Evaluate PIC / shared-everything dynamic linking as an input ABI (dissolves the #351 reloc-drift class) — revisit ADR-6

[avrabe]

Summary

Evaluate PIC / shared-everything dynamic linking as an input ABI for meld,
as an alternative (or complement) to the relocatable-inputs contract decided in
ADR-6. Raised by Christof re: #352 — with PIC inputs, address "rebasing" becomes
"set one __memory_base global per module", which structurally dissolves the
entire #351/#340 stale-reloc.CODE failure class: there are no absolute
i32.const address literals to rewrite, so there is nothing for a producer's
LEB-relaxation to desync.

Refs: SharedEverythingDynamicLinking.md,
DynamicLinking.md.

Grounded findings (verified today — wasm-tools 1.243.0, wac 0.6.0, clang 22.1.8)

1. PIC eliminates absolute addresses. clang --target=wasm32 -fPIC -O2 -c +
   wasm-ld --experimental-pic -shared turns dataB into
   (data (global.get $__memory_base) …) and ptr_b into
   global.get $__memory_base + offset. No i32.const <addr> literals exist.
2. An AOT linker exists and works: wasm-tools component link (and wac 0.6.0) link two dylink.0 modules into a valid component — one $main
   module owns a shared memory and exports it; each dylib is instantiated
   (with "env" …) with that memory + a disjoint __memory_base; an
   $__init module applies relocations at instantiation. This is the
   SharedEverythingDynamicLinking model, working out of the box.
3. This is exactly the path the fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326 spike (ADR-6) mis-scoped. The spike
   concluded "PIC excluded" — but it tested wasm-tools component **new**, which
   rejects a dylink core (reconfirmed today: error: failed to decode world from module; the CM forbids the env.memory/__memory_base non-function
   imports). component **link** is purpose-built for these and accepts the
   same core (reconfirmed). ADR-6's exclusion is really "excluded from the
   component new pipeline", not "excluded".

Alignment with PulseEngine goals

• Formal verification (Rocq/ASIL-D): strongest argument for PIC. "addresses =
  base_i + intra_offset, bases disjoint" ≈ the memory-layout-disjointness lemma
  meld already proves for merge. The reloc-consumer (fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326→fix(326): reloc-driven shared-memory address rebasing (sound --memory shared) #340) + meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351 drift are
  byte-level and genuinely hard to prove; PIC makes that obligation disappear.
• MCU / single-address-space (jess/falcon, fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326/fuse --memory shared leaves 2 MCU-dissolve blockers on a wac-composed node: N __stack_pointer globals + a dead lowered-import shim trampoline #334/fuse: drop vestigial cabi_realloc / canonical-ABI adapter once the inter-component boundary is internalized (unblocks --memory shared) #298 arc): shared-
  everything is the native model there (no MMU/sandbox), so Christof's
  "sacrifices the sandbox" caveat is a non-issue for the MCU target — it's the
  goal. The whole MCU-dissolve arc would have been trivial with PIC inputs.
• synth (native AOT) / loom (whole-program opt): a single static core with
  fixed addresses is the cleanest input; better than component link's
  instantiation-time relocation.
• meld's thesis ("static fusion, no runtime linking, single monolithic
  module"): the hard constraint. meld must NOT shell out to component link —
  that produces the linked-but-separate graph meld positions against (= wac). The
  meld-shaped design is: consume PIC/-shared dylibs and resolve
  __memory_base per module STATICALLY at fuse time, emitting one flat core —
  keeping meld's static-single-core output while adopting the PIC input ABI.
• Producer cost (gale, Rust+Verus → wasm): the main friction against.
  rustc→PIC-wasm fights default --export/--gc-sections; a bigger build change
  than fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326's one-flag -C link-arg=--emit-relocs that gale already uses.

Proposal

Treat input ABI as a spectrum, not a single choice:

• Near-term: keep --emit-relocs (works for gale today); land the fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352
  backstop as the safety net for it.
• Long-term: develop PIC-input + static __memory_base assignment as a
  parallel input path — the better foundation for the formally-verified/MCU/synth
  goals, and it retires the meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351 reloc-drift class instead of chasing it with
  drift-tolerant rebasing (the previously-planned fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352 tier-2).

Decisive spike (feasibility question to answer next)

Can meld consume PIC/-shared dylibs (or a component link-style shared-
everything graph) and statically flatten them into one core module —
resolving $__init's instantiation-time relocations at build time, assigning
disjoint bases itself? If yes, this is a cleaner ADR-6 successor. If the
instantiation-time relocation can't be statically resolved, PIC stays an
input-format improvement only.

Relation to existing work

• Revisits ADR-6 (safety/adr/ADR-6-shared-memory-address-relocation.md).
• Supersedes the planned fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352 tier-2 (drift-tolerant reloc rebasing) if the
  spike succeeds. fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352 tier-1 (backstop) is orthogonal and still lands.
• Related: fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326 (reloc-consumer), fuse --memory shared --address-rebase rejects components with memory.grow (default wasip2 allocator) — blocks single-address-space MCU lowering (jess/gale Pixhawk) #299 (growable-region ABI), fuse: pass through embedder import cabi-arena-realloc instead of trying to satisfy it #301 (arena
  realloc), Close the meld→kiln end-to-end seam: run a meld-fused core module on kiln and assert behavioural equivalence #297 (kiln seam).

[avrabe]

Spike result: static PIC / shared-everything flattening — FEASIBLE, dissolves the #351 class; gap = instantiation-topology modeling (not reloc rewriting)

Ran the decisive feasibility spike (wasm-tools 1.243.0, wac 0.6.0, clang 22.1.8; /tmp/pic-spike). Verdict: feasible, and the better long-term foundation — but the work is new topology modeling, orthogonal to (and retiring) the reloc-rebasing machinery.

What's already solved for us (the hard part)

• Addresses are statically resolved at link time. In the wasm-tools component link output, each module's __memory_base is a compile-time constant ($main sets stack=0x100000, heap=0x100010, disjoint per module); global.get $__memory_base count in the output = 0 (all folded). $__init is a (start) that writes only fixed base-derived constants into memory (data (i32.const 1048576) "…\10\00") — no runtime state.
• ⟹ There are no absolute-address relocation sites to rewrite, so the entire fix(326): reloc-driven shared-memory address rebasing (sound --memory shared) #340/meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351 stale-reloc.CODE drift class is structurally absent on this path. This is the core win.
• meld already parses the shared-everything component (meld inspect → "Core modules: 2") and produces a valid flattened output that preserves the resolved base constants. It already has the extended-const global.get $base + N machinery from meld fuse silently truncates extended-const exprs beginning with global.get (drops trailing arithmetic) — corrupts global initializers + data/element offsets (PIE base+N) #338 — the exact operator shape PIC uses.

The concrete gap (what meld must add)

meld fuse linked.wasm → 2 memory declarations. meld treats $main's memory and $__init's imported memory as two independent memories and multi-merges them. But in shared-everything they are one memory ($__init is (instantiate … (with "env" (instance $main))) — it imports $main's memory). meld does not model the instantiation-time sharing, so $__init's relocation writes would land in the wrong (duplicated) memory.

To flatten a shared-everything graph correctly meld must:

1. Model core-instance memory/table sharing — when instance B imports instance A's memory/__indirect_function_table, unify them into one, don't mint a second.
2. Statically fold the $__init (start) relocation — evaluate its data writes (all fixed constants) into the shared memory's data segments at build time, then drop $__init.

Both are squarely in meld's flattening competency; neither is reloc-offset rewriting.

Two implementation routes

• Path A (lower risk): consume the component link/wac output. The linker already does base-assignment + reloc resolution; meld adds topology-modeling + start-relocation folding. Fastest to a working single-static-core.
• Path B (meld owns it): consume raw PIC dylibs directly, doing base-assignment + GOT/dylink.0 resolution itself (per DynamicLinking.md). Bigger, but makes meld the linker — no external component link step.

Recommendation

• PIC + static base assignment is the cleaner long-term foundation for the formally-verified / MCU / synth goals, and it retires the meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351 reloc-drift class rather than chasing it with drift-tolerant rebasing (the previously-planned fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352 tier-2).
• Suggested next step: prototype Path A — teach the parser/merger to model shared-everything core-instance memory sharing + fold the $__init start-relocation, emitting one core module. Keep --emit-relocs + the fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile #352 backstop as the near-term path for gale.

Runtime cross-check still to do: the linked component exports nothing at the component boundary (needs a WIT to lift ptr-a/ptr-b), so end-to-end wasmtime execution of disjoint-address correctness is the one remaining verification before committing to Path A.

[avrabe]

Runtime confirmation (closes the spike's last evidence gap)

Demonstrated the core meld operation directly: take a PIC dylib, fold __memory_base → a chosen constant (0x30000) in code + data offset, and run it standalone (wasmtime 41):

• ptr_b → 196608 (0x30000 + 0) — correct base-relative pointer.
• get_b → 0xB0B0B0B0 (= dataB[0], read from the folded base) — data landed correctly.
• A second base (0x50000) tracks — proves it's genuinely base-relative, so disjoint per-module placement works.

Design constraint discovered: the data-segment offset const-expr must be folded to i32.const <base> — a locally-defined global.get is rejected by wasmtime in a data const-expr (constant expression required: global.get of locally defined global), even though wasm-tools validate is lenient about it. So static flattening = fold global.get $__memory_base → i32.const base in both code and data offsets (exactly what meld's #338 extended-const machinery already does), NOT redefine __memory_base as a local global. Confirmed end-to-end.

Spike is now fully grounded: static resolvability ✓, meld parses PIC components ✓, base-folding → correct addresses at runtime ✓, folding-not-redefine constraint ✓. Remaining work is the topology-modeling + start-relocation fold described above.

[cpetig]

If you go the route of fusing components with a shared address space you might want to take a look at the symmetric ABI implemented in https://github.com/cpetig/wit-bindgen , see https://wasmcon24.sched.com/event/1qvIG/component-model-in-software-defined-vehicles-christof-petig-aptiv for a presentation of the concepts.

[avrabe]

Thanks @cpetig — this is the missing half. The symmetric ABI is the adapter-side complement to what #353 covers on the relocation-side, and together they define a coherent shared-everything stack for the safety-critical target. Read the HackMD doc + the meshless_strings/meshless_resources tests; here's how it lands for meld specifically.

Two orthogonal simplifications, same direction:

• PIC / static base assignment (this issue): dissolves the address-relocation problem — no absolute i32.const addresses to rebase, so the whole fix(326): reloc-driven shared-memory address rebasing (sound --memory shared) #340/meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351 reloc.CODE machinery isn't needed.
• Symmetric ABI (your work): dissolves the adapter problem — "use the import ABI also for exports", args passed as views/pointers, no cabi_post_/cabi_realloc phase, handles extended to pointer size = rep. Zero-copy, allocation-free cross-component calls when memory is shared.

Why this is big for meld concretely: meld's canonical-ABI adapter subsystem (FACT-style trampolines — string transcoding, memory.copy between component memories, list serialization, realloc) is ~16.4k lines (meld-core/src/adapter/), and it exists only because the canonical ABI assumes disjoint memories. For symmetric-ABI + shared-address-space inputs, cross-component calls are direct — meld wires them per the symmetric convention instead of generating trampolines. So the fusion job for this input class collapses to roughly: index-space merge + direct-call wiring + static __memory_base assignment. That is dramatically less code on the hot path and far less to formally verify (no adapter lift/lower semantics, no reloc arithmetic) — which is the whole point for the Rocq/ASIL-D goal.

Alignment: no dynamic allocation per call is exactly the functional-safety requirement (gale is ASIL-D-targeted; jess/falcon is Cortex-M/Pixhawk), and it's the SDV angle from your WasmCon24 talk. So the shared-everything path isn't just "an option" — for the safety-critical single-address-space target it looks like the right stack: PIC linking (addresses) + symmetric ABI (calls) + meld static fusion → one zero-copy, allocation-free binary.

Caveats to be honest about: the symmetric ABI is a distinct, non-canonical ABI — producer opt-in (built via cpetig/wit-bindgen), and symmetric composes with symmetric; standard canonical-ABI components still need the existing adapter path. So this is a second input contract for the safety path alongside the canonical one, not a replacement — same shape as the PIC-vs---emit-relocs split (a producer-side choice that unlocks a much simpler, more verifiable fusion).

Folding this into #353's scope: the "shared-everything input contract" = PIC linking + symmetric ABI, both producer-side opt-ins, each dissolving a major meld subsystem (relocation, then adapters). The Path-A prototype should keep the symmetric-ABI call convention in view so the two compose. Will report back when I've read the meshless_* tests in detail.

[cpetig]

I fear that the meshless tests are outdated, now the standard tests in tests/runtime* work with --symmetric and are both more up to date and test more complex situations.

[avrabe]

@cpetig noted — thanks, re-pointed. Confirmed by reading crates/cpp/tests/symmetric.rs: symmetric_integration() reuses the standard tests/runtime sources and builds them with opts.symmetric = true + -shared (PIC cdylib), rather than the (outdated) meshless_* fixtures. So the symmetric ABI is exercised against the full runtime suite (records/variants/lists/resources/results), which is much stronger evidence of maturity than the toy cases.

Takeaway for the meld side: when we prototype Path A / keep the symmetric convention in view (per this thread), the reference to study is tests/runtime* under --symmetric + the -shared link recipe, not meshless. The producer contract is 'wit-bindgen symmetric = true → -shared'. Updating our ADR-7 note accordingly.

(Still consistent with the ADR-7 review consensus: symmetric stays a producer-opt-in via cpetig/wit-bindgen and should be driven to a BA/wit-bindgen standard before a safety product cites it — the fuller test coverage is a good step toward that.)