Handle OOM in `Func::call_async` and fiber creation (#12954)* Handle OOM in `Func::call_async` and fiber creation* fix clippy* fix build* really fix build* address review feedback* fix bu
Handle OOM in `Func::call_async` and fiber creation (#12954)* Handle OOM in `Func::call_async` and fiber creation* fix clippy* fix build* really fix build* address review feedback* fix build* fix warnings
show more ...
Update fibers to avoid no-return functions (#12928)* Update fibers to avoid no-return functionsThis commit is aimed at fixing the ASAN false positives in #12899.Initially the fix there was to in
Update fibers to avoid no-return functions (#12928)* Update fibers to avoid no-return functionsThis commit is aimed at fixing the ASAN false positives in #12899.Initially the fix there was to invoke some `__asan_*` intrinsics, andI ended up finding a sort of smaller set of `__asan_*` intrinsics tocall as well. In the end what's happening though is that fibers, uponterminating, have a few frames of Rust code on the stack beforeswitching off. To ASAN these frames never returned so when a stack issubsequently reused ASAN is tricked into thinking this is bufferoverflow or use-after-free since it's stomping on frames that haven'treturned.The fix in this commit is to avoid this style of function which doesn'treturns. Functions which don't return in Rust are easy to leak memoryfrom and are a hazard from a safety perspective as well (e.g. it'sunsafe to skip running destructors of stack variables). I feel we've hadbetter success over time with "all Rust functions always return" and sowhat's what was applied here. Unlike #12899 or my thoughts on that PRthis does not have any new `__asan_*` intrinsic calls. Instead what thisdoes is it shuffles around responsibility for what exact piece of theinfrastructure is responsible for what. Specifically `fiber_start`functions now actually return, meaning the `wasmtime_fiber_start` nakedfunction actually resumes execution, unlike before. The`wasmtime_fiber_start` then delegates to `wasmtime_fiber_switch`immediately to perform the final switch.Effectively there's now only two function frames that never return, andboth of these frames are handwritten inline assembly. This means thatASAN gets to see that all normal functions return and updates all of itsmetadata accordingly. The end result is that the original issue from #12899is fixed and this I feel is in general more robust as well.One caveat is that the handwritten `wasmtime_fiber_start` assembly needsto invoke a sibling `wasmtime_fiber_switch_` function. In lieu of tryingto figure out how to get PIC-vs-not calls working (e.g. static calls)I've opted to use indirect function calls and pointers instead. Thismirrors historical changes in our fiber implementation too.* Fix CI builds* Fix miri
Fix some overflows when allocating a max-size fiber stack (#12868)* Fix some overflows when allocating a max-size fiber stackThese are some minor issues that won't actually surface in practice bu
Fix some overflows when allocating a max-size fiber stack (#12868)* Fix some overflows when allocating a max-size fiber stackThese are some minor issues that won't actually surface in practice butseem good to fix nonetheless. Allocating a max-size fiber stack shouldfail, and it shouldn't fail with a panic or a debug assert.* Fix CI
fix: correct various typos (#12807)Signed-off-by: Ho Kim <[email protected]>
Add fiber implementation for riscv32imac (#12506)* Add fiber implementation for riscv32imac* Adjusted formatting around commas* Added padding infront of `last_sp`
Added a thread_local guard to trigger dtor hook before fibers are used (#12426)* Added a thread_local guard to trigger dtor hook before fibers are used* Add a test for async function that use a t
Added a thread_local guard to trigger dtor hook before fibers are used (#12426)* Added a thread_local guard to trigger dtor hook before fibers are used* Add a test for async function that use a tls variable with a destructor
Don't use fully-qualified paths for `wasmtime_environ::error::*` (#12221)* Don't use fully-qualified paths for `wasmtime_environ::error::*`Use the types via the `wasmtime_environ::prelude` instea
Don't use fully-qualified paths for `wasmtime_environ::error::*` (#12221)* Don't use fully-qualified paths for `wasmtime_environ::error::*`Use the types via the `wasmtime_environ::prelude` instead.Follow up to https://github.com/bytecodealliance/wasmtime/pull/12204* Fix unwinder build without cranelift feature
wasmtime-fiber: use `wasmtime_environ::error` instead of `anyhow` (#12206)* wasmtime-fiber: use `wasmtime_environ::error` instead of `anyhow`* Fix publish script topological sorting
Work around naked-function-plus-LTO issue (#11960)This is an attempt to apply a local fix for #11957 which works aroundthe upstream Rust issue mentioned in that issue.
Rewrite `wasmtime_fiber_init` in Rust (#11860)* Rewrite `wasmtime_fiber_init` in RustThis commit updates all implementations of `wasmtime_fiber_init` to bedefined in Rust rather than purely in i
Rewrite `wasmtime_fiber_init` in Rust (#11860)* Rewrite `wasmtime_fiber_init` in RustThis commit updates all implementations of `wasmtime_fiber_init` to bedefined in Rust rather than purely in inline assembly. There was never aneed to define this function in inline assembly and as far as I canremember I did this originally for consistency with the other functions.The motivation for this PR is to avoid the need to figure out how to doPIC-relative addressing in `wasmtime_fiber_init` to get the symboladdress of `wasmtime_fiber_start`. This has apparently never worked oni686 platforms and this is now becoming a problem on nightly Rust whereLLD complains about this (and presumably the default linker didn't?).In rewriting these functions I additionally fixed a few minor issues:* On AArch64 the registers are now ordered differently to make the order more consistent on the stack.* On s390x the unix.rs-specified 16-bytes-at-the-top-of-the-stack is now separate from the 160-byte register save area as opposed to having it folded into the same.* Remove unnecessary comments
chore: fix some minor issues in the comments (#11742)Signed-off-by: juejinyuxitu <[email protected]>
Use `naked_asm!`, delete `asm_func!` (#11405)This deletes our home-grown `asm_func!` macro in favor of using`#[unsafe(naked)]` functions within Wasmtime. This is needed forfiber-related bits righ
Use `naked_asm!`, delete `asm_func!` (#11405)This deletes our home-grown `asm_func!` macro in favor of using`#[unsafe(naked)]` functions within Wasmtime. This is needed forfiber-related bits right now where we need tight control over the exactassembly of some functions. This additionally migrates s390x fiber bitsto Rust as inline assembly is now stable for s390x.prtest:full
Add a dummy impl of fibers for Miri (#11009)* Add a dummy impl of fibers for MiriThis commit extends the `wasmtime-internal-fiber` crate with animplementation for Miri. Previously this was entir
Add a dummy impl of fibers for Miri (#11009)* Add a dummy impl of fibers for MiriThis commit extends the `wasmtime-internal-fiber` crate with animplementation for Miri. Previously this was entirely unsupportedbecause fibers use inline assembly. The implementation with Miri spawnsa separate thread and keeps it in a suspended state with locks to modela suspended stack. This technically isn't correct because TLS variableswill be wrong, but it's "correct enough" for our usage in Wasmtime. Inthe end this enables running more tests in Miri which is always a goodthing, and a number of loose odds and ends were cleaned up relate to ourunsafe management of async state.* Apply suggestions from code reviewCo-authored-by: Pat Hickey <[email protected]>---------Co-authored-by: Pat Hickey <[email protected]>
More clearly flag internal crates as such (#10963)* More clearly flag internal crates as suchThis commit is an attempt to more clearly flag internal crates in thisproject as internal and not int
More clearly flag internal crates as such (#10963)* More clearly flag internal crates as suchThis commit is an attempt to more clearly flag internal crates in thisproject as internal and not intended for external use. Specifically:* Many crates are renamed from `wasmtime-foo` to `wasmtime-internal-foo`.* All of these crates now have `INTERNAL: ...` in their crates.io description.* All of these crates now have a warning at the top of their documentation discouraging use.This change is a result of rustsec/advisory-db#1999 where the goal is tobe crystal clear from a project perspective that usage of these cratesare highly discouraged and not supported. We'll still probably get suchadvisories but we won't be considering them CVEs from the project itselfdue to the internal nature of these crates and the discouragingwarnings.Some concrete changes used here are:* Inter-crate dependencies still use `wasmtime_foo` for naming and do so with Cargo's package-renaming features.* Crate renames are specified at the workspace level so the rename is only in one locations and all other inherit it.* Contribution documentation now has some brief guidelines about crate organization.* Update vet config* Update checks for wasmtime-fiberprtest:full* Update publish script* Another fiber rename* Fix some doc tests
Duplicate page size determination in `wasmtime-fiber` (#10803)* Duplicate page size determination in `wasmtime-fiber`Currently Wasmtime has a function `crate::runtime::vm::host_page_size`but thi
Duplicate page size determination in `wasmtime-fiber` (#10803)* Duplicate page size determination in `wasmtime-fiber`Currently Wasmtime has a function `crate::runtime::vm::host_page_size`but this isn't reachable from the `wasmtime-fiber` crate and instead thacrate uses `rustix::param::page_size` to determine the host page size.It looks like this usage of `rustix` is causing a panic in #10802.Ideally `wasmtime-fiber` would be able to use the same function but thecrate separation does not currently make that feasible. For nowduplicate the logic of `wasmtime` into `wasmtime-fiber` as it's modestenough to ensure that this does not panic.Closes #10802* Run full test suite in CIprtest:full
Remove some `#![expect(clippy::allow_attributes_without_reason)]` (#10661)Clean up some crates by migrating from `#[allow]` to `#[expect]`(ideally) or `#[allow]`-with-reason
Run CI tests through AddressSanitizer (#10537)This is similar to running tests in Valgrind (which we should perhapsalso do...) but can be useful for catching use-after-free style bugsfaster than
Run CI tests through AddressSanitizer (#10537)This is similar to running tests in Valgrind (which we should perhapsalso do...) but can be useful for catching use-after-free style bugsfaster than when a process crashes. Given the unsafe nature of Wasmtimethis is something we should have probably enabled awhile back butotherwise so long as it doesn't take too long to run on CI seems like aneasy win of a boost-of-confidence.prtest:asan
Enable the `unsafe-op-in-unsafe-fn` lint (#10559)* Enable the `unsafe-op-in-unsafe-fn` lintThis commit enables the `unsafe-op-in-unsafe-fn` lint in rustc for theentire workspace. This lint will
Enable the `unsafe-op-in-unsafe-fn` lint (#10559)* Enable the `unsafe-op-in-unsafe-fn` lintThis commit enables the `unsafe-op-in-unsafe-fn` lint in rustc for theentire workspace. This lint will be warn-by-default in the 2024 editionso this is intended to smooth the future migration to the new edition.Many `unsafe` blocks were added in places the lint warned about, withtwo major exceptions. The `wasmtime` and `wasmtime-c-api` crates simplyexpect this lint to fire and effectively disable the lint. They're toobig at this time to do through this PR. My hope is that one day in thefuture they'll be migrated, but more realistically that probably won'thappen so these crates just won't benefit from this lint.* Fix nostd fiber buildprtest:full* Fix build on Windows* Fix asan build
Improve support for completely unknown architectures (#10107)* Improve support for completely unknown architecturesThis commit is a step in the direction of trying to make Wasmtime moreportable
Improve support for completely unknown architectures (#10107)* Improve support for completely unknown architecturesThis commit is a step in the direction of trying to make Wasmtime moreportable by default. The goal here is to enable Wasmtime to compile forarchitectures that it has no prior knowledge of. There's a fewmiscellaneous locations through Wasmtime where we needarchitecture-specific intrinsics and such but that's all in service ofCranelift itself. Without Cranelift support none of them are necessary.This commit plumbs a custom `#[cfg]` from Wasmtime's `build.rs` scriptinto the crate about whether there's a supported Cranelift backend. Ifthis isn't available some architecture-specific intrinsics are turnedoff and not included. An example is that `vm::arch` entirely disappearswhich is only in service of `UnwindHost`, which also disappears.Furthermore the `helpers.c` file also entirely disappears as it's notnecessary on unknown architectures.To help keep this working I've added CI to build Wasmtime for`powerpc64le-unknown-linux-gnu`. Wasmtime currently has no support forthis architecture, although if it grows such support in the futurethis'll need to be changed to some other unsupported architecture.* Review feedback* Fix powerpc build* Refactor windows trap handling to look like UnixShuffle some files around to be more amenable to #[cfg]* Move signal-handling tests to wasmtime crateThat way it's got easy access to the #[cfg]'s from the build script* Disable signals support without a host compilerEven if custom signals are enabled, don't compile it in.prtest:full* Fix windows unused imports* Fix unused imports on Windows* Remove untested stubs for arch intrinsicsThese aren't needed any more to compile Pulley* Defer tunables validation to loading modulesInstead of validating at `Engine` config time instead validate at`Module` config time to enable cross-compilation.* Skip `Tunables` auto-configuration if cross-compilingThis commit* Tweak some Tunables based on PulleyEnsures that specific `--target pulleyNN` works most of the time.* Update host_segfault.rs to handle new 32-bit defaultsNo signal handlers are used at all with Pulley so when the async stackoverflows there's no message printed any more.* Disable Tunables::signals_based_traps on miri
Wasmtime: generalize `async_stack_zeroing` knob to cover initialization (#10027)* Wasmtime: generalize `async_stack_zeroing` knob to cover initializationThis commit moves the knob from the `Pooli
Wasmtime: generalize `async_stack_zeroing` knob to cover initialization (#10027)* Wasmtime: generalize `async_stack_zeroing` knob to cover initializationThis commit moves the knob from the `PoolingInstanceAllocatorConfig` to theregular `Config` and now controls both whether stacks are zeroed before reuseand whether they are zeroed before the initial use. The latter doesn't matterusually, since anonymous mmaps are already zeroed so we don't have to doanything there, but for no-std environments it is the difference betweenmanually zeroing the stack or simply using unininitialized memory.* Fix CLI and test builds* fix default config value* fix some more tests
Enable `missing-unsafe-on-extern` lint (#9963)* Enable `missing-unsafe-on-extern` lintThis'll be a hard error in the 2024 edition so go ahead and opt-in to itnow to ease our future transition.
Enable `missing-unsafe-on-extern` lint (#9963)* Enable `missing-unsafe-on-extern` lintThis'll be a hard error in the 2024 edition so go ahead and opt-in to itnow to ease our future transition.* Fix adapter build* Fix custom c-api build* Fix fuzzer build* Fix some Windows `extern` blocks
Add aarch64-apple-ios to platform-check matrix (#9888)* Add aarch64-apple-ios to platform-check matrixThis commit is somewhat of a rebase of #7506 to port most of it to`main`. I've left out any
Add aarch64-apple-ios to platform-check matrix (#9888)* Add aarch64-apple-ios to platform-check matrixThis commit is somewhat of a rebase of #7506 to port most of it to`main`. I've left out any test-related changes since we're not testinganything just yet. I've also found that rustc now has`target_vendor = "apple"` to cover both macOS and iOS targets (andpresumably other targets like tvOS as well if they get added)Closes #7506* Set env var to target iOS during checks
Port wasmtime-fiber to `no_std` and allow `async` feature in `no_std` Wasmtime. (#9689)This PR allows a `no_std` Wasmtime build to be configured with the`async` feature. (Previously, a minimal `no
Port wasmtime-fiber to `no_std` and allow `async` feature in `no_std` Wasmtime. (#9689)This PR allows a `no_std` Wasmtime build to be configured with the`async` feature. (Previously, a minimal `no_std` configuration couldonly run with sync entry points, without suspending of stacks.)The main hurdle to this support was the `wasmtime-fiber` crate.Fortunately, the "unix" variant of fibers was almost entirely portableto a `no_std` environment, owing to the fact that it implementsstack-switching manually in assembly itself. I moved the per-ISAimplementations to a shared submodule and built the nostd platformbackend for `wasmtime-fiber` with a stripped-down version of the unixbackend.The nostd backend does not support mmap'd stacks, does not supportcustom stack allocators, and does not propagate panics.prtest:full
Start using `#[expect]` instead of `#[allow]` (#9696)* Start using `#[expect]` instead of `#[allow]`In Rust 1.81, our new MSRV, a new feature was added to Rust to use`#[expect]` to control lint
Start using `#[expect]` instead of `#[allow]` (#9696)* Start using `#[expect]` instead of `#[allow]`In Rust 1.81, our new MSRV, a new feature was added to Rust to use`#[expect]` to control lint levels. This new lint annotation willsilence a lint but will itself cause a lint if it doesn't actuallysilence anything. This is quite useful to ensure that annotations don'tget stale over time.Another feature is the ability to use a `reason` directive on theattribute with a string explaining why the attribute is there. Thisstring is then rendered in compiler messages if a warning or errorhappens.This commit migrates applies a few changes across the workspace:* Some `#[allow]` are changed to `#[expect]` with a `reason`.* Some `#[allow]` have a `reason` added if the lint conditionally fires (mostly related to macros).* Some `#[allow]` are removed since the lint doesn't actually fire.* The workspace configures `clippy::allow_attributes_without_reason = 'warn'` as a "ratchet" to prevent future regressions.* Many crates are annotated to allow `allow_attributes_without_reason` during this transitionary period.The end-state is that all crates should use`#[expect(..., reason = "...")]` for any lint that unconditionally firesbut is expected. The `#[allow(..., reason = "...")]` lint should be usedfor conditionally firing lints, primarily in macro-related code.The `allow_attributes_without_reason = 'warn'` level is intended to bepermanent but the transitionary`#[expect(clippy::allow_attributes_without_reason)]` crate annotationsto go away over time.* Fix adapter buildprtest:full* Fix one-core build of icache coherence* Use `allow` for missing_docsWork around rust-lang/rust#130021 which was fixed in Rust 1.83 and isn'tfixed for our MSRV at this time.* More MSRV compat
Store one fiber stack in a `Store<T>` (#9604)* Store one fiber stack in a `Store<T>`This commit stores a single fiber stack in `Store<T>` as a cache to beused throughout the lifetime of the `Sto
Store one fiber stack in a `Store<T>` (#9604)* Store one fiber stack in a `Store<T>`This commit stores a single fiber stack in `Store<T>` as a cache to beused throughout the lifetime of the `Store`. This should help amortizethe cost of allocating a stack for use in a store because the same stackcan be used continuously throughout the lifetime of the `Store<T>`. Thisnotably reduces contention on the lock used to manage the poolingallocator when possible.* Fix non-async build
1234