[Mono][ARM64] JIT thunk target literals can be insufficiently aligned for concurrent updates

# Mono ARM64 thunk alignment reproducer

This independent C host and C# console application use public Mono APIs and
standard .NET libraries. No engine, game, service, account, or proprietary
assembly is required. No application capture or runtime binary is distributed.

## Build and run

Set ANDROID_NDK_ROOT to an Android NDK installation. Set NDK_HOST_TAG to
linux-x86_64 on Linux (the default is darwin-x86_64). Install a .NET10 SDK, then
run `sh build.sh`.

Prepare a separate `runtime` directory from official Mono Android ARM64 runtime
and matching standard managed runtime packages: libmonosgen-2.0.so, its native
runtime dependencies, System.Private.CoreLib.dll and the standard framework
assemblies required by the console application. Do not copy an application's
publish directory. Copy out/managed/ThunkProbe.dll into this directory.

Push out/thunk-probe and runtime to a new directory on an ARM64 Android device,
for example /data/local/tmp/mono-thunk-alignment. Run from that directory:

```
LD_LIBRARY_PATH=runtime ./thunk-probe runtime/libmonosgen-2.0.so runtime
```

For comparison, put the patched library alongside thunk-probe and run:

```
LD_LIBRARY_PATH=runtime ./thunk-probe ./libmonosgen-patched.so runtime
```

Exit0 means managed execution succeeded and all observed literals were aligned;
exit72 flags misalignment or an invalid sampled target. This reproduces
misalignment, not a deterministic runtime crash. The probe reads bounded
/proc/self/mem snapshots after JIT completion. It may observe duplicate or nearby
stubs; snapshot failures and unreadable windows are reported. It does not prove
exhaustive coverage, target write history, or runtime repatching coverage.

#!/bin/sh
set -eu
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
: "${ANDROID_NDK_ROOT:?Set ANDROID_NDK_ROOT to an installed Android NDK}"
HOST_TAG=${NDK_HOST_TAG:-darwin-x86_64}
CLANG="$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/$HOST_TAG/bin/aarch64-linux-android21-clang"
OUT="$ROOT/out"
mkdir -p "$OUT/managed"
dotnet build "$ROOT/ThunkProbe.csproj" -c Release -o "$OUT/managed"
"$CLANG" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie "$ROOT/host.c" -ldl -o "$OUT/thunk-probe"
printf '%s\n' "Built $OUT/thunk-probe and $OUT/managed/ThunkProbe.dll"

--- a/src/mono/mono/mini/mini.c
+++ b/src/mono/mono/mini/mini.c
@@ -2123,6 +2123,13 @@
 		unwindlen = mono_arch_unwindinfo_init_method_unwind_info (cfg);
 #endif
 
+	/* Keep ARM64 thunk target literals naturally aligned for concurrent updates. */
+	cfg->thunks_offset = cfg->code_size + unwindlen;
+#if defined(TARGET_ARM64)
+	if (cfg->thunk_area)
+		cfg->thunks_offset = ALIGN_TO (cfg->thunks_offset, 8);
+#endif
+
 	if (cfg->method->dynamic) {
 		/* Allocate the code into a separate memory pool so it can be freed */
 		cfg->dynamic_info = g_new0 (MonoJitDynamicMethodInfo, 1);
@@ -2135,15 +2142,14 @@
 		g_hash_table_insert (jit_mm->dynamic_code_hash, cfg->method, cfg->dynamic_info);
 		jit_mm_unlock (jit_mm);
 
-		code = (guint8 *)mono_code_manager_reserve (cfg->dynamic_info->code_mp, cfg->code_size + cfg->thunk_area + unwindlen);
+		code = (guint8 *)mono_code_manager_reserve (cfg->dynamic_info->code_mp, cfg->thunks_offset + cfg->thunk_area);
 	} else {
-		code = (guint8 *)mono_mem_manager_code_reserve (code_mem_manager, cfg->code_size + cfg->thunk_area + unwindlen);
+		code = (guint8 *)mono_mem_manager_code_reserve (code_mem_manager, cfg->thunks_offset + cfg->thunk_area);
 	}
 
 	mono_codeman_enable_write ();
 
 	if (cfg->thunk_area) {
-		cfg->thunks_offset = cfg->code_size + unwindlen;
 		cfg->thunks = code + cfg->thunks_offset;
 		memset (cfg->thunks, 0, cfg->thunk_area);
 	}
--- a/src/mono/mono/mini/mini-arm64.c
+++ b/src/mono/mono/mini/mini-arm64.c
@@ -1272,6 +1272,8 @@
 emit_thunk (guint8 *code, gconstpointer target)
 {
 	guint8 *p = code;
+
+	g_assert (((gsize)code & 7) == 0);
 
 	arm_ldrx_lit (code, ARMREG_IP0, code + 8);
 	arm_brx (code, ARMREG_IP0);

#define _GNU_SOURCE
#include <dlfcn.h>
#include <errno.h>
#include <fcntl.h>
#include <inttypes.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/*
 * This uses only the public profiler callbacks and opaque MonoJitInfo accessors.
 * It deliberately does not assume the private MonoThunkJitInfo layout.
 */
typedef struct _MonoProfiler MonoProfiler;
typedef struct _MonoProfilerDesc *MonoProfilerHandle;
typedef struct _MonoMethod MonoMethod;
typedef struct _MonoJitInfo MonoJitInfo;
typedef void (*jit_done_callback)(MonoProfiler *, MonoMethod *, MonoJitInfo *);
typedef void *(*mono_profiler_create_fn)(MonoProfiler *);
typedef void (*mono_profiler_set_jit_done_callback_fn)(MonoProfilerHandle, jit_done_callback);
typedef void *(*mono_jit_info_get_code_start_fn)(MonoJitInfo *);
typedef int (*mono_jit_info_get_code_size_fn)(MonoJitInfo *);
typedef int (*coreclr_initialize_fn)(const char *, const char *, int, const char **, const char **, void **, unsigned int *);
typedef int (*coreclr_execute_assembly_fn)(void *, unsigned int, int, const char **, const char *, unsigned int *);
typedef void (*mono_set_assemblies_path_fn)(const char *);

static mono_jit_info_get_code_start_fn jit_info_start;
static mono_jit_info_get_code_size_fn jit_info_size;
static volatile unsigned long long methods_seen;
static volatile unsigned long long stubs_seen;
static volatile unsigned long long aligned_literals;
static volatile unsigned long long misaligned_literals;
static volatile unsigned long long invalid_targets;
static volatile unsigned long long unreadable_windows;
static volatile unsigned long long snapshot_failures;
static volatile unsigned long long partial_snapshots;

#define MAX_ROWS 256
struct observation {
    uintptr_t method;
    uintptr_t code_start;
    uintptr_t literal_address;
    uintptr_t target;
    uint32_t code_size;
    uint32_t flags;
};
static struct observation rows[MAX_ROWS];
static volatile unsigned int row_count;

static void *needed(void *library, const char *name) {
    void *result = dlsym(library, name);
    if (!result) fprintf(stderr, "missing %s: %s\n", name, dlerror());
    return result;
}

/* Return the readable/executable map end containing address, or zero. */
static uintptr_t executable_map_end(uintptr_t address) {
    FILE *maps = fopen("/proc/self/maps", "re");
    if (!maps) return 0;
    char line[512], perms[5];
    unsigned long long start, end;
    uintptr_t result = 0;
    while (fgets(line, sizeof(line), maps)) {
        if (sscanf(line, "%llx-%llx %4s", &start, &end, perms) == 3 &&
            address >= (uintptr_t)start && address < (uintptr_t)end &&
            perms[0] == 'r' && perms[2] == 'x') {
            result = (uintptr_t)end;
            break;
        }
    }
    fclose(maps);
    return result;
}

static void save_observation(MonoMethod *method, uintptr_t start, int size,
                             uintptr_t literal, uintptr_t target, uint32_t flags) {
    unsigned int slot = __atomic_fetch_add(&row_count, 1, __ATOMIC_RELAXED);
    if (slot >= MAX_ROWS) return;
    rows[slot].method = (uintptr_t)method;
    rows[slot].code_start = start;
    rows[slot].code_size = (uint32_t)size;
    rows[slot].literal_address = literal;
    rows[slot].target = target;
    rows[slot].flags = flags;
}

static void inspect_jitted_method(MonoProfiler *prof, MonoMethod *method, MonoJitInfo *info) {
    (void)prof;
    (void)method;
    __atomic_fetch_add(&methods_seen, 1, __ATOMIC_RELAXED);
    if (!jit_info_start || !jit_info_size) return;

    const uint8_t *code = (const uint8_t *)jit_info_start(info);
    int size = jit_info_size(info);
    if (!code || size < 0) return;

    /* The ARM64 mini JIT appends each method's thunk area after its reported code. */
    uintptr_t scan = (uintptr_t)code + (uintptr_t)size;
    uintptr_t map_end = executable_map_end(scan);
    if (!map_end || map_end <= scan) {
        __atomic_fetch_add(&unreadable_windows, 1, __ATOMIC_RELAXED);
        return;
    }
    size_t available = (size_t)(map_end - scan);
    if (available > 2048) available = 2048;
    uint8_t snapshot[2048];
    int mem = open("/proc/self/mem", O_RDONLY | O_CLOEXEC);
    if (mem < 0) {
        __atomic_fetch_add(&snapshot_failures, 1, __ATOMIC_RELAXED);
        return;
    }
    ssize_t bytes = pread(mem, snapshot, available, (off_t)scan);
    close(mem);
    if (bytes < 16) {
        __atomic_fetch_add(&snapshot_failures, 1, __ATOMIC_RELAXED);
        return;
    }
    if ((size_t)bytes != available)
        __atomic_fetch_add(&partial_snapshots, 1, __ATOMIC_RELAXED);
    size_t captured = (size_t)bytes;
    for (size_t offset = 0; offset + 16 <= captured; offset += 4) {
        uint32_t first, second;
        memcpy(&first, snapshot + offset, sizeof(first));
        memcpy(&second, snapshot + offset + 4, sizeof(second));
        /* ldr x16, #8 ; br x16 -- the exact literal thunk form under test. */
        if (first != UINT32_C(0x58000050) || second != UINT32_C(0xd61f0200)) continue;
        uintptr_t literal_address = scan + offset + 8;
        uintptr_t target;
        memcpy(&target, snapshot + offset + 8, sizeof(target));
        __atomic_fetch_add(&stubs_seen, 1, __ATOMIC_RELAXED);
        uint32_t flags = 0;
        if ((literal_address & 7u) == 0)
        {
            __atomic_fetch_add(&aligned_literals, 1, __ATOMIC_RELAXED);
            flags |= 1;
        }
        else
            __atomic_fetch_add(&misaligned_literals, 1, __ATOMIC_RELAXED);
        if ((target & 3u) != 0 || !executable_map_end(target))
            __atomic_fetch_add(&invalid_targets, 1, __ATOMIC_RELAXED);
        else
            flags |= 2;
        save_observation(method, (uintptr_t)code, size, literal_address, target, flags);
    }
}

int main(int argc, char **argv) {
    if (argc != 3) {
        fprintf(stderr, "usage: thunk-probe libmonosgen-2.0.so runtime-dir\n");
        return 64;
    }
    void *mono = dlopen(argv[1], RTLD_NOW | RTLD_GLOBAL);
    if (!mono) { fprintf(stderr, "dlopen: %s\n", dlerror()); return 65; }
    coreclr_initialize_fn initialize = (coreclr_initialize_fn)needed(mono, "coreclr_initialize");
    coreclr_execute_assembly_fn execute = (coreclr_execute_assembly_fn)needed(mono, "coreclr_execute_assembly");
    mono_set_assemblies_path_fn set_path = (mono_set_assemblies_path_fn)needed(mono, "mono_set_assemblies_path");
    mono_profiler_create_fn profiler_create = (mono_profiler_create_fn)needed(mono, "mono_profiler_create");
    mono_profiler_set_jit_done_callback_fn set_jit_done = (mono_profiler_set_jit_done_callback_fn)needed(mono, "mono_profiler_set_jit_done_callback");
    jit_info_start = (mono_jit_info_get_code_start_fn)needed(mono, "mono_jit_info_get_code_start");
    jit_info_size = (mono_jit_info_get_code_size_fn)needed(mono, "mono_jit_info_get_code_size");
    if (!initialize || !execute || !set_path || !profiler_create || !set_jit_done || !jit_info_start || !jit_info_size) return 66;

    MonoProfilerHandle profiler = (MonoProfilerHandle)profiler_create(NULL);
    if (!profiler) { fprintf(stderr, "mono_profiler_create failed\n"); return 67; }
    set_jit_done(profiler, inspect_jitted_method);
    set_path(argv[2]);
    void *host = NULL;
    unsigned int domain = 0;
    int result = initialize(NULL, NULL, 0, NULL, NULL, &host, &domain);
    if (result != 0) { fprintf(stderr, "coreclr_initialize=%d\n", result); return 68; }
    char assembly_path[1024];
    if (snprintf(assembly_path, sizeof(assembly_path), "%s/ThunkProbe.dll", argv[2]) >= (int)sizeof(assembly_path)) return 69;
    unsigned int exit_code = 0;
    const char *managed_args[] = { "ThunkProbe.dll" };
    result = execute(host, domain, 1, managed_args, assembly_path, &exit_code);
    unsigned long long observed_methods = __atomic_load_n(&methods_seen, __ATOMIC_ACQUIRE);
    unsigned long long observed_stubs = __atomic_load_n(&stubs_seen, __ATOMIC_ACQUIRE);
    unsigned long long observed_aligned = __atomic_load_n(&aligned_literals, __ATOMIC_ACQUIRE);
    unsigned long long observed_misaligned = __atomic_load_n(&misaligned_literals, __ATOMIC_ACQUIRE);
    unsigned long long observed_invalid = __atomic_load_n(&invalid_targets, __ATOMIC_ACQUIRE);
    unsigned long long observed_unreadable = __atomic_load_n(&unreadable_windows, __ATOMIC_ACQUIRE);
    unsigned long long observed_failures = __atomic_load_n(&snapshot_failures, __ATOMIC_ACQUIRE);
    unsigned long long observed_partial = __atomic_load_n(&partial_snapshots, __ATOMIC_ACQUIRE);
    unsigned int observed_rows = __atomic_load_n(&row_count, __ATOMIC_ACQUIRE);
    unsigned int printed_rows = observed_rows < MAX_ROWS ? observed_rows : MAX_ROWS;
    printf("coreclr_execute_assembly=%d exit=%u methods=%llu stubs=%llu aligned=%llu misaligned=%llu invalid_targets=%llu unreadable_windows=%llu snapshot_failures=%llu partial_snapshots=%llu rows=%u\n",
        result, exit_code, observed_methods, observed_stubs, observed_aligned, observed_misaligned, observed_invalid, observed_unreadable, observed_failures, observed_partial, printed_rows);
    for (unsigned int index = 0; index < printed_rows; index++) {
        const struct observation *row = &rows[index];
        printf("thunk_row method=0x%" PRIxPTR " code=0x%" PRIxPTR " size=%" PRIu32 " literal=0x%" PRIxPTR " target=0x%" PRIxPTR " flags=%" PRIu32 "\n",
            row->method, row->code_start, row->code_size, row->literal_address, row->target, row->flags);
    }
    if (result != 0 || exit_code != 0) return 70;
    if (!observed_stubs) return 71;
    return observed_misaligned == 0 && observed_invalid == 0 ? 0 : 72;
}

using System;
using System.Collections.Concurrent;
using System.Reflection.Emit;
using System.Runtime.CompilerServices;
using System.Threading;
using System.Threading.Tasks;

namespace ThunkProbe;

public static class Program
{
    [MethodImpl(MethodImplOptions.NoInlining)]
    private static int Leaf(int value) => value * 17 + 3;

    [MethodImpl(MethodImplOptions.NoInlining)]
    private static int Ordinary(int value)
    {
        string input = "ExampleX/" + value;
        return Leaf(input.Substring(0, 8).Length + value);
    }

    private static Func<int, int> NewDynamicMethod(int addend)
    {
        var method = new DynamicMethod("probe_dynamic_" + addend, typeof(int), new[] { typeof(int) }, typeof(Program).Module, true);
        ILGenerator il = method.GetILGenerator();
        il.Emit(OpCodes.Ldarg_0);
        il.Emit(OpCodes.Ldc_I4, addend);
        il.Emit(OpCodes.Add);
        il.Emit(OpCodes.Call, typeof(Program).GetMethod(nameof(Leaf), System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!);
        il.Emit(OpCodes.Ret);
        return (Func<int, int>)method.CreateDelegate(typeof(Func<int, int>));
    }

    public static int Main()
    {
        const int workers = 16;
        using var gate = new ManualResetEventSlim(false);
        var answers = new ConcurrentBag<int>();
        Task[] tasks = new Task[workers];
        for (int i = 0; i < workers; i++)
        {
            int captured = i;
            tasks[i] = Task.Run(() =>
            {
                gate.Wait();
                Func<int, int> dynamicCall = NewDynamicMethod(captured + 100);
                int answer = Ordinary(captured) + dynamicCall(captured);
                answers.Add(answer);
            });
        }
        gate.Set();
        Task.WaitAll(tasks);
        int checksum = 0;
        foreach (int answer in answers) checksum += answer;
        Console.WriteLine($"workers={workers} answers={answers.Count} checksum={checksum}");
        return answers.Count == workers && checksum != 0 ? 0 : 1;
    }
}

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <OutputType>Exe</OutputType>
    <ImplicitUsings>disable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
</Project>