summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnil Dongare <adongare@cisco.com>2026-03-16 09:55:22 -0700
committerKhem Raj <raj.khem@gmail.com>2026-03-16 14:09:55 -0700
commit5bce7e26a38a58bb52242494e54ab2af40009574 (patch)
tree68f3378c3574b896c4de892ed5b4f98420261c36
parent613362523f3bf85ff4862e2f1f00113b8d2028be (diff)
downloadmeta-clang-scarthgap.tar.gz
clang : Fix CVE-2024-7883scarthgap
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/llvm/llvm-project/commit/33411d520783189c31e9936a67371198d6da5f25 [2] https://security-tracker.debian.org/tracker/CVE-2024-7883 Signed-off-by: Anil Dongare <adongare@cisco.com>
Diffstat
-rw-r--r--recipes-devtools/clang/clang/CVE-2024-7883.patch519
-rw-r--r--recipes-devtools/clang/common.inc1
2 files changed, 520 insertions, 0 deletions
diff --git a/recipes-devtools/clang/clang/CVE-2024-7883.patch b/recipes-devtools/clang/clang/CVE-2024-7883.patch
new file mode 100644
index 0000000..bc06bf1
--- /dev/null
+++ b/recipes-devtools/clang/clang/CVE-2024-7883.patch
@@ -0,0 +1,519 @@
1From de90874bca7e85ea13bbb2167fde6177cf7ee00c Mon Sep 17 00:00:00 2001
2From: Oliver Stannard <oliver.stannard@arm.com>
3Date: Fri, 1 Nov 2024 10:36:13 +0100
4Subject: [PATCH] [ARM] Fix CMSE S->NS calls when CONTROL_S.SFPA==0
5 (CVE-2024-7883) (#114433)
6
7When doing a call from CMSE secure state to non-secure state for
8v8-M.main, we use the VLLDM and VLSTM instructions to save, clear and
9restore the FP registers around the call. These instructions both check
10the CONTROL_S.SFPA bit, and if it is clear (meaning the current contents
11of the FP registers are not secret) they execute as no-ops.
12
13This causes a problem when CONTROL_S.SFPA==0 before the call, which
14happens if there are no floating-point instructions executed between
15entry to secure state and the call. If this is the case, then the VLSTM
16instruction will do nothing, leaving the save area in the stack
17uninitialised. If the called function returns a value in floating-point
18registers, the call sequence includes an instruction to copy the return
19value from a floating-point register to a GPR, which must be before the
20VLLDM instruction. This copy sets CONTROL_S.SFPA, meaning that the VLLDM
21will fully execute, and load the uninitialised stack memory into the FP
22registers.
23
24This causes two problems:
25* The FP register file is clobbered, including all of the callee-saved
26 registers, which might contain live values.
27* The stack region might contain secret values, which will be leaked to
28 non-secure state through the floating-point registers if/when we
29 return to non-secure state.
30
31The fix is to insert a `vmov s0, s0` instruction before the VLSTM
32instruction, to ensure that CONTROL_S.SFPA is set for both the VLLDM and
33VLSTM instruction.
34
35CVE: https://www.cve.org/cverecord?id=CVE-2024-7883
36Security bulletin:
37https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability
38
39CVE: CVE-2024-7883
40Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/33411d520783189c31e9936a67371198d6da5f25]
41
42(cherry picked from commit 33411d520783189c31e9936a67371198d6da5f25)
43Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
44---
45 llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp | 44 ++++-
46 .../test/CodeGen/ARM/cmse-clear-float-hard.ll | 160 ++++++++++++++----
47 .../CodeGen/ARM/cmse-vlldm-no-reorder.mir | 1 +
48 3 files changed, 172 insertions(+), 33 deletions(-)
49
50diff --git a/llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp b/llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp
51index 2f9236bb977f..1db4d410a467 100644
52--- a/llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp
53+++ b/llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp
54@@ -1429,6 +1429,7 @@ void ARMExpandPseudo::CMSESaveClearFPRegsV8(
55 // Use ScratchRegs to store the fp regs
56 std::vector<std::tuple<unsigned, unsigned, unsigned>> ClearedFPRegs;
57 std::vector<unsigned> NonclearedFPRegs;
58+ bool ReturnsFPReg = false;
59 for (const MachineOperand &Op : MBBI->operands()) {
60 if (Op.isReg() && Op.isUse()) {
61 Register Reg = Op.getReg();
62@@ -1463,14 +1464,51 @@ void ARMExpandPseudo::CMSESaveClearFPRegsV8(
63 NonclearedFPRegs.push_back(Reg);
64 }
65 }
66+ } else if (Op.isReg() && Op.isDef()) {
67+ Register Reg = Op.getReg();
68+ if (ARM::SPRRegClass.contains(Reg) || ARM::DPRRegClass.contains(Reg) ||
69+ ARM::QPRRegClass.contains(Reg))
70+ ReturnsFPReg = true;
71 }
72 }
73
74- bool passesFPReg = (!NonclearedFPRegs.empty() || !ClearedFPRegs.empty());
75+ bool PassesFPReg = (!NonclearedFPRegs.empty() || !ClearedFPRegs.empty());
76
77- if (passesFPReg)
78+ if (PassesFPReg || ReturnsFPReg)
79 assert(STI->hasFPRegs() && "Subtarget needs fpregs");
80
81+ // CVE-2024-7883
82+ //
83+ // The VLLDM/VLSTM instructions set up lazy state preservation, but they
84+ // execute as NOPs if the FP register file is not considered to contain
85+ // secure data, represented by the CONTROL_S.SFPA bit. This means that the
86+ // state of CONTROL_S.SFPA must be the same when these two instructions are
87+ // executed. That might not be the case if we haven't used any FP
88+ // instructions before the VLSTM, so CONTROL_S.SFPA is clear, but do have one
89+ // before the VLLDM, which sets it..
90+ //
91+ // If we can't prove that SFPA will be the same for the VLSTM and VLLDM, we
92+ // execute a "vmov s0, s0" instruction before the VLSTM to ensure that
93+ // CONTROL_S.SFPA is set for both.
94+ //
95+ // That can only happen for callees which take no FP arguments (or we'd have
96+ // inserted a VMOV above) and which return values in FP regs (so that we need
97+ // to use a VMOV to back-up the return value before the VLLDM). It also can't
98+ // happen if the call is dominated by other existing floating-point
99+ // instructions, but we don't currently check for that case.
100+ //
101+ // These conditions mean that we only emit this instruction when using the
102+ // hard-float ABI, which means we can assume that FP instructions are
103+ // available, and don't need to make it conditional like we do for the
104+ // CVE-2021-35465 workaround.
105+ if (ReturnsFPReg && !PassesFPReg) {
106+ bool S0Dead = !LiveRegs.contains(ARM::S0);
107+ BuildMI(MBB, MBBI, DL, TII->get(ARM::VMOVS))
108+ .addReg(ARM::S0, RegState::Define | getDeadRegState(S0Dead))
109+ .addReg(ARM::S0, getUndefRegState(S0Dead))
110+ .add(predOps(ARMCC::AL));
111+ }
112+
113 // Lazy store all fp registers to the stack.
114 // This executes as NOP in the absence of floating-point support.
115 MachineInstrBuilder VLSTM = BuildMI(MBB, MBBI, DL, TII->get(ARM::VLSTM))
116@@ -1525,7 +1563,7 @@ void ARMExpandPseudo::CMSESaveClearFPRegsV8(
117 }
118 // restore FPSCR from stack and clear bits 0-4, 7, 28-31
119 // The other bits are program global according to the AAPCS
120- if (passesFPReg) {
121+ if (PassesFPReg) {
122 BuildMI(MBB, MBBI, DL, TII->get(ARM::tLDRspi), SpareReg)
123 .addReg(ARM::SP)
124 .addImm(0x10)
125diff --git a/llvm/test/CodeGen/ARM/cmse-clear-float-hard.ll b/llvm/test/CodeGen/ARM/cmse-clear-float-hard.ll
126index 606859db0a0e..f97fc51a0c45 100644
127--- a/llvm/test/CodeGen/ARM/cmse-clear-float-hard.ll
128+++ b/llvm/test/CodeGen/ARM/cmse-clear-float-hard.ll
129@@ -187,7 +187,7 @@ define float @f2(ptr nocapture %fptr) #2 {
130 ; CHECK-8M-NEXT: bic r0, r0, #1
131 ; CHECK-8M-NEXT: sub sp, #136
132 ; CHECK-8M-NEXT: vmov r12, s0
133-; CHECK-8M-NEXT: vlstm sp
134+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
135 ; CHECK-8M-NEXT: vmov s0, r12
136 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
137 ; CHECK-8M-NEXT: bic r1, r1, #159
138@@ -207,7 +207,7 @@ define float @f2(ptr nocapture %fptr) #2 {
139 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
140 ; CHECK-8M-NEXT: blxns r0
141 ; CHECK-8M-NEXT: vmov r12, s0
142-; CHECK-8M-NEXT: vlldm sp
143+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
144 ; CHECK-8M-NEXT: vmov s0, r12
145 ; CHECK-8M-NEXT: add sp, #136
146 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
147@@ -245,7 +245,7 @@ define double @d2(ptr nocapture %fptr) #2 {
148 ; CHECK-8M-LE-NEXT: bic r0, r0, #1
149 ; CHECK-8M-LE-NEXT: sub sp, #136
150 ; CHECK-8M-LE-NEXT: vmov r11, r12, d0
151-; CHECK-8M-LE-NEXT: vlstm sp
152+; CHECK-8M-LE-NEXT: vlstm sp, {d0 - d15}
153 ; CHECK-8M-LE-NEXT: vmov d0, r11, r12
154 ; CHECK-8M-LE-NEXT: ldr r1, [sp, #64]
155 ; CHECK-8M-LE-NEXT: bic r1, r1, #159
156@@ -264,7 +264,7 @@ define double @d2(ptr nocapture %fptr) #2 {
157 ; CHECK-8M-LE-NEXT: msr apsr_nzcvqg, r0
158 ; CHECK-8M-LE-NEXT: blxns r0
159 ; CHECK-8M-LE-NEXT: vmov r11, r12, d0
160-; CHECK-8M-LE-NEXT: vlldm sp
161+; CHECK-8M-LE-NEXT: vlldm sp, {d0 - d15}
162 ; CHECK-8M-LE-NEXT: vmov d0, r11, r12
163 ; CHECK-8M-LE-NEXT: add sp, #136
164 ; CHECK-8M-LE-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
165@@ -283,7 +283,7 @@ define double @d2(ptr nocapture %fptr) #2 {
166 ; CHECK-8M-BE-NEXT: bic r0, r0, #1
167 ; CHECK-8M-BE-NEXT: sub sp, #136
168 ; CHECK-8M-BE-NEXT: vmov r11, r12, d0
169-; CHECK-8M-BE-NEXT: vlstm sp
170+; CHECK-8M-BE-NEXT: vlstm sp, {d0 - d15}
171 ; CHECK-8M-BE-NEXT: vmov d0, r11, r12
172 ; CHECK-8M-BE-NEXT: ldr r1, [sp, #64]
173 ; CHECK-8M-BE-NEXT: bic r1, r1, #159
174@@ -302,7 +302,7 @@ define double @d2(ptr nocapture %fptr) #2 {
175 ; CHECK-8M-BE-NEXT: msr apsr_nzcvqg, r0
176 ; CHECK-8M-BE-NEXT: blxns r0
177 ; CHECK-8M-BE-NEXT: vmov r11, r12, d0
178-; CHECK-8M-BE-NEXT: vlldm sp
179+; CHECK-8M-BE-NEXT: vlldm sp, {d0 - d15}
180 ; CHECK-8M-BE-NEXT: vmov d0, r11, r12
181 ; CHECK-8M-BE-NEXT: add sp, #136
182 ; CHECK-8M-BE-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
183@@ -368,7 +368,7 @@ define float @f3(ptr nocapture %fptr) #4 {
184 ; CHECK-8M-NEXT: bic r0, r0, #1
185 ; CHECK-8M-NEXT: sub sp, #136
186 ; CHECK-8M-NEXT: vmov r12, s0
187-; CHECK-8M-NEXT: vlstm sp
188+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
189 ; CHECK-8M-NEXT: vmov s0, r12
190 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
191 ; CHECK-8M-NEXT: bic r1, r1, #159
192@@ -388,7 +388,7 @@ define float @f3(ptr nocapture %fptr) #4 {
193 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
194 ; CHECK-8M-NEXT: blxns r0
195 ; CHECK-8M-NEXT: vmov r12, s0
196-; CHECK-8M-NEXT: vlldm sp
197+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
198 ; CHECK-8M-NEXT: vmov s0, r12
199 ; CHECK-8M-NEXT: add sp, #136
200 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
201@@ -426,7 +426,7 @@ define double @d3(ptr nocapture %fptr) #4 {
202 ; CHECK-8M-LE-NEXT: bic r0, r0, #1
203 ; CHECK-8M-LE-NEXT: sub sp, #136
204 ; CHECK-8M-LE-NEXT: vmov r11, r12, d0
205-; CHECK-8M-LE-NEXT: vlstm sp
206+; CHECK-8M-LE-NEXT: vlstm sp, {d0 - d15}
207 ; CHECK-8M-LE-NEXT: vmov d0, r11, r12
208 ; CHECK-8M-LE-NEXT: ldr r1, [sp, #64]
209 ; CHECK-8M-LE-NEXT: bic r1, r1, #159
210@@ -445,7 +445,7 @@ define double @d3(ptr nocapture %fptr) #4 {
211 ; CHECK-8M-LE-NEXT: msr apsr_nzcvqg, r0
212 ; CHECK-8M-LE-NEXT: blxns r0
213 ; CHECK-8M-LE-NEXT: vmov r11, r12, d0
214-; CHECK-8M-LE-NEXT: vlldm sp
215+; CHECK-8M-LE-NEXT: vlldm sp, {d0 - d15}
216 ; CHECK-8M-LE-NEXT: vmov d0, r11, r12
217 ; CHECK-8M-LE-NEXT: add sp, #136
218 ; CHECK-8M-LE-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
219@@ -464,7 +464,7 @@ define double @d3(ptr nocapture %fptr) #4 {
220 ; CHECK-8M-BE-NEXT: bic r0, r0, #1
221 ; CHECK-8M-BE-NEXT: sub sp, #136
222 ; CHECK-8M-BE-NEXT: vmov r11, r12, d0
223-; CHECK-8M-BE-NEXT: vlstm sp
224+; CHECK-8M-BE-NEXT: vlstm sp, {d0 - d15}
225 ; CHECK-8M-BE-NEXT: vmov d0, r11, r12
226 ; CHECK-8M-BE-NEXT: ldr r1, [sp, #64]
227 ; CHECK-8M-BE-NEXT: bic r1, r1, #159
228@@ -483,7 +483,7 @@ define double @d3(ptr nocapture %fptr) #4 {
229 ; CHECK-8M-BE-NEXT: msr apsr_nzcvqg, r0
230 ; CHECK-8M-BE-NEXT: blxns r0
231 ; CHECK-8M-BE-NEXT: vmov r11, r12, d0
232-; CHECK-8M-BE-NEXT: vlldm sp
233+; CHECK-8M-BE-NEXT: vlldm sp, {d0 - d15}
234 ; CHECK-8M-BE-NEXT: vmov d0, r11, r12
235 ; CHECK-8M-BE-NEXT: add sp, #136
236 ; CHECK-8M-BE-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
237@@ -547,8 +547,9 @@ define float @f4(ptr nocapture %fptr) #6 {
238 ; CHECK-8M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
239 ; CHECK-8M-NEXT: bic r0, r0, #1
240 ; CHECK-8M-NEXT: sub sp, #136
241-; CHECK-8M-NEXT: vlstm sp
242+; CHECK-8M-NEXT: vmov.f32 s0, s0
243 ; CHECK-8M-NEXT: mov r1, r0
244+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
245 ; CHECK-8M-NEXT: mov r2, r0
246 ; CHECK-8M-NEXT: mov r3, r0
247 ; CHECK-8M-NEXT: mov r4, r0
248@@ -563,7 +564,7 @@ define float @f4(ptr nocapture %fptr) #6 {
249 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
250 ; CHECK-8M-NEXT: blxns r0
251 ; CHECK-8M-NEXT: vmov r12, s0
252-; CHECK-8M-NEXT: vlldm sp
253+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
254 ; CHECK-8M-NEXT: vmov s0, r12
255 ; CHECK-8M-NEXT: add sp, #136
256 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
257@@ -598,8 +599,9 @@ define double @d4(ptr nocapture %fptr) #6 {
258 ; CHECK-8M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
259 ; CHECK-8M-NEXT: bic r0, r0, #1
260 ; CHECK-8M-NEXT: sub sp, #136
261-; CHECK-8M-NEXT: vlstm sp
262+; CHECK-8M-NEXT: vmov.f32 s0, s0
263 ; CHECK-8M-NEXT: mov r1, r0
264+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
265 ; CHECK-8M-NEXT: mov r2, r0
266 ; CHECK-8M-NEXT: mov r3, r0
267 ; CHECK-8M-NEXT: mov r4, r0
268@@ -614,7 +616,7 @@ define double @d4(ptr nocapture %fptr) #6 {
269 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
270 ; CHECK-8M-NEXT: blxns r0
271 ; CHECK-8M-NEXT: vmov r11, r12, d0
272-; CHECK-8M-NEXT: vlldm sp
273+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
274 ; CHECK-8M-NEXT: vmov d0, r11, r12
275 ; CHECK-8M-NEXT: add sp, #136
276 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
277@@ -649,7 +651,7 @@ define void @fd(ptr %f, float %a, double %b) #8 {
278 ; CHECK-8M-NEXT: vmov r12, s0
279 ; CHECK-8M-NEXT: mov r2, r0
280 ; CHECK-8M-NEXT: vmov r10, r11, d1
281-; CHECK-8M-NEXT: vlstm sp
282+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
283 ; CHECK-8M-NEXT: vmov s0, r12
284 ; CHECK-8M-NEXT: vmov d1, r10, r11
285 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
286@@ -666,7 +668,7 @@ define void @fd(ptr %f, float %a, double %b) #8 {
287 ; CHECK-8M-NEXT: mov r9, r0
288 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
289 ; CHECK-8M-NEXT: blxns r0
290-; CHECK-8M-NEXT: vlldm sp
291+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
292 ; CHECK-8M-NEXT: add sp, #136
293 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
294 ; CHECK-8M-NEXT: pop {r7, pc}
295@@ -708,7 +710,7 @@ define void @fdff(ptr %f, float %a, double %b, float %c, float %d) #8 {
296 ; CHECK-8M-NEXT: vmov r9, s1
297 ; CHECK-8M-NEXT: mov r4, r0
298 ; CHECK-8M-NEXT: vmov r8, s4
299-; CHECK-8M-NEXT: vlstm sp
300+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
301 ; CHECK-8M-NEXT: vmov s0, r12
302 ; CHECK-8M-NEXT: vmov d1, r10, r11
303 ; CHECK-8M-NEXT: vmov s1, r9
304@@ -723,7 +725,7 @@ define void @fdff(ptr %f, float %a, double %b, float %c, float %d) #8 {
305 ; CHECK-8M-NEXT: mov r7, r0
306 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
307 ; CHECK-8M-NEXT: blxns r0
308-; CHECK-8M-NEXT: vlldm sp
309+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
310 ; CHECK-8M-NEXT: add sp, #136
311 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
312 ; CHECK-8M-NEXT: pop {r7, pc}
313@@ -765,7 +767,7 @@ define void @fidififid(ptr %fu, float %a, i32 %b, double %c, i32 %d, float %e, i
314 ; CHECK-8M-NEXT: vmov r8, s1
315 ; CHECK-8M-NEXT: vmov r7, s4
316 ; CHECK-8M-NEXT: vmov r5, r6, d3
317-; CHECK-8M-NEXT: vlstm sp
318+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
319 ; CHECK-8M-NEXT: vmov s0, r11
320 ; CHECK-8M-NEXT: vmov d1, r9, r10
321 ; CHECK-8M-NEXT: vmov s1, r8
322@@ -778,7 +780,7 @@ define void @fidififid(ptr %fu, float %a, i32 %b, double %c, i32 %d, float %e, i
323 ; CHECK-8M-NEXT: mov r4, r12
324 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r12
325 ; CHECK-8M-NEXT: blxns r12
326-; CHECK-8M-NEXT: vlldm sp
327+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
328 ; CHECK-8M-NEXT: add sp, #136
329 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
330 ; CHECK-8M-NEXT: pop {r7, pc}
331@@ -897,7 +899,7 @@ define half @h2(ptr nocapture %hptr) nounwind {
332 ; CHECK-8M-NEXT: bic r0, r0, #1
333 ; CHECK-8M-NEXT: sub sp, #136
334 ; CHECK-8M-NEXT: vmov r12, s0
335-; CHECK-8M-NEXT: vlstm sp
336+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
337 ; CHECK-8M-NEXT: vmov s0, r12
338 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
339 ; CHECK-8M-NEXT: bic r1, r1, #159
340@@ -917,7 +919,7 @@ define half @h2(ptr nocapture %hptr) nounwind {
341 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
342 ; CHECK-8M-NEXT: blxns r0
343 ; CHECK-8M-NEXT: vmov r12, s0
344-; CHECK-8M-NEXT: vlldm sp
345+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
346 ; CHECK-8M-NEXT: vmov s0, r12
347 ; CHECK-8M-NEXT: add sp, #136
348 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
349@@ -976,7 +978,7 @@ define half @h3(ptr nocapture %hptr) nounwind {
350 ; CHECK-8M-NEXT: bic r0, r0, #1
351 ; CHECK-8M-NEXT: sub sp, #136
352 ; CHECK-8M-NEXT: vmov r12, s0
353-; CHECK-8M-NEXT: vlstm sp
354+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
355 ; CHECK-8M-NEXT: vmov s0, r12
356 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
357 ; CHECK-8M-NEXT: bic r1, r1, #159
358@@ -996,7 +998,7 @@ define half @h3(ptr nocapture %hptr) nounwind {
359 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
360 ; CHECK-8M-NEXT: blxns r0
361 ; CHECK-8M-NEXT: vmov r12, s0
362-; CHECK-8M-NEXT: vlldm sp
363+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
364 ; CHECK-8M-NEXT: vmov s0, r12
365 ; CHECK-8M-NEXT: add sp, #136
366 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
367@@ -1053,8 +1055,9 @@ define half @h4(ptr nocapture %hptr) nounwind {
368 ; CHECK-8M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
369 ; CHECK-8M-NEXT: bic r0, r0, #1
370 ; CHECK-8M-NEXT: sub sp, #136
371-; CHECK-8M-NEXT: vlstm sp
372+; CHECK-8M-NEXT: vmov.f32 s0, s0
373 ; CHECK-8M-NEXT: mov r1, r0
374+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
375 ; CHECK-8M-NEXT: mov r2, r0
376 ; CHECK-8M-NEXT: mov r3, r0
377 ; CHECK-8M-NEXT: mov r4, r0
378@@ -1069,7 +1072,7 @@ define half @h4(ptr nocapture %hptr) nounwind {
379 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
380 ; CHECK-8M-NEXT: blxns r0
381 ; CHECK-8M-NEXT: vmov r12, s0
382-; CHECK-8M-NEXT: vlldm sp
383+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
384 ; CHECK-8M-NEXT: vmov s0, r12
385 ; CHECK-8M-NEXT: add sp, #136
386 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
387@@ -1176,7 +1179,7 @@ define half @h1_arg(ptr nocapture %hptr, half %harg) nounwind {
388 ; CHECK-8M-NEXT: bic r0, r0, #1
389 ; CHECK-8M-NEXT: sub sp, #136
390 ; CHECK-8M-NEXT: vmov r12, s0
391-; CHECK-8M-NEXT: vlstm sp
392+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
393 ; CHECK-8M-NEXT: vmov s0, r12
394 ; CHECK-8M-NEXT: ldr r1, [sp, #64]
395 ; CHECK-8M-NEXT: bic r1, r1, #159
396@@ -1196,7 +1199,7 @@ define half @h1_arg(ptr nocapture %hptr, half %harg) nounwind {
397 ; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
398 ; CHECK-8M-NEXT: blxns r0
399 ; CHECK-8M-NEXT: vmov r12, s0
400-; CHECK-8M-NEXT: vlldm sp
401+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
402 ; CHECK-8M-NEXT: vmov s0, r12
403 ; CHECK-8M-NEXT: add sp, #136
404 ; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
405@@ -1241,3 +1244,100 @@ entry:
406 ret half %call
407 }
408
409+define float @float_return_undef_arg(ptr nocapture %fptr) #6 {
410+; CHECK-8M-LABEL: float_return_undef_arg:
411+; CHECK-8M: @ %bb.0: @ %entry
412+; CHECK-8M-NEXT: push {r7, lr}
413+; CHECK-8M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
414+; CHECK-8M-NEXT: bic r0, r0, #1
415+; CHECK-8M-NEXT: sub sp, #136
416+; CHECK-8M-NEXT: vmov.f32 s0, s0
417+; CHECK-8M-NEXT: mov r1, r0
418+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
419+; CHECK-8M-NEXT: mov r2, r0
420+; CHECK-8M-NEXT: mov r3, r0
421+; CHECK-8M-NEXT: mov r4, r0
422+; CHECK-8M-NEXT: mov r5, r0
423+; CHECK-8M-NEXT: mov r6, r0
424+; CHECK-8M-NEXT: mov r7, r0
425+; CHECK-8M-NEXT: mov r8, r0
426+; CHECK-8M-NEXT: mov r9, r0
427+; CHECK-8M-NEXT: mov r10, r0
428+; CHECK-8M-NEXT: mov r11, r0
429+; CHECK-8M-NEXT: mov r12, r0
430+; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
431+; CHECK-8M-NEXT: blxns r0
432+; CHECK-8M-NEXT: vmov r12, s0
433+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
434+; CHECK-8M-NEXT: vmov s0, r12
435+; CHECK-8M-NEXT: add sp, #136
436+; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
437+; CHECK-8M-NEXT: pop {r7, pc}
438+;
439+; CHECK-81M-LABEL: float_return_undef_arg:
440+; CHECK-81M: @ %bb.0: @ %entry
441+; CHECK-81M-NEXT: push {r7, lr}
442+; CHECK-81M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
443+; CHECK-81M-NEXT: bic r0, r0, #1
444+; CHECK-81M-NEXT: vpush {s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31}
445+; CHECK-81M-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31, vpr}
446+; CHECK-81M-NEXT: vstr fpcxts, [sp, #-8]!
447+; CHECK-81M-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr}
448+; CHECK-81M-NEXT: blxns r0
449+; CHECK-81M-NEXT: vldr fpcxts, [sp], #8
450+; CHECK-81M-NEXT: vpop {s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31}
451+; CHECK-81M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
452+; CHECK-81M-NEXT: pop {r7, pc}
453+entry:
454+ %call = call float %fptr(i32 undef) #7
455+ ret float %call
456+}
457+
458+define float @float_return_poison_arg(ptr nocapture %fptr) #6 {
459+; CHECK-8M-LABEL: float_return_poison_arg:
460+; CHECK-8M: @ %bb.0: @ %entry
461+; CHECK-8M-NEXT: push {r7, lr}
462+; CHECK-8M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
463+; CHECK-8M-NEXT: bic r0, r0, #1
464+; CHECK-8M-NEXT: sub sp, #136
465+; CHECK-8M-NEXT: vmov.f32 s0, s0
466+; CHECK-8M-NEXT: mov r1, r0
467+; CHECK-8M-NEXT: vlstm sp, {d0 - d15}
468+; CHECK-8M-NEXT: mov r2, r0
469+; CHECK-8M-NEXT: mov r3, r0
470+; CHECK-8M-NEXT: mov r4, r0
471+; CHECK-8M-NEXT: mov r5, r0
472+; CHECK-8M-NEXT: mov r6, r0
473+; CHECK-8M-NEXT: mov r7, r0
474+; CHECK-8M-NEXT: mov r8, r0
475+; CHECK-8M-NEXT: mov r9, r0
476+; CHECK-8M-NEXT: mov r10, r0
477+; CHECK-8M-NEXT: mov r11, r0
478+; CHECK-8M-NEXT: mov r12, r0
479+; CHECK-8M-NEXT: msr apsr_nzcvqg, r0
480+; CHECK-8M-NEXT: blxns r0
481+; CHECK-8M-NEXT: vmov r12, s0
482+; CHECK-8M-NEXT: vlldm sp, {d0 - d15}
483+; CHECK-8M-NEXT: vmov s0, r12
484+; CHECK-8M-NEXT: add sp, #136
485+; CHECK-8M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
486+; CHECK-8M-NEXT: pop {r7, pc}
487+;
488+; CHECK-81M-LABEL: float_return_poison_arg:
489+; CHECK-81M: @ %bb.0: @ %entry
490+; CHECK-81M-NEXT: push {r7, lr}
491+; CHECK-81M-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11}
492+; CHECK-81M-NEXT: bic r0, r0, #1
493+; CHECK-81M-NEXT: vpush {s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31}
494+; CHECK-81M-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31, vpr}
495+; CHECK-81M-NEXT: vstr fpcxts, [sp, #-8]!
496+; CHECK-81M-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr}
497+; CHECK-81M-NEXT: blxns r0
498+; CHECK-81M-NEXT: vldr fpcxts, [sp], #8
499+; CHECK-81M-NEXT: vpop {s16, s17, s18, s19, s20, s21, s22, s23, s24, s25, s26, s27, s28, s29, s30, s31}
500+; CHECK-81M-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11}
501+; CHECK-81M-NEXT: pop {r7, pc}
502+entry:
503+ %call = call float %fptr(i32 poison) #7
504+ ret float %call
505+}
506diff --git a/llvm/test/CodeGen/ARM/cmse-vlldm-no-reorder.mir b/llvm/test/CodeGen/ARM/cmse-vlldm-no-reorder.mir
507index 2bc4288884f1..416cf3a53c9b 100644
508--- a/llvm/test/CodeGen/ARM/cmse-vlldm-no-reorder.mir
509+++ b/llvm/test/CodeGen/ARM/cmse-vlldm-no-reorder.mir
510@@ -89,6 +89,7 @@ body: |
511 # CHECK: $sp = t2STMDB_UPD $sp, 14 /* CC::al */, $noreg, $r4, $r5, $r6, undef $r7, $r8, $r9, $r10, $r11
512 # CHECK-NEXT: $r0 = t2BICri $r0, 1, 14 /* CC::al */, $noreg, $noreg
513 # CHECK-NEXT: $sp = tSUBspi $sp, 34, 14 /* CC::al */, $noreg
514+# CHECK-NEXT: dead $s0 = VMOVS undef $s0, 14 /* CC::al */, $noreg
515 # CHECK-NEXT: VLSTM $sp, 14 /* CC::al */, $noreg, implicit undef $vpr, implicit undef $fpscr, implicit undef $fpscr_nzcv, implicit undef $q0, implicit undef $q1, implicit undef $q2, implicit undef $q3, implicit undef $q4, implicit undef $q5, implicit undef $q6, implicit undef $q7
516 # CHECK-NEXT: $r1 = tMOVr $r0, 14 /* CC::al */, $noreg
517 # CHECK-NEXT: $r2 = tMOVr $r0, 14 /* CC::al */, $noreg
518--
5192.43.7
diff --git a/recipes-devtools/clang/common.inc b/recipes-devtools/clang/common.inc
index f48be06..660b999 100644
--- a/recipes-devtools/clang/common.inc
+++ b/recipes-devtools/clang/common.inc
@@ -50,6 +50,7 @@ SRC_URI = "\
50 file://0037-Include-cstdint-in-AMDGPUMCTargetDesc-101766.patch \ 50 file://0037-Include-cstdint-in-AMDGPUMCTargetDesc-101766.patch \
51 file://0038-Add-missing-include-to-X86MCTargetDesc.h-123320.patch \ 51 file://0038-Add-missing-include-to-X86MCTargetDesc.h-123320.patch \
52 file://0039-Add-cstdint-to-AddressableBits-102110.patch \ 52 file://0039-Add-cstdint-to-AddressableBits-102110.patch \
53 file://CVE-2024-7883.patch \
53 " 54 "
54# Fallback to no-PIE if not set 55# Fallback to no-PIE if not set
55GCCPIE ??= "" 56GCCPIE ??= ""
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-01 16:46:37 +0000