Add AArch64 (ARMv8.2-A) recompiler backend for the generic sandbox

.github/workflows/rust.yml

@@ -28,6 +28,18 @@ jobs:
       run: sudo apt-get install -y lld
     - name: Build and test (generic)
       run: ./ci/jobs/build-and-test-${{ matrix.profile }}.sh
+  build-and-test-linux-aarch64:
+    # The AArch64 recompiler runs through the generic sandbox here, at a native 4K page size --
+    # which macOS (16K) cannot exercise. The Linux zygote sandbox is x86_64-only, hence generic.
+    runs-on: ubuntu-24.04-arm
+    steps:
+    - uses: actions/checkout@v4
+    - name: uname -a
+      run: uname -a
+    - name: Install LLD
+      run: sudo apt-get install -y lld
+    - name: Build and test (generic sandbox, AArch64)
+      run: ./ci/jobs/build-and-test-linux-aarch64.sh
   build-and-test-linux-only:
     runs-on: ubuntu-24.04
     steps:

ci/hypervisor/hypervisor.entitlements

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>com.apple.security.hypervisor</key><true/>
+</dict></plist>

ci/hypervisor/sign-and-run.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# Cargo test-runner: ad-hoc codesign the test binary with the hypervisor
+# entitlement, then run it. Lets `cargo test` exercise the Hypervisor sandbox.
+set -e
+bin="$1"; shift
+codesign -s - --entitlements "$(dirname "$0")/hypervisor.entitlements" --force "$bin" >/dev/null 2>&1 || true
+exec "$bin" "$@"

ci/jobs/build-and-test-linux-aarch64.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# AArch64 recompiler tests via the generic sandbox. Unlike macOS (16K pages) this host has a 4K
+# native page size, so the paging/protection boundary logic is exercised at the production granule.
+
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+cd ../..
+
+echo ">> getconf PAGESIZE"
+getconf PAGESIZE
+
+echo ">> cargo test (generic-sandbox)"
+cargo test --features generic-sandbox -p polkavm
+
+echo ">> cargo test (assembler)"
+cargo test -p polkavm-assembler --features alloc
+
+echo ">> cargo run (examples, compiler, generic)"
+POLKAVM_TRACE_EXECUTION=1 POLKAVM_ALLOW_INSECURE=1 POLKAVM_BACKEND=compiler POLKAVM_SANDBOX=generic \
+    cargo run -p hello-world-host

ci/jobs/build-and-test-macos-4k-lima.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Run the AArch64 recompiler (generic-sandbox) tests on a REAL 4K page size.
+#
+# macOS on Apple Silicon uses 16K pages natively, so the recompiler's paging /
+# mprotect logic is never exercised at 4K on a Mac. A Linux guest under Apple's
+# Virtualization.framework (Lima's `vz` backend) runs a 4K-page kernel on the
+# real hardware MMU at near-native speed. This boots such a guest and runs the
+# generic-sandbox compiler tests inside it against the working tree.
+#
+# Usage:
+#   ci/jobs/build-and-test-macos-4k-lima.sh            # default recompiler tests
+#   ci/jobs/build-and-test-macos-4k-lima.sh <cargo test filter args...>
+#
+# Env overrides: POLKAVM_LIMA_VM, POLKAVM_LIMA_CPUS, POLKAVM_LIMA_MEM
+# Teardown:      limactl stop polkavm-4k && limactl delete polkavm-4k
+
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+cd ../..
+REPO="$(pwd)"
+
+VM="${POLKAVM_LIMA_VM:-polkavm-4k}"
+CPUS="${POLKAVM_LIMA_CPUS:-8}"
+MEM="${POLKAVM_LIMA_MEM:-12}"
+
+command -v limactl >/dev/null || { echo "!! lima not installed. Install with: brew install lima"; exit 1; }
+
+sh() { limactl shell "$VM" -- bash -lc "$1"; }
+
+# Create the VM once. vz => real hardware MMU (not TCG emulation); the stock
+# Ubuntu arm64 kernel is built for 4K pages, which is exactly what we want.
+if ! limactl list -q 2>/dev/null | grep -qx "$VM"; then
+    echo ">> creating Lima VM '$VM' (vz backend, 4K guest, ${CPUS} cpus / ${MEM} GiB)"
+    limactl start --vm-type=vz --cpus="$CPUS" --memory="$MEM" --name="$VM" template://ubuntu --tty=false
+else
+    echo ">> starting Lima VM '$VM'"
+    limactl start "$VM" --tty=false
+fi
+
+# Fail loudly if the guest is not actually 4K (e.g. a fallback to a 16K kernel).
+PS="$(sh 'getconf PAGE_SIZE')"
+echo ">> guest page size: $PS"
+[ "$PS" = "4096" ] || { echo "!! guest page size is $PS, expected 4096 — aborting"; exit 1; }
+
+# Provision the toolchain and native build deps once (idempotent marker file).
+if ! sh 'test -f "$HOME/.polkavm-4k-provisioned"'; then
+    echo ">> provisioning guest (apt deps + rustup)"
+    sh 'sudo apt-get update -qq && sudo apt-get install -y -qq gcc g++ make cmake clang pkg-config libssl-dev perl curl'
+    sh 'command -v cargo >/dev/null || curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal'
+    sh 'touch "$HOME/.polkavm-4k-provisioned"'
+fi
+
+# The repo is a read-only virtiofs mount inside the guest, so send cargo's build
+# output to the guest's own writable disk.
+#
+# memset_with_dynamic_paging is skipped on macOS (16K) but PASSES at 4K, so we run
+# it here. memset_basic is a pre-existing AArch64-recompiler gas-metering quirk
+# (skipped on macOS too), unrelated to page size.
+TEST_ARGS="${*:-tests::compiler_generic_ --skip tests::compiler_generic_memset_basic}"
+
+echo ">> cargo test (generic-sandbox) at 4K page size"
+sh "source \$HOME/.cargo/env
+    cd '$REPO'
+    export CARGO_TARGET_DIR=\$HOME/polkavm-target-4k
+    echo \"   toolchain: \$(rustc --version)  |  page size: \$(getconf PAGE_SIZE)\"
+    cargo test --locked --features generic-sandbox -p polkavm -- $TEST_ARGS"
+
+echo ">> done (4K page size validated)"

ci/jobs/build-and-test-macos-hypervisor.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Hypervisor-sandbox tests. `hv_vm_create` needs the `com.apple.security.hypervisor` entitlement,
+# which cargo's test binaries don't carry, so they are ad-hoc codesigned by a cargo test runner.
+#
+# This needs a real Apple Silicon host: GitHub's macOS runners are themselves VMs and cannot nest
+# virtualization, so this job only works on self-hosted hardware.
+
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+cd ../..
+
+if [ "$(uname -sm)" != "Darwin arm64" ]; then
+    echo ">> skipping: the hypervisor sandbox needs macOS on Apple Silicon (got '$(uname -sm)')"
+    exit 0
+fi
+
+export CARGO_TARGET_AARCH64_APPLE_DARWIN_RUNNER="$(pwd)/ci/hypervisor/sign-and-run.sh"
+
+echo ">> cargo test (hypervisor-sandbox only)"
+cargo test --target aarch64-apple-darwin --features hypervisor-sandbox -p polkavm -- tests::aarch64_hypervisor
+
+echo ">> cargo test (hypervisor-sandbox + generic-sandbox)"
+cargo test --target aarch64-apple-darwin --features generic-sandbox,hypervisor-sandbox -p polkavm
+
+echo ">> cargo test (AArch64 backend corpus routed through the hypervisor)"
+POLKAVM_TEST_HYPERVISOR=1 cargo test --target aarch64-apple-darwin \
+    --features generic-sandbox,hypervisor-sandbox -p polkavm -- tests::aarch64_backend
+
+# The whole matrix at a real 4K guest granule. Serial: one VM per process.
+echo ">> cargo test (full matrix through the hypervisor, 4K guest pages)"
+POLKAVM_TEST_HYPERVISOR=1 cargo test --target aarch64-apple-darwin \
+    --features generic-sandbox,hypervisor-sandbox -p polkavm --lib -- \
+    tests::compiler_hypervisor_ --test-threads=1

ci/jobs/build-and-test-macos.sh

@@ -16,7 +16,4 @@ echo ">> cargo run (examples, interpreter, aarch64-apple-darwin)"
 POLKAVM_TRACE_EXECUTION=1 POLKAVM_ALLOW_INSECURE=1 POLKAVM_BACKEND=interpreter cargo run --target=aarch64-apple-darwin -p hello-world-host
 
 echo ">> cargo test (generic-sandbox)"
-cargo test --features generic-sandbox -p polkavm -- \
-    tests::compiler_generic_ \
-    --skip tests::compiler_generic_memset_basic \
-    --skip tests::compiler_generic_memset_with_dynamic_paging
+cargo test --features generic-sandbox -p polkavm -- tests::compiler_generic_ tests::tracing_generic_

ci/jobs/lib/build-and-test.sh

@@ -8,7 +8,8 @@ PROFILE="${1:?usage: build-and-test.sh <profile>}"
 
 echo ">> cargo test (main crates, $PROFILE)"
 cargo test --profile $PROFILE -p polkavm
-cargo test --profile $PROFILE -p polkavm-assembler
+# `alloc` gates the assembler's own tests; without it the run is empty.
+cargo test --profile $PROFILE -p polkavm-assembler --features alloc
 cargo test --profile $PROFILE -p polkavm-common
 cargo test --profile $PROFILE -p polkavm-common --all-features
 cargo test --profile $PROFILE -p polkavm-derive