Using WASM as a mod system for a game built in rust

[alexbowers]

Summary

A clear and concise summary of your question.

I've been looking at using Rust for a simple prototype 2d game with support for modding built in to the core of the game.

For the modding I am looking at WASM, where there would be a directory of <mod>.wasm files that can be loaded and they provide the modded functionality.

The way I was looking at doing this would be to glob all of the files in a mod directory somewhere, and in the initial boot of the game load them all and call a simple registration method which would return to the game which events they want to hook into.

My question is focused on the event hooks. I want to be able to pass through core parts of the game in the structure that the game uses them (ie, as structs) and get them returned back to me as a struct that is usable.

Is this something that is possible, or is it not doable, and if it isn't doable, what would be your recommended way to handle something like this?

I could convert the entire struct to some other data structure (either structured text / json), for it to be handled and accept that back, but that would require more validation on my side to make sure the core structure isn't lost.

[MarkMcCaskey]

I think this is a compelling use case for Wasm, however how you do it depends on your trust model. If a server is taking user-uploaded mods at runtime, then you will need as much sandboxing as possible. However if you're using Wasm more as a scripting system and the Wasm modules are trusted, you don't need to worry about sandboxing as much.

When fully sandboxed, the guest Wasm and the host (using the wasmer library) do not share memory. The host can look directly into guest memory, but you must be careful to avoid undefined behavior (for example using unsafe to deref a &bool pointing into Wasm memory: anything but the bit pattern 0 and 1 are UB for bool in Rust). So there is no way to avoid some amount of validation and parsing, in general, when dealing with untrusted code. It is safe to read from a &[u8] or &str into memory as long as the Wasm is not allowed to execute while you hold that reference as the Wasm may invalidate that memory or break other invariants.

The way I'd structure this if I were doing it is:

1. the guest Wasm modules should fully trust data from the host (unless you want to allow Wasm modules to pass each other data, in which case, that must also be validated)
2. the host should validate the data it reads from Wasm memory when data is being passed from the Wasm guest to the host
3. the specific protocol doesn't matter too much, if you use a flexible system like serde or equivalent, then it should be easy to benchmark and try out various encoding schemes.

There are ways to avoid the serialization / deserialization step, but I think it's probably not worth it in general, it'll take more careful design and planning and is less flexible. If you want some inspiration for what an API with less parsing of blobs of data might look like, check out the design of WASI, specifically how directory entries are listed. WASI is designed around the host never allocating memory in the Wasm, so everything is fully controlled by the Wasm guest.

[alexbowers]

Hi,

The plan is for this to be added to an offline single player game (IE. the game lives entirely on the users machine), so the trust model is entirely on what they choose to install. To this extent I don't think that any form of sandboxing is strictly necessary, the user themselves should perform some due-diligence on whether or not the mod is safe and suitable.

I will be adding in some basic checks to make sure the mod is compatible and not just a random WASM file that was added to the folder, but beyond that, its down to the user themselves.

You mention about avoiding serialization / deserialization, I just want to check does WASM support structs, or would it have to be some form of encoding to pass it back and forth?

[nlewycky]

Wasm types don't include structs, however, functions can return multiple values once support for multi-value was added, and not all Wasm ecosystem software has been updated for that yet. For example, if you go to the Rust playground and write code that returns a struct (select "show wasm" from the dropdown to the right of "Build ▶"), it will create a Wasm function that returns nothing, and the struct data is written into the Wasm memory. The question of how a language-level struct is passed in Wasm code is akin to an ABI for native code, but in Wasm. I don't think Rust documents their Wasm ABI.

[MarkMcCaskey]

Oops, sorry I dropped the ball on responding here, @nlewycky is correct but I'd just like to add one thing!

The default ABI, if unspecified, in rust is extern "Rust", you can opt-in to other, stable ABIs if it's important to you.

For example extern "C" fn my_func(i32) -> (i32, i32) uses the "C" ABI and should give you a stable representation (note that the stability of the representation is dependent on what version of Wasm is being targeted... for example, before the multi-value proposal, the function obviously couldn't return multiple values at the Wasm level.

The equivalent for structs is #[repr(C)] which makes struct layout act like C (the fields are in the order listed, the way padding works, etc).

[chances]

I am also implementing a scripting solution in a similar vein.

[protheory8]

Veloren game has a plugin support using Wasmer runtime, might be interesting: https://gitlab.com/veloren/veloren/-/blob/6cfb4bd74d565f2cffb583c1960bafb7c384685a/common/sys/src/plugin/module.rs