summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/gcc/gcc-9.2.inc3
-rw-r--r--meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_1.patch521
-rw-r--r--meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_2.patch77
-rw-r--r--meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_3.patch62
4 files changed, 663 insertions, 0 deletions
diff --git a/meta/recipes-devtools/gcc/gcc-9.2.inc b/meta/recipes-devtools/gcc/gcc-9.2.inc
index 01d3bf0f32..c6395998d5 100644
--- a/meta/recipes-devtools/gcc/gcc-9.2.inc
+++ b/meta/recipes-devtools/gcc/gcc-9.2.inc
@@ -65,6 +65,9 @@ SRC_URI = "\
65 file://0035-Fix-for-testsuite-failure.patch \ 65 file://0035-Fix-for-testsuite-failure.patch \
66 file://0036-Re-introduce-spe-commandline-options.patch \ 66 file://0036-Re-introduce-spe-commandline-options.patch \
67 file://CVE-2019-14250.patch \ 67 file://CVE-2019-14250.patch \
68 file://CVE-2019-15847_1.patch \
69 file://CVE-2019-15847_2.patch \
70 file://CVE-2019-15847_3.patch \
68" 71"
69S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/gcc-${PV}" 72S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/gcc-${PV}"
70SRC_URI[md5sum] = "3818ad8600447f05349098232c2ddc78" 73SRC_URI[md5sum] = "3818ad8600447f05349098232c2ddc78"
diff --git a/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_1.patch b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_1.patch
new file mode 100644
index 0000000000..227fd47c95
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_1.patch
@@ -0,0 +1,521 @@
1From 8c61566116d23063ff597271884f8e00d94ab1a1 Mon Sep 17 00:00:00 2001
2From: segher <segher@138bc75d-0d04-0410-961f-82ee72b054a4>
3Date: Fri, 30 Aug 2019 13:48:48 +0000
4Subject: [PATCH] Backport from trunk 2019-08-22 Segher Boessenkool
5 <segher@kernel.crashing.org>
6
7 * config/rs6000/altivec.md (unspec): Delete UNSPEC_DARN, UNSPEC_DARN_32,
8 UNSPEC_DARN_RAW, UNSPEC_CMPRB, UNSPEC_CMPRB2, UNSPEC_CMPEQB; move to...
9 * config/rs6000/rs6000.md (unspec): ... here.
10 * config/rs6000/altivec.md (darn_32, darn_raw, darn, cmprb,
11 *cmprb_internal, setb_signed, setb_unsigned, cmprb2, *cmprb2_internal,
12 cmpeqb, *cmpeqb_internal): Delete, move to...
13 * config/rs6000/rs6000.md (darn_32, darn_raw, darn, cmprb,
14 *cmprb_internal, setb_signed, setb_unsigned, cmprb2, *cmprb2_internal,
15 cmpeqb, *cmpeqb_internal): ... here.
16
17
18git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-9-branch@275170 138bc75d-0d04-0410-961f-82ee72b054a4
19
20Upstream-Status: Backport
21CVE: CVE-2019-15847 p1
22Affects <= 9.2.0
23Dropped Changelog changes
24Signed-off-by: Armin Kuster <akuster@mvista.com>
25
26---
27 gcc/config/rs6000/altivec.md | 223 ----------------------------------
28 gcc/config/rs6000/rs6000.md | 224 +++++++++++++++++++++++++++++++++++
29 3 files changed, 239 insertions(+), 223 deletions(-)
30
31Index: gcc-9.2.0/gcc/config/rs6000/altivec.md
32===================================================================
33--- gcc-9.2.0.orig/gcc/config/rs6000/altivec.md
34+++ gcc-9.2.0/gcc/config/rs6000/altivec.md
35@@ -80,9 +80,6 @@
36 UNSPEC_VUPKHPX
37 UNSPEC_VUPKLPX
38 UNSPEC_CONVERT_4F32_8I16
39- UNSPEC_DARN
40- UNSPEC_DARN_32
41- UNSPEC_DARN_RAW
42 UNSPEC_DST
43 UNSPEC_DSTT
44 UNSPEC_DSTST
45@@ -161,9 +158,6 @@
46 UNSPEC_BCDADD
47 UNSPEC_BCDSUB
48 UNSPEC_BCD_OVERFLOW
49- UNSPEC_CMPRB
50- UNSPEC_CMPRB2
51- UNSPEC_CMPEQB
52 UNSPEC_VRLMI
53 UNSPEC_VRLNM
54 ])
55@@ -4101,223 +4095,6 @@
56 "bcd<bcd_add_sub>. %0,%1,%2,%3"
57 [(set_attr "type" "vecsimple")])
58
59-(define_insn "darn_32"
60- [(set (match_operand:SI 0 "register_operand" "=r")
61- (unspec:SI [(const_int 0)] UNSPEC_DARN_32))]
62- "TARGET_P9_MISC"
63- "darn %0,0"
64- [(set_attr "type" "integer")])
65-
66-(define_insn "darn_raw"
67- [(set (match_operand:DI 0 "register_operand" "=r")
68- (unspec:DI [(const_int 0)] UNSPEC_DARN_RAW))]
69- "TARGET_P9_MISC && TARGET_64BIT"
70- "darn %0,2"
71- [(set_attr "type" "integer")])
72-
73-(define_insn "darn"
74- [(set (match_operand:DI 0 "register_operand" "=r")
75- (unspec:DI [(const_int 0)] UNSPEC_DARN))]
76- "TARGET_P9_MISC && TARGET_64BIT"
77- "darn %0,1"
78- [(set_attr "type" "integer")])
79-
80-;; Test byte within range.
81-;;
82-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
83-;; represents a byte whose value is ignored in this context and
84-;; vv, the least significant byte, holds the byte value that is to
85-;; be tested for membership within the range specified by operand 2.
86-;; The bytes of operand 2 are organized as xx:xx:hi:lo.
87-;;
88-;; Return in target register operand 0 a value of 1 if lo <= vv and
89-;; vv <= hi. Otherwise, set register operand 0 to 0.
90-;;
91-;; Though the instructions to which this expansion maps operate on
92-;; 64-bit registers, the current implementation only operates on
93-;; SI-mode operands as the high-order bits provide no information
94-;; that is not already available in the low-order bits. To avoid the
95-;; costs of data widening operations, future enhancements might allow
96-;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
97-(define_expand "cmprb"
98- [(set (match_dup 3)
99- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
100- (match_operand:SI 2 "gpc_reg_operand" "r")]
101- UNSPEC_CMPRB))
102- (set (match_operand:SI 0 "gpc_reg_operand" "=r")
103- (if_then_else:SI (lt (match_dup 3)
104- (const_int 0))
105- (const_int -1)
106- (if_then_else (gt (match_dup 3)
107- (const_int 0))
108- (const_int 1)
109- (const_int 0))))]
110- "TARGET_P9_MISC"
111-{
112- operands[3] = gen_reg_rtx (CCmode);
113-})
114-
115-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
116-;; represents a byte whose value is ignored in this context and
117-;; vv, the least significant byte, holds the byte value that is to
118-;; be tested for membership within the range specified by operand 2.
119-;; The bytes of operand 2 are organized as xx:xx:hi:lo.
120-;;
121-;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if
122-;; lo <= vv and vv <= hi. Otherwise, set the GT bit to 0. The other
123-;; 3 bits of the target CR register are all set to 0.
124-(define_insn "*cmprb_internal"
125- [(set (match_operand:CC 0 "cc_reg_operand" "=y")
126- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
127- (match_operand:SI 2 "gpc_reg_operand" "r")]
128- UNSPEC_CMPRB))]
129- "TARGET_P9_MISC"
130- "cmprb %0,0,%1,%2"
131- [(set_attr "type" "logical")])
132-
133-;; Set operand 0 register to -1 if the LT bit (0x8) of condition
134-;; register operand 1 is on. Otherwise, set operand 0 register to 1
135-;; if the GT bit (0x4) of condition register operand 1 is on.
136-;; Otherwise, set operand 0 to 0. Note that the result stored into
137-;; register operand 0 is non-zero iff either the LT or GT bits are on
138-;; within condition register operand 1.
139-(define_insn "setb_signed"
140- [(set (match_operand:SI 0 "gpc_reg_operand" "=r")
141- (if_then_else:SI (lt (match_operand:CC 1 "cc_reg_operand" "y")
142- (const_int 0))
143- (const_int -1)
144- (if_then_else (gt (match_dup 1)
145- (const_int 0))
146- (const_int 1)
147- (const_int 0))))]
148- "TARGET_P9_MISC"
149- "setb %0,%1"
150- [(set_attr "type" "logical")])
151-
152-(define_insn "setb_unsigned"
153- [(set (match_operand:SI 0 "gpc_reg_operand" "=r")
154- (if_then_else:SI (ltu (match_operand:CCUNS 1 "cc_reg_operand" "y")
155- (const_int 0))
156- (const_int -1)
157- (if_then_else (gtu (match_dup 1)
158- (const_int 0))
159- (const_int 1)
160- (const_int 0))))]
161- "TARGET_P9_MISC"
162- "setb %0,%1"
163- [(set_attr "type" "logical")])
164-
165-;; Test byte within two ranges.
166-;;
167-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
168-;; represents a byte whose value is ignored in this context and
169-;; vv, the least significant byte, holds the byte value that is to
170-;; be tested for membership within the range specified by operand 2.
171-;; The bytes of operand 2 are organized as hi_1:lo_1:hi_2:lo_2.
172-;;
173-;; Return in target register operand 0 a value of 1 if (lo_1 <= vv and
174-;; vv <= hi_1) or if (lo_2 <= vv and vv <= hi_2). Otherwise, set register
175-;; operand 0 to 0.
176-;;
177-;; Though the instructions to which this expansion maps operate on
178-;; 64-bit registers, the current implementation only operates on
179-;; SI-mode operands as the high-order bits provide no information
180-;; that is not already available in the low-order bits. To avoid the
181-;; costs of data widening operations, future enhancements might allow
182-;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
183-(define_expand "cmprb2"
184- [(set (match_dup 3)
185- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
186- (match_operand:SI 2 "gpc_reg_operand" "r")]
187- UNSPEC_CMPRB2))
188- (set (match_operand:SI 0 "gpc_reg_operand" "=r")
189- (if_then_else:SI (lt (match_dup 3)
190- (const_int 0))
191- (const_int -1)
192- (if_then_else (gt (match_dup 3)
193- (const_int 0))
194- (const_int 1)
195- (const_int 0))))]
196- "TARGET_P9_MISC"
197-{
198- operands[3] = gen_reg_rtx (CCmode);
199-})
200-
201-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
202-;; represents a byte whose value is ignored in this context and
203-;; vv, the least significant byte, holds the byte value that is to
204-;; be tested for membership within the ranges specified by operand 2.
205-;; The bytes of operand 2 are organized as hi_1:lo_1:hi_2:lo_2.
206-;;
207-;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if
208-;; (lo_1 <= vv and vv <= hi_1) or if (lo_2 <= vv and vv <= hi_2).
209-;; Otherwise, set the GT bit to 0. The other 3 bits of the target
210-;; CR register are all set to 0.
211-(define_insn "*cmprb2_internal"
212- [(set (match_operand:CC 0 "cc_reg_operand" "=y")
213- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
214- (match_operand:SI 2 "gpc_reg_operand" "r")]
215- UNSPEC_CMPRB2))]
216- "TARGET_P9_MISC"
217- "cmprb %0,1,%1,%2"
218- [(set_attr "type" "logical")])
219-
220-;; Test byte membership within set of 8 bytes.
221-;;
222-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
223-;; represents a byte whose value is ignored in this context and
224-;; vv, the least significant byte, holds the byte value that is to
225-;; be tested for membership within the set specified by operand 2.
226-;; The bytes of operand 2 are organized as e0:e1:e2:e3:e4:e5:e6:e7.
227-;;
228-;; Return in target register operand 0 a value of 1 if vv equals one
229-;; of the values e0, e1, e2, e3, e4, e5, e6, or e7. Otherwise, set
230-;; register operand 0 to 0. Note that the 8 byte values held within
231-;; operand 2 need not be unique.
232-;;
233-;; Though the instructions to which this expansion maps operate on
234-;; 64-bit registers, the current implementation requires that operands
235-;; 0 and 1 have mode SI as the high-order bits provide no information
236-;; that is not already available in the low-order bits. To avoid the
237-;; costs of data widening operations, future enhancements might allow
238-;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
239-(define_expand "cmpeqb"
240- [(set (match_dup 3)
241- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
242- (match_operand:DI 2 "gpc_reg_operand" "r")]
243- UNSPEC_CMPEQB))
244- (set (match_operand:SI 0 "gpc_reg_operand" "=r")
245- (if_then_else:SI (lt (match_dup 3)
246- (const_int 0))
247- (const_int -1)
248- (if_then_else (gt (match_dup 3)
249- (const_int 0))
250- (const_int 1)
251- (const_int 0))))]
252- "TARGET_P9_MISC && TARGET_64BIT"
253-{
254- operands[3] = gen_reg_rtx (CCmode);
255-})
256-
257-;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
258-;; represents a byte whose value is ignored in this context and
259-;; vv, the least significant byte, holds the byte value that is to
260-;; be tested for membership within the set specified by operand 2.
261-;; The bytes of operand 2 are organized as e0:e1:e2:e3:e4:e5:e6:e7.
262-;;
263-;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if vv
264-;; equals one of the values e0, e1, e2, e3, e4, e5, e6, or e7. Otherwise,
265-;; set the GT bit to zero. The other 3 bits of the target CR register
266-;; are all set to 0.
267-(define_insn "*cmpeqb_internal"
268- [(set (match_operand:CC 0 "cc_reg_operand" "=y")
269- (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
270- (match_operand:DI 2 "gpc_reg_operand" "r")]
271- UNSPEC_CMPEQB))]
272- "TARGET_P9_MISC && TARGET_64BIT"
273- "cmpeqb %0,%1,%2"
274- [(set_attr "type" "logical")])
275-
276 (define_expand "bcd<bcd_add_sub>_<code>"
277 [(parallel [(set (reg:CCFP CR6_REGNO)
278 (compare:CCFP
279Index: gcc-9.2.0/gcc/config/rs6000/rs6000.md
280===================================================================
281--- gcc-9.2.0.orig/gcc/config/rs6000/rs6000.md
282+++ gcc-9.2.0/gcc/config/rs6000/rs6000.md
283@@ -137,6 +137,12 @@
284 UNSPEC_LSQ
285 UNSPEC_FUSION_GPR
286 UNSPEC_STACK_CHECK
287+ UNSPEC_DARN
288+ UNSPEC_DARN_32
289+ UNSPEC_DARN_RAW
290+ UNSPEC_CMPRB
291+ UNSPEC_CMPRB2
292+ UNSPEC_CMPEQB
293 UNSPEC_ADD_ROUND_TO_ODD
294 UNSPEC_SUB_ROUND_TO_ODD
295 UNSPEC_MUL_ROUND_TO_ODD
296@@ -14322,7 +14328,225 @@
297 "xscmpuqp %0,%1,%2"
298 [(set_attr "type" "veccmp")
299 (set_attr "size" "128")])
300+
301+;; Miscellaneous ISA 3.0 (power9) instructions
302+
303+(define_insn "darn_32"
304+ [(set (match_operand:SI 0 "register_operand" "=r")
305+ (unspec:SI [(const_int 0)] UNSPEC_DARN_32))]
306+ "TARGET_P9_MISC"
307+ "darn %0,0"
308+ [(set_attr "type" "integer")])
309+
310+(define_insn "darn_raw"
311+ [(set (match_operand:DI 0 "register_operand" "=r")
312+ (unspec:DI [(const_int 0)] UNSPEC_DARN_RAW))]
313+ "TARGET_P9_MISC && TARGET_64BIT"
314+ "darn %0,2"
315+ [(set_attr "type" "integer")])
316+
317+(define_insn "darn"
318+ [(set (match_operand:DI 0 "register_operand" "=r")
319+ (unspec:DI [(const_int 0)] UNSPEC_DARN))]
320+ "TARGET_P9_MISC && TARGET_64BIT"
321+ "darn %0,1"
322+ [(set_attr "type" "integer")])
323+
324+;; Test byte within range.
325+;;
326+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
327+;; represents a byte whose value is ignored in this context and
328+;; vv, the least significant byte, holds the byte value that is to
329+;; be tested for membership within the range specified by operand 2.
330+;; The bytes of operand 2 are organized as xx:xx:hi:lo.
331+;;
332+;; Return in target register operand 0 a value of 1 if lo <= vv and
333+;; vv <= hi. Otherwise, set register operand 0 to 0.
334+;;
335+;; Though the instructions to which this expansion maps operate on
336+;; 64-bit registers, the current implementation only operates on
337+;; SI-mode operands as the high-order bits provide no information
338+;; that is not already available in the low-order bits. To avoid the
339+;; costs of data widening operations, future enhancements might allow
340+;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
341+(define_expand "cmprb"
342+ [(set (match_dup 3)
343+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
344+ (match_operand:SI 2 "gpc_reg_operand" "r")]
345+ UNSPEC_CMPRB))
346+ (set (match_operand:SI 0 "gpc_reg_operand" "=r")
347+ (if_then_else:SI (lt (match_dup 3)
348+ (const_int 0))
349+ (const_int -1)
350+ (if_then_else (gt (match_dup 3)
351+ (const_int 0))
352+ (const_int 1)
353+ (const_int 0))))]
354+ "TARGET_P9_MISC"
355+{
356+ operands[3] = gen_reg_rtx (CCmode);
357+})
358+
359+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
360+;; represents a byte whose value is ignored in this context and
361+;; vv, the least significant byte, holds the byte value that is to
362+;; be tested for membership within the range specified by operand 2.
363+;; The bytes of operand 2 are organized as xx:xx:hi:lo.
364+;;
365+;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if
366+;; lo <= vv and vv <= hi. Otherwise, set the GT bit to 0. The other
367+;; 3 bits of the target CR register are all set to 0.
368+(define_insn "*cmprb_internal"
369+ [(set (match_operand:CC 0 "cc_reg_operand" "=y")
370+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
371+ (match_operand:SI 2 "gpc_reg_operand" "r")]
372+ UNSPEC_CMPRB))]
373+ "TARGET_P9_MISC"
374+ "cmprb %0,0,%1,%2"
375+ [(set_attr "type" "logical")])
376+
377+;; Set operand 0 register to -1 if the LT bit (0x8) of condition
378+;; register operand 1 is on. Otherwise, set operand 0 register to 1
379+;; if the GT bit (0x4) of condition register operand 1 is on.
380+;; Otherwise, set operand 0 to 0. Note that the result stored into
381+;; register operand 0 is non-zero iff either the LT or GT bits are on
382+;; within condition register operand 1.
383+(define_insn "setb_signed"
384+ [(set (match_operand:SI 0 "gpc_reg_operand" "=r")
385+ (if_then_else:SI (lt (match_operand:CC 1 "cc_reg_operand" "y")
386+ (const_int 0))
387+ (const_int -1)
388+ (if_then_else (gt (match_dup 1)
389+ (const_int 0))
390+ (const_int 1)
391+ (const_int 0))))]
392+ "TARGET_P9_MISC"
393+ "setb %0,%1"
394+ [(set_attr "type" "logical")])
395
396+(define_insn "setb_unsigned"
397+ [(set (match_operand:SI 0 "gpc_reg_operand" "=r")
398+ (if_then_else:SI (ltu (match_operand:CCUNS 1 "cc_reg_operand" "y")
399+ (const_int 0))
400+ (const_int -1)
401+ (if_then_else (gtu (match_dup 1)
402+ (const_int 0))
403+ (const_int 1)
404+ (const_int 0))))]
405+ "TARGET_P9_MISC"
406+ "setb %0,%1"
407+ [(set_attr "type" "logical")])
408+
409+;; Test byte within two ranges.
410+;;
411+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
412+;; represents a byte whose value is ignored in this context and
413+;; vv, the least significant byte, holds the byte value that is to
414+;; be tested for membership within the range specified by operand 2.
415+;; The bytes of operand 2 are organized as hi_1:lo_1:hi_2:lo_2.
416+;;
417+;; Return in target register operand 0 a value of 1 if (lo_1 <= vv and
418+;; vv <= hi_1) or if (lo_2 <= vv and vv <= hi_2). Otherwise, set register
419+;; operand 0 to 0.
420+;;
421+;; Though the instructions to which this expansion maps operate on
422+;; 64-bit registers, the current implementation only operates on
423+;; SI-mode operands as the high-order bits provide no information
424+;; that is not already available in the low-order bits. To avoid the
425+;; costs of data widening operations, future enhancements might allow
426+;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
427+(define_expand "cmprb2"
428+ [(set (match_dup 3)
429+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
430+ (match_operand:SI 2 "gpc_reg_operand" "r")]
431+ UNSPEC_CMPRB2))
432+ (set (match_operand:SI 0 "gpc_reg_operand" "=r")
433+ (if_then_else:SI (lt (match_dup 3)
434+ (const_int 0))
435+ (const_int -1)
436+ (if_then_else (gt (match_dup 3)
437+ (const_int 0))
438+ (const_int 1)
439+ (const_int 0))))]
440+ "TARGET_P9_MISC"
441+{
442+ operands[3] = gen_reg_rtx (CCmode);
443+})
444+
445+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
446+;; represents a byte whose value is ignored in this context and
447+;; vv, the least significant byte, holds the byte value that is to
448+;; be tested for membership within the ranges specified by operand 2.
449+;; The bytes of operand 2 are organized as hi_1:lo_1:hi_2:lo_2.
450+;;
451+;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if
452+;; (lo_1 <= vv and vv <= hi_1) or if (lo_2 <= vv and vv <= hi_2).
453+;; Otherwise, set the GT bit to 0. The other 3 bits of the target
454+;; CR register are all set to 0.
455+(define_insn "*cmprb2_internal"
456+ [(set (match_operand:CC 0 "cc_reg_operand" "=y")
457+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
458+ (match_operand:SI 2 "gpc_reg_operand" "r")]
459+ UNSPEC_CMPRB2))]
460+ "TARGET_P9_MISC"
461+ "cmprb %0,1,%1,%2"
462+ [(set_attr "type" "logical")])
463+
464+;; Test byte membership within set of 8 bytes.
465+;;
466+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
467+;; represents a byte whose value is ignored in this context and
468+;; vv, the least significant byte, holds the byte value that is to
469+;; be tested for membership within the set specified by operand 2.
470+;; The bytes of operand 2 are organized as e0:e1:e2:e3:e4:e5:e6:e7.
471+;;
472+;; Return in target register operand 0 a value of 1 if vv equals one
473+;; of the values e0, e1, e2, e3, e4, e5, e6, or e7. Otherwise, set
474+;; register operand 0 to 0. Note that the 8 byte values held within
475+;; operand 2 need not be unique.
476+;;
477+;; Though the instructions to which this expansion maps operate on
478+;; 64-bit registers, the current implementation requires that operands
479+;; 0 and 1 have mode SI as the high-order bits provide no information
480+;; that is not already available in the low-order bits. To avoid the
481+;; costs of data widening operations, future enhancements might allow
482+;; DI mode for operand 0 and/or might allow operand 1 to be QI mode.
483+(define_expand "cmpeqb"
484+ [(set (match_dup 3)
485+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
486+ (match_operand:DI 2 "gpc_reg_operand" "r")]
487+ UNSPEC_CMPEQB))
488+ (set (match_operand:SI 0 "gpc_reg_operand" "=r")
489+ (if_then_else:SI (lt (match_dup 3)
490+ (const_int 0))
491+ (const_int -1)
492+ (if_then_else (gt (match_dup 3)
493+ (const_int 0))
494+ (const_int 1)
495+ (const_int 0))))]
496+ "TARGET_P9_MISC && TARGET_64BIT"
497+{
498+ operands[3] = gen_reg_rtx (CCmode);
499+})
500+
501+;; The bytes of operand 1 are organized as xx:xx:xx:vv, where xx
502+;; represents a byte whose value is ignored in this context and
503+;; vv, the least significant byte, holds the byte value that is to
504+;; be tested for membership within the set specified by operand 2.
505+;; The bytes of operand 2 are organized as e0:e1:e2:e3:e4:e5:e6:e7.
506+;;
507+;; Set bit 1 (the GT bit, 0x4) of CR register operand 0 to 1 if vv
508+;; equals one of the values e0, e1, e2, e3, e4, e5, e6, or e7. Otherwise,
509+;; set the GT bit to zero. The other 3 bits of the target CR register
510+;; are all set to 0.
511+(define_insn "*cmpeqb_internal"
512+ [(set (match_operand:CC 0 "cc_reg_operand" "=y")
513+ (unspec:CC [(match_operand:SI 1 "gpc_reg_operand" "r")
514+ (match_operand:DI 2 "gpc_reg_operand" "r")]
515+ UNSPEC_CMPEQB))]
516+ "TARGET_P9_MISC && TARGET_64BIT"
517+ "cmpeqb %0,%1,%2"
518+ [(set_attr "type" "logical")])
519
520
521 (include "sync.md")
diff --git a/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_2.patch b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_2.patch
new file mode 100644
index 0000000000..de7a83c23f
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_2.patch
@@ -0,0 +1,77 @@
1From 87bc784a7ca3a43182f7272241597a50d7491342 Mon Sep 17 00:00:00 2001
2From: segher <segher@138bc75d-0d04-0410-961f-82ee72b054a4>
3Date: Fri, 30 Aug 2019 13:51:26 +0000
4Subject: [PATCH] Backport from trunk 2019-08-22 Segher Boessenkool
5 <segher@kernel.crashing.org>
6
7 PR target/91481
8 * config/rs6000/rs6000.md (unspec): Delete UNSPEC_DARN, UNSPEC_DARN_32,
9 and UNSPEC_DARN_RAW.
10 (unspecv): New enumerator values UNSPECV_DARN, UNSPECV_DARN_32, and
11 UNSPECV_DARN_RAW.
12 (darn_32): Use an unspec_volatile, and UNSPECV_DARN_32.
13 (darn_raw): Use an unspec_volatile, and UNSPECV_DARN_RAW.
14 (darn): Use an unspec_volatile, and UNSPECV_DARN.
15
16
17git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-9-branch@275175 138bc75d-0d04-0410-961f-82ee72b054a4
18
19Upstream-Status: Backport
20CVE: CVE-2019-15847 p2
21Affects <= 9.2.0
22Dropped Changelog changes
23Signed-off-by: Armin Kuster <akuster@mvista.com>
24
25---
26 gcc/config/rs6000/rs6000.md | 12 ++++++------
27 2 files changed, 20 insertions(+), 6 deletions(-)
28
29Index: gcc-9.2.0/gcc/config/rs6000/rs6000.md
30===================================================================
31--- gcc-9.2.0.orig/gcc/config/rs6000/rs6000.md
32+++ gcc-9.2.0/gcc/config/rs6000/rs6000.md
33@@ -137,9 +137,6 @@
34 UNSPEC_LSQ
35 UNSPEC_FUSION_GPR
36 UNSPEC_STACK_CHECK
37- UNSPEC_DARN
38- UNSPEC_DARN_32
39- UNSPEC_DARN_RAW
40 UNSPEC_CMPRB
41 UNSPEC_CMPRB2
42 UNSPEC_CMPEQB
43@@ -170,6 +167,9 @@
44 UNSPECV_EH_RR ; eh_reg_restore
45 UNSPECV_ISYNC ; isync instruction
46 UNSPECV_MFTB ; move from time base
47+ UNSPECV_DARN ; darn 1 (deliver a random number)
48+ UNSPECV_DARN_32 ; darn 2
49+ UNSPECV_DARN_RAW ; darn 0
50 UNSPECV_NLGR ; non-local goto receiver
51 UNSPECV_MFFS ; Move from FPSCR
52 UNSPECV_MFFSL ; Move from FPSCR light instruction version
53@@ -14333,21 +14333,21 @@
54
55 (define_insn "darn_32"
56 [(set (match_operand:SI 0 "register_operand" "=r")
57- (unspec:SI [(const_int 0)] UNSPEC_DARN_32))]
58+ (unspec_volatile:SI [(const_int 0)] UNSPECV_DARN_32))]
59 "TARGET_P9_MISC"
60 "darn %0,0"
61 [(set_attr "type" "integer")])
62
63 (define_insn "darn_raw"
64 [(set (match_operand:DI 0 "register_operand" "=r")
65- (unspec:DI [(const_int 0)] UNSPEC_DARN_RAW))]
66+ (unspec_volatile:DI [(const_int 0)] UNSPECV_DARN_RAW))]
67 "TARGET_P9_MISC && TARGET_64BIT"
68 "darn %0,2"
69 [(set_attr "type" "integer")])
70
71 (define_insn "darn"
72 [(set (match_operand:DI 0 "register_operand" "=r")
73- (unspec:DI [(const_int 0)] UNSPEC_DARN))]
74+ (unspec_volatile:DI [(const_int 0)] UNSPECV_DARN))]
75 "TARGET_P9_MISC && TARGET_64BIT"
76 "darn %0,1"
77 [(set_attr "type" "integer")])
diff --git a/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_3.patch b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_3.patch
new file mode 100644
index 0000000000..ba7130ca7d
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc-9.2/CVE-2019-15847_3.patch
@@ -0,0 +1,62 @@
1From dc4c8dd9dbe70740ec7a684b0f35620249fb036a Mon Sep 17 00:00:00 2001
2From: segher <segher@138bc75d-0d04-0410-961f-82ee72b054a4>
3Date: Fri, 30 Aug 2019 13:53:11 +0000
4Subject: [PATCH] Backport from trunk 2019-08-23 Segher Boessenkool
5 <segher@kernel.crashing.org>
6
7gcc/testsuite/
8 PR target/91481
9 * gcc.target/powerpc/darn-3.c: New testcase.
10
11
12git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-9-branch@275176 138bc75d-0d04-0410-961f-82ee72b054a4
13
14Upstream-Status: Backport
15CVE: CVE-2019-15847 p3
16Affects <= 9.2.0
17Dropped Changelog changes
18Signed-off-by: Armin Kuster <akuster@mvista.com>
19
20---
21 gcc/testsuite/ChangeLog | 6 ++++++
22 gcc/testsuite/gcc.target/powerpc/darn-3.c | 16 ++++++++++++++++
23 2 files changed, 22 insertions(+)
24 create mode 100644 gcc/testsuite/gcc.target/powerpc/darn-3.c
25
26Index: gcc-9.2.0/gcc/testsuite/gcc.target/powerpc/darn-3.c
27===================================================================
28--- /dev/null
29+++ gcc-9.2.0/gcc/testsuite/gcc.target/powerpc/darn-3.c
30@@ -0,0 +1,16 @@
31+/* { dg-do compile { target { powerpc*-*-* } } } */
32+/* { dg-skip-if "" { powerpc*-*-aix* } } */
33+/* { dg-options "-O2 -mdejagnu-cpu=power9" } */
34+
35+static int darn32(void) { return __builtin_darn_32(); }
36+
37+int four(void)
38+{
39+ int sum = 0;
40+ int i;
41+ for (i = 0; i < 4; i++)
42+ sum += darn32();
43+ return sum;
44+}
45+
46+/* { dg-final { scan-assembler-times {(?n)\mdarn .*,0\M} 4 } } */
47Index: gcc-9.2.0/gcc/testsuite/ChangeLog
48===================================================================
49--- gcc-9.2.0.orig/gcc/testsuite/ChangeLog
50+++ gcc-9.2.0/gcc/testsuite/ChangeLog
51@@ -1,3 +1,11 @@
52+2019-08-30 Segher Boessenkool <segher@kernel.crashing.org>
53+
54+ Backport from trunk
55+ 2019-08-23 Segher Boessenkool <segher@kernel.crashing.org>
56+
57+ PR target/91481
58+ * gcc.target/powerpc/darn-3.c: New testcase.
59+
60 2019-08-12 Release Manager
61
62 * GCC 9.2.0 released.
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-23 09:37:59 +0000