Nixe - #14287
Closed
pladaria wants to merge 9 commits into
Closed
Conversation
* Observe all stores we replace in `LastStores`; keep track of who observed a store (bytecodealliance#14080) Fixes bytecodealliance#14053 * update `WasiCtxBuilder::allow_{tcp,udp}` docs (bytecodealliance#14089) PR bytecodealliance#13936 disabled these settings by default but did not update the docs to match. * mpk: restore protection keys after mmap'ing memory images (bytecodealliance#14076) * mpk: restore protection keys after mmap'ing memory images A fresh `mmap` associates the pages it replaces with the default protection key 0, and key 0 is accessible from every stripe (host code needs it). `MemoryImageSlot` maps over pkey-colored pool slots in three places, so any module with a `(data ...)` segment silently lost its key. Because MPK striping deliberately shrinks the guard regions between slots, a neighboring instance could then read and write that memory for real. Note that `mprotect` preserves the key, so only `mmap` sites are affected. Fix this by re-applying the key with `pkey_mprotect` after each `mmap`: add `ProtectionKey::reprotect`, give `MemoryImageSlot` the key its stripe was colored with, and call the new `reapply_pkey` helper after `map_at`, `remap_as_zeros_at`, and `erase_existing_mapping`. Tables, stacks, and GC heaps are never pkey-colored, and decommit uses `madvise(MADV_DONTNEED)` which preserves VMA flags, so `MemoryImageSlot` was the only exposure. Cost: one extra syscall per `mmap`, and `instantiate` only `mmap`s when a slot is handed a different image than it already holds. Measured over 1000 instantiations, a module repeatedly instantiated into its affine slot adds 8 calls total (one per slot, at first use) and is in the noise end-to-end. A pool thrashing between more modules than it has slots takes 2 extra calls per instantiation, ~+43% on instantiation. With MPK disabled `ProtectionKey` is uninhabited and this all compiles away. Fixes bytecodealliance#13982 Fixes bytecodealliance#7942 * prtest:full * wasmtime: Clarify that component::Linker doesn't support intra-component linking yet (bytecodealliance#14088) * wasmtime: Clarify that component::Linker doesn't support intra-component linking yet https://bytecodealliance.zulipchat.com/#narrow/channel/217126-wasmtime/topic/.E2.9C.94.20linking.20wasm.20components.20at.20runtime.3F/near/615012938 The current state tripped me up a bit, since the docs make it sound like it's already there and working, while the API itself seems nowhere to be found. * Remove the mention of intra-component linking entirely bytecodealliance#14088 (review) * Reflow the paragraph * Remove preemption points in bulk operations (bytecodealliance#14045) * Remove preemption points in bulk operations This commit updates the translation of bulk operations such as `memory.grow` which were recently refactored to not have preemption points within the operation itself. Preemption points within the operation, while useful for very large operations, expose internal and intermediate state to embedders and the rest of the runtime. For example tables that are grown are initially filled with null, which may not be valid for the table's type. These bulk operations didn't recompute pointers/indices after a possible preemption meaning if memories were grown/moved then it would cause faults. In general this is seen as too risky of an operation to perform. The fix in this commit is to move all preemption checks to the start of the operation itself. This means that bulk operations continue to be metered with a cost proportional to the size of the operation for fuel, and they all contain an initial epoch check for epochs. Once the operation is committed to, however, there's no cancelling it and it'll continue to run. In practice this means that extremely large copies, for example, can blow the epoch budget. To re-add preemption checks within the operation, however, will require very careful reintroduction to avoid these sorts of problems/faults. * Fix miri * Fix `named_imports` with a hyphen in interface names (bytecodealliance#14105) Closes bytecodealliance#14090 --------- Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com> Co-authored-by: Joel Dice <joel.dice@fermyon.com> Co-authored-by: Johnnie Birch <johnnie.l.birch.jr@intel.com> Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>
* Fix panic compiling an empty component with debug info (bytecodealliance#14130) generate_simulated_dwarf unwrapped the first core-module translation to name its compilation unit, but a component with no core modules has no translations, so `wasmtime compile -D debug-info=y` panicked on a valid `(component)` input. Return early instead: with no translations there are no functions to describe. * Run linker callback finalizers on invalid names (bytecodealliance#14126) * Shuffle more finalizers in the C API (bytecodealliance#14133) * Shuffle more finalizers in the C API This implements a similar refactoring to bytecodealliance#14126 but for the component linker as well. * Clang-format * fix(wasmtime-cli): generic eio error thrown for wasip2 (bytecodealliance#14107) * Cranelift: unwind last-store state after removing a dead store (bytecodealliance#14111) Alias analysis's dead-store elimination removed the dead store's `mem_values` entry, but left the region's last-store slot naming the instruction it had just deleted. Leaving the removed-store meant that when we then reprocess the overwriting store, we keyed its lookup on a removed instruction, found nothing, and failed to notice that (for example) the overwriting store became idempotent and could also be removed. With this commit, each store now records the memory version it displaced, and eliminating a dead store rolls that version back, so a chain like v1 = load.i32 region0 v0 store region0 v2, v0 ;; dead store region0 v1, v0 ;; idempotent once the dead store is gone collapses in the single pass we actually make, rather than removing only one link in the chain and requiring that we do N passes to fully clean up a chain of N dead/idempotent stores. This code pattern the shape fused sync adapters emit around the `MAY_LEAVE` flag and the relevant disas tests each lose a store as a result. * Alias analysis: do not restore the last-fence into a region slot (bytecodealliance#14134) * Alias analysis: do not restore the last-fence into a region slot When we eliminate a dead store, we undo the effects that the dead store had on the `LastStore` state. However, querying the last store for a particular region falls back to the last fence, and we were incorrectly restoring that last fence into the region slot, rather than resetting the region slot to `None`. While technically incorrect, it was generally benign, but it did lead to "observing" instructions that we didn't mark observed during our initial observation pass, which ultimately led to debug assertion failures. Fixes bytecodealliance#14131 * untrim whitespace in filetests * Return is-directory when a directory fd is used as a file (bytecodealliance#14135) * wasip2: return is-directory when a directory fd is used as a file Descriptor::file() treated a directory as a bad descriptor. POSIX read/write on a directory is EISDIR, and wasi:filesystem already has is-directory. Preview1 guests still get EBADF (separate match and adapter). Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> * wasip2: map is-directory only on read-via-stream Descriptor::file() must stay bad-descriptor for directories. wasi-testsuite filesystem-advise expects that for advise. Return is-directory from read-via-stream only (p2 result, p3 result future) so a directory read matches POSIX EISDIR. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> * Fix test expectations --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca> Co-authored-by: m0g3r <87276771+m0g3r@users.noreply.github.com> Co-authored-by: grandpig <grandpig@outlook.com> Co-authored-by: Eduardo de Moura Rodrigues <16357187+eduardomourar@users.noreply.github.com> Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com> Co-authored-by: Sebastien Tardif <SebTardif@ncf.ca>
…tecodealliance#14162) (bytecodealliance#14166) Do not forward the value from a store at memory location `L` to a load of `L` when the store was big endian and the load is little endian, or vice versa. Similar for redundant-load elimination. Note that dead-store elimination overwrites the same range of bytes in memory regardless of byte order, so it can still happen when the dead store is big and the overwriter is little or vice versa, so long as we update the memory state to correctly record the overwriter's byte order. Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>
* Limit buffered writes in http/files This commit adds limits to the amount of data buffered from a guest on the host when guests write to WASIp3 streams for files and http bodies. This ensures that the guest can't control how much is allocated on the host, for example, but rather it's limited to a fixed amount. Co-authored-by: Till Schneidereit <till@tillschneidereit.net> * Update cap-std dependencies * Fix MSRV --------- Co-authored-by: Till Schneidereit <till@tillschneidereit.net>
[automatically-tag-and-release-this-commit]
* Fix handling of context slots in component compositions (bytecodealliance#14139) This commit fixes handling of `context.{get,set}` slots in sync-to-sync adapters generated by Wasmtime's FACT pass. Previously no care was taken here meaning that the context slots were wrong for `post-return` and `realloc` calls. All slots are now managed as they are on the host, mirroring the logic internally for management. * Use wasip3 hooks in wasip2 for wasmtime-wasi-http (bytecodealliance#14167) This commit extends the wasip2 implementation of `wasi:http` to include a few more hook locations which are otherwise supported on wasip3 as well.
[automatically-tag-and-release-this-commit] Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
- Reserve Nixe context, arena, budget and link-scratch registers on x86-64 and AArch64. - Redirect spills and stack slots to the fixed external frame and report its bounded extent. - Declare canonical external entries, constrain LICM to executable dominators and omit analysis-root code. - Export real entry offsets and preserve CFG metadata across cold-block placement. - Add allocator, encoding and native x86-64 regressions, including optimized multi-entry loops. - Keep physical fast-entry contracts, boundary state maps and the production gateway explicitly pending.
pladaria
requested review from
alexcrichton,
cfallin and
rvolosatovs
and removed request for
a team
September 5, 2026 16:07
Author
|
sorry, this was meant to be a PR to a fork |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.