wasmtime 20.0.2 → 21.0.1

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/sys/unix/vm.rs

@@ -0,0 +1,215 @@
+use rustix::fd::AsRawFd;
+use rustix::mm::{mmap, mmap_anonymous, mprotect, MapFlags, MprotectFlags, ProtFlags};
+use std::fs::File;
+use std::io;
+#[cfg(feature = "std")]
+use std::sync::Arc;
+
+pub unsafe fn expose_existing_mapping(ptr: *mut u8, len: usize) -> io::Result<()> {
+    mprotect(ptr.cast(), len, MprotectFlags::READ | MprotectFlags::WRITE)?;
+    Ok(())
+}
+
+pub unsafe fn hide_existing_mapping(ptr: *mut u8, len: usize) -> io::Result<()> {
+    mprotect(ptr.cast(), len, MprotectFlags::empty())?;
+    Ok(())
+}
+
+pub unsafe fn erase_existing_mapping(ptr: *mut u8, len: usize) -> io::Result<()> {
+    let ret = mmap_anonymous(
+        ptr.cast(),
+        len,
+        ProtFlags::empty(),
+        MapFlags::PRIVATE | MapFlags::FIXED,
+    )?;
+    assert_eq!(ptr, ret.cast());
+    Ok(())
+}
+
+#[cfg(feature = "pooling-allocator")]
+unsafe fn decommit(addr: *mut u8, len: usize) -> io::Result<()> {
+    if len == 0 {
+        return Ok(());
+    }
+
+    unsafe {
+        cfg_if::cfg_if! {
+            if #[cfg(target_os = "linux")] {
+                use rustix::mm::{madvise, Advice};
+
+                // On Linux, this is enough to cause the kernel to initialize
+                // the pages to 0 on next access
+                madvise(addr as _, len, Advice::LinuxDontNeed)?;
+            } else {
+                // By creating a new mapping at the same location, this will
+                // discard the mapping for the pages in the given range.
+                // The new mapping will be to the CoW zero page, so this
+                // effectively zeroes the pages.
+                mmap_anonymous(
+                    addr as _,
+                    len,
+                    ProtFlags::READ | ProtFlags::WRITE,
+                    MapFlags::PRIVATE | MapFlags::FIXED,
+                )?;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(feature = "pooling-allocator")]
+pub unsafe fn commit_table_pages(_addr: *mut u8, _len: usize) -> io::Result<()> {
+    // Table pages are always READ | WRITE so there's nothing that needs to be
+    // done here.
+    Ok(())
+}
+
+#[cfg(feature = "pooling-allocator")]
+pub unsafe fn decommit_table_pages(addr: *mut u8, len: usize) -> io::Result<()> {
+    decommit(addr, len)
+}
+
+#[cfg(all(feature = "pooling-allocator", feature = "async"))]
+pub unsafe fn commit_stack_pages(_addr: *mut u8, _len: usize) -> io::Result<()> {
+    // Like table pages stack pages are always READ | WRITE so nothing extra
+    // needs to be done to ensure they can be committed.
+    Ok(())
+}
+
+#[cfg(all(feature = "pooling-allocator", feature = "async"))]
+pub unsafe fn reset_stack_pages_to_zero(addr: *mut u8, len: usize) -> io::Result<()> {
+    decommit(addr, len)
+}
+
+pub fn get_page_size() -> usize {
+    unsafe { libc::sysconf(libc::_SC_PAGESIZE).try_into().unwrap() }
+}
+
+pub fn supports_madvise_dontneed() -> bool {
+    cfg!(target_os = "linux")
+}
+
+pub unsafe fn madvise_dontneed(ptr: *mut u8, len: usize) -> io::Result<()> {
+    cfg_if::cfg_if! {
+        if #[cfg(target_os = "linux")] {
+            rustix::mm::madvise(ptr.cast(), len, rustix::mm::Advice::LinuxDontNeed)?;
+            Ok(())
+        } else {
+            let _ = (ptr, len);
+            unreachable!();
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum MemoryImageSource {
+    #[cfg(feature = "std")]
+    Mmap(Arc<File>),
+    #[cfg(target_os = "linux")]
+    Memfd(memfd::Memfd),
+}
+
+impl MemoryImageSource {
+    #[cfg(feature = "std")]
+    pub fn from_file(file: &Arc<File>) -> Option<MemoryImageSource> {
+        Some(MemoryImageSource::Mmap(file.clone()))
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    pub fn from_data(_data: &[u8]) -> io::Result<Option<MemoryImageSource>> {
+        Ok(None)
+    }
+
+    #[cfg(target_os = "linux")]
+    pub fn from_data(data: &[u8]) -> anyhow::Result<Option<MemoryImageSource>> {
+        // On Linux `memfd_create` is used to create an anonymous
+        // in-memory file to represent the heap image. This anonymous
+        // file is then used as the basis for further mmaps.
+
+        use crate::prelude::*;
+        use std::io::{ErrorKind, Write};
+
+        // Create the memfd. It needs a name, but the documentation for
+        // `memfd_create()` says that names can be duplicated with no issues.
+        let memfd = match memfd::MemfdOptions::new()
+            .allow_sealing(true)
+            .create("wasm-memory-image")
+        {
+            Ok(memfd) => memfd,
+            // If this kernel is old enough to not support memfd then attempt to
+            // gracefully handle that and fall back to skipping the memfd
+            // optimization.
+            Err(memfd::Error::Create(err)) if err.kind() == ErrorKind::Unsupported => {
+                return Ok(None)
+            }
+            Err(e) => return Err(e.into_anyhow()),
+        };
+        memfd.as_file().write_all(data).err2anyhow()?;
+
+        // Seal the memfd's data and length.
+        //
+        // This is a defense-in-depth security mitigation. The
+        // memfd will serve as the starting point for the heap of
+        // every instance of this module. If anything were to
+        // write to this, it could affect every execution. The
+        // memfd object itself is owned by the machinery here and
+        // not exposed elsewhere, but it is still an ambient open
+        // file descriptor at the syscall level, so some other
+        // vulnerability that allowed writes to arbitrary fds
+        // could modify it. Or we could have some issue with the
+        // way that we map it into each instance. To be
+        // extra-super-sure that it never changes, and because
+        // this costs very little, we use the kernel's "seal" API
+        // to make the memfd image permanently read-only.
+        memfd
+            .add_seals(&[
+                memfd::FileSeal::SealGrow,
+                memfd::FileSeal::SealShrink,
+                memfd::FileSeal::SealWrite,
+                memfd::FileSeal::SealSeal,
+            ])
+            .err2anyhow()?;
+
+        Ok(Some(MemoryImageSource::Memfd(memfd)))
+    }
+
+    fn as_file(&self) -> &File {
+        match *self {
+            #[cfg(feature = "std")]
+            MemoryImageSource::Mmap(ref file) => file,
+            #[cfg(target_os = "linux")]
+            MemoryImageSource::Memfd(ref memfd) => memfd.as_file(),
+        }
+    }
+
+    pub unsafe fn map_at(&self, base: *mut u8, len: usize, offset: u64) -> io::Result<()> {
+        let ptr = mmap(
+            base.cast(),
+            len,
+            ProtFlags::READ | ProtFlags::WRITE,
+            MapFlags::PRIVATE | MapFlags::FIXED,
+            self.as_file(),
+            offset,
+        )?;
+        assert_eq!(base, ptr.cast());
+        Ok(())
+    }
+
+    pub unsafe fn remap_as_zeros_at(&self, base: *mut u8, len: usize) -> io::Result<()> {
+        let ptr = mmap_anonymous(
+            base.cast(),
+            len,
+            ProtFlags::READ | ProtFlags::WRITE,
+            MapFlags::PRIVATE | MapFlags::FIXED,
+        )?;
+        assert_eq!(base, ptr.cast());
+        Ok(())
+    }
+}
+
+impl PartialEq for MemoryImageSource {
+    fn eq(&self, other: &MemoryImageSource) -> bool {
+        self.as_file().as_raw_fd() == other.as_file().as_raw_fd()
+    }
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/sys/windows/mmap.rs

@@ -0,0 +1,221 @@
+use crate::prelude::*;
+use crate::runtime::vm::SendSyncPtr;
+use anyhow::{anyhow, bail, Context, Result};
+use std::fs::{File, OpenOptions};
+use std::io;
+use std::ops::Range;
+use std::os::windows::prelude::*;
+use std::path::Path;
+use std::ptr::{self, NonNull};
+use windows_sys::Win32::Foundation::*;
+use windows_sys::Win32::Storage::FileSystem::*;
+use windows_sys::Win32::System::Memory::*;
+
+#[derive(Debug)]
+pub struct Mmap {
+    memory: SendSyncPtr<[u8]>,
+    is_file: bool,
+}
+
+impl Mmap {
+    pub fn new_empty() -> Mmap {
+        Mmap {
+            memory: SendSyncPtr::from(&mut [][..]),
+            is_file: false,
+        }
+    }
+
+    pub fn new(size: usize) -> Result<Self> {
+        let ptr = unsafe {
+            VirtualAlloc(
+                ptr::null_mut(),
+                size,
+                MEM_RESERVE | MEM_COMMIT,
+                PAGE_READWRITE,
+            )
+        };
+        if ptr.is_null() {
+            bail!(io::Error::last_os_error())
+        }
+
+        let memory = std::ptr::slice_from_raw_parts_mut(ptr.cast(), size);
+        let memory = SendSyncPtr::new(NonNull::new(memory).unwrap());
+        Ok(Self {
+            memory,
+            is_file: false,
+        })
+    }
+
+    pub fn reserve(size: usize) -> Result<Self> {
+        let ptr = unsafe { VirtualAlloc(ptr::null_mut(), size, MEM_RESERVE, PAGE_NOACCESS) };
+        if ptr.is_null() {
+            bail!(io::Error::last_os_error())
+        }
+        let memory = std::ptr::slice_from_raw_parts_mut(ptr.cast(), size);
+        let memory = SendSyncPtr::new(NonNull::new(memory).unwrap());
+        Ok(Self {
+            memory,
+            is_file: false,
+        })
+    }
+
+    pub fn from_file(path: &Path) -> Result<(Self, File)> {
+        unsafe {
+            // Open the file with read/execute access and only share for
+            // read. This will enable us to perform the proper mmap below
+            // while also disallowing other processes modifying the file
+            // and having those modifications show up in our address space.
+            let file = OpenOptions::new()
+                .read(true)
+                .access_mode(FILE_GENERIC_READ | FILE_GENERIC_EXECUTE)
+                .share_mode(FILE_SHARE_READ)
+                .open(path)
+                .err2anyhow()
+                .context("failed to open file")?;
+
+            let len = file
+                .metadata()
+                .err2anyhow()
+                .context("failed to get file metadata")?
+                .len();
+            let len = usize::try_from(len).map_err(|_| anyhow!("file too large to map"))?;
+
+            // Create a file mapping that allows PAGE_EXECUTE_WRITECOPY.
+            // This enables up-to these permissions but we won't leave all
+            // of these permissions active at all times. Execution is
+            // necessary for the generated code from Cranelift and the
+            // WRITECOPY part is needed for possibly resolving relocations,
+            // but otherwise writes don't happen.
+            let mapping = CreateFileMappingW(
+                file.as_raw_handle() as isize,
+                ptr::null_mut(),
+                PAGE_EXECUTE_WRITECOPY,
+                0,
+                0,
+                ptr::null(),
+            );
+            if mapping == 0 {
+                return Err(io::Error::last_os_error().into_anyhow())
+                    .context("failed to create file mapping");
+            }
+
+            // Create a view for the entire file using all our requisite
+            // permissions so that we can change the virtual permissions
+            // later on.
+            let ptr = MapViewOfFile(
+                mapping,
+                FILE_MAP_READ | FILE_MAP_EXECUTE | FILE_MAP_COPY,
+                0,
+                0,
+                len,
+            )
+            .Value;
+            let err = io::Error::last_os_error();
+            CloseHandle(mapping);
+            if ptr.is_null() {
+                return Err(err.into_anyhow())
+                    .context(format!("failed to create map view of {:#x} bytes", len));
+            }
+
+            let memory = std::ptr::slice_from_raw_parts_mut(ptr.cast(), len);
+            let memory = SendSyncPtr::new(NonNull::new(memory).unwrap());
+            let mut ret = Self {
+                memory,
+                is_file: true,
+            };
+
+            // Protect the entire file as PAGE_WRITECOPY to start (i.e.
+            // remove the execute bit)
+            let mut old = 0;
+            if VirtualProtect(ret.as_mut_ptr().cast(), ret.len(), PAGE_WRITECOPY, &mut old) == 0 {
+                return Err(io::Error::last_os_error().into_anyhow())
+                    .context("failed change pages to `PAGE_READONLY`");
+            }
+
+            Ok((ret, file))
+        }
+    }
+
+    pub fn make_accessible(&mut self, start: usize, len: usize) -> Result<()> {
+        if unsafe {
+            VirtualAlloc(
+                self.as_ptr().add(start) as _,
+                len,
+                MEM_COMMIT,
+                PAGE_READWRITE,
+            )
+        }
+        .is_null()
+        {
+            bail!(io::Error::last_os_error())
+        }
+
+        Ok(())
+    }
+
+    #[inline]
+    pub fn as_ptr(&self) -> *const u8 {
+        self.memory.as_ptr() as *const u8
+    }
+
+    #[inline]
+    pub fn as_mut_ptr(&mut self) -> *mut u8 {
+        self.memory.as_ptr().cast()
+    }
+
+    #[inline]
+    pub fn len(&self) -> usize {
+        unsafe { (*self.memory.as_ptr()).len() }
+    }
+
+    pub unsafe fn make_executable(
+        &self,
+        range: Range<usize>,
+        enable_branch_protection: bool,
+    ) -> Result<()> {
+        let flags = if enable_branch_protection {
+            // TODO: We use this check to avoid an unused variable warning,
+            // but some of the CFG-related flags might be applicable
+            PAGE_EXECUTE_READ
+        } else {
+            PAGE_EXECUTE_READ
+        };
+        let mut old = 0;
+        let base = self.as_ptr().add(range.start);
+        let result = VirtualProtect(base as _, range.end - range.start, flags, &mut old);
+        if result == 0 {
+            bail!(io::Error::last_os_error());
+        }
+        Ok(())
+    }
+
+    pub unsafe fn make_readonly(&self, range: Range<usize>) -> Result<()> {
+        let mut old = 0;
+        let base = self.as_ptr().add(range.start);
+        let result = VirtualProtect(base as _, range.end - range.start, PAGE_READONLY, &mut old);
+        if result == 0 {
+            bail!(io::Error::last_os_error());
+        }
+        Ok(())
+    }
+}
+
+impl Drop for Mmap {
+    fn drop(&mut self) {
+        if self.len() == 0 {
+            return;
+        }
+
+        if self.is_file {
+            let r = unsafe {
+                UnmapViewOfFile(MEMORY_MAPPED_VIEW_ADDRESS {
+                    Value: self.as_mut_ptr().cast(),
+                })
+            };
+            assert_ne!(r, 0);
+        } else {
+            let r = unsafe { VirtualFree(self.as_mut_ptr().cast(), 0, MEM_RELEASE) };
+            assert_ne!(r, 0);
+        }
+    }
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/sys/windows/mod.rs

@@ -0,0 +1,20 @@
+//! Implementation of Wasmtime's system primitives for Windows.
+
+use std::cell::Cell;
+
+pub mod mmap;
+pub mod traphandlers;
+pub mod unwind;
+pub mod vm;
+
+std::thread_local!(static TLS: Cell<*mut u8> = const { Cell::new(std::ptr::null_mut()) });
+
+#[inline]
+pub fn tls_get() -> *mut u8 {
+    TLS.with(|p| p.get())
+}
+
+#[inline]
+pub fn tls_set(ptr: *mut u8) {
+    TLS.with(|p| p.set(ptr));
+}

data/ext/cargo-vendor/wasmtime-21.0.1/src/runtime/vm/sys/windows/traphandlers.rs

@@ -0,0 +1,104 @@
+use crate::runtime::vm::traphandlers::{tls, TrapTest};
+use crate::runtime::vm::VMContext;
+use std::io;
+use windows_sys::Win32::Foundation::*;
+use windows_sys::Win32::System::Diagnostics::Debug::*;
+use windows_sys::Win32::System::Kernel::*;
+
+#[link(name = "wasmtime-helpers")]
+extern "C" {
+    #[wasmtime_versioned_export_macros::versioned_link]
+    #[allow(improper_ctypes)]
+    pub fn wasmtime_setjmp(
+        jmp_buf: *mut *const u8,
+        callback: extern "C" fn(*mut u8, *mut VMContext),
+        payload: *mut u8,
+        callee: *mut VMContext,
+    ) -> i32;
+
+    #[wasmtime_versioned_export_macros::versioned_link]
+    pub fn wasmtime_longjmp(jmp_buf: *const u8) -> !;
+}
+
+/// Function which may handle custom signals while processing traps.
+pub type SignalHandler<'a> = dyn Fn(*mut EXCEPTION_POINTERS) -> bool + Send + Sync + 'a;
+
+pub unsafe fn platform_init(_macos_use_mach_ports: bool) {
+    // our trap handler needs to go first, so that we can recover from
+    // wasm faults and continue execution, so pass `1` as a true value
+    // here.
+    if AddVectoredExceptionHandler(1, Some(exception_handler)).is_null() {
+        panic!(
+            "failed to add exception handler: {}",
+            io::Error::last_os_error()
+        );
+    }
+}
+
+unsafe extern "system" fn exception_handler(exception_info: *mut EXCEPTION_POINTERS) -> i32 {
+    // Check the kind of exception, since we only handle a subset within
+    // wasm code. If anything else happens we want to defer to whatever
+    // the rest of the system wants to do for this exception.
+    let record = &*(*exception_info).ExceptionRecord;
+    if record.ExceptionCode != EXCEPTION_ACCESS_VIOLATION
+        && record.ExceptionCode != EXCEPTION_ILLEGAL_INSTRUCTION
+        && record.ExceptionCode != EXCEPTION_INT_DIVIDE_BY_ZERO
+        && record.ExceptionCode != EXCEPTION_INT_OVERFLOW
+    {
+        return ExceptionContinueSearch;
+    }
+
+    // FIXME: this is what the previous C++ did to make sure that TLS
+    // works by the time we execute this trap handling code. This isn't
+    // exactly super easy to call from Rust though and it's not clear we
+    // necessarily need to do so. Leaving this here in case we need this
+    // in the future, but for now we can probably wait until we see a
+    // strange fault before figuring out how to reimplement this in
+    // Rust.
+    //
+    // if (!NtCurrentTeb()->Reserved1[sThreadLocalArrayPointerIndex]) {
+    //     return ExceptionContinueSearch;
+    // }
+
+    // This is basically the same as the unix version above, only with a
+    // few parameters tweaked here and there.
+    tls::with(|info| {
+        let info = match info {
+            Some(info) => info,
+            None => return ExceptionContinueSearch,
+        };
+        cfg_if::cfg_if! {
+            if #[cfg(target_arch = "x86_64")] {
+                let ip = (*(*exception_info).ContextRecord).Rip as *const u8;
+                let fp = (*(*exception_info).ContextRecord).Rbp as usize;
+            } else if #[cfg(target_arch = "aarch64")] {
+                let ip = (*(*exception_info).ContextRecord).Pc as *const u8;
+                let fp = (*(*exception_info).ContextRecord).Anonymous.Anonymous.Fp as usize;
+            } else {
+                compile_error!("unsupported platform");
+            }
+        }
+        // For access violations the first element in `ExceptionInformation` is
+        // an indicator as to whether the fault was a read/write. The second
+        // element is the address of the inaccessible data causing this
+        // violation.
+        let faulting_addr = if record.ExceptionCode == EXCEPTION_ACCESS_VIOLATION {
+            assert!(record.NumberParameters >= 2);
+            Some(record.ExceptionInformation[1])
+        } else {
+            None
+        };
+        match info.test_if_trap(ip, |handler| handler(exception_info)) {
+            TrapTest::NotWasm => ExceptionContinueSearch,
+            TrapTest::HandledByEmbedder => ExceptionContinueExecution,
+            TrapTest::Trap { jmp_buf, trap } => {
+                info.set_jit_trap(ip, fp, faulting_addr, trap);
+                wasmtime_longjmp(jmp_buf)
+            }
+        }
+    })
+}
+
+pub fn lazy_per_thread_init() {
+    // Unused on Windows
+}