Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
/*
|
|
|
|
Example of instantiating of the WebAssembly module and invoking its exported
|
|
|
|
function.
|
|
|
|
|
|
|
|
You can compile and run this example on Linux with:
|
|
|
|
|
|
|
|
cargo build --release -p wasmtime-c-api
|
Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
cc examples/interrupt.c \
|
|
|
|
-I crates/c-api/include \
|
|
|
|
-I crates/c-api/wasm-c-api/include \
|
|
|
|
target/release/libwasmtime.a \
|
|
|
|
-lpthread -ldl -lm \
|
|
|
|
-o interrupt
|
|
|
|
./interrupt
|
|
|
|
|
|
|
|
Note that on Windows and macOS the command will be similar, but you'll need
|
|
|
|
to tweak the `-lpthread` and such annotations as well as the name of the
|
|
|
|
`libwasmtime.a` file on Windows.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <assert.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <wasm.h>
|
|
|
|
#include <wasmtime.h>
|
|
|
|
|
|
|
|
#ifdef _WIN32
|
|
|
|
static void spawn_interrupt(wasmtime_interrupt_handle_t *handle) {
|
|
|
|
wasmtime_interrupt_handle_interrupt(handle);
|
|
|
|
wasmtime_interrupt_handle_delete(handle);
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
#include <pthread.h>
|
|
|
|
#include <time.h>
|
|
|
|
|
|
|
|
static void* helper(void *_handle) {
|
|
|
|
wasmtime_interrupt_handle_t *handle = _handle;
|
|
|
|
struct timespec sleep_dur;
|
|
|
|
sleep_dur.tv_sec = 1;
|
|
|
|
sleep_dur.tv_nsec = 0;
|
|
|
|
nanosleep(&sleep_dur, NULL);
|
|
|
|
printf("Sending an interrupt\n");
|
|
|
|
wasmtime_interrupt_handle_interrupt(handle);
|
|
|
|
wasmtime_interrupt_handle_delete(handle);
|
|
|
|
return 0;
|
Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
}
|
|
|
|
|
|
|
|
static void spawn_interrupt(wasmtime_interrupt_handle_t *handle) {
|
|
|
|
pthread_t child;
|
|
|
|
int rc = pthread_create(&child, NULL, helper, handle);
|
|
|
|
assert(rc == 0);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static void exit_with_error(const char *message, wasmtime_error_t *error, wasm_trap_t *trap);
|
|
|
|
|
|
|
|
int main() {
|
|
|
|
// Create a `wasm_store_t` with interrupts enabled
|
|
|
|
wasm_config_t *config = wasm_config_new();
|
|
|
|
assert(config != NULL);
|
|
|
|
wasmtime_config_interruptable_set(config, true);
|
|
|
|
wasm_engine_t *engine = wasm_engine_new_with_config(config);
|
|
|
|
assert(engine != NULL);
|
|
|
|
wasm_store_t *store = wasm_store_new(engine);
|
|
|
|
assert(store != NULL);
|
|
|
|
|
|
|
|
// Create our interrupt handle we'll use later
|
|
|
|
wasmtime_interrupt_handle_t *handle = wasmtime_interrupt_handle_new(store);
|
|
|
|
assert(handle != NULL);
|
|
|
|
|
|
|
|
// Read our input file, which in this case is a wasm text file.
|
|
|
|
FILE* file = fopen("examples/interrupt.wat", "r");
|
|
|
|
assert(file != NULL);
|
|
|
|
fseek(file, 0L, SEEK_END);
|
|
|
|
size_t file_size = ftell(file);
|
|
|
|
fseek(file, 0L, SEEK_SET);
|
|
|
|
wasm_byte_vec_t wat;
|
|
|
|
wasm_byte_vec_new_uninitialized(&wat, file_size);
|
|
|
|
assert(fread(wat.data, file_size, 1, file) == 1);
|
|
|
|
fclose(file);
|
|
|
|
|
|
|
|
// Parse the wat into the binary wasm format
|
|
|
|
wasm_byte_vec_t wasm;
|
|
|
|
wasmtime_error_t *error = wasmtime_wat2wasm(&wat, &wasm);
|
|
|
|
if (error != NULL)
|
|
|
|
exit_with_error("failed to parse wat", error, NULL);
|
|
|
|
wasm_byte_vec_delete(&wat);
|
|
|
|
|
|
|
|
// Now that we've got our binary webassembly we can compile our module.
|
|
|
|
wasm_module_t *module = NULL;
|
|
|
|
wasm_trap_t *trap = NULL;
|
|
|
|
wasm_instance_t *instance = NULL;
|
|
|
|
wasm_extern_vec_t imports = WASM_EMPTY_VEC;
|
|
|
|
error = wasmtime_module_new(engine, &wasm, &module);
|
Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
wasm_byte_vec_delete(&wasm);
|
|
|
|
if (error != NULL)
|
|
|
|
exit_with_error("failed to compile module", error, NULL);
|
|
|
|
error = wasmtime_instance_new(store, module, &imports, &instance, &trap);
|
Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
if (instance == NULL)
|
|
|
|
exit_with_error("failed to instantiate", error, trap);
|
|
|
|
|
|
|
|
// Lookup our `run` export function
|
|
|
|
wasm_extern_vec_t externs;
|
|
|
|
wasm_instance_exports(instance, &externs);
|
|
|
|
assert(externs.size == 1);
|
|
|
|
wasm_func_t *run = wasm_extern_as_func(externs.data[0]);
|
|
|
|
assert(run != NULL);
|
|
|
|
|
|
|
|
// Spawn a thread to send us an interrupt after a period of time.
|
|
|
|
spawn_interrupt(handle);
|
|
|
|
|
|
|
|
// And call it!
|
|
|
|
printf("Entering infinite loop...\n");
|
|
|
|
wasm_val_vec_t args_vec = WASM_EMPTY_VEC;
|
|
|
|
wasm_val_vec_t results_vec = WASM_EMPTY_VEC;
|
|
|
|
error = wasmtime_func_call(run, &args_vec, &results_vec, &trap);
|
Implement interrupting wasm code, reimplement stack overflow (#1490)
* Implement interrupting wasm code, reimplement stack overflow
This commit is a relatively large change for wasmtime with two main
goals:
* Primarily this enables interrupting executing wasm code with a trap,
preventing infinite loops in wasm code. Note that resumption of the
wasm code is not a goal of this commit.
* Additionally this commit reimplements how we handle stack overflow to
ensure that host functions always have a reasonable amount of stack to
run on. This fixes an issue where we might longjmp out of a host
function, skipping destructors.
Lots of various odds and ends end up falling out in this commit once the
two goals above were implemented. The strategy for implementing this was
also lifted from Spidermonkey and existing functionality inside of
Cranelift. I've tried to write up thorough documentation of how this all
works in `crates/environ/src/cranelift.rs` where gnarly-ish bits are.
A brief summary of how this works is that each function and each loop
header now checks to see if they're interrupted. Interrupts and the
stack overflow check are actually folded into one now, where function
headers check to see if they've run out of stack and the sentinel value
used to indicate an interrupt, checked in loop headers, tricks functions
into thinking they're out of stack. An interrupt is basically just
writing a value to a location which is read by JIT code.
When interrupts are delivered and what triggers them has been left up to
embedders of the `wasmtime` crate. The `wasmtime::Store` type has a
method to acquire an `InterruptHandle`, where `InterruptHandle` is a
`Send` and `Sync` type which can travel to other threads (or perhaps
even a signal handler) to get notified from. It's intended that this
provides a good degree of flexibility when interrupting wasm code. Note
though that this does have a large caveat where interrupts don't work
when you're interrupting host code, so if you've got a host import
blocking for a long time an interrupt won't actually be received until
the wasm starts running again.
Some fallout included from this change is:
* Unix signal handlers are no longer registered with `SA_ONSTACK`.
Instead they run on the native stack the thread was already using.
This is possible since stack overflow isn't handled by hitting the
guard page, but rather it's explicitly checked for in wasm now. Native
stack overflow will continue to abort the process as usual.
* Unix sigaltstack management is now no longer necessary since we don't
use it any more.
* Windows no longer has any need to reset guard pages since we no longer
try to recover from faults on guard pages.
* On all targets probestack intrinsics are disabled since we use a
different mechanism for catching stack overflow.
* The C API has been updated with interrupts handles. An example has
also been added which shows off how to interrupt a module.
Closes #139
Closes #860
Closes #900
* Update comment about magical interrupt value
* Store stack limit as a global value, not a closure
* Run rustfmt
* Handle review comments
* Add a comment about SA_ONSTACK
* Use `usize` for type of `INTERRUPTED`
* Parse human-readable durations
* Bring back sigaltstack handling
Allows libstd to print out stack overflow on failure still.
* Add parsing and emission of stack limit-via-preamble
* Fix new example for new apis
* Fix host segfault test in release mode
* Fix new doc example
5 years ago
|
|
|
assert(error == NULL);
|
|
|
|
assert(trap != NULL);
|
|
|
|
printf("Got a trap!...\n");
|
|
|
|
|
|
|
|
// `trap` can be inspected here to see the trap message has an interrupt in it
|
|
|
|
|
|
|
|
wasm_trap_delete(trap);
|
|
|
|
wasm_extern_vec_delete(&externs);
|
|
|
|
wasm_instance_delete(instance);
|
|
|
|
wasm_module_delete(module);
|
|
|
|
wasm_store_delete(store);
|
|
|
|
wasm_engine_delete(engine);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void exit_with_error(const char *message, wasmtime_error_t *error, wasm_trap_t *trap) {
|
|
|
|
fprintf(stderr, "error: %s\n", message);
|
|
|
|
wasm_byte_vec_t error_message;
|
|
|
|
if (error != NULL) {
|
|
|
|
wasmtime_error_message(error, &error_message);
|
|
|
|
wasmtime_error_delete(error);
|
|
|
|
} else {
|
|
|
|
wasm_trap_message(trap, &error_message);
|
|
|
|
wasm_trap_delete(trap);
|
|
|
|
}
|
|
|
|
fprintf(stderr, "%.*s\n", (int) error_message.size, error_message.data);
|
|
|
|
wasm_byte_vec_delete(&error_message);
|
|
|
|
exit(1);
|
|
|
|
}
|