Bug report

Bug description:

While auditing the indirect branches the JIT emits on AArch64 for BTI compatibility (part of investigating gh-149697), I noticed that the trampoline for calls out of range of a bl (patch_aarch64_trampoline in Python/jit.c) is:

ldr x8, 8
br  x8

The AAPCS64 only allows a veneer to alter x16, x17 and the flags, which is why the linkers' own long-branch stubs use x16. x8 carries the address of the result buffer when the callee returns a struct too large for registers, so a callee reached through this trampoline would store its result through the trampoline's target address instead.

THere is no helper at the moment where a JIT call would return such a struct but a standalone program calling a function that returns a 32-byte struct through the same 16 bytes segfaults with x8 and works with x16. A simple reproducer:

#include <stdio.h>

typedef struct { long a, b, c, d; } big;   /* returned through x8 */

big make_big(long x) { return (big){x, x + 1, x + 2, x + 3}; }

/* trampolines */
__asm__(
    "via_x8:  ldr x8, 1f\n  br x8\n  1: .xword make_big\n"
    "via_x16: ldr x16, 2f\n br x16\n 2: .xword make_big\n"
);
big via_x8(long), via_x16(long);

int main(void)
{
    big r = via_x16(40);
    printf("via x16: %ld %ld %ld %ld\n", r.a, r.b, r.c, r.d);
    fflush(stdout);
    r = via_x8(40);
    printf("via x8:  %ld %ld %ld %ld\n", r.a, r.b, r.c, r.d);
}

$ gcc -O2 -g repro.c && ./a.out
via x16: 40 41 42 43
Segmentation fault (core dumped)

Using x16 also makes the br acceptable to a BTI C landing pad once JIT memory is mapped with PROT_BTI, which the linkers' stubs already satisfy.

Introduced in gh-119726.

cc @diegorusso

CPython versions tested on:

CPython main branch, 3.16, 3.15, 3.14

Operating systems tested on:

Linux

Linked PRs

• gh-157510: Use x16 in the aarch64 JIT trampoline #157527