keccak: don't assume SHA3 extensions on iOS (SIGILL on A12 and older) - #9
Open
AskAlexSharov wants to merge 4 commits into
Open
keccak: don't assume SHA3 extensions on iOS (SIGILL on A12 and older)#9AskAlexSharov wants to merge 4 commits into
AskAlexSharov wants to merge 4 commits into
Conversation
x/sys/cpu performs no CPU feature detection on Darwin-family systems (its arm64 doinit is empty there), so cpu.ARM64.HasSHA3 is always false and the GOOS shortcut alone decides whether the SHA3 assembly runs. That assumption is correct for macOS — arm64 macOS implies M1 or newer, which all implement FEAT_SHA3 — but wrong for iOS: FEAT_SHA3 first shipped in the Apple A13, and A12-class devices (iPhone XS/XR, iPad 8th gen, iPad Air 3, iPad mini 5) are still supported by current iOS. On those devices the first permutation executes VEOR3 and crashes with SIGILL. The Go standard library gates its equivalent assumption with 'darwin && !ios' (internal/cpu/cpu_arm64_darwin.go) for the same reason. Drop the ios clause so iOS falls back to x/crypto/sha3.
There was a problem hiding this comment.
Pull request overview
This PR fixes a crash on older iOS arm64 devices by preventing the SHA3-extension (Armv8.2-A) keccak assembly from being enabled solely based on GOOS=ios, which could otherwise execute unsupported instructions (SIGILL on A12 and older).
Changes:
- Remove the
runtime.GOOS == "ios"shortcut from the assembly gating logic. - Expand the comment to document why iOS is excluded and how this matches Go’s standard library behavior.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Go's standard library does not assume SHA3 on darwin — it probes hw.optional sysctls in internal/cpu under a 'darwin && !ios' build tag. The accurate statement is that iOS gets no feature detection at all, so std's SHA3 assembly never runs there either.
AskAlexSharov
force-pushed
the
fix/ios-sha3-detection
branch
from
July 20, 2026 08:16
270303a to
0042f38
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
keccak_arm64.goenables the SHA3-extension assembly wheneverGOOSisdarwinorios:x/sys/cpuperforms no feature detection on Darwin-family systems — its arm64doinit()is empty there (cpu_other_arm64.go), socpu.ARM64.HasSHA3is always false and the GOOS shortcut alone decides.VEOR3→ SIGILL.The Go standard library gates its equivalent assumption with
darwin && !ios(internal/cpu/cpu_arm64_darwin.go) for exactly this reason.Fix
Drop the
iosclause. iOS falls back tox/crypto/sha3(runtime detection is not possible there viax/sys/cpu), matching upstream Go's behavior.Testing
go test ./...+ 45s fuzz vs x/crypto on arm64 (native): passGOOS=ios GOARCH=arm64 go build: compilesgo vet: clean