Stream: git-wasmtime

Topic: wasmtime / Issue #1917 Wasmtime: need mechanism to associ...

Wasmtime GitHub notifications bot (Jun 24 2020 at 21:51):

pchickey opened Issue #1917:

Issue filed based on discussion: https://github.com/bytecodealliance/wasmtime/pull/1910#discussion_r444963814

The wiggle crate relies on performing run-time borrow checking of accesses into a linear memory for safety. Currently, there is no mechanism in Wasmtime which can associate a borrow checker with a linear memory. Presently, we create a fresh borrow checker each time we enter host code, but this requires the host code to never re-enter the same WebAssembly instance, a property which we cannot enforce statically or dynamically.

We need to design some mechanism by which the wasmtime crate can associate a borrow checker with a memory for the memory's entire lifetime. Wasmtime would then be responsible for checking that the borrow checker has no outstanding borrows whenever an instance which has access to that memory is called.

Ideally, the wasmtime borrow checker would be represented as a trait object, so that we can keep the definition of the borrow checker in the wiggle crate (where it is also used in Lucet), and not require wasmtime users to depend on wiggle nor wiggle users to depend on wasmtime.

Wasmtime GitHub notifications bot (Jun 24 2020 at 21:51):

pchickey labeled Issue #1917:

Issue filed based on discussion: https://github.com/bytecodealliance/wasmtime/pull/1910#discussion_r444963814

The wiggle crate relies on performing run-time borrow checking of accesses into a linear memory for safety. Currently, there is no mechanism in Wasmtime which can associate a borrow checker with a linear memory. Presently, we create a fresh borrow checker each time we enter host code, but this requires the host code to never re-enter the same WebAssembly instance, a property which we cannot enforce statically or dynamically.

We need to design some mechanism by which the wasmtime crate can associate a borrow checker with a memory for the memory's entire lifetime. Wasmtime would then be responsible for checking that the borrow checker has no outstanding borrows whenever an instance which has access to that memory is called.

Ideally, the wasmtime borrow checker would be represented as a trait object, so that we can keep the definition of the borrow checker in the wiggle crate (where it is also used in Lucet), and not require wasmtime users to depend on wiggle nor wiggle users to depend on wasmtime.

Wasmtime GitHub notifications bot (Jun 25 2020 at 14:17):

alexcrichton commented on Issue #1917:

One thing we could do here is allow attaching a type map or a Box<Any> to an instance, but I think the best route here may actually be to move the borrow checker into wasmtime itself. It seems like trying to get a raw view into wasm memory is going to be a pretty common thing to do in Rust, so making this a safe method on Memory would be pretty compelling. I'm not sure how to best work with the wasmtime/lucet split, though?

Wasmtime GitHub notifications bot (Jun 26 2020 at 17:48):

pchickey commented on Issue #1917:

My idea to manage the wasmtime/lucet split:

• change the wiggle::GuestMemory trait to have all of BorrowChecker's methods inline (has_outstanding_borrows, borrow, unborrow, is_borrowed) rather than a borrow_checker(&self) -> &BorrowChecker method.
• move the concrete wiggle::BorrowChecker type to be part of wasmtime. Impl the GuestMemory trait in wasmtime-wiggle with wasmtime's BorrowChecker and Memory.
• Lucet can make its own copy of BorrowChecker to keep in lucet-wiggle or elsewhere.

Wasmtime GitHub notifications bot (Jun 26 2020 at 17:49):

pchickey edited a comment on Issue #1917:

My idea to manage the wasmtime/lucet split:

• change the wiggle::GuestMemory trait to have all of BorrowChecker's methods inline (has_outstanding_borrows, borrow, unborrow, is_borrowed) rather than a borrow_checker(&self) -> &BorrowChecker method.
• move the concrete wiggle::BorrowChecker type to be part of wasmtime. Impl the GuestMemory trait in wasmtime-wiggle with wasmtime's BorrowChecker and Memory.
• Lucet can make its own copy of BorrowChecker to keep in lucet-wiggle or elsewhere, and i mpl the GuestMemory trait in terms of that concrete type and our Vmctx (we dont have a Memory equivelant)

Wasmtime GitHub notifications bot (Jun 26 2020 at 17:49):

pchickey edited a comment on Issue #1917:

My idea to manage the wasmtime/lucet split:

• change the wiggle::GuestMemory trait to have all of BorrowChecker's methods inline (has_outstanding_borrows, borrow, unborrow, is_borrowed) rather than a borrow_checker(&self) -> &BorrowChecker method.
• move the concrete wiggle::BorrowChecker type to be part of wasmtime. Impl the GuestMemory trait in wasmtime-wiggle with wasmtime's BorrowChecker and Memory.
• Lucet can make its own copy of BorrowChecker to keep in lucet-wiggle or elsewhere, and i mpl the GuestMemory trait in terms of that concrete type and our Vmctx (we dont have a Memory equivalent)

Wasmtime GitHub notifications bot (Jun 26 2020 at 17:49):

pchickey edited a comment on Issue #1917:

My idea to manage the wasmtime/lucet split:

• change the wiggle::GuestMemory trait to have all of BorrowChecker's methods inline (has_outstanding_borrows, borrow, unborrow, is_borrowed) rather than a borrow_checker(&self) -> &BorrowChecker method.
• move the concrete wiggle::BorrowChecker type to be part of wasmtime. Impl the GuestMemory trait in wasmtime-wiggle with wasmtime's BorrowChecker and Memory.
• Lucet can make its own copy of BorrowChecker to keep in lucet-wiggle or elsewhere, and impl the GuestMemory trait in terms of that concrete type and our Vmctx (we dont have a Memory equivalent)

Wasmtime GitHub notifications bot (Jun 26 2020 at 17:50):

pchickey edited a comment on Issue #1917:

My idea to manage the wasmtime/lucet split:

• change the wiggle::GuestMemory trait to have all of BorrowChecker's methods inline (has_outstanding_borrows, borrow, unborrow, is_borrowed) rather than a borrow_checker(&self) -> &BorrowChecker method. We can then delete the BorrowChecker type from wiggle.
• move the concrete wiggle::BorrowChecker type to be part of wasmtime. Impl the GuestMemory trait in wasmtime-wiggle with wasmtime's BorrowChecker and Memory.
• Lucet can make its own copy of BorrowChecker to keep in lucet-wiggle or elsewhere, and impl the GuestMemory trait in terms of that concrete type and our Vmctx (we dont have a Memory equivalent)

Wasmtime GitHub notifications bot (Jun 29 2020 at 14:16):

alexcrichton commented on Issue #1917:

Sounds reasonable to me!

Wasmtime GitHub notifications bot (Jun 29 2020 at 18:30):

pchickey commented on Issue #1917:

I'm preparing a PR which does steps 1 and 3 of this transformation, moving the BorrowChecker concrete impl to wasmtime-wiggle as a staging ground for step 2, where it can be moved fully into wasmtime.

Last updated: Dec 06 2025 at 06:05 UTC