Andrew Geissler | 595f630 | 2022-01-24 19:11:47 +0000 | [diff] [blame] | 1 | From 3929bca9ca95de9d35e82ae8828b188029e3eb70 Mon Sep 17 00:00:00 2001 |
| 2 | From: Richard Earnshaw <rearnsha@arm.com> |
| 3 | Date: Fri, 11 Jun 2021 16:02:05 +0100 |
| 4 | Subject: [PATCH] arm: Add command-line option for enabling CVE-2021-35465 |
| 5 | mitigation [PR102035] |
| 6 | |
| 7 | Add a new option, -mfix-cmse-cve-2021-35465 and document it. Enable it |
| 8 | automatically for cortex-m33, cortex-m35p and cortex-m55. |
| 9 | |
| 10 | gcc: |
| 11 | PR target/102035 |
| 12 | * config/arm/arm.opt (mfix-cmse-cve-2021-35465): New option. |
| 13 | * doc/invoke.texi (Arm Options): Document it. |
| 14 | * config/arm/arm-cpus.in (quirk_vlldm): New feature bit. |
| 15 | (ALL_QUIRKS): Add quirk_vlldm. |
| 16 | (cortex-m33): Add quirk_vlldm. |
| 17 | (cortex-m35p, cortex-m55): Likewise. |
| 18 | * config/arm/arm.c (arm_option_override): Enable fix_vlldm if |
| 19 | targetting an affected CPU and not explicitly controlled on |
| 20 | the command line. |
| 21 | |
| 22 | CVE: CVE-2021-35465 |
| 23 | Upstream-Status: Backport [https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=3929bca9ca95de9d35e82ae8828b188029e3eb70] |
| 24 | Signed-off-by: Pgowda <pgowda.cve@gmail.com> |
| 25 | |
| 26 | --- |
| 27 | gcc/config/arm/arm-cpus.in | 9 +++++++-- |
| 28 | gcc/config/arm/arm.c | 9 +++++++++ |
| 29 | gcc/config/arm/arm.opt | 4 ++++ |
| 30 | gcc/doc/invoke.texi | 9 +++++++++ |
| 31 | 4 files changed, 29 insertions(+), 2 deletions(-) |
| 32 | |
| 33 | diff --git a/gcc/config/arm/arm.c b/gcc/config/arm/arm.c |
| 34 | --- a/gcc/config/arm/arm.c 2021-11-15 02:13:11.100579812 -0800 |
| 35 | +++ b/gcc/config/arm/arm.c 2021-11-15 02:17:36.988237692 -0800 |
| 36 | @@ -3610,6 +3610,15 @@ arm_option_override (void) |
| 37 | fix_cm3_ldrd = 0; |
| 38 | } |
| 39 | |
| 40 | + /* Enable fix_vlldm by default if required. */ |
| 41 | + if (fix_vlldm == 2) |
| 42 | + { |
| 43 | + if (bitmap_bit_p (arm_active_target.isa, isa_bit_quirk_vlldm)) |
| 44 | + fix_vlldm = 1; |
| 45 | + else |
| 46 | + fix_vlldm = 0; |
| 47 | + } |
| 48 | + |
| 49 | /* Hot/Cold partitioning is not currently supported, since we can't |
| 50 | handle literal pool placement in that case. */ |
| 51 | if (flag_reorder_blocks_and_partition) |
| 52 | diff --git a/gcc/config/arm/arm-cpus.in b/gcc/config/arm/arm-cpus.in |
| 53 | --- a/gcc/config/arm/arm-cpus.in 2021-11-15 02:13:11.104579747 -0800 |
| 54 | +++ b/gcc/config/arm/arm-cpus.in 2021-11-15 02:17:36.984237757 -0800 |
| 55 | @@ -186,6 +186,9 @@ define feature quirk_armv6kz |
| 56 | # Cortex-M3 LDRD quirk. |
| 57 | define feature quirk_cm3_ldrd |
| 58 | |
| 59 | +# v8-m/v8.1-m VLLDM errata. |
| 60 | +define feature quirk_vlldm |
| 61 | + |
| 62 | # Don't use .cpu assembly directive |
| 63 | define feature quirk_no_asmcpu |
| 64 | |
| 65 | @@ -322,7 +325,7 @@ define implied vfp_base MVE MVE_FP ALL_F |
| 66 | # architectures. |
| 67 | # xscale isn't really a 'quirk', but it isn't an architecture either and we |
| 68 | # need to ignore it for matching purposes. |
| 69 | -define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd xscale quirk_no_asmcpu |
| 70 | +define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd quirk_vlldm xscale quirk_no_asmcpu |
| 71 | |
| 72 | define fgroup IGNORE_FOR_MULTILIB cdecp0 cdecp1 cdecp2 cdecp3 cdecp4 cdecp5 cdecp6 cdecp7 |
| 73 | |
| 74 | @@ -1570,6 +1573,7 @@ begin cpu cortex-m33 |
| 75 | architecture armv8-m.main+dsp+fp |
| 76 | option nofp remove ALL_FP |
| 77 | option nodsp remove armv7em |
| 78 | + isa quirk_vlldm |
| 79 | costs v7m |
| 80 | end cpu cortex-m33 |
| 81 | |
| 82 | @@ -1579,6 +1583,7 @@ begin cpu cortex-m35p |
| 83 | architecture armv8-m.main+dsp+fp |
| 84 | option nofp remove ALL_FP |
| 85 | option nodsp remove armv7em |
| 86 | + isa quirk_vlldm |
| 87 | costs v7m |
| 88 | end cpu cortex-m35p |
| 89 | |
| 90 | @@ -1590,7 +1595,7 @@ begin cpu cortex-m55 |
| 91 | option nomve remove mve mve_float |
| 92 | option nofp remove ALL_FP mve_float |
| 93 | option nodsp remove MVE mve_float |
| 94 | - isa quirk_no_asmcpu |
| 95 | + isa quirk_no_asmcpu quirk_vlldm |
| 96 | costs v7m |
| 97 | vendor 41 |
| 98 | end cpu cortex-m55 |
| 99 | diff --git a/gcc/config/arm/arm.opt b/gcc/config/arm/arm.opt |
| 100 | --- a/gcc/config/arm/arm.opt 2021-11-15 02:13:11.104579747 -0800 |
| 101 | +++ b/gcc/config/arm/arm.opt 2021-11-15 02:17:36.988237692 -0800 |
| 102 | @@ -268,6 +268,10 @@ Target Var(fix_cm3_ldrd) Init(2) |
| 103 | Avoid overlapping destination and address registers on LDRD instructions |
| 104 | that may trigger Cortex-M3 errata. |
| 105 | |
| 106 | +mfix-cmse-cve-2021-35465 |
| 107 | +Target Var(fix_vlldm) Init(2) |
| 108 | +Mitigate issues with VLLDM on some M-profile devices (CVE-2021-35465). |
| 109 | + |
| 110 | munaligned-access |
| 111 | Target Var(unaligned_access) Init(2) Save |
| 112 | Enable unaligned word and halfword accesses to packed data. |
| 113 | diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi |
| 114 | --- a/gcc/doc/invoke.texi 2021-11-15 02:13:11.112579616 -0800 |
| 115 | +++ b/gcc/doc/invoke.texi 2021-11-15 02:17:36.996237562 -0800 |
| 116 | @@ -804,6 +804,7 @@ Objective-C and Objective-C++ Dialects}. |
| 117 | -mverbose-cost-dump @gol |
| 118 | -mpure-code @gol |
| 119 | -mcmse @gol |
| 120 | +-mfix-cmse-cve-2021-35465 @gol |
| 121 | -mfdpic} |
| 122 | |
| 123 | @emph{AVR Options} |
| 124 | @@ -20487,6 +20488,14 @@ Generate secure code as per the "ARMv8-M |
| 125 | Development Tools Engineering Specification", which can be found on |
| 126 | @url{https://developer.arm.com/documentation/ecm0359818/latest/}. |
| 127 | |
| 128 | +@item -mfix-cmse-cve-2021-35465 |
| 129 | +@opindex mfix-cmse-cve-2021-35465 |
| 130 | +Mitigate against a potential security issue with the @code{VLLDM} instruction |
| 131 | +in some M-profile devices when using CMSE (CVE-2021-365465). This option is |
| 132 | +enabled by default when the option @option{-mcpu=} is used with |
| 133 | +@code{cortex-m33}, @code{cortex-m35p} or @code{cortex-m55}. The option |
| 134 | +@option{-mno-fix-cmse-cve-2021-35465} can be used to disable the mitigation. |
| 135 | + |
| 136 | @item -mfdpic |
| 137 | @itemx -mno-fdpic |
| 138 | @opindex mfdpic |