kobako 0.28.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/memory.rs

@@ -0,0 +1,172 @@
+//! The guest's linear memory as one preview1 call reads what its generated
+//! glue left as pointers. An address outside the memory traps, as preview1
+//! requires.
+
+use std::cell::Cell;
+
+use wiggle::{GuestPtr, GuestType};
+
+use super::errno::{Answer, Errno};
+use super::types;
+
+/// A memory shared between threads hands out no slice to read or write, and
+/// no Guest Binary declares one.
+fn require_unshared<T>(slice: Option<T>) -> Answer<T> {
+    slice.ok_or_else(|| {
+        types::Error::trap(wasmtime::Error::msg(
+            "a preview1 call needs the guest's memory unshared",
+        ))
+    })
+}
+
+pub(crate) struct GuestMemory<'a, 'm> {
+    memory: &'a mut wiggle::GuestMemory<'m>,
+    fuel: Cell<u64>,
+}
+
+impl<'a, 'm> GuestMemory<'a, 'm> {
+    pub(crate) fn new(memory: &'a mut wiggle::GuestMemory<'m>, fuel: usize) -> Self {
+        Self {
+            memory,
+            fuel: Cell::new(fuel as u64),
+        }
+    }
+
+    /// Spend `count` elements of `size` bytes of this call's fuel, as
+    /// wasmtime-wasi spends it before it copies an array.
+    pub(crate) fn consume(&self, count: u32, size: u32) -> Answer {
+        let cost = u64::from(count) * u64::from(size);
+        let left = self.fuel.get().checked_sub(cost).ok_or(Errno::Nomem)?;
+        self.fuel.set(left);
+        Ok(())
+    }
+
+    pub(crate) fn bytes(&self, ptr: GuestPtr<[u8]>) -> Answer<&[u8]> {
+        require_unshared(self.memory.as_slice(ptr)?)
+    }
+
+    pub(crate) fn bytes_mut(&mut self, ptr: GuestPtr<[u8]>) -> Answer<&mut [u8]> {
+        require_unshared(self.memory.as_slice_mut(ptr)?)
+    }
+
+    pub(crate) fn read<T: GuestType>(&self, ptr: GuestPtr<T>) -> Answer<T> {
+        Ok(self.memory.read(ptr)?)
+    }
+
+    pub(crate) fn write<T: GuestType>(&mut self, ptr: GuestPtr<T>, value: T) -> Answer {
+        Ok(self.memory.write(ptr, value)?)
+    }
+
+    /// Copy `bytes` into guest memory at `ptr`.
+    pub(crate) fn write_bytes(&mut self, ptr: GuestPtr<u8>, bytes: &[u8]) -> Answer {
+        Ok(self
+            .memory
+            .copy_from_slice(bytes, ptr.as_array(bytes.len() as u32))?)
+    }
+
+    /// A guest path, which preview1 requires to be UTF-8, charged to the
+    /// call's fuel before it is read, as wasmtime-wasi charges it.
+    pub(crate) fn path(&self, ptr: GuestPtr<str>) -> Answer<String> {
+        self.consume(ptr.len(), 1)?;
+        let bytes = self.memory.as_cow(ptr.as_bytes())?;
+        String::from_utf8(bytes.into_owned()).map_err(|_| Errno::Ilseq.into())
+    }
+
+    /// The first non-empty buffer of `iovs`, or an empty one when every
+    /// buffer is empty. Like wasmtime-wasi, kobako moves one buffer per call,
+    /// and the buffer itself is bounded only once the call has found its
+    /// descriptor.
+    pub(crate) fn first_non_empty_iovec(&self, iovs: types::IovecArray) -> Answer<GuestPtr<[u8]>> {
+        self.first_non_empty(iovs, |iov: types::Iovec| (iov.buf, iov.buf_len))
+    }
+
+    /// The first non-empty buffer of `ciovs`, as `first_non_empty_iovec`.
+    pub(crate) fn first_non_empty_ciovec(
+        &self,
+        ciovs: types::CiovecArray,
+    ) -> Answer<GuestPtr<[u8]>> {
+        self.first_non_empty(ciovs, |ciov: types::Ciovec| (ciov.buf, ciov.buf_len))
+    }
+
+    fn first_non_empty<T: GuestType>(
+        &self,
+        array: GuestPtr<[T]>,
+        buffer: impl Fn(T) -> (GuestPtr<u8>, u32),
+    ) -> Answer<GuestPtr<[u8]>> {
+        self.consume(array.len(), T::guest_size())?;
+        for entry in array.iter() {
+            let (ptr, len) = buffer(self.memory.read(entry?)?);
+            if len != 0 {
+                self.consume(len, 1)?;
+                return Ok(ptr.as_array(len));
+            }
+        }
+        Ok(GuestPtr::new((0, 0)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The most of a guest's memory one call may have the host copy or walk,
+    /// which wasmtime hands each call by default.
+    const HOSTCALL_FUEL: usize = 128 << 20;
+
+    // Linux's `readv` would move all three buffers, so only the first with room
+    // being the one handed back shows the encoding moves one per call.
+    // @behavior RT-284
+    #[test]
+    fn a_read_or_write_moves_its_first_buffer_with_room() {
+        #[repr(align(8))]
+        struct AlignedBytes([u8; 64]);
+
+        // Three iovecs at 0: empty at 32, three bytes at 40, two at 48.
+        let mut bytes = AlignedBytes([0; 64]);
+        for (at, (buf, len)) in [(32u32, 0u32), (40, 3), (48, 2)].into_iter().enumerate() {
+            bytes.0[at * 8..at * 8 + 4].copy_from_slice(&buf.to_le_bytes());
+            bytes.0[at * 8 + 4..at * 8 + 8].copy_from_slice(&len.to_le_bytes());
+        }
+        let mut memory = wiggle::GuestMemory::Unshared(&mut bytes.0);
+        let taken = GuestMemory::new(&mut memory, HOSTCALL_FUEL)
+            .first_non_empty_iovec(GuestPtr::new((0, 3)))
+            .unwrap_or_else(|_| panic!("the iovecs must be read"));
+        assert_eq!(
+            (taken.offset_base(), taken.len()),
+            (40, 3),
+            "a preview1 read handed an empty buffer, then three bytes, then two, must move only \
+             the three bytes, as wasmtime-wasi does"
+        );
+    }
+
+    // Neither the array nor the buffer exists in this small memory, so the
+    // budget alone, spent before anything is read, refuses each.
+    // @behavior RT-096
+    #[test]
+    fn a_call_past_its_hostcall_fuel_answers_nomem() {
+        // A guest's memory starts aligned, and wiggle refuses an `iovec` at a
+        // host address that is not.
+        #[repr(align(8))]
+        struct AlignedBytes([u8; 64]);
+
+        let mut array_bytes = AlignedBytes([0; 64]);
+        let mut buffer_bytes = AlignedBytes([0; 64]);
+        buffer_bytes.0[4..8].copy_from_slice(&(128u32 << 20).wrapping_add(1).to_le_bytes());
+        let answer = |bytes: &mut [u8], count: u32| {
+            let mut memory = wiggle::GuestMemory::Unshared(bytes);
+            GuestMemory::new(&mut memory, HOSTCALL_FUEL)
+                .first_non_empty_iovec(GuestPtr::new((0, count)))
+                .err()
+                .and_then(|err| err.downcast().ok())
+        };
+        assert_eq!(
+            (
+                answer(&mut array_bytes.0, (16 << 20) + 1),
+                answer(&mut buffer_bytes.0, 1)
+            ),
+            (Some(Errno::Nomem), Some(Errno::Nomem)),
+            "an iovec array or a buffer past 128 MiB through one preview1 call must answer \
+             NOMEM before the host copies any of it"
+        );
+    }
+}

data/crates/kobako-wasmtime/src/preview1/mount_view/wrap.rs

@@ -0,0 +1,211 @@
+//! A test's Filesystem over another: every call forwards to the entry it
+//! wraps unless its `Hook` steps in, and every entry a lookup finds is
+//! wrapped too, as a Filesystem wrapping another must. It makes a file
+//! through `create` and leaves the open to the VFS, as overlayfs does, so an
+//! open's lookup reaches the `Hook` as any lookup does. It hands the
+//! Filesystem beneath the dentry it is handed, where overlayfs hands a real
+//! one, so what that Filesystem makes is recorded unwrapped and later calls
+//! on it reach that Filesystem past the `Hook`.
+
+use std::any::Any;
+use std::marker::PhantomData;
+use std::sync::Arc;
+
+use kobako_runtime::filesystem::{
+    DentryOperations, FileOperations, FileSystemType, Filesystem, FilesystemError, InodeOperations,
+    Kstat, Lookup, OpenHow, RenameFlag,
+};
+use kobako_runtime::vfs::{Dentry, Inode};
+
+/// What a test changes of the Filesystem beneath it.
+pub(super) trait Hook: Send + Sync + 'static {
+    fn getattr(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Kstat, FilesystemError> {
+        inner.getattr(dentry)
+    }
+
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        inner.lookup(dentry)
+    }
+
+    fn fill_super(
+        &self,
+        fs: Arc<dyn FileSystemType>,
+        sb: &mut Filesystem,
+    ) -> Result<(), FilesystemError> {
+        fs.fill_super(sb)
+    }
+
+    fn open(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        inner.open(dentry, how)
+    }
+
+    fn mkdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.mkdir(dentry)
+    }
+
+    fn rmdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.rmdir(dentry)
+    }
+
+    fn unlink(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.unlink(dentry)
+    }
+
+    fn rename(
+        &self,
+        inner: &dyn InodeOperations,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        inner.rename(from, to_dir, to, flag)
+    }
+}
+
+/// A Filesystem over the one `fs` makes, with `hook` stepping in.
+pub(super) struct Wrap<H> {
+    fs: Arc<dyn FileSystemType>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> Wrap<H> {
+    pub(super) fn new(fs: Arc<dyn FileSystemType>, hook: Arc<H>) -> Arc<Self> {
+        Arc::new(Self { fs, hook })
+    }
+}
+
+impl<H: Hook> FileSystemType for Wrap<H> {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        self.hook.fill_super(self.fs.clone(), sb)?;
+        if let Some(ops) = sb.d_op().cloned() {
+            sb.set_default_d_op(Arc::new(WrapDentry::<H> {
+                ops,
+                hook: PhantomData,
+            }));
+        }
+        if let Some(root) = sb.root().and_then(|root| root.inode()) {
+            let wrapped = WrapInode {
+                inner: root.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            sb.d_make_root(root.with_ops(Arc::new(wrapped)));
+        }
+        Ok(())
+    }
+}
+
+/// `inner`, an entry of the Filesystem beneath, with `hook` stepping in.
+struct WrapInode<H> {
+    inner: Arc<dyn InodeOperations>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> WrapInode<H> {
+    /// `found` with the entry it names wrapped too.
+    fn wrap(&self, found: Lookup) -> Lookup {
+        let wrapped = |inode: Arc<Inode>| {
+            let ops = Self {
+                inner: inode.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            inode.with_ops(Arc::new(ops))
+        };
+        match found {
+            Lookup::Found(inode) => Lookup::Found(wrapped(inode)),
+            Lookup::Spelled { name, inode } => Lookup::Spelled {
+                name,
+                inode: wrapped(inode),
+            },
+            Lookup::Absent => Lookup::Absent,
+        }
+    }
+}
+
+/// `ops`, handed the directory a `WrapInode<H>` wraps.
+struct WrapDentry<H> {
+    ops: Arc<dyn DentryOperations>,
+    hook: PhantomData<H>,
+}
+
+impl<H: Hook> DentryOperations for WrapDentry<H> {
+    fn revalidate(
+        &self,
+        dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        let dir = (dir as &dyn Any)
+            .downcast_ref::<WrapInode<H>>()
+            .map_or(dir, |wrap| wrap.inner.as_ref());
+        self.ops.revalidate(dir, dentry)
+    }
+}
+
+impl<H: Hook> InodeOperations for WrapInode<H> {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.hook.getattr(self.inner.as_ref(), dentry)
+    }
+
+    fn setattr(
+        &self,
+        dentry: &Dentry,
+        attr: &kobako_runtime::filesystem::Iattr,
+    ) -> Result<(), FilesystemError> {
+        self.inner.setattr(dentry, attr)
+    }
+
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(self.wrap(self.hook.lookup(self.inner.as_ref(), dentry)?))
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        self.hook.open(self.inner.as_ref(), dentry, how)
+    }
+
+    fn create(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.inner.create(dentry)
+    }
+
+    fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.mkdir(self.inner.as_ref(), dentry)
+    }
+
+    fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.rmdir(self.inner.as_ref(), dentry)
+    }
+
+    fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.unlink(self.inner.as_ref(), dentry)
+    }
+
+    fn rename(
+        &self,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        let target = (to_dir as &dyn Any)
+            .downcast_ref::<Self>()
+            .ok_or(FilesystemError::CrossesDevices)?;
+        self.hook
+            .rename(self.inner.as_ref(), from, target.inner.as_ref(), to, flag)
+    }
+}