summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPgowda <pgowda.cve@gmail.com>2021-11-15 04:14:40 -0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-11-24 21:12:46 +0000
commit24b0ee2be7ef453f8b8d43d01f39777ee886cf50 (patch)
treef93e686fd1da92375ed20d984ae2cd1bb24a41a8
parent82077a92b2d1791e1be219835e688b73dfd1a33a (diff)
downloadpoky-24b0ee2be7ef453f8b8d43d01f39777ee886cf50.tar.gz
gcc: Fix CVE-2021-35465
source : https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102035 Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=3929bca9ca95de9d35e82ae8828b188029e3eb70] Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=574e7950bd6b34e9e2cacce18c802b45505d1d0a] Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=30461cf8dba3d3adb15a125e4da48800eb2b9b8f] Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=809330ab8450261e05919b472783bf15e4b000f7] (From OE-Core rev: 2dae3da5dbb0c8293927f0676fff08437f75d0d2) Signed-off-by: Pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat
-rw-r--r--meta/recipes-devtools/gcc/gcc-10.2.inc4
-rw-r--r--meta/recipes-devtools/gcc/gcc/0001-CVE-2021-35465.patch138
-rw-r--r--meta/recipes-devtools/gcc/gcc/0002-CVE-2021-35465.patch40
-rw-r--r--meta/recipes-devtools/gcc/gcc/0003-CVE-2021-35465.patch103
-rw-r--r--meta/recipes-devtools/gcc/gcc/0004-CVE-2021-35465.patch304
5 files changed, 589 insertions, 0 deletions
diff --git a/meta/recipes-devtools/gcc/gcc-10.2.inc b/meta/recipes-devtools/gcc/gcc-10.2.inc
index c0cd8b31d5..248e002106 100644
--- a/meta/recipes-devtools/gcc/gcc-10.2.inc
+++ b/meta/recipes-devtools/gcc/gcc-10.2.inc
@@ -70,6 +70,10 @@ SRC_URI = "\
70 file://0003-aarch64-Mitigate-SLS-for-BLR-instruction.patch \ 70 file://0003-aarch64-Mitigate-SLS-for-BLR-instruction.patch \
71 file://0001-aarch64-Fix-up-__aarch64_cas16_acq_rel-fallback.patch \ 71 file://0001-aarch64-Fix-up-__aarch64_cas16_acq_rel-fallback.patch \
72 file://0001-libatomic-libgomp-libitc-Fix-bootstrap-PR70454.patch \ 72 file://0001-libatomic-libgomp-libitc-Fix-bootstrap-PR70454.patch \
73 file://0001-CVE-2021-35465.patch \
74 file://0002-CVE-2021-35465.patch \
75 file://0003-CVE-2021-35465.patch \
76 file://0004-CVE-2021-35465.patch \
73" 77"
74SRC_URI[sha256sum] = "b8dd4368bb9c7f0b98188317ee0254dd8cc99d1e3a18d0ff146c855fe16c1d8c" 78SRC_URI[sha256sum] = "b8dd4368bb9c7f0b98188317ee0254dd8cc99d1e3a18d0ff146c855fe16c1d8c"
75 79
diff --git a/meta/recipes-devtools/gcc/gcc/0001-CVE-2021-35465.patch b/meta/recipes-devtools/gcc/gcc/0001-CVE-2021-35465.patch
new file mode 100644
index 0000000000..b9bca49dd8
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0001-CVE-2021-35465.patch
@@ -0,0 +1,138 @@
1From 3929bca9ca95de9d35e82ae8828b188029e3eb70 Mon Sep 17 00:00:00 2001
2From: Richard Earnshaw <rearnsha@arm.com>
3Date: Fri, 11 Jun 2021 16:02:05 +0100
4Subject: [PATCH] arm: Add command-line option for enabling CVE-2021-35465
5 mitigation [PR102035]
6
7Add a new option, -mfix-cmse-cve-2021-35465 and document it. Enable it
8automatically for cortex-m33, cortex-m35p and cortex-m55.
9
10gcc:
11 PR target/102035
12 * config/arm/arm.opt (mfix-cmse-cve-2021-35465): New option.
13 * doc/invoke.texi (Arm Options): Document it.
14 * config/arm/arm-cpus.in (quirk_vlldm): New feature bit.
15 (ALL_QUIRKS): Add quirk_vlldm.
16 (cortex-m33): Add quirk_vlldm.
17 (cortex-m35p, cortex-m55): Likewise.
18 * config/arm/arm.c (arm_option_override): Enable fix_vlldm if
19 targetting an affected CPU and not explicitly controlled on
20 the command line.
21
22CVE: CVE-2021-35465
23Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=3929bca9ca95de9d35e82ae8828b188029e3eb70]
24Signed-off-by: Pgowda <pgowda.cve@gmail.com>
25
26---
27 gcc/config/arm/arm-cpus.in | 9 +++++++--
28 gcc/config/arm/arm.c | 9 +++++++++
29 gcc/config/arm/arm.opt | 4 ++++
30 gcc/doc/invoke.texi | 9 +++++++++
31 4 files changed, 29 insertions(+), 2 deletions(-)
32
33diff --git a/gcc/config/arm/arm.c b/gcc/config/arm/arm.c
34--- a/gcc/config/arm/arm.c 2020-07-22 23:35:17.344384552 -0700
35+++ b/gcc/config/arm/arm.c 2021-11-11 20:16:19.761241867 -0800
36@@ -3595,6 +3595,15 @@ arm_option_override (void)
37 fix_cm3_ldrd = 0;
38 }
39
40+ /* Enable fix_vlldm by default if required. */
41+ if (fix_vlldm == 2)
42+ {
43+ if (bitmap_bit_p (arm_active_target.isa, isa_bit_quirk_vlldm))
44+ fix_vlldm = 1;
45+ else
46+ fix_vlldm = 0;
47+ }
48+
49 /* Hot/Cold partitioning is not currently supported, since we can't
50 handle literal pool placement in that case. */
51 if (flag_reorder_blocks_and_partition)
52diff --git a/gcc/config/arm/arm-cpus.in b/gcc/config/arm/arm-cpus.in
53--- a/gcc/config/arm/arm-cpus.in 2020-07-22 23:35:17.340384509 -0700
54+++ b/gcc/config/arm/arm-cpus.in 2021-11-11 20:17:01.364573561 -0800
55@@ -190,6 +190,9 @@ define feature quirk_armv6kz
56 # Cortex-M3 LDRD quirk.
57 define feature quirk_cm3_ldrd
58
59+# v8-m/v8.1-m VLLDM errata.
60+define feature quirk_vlldm
61+
62 # Don't use .cpu assembly directive
63 define feature quirk_no_asmcpu
64
65@@ -314,7 +317,7 @@ define fgroup DOTPROD NEON dotprod
66 # architectures.
67 # xscale isn't really a 'quirk', but it isn't an architecture either and we
68 # need to ignore it for matching purposes.
69-define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd xscale quirk_no_asmcpu
70+define fgroup ALL_QUIRKS quirk_no_volatile_ce quirk_armv6kz quirk_cm3_ldrd quirk_vlldm xscale quirk_no_asmcpu
71
72 # Architecture entries
73 # format:
74@@ -1492,6 +1495,7 @@ begin cpu cortex-m33
75 architecture armv8-m.main+dsp+fp
76 option nofp remove ALL_FP
77 option nodsp remove armv7em
78+ isa quirk_vlldm
79 costs v7m
80 end cpu cortex-m33
81
82@@ -1501,6 +1505,7 @@ begin cpu cortex-m35p
83 architecture armv8-m.main+dsp+fp
84 option nofp remove ALL_FP
85 option nodsp remove armv7em
86+ isa quirk_vlldm
87 costs v7m
88 end cpu cortex-m35p
89
90@@ -1508,7 +1513,7 @@ begin cpu cortex-m55
91 cname cortexm55
92 tune flags LDSCHED
93 architecture armv8.1-m.main+mve.fp+fp.dp
94- isa quirk_no_asmcpu
95+ isa quirk_no_asmcpu quirk_vlldm
96 costs v7m
97 vendor 41
98 end cpu cortex-m55
99diff --git a/gcc/config/arm/arm.opt b/gcc/config/arm/arm.opt
100--- a/gcc/config/arm/arm.opt 2020-07-22 23:35:17.344384552 -0700
101+++ b/gcc/config/arm/arm.opt 2021-11-11 20:16:19.761241867 -0800
102@@ -271,6 +271,10 @@ Target Report Var(fix_cm3_ldrd) Init(2)
103 Avoid overlapping destination and address registers on LDRD instructions
104 that may trigger Cortex-M3 errata.
105
106+mfix-cmse-cve-2021-35465
107+Target Var(fix_vlldm) Init(2)
108+Mitigate issues with VLLDM on some M-profile devices (CVE-2021-35465).
109+
110 munaligned-access
111 Target Report Var(unaligned_access) Init(2) Save
112 Enable unaligned word and halfword accesses to packed data.
113diff -upr a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
114--- a/gcc/doc/invoke.texi 2021-11-11 19:30:56.264523105 -0800
115+++ b/gcc/doc/invoke.texi 2021-11-11 20:16:19.769241739 -0800
116@@ -773,6 +773,7 @@ Objective-C and Objective-C++ Dialects}.
117 -mverbose-cost-dump @gol
118 -mpure-code @gol
119 -mcmse @gol
120+-mfix-cmse-cve-2021-35465 @gol
121 -mfdpic}
122
123 @emph{AVR Options}
124@@ -21233,6 +21234,14 @@ Use multiply and add/subtract instructio
125
126 Do not use multiply and add/subtract instructions.
127
128+@item -mfix-cmse-cve-2021-35465
129+@opindex mfix-cmse-cve-2021-35465
130+Mitigate against a potential security issue with the @code{VLLDM} instruction
131+in some M-profile devices when using CMSE (CVE-2021-365465). This option is
132+enabled by default when the option @option{-mcpu=} is used with
133+@code{cortex-m33}, @code{cortex-m35p} or @code{cortex-m55}. The option
134+@option{-mno-fix-cmse-cve-2021-35465} can be used to disable the mitigation.
135+
136 @item -mfdpic
137 @opindex mfdpic
138
diff --git a/meta/recipes-devtools/gcc/gcc/0002-CVE-2021-35465.patch b/meta/recipes-devtools/gcc/gcc/0002-CVE-2021-35465.patch
new file mode 100644
index 0000000000..38d02dc770
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0002-CVE-2021-35465.patch
@@ -0,0 +1,40 @@
1From 574e7950bd6b34e9e2cacce18c802b45505d1d0a Mon Sep 17 00:00:00 2001
2From: Richard Earnshaw <rearnsha@arm.com>
3Date: Fri, 18 Jun 2021 17:16:25 +0100
4Subject: [PATCH] arm: add erratum mitigation to __gnu_cmse_nonsecure_call
5 [PR102035]
6
7Add the recommended erratum mitigation sequence to
8__gnu_cmse_nonsecure_call for use on Armv8-m.main devices. Since this
9is in the library code we cannot know in advance whether the core we
10are running on will be affected by this, so always enable it.
11
12libgcc:
13 PR target/102035
14 * config/arm/cmse_nonsecure_call.S (__gnu_cmse_nonsecure_call):
15 Add vlldm erratum work-around.
16
17CVE: CVE-2021-35465
18Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=574e7950bd6b34e9e2cacce18c802b45505d1d0a]
19Signed-off-by: Pgowda <pgowda.cve@gmail.com>
20
21---
22 libgcc/config/arm/cmse_nonsecure_call.S | 5 +++++
23 1 file changed, 5 insertions(+)
24
25diff --git a/libgcc/config/arm/cmse_nonsecure_call.S b/libgcc/config/arm/cmse_nonsecure_call.S
26index 00830ade98e..c8e0fbbe665 100644
27--- a/libgcc/config/arm/cmse_nonsecure_call.S
28+++ b/libgcc/config/arm/cmse_nonsecure_call.S
29@@ -102,6 +102,11 @@ blxns r4
30 #ifdef __ARM_PCS_VFP
31 vpop.f64 {d8-d15}
32 #else
33+/* VLLDM erratum mitigation sequence. */
34+mrs r5, control
35+tst r5, #8 /* CONTROL_S.SFPA */
36+it ne
37+.inst.w 0xeeb00a40 /* vmovne s0, s0 */
38 vlldm sp /* Lazy restore of d0-d16 and FPSCR. */
39 add sp, sp, #0x88 /* Free space used to save floating point registers. */
40 #endif /* __ARM_PCS_VFP */
diff --git a/meta/recipes-devtools/gcc/gcc/0003-CVE-2021-35465.patch b/meta/recipes-devtools/gcc/gcc/0003-CVE-2021-35465.patch
new file mode 100644
index 0000000000..d87be19866
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0003-CVE-2021-35465.patch
@@ -0,0 +1,103 @@
1From 30461cf8dba3d3adb15a125e4da48800eb2b9b8f Mon Sep 17 00:00:00 2001
2From: Richard Earnshaw <rearnsha@arm.com>
3Date: Fri, 18 Jun 2021 17:18:37 +0100
4Subject: [PATCH] arm: fix vlldm erratum for Armv8.1-m [PR102035]
5
6For Armv8.1-m we generate code that emits VLLDM directly and do not
7rely on support code in the library, so emit the mitigation directly
8as well, when required. In this case, we can use the compiler options
9to determine when to apply the fix and when it is safe to omit it.
10
11gcc:
12 PR target/102035
13 * config/arm/arm.md (attribute arch): Add fix_vlldm.
14 (arch_enabled): Use it.
15 * config/arm/vfp.md (lazy_store_multiple_insn): Add alternative to
16 use when erratum mitigation is needed.
17
18CVE: CVE-2021-35465
19Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=30461cf8dba3d3adb15a125e4da48800eb2b9b8f]
20Signed-off-by: Pgowda <pgowda.cve@gmail.com>
21
22---
23 gcc/config/arm/arm.md | 11 +++++++++--
24 gcc/config/arm/vfp.md | 10 +++++++---
25 2 files changed, 16 insertions(+), 5 deletions(-)
26
27diff -upr a/gcc/config/arm/arm.md b/gcc/config/arm/arm.md
28--- a/gcc/config/arm/arm.md 2020-07-22 23:35:17.344384552 -0700
29+++ b/gcc/config/arm/arm.md 2021-11-11 20:33:58.431543947 -0800
30@@ -132,9 +132,12 @@
31 ; TARGET_32BIT, "t1" or "t2" to specify a specific Thumb mode. "v6"
32 ; for ARM or Thumb-2 with arm_arch6, and nov6 for ARM without
33 ; arm_arch6. "v6t2" for Thumb-2 with arm_arch6 and "v8mb" for ARMv8-M
34-; Baseline. This attribute is used to compute attribute "enabled",
35+; Baseline. "fix_vlldm" is for fixing the v8-m/v8.1-m VLLDM erratum.
36+; This attribute is used to compute attribute "enabled",
37 ; use type "any" to enable an alternative in all cases.
38-(define_attr "arch" "any,a,t,32,t1,t2,v6,nov6,v6t2,v8mb,iwmmxt,iwmmxt2,armv6_or_vfpv3,neon,mve"
39+(define_attr "arch" "any, a, t, 32, t1, t2, v6,nov6, v6t2, \
40+ v8mb, fix_vlldm, iwmmxt, iwmmxt2, armv6_or_vfpv3, \
41+ neon, mve"
42 (const_string "any"))
43
44 (define_attr "arch_enabled" "no,yes"
45@@ -177,6 +180,10 @@
46 (match_test "TARGET_THUMB1 && arm_arch8"))
47 (const_string "yes")
48
49+ (and (eq_attr "arch" "fix_vlldm")
50+ (match_test "fix_vlldm"))
51+ (const_string "yes")
52+
53 (and (eq_attr "arch" "iwmmxt2")
54 (match_test "TARGET_REALLY_IWMMXT2"))
55 (const_string "yes")
56diff -upr a/gcc/config/arm/vfp.md b/gcc/config/arm/vfp.md
57--- a/gcc/config/arm/vfp.md 2020-07-22 23:35:17.356384684 -0700
58+++ b/gcc/config/arm/vfp.md 2021-11-11 20:33:58.431543947 -0800
59@@ -1703,12 +1703,15 @@
60 (set_attr "type" "mov_reg")]
61 )
62
63+;; Both this and the next instruction are treated by GCC in the same
64+;; way as a blockage pattern. That's perhaps stronger than it needs
65+;; to be, but we do not want accesses to the VFP register bank to be
66+;; moved across either instruction.
67+
68 (define_insn "lazy_store_multiple_insn"
69- [(set (match_operand:SI 0 "s_register_operand" "+&rk")
70- (post_dec:SI (match_dup 0)))
71- (unspec_volatile [(const_int 0)
72- (mem:SI (post_dec:SI (match_dup 0)))]
73- VUNSPEC_VLSTM)]
74+ [(unspec_volatile
75+ [(mem:BLK (match_operand:SI 0 "s_register_operand" "rk"))]
76+ VUNSPEC_VLSTM)]
77 "use_cmse && reload_completed"
78 "vlstm%?\\t%0"
79 [(set_attr "predicable" "yes")
80@@ -1716,14 +1719,16 @@
81 )
82
83 (define_insn "lazy_load_multiple_insn"
84- [(set (match_operand:SI 0 "s_register_operand" "+&rk")
85- (post_inc:SI (match_dup 0)))
86- (unspec_volatile:SI [(const_int 0)
87- (mem:SI (match_dup 0))]
88- VUNSPEC_VLLDM)]
89+ [(unspec_volatile
90+ [(mem:BLK (match_operand:SI 0 "s_register_operand" "rk,rk"))]
91+ VUNSPEC_VLLDM)]
92 "use_cmse && reload_completed"
93- "vlldm%?\\t%0"
94- [(set_attr "predicable" "yes")
95+ "@
96+ vscclrm\\t{vpr}\;vlldm\\t%0
97+ vlldm\\t%0"
98+ [(set_attr "arch" "fix_vlldm,*")
99+ (set_attr "predicable" "no")
100+ (set_attr "length" "8,4")
101 (set_attr "type" "load_4")]
102 )
103
diff --git a/meta/recipes-devtools/gcc/gcc/0004-CVE-2021-35465.patch b/meta/recipes-devtools/gcc/gcc/0004-CVE-2021-35465.patch
new file mode 100644
index 0000000000..9f7a38ed2e
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0004-CVE-2021-35465.patch
@@ -0,0 +1,304 @@
1From 809330ab8450261e05919b472783bf15e4b000f7 Mon Sep 17 00:00:00 2001
2From: Richard Earnshaw <rearnsha@arm.com>
3Date: Tue, 6 Jul 2021 15:10:18 +0100
4Subject: [PATCH] arm: Add tests for VLLDM mitigation [PR102035]
5
6New tests for the erratum mitigation.
7
8gcc/testsuite:
9 PR target/102035
10 * gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c: New test.
11 * gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c: Likewise.
12 * gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c: Likewise.
13 * gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c: Likewise.
14 * gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c: Likewise.
15 * gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c: Likewise.
16 * gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c: Likewise.
17 * gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c: Likewise.
18
19CVE: CVE-2021-35465
20Upstream-Status: Backport[https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=809330ab8450261e05919b472783bf15e4b000f7]
21Signed-off-by: Pgowda <pgowda.cve@gmail.com>
22
23---
24 .../arm/cmse/mainline/8_1m/soft/cmse-13a.c | 31 +++++++++++++++++++
25 .../arm/cmse/mainline/8_1m/soft/cmse-7a.c | 28 +++++++++++++++++
26 .../arm/cmse/mainline/8_1m/soft/cmse-8a.c | 30 ++++++++++++++++++
27 .../cmse/mainline/8_1m/softfp-sp/cmse-7a.c | 27 ++++++++++++++++
28 .../cmse/mainline/8_1m/softfp-sp/cmse-8a.c | 29 +++++++++++++++++
29 .../arm/cmse/mainline/8_1m/softfp/cmse-13a.c | 30 ++++++++++++++++++
30 .../arm/cmse/mainline/8_1m/softfp/cmse-7a.c | 27 ++++++++++++++++
31 .../arm/cmse/mainline/8_1m/softfp/cmse-8a.c | 29 +++++++++++++++++
32 8 files changed, 231 insertions(+)
33 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c
34 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c
35 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c
36 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c
37 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c
38 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c
39 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c
40 create mode 100644 gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c
41
42diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c
43--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c 1969-12-31 16:00:00.000000000 -0800
44+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-13a.c 2021-11-11 20:38:44.286766084 -0800
45@@ -0,0 +1,31 @@
46+/* { dg-do compile } */
47+/* { dg-options "-mcmse -mfloat-abi=soft -mfix-cmse-cve-2021-35465" } */
48+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=soft" } } */
49+
50+#include "../../../cmse-13.x"
51+
52+/* Checks for saving and clearing prior to function call. */
53+/* Shift on the same register as blxns. */
54+/* { dg-final { scan-assembler "lsrs\t(r\[1,4-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
55+/* { dg-final { scan-assembler "lsls\t(r\[1,4-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
56+/* { dg-final { scan-assembler-not "mov\tr0, r4" } } */
57+/* { dg-final { scan-assembler-not "mov\tr2, r4" } } */
58+/* { dg-final { scan-assembler-not "mov\tr3, r4" } } */
59+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
60+/* { dg-final { scan-assembler "vlstm\tsp" } } */
61+/* Check the right registers are cleared and none appears twice. */
62+/* { dg-final { scan-assembler "clrm\t\{(r1, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
63+/* Check that the right number of registers is cleared and thus only one
64+ register is missing. */
65+/* { dg-final { scan-assembler "clrm\t\{((r\[1,4-9\]|r10|fp|ip), ){9}APSR\}" } } */
66+/* Check that no cleared register is used for blxns. */
67+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[1,4-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
68+/* Check for v8.1-m variant of erratum work-around. */
69+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
70+/* { dg-final { scan-assembler "vlldm\tsp" } } */
71+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
72+/* { dg-final { scan-assembler-not "vmov" } } */
73+/* { dg-final { scan-assembler-not "vmsr" } } */
74+
75+/* Now we check that we use the correct intrinsic to call. */
76+/* { dg-final { scan-assembler "blxns" } } */
77diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c
78--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c 1969-12-31 16:00:00.000000000 -0800
79+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-7a.c 2021-11-11 20:38:44.286766084 -0800
80@@ -0,0 +1,28 @@
81+/* { dg-do compile } */
82+/* { dg-options "-mcmse -mfloat-abi=soft -mfix-cmse-cve-2021-35465" } */
83+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=soft" } } */
84+
85+#include "../../../cmse-7.x"
86+
87+/* Checks for saving and clearing prior to function call. */
88+/* Shift on the same register as blxns. */
89+/* { dg-final { scan-assembler "lsrs\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
90+/* { dg-final { scan-assembler "lsls\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
91+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
92+/* { dg-final { scan-assembler "vlstm\tsp" } } */
93+/* Check the right registers are cleared and none appears twice. */
94+/* { dg-final { scan-assembler "clrm\t\{(r0, )?(r1, )?(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
95+/* Check that the right number of registers is cleared and thus only one
96+ register is missing. */
97+/* { dg-final { scan-assembler "clrm\t\{((r\[0-9\]|r10|fp|ip), ){12}APSR\}" } } */
98+/* Check that no cleared register is used for blxns. */
99+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[0-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
100+/* Check for v8.1-m variant of erratum work-around. */
101+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
102+/* { dg-final { scan-assembler "vlldm\tsp" } } */
103+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
104+/* { dg-final { scan-assembler-not "vmov" } } */
105+/* { dg-final { scan-assembler-not "vmsr" } } */
106+
107+/* Now we check that we use the correct intrinsic to call. */
108+/* { dg-final { scan-assembler "blxns" } } */
109diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c
110--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c 1969-12-31 16:00:00.000000000 -0800
111+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/soft/cmse-8a.c 2021-11-11 20:38:44.286766084 -0800
112@@ -0,0 +1,30 @@
113+/* { dg-do compile } */
114+/* { dg-options "-mcmse -mfloat-abi=soft -mfix-cmse-cve-2021-35465" } */
115+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=soft" } } */
116+
117+#include "../../../cmse-8.x"
118+
119+/* Checks for saving and clearing prior to function call. */
120+/* Shift on the same register as blxns. */
121+/* { dg-final { scan-assembler "lsrs\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
122+/* { dg-final { scan-assembler "lsls\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
123+/* { dg-final { scan-assembler-not "mov\tr0, r4" } } */
124+/* { dg-final { scan-assembler-not "mov\tr1, r4" } } */
125+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
126+/* { dg-final { scan-assembler "vlstm\tsp" } } */
127+/* Check the right registers are cleared and none appears twice. */
128+/* { dg-final { scan-assembler "clrm\t\{(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
129+/* Check that the right number of registers is cleared and thus only one
130+ register is missing. */
131+/* { dg-final { scan-assembler "clrm\t\{((r\[2-9\]|r10|fp|ip), ){10}APSR\}" } } */
132+/* Check that no cleared register is used for blxns. */
133+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[2-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
134+/* Check for v8.1-m variant of erratum work-around. */
135+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
136+/* { dg-final { scan-assembler "vlldm\tsp" } } */
137+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
138+/* { dg-final { scan-assembler-not "vmov" } } */
139+/* { dg-final { scan-assembler-not "vmsr" } } */
140+
141+/* Now we check that we use the correct intrinsic to call. */
142+/* { dg-final { scan-assembler "blxns" } } */
143diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c
144--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c 1969-12-31 16:00:00.000000000 -0800
145+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-13a.c 2021-11-11 20:38:44.286766084 -0800
146@@ -0,0 +1,30 @@
147+/* { dg-do compile } */
148+/* { dg-options "-mcmse -mfloat-abi=softfp -mfpu=fpv5-d16 -mfix-cmse-cve-2021-35465" } */
149+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=softfp" } } */
150+/* { dg-skip-if "Skip these if testing single precision" {*-*-*} {"-mfpu=*-sp-*"} {""} } */
151+
152+#include "../../../cmse-13.x"
153+
154+/* Checks for saving and clearing prior to function call. */
155+/* Shift on the same register as blxns. */
156+/* { dg-final { scan-assembler "lsrs\t(r\[1,4-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
157+/* { dg-final { scan-assembler "lsls\t(r\[1,4-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
158+/* { dg-final { scan-assembler-not "mov\tr0, r4" } } */
159+/* { dg-final { scan-assembler-not "mov\tr2, r4" } } */
160+/* { dg-final { scan-assembler-not "mov\tr3, r4" } } */
161+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
162+/* { dg-final { scan-assembler "vlstm\tsp" } } */
163+/* Check the right registers are cleared and none appears twice. */
164+/* { dg-final { scan-assembler "clrm\t\{(r1, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
165+/* Check that the right number of registers is cleared and thus only one
166+ register is missing. */
167+/* { dg-final { scan-assembler "clrm\t\{((r\[1,4-9\]|r10|fp|ip), ){9}APSR\}" } } */
168+/* Check that no cleared register is used for blxns. */
169+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[1,4-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
170+/* Check for v8.1-m variant of erratum work-around. */
171+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
172+/* { dg-final { scan-assembler "vlldm\tsp" } } */
173+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
174+
175+/* Now we check that we use the correct intrinsic to call. */
176+/* { dg-final { scan-assembler "blxns" } } */
177diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c
178--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c 1969-12-31 16:00:00.000000000 -0800
179+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-7a.c 2021-11-11 20:38:44.286766084 -0800
180@@ -0,0 +1,27 @@
181+/* { dg-do compile } */
182+/* { dg-options "-mcmse -mfloat-abi=softfp -mfpu=fpv5-d16 -mfix-cmse-cve-2021-35465" } */
183+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=softfp" } } */
184+/* { dg-skip-if "Skip these if testing single precision" {*-*-*} {"-mfpu=*-sp-*"} {""} } */
185+
186+#include "../../../cmse-7.x"
187+
188+/* Checks for saving and clearing prior to function call. */
189+/* Shift on the same register as blxns. */
190+/* { dg-final { scan-assembler "lsrs\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
191+/* { dg-final { scan-assembler "lsls\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
192+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
193+/* { dg-final { scan-assembler "vlstm\tsp" } } */
194+/* Check the right registers are cleared and none appears twice. */
195+/* { dg-final { scan-assembler "clrm\t\{(r0, )?(r1, )?(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
196+/* Check that the right number of registers is cleared and thus only one
197+ register is missing. */
198+/* { dg-final { scan-assembler "clrm\t\{((r\[0-9\]|r10|fp|ip), ){12}APSR\}" } } */
199+/* Check that no cleared register is used for blxns. */
200+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[0-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
201+/* Check for v8.1-m variant of erratum work-around. */
202+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
203+/* { dg-final { scan-assembler "vlldm\tsp" } } */
204+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
205+
206+/* Now we check that we use the correct intrinsic to call. */
207+/* { dg-final { scan-assembler "blxns" } } */
208diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c
209--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c 1969-12-31 16:00:00.000000000 -0800
210+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp/cmse-8a.c 2021-11-11 20:38:44.290766017 -0800
211@@ -0,0 +1,29 @@
212+/* { dg-do compile } */
213+/* { dg-options "-mcmse -mfloat-abi=softfp -mfpu=fpv5-d16 -mfix-cmse-cve-2021-35465" } */
214+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=softfp" } } */
215+/* { dg-skip-if "Skip these if testing single precision" {*-*-*} {"-mfpu=*-sp-*"} {""} } */
216+
217+#include "../../../cmse-8.x"
218+
219+/* Checks for saving and clearing prior to function call. */
220+/* Shift on the same register as blxns. */
221+/* { dg-final { scan-assembler "lsrs\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
222+/* { dg-final { scan-assembler "lsls\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
223+/* { dg-final { scan-assembler-not "mov\tr0, r4" } } */
224+/* { dg-final { scan-assembler-not "mov\tr1, r4" } } */
225+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
226+/* { dg-final { scan-assembler "vlstm\tsp" } } */
227+/* Check the right registers are cleared and none appears twice. */
228+/* { dg-final { scan-assembler "clrm\t\{(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
229+/* Check that the right number of registers is cleared and thus only one
230+ register is missing. */
231+/* { dg-final { scan-assembler "clrm\t\{((r\[2-9\]|r10|fp|ip), ){10}APSR\}" } } */
232+/* Check that no cleared register is used for blxns. */
233+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[2-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
234+/* Check for v8.1-m variant of erratum work-around. */
235+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
236+/* { dg-final { scan-assembler "vlldm\tsp" } } */
237+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
238+
239+/* Now we check that we use the correct intrinsic to call. */
240+/* { dg-final { scan-assembler "blxns" } } */
241diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c
242--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c 1969-12-31 16:00:00.000000000 -0800
243+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-7a.c 2021-11-11 20:38:44.286766084 -0800
244@@ -0,0 +1,27 @@
245+/* { dg-do compile } */
246+/* { dg-options "-mcmse -mfloat-abi=softfp -mfpu=fpv5-sp-d16 -mfix-cmse-cve-2021-35465" } */
247+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=softfp" } } */
248+/* { dg-skip-if "Skip these if testing double precision" {*-*-*} {"-mfpu=fpv[4-5]-d16"} {""} } */
249+
250+#include "../../../cmse-7.x"
251+
252+/* Checks for saving and clearing prior to function call. */
253+/* Shift on the same register as blxns. */
254+/* { dg-final { scan-assembler "lsrs\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
255+/* { dg-final { scan-assembler "lsls\t(r\[0-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
256+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
257+/* { dg-final { scan-assembler "vlstm\tsp" } } */
258+/* Check the right registers are cleared and none appears twice. */
259+/* { dg-final { scan-assembler "clrm\t\{(r0, )?(r1, )?(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
260+/* Check that the right number of registers is cleared and thus only one
261+ register is missing. */
262+/* { dg-final { scan-assembler "clrm\t\{((r\[0-9\]|r10|fp|ip), ){12}APSR\}" } } */
263+/* Check that no cleared register is used for blxns. */
264+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[0-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
265+/* Check for v8.1-m variant of erratum work-around. */
266+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
267+/* { dg-final { scan-assembler "vlldm\tsp" } } */
268+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
269+
270+/* Now we check that we use the correct intrinsic to call. */
271+/* { dg-final { scan-assembler "blxns" } } */
272diff --git a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c
273--- a/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c 1969-12-31 16:00:00.000000000 -0800
274+++ b/gcc/testsuite/gcc.target/arm/cmse/mainline/8_1m/softfp-sp/cmse-8a.c 2021-11-11 20:38:44.286766084 -0800
275@@ -0,0 +1,29 @@
276+/* { dg-do compile } */
277+/* { dg-options "-mcmse -mfloat-abi=softfp -mfpu=fpv5-sp-d16 -mfix-cmse-cve-2021-35465" } */
278+/* { dg-skip-if "Incompatible float ABI" { *-*-* } { "-mfloat-abi=*" } { "-mfloat-abi=softfp" } } */
279+/* { dg-skip-if "Skip these if testing double precision" {*-*-*} {"-mfpu=fpv[4-5]-d16"} {""} } */
280+
281+#include "../../../cmse-8.x"
282+
283+/* Checks for saving and clearing prior to function call. */
284+/* Shift on the same register as blxns. */
285+/* { dg-final { scan-assembler "lsrs\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
286+/* { dg-final { scan-assembler "lsls\t(r\[2-9\]|r10|fp|ip), \\1, #1.*blxns\t\\1" } } */
287+/* { dg-final { scan-assembler-not "mov\tr0, r4" } } */
288+/* { dg-final { scan-assembler-not "mov\tr1, r4" } } */
289+/* { dg-final { scan-assembler "push\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
290+/* { dg-final { scan-assembler "vlstm\tsp" } } */
291+/* Check the right registers are cleared and none appears twice. */
292+/* { dg-final { scan-assembler "clrm\t\{(r2, )?(r3, )?(r4, )?(r5, )?(r6, )?(r7, )?(r8, )?(r9, )?(r10, )?(fp, )?(ip, )?APSR\}" } } */
293+/* Check that the right number of registers is cleared and thus only one
294+ register is missing. */
295+/* { dg-final { scan-assembler "clrm\t\{((r\[2-9\]|r10|fp|ip), ){10}APSR\}" } } */
296+/* Check that no cleared register is used for blxns. */
297+/* { dg-final { scan-assembler-not "clrm\t\{\[^\}\]\+(r\[2-9\]|r10|fp|ip),\[^\}\]\+\}.*blxns\t\\1" } } */
298+/* Check for v8.1-m variant of erratum work-around. */
299+/* { dg-final { scan-assembler "vscclrm\t\{vpr\}" } } */
300+/* { dg-final { scan-assembler "vlldm\tsp" } } */
301+/* { dg-final { scan-assembler "pop\t\{r4, r5, r6, r7, r8, r9, r10, fp\}" } } */
302+
303+/* Now we check that we use the correct intrinsic to call. */
304+/* { dg-final { scan-assembler "blxns" } } */
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-09 21:12:02 +0000