new file mode 100644
@@ -0,0 +1,85 @@
+commit b1a5ee1febd8a903cec3dfdad61d57900dc3823e
+Author: Florian Hahn <flo@fhahn.com>
+Date: Wed Dec 20 16:56:15 2023 +0100
+
+ [ARM] Check all terms in emitPopInst when clearing Restored for LR. (#75527)
+
+ emitPopInst checks a single function exit MBB. If other paths also exit
+ the function and any of there terminators uses LR implicitly, it is not
+ save to clear the Restored bit.
+
+ Check all terminators for the function before clearing Restored.
+
+ This fixes a mis-compile in outlined-fn-may-clobber-lr-in-caller.ll
+ where the machine-outliner previously introduced BLs that clobbered LR
+ which in turn is used by the tail call return.
+
+ Alternative to #73553
+
+Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/b1a5ee1febd8a903cec3dfdad61d57900dc3823e]
+CVE: CVE-2024-31852
+Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
+---
+diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.cpp b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
+index 025e43444f9c..a9acf338ebf5 100644
+--- a/llvm/lib/Target/ARM/ARMFrameLowering.cpp
++++ b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
+@@ -1236,9 +1236,6 @@ void ARMFrameLowering::emitPopInst(MachineBasicBlock &MBB,
+ // Fold the return instruction into the LDM.
+ DeleteRet = true;
+ LdmOpc = AFI->isThumbFunction() ? ARM::t2LDMIA_RET : ARM::LDMIA_RET;
+- // We 'restore' LR into PC so it is not live out of the return block:
+- // Clear Restored bit.
+- Info.setRestored(false);
+ }
+
+ // If NoGap is true, pop consecutive registers and then leave the rest
+@@ -2292,6 +2289,33 @@ void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
+ AFI->setLRIsSpilled(SavedRegs.test(ARM::LR));
+ }
+
++void ARMFrameLowering::processFunctionBeforeFrameFinalized(
++ MachineFunction &MF, RegScavenger *RS) const {
++ TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
++
++ MachineFrameInfo &MFI = MF.getFrameInfo();
++ if (!MFI.isCalleeSavedInfoValid())
++ return;
++
++ // Check if all terminators do not implicitly use LR. Then we can 'restore' LR
++ // into PC so it is not live out of the return block: Clear the Restored bit
++ // in that case.
++ for (CalleeSavedInfo &Info : MFI.getCalleeSavedInfo()) {
++ if (Info.getReg() != ARM::LR)
++ continue;
++ if (all_of(MF, [](const MachineBasicBlock &MBB) {
++ return all_of(MBB.terminators(), [](const MachineInstr &Term) {
++ return !Term.isReturn() || Term.getOpcode() == ARM::LDMIA_RET ||
++ Term.getOpcode() == ARM::t2LDMIA_RET ||
++ Term.getOpcode() == ARM::tPOP_RET;
++ });
++ })) {
++ Info.setRestored(false);
++ break;
++ }
++ }
++}
++
+ void ARMFrameLowering::getCalleeSaves(const MachineFunction &MF,
+ BitVector &SavedRegs) const {
+ TargetFrameLowering::getCalleeSaves(MF, SavedRegs);
+diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.h b/llvm/lib/Target/ARM/ARMFrameLowering.h
+index 9822e2321bb4..266d642bb97b 100644
+--- a/llvm/lib/Target/ARM/ARMFrameLowering.h
++++ b/llvm/lib/Target/ARM/ARMFrameLowering.h
+@@ -58,6 +58,9 @@ public:
+ void determineCalleeSaves(MachineFunction &MF, BitVector &SavedRegs,
+ RegScavenger *RS) const override;
+
++ void processFunctionBeforeFrameFinalized(
++ MachineFunction &MF, RegScavenger *RS = nullptr) const override;
++
+ void adjustForSegmentedStacks(MachineFunction &MF,
+ MachineBasicBlock &MBB) const override;
+
+
new file mode 100644
@@ -0,0 +1,117 @@
+commit 0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
+Author: ostannard <oliver.stannard@arm.com>
+Date: Mon Feb 26 12:23:25 2024 +0000
+
+ [ARM] Update IsRestored for LR based on all returns (#82745)
+
+ PR #75527 fixed ARMFrameLowering to set the IsRestored flag for LR based
+ on all of the return instructions in the function, not just one.
+ However, there is also code in ARMLoadStoreOptimizer which changes
+ return instructions, but it set IsRestored based on the one instruction
+ it changed, not the whole function.
+
+ The fix is to factor out the code added in #75527, and also call it from
+ ARMLoadStoreOptimizer if it made a change to return instructions.
+
+ Fixes #80287.
+
+ (cherry picked from commit 749384c08e042739342c88b521c8ba5dac1b9276)
+
+Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2]
+CVE: CVE-2024-31852
+Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
+---
+diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.cpp b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
+index a9acf338ebf5..13d3cbf650ed 100644
+--- a/llvm/lib/Target/ARM/ARMFrameLowering.cpp
++++ b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
+@@ -2289,10 +2289,7 @@ void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
+ AFI->setLRIsSpilled(SavedRegs.test(ARM::LR));
+ }
+
+-void ARMFrameLowering::processFunctionBeforeFrameFinalized(
+- MachineFunction &MF, RegScavenger *RS) const {
+- TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
+-
++void ARMFrameLowering::updateLRRestored(MachineFunction &MF) {
+ MachineFrameInfo &MFI = MF.getFrameInfo();
+ if (!MFI.isCalleeSavedInfoValid())
+ return;
+@@ -2316,6 +2313,12 @@ void ARMFrameLowering::processFunctionBeforeFrameFinalized(
+ }
+ }
+
++void ARMFrameLowering::processFunctionBeforeFrameFinalized(
++ MachineFunction &MF, RegScavenger *RS) const {
++ TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
++ updateLRRestored(MF);
++}
++
+ void ARMFrameLowering::getCalleeSaves(const MachineFunction &MF,
+ BitVector &SavedRegs) const {
+ TargetFrameLowering::getCalleeSaves(MF, SavedRegs);
+diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.h b/llvm/lib/Target/ARM/ARMFrameLowering.h
+index 67505b61a5e1..b13b76d7086c 100644
+--- a/llvm/lib/Target/ARM/ARMFrameLowering.h
++++ b/llvm/lib/Target/ARM/ARMFrameLowering.h
+@@ -58,6 +58,10 @@ public:
+ void determineCalleeSaves(MachineFunction &MF, BitVector &SavedRegs,
+ RegScavenger *RS) const override;
+
++ /// Update the IsRestored flag on LR if it is spilled, based on the return
++ /// instructions.
++ static void updateLRRestored(MachineFunction &MF);
++
+ void processFunctionBeforeFrameFinalized(
+ MachineFunction &MF, RegScavenger *RS = nullptr) const override;
+
+diff --git a/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp b/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
+index fd06bfdf352c..561c1396190d 100644
+--- a/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
++++ b/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
+@@ -2060,17 +2060,6 @@ bool ARMLoadStoreOpt::MergeReturnIntoLDM(MachineBasicBlock &MBB) {
+ MO.setReg(ARM::PC);
+ PrevMI.copyImplicitOps(*MBB.getParent(), *MBBI);
+ MBB.erase(MBBI);
+- // We now restore LR into PC so it is not live-out of the return block
+- // anymore: Clear the CSI Restored bit.
+- MachineFrameInfo &MFI = MBB.getParent()->getFrameInfo();
+- // CSI should be fixed after PrologEpilog Insertion
+- assert(MFI.isCalleeSavedInfoValid() && "CSI should be valid");
+- for (CalleeSavedInfo &Info : MFI.getCalleeSavedInfo()) {
+- if (Info.getReg() == ARM::LR) {
+- Info.setRestored(false);
+- break;
+- }
+- }
+ return true;
+ }
+ }
+@@ -2118,16 +2107,24 @@ bool ARMLoadStoreOpt::runOnMachineFunction(MachineFunction &Fn) {
+ isThumb2 = AFI->isThumb2Function();
+ isThumb1 = AFI->isThumbFunction() && !isThumb2;
+
+- bool Modified = false;
++ bool Modified = false, ModifiedLDMReturn = false;
+ for (MachineFunction::iterator MFI = Fn.begin(), E = Fn.end(); MFI != E;
+ ++MFI) {
+ MachineBasicBlock &MBB = *MFI;
+ Modified |= LoadStoreMultipleOpti(MBB);
+ if (STI->hasV5TOps())
+- Modified |= MergeReturnIntoLDM(MBB);
++ ModifiedLDMReturn |= MergeReturnIntoLDM(MBB);
+ if (isThumb1)
+ Modified |= CombineMovBx(MBB);
+ }
++ Modified |= ModifiedLDMReturn;
++
++ // If we merged a BX instruction into an LDM, we need to re-calculate whether
++ // LR is restored. This check needs to consider the whole function, not just
++ // the instruction(s) we changed, because there may be other BX returns which
++ // still need LR to be restored.
++ if (ModifiedLDMReturn)
++ ARMFrameLowering::updateLRRestored(Fn);
+
+ Allocator.DestroyAll();
+ return Modified;
+
@@ -34,6 +34,8 @@ SRC_URI = "git://github.com/llvm/llvm-project.git;branch=${BRANCH};protocol=http
file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2 \
file://0001-Support-Add-missing-cstdint-header-to-Signals.h.patch;striplevel=2 \
file://CVE-2023-46049.patch;striplevel=2 \
+ file://CVE-2024-31852-1.patch;striplevel=2 \
+ file://CVE-2024-31852-2.patch;striplevel=2 \
"
UPSTREAM_CHECK_GITTAGREGEX = "llvmorg-(?P<pver>\d+(\.\d+)+)"