[PowerPC] Add ROP Protection Instructions for PowerPC

[stefanp]

Summary

There are four new PowerPC instructions that are introduced in
Power 10. They are hashst, hashchk, hashstp, hashchkp.

These instructions will be used for ROP Protection.
This patch adds the four instructions.

[amyk]

Overall this LGTM.

llvm/lib/Target/PowerPC/PPCInstr64Bit.td

1536

I believe the hasSideEffects is needed because the instruction may TRAP if the hash does not match the hash stored at the specified address. This is a super minor nit, but maybe it might be better to explicitly say that the flag is needed because of this reason.

The hasSideEffects flag is needed as the instruction may TRAP if ...

I think this is minor though, so if you think it's not needed, you can feel free to disregard this comment.

[nemanjai]

LGTM.

[stefanp]

Updated comment.

[hctim]

Looks like this patch broke the UBSan buildbot (https://lab.llvm.org/buildbot/#/builders/5/builds/6546), PTAL.

Repro instructions here, copied the UBSan report below for your reference:

FAIL: LLVM :: MC/Disassembler/PowerPC/ppc64-encoding-ISA31.txt (54419 of 75431)
******************** TEST 'LLVM :: MC/Disassembler/PowerPC/ppc64-encoding-ISA31.txt' FAILED ********************
Script:
--
: 'RUN: at line 1';   /b/sanitizer-x86_64-linux-fast/build/llvm_build_ubsan/bin/llvm-mc --disassemble /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/MC/Disassembler/PowerPC/ppc64-encoding-ISA31.txt -triple powerpc64-unknown-linux-gnu    -mcpu=pwr10 | /b/sanitizer-x86_64-linux-fast/build/llvm_build_ubsan/bin/FileCheck /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/MC/Disassembler/PowerPC/ppc64-encoding-ISA31.txt
--
Exit Code: 1
Command Output (stderr):
--
/b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/Target/PowerPC/Disassembler/PPCDisassembler.cpp:290:60: runtime error: left shift of negative value -1
    #0 0x133a4a8 in decodeMemRIHashOperands /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/Target/PowerPC/Disassembler/PPCDisassembler.cpp:290:60
    #1 0x133a4a8 in llvm::MCDisassembler::DecodeStatus llvm::decodeToMCInst<unsigned long>(llvm::MCDisassembler::DecodeStatus, unsigned int, unsigned long, llvm::MCInst&, unsigned long, void const*, bool&) /b/sanitizer-x86_64-linux-fast/build/llvm_build_ubsan/lib/Target/PowerPC/PPCGenDisassemblerTables.inc:6657:9
    #2 0x1337b3e in llvm::MCDisassembler::DecodeStatus llvm::decodeInstruction<unsigned long>(unsigned char const*, llvm::MCInst&, unsigned long, unsigned long, void const*, llvm::MCSubtargetInfo const&) /b/sanitizer-x86_64-linux-fast/build/llvm_build_ubsan/lib/Target/PowerPC/PPCGenDisassemblerTables.inc:8119:11
    #3 0xfc69a9 in PrintInsts /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/tools/llvm-mc/Disassembler.cpp:49:16
    #4 0xfc69a9 in llvm::Disassembler::disassemble(llvm::Target const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, llvm::MCSubtargetInfo&, llvm::MCStreamer&, llvm::MemoryBuffer&, llvm::SourceMgr&, llvm::MCContext&, llvm::raw_ostream&, llvm::MCTargetOptions const&) /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/tools/llvm-mc/Disassembler.cpp:196:24
    #5 0xfb7b68 in main /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/tools/llvm-mc/llvm-mc.cpp:559:11
    #6 0x7ff4a60a409a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #7 0xf9c949 in _start (/b/sanitizer-x86_64-linux-fast/build/llvm_build_ubsan/bin/llvm-mc+0xf9c949)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/Target/PowerPC/Disassembler/PPCDisassembler.cpp:290:60 in

[stefanp]

Reopening review to investigate the issue.

[stefanp]

Was able to reproduce the issue that caused the left shift of -1.
Fixed the patch by replacing the shift with a multiply.
Also realized that the type should have been signed and not unsigned.

llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp

switch (Kind) {
         return isInt<16>(getImmS16Context());
       default:
         return false;
     }
   }
   bool isS16ImmX4() const { return Kind == Expression ||
                                    (Kind == Immediate && isInt<16>(getImm()) &&
                                     (getImm() & 3) == 0); }
+
+  bool isHashImmX8() const {
+    // The Hash Imm form is used for instructions that check or store a hash.
+    // These instructions have a small immediate range that spans between
+    // -8 and -512.
+    return (Kind == Immediate && getImm() <= -8 && getImm() >= -512 &&
+            (getImm() & 7) == 0);
+  }
+
   bool isS16ImmX16() const { return Kind == Expression ||
                                     (Kind == Immediate && isInt<16>(getImm()) &&
                                      (getImm() & 15) == 0); }
   bool isS34ImmX16() const {
     return Kind == Expression ||
            (Kind == Immediate && isInt<34>(getImm()) && (getImm() & 15) == 0);
   }
   bool isS34Imm() const {

llvm/lib/Target/PowerPC/Disassembler/PPCDisassembler.cpp

static DecodeStatus decodeMemRIXOperands(MCInst &Inst, uint64_t Imm,
   else if (Inst.getOpcode() == PPC::STDU)
     Inst.insert(Inst.begin(), MCOperand::createReg(RRegsNoR0[Base]));
 
   Inst.addOperand(MCOperand::createImm(SignExtend64<16>(Disp << 2)));
   Inst.addOperand(MCOperand::createReg(RRegsNoR0[Base]));
   return MCDisassembler::Success;
 }
 
+static DecodeStatus decodeMemRIHashOperands(MCInst &Inst, uint64_t Imm,
+                                            int64_t Address,
+                                            const void *Decoder) {
+  // Decode the memrix field for a hash store or hash check operation.
+  // The field is composed of a register and an immediate value that is 6 bits
+  // and covers the range -8 to -512. The immediate is always negative and 2s
+  // complement which is why we sign extend a 7 bit value.
+  const uint64_t Base = Imm >> 6;
+  const uint64_t Disp = SignExtend64<7>((Imm & 0x3F) + 64) << 3;
+
+  assert(Base < 32 && "Invalid base register");
+
+  Inst.addOperand(MCOperand::createImm(Disp));
+  Inst.addOperand(MCOperand::createReg(RRegs[Base]));
+  return MCDisassembler::Success;
+}
+
 static DecodeStatus decodeMemRIX16Operands(MCInst &Inst, uint64_t Imm,
                                          int64_t Address, const void *Decoder) {
   // Decode the memrix16 field (imm, reg), which has the low 12-bits as the
   // displacement with 16-byte aligned, and the next 5 bits as the register #.
 
   uint64_t Base = Imm >> 12;
   uint64_t Disp = Imm & 0xFFF;
 

llvm/lib/Target/PowerPC/MCTargetDesc/PPCInstPrinter.h

public:
   void printTLSCall(const MCInst *MI, unsigned OpNo, const MCSubtargetInfo &STI,
                     raw_ostream &O);
 
   void printcrbitm(const MCInst *MI, unsigned OpNo, const MCSubtargetInfo &STI,
                    raw_ostream &O);
 
   void printMemRegImm(const MCInst *MI, unsigned OpNo,
                       const MCSubtargetInfo &STI, raw_ostream &O);
+  void printMemRegImmHash(const MCInst *MI, unsigned OpNo,
+                          const MCSubtargetInfo &STI, raw_ostream &O);
   void printMemRegImm34PCRel(const MCInst *MI, unsigned OpNo,
                              const MCSubtargetInfo &STI, raw_ostream &O);
   void printMemRegImm34(const MCInst *MI, unsigned OpNo,
                         const MCSubtargetInfo &STI, raw_ostream &O);
   void printMemRegReg(const MCInst *MI, unsigned OpNo,
                       const MCSubtargetInfo &STI, raw_ostream &O);
 };
 } // end namespace llvm
 
 #endif

llvm/lib/Target/PowerPC/MCTargetDesc/PPCInstPrinter.cpp

void PPCInstPrinter::printMemRegImm(const MCInst *MI, unsigned OpNo,
   O << '(';
   if (MI->getOperand(OpNo+1).getReg() == PPC::R0)
     O << "0";
   else
     printOperand(MI, OpNo + 1, STI, O);
   O << ')';
 }
 
+void PPCInstPrinter::printMemRegImmHash(const MCInst *MI, unsigned OpNo,
+                                        const MCSubtargetInfo &STI,
+                                        raw_ostream &O) {
+  O << MI->getOperand(OpNo).getImm();
+  O << '(';
+  printOperand(MI, OpNo + 1, STI, O);
+  O << ')';
+}
+
 void PPCInstPrinter::printMemRegImm34PCRel(const MCInst *MI, unsigned OpNo,
                                            const MCSubtargetInfo &STI,
                                            raw_ostream &O) {
   printS34ImmOperand(MI, OpNo, STI, O);
   O << '(';
   printImmZeroOperand(MI, OpNo + 1, STI, O);
   O << ')';
 }

llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.h

unsigned getMemRIEncoding(const MCInst &MI, unsigned OpNo,
                             SmallVectorImpl<MCFixup> &Fixups,
                             const MCSubtargetInfo &STI) const;
   unsigned getMemRIXEncoding(const MCInst &MI, unsigned OpNo,
                              SmallVectorImpl<MCFixup> &Fixups,
                              const MCSubtargetInfo &STI) const;
   unsigned getMemRIX16Encoding(const MCInst &MI, unsigned OpNo,
                                SmallVectorImpl<MCFixup> &Fixups,
                                const MCSubtargetInfo &STI) const;
+  unsigned getMemRIHashEncoding(const MCInst &MI, unsigned OpNo,
+                                SmallVectorImpl<MCFixup> &Fixups,
+                                const MCSubtargetInfo &STI) const;
   uint64_t getMemRI34PCRelEncoding(const MCInst &MI, unsigned OpNo,
                                    SmallVectorImpl<MCFixup> &Fixups,
                                    const MCSubtargetInfo &STI) const;
   uint64_t getMemRI34Encoding(const MCInst &MI, unsigned OpNo,
                               SmallVectorImpl<MCFixup> &Fixups,
                               const MCSubtargetInfo &STI) const;
   unsigned getSPE8DisEncoding(const MCInst &MI, unsigned OpNo,
                               SmallVectorImpl<MCFixup> &Fixups,

llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp

unsigned PPCMCCodeEmitter::getMemRIX16Encoding(const MCInst &MI, unsigned OpNo,
   }
 
   // Otherwise add a fixup for the displacement field.
   Fixups.push_back(MCFixup::create(IsLittleEndian? 0 : 2, MO.getExpr(),
                                    (MCFixupKind)PPC::fixup_ppc_half16ds));
   return RegBits;
 }
 
+unsigned
+PPCMCCodeEmitter::getMemRIHashEncoding(const MCInst &MI, unsigned OpNo,
+                                       SmallVectorImpl<MCFixup> &Fixups,
+                                       const MCSubtargetInfo &STI) const {
+  // Encode (imm, reg) for the hash load/store to stack for the ROP Protection
+  // instructions.
+  const MCOperand &RegMO = MI.getOperand(OpNo + 1);
+  const MCOperand &MO = MI.getOperand(OpNo);
+
+  assert(RegMO.isReg() && "Base address must be a register.");
+  assert(MO.isImm() && "Expecting an immediate operand.");
+  assert(!(MO.getImm() % 8) && "Expecting offset to be 8 byte aligned.");
+
+  unsigned RegBits = getMachineOpValue(MI, RegMO, Fixups, STI) << 6;
+  unsigned DX = (MO.getImm() >> 3) & 0x3F;
+  return RegBits | DX;
+}
+
 uint64_t
 PPCMCCodeEmitter::getMemRI34PCRelEncoding(const MCInst &MI, unsigned OpNo,
                                           SmallVectorImpl<MCFixup> &Fixups,
                                           const MCSubtargetInfo &STI) const {
   // Encode the PCRelative version of memri34: imm34(r0).
   // In the PC relative version the register for the address must be zero.
   // The 34 bit immediate can fall into one of three cases:
   // 1) It is a relocation to be filled in by the linker represented as:

llvm/lib/Target/PowerPC/P9InstrResources.td

def : InstRW<[],
   (instregex "L(W|H|B)EPX$"),
   (instregex "ST(W|H|B)EPX$"),
   (instregex "(L|ST)FDEPX$"),
   (instregex "M(T|F)SR(IN)?$"),
   (instregex "M(T|F)DCR$"),
   (instregex "NOP_GT_PWR(6|7)$"),
   (instregex "TLB(IA|IVAX|SX|SX2|SX2D|LD|LI|RE|RE2|WE|WE2)$"),
   (instregex "WRTEE(I)?$"),
+  (instregex "HASH(ST|STP|CHK|CHKP)$"),
   ATTN,
   CLRBHRB,
   MFBHRBE,
   MBAR,
   MSYNC,
   SLBSYNC,
   SLBFEE_rec,
   NAP,

llvm/lib/Target/PowerPC/PPCInstr64Bit.td

 defm FCTIDUZ : XForm_26r<63, 943, (outs f8rc:$frD), (ins f8rc:$frB),
                         "fctiduz", "$frD, $frB", IIC_FPGeneral,
                         [(set f64:$frD, (PPCany_fctiduz f64:$frB))]>, isPPC64;
 defm FCTIWUZ : XForm_26r<63, 143, (outs f8rc:$frD), (ins f8rc:$frB),
                         "fctiwuz", "$frD, $frB", IIC_FPGeneral,
                         [(set f64:$frD, (PPCany_fctiwuz f64:$frB))]>, isPPC64;
 }
 
+// These instructions store a hash computed from the value of the link register
+// and the value of the stack pointer.
+let mayStore = 1 in {
+def HASHST : XForm_XD6_RA5_RB5<31, 722, (outs),
+                               (ins g8rc:$RB, memrihash:$D_RA_XD),
+                               "hashst $RB, $D_RA_XD", IIC_IntGeneral, []>;
+def HASHSTP : XForm_XD6_RA5_RB5<31, 658, (outs),
+                                (ins g8rc:$RB, memrihash:$D_RA_XD),
+                                "hashstp $RB, $D_RA_XD", IIC_IntGeneral, []>;
+}
+
+// These instructions check a hash computed from the value of the link register
+// and the value of the stack pointer. The hasSideEffects flag is needed as the
+// instruction may TRAP if the hash does not match the hash stored at the
+// specified address.
+let mayLoad = 1, hasSideEffects = 1 in {
+def HASHCHK : XForm_XD6_RA5_RB5<31, 754, (outs),
+                                (ins g8rc:$RB, memrihash:$D_RA_XD),
+                                "hashchk $RB, $D_RA_XD", IIC_IntGeneral, []>;
+def HASHCHKP : XForm_XD6_RA5_RB5<31, 690, (outs),
+                                 (ins g8rc:$RB, memrihash:$D_RA_XD),
+                                 "hashchkp $RB, $D_RA_XD", IIC_IntGeneral, []>;
+}
 
 //===----------------------------------------------------------------------===//
 // Instruction Patterns
 //
 
 // Extensions and truncates to/from 32-bit regs.
 def : Pat<(i64 (zext i32:$in)),
           (RLDICL (INSERT_SUBREG (i64 (IMPLICIT_DEF)), $in, sub_32),

llvm/lib/Target/PowerPC/PPCInstrFormats.td

class XX2_RD6_DCMX7_RS6<bits<6> opcode, bits<4> xo1, bits<3> xo2,
   let Inst{21-24} = xo1;
   let Inst{25}    = DCMX{6};
   let Inst{26-28} = xo2;
   let Inst{29}    = DCMX{5};
   let Inst{30}    = XB{5};
   let Inst{31}    = XT{5};
 }
 
+class XForm_XD6_RA5_RB5<bits<6> opcode, bits<10> xo, dag OOL, dag IOL,
+                        string asmstr, InstrItinClass itin, list<dag> pattern>
+  : I<opcode, OOL, IOL, asmstr, itin> {
+  bits<11> D_RA_XD;
+  bits<5> RB;
+
+  let Pattern = pattern;
+
+  let Inst{6-10}  = D_RA_XD{4-0};  // D
+  let Inst{11-15} = D_RA_XD{10-6}; // RA
+  let Inst{16-20} = RB;
+  let Inst{21-30} = xo;
+  let Inst{31}    = D_RA_XD{5};    // DX
+}
+
 class XX3Form<bits<6> opcode, bits<8> xo, dag OOL, dag IOL, string asmstr, 
               InstrItinClass itin, list<dag> pattern>
   : I<opcode, OOL, IOL, asmstr, itin> {
   bits<6> XT;
   bits<6> XA;
   bits<6> XB;
 
   let Pattern = pattern;

llvm/lib/Target/PowerPC/PPCInstrInfo.td

 }
 def PPCDispRIXOperand : AsmOperandClass {
  let Name = "DispRIX"; let PredicateMethod = "isS16ImmX4";
  let RenderMethod = "addImmOperands";
 }
 def dispRIX : Operand<iPTR> {
   let ParserMatchClass = PPCDispRIXOperand;
 }
+def PPCDispRIHashOperand : AsmOperandClass {
+  let Name = "DispRIHash"; let PredicateMethod = "isHashImmX8";
+  let RenderMethod = "addImmOperands";
+}
+def dispRIHash : Operand<iPTR> {
+  let ParserMatchClass = PPCDispRIHashOperand;
+}
 def PPCDispRIX16Operand : AsmOperandClass {
  let Name = "DispRIX16"; let PredicateMethod = "isS16ImmX16";
  let RenderMethod = "addImmOperands";
 }
 def dispRIX16 : Operand<iPTR> {
   let ParserMatchClass = PPCDispRIX16Operand;
 }
 def PPCDispSPE8Operand : AsmOperandClass {

 }
 def memrix : Operand<iPTR> {   // memri where the imm is 4-aligned.
   let PrintMethod = "printMemRegImm";
   let MIOperandInfo = (ops dispRIX:$imm, ptr_rc_nor0:$reg);
   let EncoderMethod = "getMemRIXEncoding";
   let DecoderMethod = "decodeMemRIXOperands";
   let OperandType = "OPERAND_MEMORY";
 }
+def memrihash : Operand<iPTR> {
+  // memrihash 8-aligned for ROP Protection Instructions.
+  let PrintMethod = "printMemRegImmHash";
+  let MIOperandInfo = (ops dispRIHash:$imm, ptr_rc_nor0:$reg);
+  let EncoderMethod = "getMemRIHashEncoding";
+  let DecoderMethod = "decodeMemRIHashOperands";
+  let OperandType = "OPERAND_MEMORY";
+}
 def memrix16 : Operand<iPTR> { // memri, imm is 16-aligned, 12-bit, Inst{16:27}
   let PrintMethod = "printMemRegImm";
   let MIOperandInfo = (ops dispRIX16:$imm, ptr_rc_nor0:$reg);
   let EncoderMethod = "getMemRIX16Encoding";
   let DecoderMethod = "decodeMemRIX16Operands";
   let OperandType = "OPERAND_MEMORY";
 }
 def spe8dis : Operand<iPTR> {   // SPE displacement where the imm is 8-aligned.

llvm/test/MC/Disassembler/PowerPC/ppc64-encoding-ISA31.txt

 # CHECK: vstrihl. 2, 2
 0x10 0x42 0x14 0x0d
 
 # CHECK: xvcvspbf16 33, 34
 0xf0 0x31 0x17 0x6f
 
 # CHECK: xvcvbf16spn 33, 34
 0xf0 0x30 0x17 0x6f
+
+# CHECK: hashst 5, -8(1)
+0x7f 0xe1 0x2d 0xa5
+
+# CHECK: hashst 0, -8(30)
+0x7f 0xfe 0x05 0xa5
+
+# CHECK: hashst 5, -512(1)
+0x7c 0x01 0x2d 0xa4
+
+# CHECK: hashchk 5, -8(1)
+0x7f 0xe1 0x2d 0xe5
+
+# CHECK: hashchk 0, -8(30)
+0x7f 0xfe 0x05 0xe5
+
+# CHECK: hashchk 5, -512(1)
+0x7c 0x01 0x2d 0xe4
+
+# CHECK: hashstp 5, -8(1)
+0x7f 0xe1 0x2d 0x25
+
+# CHECK: hashstp 0, -8(30)
+0x7f 0xfe 0x05 0x25
+
+# CHECK: hashstp 5, -512(1)
+0x7c 0x01 0x2d 0x24
+
+# CHECK: hashchkp 5, -8(1)
+0x7f 0xe1 0x2d 0x65
+
+# CHECK: hashchkp 0, -8(30)
+0x7f 0xfe 0x05 0x65
+
+# CHECK: hashchkp 5, -512(1)
+0x7c 0x01 0x2d 0x64
+

llvm/test/MC/PowerPC/ppc64-encoding-ISA31.s

 # CHECK-LE: vstrihl. 2, 2                         # encoding: [0x0d,0x14,0x42,0x10]
             vstrihl. 2, 2
 # CHECK-BE: xvcvspbf16 33, 34                     # encoding: [0xf0,0x31,0x17,0x6f]
 # CHECK-LE: xvcvspbf16 33, 34                     # encoding: [0x6f,0x17,0x31,0xf0]
             xvcvspbf16 33, 34
 # CHECK-BE: xvcvbf16spn 33, 34                    # encoding: [0xf0,0x30,0x17,0x6f]
 # CHECK-LE: xvcvbf16spn 33, 34                    # encoding: [0x6f,0x17,0x30,0xf0]
             xvcvbf16spn 33, 34
+# CHECK-BE: hashst 5, -8(1)                       # encoding: [0x7f,0xe1,0x2d,0xa5]
+# CHECK-LE: hashst 5, -8(1)                       # encoding: [0xa5,0x2d,0xe1,0x7f]
+            hashst 5, -8(1)
+# CHECK-BE: hashst 0, -8(30)                      # encoding: [0x7f,0xfe,0x05,0xa5]
+# CHECK-LE: hashst 0, -8(30)                      # encoding: [0xa5,0x05,0xfe,0x7f]
+            hashst 0, -8(30)
+# CHECK-BE: hashst 5, -512(1)                     # encoding: [0x7c,0x01,0x2d,0xa4]
+# CHECK-LE: hashst 5, -512(1)                     # encoding: [0xa4,0x2d,0x01,0x7c]
+            hashst 5, -512(1)
+# CHECK-BE: hashchk 5, -8(1)                      # encoding: [0x7f,0xe1,0x2d,0xe5]
+# CHECK-LE: hashchk 5, -8(1)                      # encoding: [0xe5,0x2d,0xe1,0x7f]
+            hashchk 5, -8(1)
+# CHECK-BE: hashchk 0, -8(30)                     # encoding: [0x7f,0xfe,0x05,0xe5]
+# CHECK-LE: hashchk 0, -8(30)                     # encoding: [0xe5,0x05,0xfe,0x7f]
+            hashchk 0, -8(30)
+# CHECK-BE: hashchk 5, -512(1)                    # encoding: [0x7c,0x01,0x2d,0xe4]
+# CHECK-LE: hashchk 5, -512(1)                    # encoding: [0xe4,0x2d,0x01,0x7c]
+            hashchk 5, -512(1)
+# CHECK-BE: hashstp 5, -8(1)                      # encoding: [0x7f,0xe1,0x2d,0x25]
+# CHECK-LE: hashstp 5, -8(1)                      # encoding: [0x25,0x2d,0xe1,0x7f]
+            hashstp 5, -8(1)
+# CHECK-BE: hashstp 0, -8(30)                     # encoding: [0x7f,0xfe,0x05,0x25]
+# CHECK-LE: hashstp 0, -8(30)                     # encoding: [0x25,0x05,0xfe,0x7f]
+            hashstp 0, -8(30)
+# CHECK-BE: hashstp 5, -512(1)                    # encoding: [0x7c,0x01,0x2d,0x24]
+# CHECK-LE: hashstp 5, -512(1)                    # encoding: [0x24,0x2d,0x01,0x7c]
+            hashstp 5, -512(1)
+# CHECK-BE: hashchkp 5, -8(1)                     # encoding: [0x7f,0xe1,0x2d,0x65]
+# CHECK-LE: hashchkp 5, -8(1)                     # encoding: [0x65,0x2d,0xe1,0x7f]
+            hashchkp 5, -8(1)
+# CHECK-BE: hashchkp 0, -8(30)                    # encoding: [0x7f,0xfe,0x05,0x65]
+# CHECK-LE: hashchkp 0, -8(30)                    # encoding: [0x65,0x05,0xfe,0x7f]
+            hashchkp 0, -8(30)
+# CHECK-BE: hashchkp 5, -512(1)                   # encoding: [0x7c,0x01,0x2d,0x64]
+# CHECK-LE: hashchkp 5, -512(1)                   # encoding: [0x64,0x2d,0x01,0x7c]
+            hashchkp 5, -512(1)