Implement inline stack probes for AArch64 (#5353)

* Turn off probestack by default in Cranelift

The probestack feature is not implemented for the aarch64 and s390x
backends and currently the on-by-default status requires the aarch64 and
s390x implementations to be a stub. Turning off probestack by default
allows the s390x and aarch64 backends to panic with an error message to
avoid providing a false sense of security. When the probestack option is
implemented for all backends, however, it may be reasonable to
re-enable.

* aarch64: Improve codegen for AMode fallback

Currently the final fallback for finalizing an `AMode` will generate
both a constant-loading instruction as well as an `add` instruction to
the base register into the same temporary. This commit improves the
codegen by removing the `add` instruction and folding the final add into
the finalized `AMode`. This changes the `extendop` used but both
registers are 64-bit so shouldn't be affected by the extending
operation.

* aarch64: Implement inline stack probes

This commit implements inline stack probes for the aarch64 backend in
Cranelift. The support here is modeled after the x64 support where
unrolled probes are used up to a particular threshold after which a loop
is generated. The instructions here are similar in spirit to x64 except
that unlike x64 the stack pointer isn't modified during the unrolled
loop to avoid needing to re-adjust it back up at the end of the loop.

* Enable inline probestack for AArch64 and Riscv64

This commit enables inline probestacks for the AArch64 and Riscv64
architectures in the same manner that x86_64 has it enabled now. Some
more testing was additionally added since on Unix platforms we should be
guaranteed that Rust's stack overflow message is now printed too.

* Enable probestack for aarch64 in cranelift-fuzzgen

* Address review comments

* Remove implicit stack overflow traps from x64 backend

This commit removes implicit `StackOverflow` traps inserted by the x64
backend for stack-based operations. This was historically required when
stack overflow was detected with page faults but Wasmtime no longer
requires that since it's not suitable for wasm modules which call host
functions. Additionally no other backend implements this form of
implicit trap-code additions so this is intended to synchronize the
behavior of all the backends.

This fixes a test added prior for aarch64 to properly abort the process
instead of accidentally being caught by Wasmtime.

* Fix a style issue

tests/host_segfault.rs

@@ -144,6 +144,16 @@ fn main() {
             },
             true,
         ),
+        (
+            "overrun 8k with misconfigured host",
+            || overrun_with_big_module(8 << 10),
+            true,
+        ),
+        (
+            "overrun 32k with misconfigured host",
+            || overrun_with_big_module(32 << 10),
+            true,
+        ),
         #[cfg(not(any(target_arch = "riscv64")))]
         // Due to `InstanceAllocationStrategy::pooling()` trying to alloc more than 6000G memory space.
         // https://gitlab.com/qemu-project/qemu/-/issues/1214
@@ -178,6 +188,7 @@ fn main() {
         }
         Err(_) => {
             for (name, _test, stack_overflow) in tests {
+                println!("running {name}");
                 run_test(name, *stack_overflow);
             }
         }
@@ -245,7 +256,7 @@ fn is_stack_overflow(status: &ExitStatus, stderr: &str) -> bool {
     use std::os::unix::prelude::*;
 
     // The main thread might overflow or it might be from a fiber stack (SIGSEGV/SIGBUS)
-    stderr.contains("thread 'main' has overflowed its stack")
+    stderr.contains("has overflowed its stack")
         || match status.signal() {
             Some(libc::SIGSEGV) | Some(libc::SIGBUS) => true,
             _ => false,
@@ -267,3 +278,47 @@ fn is_stack_overflow(status: &ExitStatus, _stderr: &str) -> bool {
         _ => false,
     }
 }
+
+fn overrun_with_big_module(approx_stack: usize) {
+    // Each call to `$get` produces ten 8-byte values which need to be saved
+    // onto the stack, so divide `approx_stack` by 80 to get
+    // a rough number of calls to consume `approx_stack` stack.
+    let n = approx_stack / 10 / 8;
+
+    let mut s = String::new();
+    s.push_str("(module\n");
+    s.push_str("(func $big_stack\n");
+    for _ in 0..n {
+        s.push_str("call $get\n");
+    }
+    for _ in 0..n {
+        s.push_str("call $take\n");
+    }
+    s.push_str(")\n");
+    s.push_str("(func $get (result i64 i64 i64 i64 i64 i64 i64 i64 i64 i64) call $big_stack unreachable)\n");
+    s.push_str("(func $take (param i64 i64 i64 i64 i64 i64 i64 i64 i64 i64) unreachable)\n");
+    s.push_str("(func (export \"\") call $big_stack)\n");
+    s.push_str(")\n");
+
+    // Give 100MB of stack to wasm, representing a misconfigured host. Run the
+    // actual module on a 2MB stack in a child thread to guarantee that the
+    // module here will overrun the stack. This should deterministically hit the
+    // guard page.
+    let mut config = Config::default();
+    config.max_wasm_stack(100 << 20).async_stack_size(100 << 20);
+    let engine = Engine::new(&config).unwrap();
+    let module = Module::new(&engine, &s).unwrap();
+    let mut store = Store::new(&engine, ());
+    let i = Instance::new(&mut store, &module, &[]).unwrap();
+    let f = i.get_typed_func::<(), ()>(&mut store, "").unwrap();
+    std::thread::Builder::new()
+        .stack_size(2 << 20)
+        .spawn(move || {
+            println!("{CONFIRM}");
+            f.call(&mut store, ()).unwrap();
+        })
+        .unwrap()
+        .join()
+        .unwrap();
+    unreachable!();
+}