Implement interrupting wasm code, reimplement stack overflow (#1490)

* Implement interrupting wasm code, reimplement stack overflow

This commit is a relatively large change for wasmtime with two main
goals:

* Primarily this enables interrupting executing wasm code with a trap,
  preventing infinite loops in wasm code. Note that resumption of the
  wasm code is not a goal of this commit.

* Additionally this commit reimplements how we handle stack overflow to
  ensure that host functions always have a reasonable amount of stack to
  run on. This fixes an issue where we might longjmp out of a host
  function, skipping destructors.

Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.

A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.

When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.

Some fallout included from this change is:

* Unix signal handlers are no longer registered with `SA_ONSTACK`.
  Instead they run on the native stack the thread was already using.
  This is possible since stack overflow isn't handled by hitting the
  guard page, but rather it's explicitly checked for in wasm now. Native
  stack overflow will continue to abort the process as usual.

* Unix sigaltstack management is now no longer necessary since we don't
  use it any more.

* Windows no longer has any need to reset guard pages since we no longer
  try to recover from faults on guard pages.

* On all targets probestack intrinsics are disabled since we use a
  different mechanism for catching stack overflow.

* The C API has been updated with interrupts handles. An example has
  also been added which shows off how to interrupt a module.

Closes #139
Closes #860
Closes #900

* Update comment about magical interrupt value

* Store stack limit as a global value, not a closure

* Run rustfmt

* Handle review comments

* Add a comment about SA_ONSTACK

* Use `usize` for type of `INTERRUPTED`

* Parse human-readable durations

* Bring back sigaltstack handling

Allows libstd to print out stack overflow on failure still.

* Add parsing and emission of stack limit-via-preamble

* Fix new example for new apis

* Fix host segfault test in release mode

* Fix new doc example

crates/runtime/src/instance.rs

@@ -11,8 +11,8 @@ use crate::traphandlers;
 use crate::traphandlers::{catch_traps, Trap};
 use crate::vmcontext::{
     VMBuiltinFunctionsArray, VMCallerCheckedAnyfunc, VMContext, VMFunctionBody, VMFunctionImport,
-    VMGlobalDefinition, VMGlobalImport, VMMemoryDefinition, VMMemoryImport, VMSharedSignatureIndex,
-    VMTableDefinition, VMTableImport, VMTrampoline,
+    VMGlobalDefinition, VMGlobalImport, VMInterrupts, VMMemoryDefinition, VMMemoryImport,
+    VMSharedSignatureIndex, VMTableDefinition, VMTableImport, VMTrampoline,
 };
 use crate::{ExportFunction, ExportGlobal, ExportMemory, ExportTable};
 use memoffset::offset_of;
@@ -110,6 +110,10 @@ pub(crate) struct Instance {
     /// Handler run when `SIGBUS`, `SIGFPE`, `SIGILL`, or `SIGSEGV` are caught by the instance thread.
     pub(crate) signal_handler: Cell<Option<Box<SignalHandler>>>,
 
+    /// Externally allocated data indicating how this instance will be
+    /// interrupted.
+    pub(crate) interrupts: Arc<VMInterrupts>,
+
     /// Additional context used by compiled wasm code. This field is last, and
     /// represents a dynamically-sized array that extends beyond the nominal
     /// end of the struct (similar to a flexible array member).
@@ -275,6 +279,11 @@ impl Instance {
         unsafe { self.vmctx_plus_offset(self.offsets.vmctx_builtin_functions_begin()) }
     }
 
+    /// Return a pointer to the interrupts structure
+    pub fn interrupts(&self) -> *mut *const VMInterrupts {
+        unsafe { self.vmctx_plus_offset(self.offsets.vmctx_interrupts()) }
+    }
+
     /// Return a reference to the vmctx used by compiled wasm code.
     pub fn vmctx(&self) -> &VMContext {
         &self.vmctx
@@ -377,17 +386,21 @@ impl Instance {
     }
 
     /// Invoke the WebAssembly start function of the instance, if one is present.
-    fn invoke_start_function(&self) -> Result<(), InstantiationError> {
+    fn invoke_start_function(&self, max_wasm_stack: usize) -> Result<(), InstantiationError> {
         let start_index = match self.module.start_func {
             Some(idx) => idx,
             None => return Ok(()),
         };
 
-        self.invoke_function_index(start_index)
+        self.invoke_function_index(start_index, max_wasm_stack)
             .map_err(InstantiationError::StartTrap)
     }
 
-    fn invoke_function_index(&self, callee_index: FuncIndex) -> Result<(), Trap> {
+    fn invoke_function_index(
+        &self,
+        callee_index: FuncIndex,
+        max_wasm_stack: usize,
+    ) -> Result<(), Trap> {
         let (callee_address, callee_vmctx) =
             match self.module.local.defined_func_index(callee_index) {
                 Some(defined_index) => {
@@ -404,17 +417,18 @@ impl Instance {
                 }
             };
 
-        self.invoke_function(callee_vmctx, callee_address)
+        self.invoke_function(callee_vmctx, callee_address, max_wasm_stack)
     }
 
     fn invoke_function(
         &self,
         callee_vmctx: *mut VMContext,
         callee_address: *const VMFunctionBody,
+        max_wasm_stack: usize,
     ) -> Result<(), Trap> {
         // Make the call.
         unsafe {
-            catch_traps(callee_vmctx, || {
+            catch_traps(callee_vmctx, max_wasm_stack, || {
                 mem::transmute::<
                     *const VMFunctionBody,
                     unsafe extern "C" fn(*mut VMContext, *mut VMContext),
@@ -869,6 +883,8 @@ impl InstanceHandle {
         dbg_jit_registration: Option<Rc<GdbJitImageRegistration>>,
         is_bulk_memory: bool,
         host_state: Box<dyn Any>,
+        interrupts: Arc<VMInterrupts>,
+        max_wasm_stack: usize,
     ) -> Result<Self, InstantiationError> {
         let tables = create_tables(&module);
         let memories = create_memories(&module, mem_creator.unwrap_or(&DefaultMemoryCreator {}))?;
@@ -906,6 +922,7 @@ impl InstanceHandle {
                 dbg_jit_registration,
                 host_state,
                 signal_handler: Cell::new(None),
+                interrupts,
                 vmctx: VMContext {},
             };
             let layout = instance.alloc_layout();
@@ -964,6 +981,7 @@ impl InstanceHandle {
             instance.builtin_functions_ptr() as *mut VMBuiltinFunctionsArray,
             VMBuiltinFunctionsArray::initialized(),
         );
+        *instance.interrupts() = &*instance.interrupts;
 
         // Check initializer bounds before initializing anything. Only do this
         // when bulk memory is disabled, since the bulk memory proposal changes
@@ -986,7 +1004,7 @@ impl InstanceHandle {
 
         // The WebAssembly spec specifies that the start function is
         // invoked automatically at instantiation time.
-        instance.invoke_start_function()?;
+        instance.invoke_start_function(max_wasm_stack)?;
 
         Ok(handle)
     }

crates/runtime/src/lib.rs

@@ -47,8 +47,8 @@ pub use crate::traphandlers::resume_panic;
 pub use crate::traphandlers::{catch_traps, raise_lib_trap, raise_user_trap, Trap};
 pub use crate::vmcontext::{
     VMCallerCheckedAnyfunc, VMContext, VMFunctionBody, VMFunctionImport, VMGlobalDefinition,
-    VMGlobalImport, VMInvokeArgument, VMMemoryDefinition, VMMemoryImport, VMSharedSignatureIndex,
-    VMTableDefinition, VMTableImport, VMTrampoline,
+    VMGlobalImport, VMInterrupts, VMInvokeArgument, VMMemoryDefinition, VMMemoryImport,
+    VMSharedSignatureIndex, VMTableDefinition, VMTableImport, VMTrampoline,
 };
 
 /// Version number of this crate.

crates/runtime/src/traphandlers.rs

@@ -2,13 +2,14 @@
 //! signalhandling mechanisms.
 
 use crate::instance::{InstanceHandle, SignalHandler};
-use crate::vmcontext::VMContext;
+use crate::VMContext;
 use backtrace::Backtrace;
 use std::any::Any;
 use std::cell::Cell;
 use std::error::Error;
 use std::io;
 use std::ptr;
+use std::sync::atomic::{AtomicUsize, Ordering::SeqCst};
 use std::sync::Once;
 use wasmtime_environ::ir;
 
@@ -104,7 +105,6 @@ cfg_if::cfg_if! {
                 // out what to do based on the result of the trap handling.
                 let jmp_buf = info.handle_trap(
                     get_pc(context),
-                    false,
                     |handler| handler(signum, siginfo, context),
                 );
 
@@ -198,7 +198,6 @@ cfg_if::cfg_if! {
             let record = &*(*exception_info).ExceptionRecord;
             if record.ExceptionCode != EXCEPTION_ACCESS_VIOLATION &&
                 record.ExceptionCode != EXCEPTION_ILLEGAL_INSTRUCTION &&
-                record.ExceptionCode != EXCEPTION_STACK_OVERFLOW &&
                 record.ExceptionCode != EXCEPTION_INT_DIVIDE_BY_ZERO &&
                 record.ExceptionCode != EXCEPTION_INT_OVERFLOW
             {
@@ -226,7 +225,6 @@ cfg_if::cfg_if! {
                 };
                 let jmp_buf = info.handle_trap(
                     (*(*exception_info).ContextRecord).Rip as *const u8,
-                    record.ExceptionCode == EXCEPTION_STACK_OVERFLOW,
                     |handler| handler(exception_info),
                 );
                 if jmp_buf.is_null() {
@@ -302,22 +300,6 @@ pub unsafe fn resume_panic(payload: Box<dyn Any + Send>) -> ! {
     tls::with(|info| info.unwrap().unwind_with(UnwindReason::Panic(payload)))
 }
 
-#[cfg(target_os = "windows")]
-fn reset_guard_page() {
-    extern "C" {
-        fn _resetstkoflw() -> winapi::ctypes::c_int;
-    }
-
-    // We need to restore guard page under stack to handle future stack overflows properly.
-    // https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/resetstkoflw?view=vs-2019
-    if unsafe { _resetstkoflw() } == 0 {
-        panic!("failed to restore stack guard page");
-    }
-}
-
-#[cfg(not(target_os = "windows"))]
-fn reset_guard_page() {}
-
 /// Stores trace message with backtrace.
 #[derive(Debug)]
 pub enum Trap {
@@ -330,6 +312,10 @@ pub enum Trap {
         pc: usize,
         /// Native stack backtrace at the time the trap occurred
         backtrace: Backtrace,
+        /// An indicator for whether this may have been a trap generated from an
+        /// interrupt, used for switching what would otherwise be a stack
+        /// overflow trap to be an interrupt trap.
+        maybe_interrupted: bool,
     },
 
     /// A trap raised from a wasm libcall
@@ -372,7 +358,11 @@ impl Trap {
 /// returning them as a `Result`.
 ///
 /// Highly unsafe since `closure` won't have any dtors run.
-pub unsafe fn catch_traps<F>(vmctx: *mut VMContext, mut closure: F) -> Result<(), Trap>
+pub unsafe fn catch_traps<F>(
+    vmctx: *mut VMContext,
+    max_wasm_stack: usize,
+    mut closure: F,
+) -> Result<(), Trap>
 where
     F: FnMut(),
 {
@@ -380,7 +370,7 @@ where
     #[cfg(unix)]
     setup_unix_sigaltstack()?;
 
-    return CallThreadState::new(vmctx).with(|cx| {
+    return CallThreadState::new(vmctx).with(max_wasm_stack, |cx| {
         RegisterSetjmp(
             cx.jmp_buf.as_ptr(),
             call_closure::<F>,
@@ -401,7 +391,6 @@ where
 pub struct CallThreadState {
     unwind: Cell<UnwindReason>,
     jmp_buf: Cell<*const u8>,
-    reset_guard_page: Cell<bool>,
     prev: Option<*const CallThreadState>,
     vmctx: *mut VMContext,
     handling_trap: Cell<bool>,
@@ -421,15 +410,19 @@ impl CallThreadState {
             unwind: Cell::new(UnwindReason::None),
             vmctx,
             jmp_buf: Cell::new(ptr::null()),
-            reset_guard_page: Cell::new(false),
             prev: None,
             handling_trap: Cell::new(false),
         }
     }
 
-    fn with(mut self, closure: impl FnOnce(&CallThreadState) -> i32) -> Result<(), Trap> {
+    fn with(
+        mut self,
+        max_wasm_stack: usize,
+        closure: impl FnOnce(&CallThreadState) -> i32,
+    ) -> Result<(), Trap> {
         tls::with(|prev| {
             self.prev = prev.map(|p| p as *const _);
+            let _reset = self.update_stack_limit(max_wasm_stack)?;
             let ret = tls::set(&self, || closure(&self));
             match self.unwind.replace(UnwindReason::None) {
                 UnwindReason::None => {
@@ -443,7 +436,15 @@ impl CallThreadState {
                 UnwindReason::LibTrap(trap) => Err(trap),
                 UnwindReason::JitTrap { backtrace, pc } => {
                     debug_assert_eq!(ret, 0);
-                    Err(Trap::Jit { pc, backtrace })
+                    let maybe_interrupted = unsafe {
+                        (*self.vmctx).instance().interrupts.stack_limit.load(SeqCst)
+                            == wasmtime_environ::INTERRUPTED
+                    };
+                    Err(Trap::Jit {
+                        pc,
+                        backtrace,
+                        maybe_interrupted,
+                    })
                 }
                 UnwindReason::Panic(panic) => {
                     debug_assert_eq!(ret, 0);
@@ -453,6 +454,87 @@ impl CallThreadState {
         })
     }
 
+    /// Checks and/or initializes the wasm native call stack limit.
+    ///
+    /// This function will inspect the current state of the stack and calling
+    /// context to determine which of three buckets we're in:
+    ///
+    /// 1. We are the first wasm call on the stack. This means that we need to
+    ///    set up a stack limit where beyond which if the native wasm stack
+    ///    pointer goes beyond forces a trap. For now we simply reserve an
+    ///    arbitrary chunk of bytes (1 MB from roughly the current native stack
+    ///    pointer). This logic will likely get tweaked over time.
+    ///
+    /// 2. We aren't the first wasm call on the stack. In this scenario the wasm
+    ///    stack limit is already configured. This case of wasm -> host -> wasm
+    ///    we assume that the native stack consumed by the host is accounted for
+    ///    in the initial stack limit calculation. That means that in this
+    ///    scenario we do nothing.
+    ///
+    /// 3. We were previously interrupted. In this case we consume the interrupt
+    ///    here and return a trap, clearing the interrupt and allowing the next
+    ///    wasm call to proceed.
+    ///
+    /// The return value here is a trap for case 3, a noop destructor in case 2,
+    /// and a meaningful destructor in case 1
+    ///
+    /// For more information about interrupts and stack limits see
+    /// `crates/environ/src/cranelift.rs`.
+    ///
+    /// Note that this function must be called with `self` on the stack, not the
+    /// heap/etc.
+    fn update_stack_limit(&self, max_wasm_stack: usize) -> Result<impl Drop + '_, Trap> {
+        // Make an "educated guess" to figure out where the wasm sp value should
+        // start trapping if it drops below.
+        let wasm_stack_limit = self as *const _ as usize - max_wasm_stack;
+
+        let interrupts = unsafe { &**(&*self.vmctx).instance().interrupts() };
+        let reset_stack_limit = match interrupts.stack_limit.compare_exchange(
+            usize::max_value(),
+            wasm_stack_limit,
+            SeqCst,
+            SeqCst,
+        ) {
+            Ok(_) => {
+                // We're the first wasm on the stack so we've now reserved the
+                // `max_wasm_stack` bytes of native stack space for wasm.
+                // Nothing left to do here now except reset back when we're
+                // done.
+                true
+            }
+            Err(n) if n == wasmtime_environ::INTERRUPTED => {
+                // This means that an interrupt happened before we actually
+                // called this function, which means that we're now
+                // considered interrupted. Be sure to consume this interrupt
+                // as part of this process too.
+                interrupts.stack_limit.store(usize::max_value(), SeqCst);
+                return Err(Trap::Wasm {
+                    trap_code: ir::TrapCode::Interrupt,
+                    backtrace: Backtrace::new_unresolved(),
+                });
+            }
+            Err(_) => {
+                // The stack limit was previously set by a previous wasm
+                // call on the stack. We leave the original stack limit for
+                // wasm in place in that case, and don't reset the stack
+                // limit when we're done.
+                false
+            }
+        };
+
+        struct Reset<'a>(bool, &'a AtomicUsize);
+
+        impl Drop for Reset<'_> {
+            fn drop(&mut self) {
+                if self.0 {
+                    self.1.store(usize::max_value(), SeqCst);
+                }
+            }
+        }
+
+        Ok(Reset(reset_stack_limit, &interrupts.stack_limit))
+    }
+
     fn any_instance(&self, func: impl Fn(&InstanceHandle) -> bool) -> bool {
         unsafe {
             if func(&InstanceHandle::from_vmctx(self.vmctx)) {
@@ -475,8 +557,6 @@ impl CallThreadState {
     /// Trap handler using our thread-local state.
     ///
     /// * `pc` - the program counter the trap happened at
-    /// * `reset_guard_page` - whether or not to reset the guard page,
-    ///   currently Windows specific
     /// * `call_handler` - a closure used to invoke the platform-specific
     ///   signal handler for each instance, if available.
     ///
@@ -492,7 +572,6 @@ impl CallThreadState {
     fn handle_trap(
         &self,
         pc: *const u8,
-        reset_guard_page: bool,
         call_handler: impl Fn(&SignalHandler) -> bool,
     ) -> *const u8 {
         // If we hit a fault while handling a previous trap, that's quite bad,
@@ -532,7 +611,6 @@ impl CallThreadState {
             return ptr::null();
         }
         let backtrace = Backtrace::new_unresolved();
-        self.reset_guard_page.set(reset_guard_page);
         self.unwind.replace(UnwindReason::JitTrap {
             backtrace,
             pc: pc as usize,
@@ -542,14 +620,6 @@ impl CallThreadState {
     }
 }
 
-impl Drop for CallThreadState {
-    fn drop(&mut self) {
-        if self.reset_guard_page.get() {
-            reset_guard_page();
-        }
-    }
-}
-
 // A private inner module for managing the TLS state that we require across
 // calls in wasm. The WebAssembly code is called from C++ and then a trap may
 // happen which requires us to read some contextual state to figure out what to

crates/runtime/src/vmcontext.rs

@@ -3,6 +3,7 @@
 
 use crate::instance::Instance;
 use std::any::Any;
+use std::sync::atomic::{AtomicUsize, Ordering::SeqCst};
 use std::{ptr, u32};
 use wasmtime_environ::BuiltinFunctionIndex;
 
@@ -612,6 +613,52 @@ impl VMInvokeArgument {
     }
 }
 
+/// Structure used to control interrupting wasm code, currently with only one
+/// atomic flag internally used.
+#[derive(Debug)]
+#[repr(C)]
+pub struct VMInterrupts {
+    /// Current stack limit of the wasm module.
+    ///
+    /// This is used to control both stack overflow as well as interrupting wasm
+    /// modules. For more information see `crates/environ/src/cranelift.rs`.
+    pub stack_limit: AtomicUsize,
+}
+
+impl VMInterrupts {
+    /// Flag that an interrupt should occur
+    pub fn interrupt(&self) {
+        self.stack_limit
+            .store(wasmtime_environ::INTERRUPTED, SeqCst);
+    }
+}
+
+impl Default for VMInterrupts {
+    fn default() -> VMInterrupts {
+        VMInterrupts {
+            stack_limit: AtomicUsize::new(usize::max_value()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod test_vminterrupts {
+    use super::VMInterrupts;
+    use memoffset::offset_of;
+    use std::mem::size_of;
+    use wasmtime_environ::{Module, VMOffsets};
+
+    #[test]
+    fn check_vminterrupts_interrupted_offset() {
+        let module = Module::new();
+        let offsets = VMOffsets::new(size_of::<*mut u8>() as u8, &module.local);
+        assert_eq!(
+            offset_of!(VMInterrupts, stack_limit),
+            usize::from(offsets.vminterrupts_stack_limit())
+        );
+    }
+}
+
 /// The VM "context", which is pointed to by the `vmctx` arg in Cranelift.
 /// This has information about globals, memories, tables, and other runtime
 /// state associated with the current instance.