From 3929bca9ca95de9d35e82ae8828b188029e3eb70 Mon Sep 17 00:00:00 2001
|
From: Richard Earnshaw <rearnsha@arm.com>
|
Date: Fri, 11 Jun 2021 16:02:05 +0100
|
Subject: [PATCH] arm: Add command-line option for enabling CVE-2021-35465
|
mitigation [PR102035]
|
|
Add a new option, -mfix-cmse-cve-2021-35465 and document it. Enable it
|
automatically for cortex-m33, cortex-m35p and cortex-m55.
|
|
gcc:
|
PR target/102035
|
* config/arm/arm.opt (mfix-cmse-cve-2021-35465): New option.
|
* doc/invoke.texi (Arm Options): Document it.
|
* config/arm/arm-cpus.in (quirk_vlldm): New feature bit.
|
(ALL_QUIRKS): Add quirk_vlldm.
|
(cortex-m33): Add quirk_vlldm.
|
(cortex-m35p, cortex-m55): Likewise.
|
* config/arm/arm.c (arm_option_override): Enable fix_vlldm if
|
targetting an affected CPU and not explicitly controlled on
|
the command line.
|
|
CVE: CVE-2021-35465
|
Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=3929bca9ca95de9d35e82ae8828b188029e3eb70]
|
Signed-off-by: Pgowda <pgowda.cve@gmail.com>
|
|
---
|
gcc/config/arm/arm-cpus.in | 9 +++++++--
|
gcc/config/arm/arm.c | 9 +++++++++
|
gcc/config/arm/arm.opt | 4 ++++
|
gcc/doc/invoke.texi | 9 +++++++++
|
4 files changed, 29 insertions(+), 2 deletions(-)
|
|
diff --git a/gcc/config/arm/arm.c b/gcc/config/arm/arm.c
|
--- a/gcc/config/arm/arm.c 2021-11-15 02:13:11.100579812 -0800
|
+++ b/gcc/config/arm/arm.c 2021-11-15 02:17:36.988237692 -0800
|
@@ -3610,6 +3610,15 @@ arm_option_override (void)
|
fix_cm3_ldrd = 0;
|
}
|
|
+ /* Enable fix_vlldm by default if required. */
|
+ if (fix_vlldm == 2)
|
+ {
|
+ if (bitmap_bit_p (arm_active_target.isa, isa_bit_quirk_vlldm))
|
+ fix_vlldm = 1;
|
+ else
|
+ fix_vlldm = 0;
|
+ }
|
+
|
/* Hot/Cold partitioning is not currently supported, since we can't
|
handle literal pool placement in that case. */
|
if (flag_reorder_blocks_and_partition)
|
diff --git a/gcc/config/arm/arm-cpus.in b/gcc/config/arm/arm-cpus.in
|
--- a/gcc/config/arm/arm-cpus.in 2021-11-15 02:13:11.104579747 -0800
|
+++ b/gcc/config/arm/arm-cpus.in 2021-11-15 02:17:36.984237757 -0800
|
@@ -186,6 +186,9 @@ define feature quirk_armv6kz
|
# Cortex-M3 LDRD quirk.
|
define feature quirk_cm3_ldrd
|
|
+# v8-m/v8.1-m VLLDM errata.
|
+define feature quirk_vlldm
|
+
|
# Don't use .cpu assembly directive
|
define feature quirk_no_asmcpu
|
|
@@ -322,7 +325,7 @@ define implied vfp_base MVE MVE_FP ALL_F
|
# architectures.
|
# xscale isn't really a 'quirk', but it isn't an architecture either and we
|
# need to ignore it for matching purposes.
|
-define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd xscale quirk_no_asmcpu
|
+define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd quirk_vlldm xscale quirk_no_asmcpu
|
|
define fgroup IGNORE_FOR_MULTILIB cdecp0 cdecp1 cdecp2 cdecp3 cdecp4 cdecp5 cdecp6 cdecp7
|
|
@@ -1570,6 +1573,7 @@ begin cpu cortex-m33
|
architecture armv8-m.main+dsp+fp
|
option nofp remove ALL_FP
|
option nodsp remove armv7em
|
+ isa quirk_vlldm
|
costs v7m
|
end cpu cortex-m33
|
|
@@ -1579,6 +1583,7 @@ begin cpu cortex-m35p
|
architecture armv8-m.main+dsp+fp
|
option nofp remove ALL_FP
|
option nodsp remove armv7em
|
+ isa quirk_vlldm
|
costs v7m
|
end cpu cortex-m35p
|
|
@@ -1590,7 +1595,7 @@ begin cpu cortex-m55
|
option nomve remove mve mve_float
|
option nofp remove ALL_FP mve_float
|
option nodsp remove MVE mve_float
|
- isa quirk_no_asmcpu
|
+ isa quirk_no_asmcpu quirk_vlldm
|
costs v7m
|
vendor 41
|
end cpu cortex-m55
|
diff --git a/gcc/config/arm/arm.opt b/gcc/config/arm/arm.opt
|
--- a/gcc/config/arm/arm.opt 2021-11-15 02:13:11.104579747 -0800
|
+++ b/gcc/config/arm/arm.opt 2021-11-15 02:17:36.988237692 -0800
|
@@ -268,6 +268,10 @@ Target Var(fix_cm3_ldrd) Init(2)
|
Avoid overlapping destination and address registers on LDRD instructions
|
that may trigger Cortex-M3 errata.
|
|
+mfix-cmse-cve-2021-35465
|
+Target Var(fix_vlldm) Init(2)
|
+Mitigate issues with VLLDM on some M-profile devices (CVE-2021-35465).
|
+
|
munaligned-access
|
Target Var(unaligned_access) Init(2) Save
|
Enable unaligned word and halfword accesses to packed data.
|
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
|
--- a/gcc/doc/invoke.texi 2021-11-15 02:13:11.112579616 -0800
|
+++ b/gcc/doc/invoke.texi 2021-11-15 02:17:36.996237562 -0800
|
@@ -804,6 +804,7 @@ Objective-C and Objective-C++ Dialects}.
|
-mverbose-cost-dump @gol
|
-mpure-code @gol
|
-mcmse @gol
|
+-mfix-cmse-cve-2021-35465 @gol
|
-mfdpic}
|
|
@emph{AVR Options}
|
@@ -20487,6 +20488,14 @@ Generate secure code as per the "ARMv8-M
|
Development Tools Engineering Specification", which can be found on
|
@url{https://developer.arm.com/documentation/ecm0359818/latest/}.
|
|
+@item -mfix-cmse-cve-2021-35465
|
+@opindex mfix-cmse-cve-2021-35465
|
+Mitigate against a potential security issue with the @code{VLLDM} instruction
|
+in some M-profile devices when using CMSE (CVE-2021-365465). This option is
|
+enabled by default when the option @option{-mcpu=} is used with
|
+@code{cortex-m33}, @code{cortex-m35p} or @code{cortex-m55}. The option
|
+@option{-mno-fix-cmse-cve-2021-35465} can be used to disable the mitigation.
|
+
|
@item -mfdpic
|
@itemx -mno-fdpic
|
@opindex mfdpic
|
