wasmtime 20.0.2 → 21.0.1

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/mmap.rs

@@ -0,0 +1,220 @@
+//! Low-level abstraction for allocating and managing zero-filled pages
+//! of memory.
+
+use crate::prelude::*;
+use crate::runtime::vm::sys::mmap;
+use anyhow::{Context, Result};
+use core::ops::Range;
+#[cfg(feature = "std")]
+use std::{fs::File, path::Path, sync::Arc};
+
+/// A simple struct consisting of a page-aligned pointer to page-aligned
+/// and initially-zeroed memory and a length.
+#[derive(Debug)]
+pub struct Mmap {
+    sys: mmap::Mmap,
+    #[cfg(feature = "std")]
+    file: Option<Arc<File>>,
+}
+
+impl Mmap {
+    /// Create a new `Mmap` pointing to at least `size` bytes of page-aligned
+    /// accessible memory.
+    pub fn with_at_least(size: usize) -> Result<Self> {
+        let page_size = crate::runtime::vm::page_size();
+        let rounded_size = (size + (page_size - 1)) & !(page_size - 1);
+        Self::accessible_reserved(rounded_size, rounded_size)
+    }
+
+    /// Creates a new `Mmap` by opening the file located at `path` and mapping
+    /// it into memory.
+    ///
+    /// The memory is mapped in read-only mode for the entire file. If portions
+    /// of the file need to be modified then the `region` crate can be use to
+    /// alter permissions of each page.
+    ///
+    /// The memory mapping and the length of the file within the mapping are
+    /// returned.
+    #[cfg(feature = "std")]
+    pub fn from_file(path: &Path) -> Result<Self> {
+        let (sys, file) = mmap::Mmap::from_file(path)?;
+        Ok(Mmap {
+            sys,
+            file: Some(Arc::new(file)),
+        })
+    }
+
+    /// Create a new `Mmap` pointing to `accessible_size` bytes of page-aligned
+    /// accessible memory, within a reserved mapping of `mapping_size` bytes.
+    /// `accessible_size` and `mapping_size` must be native page-size multiples.
+    ///
+    /// # Panics
+    ///
+    /// This function will panic if `accessible_size` is greater than
+    /// `mapping_size` or if either of them are not page-aligned.
+    pub fn accessible_reserved(accessible_size: usize, mapping_size: usize) -> Result<Self> {
+        let page_size = crate::runtime::vm::page_size();
+        assert!(accessible_size <= mapping_size);
+        assert_eq!(mapping_size & (page_size - 1), 0);
+        assert_eq!(accessible_size & (page_size - 1), 0);
+
+        if mapping_size == 0 {
+            Ok(Mmap {
+                sys: mmap::Mmap::new_empty(),
+                #[cfg(feature = "std")]
+                file: None,
+            })
+        } else if accessible_size == mapping_size {
+            Ok(Mmap {
+                sys: mmap::Mmap::new(mapping_size)
+                    .context(format!("mmap failed to allocate {mapping_size:#x} bytes"))?,
+                #[cfg(feature = "std")]
+                file: None,
+            })
+        } else {
+            let mut result = Mmap {
+                sys: mmap::Mmap::reserve(mapping_size)
+                    .context(format!("mmap failed to reserve {mapping_size:#x} bytes"))?,
+                #[cfg(feature = "std")]
+                file: None,
+            };
+            if accessible_size > 0 {
+                result.make_accessible(0, accessible_size).context(format!(
+                    "mmap failed to allocate {accessible_size:#x} bytes"
+                ))?;
+            }
+            Ok(result)
+        }
+    }
+
+    /// Make the memory starting at `start` and extending for `len` bytes
+    /// accessible. `start` and `len` must be native page-size multiples and
+    /// describe a range within `self`'s reserved memory.
+    ///
+    /// # Panics
+    ///
+    /// This function will panic if `start` or `len` is not page aligned or if
+    /// either are outside the bounds of this mapping.
+    pub fn make_accessible(&mut self, start: usize, len: usize) -> Result<()> {
+        let page_size = crate::runtime::vm::page_size();
+        assert_eq!(start & (page_size - 1), 0);
+        assert_eq!(len & (page_size - 1), 0);
+        assert!(len <= self.len());
+        assert!(start <= self.len() - len);
+
+        self.sys.make_accessible(start, len)
+    }
+
+    /// Return the allocated memory as a slice of u8.
+    ///
+    /// # Safety
+    ///
+    /// The caller must ensure that the range of bytes is accessible to the
+    /// program and additionally has previously been initialized.
+    ///
+    /// # Panics
+    ///
+    /// Panics of the `range` provided is outside of the limits of this mmap.
+    #[inline]
+    pub unsafe fn slice(&self, range: Range<usize>) -> &[u8] {
+        assert!(range.start <= range.end);
+        assert!(range.end <= self.len());
+        core::slice::from_raw_parts(self.as_ptr().add(range.start), range.end - range.start)
+    }
+
+    /// Return the allocated memory as a mutable slice of u8.
+    ///
+    /// # Safety
+    ///
+    /// The caller must ensure that the range of bytes is accessible to the
+    /// program and additionally has previously been initialized.
+    ///
+    /// # Panics
+    ///
+    /// Panics of the `range` provided is outside of the limits of this mmap.
+    pub unsafe fn slice_mut(&mut self, range: Range<usize>) -> &mut [u8] {
+        assert!(range.start <= range.end);
+        assert!(range.end <= self.len());
+        core::slice::from_raw_parts_mut(self.as_mut_ptr().add(range.start), range.end - range.start)
+    }
+
+    /// Return the allocated memory as a pointer to u8.
+    #[inline]
+    pub fn as_ptr(&self) -> *const u8 {
+        self.sys.as_ptr()
+    }
+
+    /// Return the allocated memory as a mutable pointer to u8.
+    #[inline]
+    pub fn as_mut_ptr(&mut self) -> *mut u8 {
+        self.sys.as_mut_ptr()
+    }
+
+    /// Return the length of the allocated memory.
+    ///
+    /// This is the byte length of this entire mapping which includes both
+    /// addressible and non-addressible memory.
+    #[inline]
+    pub fn len(&self) -> usize {
+        self.sys.len()
+    }
+
+    /// Return whether any memory has been allocated or reserved.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Makes the specified `range` within this `Mmap` to be read/execute.
+    ///
+    /// # Unsafety
+    ///
+    /// This method is unsafe as it's generally not valid to simply make memory
+    /// executable, so it's up to the caller to ensure that everything is in
+    /// order and this doesn't overlap with other memory that should only be
+    /// read or only read/write.
+    ///
+    /// # Panics
+    ///
+    /// Panics of `range` is out-of-bounds or not page-aligned.
+    pub unsafe fn make_executable(
+        &self,
+        range: Range<usize>,
+        enable_branch_protection: bool,
+    ) -> Result<()> {
+        assert!(range.start <= self.len());
+        assert!(range.end <= self.len());
+        assert!(range.start <= range.end);
+        assert!(
+            range.start % crate::runtime::vm::page_size() == 0,
+            "changing of protections isn't page-aligned",
+        );
+        self.sys
+            .make_executable(range, enable_branch_protection)
+            .context("failed to make memory executable")
+    }
+
+    /// Makes the specified `range` within this `Mmap` to be readonly.
+    pub unsafe fn make_readonly(&self, range: Range<usize>) -> Result<()> {
+        assert!(range.start <= self.len());
+        assert!(range.end <= self.len());
+        assert!(range.start <= range.end);
+        assert!(
+            range.start % crate::runtime::vm::page_size() == 0,
+            "changing of protections isn't page-aligned",
+        );
+        self.sys
+            .make_readonly(range)
+            .context("failed to make memory readonly")
+    }
+
+    /// Returns the underlying file that this mmap is mapping, if present.
+    #[cfg(feature = "std")]
+    pub fn original_file(&self) -> Option<&Arc<File>> {
+        self.file.as_ref()
+    }
+}
+
+fn _assert() {
+    fn _assert_send_sync<T: Send + Sync>() {}
+    _assert_send_sync::<Mmap>();
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/mmap_vec.rs

@@ -0,0 +1,162 @@
+use crate::prelude::*;
+use crate::runtime::vm::Mmap;
+use alloc::sync::Arc;
+use anyhow::Result;
+use core::ops::{Deref, DerefMut, Range};
+#[cfg(feature = "std")]
+use std::{fs::File, path::Path};
+
+/// A type akin to `Vec<u8>`, but backed by `mmap` and able to be split.
+///
+/// This type is a non-growable owned list of bytes. It can be segmented into
+/// disjoint separately owned views akin to the `split_at` method on slices in
+/// Rust. An `MmapVec` is backed by an OS-level memory allocation and is not
+/// suitable for lots of small allocation (since it works at the page
+/// granularity).
+///
+/// An `MmapVec` is an owned value which means that owners have the ability to
+/// get exclusive access to the underlying bytes, enabling mutation.
+pub struct MmapVec {
+    mmap: Arc<Mmap>,
+    range: Range<usize>,
+}
+
+impl MmapVec {
+    /// Consumes an existing `mmap` and wraps it up into an `MmapVec`.
+    ///
+    /// The returned `MmapVec` will have the `size` specified, which can be
+    /// smaller than the region mapped by the `Mmap`. The returned `MmapVec`
+    /// will only have at most `size` bytes accessible.
+    pub fn new(mmap: Mmap, size: usize) -> MmapVec {
+        assert!(size <= mmap.len());
+        MmapVec {
+            mmap: Arc::new(mmap),
+            range: 0..size,
+        }
+    }
+
+    /// Creates a new zero-initialized `MmapVec` with the given `size`.
+    ///
+    /// This commit will return a new `MmapVec` suitably sized to hold `size`
+    /// bytes. All bytes will be initialized to zero since this is a fresh OS
+    /// page allocation.
+    pub fn with_capacity(size: usize) -> Result<MmapVec> {
+        Ok(MmapVec::new(Mmap::with_at_least(size)?, size))
+    }
+
+    /// Creates a new `MmapVec` from the contents of an existing `slice`.
+    ///
+    /// A new `MmapVec` is allocated to hold the contents of `slice` and then
+    /// `slice` is copied into the new mmap. It's recommended to avoid this
+    /// method if possible to avoid the need to copy data around.
+    pub fn from_slice(slice: &[u8]) -> Result<MmapVec> {
+        let mut result = MmapVec::with_capacity(slice.len())?;
+        result.copy_from_slice(slice);
+        Ok(result)
+    }
+
+    /// Creates a new `MmapVec` which is the `path` specified mmap'd into
+    /// memory.
+    ///
+    /// This function will attempt to open the file located at `path` and will
+    /// then use that file to learn about its size and map the full contents
+    /// into memory. This will return an error if the file doesn't exist or if
+    /// it's too large to be fully mapped into memory.
+    #[cfg(feature = "std")]
+    pub fn from_file(path: &Path) -> Result<MmapVec> {
+        use anyhow::Context;
+
+        let mmap = Mmap::from_file(path)
+            .with_context(|| format!("failed to create mmap for file: {}", path.display()))?;
+        let len = mmap.len();
+        Ok(MmapVec::new(mmap, len))
+    }
+
+    /// Makes the specified `range` within this `mmap` to be read/execute.
+    pub unsafe fn make_executable(
+        &self,
+        range: Range<usize>,
+        enable_branch_protection: bool,
+    ) -> Result<()> {
+        assert!(range.start <= range.end);
+        assert!(range.end <= self.range.len());
+        self.mmap.make_executable(
+            range.start + self.range.start..range.end + self.range.start,
+            enable_branch_protection,
+        )
+    }
+
+    /// Makes the specified `range` within this `mmap` to be read-only.
+    pub unsafe fn make_readonly(&self, range: Range<usize>) -> Result<()> {
+        assert!(range.start <= range.end);
+        assert!(range.end <= self.range.len());
+        self.mmap
+            .make_readonly(range.start + self.range.start..range.end + self.range.start)
+    }
+
+    /// Returns the underlying file that this mmap is mapping, if present.
+    #[cfg(feature = "std")]
+    pub fn original_file(&self) -> Option<&Arc<File>> {
+        self.mmap.original_file()
+    }
+
+    /// Returns the offset within the original mmap that this `MmapVec` is
+    /// created from.
+    pub fn original_offset(&self) -> usize {
+        self.range.start
+    }
+
+    /// Returns the bounds, in host memory, of where this mmap
+    /// image resides.
+    pub fn image_range(&self) -> Range<*const u8> {
+        let base = self.as_ptr();
+        let len = self.len();
+        base..base.wrapping_add(len)
+    }
+}
+
+impl Deref for MmapVec {
+    type Target = [u8];
+
+    #[inline]
+    fn deref(&self) -> &[u8] {
+        // SAFETY: this mmap owns its own range of the underlying mmap so it
+        // should be all good-to-read.
+        unsafe { self.mmap.slice(self.range.clone()) }
+    }
+}
+
+impl DerefMut for MmapVec {
+    fn deref_mut(&mut self) -> &mut [u8] {
+        // SAFETY: The underlying mmap is protected behind an `Arc` which means
+        // there there can be many references to it. We are guaranteed, though,
+        // that each reference to the underlying `mmap` has a disjoint `range`
+        // listed that it can access. This means that despite having shared
+        // access to the mmap itself we have exclusive ownership of the bytes
+        // specified in `self.range`. This should allow us to safely hand out
+        // mutable access to these bytes if so desired.
+        unsafe {
+            let slice =
+                core::slice::from_raw_parts_mut(self.mmap.as_ptr().cast_mut(), self.mmap.len());
+            &mut slice[self.range.clone()]
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::MmapVec;
+
+    #[test]
+    fn smoke() {
+        let mut mmap = MmapVec::with_capacity(10).unwrap();
+        assert_eq!(mmap.len(), 10);
+        assert_eq!(&mmap[..], &[0; 10]);
+
+        mmap[0] = 1;
+        mmap[2] = 3;
+        assert!(mmap.get(10).is_none());
+        assert_eq!(mmap[0], 1);
+        assert_eq!(mmap[2], 3);
+    }
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/module_id.rs

@@ -0,0 +1,43 @@
+//! Unique IDs for modules in the runtime.
+
+use core::{
+    num::NonZeroU64,
+    sync::atomic::{AtomicU64, Ordering},
+};
+
+/// A unique identifier (within an engine or similar) for a compiled
+/// module.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct CompiledModuleId(NonZeroU64);
+
+/// An allocator for compiled module IDs.
+pub struct CompiledModuleIdAllocator {
+    next: AtomicU64,
+}
+
+impl CompiledModuleIdAllocator {
+    /// Create a compiled-module ID allocator.
+    pub fn new() -> Self {
+        Self {
+            next: AtomicU64::new(1),
+        }
+    }
+
+    /// Allocate a new ID.
+    pub fn alloc(&self) -> CompiledModuleId {
+        // Note: why is `Relaxed` OK here?
+        //
+        // The only requirement we have is that IDs are unique. We
+        // don't care how one module's ID compares to another, i.e.,
+        // what order they come in. `Relaxed` means that this
+        // `fetch_add` operation does not have any particular
+        // synchronization (ordering) with respect to any other memory
+        // access in the program. However, `fetch_add` is always
+        // atomic with respect to other accesses to this variable
+        // (`self.next`). So we will always hand out separate, unique
+        // IDs correctly, just in some possibly arbitrary order (which
+        // is fine).
+        let id = self.next.fetch_add(1, Ordering::Relaxed);
+        CompiledModuleId(NonZeroU64::new(id).unwrap())
+    }
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/mpk/enabled.rs

@@ -0,0 +1,214 @@
+//!
+
+use super::{pkru, sys};
+use crate::prelude::*;
+use anyhow::{Context, Result};
+use std::sync::OnceLock;
+
+/// Check if the MPK feature is supported.
+pub fn is_supported() -> bool {
+    cfg!(target_os = "linux") && cfg!(target_arch = "x86_64") && pkru::has_cpuid_bit_set()
+}
+
+/// Allocate up to `max` protection keys.
+///
+/// This asks the kernel for all available keys up to `max` in a thread-safe way
+/// (we can expect 1-15; 0 is kernel-reserved). This avoids interference when
+/// multiple threads try to allocate keys at the same time (e.g., during
+/// testing). It also ensures that a single copy of the keys is reserved for the
+/// lifetime of the process. Because of this, `max` is only a hint to
+/// allocation: it only is effective on the first invocation of this function.
+///
+/// TODO: this is not the best-possible design. This creates global state that
+/// would prevent any other code in the process from using protection keys; the
+/// `KEYS` are never deallocated from the system with `pkey_dealloc`.
+pub fn keys(max: usize) -> &'static [ProtectionKey] {
+    let keys = KEYS.get_or_init(|| {
+        let mut allocated = vec![];
+        if is_supported() {
+            while allocated.len() < max {
+                if let Ok(key_id) = sys::pkey_alloc(0, 0) {
+                    debug_assert!(key_id < 16);
+                    // UNSAFETY: here we unsafely assume that the
+                    // system-allocated pkey will exist forever.
+                    allocated.push(ProtectionKey {
+                        id: key_id,
+                        stripe: allocated.len().try_into().unwrap(),
+                    });
+                } else {
+                    break;
+                }
+            }
+        }
+        allocated
+    });
+    &keys[..keys.len().min(max)]
+}
+static KEYS: OnceLock<Vec<ProtectionKey>> = OnceLock::new();
+
+/// Only allow access to pages marked by the keys set in `mask`.
+///
+/// Any accesses to pages marked by another key will result in a `SIGSEGV`
+/// fault.
+pub fn allow(mask: ProtectionMask) {
+    let previous = if log::log_enabled!(log::Level::Trace) {
+        pkru::read()
+    } else {
+        0
+    };
+    pkru::write(mask.0);
+    log::trace!("PKRU change: {:#034b} => {:#034b}", previous, pkru::read());
+}
+
+/// Retrieve the current protection mask.
+pub fn current_mask() -> ProtectionMask {
+    ProtectionMask(pkru::read())
+}
+
+/// An MPK protection key.
+///
+/// The expected usage is:
+/// - receive system-allocated keys from [`keys`]
+/// - mark some regions of memory as accessible with [`ProtectionKey::protect`]
+/// - [`allow`] or disallow access to the memory regions using a
+///   [`ProtectionMask`]; any accesses to unmarked pages result in a fault
+/// - drop the key
+#[derive(Clone, Copy, Debug)]
+pub struct ProtectionKey {
+    id: u32,
+    stripe: u32,
+}
+
+impl ProtectionKey {
+    /// Mark a page as protected by this [`ProtectionKey`].
+    ///
+    /// This "colors" the pages of `region` via a kernel `pkey_mprotect` call to
+    /// only allow reads and writes when this [`ProtectionKey`] is activated
+    /// (see [`allow`]).
+    ///
+    /// # Errors
+    ///
+    /// This will fail if the region is not page aligned or for some unknown
+    /// kernel reason.
+    pub fn protect(&self, region: &mut [u8]) -> Result<()> {
+        let addr = region.as_mut_ptr() as usize;
+        let len = region.len();
+        let prot = sys::PROT_NONE;
+        sys::pkey_mprotect(addr, len, prot, self.id).with_context(|| {
+            format!(
+                "failed to mark region with pkey (addr = {addr:#x}, len = {len}, prot = {prot:#b})"
+            )
+        })
+    }
+
+    /// Convert the [`ProtectionKey`] to its 0-based index; this is useful for
+    /// determining which allocation "stripe" a key belongs to.
+    ///
+    /// This function assumes that the kernel has allocated key 0 for itself.
+    pub fn as_stripe(&self) -> usize {
+        self.stripe as usize
+    }
+}
+
+/// A bit field indicating which protection keys should be allowed and disabled.
+///
+/// The internal representation makes it easy to use [`ProtectionMask`] directly
+/// with the PKRU register. When bits `n` and `n+1` are set, it means the
+/// protection key is *not* allowed (see the PKRU write and access disabled
+/// bits).
+pub struct ProtectionMask(u32);
+impl ProtectionMask {
+    /// Allow access from all protection keys.
+    #[inline]
+    pub fn all() -> Self {
+        Self(pkru::ALLOW_ACCESS)
+    }
+
+    /// Only allow access to memory protected with protection key 0; note that
+    /// this does not mean "none" but rather allows access from the default
+    /// kernel protection key.
+    #[inline]
+    pub fn zero() -> Self {
+        Self(pkru::DISABLE_ACCESS ^ 0b11)
+    }
+
+    /// Include `pkey` as another allowed protection key in the mask.
+    #[inline]
+    pub fn or(self, pkey: ProtectionKey) -> Self {
+        let mask = pkru::DISABLE_ACCESS ^ 0b11 << (pkey.id * 2);
+        Self(self.0 & mask)
+    }
+}
+
+/// Helper macro for skipping tests on systems that do not have MPK enabled
+/// (e.g., older architecture, disabled by kernel, etc.)
+#[cfg(test)]
+macro_rules! skip_if_mpk_unavailable {
+    () => {
+        if !crate::runtime::vm::mpk::is_supported() {
+            println!("> mpk is not supported: ignoring test");
+            return;
+        }
+    };
+}
+/// Necessary for inter-module access.
+#[cfg(test)]
+pub(crate) use skip_if_mpk_unavailable;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_is_supported() {
+        println!("is pku supported = {}", is_supported());
+        if std::env::var("WASMTIME_TEST_FORCE_MPK").is_ok() {
+            assert!(is_supported());
+        }
+    }
+
+    #[test]
+    fn check_initialized_keys() {
+        if is_supported() {
+            assert!(!keys(15).is_empty())
+        }
+    }
+
+    #[test]
+    fn check_invalid_mark() {
+        skip_if_mpk_unavailable!();
+        let pkey = keys(15)[0];
+        let unaligned_region = unsafe {
+            let addr = 1 as *mut u8; // this is not page-aligned!
+            let len = 1;
+            std::slice::from_raw_parts_mut(addr, len)
+        };
+        let result = pkey.protect(unaligned_region);
+        assert!(result.is_err());
+        assert_eq!(
+            result.unwrap_err().to_string(),
+            "failed to mark region with pkey (addr = 0x1, len = 1, prot = 0b0)"
+        );
+    }
+
+    #[test]
+    fn check_masking() {
+        skip_if_mpk_unavailable!();
+        let original = pkru::read();
+
+        allow(ProtectionMask::all());
+        assert_eq!(0, pkru::read());
+
+        allow(ProtectionMask::all().or(ProtectionKey { id: 5, stripe: 0 }));
+        assert_eq!(0, pkru::read());
+
+        allow(ProtectionMask::zero());
+        assert_eq!(0b11111111_11111111_11111111_11111100, pkru::read());
+
+        allow(ProtectionMask::zero().or(ProtectionKey { id: 5, stripe: 0 }));
+        assert_eq!(0b11111111_11111111_11110011_11111100, pkru::read());
+
+        // Reset the PKRU state to what we originally observed.
+        pkru::write(original);
+    }
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/mpk/mod.rs

@@ -0,0 +1,54 @@
+//! Memory Protection Keys (MPK) implementation for use in striped memory
+//! allocation.
+//!
+//! MPK is an x86 feature available on relatively recent versions of Intel and
+//! AMD CPUs. In Linux, this feature is named `pku` (protection keys userspace)
+//! and consists of three new system calls: `pkey_alloc`, `pkey_free`, and
+//! `pkey_mprotect` (see the [Linux documentation]). This crate provides an
+//! abstraction, [`ProtectionKey`], that the [pooling allocator] applies to
+//! contiguous memory allocations, allowing it to avoid guard pages in some
+//! cases and more efficiently use memory. This technique was first presented in
+//! a 2022 paper: [Segue and ColorGuard: Optimizing SFI Performance and
+//! Scalability on Modern x86][colorguard].
+//!
+//! [pooling allocator]: crate::runtime::vm::PoolingInstanceAllocator
+//! [Linux documentation]:
+//!     https://www.kernel.org/doc/html/latest/core-api/protection-keys.html
+//! [colorguard]: https://plas2022.github.io/files/pdf/SegueColorGuard.pdf
+//!
+//! On x86_64 Linux systems, this module implements the various parts necessary
+//! to use MPK in Wasmtime:
+//! - [`is_supported`] indicates whether the feature is available at runtime
+//! - [`ProtectionKey`] provides access to the kernel-allocated protection keys
+//!   (see [`keys`])
+//! - [`allow`] sets the CPU state to prevent access to regions outside the
+//!   [`ProtectionMask`]
+//! - the `sys` module bridges the gap to Linux's `pkey_*` system calls
+//! - the `pkru` module controls the x86 `PKRU` register (and other CPU state)
+//!
+//! On any other kind of machine, this module exposes noop implementations of
+//! the public interface.
+
+cfg_if::cfg_if! {
+    if #[cfg(all(target_arch = "x86_64", target_os = "linux", feature = "std", not(miri)))] {
+        mod enabled;
+        mod pkru;
+        mod sys;
+        pub use enabled::{allow, current_mask, is_supported, keys, ProtectionKey, ProtectionMask};
+    } else {
+        mod disabled;
+        pub use disabled::{allow, current_mask, is_supported, keys, ProtectionKey, ProtectionMask};
+    }
+}
+
+/// Describe the tri-state configuration of memory protection keys (MPK).
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
+pub enum MpkEnabled {
+    /// Use MPK if supported by the current system; fall back to guard regions
+    /// otherwise.
+    Auto,
+    /// Use MPK or fail if not supported.
+    Enable,
+    /// Do not use MPK.
+    Disable,
+}