Repository navigation
aarch64: A number of issues with BTI and its implementation #14938
Description
This test:
(module
(func (export "f") (param i32) (result i32)
(block $default
(block $b1
(block $b0
local.get 0
br_table $b0 $b1 $default)
i32.const 10
return)
i32.const 20
return)
i32.const 30))
(assert_return (invoke "f" (i32.const 0)) (i32.const 10))
(assert_return (invoke "f" (i32.const 5)) (i32.const 30))fails with:
$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti br-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
This test:
(module
(tag $e (param i32))
(func $throw (param i32)
local.get 0
throw $e)
(func (export "f") (param i32) (result i32)
(block $h (result i32)
(try_table (catch $e $h)
local.get 0
call $throw)
unreachable)))
(assert_return (invoke "f" (i32.const 5)) (i32.const 5))fails with:
$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti try-table.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
This test:
(module
(type $t (func (param i32) (result i32)))
(table funcref (elem $g))
(func $g (type $t)
local.get 0
i32.const 1
i32.add)
(func (export "f") (param i32) (result i32)
local.get 0
i32.const 0
return_call_indirect (type $t)))
(assert_return (invoke "f" (i32.const 5)) (i32.const 6))fails with:
$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti return-call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
This test:
(module
(type $t (func (param i32) (result i32)))
(table funcref (elem $g))
(func $g (type $t)
local.get 0
i32.const 1
i32.add)
(func (export "f") (param i32) (result i32)
local.get 0
i32.const 0
call_indirect (type $t)))
(assert_return (invoke "f" (i32.const 5)) (i32.const 6))fails with:
$ cargo run --target aarch64-unknown-linux-gnu -- wast -Ccranelift-use-bti -Ccranelift-sign-return-address call-indirect.wast
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
LLM summary, if useful
br_tabledefault: since Cranelift/aarch64: fix br_tables with very large target count. #14826 the aarch64 jump-table sequence
clamps the index and reaches the default block through the table, but
visit_block_succs(inst_predicates.rs) still reports the default as
a direct successor, so it gets nobti j. The expected output in
filetests/isa/aarch64/bti.clifalready shows this.try_tablehandlers: the unwinder resumes intotry_callhandler
blocks withbr x4(crates/unwinder/src/arch/aarch64.rs), but handler
blocks aren't treated as indirect-branch targets, so they get no
bti j.return_call_indirect/return_call_ref:ReturnCallIndpins the
target to x1 and emitsbr x1. The callee'sbti cacceptsbronly
from x16/x17.call_indirectwithsign_return_address:tail-convention
functions sign with the zero-modifier key (paciaz) and skipbti c,
assuming the PACI instruction is an implicit landing pad. Only
paciasp/pacibspare, so everyblrinto a Wasm function faults.- CLIF runtests don't catch any of this: the runner skips a
target aarch64 use_btiline becausecranelift-nativenever reports
use_btifor the host, soruntests/br_table.clif's existinguse_bti
target never runs.
Activity