kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/descriptors.rs

@@ -3,123 +3,106 @@
 //!
 //! kobako answers every preview1 call that reads this table, so the guest
 //! sees one table and no call falls through to a second one that
-//! disagrees. Numbering follows wasmtime-wasi's: a closed number is reused
-//! before a fresh one is taken.
+//! disagrees. Numbering follows Linux's `alloc_fd`: the lowest closed number
+//! is reused before a fresh one is taken.
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::sync::Arc;
 
-use kobako_runtime::filesystem::{DirEntry, File, Hold, Metadata};
+use kobako_runtime::filesystem::FilesystemError;
 use kobako_runtime::mount::Mount;
-use wasmtime_wasi::p2::pipe::{MemoryInputPipe, MemoryOutputPipe};
-
-/// What one descriptor stands for.
-pub(crate) enum Descriptor {
-    /// Descriptor 0, carrying the Preamble.
-    Stdin(MemoryInputPipe),
-    /// Descriptor 1 or 2, a capture pipe the guest writes a Channel into.
-    Channel(MemoryOutputPipe),
-    /// A directory beneath a Mount; a preopen is the Mount's own root.
-    Directory(OpenDirectory),
-    File(OpenFile),
-}
+use kobako_runtime::profile::Profile;
+use kobako_runtime::security::{restrict_self, WalkGuard};
+use kobako_runtime::vfs::{Cred, File};
 
-/// What a directory is, apart from where it stands: the device and inode
-/// numbers its Filesystem names it by.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) struct Identity {
-    dev: u64,
-    ino: u64,
+/// What one descriptor stands for, as Linux's fd table holds a `struct file`.
+pub(crate) struct Descriptor {
+    pub(crate) file: File,
+    /// The guest path a preopen names; a Mount's own root has one.
+    pub(crate) preopen_path: Option<String>,
 }
 
-impl Identity {
-    /// The identity `metadata` names, or `None` where its inode of zero
-    /// reports none.
-    pub(crate) fn of(metadata: &Metadata) -> Option<Self> {
-        (metadata.ino != 0).then_some(Self {
-            dev: metadata.dev,
-            ino: metadata.ino,
-        })
+impl Descriptor {
+    /// The descriptor of `file`, naming no preopen.
+    pub(crate) fn for_file(file: File) -> Self {
+        Self {
+            file,
+            preopen_path: None,
+        }
     }
 }
 
-pub(crate) struct OpenDirectory {
-    pub(crate) mount: Arc<Mount>,
-    /// The directory's path relative to the mount's root.
-    pub(crate) path: String,
-    /// The identity the directory had when it was opened, so one made in
-    /// its place is not taken for it; without one it follows its path.
-    pub(crate) identity: Option<Identity>,
-    /// What keeps that identity from passing to a directory made in this
-    /// one's place while the descriptor is open.
-    pub(crate) _hold: Option<Hold>,
-    pub(crate) preopen: bool,
-    /// The entries a listing began with, held until it reaches its end, so
-    /// each later call reads on without listing the directory again.
-    pub(crate) listing: Option<Vec<DirEntry>>,
-}
-
-pub(crate) struct OpenFile {
-    pub(crate) file: Box<dyn File>,
-    pub(crate) position: u64,
-    pub(crate) append: bool,
-    pub(crate) readable: bool,
-    pub(crate) writable: bool,
-    /// The Mount it was opened beneath, whose permission to write answers a
-    /// wait to write and a resize, as wasmtime-wasi answers both by its
-    /// preopen's permissions.
-    pub(crate) mount: Arc<Mount>,
-}
-
 pub(crate) struct Descriptors {
     used: BTreeMap<u32, Descriptor>,
     free: BTreeSet<u32>,
     limit: Option<usize>,
+    /// Who the guest's calls are made for, as a task holds its `cred`.
+    cred: Arc<Cred>,
+    /// What a descriptor's call asks before it starts.
+    walk_guard: WalkGuard,
+    /// The isolation the guest runs under, which decides what it sees of
+    /// the times a Filesystem reports.
+    profile: Profile,
 }
 
 impl Descriptors {
     /// The table every invocation starts from: stdin, then the two
     /// Channels, then one preopen per Mount from descriptor 3. It holds at
     /// most `limit` descriptors, those included, as a process's
-    /// `RLIMIT_NOFILE` counts every one it holds.
+    /// `RLIMIT_NOFILE` counts every one it holds. Each Mount's root opens as
+    /// `opener`, the Cred the Driver prepared, before its Policy applies.
     pub(crate) fn new(
-        stdin: MemoryInputPipe,
-        stdout: MemoryOutputPipe,
-        stderr: MemoryOutputPipe,
+        stdin: File,
+        stdout: File,
+        stderr: File,
         mounts: Vec<Mount>,
         limit: Option<usize>,
-    ) -> Self {
+        opener: Arc<Cred>,
+        profile: Profile,
+    ) -> Result<Self, FilesystemError> {
         let mut used = BTreeMap::from([
-            (0, Descriptor::Stdin(stdin)),
-            (1, Descriptor::Channel(stdout)),
-            (2, Descriptor::Channel(stderr)),
+            (0, Descriptor::for_file(stdin)),
+            (1, Descriptor::for_file(stdout)),
+            (2, Descriptor::for_file(stderr)),
         ]);
-        for (fd, mount) in (3..).zip(mounts) {
-            // A root the Filesystem cannot stat or hold reports no
-            // identity, and the descriptor follows its path alone.
-            let filesystem = mount.filesystem();
-            let identity = filesystem
-                .metadata("")
-                .ok()
-                .and_then(|root| Identity::of(&root));
-            let hold = filesystem.hold_directory("").ok().flatten();
+        // Each Mount's root opens before its Policy applies, as a Linux task
+        // opens what it keeps and then calls `landlock_restrict_self`, so a
+        // Policy judges only what the guest asks for.
+        for (fd, mount) in (3..).zip(&mounts) {
             used.insert(
                 fd,
-                Descriptor::Directory(OpenDirectory {
-                    mount: Arc::new(mount),
-                    path: String::new(),
-                    identity,
-                    _hold: hold,
-                    preopen: true,
-                    listing: None,
-                }),
+                Descriptor {
+                    file: File::root(mount.mnt(), &opener)?,
+                    preopen_path: Some(mount.at().to_string()),
+                },
             );
         }
-        Self {
+        let cred = restrict_self(&opener, &mounts);
+        let walk_guard = WalkGuard::new(&mounts);
+        Ok(Self {
             used,
             free: BTreeSet::new(),
             limit,
-        }
+            cred,
+            walk_guard,
+            profile,
+        })
+    }
+
+    /// Who the guest's calls are made for.
+    pub(crate) fn cred(&self) -> &Arc<Cred> {
+        &self.cred
+    }
+
+    /// What every call through a descriptor asks first, so a Policy judges the
+    /// path it stands at.
+    pub(crate) fn walk_guard(&self) -> &WalkGuard {
+        &self.walk_guard
+    }
+
+    /// The isolation the guest runs under.
+    pub(crate) fn profile(&self) -> Profile {
+        self.profile
     }
 
     pub(crate) fn get(&self, fd: u32) -> Option<&Descriptor> {
@@ -137,31 +120,81 @@ impl Descriptors {
         Some(descriptor)
     }
 
-    /// Place `descriptor` at `fd`, a number the caller has just freed.
+    /// Place `descriptor` at `fd`, a number the caller has just freed or
+    /// `lowest_unused` found, as Linux's `fd_install` does.
     pub(crate) fn place(&mut self, fd: u32, descriptor: Descriptor) {
         self.free.remove(&fd);
         self.used.insert(fd, descriptor);
     }
 
-    /// Whether the table holds as many descriptors as it may.
-    pub(crate) fn is_full(&self) -> bool {
-        self.limit.is_some_and(|limit| self.used.len() >= limit)
-    }
-
-    /// Add `descriptor` under the highest freed number, or the one past
-    /// the highest in use; `None` when the table is full.
-    pub(crate) fn push(&mut self, descriptor: Descriptor) -> Option<u32> {
-        if self.is_full() {
+    /// The number the next descriptor takes, the lowest freed one or the one
+    /// past the highest in use, as Linux's `get_unused_fd_flags` finds it;
+    /// `None` when the table holds as many as it may. Nothing is placed
+    /// until `place`, as `fd_install` fills what was found.
+    pub(crate) fn lowest_unused(&self) -> Option<u32> {
+        if self.limit.is_some_and(|limit| self.used.len() >= limit) {
             return None;
         }
-        let fd = match self.free.pop_last() {
-            Some(fd) => fd,
+        match self.free.first() {
+            Some(fd) => Some(*fd),
             None => match self.used.last_key_value() {
-                Some((last, _)) => last.checked_add(1)?,
-                None => 0,
+                Some((last, _)) => last.checked_add(1),
+                None => Some(0),
             },
-        };
-        self.used.insert(fd, descriptor);
+        }
+    }
+
+    /// Add `descriptor` under the number `lowest_unused` finds; `None` when
+    /// the table is full.
+    #[cfg(test)]
+    pub(crate) fn push(&mut self, descriptor: Descriptor) -> Option<u32> {
+        let fd = self.lowest_unused()?;
+        self.place(fd, descriptor);
         Some(fd)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use kobako_runtime::filesystem::{create_pipe_files, PipeInodeInfo};
+    use kobako_runtime::security::prepare_creds_within;
+
+    fn pipe_end() -> File {
+        create_pipe_files(&PipeInodeInfo::new(1), &prepare_creds_within(&[], None)).1
+    }
+
+    // @behavior RT-189
+    #[test]
+    fn a_new_descriptor_takes_the_lowest_closed_number() {
+        let mut table = Descriptors::new(
+            pipe_end(),
+            pipe_end(),
+            pipe_end(),
+            Vec::new(),
+            None,
+            prepare_creds_within(&[], None),
+            Profile::Hermetic,
+        )
+        .unwrap_or_else(|_| panic!("a table holding no Mount must make"));
+        let mut open = || {
+            table
+                .push(Descriptor::for_file(pipe_end()))
+                .expect("a table with no limit takes every descriptor")
+        };
+        let numbers = [open(), open(), open()];
+        assert_eq!(numbers, [3, 4, 5], "descriptors must number from 3");
+        table.remove(3);
+        table.remove(4);
+        assert_eq!(
+            (
+                table.push(Descriptor::for_file(pipe_end())),
+                table.push(Descriptor::for_file(pipe_end())),
+                table.push(Descriptor::for_file(pipe_end())),
+            ),
+            (Some(3), Some(4), Some(6)),
+            "path_open's descriptors must take the lowest closed number first, as Linux's alloc_fd \
+             does, and then the one past the highest"
+        );
+    }
+}

data/crates/kobako-wasmtime/src/driver.rs

@@ -14,25 +14,27 @@ use wasmtime::{
     AsContextMut, InstancePre as WtInstancePre, ResourceLimiter, Store as WtStore, TypedFunc,
 };
 
-use crate::cache::shared_engine;
+use crate::cache::load_engine;
 use crate::config::Config;
 use crate::exports::{self, Exports};
+use crate::guest::Guest;
 use crate::invocation::Invocation;
 use crate::wasi::Wasi;
-use crate::{capture, guest_mem, instance_pre, io, trap};
+use crate::{instance_pre, trap};
 use kobako_runtime::dispatch::DispatchHandler;
+use kobako_runtime::endpoint;
 use kobako_runtime::error::{InvokeError, SetupError, Trap};
 use kobako_runtime::grant::{Grant, GrantKind};
 use kobako_runtime::profile::Profile;
 use kobako_runtime::runtime::{Entry, Runtime as ContractRuntime};
 use kobako_runtime::snapshot::{Capture, Completion, Snapshot, Usage};
-use kobako_transport::envelope::{CompileReply, Downcall, Preamble, Run, Snippet};
+use kobako_transport::envelope::Preamble;
 
 /// The wasmtime execution unit behind one sandbox runtime.
 pub struct Driver {
     // Pre-linked instantiation template (import wiring, type checks,
     // and the ABI version check done once in
-    // `instance_pre::cached_instance_pre`). Every invocation
+    // `instance_pre::load_instance_pre`). Every invocation
     // instantiates a fresh instance from it and discards the whole
     // Store afterwards — the per-invocation instance discipline.
     instance_pre: WtInstancePre<Invocation>,
@@ -46,7 +48,7 @@ impl Driver {
     /// neither leaves the driver.
     pub fn new(path: &Path, config: Config) -> Result<Self, SetupError> {
         Ok(Self {
-            instance_pre: instance_pre::cached_instance_pre(path, config.setup_timeout)?,
+            instance_pre: instance_pre::load_instance_pre(path, config.setup_timeout)?,
             config,
         })
     }
@@ -56,7 +58,7 @@ impl Driver {
     /// `timeout` as the export call does.
     fn new_store(&self, wasi: Wasi) -> Result<WtStore<Invocation>, SetupError> {
         let mut store = WtStore::new(
-            shared_engine()?,
+            load_engine()?,
             Invocation::new(self.config.memory_limit, wasi),
         );
         store.limiter(|state: &mut Invocation| -> &mut dyn ResourceLimiter { state.limiter_mut() });
@@ -96,7 +98,12 @@ impl Driver {
         Results: wasmtime::WasmResults,
     {
         self.arm_memory_cap(store, exports);
-        let result = export.call(store.as_context_mut(), params);
+        // A wait for a lock the call meets ends at the same deadline the guest's
+        // code does, so another Sandbox holding it cannot keep this one past it.
+        let deadline = store.data().deadline();
+        let result = kobako_runtime::sched::run_task(deadline, || {
+            export.call(store.as_context_mut(), params)
+        });
         disarm_caps(store);
         result
     }
@@ -121,7 +128,7 @@ impl Driver {
         usage.memory_peak = data.memory_peak();
         let clip = |bytes, limit| {
             let mut capture = Capture::default();
-            (capture.bytes, capture.truncated) = capture::clip_capture(bytes, limit);
+            (capture.bytes, capture.truncated) = endpoint::clip_capture(bytes, limit);
             capture
         };
         Snapshot::new(
@@ -145,28 +152,20 @@ impl ContractRuntime for Driver {
         handler: Option<Arc<dyn DispatchHandler>>,
         grants: &[Grant],
     ) -> Result<Snapshot, InvokeError> {
-        let wasi = Wasi::for_invocation(&self.config, &preamble.encode(), grants)?;
+        let stdin =
+            endpoint::stdin_content(preamble).map_err(|msg| Trap::Other(msg.to_string()))?;
+        let wasi = Wasi::for_invocation(&self.config, stdin, grants)?;
         let mut store = self.new_store(wasi)?;
         if let Some(handler) = handler {
             store.data_mut().bind_on_dispatch(handler);
         }
         let exports = self.instantiate(&mut store)?;
         let downcall = exports::require(exports.downcall.as_ref())?;
-        let request = match entry {
-            Entry::Eval { source } => Downcall::Eval(source.to_vec()),
-            Entry::Run {
-                entrypoint,
-                payload,
-            } => Downcall::Run(Run {
-                entrypoint: entrypoint.to_owned(),
-                payload,
-            }),
-        }
-        .encode();
-        let (ptr, len) = io::write_request(&mut store, &exports, &request)?;
+        let request = endpoint::request_of(entry);
+        let (ptr, len) = endpoint::write_request(&mut guest_of(&mut store), &request)?;
         let called = self.call_with_caps(&mut store, &exports, downcall, (ptr, len));
         let completion = match called {
-            Ok(packed) => match io::read_outcome(&store, &exports, packed) {
+            Ok(packed) => match endpoint::read_outcome(&mut guest_of(&mut store), packed) {
                 Ok(outcome) => Completion::Outcome(outcome),
                 Err(t) => Completion::Trap(t),
             },
@@ -192,93 +191,27 @@ impl ContractRuntime for Driver {
     /// own that no script ever runs on, so what it answers carries
     /// nothing a script could have written.
     fn compile(&self, preamble: &Preamble) -> Option<Vec<Vec<u8>>> {
-        let wasi = Wasi::for_compile(&self.config, &preamble.encode()).ok()?;
+        let wasi = Wasi::for_compile(&self.config, endpoint::stdin_content(preamble).ok()?).ok()?;
         let mut store = self.new_store(wasi).ok()?;
         let exports = self.instantiate(&mut store).ok()?;
         let downcall = exports::require(exports.downcall.as_ref()).ok()?;
         let (ptr, len) =
-            io::write_request(&mut store, &exports, &Downcall::Compile.encode()).ok()?;
+            endpoint::write_request(&mut guest_of(&mut store), &endpoint::compile_request())
+                .ok()?;
         let packed = self
             .call_with_caps(&mut store, &exports, downcall, (ptr, len))
             .ok()?;
-        match io::read_compile_reply(&store, &exports, packed).ok()? {
-            CompileReply::Ok(bytecodes) => one_per_source(preamble, bytecodes)
-                .filter(|bytecodes| replay_fits(preamble, bytecodes)),
-            CompileReply::Error(_) | CompileReply::Unsupported(_) => None,
-        }
-    }
-}
-
-/// Each invocation sends the Preamble with every bytecode in place of its
-/// source, so an answer that would carry it past the payload cap would trap
-/// every invocation the source alone fits.
-fn replay_fits(preamble: &Preamble, bytecodes: &[Vec<u8>]) -> bool {
-    let mut replay = preamble.clone();
-    let sources = replay
-        .snippets
-        .entries
-        .iter_mut()
-        .filter(|entry| matches!(entry, Snippet::Source { .. }));
-    for (entry, body) in sources.zip(bytecodes) {
-        *entry = Snippet::Bytecode { body: body.clone() };
+        let reply = endpoint::read_compile_reply(&mut guest_of(&mut store), packed).ok()?;
+        endpoint::compiled_bytecodes(preamble, reply)
     }
-    guest_mem::checked_payload_len(replay.encode().len()).is_ok()
 }
 
-/// A frontend replays each bytecode in place of one source snippet, in
-/// order, so an answer of any other length leaves nothing to replay.
-fn one_per_source(preamble: &Preamble, bytecodes: Vec<Vec<u8>>) -> Option<Vec<Vec<u8>>> {
-    let sources = preamble
-        .snippets
-        .entries
-        .iter()
-        .filter(|entry| matches!(entry, Snippet::Source { .. }))
-        .count();
-    (bytecodes.len() == sources).then_some(bytecodes)
+/// The instance the runtime's host ABI endpoint drives, through `store`.
+fn guest_of(store: &mut WtStore<Invocation>) -> Guest<'_> {
+    Guest(store.as_context_mut())
 }
 
 fn disarm_caps(store: &mut WtStore<Invocation>) {
     store.data_mut().stop_wall_clock();
     store.data_mut().disarm_memory_cap();
 }
-
-#[cfg(test)]
-mod tests {
-    use kobako_transport::envelope::Snippets;
-
-    use super::*;
-
-    /// One source between two bytecode snippets: a compile answers one
-    /// bytecode for it.
-    fn one_source() -> Preamble {
-        let mut preamble = Preamble::default();
-        preamble.snippets = Snippets {
-            entries: vec![
-                Snippet::Bytecode { body: vec![0xaa] },
-                Snippet::Source {
-                    name: "Only".into(),
-                    body: "1".into(),
-                },
-                Snippet::Bytecode { body: vec![0xbb] },
-            ],
-        };
-        preamble
-    }
-
-    // @behavior WE-089
-    #[test]
-    fn a_compiled_answer_of_another_length_leaves_nothing_compiled() {
-        let preamble = one_source();
-
-        assert_eq!(
-            [
-                one_per_source(&preamble, Vec::new()),
-                one_per_source(&preamble, vec![vec![0x01], vec![0x02]]),
-                one_per_source(&preamble, vec![vec![0x01]]),
-            ],
-            [None, None, Some(vec![vec![0x01]])],
-            "a compiled answer through Driver#compile must be kept only when it carries one \
-             bytecode per source snippet"
-        );
-    }
-}

data/crates/kobako-wasmtime/src/exports.rs

@@ -10,19 +10,13 @@
 
 use wasmtime::{AsContextMut, Instance as WtInstance, Memory, TypedFunc};
 
-use crate::guest_mem::SANDBOX_RUNTIME_NOT_KOBAKO;
+use kobako_runtime::endpoint::RUNTIME_INCOMPATIBLE;
 use kobako_runtime::error::Trap;
 
-/// For a required guest export that is absent or mistyped, wherever it is
-/// looked up. Names neither the export nor a frontend's artifact path;
-/// what a caller can do is rebuild the runtime.
-pub(crate) const RUNTIME_INCOMPATIBLE: &str =
-    "the Sandbox runtime is incompatible; rebuild it against the kobako version in use";
-
 /// The resolved host-driven export handles. Each is `Option` because test
 /// fixtures (a minimal "ping" module) need not provide them; real
-/// `kobako.wasm` always does, and the run path surfaces a `Trap` (via
-/// `require` / `Exports::require_memory`) when a handle is `None`.
+/// `kobako.wasm` always does, and the run path surfaces a `Trap` when a
+/// handle is `None`.
 ///
 /// The handles are indices into the owning Store, not borrows of the
 /// `Instance` — they stay valid for the Store's lifetime, which is why
@@ -49,11 +43,6 @@ impl Exports {
             memory: instance.get_memory(&mut ctx, "memory"),
         }
     }
-
-    pub(crate) fn require_memory(&self) -> Result<Memory, Trap> {
-        self.memory
-            .ok_or_else(|| Trap::Other(SANDBOX_RUNTIME_NOT_KOBAKO.to_string()))
-    }
 }
 
 pub(crate) fn require<Params, Results>(
@@ -77,7 +66,7 @@ mod tests {
 
     use wasmtime::ExternType;
 
-    use crate::cache::cached_module;
+    use crate::cache::load_module;
 
     const WASM: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/../../data/kobako.wasm");
 
@@ -98,7 +87,7 @@ mod tests {
             );
             return;
         }
-        let module = cached_module(path).expect("the Guest Binary must load");
+        let module = load_module(path).expect("the Guest Binary must load");
 
         let mut functions: Vec<&str> = module
             .exports()

data/crates/kobako-wasmtime/src/guest.rs

@@ -0,0 +1,38 @@
+//! One wasmtime instance as the runtime's host ABI endpoint drives it, from the
+//! invocation body's `Store` and from a host import's `Caller` alike.
+
+use kobako_runtime::endpoint::{Calls, GuestInstance};
+use kobako_runtime::error::Trap;
+use wasmtime::StoreContextMut;
+
+use crate::invocation::Invocation;
+use crate::trap;
+
+pub(crate) struct Guest<'a>(pub(crate) StoreContextMut<'a, Invocation>);
+
+impl GuestInstance for Guest<'_> {
+    type Fault = wasmtime::Error;
+
+    fn calls(&mut self) -> &mut Calls<wasmtime::Error> {
+        self.0.data_mut().calls_mut()
+    }
+
+    fn memory(&mut self) -> Option<&mut [u8]> {
+        let memory = self.0.data().exports()?.memory?;
+        Some(memory.data_mut(&mut self.0))
+    }
+
+    fn alloc(&mut self, len: u32) -> Option<wasmtime::Result<u32>> {
+        let alloc = self.0.data().exports()?.alloc?;
+        Some(alloc.call(&mut self.0, len))
+    }
+
+    fn downcall(&mut self, ptr: i32, len: i32) -> Option<wasmtime::Result<u64>> {
+        let downcall = self.0.data().exports()?.downcall?;
+        Some(downcall.call(&mut self.0, (ptr, len)))
+    }
+
+    fn cap_trap(fault: &wasmtime::Error) -> Option<Trap> {
+        trap::cap_trap(fault)
+    }
+}

data/crates/kobako-wasmtime/src/imports.rs

@@ -5,16 +5,18 @@
 //! calling Store, never from a Runtime, so the wiring is the same for
 //! every Sandbox and `crate::instance_pre` can cache what it resolves.
 
-use wasmtime::{Caller, Linker};
+use wasmtime::{AsContextMut, Caller, Linker};
 use wasmtime_wasi::p1;
 
-use crate::cache::shared_engine;
+use crate::cache::load_engine;
+use crate::guest::Guest;
 use crate::invocation::Invocation;
-use crate::{dispatch, preview1};
+use crate::preview1;
+use kobako_runtime::endpoint::{self, UpcallEnd, ABANDONED};
 use kobako_runtime::error::SetupError;
 
 pub(crate) fn linker() -> Result<Linker<Invocation>, SetupError> {
-    let mut linker: Linker<Invocation> = Linker::new(shared_engine()?);
+    let mut linker: Linker<Invocation> = Linker::new(load_engine()?);
 
     // Wire the wasmtime-wasi preview1 WASI imports against each
     // invocation's own `Wasi` context, then answer every call that reads
@@ -26,9 +28,8 @@ pub(crate) fn linker() -> Result<Linker<Invocation>, SetupError> {
     .and_then(|_| preview1::shadow(&mut linker))
     .map_err(|e| SetupError::Dead(format!("failed to set up the WASI runtime: {e}")))?;
 
-    // `__kobako_upcall`, `(ptr: i32, len: i32) -> i64` per
-    // docs/wire/abi.md § ABI Signatures; `dispatch::handle` owns what it
-    // answers.
+    // `__kobako_upcall`, `(ptr: i32, len: i32) -> i64` in the ABI;
+    // `endpoint::handle` owns what it answers.
     linker
         .func_wrap(
             "env",
@@ -37,7 +38,12 @@ pub(crate) fn linker() -> Result<Linker<Invocation>, SetupError> {
              req_ptr: i32,
              req_len: i32|
              -> wasmtime::Result<i64> {
-                dispatch::handle(&mut caller, req_ptr, req_len)
+                let mut guest = Guest(caller.as_context_mut());
+                endpoint::handle(&mut guest, req_ptr, req_len).map_err(|end| match end {
+                    UpcallEnd::Fault(trap) => trap,
+                    UpcallEnd::Abandoned => wasmtime::Error::msg(ABANDONED),
+                    UpcallEnd::Unwritable(reason) => wasmtime::Error::msg(reason),
+                })
             },
         )
         .map_err(|e| SetupError::Dead(format!("failed to set up the host callback bridge: {e}")))?;

data/crates/kobako-wasmtime/src/instance_pre.rs

@@ -16,7 +16,7 @@ use std::time::Duration;
 
 use wasmtime::InstancePre;
 
-use crate::cache::cached_module;
+use crate::cache::load_module;
 use crate::invocation::Invocation;
 use crate::{abi, imports, trap};
 use kobako_runtime::error::SetupError;
@@ -26,7 +26,7 @@ static INSTANCE_PRE_CACHE: OnceLock<Mutex<HashMap<PathBuf, InstancePre<Invocatio
 
 /// The probe runs only on the first load of a path, so only that load's
 /// `setup_timeout` bounds it; a path already verified is not set up again.
-pub(crate) fn cached_instance_pre(
+pub(crate) fn load_instance_pre(
     path: &Path,
     setup_timeout: Option<Duration>,
 ) -> Result<InstancePre<Invocation>, SetupError> {
@@ -41,7 +41,7 @@ pub(crate) fn cached_instance_pre(
         return Ok(pre);
     }
 
-    let module = cached_module(path)?;
+    let module = load_module(path)?;
     let linker = imports::linker()?;
     let pre = linker
         .instantiate_pre(&module)