Merge branch 'bytecodealliance:main' into fix/zephyr_product_mini

2026-02-15 15:18:33 +00:00 · 2025-10-27 13:02:17 +01:00 · 2025-10-27 13:02:17 +01:00 · 505eb2dd2f
commit 505eb2dd2f
parent b69ff79e70 ba9f9d180f
100 changed files with 2051 additions and 183 deletions
--- a/.github/ISSUE_TEMPLATE/blank_issue.md
+++ b/.github/ISSUE_TEMPLATE/blank_issue.md
@ -1,5 +0,0 @@
---
-name: Blank Issue
-about: Create a blank issue.
-title: ''
---
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@ -0,0 +1,41 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "Add a placeholder for issue title. ex: [BUG]"
+labels: bug
+assignees: ""
+---
+
+**Is it a security vulnerability?**
+If it results in a crash or hang, please refer to [a quick checklist](../../doc/security_need_to_know.md#is-this-bug-considered-a-security-vulnerability) to determine if it is a security vulnerability. If you are still unsure, please report it through [a security advisor](https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories) and allow the maintainer to make a decision. Thank you.
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Version**
+Information like tags, release version, commits.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Compile iwasm with flags like '...'
+2. (Optional) Compile wamrc with flags like '....'
+3. (Optional) Run wamrc with CLI options like '...' to generate .aot
+4. Run iwasm with CLI options like '...'
+5. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Actual Result**
+What you've got.
+
+**Desktop (please complete the following information):**
+
+- Arch [e.g. x86_64, arm64, 32bit]
+- Board [e.g. STM32F407]
+- OS [e.g. Linux, Windows, macOS, FreeRTOS]
+- Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@ -0,0 +1 @@
+blank_issues_enabled: true
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: 'Add a placeholder for issue title. ex: [RFC]'
+labels: help wanted
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
--- a/.github/ISSUE_TEMPLATE/improvement.md
+++ b/.github/ISSUE_TEMPLATE/improvement.md
@ -1,28 +0,0 @@
---
-name: Improvement
-about: A feature request or code improvement.
-title: ''
-labels: ''
-assignees: ''
---
-
-Thanks for filing a feature request! Please fill out the TODOs below.
-
-#### Feature
-
-TODO: Brief description of the feature/improvement you'd like to see in WAMR
-
-#### Benefit
-
-TODO: What is the value of adding this in WAMR? What problems does it solve?
-
-#### Implementation
-
-TODO: Do you have an implementation plan, and/or ideas for data structures or
-algorithms to use?
-
-#### Alternatives
-
-TODO: What are the alternative implementation approaches or alternative ways to
-solve the problem that this feature would solve? How do these alternatives
-compare to this proposal?
--- a/.github/ISSUE_TEMPLATE/report_bug.md
+++ b/.github/ISSUE_TEMPLATE/report_bug.md
@ -1,36 +0,0 @@
---
-name: WAMR bug or defect report
-about: Report a bug or defect in WAMR
-title: ''
---
-
-Thanks for filing a bug or defect report! Please fill out the TODOs below.
-
-### Subject of the issue
-
-Describe the bug or defect here.
-
-### Test case
-
-Upload the related wasm file, wast file or the source files if you can.
-
-### Your environment
-
-* Host OS
-* WAMR version, platform, cpu architecture, running mode, etc.
-
-### Steps to reproduce
-
-Tell us how to reproduce this bug or defect.
-
-### Expected behavior
-
-Tell us what should happen
-
-### Actual behavior
-
-Tell us what happens instead
-
-### Extra Info
-
-Anything else you'd like to add?
--- a/.github/workflows/build_iwasm_release.yml
+++ b/.github/workflows/build_iwasm_release.yml
@ -151,7 +151,7 @@ jobs:
        working-directory: ${{ inputs.cwd }}

      - name: Compress the binary on Windows
-        if: inputs.runner == 'windows-latest'
+        if: inputs.runner == 'windows-2022'
        run: |
          tar -czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm.exe
          Compress-Archive -Path iwasm.exe -DestinationPath iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
@ -159,7 +159,7 @@ jobs:
        working-directory: ${{ inputs.cwd }}/build/Release

      - name: compress the binary on non-Windows
-        if: inputs.runner != 'windows-latest'
+        if: inputs.runner != 'windows-2022'
        run: |
          # Follow the symlink to the actual binary file
          tar --dereference -czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm
--- a/.github/workflows/build_llvm_libraries.yml
+++ b/.github/workflows/build_llvm_libraries.yml
@ -118,11 +118,11 @@ jobs:
          key: 0-ccache-${{ inputs.os }}-${{ steps.get_last_commit.outputs.last_commit }}
          restore-keys: |
            0-ccache-${{ inputs.os }}
-        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-latest'
+        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-2022'

      # Install tools on Windows
      - run: choco install -y ccache ninja
-        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-latest'
+        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-2022'

      - name: Build LLVM libraries
        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true'
--- a/.github/workflows/build_wamr_vscode_ext.yml
+++ b/.github/workflows/build_wamr_vscode_ext.yml
@ -27,7 +27,7 @@ jobs:
      - uses: actions/checkout@v5

      - name: Use Node.js 18.x
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
        with:
          node-version: 18.x

--- a/.github/workflows/build_wamrc.yml
+++ b/.github/workflows/build_wamrc.yml
@ -87,7 +87,7 @@ jobs:
        working-directory: wamr-compiler

      - name: Compress the binary on Windows
-        if: inputs.runner == 'windows-latest' && inputs.release
+        if: inputs.runner == 'windows-2022' && inputs.release
        run: |
          tar -czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc.exe
          Compress-Archive -Path wamrc.exe -DestinationPath wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
@ -95,7 +95,7 @@ jobs:
        working-directory: wamr-compiler/build/Release

      - name: compress the binary on non-Windows
-        if: inputs.runner != 'windows-latest' && inputs.release
+        if: inputs.runner != 'windows-2022' && inputs.release
        run: |
          # Follow the symlink to the actual binary file
          tar --dereference -czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -53,7 +53,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3.30.1
+      uses: github/codeql-action/init@v4.30.9
      with:
        languages: ${{ matrix.language }}

@ -70,7 +70,7 @@ jobs:
    - run: |
        ./.github/scripts/codeql_buildscript.sh
    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3.30.1
+      uses: github/codeql-action/analyze@v4.30.9
      with:
        category: "/language:${{matrix.language}}"
        upload: false
@ -99,7 +99,7 @@ jobs:
        output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif

    - name: Upload CodeQL results to code scanning
-      uses: github/codeql-action/upload-sarif@v3.30.1
+      uses: github/codeql-action/upload-sarif@v4.30.9
      with:
        sarif_file: ${{ steps.step1.outputs.sarif-output }}
        category: "/language:${{matrix.language}}"
--- a/.github/workflows/compilation_on_android_ubuntu.yml
+++ b/.github/workflows/compilation_on_android_ubuntu.yml
@ -622,6 +622,14 @@ jobs:
          ./shared_heap_test
          ./shared_heap_test --aot

+      - name: Build Sample [import-func-callback]
+        run: |
+          cd samples/import-func-callback
+          mkdir build && cd build
+          cmake ..
+          cmake --build . --config Release --parallel 4
+          ./import-func-callback
+
  test:
    needs:
      [
--- a/.github/workflows/compilation_on_macos.yml
+++ b/.github/workflows/compilation_on_macos.yml
@ -422,3 +422,11 @@ jobs:
          cmake --build . --config Debug --parallel 4
          ./shared_heap_test
          ./shared_heap_test --aot
+
+      - name: Build Sample [import-func-callback]
+        run: |
+          cd samples/import-func-callback
+          mkdir build && cd build
+          cmake ..
+          cmake --build . --config Release --parallel 4
+          ./import-func-callback
--- a/.github/workflows/compilation_on_windows.yml
+++ b/.github/workflows/compilation_on_windows.yml
@ -1,7 +1,7 @@
 # Copyright (C) 2019 Intel Corporation.  All rights reserved.
 # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

-name: compilation on windows-latest
+name: compilation on windows-2022

 on:
  # will be triggered on PR events
@ -63,11 +63,11 @@ jobs:
      actions: write
    uses: ./.github/workflows/build_llvm_libraries.yml
    with:
-      os: "windows-latest"
+      os: "windows-2022"
      arch: "AArch64 ARM Mips RISCV X86"

  build_iwasm:
-    runs-on: windows-latest
+    runs-on: windows-2022
    strategy:
      matrix:
        build_options:
@ -105,7 +105,7 @@ jobs:
    strategy:
      matrix:
        include:
-          - os: windows-latest
+          - os: windows-2022
            llvm_cache_key: ${{ needs.build_llvm_libraries_on_windows.outputs.cache_key }}
    steps:
      - name: checkout
@ -136,7 +136,7 @@ jobs:
        working-directory: wamr-compiler

  test:
-    runs-on: windows-latest
+    runs-on: windows-2022
    needs: [build_iwasm, build_wamrc]
    strategy:
      fail-fast: false
--- a/.github/workflows/compilation_on_zephyr.yml
+++ b/.github/workflows/compilation_on_zephyr.yml
@ -11,6 +11,7 @@ on:
      - synchronize
    paths:
      - ".github/**"
+      - "!.github/ISSUE_TEMPLATE/**"
      - "build-scripts/**"
      - "core/**"
      - "!core/deps/**"
@ -27,6 +28,7 @@ on:
      - "dev/**"
    paths:
      - ".github/**"
+      - "!.github/ISSUE_TEMPLATE/**"
      - "build-scripts/**"
      - "core/**"
      - "!core/deps/**"
--- a/.github/workflows/nightly_run.yml
+++ b/.github/workflows/nightly_run.yml
@ -568,6 +568,14 @@ jobs:
          ./shared_heap_test
          ./shared_heap_test --aot

+      - name: Build Sample [import-func-callback]
+        run: |
+          cd samples/import-func-callback
+          mkdir build && cd build
+          cmake ..
+          cmake --build . --config Release --parallel 4
+          ./import-func-callback
+
  test:
    needs: [build_iwasm, build_llvm_libraries_on_ubuntu, build_wamrc]
    runs-on: ${{ matrix.os }}
--- a/.github/workflows/release_process.yml
+++ b/.github/workflows/release_process.yml
@ -105,7 +105,7 @@ jobs:
    needs: [create_tag, create_release]
    uses: ./.github/workflows/build_llvm_libraries.yml
    with:
-      os: "windows-latest"
+      os: "windows-2022"
      arch: "AArch64 ARM Mips RISCV X86"

  #
@ -142,7 +142,7 @@ jobs:
    with:
      llvm_cache_key: ${{ needs.build_llvm_libraries_on_windows.outputs.cache_key }}
      release: true
-      runner: windows-latest
+      runner: windows-2022
      upload_url: ${{ needs.create_release.outputs.upload_url }}
      ver_num: ${{ needs.create_tag.outputs.new_ver }}

@ -180,7 +180,7 @@ jobs:
    with:
      cwd: product-mini/platforms/windows
      llvm_cache_key: ${{ needs.build_llvm_libraries_on_windows.outputs.cache_key }}
-      runner: windows-latest
+      runner: windows-2022
      upload_url: ${{ needs.create_release.outputs.upload_url }}
      ver_num: ${{ needs.create_tag.outputs.new_ver}}

--- a/.github/workflows/supply_chain.yml
+++ b/.github/workflows/supply_chain.yml
@ -39,7 +39,7 @@ jobs:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
@ -60,6 +60,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@144880b6f0c9977178ab4000985a49023783178f 
+        uses: github/codeql-action/upload-sarif@d88a5540c3fd916f4e15b7744d287a124278e065 
        with:
          sarif_file: results.sarif
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@ -1,3 +1,35 @@
+## WAMR-2.4.3
+
+### Breaking Changes
+
+### New Features
+
+### Bug Fixes
+
+- libc-wasi: add missing pointer validations to socket functions (#4611) (#4665)
+
+### Enhancements
+
+### Others
+
+---
+
+## WAMR-2.4.2
+
+### Breaking Changes
+
+### New Features
+
+### Bug Fixes
+
+- CVE-2025-58749. Fix a potential hang issue in LLVMJIT mode
+
+### Enhancements
+
+### Others
+
+---
+
 ## WAMR-2.4.1

 ### Breaking Changes
--- a/SUMMARY.md
+++ b/SUMMARY.md
@ -0,0 +1,90 @@
+# Summary: structure of chapters and subchapters of the book
+
+* [WAMR Document Home Page](gitbook/home_page.md)
+
+## Basics
+
+* [Introduction](gitbook/basics/introduction/README.md)
+  * [WebAssembly](gitbook/basics/introduction/webassembly.md)
+  * [WAMR Project](gitbook/basics/introduction/wamr_project.md)
+  * [Security Feature](gitbook/basics/introduction/security_feature.md)
+
+* [Getting Started](gitbook/basics/getting-started/README.md)
+  * [Host Environment Preparation](gitbook/basics/getting-started/host_prerequsites.md)
+  * [Hello-world Program On Host](gitbook/basics/getting-started/on_host.md)
+  * [Docker Environment Preparation](doc/devcontainer.md)
+  * [Hello-world Program On Docker](gitbook/basics/getting-started/on_docker.md)
+  * [Build And Run WASM Application](doc/build_wasm_app.md)
+    * [More Tools To Create WASM Application](doc/other_wasm_compilers.md)
+
+## WAMR In Practice
+
+* [Tutorial](gitbook/tutorial/README.md)
+  * [WAMR Running Modes](gitbook/tutorial/running-modes/README.md)
+  * [Build Tutorial](gitbook/tutorial/build-tutorial/README.md)
+    * [Build iwasm](doc/build_wamr.md)
+    * [Build wamrc](gitbook/tutorial/build-tutorial/build_wamrc.md)
+  * [Language Embedding](gitbook/tutorial/language-embedding/README.md)
+    * [C/C++](doc/embed_wamr.md)
+    * [Python](language-bindings/python/README.md)
+    * [Go](language-bindings/go/README.md)
+  * [Debugging & IDE Support](gitbook/tutorial/debugging%26IDE-support/README.md)
+    * [WAMR Source Debugging With LLDB](doc/source_debugging.md)
+    * [VS Code Support](test-tools/wamr-ide/README.md)
+      * [Enable Debugging In VS Code](test-tools/wamr-ide/VSCode-Extension/README.md)
+      * [Move LLDB Binaries](test-tools/wamr-ide/VSCode-Extension/resource/debug/README.md)
+
+* [Advance Tutorial](gitbook/advance-tutorial/README.md)
+  * [Performance Test](gitbook/advance-tutorial/performance-benchmark/README.md)
+    * [PolyBench](tests/benchmarks/polybench/README.md)
+    * [CoreMark](tests/benchmarks/coremark/README.md)
+    * [Sightglass](tests/benchmarks/sightglass/README.md)
+    * [JetStream2](tests/benchmarks/jetstream/README.md)
+  * [Memory Usage Tunning](doc/memory_tune.md)
+  * [WAMR Porting Guide](doc/port_wamr.md)
+
+* [Features](gitbook/features/README.md)
+  * [Export Native APIs To WASM Applications](doc/export_native_api.md)
+    * [Example 1: Export C Functions to WASM](samples/basic/README.md)
+    * [Example 2: Using "native-lib"](samples/native-lib/README.md)
+  * [Multiple Modules As Dependencies](doc/multi_module.md)
+    * [Multi-modules Example](samples/multi-module/README.md)
+  * [Multi-thread, Pthread APIs And Thread Management](doc/pthread_library.md)
+    * [Multi-thread Example](samples/multi-thread/README.md)
+  * [Linux SGX(Intel Software Guard Extension) Support](doc/linux_sgx.md)
+  * [Linux SGX Remote Attestation](samples/sgx-ra/README.md)
+  * [XIP(Execution In Place) Support](doc/xip.md)
+  * [Socket Support](doc/socket_api.md)
+    * [Example: Use Socket Api in WAMR](samples/socket-api/README.md)
+  * [Post-MVP Features](gitbook/features/demo-examples/README.md)
+    * [WASM C API](samples/wasm-c-api/README.md)
+    * [128-bit SIMD](samples/workload/README.md)
+    * [Reference Types](samples/ref-types/README.md)
+
+* [More Examples](gitbook/examples/README.md)
+  * [File Interaction Of WASI](samples/file/README.md)
+  * [Same WASM Program Executing Concurrently](samples/spawn-thread/README.md)
+  * [Build And Run Workload](samples/workload/README.md)
+
+* [User Case](gitbook/features/user-case/README.md)
+
+## Programmer's Manual
+
+* [Programmer's Manual](gitbook/programmer's-manual/README.md)
+  * [C API Lists](gitbook/programmer's-manual/C_API_Lists.md)
+
+## Community
+
+* [How To Contribute](CONTRIBUTING.md)
+
+* [WAMR On Github](https://github.com/bytecodealliance/wasm-micro-runtime)
+
+* [WAMR Blogs](https://bytecodealliance.github.io/wamr.dev/)
+
+## Appendix
+
+* [Appendix A. Background Knowledge And Glossary Of Terms](gitbook/appendix/background_knowledge.md)
+
+* [Appendix B. WebAssembly Details](gitbook/appendix/webassembly_details.md)
+
+* [Appendix C. Complete WAMR Guide](README.md)
--- a/build-scripts/version.cmake
+++ b/build-scripts/version.cmake
@ -8,7 +8,7 @@ endif()

 set(WAMR_VERSION_MAJOR 2)
 set(WAMR_VERSION_MINOR 4)
-set(WAMR_VERSION_PATCH 1)
+set(WAMR_VERSION_PATCH 3)

 message("-- WAMR version: ${WAMR_VERSION_MAJOR}.${WAMR_VERSION_MINOR}.${WAMR_VERSION_PATCH}")

--- a/core/iwasm/aot/aot_runtime.c
+++ b/core/iwasm/aot/aot_runtime.c
@ -114,6 +114,13 @@ set_error_buf_v(char *error_buf, uint32 error_buf_size, const char *format, ...)
    }
 }

+static void
+aot_unlinked_import_func_trap(WASMExecEnv *exec_env)
+{
+    AOTModuleInstance *module_inst = (AOTModuleInstance *)exec_env->module_inst;
+    aot_set_exception_with_id(module_inst, EXCE_CALL_UNLINKED_IMPORT_FUNC);
+}
+
 static void *
 runtime_malloc(uint64 size, char *error_buf, uint32 error_buf_size)
 {
@ -1397,6 +1404,7 @@ init_func_ptrs(AOTModuleInstance *module_inst, AOTModule *module,
             * Debugging: Check if the import is resolved at link time */
            LOG_WARNING("warning: failed to link import function (%s, %s)",
                        module_name, field_name);
+            *func_ptrs = (void *)aot_unlinked_import_func_trap;
        }
    }

@ -1889,8 +1897,9 @@ check_linked_symbol(AOTModule *module, char *error_buf, uint32 error_buf_size)

 AOTModuleInstance *
 aot_instantiate(AOTModule *module, AOTModuleInstance *parent,
-                WASMExecEnv *exec_env_main, uint32 stack_size, uint32 heap_size,
-                uint32 max_memory_pages, char *error_buf, uint32 error_buf_size)
+                WASMExecEnv *exec_env_main,
+                const struct InstantiationArgs2 *args, char *error_buf,
+                uint32 error_buf_size)
 {
    AOTModuleInstance *module_inst;
 #if WASM_ENABLE_BULK_MEMORY != 0 || WASM_ENABLE_REF_TYPES != 0
@ -1908,6 +1917,9 @@ aot_instantiate(AOTModule *module, AOTModuleInstance *parent,
 #if WASM_ENABLE_MULTI_MODULE != 0
    bool ret = false;
 #endif
+    uint32 stack_size = args->v1.default_stack_size;
+    uint32 heap_size = args->v1.host_managed_heap_size;
+    uint32 max_memory_pages = args->v1.max_memory_pages;

    /* Align and validate heap size */
    heap_size = align_uint(heap_size, 8);
@ -1989,7 +2001,7 @@ aot_instantiate(AOTModule *module, AOTModuleInstance *parent,

    ret = wasm_runtime_sub_module_instantiate(
        (WASMModuleCommon *)module, (WASMModuleInstanceCommon *)module_inst,
-        stack_size, heap_size, max_memory_pages, error_buf, error_buf_size);
+        args, error_buf, error_buf_size);
    if (!ret) {
        LOG_DEBUG("build a sub module list failed");
        goto fail;
@ -4495,7 +4507,7 @@ aot_create_call_stack(struct WASMExecEnv *exec_env)
            frame.frame_ref = (uint8 *)frame.lp + (frame_ref - (uint8 *)lp);
            /* copy local ref flags from AOT module */
            bh_memcpy_s(frame.frame_ref, local_ref_flags_cell_num,
-                        local_ref_flags, lp_size);
+                        local_ref_flags, local_ref_flags_cell_num);
 #endif
        }

--- a/core/iwasm/aot/aot_runtime.h
+++ b/core/iwasm/aot/aot_runtime.h
@ -544,10 +544,7 @@ aot_resolve_import_func(AOTModule *module, AOTImportFunc *import_func);
 *
 * @param module the AOT module to instantiate
 * @param parent the parent module instance
- * @param heap_size the default heap size of the module instance, a heap will
- *        be created besides the app memory space. Both wasm app and native
- *        function can allocate memory from the heap. If heap_size is 0, the
- *        default heap size will be used.
+ * @param args   the instantiation parameters
 * @param error_buf buffer to output the error info if failed
 * @param error_buf_size the size of the error buffer
 *
@ -555,8 +552,8 @@ aot_resolve_import_func(AOTModule *module, AOTImportFunc *import_func);
 */
 AOTModuleInstance *
 aot_instantiate(AOTModule *module, AOTModuleInstance *parent,
-                WASMExecEnv *exec_env_main, uint32 stack_size, uint32 heap_size,
-                uint32 max_memory_pages, char *error_buf,
+                WASMExecEnv *exec_env_main,
+                const struct InstantiationArgs2 *args, char *error_buf,
                uint32 error_buf_size);

 /**
--- a/core/iwasm/aot/arch/aot_reloc_arc.c
+++ b/core/iwasm/aot/arch/aot_reloc_arc.c
@ -310,6 +310,80 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,
                 int32 symbol_index, char *error_buf, uint32 error_buf_size)
 {
    switch (reloc_type) {
+        case R_ARC_S21H_PCREL:
+        {
+            uint32 insn = LOAD_I32(target_section_addr + reloc_offset);
+            int32 addend, value;
+            uintptr_t S, P;
+            intptr_t A;
+
+            CHECK_RELOC_OFFSET(sizeof(void *));
+
+            /* Convert from middle endian */
+            insn = middle_endian_convert(insn);
+
+            /* Extract the first 10 bits from Position 6 to 15 in insn */
+            addend = (insn << 16) >> 22;
+            addend = addend << 10;
+            /* Extract the remaining 10 bits from Position 17 to 26 in insn */
+            addend |= ((insn << 5) >> 22);
+            /* Fill in 1 bits to get the 21 bit Offset Value */
+            addend = addend << 1;
+
+            /* (S + A) - P */
+            S = (uintptr_t)(uint8 *)symbol_addr;
+            A = (intptr_t)reloc_addend;
+            P = (uintptr_t)(target_section_addr + reloc_offset);
+            P &= (uintptr_t)~1;
+            value = (int32)(S + A + addend - P);
+
+            insn = insn & 0xf801003f;
+            insn |= ((((value >> 1) & 0x3ff) << 17)
+                     | (((value >> 1) & 0xffc00) >> 4));
+
+            /* Convert to middle endian */
+            insn = middle_endian_convert(insn);
+
+            STORE_U32(target_section_addr + reloc_offset, insn);
+            break;
+        }
+        case R_ARC_S21W_PCREL:
+        {
+            uint32 insn = LOAD_I32(target_section_addr + reloc_offset);
+            int32 addend, value;
+            uintptr_t S, P;
+            intptr_t A;
+
+            CHECK_RELOC_OFFSET(sizeof(void *));
+
+            /* Convert from middle endian */
+            insn = middle_endian_convert(insn);
+
+            /* Extract the first 10 bits from Position 6 to 15 in insn */
+            addend = (insn << 16) >> 22;
+            addend = addend << 9;
+            /* Extract the remaining 9 bits from Position 18 to 26 in insn */
+            addend |= ((insn << 5) >> 23);
+            /* Fill in 2 bits to get the 21 bit Offset Value */
+            addend = addend << 2;
+
+            /* (S + A) - P */
+            S = (uintptr_t)(uint8 *)symbol_addr;
+            A = (intptr_t)reloc_addend;
+            P = (uintptr_t)(target_section_addr + reloc_offset);
+            P &= (uintptr_t)~3;
+            value = (int32)(S + A + addend - P);
+
+            insn = insn & 0xf803003f;
+            insn |= ((((value >> 2) & 0x1ff) << 18)
+                     | (((value >> 2) & 0x7fe00) >> 3));
+
+            /* Convert to middle endian */
+            insn = middle_endian_convert(insn);
+
+            STORE_U32(target_section_addr + reloc_offset, insn);
+            break;
+        }
        case R_ARC_S25H_PCREL:
        {
            uint32 insn = LOAD_I32(target_section_addr + reloc_offset);
@ -340,8 +414,8 @@ apply_relocation(AOTModule *module, uint8 *target_section_addr,

            insn = insn & 0xf8010030;
            insn |= ((((value >> 1) & 0x3ff) << 17)
-                     | (((value >> 1) & 0xffc00) >> 3)
-                     | (((value >> 1) & 0xf00000) >> 19));
+                     | (((value >> 1) & 0xffc00) >> 4)
+                     | (((value >> 1) & 0xf00000) >> 20));

            /* Convert to middle endian */
            insn = middle_endian_convert(insn);
--- a/core/iwasm/common/arch/invokeNative_armasm64.asm
+++ b/core/iwasm/common/arch/invokeNative_armasm64.asm
@ -0,0 +1,73 @@
+        ; Copyright (C) 2019 Intel Corporation.  All rights reserved.
+        ; SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+        AREA    |.text|, CODE, READONLY, ALIGN=2
+
+        EXPORT  invokeNative
+
+; ------------------------ direct call path ------------------------
+
+call_func
+        mov     x20, x30                 ; save x30(lr)
+        blr     x19
+        mov     sp, x22                  ; restore sp saved before function call
+
+return_label
+        mov     x30,  x20                ; restore x30(lr)
+        ldp     x19, x20, [sp, #0x20]
+        ldp     x21, x22, [sp, #0x10]
+        ldp     x23, x24, [sp, #0x0]
+        add     sp, sp, #0x30
+        ret
+
+; ------------------------ stack-args path ------------------------
+
+handle_stack
+        ; Reserve aligned stack space for stack arguments and copy them
+        mov     x23, sp
+        bic     sp,  x23, #15            ; Ensure 16-byte alignment
+        lsl     x23, x21, #3             ; x23 = nstacks * 8
+        add     x23, x23, #15
+        bic     x23, x23, #15
+        sub     sp, sp, x23
+        mov     x23, sp
+
+copy_loop
+        cmp     x21, #0
+        b.eq    call_func                ; when done, branch back to call path
+        ldr     x24, [x20], #8
+        str     x24, [x23], #8
+        sub     x21, x21, #1
+        b       copy_loop
+
+; ------------------------ function entry ------------------------
+
+invokeNative
+        sub     sp, sp, #0x30
+        stp     x19, x20, [sp, #0x20]    ; save the registers
+        stp     x21, x22, [sp, #0x10]
+        stp     x23, x24, [sp, #0x0]
+
+        mov     x19, x0                  ; x19 = function ptr
+        mov     x20, x1                  ; x20 = argv
+        mov     x21, x2                  ; x21 = nstacks
+        mov     x22, sp                  ; save the sp before call function
+
+        ; Fill in floating-point registers
+        ldp     d0, d1, [x20], #16
+        ldp     d2, d3, [x20], #16
+        ldp     d4, d5, [x20], #16
+        ldp     d6, d7, [x20], #16
+
+        ; Fill integer registers
+        ldp     x0, x1, [x20], #16       ; x0 = argv[8] = exec_env, x1 = argv[9]
+        ldp     x2, x3, [x20], #16
+        ldp     x4, x5, [x20], #16
+        ldp     x6, x7, [x20], #16
+
+        ; Now x20 points to stack args
+        cmp     x21, #0
+        b.ne    handle_stack             ; backward: there are stack args
+        b       call_func                ; backward: no stack args
+
+        END
--- a/core/iwasm/common/arch/invokeNative_armasm64_simd.asm
+++ b/core/iwasm/common/arch/invokeNative_armasm64_simd.asm
@ -0,0 +1,73 @@
+        ; Copyright (C) 2019 Intel Corporation.  All rights reserved.
+        ; SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+        AREA    |.text|, CODE, READONLY, ALIGN=2
+
+        EXPORT  invokeNative
+
+; ------------------------ direct call path ------------------------
+
+call_func
+        mov     x20, x30                 ; save x30(lr)
+        blr     x19
+        mov     sp, x22                  ; restore sp saved before function call
+
+return_label
+        mov     x30,  x20                ; restore x30(lr)
+        ldp     x19, x20, [sp, #0x20]
+        ldp     x21, x22, [sp, #0x10]
+        ldp     x23, x24, [sp, #0x0]
+        add     sp, sp, #0x30
+        ret
+
+; ------------------------ stack-args path ------------------------
+
+handle_stack
+        ; Reserve aligned stack space for stack arguments and copy them
+        mov     x23, sp
+        bic     sp,  x23, #15            ; Ensure 16-byte alignment
+        lsl     x23, x21, #3             ; x23 = nstacks * 8
+        add     x23, x23, #15
+        bic     x23, x23, #15
+        sub     sp, sp, x23
+        mov     x23, sp
+
+copy_loop
+        cmp     x21, #0
+        b.eq    call_func                ; when done, branch back to call path
+        ldr     x24, [x20], #8
+        str     x24, [x23], #8
+        sub     x21, x21, #1
+        b       copy_loop
+
+; ------------------------ function entry ------------------------
+
+invokeNative
+        sub     sp, sp, #0x30
+        stp     x19, x20, [sp, #0x20]    ; save the registers
+        stp     x21, x22, [sp, #0x10]
+        stp     x23, x24, [sp, #0x0]
+
+        mov     x19, x0                  ; x19 = function ptr
+        mov     x20, x1                  ; x20 = argv
+        mov     x21, x2                  ; x21 = nstacks
+        mov     x22, sp                  ; save the sp before call function
+
+        ; Fill in floating-point registers
+        ; v0 = argv[0], v1 = argv[1], v2 = argv[2], v3 = argv[3]
+        ld1     {v0.2D, v1.2D, v2.2D, v3.2D}, [x20], #64
+        ; v4 = argv[4], v5 = argv[5], v6 = argv[6], v7 = argv[7]
+        ld1     {v4.2D, v5.2D, v6.2D, v7.2D}, [x20], #64
+
+        ; Fill integer registers
+        ldp     x0, x1, [x20], #16       ; x0 = argv[8] = exec_env, x1 = argv[9]
+        ldp     x2, x3, [x20], #16
+        ldp     x4, x5, [x20], #16
+        ldp     x6, x7, [x20], #16
+
+        ; Now x20 points to stack args
+        cmp     x21, #0
+        b.ne    handle_stack             ; (backward) there are stack args
+        b       call_func                ; (backward) no stack args
+
+        END
--- a/core/iwasm/common/iwasm_common.cmake
+++ b/core/iwasm/common/iwasm_common.cmake
@ -4,6 +4,42 @@
 set (IWASM_COMMON_DIR ${CMAKE_CURRENT_LIST_DIR})

 include_directories (${IWASM_COMMON_DIR})
+if (MSVC AND WAMR_BUILD_PLATFORM STREQUAL "windows" AND WAMR_BUILD_TARGET MATCHES "AARCH64.*")
+  if (DEFINED ENV{VCToolsInstallDir})
+    # Detect host tool dir
+    set(_ARMASM64_CANDIDATES
+        "$ENV{VCToolsInstallDir}/bin/HostX64/ARM64/armasm64.exe"
+        "$ENV{VCToolsInstallDir}/bin/HostARM64/arm64/armasm64.exe")
+    set(_ARMASM64_EXE "")
+    foreach(_p IN LISTS _ARMASM64_CANDIDATES)
+      if (EXISTS "${_p}")
+        set(_ARMASM64_EXE "${_p}")
+        break()
+      endif()
+    endforeach()
+    if (_ARMASM64_EXE STREQUAL "")
+      message(FATAL_ERROR "armasm64.exe not found under VCToolsInstallDir")
+    endif()
+
+    # Wrapper without spaces to avoid quoting hell on NMake/cmd.exe
+    set(_WRAP "${CMAKE_BINARY_DIR}/armasm64_wrapper.bat")
+    file(WRITE "${_WRAP}"
+"@echo off\r\n\"${_ARMASM64_EXE}\" %*\r\n")
+
+    # Use wrapper as compiler (no spaces in path)
+    set(CMAKE_ASM_MASM_COMPILER
+        "${_WRAP}"
+        CACHE FILEPATH "" FORCE)
+
+    # Quote ONLY object and source (compiler path has no spaces now)
+    set(CMAKE_ASM_MASM_COMPILE_OBJECT
+        "<CMAKE_ASM_MASM_COMPILER> /nologo -o \"<OBJECT>\" \"<SOURCE>\""
+        CACHE STRING "" FORCE)
+
+  else()
+    message(FATAL_ERROR "VCToolsInstallDir is not defined. Please run from a Developer Command Prompt or specify armasm64.exe manually.")
+  endif()
+endif()

 add_definitions(-DBH_MALLOC=wasm_runtime_malloc)
 add_definitions(-DBH_FREE=wasm_runtime_free)
@ -79,9 +115,37 @@ elseif (WAMR_BUILD_TARGET MATCHES "THUMB.*")
  endif ()
 elseif (WAMR_BUILD_TARGET MATCHES "AARCH64.*")
  if (NOT WAMR_BUILD_SIMD EQUAL 1)
-    set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_aarch64.s)
+    if (WAMR_BUILD_PLATFORM STREQUAL "windows")
+      if (MSVC)
+        set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_armasm64.asm)
+        set(_WAMR_ARM64_MASM_SOURCES ${IWASM_COMMON_DIR}/arch/invokeNative_armasm64.asm)
+        set_source_files_properties(${_WAMR_ARM64_MASM_SOURCES}
+          PROPERTIES
+            LANGUAGE ASM_MASM
+            COMPILE_DEFINITIONS ""
+            INCLUDE_DIRECTORIES ""
+            COMPILE_OPTIONS "/nologo"
+        )
+      endif ()
+    else ()
+      set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_aarch64.s)
+    endif ()
  else()
-    set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_aarch64_simd.s)
+    if (WAMR_BUILD_PLATFORM STREQUAL "windows")
+      if (MSVC)
+        set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_armasm64_simd.asm)
+        set(_WAMR_ARM64_MASM_SOURCES_SIMD ${IWASM_COMMON_DIR}/arch/invokeNative_armasm64_simd.asm)
+        set_source_files_properties(${_WAMR_ARM64_MASM_SOURCES_SIMD}
+          PROPERTIES
+            LANGUAGE ASM_MASM
+            COMPILE_DEFINITIONS ""
+            INCLUDE_DIRECTORIES ""
+            COMPILE_OPTIONS "/nologo"
+        )
+      endif ()
+    else ()
+      set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_aarch64_simd.s)
+    endif ()
  endif()
 elseif (WAMR_BUILD_TARGET STREQUAL "MIPS")
  set (source_all ${c_source_all} ${IWASM_COMMON_DIR}/arch/invokeNative_mips.s)
--- a/core/iwasm/common/wasm_runtime_common.c
+++ b/core/iwasm/common/wasm_runtime_common.c
@ -1623,41 +1623,45 @@ wasm_runtime_get_max_mem(uint32 max_memory_pages, uint32 module_init_page_count,
 WASMModuleInstanceCommon *
 wasm_runtime_instantiate_internal(WASMModuleCommon *module,
                                  WASMModuleInstanceCommon *parent,
-                                  WASMExecEnv *exec_env_main, uint32 stack_size,
-                                  uint32 heap_size, uint32 max_memory_pages,
+                                  WASMExecEnv *exec_env_main,
+                                  const struct InstantiationArgs2 *args,
                                  char *error_buf, uint32 error_buf_size)
 {
 #if WASM_ENABLE_INTERP != 0
    if (module->module_type == Wasm_Module_Bytecode)
        return (WASMModuleInstanceCommon *)wasm_instantiate(
            (WASMModule *)module, (WASMModuleInstance *)parent, exec_env_main,
-            stack_size, heap_size, max_memory_pages, error_buf, error_buf_size);
+            args, error_buf, error_buf_size);
 #endif
 #if WASM_ENABLE_AOT != 0
    if (module->module_type == Wasm_Module_AoT)
        return (WASMModuleInstanceCommon *)aot_instantiate(
            (AOTModule *)module, (AOTModuleInstance *)parent, exec_env_main,
-            stack_size, heap_size, max_memory_pages, error_buf, error_buf_size);
+            args, error_buf, error_buf_size);
 #endif
    set_error_buf(error_buf, error_buf_size,
                  "Instantiate module failed, invalid module type");
    return NULL;
 }

+void
+wasm_runtime_instantiation_args_set_defaults(struct InstantiationArgs2 *args)
+{
+    memset(args, 0, sizeof(*args));
+}
+
 WASMModuleInstanceCommon *
 wasm_runtime_instantiate(WASMModuleCommon *module, uint32 stack_size,
                         uint32 heap_size, char *error_buf,
                         uint32 error_buf_size)
 {
-    return wasm_runtime_instantiate_internal(module, NULL, NULL, stack_size,
-                                             heap_size, 0, error_buf,
-                                             error_buf_size);
-}
-
-static void
-instantiation_args_set_defaults(struct InstantiationArgs2 *args)
-{
-    memset(args, 0, sizeof(*args));
+    struct InstantiationArgs2 args;
+    wasm_runtime_instantiation_args_set_defaults(&args);
+    wasm_runtime_instantiation_args_set_default_stack_size(&args, stack_size);
+    wasm_runtime_instantiation_args_set_host_managed_heap_size(&args,
+                                                               heap_size);
+    return wasm_runtime_instantiate_internal(module, NULL, NULL, &args,
+                                             error_buf, error_buf_size);
 }

 WASMModuleInstanceCommon *
@ -1666,7 +1670,7 @@ wasm_runtime_instantiate_ex(WASMModuleCommon *module,
                            uint32 error_buf_size)
 {
    struct InstantiationArgs2 v2;
-    instantiation_args_set_defaults(&v2);
+    wasm_runtime_instantiation_args_set_defaults(&v2);
    v2.v1 = *args;
    return wasm_runtime_instantiate_ex2(module, &v2, error_buf, error_buf_size);
 }
@ -1678,7 +1682,7 @@ wasm_runtime_instantiation_args_create(struct InstantiationArgs2 **p)
    if (args == NULL) {
        return false;
    }
-    instantiation_args_set_defaults(args);
+    wasm_runtime_instantiation_args_set_defaults(args);
    *p = args;
    return true;
 }
@ -1715,10 +1719,8 @@ wasm_runtime_instantiate_ex2(WASMModuleCommon *module,
                             const struct InstantiationArgs2 *args,
                             char *error_buf, uint32 error_buf_size)
 {
-    return wasm_runtime_instantiate_internal(
-        module, NULL, NULL, args->v1.default_stack_size,
-        args->v1.host_managed_heap_size, args->v1.max_memory_pages, error_buf,
-        error_buf_size);
+    return wasm_runtime_instantiate_internal(module, NULL, NULL, args,
+                                             error_buf, error_buf_size);
 }

 void
@ -7666,9 +7668,8 @@ delete_loading_module:
 bool
 wasm_runtime_sub_module_instantiate(WASMModuleCommon *module,
                                    WASMModuleInstanceCommon *module_inst,
-                                    uint32 stack_size, uint32 heap_size,
-                                    uint32 max_memory_pages, char *error_buf,
-                                    uint32 error_buf_size)
+                                    const struct InstantiationArgs2 *args,
+                                    char *error_buf, uint32 error_buf_size)
 {
    bh_list *sub_module_inst_list = NULL;
    WASMRegisteredModule *sub_module_list_node = NULL;
@ -7696,8 +7697,7 @@ wasm_runtime_sub_module_instantiate(WASMModuleCommon *module,
        WASMModuleCommon *sub_module = sub_module_list_node->module;
        WASMModuleInstanceCommon *sub_module_inst = NULL;
        sub_module_inst = wasm_runtime_instantiate_internal(
-            sub_module, NULL, NULL, stack_size, heap_size, max_memory_pages,
-            error_buf, error_buf_size);
+            sub_module, NULL, NULL, args, error_buf, error_buf_size);
        if (!sub_module_inst) {
            LOG_DEBUG("instantiate %s failed",
                      sub_module_list_node->module_name);
--- a/core/iwasm/common/wasm_runtime_common.h
+++ b/core/iwasm/common/wasm_runtime_common.h
@ -616,6 +616,9 @@ struct InstantiationArgs2 {
    InstantiationArgs v1;
 };

+void
+wasm_runtime_instantiation_args_set_defaults(struct InstantiationArgs2 *args);
+
 /* See wasm_export.h for description */
 WASM_RUNTIME_API_EXTERN bool
 wasm_runtime_init(void);
@ -683,8 +686,8 @@ wasm_runtime_get_max_mem(uint32 max_memory_pages, uint32 module_init_page_count,
 WASMModuleInstanceCommon *
 wasm_runtime_instantiate_internal(WASMModuleCommon *module,
                                  WASMModuleInstanceCommon *parent,
-                                  WASMExecEnv *exec_env_main, uint32 stack_size,
-                                  uint32 heap_size, uint32 max_memory_pages,
+                                  WASMExecEnv *exec_env_main,
+                                  const struct InstantiationArgs2 *args,
                                  char *error_buf, uint32 error_buf_size);

 /* Internal API */
@ -1064,9 +1067,8 @@ wasm_runtime_load_depended_module(const WASMModuleCommon *parent_module,
 bool
 wasm_runtime_sub_module_instantiate(WASMModuleCommon *module,
                                    WASMModuleInstanceCommon *module_inst,
-                                    uint32 stack_size, uint32 heap_size,
-                                    uint32 max_memory_pages, char *error_buf,
-                                    uint32 error_buf_size);
+                                    const struct InstantiationArgs2 *args,
+                                    char *error_buf, uint32 error_buf_size);
 void
 wasm_runtime_sub_module_deinstantiate(WASMModuleInstanceCommon *module_inst);
 #endif
--- a/core/iwasm/compilation/aot_emit_control.c
+++ b/core/iwasm/compilation/aot_emit_control.c
@ -495,15 +495,17 @@ push_aot_block_to_stack_and_pass_params(AOTCompContext *comp_ctx,

        /* Create param phis */
        for (i = 0; i < block->param_count; i++) {
-            SET_BUILDER_POS(block->llvm_entry_block);
-            snprintf(name, sizeof(name), "%s%d_phi%d",
-                     block_name_prefix[block->label_type], block->block_index,
-                     i);
-            if (!(block->param_phis[i] = LLVMBuildPhi(
-                      comp_ctx->builder, TO_LLVM_TYPE(block->param_types[i]),
-                      name))) {
-                aot_set_last_error("llvm build phi failed.");
-                goto fail;
+            if (block->llvm_entry_block) {
+                SET_BUILDER_POS(block->llvm_entry_block);
+                snprintf(name, sizeof(name), "%s%d_phi%d",
+                         block_name_prefix[block->label_type],
+                         block->block_index, i);
+                if (!(block->param_phis[i] = LLVMBuildPhi(
+                          comp_ctx->builder,
+                          TO_LLVM_TYPE(block->param_types[i]), name))) {
+                    aot_set_last_error("llvm build phi failed.");
+                    goto fail;
+                }
            }

            if (block->label_type == LABEL_TYPE_IF
--- a/core/iwasm/compilation/aot_llvm_extra2.cpp
+++ b/core/iwasm/compilation/aot_llvm_extra2.cpp
@ -157,8 +157,13 @@ LLVMCreateTargetMachineWithOpts(LLVMTargetRef ctarget, const char *triple,
    auto ol = convert(opt_level);
    bool jit;
    auto cm = convert(code_model, &jit);
+#if LLVM_VERSION_MAJOR >= 21
+    auto targetmachine = target->createTargetMachine(
+        llvm::Triple(triple), cpu, features, opts, rm, cm, ol, jit);
+#else
    auto targetmachine = target->createTargetMachine(triple, cpu, features,
                                                     opts, rm, cm, ol, jit);
+#endif
 #if LLVM_VERSION_MAJOR >= 18
    // always place data in normal data section.
    //
--- a/core/iwasm/include/wasm_export.h
+++ b/core/iwasm/include/wasm_export.h
@ -1526,6 +1526,14 @@ wasm_runtime_get_native_addr_range(wasm_module_inst_t module_inst,
 /**
 * Get the number of import items for a WASM module
 *
+ * Typical usage scenario:
+ * Combine this function with wasm_runtime_get_import_count() to traverse
+ * all import items in a module. Use import_type.kind to filter and identify
+ * different types of import items.
+ *
+ * Example usage (as wasm_runtime_for_each_import_func() in
+ * samples/import-func-callback)
+ *
 * @param module the WASM module
 *
 * @return the number of imports (zero for none), or -1 for failure
@ -1536,6 +1544,14 @@ wasm_runtime_get_import_count(const wasm_module_t module);
 /**
 * Get information about a specific WASM module import
 *
+ * Typical usage scenario:
+ * Combine this function with wasm_runtime_get_import_count() to traverse
+ * all import items in a module. Use import_type.kind to filter and identify
+ * different types of import items.
+ *
+ * Example usage (as wasm_runtime_for_each_import_func() in
+ * samples/import-func-callback)
+ *
 * @param module the WASM module
 * @param import_index the desired import index
 * @param import_type the location to store information about the import
--- a/core/iwasm/interpreter/wasm_interp_classic.c
+++ b/core/iwasm/interpreter/wasm_interp_classic.c
@ -3165,7 +3165,7 @@ wasm_interp_call_func_bytecode(WASMModuleInstance *module,

                        if (len > 0) {
                            if ((uint64)start_offset + len
-                                >= wasm_array_obj_length(array_obj)) {
+                                > wasm_array_obj_length(array_obj)) {
                                wasm_set_exception(
                                    module, "out of bounds array access");
                                goto got_exception;
--- a/core/iwasm/interpreter/wasm_interp_fast.c
+++ b/core/iwasm/interpreter/wasm_interp_fast.c
@ -2562,7 +2562,7 @@ wasm_interp_call_func_bytecode(WASMModuleInstance *module,

                        if (len > 0) {
                            if ((uint64)start_offset + len
-                                >= wasm_array_obj_length(array_obj)) {
+                                > wasm_array_obj_length(array_obj)) {
                                wasm_set_exception(
                                    module, "out of bounds array access");
                                goto got_exception;
@ -5057,6 +5057,10 @@ wasm_interp_call_func_bytecode(WASMModuleInstance *module,
                    PUT_I64_TO_ADDR((uint32 *)(frame_lp + local_offset),
                                    GET_I64_FROM_ADDR(frame_lp + addr1));
                }
+                else if (local_type == VALUE_TYPE_V128) {
+                    PUT_V128_TO_ADDR((frame_lp + local_offset),
+                                     GET_V128_FROM_ADDR(frame_lp + addr1));
+                }
 #if WASM_ENABLE_GC != 0
                else if (wasm_is_type_reftype(local_type)) {
                    PUT_REF_TO_ADDR((uint32 *)(frame_lp + local_offset),
--- a/core/iwasm/interpreter/wasm_loader.c
+++ b/core/iwasm/interpreter/wasm_loader.c
@ -8542,6 +8542,15 @@ check_offset_pop(WASMLoaderContext *ctx, uint32 cells)
    return true;
 }

+static bool
+check_dynamic_offset_pop(WASMLoaderContext *ctx, uint32 cells)
+{
+    if (ctx->dynamic_offset < 0
+        || (ctx->dynamic_offset > 0 && (uint32)ctx->dynamic_offset < cells))
+        return false;
+    return true;
+}
+
 static void
 free_label_patch_list(BranchBlock *frame_csp)
 {
@ -9980,7 +9989,8 @@ wasm_loader_pop_frame_offset(WASMLoaderContext *ctx, uint8 type,
        return true;

    ctx->frame_offset -= cell_num_to_pop;
-    if ((*(ctx->frame_offset) > ctx->start_dynamic_offset)
+    if (check_dynamic_offset_pop(ctx, cell_num_to_pop)
+        && (*(ctx->frame_offset) > ctx->start_dynamic_offset)
        && (*(ctx->frame_offset) < ctx->max_dynamic_offset))
        ctx->dynamic_offset -= cell_num_to_pop;

@ -12050,9 +12060,25 @@ re_scan:
                    WASMFuncType *wasm_type = block_type.u.type;

                    BranchBlock *cur_block = loader_ctx->frame_csp - 1;
+#if WASM_ENABLE_GC != 0
+                    WASMRefType *ref_type;
+                    uint32 j = 0;
+#endif
 #if WASM_ENABLE_FAST_INTERP != 0
                    uint32 cell_num;
                    available_params = block_type.u.type->param_count;
+#endif
+#if WASM_ENABLE_GC != 0
+                    /* find the index of the last param
+                     * in wasm_type->ref_type_maps as j */
+                    for (i = 0; i < block_type.u.type->param_count; i++) {
+                        if (wasm_is_type_multi_byte_type(wasm_type->types[i])) {
+                            j += 1;
+                        }
+                    }
+                    if (j > 0) {
+                        j -= 1;
+                    }
 #endif
                    for (i = 0; i < block_type.u.type->param_count; i++) {

@ -12066,6 +12092,19 @@ re_scan:
 #endif
                            break;
                        }
+#if WASM_ENABLE_GC != 0
+                        if (wasm_is_type_multi_byte_type(
+                                wasm_type
+                                    ->types[wasm_type->param_count - i - 1])) {
+                            bh_assert(wasm_type->ref_type_maps[j].index
+                                      == wasm_type->param_count - i - 1);
+                            ref_type = wasm_type->ref_type_maps[j].ref_type;
+                            bh_memcpy_s(&wasm_ref_type, sizeof(WASMRefType),
+                                        ref_type,
+                                        wasm_reftype_struct_size(ref_type));
+                            j--;
+                        }
+#endif

                        POP_TYPE(
                            wasm_type->types[wasm_type->param_count - i - 1]);
--- a/core/iwasm/interpreter/wasm_mini_loader.c
+++ b/core/iwasm/interpreter/wasm_mini_loader.c
@ -4342,6 +4342,15 @@ check_offset_pop(WASMLoaderContext *ctx, uint32 cells)
    return true;
 }

+static bool
+check_dynamic_offset_pop(WASMLoaderContext *ctx, uint32 cells)
+{
+    if (ctx->dynamic_offset < 0
+        || (ctx->dynamic_offset > 0 && (uint32)ctx->dynamic_offset < cells))
+        return false;
+    return true;
+}
+
 static void
 free_label_patch_list(BranchBlock *frame_csp)
 {
@ -5256,7 +5265,8 @@ wasm_loader_pop_frame_offset(WASMLoaderContext *ctx, uint8 type,
        return true;

    ctx->frame_offset -= cell_num_to_pop;
-    if ((*(ctx->frame_offset) > ctx->start_dynamic_offset)
+    if (check_dynamic_offset_pop(ctx, cell_num_to_pop)
+        && (*(ctx->frame_offset) > ctx->start_dynamic_offset)
        && (*(ctx->frame_offset) < ctx->max_dynamic_offset))
        ctx->dynamic_offset -= cell_num_to_pop;

--- a/core/iwasm/interpreter/wasm_runtime.c
+++ b/core/iwasm/interpreter/wasm_runtime.c
@ -2421,8 +2421,8 @@ wasm_set_running_mode(WASMModuleInstance *module_inst, RunningMode running_mode)
 */
 WASMModuleInstance *
 wasm_instantiate(WASMModule *module, WASMModuleInstance *parent,
-                 WASMExecEnv *exec_env_main, uint32 stack_size,
-                 uint32 heap_size, uint32 max_memory_pages, char *error_buf,
+                 WASMExecEnv *exec_env_main,
+                 const struct InstantiationArgs2 *args, char *error_buf,
                 uint32 error_buf_size)
 {
    WASMModuleInstance *module_inst;
@ -2440,6 +2440,9 @@ wasm_instantiate(WASMModule *module, WASMModuleInstance *parent,
    bool ret = false;
 #endif
    const bool is_sub_inst = parent != NULL;
+    uint32 stack_size = args->v1.default_stack_size;
+    uint32 heap_size = args->v1.host_managed_heap_size;
+    uint32 max_memory_pages = args->v1.max_memory_pages;

    if (!module)
        return NULL;
@ -2515,7 +2518,7 @@ wasm_instantiate(WASMModule *module, WASMModuleInstance *parent,
        &module_inst->e->sub_module_inst_list_head;
    ret = wasm_runtime_sub_module_instantiate(
        (WASMModuleCommon *)module, (WASMModuleInstanceCommon *)module_inst,
-        stack_size, heap_size, max_memory_pages, error_buf, error_buf_size);
+        args, error_buf, error_buf_size);
    if (!ret) {
        LOG_DEBUG("build a sub module list failed");
        goto fail;
--- a/core/iwasm/interpreter/wasm_runtime.h
+++ b/core/iwasm/interpreter/wasm_runtime.h
@ -553,8 +553,8 @@ wasm_resolve_import_func(const WASMModule *module,

 WASMModuleInstance *
 wasm_instantiate(WASMModule *module, WASMModuleInstance *parent,
-                 WASMExecEnv *exec_env_main, uint32 stack_size,
-                 uint32 heap_size, uint32 max_memory_pages, char *error_buf,
+                 WASMExecEnv *exec_env_main,
+                 const struct InstantiationArgs2 *args, char *error_buf,
                 uint32 error_buf_size);

 void
--- a/core/iwasm/libraries/lib-pthread/lib_pthread_wrapper.c
+++ b/core/iwasm/libraries/lib-pthread/lib_pthread_wrapper.c
@ -561,6 +561,7 @@ pthread_create_wrapper(wasm_exec_env_t exec_env,
    uint32 aux_stack_size;
    uint64 aux_stack_start = 0;
    int32 ret = -1;
+    struct InstantiationArgs2 args;

    bh_assert(module);
    bh_assert(module_inst);
@ -579,8 +580,10 @@ pthread_create_wrapper(wasm_exec_env_t exec_env,
    }
 #endif

+    wasm_runtime_instantiation_args_set_defaults(&args);
+    wasm_runtime_instantiation_args_set_default_stack_size(&args, stack_size);
    if (!(new_module_inst = wasm_runtime_instantiate_internal(
-              module, module_inst, exec_env, stack_size, 0, 0, NULL, 0)))
+              module, module_inst, exec_env, &args, NULL, 0)))
        return -1;

    /* Set custom_data to new module instance */
--- a/core/iwasm/libraries/lib-wasi-threads/lib_wasi_threads_wrapper.c
+++ b/core/iwasm/libraries/lib-wasi-threads/lib_wasi_threads_wrapper.c
@ -80,14 +80,17 @@ thread_spawn_wrapper(wasm_exec_env_t exec_env, uint32 start_arg)
    int32 thread_id;
    uint32 stack_size = 8192;
    int32 ret = -1;
+    struct InstantiationArgs2 args;

    bh_assert(module);
    bh_assert(module_inst);

    stack_size = ((WASMModuleInstance *)module_inst)->default_wasm_stack_size;

+    wasm_runtime_instantiation_args_set_defaults(&args);
+    wasm_runtime_instantiation_args_set_default_stack_size(&args, stack_size);
    if (!(new_module_inst = wasm_runtime_instantiate_internal(
-              module, module_inst, exec_env, stack_size, 0, 0, NULL, 0)))
+              module, module_inst, exec_env, &args, NULL, 0)))
        return -1;

    wasm_runtime_set_custom_data_internal(
--- a/core/iwasm/libraries/thread-mgr/thread_manager.c
+++ b/core/iwasm/libraries/thread-mgr/thread_manager.c
@ -501,13 +501,16 @@ wasm_cluster_spawn_exec_env(WASMExecEnv *exec_env)
    uint32 aux_stack_size;
    uint64 aux_stack_start;
    uint32 stack_size = 8192;
+    struct InstantiationArgs2 args;

    if (!module_inst || !(module = wasm_exec_env_get_module(exec_env))) {
        return NULL;
    }

+    wasm_runtime_instantiation_args_set_defaults(&args);
+    wasm_runtime_instantiation_args_set_default_stack_size(&args, stack_size);
    if (!(new_module_inst = wasm_runtime_instantiate_internal(
-              module, module_inst, exec_env, stack_size, 0, 0, NULL, 0))) {
+              module, module_inst, exec_env, &args, NULL, 0))) {
        return NULL;
    }

--- a/core/shared/platform/common/math/math.c
+++ b/core/shared/platform/common/math/math.c
@ -851,7 +851,7 @@ freebsd_floor(double x)
                    i0 += 1;
                else {
                    j = i1 + (1 << (52 - j0));
-                    if (j < i1)
+                    if (j < (u_int32_t)i1)
                        i0 += 1; /* got a carry */
                    i1 = j;
                }
@ -913,7 +913,7 @@ freebsd_ceil(double x)
                    i0 += 1;
                else {
                    j = i1 + (1 << (52 - j0));
-                    if (j < i1)
+                    if (j < (u_int32_t)i1)
                        i0 += 1; /* got a carry */
                    i1 = j;
                }
@ -1345,7 +1345,7 @@ freebsd_pow(double x, double y)
            k = (iy >> 20) - 0x3ff; /* exponent */
            if (k > 20) {
                j = ly >> (52 - k);
-                if ((j << (52 - k)) == ly)
+                if (((u_int32_t)(j << (52 - k))) == ly)
                    yisint = 2 - (j & 1);
            }
            else if (ly == 0) {
--- a/core/shared/platform/linux-sgx/sgx_platform.c
+++ b/core/shared/platform/linux-sgx/sgx_platform.c
@ -131,8 +131,9 @@ os_is_handle_valid(os_file_handle *handle)
 /* implemented in posix_file.c */
 #endif

-void *
-os_mmap(void *hint, size_t size, int prot, int flags, os_file_handle file)
+static void *
+os_mmap_internal(void *hint, size_t size, int prot, int flags,
+                 os_file_handle file, bool clear)
 {
    int mprot = 0;
    uint64 aligned_size, page_size;
@ -161,6 +162,10 @@ os_mmap(void *hint, size_t size, int prot, int flags, os_file_handle file)
        return NULL;
    }

+    if (clear) {
+        memset(ret, 0, aligned_size);
+    }
+
    if (prot & MMAP_PROT_READ)
        mprot |= SGX_PROT_READ;
    if (prot & MMAP_PROT_WRITE)
@ -179,6 +184,30 @@ os_mmap(void *hint, size_t size, int prot, int flags, os_file_handle file)
    return ret;
 }

+void *
+os_mmap(void *hint, size_t size, int prot, int flags, os_file_handle file)
+{
+    return os_mmap_internal(hint, size, prot, flags, file, true);
+}
+
+void *
+os_mremap(void *old_addr, size_t old_size, size_t new_size)
+{
+    void *new_memory =
+        os_mmap_internal(NULL, new_size, MMAP_PROT_WRITE | MMAP_PROT_READ, 0,
+                         os_get_invalid_handle(), false);
+    if (!new_memory) {
+        return NULL;
+    }
+    size_t copy_size = new_size < old_size ? new_size : old_size;
+    memcpy(new_memory, old_addr, copy_size);
+    if (new_size > copy_size) {
+        memset((char *)new_memory + copy_size, 0, new_size - copy_size);
+    }
+    os_munmap(old_addr, old_size);
+    return new_memory;
+}
+
 void
 os_munmap(void *addr, size_t size)
 {
@ -216,8 +245,10 @@ os_mprotect(void *addr, size_t size, int prot)

 void
 os_dcache_flush(void)
-{}
+{
+}

 void
 os_icache_flush(void *start, size_t len)
-{}
+{
+}
--- a/core/shared/platform/linux-sgx/shared_platform.cmake
+++ b/core/shared/platform/linux-sgx/shared_platform.cmake
@ -37,9 +37,6 @@ else()
  set(source_all ${source_all} ${PLATFORM_COMMON_LIBC_UTIL_SOURCE})
 endif()

-include (${CMAKE_CURRENT_LIST_DIR}/../common/memory/platform_api_memory.cmake)
-set (source_all ${source_all} ${PLATFORM_COMMON_MEMORY_SOURCE})
-
 file (GLOB source_all_untrusted ${PLATFORM_SHARED_DIR}/untrusted/*.c)

 set (PLATFORM_SHARED_SOURCE ${source_all})
--- a/core/shared/platform/zephyr/platform_internal.h
+++ b/core/shared/platform/zephyr/platform_internal.h
@ -308,7 +308,9 @@ typedef struct {
 #define CLOCK_REALTIME 1
 #endif

+#ifndef CLOCK_MONOTONIC
 #define CLOCK_MONOTONIC 4
+#endif

 static inline int
 os_sched_yield(void)
--- a/core/version.h
+++ b/core/version.h
@ -18,7 +18,7 @@
 /* clang-format off */
 #define WAMR_VERSION_MAJOR 2
 #define WAMR_VERSION_MINOR 4
-#define WAMR_VERSION_PATCH 1
+#define WAMR_VERSION_PATCH 3
 /* clang-format on */

 #endif
--- a/doc/build_wamr.md
+++ b/doc/build_wamr.md
@ -20,6 +20,8 @@ add_library(vmlib ${WAMR_RUNTIME_LIB_SOURCE})

 The script `runtime_lib.cmake` defines a number of variables for configuring the WAMR runtime features. You can set these variables in your CMakeList.txt or pass the configurations from cmake command line.

+Please refer to [a full list of configuration options](./tired_support.md#appendix-all-compilation-flags).
+
 ### **Configure platform and architecture**

 - **WAMR_BUILD_PLATFORM**:  set the target platform. It can be set to any platform name (folder name) under folder [core/shared/platform](../core/shared/platform).
--- a/doc/security_need_to_know.md
+++ b/doc/security_need_to_know.md
@ -15,10 +15,41 @@ It is commonly stated that a security issue is an issue that:

 Given that WASI is a set of Capability-based APIs, all unauthorized actions are not supposed to happen. Most of the above security concerns can be alleviated. What remains for us is to ensure that the execution of Wasm modules is secure. In other words, do not compromise the sandbox. Unless it is explicitly disabled beforehand.

-Thus, we share most of the criteria for judging security issues with [the Bytecode Alliance](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#definition).
+### Is this bug considered a security vulnerability?

-> [!NOTE]
-> keep updating this document as the project evolves.
+#### For someone who finds a problem
+
+if a bug **results in crash or hang**, please treat it as a security problem and report it to a security advisor. The maintainer will look into it and change its category if needed. It is better safe than sorry.
+
+If the author of an issue(results in crash or hang) can go through the following checklist and answer all questions with "No", it is fine to mark it as a regular bug. If not, please report it as a security issue.
+
+---
+
+#### For those maintainers
+
+please use the following guidelines to determine if a bug or advisory is a security issue:
+
+Only bugs that affect [tier A platforms or features](./tiered_support.md) should be considered.
+
+Actions that differ from Wasm rules (like calculating wrong values) are not seen as security issues as long as they stay within the sandbox.
+
+By default, native APIs and CLIs are following the principle of **caller guarantee**. If the caller provides incorrect parameters or users input malformed options, it is not a security issue. For example, if a user passes an invalid file descriptor to `fd_read`, it is not a security issue.
+
+.wasm are not trusted. Malformed .wasm files should be handled gracefully. If a .wasm file causes a runtime crash or hang, it is a security issue. On the other hand, it's expected that aot runtime alone doesn't provide the same guarantee. So user-crafted .aot can cause anything, including crashes or hangs. They are not considered security issues.
+
+A denial-of-service (DoS) attack is a cyberattack that aims to make a computer or network resource unavailable to its users. If the service (runtime in this case) can recover and start another module or run another function within the same instance, it is not considered unavailable, and thus not a Denial of Service (DoS).
+
+Another type of execution problem we usually do not classify as a security one is if it is caused by an infinite loop or incorrect recursive function call chain.
+
+### When a maintainer identify a problem that should be classified as a security vulnerability
+
+Once a maintainer realizes an issue or PR describes a real or possible security vulnerability, act quickly to minimize exposure. Do not share technical details publicly on the issue or PR anymore. Maintainers should:
+
+- Close or edit the public discussion. Thank the person who reported it and explain that security-related issues should go through the Security Advisory process. Close the public issue or pull request as soon as possible to prevent further public sharing. If details have already been shared, consider editing or asking GitHub staff to remove sensitive content.
+
+- Create a Security Advisory. Invite the reporter to join as a collaborator or reporter. If the reporter is uncomfortable using GitHub Security Advisories, offer another private communication method, such as email.
+
+- Follow the guidelines in [the security issue runbook](./security_issue_runbook.md) for the next steps.

 ## reporting a security issue

@ -26,8 +57,4 @@ Follow the [same guidelines](https://bytecodealliance.org/security) as other pro

 ## managing a security issue

-Before reporting an issue, particularly one related to crashing, consult [the cheat sheet](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#cheat-sheet-is-this-bug-considered-a-security-vulnerability), _Report a security vulnerability_ if it qualifies.
-
-Upon receiving an issue, thoroughly review [the cheat sheet](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#cheat-sheet-is-this-bug-considered-a-security-vulnerability) to assess and _Report a security vulnerability_ if the issue is indeed a security vulnerability.
-
 Once a security issue is confirmed, please refer to [the runbook](./security_issue_runbook.md) for the subsequent steps to take.
--- a/doc/tiered_support.md
+++ b/doc/tiered_support.md
@ -0,0 +1,196 @@
+# Tiered Supported
+
+**Tier definitions**
+
+- **A — Production Ready:** fully tested and stable.
+- **B — Almost Production Ready:** partially tested; close to production.
+- **C — Experimental / Not Production Ready:** unfinished or volatile.
+
+The condition _tested_ mentioned above specifically refers to whether there are enough tests in CI.
+
+## Architecture Support
+
+| Architecture | Tier  |
+| ------------ | ----- |
+| **x86-64**   | **A** |
+| **x86-32**   | **A** |
+| AArch64      | B     |
+| ARC          | B     |
+| ARM          | B     |
+| RISCV32      | B     |
+| RISCV64      | B     |
+| THUMB        | B     |
+| XTENSA       | B     |
+| MIPS         | C     |
+
+## OS / Platform Support
+
+| Platform           | Tier  |
+| ------------------ | ----- |
+| **NuttX**          | **A** |
+| **Ubuntu**         | **A** |
+| Android            | B     |
+| macOS              | B     |
+| Windows            | B     |
+| Zephyr             | B     |
+| AliOS-Things       | C     |
+| Cosmopolitan       | C     |
+| ESP-IDF (FreeRTOS) | C     |
+| FreeBSD            | C     |
+| iOS                | C     |
+| RT-Thread          | C     |
+| RIOT               | C     |
+| VxWorks            | C     |
+
+## WebAssembly Proposal Support
+
+> During configuration, It is able to disable or enable the following features by setting the corresponding flags (see Appendix). It is also possible to check features status in the configuration output.
+
+| WASM Proposal / Extension              | Tier        |
+| -------------------------------------- | ----------- |
+| **Bulk Memory**                        | A           |
+| **Extended Constant Expressions**      | A           |
+| **Import/Export of Mutable Globals**   | A           |
+| **Memory64**                           | A           |
+| **Multi-value**                        | A           |
+| **Non-trapping float-to-int**          | A           |
+| **Reference Types**                    | A           |
+| **Shared Memory (Threads)**            | A           |
+| **SIMD (128-bit)**                     | A           |
+| **Sign-extension Operators**           | A           |
+| GC (Garbage Collection)                | B           |
+| Stringref                              | B           |
+| Tail Calls                             | B           |
+| Multi-memory                           | C           |
+| Legacy Exception Handling              | C           |
+| Branch Hinting                         | Unsupported |
+| Custom Annotation Syntax (text format) | Unsupported |
+| Exception Handling (new spec)          | Unsupported |
+| JS String Builtins                     | Unsupported |
+| Relaxed SIMD                           | Unsupported |
+
+# WAMR-Specific Feature Support
+
+> During configuration, It is able to disable or enable the following features by setting the corresponding flags (see Appendix). It is also possible to check features status in the configuration output.
+
+| WAMR Feature                      | Tier |
+| --------------------------------- | ---- |
+| **AoT (wamrc)**                   | A    |
+| **AOT intrinsics**                | A    |
+| **Fast Interpreter**              | A    |
+| **Interpreter (classic)**         | A    |
+| **Libc builtin**                  | A    |
+| **Libc WASI**                     | A    |
+| **Quick AOT/JIT entries**         | A    |
+| **Shrunk memory**                 | A    |
+| **Wakeup of blocking operations** | A    |
+| **WASM C API**                    | A    |
+| Fast JIT                          | B    |
+| LLVM ORC JIT                      | B    |
+| Memory profiling                  | B    |
+| Module instance context[^7]       | B    |
+| Multi-module                      | B    |
+| Perf profiling                    | B    |
+| Pthread                           | B    |
+| Shared heap                       | B    |
+| WASI threads                      | B    |
+| WASI-NN (neural network APIs)     | B    |
+| Debug Interpreter                 | B    |
+| Debug AOT                         | C    |
+| Tier-up (Fast JIT → LLVM JIT)     | C    |
+
+---
+
+# Appendix: All compilation flags
+
+| Compilation flags                           | Tiered | Default | on Ubuntu |
+| ------------------------------------------- | ------ | ------- | --------- |
+| WAMR_APP_THREAD_STACK_SIZE_MAX              | B      | ND[^1]  |           |
+| WAMR_BH_LOG                                 | B      | ND      |           |
+| WAMR_BH_VPRINTF                             | B      | ND      |           |
+| WAMR_BUILD_ALLOC_WITH_USAGE                 | B      | ND      |           |
+| WAMR_BUILD_ALLOC_WITH_USER_DATA             | B      | ND      |           |
+| WAMR_BUILD_AOT                              | A      | ND      | 1         |
+| WAMR_BUILD_AOT_INTRINSICS                   | A      | 1[^2]   |           |
+| WAMR_BUILD_AOT_STACK_FRAME                  | A      | ND      |           |
+| WAMR_BUILD_AOT_VALIDATOR                    | B      | ND      |           |
+| WAMR_BUILD_BULK_MEMORY                      | A      | 1       |           |
+| WAMR_BUILD_COPY_CALL_STACK                  | B      | ND      |           |
+| WAMR_BUILD_CUSTOM_NAME_SECTION              | B      | ND      |           |
+| WAMR_BUILD_DEBUG_AOT                        | C      | ND      |           |
+| WAMR_BUILD_DEBUG_INTERP                     | B      | ND      |           |
+| WAMR_BUILD_DUMP_CALL_STACK                  | B      | ND      |           |
+| WAMR_BUILD_DYNAMIC_AOT_DEBUG                | C      | ND      |           |
+| WAMR_BUILD_EXCE_HANDLING                    | C      | 0       |           |
+| WAMR_BUILD_EXTENDED_CONST_EXPR              | A      | 0       |           |
+| WAMR_BUILD_FAST_INTERP                      | A      | ND      | 1         |
+| WAMR_BUILD_FAST_JIT                         | B      | ND      |           |
+| WAMR_BUILD_FAST_JIT_DUMP                    | B      | ND      |           |
+| WAMR_BUILD_GC                               | B      | 0       |           |
+| WAMR_BUILD_GC_HEAP_VERIFY                   | B      | ND      |           |
+| WAMR_BUILD_GLOBAL_HEAP_POOL                 | A      | ND      |           |
+| WAMR_BUILD_GLOBAL_HEAP_SIZE                 | A      | ND      |           |
+| WAMR_BUILD_INSTRUCTION_METERING             | C      | ND      |           |
+| WAMR_BUILD_INTERP                           | A      | ND      | 1         |
+| WAMR_BUILD_INVOKE_NATIVE_GENERAL            | B      | ND      |           |
+| WAMR_BUILD_JIT                              | B      | ND      |           |
+| WAMR_BUILD_LAZY_JIT                         | B      | 1[^3]   |           |
+| WAMR_BUILD_LIBC_BUILTIN                     | A      | ND      | 1         |
+| WAMR_BUILD_LIBC_EMCC                        | C      | ND      |           |
+| WAMR_BUILD_LIBC_UVWASI                      | C      | ND      |           |
+| WAMR_BUILD_LIBC_WASI                        | A      | ND      | 1         |
+| WAMR_BUILD_LIB_PTHREAD                      | B      | ND      |           |
+| WAMR_BUILD_LIB_PTHREAD_SEMAPHORE            | B      | ND      |           |
+| WAMR_BUILD_LIB_RATS                         | C      | ND      |           |
+| WAMR_BUILD_LIB_WASI_THREADS                 | B      | ND      |           |
+| WAMR_BUILD_LINUX_PERF                       | B      | ND      |           |
+| WAMR_BUILD_LIME1                            | A      | NO      |           |
+| WAMR_BUILD_LOAD_CUSTOM_SECTION              | A      | ND      |           |
+| WAMR_BUILD_MEMORY64                         | A      | 0       |           |
+| WAMR_BUILD_MEMORY_PROFILING                 | B      | ND      |           |
+| WAMR_BUILD_MINI_LOADER                      | B      | ND      |           |
+| WAMR_BUILD_MODULE_INST_CONTEXT              | B      | ND      | 1         |
+| WAMR_BUILD_MULTI_MEMORY                     | C      | 0       |           |
+| WAMR_BUILD_MULTI_MODULE                     | B      | ND      |           |
+| WAMR_BUILD_PERF_PROFILING                   | B      | ND      |           |
+| WAMR_BUILD_PLATFORM                         | -      | ND      | linux     |
+| WAMR_BUILD_QUICK_AOT_ENTRY                  | A      | 1[^4]   |           |
+| WAMR_BUILD_REF_TYPES                        | A      | ND      | 1         |
+| WAMR_BUILD_SANITIZER                        | B      | ND      |           |
+| WAMR_BUILD_SGX_IPFS                         | C      | ND      |           |
+| WAMR_BUILD_SHARED_HEAP                      | A      | ND      |           |
+| WAMR_BUILD_SHARED_MEMORY                    | A      | 0       | 1         |
+| WAMR_BUILD_SHRUNK_MEMORY                    | A      | ND      | 1         |
+| WAMR_BUILD_SIMD                             | A      | ND      | 1         |
+| WAMR_BUILD_SIMDE                            | A      | ND      | 1         |
+| WAMR_BUILD_SPEC_TEST                        | A      | ND      |           |
+| WAMR_BUILD_STACK_GUARD_SIZE                 | B      | ND      |           |
+| WAMR_BUILD_STATIC_PGO                       | B      | ND      |           |
+| WAMR_BUILD_STRINGREF                        | B      | 0       |           |
+| WAMR_BUILD_TAIL_CALL                        | A      | 0       | 1         |
+| WAMR_BUILD_TARGET                           | -      | ND      | X86-64    |
+| WAMR_BUILD_THREAD_MGR                       | A      | ND      |           |
+| WAMR_BUILD_WAMR_COMPILER                    | A      | ND      |           |
+| WAMR_BUILD_WASI_EPHEMERAL_NN                | B      | ND      |           |
+| WAMR_BUILD_WASI_NN                          | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_ENABLE_EXTERNAL_DELEGATE | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_ENABLE_GPU               | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_EXTERNAL_DELEGATE_PATH   | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_LLAMACPP                 | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_ONNX                     | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_OPENVINO                 | B      | ND      |           |
+| WAMR_BUILD_WASI_NN_TFLITE                   | B      | ND      |           |
+| WAMR_BUILD_WASI_TEST                        | B      | ND      |           |
+| WAMR_BUILD_WASM_CACHE                       | B      | ND      |           |
+| WAMR_CONFIGURABLE_BOUNDS_CHECKS             | C      | ND      |           |
+| WAMR_DISABLE_APP_ENTRY                      | A      | ND      |           |
+| WAMR_DISABLE_HW_BOUND_CHECK                 | A      | ND      |           |
+| WAMR_DISABLE_STACK_HW_BOUND_CHECK           | A      | ND      |           |
+| WAMR_DISABLE_WAKEUP_BLOCKING_OP             | B      | ND      |           |
+| WAMR_DISABLE_WRITE_GS_BASE                  | B      | ND      |           |
+| WAMR_TEST_GC                                | B      | ND      |           |
+
+[^1]: _ND_ represents _not defined_
+[^2]: active if `WAMR_BUILD_AOT` is 1
+[^3]: active if `WAMR_BUILD_FAST_JIT` or `WAMR_BUILD_JIT1` is 1
+[^4]: active if `WAMR_BUILD_AOT` or `WAMR_BUILD_JIT` is 1
--- a/gitbook/advance-tutorial/README.md
+++ b/gitbook/advance-tutorial/README.md
@ -0,0 +1,7 @@
+# Advance tutorial
+
+Welcome to the chapter of the advanced tutorial.
+
+If you care about performance(don't we all?), want to know whether WAMR stands out among other wasm runtimes with respect to your demands, or wish to fine-tune your wasm application's memory footprint. You could refer to [this section](performance-benchmark/README.md)
+
+In later sections, you can find the tutorial on how to use [application framework](../../doc/wamr_api.md) and [dynamic management](remote-applicatoin-management/README.md). Also, there is a tutorial on [how to port WAMR to the platform](../../doc/port_wamr.md)
--- a/gitbook/advance-tutorial/performance-benchmark/README.md
+++ b/gitbook/advance-tutorial/performance-benchmark/README.md
@ -0,0 +1,18 @@
+# Performance Test
+
+Like word on the street said(no way it's just us saying!) or you may saw in previous chapters(maybe multiple times), WAMR is a **lightweight** standalone WebAssembly (WASM) runtime with **small footprint**, **high performance** and highly configurable features.
+
+Well, you don't have to take our word for it. You could run the [Benchmarks in our repo](https://github.com/bytecodealliance/wasm-micro-runtime/tree/main/tests/benchmarks) and decide whether the performance is good enough.
+
+We provide multiple benchmarks that you could try:
+
+- [PolyBench](../../../tests/benchmarks/polybench/README.md)
+- [CoreMark](../../../tests/benchmarks/coremark/README.md)
+- [Sightglass](../../../tests/benchmarks/sightglass/README.md)
+- [JetStream2](../../../tests/benchmarks/jetstream/README.md)
+
+For the memory footprint, you can refer to the links below.
+
+- [Performance and footprint data](https://github.com/bytecodealliance/wasm-micro-runtime/wiki/Performance): checkout [here](https://github.com/bytecodealliance/wasm-micro-runtime/wiki/Performance) for the performance and footprint data
+
+And in the next section, we provide tutorials on memory usage tuning. You can [profile memory usage](../../../doc/build_wamr.md#enable-memory-profiling-experiment) and [tunning memory usage](../../../doc/memory_tune.md)
--- a/gitbook/advance-tutorial/remote-applicatoin-management/README.md
+++ b/gitbook/advance-tutorial/remote-applicatoin-management/README.md
@ -0,0 +1,7 @@
+# Remote application management
+
+The WAMR application manager supports **remote application management**(check out local directory {WAMR-DIR}/core/app-mgr or [same directory on GitHub](https://github.com/bytecodealliance/wasm-micro-runtime/tree/main/core/app-mgr) for more) from the host environment or the cloud through any physical communications such as TCP, UPD, UART, BLE, etc. Its modular design makes it able to support application management for different managed runtimes.
+
+The tool **host_tool** (check out local directory {WAMR-DIR}/test-tools/host-tool or [same directory on GitHub](https://github.com/bytecodealliance/wasm-micro-runtime/tree/main/test-tools/host-tool) for more) communicates to the WAMR app manager for installing/uninstalling the wasm applications on the companion chip from the host system.
+
+We have two example demos of the use of **host_tool**. One is the [simple example](../../../samples/simple/README.md) using the tool "host_tool" to remotely install/uninstall wasm applications from the WAMR runtime over either TCP socket or UART cable; the other is the [IoT App Store Demo](../../../test-tools/IoT-APP-Store-Demo/README.md) showing the concept of remotely managing the device applications from the cloud.
--- a/gitbook/appendix/background_knowledge.md
+++ b/gitbook/appendix/background_knowledge.md
@ -0,0 +1,61 @@
+# Some background knowledge
+
+In this section, we aggregate some basic background knowledge and jargon in our project field. This section could be served as a refresher for those who have left academia for a while and cannot fully recall all the weary details and exact meaning of jargon in the Compiler course. Also, it would be a great primer for those who did not take such a course and are interested in such a field(and, of course, our fantastic WAMR project).
+
+We think providing such a section would be nice so that you do not have to Google around. If there is anything you find inaccurate, you think should be included, or even better, you have something for us that would perfect this section, do feel free to reach out to us on [GitHub](https://github.com/bytecodealliance/wasm-micro-runtime)!
+
+Let's dive right into our exciting recitation/learning journey without further ado!
+
+## 1. Compiler
+
+### 1.1 What is a Compiler?
+
+Strictly speaking(formal definition you usually find in textbooks), the compiler is a special computer program, a system program(serves as a platform for other software), to be more precise. It takes a source program as input and outputs a target program. The source program is written in the source programming language, and usually, it is a high-level programming language such as C/C++, Java, Rust, and so on. The target program is written in a target programming language would be a low-level programming language like assembly. Take C/C++ as an example, the input for the GCC compiler(component) is a C/C++ translation unit(a source file along with any header it used), and the output is platform-dependent assembly code.
+
+However, in our daily life, what we usually mean when we refer to the word compiler is the compiler toolchain, which comprises a compiler, assembler, and linker. The assembler is in charge of translating the compiled translation unit(object file) from assembly to truly machine-readable machine code. The linker is used to link all the parts of the program(object files) into one executable file. Together, they can translate our human-readable source code(potentially many files) into a program that can run on the machine.
+
+For now, we will mainly focus on the more strict definition because I think the concept and algorithm compiler use more closely pertain to our WAMR project.
+
+<!-- TODO: graph -->
+
+### 1.2 Structure and algorithm involved
+
+<!-- TODO: graph -->
+
+Since we alright know what a compiler is, now let's learn more details about compilers. First, let's talk about the structure of the compiler and the algorithm related to each part. Typically, the compiler consists of three parts, Front End, Optimizer and Back End:
+
+- Front End: in some sense, this part is more "mature." The theory involved and actual implementation is more or less stable nowadays. Its primary purpose is to gather textual information from source-language programs and understand it syntactically and semantically. After that, it encodes the knowledge it has into Intermediate Representation. The theory behind Front End is formal language theory(Scanners & Parsers) and lattice theory(Elaboration for type checking).
+
+- Optimizer: as the name suggests, the Optimizer's goal is to optimize our program's performance. Clever readers may be conscious of the difficulty when they hear the word "optimize." Indeed, the Optimizer is very challenging to design and implement since it's a vital part of compiler infrastructure and imposes a heavy performance impact. It analyses the input IR and transforms it into definitive IR, usually through multiple passes, gradually accumulating knowledge of the program and applying a better(hopefully) transformation to it. The output(definitive IR) is semantically equivalent to the input IR to preserve the original meaning of the program we are compiling. The theories and algorithms that could be used for Optimizer are too many to list here. Here are examples: Number theory, some graph algorithms for static analysis, and fixed-point algorithms for data-flow analysis. It's still an active field that attracts many people to research.
+
+- Back End: the Back End is in charge of mapping programs (in IR form) to low-level code forms that can run on the target machine. Usually, there is more than one Back End, so the compiler is portable for different platforms (ISA). Its main functionality includes instruction selection, register allocation, and instruction scheduling, in which many algorithms are applied, like heuristic search, graph coloring, and some dynamic programming. Like Optimizer, the Back End has many open problems to tackle and also is a field many people hold great interest in.
+
+## 2. Interpreter
+
+### 2.1 What is an Interpreter?
+
+The Interpreter is also a system computer program. Like the compiler, it takes a source program as input; but instead of outputting a target program, it directly executes the program line by line and returns the corresponding results. One thing worth noting is that it's not uncommon for an interpreter to adapt widely used techniques in the compilers to improve its performance. Sometimes they are even used together.
+
+Based on the levels of the source language(high or low) and compilation strategies, the interpreters can be divided into several different categories. Let's look at them in more detail in the following section.
+
+### 2.2  Technique and jargon in Interpreter
+
+- Bytecode:
+
+  The bytecode is a kind of low-level programming language in a very highly optimized and compact format. It could be the target language for the compiler. Because the instruction-like bytecode can be executed line by line in an interpreter on any platform, regardless of what hardware-related ISA it uses, it is also called p-code(portable). One example of bytecode you may be familiar with is Java bytecode.
+  
+- Ahead-of-time(AOT) and Just-in-time(JIT) compilation:
+
+  - AOT: as the name suggests, the AOT compilation means that the compilation happens before the program run time. Normally the target language after  AOT compilation is some low-level machine code or bytecode. Then the compiled code can be executed by either a process VM or a normal computer.
+
+  - JIT: just in time compilation is a technique widely adopted by the Interpreter to improve its performance. It detects the heavily used code section when interpreting the program and compiles them into more efficient machine code. When that code section is called again, the machine code is executed rather than having the bytecode interpreted.
+
+## 3. Virtual machines
+
+When it comes to the word "Virtual Machines," we usually would remember or refer to that System virtual machines managed by hypervisors such as KVM, VirtualBox, or VMware. We often use them as a substitute for real computers to resolve dependency or compatibility issues for courses or daily work.
+
+But there is also another type of virtual machine you may have heard of(even you may get really confused at first) and related more closely to the field where our project is. Process (application) virtual machines provide an environment independent of hardware, aiming to run computer programs written in a certain language. Take JVM as an example. It provides an environment for Java bytecode to execute across many platforms.
+
+## 4. Runtime system
+
+It's a rather vague term that is really difficult to explain or understand. To make things worse, when people sometimes refer to it as runtime, it's easily confused with compilation runtime, runtime library. The runtime system is an infrastructure that participates in the creation and running of our program. Typically, the components are the execution environment(Application VM maybe) to provide a place for the program to run, and the compiler front end or/and compiler back end to do the necessary analysis, transformation(from source code to bytecode), and optimization.
--- a/gitbook/appendix/webassembly_details.md
+++ b/gitbook/appendix/webassembly_details.md
@ -0,0 +1,6 @@
+---
+description: "This page is under construction/refinement. p.s. wanna hear a construction joke? we are still working on it"
+---
+# WebAssembly details
+
+Meanwhile, if you can't wait to learn more about Wasm, check out this book: _WebAssembly in Action_. It's a great book showcasing wasm basics and how to use wasm with JavaScript inside a browser.
--- a/gitbook/basics/getting-started/README.md
+++ b/gitbook/basics/getting-started/README.md
@ -0,0 +1,13 @@
+# Getting started: a hello world program
+
+In this chapter, you'll learn how to run a simple hello world wasm program on your host or the Docker environment using WAMR. The docker tutorial is recommended so you don't have to worry about all the platform-related dependencies and compatibility problems. The hello world program will give you a taste of what our WAMR could do as server-side runtime and ready you for a more detailed guide at the end of this chapter. The [latter guide](../../../doc/build_wasm_app.md) covers the meaning of the compile and build option in detail and gives suggestions on fine-tuning your wasm module. More example programs can be found in [chapter 4. features](../../features/README.md)
+
+Now, here is the last piece of gibberish before you get your hand dirty:
+
+Clone our source code repo and use
+
+```sh
+git clone https://github.com/bytecodealliance/wasm-micro-runtime.git
+```
+
+Or download from <https://github.com/bytecodealliance/wasm-micro-runtime> use any way you like
--- a/gitbook/basics/getting-started/host_prerequsites.md
+++ b/gitbook/basics/getting-started/host_prerequsites.md
@ -0,0 +1,40 @@
+# Prerequisites for your host environment
+
+## Ubuntu
+
+First, install the needed packages and libraries.
+
+```sh
+apt-get update \
+  && apt-get install -y apt-transport-https apt-utils build-essential \
+  ca-certificates curl g++-multilib git gnupg \
+  libgcc-9-dev lib32gcc-9-dev lsb-release \
+  ninja-build ocaml ocamlbuild python2.7 \
+  software-properties-common tree tzdata \
+  unzip valgrind vim wget zip --no-install-recommends
+```
+
+Then install CMake and wasi-sdk-16.0
+
+```sh
+wget --progress=dot:giga -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | tee /usr/share/keyrings/kitware-archive-keyring.gpg > /dev/null \
+  && echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ bionic main' | tee /etc/apt/sources.list.d/kitware.list >/dev/null \
+  && apt-get update \
+  && rm /usr/share/keyrings/kitware-archive-keyring.gpg \
+  && apt-get install -y kitware-archive-keyring --no-install-recommends \
+  && apt-get install -y cmake --no-install-recommends 
+
+wget -c --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-16/wasi-sdk-16.0-linux.tar.gz -P /opt \
+  && tar xf /opt/wasi-sdk-16.0-linux.tar.gz -C /opt \
+  && ln -fs /opt/wasi-sdk-16.0 /opt/wasi-sdk \
+  && rm /opt/wasi-sdk-16.0-linux.tar.gz
+```
+
+This should be sufficient to build WAMR and run our hello world program.
+<!-- 
+TODO:
+
+## MacOS
+
+## Windows
+ -->
--- a/gitbook/basics/getting-started/on_docker.md
+++ b/gitbook/basics/getting-started/on_docker.md
@ -0,0 +1,26 @@
+# Using docker
+
+Now that we have set up docker, we could run the following command directly in VS Code terminal(or the bash of your if you prefer ssh docker container directly).
+
+Similarly, build iwasm vmcore.
+
+```sh
+cd product-mini/platforms/linux
+mkdir build && cd build
+cmake ..
+make 
+```
+
+Then you are ready to go to the directory that contains the hello world program and copy our iwasm vmcore
+
+```sh
+cp iwasm ../../../app-samples/hello-world
+cd ../../../app-samples/hello-world
+./build.sh
+```
+
+Now you can execute your first wasm program!
+
+```sh
+./iwasm test.wasm
+```
--- a/gitbook/basics/getting-started/on_host.md
+++ b/gitbook/basics/getting-started/on_host.md
@ -0,0 +1,26 @@
+# Compile, build and test hello world on the host
+
+Now we have our host set up, we can build our hello world program and run it using WAMR.
+
+First, build iwasm vmcore on your platform.
+
+```sh
+cd ${WAMR-dir}/product-mini/platforms/${your platform}
+mkdir build && cd build
+cmake ..
+make 
+```
+
+Then you are ready to go to the directory that contains the hello world program and copy our iwasm vmcore
+
+```sh
+cp iwasm ../../../app-samples/hello-world
+cd ${WAMR-dir}/product-mini/app-samples/hello-world
+./build.sh
+```
+
+Now you could execute your first wasm program!
+
+```sh
+./iwasm test.wasm
+```
--- a/gitbook/basics/introduction/README.md
+++ b/gitbook/basics/introduction/README.md
@ -0,0 +1,5 @@
+# Introduction
+
+In this chapter, we will introduce you to some basic knowledge about [WebAssembly](./webassembly.md) and our project [WAMR](./wamr_project.md). And discuss the security feature that Webassembly language itself and WAMR's enhancement can bring in [this section](./security_feature.md)
+
+We understand because our backgrounds vary, some terms in the following section may sound familiar but vague. We have a primer in [Appendix A](../../appendix/background_knowledge.md) gathering some details about background knowledge(compiler, interpreter, runtime system, all other jargon) that may be helpful and free you from googling around. You are more than welcome to check it out.
--- a/gitbook/basics/introduction/security_feature.md
+++ b/gitbook/basics/introduction/security_feature.md
@ -0,0 +1,147 @@
+# The Security of WebAssembly and WAMR's implementation
+
+WebAssembly is a cutting-edge programming language that helps Web applications such as PhotoShop Online run at native speed in the browser and offers a sandbox mechanism to protect the host environment from malicious attacks cross the world. Beyond the browser, the Wasm can be executed in standalone runtime such as WAMR safely without the need of additional security support from OS and HW.
+
+## WebAssembly Security Overview
+
+The security features of WebAssembly(More detailed Wasm language-level security features can be found on the official [WebAssembly website](https://webassembly.org/docs/security/))
+
+WebAssembly (Wasm) is designed with two key security goals:
+
+1. protecting users from malicious or faulty modules
+
+2. providing developers with robust tools for building secure applications.
+
+### User Protection
+
+Each WebAssembly module executes within a sandboxed environment separated from the host runtime using fault isolation techniques. This implies:
+
+- Applications execute independently, and can't escape the sandbox without going through appropriate APIs.
+- Applications generally execute deterministically with limited exceptions.
+
+Modules must also comply with the security policies of the host environment, such as the same-origin policy in browsers or POSIX on other platforms.
+
+### Developer Safety Tools
+
+WebAssembly's design emphasizes security by removing unsafe execution features while maintaining compatibility with C/C++ programs.
+
+Key safety features include:
+
+- **Control-flow Integrity (CFI):**
+  - Modules must declare all accessible functions and their types at load time, enforcing structured control flow.
+  - Immutable, non-observable compiled code prevents control-flow hijacking attacks.
+  
+- **Function Calls:**
+  - Calls must reference a valid function index.
+  - Indirect function calls are checked at runtime for type signature compatibility.
+  - A protected call stack prevents buffer overflows, ensuring safe returns.
+  - Branches are restricted to valid destinations within the current function.
+
+- **Variable Handling:**
+  - Local variables (fixed scope) are initialized to zero and stored in the protected call stack.
+  - Global variables are stored in the global index space and can be imported from external modules.
+  - Variables with unclear static scope (e.g., structs or address-of operator) are stored in isolated linear memory, which has bounds checking and zero-initialization by default.
+
+- **Traps:**
+  - Used to terminate execution and signal errors (e.g., invalid index, type mismatch, stack overflow, out-of-bounds memory access, or illegal arithmetic).
+  - In a browser, traps trigger a JavaScript exception. Future updates may support custom module-defined trap handlers.
+
+Future improvements may introduce multiple memory sections and finer memory controls (e.g., shared memory, page protection).
+
+### Memory Safety
+
+WebAssembly improves memory safety by eliminating common bugs found in traditional C/C++ programs:
+
+- **Buffer Overflows**: Local and global variables are fixed-size and stored by index, preventing buffer overflows from affecting adjacent memory. Linear memory regions, though, can overwrite objects, but bounds checking and control-flow integrity (CFI) prevent direct code injection, so mitigation like DEP or SSP is unnecessary.
+  
+- **Pointer Safety**: Unsafe pointer usage, like dereferencing unallocated memory or accessing freed memory, is minimized. WebAssembly removes pointer semantics for function calls and variables with fixed scope, and invalid index references result in load-time validation errors or runtime traps. Linear memory is bounds-checked at the region level and zero-initialized by default.
+
+- **Control Flow Protection**: Although WebAssembly prevents direct code injection, code reuse attacks targeting indirect calls are still possible. However, conventional ROP attacks are infeasible due to CFI, which enforces valid call targets declared at load time.
+
+- **Potential Vulnerabilities**: Race conditions (e.g., TOCTOU) and side-channel attacks (e.g., timing attacks) are possible, as WebAssembly offers no scheduling guarantees. Future enhancements may introduce memory randomization, code diversification, and bounded pointers to strengthen protection.
+
+### Control-Flow Integrity (CFI)
+
+Wasm ensures CFI for both direct and indirect function calls as well as function returns. It uses explicit function section indexes and runtime type checks to verify safe transitions. However, as mentioned above, while these mechanisms prevent most code injection, indirect call exploits using code reuse techniques are still possible.
+
+Developers can enhance security by enabling fine-grained CFI through Clang/LLVM's WebAssembly support, which adds richer type-level checks and mitigates indirect call attacks, albeit with minor performance trade-offs.
+
+## WAMR Security Features
+
+The WebAssembly Micro Runtime (WAMR) is designed to provide an efficient, secure, and lightweight runtime for WebAssembly on standalone devices. It offers a full coverage of the WebAssembly specification and added additional security enhancements to ensure safe execution of Wasm modules.
+
+### Wasm Language Security Features
+
+WAMR enforces WebAssembly language-level security features rigorously, ensuring that each Wasm module undergoes comprehensive validation at the loading phase and that execution conforms to the WebAssembly specification during runtime.
+
+#### Module Validation
+
+Before execution, WAMR validates the Wasm module to ensure it adheres to the WebAssembly specification. This involves several key checks:
+
+- **Format Validation**: Ensuring the binary is well-formed and compliant with the Wasm format. This checks the structure, ensuring correct definitions for functions, memory segments, tables, and types.
+  
+- **Type Checking**: All function signatures, local variables, and global variables are verified against their declared types. This ensures type safety across calls and memory operations.
+
+- **Control Flow Integrity**: Verifies the function call graph to ensure that all function indices and signatures are valid and that function calls do not violate control-flow safety rules.
+
+- **Operand Stack Integrity**: WAMR ensures that operand stack overflows and underflows are checked during validation. For each function, the number of values pushed and popped from the operand stack must match the declared function signature, avoiding stack imbalances.
+
+- **Memory and Table Boundaries**: Ensures that memory and table sizes do not exceed predefined limits and that access to these regions remains within bounds.
+
+#### Module Execution
+
+During runtime, WAMR ensures that execution strictly conforms to the WebAssembly spec and maintains the security guarantees made at load time:
+
+- **Memory Safety**: Memory access, both direct and indirect, is rigorously checked. WAMR prevents out-of-bounds access, helping mitigate common vulnerabilities like buffer overflows.
+
+  - Implementation of **Boundary Checks**: WAMR can leverage either software boundary checks or hardware boundary checks. For software boundary checks, before each memory access, the address is validated to ensure it falls within the allowable bounds of the allocated memory. For hardware boundary checks, protection mechanisms such as `mmap`-based memory protection, where sections of memory can be made non-writable or non-executable to prevent invalid memory address access.
+  
+- Like previously mentioned, applications generally execute deterministically with **limited exceptions**, which can be handled in the runtime rather than simply crushing or causing undefined behavior. The exceptions that WAMR can handle include but are not limited to:
+
+  - EXCE_UNREACHABLE: Triggered when unreachable code is executed.
+  - EXCE_OUT_OF_MEMORY: Signaled when the runtime runs out of memory.
+  - EXCE_OUT_OF_BOUNDS_MEMORY_ACCESS: Raised when memory access goes out of bounds.
+  - EXCE_INTEGER_OVERFLOW: Detects integer overflow during arithmetic operations.
+  - EXCE_INTEGER_DIVIDE_BY_ZERO: Handles division by zero in integer operations.
+  - EXCE_INVALID_CONVERSION_TO_INTEGER: Raised when an invalid conversion to an integer occurs.
+  - EXCE_INVALID_FUNCTION_TYPE_INDEX: Triggered when an invalid function type index is accessed.
+  - EXCE_INVALID_FUNCTION_INDEX: Signaled when an invalid function index is used.
+  - EXCE_UNDEFINED_ELEMENT: Raised when accessing an undefined element.
+  - EXCE_UNINITIALIZED_ELEMENT: Triggered when an uninitialized element is accessed.
+  - EXCE_CALL_UNLINKED_IMPORT_FUNC: Handles calls to unlinked imported functions.
+  - EXCE_NATIVE_STACK_OVERFLOW: Triggered when the native stack exceeds its limit.
+  - EXCE_UNALIGNED_ATOMIC: Raised when an unaligned atomic operation is attempted.
+  - EXCE_AUX_STACK_OVERFLOW: Signals that the auxiliary stack has overflowed.
+  - EXCE_AUX_STACK_UNDERFLOW: Triggered when the auxiliary stack is underflowed.
+  - EXCE_OUT_OF_BOUNDS_TABLE_ACCESS: Raised when accessing a table out of bounds.
+  - EXCE_OPERAND_STACK_OVERFLOW: Signaled when the operand stack overflows.
+
+These features, combined with the robust validation and execution checks, ensure that WAMR achieves comprehensive security for running WebAssembly modules.
+
+### Extra Enhancements on Security
+
+WAMR goes beyond the standard WebAssembly security features by offering additional mechanisms to enhance the security of applications, particularly in the areas of native API access control and hardware-based security.
+
+#### Native API Export Control
+
+WAMR allows WebAssembly applications to interact with the host environment through **exported native APIs**. However, unrestricted access to these APIs can introduce security risks, such as unauthorized system calls or resource manipulation. To mitigate these risks, WAMR implements a **fine-grained access control** mechanism for native APIs:
+
+- **Restricted API Access**: Developers can explicitly define which native APIs are exposed to WebAssembly modules, limiting the surface area for potential misuse. This allows for precise control over which system resources (e.g., file system, networking, I/O devices) can be accessed by a module.
+
+- **Custom API Policies**: WAMR supports customizable policies, enabling developers to set permissions and constraints on how WebAssembly modules can interact with native APIs. This is particularly useful for sandboxing untrusted code while still allowing necessary functionality under controlled conditions.
+
+- **API Call Validation**: All calls to native APIs are validated at runtime to ensure that they conform to the defined policies, preventing unauthorized or malicious API usage.
+
+#### Intel SGX Remote Attestation
+
+WAMR enhances security for trusted execution environments (TEEs) through its support for **Intel Software Guard Extensions (SGX)**, which provides hardware-level security features, including **remote attestation**:
+
+- **SGX Integration**: WAMR can run WebAssembly modules within an SGX enclave, a protected area of execution that provides isolation from the rest of the system. This ensures that even if the host machine is compromised, the code and data within the enclave remain secure.
+
+- **Remote Attestation**: WAMR supports SGX remote attestation, allowing remote parties to verify that a WebAssembly module is running inside a genuine SGX enclave. This involves generating and sending an **attestation report**, which proves the authenticity of the enclave and the integrity of the code running inside it.
+
+  - **Endorsement of Trusted Execution**: The attestation process ensures that the WebAssembly module and its execution environment have not been tampered with, providing assurance to remote users that the module is running in a secure, trusted state.
+
+- **Sealing and Unsealing**: WAMR supports SGX's data sealing features, enabling WebAssembly modules to securely store sensitive data on disk. Sealed data can only be accessed by the same enclave in future executions, protecting it from unauthorized access even if the host system is compromised.
+
+These features enhance WAMR’s security, making it suitable for use cases that require both flexible native API access and strong hardware-backed guarantees of code integrity and confidentiality.
--- a/gitbook/basics/introduction/wamr_project.md
+++ b/gitbook/basics/introduction/wamr_project.md
@ -0,0 +1,65 @@
+# WAMR project
+
+ In this section, we will introduce the basics of project WAMR to you. In each brief introduction section, you are more than welcome to jump to details of that section triggering your interest.
+
+## What is it?
+
+WebAssembly Micro Runtime (WAMR) is a [Bytecode Alliance](https://bytecodealliance.org/) project. A lightweight standalone WebAssembly (WASM) runtime with a small footprint, high performance, and highly configurable features for applications across from embedded, IoT, edge to Trusted Execution Environment (TEE), smart contract, cloud-native, and so on.
+
+## Why you may want to use it
+
+<!-- TODO: link  -->
+
+As we explained in the previous section, WebAssembly is great for code reuse on the server side with the help of runtime like our Project WAMR. So the most straightforward way is to use WAMR to run your WASM program.
+
+It's not limited to simply being a command line application that runs your wasm program. You could also use it as a library, integrated into your application to run any wasm program inside your application. Although most user cases are embedding WAMR in their C/C++ program, we do support other [language-binding](../../tutorial/language-embedding/README.md) so that you could use WAMR in some language you prefer.
+
+## Component of WAMR
+
+<!-- TODO: link -->
+
+There are four parts of WAMR. Two main parts of WAMR are:
+
+1. The "iwasm" VM core to run WASM applications. It has many features and achieves several functionalities. The complete list of features and examples demonstrating it can be found in [Features](../../features/README.md). Here are some brief introductions of some features that may interest you:
+
+   - Flexibility: It supports multiple running modes to provide the ideal responsive time and performance on your demand. The running mode includes interpreter mode, AOT mode (Ahead-of-Time compilation), and JIT modes (Just-in-Time compilation, LLVM JIT, and Fast JIT are supported). Details on how to build and use each mode properly and where you may want to use it can be found in [Tutorial](../../tutorial/README.md)
+
+   - High Performance: WAMR achieves nearly native speed by  AOT and JIT modes. It also has a small runtime binary size (~85K for interpreter and ~50K for AOT) and low memory usage
+
+   - Portability: It supports many architectures and platforms.
+
+     The architectures it supports:
+
+     - X86-64, X86-32
+     - ARM, THUMB (ARMV7 Cortex-M7 and Cortex-A15 are tested)
+     - AArch64 (Cortex-A57 and Cortex-A53 are tested)
+     - RISCV64, RISCV32 (RISC-V LP64 and RISC-V LP64D are tested)
+     - XTENSA, MIPS, ARC
+
+     The  platforms it supports:
+
+     - [Linux](../../../doc/build_wamr.md#linux),  [Linux SGX (Intel Software Guard Extension)](../../../doc/linux_sgx.md),  [MacOS](../../../doc/build_wamr.md#macos),  [Android](../../../doc/build_wamr.md#android), [Windows](../../../doc/build_wamr.md#windows), [Windows (MinGW)](../../../doc/build_wamr.md#mingw)
+
+     - [Zephyr](../../../doc/build_wamr.md#zephyr),  [AliOS-Things](../../../doc/build_wamr.md#alios-things),  [VxWorks](../../../doc/build_wamr.md#vxworks), [NuttX](../../../doc/build_wamr.md#nuttx), [RT-Thread](../../../doc/build_wamr.md#RT-Thread), [ESP-IDF](../../../doc/build_wamr.md#esp-idf)
+
+     It enables true cross-platform development experience. You can even port WAMR to a new platform following [this tutorial](../../../doc/port_wamr.md). Though it's unlikely since we support many platforms, having such features is comforting.
+
+   - Security: It has Linux SGX (Intel Software Guard Extension) support. Through this unique application isolation technology, your application data is as safe as it can be.
+
+2. The "wamrc" AOT compiler to compile WASM files into AOT files for best performance and smaller runtime footprint, which is run by "iwasm" VM Core
+
+   Both the wasm binary files and AOT files are supported by iwasm. The wamrc AOT compiler compiles a wasm binary file to an AOT file, which can also be run by iwasm. The speed by AOT and JIT are near to native.
+
+The other 2 parts are:
+
+1. Application framework:
+
+   The WAMR application manager supports remote application management from the host environment or the cloud through any physical communications such as TCP, UPD, UART, BLE, etc. Its modular design makes it able to support application management for different managed runtimes.
+
+2. Application manager:
+
+   By using the iwasm VM core, we are flexible to build different application frameworks for specific domains, although it would take quite some effort.
+
+   The WAMR has offered a comprehensive framework for programming WASM applications for device and IoT usages. The framework supports running multiple applications that are based on the event-driven programming model. Here are the supporting API sets by the WAMR application framework library :
+
+   - Timer, Inter-app communication (request/response and pub/sub), Sensor, Connectivity and data transmission, 2D graphic UI
--- a/gitbook/basics/introduction/webassembly.md
+++ b/gitbook/basics/introduction/webassembly.md
@ -0,0 +1,52 @@
+# WebAssembly
+
+In this section, you will learn the basics of WebAssembly. More details about WebAssembly can be found in [Appendix B](../../appendix/webassembly_details.md)
+
+## Overview
+
+Like its name suggest, in a sense, it is related to the Web and Assembly. Web means that it, like many other forerunners, like asm.js, trying to improve JavaScript's performance in Browsers. And the Assembly means that the format of WebAssembly is not a human-readable format but a compact binary format that is more efficient for Browsers to use. To conclude, WebAssembly (Wasm) is a compact, binary instruction format tailored for a stack-based virtual machine. It serves as a portable compilation target for various programming languages, enabling smooth deployment across both client and server environments on the web. It aims to provide benefits such as:
+
+- High Performance
+  
+  Wasm is built for fast execution and compact encoding, allowing programs to be efficiently transmitted and quickly loaded. By leveraging the common hardware capabilities across platforms, WebAssembly can run at near-native speeds.
+
+- Secure Execution Environment
+  
+  Wasm operates within a memory-safe, sandboxed environment, which can be implemented even inside existing JavaScript engines. When integrated into web applications, it adheres to the same-origin policy and browser-based permission models, ensuring robust security.
+
+- Open and Debuggable Format
+  
+  Wasm is designed with a textual representation that aids in debugging, testing, and optimization. This human-readable format allows developers to experiment, learn, and even hand-code Wasm modules. When viewed on the web, this text format makes Wasm modules easily accessible for inspection.
+
+- A Core Part of the Open Web
+  
+  Built to uphold the versionless and backward-compatible nature of the web, WebAssembly seamlessly interacts with JavaScript and can access web APIs. Beyond web applications, Wasm is versatile and supports other non-web environments as well.
+
+In [The State of WebAssembly 2023](https://www.cncf.io/reports/the-state-of-webassembly-2023/) from SlashData, Linux Foundation, and the Cloud Native Computing Foundation, some key insights into the current status and adoption of WebAssembly can be found. Including the top reason why people want to use WebAssembly:
+
+- Faster loading times 23%
+- Exploring new use cases and technologies 22%
+- Sharing code between projects 20%
+- Improved performance over JavaScript 20%
+- Efficient execution of computationally intensive tasks 19%
+- Binaries run anywhere 18%
+- Sandboxed security 18%
+- Language agnostic 18%
+
+What makes it even better is that, like Javascript, shortly after the appearance of WebAssembly, it is not limited to the browser. It could also be used server-side. Many WebAssembly runtimes are out there, including our project WAMR.
+
+## How does it work
+
+### A browser example
+
+The most straightforward place you could think of when it comes to the use of WebAssembly is in the browser.
+
+Emscripten is a compiler toolchain for WebAssembly. It took the C/C++(or any other programming language LLVM frontend support) source program as input and translated it into the WebAssembly target program module.
+
+Optionally, an HTML and a Javascript file are generated alongside a wasm file, so the plumbing JS code is ready for you to call your wasm module. And you could open HTML on your browser to see the result of your wasm program.
+
+Here is the more detailed [emscripten official tutorial](https://emscripten.org/docs/getting_started/Tutorial.html) you could follow to write your hello world wasm program and run it on the browser.
+
+### A server-side example
+
+A hello world example using our WAMR can be found [here](../getting-started/README.md)
--- a/gitbook/examples/README.md
+++ b/gitbook/examples/README.md
@ -0,0 +1,11 @@
+# More Examples
+
+In this chapter, we provide some extra useful examples to demonstrate how you may want to use WAMR:
+
+- [File Interaction Of WASI](../../samples/file/README.md): Demonstrating the supported file interaction API of WASI. This sample can also demonstrate the SGX IPFS (Intel Protected File System), enabling an enclave to seal and unseal data at rest.
+
+- [GUI Examples](gui-examples/README.md): We provide two examples that both use [LVGL library](https://github.com/lvgl/lvgl)
+
+- [Concurrent WASM Application](../../samples/spawn-thread): Demonstrating how to execute wasm functions of the same wasm application concurrently in threads created by host embedder or runtime, but not the wasm application itself.
+
+- [Workload](../../samples/workload/README.md): Demonstrating how to build and run some complex workloads, e.g., tensorflow-lite, XNNPACK, wasm-av1, meshoptimizer, and bwa.
--- a/gitbook/features/README.md
+++ b/gitbook/features/README.md
@ -0,0 +1,39 @@
+---
+description: "This page is under construction/refinement. p.s. wanna hear a construction joke? we are still working on it"
+---
+# Features And Examples
+
+<!-- TODO: each sample should have a link/path to the source code involved -->
+
+In this chapter, you can see the complete list of features that WAMR support. And for each feature, we have an example followed demonstrating the usage of such a feature.
+
+## IWASM features
+
+### Key features
+
+- Full compliant to the W3C WASM MVP
+- Small runtime binary size (~85K for interpreter and ~50K for AOT) and low memory usage
+- Near to native speed by AOT and JIT
+- Self-implemented AOT module loader to enable AOT work on Linux, Windows, MacOS, Android, SGX, and MCU systems
+- Choices of WASM application libc support: the built-in libc subset for the embedded environment or [WASI](https://github.com/WebAssembly/WASI) for the standard libc
+- [The simple C APIs to embed WAMR into host environment](../../doc/embed_wamr.md), see [how to integrate WAMR](../../doc/embed_wamr.md) and the [API list](../../core/iwasm/include/wasm_export.h)
+- [The mechanism to export native APIs to WASM applications](../../doc/export_native_api.md), see [how to register native APIs](../../doc/export_native_api.md)
+- [Multiple modules as dependencies](../../doc/multi_module.md), ref to [document](../../doc/multi_module.md) and [sample](../../samples/multi-module)
+- [Multi-thread, pthread APIs and thread management](../../doc/pthread_library.md), ref to [document](../../doc/pthread_library.md) and [sample](../../samples/multi-thread)
+- [Linux SGX (Intel Software Guard Extension) support](../../doc/linux_sgx.md), ref to [document](../../doc/linux_sgx.md)
+- [Source debugging support](../../doc/source_debugging.md), ref to [document](../../doc/source_debugging.md)
+- [WAMR-IDE (Experimental)](../../test-tools/wamr-ide) to develop WebAssembly applications with build, run and debug support, ref to [document](../../test-tools/wamr-ide)
+- [XIP (Execution In Place) support](../../doc/xip.md), ref to [document](../../doc/xip.md)
+- [Berkeley/Posix Socket support](../../doc/socket_api.md), ref to [document](../../doc/socket_api.md) and [sample](../../samples/socket-api)
+- Language bindings: [Go](../../language-bindings/go/README.md), [Python](../../language-bindings/python/README.md)
+
+### WASM post-MVP features
+
+There are many post-MVP features for WASM. We support some of them. You can see the details in [this section](demo-examples/README.md)
+
+- [wasm-c-api](https://github.com/WebAssembly/wasm-c-api)
+- [128-bit SIMD](https://github.com/WebAssembly/simd)
+- [Reference Types](https://github.com/WebAssembly/reference-types)
+- [Non-trapping float-to-int conversions](https://github.com/WebAssembly/nontrapping-float-to-int-conversions)
+- [Sign-extension operators](https://github.com/WebAssembly/sign-extension-ops), [Bulk memory operations](https://github.com/WebAssembly/bulk-memory-operations)
+- [Multi-value](https://github.com/WebAssembly/multi-value), [Tail-call](https://github.com/WebAssembly/tail-call), [Shared memory](https://github.com/WebAssembly/threads/blob/main/proposals/threads/Overview.md#shared-linear-memory)
--- a/gitbook/features/demo-examples/README.md
+++ b/gitbook/features/demo-examples/README.md
@ -0,0 +1,15 @@
+# WASM post-MVP features
+
+The ones we support:
+
+- [wasm-c-api](https://github.com/WebAssembly/wasm-c-api), ref to [document](../../../doc/wasm_c_api.md) and [sample](../../../samples/wasm-c-api)
+
+- [128-bit SIMD](https://github.com/WebAssembly/simd), ref to [samples/workload](../../../samples/workload/README.md)
+
+- [Reference Types](https://github.com/WebAssembly/reference-types), ref to [document](../../../doc/ref_types.md) and [sample](../../../samples/ref-types)
+
+Other post-MVP features:
+
+- [Non-trapping float-to-int conversions](https://github.com/WebAssembly/nontrapping-float-to-int-conversions)
+- [Sign-extension operators](https://github.com/WebAssembly/sign-extension-ops), [Bulk memory operations](https://github.com/WebAssembly/bulk-memory-operations)
+- [Multi-value](https://github.com/WebAssembly/multi-value), [Tail-call](https://github.com/WebAssembly/tail-call), [Shared memory](https://github.com/WebAssembly/threads/blob/main/proposals/threads/Overview.md#shared-linear-memory)
--- a/gitbook/features/user-case/README.md
+++ b/gitbook/features/user-case/README.md
@ -0,0 +1,10 @@
+# User case
+
+WAMR is widely used in a lot of areas. Here are some cases:
+
+- [Hyperledger Private Data Objects](https://github.com/hyperledger-labs/private-data-objects/blob/main/common/interpreter/wawaka_wasm/README.md)
+- [Inclavare Containers](https://github.com/alibaba/inclavare-containers)
+- [Fassm](https://github.com/faasm/faasm)
+- [Waft](https://developer.aliyun.com/article/787582)
+- [Envoy Proxy](https://github.com/envoyproxy/envoy)
+- [Apache Teaclave](https://teaclave.apache.org/docs/executing-wasm)
--- a/gitbook/home_page.md
+++ b/gitbook/home_page.md
@ -0,0 +1,15 @@
+# Welcome
+
+Welcome to the home page of WAMR documentation, [WebAssembly Micro Runtime](https://github.com/bytecodealliance/wasm-micro-runtime) is an open-source project under [Bytecode Alliance](https://bytecodealliance.org/). As the name suggests, it is a lightweight standalone WebAssembly (WASM) runtime with a small footprint, high performance, and highly configurable features for applications across from embedded, IoT, edge Trusted Execution Environment (TEE), smart contract, cloud-native, and so on.
+
+## How to navigate the documentation
+
+If you are a complete beginner who just stepped into the world of WebAssembly or just looking to kill some time and learn something fun, start with [appendix A. background knowledge 101](appendix/background_knowledge.md) and our [chapter 1. introduction](basics/introduction/README.md). Also, you could learn how to run a hello world server-side wasm application using runtime WAMR in [chapter 2. getting started](basics/getting-started/README.md).
+
+Suppose you are somewhat familiar with WebAssembly and want to explore what WAMR can do for you as a user and developer. You could first check out [chapter 3. tutorial on how to use WAMR](tutorial/README.md), including [introduction to different running modes](tutorial/running-modes/README.md), how to [build different running modes](tutorial/build-tutorial/README.md), how to [embed WAMR into your application](tutorial/language-embedding/README.md) and how to [debug with WAMR](tutorial/debugging%26IDE-support/README.md). Then you could visit the complete list of [chapter 5. features](features/README.md) WAMR supported to see whether specific feature interest you and would serve your demands well. If the time comes when you start to optimize and consider improving performance or want to utilize the advanced feature, including **application framework** and **dynamic management**. In that case, you could find them in [chapter 4. advance tutorial](advance-tutorial/README.md).
+
+And, of course, you can always utilize the search function in the top right corner to locate whichever topic you are interested in
+
+## Social
+
+Feel free to check out our [blog](https://bytecodealliance.github.io/wamr.dev/) from time to time! We have some great blogs that either showcase some WAMR features and use cases or discuss some interesting topics on WAMR/WASM.
--- a/gitbook/programmer's-manual/C_API_Lists.md
+++ b/gitbook/programmer's-manual/C_API_Lists.md
@ -0,0 +1,3 @@
+# Complete C/C++ API Lists
+
+The complete C/C++ lists for embedding the WAMR VM core can be found in the header file [wasm_export.h](https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/core/iwasm/include/wasm_export.h).
--- a/gitbook/programmer's-manual/README.md
+++ b/gitbook/programmer's-manual/README.md
@ -0,0 +1,6 @@
+---
+description: "This page is under construction/refinement. p.s. wanna hear a construction joke? we are still working on it"
+---
+# Programmer's Manual
+
+Complete List of C APIs can be found [here](gitbook/programmer's_manual/C_API_Lists.md)
--- a/gitbook/tutorial/README.md
+++ b/gitbook/tutorial/README.md
@ -0,0 +1,9 @@
+# Tutorial
+
+In this chapter, we want to walk you through the basic development knowledge and skills of WARM you may need so that you are ready to write your wasm application with WARM.
+
+For starters, you could learn how to compile different running mode of WAMR and their usage in [this section](build-tutorial/README.md).
+
+Then, as we said before, WAMR is not limited to being a command line application that runs wasm code. You could also [embed WAMR](language-embedding/README.md) into your application.
+
+And don't forget the one important stage of developing, namely debugging. We cover it in [this section](debugging%26IDE-support/README.md).
--- a/gitbook/tutorial/build-tutorial/README.md
+++ b/gitbook/tutorial/build-tutorial/README.md
@ -0,0 +1,36 @@
+---
+description: "This page is under construction/refinement. p.s. wanna hear a construction joke? we are still working on it"
+---
+# build tutorial
+
+In this chapter, we provide a detailed tutorial on how to build [iwasm vmcore](../../../doc/build_wamr.md) and [wamrc](build_wamrc.md).
+
+## Quick build matrix
+
+Our powerful **iwasm vmcore** provide various running mode you could choose using the compile CMake option. Here is the matrix for different running mode and their attributes:
+
+| Running mode | CMake build options | Pros and Cons  |
+| -----------  | -----------         | ---------      |
+|  AOT         | none(default)       |                |
+|  Classic Interpreter | -DWAMR_BUILD_FAST_INTERP=0 |         |
+|  Fast Interpreter | none(default)  |                |
+|  LLVM JIT         | -DWAMR_BUILD_JIT=1  |                |
+|  Fast JIT    | -DWAMR_BUILD_FAST_JIT=1 |            |
+
+## Supported architectures and platforms
+
+Here is a list of architectures and platforms WAMR support. You could click on the link for quick reference.
+
+The iwasm supports the following architectures:
+
+- X86-64, X86-32
+- ARM, THUMB (ARMV7 Cortex-M7 and Cortex-A15 are tested)
+- AArch64 (Cortex-A57 and Cortex-A53 are tested)
+- RISCV64, RISCV32 (RISC-V LP64 and RISC-V LP64D are tested)
+- XTENSA, MIPS, ARC
+
+The following platforms are supported. Click each link below for how to build iwasm on that platform. Refer to [WAMR porting guide](../../../doc/port_wamr.md) for how to port WAMR to a new platform.
+
+- [Linux](../../../doc/build_wamr.md#linux), [Linux SGX (Intel Software Guard Extension)](../../../doc/linux_sgx.md), [MacOS](../../../doc/build_wamr.md#macos), [Android](../../../doc/build_wamr.md#android), [Windows](../../../doc/build_wamr.md#windows), [Windows (MinGW)](../../../doc/build_wamr.md#mingw)
+
+- [Zephyr](../../../doc/build_wamr.md#zephyr), [AliOS-Things](../../../doc/build_wamr.md#alios-things), [VxWorks](../../../doc/build_wamr.md#vxworks), [NuttX](../../../doc/build_wamr.md#nuttx), [RT-Thread](../../../doc/build_wamr.md#RT-Thread), [ESP-IDF](../../../doc/build_wamr.md#esp-idf)
--- a/gitbook/tutorial/build-tutorial/build_wamrc.md
+++ b/gitbook/tutorial/build-tutorial/build_wamrc.md
@ -0,0 +1,23 @@
+# How to Build wamrc AOT compiler
+
+Both the WASM binary file and AOT file are supported by iwasm. The wamrc AOT compiler compiles wasm binary file to AOT file, which can also be run by iwasm. Execute the following commands to build **wamrc** compiler for Linux:
+
+```shell
+cd wamr-compiler
+./build_llvm.sh (or "./build_llvm_xtensa.sh" to support xtensa target)
+mkdir build && cd build
+cmake .. (or "cmake .. -DWAMR_BUILD_PLATFORM=darwin" for MacOS)
+make
+# wamrc is generated under current directory
+```
+
+For **Windows**：
+
+```shell
+cd wamr-compiler
+python build_llvm.py
+mkdir build && cd build
+cmake ..
+cmake --build . --config Release
+# wamrc.exe is generated under .\Release directory
+```
--- a/gitbook/tutorial/debugging&IDE-support/README.md
+++ b/gitbook/tutorial/debugging&IDE-support/README.md
@ -0,0 +1,3 @@
+# debugging & IDE support
+
+Has concern about debugging when it comes to a newly emerging technique like wasm? No worries, we got you covered. You could either [debug directly with lldb](../../../doc/source_debugging.md), or you could even [debug using VS Code](../../../test-tools/wamr-ide/README.md)
--- a/gitbook/tutorial/language-embedding/README.md
+++ b/gitbook/tutorial/language-embedding/README.md
@ -0,0 +1,9 @@
+# language embedding
+
+As we mentioned before, WAMR is not only a server-side runtime for a wasm application but also a library that you could embed in your application. What's even better is that we support several programming languages so that you can choose your favorite language to embed WAMR to run the wasm app.
+
+The language WAMR support embedding:
+
+- [C/C++](../../../doc/embed_wamr.md)
+- [Python](../../../language-bindings/python/README.md)
+- [Go](../../../language-bindings/go/README.md)
--- a/gitbook/tutorial/running-modes/README.md
+++ b/gitbook/tutorial/running-modes/README.md
@ -0,0 +1,29 @@
+---
+description: "This page is under construction/refinement. p.s. wanna hear a construction joke? we are still working on it"
+---
+
+# WAMR Running Modes
+
+## Brief Introduction
+
+In this section, we want to introduce running modes and their difference to you
+
+### "iwasm" VM core running mode
+
+It could run an AOT file(compiled by wamrc AOT compiler) in AOT running mode
+
+- AOT: Ahead-of-Time compilation. As you can guess from the name, we first need to use the *wamrc* compiler to compile wasm file to the AOT file. Then it could be run with our *iwasm* vmcore. In this running mode, we could achieve the nearly native speed(the best of all running modes) with very small footprint and quick startup
+
+It could run wasm applications in Interpreter/JIT running mode:
+
+- Interpreter:
+  Interpreters are very useful when debugging or studying, but their performance is relatively poor compared with other running modes. We support two running modes of the interpreter:
+  - Classic Interpreter: plain interpreter running mode
+  - Fast Interpreter: as you can guess from the name, the fast interpreter runs ~2X faster than the classic interpreter but consumes about 2X memory to hold the pre-compiled code.
+- JIT:
+  Using the Just-in-Time compilation technique, we could make iwasm run much faster than Interpreter mode and sometimes very close to the speed of AOT running mode. We support two running modes of JIT:
+  - LLVM JIT: the JIT engine is implemented based on LLVM codegen. The performance of LLVM JIT is better than Fast JIT, with ~2x of the latter. But the startup time is slower than Fast JIT.
+  - Fast JIT: the JIT engine is implemented based on self-implemented codegen and asmjit encoder library. It is a lightweight JIT engine with small footprint, quick startup, good portability and relatively good performance. Currently it supports x86-64 target and Linux/Linux-SGX/MacOS platforms. The performance of Fast JIT is ~50% of the performance of LLVM JIT.
+
+<!-- TODO: incoming blog -->
+For more detailed introduction, kindly refer to this article(**incoming**) in our blog.
--- a/product-mini/platforms/rt-thread/iwasm.c
+++ b/product-mini/platforms/rt-thread/iwasm.c
@ -262,6 +262,7 @@ iwasm(int argc, char **argv)
    wasm_module_t wasm_module = NULL;
    wasm_module_inst_t wasm_module_inst = NULL;
    RuntimeInitArgs init_args;
+    struct InstantiationArgs2 *inst_args;
    static char error_buf[128] = { 0 };
    /* avoid stack overflow */
 #if WASM_ENABLE_LIBC_WASI != 0
@ -369,13 +370,23 @@ iwasm(int argc, char **argv)
        rt_kprintf("%s\n", error_buf);
        goto fail2;
    }
+
+    if (!wasm_runtime_instantiation_args_create(&inst_args)) {
+        rt_kprintf("failed to create instantiate args\n");
+        goto fail3;
+    }
+    wasm_runtime_instantiation_args_set_default_stack_size(inst_args,
+                                                           stack_size);
+    wasm_runtime_instantiation_args_set_host_managed_heap_size(inst_args,
+                                                               heap_size);
 #if WASM_ENABLE_LIBC_WASI != 0
    libc_wasi_init(wasm_module, argc, argv, &wasi_parse_ctx);
 #endif

    rt_memset(error_buf, 0x00, sizeof(error_buf));
-    wasm_module_inst = wasm_runtime_instantiate(
-        wasm_module, stack_size, heap_size, error_buf, sizeof(error_buf));
+    wasm_module_inst = wasm_runtime_instantiate_ex2(
+        wasm_module, inst_args, error_buf, sizeof(error_buf));
+    wasm_runtime_instantiation_args_destroy(inst_args);
    if (!wasm_module_inst) {
        rt_kprintf("%s\n", error_buf);
        goto fail3;
--- a/samples/basic/README.md
+++ b/samples/basic/README.md
@ -1,4 +1,6 @@
-
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/basic"
+---

 The "basic" sample project
 ==============
--- a/samples/file/README.md
+++ b/samples/file/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/file"
+---
 # "file" sample introduction

 This sample demonstrates the supported file interaction API of WASI.
--- a/samples/import-func-callback/CMakeLists.txt
+++ b/samples/import-func-callback/CMakeLists.txt
@ -0,0 +1,106 @@
+# Copyright (C) 2019 Intel Corporation.  All rights reserved.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+cmake_minimum_required (VERSION 3.14)
+
+include(CheckPIESupported)
+include(ExternalProject)
+
+project (import-func-callback)
+
+set (CMAKE_CXX_STANDARD 17)
+
+################  runtime settings  ################
+string (TOLOWER ${CMAKE_HOST_SYSTEM_NAME} WAMR_BUILD_PLATFORM)
+if (APPLE)
+  add_definitions(-DBH_PLATFORM_DARWIN)
+endif ()
+
+# Reset default linker flags
+set (CMAKE_SHARED_LIBRARY_LINK_C_FLAGS "")
+set (CMAKE_SHARED_LIBRARY_LINK_CXX_FLAGS "")
+
+# WAMR features switch
+
+# Set WAMR_BUILD_TARGET, currently values supported:
+# "X86_64", "AMD_64", "X86_32", "AARCH64[sub]", "ARM[sub]", "THUMB[sub]",
+# "MIPS", "XTENSA", "RISCV64[sub]", "RISCV32[sub]"
+if (NOT DEFINED WAMR_BUILD_TARGET)
+  if (CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|aarch64)")
+    set (WAMR_BUILD_TARGET "AARCH64")
+  elseif (CMAKE_SYSTEM_PROCESSOR STREQUAL "riscv64")
+    set (WAMR_BUILD_TARGET "RISCV64")
+  elseif (CMAKE_SIZEOF_VOID_P EQUAL 8)
+    # Build as X86_64 by default in 64-bit platform
+    set (WAMR_BUILD_TARGET "X86_64")
+  elseif (CMAKE_SIZEOF_VOID_P EQUAL 4)
+    # Build as X86_32 by default in 32-bit platform
+    set (WAMR_BUILD_TARGET "X86_32")
+  else ()
+    message(SEND_ERROR "Unsupported build target platform!")
+  endif ()
+endif ()
+
+if (NOT CMAKE_BUILD_TYPE)
+  set (CMAKE_BUILD_TYPE Debug)
+endif ()
+
+set (WAMR_BUILD_INTERP 1)
+
+if (NOT MSVC)
+  # linker flags
+  if (NOT (CMAKE_C_COMPILER MATCHES ".*clang.*" OR CMAKE_C_COMPILER_ID MATCHES ".*Clang"))
+    set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--gc-sections")
+  endif ()
+  set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wformat -Wformat-security")
+  if (WAMR_BUILD_TARGET MATCHES "X86_.*" OR WAMR_BUILD_TARGET STREQUAL "AMD_64")
+    if (NOT (CMAKE_C_COMPILER MATCHES ".*clang.*" OR CMAKE_C_COMPILER_ID MATCHES ".*Clang"))
+      set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -mindirect-branch-register")
+    endif ()
+  endif ()
+endif ()
+
+# build out vmlib
+set (WAMR_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/../..)
+include (${WAMR_ROOT_DIR}/build-scripts/runtime_lib.cmake)
+
+add_library(vmlib ${WAMR_RUNTIME_LIB_SOURCE})
+
+################ wasm application ################
+if (NOT DEFINED WASI_SDK_DIR)
+    set (WASI_SDK_DIR "/opt/wasi-sdk")
+endif ()
+
+ExternalProject_Add(wasm_app
+    SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/wasm-apps
+    BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}/wasm-apps
+    CONFIGURE_COMMAND ""
+    BUILD_COMMAND ${CMAKE_COMMAND} -E env
+        ${WASI_SDK_DIR}/bin/clang
+        -nostdlib
+        --target=wasm32
+        -Wl,--no-entry
+        -Wl,--export=test
+        -Wl,--allow-undefined
+        -o ${CMAKE_CURRENT_BINARY_DIR}/wasm-apps/test.wasm
+        ${CMAKE_CURRENT_SOURCE_DIR}/wasm-apps/test.c
+    BUILD_ALWAYS TRUE
+    INSTALL_COMMAND ""
+)
+
+################  application related  ################
+include_directories(${CMAKE_CURRENT_LIST_DIR}/src)
+include (${SHARED_DIR}/utils/uncommon/shared_uncommon.cmake)
+
+add_executable (import-func-callback src/main.c ${UNCOMMON_SHARED_SOURCE})
+
+add_dependencies(import-func-callback wasm_app)
+
+check_pie_supported()
+set_target_properties (import-func-callback PROPERTIES POSITION_INDEPENDENT_CODE ON)
+
+if (APPLE)
+  target_link_libraries (import-func-callback vmlib -lm -ldl -lpthread ${LLVM_AVAILABLE_LIBS})
+else ()
+  target_link_libraries (import-func-callback vmlib -lm -ldl -lpthread -lrt ${LLVM_AVAILABLE_LIBS})
+endif ()
--- a/samples/import-func-callback/README.md
+++ b/samples/import-func-callback/README.md
@ -0,0 +1,14 @@
+# "import function callback" sample introduction
+
+This sample demonstrates how to use import function callbacks to handle WebAssembly modules that import external functions. The sample shows how to register callback functions for imported functions and execute them when the WASM module loads these imported functions.
+
+The sample includes a WASM module that imports external functions and a host application that provides callback `import_func_type_callback` for these imported functions.
+
+## Build and run the sample
+
+```bash
+mkdir build && cd build
+cmake ..
+cmake --build . --config Release
+./import-func-callback
+```
--- a/samples/import-func-callback/src/main.c
+++ b/samples/import-func-callback/src/main.c
@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2019 Intel Corporation.  All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+ */
+
+#include "wasm_export.h"
+#include "bh_read_file.h"
+#include "bh_getopt.h"
+#include "assert.h"
+
+typedef void (*wasm_func_type_callback_t)(const wasm_import_t *import_type);
+
+const char *import_func_names[] = { "import_func1", "import_func2" };
+
+void
+import_func_type_callback(const wasm_import_t *import_type)
+{
+    int ret = 0;
+    for (uint32_t i = 0;
+         i < sizeof(import_func_names) / sizeof(import_func_names[0]); i++) {
+        if (strcmp(import_type->name, import_func_names[i]) == 0) {
+            ret = 1;
+            break;
+        }
+    }
+    assert(ret == 1);
+    return;
+}
+
+/* Iterate over all import functions in the module */
+void
+wasm_runtime_for_each_import_func(const wasm_module_t module,
+                                  wasm_func_type_callback_t callback)
+{
+    int32_t import_count = wasm_runtime_get_import_count(module);
+    if (import_count <= 0)
+        return;
+    if (callback == NULL)
+        return;
+
+    for (int32_t i = 0; i < import_count; ++i) {
+        wasm_import_t import_type;
+        wasm_runtime_get_import_type(module, i, &import_type);
+
+        if (import_type.kind != WASM_IMPORT_EXPORT_KIND_FUNC) {
+            continue;
+        }
+
+        callback(&import_type);
+    }
+}
+
+int
+main(int argc, char *argv_main[])
+{
+    static char global_heap_buf[512 * 1024];
+    wasm_module_t module = NULL;
+    uint32 buf_size;
+    char *buffer = NULL;
+    const char *wasm_path = "wasm-apps/test.wasm";
+    char error_buf[128];
+
+    RuntimeInitArgs init_args;
+    memset(&init_args, 0, sizeof(RuntimeInitArgs));
+
+    init_args.mem_alloc_type = Alloc_With_Pool;
+    init_args.mem_alloc_option.pool.heap_buf = global_heap_buf;
+    init_args.mem_alloc_option.pool.heap_size = sizeof(global_heap_buf);
+
+    if (!wasm_runtime_full_init(&init_args)) {
+        printf("Init runtime environment failed.\n");
+        return -1;
+    }
+    buffer = bh_read_file_to_buffer(wasm_path, &buf_size);
+
+    if (!buffer) {
+        printf("Open wasm app file [%s] failed.\n", wasm_path);
+        goto fail;
+    }
+
+    module = wasm_runtime_load((uint8 *)buffer, buf_size, error_buf,
+                               sizeof(error_buf));
+    if (!module) {
+        printf("Load wasm app file [%s] failed.\n", wasm_path);
+        goto fail;
+    }
+
+    wasm_runtime_for_each_import_func(module, import_func_type_callback);
+
+fail:
+    if (module)
+        wasm_runtime_unload(module);
+    if (buffer)
+        BH_FREE(buffer);
+    wasm_runtime_destroy();
+    return 0;
+}
--- a/samples/import-func-callback/wasm-apps/test.c
+++ b/samples/import-func-callback/wasm-apps/test.c
@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2019 Intel Corporation.  All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+ */
+
+extern int
+import_func1(int a, int b);
+extern int
+import_func2(int a);
+
+int
+test()
+{
+    int a = import_func1(1, 2);
+    int b = import_func2(3);
+    return a + b;
+}
--- a/samples/multi-module/README.md
+++ b/samples/multi-module/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/multi-module"
+---
 # WAMR MULTI-MODUEL SAMPLE
 **WAMR supports *multi-module* in both *interpreter* mode and *aot* mode.**

--- a/samples/multi-thread/README.md
+++ b/samples/multi-thread/README.md
@ -0,0 +1,3 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/multi-thread"
+---
--- a/samples/native-lib/README.md
+++ b/samples/native-lib/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/native-lib"
+---
 # "native-lib" sample introduction

 This sample demonstrates how to write required interfaces in native library, build it into a shared library and register the shared library to iwasm.
--- a/samples/ref-types/README.md
+++ b/samples/ref-types/README.md
@ -0,0 +1,3 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/ref-types"
+---
--- a/samples/sgx-ra/README.md
+++ b/samples/sgx-ra/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/sgx-ra"
+---
 "sgx-ra" sample introduction
 ==============

--- a/samples/socket-api/CMakeLists.txt
+++ b/samples/socket-api/CMakeLists.txt
@ -34,7 +34,7 @@ endif()

 message(CHECK_START "Detecting WASI_TOOLCHAIN_FILE at ${WASI_SDK_DIR}")
 find_file(WASI_TOOLCHAIN_FILE
-  wasi-sdk.cmake
+  wasi-sdk-pthread.cmake
  PATHS "${WASI_SDK_DIR}/share/cmake"
  NO_DEFAULT_PATH
  NO_CMAKE_FIND_ROOT_PATH
@ -46,7 +46,7 @@ else()
 endif()

 if(WASI_TOOLCHAIN_FILE-NOTFOUND)
-  message(FATAL_ERROR "Can not find wasi-sdk.cmake under ${WASI_SDK_DIR}")
+  message(FATAL_ERROR "Can not find wasi-sdk-pthread.cmake under ${WASI_SDK_DIR}")
 endif()

 message(CHECK_START "Detecting WASI_SYS_ROOT at ${WASI_SDK_DIR}")
@ -80,10 +80,7 @@ ExternalProject_Add(wasm-app
  SOURCE_DIR        ${CMAKE_CURRENT_SOURCE_DIR}/wasm-src
  UPDATE_COMMAND    ""
  PATCH_COMMAND     ""
-  CONFIGURE_COMMAND ${CMAKE_COMMAND} -E copy
-                      ${CMAKE_CURRENT_SOURCE_DIR}/../../wamr-sdk/app/libc-builtin-sysroot/include/pthread.h
-                      ${CMAKE_CURRENT_SOURCE_DIR}/wasm-src/inc
-                    && ${CMAKE_COMMAND}
+  CONFIGURE_COMMAND ${CMAKE_COMMAND}
                      -DWASI_SDK_PREFIX=${WASI_SDK_DIR}
                      -DCMAKE_TOOLCHAIN_FILE=${WASI_TOOLCHAIN_FILE}
                      -DCMAKE_SYSROOT=${WASI_SYS_ROOT}
@ -170,8 +167,8 @@ set(WAMR_BUILD_AOT 1)
 set(WAMR_BUILD_JIT 0)
 set(WAMR_BUILD_LIBC_BUILTIN 1)
 set(WAMR_BUILD_LIBC_WASI 1)
-set(WAMR_BUILD_LIB_PTHREAD 1)
 set(WAMR_BUILD_REF_TYPES 1)
+set(WAMR_BUILD_LIB_WASI_THREADS 1)

 # compiling and linking flags
 if (NOT (CMAKE_C_COMPILER MATCHES ".*clang.*" OR CMAKE_C_COMPILER_ID MATCHES ".*Clang"))
--- a/samples/socket-api/README.md
+++ b/samples/socket-api/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/socket-api"
+---
 # "socket-api" sample introduction

 This sample demonstrates how to use WAMR socket-api to develop wasm network applications.
--- a/samples/socket-api/sample_test_run.py
+++ b/samples/socket-api/sample_test_run.py
@ -31,7 +31,7 @@ def run_cmd(cmd, cwd):
        shlex.split(cmd), cwd=cwd, check=False, capture_output=True
    )
    if (qry_prc.returncode != 0):
-        print("Run {} failed, return {}".format(cmd), qry_prc.returncode)
+        print("Run {} failed, return {}".format(cmd, qry_prc.returncode))
        return
    print("return code: {}, output:\n{}".format(qry_prc.returncode,
                                                 qry_prc.stdout.decode()))
--- a/samples/spawn-thread/README.md
+++ b/samples/spawn-thread/README.md
@ -0,0 +1,3 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/spawn-thread"
+---
--- a/samples/wasm-c-api/README.md
+++ b/samples/wasm-c-api/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/wasm-c-api"
+---
 WAMR supports *wasm-c-api* in both *interpreter* mode and *aot* mode.

 Before staring, we need to download and install [WABT](https://github.com/WebAssembly/wabt/releases/latest).
--- a/samples/workload/README.md
+++ b/samples/workload/README.md
@ -1,3 +1,6 @@
+---
+description: "The related code/working directory of this example resides in directory {WAMR_DIR}/samples/workload"
+---
 All workloads have similar requirement of software dependencies, including **emsdk** and **binaryen**

 > There might be slight differences when using MacOS and other Linux distro than Ubuntu. This document targets
--- a/tests/regression/ba-issues/issues/issue-4643/test.wasm
+++ b/tests/regression/ba-issues/issues/issue-4643/test.wasm
--- a/tests/regression/ba-issues/issues/issue-4643/test.wat
+++ b/tests/regression/ba-issues/issues/issue-4643/test.wat
@ -0,0 +1,43 @@
+(module
+  (memory 1)
+  (export "memory" (memory 0))
+
+  (func $test
+    ;; Add 130 i64 locals (260 slots) to push v128 past offset 256
+    (local $d0 i64) (local $d1 i64) (local $d2 i64) (local $d3 i64) (local $d4 i64)
+    (local $d5 i64) (local $d6 i64) (local $d7 i64) (local $d8 i64) (local $d9 i64)
+    (local $d10 i64) (local $d11 i64) (local $d12 i64) (local $d13 i64) (local $d14 i64)
+    (local $d15 i64) (local $d16 i64) (local $d17 i64) (local $d18 i64) (local $d19 i64)
+    (local $d20 i64) (local $d21 i64) (local $d22 i64) (local $d23 i64) (local $d24 i64)
+    (local $d25 i64) (local $d26 i64) (local $d27 i64) (local $d28 i64) (local $d29 i64)
+    (local $d30 i64) (local $d31 i64) (local $d32 i64) (local $d33 i64) (local $d34 i64)
+    (local $d35 i64) (local $d36 i64) (local $d37 i64) (local $d38 i64) (local $d39 i64)
+    (local $d40 i64) (local $d41 i64) (local $d42 i64) (local $d43 i64) (local $d44 i64)
+    (local $d45 i64) (local $d46 i64) (local $d47 i64) (local $d48 i64) (local $d49 i64)
+    (local $d50 i64) (local $d51 i64) (local $d52 i64) (local $d53 i64) (local $d54 i64)
+    (local $d55 i64) (local $d56 i64) (local $d57 i64) (local $d58 i64) (local $d59 i64)
+    (local $d60 i64) (local $d61 i64) (local $d62 i64) (local $d63 i64) (local $d64 i64)
+    (local $d65 i64) (local $d66 i64) (local $d67 i64) (local $d68 i64) (local $d69 i64)
+    (local $d70 i64) (local $d71 i64) (local $d72 i64) (local $d73 i64) (local $d74 i64)
+    (local $d75 i64) (local $d76 i64) (local $d77 i64) (local $d78 i64) (local $d79 i64)
+    (local $d80 i64) (local $d81 i64) (local $d82 i64) (local $d83 i64) (local $d84 i64)
+    (local $d85 i64) (local $d86 i64) (local $d87 i64) (local $d88 i64) (local $d89 i64)
+    (local $d90 i64) (local $d91 i64) (local $d92 i64) (local $d93 i64) (local $d94 i64)
+    (local $d95 i64) (local $d96 i64) (local $d97 i64) (local $d98 i64) (local $d99 i64)
+    (local $d100 i64) (local $d101 i64) (local $d102 i64) (local $d103 i64) (local $d104 i64)
+    (local $d105 i64) (local $d106 i64) (local $d107 i64) (local $d108 i64) (local $d109 i64)
+    (local $d110 i64) (local $d111 i64) (local $d112 i64) (local $d113 i64) (local $d114 i64)
+    (local $d115 i64) (local $d116 i64) (local $d117 i64) (local $d118 i64) (local $d119 i64)
+    (local $d120 i64) (local $d121 i64) (local $d122 i64) (local $d123 i64) (local $d124 i64)
+    (local $d125 i64) (local $d126 i64) (local $d127 i64) (local $d128 i64) (local $d129 i64)
+
+    (local $vec v128)
+
+    ;; Should hit WASM_OP_TEE_LOCAL rather than EXT_OP_TEE_LOCAL_FAST_V128
+    (v128.const i32x4 1 2 3 4)
+    (local.tee $vec)
+    (drop)
+  )
+
+  (export "_start" (func $test))
+)
--- a/tests/regression/ba-issues/issues/issue-4646/test.wasm
+++ b/tests/regression/ba-issues/issues/issue-4646/test.wasm
--- a/tests/regression/ba-issues/issues/issue-4646/test.wat
+++ b/tests/regression/ba-issues/issues/issue-4646/test.wat
@ -0,0 +1,31 @@
+;; define different reference types
+(type $struct_a (struct (field (mut i32))))
+(type $struct_b (struct (field (mut i64))))
+(type $struct_c (struct (field (mut i32)) (field (mut i32))))
+
+(func $main
+  ;; prepare parameters: i32, ref_a, i32, ref_b
+  (i32.const 10)
+  (struct.new $struct_a (i32.const 100))
+  (i32.const 20)
+  (struct.new $struct_b (i64.const 200))
+
+  ;; block with interleaved parameters: i32, ref_a, i32, ref_b -> ref_c
+  (block (param i32 (ref $struct_a) i32 (ref $struct_b)) (result (ref $struct_c))
+    ;; clean up parameters from stack
+    drop  ;; drop ref_b
+    drop  ;; drop i32
+    drop  ;; drop ref_a
+    drop  ;; drop i32
+
+    ;; return new type reference struct_c
+    (struct.new $struct_c (i32.const 300) (i32.const 400))
+  )
+
+  ;; drop return value
+  drop
+)
+
+(memory 1)
+(export "memory" (memory 0))
+(export "_start" (func $main))
--- a/tests/regression/ba-issues/running_config.json
+++ b/tests/regression/ba-issues/running_config.json
@ -1754,6 +1754,38 @@
                "stdout content": "",
                "description": "no sanitizer 'heap-buffer-overflow'"
            }
+        },
+        {
+            "deprecated": false,
+            "ids": [
+                4643
+            ],
+            "runtime": "iwasm-default-wasi-disabled",
+            "file": "test.wasm",
+            "mode": "fast-interp",
+            "options": "-f _start",
+            "argument": "",
+            "expected return": {
+                "ret code": 0,
+                "stdout content": "",
+                "description": "no 'invalid local type'"
+            }
+        },
+        {
+            "deprecated": false,
+            "ids": [
+                4646
+            ],
+            "runtime": "iwasm-default-gc-enabled",
+            "file": "test.wasm",
+            "mode": "classic-interp",
+            "options": "-f _start",
+            "argument": "",
+            "expected return": {
+                "ret code": 0,
+                "stdout content": "",
+                "description": "load successfully"
+            }
        }
    ]
 }
--- a/tests/wamr-test-suites/spec-test-script/gc_array_fill_cases.patch
+++ b/tests/wamr-test-suites/spec-test-script/gc_array_fill_cases.patch
@ -0,0 +1,27 @@
+diff --git a/test/core/gc/array_fill.wast b/test/core/gc/array_fill.wast
+index 0379ad53..73122178 100644
+--- a/test/core/gc/array_fill.wast
+++ b/test/core/gc/array_fill.wast
+@@ -79,3 +79,22 @@
+ (assert_return (invoke "array_get_nth" (i32.const 2)) (i32.const 11))
+ (assert_return (invoke "array_get_nth" (i32.const 3)) (i32.const 11))
+ (assert_return (invoke "array_get_nth" (i32.const 4)) (i32.const 0))
+
+;; fill the whole array
+(assert_return (invoke "array_fill" (i32.const 0) (i32.const 42) (i32.const 12)))
+(assert_return (invoke "array_get_nth" (i32.const 0)) (i32.const 42))
+(assert_return (invoke "array_get_nth" (i32.const 2)) (i32.const 42))
+(assert_return (invoke "array_get_nth" (i32.const 5)) (i32.const 42))
+(assert_return (invoke "array_get_nth" (i32.const 11)) (i32.const 42))
+
+;; fill the first element
+(assert_return (invoke "array_fill" (i32.const 0) (i32.const 7) (i32.const 1)))
+(assert_return (invoke "array_get_nth" (i32.const 0)) (i32.const 7))
+(assert_return (invoke "array_get_nth" (i32.const 1)) (i32.const 42))
+(assert_return (invoke "array_get_nth" (i32.const 11)) (i32.const 42))
+
+;; fill the last 2 elements
+(assert_return (invoke "array_fill" (i32.const 10) (i32.const 9) (i32.const 2)))
+(assert_return (invoke "array_get_nth" (i32.const 9)) (i32.const 42))
+(assert_return (invoke "array_get_nth" (i32.const 10)) (i32.const 9))
+(assert_return (invoke "array_get_nth" (i32.const 11)) (i32.const 9))
--- a/tests/wamr-test-suites/test_wamr.sh
+++ b/tests/wamr-test-suites/test_wamr.sh
@ -478,6 +478,7 @@ function spec_test()
        #  Dec 9, 2024. Merge branch 'funcref'
        git reset --hard 756060f5816c7e2159f4817fbdee76cf52f9c923
        git apply --ignore-whitespace ../../spec-test-script/gc_ignore_cases.patch || exit 1
+        git apply --ignore-whitespace ../../spec-test-script/gc_array_fill_cases.patch || exit 1

        if [[ ${ENABLE_QEMU} == 1 ]]; then
            # Decrease the recursive count for tail call cases as nuttx qemu's