Skip to content

Shadow stack support#2

Merged
frank-emrich merged 5 commits intomainfrom
shadow_stack
May 15, 2024
Merged

Shadow stack support#2
frank-emrich merged 5 commits intomainfrom
shadow_stack

Conversation

@frank-emrich
Copy link
Contributor

This draft PR demonstrates how to integrate the shadow stack support into the waeio httpserver example.

One caveat is that the way we currently instantiate the module using the wasmtime C API causes a failure when the __exported_shadow_stack_pointer export is present in the final wasm file.

As a temporary workaround, this PR adds more textual manipulation hackery to remove the export from the final wasm file. However, this only works for the httpserver_host_wasmfx.wasm target: In the httpserver_wasio_host_wasmfx.wasm target, the reference interpreter fails during the wat <-> wasm conversion, which I need to investigate further.

@frank-emrich
Copy link
Contributor Author

Note: This PR updates the the fiber-c submodule to wasmfx/fiber-c#3, this needs to be updated before this PR can land

@frank-emrich
Copy link
Contributor Author

I've now updated the PR to use the flag added to the C API in wasmfx/wasmfxtime#173, so that we no longer need to remove the __stack_pointer export through textual manipulation.

@frank-emrich frank-emrich marked this pull request as ready for review May 15, 2024 13:29
@frank-emrich frank-emrich requested a review from dhil May 15, 2024 13:29
frank-emrich added a commit to wasmfx/wasmfxtime that referenced this pull request May 15, 2024
The C API for using the wasmtime linker currently only gives access to
the `allow_shadowing` setting of the linker, but not to the
`allow_unknown_exports` setting. However, the latter setting needs to be
enabled in order to allow exporting the global `__stack_pointer`. This
is what's causing the issue described in wasmfx/waeio#2.

(Alternatively, we may add `__stack_pointer` to the list of blessed
globals in the `command` function in
crates/wasmtime/src/runtime/linker.rs, but the comments there suggest
that new items shouldn't be added to that list. Therefore, just making
this setting accessible in the C API seems less controversial.)
@frank-emrich frank-emrich merged commit f84e47a into main May 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants