Fix compiler backend audit findings

Author: a19q3

src/codegen/abi.rs

@@ -12,6 +12,7 @@ use crate::error::Result;
 use crate::ir::*;
 use crate::ENTRY_WITNESS_ABI_MAGIC;
 
+use super::assembler::align_up;
 use super::{
     fixed_aggregate_pointer_param_width, fixed_byte_pointer_param_width, fixed_register_width, named_type_name, type_static_length,
     CellScriptRuntimeError, CodeGenerator,
@@ -80,6 +81,15 @@ pub(crate) fn entry_abi_arg_count(params: &[IrParam], abi: Option<&CallableAbi>)
         .sum()
 }
 
+pub(crate) fn outgoing_stack_arg_bytes(abi_arg_count: usize) -> usize {
+    let bytes = abi_arg_count.saturating_sub(8) * 8;
+    if bytes == 0 {
+        0
+    } else {
+        align_up(bytes, 16)
+    }
+}
+
 pub(crate) fn call_param_abi_arg_count(param: &IrParam, needs_type_hash: bool) -> usize {
     if named_type_name(&param.ty).is_some() {
         return 2 + usize::from(needs_type_hash) * 2;
@@ -211,7 +221,7 @@ impl CodeGenerator {
         let callable_abi = self.callable_abis.get(target).cloned();
         let type_hash_param_indices = callable_abi.as_ref().map(|abi| abi.type_hash_param_indices.clone()).unwrap_or_default();
         let runtime_bound_param_indices = callable_abi.as_ref().map(|abi| abi.runtime_bound_param_indices.clone()).unwrap_or_default();
-        let outgoing_stack_arg_bytes = entry_abi_arg_count(params, callable_abi.as_ref()).saturating_sub(8) * 8;
+        let outgoing_stack_arg_bytes = outgoing_stack_arg_bytes(entry_abi_arg_count(params, callable_abi.as_ref()));
         let payload = entry_witness_payload_layout(params, &runtime_bound_param_indices);
         let payload_len = payload.iter().map(|arg| arg.width).sum::<usize>();
         let has_witness_payload = payload.iter().any(|arg| arg.width > 0 || arg.unsupported);
@@ -388,9 +398,15 @@ impl CodeGenerator {
                     self.emit(format!("addi t0, t0, {}", ENTRY_WITNESS_BUFFER_OFFSET));
                     if abi_index < 8 {
                         self.emit_entry_witness_scalar_load_from_reg(&format!("a{}", abi_index), "t0", width);
+                        if param.ty == IrType::Bool {
+                            self.emit_entry_bool_canonical_check(&format!("a{}", abi_index), &fail_label);
+                        }
                     } else {
                         let caller_stack_offset = (abi_index - 8) * 8;
                         self.emit_entry_witness_scalar_load_from_reg("t3", "t0", width);
+                        if param.ty == IrType::Bool {
+                            self.emit_entry_bool_canonical_check("t3", &fail_label);
+                        }
                         self.emit(format!(
                             "# cellscript entry abi: scalar param {} stored to caller stack +{}",
                             param.name, caller_stack_offset
@@ -480,9 +496,15 @@ impl CodeGenerator {
                     let stack_offset = ENTRY_WITNESS_BUFFER_OFFSET + ENTRY_WITNESS_HEADER_SIZE + payload_cursor;
                     if abi_index < 8 {
                         self.emit_entry_witness_scalar_load(&format!("a{}", abi_index), stack_offset, width);
+                        if param.ty == IrType::Bool {
+                            self.emit_entry_bool_canonical_check(&format!("a{}", abi_index), &fail_label);
+                        }
                     } else {
                         let caller_stack_offset = (abi_index - 8) * 8;
                         self.emit_entry_witness_scalar_load("t3", stack_offset, width);
+                        if param.ty == IrType::Bool {
+                            self.emit_entry_bool_canonical_check("t3", &fail_label);
+                        }
                         self.emit(format!(
                             "# cellscript entry abi: scalar param {} stored to caller stack +{}",
                             param.name, caller_stack_offset
@@ -606,6 +628,17 @@ impl CodeGenerator {
         }
     }
 
+    fn emit_entry_bool_canonical_check(&mut self, register: &str, fail_label: &str) {
+        let zero_ok = self.fresh_label("entry_bool_zero_ok");
+        let bool_ok = self.fresh_label("entry_bool_canonical_ok");
+        self.emit(format!("beqz {}, {}", register, zero_ok));
+        self.emit("li t2, 1");
+        self.emit(format!("beq {}, t2, {}", register, bool_ok));
+        self.emit(format!("j {}", fail_label));
+        self.emit_label(&zero_ok);
+        self.emit_label(&bool_ok);
+    }
+
     fn emit_entry_load_u32_from_stack(&mut self, dest_reg: &str, stack_offset: usize) {
         self.emit(format!("li {}, 0", dest_reg));
         for byte_index in 0..4 {
@@ -729,9 +762,15 @@ impl CodeGenerator {
             *abi_index += 2;
         } else if *abi_index < 8 {
             self.emit_entry_witness_scalar_load_from_reg(&format!("a{}", *abi_index), "t0", width);
+            if param.ty == IrType::Bool {
+                self.emit_entry_bool_canonical_check(&format!("a{}", *abi_index), fail_label);
+            }
             *abi_index += 1;
         } else {
             self.emit_entry_witness_scalar_load_from_reg("t4", "t0", width);
+            if param.ty == IrType::Bool {
+                self.emit_entry_bool_canonical_check("t4", fail_label);
+            }
             self.emit_entry_abi_reg_arg(*abi_index, "t4", outgoing_stack_arg_bytes);
             *abi_index += 1;
         }

src/codegen/assembler.rs

@@ -633,6 +633,12 @@ impl ParsedAssembly {
                     if !signed_bits_fit(relative_offset(pc, target)?, 13) {
                         relaxed.insert(index);
                     }
+                } else if let Instruction::Jump { label } = inst {
+                    let pc = layout.text_user_base + offset as u64;
+                    let target = self.symbol_address(label, layout)?;
+                    if !signed_bits_fit(relative_offset(pc, target)?, 21) {
+                        relaxed.insert(index);
+                    }
                 }
             }
             offset += op_size(op, offset, SectionKind::Text, index, BranchSizeMode::Conservative);
@@ -1417,7 +1423,11 @@ fn encode_instruction(
         }
         Instruction::Jump { label } => {
             let target = parsed.symbol_address(label, layout)?;
-            out.extend_from_slice(&encode_j_type(0x6f, 0, relative_offset(pc, target)?)?.to_le_bytes());
+            if relaxed_branch {
+                encode_long_jump_sequence(out, pc, target)?;
+            } else {
+                out.extend_from_slice(&encode_j_type(0x6f, 0, relative_offset(pc, target)?)?.to_le_bytes());
+            }
         }
         Instruction::Beq { .. }
         | Instruction::Bne { .. }
@@ -1430,8 +1440,8 @@ fn encode_instruction(
             let (rs1, rs2, label, funct3) = conditional_branch_parts(inst).expect("conditional branch parts");
             let target = parsed.symbol_address(label, layout)?;
             if relaxed_branch {
-                out.extend_from_slice(&encode_b_type(0x63, inverse_branch_funct3(funct3), rs1, rs2, 8)?.to_le_bytes());
-                out.extend_from_slice(&encode_j_type(0x6f, 0, relative_offset(pc + 4, target)?)?.to_le_bytes());
+                out.extend_from_slice(&encode_b_type(0x63, inverse_branch_funct3(funct3), rs1, rs2, 12)?.to_le_bytes());
+                encode_long_jump_sequence(out, pc + 4, target)?;
             } else {
                 out.extend_from_slice(&encode_b_type(0x63, funct3, rs1, rs2, relative_offset(pc, target)?)?.to_le_bytes());
             }
@@ -1493,12 +1503,29 @@ fn encode_call_sequence(out: &mut Vec<u8>, pc: u64, target: u64) -> Result<()> {
     Ok(())
 }
 
+fn encode_long_jump_sequence(out: &mut Vec<u8>, pc: u64, target: u64) -> Result<()> {
+    let scratch = 31;
+    let offset = relative_offset(pc, target)?;
+    if offset % 2 != 0 {
+        return Err(CompileError::new("jump target is not 2-byte aligned", crate::error::Span::default()));
+    }
+    let (hi, lo) = split_hi_lo(offset)?;
+    out.extend_from_slice(&encode_u_type(0x17, scratch, hi).to_le_bytes());
+    out.extend_from_slice(&encode_i_type(0x67, 0, 0b000, scratch, lo)?.to_le_bytes());
+    Ok(())
+}
+
 fn op_size(op: &AsmOp, current_offset: usize, section: SectionKind, op_index: usize, branch_size_mode: BranchSizeMode<'_>) -> usize {
     match op {
         AsmOp::Label(_) => 0,
         AsmOp::Instruction(Instruction::Li { imm, .. }) => li_sequence_size(*imm),
         AsmOp::Instruction(Instruction::La { .. }) => 8,
         AsmOp::Instruction(Instruction::Call { .. }) => 8,
+        AsmOp::Instruction(Instruction::Jump { .. }) => match branch_size_mode {
+            BranchSizeMode::Conservative => 8,
+            BranchSizeMode::Exact(relaxed) if section == SectionKind::Text && relaxed.contains(&op_index) => 8,
+            BranchSizeMode::Exact(_) => 4,
+        },
         AsmOp::Instruction(
             Instruction::Beq { .. }
             | Instruction::Bne { .. }
@@ -1509,8 +1536,8 @@ fn op_size(op: &AsmOp, current_offset: usize, section: SectionKind, op_index: us
             | Instruction::Beqz { .. }
             | Instruction::Bnez { .. },
         ) => match branch_size_mode {
-            BranchSizeMode::Conservative => 8,
-            BranchSizeMode::Exact(relaxed) if section == SectionKind::Text && relaxed.contains(&op_index) => 8,
+            BranchSizeMode::Conservative => 12,
+            BranchSizeMode::Exact(relaxed) if section == SectionKind::Text && relaxed.contains(&op_index) => 12,
             BranchSizeMode::Exact(_) => 4,
         },
         AsmOp::Instruction(_) => 4,

src/codegen/calls.rs

@@ -9,7 +9,7 @@ use crate::error::{CompileError, Result};
 use crate::ir::*;
 use crate::runtime_errors::CellScriptRuntimeError;
 
-use super::abi::{abi_arg_label, call_abi_arg_count, CallLengthKind};
+use super::abi::{abi_arg_label, call_abi_arg_count, outgoing_stack_arg_bytes, CallLengthKind};
 use super::assembler::{scratch_register_avoiding, small_signed_immediate};
 use super::runtime::is_ckb_fixed_hash_helper;
 use super::schema::{fixed_aggregate_pointer_param_width, fixed_byte_pointer_param_width, named_type_name};
@@ -71,7 +71,7 @@ impl CodeGenerator {
         self.emit(format!("# call {}", func));
 
         let abi = self.callable_abis.get(func).cloned();
-        let outgoing_stack_arg_bytes = call_abi_arg_count(abi.as_ref(), args).saturating_sub(8) * 8;
+        let outgoing_stack_arg_bytes = outgoing_stack_arg_bytes(call_abi_arg_count(abi.as_ref(), args));
         let mut abi_index = 0usize;
         for (arg_index, arg) in args.iter().enumerate() {
             if let Some(abi) = &abi {

src/codegen/mod.rs

@@ -58,7 +58,7 @@
 
 use crate::ast::{BinaryOp, ParamSource, UnaryOp};
 use crate::codegen::cell_ops::consumed_operand_var;
-use crate::error::Result;
+use crate::error::{CompileError, Result};
 
 use crate::ir::*;
 use crate::runtime_errors::CellScriptRuntimeError;
@@ -1807,7 +1807,27 @@ impl CodeGenerator {
             }
             IrTerminator::Return(Some(operand)) => {
                 if let IrOperand::Var(v) = operand {
+                    if let IrType::Tuple(items) = &v.ty {
+                        if items.len() > 8 {
+                            return Err(CompileError::new(
+                                format!("tuple return ABI supports at most 8 fields, but return value has {} fields", items.len()),
+                                crate::error::Span::default(),
+                            ));
+                        }
+                        if !self.tuple_aggregate_fields.contains_key(&v.id) {
+                            return Err(CompileError::new(
+                                "tuple return ABI requires a directly materialized tuple aggregate",
+                                crate::error::Span::default(),
+                            ));
+                        }
+                    }
                     if let Some(fields) = self.tuple_aggregate_fields.get(&v.id).cloned() {
+                        if fields.len() > 8 {
+                            return Err(CompileError::new(
+                                format!("tuple return ABI supports at most 8 fields, but return value has {} fields", fields.len()),
+                                crate::error::Span::default(),
+                            ));
+                        }
                         self.emit(format!("# cellscript abi: return tuple aggregate var{} fields={}", v.id, fields.len()));
                         if fields.is_empty() {
                             self.emit("li a0, 0");
@@ -2411,6 +2431,35 @@ mod tests {
         ("tail", "tail target"),
     ];
 
+    #[test]
+    fn outgoing_stack_arg_area_is_16_byte_aligned_at_call_boundaries() {
+        let cases = [(0, 0), (1, 0), (8, 0), (9, 16), (10, 16), (11, 32), (12, 32), (13, 48), (16, 64)];
+
+        for (abi_arg_count, expected_bytes) in cases {
+            let bytes = super::abi::outgoing_stack_arg_bytes(abi_arg_count);
+            assert_eq!(bytes, expected_bytes, "unexpected outgoing stack size for {} ABI args", abi_arg_count);
+            if bytes > 0 {
+                assert_eq!(bytes % 16, 0, "outgoing stack area must preserve RISC-V psABI sp alignment");
+            }
+        }
+    }
+
+    #[test]
+    fn internal_assembler_keeps_near_unconditional_jump_compact() {
+        let lines = vec![
+            ".section .text".to_string(),
+            ".global entry".to_string(),
+            "entry:".to_string(),
+            "j done".to_string(),
+            "done:".to_string(),
+            "ret".to_string(),
+        ];
+
+        let plan = MachineLayoutPlan::build(&lines).expect("near unconditional jump should assemble");
+        assert_eq!(plan.metrics.text_size, 8, "near j should remain a compact 4-byte jal x0 sequence");
+        assert_eq!(plan.metrics.relaxed_branch_count, 0, "near j should not be marked as a relaxed long jump");
+    }
+
     #[test]
     fn internal_assembler_relaxes_out_of_range_conditional_branch() {
         let mut lines = vec![
@@ -2430,6 +2479,39 @@ mod tests {
         assert!(elf.starts_with(b"\x7fELF"));
     }
 
+    #[test]
+    fn internal_assembler_encodes_far_unconditional_jump() {
+        let lines = vec![
+            ".section .text".to_string(),
+            ".global entry".to_string(),
+            "entry:".to_string(),
+            "j far_target".to_string(),
+            format!(".ascii \"{}\"", "x".repeat(1_100_000)),
+            "far_target:".to_string(),
+            "ret".to_string(),
+        ];
+
+        let elf = assemble_elf_internal(&lines).expect("internal assembler should encode far unconditional jumps");
+        assert!(elf.starts_with(b"\x7fELF"));
+    }
+
+    #[test]
+    fn internal_assembler_relaxes_far_conditional_branch_with_long_jump() {
+        let lines = vec![
+            ".section .text".to_string(),
+            ".global entry".to_string(),
+            "entry:".to_string(),
+            "li a0, 0".to_string(),
+            "beqz a0, far_target".to_string(),
+            format!(".ascii \"{}\"", "x".repeat(1_100_000)),
+            "far_target:".to_string(),
+            "ret".to_string(),
+        ];
+
+        let elf = assemble_elf_internal(&lines).expect("internal assembler should relax far conditional branches through long jumps");
+        assert!(elf.starts_with(b"\x7fELF"));
+    }
+
     #[test]
     fn internal_assembler_encodes_register_conditional_branches() {
         for mnemonic in ["beq", "bne", "blt", "bge", "bltu", "bgeu"] {