Crash on Rosetta for double mapping jitted code

[noahfalk]

Description

Roblox reported that their app crashes when run in Rosetta unless they set DOTNET_EnableWriteXorExecute=0

Reproduction Steps

docker run --platform linux/amd64 -it docker.artifactory.rbx.com/dotnet/sdk:8.0 /bin/bash

root@361134e3e399:/# dotnet new tool-manifest

Expected behavior

No crash

Actual behavior

Segmentation fault

Regression?

Unknown

Known Workarounds

set DOTNET_EnableWriteXorExecute=0

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

[filipnavara]

Rosetta doesn't support the W^X double mapping. It's disabled on macOS when running under Rosetta. I am not sure if it's possible to detect it under linux-arm64 container/VM.

[mangod9]

• @janvorli. @noahfalk, is the workaround acceptable if documented?

[janvorli]

I think it could be acceptable, since if we detected that automatically somehow in the runtime, we would do the same thing as setting that env variable would do. But I'd look if there is a way to detect that we are running in linux container on mac.

[noahfalk]

@janvorli. @noahfalk, is the workaround acceptable if documented?

I don't think Roblox cares whether W^X is enabled or not as long as the app doesn't crash. Now that they know about the env var I suspect this is only a small inconvenience for them, but they are reporting it for the benefit of others who might run into the same thing.

My main worries here would be:

1. When .NET crashes on startup it gives a bad perception for .NET product quality regardless if a workaround exists.
2. If we documented the workaround, how easily do we expect people hitting this issue would find it? For example if they searched for ".NET seg fault" would they find our doc page when there are probably tons of other web pages talking about seg faults too?

[janvorli]

Thinking about it more, I need to refresh my mind on what exactly happens when we try to double map under rosetta. I believe I have it recorded in my notes somewhere. If that was something we can reliably test at startup and figure out it doesn't work, we can use that instead of trying to figure out if a linux container is running on rosetta.

[janvorli]

Ah, found it. The problem is that when a code is modified in memory via a secondary mapping and the preexisting code in the same page was already executed before, rosetta basically ignores the modifications. It doesn't detect that it needs to recompile the code on that page from x64 to arm64 again. I guess this would be detectable by creating a page with some code that e.g. returns a constant. Then modifying the code via double mapping to code that returns a different constant, calling that code and checking the result.