Skip to content

Harden Wasmtime's compiled GC code against corruption #13321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexcrichton wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Harden Wasmtime's compiled GC code against corruption #13321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9ae4229
Harden Wasmtime's compiled GC code against corruption
alexcrichton May 7, 2026
c084e97
Implement custom trapping loads/stores for Pulley
alexcrichton May 8, 2026
645d346
Plumb trap codes differently for `AddrZ`
alexcrichton May 8, 2026
06021b7
Update some expectations
alexcrichton May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions cranelift/codegen/meta/src/pulley.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,14 +75,16 @@ impl Inst<'_> {
},
(name, ty) => Operand::Normal { name, ty },
})
.chain(if self.name.contains("Trap") {
Some(Operand::TrapCode {
name: "code",
ty: "TrapCode",
})
} else {
None
})
.chain(
if self.name.contains("Trap") || self.fields.iter().any(|(_, ty)| *ty == "AddrZ") {
Some(Operand::TrapCode {
name: "code",
ty: "TrapCode",
})
} else {
None
},
)
}

fn skip(&self) -> bool {
Expand Down
3 changes: 3 additions & 0 deletions cranelift/codegen/src/isa/pulley_shared/inst.isle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,9 @@
(decl pure memflags_nontrapping (MemFlags) bool)
(extern constructor memflags_nontrapping memflags_nontrapping)

(decl pure partial memflags_trapping (MemFlags) TrapCode)
(extern constructor memflags_trapping memflags_trapping)

(decl pure memflags_is_wasm (MemFlags) bool)
(extern constructor memflags_is_wasm memflags_is_wasm)

Expand Down
153 changes: 101 additions & 52 deletions cranelift/codegen/src/isa/pulley_shared/lower.isle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1069,29 +1069,48 @@
(rule (emit_addro32_xload addr $I32 (ExtKind.Zero64)) (pulley_zext32 (pulley_xload32le_o32 addr)))
(rule (emit_addro32_xload addr $I64 _ext) (pulley_xload64le_o32 addr))

;; Special case: wasm loads/stores that map trap use the `*_z` addressing modes
;; which generates a trap for load-from-null.
;; Special case: trapping loads/stores that map trap use the `*_z` addressing
;; modes which generates a trap for load-from-null.
(rule 1 (gen_xload addr offset flags ty ext)
(if-let true (memflags_is_wasm flags))
(emit_addrz_xload (addrz addr offset) ty ext))

(decl emit_addrz_xload (AddrZ Type ExtKind) XReg)
(rule (emit_addrz_xload addr $I8 (ExtKind.None)) (pulley_xload8_u32_z addr))
(rule (emit_addrz_xload addr $I8 (ExtKind.Sign32)) (pulley_xload8_s32_z addr))
(rule (emit_addrz_xload addr $I8 (ExtKind.Zero32)) (pulley_xload8_u32_z addr))
(rule (emit_addrz_xload addr $I8 (ExtKind.Sign64)) (pulley_sext32 (pulley_xload8_s32_z addr)))
(rule (emit_addrz_xload addr $I8 (ExtKind.Zero64)) (pulley_zext32 (pulley_xload8_u32_z addr)))
(rule (emit_addrz_xload addr $I16 (ExtKind.None)) (pulley_xload16le_u32_z addr))
(rule (emit_addrz_xload addr $I16 (ExtKind.Sign32)) (pulley_xload16le_s32_z addr))
(rule (emit_addrz_xload addr $I16 (ExtKind.Zero32)) (pulley_xload16le_u32_z addr))
(rule (emit_addrz_xload addr $I16 (ExtKind.Sign64)) (pulley_sext32 (pulley_xload16le_s32_z addr)))
(rule (emit_addrz_xload addr $I16 (ExtKind.Zero64)) (pulley_zext32 (pulley_xload16le_u32_z addr)))
(rule (emit_addrz_xload addr $I32 (ExtKind.None)) (pulley_xload32le_z addr))
(rule (emit_addrz_xload addr $I32 (ExtKind.Sign32)) (pulley_xload32le_z addr))
(rule (emit_addrz_xload addr $I32 (ExtKind.Zero32)) (pulley_xload32le_z addr))
(rule (emit_addrz_xload addr $I32 (ExtKind.Sign64)) (pulley_sext32 (pulley_xload32le_z addr)))
(rule (emit_addrz_xload addr $I32 (ExtKind.Zero64)) (pulley_zext32 (pulley_xload32le_z addr)))
(rule (emit_addrz_xload addr $I64 _ext) (pulley_xload64le_z addr))
(if-let trap (memflags_trapping flags))
(if-let (Endianness.Little) (endianness flags))
(emit_addrz_xload_le (addrz addr offset) ty ext trap))
(rule 1 (gen_xload addr offset flags ty ext)
(if-let trap (memflags_trapping flags))
(if-let (Endianness.Big) (endianness flags))
(emit_addrz_xload_be (addrz addr offset) ty ext trap))

(decl emit_addrz_xload_le (AddrZ Type ExtKind TrapCode) XReg)
(rule (emit_addrz_xload_le addr $I8 (ExtKind.None) c) (pulley_xload8_u32_z addr c))
(rule (emit_addrz_xload_le addr $I8 (ExtKind.Sign32) c) (pulley_xload8_s32_z addr c))
(rule (emit_addrz_xload_le addr $I8 (ExtKind.Zero32) c) (pulley_xload8_u32_z addr c))
(rule (emit_addrz_xload_le addr $I8 (ExtKind.Sign64) c) (pulley_sext32 (pulley_xload8_s32_z addr c)))
(rule (emit_addrz_xload_le addr $I8 (ExtKind.Zero64) c) (pulley_zext32 (pulley_xload8_u32_z addr c)))
(rule (emit_addrz_xload_le addr $I16 (ExtKind.None) c) (pulley_xload16le_u32_z addr c))
(rule (emit_addrz_xload_le addr $I16 (ExtKind.Sign32) c) (pulley_xload16le_s32_z addr c))
(rule (emit_addrz_xload_le addr $I16 (ExtKind.Zero32) c) (pulley_xload16le_u32_z addr c))
(rule (emit_addrz_xload_le addr $I16 (ExtKind.Sign64) c) (pulley_sext32 (pulley_xload16le_s32_z addr c)))
(rule (emit_addrz_xload_le addr $I16 (ExtKind.Zero64) c) (pulley_zext32 (pulley_xload16le_u32_z addr c)))
(rule (emit_addrz_xload_le addr $I32 (ExtKind.None) c) (pulley_xload32le_z addr c))
(rule (emit_addrz_xload_le addr $I32 (ExtKind.Sign32) c) (pulley_xload32le_z addr c))
(rule (emit_addrz_xload_le addr $I32 (ExtKind.Zero32) c) (pulley_xload32le_z addr c))
(rule (emit_addrz_xload_le addr $I32 (ExtKind.Sign64) c) (pulley_sext32 (pulley_xload32le_z addr c)))
(rule (emit_addrz_xload_le addr $I32 (ExtKind.Zero64) c) (pulley_zext32 (pulley_xload32le_z addr c)))
(rule (emit_addrz_xload_le addr $I64 _ext c) (pulley_xload64le_z addr c))

(decl emit_addrz_xload_be (AddrZ Type ExtKind TrapCode) XReg)
(rule (emit_addrz_xload_be addr $I8 e c) (emit_addrz_xload_le addr $I8 e c))
(rule (emit_addrz_xload_be addr $I16 (ExtKind.None) c) (pulley_xload16be_u32_z addr c))
(rule (emit_addrz_xload_be addr $I16 (ExtKind.Sign32) c) (pulley_xload16be_s32_z addr c))
(rule (emit_addrz_xload_be addr $I16 (ExtKind.Zero32) c) (pulley_xload16be_u32_z addr c))
(rule (emit_addrz_xload_be addr $I16 (ExtKind.Sign64) c) (pulley_sext32 (pulley_xload16be_s32_z addr c)))
(rule (emit_addrz_xload_be addr $I16 (ExtKind.Zero64) c) (pulley_zext32 (pulley_xload16be_u32_z addr c)))
(rule (emit_addrz_xload_be addr $I32 (ExtKind.None) c) (pulley_xload32be_z addr c))
(rule (emit_addrz_xload_be addr $I32 (ExtKind.Sign32) c) (pulley_xload32be_z addr c))
(rule (emit_addrz_xload_be addr $I32 (ExtKind.Zero32) c) (pulley_xload32be_z addr c))
(rule (emit_addrz_xload_be addr $I32 (ExtKind.Sign64) c) (pulley_sext32 (pulley_xload32be_z addr c)))
(rule (emit_addrz_xload_be addr $I32 (ExtKind.Zero64) c) (pulley_zext32 (pulley_xload32be_z addr c)))
(rule (emit_addrz_xload_be addr $I64 _ext c) (pulley_xload64be_z addr c))

;; Special case: wasm loads/stores that may trap use the `*_g32` addressing
;; modes. This is a superset of the `*_z` modes above and requires extracting
Expand Down Expand Up @@ -1155,14 +1174,22 @@
(pulley_fload (amode addr offset) ty flags))

;; Base case: use trapping loads stores with the `*_z` addressing mode for
;; wasm-looking loads/stores.
;; loads/stores.
(rule 1 (gen_fload addr offset flags ty)
(if-let true (memflags_is_wasm flags))
(emit_addrz_fload (addrz addr offset) ty))
(if-let code (memflags_trapping flags))
(if-let (Endianness.Little) (endianness flags))
(emit_addrz_fload_le (addrz addr offset) ty code))
(rule 1 (gen_fload addr offset flags ty)
(if-let code (memflags_trapping flags))
(if-let (Endianness.Big) (endianness flags))
(emit_addrz_fload_be (addrz addr offset) ty code))

(decl emit_addrz_fload (AddrZ Type) FReg)
(rule (emit_addrz_fload addr $F32) (pulley_fload32le_z addr))
(rule (emit_addrz_fload addr $F64) (pulley_fload64le_z addr))
(decl emit_addrz_fload_le (AddrZ Type TrapCode) FReg)
(rule (emit_addrz_fload_le addr $F32 c) (pulley_fload32le_z addr c))
(rule (emit_addrz_fload_le addr $F64 c) (pulley_fload64le_z addr c))
(decl emit_addrz_fload_be (AddrZ Type TrapCode) FReg)
(rule (emit_addrz_fload_be addr $F32 c) (pulley_fload32be_z addr c))
(rule (emit_addrz_fload_be addr $F64 c) (pulley_fload64be_z addr c))

;; Special case: use `*_g32` addressing when the bounds-check can be
;; pattern-matched.
Expand All @@ -1184,19 +1211,27 @@
(if-let true (memflags_nontrapping flags))
(pulley_vload (amode addr offset) ty flags))

;; Base case: wasm loads/stores using the `*_z` addressing mode.
;; Base case: trapping loads/stores using the `*_z` addressing mode.
(rule 1 (gen_vload addr offset flags ty ext)
(if-let code (memflags_trapping flags))
(if-let (Endianness.Little) (endianness flags))
(emit_addrz_vload_le (addrz addr offset) ty ext code))
(rule 1 (gen_vload addr offset flags ty ext)
(if-let true (memflags_is_wasm flags))
(emit_addrz_vload (addrz addr offset) ty ext))

(decl emit_addrz_vload (AddrZ Type VExtKind) VReg)
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.None)) (pulley_vload128le_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.S8x8)) (pulley_vload8x8_s_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.U8x8)) (pulley_vload8x8_u_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.S16x4)) (pulley_vload16x4le_s_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.U16x4)) (pulley_vload16x4le_u_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.S32x2)) (pulley_vload32x2le_s_z addr))
(rule (emit_addrz_vload addr (ty_vec128 _) (VExtKind.U32x2)) (pulley_vload32x2le_u_z addr))
(if-let code (memflags_trapping flags))
(if-let (Endianness.Big) (endianness flags))
(emit_addrz_vload_be (addrz addr offset) ty ext code))

(decl emit_addrz_vload_le (AddrZ Type VExtKind TrapCode) VReg)
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.None) c) (pulley_vload128le_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.S8x8) c) (pulley_vload8x8_s_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.U8x8) c) (pulley_vload8x8_u_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.S16x4) c) (pulley_vload16x4le_s_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.U16x4) c) (pulley_vload16x4le_u_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.S32x2) c) (pulley_vload32x2le_s_z addr c))
(rule (emit_addrz_vload_le addr (ty_vec128 _) (VExtKind.U32x2) c) (pulley_vload32x2le_u_z addr c))

(decl emit_addrz_vload_be (AddrZ Type VExtKind TrapCode) VReg)
(rule (emit_addrz_vload_be addr (ty_vec128 _) (VExtKind.None) c) (pulley_vload128be_z addr c))

;; Special case: use `*_g32` addressing when the bounds-check can be
;; pattern-matched.
Expand Down Expand Up @@ -1263,19 +1298,33 @@
(if-let true (memflags_nontrapping flags))
(pulley_vstore (amode addr offset) src ty flags))

;; Base case: wasm stores
;; Base case: trapping stores
(rule 3 (gen_store src addr offset flags ty)
(if-let true (memflags_is_wasm flags))
(emit_addrz_store (addrz addr offset) src ty))

(decl emit_addrz_store (AddrZ Value Type) SideEffectNoResult)
(rule (emit_addrz_store addr val $I8) (pulley_xstore8_z addr val))
(rule (emit_addrz_store addr val $I16) (pulley_xstore16le_z addr val))
(rule (emit_addrz_store addr val $I32) (pulley_xstore32le_z addr val))
(rule (emit_addrz_store addr val $I64) (pulley_xstore64le_z addr val))
(rule (emit_addrz_store addr val $F32) (pulley_fstore32le_z addr val))
(rule (emit_addrz_store addr val $F64) (pulley_fstore64le_z addr val))
(rule 1 (emit_addrz_store addr val (ty_vec128 _)) (pulley_vstore128le_z addr val))
(if-let code (memflags_trapping flags))
(if-let (Endianness.Little) (endianness flags))
(emit_addrz_store_le (addrz addr offset) src ty code))
(rule 3 (gen_store src addr offset flags ty)
(if-let code (memflags_trapping flags))
(if-let (Endianness.Big) (endianness flags))
(emit_addrz_store_be (addrz addr offset) src ty code))

(decl emit_addrz_store_le (AddrZ Value Type TrapCode) SideEffectNoResult)
(rule (emit_addrz_store_le addr val $I8 c) (pulley_xstore8_z addr val c))
(rule (emit_addrz_store_le addr val $I16 c) (pulley_xstore16le_z addr val c))
(rule (emit_addrz_store_le addr val $I32 c) (pulley_xstore32le_z addr val c))
(rule (emit_addrz_store_le addr val $I64 c) (pulley_xstore64le_z addr val c))
(rule (emit_addrz_store_le addr val $F32 c) (pulley_fstore32le_z addr val c))
(rule (emit_addrz_store_le addr val $F64 c) (pulley_fstore64le_z addr val c))
(rule 1 (emit_addrz_store_le addr val (ty_vec128 _) c) (pulley_vstore128le_z addr val c))

(decl emit_addrz_store_be (AddrZ Value Type TrapCode) SideEffectNoResult)
(rule (emit_addrz_store_be addr val $I8 c) (pulley_xstore8_z addr val c))
(rule (emit_addrz_store_be addr val $I16 c) (pulley_xstore16be_z addr val c))
(rule (emit_addrz_store_be addr val $I32 c) (pulley_xstore32be_z addr val c))
(rule (emit_addrz_store_be addr val $I64 c) (pulley_xstore64be_z addr val c))
(rule (emit_addrz_store_be addr val $F32 c) (pulley_fstore32be_z addr val c))
(rule (emit_addrz_store_be addr val $F64 c) (pulley_fstore64be_z addr val c))
(rule 1 (emit_addrz_store_be addr val (ty_vec128 _) c) (pulley_vstore128be_z addr val c))

;; special case: wasm stores with a folded bounds check
(rule 4 (gen_store src addr offset flags ty)
Expand Down
4 changes: 4 additions & 0 deletions cranelift/codegen/src/isa/pulley_shared/lower/isle.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,10 @@ where
flags.trap_code().is_none()
}

fn memflags_trapping(&mut self, flags: MemFlags) -> Option<TrapCode> {
flags.trap_code()
}

fn memflags_is_wasm(&mut self, flags: MemFlags) -> bool {
flags.trap_code() == Some(TrapCode::HEAP_OUT_OF_BOUNDS)
&& self.endianness(flags) == Endianness::Little
Expand Down
8 changes: 4 additions & 4 deletions cranelift/filetests/filetests/isa/pulley32/load.clif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ block0(v0: i32):

; VCode:
; block0:
; xload32le_z x0, x0, 0
; xload32le_z x0, x0, 0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -24,7 +24,7 @@ block0(v0: i32):

; VCode:
; block0:
; xload64le_z x0, x0, 0
; xload64le_z x0, x0, 0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -39,7 +39,7 @@ block0(v0: i32):

; VCode:
; block0:
; xload32le_z x0, x0, 4
; xload32le_z x0, x0, 4 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -54,7 +54,7 @@ block0(v0: i32):

; VCode:
; block0:
; xload64le_z x0, x0, 8
; xload64le_z x0, x0, 8 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand Down
8 changes: 4 additions & 4 deletions cranelift/filetests/filetests/isa/pulley32/store.clif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ block0(v0: i32, v1: i32):

; VCode:
; block0:
; xstore32le_z x1, 0, x0
; xstore32le_z x1, 0, x0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -24,7 +24,7 @@ block0(v0: i64, v1: i32):

; VCode:
; block0:
; xstore64le_z x1, 0, x0
; xstore64le_z x1, 0, x0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -39,7 +39,7 @@ block0(v0: i32, v1: i32):

; VCode:
; block0:
; xstore32le_z x1, 4, x0
; xstore32le_z x1, 4, x0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand All @@ -54,7 +54,7 @@ block0(v0: i64, v1: i32):

; VCode:
; block0:
; xstore64le_z x1, 8, x0
; xstore64le_z x1, 8, x0 // trap=TrapCode(253)
; ret
;
; Disassembled:
Expand Down
Loading
Loading