[CMSE] Clear padding bits of struct/unions/fp16 passed by value
authorMomchil Velikov <momchil.velikov@arm.com>
Tue, 28 Apr 2020 15:27:52 +0000 (16:27 +0100)
committerMomchil Velikov <momchil.velikov@arm.com>
Tue, 28 Apr 2020 16:05:58 +0000 (17:05 +0100)
commit102b4105e3fd568ed2c758ed7e6fd266a819d6db
treef796adbf9532f2df0bb16b7aca0e0effda619200
parente770153865c53c4fd72a68f23acff33c24e42a08
[CMSE] Clear padding bits of struct/unions/fp16 passed by value

When passing a value of a struct/union type from secure to non-secure
state (that is returning from a CMSE entry function or passing an
argument to CMSE-non-secure call), there is a potential sensitive
information leak via the padding bits in the structure. It is not
possible in the general case to ensure those bits are cleared by using
Standard C/C++.

This patch makes the compiler emit code to clear such padding
bits. Since type information is lost in LLVM IR, the code generation
is done by Clang.

For each interesting record type, we build a bitmask, in which all the
bits, corresponding to user declared members, are set. Values of
record types are returned by coercing them to an integer. After the
coercion, the coerced value is masked (with bitwise AND) and then
returned by the function. In a similar manner, values of record types
are passed as arguments by coercing them to an array of integers, and
the coerced values themselves are masked.

For union types, we effectively clear only bits, which aren't part of
any member, since we don't know which is the currently active one.
The compiler will issue a warning, whenever a union is passed to
non-secure state.

Values of half-precision floating-point types are passed in the least
significant bits of a 32-bit register (GPR or FPR) with the most
significant bits unspecified. Since this is also a potential leak of
sensitive information, this patch also clears those unspecified bits.

Differential Revision: https://reviews.llvm.org/D76369
13 files changed:
clang/include/clang/AST/Decl.h
clang/include/clang/Basic/DiagnosticSemaKinds.td
clang/lib/AST/Decl.cpp
clang/lib/CodeGen/CGCall.cpp
clang/lib/CodeGen/CodeGenFunction.h
clang/lib/Sema/SemaDeclAttr.cpp
clang/lib/Sema/SemaExpr.cpp
clang/lib/Sema/SemaStmt.cpp
clang/test/CodeGen/cmse-clear-arg.c [new file with mode: 0644]
clang/test/CodeGen/cmse-clear-fp16.c [new file with mode: 0644]
clang/test/CodeGen/cmse-clear-return.c [new file with mode: 0644]
clang/test/Sema/arm-cmse-no-diag.c [new file with mode: 0644]
clang/test/Sema/arm-cmse.c