotPlt = InX::GotPlt->getVA();
   writeValue<E>(Buf, GotPlt + 0x8000, 16, 16);
   writeValue<E>(Buf + 4, GotPlt, 16, 0);
   writeValue<E>(Buf + 8, GotPlt, 16, 0);
 }
 
if (isMipsR6()) {
       write16<E>(Buf + 4, 0xff22);  // lw $25, 0($2)
       write16<E>(Buf + 8, 0x4599);  // jrc $25 / jr16 $25
       write16<E>(Buf + 10, 0x0f02); // move $24, $2
       relocateOne(Buf, R_MICROMIPS_PC23_S2, GotPltEntryAddr - PltEntryAddr);
     }
     return;
   }
 
+  unsigned JrInst =
+      isMipsR6() ? (Config->ZHazardplt ? 0x03200409 : 0x03200009)
+                 : (Config->ZHazardplt ? 0x03200408 : 0x03200008);
+
   write32<E>(Buf, 0x3c0f0000);     // lui   $15, %hi(.got.plt entry)
   write32<E>(Buf + 4, 0x8df90000); // l[wd] $25, %lo(.got.plt entry)($15)
-  write32<E>(Buf + 8, isMipsR6() ? 0x03200009 : 0x03200008);  // jr  $25
+  write32<E>(Buf + 8, JrInst);     // jr  $25 / jr.hb $25
   write32<E>(Buf + 12, 0x25f80000); // addiu $24, $15, %lo(.got.plt entry)
   writeValue<E>(Buf, GotPltEntryAddr + 0x8000, 16, 16);
   writeValue<E>(Buf + 4, GotPltEntryAddr, 16, 0);
   writeValue<E>(Buf + 12, GotPltEntryAddr, 16, 0);
 }
 
 template <class ELFT>
 bool MIPS<ELFT>::needsThunk(RelExpr Expr, RelType Type, const InputFile *File,

lld/trunk/ELF/Config.h

struct Configuration {
   bool Trace;
   bool UndefinedVersion;
   bool WarnCommon;
   bool WarnMissingEntry;
   bool WarnSymbolOrdering;
   bool WriteAddends;
   bool ZCombreloc;
   bool ZExecstack;
+  bool ZHazardplt;
   bool ZNocopyreloc;
   bool ZNodelete;
   bool ZNodlopen;
   bool ZNow;
   bool ZOrigin;
   bool ZRelro;
   bool ZRodynamic;
   bool ZText;

lld/trunk/ELF/Driver.cpp

void LinkerDriver::readConfigs(opt::InputArgList &Args) {
   Config->UndefinedVersion =
       Args.hasFlag(OPT_undefined_version, OPT_no_undefined_version, true);
   Config->UnresolvedSymbols = getUnresolvedSymbolPolicy(Args);
   Config->WarnCommon = Args.hasFlag(OPT_warn_common, OPT_no_warn_common, false);
   Config->WarnSymbolOrdering =
       Args.hasFlag(OPT_warn_symbol_ordering, OPT_no_warn_symbol_ordering, true);
   Config->ZCombreloc = !hasZOption(Args, "nocombreloc");
   Config->ZExecstack = hasZOption(Args, "execstack");
+  Config->ZHazardplt = hasZOption(Args, "hazardplt");
   Config->ZNocopyreloc = hasZOption(Args, "nocopyreloc");
   Config->ZNodelete = hasZOption(Args, "nodelete");
   Config->ZNodlopen = hasZOption(Args, "nodlopen");
   Config->ZNow = hasZOption(Args, "now");
   Config->ZOrigin = hasZOption(Args, "origin");
   Config->ZRelro = !hasZOption(Args, "norelro");
   Config->ZRetpolineplt = hasZOption(Args, "retpolineplt");
   Config->ZRodynamic = hasZOption(Args, "rodynamic");

lld/trunk/test/ELF/mips-26-n32-n64.s

 # Check R_MIPS_26 relocation handling in case of N64 ABIs.
 
 # RUN: llvm-mc -filetype=obj -triple=mips64-unknown-linux \
 # RUN:         %S/Inputs/mips-dynamic.s -o %t-so.o
 # RUN: ld.lld %t-so.o -shared -o %t.so
 # RUN: llvm-mc -filetype=obj -triple=mips64-unknown-linux %s -o %t.o
 # RUN: ld.lld %t.o %t.so -o %t.exe
-# RUN: llvm-objdump -d %t.exe | FileCheck %s
+# RUN: llvm-objdump -d %t.exe | FileCheck %s --check-prefixes=CHECK,DEFAULT
+# RUN: ld.lld %t-so.o -shared -o %t.so -z hazardplt
+# RUN: ld.lld %t.o %t.so -o %t.exe -z hazardplt
+# RUN: llvm-objdump -d %t.exe | FileCheck %s --check-prefixes=CHECK,HAZARDPLT
+
 
 # REQUIRES: mips
 
 # CHECK:      Disassembly of section .text:
 # CHECK-NEXT: __start:
 # CHECK-NEXT:    20000:       0c 00 80 0c     jal     131120
 # CHECK-NEXT:    20004:       00 00 00 00     nop
 # CHECK-NEXT: Disassembly of section .plt:
 # CHECK-NEXT: .plt:
 # CHECK-NEXT:    20010:       3c 0e 00 03     lui     $14, 3
 # CHECK-NEXT:    20014:       dd d9 00 08     ld      $25, 8($14)
 # CHECK-NEXT:    20018:       25 ce 00 08     addiu   $14, $14, 8
 # CHECK-NEXT:    2001c:       03 0e c0 23     subu    $24, $24, $14
 # CHECK-NEXT:    20020:       03 e0 78 25     move    $15, $ra
 # CHECK-NEXT:    20024:       00 18 c0 c2     srl     $24, $24, 3
-# CHECK-NEXT:    20028:       03 20 f8 09     jalr    $25
+# DEFAULT:       20028:       03 20 f8 09     jalr    $25
+# HAZARDPLT:     20028:       03 20 fc 09     jalr.hb $25
 # CHECK-NEXT:    2002c:       27 18 ff fe     addiu   $24, $24, -2
 # CHECK-NEXT:    20030:       3c 0f 00 03     lui     $15, 3
 # CHECK-NEXT:    20034:       8d f9 00 18     lw      $25, 24($15)
-# CHECK-NEXT:    20038:       03 20 00 08     jr      $25
+# DEFAULT:       20038:       03 20 00 08     jr      $25
+# HAZARDPLT:     20038:       03 20 04 08     jr.hb   $25
 # CHECK-NEXT:    2003c:       25 f8 00 18     addiu   $24, $15, 24
 
   .text
   .option pic0
   .global __start
 __start:
   jal   foo0

lld/trunk/test/ELF/mips-plt-r6.s

 # Check PLT entries generation in case of R6 ABI version.
 
 # RUN: llvm-mc -filetype=obj -triple=mips-unknown-linux \
 # RUN:         -mcpu=mips32r6 %s -o %t1.o
 # RUN: llvm-mc -filetype=obj -triple=mips-unknown-linux \
 # RUN:         -mcpu=mips32r6 %S/Inputs/mips-dynamic.s -o %t2.o
 # RUN: ld.lld %t2.o -shared -o %t.so
 # RUN: ld.lld %t1.o %t.so -o %t.exe
-# RUN: llvm-objdump -d %t.exe | FileCheck %s
+# RUN: llvm-objdump -d %t.exe | FileCheck %s --check-prefixes=DEFAULT,CHECK
+# RUN: ld.lld %t2.o -shared -o %t.so -z hazardplt
+# RUN: ld.lld %t1.o %t.so -o %t.exe -z hazardplt
+# RUN: llvm-objdump -d %t.exe | FileCheck %s --check-prefixes=HAZARDPLT,CHECK
 
 # REQUIRES: mips
 
 # CHECK:      Disassembly of section .text:
 # CHECK-NEXT: __start:
 # CHECK-NEXT:   20000:       0c 00 80 0c     jal     131120
 #                                                    ^-- 0x20030 gotplt[foo0]
 # CHECK-NEXT:   20004:       00 00 00 00     nop
 #
 # CHECK-NEXT: Disassembly of section .plt:
 # CHECK-NEXT: .plt:
 # CHECK-NEXT:   20010:       3c 1c 00 03     aui     $gp, $zero, 3
 # CHECK-NEXT:   20014:       8f 99 00 04     lw      $25, 4($gp)
 # CHECK-NEXT:   20018:       27 9c 00 04     addiu   $gp, $gp, 4
 # CHECK-NEXT:   2001c:       03 1c c0 23     subu    $24, $24, $gp
 # CHECK-NEXT:   20020:       03 e0 78 25     move    $15, $ra
 # CHECK-NEXT:   20024:       00 18 c0 82     srl     $24, $24, 2
-# CHECK-NEXT:   20028:       03 20 f8 09     jalr    $25
+# DEFAULT:      20028:       03 20 f8 09     jalr    $25
+# HAZARDPLT:    20028:       03 20 fc 09     jalr.hb $25
 # CHECK-NEXT:   2002c:       27 18 ff fe     addiu   $24, $24, -2
 
 # CHECK-NEXT:   20030:       3c 0f 00 03     aui     $15, $zero, 3
 # CHECK-NEXT:   20034:       8d f9 00 0c     lw      $25, 12($15)
-# CHECK-NEXT:   20038:       03 20 00 09     jr      $25
+# DEFAULT:      20038:       03 20 00 09     jr      $25
+# HAZARDPLT:    20038:       03 20 04 09     jr.hb   $25
 # CHECK-NEXT:   2003c:       25 f8 00 0c     addiu   $24, $15, 12
 
   .text
   .global __start
 __start:
   jal foo0        # R_MIPS_26 against 'foo0' from DSO