Repository: bytecodealliance/wasmtime
Pull request #7815 (2024-01-24 22:01:11)

mpk: enable MPK if available in CI
After discussing several options for testing MPK in CI, this stopgap
measure at least provides some coverage. Other options include
maintaining a separate MPK-enabled CI runner (configuration is not
transparent, hard to maintain) or running the MPK-enabled tests in a
system-mode QEMU VM (tricky to get right, also hard to maintain). For
now, those of us at the Cranelift meeting agreed this at least gets some
CI testing for the MPK bits, which shouldn't be changing too often.
Since not all GitHub runners have MPK available, we only set the
`WASMTIME_TEST_FORCE_MPK` environment variable when it is. This change
also emits a warning to the GitHub logs in either case for easier
troubleshooting (e.g., to attempt to provide context if MPK logic breaks
and is only found in a later CI run).

prtest:full

<!--
Please make sure you include the following information:

- If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

- Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->


alexcrichton: Could this add a dedicated builder which is the only one enabling MPK? That one could perhaps run just a small subset of the test suite as well. I'm also a bit worried about the inverse where we always run with MPK by accident somehow and never see issues when it's turned off.

Otherwise, could the warning be tweaked a bit? Ideally what I'd imagine is that on failure a warning would be printed, but if everything succeeded no warning necessary as otherwise it can clutter up the view (e.g. [this link](https://github.com/bytecodealliance/wasmtime/actions/runs/7646831639?pr=7815) has a number of non-actionable warnings at the bottom)
abrown: Take a look at [this run](https://github.com/bytecodealliance/wasmtime/actions/runs/7763050750); this change will now only cause a single warning when MPK is not present.

Patch:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4d6062754..7f385bc00 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -520,6 +520,19 @@ jobs:
       shell: pwsh
       if: matrix.os == 'windows-latest'
 
+    # Since MPK (PKU) is not present on some GitHub runners, we check if it is
+    # available before force-enabling it. This occasional testing is better than
+    # none at all; ideally we would test in a system-mode QEMU VM.
+    - name: Force-run with MPK enabled, if available
+      if: ${{ contains(matrix.name, 'MPK') }}
+      run: |
+        if cargo run --example mpk-available; then
+          echo "::notice::This CI run will force-enable MPK; this ensures tests conditioned with the \`WASMTIME_TEST_FORCE_MPK\` environment variable will run with MPK-protected memory pool stripes."
+          echo WASMTIME_TEST_FORCE_MPK=1 >> $GITHUB_ENV
+        else
+          echo "::warning::This CI run will not test MPK; it has been detected as not available on this machine (\`cargo run --example mpk-available\`)."
+        fi
+
     # Build and test all features
     - run: ./ci/run-tests.sh --locked
       env:
diff --git a/examples/mpk-available.rs b/examples/mpk-available.rs
new file mode 100644
index 000000000..e48663112
--- /dev/null
+++ b/examples/mpk-available.rs
@@ -0,0 +1,16 @@
+//! This example checks if memory protection keys (MPK) are available on the
+//! current system using the
+//! [`PoolingAllocationConfig::are_memory_protection_keys_available`] API.
+
+use std::process::exit;
+use wasmtime::*;
+
+fn main() {
+    if PoolingAllocationConfig::are_memory_protection_keys_available() {
+        eprintln!("MPK is available");
+        exit(0);
+    } else {
+        eprintln!("MPK is not available");
+        exit(1);
+    }
+}


Test patch:
diff --git a/ci/build-test-matrix.js b/ci/build-test-matrix.js
index 5fee846d6..b5b776fc7 100644
--- a/ci/build-test-matrix.js
+++ b/ci/build-test-matrix.js
@@ -48,6 +48,12 @@ const array = [
     "isa": "x64",
     "rust": "msrv",
   },
+  {
+    "os": "ubuntu-latest",
+    "name": "Test Linux x86_64 with MPK",
+    "filter": "linux-x64",
+    "isa": "x64"
+  },
   {
     "os": "macos-latest",
     "name": "Test macOS x86_64",