kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/path.rs

@@ -0,0 +1,21 @@
+//! Paths beneath a Filesystem's root, components joined by `/` and the
+//! empty path being the root: the files a Host App seeds a Tmpfs with.
+
+/// The last name of `path`, within its parent.
+pub(crate) fn name(path: &str) -> &str {
+    path.rsplit_once('/').map_or(path, |(_, name)| name)
+}
+
+/// Every directory above `path`, outermost first, the root left out.
+pub(crate) fn ancestors(path: &str) -> impl Iterator<Item = &str> {
+    path.match_indices('/').map(move |(end, _)| &path[..end])
+}
+
+/// A path a Host App seeds a Filesystem with, in the form a runtime hands
+/// over: no leading `/`, and no empty or `.` component.
+pub(crate) fn normalize_seed(path: &str) -> String {
+    path.split('/')
+        .filter(|component| !component.is_empty() && *component != ".")
+        .collect::<Vec<_>>()
+        .join("/")
+}

data/crates/kobako-runtime/src/filesystem/pipe.rs

@@ -0,0 +1,221 @@
+//! The in-memory pipes an invocation's standard streams run over, as Linux's
+//! pipefs holds anonymous pipes. Any ABI a Wasm Driver encodes reads the Preamble
+//! and writes a Channel through them, so none brings its own, and a pipe's two
+//! ends are open files like any other.
+
+use std::sync::{Arc, LazyLock, Mutex, PoisonError};
+
+use crate::vfs::{
+    alloc_file_pseudo, Cred, Dentry, FMode, File, FileOperations, FileSystemType, FileType,
+    FilesystemError, Inode, InodeOperations, Kiocb, Kstat, OpenHow, PollMask, SuperBlock, VfsMount,
+};
+
+/// The one Filesystem every pipe stands on, as Linux's `pipe_mnt`. No path
+/// reaches it: a pipe is only ever open.
+static PIPE_MNT: LazyLock<Arc<VfsMount>> = LazyLock::new(|| {
+    let sb = SuperBlock::new(Arc::new(PipeFs)).expect("pipefs fills in nothing that can fail");
+    VfsMount::kern_mount(sb)
+});
+
+/// A pipe reports what it is and no length, as `get_pipe_inode` makes one.
+struct PipeFs;
+
+impl FileSystemType for PipeFs {
+    fn fill_super(self: Arc<Self>, sb: &mut SuperBlock) -> Result<(), FilesystemError> {
+        sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+        Ok(())
+    }
+}
+
+impl InodeOperations for PipeFs {
+    fn getattr(&self, _dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        Ok(Kstat::new(FileType::Fifo, 0))
+    }
+}
+
+/// What a pipe holds, as Linux's `pipe_inode_info`: what was written and not
+/// yet read, up to a capacity.
+pub struct PipeInodeInfo {
+    state: Mutex<PipeState>,
+    capacity: usize,
+}
+
+struct PipeState {
+    bytes: Vec<u8>,
+    read: usize,
+}
+
+impl PipeInodeInfo {
+    /// An empty pipe holding at most `capacity` bytes.
+    pub fn new(capacity: usize) -> Arc<Self> {
+        Self::with_bytes(Vec::new(), capacity)
+    }
+
+    /// A pipe already holding `bytes`, as the Preamble's stream does, with no
+    /// room for more.
+    pub fn from_bytes(bytes: Vec<u8>) -> Arc<Self> {
+        let capacity = bytes.len();
+        Self::with_bytes(bytes, capacity)
+    }
+
+    fn with_bytes(bytes: Vec<u8>, capacity: usize) -> Arc<Self> {
+        Arc::new(Self {
+            state: Mutex::new(PipeState { bytes, read: 0 }),
+            capacity,
+        })
+    }
+
+    /// Everything written so far, as a Channel's capture reads it back.
+    pub fn contents(&self) -> Vec<u8> {
+        self.state().bytes.clone()
+    }
+
+    fn state(&self) -> std::sync::MutexGuard<'_, PipeState> {
+        self.state.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+/// What answers for either end of a pipe, as Linux's `pipeanon_fops`.
+struct AnonPipe(Arc<PipeInodeInfo>);
+
+impl FileOperations for AnonPipe {
+    /// A pipe has no offsets, so a read takes what comes next. A drained pipe
+    /// reads nothing, as a closed writer's does, and so does a read into no
+    /// room, as `pipe_read` answers one.
+    fn read_iter(&mut self, _iocb: &mut Kiocb, buf: &mut [u8]) -> Result<usize, FilesystemError> {
+        let mut state = self.0.state();
+        let start = state.read;
+        let rest = &state.bytes[start..];
+        let take = rest.len().min(buf.len());
+        buf[..take].copy_from_slice(&rest[..take]);
+        state.read += take;
+        Ok(take)
+    }
+
+    /// A pipe has no offsets, so a write lands after the last. A write past
+    /// the capacity keeps what fit and answers a failure, which is how a
+    /// capture one past its limit learns it was truncated.
+    fn write_iter(&mut self, _iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        let mut state = self.0.state();
+        let take = buf.len().min(self.0.capacity - state.bytes.len());
+        state.bytes.extend_from_slice(&buf[..take]);
+        if take < buf.len() {
+            return Err(FilesystemError::Other("the pipe is full".to_string()));
+        }
+        Ok(take)
+    }
+
+    /// Each end is ready for what it was opened for, as `pipe_poll` reads
+    /// `f_mode`; nothing here waits for the other end.
+    fn poll(&self, mode: FMode) -> PollMask {
+        match mode.contains(FMode::READ) {
+            true => PollMask::IN,
+            false => PollMask::OUT,
+        }
+    }
+
+    /// Neither end takes a position, as `create_pipe_files` calls
+    /// `stream_open` on both.
+    fn is_stream(&self) -> bool {
+        true
+    }
+}
+
+/// The read and the write end of `pipe`, opened as `cred`, as Linux's
+/// `create_pipe_files` opens both on one inode as the calling task. Neither
+/// takes a position.
+pub fn create_pipe_files(pipe: &Arc<PipeInodeInfo>, cred: &Arc<Cred>) -> (File, File) {
+    let inode = Inode::new(&Kstat::new(FileType::Fifo, 0), Arc::new(PipeFs));
+    let write = alloc_file_pseudo(
+        inode,
+        &PIPE_MNT,
+        &OpenHow {
+            write: true,
+            ..OpenHow::default()
+        },
+        Box::new(AnonPipe(pipe.clone())),
+        cred,
+    );
+    let read = write.alloc_file_clone(
+        &OpenHow {
+            read: true,
+            ..OpenHow::default()
+        },
+        Box::new(AnonPipe(pipe.clone())),
+    );
+    (read, write)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_reader_reads_in_order_then_nothing() {
+        let (mut reader, _) =
+            create_pipe_files(&PipeInodeInfo::from_bytes(b"abc".to_vec()), &Arc::default());
+        let mut buf = [0; 2];
+        assert_eq!(
+            (
+                reader.read(&mut buf),
+                buf,
+                reader.read(&mut buf),
+                reader.read(&mut buf)
+            ),
+            (Ok(2), *b"ab", Ok(1), Ok(0)),
+            "File::read of a pipe's read end holding three bytes in steps of two must take them \
+             in order, then nothing"
+        );
+    }
+
+    // @behavior RT-217
+    #[test]
+    fn a_read_into_no_room_reads_nothing() {
+        let (mut holding, _) =
+            create_pipe_files(&PipeInodeInfo::from_bytes(b"a".to_vec()), &Arc::default());
+        let mut byte = [0];
+        assert_eq!(
+            (holding.read(&mut []), holding.read(&mut byte), byte),
+            (Ok(0), Ok(1), *b"a"),
+            "File::read of a pipe into no room must read nothing and leave its bytes for the next"
+        );
+    }
+
+    #[test]
+    fn a_writer_keeps_what_fits_and_fails_past_its_capacity() {
+        let pipe = PipeInodeInfo::new(3);
+        let (_, mut writer) = create_pipe_files(&pipe, &Arc::default());
+        assert_eq!(
+            (
+                writer.write(b"ab").ok(),
+                writer.write(b"cd").is_err(),
+                pipe.contents()
+            ),
+            (Some(2), true, b"abc".to_vec()),
+            "File::write past a pipe's capacity must keep what fit and fail, and \
+             PipeInodeInfo::contents must read what was written"
+        );
+    }
+
+    #[test]
+    fn a_pipe_takes_no_position() {
+        let (reader, writer) = create_pipe_files(&PipeInodeInfo::new(1), &Arc::default());
+        for end in [reader, writer] {
+            assert!(
+                end.is_stream() && !end.mode().contains(FMode::LSEEK),
+                "create_pipe_files must open each end as a stream with no position"
+            );
+        }
+    }
+
+    // @behavior RT-198
+    #[test]
+    fn a_pipe_reports_a_fifo() {
+        let (reader, _writer) = create_pipe_files(&PipeInodeInfo::new(1), &Arc::default());
+        assert_eq!(
+            reader.getattr().map(|metadata| metadata.file_type).ok(),
+            Some(FileType::Fifo),
+            "File::getattr of an end create_pipe_files made must report a FIFO"
+        );
+    }
+}

data/crates/kobako-runtime/src/filesystem/rdir.rs

@@ -0,0 +1,101 @@
+//! What a Filesystem reading a whole directory at once holds while a listing
+//! goes on, as 9p's `fid->rdir` holds what its server sent, so a caller reading in
+//! small steps costs one listing, not one per step.
+
+use std::sync::Arc;
+
+use crate::vfs::{Cred, Dentry, DirContext, DirEntry, FileType, FilesystemError};
+
+/// The entries a listing began with, `.` and `..` first, on the open directory
+/// until it reaches its end, counted against who holds them.
+#[derive(Default)]
+pub struct Rdir(Option<Listing>);
+
+struct Listing {
+    entries: Vec<DirEntry>,
+    /// Gives the entries' bytes back once the listing goes.
+    _charge: Charge,
+}
+
+/// Bytes a listing counts for as long as it holds them, as shmem pairs
+/// `shmem_acct_size` with `shmem_unacct_size`.
+struct Charge {
+    cred: Arc<Cred>,
+    bytes: usize,
+}
+
+impl Charge {
+    fn account(cred: &Arc<Cred>, entries: &[DirEntry]) -> Result<Self, FilesystemError> {
+        let names: usize = entries.iter().map(|entry| entry.name.capacity()).sum();
+        let bytes = size_of_val(entries) + names;
+        cred.security_vm_enough_memory(bytes)?;
+        Ok(Self {
+            cred: cred.clone(),
+            bytes,
+        })
+    }
+}
+
+impl Drop for Charge {
+    fn drop(&mut self) {
+        self.cred.vm_unacct_memory(self.bytes);
+    }
+}
+
+impl Rdir {
+    /// Hand `ctx` the directory from its position. A listing from the start
+    /// reads the directory through `read`, then stats it and what stands above
+    /// it for `.` and `..`, as 9p and FUSE take those from their server and
+    /// `ovl_cache_update` asks `vfs_getattr`; a failure of either answers before
+    /// any entry. A listing going on reads what that listing began with. Those
+    /// entries count against the caller from the moment they are read until the
+    /// listing ends, as `ovl_cache_get` and `v9fs_alloc_rdir_buf` allocate before
+    /// the first `dir_emit`: past what a security module allows, the listing
+    /// answers out of memory before it hands any entry.
+    pub fn iterate(
+        &mut self,
+        dentry: &Dentry,
+        ctx: &mut DirContext<'_>,
+        read: impl FnOnce() -> Result<Vec<DirEntry>, FilesystemError>,
+    ) -> Result<(), FilesystemError> {
+        let listing = match self.0.take().filter(|_| ctx.pos() != 0) {
+            Some(held) => held,
+            None => {
+                let read = read()?;
+                let mut entries = dots(dentry)?;
+                entries.extend(read);
+                entries.shrink_to_fit();
+                let _charge = Charge::account(ctx.cred(), &entries)?;
+                Listing { entries, _charge }
+            }
+        };
+        if !emit_from(ctx, &listing.entries) {
+            self.0 = Some(listing);
+        }
+        Ok(())
+    }
+}
+
+/// `.` and `..` as a stat of `dentry` and of what stands above it reports them,
+/// `..` naming `dentry` itself at the root.
+fn dots(dentry: &Dentry) -> Result<Vec<DirEntry>, FilesystemError> {
+    let dot = dentry.getattr()?;
+    let dotdot = dentry.parent().getattr()?;
+    Ok(vec![
+        DirEntry::new(".", FileType::Dir).with_identity(dot.dev, dot.ino),
+        DirEntry::new("..", FileType::Dir).with_identity(dotdot.dev, dotdot.ino),
+    ])
+}
+
+/// Hand `ctx` `entries` from where it stands, each at its index, answering
+/// whether it took them all.
+fn emit_from(ctx: &mut DirContext<'_>, entries: &[DirEntry]) -> bool {
+    let skip = usize::try_from(ctx.pos()).unwrap_or(usize::MAX);
+    entries.iter().skip(skip).all(|entry| {
+        let took = ctx.dir_emit(entry);
+        if took {
+            ctx.set_pos(ctx.pos() + 1);
+        }
+        took
+    })
+}

data/crates/kobako-runtime/src/filesystem/tmpfs/tmpfile.rs

@@ -0,0 +1,32 @@
+//! A file made with no name and named once whole, as tmpfs's
+//! `shmem_tmpfile` and `linkat` let overlayfs copy a file up unseen, and
+//! the times set on what it copies.
+
+use super::super::{FilesystemError, Iattr};
+use super::{lock, Content, Node, Tmpfs, TmpfsFile};
+
+impl Tmpfs {
+    /// An empty file with no name yet, as `O_TMPFILE` opens one. Dropped
+    /// unnamed, it gives its room back.
+    pub(crate) fn tmpfile(&self) -> Result<TmpfsFile, FilesystemError> {
+        Ok(TmpfsFile {
+            data: Content::create(&self.tree)?,
+        })
+    }
+
+    /// Name `file` `name` in this directory, as `simple_link` names a file
+    /// `O_TMPFILE` opened once `vfs_link` found the name free.
+    pub(crate) fn link(&self, file: &TmpfsFile, name: &str) -> Result<(), FilesystemError> {
+        self.dir.state().insert(name, Node::File(file.data.clone()));
+        Ok(())
+    }
+}
+
+impl TmpfsFile {
+    /// Set the times `attr` names on a file with no name yet, as
+    /// `shmem_setattr` takes them where overlayfs sets the temporary file's
+    /// times before naming it.
+    pub(crate) fn setattr(&self, attr: &Iattr) {
+        lock(&self.data).times.apply(attr);
+    }
+}

data/crates/kobako-runtime/src/filesystem/tmpfs/whiteout.rs

@@ -0,0 +1,85 @@
+//! The whiteout a Tmpfs holds for an Overlay, and the moves that place
+//! one, as tmpfs's `shmem_whiteout` makes a character device 0:0 and
+//! `shmem_rename2` takes `RENAME_NOREPLACE`, `RENAME_EXCHANGE`, and
+//! `RENAME_WHITEOUT`.
+
+use std::sync::Arc;
+
+use super::super::FilesystemError;
+use super::{Node, Space, Tmpfs};
+use crate::vfs::RenameFlag;
+
+/// A whiteout, counting one inode for as long as it stands, as the
+/// character device tmpfs makes for one does.
+pub(super) struct Whiteout {
+    space: Arc<Space>,
+}
+
+impl Drop for Whiteout {
+    fn drop(&mut self) {
+        self.space.inodes.give(1);
+    }
+}
+
+impl Tmpfs {
+    fn new_whiteout(&self) -> Result<Node, FilesystemError> {
+        self.tree.space.inodes.take(1)?;
+        Ok(Node::Whiteout {
+            _inode: Arc::new(Whiteout {
+                space: self.tree.space.clone(),
+            }),
+        })
+    }
+
+    /// Whether a whiteout stands at `name`, as overlayfs's
+    /// `ovl_is_whiteout` reads a character device 0:0.
+    pub(crate) fn is_whiteout(&self, name: &str) -> bool {
+        matches!(self.dir.get(name), Ok(Node::Whiteout { .. }))
+    }
+
+    /// Make a whiteout at `name`, as `shmem_mknod` makes the character
+    /// device 0:0 `vfs_whiteout` asks for.
+    pub(crate) fn whiteout(&self, name: &str) -> Result<(), FilesystemError> {
+        let whiteout = self.new_whiteout()?;
+        self.dir.state().insert(name, whiteout);
+        Ok(())
+    }
+
+    /// Move `from` to `to` in `target` as `shmem_rename2` does with
+    /// `flag`, the entry taking all it holds, so no name beneath it
+    /// changes. Without one, what stands at `to` goes as rename(2)
+    /// replaces it, once the VFS found the move fits what stands on each
+    /// side.
+    pub(super) fn rename_at(
+        &self,
+        from: &str,
+        target: &Tmpfs,
+        to: &str,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        let (from_dir, to_dir) = (&self.dir, &target.dir);
+        let moving = from_dir.get(from)?;
+        let replaced = to_dir.get(to).ok();
+        if flag == Some(RenameFlag::Exchange) {
+            let replaced = replaced.ok_or(FilesystemError::NotFound)?;
+            from_dir.state().exchange(from, replaced);
+            to_dir.state().exchange(to, moving);
+            return Ok(());
+        }
+        if let Some(Node::Directory(dir)) = &replaced {
+            if !dir.state().entries.is_empty() {
+                return Err(FilesystemError::DirectoryNotEmpty);
+            }
+        }
+        let left = match flag {
+            Some(RenameFlag::Whiteout) => Some(self.new_whiteout()?),
+            _ => None,
+        };
+        match left {
+            Some(left) => from_dir.state().exchange(from, left),
+            None => from_dir.state().take(from),
+        }
+        to_dir.state().insert(to, moving);
+        Ok(())
+    }
+}

data/crates/kobako-runtime/src/filesystem/tmpfs/xattr.rs

@@ -0,0 +1,22 @@
+//! A directory's extended attributes, as tmpfs keeps the `trusted.*`
+//! ones overlayfs marks a directory opaque with.
+
+use super::super::FilesystemError;
+use super::Tmpfs;
+
+impl Tmpfs {
+    /// The value of the attribute `name` on this directory, as `getxattr`
+    /// reads it, or `None` where it is not set.
+    pub(crate) fn getxattr(&self, name: &str) -> Option<Vec<u8>> {
+        self.dir.state().xattrs.get(name).cloned()
+    }
+
+    /// Set the attribute `name` on this directory, as `setxattr` does.
+    pub(crate) fn setxattr(&self, name: &str, value: &[u8]) -> Result<(), FilesystemError> {
+        self.dir
+            .state()
+            .xattrs
+            .insert(name.to_string(), value.to_vec());
+        Ok(())
+    }
+}