Host function protocol gating

[jayz22]

What

Allow host functions to specify its supported protocol bounds, e.g.

        {
            "name": "test",
            "export": "t",
            "functions": [
                {
                    "export": "_",
                    "name": "dummy0",
                    "args": [],
                    "return": "Val",
                    "docs": "A dummy function taking 0 arguments and performs no-op.                
+                  "min_supported_protocol": 20,
+                   "max_supported_protocol": 21
                }                
            ]
        },

And adds logic (mostly macro generated) that automatically checks and enforces these protocol bounds in various paths:

• Host running as native. Covered by impl Env for VmCallerEnv.
• Host running from the guest Wasm contract. Covered by Vm link-time check, as well as the dispatch functions (as a redundant safe guard).

Tests are added in tests/protocol_gate.rs.

For more context, visit the design doc

[graydon]

I pushed a couple minor fixes, looks good overall!

[dmkozh]

Isn't this a protocol change? I thought it was only intended for testing. I think it should still be gated by protocol 21, or otherwise we would risk a divergence.

[jayz22]

This won't have an effect on protocol because no contract can link to it. It's min and max protocol are both specified as 19. So if a contract tries, it will fail the validation check during the upload (same as linking to a non-existent function today).

The reason this has to be 19 (or any value lower than 20) is because the test includes the case where the ledger protocol version > host function max protocol (see test_host_protocol_gating_for_wasm), and the ledger protocol version cannot be larger than the env version (20, which is compiled in and non-overridable).

Note setting the min_supported_protocol to 21 is using the exact same mechanism for protection against contract built with protocol 20. So effectively this function is always protocol gated out.

[dmkozh]

Ah, that's clever. Thanks for the explanation.

[jayz22]

Good point. I've added a comment to the function docs in #1356