PPC/s390: [wasm][x64] Fix OSR shadow stack violation

Port 06a2c2e0

Original Commit Message:

    We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
    addresses. This is in direct violation of Intel CET's shadow stack,
    which we plan to enable eventually.

    This change works around this by postponing OSR until after we return to
    the old code. The main changes are:
    - Reserve a slot in Liftoff frames to store the OSR target,
    - Skip the return address modification, and instead store the new code
    pointer in the dedicated slot,
    - Upon returning to the old code, check the slot and do an indirect jump
    to the new code if needed.

    CET also prevents indirect jumps to arbitrary locations, so the last
    point is also a CET violation. Valid indirect jump targets must be
    marked with the ENDBRANCH instruction, which I will do in a follow-up
    CL.

R=thibaudm@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id972de1ba7556474cb00b377ea3a38eb4332eae3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2828870Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73984}

src/builtins/ppc/builtins-ppc.cc

@@ -2512,6 +2512,11 @@ void Builtins::Generate_GenericJSToWasmWrapper(MacroAssembler* masm) {
   // TODO(v8:10701): Implement for this platform.
   __ Trap();
 }
+
+void Builtins::Generate_WasmOnStackReplace(MacroAssembler* masm) {
+  // Only needed on x64.
+  __ Trap();
+}
 #endif  // V8_ENABLE_WEBASSEMBLY
 
 void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,

src/builtins/s390/builtins-s390.cc

@@ -2550,6 +2550,11 @@ void Builtins::Generate_GenericJSToWasmWrapper(MacroAssembler* masm) {
   // TODO(v8:10701): Implement for this platform.
   __ Trap();
 }
+
+void Builtins::Generate_WasmOnStackReplace(MacroAssembler* masm) {
+  // Only needed on x64.
+  __ Trap();
+}
 #endif  // V8_ENABLE_WEBASSEMBLY
 
 void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,

src/wasm/baseline/ppc/liftoff-assembler-ppc.h

@@ -109,6 +109,8 @@ void LiftoffAssembler::SpillInstance(Register instance) {
   bailout(kUnsupportedArchitecture, "SpillInstance");
 }
 
+void LiftoffAssembler::ResetOSRTarget() {}
+
 void LiftoffAssembler::FillInstanceInto(Register dst) {
   bailout(kUnsupportedArchitecture, "FillInstanceInto");
 }
@@ -1801,6 +1803,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   bailout(kUnsupportedArchitecture, "DeallocateStackSlot");
 }
 
+void LiftoffAssembler::MaybeOSR() {}
+
 void LiftoffStackSlots::Construct(int param_slots) {
   asm_->bailout(kUnsupportedArchitecture, "LiftoffStackSlots::Construct");
 }

src/wasm/baseline/s390/liftoff-assembler-s390.h

@@ -224,6 +224,8 @@ void LiftoffAssembler::SpillInstance(Register instance) {
   StoreU64(instance, liftoff::GetInstanceOperand());
 }
 
+void LiftoffAssembler::ResetOSRTarget() {}
+
 void LiftoffAssembler::FillInstanceInto(Register dst) {
   LoadU64(dst, liftoff::GetInstanceOperand());
 }
@@ -3443,6 +3445,8 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   lay(sp, MemOperand(sp, size));
 }
 
+void LiftoffAssembler::MaybeOSR() {}
+
 void LiftoffStackSlots::Construct(int param_slots) {
   DCHECK_LT(0, slots_.size());
   SortInPushOrder();