Files
wasmtime/crates/wasi/src/instantiate.rs
Alex Crichton 47d6db0be8 Reel in unsafety around InstanceHandle (#856)
* Reel in unsafety around `InstanceHandle`

This commit is an attempt, or at least is targeted at being a start, at
reeling in the unsafety around the `InstanceHandle` type. Currently this
type represents a sort of moral `Rc<Instance>` but is a bit more
specialized since the underlying memory is allocated through mmap.

Additionally, though, `InstanceHandle` exposes a fundamental flaw in its
safety by safetly allowing mutable access so long as you have `&mut
InstanceHandle`. This type, however, is trivially created by simply
cloning a `InstanceHandle` to get an owned reference. This means that
`&mut InstanceHandle` does not actually provide any guarantees about
uniqueness, so there's no more safety than `&InstanceHandle` itself.

This commit removes all `&mut self` APIs from `InstanceHandle`,
additionally removing some where `&self` was `unsafe` and `&mut self`
was safe (since it was trivial to subvert this "safety"). In doing so
interior mutability patterns are now used much more extensively through
structures such as `Table` and `Memory`. Additionally a number of
methods were refactored to be a bit clearer and use helper functions
where possible.

This is a relatively large commit unfortunately, but it snowballed very
quickly into touching quite a few places. My hope though is that this
will prevent developers working on wasmtime internals as well as
developers still yet to migrate to the `wasmtime` crate from falling
into trivial unsafe traps by accidentally using `&mut` when they can't.
All existing users relying on `&mut` will need to migrate to some form
of interior mutability, such as using `RefCell` or `Cell`.

This commit also additionally marks `InstanceHandle::new` as an `unsafe`
function. The rationale for this is that the `&mut`-safety is only the
beginning for the safety of `InstanceHandle`. In general the wasmtime
internals are extremely unsafe and haven't been audited for appropriate
usage of `unsafe`. Until that's done it's hoped that we can warn users
with this `unsafe` constructor and otherwise push users to the
`wasmtime` crate which we know is safe.

* Fix windows build

* Wrap up mutable memory state in one structure

Rather than having separate fields

* Use `Cell::set`, not `Cell::replace`, where possible

* Add a helper function for offsets from VMContext

* Fix a typo from merging

* rustfmt

* Use try_from, not as

* Tweak style of some setters
2020-01-24 14:20:35 -06:00

132 lines
4.2 KiB
Rust

use cranelift_codegen::ir::types;
use cranelift_codegen::{ir, isa};
use cranelift_entity::PrimaryMap;
use cranelift_wasm::DefinedFuncIndex;
use std::cell::RefCell;
use std::fs::File;
use std::sync::Arc;
use target_lexicon::HOST;
use wasi_common::hostcalls;
use wasi_common::wasi;
use wasi_common::{WasiCtx, WasiCtxBuilder};
use wasmtime_environ::{translate_signature, Export, Module};
use wasmtime_runtime::{Imports, InstanceHandle, InstantiationError, VMContext};
/// Creates `wasmtime::Instance` object implementing the "wasi" interface.
pub fn create_wasi_instance(
store: &wasmtime::Store,
preopened_dirs: &[(String, File)],
argv: &[String],
environ: &[(String, String)],
) -> Result<wasmtime::Instance, InstantiationError> {
let wasi = instantiate_wasi(preopened_dirs, argv, environ)?;
let instance = wasmtime::Instance::from_handle(&store, wasi);
Ok(instance)
}
/// Return an instance implementing the "wasi" interface.
pub fn instantiate_wasi(
preopened_dirs: &[(String, File)],
argv: &[String],
environ: &[(String, String)],
) -> Result<InstanceHandle, InstantiationError> {
let mut wasi_ctx_builder = WasiCtxBuilder::new()
.inherit_stdio()
.args(argv)
.envs(environ);
for (dir, f) in preopened_dirs {
wasi_ctx_builder = wasi_ctx_builder.preopened_dir(
f.try_clone().map_err(|err| {
InstantiationError::Resource(format!(
"couldn't clone an instance handle to pre-opened dir: {}",
err
))
})?,
dir,
);
}
let wasi_ctx = wasi_ctx_builder.build().map_err(|err| {
InstantiationError::Resource(format!("couldn't assemble WASI context object: {}", err))
})?;
instantiate_wasi_with_context(wasi_ctx)
}
/// Return an instance implementing the "wasi" interface.
///
/// The wasi context is configured by
pub fn instantiate_wasi_with_context(
wasi_ctx: WasiCtx,
) -> Result<InstanceHandle, InstantiationError> {
let pointer_type = types::Type::triple_pointer_type(&HOST);
let mut module = Module::new();
let mut finished_functions = PrimaryMap::new();
let call_conv = isa::CallConv::triple_default(&HOST);
// This function is defined in the macro invocation of
// `define_add_wrappers_to_module` below. For more information about how
// this works it'd recommended to read the source in
// `crates/wasi-common/wig/src/wasi.rs`.
add_wrappers_to_module(
&mut module,
&mut finished_functions,
call_conv,
pointer_type,
);
let imports = Imports::none();
let data_initializers = Vec::new();
let signatures = PrimaryMap::new();
unsafe {
InstanceHandle::new(
Arc::new(module),
finished_functions.into_boxed_slice(),
imports,
&data_initializers,
signatures.into_boxed_slice(),
None,
Box::new(RefCell::new(wasi_ctx)),
)
}
}
wig::define_add_wrappers_to_module!(
"snapshot" "wasi_snapshot_preview1"
);
// Used by `add_wrappers_to_module` defined in the macro above
fn get_wasi_ctx(vmctx: &mut VMContext) -> Result<&RefCell<WasiCtx>, wasi::__wasi_errno_t> {
unsafe {
vmctx
.host_state()
.downcast_ref()
.ok_or_else(|| panic!("no host state named WasiCtx available"))
}
}
// Used by `add_wrappers_to_module` defined in the macro above
fn get_memory(caller_vmctx: &mut VMContext) -> Result<&mut [u8], wasi::__wasi_errno_t> {
match unsafe { InstanceHandle::from_vmctx(caller_vmctx) }.lookup("memory") {
Some(wasmtime_runtime::Export::Memory {
definition,
vmctx: _,
memory: _,
}) => unsafe {
let definition = &*definition;
let ptr = definition.base;
let len = definition.current_length;
Ok(std::slice::from_raw_parts_mut(ptr, len))
},
Some(export) => {
log::error!("export named \"memory\" isn't a memory: {:?}", export);
Err(wasi::__WASI_ERRNO_INVAL)
}
None => {
log::error!("no export named \"memory\" available from caller");
Err(wasi::__WASI_ERRNO_INVAL)
}
}
}