Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Wrote a WebAssembly VM in C

irreducible.io

Post reply on HN
Print view View original

31–40 of 104 posts

Re: I Wrote a WebAssembly VM in C

#31

Post by shpongled »

amw-zero wrote: post #20
pdubroy wrote: post #2

This is great! The WebAssembly Core Specification is actually quite readable, although some of the language can be a bit intimidating if you're not used to reading programming language papers. If anyone is looking for a slightly more accessible way to learn WebAssembly, you might enjoy WebAssembly from the Ground Up: https://wasmgroundup.com (Disclaimer: I'm one of the authors)

I think it's much better to just learn how to read inference rules. They're actually quite simple, and are used ubiquitously to define PL semantics definitions. Constraining this on "that's not an option" is a big waste of time - learning this will open up all of the literature written on the subject.

The WASM spec is so well defined presumably because Andreas Rossberg is the editor - and he did a bunch of PL research on extensions to Standard ML, which is famous for it's specification!

Re: I Wrote a WebAssembly VM in C

#33

Post by benatkin »

syrusakbary wrote: post #6

This is an interesting approach, great work! For anyone that wants to check where the meat is at, is mostly in this file: https://github.com/irrio/semblance/blob/main/src/wrun.c Thinking out loud, I think it would have been a great idea to conform with the Wasm-C-API ( https://github.com/WebAssembly/wasm-c-api ) as a standard interface for the project (which most of the Wasm runtimes: Wasmer, V8, wasmi, etc. have ado…

Um, the author is clearly familiar enough with Wasm, but probably knows enough to know to avoid a company that tried to trademark WebAssembly.

> understandable concerns about the fact we, Wasmer, a VC-backed corporation, attempted to trademark the name of a non-profit organization, specifically WebAssembly

Acknowledgement of wrongdoing.

Re: I Wrote a WebAssembly VM in C

#34

Post by hb-robo »

coliveira wrote: post #30
MuffinFlavored wrote: post #3

Earlier quoted context omitted.

I know one of WebAssembly's biggest features by design is security / "sandbox". But I've always gotten confused with... it is secure because by default it can't do much. I don't quite understand how to view WebAssembly. You write in one language, it compiles things like basic math (nothing with network or filesystem) to another and it runs in an interpreter. I feel like I have a severe lack/misunderstanding. There's…

I think the biggest advantage of wasm in terms of security is that it doesn't accept machine language written in the target machine, only in this artificial machine language. This means that it cannot encode arbitrary code that could be executed by the host machine. Everything it runs has necessarily to go through the wasm interpreter.

That's quite interesting. This is way outside of my wheelhouse - has this kind of approach been tried in other security contexts before? What would you even call that, virtualization?

Re: I Wrote a WebAssembly VM in C

#35

Post by kowlo »

benatkin wrote: post #33
syrusakbary wrote: post #6

This is an interesting approach, great work! For anyone that wants to check where the meat is at, is mostly in this file: https://github.com/irrio/semblance/blob/main/src/wrun.c Thinking out loud, I think it would have been a great idea to conform with the Wasm-C-API ( https://github.com/WebAssembly/wasm-c-api ) as a standard interface for the project (which most of the Wasm runtimes: Wasmer, V8, wasmi, etc. have ado…

Um, the author is clearly familiar enough with Wasm, but probably knows enough to know to avoid a company that tried to trademark WebAssembly. > understandable concerns about the fact we, Wasmer, a VC-backed corporation, attempted to trademark the name of a non-profit organization, specifically WebAssembly Acknowledgement of wrongdoing.

I hadn't heard about this - terrible.

Re: I Wrote a WebAssembly VM in C

#37

Post by kouteiheika »

whizzter wrote: post #9
Karellen wrote: post #8

Earlier quoted context omitted.

> You write in one language Not quite. Web assembly isn't a source language, it's a compiler target. So you should be able to write in C, Rust, Fortran, or Lua and compile any of those to WebAssembly. Except that WebAssembly is a cross-platform assembly language/machine code which is very similar to the native machine code of many/most contemporary CPUs. This means a WebAssembly interpreter can be very straightforwar…

A JIT should be able to translate most arithmetic and binary instructions to single-opcodes, however anything involving memory and functions calls needs safety checks that becomes multi-instruction. branches could mostly be direct _unless_ the runtime has any kind of metering (it should) to stop eternal loops (if it also wants to be crash-safe even if it's exploit safe).

> anything involving memory [..] needs safety checks that becomes multi-instruction

Not necessarily; on AMD64 you can do memory accesses in a single instruction relatively easily by using the CPU's paging machinery for safety checks plus some clever use of address space.

> branches could mostly be direct _unless_ the runtime has any kind of metering (it should) to stop eternal loops

Even with metering the branches would be direct, you'd just insert the metering code at the start of each basic block (so that's two extra instructions at the start of each basic block). Or did you mean something else?

Re: I Wrote a WebAssembly VM in C

#38

Post by tubs »

hb-robo wrote: post #34
coliveira wrote: post #30

Earlier quoted context omitted.

I think the biggest advantage of wasm in terms of security is that it doesn't accept machine language written in the target machine, only in this artificial machine language. This means that it cannot encode arbitrary code that could be executed by the host machine. Everything it runs has necessarily to go through the wasm interpreter.

That's quite interesting. This is way outside of my wheelhouse - has this kind of approach been tried in other security contexts before? What would you even call that, virtualization?

Java.

Re: I Wrote a WebAssembly VM in C

#39

Post by wyldfire »

coliveira wrote: post #30
MuffinFlavored wrote: post #3

Earlier quoted context omitted.

I know one of WebAssembly's biggest features by design is security / "sandbox". But I've always gotten confused with... it is secure because by default it can't do much. I don't quite understand how to view WebAssembly. You write in one language, it compiles things like basic math (nothing with network or filesystem) to another and it runs in an interpreter. I feel like I have a severe lack/misunderstanding. There's…

I think the biggest advantage of wasm in terms of security is that it doesn't accept machine language written in the target machine, only in this artificial machine language. This means that it cannot encode arbitrary code that could be executed by the host machine. Everything it runs has necessarily to go through the wasm interpreter.

> This means that it cannot encode arbitrary code that could be executed by the host machine.

But the host machine still can, so it's not as big of advantage in that regard. If you could somehow deliver a payload of native code and jump to it, it'd work just fine. But the security you get is the fact that it's really hard to do that because there's no wasm instructions to jump to arbitrary memory locations (even if all the host ISAs do have those). Having a VM alone doesn't provide security against attacks.

It's often the case that VMs are used with memory-safe languages and those languages' runtime bounds checks and other features are what gives them safety moreso than their VM. In fact, most bytecode languages provide a JIT (including some wasm deployments) so you're actually running native code regardless.

Re: I Wrote a WebAssembly VM in C

#40

Post by charleslmunger »

kouteiheika wrote: post #37
whizzter wrote: post #9

Earlier quoted context omitted.

A JIT should be able to translate most arithmetic and binary instructions to single-opcodes, however anything involving memory and functions calls needs safety checks that becomes multi-instruction. branches could mostly be direct _unless_ the runtime has any kind of metering (it should) to stop eternal loops (if it also wants to be crash-safe even if it's exploit safe).

> anything involving memory [..] needs safety checks that becomes multi-instruction Not necessarily; on AMD64 you can do memory accesses in a single instruction relatively easily by using the CPU's paging machinery for safety checks plus some clever use of address space. > branches could mostly be direct _unless_ the runtime has any kind of metering (it should) to stop eternal loops Even with metering the branches wo…

Metering also doesn't require a branch if you implement it with page faults. See "Implicit suspend checks" in https://android-developers.googleblog.com/2023/11/the-secret...
Post reply on HN