Aarch64 Android平台汇编非法指令异常问题排查求助

我正在开发基于Aarch64架构的Forth解释器，采用C、内联汇编及动态生成汇编代码混合实现。运行单元测试时，程序因"非法指令"被终止。该代码在标准Aarch64 Linux（如Qemu上的Ubuntu或AWS上的Amazon Linux）中可正常运行，但在未root的Android设备Termux环境下崩溃。

GDB调试会话记录 #

...
../test/Testipf_core.c:968:test_pick_roll:PASS
../test/Testipf_core.c:969:test_parse_word:PASS
../test/Testipf_core.c:970:test_find:PASS

Program received signal SIGILL, Illegal instruction.
0x0000007ff6e37020 in ?? ()
(gdb) disassemble 0x0000007ff6e37010,+64
Dump of assembler code from 0x7ff6e37010 to 0x7ff6e37050:
   0x0000007ff6e37010:  blr     x28
   0x0000007ff6e37014:  mov     x28, #0xa74                     // #2676
   0x0000007ff6e37018:  add     x28, x28, x23
   0x0000007ff6e3701c:  blr     x28
=> 0x0000007ff6e37020:  ldr     x30, [sp], #16
   0x0000007ff6e37024:  ret

(gdb) info registers lr sp x28
lr             0x7ff6e37020        549602947104
sp             0x7fffffe2f0        0x7fffffe2f0
x28            0x300001af14        206158540564
(gdb) disassemble 0x300001af14,40
Dump of assembler code from 0x300001af14 to 0x28:
End of assembler dump.
(gdb) disassemble 0x300001af14,+40
Dump of assembler code from 0x300001af14 to 0x300001af3c:
   0x000000300001af14 <xt_two_star+0>:  mov     x0, x19
   0x000000300001af18 <xt_two_star+4>:  str     x30, [sp, #-16]!
   0x000000300001af1c <xt_two_star+8>:  bl      0x3000016fd4 <c_two_star>
   0x000000300001af20 <xt_two_star+12>: ldr     x30, [sp], #16
   0x000000300001af24 <xt_two_star+16>: mov     x19, x0
   0x000000300001af28 <xt_exit_two_star+0>:     ret
   0x000000300001af2c <nt_two_slash+0>: udf     #36
   0x000000300001af30 <nt_two_slash+4>: .inst   0x002f3202 ; NYI
   0x000000300001af34 <nt_two_slash+8>: adrp    x0, 0x302801a000
   0x000000300001af38 <xt_two_slash+0>: mov     x0, x19
End of assembler dump.
(gdb) x/10xg 0x7fffffe2f0
0x7fffffe2f0:   0x0000003000017a4c      0x000000300001cf0c
0x7fffffe300:   0x0000007ff6e38fb8      0x0000007ff6e37ed0
0x7fffffe310:   0x0000000000014b75      0x000000300001a578
0x7fffffe320:   0x0000007ff70ec000      0x0000007fffffe3c0
0x7fffffe330:   0x000000300004094c      0x0000007ff4ade3d0

(gdb) disassemble 0x0000003000017a40, +20
Dump of assembler code from 0x3000017a40 to 0x3000017a54:
   0x0000003000017a40 <ipf_execute+64>: stp     x14, x15, [sp, #16]
   0x0000003000017a44 <ipf_execute+68>: stp     x18, x29, [sp, #32]
   0x0000003000017a48 <ipf_execute+72>: blr     x8
   0x0000003000017a4c <ipf_execute+76>: ldp     x18, x29, [sp, #32]
   0x0000003000017a50 <ipf_execute+80>: ldp     x14, x15, [sp, #16]

预期与实际差异 #

预期程序执行ret指令后会跳转到地址0x0000003000017a4c继续运行，但实际触发了非法指令异常。

内容的提问来源于stack exchange，提问作者Ivan Priesol