1 //! An `Instance` contains all the runtime state used by execution of a 2 //! wasm module (except its callstack and register state). An 3 //! `InstanceHandle` is a reference-counting handle for an `Instance`. 4 5 use crate::runtime::vm::const_expr::{ConstEvalContext, ConstExprEvaluator}; 6 use crate::runtime::vm::export::Export; 7 use crate::runtime::vm::memory::{Memory, RuntimeMemoryCreator}; 8 use crate::runtime::vm::table::{Table, TableElement, TableElementType}; 9 use crate::runtime::vm::vmcontext::{ 10 VMBuiltinFunctionsArray, VMContext, VMFuncRef, VMFunctionImport, VMGlobalDefinition, 11 VMGlobalImport, VMMemoryDefinition, VMMemoryImport, VMOpaqueContext, VMStoreContext, VMTable, 12 VMTableDefinition, VMTagDefinition, VMTagImport, 13 }; 14 use crate::runtime::vm::{ 15 ExportFunction, ExportGlobal, ExportMemory, ExportTable, ExportTag, GcStore, Imports, 16 ModuleRuntimeInfo, SendSyncPtr, VMFunctionBody, VMGcRef, VMStore, VMStoreRawPtr, VmPtr, VmSafe, 17 WasmFault, 18 }; 19 use crate::store::{InstanceId, StoreInner, StoreOpaque}; 20 use crate::{StoreContextMut, prelude::*}; 21 use alloc::sync::Arc; 22 use core::alloc::Layout; 23 use core::any::Any; 24 use core::ops::Range; 25 use core::ptr::NonNull; 26 #[cfg(target_has_atomic = "64")] 27 use core::sync::atomic::AtomicU64; 28 use core::{mem, ptr}; 29 #[cfg(feature = "gc")] 30 use wasmtime_environ::ModuleInternedTypeIndex; 31 use wasmtime_environ::{ 32 DataIndex, DefinedGlobalIndex, DefinedMemoryIndex, DefinedTableIndex, DefinedTagIndex, 33 ElemIndex, EntityIndex, EntityRef, EntitySet, FuncIndex, GlobalIndex, HostPtr, MemoryIndex, 34 Module, PrimaryMap, PtrSize, TableIndex, TableInitialValue, TableSegmentElements, TagIndex, 35 Trap, VMCONTEXT_MAGIC, VMOffsets, VMSharedTypeIndex, WasmHeapTopType, 36 packed_option::ReservedValue, 37 }; 38 #[cfg(feature = "wmemcheck")] 39 use wasmtime_wmemcheck::Wmemcheck; 40 41 mod allocator; 42 pub use allocator::*; 43 44 /// The pair of an instance and a raw pointer its associated store. 45 /// 46 /// ### Safety 47 /// 48 /// Getting a borrow of a vmctx's store is one of the fundamental bits of unsafe 49 /// code in Wasmtime. No matter how we architect the runtime, some kind of 50 /// unsafe conversion from a raw vmctx pointer that Wasm is using into a Rust 51 /// struct must happen. 52 /// 53 /// It is our responsibility to ensure that multiple (exclusive) borrows of the 54 /// vmctx's store never exist at the same time. The distinction between the 55 /// `Instance` type (which doesn't expose its underlying vmctx pointer or a way 56 /// to get a borrow of its associated store) and this type (which does) is 57 /// designed to help with that. 58 /// 59 /// Going from a `*mut VMContext` to a `&mut StoreInner<T>` is naturally unsafe 60 /// due to the raw pointer usage, but additionally the `T` type parameter needs 61 /// to be the same `T` that was used to define the `dyn VMStore` trait object 62 /// that was stuffed into the vmctx. 63 /// 64 /// ### Usage 65 /// 66 /// Usage generally looks like: 67 /// 68 /// 1. You get a raw `*mut VMContext` from Wasm 69 /// 70 /// 2. You call `InstanceAndStore::from_vmctx` on that raw pointer 71 /// 72 /// 3. You then call `InstanceAndStore::unpack_mut` (or another helper) to get 73 /// the underlying `&mut Instance` and `&mut dyn VMStore` (or `&mut 74 /// StoreInner<T>`). 75 /// 76 /// 4. You then use whatever `Instance` methods you need to, each of which take 77 /// a store argument as necessary. 78 /// 79 /// In step (4) you no longer need to worry about double exclusive borrows of 80 /// the store, so long as you don't do (1-2) again. Note also that the borrow 81 /// checker prevents repeating step (3) if you never repeat (1-2). In general, 82 /// steps (1-3) should be done in a single, common, internally-unsafe, 83 /// plumbing-code bottleneck and the raw pointer should never be exposed to Rust 84 /// code that does (4) after the `InstanceAndStore` is created. Follow this 85 /// pattern, and everything using the resulting `Instance` and `Store` can be 86 /// safe code (at least, with regards to accessing the store itself). 87 /// 88 /// As an illustrative example, the common plumbing code for our various 89 /// libcalls performs steps (1-3) before calling into each actual libcall 90 /// implementation function that does (4). The plumbing code hides the raw vmctx 91 /// pointer and never gives out access to it to the libcall implementation 92 /// functions, nor does an `Instance` expose its internal vmctx pointer, which 93 /// would allow unsafely repeating steps (1-2). 94 #[repr(transparent)] 95 pub struct InstanceAndStore { 96 instance: Instance, 97 } 98 99 impl InstanceAndStore { 100 /// Converts the provided `*mut VMContext` to an `InstanceAndStore` 101 /// reference and calls the provided closure with it. 102 /// 103 /// This method will move the `vmctx` pointer backwards to point to the 104 /// original `Instance` that precedes it. The closure is provided a 105 /// temporary reference to the `InstanceAndStore` with a constrained 106 /// lifetime to ensure that it doesn't accidentally escape. 107 /// 108 /// # Safety 109 /// 110 /// Callers must validate that the `vmctx` pointer is a valid allocation and 111 /// that it's valid to acquire `&mut InstanceAndStore` at this time. For 112 /// example this can't be called twice on the same `VMContext` to get two 113 /// active mutable borrows to the same `InstanceAndStore`. 114 /// 115 /// See also the safety discussion in this type's documentation. 116 #[inline] 117 pub(crate) unsafe fn from_vmctx<R>( 118 vmctx: NonNull<VMContext>, 119 f: impl for<'a> FnOnce(&'a mut Self) -> R, 120 ) -> R { 121 const _: () = assert!(mem::size_of::<InstanceAndStore>() == mem::size_of::<Instance>()); 122 let mut ptr = vmctx 123 .byte_sub(mem::size_of::<Instance>()) 124 .cast::<InstanceAndStore>(); 125 126 f(ptr.as_mut()) 127 } 128 129 /// Unpacks this `InstanceAndStore` into its underlying `Instance` and `dyn 130 /// VMStore`. 131 #[inline] 132 pub(crate) fn unpack_mut(&mut self) -> (&mut Instance, &mut dyn VMStore) { 133 unsafe { 134 let store = &mut *self.store_ptr(); 135 (&mut self.instance, store) 136 } 137 } 138 139 /// Unpacks this `InstanceAndStore` into its underlying `Instance` and 140 /// `StoreInner<T>`. 141 /// 142 /// # Safety 143 /// 144 /// The `T` must be the same `T` that was used to define this store's 145 /// instance. 146 #[inline] 147 pub(crate) unsafe fn unpack_context_mut<T>( 148 &mut self, 149 ) -> (&mut Instance, StoreContextMut<'_, T>) { 150 let store_ptr = self.store_ptr().cast::<StoreInner<T>>(); 151 (&mut self.instance, StoreContextMut(&mut *store_ptr)) 152 } 153 154 /// Gets a pointer to this instance's `Store` which was originally 155 /// configured on creation. 156 /// 157 /// # Panics 158 /// 159 /// May panic if the originally configured store was `None`. That can happen 160 /// for host functions so host functions can't be queried what their 161 /// original `Store` was since it's just retained as null (since host 162 /// functions are shared amongst threads and don't all share the same 163 /// store). 164 #[inline] 165 fn store_ptr(&self) -> *mut dyn VMStore { 166 self.instance.store.unwrap().0.as_ptr() 167 } 168 } 169 170 /// A type that roughly corresponds to a WebAssembly instance, but is also used 171 /// for host-defined objects. 172 /// 173 /// This structure is never allocated directly but is instead managed through 174 /// an `InstanceHandle`. This structure ends with a `VMContext` which has a 175 /// dynamic size corresponding to the `module` configured within. Memory 176 /// management of this structure is always externalized. 177 /// 178 /// Instances here can correspond to actual instantiated modules, but it's also 179 /// used ubiquitously for host-defined objects. For example creating a 180 /// host-defined memory will have a `module` that looks like it exports a single 181 /// memory (and similar for other constructs). 182 /// 183 /// This `Instance` type is used as a ubiquitous representation for WebAssembly 184 /// values, whether or not they were created on the host or through a module. 185 #[repr(C)] // ensure that the vmctx field is last. 186 pub struct Instance { 187 /// The index, within a `Store` that this instance lives at 188 id: InstanceId, 189 190 /// The runtime info (corresponding to the "compiled module" 191 /// abstraction in higher layers) that is retained and needed for 192 /// lazy initialization. This provides access to the underlying 193 /// Wasm module entities, the compiled JIT code, metadata about 194 /// functions, lazy initialization state, etc. 195 runtime_info: ModuleRuntimeInfo, 196 197 /// WebAssembly linear memory data. 198 /// 199 /// This is where all runtime information about defined linear memories in 200 /// this module lives. 201 /// 202 /// The `MemoryAllocationIndex` was given from our `InstanceAllocator` and 203 /// must be given back to the instance allocator when deallocating each 204 /// memory. 205 memories: PrimaryMap<DefinedMemoryIndex, (MemoryAllocationIndex, Memory)>, 206 207 /// WebAssembly table data. 208 /// 209 /// Like memories, this is only for defined tables in the module and 210 /// contains all of their runtime state. 211 /// 212 /// The `TableAllocationIndex` was given from our `InstanceAllocator` and 213 /// must be given back to the instance allocator when deallocating each 214 /// table. 215 tables: PrimaryMap<DefinedTableIndex, (TableAllocationIndex, Table)>, 216 217 /// Stores the dropped passive element segments in this instantiation by index. 218 /// If the index is present in the set, the segment has been dropped. 219 dropped_elements: EntitySet<ElemIndex>, 220 221 /// Stores the dropped passive data segments in this instantiation by index. 222 /// If the index is present in the set, the segment has been dropped. 223 dropped_data: EntitySet<DataIndex>, 224 225 /// Hosts can store arbitrary per-instance information here. 226 /// 227 /// Most of the time from Wasmtime this is `Box::new(())`, a noop 228 /// allocation, but some host-defined objects will store their state here. 229 host_state: Box<dyn Any + Send + Sync>, 230 231 /// A pointer to the `vmctx` field at the end of the `Instance`. 232 /// 233 /// If you're looking at this a reasonable question would be "why do we need 234 /// a pointer to ourselves?" because after all the pointer's value is 235 /// trivially derivable from any `&Instance` pointer. The rationale for this 236 /// field's existence is subtle, but it's required for correctness. The 237 /// short version is "this makes miri happy". 238 /// 239 /// The long version of why this field exists is that the rules that MIRI 240 /// uses to ensure pointers are used correctly have various conditions on 241 /// them depend on how pointers are used. More specifically if `*mut T` is 242 /// derived from `&mut T`, then that invalidates all prior pointers drived 243 /// from the `&mut T`. This means that while we liberally want to re-acquire 244 /// a `*mut VMContext` throughout the implementation of `Instance` the 245 /// trivial way, a function `fn vmctx(&mut Instance) -> *mut VMContext` 246 /// would effectively invalidate all prior `*mut VMContext` pointers 247 /// acquired. The purpose of this field is to serve as a sort of 248 /// source-of-truth for where `*mut VMContext` pointers come from. 249 /// 250 /// This field is initialized when the `Instance` is created with the 251 /// original allocation's pointer. That means that the provenance of this 252 /// pointer contains the entire allocation (both instance and `VMContext`). 253 /// This provenance bit is then "carried through" where `fn vmctx` will base 254 /// all returned pointers on this pointer itself. This provides the means of 255 /// never invalidating this pointer throughout MIRI and additionally being 256 /// able to still temporarily have `&mut Instance` methods and such. 257 /// 258 /// It's important to note, though, that this is not here purely for MIRI. 259 /// The careful construction of the `fn vmctx` method has ramifications on 260 /// the LLVM IR generated, for example. A historical CVE on Wasmtime, 261 /// GHSA-ch89-5g45-qwc7, was caused due to relying on undefined behavior. By 262 /// deriving VMContext pointers from this pointer it specifically hints to 263 /// LLVM that trickery is afoot and it properly informs `noalias` and such 264 /// annotations and analysis. More-or-less this pointer is actually loaded 265 /// in LLVM IR which helps defeat otherwise present aliasing optimizations, 266 /// which we want, since writes to this should basically never be optimized 267 /// out. 268 /// 269 /// As a final note it's worth pointing out that the machine code generated 270 /// for accessing `fn vmctx` is still as one would expect. This member isn't 271 /// actually ever loaded at runtime (or at least shouldn't be). Perhaps in 272 /// the future if the memory consumption of this field is a problem we could 273 /// shrink it slightly, but for now one extra pointer per wasm instance 274 /// seems not too bad. 275 vmctx_self_reference: SendSyncPtr<VMContext>, 276 277 // TODO: add support for multiple memories; `wmemcheck_state` corresponds to 278 // memory 0. 279 #[cfg(feature = "wmemcheck")] 280 pub(crate) wmemcheck_state: Option<Wmemcheck>, 281 282 /// Self-pointer back to `Store<T>` and its functions. Not present for 283 /// the brief time that `Store<T>` is itself being created. Also not 284 /// present for some niche uses that are disconnected from stores (e.g. 285 /// cross-thread stuff used in `InstancePre`) 286 store: Option<VMStoreRawPtr>, 287 288 /// Additional context used by compiled wasm code. This field is last, and 289 /// represents a dynamically-sized array that extends beyond the nominal 290 /// end of the struct (similar to a flexible array member). 291 vmctx: VMContext, 292 } 293 294 impl Instance { 295 /// Create an instance at the given memory address. 296 /// 297 /// It is assumed the memory was properly aligned and the 298 /// allocation was `alloc_size` in bytes. 299 unsafe fn new( 300 req: InstanceAllocationRequest, 301 memories: PrimaryMap<DefinedMemoryIndex, (MemoryAllocationIndex, Memory)>, 302 tables: PrimaryMap<DefinedTableIndex, (TableAllocationIndex, Table)>, 303 memory_tys: &PrimaryMap<MemoryIndex, wasmtime_environ::Memory>, 304 ) -> InstanceHandle { 305 // The allocation must be *at least* the size required of `Instance`. 306 let layout = Self::alloc_layout(req.runtime_info.offsets()); 307 let ptr = alloc::alloc::alloc(layout); 308 if ptr.is_null() { 309 alloc::alloc::handle_alloc_error(layout); 310 } 311 let ptr = ptr.cast::<Instance>(); 312 313 let module = req.runtime_info.env_module(); 314 let dropped_elements = EntitySet::with_capacity(module.passive_elements.len()); 315 let dropped_data = EntitySet::with_capacity(module.passive_data_map.len()); 316 317 #[cfg(not(feature = "wmemcheck"))] 318 let _ = memory_tys; 319 320 ptr::write( 321 ptr, 322 Instance { 323 id: req.id, 324 runtime_info: req.runtime_info.clone(), 325 memories, 326 tables, 327 dropped_elements, 328 dropped_data, 329 host_state: req.host_state, 330 vmctx_self_reference: SendSyncPtr::new(NonNull::new(ptr.add(1).cast()).unwrap()), 331 vmctx: VMContext { 332 _marker: core::marker::PhantomPinned, 333 }, 334 #[cfg(feature = "wmemcheck")] 335 wmemcheck_state: { 336 if req.wmemcheck { 337 let size = memory_tys 338 .iter() 339 .next() 340 .map(|memory| memory.1.limits.min) 341 .unwrap_or(0) 342 * 64 343 * 1024; 344 Some(Wmemcheck::new(size as usize)) 345 } else { 346 None 347 } 348 }, 349 store: None, 350 }, 351 ); 352 353 (*ptr).initialize_vmctx(module, req.runtime_info.offsets(), req.store, req.imports); 354 InstanceHandle { 355 instance: Some(SendSyncPtr::new(NonNull::new(ptr).unwrap())), 356 } 357 } 358 359 /// Converts the provided `*mut VMContext` to an `Instance` pointer and runs 360 /// the provided closure with the instance. 361 /// 362 /// This method will move the `vmctx` pointer backwards to point to the 363 /// original `Instance` that precedes it. The closure is provided a 364 /// temporary version of the `Instance` pointer with a constrained lifetime 365 /// to the closure to ensure it doesn't accidentally escape. 366 /// 367 /// # Unsafety 368 /// 369 /// Callers must validate that the `vmctx` pointer is a valid allocation 370 /// and that it's valid to acquire `&mut Instance` at this time. For example 371 /// this can't be called twice on the same `VMContext` to get two active 372 /// pointers to the same `Instance`. 373 #[inline] 374 pub unsafe fn from_vmctx<R>( 375 vmctx: NonNull<VMContext>, 376 f: impl FnOnce(&mut Instance) -> R, 377 ) -> R { 378 let mut ptr = vmctx 379 .byte_sub(mem::size_of::<Instance>()) 380 .cast::<Instance>(); 381 f(ptr.as_mut()) 382 } 383 384 /// Helper function to access various locations offset from our `*mut 385 /// VMContext` object. 386 /// 387 /// Note that this method takes `&self` as an argument but returns 388 /// `NonNull<T>` which is frequently used to mutate said memory. This is an 389 /// intentional design decision where the safety of the modification of 390 /// memory is placed as a burden onto the caller. The implementation of this 391 /// method explicitly does not require `&mut self` to acquire mutable 392 /// provenance to update the `VMContext` region. Instead all pointers into 393 /// the `VMContext` area have provenance/permissions to write. 394 /// 395 /// Also note though that care must be taken to ensure that reads/writes of 396 /// memory must only happen where appropriate, for example a non-atomic 397 /// write (as most are) should never happen concurrently with another read 398 /// or write. It's generally on the burden of the caller to adhere to this. 399 /// 400 /// Also of note is that most of the time the usage of this method falls 401 /// into one of: 402 /// 403 /// * Something in the VMContext is being read or written. In that case use 404 /// `vmctx_plus_offset` or `vmctx_plus_offset_mut` if possible due to 405 /// that having a safer lifetime. 406 /// 407 /// * A pointer is being created to pass to other VM* data structures. In 408 /// that situation the lifetime of all VM data structures are typically 409 /// tied to the `Store<T>` which is what provides the guarantees around 410 /// concurrency/etc. 411 /// 412 /// There's quite a lot of unsafety riding on this method, especially 413 /// related to the ascription `T` of the byte `offset`. It's hoped that in 414 /// the future we're able to settle on an in theory safer design. 415 /// 416 /// # Safety 417 /// 418 /// This method is unsafe because the `offset` must be within bounds of the 419 /// `VMContext` object trailing this instance. Additionally `T` must be a 420 /// valid ascription of the value that resides at that location. 421 unsafe fn vmctx_plus_offset_raw<T: VmSafe>(&self, offset: impl Into<u32>) -> NonNull<T> { 422 // SAFETY: the safety requirements of `byte_add` are forwarded to this 423 // method's caller. 424 unsafe { 425 self.vmctx() 426 .byte_add(usize::try_from(offset.into()).unwrap()) 427 .cast() 428 } 429 } 430 431 /// Helper above `vmctx_plus_offset_raw` which transfers the lifetime of 432 /// `&self` to the returned reference `&T`. 433 /// 434 /// # Safety 435 /// 436 /// See the safety documentation of `vmctx_plus_offset_raw`. 437 unsafe fn vmctx_plus_offset<T: VmSafe>(&self, offset: impl Into<u32>) -> &T { 438 // SAFETY: this method has the same safety requirements as 439 // `vmctx_plus_offset_raw`. 440 unsafe { self.vmctx_plus_offset_raw(offset).as_ref() } 441 } 442 443 /// Helper above `vmctx_plus_offset_raw` which transfers the lifetime of 444 /// `&mut self` to the returned reference `&mut T`. 445 /// 446 /// # Safety 447 /// 448 /// See the safety documentation of `vmctx_plus_offset_raw`. 449 unsafe fn vmctx_plus_offset_mut<T: VmSafe>(&mut self, offset: impl Into<u32>) -> &mut T { 450 // SAFETY: this method has the same safety requirements as 451 // `vmctx_plus_offset_raw`. 452 unsafe { self.vmctx_plus_offset_raw(offset).as_mut() } 453 } 454 455 pub(crate) fn env_module(&self) -> &Arc<wasmtime_environ::Module> { 456 self.runtime_info.env_module() 457 } 458 459 #[cfg(feature = "gc")] 460 pub(crate) fn runtime_module(&self) -> Option<&crate::Module> { 461 match &self.runtime_info { 462 ModuleRuntimeInfo::Module(m) => Some(m), 463 ModuleRuntimeInfo::Bare(_) => None, 464 } 465 } 466 467 /// Translate a module-level interned type index into an engine-level 468 /// interned type index. 469 #[cfg(feature = "gc")] 470 pub fn engine_type_index(&self, module_index: ModuleInternedTypeIndex) -> VMSharedTypeIndex { 471 self.runtime_info.engine_type_index(module_index) 472 } 473 474 #[inline] 475 fn offsets(&self) -> &VMOffsets<HostPtr> { 476 self.runtime_info.offsets() 477 } 478 479 /// Return the indexed `VMFunctionImport`. 480 fn imported_function(&self, index: FuncIndex) -> &VMFunctionImport { 481 unsafe { self.vmctx_plus_offset(self.offsets().vmctx_vmfunction_import(index)) } 482 } 483 484 /// Return the index `VMTable`. 485 fn imported_table(&self, index: TableIndex) -> &VMTable { 486 unsafe { self.vmctx_plus_offset(self.offsets().vmctx_vmtable_import(index)) } 487 } 488 489 /// Return the indexed `VMMemoryImport`. 490 fn imported_memory(&self, index: MemoryIndex) -> &VMMemoryImport { 491 unsafe { self.vmctx_plus_offset(self.offsets().vmctx_vmmemory_import(index)) } 492 } 493 494 /// Return the indexed `VMGlobalImport`. 495 fn imported_global(&self, index: GlobalIndex) -> &VMGlobalImport { 496 unsafe { self.vmctx_plus_offset(self.offsets().vmctx_vmglobal_import(index)) } 497 } 498 499 /// Return the indexed `VMTagImport`. 500 fn imported_tag(&self, index: TagIndex) -> &VMTagImport { 501 unsafe { self.vmctx_plus_offset(self.offsets().vmctx_vmtag_import(index)) } 502 } 503 504 /// Return the indexed `VMTagDefinition`. 505 fn tag_ptr(&mut self, index: DefinedTagIndex) -> NonNull<VMTagDefinition> { 506 unsafe { self.vmctx_plus_offset_raw(self.offsets().vmctx_vmtag_definition(index)) } 507 } 508 509 /// Return the indexed `VMTableDefinition`. 510 #[allow(dead_code)] 511 fn table(&mut self, index: DefinedTableIndex) -> VMTableDefinition { 512 unsafe { self.table_ptr(index).read() } 513 } 514 515 /// Updates the value for a defined table to `VMTableDefinition`. 516 fn set_table(&mut self, index: DefinedTableIndex, table: VMTableDefinition) { 517 unsafe { 518 self.table_ptr(index).write(table); 519 } 520 } 521 522 /// Return the indexed `VMTableDefinition`. 523 fn table_ptr(&self, index: DefinedTableIndex) -> NonNull<VMTableDefinition> { 524 unsafe { self.vmctx_plus_offset_raw(self.offsets().vmctx_vmtable_definition(index)) } 525 } 526 527 /// Get a locally defined or imported memory. 528 pub(crate) fn get_memory(&self, index: MemoryIndex) -> VMMemoryDefinition { 529 if let Some(defined_index) = self.env_module().defined_memory_index(index) { 530 self.memory(defined_index) 531 } else { 532 let import = self.imported_memory(index); 533 unsafe { VMMemoryDefinition::load(import.from.as_ptr()) } 534 } 535 } 536 537 /// Get a locally defined or imported memory. 538 #[cfg(feature = "threads")] 539 pub(crate) fn get_runtime_memory(&mut self, index: MemoryIndex) -> &mut Memory { 540 if let Some(defined_index) = self.env_module().defined_memory_index(index) { 541 unsafe { &mut *self.get_defined_memory(defined_index) } 542 } else { 543 let import = self.imported_memory(index); 544 unsafe { 545 let ptr = Instance::from_vmctx(import.vmctx.as_non_null(), |i| { 546 i.get_defined_memory(import.index) 547 }); 548 &mut *ptr 549 } 550 } 551 } 552 553 /// Return the indexed `VMMemoryDefinition`, loaded from vmctx memory 554 /// already. 555 pub fn memory(&self, index: DefinedMemoryIndex) -> VMMemoryDefinition { 556 unsafe { VMMemoryDefinition::load(self.memory_ptr(index).as_ptr()) } 557 } 558 559 /// Set the indexed memory to `VMMemoryDefinition`. 560 fn set_memory(&self, index: DefinedMemoryIndex, mem: VMMemoryDefinition) { 561 unsafe { 562 self.memory_ptr(index).write(mem); 563 } 564 } 565 566 /// Return the address of the specified memory at `index` within this vmctx. 567 /// 568 /// Note that the returned pointer resides in wasm-code-readable-memory in 569 /// the vmctx. 570 pub fn memory_ptr(&self, index: DefinedMemoryIndex) -> NonNull<VMMemoryDefinition> { 571 unsafe { 572 self.vmctx_plus_offset::<VmPtr<_>>(self.offsets().vmctx_vmmemory_pointer(index)) 573 .as_non_null() 574 } 575 } 576 577 /// Return the indexed `VMGlobalDefinition`. 578 fn global_ptr(&mut self, index: DefinedGlobalIndex) -> NonNull<VMGlobalDefinition> { 579 unsafe { self.vmctx_plus_offset_raw(self.offsets().vmctx_vmglobal_definition(index)) } 580 } 581 582 /// Get a raw pointer to the global at the given index regardless whether it 583 /// is defined locally or imported from another module. 584 /// 585 /// Panics if the index is out of bound or is the reserved value. 586 pub(crate) fn defined_or_imported_global_ptr( 587 &mut self, 588 index: GlobalIndex, 589 ) -> NonNull<VMGlobalDefinition> { 590 if let Some(index) = self.env_module().defined_global_index(index) { 591 self.global_ptr(index) 592 } else { 593 self.imported_global(index).from.as_non_null() 594 } 595 } 596 597 /// Get all globals within this instance. 598 /// 599 /// Returns both import and defined globals. 600 /// 601 /// Returns both exported and non-exported globals. 602 /// 603 /// Gives access to the full globals space. 604 pub fn all_globals<'a>( 605 &'a mut self, 606 ) -> impl ExactSizeIterator<Item = (GlobalIndex, ExportGlobal)> + 'a { 607 let module = self.env_module().clone(); 608 module.globals.keys().map(move |idx| { 609 ( 610 idx, 611 ExportGlobal { 612 definition: self.defined_or_imported_global_ptr(idx), 613 vmctx: Some(self.vmctx()), 614 global: self.env_module().globals[idx], 615 }, 616 ) 617 }) 618 } 619 620 /// Get the globals defined in this instance (not imported). 621 pub fn defined_globals<'a>( 622 &'a mut self, 623 ) -> impl ExactSizeIterator<Item = (DefinedGlobalIndex, ExportGlobal)> + 'a { 624 let module = self.env_module().clone(); 625 module 626 .globals 627 .keys() 628 .skip(module.num_imported_globals) 629 .map(move |global_idx| { 630 let def_idx = module.defined_global_index(global_idx).unwrap(); 631 let global = ExportGlobal { 632 definition: self.global_ptr(def_idx), 633 vmctx: Some(self.vmctx()), 634 global: self.env_module().globals[global_idx], 635 }; 636 (def_idx, global) 637 }) 638 } 639 640 /// Return a pointer to the interrupts structure 641 #[inline] 642 pub fn vm_store_context(&mut self) -> NonNull<Option<VmPtr<VMStoreContext>>> { 643 unsafe { self.vmctx_plus_offset_raw(self.offsets().ptr.vmctx_store_context()) } 644 } 645 646 /// Return a pointer to the global epoch counter used by this instance. 647 #[cfg(target_has_atomic = "64")] 648 pub fn epoch_ptr(&mut self) -> &mut Option<VmPtr<AtomicU64>> { 649 unsafe { self.vmctx_plus_offset_mut(self.offsets().ptr.vmctx_epoch_ptr()) } 650 } 651 652 /// Return a pointer to the collector-specific heap data. 653 pub fn gc_heap_data(&mut self) -> &mut Option<VmPtr<u8>> { 654 unsafe { self.vmctx_plus_offset_mut(self.offsets().ptr.vmctx_gc_heap_data()) } 655 } 656 657 pub(crate) unsafe fn set_store(&mut self, store: Option<NonNull<dyn VMStore>>) { 658 self.store = store.map(VMStoreRawPtr); 659 if let Some(mut store) = store { 660 let store = store.as_mut(); 661 self.vm_store_context() 662 .write(Some(store.vm_store_context_ptr().into())); 663 #[cfg(target_has_atomic = "64")] 664 { 665 *self.epoch_ptr() = Some(NonNull::from(store.engine().epoch_counter()).into()); 666 } 667 668 if self.env_module().needs_gc_heap { 669 self.set_gc_heap(Some(store.gc_store().expect( 670 "if we need a GC heap, then `Instance::new_raw` should have already \ 671 allocated it for us", 672 ))); 673 } else { 674 self.set_gc_heap(None); 675 } 676 } else { 677 self.vm_store_context().write(None); 678 #[cfg(target_has_atomic = "64")] 679 { 680 *self.epoch_ptr() = None; 681 } 682 self.set_gc_heap(None); 683 } 684 } 685 686 unsafe fn set_gc_heap(&mut self, gc_store: Option<&GcStore>) { 687 if let Some(gc_store) = gc_store { 688 *self.gc_heap_data() = Some(gc_store.gc_heap.vmctx_gc_heap_data().into()); 689 } else { 690 *self.gc_heap_data() = None; 691 } 692 } 693 694 pub(crate) unsafe fn set_callee(&mut self, callee: Option<NonNull<VMFunctionBody>>) { 695 let callee = callee.map(|p| VmPtr::from(p)); 696 *self.vmctx_plus_offset_mut(self.offsets().ptr.vmctx_callee()) = callee; 697 } 698 699 /// Return a reference to the vmctx used by compiled wasm code. 700 #[inline] 701 pub fn vmctx(&self) -> NonNull<VMContext> { 702 // The definition of this method is subtle but intentional. The goal 703 // here is that effectively this should return `&mut self.vmctx`, but 704 // it's not quite so simple. Some more documentation is available on the 705 // `vmctx_self_reference` field, but the general idea is that we're 706 // creating a pointer to return with proper provenance. Provenance is 707 // still in the works in Rust at the time of this writing but the load 708 // of the `self.vmctx_self_reference` field is important here as it 709 // affects how LLVM thinks about aliasing with respect to the returned 710 // pointer. 711 // 712 // The intention of this method is to codegen to machine code as `&mut 713 // self.vmctx`, however. While it doesn't show up like this in LLVM IR 714 // (there's an actual load of the field) it does look like that by the 715 // time the backend runs. (that's magic to me, the backend removing 716 // loads...) 717 let addr = &raw const self.vmctx; 718 let ret = self.vmctx_self_reference.as_ptr().with_addr(addr.addr()); 719 NonNull::new(ret).unwrap() 720 } 721 722 fn get_exported_func(&mut self, index: FuncIndex) -> ExportFunction { 723 let func_ref = self.get_func_ref(index).unwrap(); 724 ExportFunction { func_ref } 725 } 726 727 fn get_exported_table(&mut self, index: TableIndex) -> ExportTable { 728 let (definition, vmctx) = 729 if let Some(def_index) = self.env_module().defined_table_index(index) { 730 (self.table_ptr(def_index), self.vmctx()) 731 } else { 732 let import = self.imported_table(index); 733 (import.from.as_non_null(), import.vmctx.as_non_null()) 734 }; 735 ExportTable { 736 definition, 737 vmctx, 738 table: self.env_module().tables[index], 739 } 740 } 741 742 fn get_exported_memory(&mut self, index: MemoryIndex) -> ExportMemory { 743 let (definition, vmctx, def_index) = 744 if let Some(def_index) = self.env_module().defined_memory_index(index) { 745 (self.memory_ptr(def_index), self.vmctx(), def_index) 746 } else { 747 let import = self.imported_memory(index); 748 ( 749 import.from.as_non_null(), 750 import.vmctx.as_non_null(), 751 import.index, 752 ) 753 }; 754 ExportMemory { 755 definition, 756 vmctx, 757 memory: self.env_module().memories[index], 758 index: def_index, 759 } 760 } 761 762 fn get_exported_global(&mut self, index: GlobalIndex) -> ExportGlobal { 763 ExportGlobal { 764 definition: if let Some(def_index) = self.env_module().defined_global_index(index) { 765 self.global_ptr(def_index) 766 } else { 767 self.imported_global(index).from.as_non_null() 768 }, 769 vmctx: Some(self.vmctx()), 770 global: self.env_module().globals[index], 771 } 772 } 773 774 fn get_exported_tag(&mut self, index: TagIndex) -> ExportTag { 775 ExportTag { 776 definition: if let Some(def_index) = self.env_module().defined_tag_index(index) { 777 self.tag_ptr(def_index) 778 } else { 779 self.imported_tag(index).from.as_non_null() 780 }, 781 tag: self.env_module().tags[index], 782 } 783 } 784 785 /// Return an iterator over the exports of this instance. 786 /// 787 /// Specifically, it provides access to the key-value pairs, where the keys 788 /// are export names, and the values are export declarations which can be 789 /// resolved `lookup_by_declaration`. 790 pub fn exports(&self) -> wasmparser::collections::index_map::Iter<String, EntityIndex> { 791 self.env_module().exports.iter() 792 } 793 794 /// Return a reference to the custom state attached to this instance. 795 #[inline] 796 pub fn host_state(&self) -> &dyn Any { 797 &*self.host_state 798 } 799 800 /// Return the table index for the given `VMTableDefinition`. 801 pub unsafe fn table_index(&mut self, table: &VMTableDefinition) -> DefinedTableIndex { 802 let index = DefinedTableIndex::new( 803 usize::try_from( 804 (table as *const VMTableDefinition) 805 .offset_from(self.table_ptr(DefinedTableIndex::new(0)).as_ptr()), 806 ) 807 .unwrap(), 808 ); 809 assert!(index.index() < self.tables.len()); 810 index 811 } 812 813 /// Get the given memory's page size, in bytes. 814 pub(crate) fn memory_page_size(&self, index: MemoryIndex) -> usize { 815 usize::try_from(self.env_module().memories[index].page_size()).unwrap() 816 } 817 818 /// Grow memory by the specified amount of pages. 819 /// 820 /// Returns `None` if memory can't be grown by the specified amount 821 /// of pages. Returns `Some` with the old size in bytes if growth was 822 /// successful. 823 pub(crate) fn memory_grow( 824 &mut self, 825 store: &mut dyn VMStore, 826 index: MemoryIndex, 827 delta: u64, 828 ) -> Result<Option<usize>, Error> { 829 match self.env_module().defined_memory_index(index) { 830 Some(idx) => self.defined_memory_grow(store, idx, delta), 831 None => { 832 let import = self.imported_memory(index); 833 unsafe { 834 Instance::from_vmctx(import.vmctx.as_non_null(), |i| { 835 i.defined_memory_grow(store, import.index, delta) 836 }) 837 } 838 } 839 } 840 } 841 842 fn defined_memory_grow( 843 &mut self, 844 store: &mut dyn VMStore, 845 idx: DefinedMemoryIndex, 846 delta: u64, 847 ) -> Result<Option<usize>, Error> { 848 let memory = &mut self.memories[idx].1; 849 850 let result = unsafe { memory.grow(delta, Some(store)) }; 851 852 // Update the state used by a non-shared Wasm memory in case the base 853 // pointer and/or the length changed. 854 if memory.as_shared_memory().is_none() { 855 let vmmemory = memory.vmmemory(); 856 self.set_memory(idx, vmmemory); 857 } 858 859 result 860 } 861 862 pub(crate) fn table_element_type(&mut self, table_index: TableIndex) -> TableElementType { 863 unsafe { (*self.get_table(table_index)).element_type() } 864 } 865 866 /// Grow table by the specified amount of elements, filling them with 867 /// `init_value`. 868 /// 869 /// Returns `None` if table can't be grown by the specified amount of 870 /// elements, or if `init_value` is the wrong type of table element. 871 pub(crate) fn table_grow( 872 &mut self, 873 store: &mut dyn VMStore, 874 table_index: TableIndex, 875 delta: u64, 876 init_value: TableElement, 877 ) -> Result<Option<usize>, Error> { 878 self.with_defined_table_index_and_instance(table_index, |i, instance| { 879 instance.defined_table_grow(store, i, delta, init_value) 880 }) 881 } 882 883 fn defined_table_grow( 884 &mut self, 885 store: &mut dyn VMStore, 886 table_index: DefinedTableIndex, 887 delta: u64, 888 init_value: TableElement, 889 ) -> Result<Option<usize>, Error> { 890 let table = &mut self 891 .tables 892 .get_mut(table_index) 893 .unwrap_or_else(|| panic!("no table for index {}", table_index.index())) 894 .1; 895 896 let result = unsafe { table.grow(delta, init_value, store) }; 897 898 // Keep the `VMContext` pointers used by compiled Wasm code up to 899 // date. 900 let element = self.tables[table_index].1.vmtable(); 901 self.set_table(table_index, element); 902 903 result 904 } 905 906 fn alloc_layout(offsets: &VMOffsets<HostPtr>) -> Layout { 907 let size = mem::size_of::<Self>() 908 .checked_add(usize::try_from(offsets.size_of_vmctx()).unwrap()) 909 .unwrap(); 910 let align = mem::align_of::<Self>(); 911 Layout::from_size_align(size, align).unwrap() 912 } 913 914 fn type_ids_array(&mut self) -> NonNull<VmPtr<VMSharedTypeIndex>> { 915 unsafe { self.vmctx_plus_offset_raw(self.offsets().ptr.vmctx_type_ids_array()) } 916 } 917 918 /// Construct a new VMFuncRef for the given function 919 /// (imported or defined in this module) and store into the given 920 /// location. Used during lazy initialization. 921 /// 922 /// Note that our current lazy-init scheme actually calls this every 923 /// time the funcref pointer is fetched; this turns out to be better 924 /// than tracking state related to whether it's been initialized 925 /// before, because resetting that state on (re)instantiation is 926 /// very expensive if there are many funcrefs. 927 fn construct_func_ref( 928 &mut self, 929 index: FuncIndex, 930 type_index: VMSharedTypeIndex, 931 into: *mut VMFuncRef, 932 ) { 933 let func_ref = if let Some(def_index) = self.env_module().defined_func_index(index) { 934 VMFuncRef { 935 array_call: self 936 .runtime_info 937 .array_to_wasm_trampoline(def_index) 938 .expect("should have array-to-Wasm trampoline for escaping function") 939 .into(), 940 wasm_call: Some(self.runtime_info.function(def_index).into()), 941 vmctx: VMOpaqueContext::from_vmcontext(self.vmctx()).into(), 942 type_index, 943 } 944 } else { 945 let import = self.imported_function(index); 946 VMFuncRef { 947 array_call: import.array_call, 948 wasm_call: Some(import.wasm_call), 949 vmctx: import.vmctx, 950 type_index, 951 } 952 }; 953 954 // Safety: we have a `&mut self`, so we have exclusive access 955 // to this Instance. 956 unsafe { 957 ptr::write(into, func_ref); 958 } 959 } 960 961 /// Get a `&VMFuncRef` for the given `FuncIndex`. 962 /// 963 /// Returns `None` if the index is the reserved index value. 964 /// 965 /// The returned reference is a stable reference that won't be moved and can 966 /// be passed into JIT code. 967 pub(crate) fn get_func_ref(&mut self, index: FuncIndex) -> Option<NonNull<VMFuncRef>> { 968 if index == FuncIndex::reserved_value() { 969 return None; 970 } 971 972 // Safety: we have a `&mut self`, so we have exclusive access 973 // to this Instance. 974 unsafe { 975 // For now, we eagerly initialize an funcref struct in-place 976 // whenever asked for a reference to it. This is mostly 977 // fine, because in practice each funcref is unlikely to be 978 // requested more than a few times: once-ish for funcref 979 // tables used for call_indirect (the usual compilation 980 // strategy places each function in the table at most once), 981 // and once or a few times when fetching exports via API. 982 // Note that for any case driven by table accesses, the lazy 983 // table init behaves like a higher-level cache layer that 984 // protects this initialization from happening multiple 985 // times, via that particular table at least. 986 // 987 // When `ref.func` becomes more commonly used or if we 988 // otherwise see a use-case where this becomes a hotpath, 989 // we can reconsider by using some state to track 990 // "uninitialized" explicitly, for example by zeroing the 991 // funcrefs (perhaps together with other 992 // zeroed-at-instantiate-time state) or using a separate 993 // is-initialized bitmap. 994 // 995 // We arrived at this design because zeroing memory is 996 // expensive, so it's better for instantiation performance 997 // if we don't have to track "is-initialized" state at 998 // all! 999 let func = &self.env_module().functions[index]; 1000 let sig = func.signature.unwrap_engine_type_index(); 1001 let func_ref = self 1002 .vmctx_plus_offset_raw::<VMFuncRef>(self.offsets().vmctx_func_ref(func.func_ref)); 1003 self.construct_func_ref(index, sig, func_ref.as_ptr()); 1004 1005 Some(func_ref) 1006 } 1007 } 1008 1009 /// Get the passive elements segment at the given index. 1010 /// 1011 /// Returns an empty segment if the index is out of bounds or if the segment 1012 /// has been dropped. 1013 /// 1014 /// The `storage` parameter should always be `None`; it is a bit of a hack 1015 /// to work around lifetime issues. 1016 pub(crate) fn passive_element_segment<'a>( 1017 &self, 1018 storage: &'a mut Option<(Arc<wasmtime_environ::Module>, TableSegmentElements)>, 1019 elem_index: ElemIndex, 1020 ) -> &'a TableSegmentElements { 1021 debug_assert!(storage.is_none()); 1022 *storage = Some(( 1023 // TODO: this `clone()` shouldn't be necessary but is used for now to 1024 // inform `rustc` that the lifetime of the elements here are 1025 // disconnected from the lifetime of `self`. 1026 self.env_module().clone(), 1027 // NB: fall back to an expressions-based list of elements which 1028 // doesn't have static type information (as opposed to 1029 // `TableSegmentElements::Functions`) since we don't know what type 1030 // is needed in the caller's context. Let the type be inferred by 1031 // how they use the segment. 1032 TableSegmentElements::Expressions(Box::new([])), 1033 )); 1034 let (module, empty) = storage.as_ref().unwrap(); 1035 1036 match module.passive_elements_map.get(&elem_index) { 1037 Some(index) if !self.dropped_elements.contains(elem_index) => { 1038 &module.passive_elements[*index] 1039 } 1040 _ => empty, 1041 } 1042 } 1043 1044 /// The `table.init` operation: initializes a portion of a table with a 1045 /// passive element. 1046 /// 1047 /// # Errors 1048 /// 1049 /// Returns a `Trap` error when the range within the table is out of bounds 1050 /// or the range within the passive element is out of bounds. 1051 pub(crate) fn table_init( 1052 &mut self, 1053 store: &mut StoreOpaque, 1054 table_index: TableIndex, 1055 elem_index: ElemIndex, 1056 dst: u64, 1057 src: u64, 1058 len: u64, 1059 ) -> Result<(), Trap> { 1060 let mut storage = None; 1061 let elements = self.passive_element_segment(&mut storage, elem_index); 1062 let mut const_evaluator = ConstExprEvaluator::default(); 1063 self.table_init_segment( 1064 store, 1065 &mut const_evaluator, 1066 table_index, 1067 elements, 1068 dst, 1069 src, 1070 len, 1071 ) 1072 } 1073 1074 pub(crate) fn table_init_segment( 1075 &mut self, 1076 store: &mut StoreOpaque, 1077 const_evaluator: &mut ConstExprEvaluator, 1078 table_index: TableIndex, 1079 elements: &TableSegmentElements, 1080 dst: u64, 1081 src: u64, 1082 len: u64, 1083 ) -> Result<(), Trap> { 1084 // https://webassembly.github.io/bulk-memory-operations/core/exec/instructions.html#exec-table-init 1085 1086 let table = unsafe { &mut *self.get_table(table_index) }; 1087 let src = usize::try_from(src).map_err(|_| Trap::TableOutOfBounds)?; 1088 let len = usize::try_from(len).map_err(|_| Trap::TableOutOfBounds)?; 1089 let module = self.env_module().clone(); 1090 1091 match elements { 1092 TableSegmentElements::Functions(funcs) => { 1093 let elements = funcs 1094 .get(src..) 1095 .and_then(|s| s.get(..len)) 1096 .ok_or(Trap::TableOutOfBounds)?; 1097 table.init_func(dst, elements.iter().map(|idx| self.get_func_ref(*idx)))?; 1098 } 1099 TableSegmentElements::Expressions(exprs) => { 1100 let exprs = exprs 1101 .get(src..) 1102 .and_then(|s| s.get(..len)) 1103 .ok_or(Trap::TableOutOfBounds)?; 1104 let mut context = ConstEvalContext::new(self); 1105 match module.tables[table_index].ref_type.heap_type.top() { 1106 WasmHeapTopType::Extern => table.init_gc_refs( 1107 dst, 1108 exprs.iter().map(|expr| unsafe { 1109 let raw = const_evaluator 1110 .eval(store, &mut context, expr) 1111 .expect("const expr should be valid"); 1112 VMGcRef::from_raw_u32(raw.get_externref()) 1113 }), 1114 )?, 1115 WasmHeapTopType::Any => table.init_gc_refs( 1116 dst, 1117 exprs.iter().map(|expr| unsafe { 1118 let raw = const_evaluator 1119 .eval(store, &mut context, expr) 1120 .expect("const expr should be valid"); 1121 VMGcRef::from_raw_u32(raw.get_anyref()) 1122 }), 1123 )?, 1124 WasmHeapTopType::Func => table.init_func( 1125 dst, 1126 exprs.iter().map(|expr| unsafe { 1127 NonNull::new( 1128 const_evaluator 1129 .eval(store, &mut context, expr) 1130 .expect("const expr should be valid") 1131 .get_funcref() 1132 .cast(), 1133 ) 1134 }), 1135 )?, 1136 WasmHeapTopType::Cont => todo!(), // FIXME: #10248 stack switching support. 1137 } 1138 } 1139 } 1140 1141 Ok(()) 1142 } 1143 1144 /// Drop an element. 1145 pub(crate) fn elem_drop(&mut self, elem_index: ElemIndex) { 1146 // https://webassembly.github.io/reference-types/core/exec/instructions.html#exec-elem-drop 1147 1148 self.dropped_elements.insert(elem_index); 1149 1150 // Note that we don't check that we actually removed a segment because 1151 // dropping a non-passive segment is a no-op (not a trap). 1152 } 1153 1154 /// Get a locally-defined memory. 1155 pub fn get_defined_memory(&mut self, index: DefinedMemoryIndex) -> *mut Memory { 1156 // SAFETY: the `unsafe` here is projecting from `*mut (A, B)` to 1157 // `*mut A`, which should be a safe operation to do. 1158 unsafe { &raw mut (*self.memories.get_raw_mut(index).unwrap()).1 } 1159 } 1160 1161 /// Do a `memory.copy` 1162 /// 1163 /// # Errors 1164 /// 1165 /// Returns a `Trap` error when the source or destination ranges are out of 1166 /// bounds. 1167 pub(crate) fn memory_copy( 1168 &mut self, 1169 dst_index: MemoryIndex, 1170 dst: u64, 1171 src_index: MemoryIndex, 1172 src: u64, 1173 len: u64, 1174 ) -> Result<(), Trap> { 1175 // https://webassembly.github.io/reference-types/core/exec/instructions.html#exec-memory-copy 1176 1177 let src_mem = self.get_memory(src_index); 1178 let dst_mem = self.get_memory(dst_index); 1179 1180 let src = self.validate_inbounds(src_mem.current_length(), src, len)?; 1181 let dst = self.validate_inbounds(dst_mem.current_length(), dst, len)?; 1182 let len = usize::try_from(len).unwrap(); 1183 1184 // Bounds and casts are checked above, by this point we know that 1185 // everything is safe. 1186 unsafe { 1187 let dst = dst_mem.base.as_ptr().add(dst); 1188 let src = src_mem.base.as_ptr().add(src); 1189 // FIXME audit whether this is safe in the presence of shared memory 1190 // (https://github.com/bytecodealliance/wasmtime/issues/4203). 1191 ptr::copy(src, dst, len); 1192 } 1193 1194 Ok(()) 1195 } 1196 1197 fn validate_inbounds(&self, max: usize, ptr: u64, len: u64) -> Result<usize, Trap> { 1198 let oob = || Trap::MemoryOutOfBounds; 1199 let end = ptr 1200 .checked_add(len) 1201 .and_then(|i| usize::try_from(i).ok()) 1202 .ok_or_else(oob)?; 1203 if end > max { 1204 Err(oob()) 1205 } else { 1206 Ok(ptr.try_into().unwrap()) 1207 } 1208 } 1209 1210 /// Perform the `memory.fill` operation on a locally defined memory. 1211 /// 1212 /// # Errors 1213 /// 1214 /// Returns a `Trap` error if the memory range is out of bounds. 1215 pub(crate) fn memory_fill( 1216 &mut self, 1217 memory_index: MemoryIndex, 1218 dst: u64, 1219 val: u8, 1220 len: u64, 1221 ) -> Result<(), Trap> { 1222 let memory = self.get_memory(memory_index); 1223 let dst = self.validate_inbounds(memory.current_length(), dst, len)?; 1224 let len = usize::try_from(len).unwrap(); 1225 1226 // Bounds and casts are checked above, by this point we know that 1227 // everything is safe. 1228 unsafe { 1229 let dst = memory.base.as_ptr().add(dst); 1230 // FIXME audit whether this is safe in the presence of shared memory 1231 // (https://github.com/bytecodealliance/wasmtime/issues/4203). 1232 ptr::write_bytes(dst, val, len); 1233 } 1234 1235 Ok(()) 1236 } 1237 1238 /// Get the internal storage range of a particular Wasm data segment. 1239 pub(crate) fn wasm_data_range(&self, index: DataIndex) -> Range<u32> { 1240 match self.env_module().passive_data_map.get(&index) { 1241 Some(range) if !self.dropped_data.contains(index) => range.clone(), 1242 _ => 0..0, 1243 } 1244 } 1245 1246 /// Given an internal storage range of a Wasm data segment (or subset of a 1247 /// Wasm data segment), get the data's raw bytes. 1248 pub(crate) fn wasm_data(&self, range: Range<u32>) -> &[u8] { 1249 let start = usize::try_from(range.start).unwrap(); 1250 let end = usize::try_from(range.end).unwrap(); 1251 &self.runtime_info.wasm_data()[start..end] 1252 } 1253 1254 /// Performs the `memory.init` operation. 1255 /// 1256 /// # Errors 1257 /// 1258 /// Returns a `Trap` error if the destination range is out of this module's 1259 /// memory's bounds or if the source range is outside the data segment's 1260 /// bounds. 1261 pub(crate) fn memory_init( 1262 &mut self, 1263 memory_index: MemoryIndex, 1264 data_index: DataIndex, 1265 dst: u64, 1266 src: u32, 1267 len: u32, 1268 ) -> Result<(), Trap> { 1269 let range = self.wasm_data_range(data_index); 1270 self.memory_init_segment(memory_index, range, dst, src, len) 1271 } 1272 1273 pub(crate) fn memory_init_segment( 1274 &mut self, 1275 memory_index: MemoryIndex, 1276 range: Range<u32>, 1277 dst: u64, 1278 src: u32, 1279 len: u32, 1280 ) -> Result<(), Trap> { 1281 // https://webassembly.github.io/bulk-memory-operations/core/exec/instructions.html#exec-memory-init 1282 1283 let memory = self.get_memory(memory_index); 1284 let data = self.wasm_data(range); 1285 let dst = self.validate_inbounds(memory.current_length(), dst, len.into())?; 1286 let src = self.validate_inbounds(data.len(), src.into(), len.into())?; 1287 let len = len as usize; 1288 1289 unsafe { 1290 let src_start = data.as_ptr().add(src); 1291 let dst_start = memory.base.as_ptr().add(dst); 1292 // FIXME audit whether this is safe in the presence of shared memory 1293 // (https://github.com/bytecodealliance/wasmtime/issues/4203). 1294 ptr::copy_nonoverlapping(src_start, dst_start, len); 1295 } 1296 1297 Ok(()) 1298 } 1299 1300 /// Drop the given data segment, truncating its length to zero. 1301 pub(crate) fn data_drop(&mut self, data_index: DataIndex) { 1302 self.dropped_data.insert(data_index); 1303 1304 // Note that we don't check that we actually removed a segment because 1305 // dropping a non-passive segment is a no-op (not a trap). 1306 } 1307 1308 /// Get a table by index regardless of whether it is locally-defined 1309 /// or an imported, foreign table. Ensure that the given range of 1310 /// elements in the table is lazily initialized. We define this 1311 /// operation all-in-one for safety, to ensure the lazy-init 1312 /// happens. 1313 /// 1314 /// Takes an `Iterator` for the index-range to lazy-initialize, 1315 /// for flexibility. This can be a range, single item, or empty 1316 /// sequence, for example. The iterator should return indices in 1317 /// increasing order, so that the break-at-out-of-bounds behavior 1318 /// works correctly. 1319 pub(crate) fn get_table_with_lazy_init( 1320 &mut self, 1321 table_index: TableIndex, 1322 range: impl Iterator<Item = u64>, 1323 ) -> *mut Table { 1324 self.with_defined_table_index_and_instance(table_index, |idx, instance| { 1325 instance.get_defined_table_with_lazy_init(idx, range) 1326 }) 1327 } 1328 1329 /// Gets the raw runtime table data structure owned by this instance 1330 /// given the provided `idx`. 1331 /// 1332 /// The `range` specified is eagerly initialized for funcref tables. 1333 pub fn get_defined_table_with_lazy_init( 1334 &mut self, 1335 idx: DefinedTableIndex, 1336 range: impl Iterator<Item = u64>, 1337 ) -> *mut Table { 1338 let elt_ty = self.tables[idx].1.element_type(); 1339 1340 if elt_ty == TableElementType::Func { 1341 for i in range { 1342 let value = match self.tables[idx].1.get(None, i) { 1343 Some(value) => value, 1344 None => { 1345 // Out-of-bounds; caller will handle by likely 1346 // throwing a trap. No work to do to lazy-init 1347 // beyond the end. 1348 break; 1349 } 1350 }; 1351 1352 if !value.is_uninit() { 1353 continue; 1354 } 1355 1356 // The table element `i` is uninitialized and is now being 1357 // initialized. This must imply that a `precompiled` list of 1358 // function indices is available for this table. The precompiled 1359 // list is extracted and then it is consulted with `i` to 1360 // determine the function that is going to be initialized. Note 1361 // that `i` may be outside the limits of the static 1362 // initialization so it's a fallible `get` instead of an index. 1363 let module = self.env_module(); 1364 let precomputed = match &module.table_initialization.initial_values[idx] { 1365 TableInitialValue::Null { precomputed } => precomputed, 1366 TableInitialValue::Expr(_) => unreachable!(), 1367 }; 1368 // Panicking here helps catch bugs rather than silently truncating by accident. 1369 let func_index = precomputed.get(usize::try_from(i).unwrap()).cloned(); 1370 let func_ref = func_index.and_then(|func_index| self.get_func_ref(func_index)); 1371 self.tables[idx] 1372 .1 1373 .set(i, TableElement::FuncRef(func_ref)) 1374 .expect("Table type should match and index should be in-bounds"); 1375 } 1376 } 1377 1378 // SAFETY: the `unsafe` here is projecting from `*mut (A, B)` to 1379 // `*mut A`, which should be a safe operation to do. 1380 unsafe { &raw mut (*self.tables.get_raw_mut(idx).unwrap()).1 } 1381 } 1382 1383 /// Get a table by index regardless of whether it is locally-defined or an 1384 /// imported, foreign table. 1385 pub(crate) fn get_table(&mut self, table_index: TableIndex) -> *mut Table { 1386 self.with_defined_table_index_and_instance(table_index, |idx, instance| unsafe { 1387 // SAFETY: the `unsafe` here is projecting from `*mut (A, B)` to 1388 // `*mut A`, which should be a safe operation to do. 1389 &raw mut (*instance.tables.get_raw_mut(idx).unwrap()).1 1390 }) 1391 } 1392 1393 /// Get a locally-defined table. 1394 pub(crate) fn get_defined_table(&mut self, index: DefinedTableIndex) -> *mut Table { 1395 // SAFETY: the `unsafe` here is projecting from `*mut (A, B)` to 1396 // `*mut A`, which should be a safe operation to do. 1397 unsafe { &raw mut (*self.tables.get_raw_mut(index).unwrap()).1 } 1398 } 1399 1400 pub(crate) fn with_defined_table_index_and_instance<R>( 1401 &mut self, 1402 index: TableIndex, 1403 f: impl FnOnce(DefinedTableIndex, &mut Instance) -> R, 1404 ) -> R { 1405 if let Some(defined_table_index) = self.env_module().defined_table_index(index) { 1406 f(defined_table_index, self) 1407 } else { 1408 let import = self.imported_table(index); 1409 unsafe { 1410 Instance::from_vmctx(import.vmctx.as_non_null(), |foreign_instance| { 1411 let foreign_table_def = import.from.as_ptr(); 1412 let foreign_table_index = foreign_instance.table_index(&*foreign_table_def); 1413 f(foreign_table_index, foreign_instance) 1414 }) 1415 } 1416 } 1417 } 1418 1419 /// Initialize the VMContext data associated with this Instance. 1420 /// 1421 /// The `VMContext` memory is assumed to be uninitialized; any field 1422 /// that we need in a certain state will be explicitly written by this 1423 /// function. 1424 unsafe fn initialize_vmctx( 1425 &mut self, 1426 module: &Module, 1427 offsets: &VMOffsets<HostPtr>, 1428 store: StorePtr, 1429 imports: Imports, 1430 ) { 1431 assert!(ptr::eq(module, self.env_module().as_ref())); 1432 1433 self.vmctx_plus_offset_raw::<u32>(offsets.ptr.vmctx_magic()) 1434 .write(VMCONTEXT_MAGIC); 1435 self.set_callee(None); 1436 self.set_store(store.as_raw()); 1437 1438 // Initialize shared types 1439 let types = NonNull::from(self.runtime_info.type_ids()); 1440 self.type_ids_array().write(types.cast().into()); 1441 1442 // Initialize the built-in functions 1443 static BUILTINS: VMBuiltinFunctionsArray = VMBuiltinFunctionsArray::INIT; 1444 let ptr = BUILTINS.expose_provenance(); 1445 self.vmctx_plus_offset_raw(offsets.ptr.vmctx_builtin_functions()) 1446 .write(VmPtr::from(ptr)); 1447 1448 // Initialize the imports 1449 debug_assert_eq!(imports.functions.len(), module.num_imported_funcs); 1450 ptr::copy_nonoverlapping( 1451 imports.functions.as_ptr(), 1452 self.vmctx_plus_offset_raw(offsets.vmctx_imported_functions_begin()) 1453 .as_ptr(), 1454 imports.functions.len(), 1455 ); 1456 debug_assert_eq!(imports.tables.len(), module.num_imported_tables); 1457 ptr::copy_nonoverlapping( 1458 imports.tables.as_ptr(), 1459 self.vmctx_plus_offset_raw(offsets.vmctx_imported_tables_begin()) 1460 .as_ptr(), 1461 imports.tables.len(), 1462 ); 1463 debug_assert_eq!(imports.memories.len(), module.num_imported_memories); 1464 ptr::copy_nonoverlapping( 1465 imports.memories.as_ptr(), 1466 self.vmctx_plus_offset_raw(offsets.vmctx_imported_memories_begin()) 1467 .as_ptr(), 1468 imports.memories.len(), 1469 ); 1470 debug_assert_eq!(imports.globals.len(), module.num_imported_globals); 1471 ptr::copy_nonoverlapping( 1472 imports.globals.as_ptr(), 1473 self.vmctx_plus_offset_raw(offsets.vmctx_imported_globals_begin()) 1474 .as_ptr(), 1475 imports.globals.len(), 1476 ); 1477 1478 debug_assert_eq!(imports.tags.len(), module.num_imported_tags); 1479 ptr::copy_nonoverlapping( 1480 imports.tags.as_ptr(), 1481 self.vmctx_plus_offset_raw(offsets.vmctx_imported_tags_begin()) 1482 .as_ptr(), 1483 imports.tags.len(), 1484 ); 1485 1486 // N.B.: there is no need to initialize the funcrefs array because we 1487 // eagerly construct each element in it whenever asked for a reference 1488 // to that element. In other words, there is no state needed to track 1489 // the lazy-init, so we don't need to initialize any state now. 1490 1491 // Initialize the defined tables 1492 let mut ptr = self.vmctx_plus_offset_raw(offsets.vmctx_tables_begin()); 1493 for i in 0..module.num_defined_tables() { 1494 ptr.write(self.tables[DefinedTableIndex::new(i)].1.vmtable()); 1495 ptr = ptr.add(1); 1496 } 1497 1498 // Initialize the defined memories. This fills in both the 1499 // `defined_memories` table and the `owned_memories` table at the same 1500 // time. Entries in `defined_memories` hold a pointer to a definition 1501 // (all memories) whereas the `owned_memories` hold the actual 1502 // definitions of memories owned (not shared) in the module. 1503 let mut ptr = self.vmctx_plus_offset_raw(offsets.vmctx_memories_begin()); 1504 let mut owned_ptr = self.vmctx_plus_offset_raw(offsets.vmctx_owned_memories_begin()); 1505 for i in 0..module.num_defined_memories() { 1506 let defined_memory_index = DefinedMemoryIndex::new(i); 1507 let memory_index = module.memory_index(defined_memory_index); 1508 if module.memories[memory_index].shared { 1509 let def_ptr = self.memories[defined_memory_index] 1510 .1 1511 .as_shared_memory() 1512 .unwrap() 1513 .vmmemory_ptr(); 1514 ptr.write(VmPtr::from(def_ptr)); 1515 } else { 1516 owned_ptr.write(self.memories[defined_memory_index].1.vmmemory()); 1517 ptr.write(VmPtr::from(owned_ptr)); 1518 owned_ptr = owned_ptr.add(1); 1519 } 1520 ptr = ptr.add(1); 1521 } 1522 1523 // Zero-initialize the globals so that nothing is uninitialized memory 1524 // after this function returns. The globals are actually initialized 1525 // with their const expression initializers after the instance is fully 1526 // allocated. 1527 for (index, _init) in module.global_initializers.iter() { 1528 self.global_ptr(index).write(VMGlobalDefinition::new()); 1529 } 1530 1531 // Initialize the defined tags 1532 let mut ptr = self.vmctx_plus_offset_raw(offsets.vmctx_tags_begin()); 1533 for i in 0..module.num_defined_tags() { 1534 let defined_index = DefinedTagIndex::new(i); 1535 let tag_index = module.tag_index(defined_index); 1536 let tag = module.tags[tag_index]; 1537 ptr.write(VMTagDefinition::new( 1538 tag.signature.unwrap_engine_type_index(), 1539 )); 1540 ptr = ptr.add(1); 1541 } 1542 } 1543 1544 fn wasm_fault(&self, addr: usize) -> Option<WasmFault> { 1545 let mut fault = None; 1546 for (_, (_, memory)) in self.memories.iter() { 1547 let accessible = memory.wasm_accessible(); 1548 if accessible.start <= addr && addr < accessible.end { 1549 // All linear memories should be disjoint so assert that no 1550 // prior fault has been found. 1551 assert!(fault.is_none()); 1552 fault = Some(WasmFault { 1553 memory_size: memory.byte_size(), 1554 wasm_address: u64::try_from(addr - accessible.start).unwrap(), 1555 }); 1556 } 1557 } 1558 fault 1559 } 1560 1561 /// Returns the id, within this instance's store, that it's assigned. 1562 pub fn id(&self) -> InstanceId { 1563 self.id 1564 } 1565 } 1566 1567 /// A handle holding an `Instance` of a WebAssembly module. 1568 #[derive(Debug)] 1569 pub struct InstanceHandle { 1570 instance: Option<SendSyncPtr<Instance>>, 1571 } 1572 1573 impl InstanceHandle { 1574 /// Creates an "empty" instance handle which internally has a null pointer 1575 /// to an instance. 1576 pub fn null() -> InstanceHandle { 1577 InstanceHandle { instance: None } 1578 } 1579 1580 /// Return a raw pointer to the vmctx used by compiled wasm code. 1581 #[inline] 1582 pub fn vmctx(&self) -> NonNull<VMContext> { 1583 self.instance().vmctx() 1584 } 1585 1586 /// Return a reference to a module. 1587 pub fn module(&self) -> &Arc<Module> { 1588 self.instance().env_module() 1589 } 1590 1591 /// Lookup a function by index. 1592 pub fn get_exported_func(&mut self, export: FuncIndex) -> ExportFunction { 1593 self.instance_mut().get_exported_func(export) 1594 } 1595 1596 /// Lookup a global by index. 1597 pub fn get_exported_global(&mut self, export: GlobalIndex) -> ExportGlobal { 1598 self.instance_mut().get_exported_global(export) 1599 } 1600 1601 /// Lookup a tag by index. 1602 pub fn get_exported_tag(&mut self, export: TagIndex) -> ExportTag { 1603 self.instance_mut().get_exported_tag(export) 1604 } 1605 1606 /// Lookup a memory by index. 1607 pub fn get_exported_memory(&mut self, export: MemoryIndex) -> ExportMemory { 1608 self.instance_mut().get_exported_memory(export) 1609 } 1610 1611 /// Lookup a table by index. 1612 pub fn get_exported_table(&mut self, export: TableIndex) -> ExportTable { 1613 self.instance_mut().get_exported_table(export) 1614 } 1615 1616 /// Lookup an item with the given index. 1617 pub fn get_export_by_index(&mut self, export: EntityIndex) -> Export { 1618 match export { 1619 EntityIndex::Function(i) => Export::Function(self.get_exported_func(i)), 1620 EntityIndex::Global(i) => Export::Global(self.get_exported_global(i)), 1621 EntityIndex::Table(i) => Export::Table(self.get_exported_table(i)), 1622 EntityIndex::Memory(i) => Export::Memory(self.get_exported_memory(i)), 1623 EntityIndex::Tag(i) => Export::Tag(self.get_exported_tag(i)), 1624 } 1625 } 1626 1627 /// Return an iterator over the exports of this instance. 1628 /// 1629 /// Specifically, it provides access to the key-value pairs, where the keys 1630 /// are export names, and the values are export declarations which can be 1631 /// resolved `lookup_by_declaration`. 1632 pub fn exports(&self) -> wasmparser::collections::index_map::Iter<String, EntityIndex> { 1633 self.instance().exports() 1634 } 1635 1636 /// Return a reference to the custom state attached to this instance. 1637 pub fn host_state(&self) -> &dyn Any { 1638 self.instance().host_state() 1639 } 1640 1641 /// Get a table defined locally within this module. 1642 pub fn get_defined_table(&mut self, index: DefinedTableIndex) -> *mut Table { 1643 self.instance_mut().get_defined_table(index) 1644 } 1645 1646 /// Get a table defined locally within this module, lazily 1647 /// initializing the given range first. 1648 pub fn get_defined_table_with_lazy_init( 1649 &mut self, 1650 index: DefinedTableIndex, 1651 range: impl Iterator<Item = u64>, 1652 ) -> *mut Table { 1653 let index = self.instance().env_module().table_index(index); 1654 self.instance_mut().get_table_with_lazy_init(index, range) 1655 } 1656 1657 /// Get all tables within this instance. 1658 /// 1659 /// Returns both import and defined tables. 1660 /// 1661 /// Returns both exported and non-exported tables. 1662 /// 1663 /// Gives access to the full tables space. 1664 pub fn all_tables<'a>( 1665 &'a mut self, 1666 ) -> impl ExactSizeIterator<Item = (TableIndex, ExportTable)> + 'a { 1667 let indices = (0..self.module().tables.len()) 1668 .map(|i| TableIndex::new(i)) 1669 .collect::<Vec<_>>(); 1670 indices.into_iter().map(|i| (i, self.get_exported_table(i))) 1671 } 1672 1673 /// Return the tables defined in this instance (not imported). 1674 pub fn defined_tables<'a>(&'a mut self) -> impl ExactSizeIterator<Item = ExportTable> + 'a { 1675 let num_imported = self.module().num_imported_tables; 1676 self.all_tables() 1677 .skip(num_imported) 1678 .map(|(_i, table)| table) 1679 } 1680 1681 /// Get all memories within this instance. 1682 /// 1683 /// Returns both import and defined memories. 1684 /// 1685 /// Returns both exported and non-exported memories. 1686 /// 1687 /// Gives access to the full memories space. 1688 pub fn all_memories<'a>( 1689 &'a mut self, 1690 ) -> impl ExactSizeIterator<Item = (MemoryIndex, ExportMemory)> + 'a { 1691 let indices = (0..self.module().memories.len()) 1692 .map(|i| MemoryIndex::new(i)) 1693 .collect::<Vec<_>>(); 1694 indices 1695 .into_iter() 1696 .map(|i| (i, self.get_exported_memory(i))) 1697 } 1698 1699 /// Return the memories defined in this instance (not imported). 1700 pub fn defined_memories<'a>(&'a mut self) -> impl ExactSizeIterator<Item = ExportMemory> + 'a { 1701 let num_imported = self.module().num_imported_memories; 1702 self.all_memories() 1703 .skip(num_imported) 1704 .map(|(_i, memory)| memory) 1705 } 1706 1707 /// Get all globals within this instance. 1708 /// 1709 /// Returns both import and defined globals. 1710 /// 1711 /// Returns both exported and non-exported globals. 1712 /// 1713 /// Gives access to the full globals space. 1714 pub fn all_globals<'a>( 1715 &'a mut self, 1716 ) -> impl ExactSizeIterator<Item = (GlobalIndex, ExportGlobal)> + 'a { 1717 self.instance_mut().all_globals() 1718 } 1719 1720 /// Get the globals defined in this instance (not imported). 1721 pub fn defined_globals<'a>( 1722 &'a mut self, 1723 ) -> impl ExactSizeIterator<Item = (DefinedGlobalIndex, ExportGlobal)> + 'a { 1724 self.instance_mut().defined_globals() 1725 } 1726 1727 /// Return a reference to the contained `Instance`. 1728 #[inline] 1729 pub(crate) fn instance(&self) -> &Instance { 1730 unsafe { &*self.instance.unwrap().as_ptr() } 1731 } 1732 1733 pub(crate) fn instance_mut(&mut self) -> &mut Instance { 1734 unsafe { &mut *self.instance.unwrap().as_ptr() } 1735 } 1736 1737 /// Get this instance's `dyn VMStore` trait object. 1738 /// 1739 /// This should only be used for initializing a vmctx's store pointer. It 1740 /// should never be used to access the store itself. Use `InstanceAndStore` 1741 /// for that instead. 1742 pub fn traitobj(&self, store: &StoreOpaque) -> NonNull<dyn VMStore> { 1743 // By requiring a store argument, we are ensuring that callers aren't 1744 // getting this trait object in order to access the store, since they 1745 // already have access. See `InstanceAndStore` and its documentation for 1746 // details about the store access patterns we want to restrict host code 1747 // to. 1748 let _ = store; 1749 1750 self.instance().store.unwrap().0 1751 } 1752 1753 /// Configure the `*mut dyn Store` internal pointer after-the-fact. 1754 /// 1755 /// This is provided for the original `Store` itself to configure the first 1756 /// self-pointer after the original `Box` has been initialized. 1757 pub unsafe fn set_store(&mut self, store: Option<NonNull<dyn VMStore>>) { 1758 self.instance_mut().set_store(store); 1759 } 1760 1761 /// Returns a clone of this instance. 1762 /// 1763 /// This is unsafe because the returned handle here is just a cheap clone 1764 /// of the internals, there's no lifetime tracking around its validity. 1765 /// You'll need to ensure that the returned handles all go out of scope at 1766 /// the same time. 1767 #[inline] 1768 pub unsafe fn clone(&self) -> InstanceHandle { 1769 InstanceHandle { 1770 instance: self.instance, 1771 } 1772 } 1773 1774 /// Performs post-initialization of an instance after its handle has been 1775 /// created and registered with a store. 1776 /// 1777 /// Failure of this function means that the instance still must persist 1778 /// within the store since failure may indicate partial failure, or some 1779 /// state could be referenced by other instances. 1780 pub fn initialize( 1781 &mut self, 1782 store: &mut StoreOpaque, 1783 module: &Module, 1784 is_bulk_memory: bool, 1785 ) -> Result<()> { 1786 allocator::initialize_instance(store, self.instance_mut(), module, is_bulk_memory) 1787 } 1788 1789 /// Attempts to convert from the host `addr` specified to a WebAssembly 1790 /// based address recorded in `WasmFault`. 1791 /// 1792 /// This method will check all linear memories that this instance contains 1793 /// to see if any of them contain `addr`. If one does then `Some` is 1794 /// returned with metadata about the wasm fault. Otherwise `None` is 1795 /// returned and `addr` doesn't belong to this instance. 1796 pub fn wasm_fault(&self, addr: usize) -> Option<WasmFault> { 1797 self.instance().wasm_fault(addr) 1798 } 1799 } 1800