[ARM] Mitigate the cve-2021-35465 security vulnurability.
authorAlexandros Lamprineas <alexandros.lamprineas@arm.com>
Thu, 2 Sep 2021 14:01:18 +0000 (15:01 +0100)
committerAlexandros Lamprineas <alexandros.lamprineas@arm.com>
Thu, 16 Sep 2021 11:56:43 +0000 (12:56 +0100)
commit1bd5ea968e9262a09512a64bca1624818640bc5b
tree60013e310e0ba927e4f3e36430ead697f44a71bf
parent61f25daa8d1b69dd5138facd5d57a8e3dfa0c5cc
[ARM] Mitigate the cve-2021-35465 security vulnurability.

Recently a vulnerability issue is found in the implementation of VLLDM
instruction in the Arm Cortex-M33, Cortex-M35P and Cortex-M55. If the
VLLDM instruction is abandoned due to an exception when it is partially
completed, it is possible for subsequent non-secure handler to access
and modify the partial restored register values. This vulnerability is
identified as CVE-2021-35465.

The mitigation sequence varies between v8-m and v8.1-m as follows:

v8-m.main
---------
mrs        r5, control
tst        r5, #8       /* CONTROL_S.SFPA */
it         ne
.inst.w    0xeeb00a40   /* vmovne s0, s0 */
1:
vlldm      sp           /* Lazy restore of d0-d16 and FPSCR. */

v8.1-m.main
-----------
vscclrm    {vpr}        /* Clear VPR. */
vlldm      sp           /* Lazy restore of d0-d16 and FPSCR. */

More details on
developer.arm.com/support/arm-security-updates/vlldm-instruction-security-vulnerability

Differential Revision: https://reviews.llvm.org/D109157
clang/docs/ClangCommandLineReference.rst
clang/include/clang/Driver/Options.td
clang/lib/Driver/ToolChains/Arch/ARM.cpp
clang/test/Driver/arm-cmse-cve-2021-35465.c [new file with mode: 0644]
llvm/lib/Target/ARM/ARM.td
llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp
llvm/lib/Target/ARM/ARMSubtarget.h
llvm/test/CodeGen/ARM/cmse-cve-2021-35465-return.ll [new file with mode: 0644]
llvm/test/CodeGen/ARM/cmse-cve-2021-35465.ll [new file with mode: 0644]
llvm/test/CodeGen/ARM/cmse-vlldm-no-reorder.mir