Skip to content

Commit c5b835e

Browse files
msaboffmsaboff
committed
[ARM64] Change break instruction comment to indicate possible security failure
https://bugs.webkit.org/show_bug.cgi?id=221936 Reviewed by Mark Lam. Source/bmalloc: Change the ASSERT break comment immediate to the same value the C++ compiler uses. * bmalloc/BAssert.h: Source/JavaScriptCore: We change the comment value to indicate a possible security issue by using the same value the C++ compiler emits. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::breakpoint): * disassembler/ARM64/A64DOpcode.cpp: (JSC::ARM64Disassembler::A64OpcodeExceptionGeneration::format): * disassembler/ARM64/A64DOpcode.h: (JSC::ARM64Disassembler::A64OpcodeExceptionGeneration::immediate16): * offlineasm/arm64.rb: Source/WTF: Change the ASSERT break comment immediate to the same value the C++ compiler uses. * wtf/Assertions.cpp: * wtf/Assertions.h: Canonical link: https://commits.webkit.org/234125@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@272892 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 0f8d688 commit c5b835e

10 files changed

Lines changed: 48 additions & 7 deletions

File tree

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,21 @@
1+
2021-02-15 Michael Saboff <msaboff@apple.com>
2+
3+
[ARM64] Change break instruction comment to indicate possible security failure
4+
https://bugs.webkit.org/show_bug.cgi?id=221936
5+
6+
Reviewed by Mark Lam.
7+
8+
We change the comment value to indicate a possible security issue by
9+
using the same value the C++ compiler emits.
10+
11+
* assembler/MacroAssemblerARM64.h:
12+
(JSC::MacroAssemblerARM64::breakpoint):
13+
* disassembler/ARM64/A64DOpcode.cpp:
14+
(JSC::ARM64Disassembler::A64OpcodeExceptionGeneration::format):
15+
* disassembler/ARM64/A64DOpcode.h:
16+
(JSC::ARM64Disassembler::A64OpcodeExceptionGeneration::immediate16):
17+
* offlineasm/arm64.rb:
18+
119
2021-02-15 Timothy Hatcher <timothy@apple.com>
220

321
Web Inspector: Add a way to wake up debuggables to the remote inspector protocol

‎Source/JavaScriptCore/assembler/MacroAssemblerARM64.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3695,7 +3695,7 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
36953695

36963696
// Miscellaneous operations:
36973697

3698-
void breakpoint(uint16_t imm = 0)
3698+
void breakpoint(uint16_t imm = 0xc471)
36993699
{
37003700
m_assembler.brk(imm);
37013701
}

‎Source/JavaScriptCore/disassembler/ARM64/A64DOpcode.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -630,7 +630,7 @@ const char* A64OpcodeExceptionGeneration::format()
630630
return A64DOpcode::format();
631631

632632
appendInstructionName(opname);
633-
appendUnsignedImmediate(immediate16());
633+
appendUnsignedHexImmediate(immediate16());
634634
return m_formatBuffer;
635635
}
636636

‎Source/JavaScriptCore/disassembler/ARM64/A64DOpcode.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -409,7 +409,7 @@ class A64OpcodeExceptionGeneration : public A64DOpcode {
409409
unsigned opc() { return (m_opcode>>21) & 0x7; }
410410
unsigned op2() { return (m_opcode>>2) & 0x7; }
411411
unsigned ll() { return m_opcode & 0x3; }
412-
int immediate16() { return (static_cast<int>((m_opcode >> 5) & 0xffff) << 16) >> 16; }
412+
unsigned immediate16() { return (static_cast<unsigned>((m_opcode >> 5) & 0xffff) << 16) >> 16; }
413413
};
414414

415415
class A64DOpcodeExtract : public A64DOpcode {

‎Source/JavaScriptCore/offlineasm/arm64.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1016,7 +1016,7 @@ def lowerARM64
10161016
emitARM64Unflipped("blr", operands, :quad)
10171017
end
10181018
when "break"
1019-
$asm.puts "brk \#0"
1019+
$asm.puts "brk \#0xc471"
10201020
when "ret"
10211021
$asm.puts "ret"
10221022
when "cieq", "cbeq"

‎Source/WTF/ChangeLog‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
2021-02-15 Michael Saboff <msaboff@apple.com>
2+
3+
[ARM64] Change break instruction comment to indicate possible security failure
4+
https://bugs.webkit.org/show_bug.cgi?id=221936
5+
6+
Reviewed by Mark Lam.
7+
8+
Change the ASSERT break comment immediate to the same value the C++ compiler uses.
9+
10+
* wtf/Assertions.cpp:
11+
* wtf/Assertions.h:
12+
113
2021-02-15 Said Abou-Hallawa <said@apple.com>
214

315
[GPU Process] Ensure that no image decoders run in the GPU Process

‎Source/WTF/wtf/Assertions.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,7 +610,7 @@ void WTFReleaseLogStackTrace(WTFLogChannel* channel)
610610

611611
#elif CPU(ARM64) // CPU(X86_64)
612612

613-
#define CRASH_INST "brk #0"
613+
#define CRASH_INST "brk #0xc471"
614614

615615
// See comment above on the ordering.
616616
#define CRASH_GPR0 "x16"

‎Source/WTF/wtf/Assertions.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ WTF_EXPORT_PRIVATE bool WTFIsDebuggerAttached(void);
235235
#elif CPU(ARM_THUMB2)
236236
#define WTFBreakpointTrap() asm volatile ("bkpt #0")
237237
#elif CPU(ARM64)
238-
#define WTFBreakpointTrap() asm volatile ("brk #0")
238+
#define WTFBreakpointTrap() asm volatile ("brk #0xc471")
239239
#else
240240
#define WTFBreakpointTrap() WTFCrash() // Not implemented.
241241
#endif

‎Source/bmalloc/ChangeLog‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
2021-02-15 Michael Saboff <msaboff@apple.com>
2+
3+
[ARM64] Change break instruction comment to indicate possible security failure
4+
https://bugs.webkit.org/show_bug.cgi?id=221936
5+
6+
Reviewed by Mark Lam.
7+
8+
Change the ASSERT break comment immediate to the same value the C++ compiler uses.
9+
10+
* bmalloc/BAssert.h:
11+
112
2020-12-07 Don Olmstead <don.olmstead@sony.com>
213

314
[CMake] Remove WEBKIT_WRAP_SOURCELIST

‎Source/bmalloc/bmalloc/BAssert.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
#elif BCPU(ARM_THUMB2)
4242
#define BBreakpointTrap() __asm__ volatile ("bkpt #0")
4343
#elif BCPU(ARM64)
44-
#define BBreakpointTrap() __asm__ volatile ("brk #0")
44+
#define BBreakpointTrap() __asm__ volatile ("brk #0xc471")
4545
#else
4646
#error "Unsupported CPU".
4747
#endif

0 commit comments

Comments
 (0)