kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/wrap.rs

@@ -0,0 +1,224 @@
+//! A test's Filesystem over another: every call forwards to the entry it
+//! wraps unless its `Hook` steps in, and every entry a lookup finds is
+//! wrapped too, as a Filesystem wrapping another must. It makes a file
+//! through `create` and leaves the open to the VFS, as overlayfs does, so an
+//! open's lookup reaches the `Hook` as any lookup does. It hands the
+//! Filesystem beneath the dentry it is handed, where overlayfs hands a real
+//! one, so what that Filesystem makes is recorded unwrapped and later calls
+//! on it reach that Filesystem past the `Hook`.
+
+use std::any::Any;
+use std::sync::Arc;
+
+use super::{
+    DentryOperations, FileOperations, FileSystemType, Filesystem, FilesystemError, Iattr,
+    InodeOperations, Kstat, Lookup, Mask, OpenHow, RenameFlag,
+};
+use crate::vfs::{Dentry, Inode};
+
+/// What a test changes of the Filesystem beneath it.
+pub(crate) trait Hook: Send + Sync + 'static {
+    fn permission(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+        mask: Mask,
+    ) -> Result<(), FilesystemError> {
+        inner.permission(dentry, mask)
+    }
+
+    fn revalidate(
+        &self,
+        ops: &dyn DentryOperations,
+        dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        ops.revalidate(dir, dentry)
+    }
+
+    fn getattr(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Kstat, FilesystemError> {
+        inner.getattr(dentry)
+    }
+
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        inner.lookup(dentry)
+    }
+
+    fn open(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        inner.open(dentry, how)
+    }
+
+    fn mkdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.mkdir(dentry)
+    }
+
+    fn rmdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.rmdir(dentry)
+    }
+
+    fn unlink(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.unlink(dentry)
+    }
+
+    fn rename(
+        &self,
+        inner: &dyn InodeOperations,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        inner.rename(from, to_dir, to, flag)
+    }
+}
+
+/// A Filesystem over the one `fs` makes, with `hook` stepping in.
+pub(crate) struct Wrap<H> {
+    fs: Arc<dyn FileSystemType>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> Wrap<H> {
+    pub(crate) fn new(fs: Arc<dyn FileSystemType>, hook: Arc<H>) -> Self {
+        Self { fs, hook }
+    }
+}
+
+impl<H: Hook> FileSystemType for Wrap<H> {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        self.fs.clone().fill_super(sb)?;
+        if let Some(ops) = sb.d_op().cloned() {
+            sb.set_default_d_op(Arc::new(WrapDentry {
+                ops,
+                hook: self.hook.clone(),
+            }));
+        }
+        if let Some(root) = sb.root().and_then(|root| root.inode()) {
+            let wrapped = WrapInode {
+                inner: root.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            sb.d_make_root(root.with_ops(Arc::new(wrapped)));
+        }
+        Ok(())
+    }
+}
+
+/// `inner`, an entry of the Filesystem beneath, with `hook` stepping in.
+struct WrapInode<H> {
+    inner: Arc<dyn InodeOperations>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> WrapInode<H> {
+    /// `found` with the entry it names wrapped too.
+    fn wrap(&self, found: Lookup) -> Lookup {
+        let wrapped = |inode: Arc<Inode>| {
+            let ops = Self {
+                inner: inode.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            inode.with_ops(Arc::new(ops))
+        };
+        match found {
+            Lookup::Found(inode) => Lookup::Found(wrapped(inode)),
+            Lookup::Spelled { name, inode } => Lookup::Spelled {
+                name,
+                inode: wrapped(inode),
+            },
+            Lookup::Absent => Lookup::Absent,
+        }
+    }
+}
+
+/// `ops`, handed the directory a `WrapInode<H>` wraps.
+struct WrapDentry<H> {
+    ops: Arc<dyn DentryOperations>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> DentryOperations for WrapDentry<H> {
+    fn revalidate(
+        &self,
+        dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        let dir = (dir as &dyn Any)
+            .downcast_ref::<WrapInode<H>>()
+            .map_or(dir, |wrap| wrap.inner.as_ref());
+        self.hook.revalidate(self.ops.as_ref(), dir, dentry)
+    }
+}
+
+impl<H: Hook> InodeOperations for WrapInode<H> {
+    fn permission(&self, dentry: &Dentry, mask: Mask) -> Result<(), FilesystemError> {
+        self.hook.permission(self.inner.as_ref(), dentry, mask)
+    }
+
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.hook.getattr(self.inner.as_ref(), dentry)
+    }
+
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(self.wrap(self.hook.lookup(self.inner.as_ref(), dentry)?))
+    }
+
+    fn setattr(&self, dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+        self.inner.setattr(dentry, attr)
+    }
+
+    fn get_link(&self, dentry: &Dentry) -> Result<String, FilesystemError> {
+        self.inner.get_link(dentry)
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        self.hook.open(self.inner.as_ref(), dentry, how)
+    }
+
+    fn create(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.inner.create(dentry)
+    }
+
+    fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.mkdir(self.inner.as_ref(), dentry)
+    }
+
+    fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.rmdir(self.inner.as_ref(), dentry)
+    }
+
+    fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.unlink(self.inner.as_ref(), dentry)
+    }
+
+    fn rename(
+        &self,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        let target = (to_dir as &dyn Any)
+            .downcast_ref::<Self>()
+            .ok_or(FilesystemError::CrossesDevices)?;
+        self.hook
+            .rename(self.inner.as_ref(), from, target.inner.as_ref(), to, flag)
+    }
+}

data/crates/kobako-runtime/src/filesystem.rs

@@ -0,0 +1,26 @@
+//! The Filesystem kinds kobako ships, each built on the VFS as a Linux
+//! filesystem is: what answers every call a guest makes beneath a Mount.
+//!
+//! A third party implements the same tables to bring its own, so they are
+//! named here too; the VFS, which calls them, owns them.
+
+mod bind;
+mod overlay;
+mod path;
+mod pipe;
+mod rdir;
+mod tmpfs;
+#[cfg(test)]
+pub(crate) mod wrap;
+
+pub use bind::Bind;
+pub use overlay::Overlay;
+pub use pipe::{create_pipe_files, PipeInodeInfo};
+pub use rdir::Rdir;
+pub use tmpfs::{SeedError, Tmpfs};
+
+pub use crate::vfs::{
+    Dentry, DentryOperations, DirContext, DirEntry, FMode, FileOperations, FileSystemType,
+    FileType, FilesystemError, Finish, Iattr, Inode, InodeOperations, Kiocb, Kstat, Lookup, Mask,
+    OpenHow, PollMask, RenameFlag, SetTime, SuperBlock as Filesystem, Whence,
+};

data/crates/kobako-runtime/src/grant.rs

@@ -0,0 +1,20 @@
+//! A Grant: a host resource the Host App hands the runtime instead of
+//! binding it by name. The Sandbox holds it and each Invocation receives it
+//! afresh; the guest reaches it through its system interface.
+
+use crate::mount::Mount;
+
+/// One resource handed over for an Invocation. Each kind carries what it
+/// is and decides its own access.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum Grant {
+    Mount(Mount),
+}
+
+/// The kinds of Grant a runtime may support.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum GrantKind {
+    Mount,
+}

data/crates/kobako-runtime/src/hashtable.rs

@@ -0,0 +1,44 @@
+//! A table of objects held elsewhere, by key, as Linux's `hashtable.h`
+//! keeps the dentries and inodes in use.
+
+use std::collections::HashMap;
+use std::hash::Hash;
+use std::sync::{Arc, Weak};
+
+/// Each object by its key while something else holds it. Entries no longer
+/// held are swept out once the table reaches twice what the last sweep
+/// left, so each insertion pays a constant share of the sweeps.
+pub(crate) struct Hashtable<K, V> {
+    entries: HashMap<K, Weak<V>>,
+    sweep_at: usize,
+}
+
+impl<K, V> Default for Hashtable<K, V> {
+    fn default() -> Self {
+        Self {
+            entries: HashMap::new(),
+            sweep_at: 0,
+        }
+    }
+}
+
+impl<K: Hash + Eq, V> Hashtable<K, V> {
+    /// The object at `key`, while something holds it.
+    pub(crate) fn get(&self, key: &K) -> Option<Arc<V>> {
+        self.entries.get(key).and_then(Weak::upgrade)
+    }
+
+    pub(crate) fn insert(&mut self, key: K, value: &Arc<V>) {
+        if self.entries.len() >= self.sweep_at {
+            self.entries.retain(|_, held| held.strong_count() > 0);
+            self.sweep_at = (self.entries.len() * 2).max(16);
+        }
+        self.entries.insert(key, Arc::downgrade(value));
+    }
+
+    /// Take the object at `key` out of the table, answering it while
+    /// something holds it.
+    pub(crate) fn remove(&mut self, key: &K) -> Option<Arc<V>> {
+        self.entries.remove(key).and_then(|held| held.upgrade())
+    }
+}

data/crates/kobako-runtime/src/lib.rs

@@ -2,7 +2,8 @@
 //!
 //! The surface where a wasm engine implementation and a host frontend
 //! meet: the `Runtime` trait, the isolation `Profile` a runtime
-//! declares, the neutral per-invocation value types, and the dispatch /
+//! declares, the Grants it presents to the guest and the Filesystem a
+//! Mount places, the neutral per-invocation value types, and the dispatch /
 //! yield re-entry traits a frontend supplies. The messages these carry
 //! are `kobako-transport`'s, which this crate takes as given.
 //! Nothing here depends on an engine or a frontend type — each engine
@@ -12,18 +13,32 @@
 //! so the engine stays swappable.
 
 pub mod dispatch;
+pub mod endpoint;
 pub mod error;
+pub mod filesystem;
+pub mod grant;
+mod hashtable;
+mod locking;
+pub mod mount;
 pub mod profile;
 pub mod runtime;
+pub mod sched;
+pub mod security;
 pub mod snapshot;
+pub mod vfs;
 pub mod yielder;
 
 // Every name an engine implementation writes into its own signatures, at
 // the crate root: the module path repeats the crate name and adds nothing
 // a reader of `kobako_runtime::Runtime` was missing.
 pub use dispatch::DispatchHandler;
+pub use endpoint::{Calls, GuestInstance};
 pub use error::{InvokeError, SetupError, Trap};
+pub use filesystem::{Bind, DirEntry, FileType, FilesystemError, Kstat, Overlay, SeedError, Tmpfs};
+pub use grant::{Grant, GrantKind};
+pub use mount::{Access, Mount, MountPathError, Policy};
 pub use profile::Profile;
 pub use runtime::{Entry, Runtime};
+pub use sched::Blocking;
 pub use snapshot::{Capture, Completion, Snapshot, Usage};
 pub use yielder::Yielder;

data/crates/kobako-runtime/src/locking/seqlock.rs

@@ -0,0 +1,66 @@
+//! A lock its readers never wait on, as Linux's `seqlock_t`: a writer
+//! counts each write, and a reader that a write overlapped reads again.
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Mutex, PoisonError};
+
+pub(crate) struct SeqLock {
+    /// Holds one writer at a time, as `write_seqlock` takes the lock's
+    /// spinlock.
+    writer: Mutex<()>,
+    /// How many times a write began or ended, odd while one is under way.
+    sequence: AtomicUsize,
+}
+
+impl SeqLock {
+    pub(crate) const fn new() -> Self {
+        Self {
+            writer: Mutex::new(()),
+            sequence: AtomicUsize::new(0),
+        }
+    }
+
+    /// Run `write` with every reader overlapping it told to read again, as
+    /// `write_seqlock` and `write_sequnlock` bracket a write.
+    pub(crate) fn write<T>(&self, write: impl FnOnce() -> T) -> T {
+        let _held = self.writer.lock().unwrap_or_else(PoisonError::into_inner);
+        self.sequence.fetch_add(1, Ordering::SeqCst);
+        let written = write();
+        self.sequence.fetch_add(1, Ordering::SeqCst);
+        written
+    }
+
+    /// Where the writes stand once none is under way, to ask `read_seqretry`
+    /// about later, as `__read_seqcount_begin` spins past an odd count. Holding
+    /// the writer's lock a moment waits out the one write it guards.
+    pub(crate) fn read_seqbegin(&self) -> usize {
+        loop {
+            let sequence = self.sequence.load(Ordering::SeqCst);
+            if sequence.is_multiple_of(2) {
+                return sequence;
+            }
+            drop(self.writer.lock().unwrap_or_else(PoisonError::into_inner));
+        }
+    }
+
+    /// Whether a write began since `read_seqbegin` answered `begun`.
+    pub(crate) fn read_seqretry(&self, begun: usize) -> bool {
+        self.sequence.load(Ordering::SeqCst) != begun
+    }
+
+    /// What `read` answers with no write overlapping it, as
+    /// `read_seqbegin_or_lock` reads: first without waiting, then, once a
+    /// write overlapped, holding writers off, so writes one after another
+    /// never keep a reader reading again.
+    pub(crate) fn read<T>(&self, mut read: impl FnMut() -> T) -> T {
+        let begun = self.sequence.load(Ordering::SeqCst);
+        if begun.is_multiple_of(2) {
+            let answer = read();
+            if self.sequence.load(Ordering::SeqCst) == begun {
+                return answer;
+            }
+        }
+        let _held = self.writer.lock().unwrap_or_else(PoisonError::into_inner);
+        read()
+    }
+}

data/crates/kobako-runtime/src/locking.rs

@@ -0,0 +1,218 @@
+//! The lock a directory's calls run under, as Linux's `rw_semaphore` in
+//! `kernel/locking`: shared while a name in it is looked up, exclusive while
+//! one is made, removed, or moved. The other locks beneath the VFS sit
+//! beside it.
+
+pub(crate) mod seqlock;
+
+use std::sync::{Arc, Condvar, Mutex, MutexGuard, PoisonError};
+use std::thread::ThreadId;
+
+use crate::sched;
+
+/// Why a hold was not taken.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum DownError {
+    /// A wait no release could ever end, since the thread asking holds what it
+    /// asks for. A thread must never hang on itself, so it is answered, as
+    /// Linux's `rt_mutex` answers `-EDEADLK`.
+    Deadlock,
+    /// The wait's run was to stop, past its deadline or interrupted, as
+    /// `down_read_killable` answers `-EINTR` on a fatal signal.
+    Interrupted,
+}
+
+/// Held shared by any number of threads or exclusive by one. A thread
+/// asking again for a hold it could only get once it let go of its own is
+/// refused as a Deadlock; a thread already holding it shared may hold it
+/// shared again, even past a waiting writer, which waits for that thread.
+/// Every wait for it ends once its run is to stop, as each wait of Linux's
+/// is `_killable`.
+#[derive(Default)]
+pub(crate) struct RwSemaphore {
+    holders: Mutex<Holders>,
+    freed: Condvar,
+}
+
+#[derive(Default)]
+struct Holders {
+    writer: Option<ThreadId>,
+    /// One entry for each shared hold, a thread holding it shared twice
+    /// standing twice.
+    readers: Vec<ThreadId>,
+    /// How many threads wait for a release, so one nobody waits for wakes
+    /// no one.
+    waiting: usize,
+    /// How many threads wait to hold it exclusive, which a thread arriving to hold
+    /// it shared goes behind, as `rwsem_down_read_slowpath` queues behind a waiting
+    /// writer, so readers one after another never keep a writer out.
+    writers_waiting: usize,
+}
+
+/// The semaphore while one call holds it, freed as the call returns. It keeps
+/// the semaphore alive itself, so whatever a lock was reached through may go
+/// first.
+pub(crate) struct RwSemaphoreGuard {
+    semaphore: Arc<RwSemaphore>,
+    holder: ThreadId,
+    exclusive: bool,
+}
+
+impl RwSemaphore {
+    fn holders(&self) -> MutexGuard<'_, Holders> {
+        self.holders.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Hold it shared, waiting while a writer holds it.
+    pub(crate) fn down_read(self: &Arc<Self>) -> Result<RwSemaphoreGuard, DownError> {
+        let current = sched::current();
+        self.down(current, false, |holders| match holders.writer {
+            Some(writer) if writer == current => Err(DownError::Deadlock),
+            Some(_) => Ok(false),
+            None if holders.writers_waiting > 0 && !holders.readers.contains(&current) => Ok(false),
+            None => {
+                holders.readers.push(current);
+                Ok(true)
+            }
+        })
+    }
+
+    /// Hold it exclusive, waiting while anyone holds it.
+    pub(crate) fn down_write(self: &Arc<Self>) -> Result<RwSemaphoreGuard, DownError> {
+        let current = sched::current();
+        self.down(current, true, |holders| {
+            if holders.writer == Some(current) || holders.readers.contains(&current) {
+                return Err(DownError::Deadlock);
+            }
+            if holders.writer.is_some() || !holders.readers.is_empty() {
+                return Ok(false);
+            }
+            holders.writer = Some(current);
+            Ok(true)
+        })
+    }
+
+    /// Hold it shared where nobody holds or waits to hold it exclusive, without
+    /// waiting, as `down_read_trylock` fails on a writer or a waiter.
+    pub(crate) fn down_read_trylock(self: &Arc<Self>) -> Option<RwSemaphoreGuard> {
+        let current = sched::current();
+        let mut holders = self.holders();
+        if holders.writer.is_some() || holders.writers_waiting > 0 {
+            return None;
+        }
+        holders.readers.push(current);
+        Some(self.guard(current, false))
+    }
+
+    /// Hold it exclusive where nobody holds it, without waiting, as
+    /// `down_write_trylock`.
+    pub(crate) fn down_write_trylock(self: &Arc<Self>) -> Option<RwSemaphoreGuard> {
+        let current = sched::current();
+        let mut holders = self.holders();
+        if holders.writer.is_some() || !holders.readers.is_empty() {
+            return None;
+        }
+        holders.writer = Some(current);
+        Some(self.guard(current, true))
+    }
+
+    fn guard(self: &Arc<Self>, holder: ThreadId, exclusive: bool) -> RwSemaphoreGuard {
+        RwSemaphoreGuard {
+            semaphore: self.clone(),
+            holder,
+            exclusive,
+        }
+    }
+
+    /// Whether a thread waits to hold it exclusive, for a test to see one queued.
+    #[cfg(test)]
+    pub(crate) fn writer_waits(&self) -> bool {
+        self.holders().writers_waiting > 0
+    }
+
+    /// Take the hold `take` grants, or wait for it.
+    fn down(
+        self: &Arc<Self>,
+        holder: ThreadId,
+        exclusive: bool,
+        mut take: impl FnMut(&mut Holders) -> Result<bool, DownError>,
+    ) -> Result<RwSemaphoreGuard, DownError> {
+        let mut holders = self.holders();
+        if !take(&mut holders)? {
+            drop(holders);
+            self.down_slowpath(exclusive, &mut take)?;
+        }
+        Ok(self.guard(holder, exclusive))
+    }
+
+    /// Wait for a release and ask again, as `rwsem_down_read_slowpath` and
+    /// `rwsem_down_write_slowpath` call `schedule`, until the run is to stop, as
+    /// a killable wait looks at `fatal_signal_pending` each time it wakes.
+    fn down_slowpath(
+        &self,
+        exclusive: bool,
+        take: &mut impl FnMut(&mut Holders) -> Result<bool, DownError>,
+    ) -> Result<(), DownError> {
+        let mut taken = Ok(());
+        sched::schedule(&mut || {
+            let mut holders = self.holders();
+            holders.writers_waiting += usize::from(exclusive);
+            loop {
+                match take(&mut holders) {
+                    Ok(true) => break,
+                    Ok(false) if sched::fatal_signal_pending() => {
+                        taken = Err(DownError::Interrupted);
+                        break;
+                    }
+                    Ok(false) => {
+                        holders.waiting += 1;
+                        holders = self
+                            .freed
+                            .wait_timeout(holders, sched::sleep_slice())
+                            .unwrap_or_else(PoisonError::into_inner)
+                            .0;
+                        holders.waiting -= 1;
+                    }
+                    Err(err) => {
+                        taken = Err(err);
+                        break;
+                    }
+                }
+            }
+            holders.writers_waiting -= usize::from(exclusive);
+            // A reader may have stood behind this writer, which now takes it or
+            // gave up; one that took it wakes them again once it lets go.
+            if holders.waiting > 0 && taken.is_err() {
+                self.freed.notify_all();
+            }
+        });
+        taken
+    }
+}
+
+impl RwSemaphoreGuard {
+    /// Whether this holds `semaphore`.
+    pub(crate) fn holds(&self, semaphore: &Arc<RwSemaphore>) -> bool {
+        Arc::ptr_eq(&self.semaphore, semaphore)
+    }
+}
+
+impl Drop for RwSemaphoreGuard {
+    fn drop(&mut self) {
+        let mut holders = self.semaphore.holders();
+        if self.exclusive {
+            holders.writer = None;
+        } else if let Some(at) = holders
+            .readers
+            .iter()
+            .position(|reader| *reader == self.holder)
+        {
+            holders.readers.swap_remove(at);
+        }
+        let waiting = holders.waiting > 0;
+        drop(holders);
+        if waiting {
+            self.semaphore.freed.notify_all();
+        }
+    }
+}