Launching latest Firefox fails due to lack of ARCH_SET_GS support

[pawalt]

Description

On Firefox version 136.0.2, Firefox fails to start up with a failed WebAssembly call:

wasm_rt_syscall_set_segue_base error: Invalid argument
Redirecting call to abort() to mozalloc_abort

On version 135.0.1, it starts up as expected.

If we strace the Firefox call on 136.0.2, we can see that it's failing when trying to use ARCH_SET_GS:

arch_prctl(ARCH_SET_GS, 0x7ee300000000) = -1 EINVAL (Invalid argument)

This limitation is documented:
https://gvisor.dev/docs/user_guide/compatibility/linux/amd64/

We're wondering if implementing ARCH_SET_GS is on the near-term roadmap and what the path to implementation would be.

cc @aksh-at @thundergolfer @cweld510

Steps to reproduce

You can use runsc with Docker to repro this. You can change the FF_VERSION parameter to switch behavior:

docker run -it --runtime=runsc --rm ubuntu:22.04 /bin/bash

$ apt update && apt install curl -y
$ # export FF_VERSION=135.0.1
$ export FF_VERSION=136.0.2
$ DEBIAN_FRONTEND=noninteractive; (apt-get update && apt-get install --yes --no-install-recommends libasound2 libgtk-3-0 libx11-xcb1 xz-utils) | wc -l
$ curl -sk http://download-installer.cdn.mozilla.net/pub/firefox/releases/$FF_VERSION/linux-x86_64/en-US/firefox-$FF_VERSION.tar.xz | tar -xJv -C /opt | wc -l
$ /opt/firefox/firefox --headless --marionette

*** You are running in headless mode.
[GFX1-]: glxtest: libGL.so.1 missing
[GFX1-]: No GPUs detected via PCI

wasm_rt_syscall_set_segue_base error: Invalid argument
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump attempting to generate:/root/.mozilla/firefox/y1ifd1wg.default-release/minidumps/362ba672-fff0-304b-b740-8f684d1f3a1b.dmp
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::GenerateDump cloned child 4411
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::GenerateDump minidump generation succeeded
root@1315e944c842:/# 
(crashreporter:4412): Gtk-WARNING **: 19:27:43.414: cannot open display:

runsc version

/var/tmp/.modal-special/runsc -version                      
runsc version 1a9abee80b7c
spec: 1.1.0-rc.1

docker version (if using docker)

docker version                                            
Client: Docker Engine - Community
 Version:           26.1.4
 API version:       1.45
 Go version:        go1.21.11
 Git commit:        5650f9b
 Built:             Wed Jun  5 11:30:53 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:11 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.33
  GitCommit:        d2d58213f83a351ca8f528a95fbd145f5654e957
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

uname

Linux ip-10-1-4-158.ec2.internal 5.15.0-207.156.6.el9uek.x86_64 #2 SMP Thu Jun 6 02:32:40 PDT 2024 x86_64 x86_64 x86_64 GNU/Linux

kubectl (if using Kubernetes)

N/A

repo state (if built from source)

1a9abee

runsc debug logs (if available)

[ayushr2]

As per #11112 (comment), ARCH_SET_GS is used to implement systrap fast path. Not sure how feasible this in for systrap. cc @avagin @konstantin-s-bogom

[pawalt]

@ayushr2 thanks - if there's a quicker path towards implementing it for platform=kvm exclusively, we do run some baremetal hosts. Obviously we'd both prefer it to be standardized, but if that's not feasible, just KVM support would unblock us.

[konstantin-s-bogom]

Take a look at avagin@0a2587e. For systrap this is only feasible if we introduce a systrap mode without fastpath, which would be significantly slower.

[hbhasker]

One fix might be to disable this optimization see https://github.com/WebAssembly/wabt/blob/a27b4801a8a11e868b9dc5bb35ab72da453aad28/wasm2c/wasm-rt.h#L246

[yannayl]

Does anybody have a workaround?
@pawalt
🙏

[pawalt]

@yannayl at the moment we're having our customers run the old Firefox version or build without the optimization. There might be a path to getting this to work with gVisor KVM, but it would be a fork in functionality between the platforms.