T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove the ModuleLimits pooling configuration structure (#3837)

Browse Source 
* Remove the `ModuleLimits` pooling configuration structure

This commit is an attempt to improve the usability of the pooling
allocator by removing the need to configure a `ModuleLimits` structure.
Internally this structure has limits on all forms of wasm constructs but
this largely bottoms out in the size of an allocation for an instance in
the instance pooling allocator. Maintaining this list of limits can be
cumbersome as modules may get tweaked over time and there's otherwise no
real reason to limit the number of globals in a module since the main
goal is to limit the memory consumption of a `VMContext` which can be
done with a memory allocation limit rather than fine-tuned control over
each maximum and minimum.

The new approach taken in this commit is to remove `ModuleLimits`. Some
fields, such as `tables`, `table_elements` , `memories`, and
`memory_pages` are moved to `InstanceLimits` since they're still
enforced at runtime. A new field `size` is added to `InstanceLimits`
which indicates, in bytes, the maximum size of the `VMContext`
allocation. If the size of a `VMContext` for a module exceeds this value
then instantiation will fail.

This involved adding a few more checks to `{Table, Memory}::new_static`
to ensure that the minimum size is able to fit in the allocation, since
previously modules were validated at compile time of the module that
everything fit and that validation no longer happens (it happens at
runtime).

A consequence of this commit is that Wasmtime will have no built-in way
to reject modules at compile time if they'll fail to be instantiated
within a particular pooling allocator configuration. Instead a module
must attempt instantiation see if a failure happens.

* Fix benchmark compiles

* Fix some doc links

* Fix a panic by ensuring modules have limited tables/memories

* Review comments

* Add back validation at `Module` time instantiation is possible

This allows for getting an early signal at compile time that a module
will never be instantiable in an engine with matching settings.

* Provide a better error message when sizes are exceeded

Improve the error message when an instance size exceeds the maximum by
providing a breakdown of where the bytes are all going and why the large
size is being requested.

* Try to fix test in qemu

* Flag new test as 64-bit only

Sizes are all specific to 64-bit right now
This commit is contained in:
Alex Crichton
2022-02-25 09:11:51 -06:00
committed by GitHub
parent b064e60087
commit 15bb0c6903
20 changed files with 574 additions and 1095 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
crates/runtime/src/instance/allocator.rs
View File

@@ -23,9 +23,7 @@ use wasmtime_environ::{
mod pooling;
#[cfg(feature = "pooling-allocator")]
pub use self::pooling::{
InstanceLimits, ModuleLimits, PoolingAllocationStrategy, PoolingInstanceAllocator,
};
pub use self::pooling::{InstanceLimits, PoolingAllocationStrategy, PoolingInstanceAllocator};
/// Represents a request for a new runtime instance.
pub struct InstanceAllocationRequest<'a> {

901
crates/runtime/src/instance/allocator/pooling.rs
View File

File diff suppressed because it is too large Load Diff

30
crates/runtime/src/instance/allocator/pooling/uffd.rs
View File

@@ -96,7 +96,7 @@ pub fn decommit_stack_pages(addr: *mut u8, len: usize) -> Result<()> {
/// the page fault handler will detect an out of bounds access and treat the page, temporarily,
/// as a guard page.
pub(super) fn initialize_memory_pool(pool: &MemoryPool) -> Result<()> {
if pool.memory_size == 0 || pool.max_wasm_pages == 0 {
if pool.memory_reservation_size == 0 || pool.max_memory_size == 0 {
return Ok(());
}
@@ -105,7 +105,7 @@ pub(super) fn initialize_memory_pool(pool: &MemoryPool) -> Result<()> {
unsafe {
region::protect(
base as _,
pool.max_wasm_pages as usize * WASM_PAGE_SIZE,
pool.max_memory_size,
region::Protection::READ_WRITE,
)
.context("failed to initialize memory pool for uffd")?;
@@ -177,7 +177,7 @@ impl FaultLocator {
max_instances: instances.max_instances,
memories_start,
memories_end,
memory_size: instances.memories.memory_size,
memory_size: instances.memories.memory_reservation_size,
max_memories: instances.memories.max_memories,
}
}
@@ -438,8 +438,8 @@ impl Drop for PageFaultHandler {
mod test {
use super::*;
use crate::{
Imports, InstanceAllocationRequest, InstanceLimits, ModuleLimits,
PoolingAllocationStrategy, Store, StorePtr,
Imports, InstanceAllocationRequest, InstanceLimits, PoolingAllocationStrategy, Store,
StorePtr,
};
use std::sync::atomic::AtomicU64;
use std::sync::Arc;
@@ -448,20 +448,15 @@ mod test {
#[cfg(target_pointer_width = "64")]
#[test]
fn test_address_locator() {
let module_limits = ModuleLimits {
imported_functions: 0,
imported_tables: 0,
imported_memories: 0,
imported_globals: 0,
types: 0,
functions: 0,
let instance_limits = InstanceLimits {
count: 3,
tables: 0,
memories: 2,
globals: 0,
table_elements: 0,
memory_pages: 2,
size: 1000,
..Default::default()
};
let instance_limits = InstanceLimits { count: 3 };
let tunables = Tunables {
static_memory_bound: 10,
static_memory_offset_guard_size: 0,
@@ -471,7 +466,6 @@ mod test {
let instances = InstancePool::new(
PoolingAllocationStrategy::Random,
&module_limits,
&instance_limits,
&tunables,
)
@@ -480,7 +474,7 @@ mod test {
let locator = FaultLocator::new(&instances);
assert_eq!(locator.instances_start, instances.mapping.as_ptr() as usize);
assert_eq!(locator.instance_size, 4096);
assert_eq!(locator.instance_size, 1008);
assert_eq!(locator.max_instances, 3);
assert_eq!(
locator.memories_start,
@@ -499,7 +493,7 @@ mod test {
let mut module = Module::new();
for _ in 0..module_limits.memories {
for _ in 0..instance_limits.memories {
module.memory_plans.push(MemoryPlan {
memory: Memory {
minimum: 2,
@@ -513,8 +507,6 @@ mod test {
});
}
module_limits.validate(&module).expect("should validate");
// An InstanceAllocationRequest with a module must also have
// a non-null StorePtr. Here we mock just enough of a store
// to satisfy this test.

4
crates/runtime/src/lib.rs
View File

@@ -54,9 +54,7 @@ pub use crate::instance::{
OnDemandInstanceAllocator, StorePtr,
};
#[cfg(feature = "pooling-allocator")]
pub use crate::instance::{
InstanceLimits, ModuleLimits, PoolingAllocationStrategy, PoolingInstanceAllocator,
};
pub use crate::instance::{InstanceLimits, PoolingAllocationStrategy, PoolingInstanceAllocator};
pub use crate::memory::{DefaultMemoryCreator, Memory, RuntimeLinearMemory, RuntimeMemoryCreator};
pub use crate::mmap::Mmap;
pub use crate::mmap_vec::MmapVec;

9
crates/runtime/src/memory.rs
View File

@@ -315,6 +315,15 @@ impl Memory {
) -> Result<Self> {
let (minimum, maximum) = Self::limit_new(plan, store)?;
if base.len() < minimum {
bail!(
"initial memory size of {} exceeds the pooling allocator's \
configured maximum memory size of {} bytes",
minimum,
base.len(),
);
}
let base = match maximum {
Some(max) if max < base.len() => &mut base[..max],
_ => base,

8
crates/runtime/src/table.rs
View File

@@ -195,6 +195,14 @@ impl Table {
Self::limit_new(plan, store)?;
let size = plan.table.minimum;
let ty = wasm_to_table_type(plan.table.wasm_ty)?;
if data.len() < (plan.table.minimum as usize) {
bail!(
"initial table size of {} exceeds the pooling allocator's \
configured maximum table size of {} elements",
plan.table.minimum,
data.len(),
);
}
let data = match plan.table.maximum {
Some(max) if (max as usize) < data.len() => &mut data[..max as usize],
_ => data,