T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Delete historical interruptable support in Wasmtime (#3925)

Browse Source 
* Delete historical interruptable support in Wasmtime

This commit removes the `Config::interruptable` configuration along with
the `InterruptHandle` type from the `wasmtime` crate. The original
support for adding interruption to WebAssembly was added pretty early on
in the history of Wasmtime when there was no other method to prevent an
infinite loop from the host. Nowadays, however, there are alternative
methods for interruption such as fuel or epoch-based interruption.

One of the major downsides of `Config::interruptable` is that even when
it's not enabled it forces an atomic swap to happen when entering
WebAssembly code. This technically could be a non-atomic swap if the
configuration option isn't enabled but that produces even more branch-y
code on entry into WebAssembly which is already something we try to
optimize. Calling into WebAssembly is on the order of a dozens of
nanoseconds at this time and an atomic swap, even uncontended, can add
up to 5ns on some platforms.

The main goal of this PR is to remove this atomic swap on entry into
WebAssembly. This is done by removing the `Config::interruptable` field
entirely, moving all existing consumers to epochs instead which are
suitable for the same purposes. This means that the stack overflow check
is no longer entangled with the interruption check and perhaps one day
we could continue to optimize that further as well.

Some consequences of this change are:

* Epochs are now the only method of remote-thread interruption.
* There are no more Wasmtime traps that produces the `Interrupted` trap
  code, although we may wish to move future traps to this so I left it
  in place.
* The C API support for interrupt handles was also removed and bindings
  for epoch methods were added.
* Function-entry checks for interruption are a tiny bit less efficient
  since one check is performed for the stack limit and a second is
  performed for the epoch as opposed to the `Config::interruptable`
  style of bundling the stack limit and the interrupt check in one. It's
  expected though that this is likely to not really be measurable.
* The old `VMInterrupts` structure is renamed to `VMRuntimeLimits`.
This commit is contained in:
Alex Crichton
2022-03-14 15:25:11 -05:00
committed by GitHub
parent 62a6a7ab6c
commit c22033bf93
33 changed files with 293 additions and 589 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
crates/cranelift/src/compiler.rs
View File

@@ -129,7 +129,7 @@ impl wasmtime_environ::Compiler for Compiler {
// needed by `ir::Function`.
//
// Otherwise our stack limit is specially calculated from the vmctx
// argument, where we need to load the `*const VMInterrupts`
// argument, where we need to load the `*const VMRuntimeLimits`
// pointer, and then from that pointer we need to load the stack
// limit itself. Note that manual register allocation is needed here
// too due to how late in the process this codegen happens.
@@ -141,7 +141,7 @@ impl wasmtime_environ::Compiler for Compiler {
.create_global_value(ir::GlobalValueData::VMContext);
let interrupts_ptr = context.func.create_global_value(ir::GlobalValueData::Load {
base: vmctx,
offset: i32::try_from(func_env.offsets.vmctx_interrupts())
offset: i32::try_from(func_env.offsets.vmctx_runtime_limits())
.unwrap()
.into(),
global_type: isa.pointer_type(),
@@ -149,7 +149,7 @@ impl wasmtime_environ::Compiler for Compiler {
});
let stack_limit = context.func.create_global_value(ir::GlobalValueData::Load {
base: interrupts_ptr,
offset: i32::try_from(func_env.offsets.vminterrupts_stack_limit())
offset: i32::try_from(func_env.offsets.vmruntime_limits_stack_limit())
.unwrap()
.into(),
global_type: isa.pointer_type(),

78
crates/cranelift/src/func_environ.rs
View File

@@ -17,7 +17,7 @@ use std::mem;
use wasmparser::Operator;
use wasmtime_environ::{
BuiltinFunctionIndex, MemoryPlan, MemoryStyle, Module, ModuleTranslation, TableStyle, Tunables,
TypeTables, VMOffsets, INTERRUPTED, WASM_PAGE_SIZE,
TypeTables, VMOffsets, WASM_PAGE_SIZE,
};
use wasmtime_environ::{FUNCREF_INIT_BIT, FUNCREF_MASK};
@@ -129,17 +129,17 @@ pub struct FuncEnvironment<'module_environment> {
/// A function-local variable which stores the cached value of the amount of
/// fuel remaining to execute. If used this is modified frequently so it's
/// stored locally as a variable instead of always referenced from the field
/// in `*const VMInterrupts`
/// in `*const VMRuntimeLimits`
fuel_var: cranelift_frontend::Variable,
/// A function-local variable which caches the value of `*const
/// VMInterrupts` for this function's vmctx argument. This pointer is stored
/// VMRuntimeLimits` for this function's vmctx argument. This pointer is stored
/// in the vmctx itself, but never changes for the lifetime of the function,
/// so if we load it up front we can continue to use it throughout.
vminterrupts_ptr: cranelift_frontend::Variable,
vmruntime_limits_ptr: cranelift_frontend::Variable,
/// A cached epoch deadline value, when performing epoch-based
/// interruption. Loaded from `VMInterrupts` and reloaded after
/// interruption. Loaded from `VMRuntimeLimits` and reloaded after
/// any yield.
epoch_deadline_var: cranelift_frontend::Variable,
@@ -182,7 +182,7 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
fuel_var: Variable::new(0),
epoch_deadline_var: Variable::new(0),
epoch_ptr_var: Variable::new(0),
vminterrupts_ptr: Variable::new(0),
vmruntime_limits_ptr: Variable::new(0),
// Start with at least one fuel being consumed because even empty
// functions should consume at least some fuel.
@@ -344,27 +344,27 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
}
}
fn declare_vminterrupts_ptr(&mut self, builder: &mut FunctionBuilder<'_>) {
// We load the `*const VMInterrupts` value stored within vmctx at the
fn declare_vmruntime_limits_ptr(&mut self, builder: &mut FunctionBuilder<'_>) {
// We load the `*const VMRuntimeLimits` value stored within vmctx at the
// head of the function and reuse the same value across the entire
// function. This is possible since we know that the pointer never
// changes for the lifetime of the function.
let pointer_type = self.pointer_type();
builder.declare_var(self.vminterrupts_ptr, pointer_type);
builder.declare_var(self.vmruntime_limits_ptr, pointer_type);
let vmctx = self.vmctx(builder.func);
let base = builder.ins().global_value(pointer_type, vmctx);
let offset = i32::try_from(self.offsets.vmctx_interrupts()).unwrap();
let offset = i32::try_from(self.offsets.vmctx_runtime_limits()).unwrap();
let interrupt_ptr = builder
.ins()
.load(pointer_type, ir::MemFlags::trusted(), base, offset);
builder.def_var(self.vminterrupts_ptr, interrupt_ptr);
builder.def_var(self.vmruntime_limits_ptr, interrupt_ptr);
}
fn fuel_function_entry(&mut self, builder: &mut FunctionBuilder<'_>) {
// On function entry we load the amount of fuel into a function-local
// `self.fuel_var` to make fuel modifications fast locally. This cache
// is then periodically flushed to the Store-defined location in
// `VMInterrupts` later.
// `VMRuntimeLimits` later.
builder.declare_var(self.fuel_var, ir::types::I64);
self.fuel_load_into_var(builder);
self.fuel_check(builder);
@@ -412,13 +412,13 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
match op {
// Exiting a function (via a return or unreachable) or otherwise
// entering a different function (via a call) means that we need to
// update the fuel consumption in `VMInterrupts` because we're
// update the fuel consumption in `VMRuntimeLimits` because we're
// about to move control out of this function itself and the fuel
// may need to be read.
//
// Before this we need to update the fuel counter from our own cost
// leading up to this function call, and then we can store
// `self.fuel_var` into `VMInterrupts`.
// `self.fuel_var` into `VMRuntimeLimits`.
Operator::Unreachable
| Operator::Return
| Operator::CallIndirect { .. }
@@ -502,7 +502,7 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
builder.def_var(self.fuel_var, fuel);
}
/// Loads the fuel consumption value from `VMInterrupts` into `self.fuel_var`
/// Loads the fuel consumption value from `VMRuntimeLimits` into `self.fuel_var`
fn fuel_load_into_var(&mut self, builder: &mut FunctionBuilder<'_>) {
let (addr, offset) = self.fuel_addr_offset(builder);
let fuel = builder
@@ -512,7 +512,7 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
}
/// Stores the fuel consumption value from `self.fuel_var` into
/// `VMInterrupts`.
/// `VMRuntimeLimits`.
fn fuel_save_from_var(&mut self, builder: &mut FunctionBuilder<'_>) {
let (addr, offset) = self.fuel_addr_offset(builder);
let fuel_consumed = builder.use_var(self.fuel_var);
@@ -522,14 +522,14 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
}
/// Returns the `(address, offset)` of the fuel consumption within
/// `VMInterrupts`, used to perform loads/stores later.
/// `VMRuntimeLimits`, used to perform loads/stores later.
fn fuel_addr_offset(
&mut self,
builder: &mut FunctionBuilder<'_>,
) -> (ir::Value, ir::immediates::Offset32) {
(
builder.use_var(self.vminterrupts_ptr),
i32::from(self.offsets.vminterrupts_fuel_consumed()).into(),
builder.use_var(self.vmruntime_limits_ptr),
i32::from(self.offsets.vmruntime_limits_fuel_consumed()).into(),
)
}
@@ -628,12 +628,12 @@ impl<'module_environment> FuncEnvironment<'module_environment> {
}
fn epoch_load_deadline_into_var(&mut self, builder: &mut FunctionBuilder<'_>) {
let interrupts = builder.use_var(self.vminterrupts_ptr);
let interrupts = builder.use_var(self.vmruntime_limits_ptr);
let deadline = builder.ins().load(
ir::types::I64,
ir::MemFlags::trusted(),
interrupts,
ir::immediates::Offset32::new(self.offsets.vminterupts_epoch_deadline() as i32),
ir::immediates::Offset32::new(self.offsets.vmruntime_limits_epoch_deadline() as i32),
);
builder.def_var(self.epoch_deadline_var, deadline);
}
@@ -824,7 +824,7 @@ impl<'module_environment> cranelift_wasm::FuncEnvironment for FuncEnvironment<'m
}
fn after_locals(&mut self, num_locals: usize) {
self.vminterrupts_ptr = Variable::new(num_locals);
self.vmruntime_limits_ptr = Variable::new(num_locals);
self.fuel_var = Variable::new(num_locals + 1);
self.epoch_deadline_var = Variable::new(num_locals + 2);
self.epoch_ptr_var = Variable::new(num_locals + 3);
@@ -1976,31 +1976,6 @@ impl<'module_environment> cranelift_wasm::FuncEnvironment for FuncEnvironment<'m
}
fn translate_loop_header(&mut self, builder: &mut FunctionBuilder) -> WasmResult<()> {
// If enabled check the interrupt flag to prevent long or infinite
// loops.
//
// For more information about this see comments in
// `crates/environ/src/cranelift.rs`
if self.tunables.interruptable {
let pointer_type = self.pointer_type();
let interrupt_ptr = builder.use_var(self.vminterrupts_ptr);
let interrupt = builder.ins().load(
pointer_type,
ir::MemFlags::trusted(),
interrupt_ptr,
i32::from(self.offsets.vminterrupts_stack_limit()),
);
// Note that the cast to `isize` happens first to allow sign-extension,
// if necessary, to `i64`.
let interrupted_sentinel = builder
.ins()
.iconst(pointer_type, INTERRUPTED as isize as i64);
let cmp = builder
.ins()
.icmp(IntCC::Equal, interrupt, interrupted_sentinel);
builder.ins().trapnz(cmp, ir::TrapCode::Interrupt);
}
// Additionally if enabled check how much fuel we have remaining to see
// if we've run out by this point.
if self.tunables.consume_fuel {
@@ -2045,13 +2020,10 @@ impl<'module_environment> cranelift_wasm::FuncEnvironment for FuncEnvironment<'m
builder: &mut FunctionBuilder,
_state: &FuncTranslationState,
) -> WasmResult<()> {
// If the `vminterrupts_ptr` variable will get used then we initialize
// If the `vmruntime_limits_ptr` variable will get used then we initialize
// it here.
if self.tunables.consume_fuel
|| self.tunables.interruptable
|| self.tunables.epoch_interruption
{
self.declare_vminterrupts_ptr(builder);
if self.tunables.consume_fuel || self.tunables.epoch_interruption {
self.declare_vmruntime_limits_ptr(builder);
}
// Additionally we initialize `fuel_var` if it will get used.
if self.tunables.consume_fuel {

64
crates/cranelift/src/lib.rs
View File

@@ -5,20 +5,20 @@
// # How does Wasmtime prevent stack overflow?
//
// A few locations throughout the codebase link to this file to explain
// interrupts and stack overflow. To start off, let's take a look at stack
// overflow. Wasm code is well-defined to have stack overflow being recoverable
// and raising a trap, so we need to handle this somehow! There's also an added
// constraint where as an embedder you frequently are running host-provided
// code called from wasm. WebAssembly and native code currently share the same
// call stack, so you want to make sure that your host-provided code will have
// enough call-stack available to it.
// A few locations throughout the codebase link to this file to explain stack
// overflow. To start off, let's take a look at stack overflow. Wasm code is
// well-defined to have stack overflow being recoverable and raising a trap, so
// we need to handle this somehow! There's also an added constraint where as an
// embedder you frequently are running host-provided code called from wasm.
// WebAssembly and native code currently share the same call stack, so you want
// to make sure that your host-provided code will have enough call-stack
// available to it.
//
// Given all that, the way that stack overflow is handled is by adding a
// prologue check to all JIT functions for how much native stack is remaining.
// The `VMContext` pointer is the first argument to all functions, and the first
// field of this structure is `*const VMInterrupts` and the first field of that
// is the stack limit. Note that the stack limit in this case means "if the
// field of this structure is `*const VMRuntimeLimits` and the first field of
// that is the stack limit. Note that the stack limit in this case means "if the
// stack pointer goes below this, trap". Each JIT function which consumes stack
// space or isn't a leaf function starts off by loading the stack limit,
// checking it against the stack pointer, and optionally traps.
@@ -43,50 +43,6 @@
// For more information about the tricky bits of managing the reserved stack
// size of wasm, see the implementation in `traphandlers.rs` in the
// `update_stack_limit` function.
//
// # How is Wasmtime interrupted?
//
// Ok so given all that background of stack checks, the next thing we want to
// build on top of this is the ability to *interrupt* executing wasm code. This
// is useful to ensure that wasm always executes within a particular time slice
// or otherwise doesn't consume all CPU resources on a system. There are two
// major ways that interrupts are required:
//
// * Loops - likely immediately apparent but it's easy to write an infinite
// loop in wasm, so we need the ability to interrupt loops.
// * Function entries - somewhat more subtle, but imagine a module where each
// function calls the next function twice. This creates 2^n calls pretty
// quickly, so a pretty small module can export a function with no loops
// that takes an extremely long time to call.
//
// In many cases if an interrupt comes in you want to interrupt host code as
// well, but we're explicitly not considering that here. We're hoping that
// interrupting host code is largely left to the embedder (e.g. figuring out
// how to interrupt blocking syscalls) and they can figure that out. The purpose
// of this feature is to basically only give the ability to interrupt
// currently-executing wasm code (or triggering an interrupt as soon as wasm
// reenters itself).
//
// To implement interruption of loops we insert code at the head of all loops
// which checks the stack limit counter. If the counter matches a magical
// sentinel value that's impossible to be the real stack limit, then we
// interrupt the loop and trap. To implement interrupts of functions, we
// actually do the same thing where the magical sentinel value we use here is
// automatically considered as considering all stack pointer values as "you ran
// over your stack". This means that with a write of a magical value to one
// location we can interrupt both loops and function bodies.
//
// The "magical value" here is `usize::max_value() - N`. We reserve
// `usize::max_value()` for "the stack limit isn't set yet" and so -N is
// then used for "you got interrupted". We do a bit of patching afterwards to
// translate a stack overflow into an interrupt trap if we see that an
// interrupt happened. Note that `N` here is a medium-size-ish nonzero value
// chosen in coordination with the cranelift backend. Currently it's 32k. The
// value of N is basically a threshold in the backend for "anything less than
// this requires only one branch in the prologue, any stack size bigger requires
// two branches". Naturally we want most functions to have one branch, but we
// also need to actually catch stack overflow, so for now 32k is chosen and it's
// assume no valid stack pointer will ever be `usize::max_value() - 32k`.
use cranelift_codegen::binemit;
use cranelift_codegen::ir;