Skip to content

backport ARM CMSE CVE patches from upstream releases/gcc-10 branch #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 10, 2021
Merged

backport ARM CMSE CVE patches from upstream releases/gcc-10 branch #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
44538c7
arm: Fix general issues with patterns for VLLDM and VLSTM
Jun 11, 2021
989278e
arm: Add command-line option for enabling CVE-2021-35465 mitigation […
Jun 11, 2021
b47a759
arm: add erratum mitigation to __gnu_cmse_nonsecure_call [PR102035]
Jun 18, 2021
7960bae
arm: fix vlldm erratum for Armv8.1-m [PR102035]
Jun 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions gcc/config/arm/arm-cpus.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,9 @@ define feature quirk_armv6kz
# Cortex-M3 LDRD quirk.
define feature quirk_cm3_ldrd

# v8-m/v8.1-m VLLDM errata.
define feature quirk_vlldm

# Don't use .cpu assembly directive
define feature quirk_no_asmcpu

Expand Down Expand Up @@ -322,7 +325,7 @@ define implied vfp_base MVE MVE_FP ALL_FP
# architectures.
# xscale isn't really a 'quirk', but it isn't an architecture either and we
# need to ignore it for matching purposes.
define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd xscale quirk_no_asmcpu
define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd quirk_vlldm xscale quirk_no_asmcpu

# Architecture entries
# format:
Expand Down Expand Up @@ -1524,6 +1527,7 @@ begin cpu cortex-m33
architecture armv8-m.main+dsp+fp
option nofp remove ALL_FP
option nodsp remove armv7em
isa quirk_vlldm
costs v7m
end cpu cortex-m33

Expand All @@ -1533,6 +1537,7 @@ begin cpu cortex-m35p
architecture armv8-m.main+dsp+fp
option nofp remove ALL_FP
option nodsp remove armv7em
isa quirk_vlldm
costs v7m
end cpu cortex-m35p

Expand All @@ -1544,7 +1549,7 @@ begin cpu cortex-m55
option nomve remove mve mve_float
option nofp remove ALL_FP mve_float
option nodsp remove MVE mve_float
isa quirk_no_asmcpu
isa quirk_no_asmcpu quirk_vlldm
costs v7m
vendor 41
end cpu cortex-m55
Expand Down
9 changes: 9 additions & 0 deletions gcc/config/arm/arm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3610,6 +3610,15 @@ arm_option_override (void)
fix_cm3_ldrd = 0;
}

/* Enable fix_vlldm by default if required. */
if (fix_vlldm == 2)
{
if (bitmap_bit_p (arm_active_target.isa, isa_bit_quirk_vlldm))
fix_vlldm = 1;
else
fix_vlldm = 0;
}

/* Hot/Cold partitioning is not currently supported, since we can't
handle literal pool placement in that case. */
if (flag_reorder_blocks_and_partition)
Expand Down
11 changes: 9 additions & 2 deletions gcc/config/arm/arm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,9 +132,12 @@
; TARGET_32BIT, "t1" or "t2" to specify a specific Thumb mode. "v6"
; for ARM or Thumb-2 with arm_arch6, and nov6 for ARM without
; arm_arch6. "v6t2" for Thumb-2 with arm_arch6 and "v8mb" for ARMv8-M
; Baseline. This attribute is used to compute attribute "enabled",
; Baseline. "fix_vlldm" is for fixing the v8-m/v8.1-m VLLDM erratum.
; This attribute is used to compute attribute "enabled",
; use type "any" to enable an alternative in all cases.
(define_attr "arch" "any,a,t,32,t1,t2,v6,nov6,v6t2,v8mb,iwmmxt,iwmmxt2,armv6_or_vfpv3,neon,mve"
(define_attr "arch" "any, a, t, 32, t1, t2, v6,nov6, v6t2, \
v8mb, fix_vlldm, iwmmxt, iwmmxt2, armv6_or_vfpv3, \
neon, mve"
(const_string "any"))

(define_attr "arch_enabled" "no,yes"
Expand Down Expand Up @@ -177,6 +180,10 @@
(match_test "TARGET_THUMB1 && arm_arch8"))
(const_string "yes")

(and (eq_attr "arch" "fix_vlldm")
(match_test "fix_vlldm"))
(const_string "yes")

(and (eq_attr "arch" "iwmmxt2")
(match_test "TARGET_REALLY_IWMMXT2"))
(const_string "yes")
Expand Down
4 changes: 4 additions & 0 deletions gcc/config/arm/arm.opt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,6 +275,10 @@ Target Report Var(fix_cm3_ldrd) Init(2)
Avoid overlapping destination and address registers on LDRD instructions
that may trigger Cortex-M3 errata.

mfix-cmse-cve-2021-35465
Target Var(fix_vlldm) Init(2)
Mitigate issues with VLLDM on some M-profile devices (CVE-2021-35465).

munaligned-access
Target Report Var(unaligned_access) Init(2) Save
Enable unaligned word and halfword accesses to packed data.
Expand Down
29 changes: 17 additions & 12 deletions gcc/config/arm/vfp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1703,27 +1703,32 @@
(set_attr "type" "mov_reg")]
)

;; Both this and the next instruction are treated by GCC in the same
;; way as a blockage pattern. That's perhaps stronger than it needs
;; to be, but we do not want accesses to the VFP register bank to be
;; moved across either instruction.

(define_insn "lazy_store_multiple_insn"
[(set (match_operand:SI 0 "s_register_operand" "+&rk")
(post_dec:SI (match_dup 0)))
(unspec_volatile [(const_int 0)
(mem:SI (post_dec:SI (match_dup 0)))]
VUNSPEC_VLSTM)]
[(unspec_volatile
[(mem:BLK (match_operand:SI 0 "s_register_operand" "rk"))]
VUNSPEC_VLSTM)]
"use_cmse && reload_completed"
"vlstm%?\\t%0"
[(set_attr "predicable" "yes")
(set_attr "type" "store_4")]
)

(define_insn "lazy_load_multiple_insn"
[(set (match_operand:SI 0 "s_register_operand" "+&rk")
(post_inc:SI (match_dup 0)))
(unspec_volatile:SI [(const_int 0)
(mem:SI (match_dup 0))]
VUNSPEC_VLLDM)]
[(unspec_volatile
[(mem:BLK (match_operand:SI 0 "s_register_operand" "rk,rk"))]
VUNSPEC_VLLDM)]
"use_cmse && reload_completed"
"vlldm%?\\t%0"
[(set_attr "predicable" "yes")
"@
vscclrm\\t{vpr}\;vlldm\\t%0
vlldm\\t%0"
[(set_attr "arch" "fix_vlldm,*")
(set_attr "predicable" "no")
(set_attr "length" "8,4")
(set_attr "type" "load_4")]
)

Expand Down
9 changes: 9 additions & 0 deletions gcc/doc/invoke.texi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -770,6 +770,7 @@ Objective-C and Objective-C++ Dialects}.
-mverbose-cost-dump @gol
-mpure-code @gol
-mcmse @gol
-mfix-cmse-cve-2021-35465 @gol
-mfdpic}

@emph{AVR Options}
Expand Down Expand Up @@ -19237,6 +19238,14 @@ Generate secure code as per the "ARMv8-M Security Extensions: Requirements on
Development Tools Engineering Specification", which can be found on
@url{https://developer.arm.com/documentation/ecm0359818/latest/}.

@item -mfix-cmse-cve-2021-35465
@opindex mfix-cmse-cve-2021-35465
Mitigate against a potential security issue with the @code{VLLDM} instruction
in some M-profile devices when using CMSE (CVE-2021-365465). This option is
enabled by default when the option @option{-mcpu=} is used with
@code{cortex-m33}, @code{cortex-m35p} or @code{cortex-m55}. The option
@option{-mno-fix-cmse-cve-2021-35465} can be used to disable the mitigation.

@item -mfdpic
@itemx -mno-fdpic
@opindex mfdpic
Expand Down
5 changes: 5 additions & 0 deletions libgcc/config/arm/cmse_nonsecure_call.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,11 @@ blxns r4
#ifdef __ARM_PCS_VFP
vpop.f64 {d8-d15}
#else
/* VLLDM erratum mitigation sequence. */
mrs r5, control
tst r5, #8 /* CONTROL_S.SFPA */
it ne
.inst.w 0xeeb00a40 /* vmovne s0, s0 */
vlldm sp /* Lazy restore of d0-d16 and FPSCR. */
add sp, sp, #0x88 /* Free space used to save floating point registers. */
#endif /* __ARM_PCS_VFP */
Expand Down