multi-memory
wit-bindgen
Our great sponsors
multi-memory | wit-bindgen | |
---|---|---|
6 | 27 | |
115 | 877 | |
7.0% | 4.6% | |
3.7 | 9.4 | |
10 months ago | 5 days ago | |
WebAssembly | Rust | |
GNU General Public License v3.0 or later | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
multi-memory
-
Top 8 Recent V8 Updates
Support for multi-memory to deal with multiple memories in Wasm.
-
WASI Support in Go
> You can do attacks that most people haven't been able to do for 20+ years.
This is a bad and roundabout way to say that vulnerabilities in WebAssembly modules may cause a corruption in their linear memory. Which is absolutely true, but those attacks still matter today (not everyone turns ASLR on) and similar defences also apply. In the future multiple memories [1] should make it much easier to guard against remaining issues. WebAssembly is a lucrative target only because it is so widespread, not because it has horrible security (you don't know what the actually horrible security looks like).
[1] https://github.com/WebAssembly/multi-memory/blob/main/propos...
-
WASI: WebAssembly System Interface
Thanks! These claims are really interesting.
- WASM has no ASLR.
So I guess if a buffer overrun lets you modify a function pointer, you could replace that function pointer with another pointer to execute different code. As you say, this is hard in native linux programs because ASLR and NX. You need a pointer to some code thats loaded in memory and you need to know where it is. In wasm, the "pointer" isn't a pointer at all. indirect_call takes an index into the jump table. Yes, this makes it easier to find other valid function pointers. But wasm also has some advantages here. Unlike in native code, you can't "call" arbitrary locations in memory. And indirect_call is also runtime typechecked. So you can't call functions with an unexpected type signature. Also (I think) the jump table itself can't be edited by the running wasm module. So there's no way to inject code into the module and run it.
I could be wrong, but I wouldn't be surprised if on balance wasm still ends up safer than native code here. I'm sure there will be more than zero wasm sandbox escapes made by abusing this, but I haven't heard of any so far.
Docs: https://developer.mozilla.org/en-US/docs/WebAssembly/Underst...
- WASM allows writing to 0x0.
You're probably right about this. To be clear, it means if pointers are set to 0 then dereferenced, the program might continue before crashing. And the memory around 0 may be overwritten by an attacker. How bad this is in practice depends on the prevelance of use-after-free bugs (common in C / C++) and what ends up near 0 in memory. In rust, these sort of software bugs seem incredibly rare. And I wouldn't be surprised if wasm compilers for C/C++ start making a memory deadzone here - if they aren't doing that already.
- wasm can easily overflow buffers
Sure, but so can native C code. And unlike native code, wasm can't overflow buffers outside of the data section. So you can't overwrite methods or modify the memory of any other loaded modules. So on net, wasm is still marginally safer than native code here. If you're worried about buffer overflows, use a safer language.
- wasm doesn't have the concept of read-only memory
Interesting! I can see this definitely being useful for system libraries like mmap. This would definitely be nice to have, and it looks like the wasm authors agree with you.
https://github.com/WebAssembly/multi-memory/issues/15
-
Accessing WebAssembly reference-typed arrays from C++
There are stray references to the concept of multiple address spaces (or 'memories') in the wasm spec at present, and I recall at one point you may have always been passing 'memory #0' to your load/store opcodes. It looks like people are still working on that as the solution.
https://github.com/WebAssembly/multi-memory
-
WebAssembly and C++
It's not segmented, so no... or rather, not yet.
The wasm spec already accommodates to some extent the notion of multiple "memories" (i.e. distinct flat heaps), although it only allows for one in practice:
https://webassembly.github.io/spec/core/syntax/modules.html#...
And there's an active proposal to allow for multiple memories:
https://github.com/WebAssembly/multi-memory/blob/main/propos...
In an environment like that, you'd need full-fledged pointers to carry both the memory index and the offset; and then you might want a non-fat "pointer to same memory" alternative for perf. Might as well call them far and near.
- WebAssembly 2.0 Working Draft
wit-bindgen
- Wit-Bindgen
-
WASM by Example
The component model is already shipping in Wasmtime, and will be stable for use in Node.js and in browsers via jco (https://github.com/bytecodealliance/jco) soon. WASI Preview 2 will be done in December or January, giving component model users a stable set of interfaces to use for scheduling, streams, and higher level functionality like stdio, filesystem, sockets, and http on an opt-in basis. You should look at wit-bindgen (https://github.com/bytecodealliance/wit-bindgen) to see some of the languages currently supported, and more that will be mature enough to use very soon (https://github.com/bytecodealliance/componentize-py)
Right now jco will automatically generate the JS glue code which implements a Component Model runtime on top of the JS engine's existing WebAssembly implementation. So, yes, Components are a composition of Wasm Modules and JS code is handling passing values from one module/instance to another. You still get the performance benefits of running computation in Wasm.
One day further down the standardization road, we would like to see Web engines ship a native implementation of the Component Model, which might be able to make certain optimizations that the JS implementation cannot. Until then you can consider jco a polyfill for a native implementation, and it still gives you the power to compose isolated programs written in many languages and run them in many different contexts, including the Web.
(Disclosure: I am co-chair of WASI, Wasmtime maintainer, implemented many parts of WASI/CM)
-
Spin 2.0 – open-source tool for building and running WASM apps
Thank you!
To your point, the primary consideration for choosing the languages is their support for WebAssembly, and WASI in particular.
Due to Spin's heavy use of WASI and the component model, languages that have first party support in the WIT bindings generator (https://github.com/bytecodealliance/wit-bindgen) are the easiest to implement, followed by languages that can be built on top of the support for those with first party support.
For example, the JavaScript support is built by embedding QuickJS (in particular, Shopify's Javy project — https://github.com/fermyon/spin-js-sdk), which then uses the Rust SDK.
-
Rust + WASM + Typescript [+ React]
There are many options, but what worked best for me is compiling with cargo-wasi and loading the resulting Wasm file with browser_wasi_shim. Using wasm32-wasi instead of wasm32-unknown-unknown requires a bit more work (the communication with JS has to be set up manually), but gives the flexibility of having just a Wasm file that can be dropped in and loaded dynamically. (There's wit-bindgen for generating wrapping code according to an interface definition but I didn't have much success with it.)
-
Introducing - Wasmer Runtime 4.0
I've been playing with creating a go version of the abi for use with wit-bindgen because the current one uses cgo https://github.com/bytecodealliance/wit-bindgen
-
What in Rust is equivalent to C++ DLLs (shared libraries), or what do I need to do to support extensions in my app?
wit-bindgen - Language Binding Generator for WASM Interface Type
-
Quick tip: Numeromancy, WebAssembly and SingleStoreDB Cloud
wit-bindgen-rust = { git = "https://github.com/bytecodealliance/wit-bindgen.git", rev = "60e3c5b41e616fee239304d92128e117dd9be0a7" }
-
Using WASM for a plugin system in Rust? (generate code at runtime and then hot reloading it as a library)
Yep, you're right. For this, there are a few options. The ones most relevant to you are fp-bindgen, which targets Wasmer, and wit-bindgen, which targets wasmtime.
-
Introducing Ambient 0.1: a runtime for building high-performance multiplayer games and 3D applications, powered by Rust, WebAssembly and WebGPU
Are you evaluating if WebAssembly Component Model, its WIT format and related tooling like wit-bindgen could be a good fit for your multiple languages support?
-
Using SingleStoreDB, WebAssembly and GraphQL
[package] name = "sentiment" version = "0.1.0" edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] wit-bindgen-rust = { git = "https://github.com/bytecodealliance/wit-bindgen.git", rev = "60e3c5b41e616fee239304d92128e117dd9be0a7" } vader_sentiment = { git = "https://github.com/ckw017/vader-sentiment-rust" } lazy_static = "1.4.0" [lib] crate-type = ["cdylib"]
What are some alternatives?
wajic - WebAssembly JavaScript Interface Creator
lunatic - Lunatic is an Erlang-inspired runtime for WebAssembly
memory-control - A proposal to introduce finer grained control of WebAssembly memory.
spin - Spin is the open source developer tool for building and running serverless applications powered by WebAssembly.
reference-crdts - Simple, tiny spec-compliant reference implementations of Yjs and Automerge's list types.
kwasm - Proof of concept React-ish UI library, powered by WebAssembly
uwm-masters-thesis - My thesis for my Master's in Computer Science degree from the University of Wisconsin - Milwaukee.
webassembly-tour - ⚙️ Take you through a tour of WebAssembly (WASM targets on WASI) with wasmCloud, Krustlet, WAGI, etc. 🌟 Give it a star if you like it.
sdk - The Dart SDK, including the VM, dart2js, core libraries, and more.
wasi-experimental-http - Experimental outbound HTTP support for WebAssembly and WASI
proposals - Tracking WebAssembly proposals
component-model - Repository for design and specification of the Component Model