Skip to content

AArch64: add BTI hint to *fcontext trampolines - fixes BTI crash on Graviton4 #308

@zaydr-al

Description

@zaydr-al

Summary

When Boost.Context is built with PAC + BTI hardening (-mbranch-protection=standard), the first indirect jump into any trampoline raises SIGILL on BTI-enforcing CPUs (Graviton 4).
Cause: the trampolines are missing the mandatory btic hint.

LLVM is currently fixing the analogous omission for compiler-generated landing pads in llvm.llvm-project #149267 (PR llvm/llvm-project#149680).
Hand-written assembly still needs the hint.

Minimal repro (Amazon Linux 2023, Boost develop, Clang 15):

#1. clone Boost super-repo
git clone --branch develop --recursive https://github.com/boostorg/boost.git boost
cd boost

#2. build Boost.Context only, with PAC+BTI
./bootstrap.sh >/dev/null
./b2 -j$"(nproc)" -q --with-context toolset=clang \
        cxxflags="-O2 -fPIC -mbranch-protection=standard" \
        asmflags="-O2 -fPIC -mbranch-protection=standard" \
        linkflags="-Wl,-z,force-bti" \
        install --prefix=stage

#3. small test that throws inside a fiber
cat > test.cpp <<'CPP'
#include <boost/context/fiber.hpp>
#include <iostream>
int main(){
    boost::context::fiber f([](boost::context::fiber&& s){
        try { throw 1; } catch(int){ std::cout<<"caught\n"; }
        return std::move(s);
    }); 
    f = std::move(f).resume();
}
CPP

clang++ -target aarch64-linux-gnu -mbranch-protection=standard \
        -I$(pwd)/stage/include \
        test.cpp -Lstage/lib -lboost_context \
        -Wl,-z,force-bti \
        -Wl,-rpath,$ORIGIN/../lib -Wl,-rpath,$(pwd)/stage/lib \
        -o test_fiber

# 4. run on Arm host that enforces BTI (Graviton 4)
./test_fiber

Proposed Fix

Insert at the top of each AArch64 trampoline:

#if defined(__ARM_FEATURE_BTI_DEFAULT) && (__ARM_FEATURE_BTI_DEFAULT == 1)
/* bti c */
      hint        #34 
#endif

Files

src/asm/jump_arm64_aapcs_elf_gas.S
src/asm/make_arm64_aapcs_elf_gas.S
src/asm/ontop_arm64_aapcs_elf_gas.S

Adds one 4-byte NOP-class instruction only when BTI is requested.

Environment

  • Boost develop
  • AmazonLinux2023
  • Clang15, Clang 18
  • Hardware: AWSGraviton4

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions