Add resource limiting to the Wasmtime API. by peterhuene · Pull Request #2736 · bytecodealliance/wasmtime

peterhuene · 2021-03-17T23:52:51Z

This PR adds a ResourceLimiter trait to the Wasmtime API.

When used in conjunction with Store::new_with_limiter, this can be used to
monitor and prevent WebAssembly code from growing linear memories and tables.

This is particularly useful when hosts need to take into account host resource
usage to determine if WebAssembly code can consume more resources.

A simple Limiter is also included with these changes that will
simply limit the size of linear memories or tables for all instances created in
the store based on static values.

github-actions · 2021-03-18T01:03:31Z

Subscribe to Label Action

cc @peterhuene

Details

This issue or pull request has been labeled: "wasmtime:api"

Thus the following users have been cc'd because of the following labels:

peterhuene: wasmtime:api

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

peterhuene · 2021-03-18T18:29:15Z

So it appears that 20.04 is now ubuntu-latest by design, so we were caught in an upgrade to GitHub actions.

alexcrichton

We currently also have a few methods on Config for limiting resources, so I think it'd be good to have everything in one place and move those here as well? Otherwise this looks pretty neat to me and seems like a reasonable feature!

crates/runtime/src/instance.rs

crates/runtime/src/instance/allocator.rs

crates/runtime/src/memory.rs

crates/wasmtime/src/limiter.rs

crates/wasmtime/src/store.rs

crates/wasmtime/src/trampoline.rs

github-actions · 2021-03-23T22:14:46Z

Subscribe to Label Action

cc @fitzgen, @peterhuene

Details

This issue or pull request has been labeled: "fuzzing", "wasmtime:c-api"

Thus the following users have been cc'd because of the following labels:

fitzgen: fuzzing
peterhuene: wasmtime:c-api

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

crates/wasmtime/src/store.rs

crates/wasmtime/src/limits.rs

tests/all/limits.rs

crates/wasmtime/src/store.rs

peterhuene · 2021-04-09T02:05:01Z

Only the last commit is new; the rest were from your last review prior to my rebasing this branch on main.

alexcrichton

Looks great to me! I've got one clarification on the poolilng allocator and deinitializing halfway through, but otherwise just some documentation nits.

crates/runtime/src/instance/allocator/pooling.rs

crates/wasmtime/src/store.rs

crates/wasmtime/src/limits.rs

This commit adds a `ResourceLimiter` trait to the Wasmtime API. When used in conjunction with `Store::new_with_limiter`, this can be used to monitor and prevent WebAssembly code from growing linear memories and tables. This is particularly useful when hosts need to take into account host resource usage to determine if WebAssembly code can consume more resources. A simple `StaticResourceLimiter` is also included with these changes that will simply limit the size of linear memories or tables for all instances created in the store based on static values.

* Implemented `StoreLimits` and `StoreLimitsBuilder`. * Moved `max_instances`, `max_memories`, `max_tables` out of `Config` and into `StoreLimits`. * Moved storage of the limiter in the runtime into `Memory` and `Table`. * Made `InstanceAllocationRequest` use a reference to the limiter. * Updated docs. * Made `ResourceLimiterProxy` generic to remove a level of indirection. * Fixed the limiter not being used for `wasmtime::Memory` and `wasmtime::Table`.

* `Memory::new` now returns `Result<Self>` so that an error can be returned if the initial requested memory exceeds any limits placed on the store. * Changed an `Arc` to `Rc` as the `Arc` wasn't necessary. * Removed `Store` from the `ResourceLimiter` callbacks. Custom resource limiter implementations are free to capture any context they want, so no need to unnecessarily store a weak reference to `Store` from the proxy type. * Fixed a bug in the pooling instance allocator where an instance would be leaked from the pool. Previously, this would only have happened if the OS was unable to make the necessary linear memory available for the instance. With these changes, however, the instance might not be created due to limits placed on the store. We now properly deallocate the instance on error. * Added more tests, including one that covers the fix mentioned above.

* Add another memory to `test_pooling_allocator_initial_limits_exceeded` to ensure a partially created instance is successfully deallocated. * Update some doc comments for better documentation of `Store` and `ResourceLimiter`.

Accidental omission from bytecodealliance#2736

Accidental omission from #2736

* Add resource limiting to the Wasmtime API. This commit adds a `ResourceLimiter` trait to the Wasmtime API. When used in conjunction with `Store::new_with_limiter`, this can be used to monitor and prevent WebAssembly code from growing linear memories and tables. This is particularly useful when hosts need to take into account host resource usage to determine if WebAssembly code can consume more resources. A simple `StaticResourceLimiter` is also included with these changes that will simply limit the size of linear memories or tables for all instances created in the store based on static values. * Code review feedback. * Implemented `StoreLimits` and `StoreLimitsBuilder`. * Moved `max_instances`, `max_memories`, `max_tables` out of `Config` and into `StoreLimits`. * Moved storage of the limiter in the runtime into `Memory` and `Table`. * Made `InstanceAllocationRequest` use a reference to the limiter. * Updated docs. * Made `ResourceLimiterProxy` generic to remove a level of indirection. * Fixed the limiter not being used for `wasmtime::Memory` and `wasmtime::Table`. * Code review feedback and bug fix. * `Memory::new` now returns `Result<Self>` so that an error can be returned if the initial requested memory exceeds any limits placed on the store. * Changed an `Arc` to `Rc` as the `Arc` wasn't necessary. * Removed `Store` from the `ResourceLimiter` callbacks. Custom resource limiter implementations are free to capture any context they want, so no need to unnecessarily store a weak reference to `Store` from the proxy type. * Fixed a bug in the pooling instance allocator where an instance would be leaked from the pool. Previously, this would only have happened if the OS was unable to make the necessary linear memory available for the instance. With these changes, however, the instance might not be created due to limits placed on the store. We now properly deallocate the instance on error. * Added more tests, including one that covers the fix mentioned above. * Code review feedback. * Add another memory to `test_pooling_allocator_initial_limits_exceeded` to ensure a partially created instance is successfully deallocated. * Update some doc comments for better documentation of `Store` and `ResourceLimiter`.

Accidental omission from bytecodealliance#2736

peterhuene requested a review from pchickey March 17, 2021 23:54

aturon mentioned this pull request Mar 18, 2021

Add custom resource limiting for instances bytecodealliance/lucet#650

Open

github-actions bot added the wasmtime:api Related to the API of the `wasmtime` crate itself label Mar 18, 2021

peterhuene force-pushed the limiter branch 2 times, most recently from c21c779 to 71e2956 Compare March 18, 2021 00:53

This comment has been minimized.

Sign in to view

alexcrichton mentioned this pull request Mar 18, 2021

cranelift-module: Add support for passing a StackMapSink when defining functions #2739

Merged

cfallin mentioned this pull request Mar 18, 2021

Explicitly install LLDB in CI to fix intermittent failure on Ubuntu 20.04 image. #2740

Merged

peterhuene force-pushed the limiter branch 2 times, most recently from e956871 to de177f3 Compare March 18, 2021 20:44

alexcrichton reviewed Mar 19, 2021

View reviewed changes

peterhuene force-pushed the limiter branch from c8dc42f to 7d4cfb8 Compare March 23, 2021 21:26

github-actions bot added fuzzing Issues related to our fuzzing infrastructure wasmtime:c-api Issues pertaining to the C API. labels Mar 23, 2021

peterhuene force-pushed the limiter branch from 7d4cfb8 to fcb379b Compare April 2, 2021 18:36

peterhuene marked this pull request as ready for review April 2, 2021 18:39

peterhuene requested a review from alexcrichton April 2, 2021 23:00

alexcrichton reviewed Apr 5, 2021

View reviewed changes

crates/wasmtime/src/store.rs Outdated Show resolved Hide resolved

crates/wasmtime/src/limits.rs Outdated Show resolved Hide resolved

tests/all/limits.rs Show resolved Hide resolved

crates/wasmtime/src/store.rs Outdated Show resolved Hide resolved

peterhuene force-pushed the limiter branch from fcb379b to 732c3de Compare April 9, 2021 02:04

peterhuene requested a review from alexcrichton April 9, 2021 02:04

peterhuene force-pushed the limiter branch from 732c3de to 1048d9f Compare April 9, 2021 02:16

github-actions bot added the wasmtime:docs Issues related to Wasmtime's documentation label Apr 9, 2021

alexcrichton approved these changes Apr 15, 2021

View reviewed changes

peterhuene added 3 commits April 16, 2021 14:36

Code review feedback.

17ec96e

* Add another memory to `test_pooling_allocator_initial_limits_exceeded` to ensure a partially created instance is successfully deallocated. * Update some doc comments for better documentation of `Store` and `ResourceLimiter`.

peterhuene force-pushed the limiter branch from 1048d9f to 17ec96e Compare April 16, 2021 22:56

alexcrichton approved these changes Apr 19, 2021

View reviewed changes

alexcrichton merged commit f12b4c4 into bytecodealliance:main Apr 19, 2021

alexcrichton added a commit to alexcrichton/wasmtime that referenced this pull request Apr 20, 2021

Delete signature for no-longer-present function

6a99c25

Accidental omission from bytecodealliance#2736

alexcrichton mentioned this pull request Apr 20, 2021

Delete signature for no-longer-present function #2849

Merged

alexcrichton added a commit that referenced this pull request Apr 20, 2021

Delete signature for no-longer-present function (#2849)

200d7f1

Accidental omission from #2736

mchesser pushed a commit to mchesser/wasmtime that referenced this pull request May 24, 2021

Delete signature for no-longer-present function (bytecodealliance#2849)

ea95dc7

Accidental omission from bytecodealliance#2736

Conversation

peterhuene commented Mar 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 18, 2021

Subscribe to Label Action

Uh oh!

This comment has been minimized.

peterhuene commented Mar 18, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexcrichton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 23, 2021

Subscribe to Label Action

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

peterhuene commented Apr 9, 2021

Uh oh!

alexcrichton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

peterhuene commented Mar 17, 2021 •

edited

Loading

peterhuene commented Mar 18, 2021 •

edited

Loading