kobako 0.28.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/path.rs

@@ -0,0 +1,302 @@
+//! The 10 `path_*` calls. Each hands the call to the runtime's VFS, which
+//! resolves the path, asks the Mount, and asks the Filesystem. What a Linux
+//! syscall entry checks before the VFS stays here, such as the order of an
+//! open's errors.
+
+use kobako_runtime::filesystem::{FilesystemError, Iattr};
+use kobako_runtime::vfs::{self, OpenHow, Start};
+use wiggle::GuestPtr;
+
+use super::errno::{Answer, Errno};
+use super::fd::to_filestat;
+use super::memory::GuestMemory;
+use super::types;
+use crate::descriptors::{Descriptor, Descriptors};
+
+/// The arguments `path_open` takes besides where it starts and the path, as
+/// Linux's `openat2` takes a `struct open_how`; they become the `OpenHow` the
+/// VFS opens with.
+pub(crate) struct PathOpen {
+    pub(crate) dirflags: types::Lookupflags,
+    pub(crate) oflags: types::Oflags,
+    pub(crate) rights_base: types::Rights,
+    pub(crate) fdflags: types::Fdflags,
+}
+
+/// How many times a call is made before a guest is answered EAGAIN, as cap-std
+/// makes `openat2` four times: any move in the process answers a `..` walking
+/// past it so, and nothing bounds how often one lands.
+const MAX_ATTEMPTS: usize = 4;
+
+/// What `call` answers once no move landed during its walk, made again at most
+/// `MAX_ATTEMPTS` times in all, as cap-std retries `openat2` on EAGAIN.
+pub(super) fn retry_eagain<T>(
+    mut call: impl FnMut() -> Result<T, FilesystemError>,
+) -> Result<T, FilesystemError> {
+    let mut answer = call();
+    for _ in 1..MAX_ATTEMPTS {
+        if !matches!(answer, Err(FilesystemError::WouldBlock)) {
+            break;
+        }
+        answer = call();
+    }
+    answer
+}
+
+/// Where `fd` stands, for a path to be walked from, once the guard answered for a
+/// directory there, found when the VFS has taken the name, as Linux's
+/// `path_init` takes the descriptor. What is no directory the walk itself
+/// refuses, and a move the guard meets is one a walk meets, so `retry_eagain`
+/// makes the call again.
+fn start_of(table: &Descriptors, fd: u32) -> impl vfs::Start + '_ {
+    move || {
+        let file = &table.get(fd).ok_or(FilesystemError::BadDescriptor)?.file;
+        if file.is_directory() {
+            table.walk_guard().check(file.path())?;
+        }
+        Ok(file.path().clone())
+    }
+}
+
+pub(crate) fn create_directory(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    path: GuestPtr<str>,
+) -> Answer {
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_mkdirat(table.cred(), &start_of(table, fd), &path)
+    })?)
+}
+
+pub(crate) fn filestat_get(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    flags: types::Lookupflags,
+    path: GuestPtr<str>,
+) -> Answer<types::Filestat> {
+    let path = mem.path(path)?;
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    let stat =
+        retry_eagain(|| vfs::vfs_fstatat(table.cred(), &start_of(table, fd), &path, follow))?;
+    Ok(to_filestat(table, stat))
+}
+
+pub(crate) fn filestat_set_times(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    flags: types::Lookupflags,
+    path: GuestPtr<str>,
+    times: &Iattr,
+) -> Answer {
+    let path = mem.path(path)?;
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    Ok(retry_eagain(|| {
+        vfs::do_utimes_path(table.cred(), &start_of(table, fd), &path, follow, times)
+    })?)
+}
+
+pub(crate) fn link(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    old: (u32, GuestPtr<str>),
+    new: (u32, GuestPtr<str>),
+    flags: types::Lookupflags,
+) -> Answer {
+    let (old_path, new_path) = (mem.path(old.1)?, mem.path(new.1)?);
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    Ok(retry_eagain(|| {
+        let (from, to) = (start_of(table, old.0), start_of(table, new.0));
+        vfs::filename_linkat(table.cred(), &from, &old_path, &to, &new_path, follow)
+    })?)
+}
+
+pub(crate) fn open(
+    table: &mut Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    path: GuestPtr<str>,
+    call: &PathOpen,
+) -> Answer<types::Fd> {
+    let oflags = call.oflags;
+    let mut how = OpenHow::default();
+    // wasi-libc asks `fd_read` and `fd_readdir` for `O_RDONLY` and neither for
+    // `O_SEARCH`, which glibc spells `O_PATH`; wasi-testsuite lists a
+    // directory opened with `fd_readdir` alone, and makes a file asking no
+    // right at all, which only an `O_RDONLY` open does.
+    how.create = oflags.contains(types::Oflags::CREAT);
+    how.exclusive = oflags.contains(types::Oflags::EXCL);
+    how.truncate = oflags.contains(types::Oflags::TRUNC);
+    how.write = call.rights_base.contains(types::Rights::FD_WRITE);
+    how.read = call
+        .rights_base
+        .intersects(types::Rights::FD_READ | types::Rights::FD_READDIR)
+        || (!how.write && (how.create || how.truncate));
+    how.directory = oflags.contains(types::Oflags::DIRECTORY);
+    how.follow = call.dirflags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    how.append = call.fdflags.contains(types::Fdflags::APPEND);
+    how.nonblock = call.fdflags.contains(types::Fdflags::NONBLOCK);
+    how.dsync = call.fdflags.contains(types::Fdflags::DSYNC);
+    how.sync = call
+        .fdflags
+        .intersects(types::Fdflags::RSYNC | types::Fdflags::SYNC);
+    // Linux's `do_sys_openat2` builds the flags, then reserves a descriptor
+    // before `do_file_open` answers for the name, so a full table answers
+    // whatever the path names.
+    let op = vfs::build_open_flags(&how)?;
+    let new = table.lowest_unused().ok_or(Errno::Mfile)?;
+    let path = mem.path(path)?;
+    let file = retry_eagain(|| vfs::do_file_open(table.cred(), &start_of(table, fd), &path, &op))?;
+    table.place(new, Descriptor::for_file(file));
+    Ok(new.into())
+}
+
+pub(crate) fn readlink(
+    table: &Descriptors,
+    mem: &mut GuestMemory<'_, '_>,
+    fd: u32,
+    path: GuestPtr<str>,
+    buf: GuestPtr<u8>,
+    buf_len: types::Size,
+) -> Answer<types::Size> {
+    if buf_len == 0 {
+        return Err(Errno::Inval.into());
+    }
+    let path = mem.path(path)?;
+    let target = retry_eagain(|| vfs::do_readlinkat(table.cred(), &start_of(table, fd), &path))?;
+    write_link(mem, &target, buf, buf_len)
+}
+
+/// As much of where a link points as the buffer holds, as `readlink` cuts it
+/// off there without saying so.
+fn write_link(
+    mem: &mut GuestMemory<'_, '_>,
+    target: &str,
+    buf: GuestPtr<u8>,
+    buf_len: types::Size,
+) -> Answer<types::Size> {
+    let take = target.len().min(buf_len as usize);
+    mem.write_bytes(buf, &target.as_bytes()[..take])?;
+    Ok(take as u32)
+}
+
+pub(crate) fn remove_directory(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    path: GuestPtr<str>,
+) -> Answer {
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_rmdir(table.cred(), &start_of(table, fd), &path)
+    })?)
+}
+
+pub(crate) fn rename(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    old: (u32, GuestPtr<str>),
+    new: (u32, GuestPtr<str>),
+) -> Answer {
+    let (from_path, to_path) = (mem.path(old.1)?, mem.path(new.1)?);
+    Ok(retry_eagain(|| {
+        let (from, to) = (start_of(table, old.0), start_of(table, new.0));
+        vfs::filename_renameat2(table.cred(), &from, &from_path, &to, &to_path)
+    })?)
+}
+
+pub(crate) fn symlink(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    old_path: GuestPtr<str>,
+    fd: u32,
+    new_path: GuestPtr<str>,
+) -> Answer {
+    let (target, path) = (mem.path(old_path)?, mem.path(new_path)?);
+    // wasi-testsuite's symlink_create has a guest make no link to an absolute
+    // path, where Linux would make one; a guest walks none of them anyway. It
+    // is refused once the start is found, where the link would be made.
+    let start = || -> Result<vfs::Path, FilesystemError> {
+        let start = start_of(table, fd).path_init()?;
+        match target.starts_with('/') {
+            true => Err(FilesystemError::NotPermitted),
+            false => Ok(start),
+        }
+    };
+    Ok(retry_eagain(|| {
+        vfs::filename_symlinkat(table.cred(), &target, &start, &path)
+    })?)
+}
+
+pub(crate) fn unlink_file(
+    table: &Descriptors,
+    mem: &GuestMemory<'_, '_>,
+    fd: u32,
+    path: GuestPtr<str>,
+) -> Answer {
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_unlinkat(table.cred(), &start_of(table, fd), &path)
+    })?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Every Invocation holds to the hook refusing a readlink, so no guest call
+    // reaches this; only the encoding itself can witness it.
+    #[test]
+    fn a_link_is_cut_off_where_the_buffer_ends() {
+        let mut bytes = [0u8; 8];
+        let answered = {
+            let mut memory = wiggle::GuestMemory::Unshared(&mut bytes);
+            let mut mem = GuestMemory::new(&mut memory, 64);
+            write_link(&mut mem, "target", GuestPtr::new(2), 3)
+                .unwrap_or_else(|_| panic!("the link must write"))
+        };
+        assert_eq!(
+            (answered, &bytes),
+            (3, b"\0\0tar\0\0\0"),
+            "where a link points through path_readlink must fill the buffer and answer what fit"
+        );
+    }
+
+    /// What `retry_eagain` answers when the first `moves` calls each had a move
+    /// land in them, and how many calls it made.
+    fn retry_after_moves(moves: usize) -> (Result<(), FilesystemError>, usize) {
+        let mut made = 0;
+        let answer = retry_eagain(|| {
+            made += 1;
+            match made <= moves {
+                true => Err(FilesystemError::WouldBlock),
+                false => Ok(()),
+            }
+        });
+        (answer, made)
+    }
+
+    // A move lands during a walk only between two of its steps, which no guest
+    // call can time, so the retry itself witnesses it.
+    // @behavior RT-256
+    #[test]
+    fn a_path_call_a_move_landed_in_is_made_again_four_times_at_most() {
+        assert_eq!(
+            [
+                retry_after_moves(0),
+                retry_after_moves(3),
+                retry_after_moves(4)
+            ],
+            [
+                (Ok(()), 1),
+                (Ok(()), 4),
+                (Err(FilesystemError::WouldBlock), 4),
+            ],
+            "a path_* call answered EAGAIN must be made again until it answers otherwise, four \
+             times in all at most, as cap-std makes openat2"
+        );
+    }
+}

data/crates/kobako-wasmtime/src/preview1/poll.rs

@@ -0,0 +1,381 @@
+//! `poll_oneoff`, the guest's wait: for a clock, or for a descriptor to be
+//! ready.
+//!
+//! Every descriptor kobako holds is ready at once, so only a clock ever
+//! waits. A wait passes on the guest's own clocks: the hermetic rung's
+//! never advance, so its waits end at once, and a permissive wait takes
+//! host time but never past the invocation's deadline — the host is the
+//! one waiting, where no epoch check can interrupt it.
+
+use std::thread;
+use std::time::{Duration, Instant};
+
+use kobako_runtime::vfs::PollMask;
+use wiggle::{GuestPtr, GuestType};
+
+use super::errno::{Answer, Errno};
+use super::fd::file;
+use super::memory::GuestMemory;
+use super::types::{self, Clockid, Eventrwflags, Eventtype, Subclockflags, SubscriptionU};
+use crate::invocation::Invocation;
+use crate::trap::TimeoutTrap;
+
+/// One subscription as the guest wrote it, and the error its event reports.
+struct Subscription {
+    userdata: u64,
+    kind: Kind,
+    error: Errno,
+}
+
+enum Kind {
+    /// A clock, as the nanoseconds left before it fires.
+    Clock(u64),
+    FdRead,
+    FdWrite,
+}
+
+pub(crate) fn poll_oneoff(
+    invocation: &Invocation,
+    mem: &mut GuestMemory<'_, '_>,
+    subs: GuestPtr<types::Subscription>,
+    events: GuestPtr<types::Event>,
+    count: u32,
+) -> Answer<types::Size> {
+    if count == 0 {
+        return Err(Errno::Inval.into());
+    }
+    mem.consume(count, types::Subscription::guest_size())?;
+    mem.consume(count, types::Event::guest_size())?;
+    let subscriptions = subs
+        .as_array(count)
+        .iter()
+        .map(|sub| read_subscription(invocation, mem, sub?))
+        .collect::<Answer<Vec<_>>>()?;
+
+    let clocks = subscriptions.iter().filter_map(|sub| match sub.kind {
+        Kind::Clock(left) => Some(left),
+        Kind::FdRead | Kind::FdWrite => None,
+    });
+    let waited = if clocks.clone().count() == subscriptions.len() {
+        let soonest = clocks.min().unwrap_or(0);
+        wait(invocation, soonest)?;
+        soonest
+    } else {
+        0
+    };
+
+    let mut written = 0;
+    for sub in &subscriptions {
+        let (ready, nbytes) = match sub.kind {
+            Kind::Clock(left) => (left <= waited, 0),
+            Kind::FdRead | Kind::FdWrite => (true, u64::from(sub.error == Errno::Success)),
+        };
+        if ready {
+            mem.write(events.add(written)?, to_event(sub, nbytes))?;
+            written += 1;
+        }
+    }
+    Ok(written)
+}
+
+fn read_subscription(
+    invocation: &Invocation,
+    mem: &GuestMemory<'_, '_>,
+    sub: GuestPtr<types::Subscription>,
+) -> Answer<Subscription> {
+    let sub = mem.read(sub)?;
+    let (kind, error) = match sub.u {
+        SubscriptionU::Clock(clock) => (read_clock(invocation, &clock)?, Errno::Success),
+        SubscriptionU::FdRead(subscribed) => (
+            Kind::FdRead,
+            poll_descriptor(invocation, subscribed, PollMask::IN)?,
+        ),
+        SubscriptionU::FdWrite(subscribed) => (
+            Kind::FdWrite,
+            poll_descriptor(invocation, subscribed, PollMask::OUT)?,
+        ),
+    };
+    Ok(Subscription {
+        userdata: sub.userdata,
+        kind,
+        error,
+    })
+}
+
+/// Hold a subscription to what its descriptor would find ready, answering the
+/// error its event reports. A number no descriptor holds, or one standing only
+/// for its path, is reported in its event, as Linux's `do_pollfd` marks it
+/// `POLLNVAL` when `fdget` refuses it and the wait goes on. A
+/// pipe's end is never ready for what the other end does, and nothing here
+/// would wake a wait on it, so that is `BADF` rather than a wait that never
+/// ends.
+fn poll_descriptor(
+    invocation: &Invocation,
+    subscribed: types::SubscriptionFdReadwrite,
+    event: PollMask,
+) -> Answer<Errno> {
+    let descriptors = invocation.wasi().descriptors();
+    let Ok(file) = file(descriptors, subscribed.file_descriptor.into()) else {
+        return Ok(Errno::Badf);
+    };
+    match file.poll().contains(event) {
+        true => Ok(Errno::Success),
+        false => Err(Errno::Badf.into()),
+    }
+}
+
+/// A clock, read against the guest's own clocks. Only the realtime and
+/// monotonic clocks can be waited on, alone or among other
+/// subscriptions, as in wasmtime-wasi.
+fn read_clock(invocation: &Invocation, clock: &types::SubscriptionClock) -> Answer<Kind> {
+    let absolute = clock
+        .flags
+        .contains(Subclockflags::SUBSCRIPTION_CLOCK_ABSTIME);
+    let clocks = invocation.wasi().clocks();
+    let now = match (clock.id, absolute) {
+        (Clockid::Realtime | Clockid::Monotonic, false) => 0,
+        (Clockid::Monotonic, true) => clocks.monotonic_now(),
+        (Clockid::Realtime, true) => clocks.wall_now(),
+        _ => return Err(Errno::Inval.into()),
+    };
+    Ok(Kind::Clock(clock.timeout.saturating_sub(now)))
+}
+
+/// Wait `nanos` of the guest's time: none on frozen clocks, and on live
+/// ones no further than the invocation's deadline, which ends it as a
+/// timeout.
+fn wait(invocation: &Invocation, nanos: u64) -> Answer {
+    if nanos == 0 || !invocation.wasi().clocks().advances() {
+        return Ok(());
+    }
+    let wanted = Duration::from_nanos(nanos);
+    if let Some(deadline) = invocation.deadline() {
+        let left = deadline.saturating_duration_since(Instant::now());
+        if wanted >= left {
+            thread::sleep(left);
+            return Err(types::Error::trap(wasmtime::Error::new(TimeoutTrap)));
+        }
+    }
+    thread::sleep(wanted);
+    Ok(())
+}
+
+fn to_event(sub: &Subscription, nbytes: u64) -> types::Event {
+    types::Event {
+        userdata: sub.userdata,
+        error: sub.error,
+        type_: match sub.kind {
+            Kind::Clock(_) => Eventtype::Clock,
+            Kind::FdRead => Eventtype::FdRead,
+            Kind::FdWrite => Eventtype::FdWrite,
+        },
+        fd_readwrite: types::EventFdReadwrite {
+            nbytes,
+            flags: Eventrwflags::empty(),
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    //! Witness that a guest's clock wait passes on its posture's clocks:
+    //! at once on the frozen ones, and on the live ones no further than
+    //! the deadline.
+    use std::time::{Duration, Instant};
+
+    use wasmtime::{Module, Store};
+
+    use crate::cache::load_engine;
+    use crate::config::Config;
+    use crate::imports;
+    use crate::invocation::Invocation;
+    use crate::trap::{to_trap, NO_TIMEOUT_EPOCH_DELTA};
+    use crate::wasi::Wasi;
+    use kobako_runtime::error::Trap;
+    use kobako_runtime::profile::Profile;
+
+    /// One relative monotonic-clock subscription of ten seconds at 0,
+    /// its event written at 64 and the event count at 96.
+    const WAIT_WAT: &str = r#"
+        (module
+          (import "wasi_snapshot_preview1" "poll_oneoff"
+            (func $poll (param i32 i32 i32 i32) (result i32)))
+          (memory (export "memory") 1)
+          (func (export "wait_ten_seconds") (result i32)
+            (i32.store8 (i32.const 8) (i32.const 0))
+            (i32.store (i32.const 16) (i32.const 1))
+            (i64.store (i32.const 24) (i64.const 10000000000))
+            (call $poll (i32.const 0) (i32.const 64) (i32.const 1) (i32.const 96))))
+    "#;
+
+    /// Run the ten-second wait at `profile` under `deadline`, answering
+    /// how it ended and how long the host spent on it.
+    fn wait_ten_seconds(
+        profile: Profile,
+        deadline: Option<Duration>,
+    ) -> (wasmtime::Result<i32>, Duration) {
+        let engine = load_engine().expect("shared engine must be constructible");
+        let config = Config {
+            timeout: None,
+            setup_timeout: None,
+            memory_limit: None,
+            stdout_limit: None,
+            stderr_limit: None,
+            open_file_limit: None,
+            profile,
+            security: Vec::new(),
+        };
+        let wasi = Wasi::for_invocation(&config, Vec::new(), &[]).expect("WASI context must build");
+        let mut store = Store::new(engine, Invocation::new(None, wasi));
+        store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
+        let linker = imports::linker().expect("host imports must link");
+        let module = Module::new(engine, WAIT_WAT).expect("wait module must compile");
+        let instance = linker
+            .instantiate(&mut store, &module)
+            .expect("wait module must instantiate");
+        let wait = instance
+            .get_typed_func::<(), i32>(&mut store, "wait_ten_seconds")
+            .expect("wait export must resolve");
+        let started = Instant::now();
+        store
+            .data_mut()
+            .set_deadline(deadline.map(|left| started + left));
+        let ended = wait.call(&mut store, ());
+        (ended, started.elapsed())
+    }
+
+    // @behavior RT-073
+    #[test]
+    fn a_hermetic_wait_ends_without_the_host_waiting() {
+        let (ended, spent) = wait_ten_seconds(Profile::Hermetic, None);
+        assert_eq!(
+            ended.ok(),
+            Some(0),
+            "a ten-second clock wait through a hermetic guest's poll_oneoff must succeed"
+        );
+        assert!(
+            spent < Duration::from_secs(1),
+            "a ten-second clock wait through a hermetic guest's poll_oneoff must return at once, \
+             not after {spent:?}"
+        );
+    }
+
+    /// What a lone relative wait of no time on clock `id` answers.
+    fn wait_alone_on(id: i32) -> i32 {
+        const WAIT_ON_WAT: &str = r#"
+            (module
+              (import "wasi_snapshot_preview1" "poll_oneoff"
+                (func $poll (param i32 i32 i32 i32) (result i32)))
+              (memory (export "memory") 1)
+              (func (export "wait_on") (param $id i32) (result i32)
+                (i32.store (i32.const 16) (local.get $id))
+                (call $poll (i32.const 0) (i32.const 64) (i32.const 1) (i32.const 96))))
+        "#;
+        let engine = load_engine().expect("shared engine must be constructible");
+        let config = Config {
+            timeout: None,
+            setup_timeout: None,
+            memory_limit: None,
+            stdout_limit: None,
+            stderr_limit: None,
+            open_file_limit: None,
+            profile: Profile::Hermetic,
+            security: Vec::new(),
+        };
+        let wasi = Wasi::for_invocation(&config, Vec::new(), &[]).expect("WASI context must build");
+        let mut store = Store::new(engine, Invocation::new(None, wasi));
+        store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
+        let linker = imports::linker().expect("host imports must link");
+        let module = Module::new(engine, WAIT_ON_WAT).expect("wait module must compile");
+        linker
+            .instantiate(&mut store, &module)
+            .expect("wait module must instantiate")
+            .get_typed_func::<i32, i32>(&mut store, "wait_on")
+            .expect("wait export must resolve")
+            .call(&mut store, id)
+            .expect("the wait must not trap")
+    }
+
+    // @behavior RT-131
+    #[test]
+    fn a_lone_wait_on_a_cpu_time_clock_is_invalid() {
+        assert_eq!(
+            [0, 1, 2, 3].map(wait_alone_on),
+            [0, 0, ERRNO_INVAL, ERRNO_INVAL],
+            "a lone relative wait through poll_oneoff on the process or thread CPU-time clock \
+             must answer EINVAL as wasmtime-wasi does, while the realtime and monotonic clocks wait"
+        );
+    }
+
+    const ERRNO_INVAL: i32 = 28;
+
+    /// What a lone wait on standard output answers for event `tag`, 1 to read
+    /// and 2 to write.
+    fn wait_on_stdout(tag: i32) -> i32 {
+        const WAIT_ON_FD_WAT: &str = r#"
+            (module
+              (import "wasi_snapshot_preview1" "poll_oneoff"
+                (func $poll (param i32 i32 i32 i32) (result i32)))
+              (memory (export "memory") 1)
+              (func (export "wait_on") (param $tag i32) (result i32)
+                (i32.store8 (i32.const 8) (local.get $tag))
+                (i32.store (i32.const 16) (i32.const 1))
+                (call $poll (i32.const 0) (i32.const 64) (i32.const 1) (i32.const 96))))
+        "#;
+        let engine = load_engine().expect("shared engine must be constructible");
+        let config = Config {
+            timeout: None,
+            setup_timeout: None,
+            memory_limit: None,
+            stdout_limit: None,
+            stderr_limit: None,
+            open_file_limit: None,
+            profile: Profile::Hermetic,
+            security: Vec::new(),
+        };
+        let wasi = Wasi::for_invocation(&config, Vec::new(), &[]).expect("WASI context must build");
+        let mut store = Store::new(engine, Invocation::new(None, wasi));
+        store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
+        let linker = imports::linker().expect("host imports must link");
+        let module = Module::new(engine, WAIT_ON_FD_WAT).expect("wait module must compile");
+        linker
+            .instantiate(&mut store, &module)
+            .expect("wait module must instantiate")
+            .get_typed_func::<i32, i32>(&mut store, "wait_on")
+            .expect("wait export must resolve")
+            .call(&mut store, tag)
+            .expect("the wait must not trap")
+    }
+
+    const ERRNO_BADF: i32 = 8;
+
+    // Nothing ever makes standard output ready to read, so without the refusal
+    // the wait would only end with the invocation.
+    // @behavior RT-285
+    #[test]
+    fn a_wait_on_what_a_descriptor_never_does_answers_ebadf() {
+        assert_eq!(
+            [1, 2].map(wait_on_stdout),
+            [ERRNO_BADF, 0],
+            "poll_oneoff on standard output must answer EBADF waiting to read and be ready to \
+             write"
+        );
+    }
+
+    // @behavior RT-074
+    #[test]
+    fn a_permissive_wait_ends_at_the_deadline_as_a_timeout() {
+        let (ended, spent) = wait_ten_seconds(Profile::Permissive, Some(Duration::from_millis(50)));
+        let trap = ended.expect_err("a wait past the deadline must not return to the guest");
+        assert!(
+            matches!(to_trap(trap), Trap::Timeout(_)),
+            "a clock wait past the deadline through a permissive guest's poll_oneoff must end \
+             as a timeout"
+        );
+        assert!(
+            spent >= Duration::from_millis(50) && spent < Duration::from_secs(5),
+            "a clock wait past the deadline through a permissive guest's poll_oneoff must end \
+             at the deadline, not after {spent:?}"
+        );
+    }
+}

data/crates/kobako-wasmtime/src/preview1/sock.rs

@@ -0,0 +1,13 @@
+//! The 4 `sock_*` calls. The table holds no socket, so every open
+//! descriptor answers `NOTSOCK`, as wasmtime-wasi's preview1 does, and one
+//! standing only for its path `BADF`, as Linux's socket calls take theirs
+//! through `fdget`.
+
+use super::errno::{Answer, Errno};
+use super::fd::file;
+use crate::descriptors::Descriptors;
+
+pub(crate) fn socket<T>(table: &Descriptors, fd: u32) -> Answer<T> {
+    file(table, fd)?;
+    Err(Errno::Notsock.into())
+}