c9a0ba81a0
* Implement interrupting wasm code, reimplement stack overflow This commit is a relatively large change for wasmtime with two main goals: * Primarily this enables interrupting executing wasm code with a trap, preventing infinite loops in wasm code. Note that resumption of the wasm code is not a goal of this commit. * Additionally this commit reimplements how we handle stack overflow to ensure that host functions always have a reasonable amount of stack to run on. This fixes an issue where we might longjmp out of a host function, skipping destructors. Lots of various odds and ends end up falling out in this commit once the two goals above were implemented. The strategy for implementing this was also lifted from Spidermonkey and existing functionality inside of Cranelift. I've tried to write up thorough documentation of how this all works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are. A brief summary of how this works is that each function and each loop header now checks to see if they're interrupted. Interrupts and the stack overflow check are actually folded into one now, where function headers check to see if they've run out of stack and the sentinel value used to indicate an interrupt, checked in loop headers, tricks functions into thinking they're out of stack. An interrupt is basically just writing a value to a location which is read by JIT code. When interrupts are delivered and what triggers them has been left up to embedders of the `wasmtime` crate. The `wasmtime::Store` type has a method to acquire an `InterruptHandle`, where `InterruptHandle` is a `Send` and `Sync` type which can travel to other threads (or perhaps even a signal handler) to get notified from. It's intended that this provides a good degree of flexibility when interrupting wasm code. Note though that this does have a large caveat where interrupts don't work when you're interrupting host code, so if you've got a host import blocking for a long time an interrupt won't actually be received until the wasm starts running again. Some fallout included from this change is: * Unix signal handlers are no longer registered with `SA_ONSTACK`. Instead they run on the native stack the thread was already using. This is possible since stack overflow isn't handled by hitting the guard page, but rather it's explicitly checked for in wasm now. Native stack overflow will continue to abort the process as usual. * Unix sigaltstack management is now no longer necessary since we don't use it any more. * Windows no longer has any need to reset guard pages since we no longer try to recover from faults on guard pages. * On all targets probestack intrinsics are disabled since we use a different mechanism for catching stack overflow. * The C API has been updated with interrupts handles. An example has also been added which shows off how to interrupt a module. Closes #139 Closes #860 Closes #900 * Update comment about magical interrupt value * Store stack limit as a global value, not a closure * Run rustfmt * Handle review comments * Add a comment about SA_ONSTACK * Use `usize` for type of `INTERRUPTED` * Parse human-readable durations * Bring back sigaltstack handling Allows libstd to print out stack overflow on failure still. * Add parsing and emission of stack limit-via-preamble * Fix new example for new apis * Fix host segfault test in release mode * Fix new doc example
59 lines
2.3 KiB
Rust
59 lines
2.3 KiB
Rust
/// Tunable parameters for WebAssembly compilation.
|
|
#[derive(Clone, Hash)]
|
|
pub struct Tunables {
|
|
/// For static heaps, the size in wasm pages of the heap protected by bounds checking.
|
|
pub static_memory_bound: u32,
|
|
|
|
/// The size in bytes of the offset guard for static heaps.
|
|
pub static_memory_offset_guard_size: u64,
|
|
|
|
/// The size in bytes of the offset guard for dynamic heaps.
|
|
pub dynamic_memory_offset_guard_size: u64,
|
|
|
|
/// Whether or not to generate DWARF debug information.
|
|
pub debug_info: bool,
|
|
|
|
/// Whether or not to enable the ability to interrupt wasm code dynamically.
|
|
///
|
|
/// More info can be found about the implementation in
|
|
/// crates/environ/src/cranelift.rs. Note that you can't interrupt host
|
|
/// calls and interrupts are implemented through the `VMInterrupts`
|
|
/// structure, or `InterruptHandle` in the `wasmtime` crate.
|
|
pub interruptable: bool,
|
|
}
|
|
|
|
impl Default for Tunables {
|
|
fn default() -> Self {
|
|
Self {
|
|
#[cfg(target_pointer_width = "32")]
|
|
/// Size in wasm pages of the bound for static memories.
|
|
static_memory_bound: 0x4000,
|
|
#[cfg(target_pointer_width = "64")]
|
|
/// Size in wasm pages of the bound for static memories.
|
|
///
|
|
/// When we allocate 4 GiB of address space, we can avoid the
|
|
/// need for explicit bounds checks.
|
|
static_memory_bound: 0x1_0000,
|
|
|
|
#[cfg(target_pointer_width = "32")]
|
|
/// Size in bytes of the offset guard for static memories.
|
|
static_memory_offset_guard_size: 0x1_0000,
|
|
#[cfg(target_pointer_width = "64")]
|
|
/// Size in bytes of the offset guard for static memories.
|
|
///
|
|
/// Allocating 2 GiB of address space lets us translate wasm
|
|
/// offsets into x86 offsets as aggressively as we can.
|
|
static_memory_offset_guard_size: 0x8000_0000,
|
|
|
|
/// Size in bytes of the offset guard for dynamic memories.
|
|
///
|
|
/// Allocate a small guard to optimize common cases but without
|
|
/// wasting too much memor.
|
|
dynamic_memory_offset_guard_size: 0x1_0000,
|
|
|
|
debug_info: false,
|
|
interruptable: false,
|
|
}
|
|
}
|
|
}
|