Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dependabot: Update golang dependencies #120

Open
wants to merge 651 commits into
base: arc64
Choose a base branch
from
Open

Conversation

qwersem
Copy link

@qwersem qwersem commented Jun 4, 2024

This update fixies the following security vulnerabilities:

  • HTTP/2 rapid reset can cause excessive work in net/http;
  • golang.org/x/net/http2 vulnerable to possible excessive memory growth;
  • net/http, x/net/http2: close connections when receiving too many headers;
  • Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin;
  • HTTP/2 Stream Cancellation Attack;
  • Improper rendering of text nodes in golang.org/x/net/html.

Claudiu Zissulescu and others added 30 commits May 16, 2023 14:17
This helps guard code in downstream projects such as glibc
related to hard-float regfile save/restore.

Granted we can do this with existing macros:
|
| #if defined(__ARCV3__) && defined (__ARC_HARD_FLOAT__)
|

keeping it independent of ISA keeps it future safe.

Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
In rare cases we need to split 128b PIC access into two 64b
loads. Test provided.

Signed-off-by: Claudiu Zissulescu <claziss@synopsys.com>
claziss and others added 27 commits May 16, 2023 14:22
Throw an warning when -Waddress is used

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
The Local Dynamic model is better handled by using more generic Global
Dynamic model and accesses using anchors.

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Check if the linker resolves correctly the R_ARC_TLS_LE_32 relocation.

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
This commit adds 128-bit forms of push and pop using the movTI_insn
pattern and an implicit stack pointer operand. For the needs of these
instructions, the Ustk constraints are relaxed to accept TImode
operands.

Signed-off-by: Artemiy Volkov <artemiy@synopsys.com>
In the arc64-specific test with 128-bit loads/stores, replace the
lddl/stdl instructions involving the stack pointer to their
pushdl_s/popdl_s counterparts.

Signed-off-by: Artemiy Volkov <artemiy@synopsys.com>
Configured GCC driver to set GNU AS and GNU LD as default
assembler and linker for ARCv2

Signed-off-by: Luis Silva <luis.m.silva99@hotmail.com>
Configured GCC driver to set GNU AS and GNU LD as default
assembler and linker for ARCv3

Signed-off-by: Luis Silva <luis.m.silva99@hotmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
This is done by preferring the V8HI and V4SI modes whenever m128 is available

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
When operating in 32bit CPUs use reg-pairs

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
In MACH, we try to correct superflu movest from accumulator to a GPR
by indentifying the MAC instruction and the superflu move, and
combining those two into a single MAX instruction having the GPR as a
destination.
In the original algorithm, I was asking for next real instruction
which is can retrive an instruction acoss BB boundary which is not
correct. Thus, this patch.

Signed-off-by: Claudiu Zissulescu <claziss@gmail.com>
Before this change, cc1(plus) could emit "store" insturctions such as:

stl 0x1234, [0x80_0000_1000]

which would become "stl 0x1234, [0x1000]" by the "as"sembler.

This happened, because "arc64_legitimate_address_1_p()" was returning
"true" for any sort of "const_int"s.  With this change, it returns
"true" only if the number can fit in 32-bit, and "false" otherwise.

The address preparation as performed by "arc64_prepare_move_operands()"
during the "movdi expand" has already taken care of the rest:

(define_predicate "splittable_const_int_operand"
  (match_code "const_int")
{
  ...
  /* Check if the constant can be loaded in a single bsetl/bclrl insn. */
  if ((SINGLE_BIT_MASK_OPERAND (zext_hwi (INTVAL (op) >> 32, 32))
       && UNSIGNED_INT32 (zext_hwi (INTVAL (op), 32)))
      || (SINGLE_BIT_MASK_OPERAND (zext_hwi ((~INTVAL (op)) >> 32, 32))
          && (sext_hwi (INTVAL (op), 32) < 0)))
    return false;
  ...
}

Because of this logic, there's no need for a split and a mere
"bsetl r0, 0x1000, 39" will get the job done.
This commit fixies the following security vulnerabilities:
- HTTP/2 rapid reset can cause excessive work in net/http;
- golang.org/x/net/http2 vulnerable to possible excessive memory growth;
- net/http, x/net/http2: close connections when receiving too many headers;
- Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin;
- HTTP/2 Stream Cancellation Attack;
- Improper rendering of text nodes in golang.org/x/net/html.

Signed-off-by: Evgeny Semenov <semenov@synopsys.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants