wasmtime 15.0.1 → 16.0.0

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/mmap.rs

@@ -1,226 +0,0 @@
-//! Low-level abstraction for allocating and managing zero-filled pages
-//! of memory.
-
-use anyhow::{Context, Result};
-use std::fs::File;
-use std::ops::Range;
-use std::path::Path;
-use std::sync::Arc;
-
-cfg_if::cfg_if! {
-    if #[cfg(windows)] {
-        mod windows;
-        use windows as sys;
-    } else if #[cfg(miri)] {
-        mod miri;
-        use miri as sys;
-    } else {
-        mod unix;
-        use unix as sys;
-    }
-}
-
-/// A simple struct consisting of a page-aligned pointer to page-aligned
-/// and initially-zeroed memory and a length.
-#[derive(Debug)]
-pub struct Mmap {
-    sys: sys::Mmap,
-    file: Option<Arc<File>>,
-}
-
-impl Mmap {
-    /// Create a new `Mmap` pointing to at least `size` bytes of page-aligned
-    /// accessible memory.
-    pub fn with_at_least(size: usize) -> Result<Self> {
-        let page_size = crate::page_size();
-        let rounded_size = (size + (page_size - 1)) & !(page_size - 1);
-        Self::accessible_reserved(rounded_size, rounded_size)
-    }
-
-    /// Creates a new `Mmap` by opening the file located at `path` and mapping
-    /// it into memory.
-    ///
-    /// The memory is mapped in read-only mode for the entire file. If portions
-    /// of the file need to be modified then the `region` crate can be use to
-    /// alter permissions of each page.
-    ///
-    /// The memory mapping and the length of the file within the mapping are
-    /// returned.
-    pub fn from_file(path: &Path) -> Result<Self> {
-        let (sys, file) = sys::Mmap::from_file(path)?;
-        Ok(Mmap {
-            sys,
-            file: Some(Arc::new(file)),
-        })
-    }
-
-    /// Create a new `Mmap` pointing to `accessible_size` bytes of page-aligned
-    /// accessible memory, within a reserved mapping of `mapping_size` bytes.
-    /// `accessible_size` and `mapping_size` must be native page-size multiples.
-    ///
-    /// # Panics
-    ///
-    /// This function will panic if `accessible_size` is greater than
-    /// `mapping_size` or if either of them are not page-aligned.
-    pub fn accessible_reserved(accessible_size: usize, mapping_size: usize) -> Result<Self> {
-        let page_size = crate::page_size();
-        assert!(accessible_size <= mapping_size);
-        assert_eq!(mapping_size & (page_size - 1), 0);
-        assert_eq!(accessible_size & (page_size - 1), 0);
-
-        if mapping_size == 0 {
-            Ok(Mmap {
-                sys: sys::Mmap::new_empty(),
-                file: None,
-            })
-        } else if accessible_size == mapping_size {
-            Ok(Mmap {
-                sys: sys::Mmap::new(mapping_size)
-                    .context(format!("mmap failed to allocate {mapping_size:#x} bytes"))?,
-                file: None,
-            })
-        } else {
-            let mut result = Mmap {
-                sys: sys::Mmap::reserve(mapping_size)
-                    .context(format!("mmap failed to reserve {mapping_size:#x} bytes"))?,
-                file: None,
-            };
-            if accessible_size > 0 {
-                result.make_accessible(0, accessible_size).context(format!(
-                    "mmap failed to allocate {accessible_size:#x} bytes"
-                ))?;
-            }
-            Ok(result)
-        }
-    }
-
-    /// Make the memory starting at `start` and extending for `len` bytes
-    /// accessible. `start` and `len` must be native page-size multiples and
-    /// describe a range within `self`'s reserved memory.
-    ///
-    /// # Panics
-    ///
-    /// This function will panic if `start` or `len` is not page aligned or if
-    /// either are outside the bounds of this mapping.
-    pub fn make_accessible(&mut self, start: usize, len: usize) -> Result<()> {
-        let page_size = crate::page_size();
-        assert_eq!(start & (page_size - 1), 0);
-        assert_eq!(len & (page_size - 1), 0);
-        assert!(len <= self.len());
-        assert!(start <= self.len() - len);
-
-        self.sys.make_accessible(start, len)
-    }
-
-    /// Return the allocated memory as a slice of u8.
-    ///
-    /// # Safety
-    ///
-    /// The caller must ensure that the range of bytes is accessible to the
-    /// program and additionally has previously been initialized.
-    ///
-    /// # Panics
-    ///
-    /// Panics of the `range` provided is outside of the limits of this mmap.
-    #[inline]
-    pub unsafe fn slice(&self, range: Range<usize>) -> &[u8] {
-        assert!(range.start <= range.end);
-        assert!(range.end <= self.len());
-        std::slice::from_raw_parts(self.as_ptr().add(range.start), range.end - range.start)
-    }
-
-    /// Return the allocated memory as a mutable slice of u8.
-    ///
-    /// # Safety
-    ///
-    /// The caller must ensure that the range of bytes is accessible to the
-    /// program and additionally has previously been initialized.
-    ///
-    /// # Panics
-    ///
-    /// Panics of the `range` provided is outside of the limits of this mmap.
-    pub unsafe fn slice_mut(&mut self, range: Range<usize>) -> &mut [u8] {
-        assert!(range.start <= range.end);
-        assert!(range.end <= self.len());
-        std::slice::from_raw_parts_mut(self.as_mut_ptr().add(range.start), range.end - range.start)
-    }
-
-    /// Return the allocated memory as a pointer to u8.
-    #[inline]
-    pub fn as_ptr(&self) -> *const u8 {
-        self.sys.as_ptr()
-    }
-
-    /// Return the allocated memory as a mutable pointer to u8.
-    #[inline]
-    pub fn as_mut_ptr(&mut self) -> *mut u8 {
-        self.sys.as_mut_ptr()
-    }
-
-    /// Return the length of the allocated memory.
-    ///
-    /// This is the byte length of this entire mapping which includes both
-    /// addressible and non-addressible memory.
-    #[inline]
-    pub fn len(&self) -> usize {
-        self.sys.len()
-    }
-
-    /// Return whether any memory has been allocated or reserved.
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-
-    /// Makes the specified `range` within this `Mmap` to be read/execute.
-    ///
-    /// # Unsafety
-    ///
-    /// This method is unsafe as it's generally not valid to simply make memory
-    /// executable, so it's up to the caller to ensure that everything is in
-    /// order and this doesn't overlap with other memory that should only be
-    /// read or only read/write.
-    ///
-    /// # Panics
-    ///
-    /// Panics of `range` is out-of-bounds or not page-aligned.
-    pub unsafe fn make_executable(
-        &self,
-        range: Range<usize>,
-        enable_branch_protection: bool,
-    ) -> Result<()> {
-        assert!(range.start <= self.len());
-        assert!(range.end <= self.len());
-        assert!(range.start <= range.end);
-        assert!(
-            range.start % crate::page_size() == 0,
-            "changing of protections isn't page-aligned",
-        );
-        self.sys
-            .make_executable(range, enable_branch_protection)
-            .context("failed to make memory executable")
-    }
-
-    /// Makes the specified `range` within this `Mmap` to be readonly.
-    pub unsafe fn make_readonly(&self, range: Range<usize>) -> Result<()> {
-        assert!(range.start <= self.len());
-        assert!(range.end <= self.len());
-        assert!(range.start <= range.end);
-        assert!(
-            range.start % crate::page_size() == 0,
-            "changing of protections isn't page-aligned",
-        );
-        self.sys
-            .make_readonly(range)
-            .context("failed to make memory readonly")
-    }
-
-    /// Returns the underlying file that this mmap is mapping, if present.
-    pub fn original_file(&self) -> Option<&Arc<File>> {
-        self.file.as_ref()
-    }
-}
-
-fn _assert() {
-    fn _assert_send_sync<T: Send + Sync>() {}
-    _assert_send_sync::<Mmap>();
-}

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/mpk/enabled.rs

@@ -1,201 +0,0 @@
-//!
-
-use super::{pkru, sys};
-use anyhow::{Context, Result};
-use std::sync::OnceLock;
-
-/// Check if the MPK feature is supported.
-pub fn is_supported() -> bool {
-    cfg!(target_os = "linux") && cfg!(target_arch = "x86_64") && pkru::has_cpuid_bit_set()
-}
-
-/// Allocate up to `max` protection keys.
-///
-/// This asks the kernel for all available keys up to `max` in a thread-safe way
-/// (we can expect 1-15; 0 is kernel-reserved). This avoids interference when
-/// multiple threads try to allocate keys at the same time (e.g., during
-/// testing). It also ensures that a single copy of the keys is reserved for the
-/// lifetime of the process. Because of this, `max` is only a hint to
-/// allocation: it only is effective on the first invocation of this function.
-///
-/// TODO: this is not the best-possible design. This creates global state that
-/// would prevent any other code in the process from using protection keys; the
-/// `KEYS` are never deallocated from the system with `pkey_dealloc`.
-pub fn keys(max: usize) -> &'static [ProtectionKey] {
-    let keys = KEYS.get_or_init(|| {
-        let mut allocated = vec![];
-        if is_supported() {
-            while allocated.len() < max {
-                if let Ok(key_id) = sys::pkey_alloc(0, 0) {
-                    debug_assert!(key_id < 16);
-                    // UNSAFETY: here we unsafely assume that the
-                    // system-allocated pkey will exist forever.
-                    allocated.push(ProtectionKey {
-                        id: key_id,
-                        stripe: allocated.len().try_into().unwrap(),
-                    });
-                } else {
-                    break;
-                }
-            }
-        }
-        allocated
-    });
-    &keys[..keys.len().min(max)]
-}
-static KEYS: OnceLock<Vec<ProtectionKey>> = OnceLock::new();
-
-/// Only allow access to pages marked by the keys set in `mask`.
-///
-/// Any accesses to pages marked by another key will result in a `SIGSEGV`
-/// fault.
-pub fn allow(mask: ProtectionMask) {
-    let previous = pkru::read();
-    pkru::write(mask.0);
-    log::trace!("PKRU change: {:#034b} => {:#034b}", previous, pkru::read());
-}
-
-/// An MPK protection key.
-///
-/// The expected usage is:
-/// - receive system-allocated keys from [`keys`]
-/// - mark some regions of memory as accessible with [`ProtectionKey::protect`]
-/// - [`allow`] or disallow access to the memory regions using a
-///   [`ProtectionMask`]; any accesses to unmarked pages result in a fault
-/// - drop the key
-#[derive(Clone, Copy, Debug)]
-pub struct ProtectionKey {
-    id: u32,
-    stripe: u32,
-}
-
-impl ProtectionKey {
-    /// Mark a page as protected by this [`ProtectionKey`].
-    ///
-    /// This "colors" the pages of `region` via a kernel `pkey_mprotect` call to
-    /// only allow reads and writes when this [`ProtectionKey`] is activated
-    /// (see [`allow`]).
-    ///
-    /// # Errors
-    ///
-    /// This will fail if the region is not page aligned or for some unknown
-    /// kernel reason.
-    pub fn protect(&self, region: &mut [u8]) -> Result<()> {
-        let addr = region.as_mut_ptr() as usize;
-        let len = region.len();
-        let prot = sys::PROT_NONE;
-        sys::pkey_mprotect(addr, len, prot, self.id).with_context(|| {
-            format!(
-                "failed to mark region with pkey (addr = {addr:#x}, len = {len}, prot = {prot:#b})"
-            )
-        })
-    }
-
-    /// Convert the [`ProtectionKey`] to its 0-based index; this is useful for
-    /// determining which allocation "stripe" a key belongs to.
-    ///
-    /// This function assumes that the kernel has allocated key 0 for itself.
-    pub fn as_stripe(&self) -> usize {
-        self.stripe as usize
-    }
-}
-
-/// A bit field indicating which protection keys should be allowed and disabled.
-///
-/// The internal representation makes it easy to use [`ProtectionMask`] directly
-/// with the PKRU register. When bits `n` and `n+1` are set, it means the
-/// protection key is *not* allowed (see the PKRU write and access disabled
-/// bits).
-pub struct ProtectionMask(u32);
-impl ProtectionMask {
-    /// Allow access from all protection keys.
-    #[inline]
-    pub fn all() -> Self {
-        Self(pkru::ALLOW_ACCESS)
-    }
-
-    /// Only allow access to memory protected with protection key 0; note that
-    /// this does not mean "none" but rather allows access from the default
-    /// kernel protection key.
-    #[inline]
-    pub fn zero() -> Self {
-        Self(pkru::DISABLE_ACCESS ^ 0b11)
-    }
-
-    /// Include `pkey` as another allowed protection key in the mask.
-    #[inline]
-    pub fn or(self, pkey: ProtectionKey) -> Self {
-        let mask = pkru::DISABLE_ACCESS ^ 0b11 << (pkey.id * 2);
-        Self(self.0 & mask)
-    }
-}
-
-/// Helper macro for skipping tests on systems that do not have MPK enabled
-/// (e.g., older architecture, disabled by kernel, etc.)
-#[cfg(test)]
-macro_rules! skip_if_mpk_unavailable {
-    () => {
-        if !crate::mpk::is_supported() {
-            println!("> mpk is not supported: ignoring test");
-            return;
-        }
-    };
-}
-/// Necessary for inter-module access.
-#[cfg(test)]
-pub(crate) use skip_if_mpk_unavailable;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn check_is_supported() {
-        println!("is pku supported = {}", is_supported());
-    }
-
-    #[test]
-    fn check_initialized_keys() {
-        if is_supported() {
-            assert!(!keys(15).is_empty())
-        }
-    }
-
-    #[test]
-    fn check_invalid_mark() {
-        skip_if_mpk_unavailable!();
-        let pkey = keys(15)[0];
-        let unaligned_region = unsafe {
-            let addr = 1 as *mut u8; // this is not page-aligned!
-            let len = 1;
-            std::slice::from_raw_parts_mut(addr, len)
-        };
-        let result = pkey.protect(unaligned_region);
-        assert!(result.is_err());
-        assert_eq!(
-            result.unwrap_err().to_string(),
-            "failed to mark region with pkey (addr = 0x1, len = 1, prot = 0b0)"
-        );
-    }
-
-    #[test]
-    fn check_masking() {
-        skip_if_mpk_unavailable!();
-        let original = pkru::read();
-
-        allow(ProtectionMask::all());
-        assert_eq!(0, pkru::read());
-
-        allow(ProtectionMask::all().or(ProtectionKey { id: 5, stripe: 0 }));
-        assert_eq!(0, pkru::read());
-
-        allow(ProtectionMask::zero());
-        assert_eq!(0b11111111_11111111_11111111_11111100, pkru::read());
-
-        allow(ProtectionMask::zero().or(ProtectionKey { id: 5, stripe: 0 }));
-        assert_eq!(0b11111111_11111111_11110011_11111100, pkru::read());
-
-        // Reset the PKRU state to what we originally observed.
-        pkru::write(original);
-    }
-}

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/mpk/pkru.rs

@@ -1,93 +0,0 @@
-//! Control access to the x86 `PKRU` register.
-//!
-//! As documented in the Intel Software Development Manual, vol 3a, section 2.7,
-//! the 32 bits of the `PKRU` register laid out as follows (note the
-//! little-endianness):
-//!
-//! ```text
-//! ┌───┬───┬───┬───┬───┬───┐
-//! │...│AD2│WD1│AD1│WD0│AD0│
-//! └───┴───┴───┴───┴───┴───┘
-//! ```
-//!
-//! - `ADn = 1` means "access disable key `n`"--no reads or writes allowed to
-//!   pages marked with key `n`.
-//! - `WDn = 1` means "write disable key `n`"--only reads are prevented to pages
-//!   marked with key `n`
-//! - it is unclear what it means to have both `ADn` and `WDn` set
-//!
-//! Note that this only handles the user-mode `PKRU` register; there is an
-//! equivalent supervisor-mode MSR, `IA32_PKRS`.
-
-use core::arch::asm;
-
-/// This `PKRU` register mask allows access to any pages marked with any
-/// key--in other words, reading and writing is permitted to all pages.
-pub const ALLOW_ACCESS: u32 = 0;
-
-/// This `PKRU` register mask disables access to any page marked with any
-/// key--in other words, no reading or writing to all pages.
-pub const DISABLE_ACCESS: u32 = 0b11111111_11111111_11111111_11111111;
-
-/// Read the value of the `PKRU` register.
-pub fn read() -> u32 {
-    // ECX must be 0 to prevent a general protection exception (#GP).
-    let ecx: u32 = 0;
-    let pkru: u32;
-    unsafe {
-        asm!("rdpkru", in("ecx") ecx, out("eax") pkru, out("edx") _,
-            options(nomem, nostack, preserves_flags));
-    }
-    return pkru;
-}
-
-/// Write a value to the `PKRU` register.
-pub fn write(pkru: u32) {
-    // Both ECX and EDX must be 0 to prevent a general protection exception
-    // (#GP).
-    let ecx: u32 = 0;
-    let edx: u32 = 0;
-    unsafe {
-        asm!("wrpkru", in("eax") pkru, in("ecx") ecx, in("edx") edx,
-            options(nomem, nostack, preserves_flags));
-    }
-}
-
-/// Check the `ECX.PKU` flag (bit 3) of the `07h` `CPUID` leaf; see the
-/// Intel Software Development Manual, vol 3a, section 2.7.
-pub fn has_cpuid_bit_set() -> bool {
-    // TODO: disable MPK support until the following issue is resolved:
-    // https://github.com/bytecodealliance/wasmtime/issues/7445
-    if true {
-        return false;
-    }
-    let result = unsafe { std::arch::x86_64::__cpuid(0x07) };
-    (result.ecx & 0b100) != 0
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::mpk::enabled::skip_if_mpk_unavailable;
-
-    #[test]
-    #[ignore = "cannot be run with other tests that munge the PKRU register"]
-    fn check_read() {
-        skip_if_mpk_unavailable!();
-        assert_eq!(read(), DISABLE_ACCESS ^ 1);
-        // By default, the Linux kernel only allows a process to access key 0,
-        // the default kernel key.
-    }
-
-    #[test]
-    fn check_roundtrip() {
-        skip_if_mpk_unavailable!();
-        let pkru = read();
-        // Allow access to pages marked with any key.
-        write(ALLOW_ACCESS);
-        assert_eq!(read(), ALLOW_ACCESS);
-        // Restore the original value.
-        write(pkru);
-        assert_eq!(read(), pkru);
-    }
-}

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/trampolines/aarch64.rs

@@ -1,42 +0,0 @@
-#[rustfmt::skip]
-macro_rules! wasm_to_libcall_trampoline {
-    ($libcall:ident ; $libcall_impl:ident) => {
-        wasmtime_asm_macros::asm_func!(
-            wasmtime_versioned_export_macros::versioned_stringify_ident!($libcall),
-            "
-                .cfi_startproc
-                bti c
-
-                // Load the pointer to `VMRuntimeLimits` in `x9`.
-                ldur x9, [x0, #8]
-
-                // Store the last Wasm FP into the `last_wasm_exit_fp` in the limits.
-                stur fp, [x9, #24]
-
-                // Store the last Wasm PC into the `last_wasm_exit_pc` in the limits.
-                stur lr, [x9, #32]
-
-                // Tail call to the actual implementation of this libcall.
-                b {}
-
-                .cfi_endproc
-            ",
-            sym $libcall_impl
-        );
-    };
-}
-
-#[cfg(test)]
-mod wasm_to_libcall_trampoline_offsets_tests {
-    use wasmtime_environ::{Module, PtrSize, VMOffsets};
-
-    #[test]
-    fn test() {
-        let module = Module::new();
-        let offsets = VMOffsets::new(std::mem::size_of::<*mut u8>() as u8, &module);
-
-        assert_eq!(8, offsets.vmctx_runtime_limits());
-        assert_eq!(24, offsets.ptr.vmruntime_limits_last_wasm_exit_fp());
-        assert_eq!(32, offsets.ptr.vmruntime_limits_last_wasm_exit_pc());
-    }
-}

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/trampolines/riscv64.rs

@@ -1,45 +0,0 @@
-#[rustfmt::skip]
-macro_rules! wasm_to_libcall_trampoline {
-    ($libcall:ident ; $libcall_impl:ident) => {
-        wasmtime_asm_macros::asm_func!(
-            wasmtime_versioned_export_macros::versioned_stringify_ident!($libcall),
-            concat!(
-                "
-                    .cfi_startproc
-
-                    // Load the pointer to `VMRuntimeLimits` in `t0`.
-                    ld t0, 8(a0)
-
-                    // Store the last Wasm FP into the `last_wasm_exit_fp` in the limits.
-                    sd fp, 24(t0)
-
-                    // Store the last Wasm PC into the `last_wasm_exit_pc` in the limits.
-                    sd ra, 32(t0)
-
-                    // Tail call to the actual implementation of this libcall.
-                .Lhi_{0}:
-                    auipc t0, %pcrel_hi({0})
-                    jalr x0, %pcrel_lo(.Lhi_{0})(t0)
-
-                    .cfi_endproc
-                ",
-            ),
-            sym $libcall_impl,
-        );
-    };
-}
-
-#[cfg(test)]
-mod wasm_to_libcall_trampoline_offsets_tests {
-    use wasmtime_environ::{Module, PtrSize, VMOffsets};
-
-    #[test]
-    fn test() {
-        let module = Module::new();
-        let offsets = VMOffsets::new(std::mem::size_of::<*mut u8>() as u8, &module);
-
-        assert_eq!(8, offsets.vmctx_runtime_limits());
-        assert_eq!(24, offsets.ptr.vmruntime_limits_last_wasm_exit_fp());
-        assert_eq!(32, offsets.ptr.vmruntime_limits_last_wasm_exit_pc());
-    }
-}

data/ext/cargo-vendor/wasmtime-runtime-15.0.1/src/trampolines/s390x.rs

@@ -1,25 +0,0 @@
-// The implementation for libcall trampolines is in the s390x.S
-// file.  We provide this dummy definition of wasm_to_libcall_trampoline
-// here to make libcalls.rs compile on s390x.  Note that this means we
-// have to duplicate the list of libcalls used in the assembler file.
-
-macro_rules! wasm_to_libcall_trampoline {
-    ($libcall:ident ; $libcall_impl:ident) => {};
-}
-
-// The wasm_to_host_trampoline implementation is in the s390x.S
-// file, but we still want to have this unit test here.
-#[cfg(test)]
-mod wasm_to_libcall_trampoline_offsets_tests {
-    use wasmtime_environ::{Module, PtrSize, VMOffsets};
-
-    #[test]
-    fn test() {
-        let module = Module::new();
-        let offsets = VMOffsets::new(std::mem::size_of::<*mut u8>() as u8, &module);
-
-        assert_eq!(8, offsets.vmctx_runtime_limits());
-        assert_eq!(24, offsets.ptr.vmruntime_limits_last_wasm_exit_fp());
-        assert_eq!(32, offsets.ptr.vmruntime_limits_last_wasm_exit_pc());
-    }
-}