PPC: protect against malformed branch and memory access instructions.

src/ppc/assembler-ppc.cc

 // Copyright (c) 1994-2006 Sun Microsystems Inc.
 // All Rights Reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions
 // are met:
 //
 // - Redistributions of source code must retain the above copyright notice,
 // this list of conditions and the following disclaimer.
 //
@@ skipping 416 matching lines @@
 }
 
 
 void Assembler::target_at_put(int pos, int target_pos) {
   Instr instr = instr_at(pos);
   int opcode = instr & kOpcodeMask;
 
   switch (opcode) {
     case BX: {
       int imm26 = target_pos - pos;
-      DCHECK(is_int26(imm26) && (imm26 & (kAAMask | kLKMask)) == 0);
+      CHECK(is_int26(imm26) && (imm26 & (kAAMask | kLKMask)) == 0);
       if (imm26 == kInstrSize && !(instr & kLKMask)) {
         // Branch to next instr without link.
         instr = ORI;  // nop: ori, 0,0,0
       } else {
         instr &= ((~kImm26Mask) | kAAMask | kLKMask);
         instr |= (imm26 & kImm26Mask);
       }
       instr_at_put(pos, instr);
       break;
     }
     case BCX: {
       int imm16 = target_pos - pos;
-      DCHECK(is_int16(imm16) && (imm16 & (kAAMask | kLKMask)) == 0);
+      CHECK(is_int16(imm16) && (imm16 & (kAAMask | kLKMask)) == 0);
       if (imm16 == kInstrSize && !(instr & kLKMask)) {
         // Branch to next instr without link.
         instr = ORI;  // nop: ori, 0,0,0
       } else {
         instr &= ((~kImm16Mask) | kAAMask | kLKMask);
         instr |= (imm16 & kImm16Mask);
       }
       instr_at_put(pos, instr);
       break;
     }
@@ skipping 130 matching lines @@
   emit(instr | frt.code() * B21 | fra.code() * B16 | frb.code() * B11 | r);
 }
 
 
 void Assembler::d_form(Instr instr, Register rt, Register ra,
                        const intptr_t val, bool signed_disp) {
   if (signed_disp) {
     if (!is_int16(val)) {
       PrintF("val = %" V8PRIdPTR ", 0x%" V8PRIxPTR "\n", val, val);
     }
-    DCHECK(is_int16(val));
+    CHECK(is_int16(val));
   } else {
     if (!is_uint16(val)) {
       PrintF("val = %" V8PRIdPTR ", 0x%" V8PRIxPTR
              ", is_unsigned_imm16(val)=%d, kImm16Mask=0x%x\n",
              val, val, is_uint16(val), kImm16Mask);
     }
-    DCHECK(is_uint16(val));
+    CHECK(is_uint16(val));
   }
   emit(instr | rt.code() * B21 | ra.code() * B16 | (kImm16Mask & val));
 }
 
 
 void Assembler::x_form(Instr instr, Register ra, Register rs, Register rb,
                        RCBit r) {
   emit(instr | rs.code() * B21 | ra.code() * B16 | rb.code() * B11 | r);
 }
 
@@ skipping 89 matching lines @@
 void Assembler::bctr() { bcctr(BA, LeaveLK); }
 
 
 void Assembler::bctrl() { bcctr(BA, SetLK); }
 
 
 void Assembler::bc(int branch_offset, BOfield bo, int condition_bit, LKBit lk) {
   if (lk == SetLK) {
     positions_recorder()->WriteRecordedPositions();
   }
-  DCHECK(is_int16(branch_offset));
-  emit(BCX | bo | condition_bit * B16 | (kImm16Mask & branch_offset) | lk);
+  int imm16 = branch_offset;
+  CHECK(is_int16(imm16) && (imm16 & (kAAMask | kLKMask)) == 0);
+  emit(BCX | bo | condition_bit * B16 | (imm16 & kImm16Mask) | lk);
 }
 
 
 void Assembler::b(int branch_offset, LKBit lk) {
   if (lk == SetLK) {
     positions_recorder()->WriteRecordedPositions();
   }
-  DCHECK((branch_offset & 3) == 0);
   int imm26 = branch_offset;
-  DCHECK(is_int26(imm26));
-  // todo add AA and LK bits
+  CHECK(is_int26(imm26) && (imm26 & (kAAMask | kLKMask)) == 0);
   emit(BX | (imm26 & kImm26Mask) | lk);
 }
 
 
 void Assembler::xori(Register dst, Register src, const Operand& imm) {
   d_form(XORI, src, dst, imm.imm_, false);
 }
 
 
 void Assembler::xoris(Register ra, Register rs, const Operand& imm) {
@@ skipping 444 matching lines @@
 void Assembler::lha(Register dst, const MemOperand& src) {
   DCHECK(!src.ra_.is(r0));
   d_form(LHA, dst, src.ra(), src.offset(), true);
 }
 
 
 void Assembler::lwa(Register dst, const MemOperand& src) {
 #if V8_TARGET_ARCH_PPC64
   int offset = src.offset();
   DCHECK(!src.ra_.is(r0));
-  DCHECK(!(offset & 3) && is_int16(offset));
+  CHECK(!(offset & 3) && is_int16(offset));
   offset = kImm16Mask & offset;
   emit(LD | dst.code() * B21 | src.ra().code() * B16 | offset | 2);
 #else
   lwz(dst, src);
 #endif
 }
 
 
 void Assembler::lwax(Register rt, const MemOperand& src) {
 #if V8_TARGET_ARCH_PPC64
@@ skipping 113 matching lines @@
 void Assembler::andc(Register dst, Register src1, Register src2, RCBit rc) {
   x_form(EXT2 | ANDCX, dst, src1, src2, rc);
 }
 
 
 #if V8_TARGET_ARCH_PPC64
 // 64bit specific instructions
 void Assembler::ld(Register rd, const MemOperand& src) {
   int offset = src.offset();
   DCHECK(!src.ra_.is(r0));
-  DCHECK(!(offset & 3) && is_int16(offset));
+  CHECK(!(offset & 3) && is_int16(offset));
   offset = kImm16Mask & offset;
   emit(LD | rd.code() * B21 | src.ra().code() * B16 | offset);
 }
 
 
 void Assembler::ldx(Register rd, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LDX | rd.code() * B21 | ra.code() * B16 | rb.code() * B11);
 }
 
 
 void Assembler::ldu(Register rd, const MemOperand& src) {
   int offset = src.offset();
   DCHECK(!src.ra_.is(r0));
-  DCHECK(!(offset & 3) && is_int16(offset));
+  CHECK(!(offset & 3) && is_int16(offset));
   offset = kImm16Mask & offset;
   emit(LD | rd.code() * B21 | src.ra().code() * B16 | offset | 1);
 }
 
 
 void Assembler::ldux(Register rd, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LDUX | rd.code() * B21 | ra.code() * B16 | rb.code() * B11);
 }
 
 
 void Assembler::std(Register rs, const MemOperand& src) {
   int offset = src.offset();
   DCHECK(!src.ra_.is(r0));
-  DCHECK(!(offset & 3) && is_int16(offset));
+  CHECK(!(offset & 3) && is_int16(offset));
   offset = kImm16Mask & offset;
   emit(STD | rs.code() * B21 | src.ra().code() * B16 | offset);
 }
 
 
 void Assembler::stdx(Register rs, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | STDX | rs.code() * B21 | ra.code() * B16 | rb.code() * B11);
 }
 
 
 void Assembler::stdu(Register rs, const MemOperand& src) {
   int offset = src.offset();
   DCHECK(!src.ra_.is(r0));
-  DCHECK(!(offset & 3) && is_int16(offset));
+  CHECK(!(offset & 3) && is_int16(offset));
   offset = kImm16Mask & offset;
   emit(STD | rs.code() * B21 | src.ra().code() * B16 | offset | 1);
 }
 
 
 void Assembler::stdux(Register rs, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | STDUX | rs.code() * B21 | ra.code() * B16 | rb.code() * B11);
@@ skipping 530 matching lines @@
 
 void Assembler::isync() { emit(EXT1 | ISYNC); }
 
 
 // Floating point support
 
 void Assembler::lfd(const DoubleRegister frt, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
   DCHECK(!ra.is(r0));
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(LFD | frt.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::lfdu(const DoubleRegister frt, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
   DCHECK(!ra.is(r0));
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(LFDU | frt.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::lfdx(const DoubleRegister frt, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LFDX | frt.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::lfdux(const DoubleRegister frt, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LFDUX | frt.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::lfs(const DoubleRegister frt, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(LFS | frt.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::lfsu(const DoubleRegister frt, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(LFSU | frt.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::lfsx(const DoubleRegister frt, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LFSX | frt.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::lfsux(const DoubleRegister frt, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | LFSUX | frt.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::stfd(const DoubleRegister frs, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(STFD | frs.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::stfdu(const DoubleRegister frs, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(STFDU | frs.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::stfdx(const DoubleRegister frs, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | STFDX | frs.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::stfdux(const DoubleRegister frs, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
   DCHECK(!ra.is(r0));
   emit(EXT2 | STFDUX | frs.code() * B21 | ra.code() * B16 | rb.code() * B11 |
        LeaveRC);
 }
 
 
 void Assembler::stfs(const DoubleRegister frs, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(STFS | frs.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::stfsu(const DoubleRegister frs, const MemOperand& src) {
   int offset = src.offset();
   Register ra = src.ra();
-  DCHECK(is_int16(offset));
+  CHECK(is_int16(offset));
   DCHECK(!ra.is(r0));
   int imm16 = offset & kImm16Mask;
   // could be x_form instruction with some casting magic
   emit(STFSU | frs.code() * B21 | ra.code() * B16 | imm16);
 }
 
 
 void Assembler::stfsx(const DoubleRegister frs, const MemOperand& src) {
   Register ra = src.ra();
   Register rb = src.rb();
@@ skipping 375 matching lines @@
         pc_offset() + kMaxCondBranchReach - kMaxBlockTrampolineSectionSize;
   }
   return;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_PPC