wasmtime 17.0.1 → 18.0.3

data/ext/cargo-vendor/wasmtime-runtime-18.0.3/src/lib.rs

@@ -0,0 +1,264 @@
+//! Runtime library support for Wasmtime.
+
+#![deny(missing_docs)]
+#![warn(clippy::cast_sign_loss)]
+
+use anyhow::{Error, Result};
+use std::fmt;
+use std::ptr::NonNull;
+use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
+use std::sync::Arc;
+use wasmtime_environ::{DefinedFuncIndex, DefinedMemoryIndex, HostPtr, VMOffsets};
+
+mod arch;
+#[cfg(feature = "component-model")]
+pub mod component;
+mod export;
+mod externref;
+mod imports;
+mod instance;
+mod memory;
+mod mmap;
+mod mmap_vec;
+mod parking_spot;
+mod send_sync_ptr;
+mod store_box;
+mod sys;
+mod table;
+mod traphandlers;
+mod vmcontext;
+
+#[cfg(feature = "debug-builtins")]
+pub mod debug_builtins;
+pub mod libcalls;
+pub mod mpk;
+
+#[cfg(feature = "debug-builtins")]
+pub use wasmtime_jit_debug::gdb_jit_int::GdbJitImageRegistration;
+
+pub use crate::arch::{get_stack_pointer, V128Abi};
+pub use crate::export::*;
+pub use crate::externref::*;
+pub use crate::imports::Imports;
+pub use crate::instance::{
+    Instance, InstanceAllocationRequest, InstanceAllocator, InstanceAllocatorImpl, InstanceHandle,
+    MemoryAllocationIndex, OnDemandInstanceAllocator, StorePtr, TableAllocationIndex,
+};
+#[cfg(feature = "pooling-allocator")]
+pub use crate::instance::{
+    InstanceLimits, PoolingInstanceAllocator, PoolingInstanceAllocatorConfig,
+};
+pub use crate::memory::{
+    DefaultMemoryCreator, Memory, RuntimeLinearMemory, RuntimeMemoryCreator, SharedMemory,
+};
+pub use crate::mmap::Mmap;
+pub use crate::mmap_vec::MmapVec;
+pub use crate::mpk::MpkEnabled;
+pub use crate::store_box::*;
+pub use crate::sys::unwind::UnwindRegistration;
+pub use crate::table::{Table, TableElement};
+pub use crate::traphandlers::*;
+pub use crate::vmcontext::{
+    VMArrayCallFunction, VMArrayCallHostFuncContext, VMContext, VMFuncRef, VMFunctionBody,
+    VMFunctionImport, VMGlobalDefinition, VMGlobalImport, VMInvokeArgument, VMMemoryDefinition,
+    VMMemoryImport, VMNativeCallFunction, VMNativeCallHostFuncContext, VMOpaqueContext,
+    VMRuntimeLimits, VMSharedTypeIndex, VMTableDefinition, VMTableImport, VMWasmCallFunction,
+    ValRaw,
+};
+pub use send_sync_ptr::SendSyncPtr;
+
+mod module_id;
+pub use module_id::{CompiledModuleId, CompiledModuleIdAllocator};
+
+mod cow;
+pub use crate::cow::{MemoryImage, MemoryImageSlot, ModuleMemoryImages};
+
+/// Version number of this crate.
+pub const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Dynamic runtime functionality needed by this crate throughout the execution
+/// of a wasm instance.
+///
+/// This trait is used to store a raw pointer trait object within each
+/// `VMContext`. This raw pointer trait object points back to the
+/// `wasmtime::Store` internally but is type-erased so this `wasmtime_runtime`
+/// crate doesn't need the entire `wasmtime` crate to build.
+///
+/// Note that this is an extra-unsafe trait because no heed is paid to the
+/// lifetime of this store or the Send/Sync-ness of this store. All of that must
+/// be respected by embedders (e.g. the `wasmtime::Store` structure). The theory
+/// is that `wasmtime::Store` handles all this correctly.
+pub unsafe trait Store {
+    /// Returns the raw pointer in memory where this store's shared
+    /// `VMRuntimeLimits` structure is located.
+    ///
+    /// Used to configure `VMContext` initialization and store the right pointer
+    /// in the `VMContext`.
+    fn vmruntime_limits(&self) -> *mut VMRuntimeLimits;
+
+    /// Returns a pointer to the global epoch counter.
+    ///
+    /// Used to configure the `VMContext` on initialization.
+    fn epoch_ptr(&self) -> *const AtomicU64;
+
+    /// Returns the externref management structures necessary for this store.
+    ///
+    /// The first element returned is the table in which externrefs are stored
+    /// throughout wasm execution, and the second element is how to look up
+    /// module information for gc requests.
+    fn externref_activations_table(
+        &mut self,
+    ) -> (&mut VMExternRefActivationsTable, &dyn ModuleInfoLookup);
+
+    /// Callback invoked to allow the store's resource limiter to reject a
+    /// memory grow operation.
+    fn memory_growing(
+        &mut self,
+        current: usize,
+        desired: usize,
+        maximum: Option<usize>,
+    ) -> Result<bool, Error>;
+    /// Callback invoked to notify the store's resource limiter that a memory
+    /// grow operation has failed.
+    ///
+    /// Note that this is not invoked if `memory_growing` returns an error.
+    fn memory_grow_failed(&mut self, error: Error) -> Result<()>;
+    /// Callback invoked to allow the store's resource limiter to reject a
+    /// table grow operation.
+    fn table_growing(
+        &mut self,
+        current: u32,
+        desired: u32,
+        maximum: Option<u32>,
+    ) -> Result<bool, Error>;
+    /// Callback invoked to notify the store's resource limiter that a table
+    /// grow operation has failed.
+    ///
+    /// Note that this is not invoked if `table_growing` returns an error.
+    fn table_grow_failed(&mut self, error: Error) -> Result<()>;
+    /// Callback invoked whenever fuel runs out by a wasm instance. If an error
+    /// is returned that's raised as a trap. Otherwise wasm execution will
+    /// continue as normal.
+    fn out_of_gas(&mut self) -> Result<(), Error>;
+    /// Callback invoked whenever an instance observes a new epoch
+    /// number. Cannot fail; cooperative epoch-based yielding is
+    /// completely semantically transparent. Returns the new deadline.
+    fn new_epoch(&mut self) -> Result<u64, Error>;
+
+    /// Metadata required for resources for the component model.
+    #[cfg(feature = "component-model")]
+    fn component_calls(&mut self) -> &mut component::CallContexts;
+}
+
+/// Functionality required by this crate for a particular module. This
+/// is chiefly needed for lazy initialization of various bits of
+/// instance state.
+///
+/// When an instance is created, it holds an `Arc<dyn ModuleRuntimeInfo>`
+/// so that it can get to signatures, metadata on functions, memory and
+/// funcref-table images, etc. All of these things are ordinarily known
+/// by the higher-level layers of Wasmtime. Specifically, the main
+/// implementation of this trait is provided by
+/// `wasmtime::module::ModuleInner`.  Since the runtime crate sits at
+/// the bottom of the dependence DAG though, we don't know or care about
+/// that; we just need some implementor of this trait for each
+/// allocation request.
+pub trait ModuleRuntimeInfo: Send + Sync + 'static {
+    /// The underlying Module.
+    fn module(&self) -> &Arc<wasmtime_environ::Module>;
+
+    /// Returns the address, in memory, that the function `index` resides at.
+    fn function(&self, index: DefinedFuncIndex) -> NonNull<VMWasmCallFunction>;
+
+    /// Returns the address, in memory, of the trampoline that allows the given
+    /// defined Wasm function to be called by the native calling convention.
+    ///
+    /// Returns `None` for Wasm functions which do not escape, and therefore are
+    /// not callable from outside the Wasm module itself.
+    fn native_to_wasm_trampoline(
+        &self,
+        index: DefinedFuncIndex,
+    ) -> Option<NonNull<VMNativeCallFunction>>;
+
+    /// Returns the address, in memory, of the trampoline that allows the given
+    /// defined Wasm function to be called by the array calling convention.
+    ///
+    /// Returns `None` for Wasm functions which do not escape, and therefore are
+    /// not callable from outside the Wasm module itself.
+    fn array_to_wasm_trampoline(&self, index: DefinedFuncIndex) -> Option<VMArrayCallFunction>;
+
+    /// Return the address, in memory, of the trampoline that allows Wasm to
+    /// call a native function of the given signature.
+    fn wasm_to_native_trampoline(
+        &self,
+        signature: VMSharedTypeIndex,
+    ) -> Option<NonNull<VMWasmCallFunction>>;
+
+    /// Returns the `MemoryImage` structure used for copy-on-write
+    /// initialization of the memory, if it's applicable.
+    fn memory_image(&self, memory: DefinedMemoryIndex)
+        -> anyhow::Result<Option<&Arc<MemoryImage>>>;
+
+    /// A unique ID for this particular module. This can be used to
+    /// allow for fastpaths to optimize a "re-instantiate the same
+    /// module again" case.
+    fn unique_id(&self) -> Option<CompiledModuleId>;
+
+    /// A slice pointing to all data that is referenced by this instance.
+    fn wasm_data(&self) -> &[u8];
+
+    /// Returns an array, indexed by `SignatureIndex` of all
+    /// `VMSharedSignatureIndex` entries corresponding to the `SignatureIndex`.
+    fn type_ids(&self) -> &[VMSharedTypeIndex];
+
+    /// Offset information for the current host.
+    fn offsets(&self) -> &VMOffsets<HostPtr>;
+}
+
+/// Returns the host OS page size, in bytes.
+pub fn page_size() -> usize {
+    static PAGE_SIZE: AtomicUsize = AtomicUsize::new(0);
+
+    return match PAGE_SIZE.load(Ordering::Relaxed) {
+        0 => {
+            let size = sys::vm::get_page_size();
+            assert!(size != 0);
+            PAGE_SIZE.store(size, Ordering::Relaxed);
+            size
+        }
+        n => n,
+    };
+}
+
+/// Result of [`Memory::atomic_wait32`] and [`Memory::atomic_wait64`]
+#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+pub enum WaitResult {
+    /// Indicates that a `wait` completed by being awoken by a different thread.
+    /// This means the thread went to sleep and didn't time out.
+    Ok = 0,
+    /// Indicates that `wait` did not complete and instead returned due to the
+    /// value in memory not matching the expected value.
+    Mismatch = 1,
+    /// Indicates that `wait` completed with a timeout, meaning that the
+    /// original value matched as expected but nothing ever called `notify`.
+    TimedOut = 2,
+}
+
+/// Description about a fault that occurred in WebAssembly.
+#[derive(Debug)]
+pub struct WasmFault {
+    /// The size of memory, in bytes, at the time of the fault.
+    pub memory_size: usize,
+    /// The WebAssembly address at which the fault occurred.
+    pub wasm_address: u64,
+}
+
+impl fmt::Display for WasmFault {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "memory fault at wasm address 0x{:x} in linear memory of size 0x{:x}",
+            self.wasm_address, self.memory_size,
+        )
+    }
+}

data/ext/cargo-vendor/wasmtime-runtime-18.0.3/src/mpk/enabled.rs

@@ -0,0 +1,208 @@
+//!
+
+use super::{pkru, sys};
+use anyhow::{Context, Result};
+use std::sync::OnceLock;
+
+/// Check if the MPK feature is supported.
+pub fn is_supported() -> bool {
+    cfg!(target_os = "linux") && cfg!(target_arch = "x86_64") && pkru::has_cpuid_bit_set()
+}
+
+/// Allocate up to `max` protection keys.
+///
+/// This asks the kernel for all available keys up to `max` in a thread-safe way
+/// (we can expect 1-15; 0 is kernel-reserved). This avoids interference when
+/// multiple threads try to allocate keys at the same time (e.g., during
+/// testing). It also ensures that a single copy of the keys is reserved for the
+/// lifetime of the process. Because of this, `max` is only a hint to
+/// allocation: it only is effective on the first invocation of this function.
+///
+/// TODO: this is not the best-possible design. This creates global state that
+/// would prevent any other code in the process from using protection keys; the
+/// `KEYS` are never deallocated from the system with `pkey_dealloc`.
+pub fn keys(max: usize) -> &'static [ProtectionKey] {
+    let keys = KEYS.get_or_init(|| {
+        let mut allocated = vec![];
+        if is_supported() {
+            while allocated.len() < max {
+                if let Ok(key_id) = sys::pkey_alloc(0, 0) {
+                    debug_assert!(key_id < 16);
+                    // UNSAFETY: here we unsafely assume that the
+                    // system-allocated pkey will exist forever.
+                    allocated.push(ProtectionKey {
+                        id: key_id,
+                        stripe: allocated.len().try_into().unwrap(),
+                    });
+                } else {
+                    break;
+                }
+            }
+        }
+        allocated
+    });
+    &keys[..keys.len().min(max)]
+}
+static KEYS: OnceLock<Vec<ProtectionKey>> = OnceLock::new();
+
+/// Only allow access to pages marked by the keys set in `mask`.
+///
+/// Any accesses to pages marked by another key will result in a `SIGSEGV`
+/// fault.
+pub fn allow(mask: ProtectionMask) {
+    let previous = if log::log_enabled!(log::Level::Trace) {
+        pkru::read()
+    } else {
+        0
+    };
+    pkru::write(mask.0);
+    log::trace!("PKRU change: {:#034b} => {:#034b}", previous, pkru::read());
+}
+
+/// An MPK protection key.
+///
+/// The expected usage is:
+/// - receive system-allocated keys from [`keys`]
+/// - mark some regions of memory as accessible with [`ProtectionKey::protect`]
+/// - [`allow`] or disallow access to the memory regions using a
+///   [`ProtectionMask`]; any accesses to unmarked pages result in a fault
+/// - drop the key
+#[derive(Clone, Copy, Debug)]
+pub struct ProtectionKey {
+    id: u32,
+    stripe: u32,
+}
+
+impl ProtectionKey {
+    /// Mark a page as protected by this [`ProtectionKey`].
+    ///
+    /// This "colors" the pages of `region` via a kernel `pkey_mprotect` call to
+    /// only allow reads and writes when this [`ProtectionKey`] is activated
+    /// (see [`allow`]).
+    ///
+    /// # Errors
+    ///
+    /// This will fail if the region is not page aligned or for some unknown
+    /// kernel reason.
+    pub fn protect(&self, region: &mut [u8]) -> Result<()> {
+        let addr = region.as_mut_ptr() as usize;
+        let len = region.len();
+        let prot = sys::PROT_NONE;
+        sys::pkey_mprotect(addr, len, prot, self.id).with_context(|| {
+            format!(
+                "failed to mark region with pkey (addr = {addr:#x}, len = {len}, prot = {prot:#b})"
+            )
+        })
+    }
+
+    /// Convert the [`ProtectionKey`] to its 0-based index; this is useful for
+    /// determining which allocation "stripe" a key belongs to.
+    ///
+    /// This function assumes that the kernel has allocated key 0 for itself.
+    pub fn as_stripe(&self) -> usize {
+        self.stripe as usize
+    }
+}
+
+/// A bit field indicating which protection keys should be allowed and disabled.
+///
+/// The internal representation makes it easy to use [`ProtectionMask`] directly
+/// with the PKRU register. When bits `n` and `n+1` are set, it means the
+/// protection key is *not* allowed (see the PKRU write and access disabled
+/// bits).
+pub struct ProtectionMask(u32);
+impl ProtectionMask {
+    /// Allow access from all protection keys.
+    #[inline]
+    pub fn all() -> Self {
+        Self(pkru::ALLOW_ACCESS)
+    }
+
+    /// Only allow access to memory protected with protection key 0; note that
+    /// this does not mean "none" but rather allows access from the default
+    /// kernel protection key.
+    #[inline]
+    pub fn zero() -> Self {
+        Self(pkru::DISABLE_ACCESS ^ 0b11)
+    }
+
+    /// Include `pkey` as another allowed protection key in the mask.
+    #[inline]
+    pub fn or(self, pkey: ProtectionKey) -> Self {
+        let mask = pkru::DISABLE_ACCESS ^ 0b11 << (pkey.id * 2);
+        Self(self.0 & mask)
+    }
+}
+
+/// Helper macro for skipping tests on systems that do not have MPK enabled
+/// (e.g., older architecture, disabled by kernel, etc.)
+#[cfg(test)]
+macro_rules! skip_if_mpk_unavailable {
+    () => {
+        if !crate::mpk::is_supported() {
+            println!("> mpk is not supported: ignoring test");
+            return;
+        }
+    };
+}
+/// Necessary for inter-module access.
+#[cfg(test)]
+pub(crate) use skip_if_mpk_unavailable;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_is_supported() {
+        println!("is pku supported = {}", is_supported());
+        if std::env::var("WASMTIME_TEST_FORCE_MPK").is_ok() {
+            assert!(is_supported());
+        }
+    }
+
+    #[test]
+    fn check_initialized_keys() {
+        if is_supported() {
+            assert!(!keys(15).is_empty())
+        }
+    }
+
+    #[test]
+    fn check_invalid_mark() {
+        skip_if_mpk_unavailable!();
+        let pkey = keys(15)[0];
+        let unaligned_region = unsafe {
+            let addr = 1 as *mut u8; // this is not page-aligned!
+            let len = 1;
+            std::slice::from_raw_parts_mut(addr, len)
+        };
+        let result = pkey.protect(unaligned_region);
+        assert!(result.is_err());
+        assert_eq!(
+            result.unwrap_err().to_string(),
+            "failed to mark region with pkey (addr = 0x1, len = 1, prot = 0b0)"
+        );
+    }
+
+    #[test]
+    fn check_masking() {
+        skip_if_mpk_unavailable!();
+        let original = pkru::read();
+
+        allow(ProtectionMask::all());
+        assert_eq!(0, pkru::read());
+
+        allow(ProtectionMask::all().or(ProtectionKey { id: 5, stripe: 0 }));
+        assert_eq!(0, pkru::read());
+
+        allow(ProtectionMask::zero());
+        assert_eq!(0b11111111_11111111_11111111_11111100, pkru::read());
+
+        allow(ProtectionMask::zero().or(ProtectionKey { id: 5, stripe: 0 }));
+        assert_eq!(0b11111111_11111111_11110011_11111100, pkru::read());
+
+        // Reset the PKRU state to what we originally observed.
+        pkru::write(original);
+    }
+}

data/ext/cargo-vendor/wasmtime-runtime-18.0.3/src/mpk/pkru.rs

@@ -0,0 +1,104 @@
+//! Control access to the x86 `PKRU` register.
+//!
+//! As documented in the Intel Software Development Manual, vol 3a, section 2.7,
+//! the 32 bits of the `PKRU` register laid out as follows (note the
+//! little-endianness):
+//!
+//! ```text
+//! ┌───┬───┬───┬───┬───┬───┐
+//! │...│AD2│WD1│AD1│WD0│AD0│
+//! └───┴───┴───┴───┴───┴───┘
+//! ```
+//!
+//! - `ADn = 1` means "access disable key `n`"--no reads or writes allowed to
+//!   pages marked with key `n`.
+//! - `WDn = 1` means "write disable key `n`"--only reads are prevented to pages
+//!   marked with key `n`
+//! - it is unclear what it means to have both `ADn` and `WDn` set
+//!
+//! Note that this only handles the user-mode `PKRU` register; there is an
+//! equivalent supervisor-mode MSR, `IA32_PKRS`.
+
+use core::arch::asm;
+
+/// This `PKRU` register mask allows access to any pages marked with any
+/// key--in other words, reading and writing is permitted to all pages.
+pub const ALLOW_ACCESS: u32 = 0;
+
+/// This `PKRU` register mask disables access to any page marked with any
+/// key--in other words, no reading or writing to all pages.
+pub const DISABLE_ACCESS: u32 = 0b11111111_11111111_11111111_11111111;
+
+/// Read the value of the `PKRU` register.
+#[inline]
+pub fn read() -> u32 {
+    // ECX must be 0 to prevent a general protection exception (#GP).
+    let ecx: u32 = 0;
+    let pkru: u32;
+    unsafe {
+        asm!("rdpkru", in("ecx") ecx, out("eax") pkru, out("edx") _,
+            options(nomem, nostack, preserves_flags));
+    }
+    return pkru;
+}
+
+/// Write a value to the `PKRU` register.
+#[inline]
+pub fn write(pkru: u32) {
+    // Both ECX and EDX must be 0 to prevent a general protection exception
+    // (#GP).
+    let ecx: u32 = 0;
+    let edx: u32 = 0;
+    unsafe {
+        asm!("wrpkru", in("eax") pkru, in("ecx") ecx, in("edx") edx,
+            options(nomem, nostack, preserves_flags));
+    }
+}
+
+/// Check the `ECX.PKU` flag (bit 3, zero-based) of the `07h` `CPUID` leaf; see
+/// the Intel Software Development Manual, vol 3a, section 2.7. This flag is
+/// only set on Intel CPUs, so this function also checks the `CPUID` vendor
+/// string.
+pub fn has_cpuid_bit_set() -> bool {
+    let result = unsafe { std::arch::x86_64::__cpuid(0x07) };
+    is_intel_cpu() && (result.ecx & 0b1000) != 0
+}
+
+/// Check the `CPUID` vendor string for `GenuineIntel`; see the Intel Software
+/// Development Manual, vol 2a, `CPUID` description.
+pub fn is_intel_cpu() -> bool {
+    // To read the CPU vendor string, we pass 0 in EAX and read 12 ASCII bytes
+    // from EBX, EDX, and ECX (in that order).
+    let result = unsafe { std::arch::x86_64::__cpuid(0) };
+    // Then we check if the vendor string matches "GenuineIntel".
+    result.ebx == u32::from_le_bytes(*b"Genu")
+        && result.edx == u32::from_le_bytes(*b"ineI")
+        && result.ecx == u32::from_le_bytes(*b"ntel")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::mpk::enabled::skip_if_mpk_unavailable;
+
+    #[test]
+    #[ignore = "cannot be run with other tests that munge the PKRU register"]
+    fn check_read() {
+        skip_if_mpk_unavailable!();
+        assert_eq!(read(), DISABLE_ACCESS ^ 1);
+        // By default, the Linux kernel only allows a process to access key 0,
+        // the default kernel key.
+    }
+
+    #[test]
+    fn check_roundtrip() {
+        skip_if_mpk_unavailable!();
+        let pkru = read();
+        // Allow access to pages marked with any key.
+        write(ALLOW_ACCESS);
+        assert_eq!(read(), ALLOW_ACCESS);
+        // Restore the original value.
+        write(pkru);
+        assert_eq!(read(), pkru);
+    }
+}