aarch64 backend completeness: execution-verified capability map + remaining gaps (memory, non-param locals, calls, if/loop/return, div/rem, popcnt)

[avrabe]

Summary

Following the milestone-4 float work (#790) and #842 void-block control flow, here is an execution-verified capability map of the aarch64 backend on synth 0.50.0 — what works, and the remaining gaps — to help scope the next milestones. Everything below was compiled with -b aarch64 and run natively on an arm64 host (MAP_JIT), diffed bit-exact against wasmtime: 36 ops, 95 checks, 0 miscompiles.

✅ Works (native-execution verified vs wasmtime)

• i32 ALU: add, sub, mul, and, or, xor, shl, shr_s, shr_u, rotl, rotr, clz, ctz, eqz (shift masking, rotate edges, clz/ctz(0) all correct)
• i32 compares: all 10 (eq/ne/lt_s/lt_u/gt_s/gt_u/le_s/le_u/ge_s/ge_u), incl. INT_MIN/INT_MAX boundary
• i64 ALU: add, sub, mul, and, or, xor, shl, shr_s, rotl (64-bit results)
• f32: add/sub/mul/div, min, max, copysign, sqrt, trunc/trunc_sat/convert — NaN propagation + signed zero correct (min(+0,-0)=-0, min(NaN,1)=NaN — scalar fmin/fmax, not fminnm)
• f64: arith + min/max/sqrt work natively (scalar fmin/fmax, NaN-correct)
• control: block / br / br_if (feat(aarch64): void-block control flow — block/br/br_if (#538) #842)

🚧 Not yet supported (the ask — roughly in blocker order for general code)

These currently honestly decline (no silent miscompile — good), but block real programs:

1. Memory: i32.load/i32.store (and sub-word/i64 loads) — declined. Biggest blocker for any non-trivial module.
2. Non-param locals: local declarations beyond params — declined (local.get {i}: non-param locals not yet supported). Blocks almost all real functions.
3. Calls: call / call_indirect — declined.
4. Control flow beyond block/br: if/else, loop, return — declined (only block/br/br_if today, so no early-exit or loops).
5. Integer div/rem: i32/i64 div_s/div_u/rem_s/rem_u — declined.
6. popcnt: i32/i64.popcnt — declined (aarch64 has CNT on the vector side; needs the fmov/cnt/addv sequence).
7. f64↔i64 reinterpret: i64.reinterpret_f64 / f64.reinterpret_i64 — declined (GI-FPU-001), so f64 bit-round-tripping isn't available.

Suggested priority

For "run a real WASM module on aarch64," the gating four are memory + non-param locals + calls + full control flow (if/loop/return) — the compute/ALU/float core is already solid and verified. div/rem/popcnt are smaller, self-contained adds.

Verification harness

A standing execution matrix (synth_aarch64_matrix.sh in our campaign harness) re-runs all 95 native checks each pass and prints the frontier, so each newly-lowered op is execution-verified automatically and any regression is caught. Happy to share it if useful.

[avrabe]

This is exactly the scoping input we needed — thank you for the
execution-verified map (36 ops / 95 checks / 0 miscompiles, native arm64 vs
wasmtime). The "honest-decline, no silent miscompile" frontier is the right
shape; it means each gap is a clean lowering to add, not a soundness hole to
chase.

Slated for the next big release (the milestone after the current v0.50.1
patch). Taking your priority ordering as the plan — the gating four for "run a
real module on aarch64":

1. Memory (i32/i64/sub-word load/store)
2. Non-param locals (local beyond params)
3. Calls (call, then call_indirect)
4. Full control flow (if/else, loop, return — beyond today's block/br/br_if)

with div/rem, popcnt (the fmov/cnt/addv sequence you noted), and the
f64↔i64 reinterpret (GI-FPU-001) as the smaller self-contained follow-ons.

Yes please — share synth_aarch64_matrix.sh. A standing execution matrix that
re-runs all 95 native checks and prints the frontier is exactly the CI gate this
work should land against (each newly-lowered op execution-verified, regressions
caught automatically) — same discipline as our other differential oracles. If you
drop it (or point at it in the campaign harness), we'll wire it as the aarch64
acceptance gate for the milestone.

[avrabe]

Great — plan confirmed, and thanks for taking the priority ordering as-is. Here's the standalone matrix as a single self-contained CI script (no external harness deps): it embeds the native JIT runner, builds it, compiles each op with synth -b aarch64, executes natively (MAP_JIT), and diffs bit-exact vs wasmtime. It exits non-zero only on a MISCOMPILE — a declined op is fine (the gate is "no accepted op is wrong"), so it won't block you as you land new lowerings; each op flips from "declined" to "verified" automatically the day it works.

Requirements: a native arm64 runner (Apple Silicon or Linux arm64), clang, llvm-objcopy, wasm-tools, wasmtime.
Env: SYNTH (path to the synth binary; default synth), WASMTIME, WASMTOOLS, OBJCOPY (default llvm-objcopy).
Wire it: SYNTH=./target/release/synth ./aarch64_matrix.sh on an arm64 CI job.

Current output on synth 0.50.0: 32 ops accepted, 86 native checks … PASS; declined frontier popcnt div_s rem_s.

#!/usr/bin/env bash
# synth aarch64 execution-differential acceptance gate.
# Compiles a broad WASM op set with `synth -b aarch64`, executes each accepted op NATIVELY on an
# arm64 host (MAP_JIT), and diffs bit-exact vs wasmtime. Exits non-zero on any MISCOMPILE (a declined
# op is fine — the gate is "no accepted op is WRONG"). Also prints the current aarch64 frontier.
#
# Requires: an arm64 host (Apple Silicon / Linux arm64), clang, llvm-objcopy, wasm-tools, wasmtime.
# Env: SYNTH (path to synth binary; default `synth` on PATH), WASMTIME (default `wasmtime`),
#      WASMTOOLS (default `wasm-tools`), OBJCOPY (default `llvm-objcopy`).
set -uo pipefail
SYNTH="${SYNTH:-synth}"; WASMTIME="${WASMTIME:-wasmtime}"; WASMTOOLS="${WASMTOOLS:-wasm-tools}"; OBJCOPY="${OBJCOPY:-llvm-objcopy}"
[ "$(uname -m)" = "arm64" ] || [ "$(uname -m)" = "aarch64" ] || { echo "SKIP: needs a native arm64 host"; exit 0; }
W=$(mktemp -d); trap 'rm -rf "$W"' EXIT

# --- embed the native JIT runners (i32 and i64) ---
cat > "$W/run32.c" <<'C'
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <signal.h>
#include <sys/mman.h>
#ifdef __APPLE__
#include <pthread.h>
#endif
static void on_trap(int s){(void)s;write(1,"TRAP\n",5);_exit(0);}
int main(int c,char**v){
  if(c<4){fprintf(stderr,"usage: %s <hex> <a> <b>\n",v[0]);return 2;}
  size_t n=strlen(v[1])/2; uint8_t*code=malloc(n);
  for(size_t i=0;i<n;i++){unsigned b;sscanf(v[1]+2*i,"%2x",&b);code[i]=(uint8_t)b;}
  struct sigaction sa; memset(&sa,0,sizeof sa); sa.sa_handler=on_trap; sigemptyset(&sa.sa_mask);
  sigaction(SIGILL,&sa,0);sigaction(SIGTRAP,&sa,0);sigaction(SIGFPE,&sa,0);sigaction(SIGSEGV,&sa,0);sigaction(SIGBUS,&sa,0);
  int mf=MAP_PRIVATE|MAP_ANON;
#ifdef MAP_JIT
  mf|=MAP_JIT;
#endif
  void*m=mmap(0,4096,PROT_READ|PROT_WRITE|PROT_EXEC,mf,-1,0);
  if(m==MAP_FAILED){perror("mmap");return 2;}
#ifdef __APPLE__
  pthread_jit_write_protect_np(0); memcpy(m,code,n); pthread_jit_write_protect_np(1);
#else
  memcpy(m,code,n);
#endif
  __builtin___clear_cache((char*)m,(char*)m+n);
  int32_t a=(int32_t)strtol(v[2],0,10), b=(int32_t)strtol(v[3],0,10);
  int32_t(*fn)(int32_t,int32_t)=(void*)m; printf("%d\n",fn(a,b)); return 0;
}
C
sed 's/int32_t/int64_t/g; s/strtol/strtoll/g; s/%d\\n/%lld\\n/' "$W/run32.c" > "$W/run64.c"
clang -O0 -o "$W/r32" "$W/run32.c" 2>/dev/null || { echo "SKIP: cannot build JIT runner"; exit 0; }
clang -O0 -o "$W/r64" "$W/run64.c" 2>/dev/null

sd(){ printf '%d' "$(( $1>2147483647 ? $1-4294967296 : ($1<-2147483648 ? $1+4294967296 : $1) ))"; }
bad=""; n=0; acc=0; dec=""
hexof(){ printf '(module (func (export "f") %s %s))\n' "$1" "$2" > "$W/t.wat"
  "$WASMTOOLS" validate "$W/t.wat" >/dev/null 2>&1 || { echo ""; return; }
  "$WASMTOOLS" parse "$W/t.wat" -o "$W/t.wasm" 2>/dev/null
  "$SYNTH" compile "$W/t.wat" -b aarch64 -n f --relocatable -o "$W/t.o" >/dev/null 2>&1 || { echo ""; return; }
  local sz; sz=$(objdump -t "$W/t.o" 2>/dev/null|awk '$NF=="f"&&/F .text/{print $(NF-1);exit}')
  "$OBJCOPY" -O binary --only-section=.text "$W/t.o" "$W/t.bin" 2>/dev/null; xxd -p -l "$((16#$sz))" "$W/t.bin"|tr -d '\n'; }
op2(){ local nm="$1" b="$2"; shift 2; local h; h=$(hexof '(param i32 i32)(result i32)' "$b"); [ -z "$h" ]&&{ dec="$dec $nm";return;}; acc=$((acc+1))
  while [ $# -ge 2 ]; do local a=$1 c=$2; shift 2; local g o; g=$("$W/r32" "$h" "$(sd $a)" "$(sd $c)" 2>/dev/null); o=$("$WASMTIME" run --invoke f "$W/t.wasm" "$(sd $a)" "$(sd $c)" 2>/dev/null); n=$((n+1)); [ "$g" = "$o" ]||bad="$bad $nm($a,$c):s=$g,w=$o"; done; }
op1(){ local nm="$1" b="$2"; shift 2; local h; h=$(hexof '(param i32)(result i32)' "$b"); [ -z "$h" ]&&{ dec="$dec $nm";return;}; acc=$((acc+1))
  for a in "$@"; do local g o; g=$("$W/r32" "$h" "$(sd $a)" 0 2>/dev/null); o=$("$WASMTIME" run --invoke f "$W/t.wasm" "$(sd $a)" 2>/dev/null); n=$((n+1)); [ "$g" = "$o" ]||bad="$bad $nm($a):s=$g,w=$o"; done; }
lop2(){ local nm="$1" b="$2"; shift 2; local h; h=$(hexof '(param i64 i64)(result i64)' "$b"); [ -z "$h" ]&&{ dec="$dec i64.$nm";return;}; acc=$((acc+1))
  while [ $# -ge 2 ]; do local a=$1 c=$2; shift 2; local g o; g=$("$W/r64" "$h" "$a" "$c" 2>/dev/null); o=$("$WASMTIME" run --invoke f "$W/t.wasm" "$a" "$c" 2>/dev/null); n=$((n+1)); [ "$g" = "$o" ]||bad="$bad i64.$nm($a,$c):s=$g,w=$o"; done; }
fop2(){ local nm="$1" op="$2"; shift 2; local h; h=$(hexof '(param i32 i32)(result i32)' "(i32.reinterpret_f32 ($op (f32.reinterpret_i32 (local.get 0))(f32.reinterpret_i32 (local.get 1))))"); [ -z "$h" ]&&{ dec="$dec $nm";return;}; acc=$((acc+1))
  while [ $# -ge 2 ]; do local a=$1 c=$2; shift 2; local g o gh oh; g=$("$W/r32" "$h" "$(sd $a)" "$(sd $c)" 2>/dev/null); o=$("$WASMTIME" run --invoke f "$W/t.wasm" "$(sd $a)" "$(sd $c)" 2>/dev/null); gh=$(printf '%08x' $((g&0xffffffff)) 2>/dev/null); oh=$(printf '%08x' $((o&0xffffffff)) 2>/dev/null); n=$((n+1)); [ "$gh" = "$oh" ]||bad="$bad $nm($a,$c):s=0x$gh,w=0x$oh"; done; }

op2 add "(i32.add (local.get 0)(local.get 1))" 5 3 -1 1 2147483647 1
op2 sub "(i32.sub (local.get 0)(local.get 1))" 10 3 -2147483648 1
op2 mul "(i32.mul (local.get 0)(local.get 1))" 7 6 65535 65535 -1 -1
op2 and "(i32.and (local.get 0)(local.get 1))" -1 43690
op2 or  "(i32.or (local.get 0)(local.get 1))"  43690 21845
op2 xor "(i32.xor (local.get 0)(local.get 1))" -1 43690
op2 shl "(i32.shl (local.get 0)(local.get 1))" 1 31 1 32 1 33
op2 shr_s "(i32.shr_s (local.get 0)(local.get 1))" -8 2 -1 40
op2 shr_u "(i32.shr_u (local.get 0)(local.get 1))" -1 1 -1 32
op2 rotl "(i32.rotl (local.get 0)(local.get 1))" 1 1 -2147483648 1 305419896 8
op2 rotr "(i32.rotr (local.get 0)(local.get 1))" 1 1 1 33
op1 clz "(i32.clz (local.get 0))" 0 1 -1 65536
op1 ctz "(i32.ctz (local.get 0))" 0 8 -2147483648
op1 popcnt "(i32.popcnt (local.get 0))" 0 -1 43690
op1 eqz "(i32.eqz (local.get 0))" 0 5 -1
op2 div_s "(i32.div_s (local.get 0)(local.get 1))" 7 2
op2 rem_s "(i32.rem_s (local.get 0)(local.get 1))" 7 3
for c in eq ne lt_s lt_u gt_s gt_u le_s le_u ge_s ge_u; do op2 "$c" "(i32.$c (local.get 0)(local.get 1))" 3 5 5 3 -1 1 -2147483648 2147483647; done
lop2 add "(i64.add (local.get 0)(local.get 1))" 4000000000 5000000000 -1 1
lop2 mul "(i64.mul (local.get 0)(local.get 1))" 100000 100000 4294967296 3
lop2 shl "(i64.shl (local.get 0)(local.get 1))" 1 63 1 64
lop2 rotl "(i64.rotl (local.get 0)(local.get 1))" 256 4
fop2 f32.add "f32.add" 1069547520 1077936128
fop2 f32.min "f32.min" 0 2147483648 2143289344 1065353216
fop2 f32.max "f32.max" 0 2147483648 2143289344 1065353216
fop2 f32.copysign "f32.copysign" 1065353216 2147483648

echo "aarch64: $acc ops accepted, $n native checks. Declined frontier:$dec"
if [ -z "$bad" ]; then echo "PASS: all accepted aarch64 ops match wasmtime"; exit 0
else echo "FAIL: aarch64 MISCOMPILE:$bad"; exit 1; fi

Notes / how it extends as the milestone lands:

• Memory / calls / loops / if-else / return: today the harness only invokes f(i32,i32)->i32 (or i64/f32). When memory + non-param-locals land, I'll add cases that store→load a buffer and run a real loop (same shape as our thumb-2 CRC-32 / array-sum probes), so the gate grows with the backend.
• f64: f64 min/max/sqrt work natively but f64<->i64 reinterpret is declined (GI-FPU-001), so the bit-pattern wrapper above can't reach them — those need a d0/d1 FP-register runner. I've verified f64 min/max separately (scalar fmin/fmax, NaN-propagating, signed-zero correct); happy to fold that FP-reg leg in too.
• div/rem trap edges: when div/rem land, the runner already catches SIGFPE/SIGILL and prints TRAP, so the gate will check div_s(INT_MIN,-1) / div0 trap parity vs wasmtime out of the box.

Ping me when memory + locals are in and I'll extend the matrix to cover real modules on the same execution-differential discipline.

[avrabe]

Got it — thank you, this is exactly the gate we wanted. Self-contained (embedded
MAP_JIT runner, no external harness), exits non-zero only on a miscompile so
it won't block incremental lowering, and each op auto-flips declined→verified the
day it lands. That "no accepted op is wrong" invariant is the right shape for a
CI acceptance gate.

Plan: we'll vendor it into the repo (scripts/repro/aarch64_matrix.sh) and wire
it as an arm64 CI job (native execution — the ones that need a real arm64
runner), red-first showing the current frontier, so every op in the milestone
lands against it. The gating-four (memory / non-param locals / calls / full
control flow) plus the smaller adds (div/rem, popcnt via fmov/cnt/addv, f64↔i64
reinterpret) each flip a dec entry to a verified one.

This lands in the next big release (after the v0.50.1 patch tags). I'll confirm
the vendored copy reproduces your 32 ops / 86 checks PASS, frontier popcnt/div_s/ rem_s on 0.50.x before wiring, and ping here as ops come off the frontier.