Why RhAllocateHuntsMapping request execution permission for memory on nativeaot runtime.

[CeSun]

Why does the RhAllocateHuntsMapping function request execution permission for memory on the NativeAOT runtime on Linux?

Did you not consider the situation where the system does not support JIT (the system prohibits mmap from requesting executable anonymous memory)?

runtime/src/coreclr/nativeaot/Runtime/ThunksMapping.cpp

Lines 116 to 123 in ad90a0b

	// Note: On secure linux systems, we can't add execute permissions to a mapped virtual memory if it was not created
	// with execute permissions in the first place. This is why we create the virtual section with RX permissions, then
	// reduce it to RW for the data section. For the stubs section we need to increase to RWX to generate the stubs
	// instructions. After this we go back to RX for the stubs section before the stubs are used and should not be
	// changed anymore.
	void * pNewMapping = PalVirtualAlloc(THUNKS_MAP_SIZE * 2, PAGE_EXECUTE_READ);
	if (pNewMapping == NULL)
	return NULL;

runtime/src/coreclr/nativeaot/Runtime/ThunksMapping.cpp

Lines 128 to 133 in ad90a0b

	if (!PalVirtualProtect(pDataSection, THUNKS_MAP_SIZE, PAGE_READWRITE) ||
	!PalVirtualProtect(pThunksSection, THUNKS_MAP_SIZE, PAGE_EXECUTE_READWRITE))
	{
	PalVirtualFree(pNewMapping, THUNKS_MAP_SIZE * 2);
	return NULL;
	}

runtime/src/coreclr/nativeaot/Runtime/ThunksMapping.cpp

Lines 296 to 300 in ad90a0b

	if (!PalVirtualProtect(pThunksSection, THUNKS_MAP_SIZE, PAGE_EXECUTE_READ))
	{
	PalVirtualFree(pNewMapping, THUNKS_MAP_SIZE * 2);
	return NULL;
	}

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @MichalStrehovsky, @jkotas
See info in area-owners.md if you want to be subscribed.

[filipnavara]

RhAllocateThunksMapping has several implementation strategies. It ultimately needs to produce a variable number of thunks where the number changes at runtime.

On most platforms where dynamic code allocation is possible, the simplest way is to just allocate memory, write the code template there and make it executable.

There are other strategies that are used on Apple systems and console ports. For example, on iOS there's a fixed number of thunks generated in src/coreclr/nativeaot/Runtime/arm64/ThunkPoolThunks.S. These get mapped at runtime as necessary at different memory locations. This is, however, highly platform specific code. Check the code of PalAllocateThunksFromTemplate for more details.

[CeSun]

Please forgive me for not understanding the purpose of RhAllocateThunksMapping. My question is that one of the advantages of NativeAOT runtime is that it can be executed on platforms that prohibit JIT. Generally, JIT is prohibited by prohibiting the application of executable permission memory, but .NET applies for executable permission memory in NativeAOT runtime, which seems to conflict with the advantages I mentioned earlier.

My current situation is that I need to run .NET on a Linux platform that prohibits the application of executable permission memory. The NativeAOT runtime crashes here, and I don’t know how to modify the code.

[filipnavara]

There are cases where function pointers are passed to native code which point to an instance method of a specific object (see Marshal.GetFunctionPointerForDelegate API). As long as this specific code pattern is avoided you don't need the thunks. However, if the need arises, then the thunk is allocated for the specific tuple of (method, instance pointer) which is then passed as a single executable pointer to the native code.

[CeSun]

Can the .NET team provide an implementation under Linux that does not require dynamic assembly code generation? Because some systems are based on Linux, they do not allow dynamic assembly generation.

[filipnavara]

Such implementation currently doesn't exist. It may be possible to implement it using the same trick that is used on Apple systems but it's non-trivial. Notably, the implementation prior to 1e135d1 used relatively standard mmap and munmap calls and could likely be ported to Linux. However, it depends on a very specific layout of the code/data in ThunkPoolThunks.S (the data have to be adjacent to the code so the relative offsets in the code point to them and the code+data chunk can be mapped as single region). Such layout may not be hard to achieve on Linux with the ELF file format / linkers.

[WCKYWCKF]

Such implementation currently doesn't exist. It may be possible to implement it using the same trick that is used on Apple systems but it's non-trivial. Notably, the implementation prior to 1e135d1 used relatively standard mmap and munmap calls and could likely be ported to Linux. However, it depends on a very specific layout of the code/data in ThunkPoolThunks.S (the data have to be adjacent to the code so the relative offsets in the code point to them and the code+data chunk can be mapped as single region). Such layout may not be hard to achieve on Linux with the ELF file format / linkers.

We tried to do as you said, but it didn’t work. Could you please spare some time to give us some guidance?

• We reverted the commit [NativeAOT/Apple] Map the thunks using vm_allocate/vm_map to avoid need for specific executable segment layout (#95914).
• We changed the Apple data in ThunkPoolThunks.S to the Linux Arm64 version.

However, the program crashes when it runs to RhpGetThunkSize. The returned CppCrash semaphore is 11 (SIGSEGV).

Here is the modified ThunkPoolThunks.S we made, and I have marked the differences with <-----.

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#include <unixasmmacros.inc>

//;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;  DATA SECTIONS  ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

#define THUNK_CODESIZE 0x10 // 3 instructions, 4 bytes each (and we also have 4 bytes of padding)
#define THUNK_DATASIZE 0x10 // 2 qwords

#define POINTER_SIZE 0x08

#define THUNKS_MAP_SIZE 0x8000

#ifdef TARGET_LINUX             // <-----
#define PAGE_SIZE 0x1000     // <-----
#define PAGE_SIZE_LOG2 12  // <-----
#else
#error Unsupported OS
#endif

// THUNK_POOL_NUM_THUNKS_PER_PAGE = min(PAGE_SIZE / THUNK_CODESIZE, (PAGE_SIZE - POINTER_SIZE) / THUNK_DATASIZE)
#define THUNK_POOL_NUM_THUNKS_PER_PAGE 0xFF   // <-----

//;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Thunk Pages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

.macro THUNKS_PAGE_BLOCK
    IN_PAGE_INDEX = 0
    .rept THUNK_POOL_NUM_THUNKS_PER_PAGE

    // Set xip0 to the address of the current thunk's data block.
    adr      xip0, THUNKS_MAP_SIZE

    // start                                        : xip0 points to the current thunks first data cell in the data page
    // set xip0 to beginning of data page           : xip0 <- xip0 - (THUNK_DATASIZE * current thunk's index)
    // fix offset to point to last QWROD in page    : xip1 <- [xip0 + PAGE_SIZE - POINTER_SIZE]
    // tailcall to the location pointed at by the last qword in the data page
    ldr      xip1, [xip0, #(PAGE_SIZE - POINTER_SIZE - (THUNK_DATASIZE * IN_PAGE_INDEX))]
    br       xip1

    brk     0xf000      // Stubs need to be 16-byte aligned for CFG table. Filling padding with a
                        // deterministic brk instruction, instead of having it just filled with zeros.

    IN_PAGE_INDEX = IN_PAGE_INDEX + 1
    .endr
.endm

#ifdef TARGET_LINUX                                               // <-----
    // Create two segments in the Mach-O file:
    // __THUNKS with executable permissions
    // __THUNKS_DATA with read/write permissions

    .section __THUNKS, "ax", @progbits                    // <-----
    .p2align PAGE_SIZE_LOG2
PATCH_LABEL ThunkPool
    .rept (THUNKS_MAP_SIZE / PAGE_SIZE)
    .p2align PAGE_SIZE_LOG2
    THUNKS_PAGE_BLOCK
    .endr
    .p2align PAGE_SIZE_LOG2
    .section __THUNKS_DATA, "aw", @progbits          // <-----
    .p2align PAGE_SIZE_LOG2
    .space THUNKS_MAP_SIZE
    .p2align PAGE_SIZE_LOG2
#else
#error Unsupported OS
#endif

//;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; General Helpers ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

//
// IntPtr RhpGetThunksBase()
//
LEAF_ENTRY RhpGetThunksBase
    // Return the address of the first thunk pool to the caller (this is really the base address)
    adrp     x0, C_FUNC(ThunkPool)                           // <-----
    add      x0, x0, #:lo12:C_FUNC(ThunkPool)           // <-----
    ret
LEAF_END RhpGetThunksBase

//
// int RhpGetNumThunksPerBlock()
//
LEAF_ENTRY RhpGetNumThunksPerBlock
    mov     x0, THUNK_POOL_NUM_THUNKS_PER_PAGE
    ret
LEAF_END RhpGetNumThunksPerBlock

//
// int RhpGetThunkSize()
//
LEAF_ENTRY RhpGetThunkSize
    mov     x0, THUNK_CODESIZE
    ret
LEAF_END RhpGetThunkSize

//
// int RhpGetNumThunkBlocksPerMapping()
//
LEAF_ENTRY RhpGetNumThunkBlocksPerMapping
    mov     x0, (THUNKS_MAP_SIZE / PAGE_SIZE)
    ret
LEAF_END RhpGetNumThunkBlocksPerMapping

//
// int RhpGetThunkBlockSize
//
LEAF_ENTRY RhpGetThunkBlockSize
    mov     x0, PAGE_SIZE
    ret
LEAF_END RhpGetThunkBlockSize

//
// IntPtr RhpGetThunkDataBlockAddress(IntPtr thunkStubAddress)
//
LEAF_ENTRY RhpGetThunkDataBlockAddress
    mov     x12, PAGE_SIZE - 1
    bic     x0, x0, x12
    mov     x12, THUNKS_MAP_SIZE
    add     x0, x0, x12
    ret
LEAF_END RhpGetThunkDataBlockAddress

//
// IntPtr RhpGetThunkStubsBlockAddress(IntPtr thunkDataAddress)
//
LEAF_ENTRY RhpGetThunkStubsBlockAddress
    mov     x12, PAGE_SIZE - 1
    bic     x0, x0, x12
    mov     x12, THUNKS_MAP_SIZE
    sub     x0, x0, x12
    ret
LEAF_END RhpGetThunkStubsBlockAddress

thank.
@filipnavara

[WCKYWCKF]

I'm happy to inform everyone that we've successfully implemented the platform-specific ThunkMapping-related code in the HarmonyOS system.
This will make it easier for cross-platform libraries relying on Marshal.GetFunctionPointerForDelegate to become compatible with HarmonyOS.
Thank you for everyone's help.
@filipnavara And thank you for your guidance.

This can be closed.