ci: Move dist-aarch64-linux to an aarch64 runner

Move the dist-aarch64-linux CI job to an aarch64 runner instead of
cross-compiling it from an x86 one. This will make it possible to
perform optimisations such as LTO, PGO and BOLT later on.

src/ci/docker/host-aarch64/dist-aarch64-linux/Dockerfile

@@ -0,0 +1,101 @@
+# We document platform support for minimum glibc 2.17 and kernel 3.2.
+# CentOS 7 has headers for kernel 3.10, but that's fine as long as we don't
+# actually use newer APIs in rustc or std without a fallback. It's more
+# important that we match glibc for ELF symbol versioning.
+FROM centos:7
+
+WORKDIR /build
+
+# CentOS 7 EOL is June 30, 2024, but the repos remain in the vault.
+RUN sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
+  -e 's!^#baseurl=http://mirror.centos.org/!baseurl=https://vault.centos.org/!'
+RUN sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
+
+RUN yum upgrade -y && \
+    yum install -y \
+      automake \
+      bzip2 \
+      file \
+      gcc \
+      gcc-c++ \
+      git \
+      glibc-devel.i686 \
+      glibc-devel.x86_64 \
+      libedit-devel \
+      libstdc++-devel.i686 \
+      libstdc++-devel.x86_64 \
+      make \
+      ncurses-devel \
+      openssl-devel \
+      patch \
+      perl \
+      perl-core \
+      pkgconfig \
+      python3 \
+      unzip \
+      wget \
+      xz \
+      zlib-devel.i686 \
+      zlib-devel.x86_64 \
+      && yum clean all
+
+RUN mkdir -p /rustroot/bin
+
+ENV PATH=/rustroot/bin:$PATH
+ENV LD_LIBRARY_PATH=/rustroot/lib64:/rustroot/lib32:/rustroot/lib
+ENV PKG_CONFIG_PATH=/rustroot/lib/pkgconfig
+WORKDIR /tmp
+RUN mkdir /home/user
+COPY host-aarch64/dist-aarch64-linux/shared.sh /tmp/
+
+# Need at least GCC 5.1 to compile LLVM
+COPY host-aarch64/dist-aarch64-linux/build-gcc.sh /tmp/
+RUN ./build-gcc.sh && yum remove -y gcc gcc-c++
+
+ENV CC=gcc CXX=g++
+
+# LLVM 17 needs cmake 3.20 or higher.
+COPY scripts/cmake.sh /tmp/
+RUN ./cmake.sh
+
+# Build LLVM+Clang
+COPY host-aarch64/dist-aarch64-linux/build-clang.sh /tmp/
+RUN ./build-clang.sh
+ENV CC=clang CXX=clang++
+
+# Build zstd to enable `llvm.libzstd`.
+COPY host-aarch64/dist-aarch64-linux/build-zstd.sh /tmp/
+RUN ./build-zstd.sh
+
+COPY scripts/sccache.sh /scripts/
+RUN sh /scripts/sccache.sh
+
+ENV PGO_HOST=aarch64-unknown-linux-gnu
+ENV HOSTS=aarch64-unknown-linux-gnu
+
+ENV CPATH=/usr/include/aarch64-linux-gnu/:$CPATH
+
+ENV RUST_CONFIGURE_ARGS \
+      --build=aarch64-unknown-linux-gnu \
+      --enable-full-tools \
+      --enable-profiler \
+      --enable-sanitizers \
+      --enable-compiler-docs \
+      --set target.aarch64-unknown-linux-gnu.linker=clang \
+      --set target.aarch64-unknown-linux-gnu.ar=/rustroot/bin/llvm-ar \
+      --set target.aarch64-unknown-linux-gnu.ranlib=/rustroot/bin/llvm-ranlib \
+      --set llvm.link-shared=true \
+      --set llvm.thin-lto=false \
+      --set llvm.libzstd=true \
+      --set llvm.ninja=false \
+      --set rust.debug-assertions=false \
+      --set rust.jemalloc \
+      --set rust.use-lld=true \
+      --set rust.codegen-units=1
+
+ENV SCRIPT python3 ../x.py dist --host $HOSTS --target $HOSTS
+
+ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=clang
+ENV DIST_SRC 1
+ENV LIBCURL_NO_PKG_CONFIG 1
+ENV DIST_REQUIRE_ALL_TOOLS 1

src/ci/docker/host-aarch64/dist-aarch64-linux/build-clang.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -ex
+
+source shared.sh
+
+# Try to keep the LLVM version here in sync with src/ci/scripts/install-clang.sh
+LLVM=llvmorg-19.1.5
+
+mkdir llvm-project
+cd llvm-project
+
+curl -L https://github.com/llvm/llvm-project/archive/$LLVM.tar.gz | \
+  tar xzf - --strip-components=1
+
+mkdir clang-build
+cd clang-build
+
+# For whatever reason the default set of include paths for clang is different
+# than that of gcc. As a result we need to manually include our sysroot's
+# include path, /rustroot/include, to clang's default include path.
+INC="/rustroot/include:/usr/include"
+
+# We need compiler-rt for the profile runtime (used later to PGO the LLVM build)
+# but sanitizers aren't currently building. Since we don't need those, just
+# disable them. BOLT is used for optimizing LLVM.
+hide_output \
+    cmake ../llvm \
+      -DCMAKE_BUILD_TYPE=Release \
+      -DCMAKE_INSTALL_PREFIX=/rustroot \
+      -DCOMPILER_RT_BUILD_SANITIZERS=OFF \
+      -DCOMPILER_RT_BUILD_XRAY=OFF \
+      -DCOMPILER_RT_BUILD_MEMPROF=OFF \
+      -DCOMPILER_RT_BUILD_CTX_PROFILE=OFF \
+      -DLLVM_TARGETS_TO_BUILD=AArch64 \
+      -DLLVM_INCLUDE_BENCHMARKS=OFF \
+      -DLLVM_INCLUDE_TESTS=OFF \
+      -DLLVM_INCLUDE_EXAMPLES=OFF \
+      -DLLVM_ENABLE_PROJECTS="clang;lld;compiler-rt;bolt" \
+      -DC_INCLUDE_DIRS="$INC"
+
+hide_output make -j$(nproc)
+hide_output make install
+
+cd ../..
+rm -rf llvm-project

src/ci/docker/host-aarch64/dist-aarch64-linux/build-gcc.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -ex
+
+source shared.sh
+
+# Note: in the future when bumping to version 10.1.0, also take care of the sed block below.
+GCC=9.5.0
+
+curl https://ftp.gnu.org/gnu/gcc/gcc-$GCC/gcc-$GCC.tar.xz | xzcat | tar xf -
+cd gcc-$GCC
+
+# FIXME(#49246): Remove the `sed` below.
+#
+# On 2018 March 21st, two Travis builders' cache for Docker are suddenly invalidated. Normally this
+# is fine, because we just need to rebuild the Docker image. However, it reveals a network issue:
+# downloading from `ftp://gcc.gnu.org/` from Travis (using passive mode) often leads to "Connection
+# timed out" error, and even when the download completed, the file is usually corrupted. This causes
+# nothing to be landed that day.
+#
+# We observed that the `gcc-4.8.5.tar.bz2` above can be downloaded successfully, so as a stability
+# improvement we try to download from the HTTPS mirror instead. Turns out this uncovered the third
+# bug: the host `gcc.gnu.org` and `cygwin.com` share the same IP, and the TLS certificate of the
+# latter host is presented to `wget`! Therefore, we choose to download from the insecure HTTP server
+# instead here.
+#
+# Note: in version 10.1.0, the URL used in `download_prerequisites` has changed from using FTP to
+# using HTTP. When bumping to that gcc version, we can likely remove the sed replacement below, or
+# the expression will need to be updated. That new URL is available at:
+# https://github.com/gcc-mirror/gcc/blob/6e6e3f144a33ae504149dc992453b4f6dea12fdb/contrib/download_prerequisites#L35
+#
+sed -i'' 's|ftp://gcc\.gnu\.org/|https://gcc.gnu.org/|g' ./contrib/download_prerequisites
+
+./contrib/download_prerequisites
+mkdir ../gcc-build
+cd ../gcc-build
+
+# '-fno-reorder-blocks-and-partition' is required to
+# enable BOLT optimization of the C++ standard library,
+# which is included in librustc_driver.so
+hide_output ../gcc-$GCC/configure \
+    --prefix=/rustroot \
+    --enable-languages=c,c++ \
+    --disable-gnu-unique-object \
+    --enable-cxx-flags='-fno-reorder-blocks-and-partition'
+hide_output make -j$(nproc)
+hide_output make install
+ln -s gcc /rustroot/bin/cc
+
+cd ..
+rm -rf gcc-build
+rm -rf gcc-$GCC

src/ci/docker/host-aarch64/dist-aarch64-linux/build-zstd.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -ex
+
+hide_output() {
+  set +x
+  on_err="
+echo ERROR: An error was encountered with the build.
+cat /tmp/zstd_build.log
+exit 1
+"
+  trap "$on_err" ERR
+  bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
+  PING_LOOP_PID=$!
+  "$@" &> /tmp/zstd_build.log
+  trap - ERR
+  kill $PING_LOOP_PID
+  rm /tmp/zstd_build.log
+  set -x
+}
+
+ZSTD=1.5.6
+curl -L https://github.com/facebook/zstd/releases/download/v$ZSTD/zstd-$ZSTD.tar.gz | tar xzf -
+
+cd zstd-$ZSTD
+CFLAGS=-fPIC hide_output make -j$(nproc) VERBOSE=1
+hide_output make install
+
+cd ..
+rm -rf zstd-$ZSTD

src/ci/docker/host-aarch64/dist-aarch64-linux/shared.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+hide_output() {
+  set +x
+  on_err="
+echo ERROR: An error was encountered with the build.
+cat /tmp/build.log
+exit 1
+"
+  trap "$on_err" ERR
+  bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
+  PING_LOOP_PID=$!
+  "$@" &> /tmp/build.log
+  trap - ERR
+  kill $PING_LOOP_PID
+  set -x
+}

src/ci/github-actions/jobs.yml

@@ -128,17 +128,17 @@ auto:
   - image: aarch64-gnu-debug
     <<: *job-aarch64-linux
 
+  - image: dist-aarch64-linux
+    env:
+      CODEGEN_BACKENDS: llvm,cranelift
+    <<: *job-aarch64-linux
+
   - image: arm-android
     <<: *job-linux-4c
 
   - image: armhf-gnu
     <<: *job-linux-4c
 
-  - image: dist-aarch64-linux
-    env:
-      CODEGEN_BACKENDS: llvm,cranelift
-    <<: *job-linux-4c
-
   - image: dist-android
     <<: *job-linux-4c