kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/memory.rs

@@ -1,32 +1,34 @@
-//! The guest's linear memory as one preview1 call sees it: little-endian
-//! fields at guest addresses. An address outside the memory, or one not
-//! aligned for what it points at, traps, as preview1 requires.
+//! The guest's linear memory as one preview1 call reads what its generated
+//! glue left as pointers. An address outside the memory traps, as preview1
+//! requires.
 
 use std::cell::Cell;
-use std::ops::Range;
 
-use super::beneath::PATH_MAX;
-use super::errno::{Answer, Errno, Failure};
+use wiggle::{GuestPtr, GuestType};
 
-fn out_of_bounds() -> Failure {
-    Failure::trap("pointer out of bounds of guest memory")
-}
+use super::errno::{Answer, Errno};
+use super::types;
 
-/// The most of the guest's memory one call may have the host copy or
-/// walk, as wasmtime's default hostcall fuel bounds a preview1 call; past
-/// it the call answers NOMEM.
-const HOSTCALL_FUEL: u64 = 128 << 20;
+/// A memory shared between threads hands out no slice to read or write, and
+/// no Guest Binary declares one.
+fn require_unshared<T>(slice: Option<T>) -> Answer<T> {
+    slice.ok_or_else(|| {
+        types::Error::trap(wasmtime::Error::msg(
+            "a preview1 call needs the guest's memory unshared",
+        ))
+    })
+}
 
-pub(crate) struct GuestMemory<'a> {
-    bytes: &'a mut [u8],
+pub(crate) struct GuestMemory<'a, 'm> {
+    memory: &'a mut wiggle::GuestMemory<'m>,
     fuel: Cell<u64>,
 }
 
-impl<'a> GuestMemory<'a> {
-    pub(crate) fn new(bytes: &'a mut [u8]) -> Self {
+impl<'a, 'm> GuestMemory<'a, 'm> {
+    pub(crate) fn new(memory: &'a mut wiggle::GuestMemory<'m>, fuel: usize) -> Self {
         Self {
-            bytes,
-            fuel: Cell::new(HOSTCALL_FUEL),
+            memory,
+            fuel: Cell::new(fuel as u64),
         }
     }
 
@@ -39,129 +41,67 @@ impl<'a> GuestMemory<'a> {
         Ok(())
     }
 
-    fn range(&self, ptr: u32, len: u32) -> Answer<Range<usize>> {
-        let start = ptr as usize;
-        match start.checked_add(len as usize) {
-            Some(end) if end <= self.bytes.len() => Ok(start..end),
-            _ => Err(out_of_bounds()),
-        }
-    }
-
-    /// Hold `ptr` to the alignment of the struct or integer it points at.
-    pub(crate) fn check_aligned(ptr: u32, align: u32) -> Answer {
-        if !ptr.is_multiple_of(align) {
-            return Err(Failure::trap("pointer not aligned for what it points at"));
-        }
-        Ok(())
-    }
-
-    /// The address of element `index` of an array of `size`-byte elements
-    /// at `base`.
-    pub(crate) fn element(base: u32, index: u32, size: u32) -> Answer<u32> {
-        Self::field(base, index.checked_mul(size).ok_or_else(out_of_bounds)?)
-    }
-
-    /// The address `offset` bytes past `base`, which traps rather than
-    /// wrapping past the end of the address space.
-    pub(crate) fn field(base: u32, offset: u32) -> Answer<u32> {
-        base.checked_add(offset).ok_or_else(out_of_bounds)
-    }
-
-    pub(crate) fn bytes(&self, ptr: u32, len: u32) -> Answer<&[u8]> {
-        let range = self.range(ptr, len)?;
-        Ok(&self.bytes[range])
-    }
-
-    pub(crate) fn bytes_mut(&mut self, ptr: u32, len: u32) -> Answer<&mut [u8]> {
-        let range = self.range(ptr, len)?;
-        Ok(&mut self.bytes[range])
-    }
-
-    fn read<const N: usize>(&self, ptr: u32) -> Answer<[u8; N]> {
-        Self::check_aligned(ptr, N as u32)?;
-        let mut out = [0; N];
-        out.copy_from_slice(self.bytes(ptr, N as u32)?);
-        Ok(out)
-    }
-
-    pub(crate) fn read_u8(&self, ptr: u32) -> Answer<u8> {
-        self.read::<1>(ptr).map(|b| b[0])
-    }
-
-    pub(crate) fn read_u16(&self, ptr: u32) -> Answer<u16> {
-        self.read(ptr).map(u16::from_le_bytes)
-    }
-
-    pub(crate) fn read_u32(&self, ptr: u32) -> Answer<u32> {
-        self.read(ptr).map(u32::from_le_bytes)
-    }
-
-    pub(crate) fn read_u64(&self, ptr: u32) -> Answer<u64> {
-        self.read(ptr).map(u64::from_le_bytes)
-    }
-
-    /// Copy `bytes` into guest memory at `ptr`, which needs no alignment.
-    pub(crate) fn write(&mut self, ptr: u32, bytes: &[u8]) -> Answer {
-        self.bytes_mut(ptr, bytes.len() as u32)?
-            .copy_from_slice(bytes);
-        Ok(())
-    }
-
-    fn write_aligned<const N: usize>(&mut self, ptr: u32, bytes: [u8; N]) -> Answer {
-        Self::check_aligned(ptr, N as u32)?;
-        self.write(ptr, &bytes)
+    pub(crate) fn bytes(&self, ptr: GuestPtr<[u8]>) -> Answer<&[u8]> {
+        require_unshared(self.memory.as_slice(ptr)?)
     }
 
-    pub(crate) fn write_u8(&mut self, ptr: u32, value: u8) -> Answer {
-        self.write(ptr, &[value])
+    pub(crate) fn bytes_mut(&mut self, ptr: GuestPtr<[u8]>) -> Answer<&mut [u8]> {
+        require_unshared(self.memory.as_slice_mut(ptr)?)
     }
 
-    pub(crate) fn write_u16(&mut self, ptr: u32, value: u16) -> Answer {
-        self.write_aligned(ptr, value.to_le_bytes())
+    pub(crate) fn read<T: GuestType>(&self, ptr: GuestPtr<T>) -> Answer<T> {
+        Ok(self.memory.read(ptr)?)
     }
 
-    pub(crate) fn write_u32(&mut self, ptr: u32, value: u32) -> Answer {
-        self.write_aligned(ptr, value.to_le_bytes())
+    pub(crate) fn write<T: GuestType>(&mut self, ptr: GuestPtr<T>, value: T) -> Answer {
+        Ok(self.memory.write(ptr, value)?)
     }
 
-    pub(crate) fn write_u64(&mut self, ptr: u32, value: u64) -> Answer {
-        self.write_aligned(ptr, value.to_le_bytes())
+    /// Copy `bytes` into guest memory at `ptr`.
+    pub(crate) fn write_bytes(&mut self, ptr: GuestPtr<u8>, bytes: &[u8]) -> Answer {
+        Ok(self
+            .memory
+            .copy_from_slice(bytes, ptr.as_array(bytes.len() as u32))?)
     }
 
     /// A guest path, which preview1 requires to be UTF-8, charged to the
-    /// call's fuel before it is read, as wasmtime-wasi charges it. One
-    /// that would not fit Linux's `PATH_MAX` with its terminating NUL is
-    /// refused before it is copied, as Linux's `getname` refuses it, and
-    /// one holding a NUL names nothing a host can hold, as cap-std refuses
-    /// it.
-    pub(crate) fn path(&self, ptr: u32, len: u32) -> Answer<String> {
-        self.consume(len, 1)?;
-        let bytes = self.bytes(ptr, len)?;
-        if bytes.len() >= PATH_MAX {
-            return Err(Errno::Nametoolong.into());
-        }
-        if bytes.contains(&0) {
-            return Err(Errno::Inval.into());
-        }
-        String::from_utf8(bytes.to_vec()).map_err(|_| Errno::Ilseq.into())
-    }
-
-    /// The first non-empty buffer of an `iovec` / `ciovec` array, as
-    /// `(ptr, len)`, or an empty one when every buffer is empty. Like
-    /// wasmtime-wasi, kobako moves one buffer per call, and the buffer
-    /// itself is bounded only once the call has found its descriptor.
-    pub(crate) fn first_non_empty_buffer(&self, array: u32, count: u32) -> Answer<(u32, u32)> {
-        self.consume(count, 8)?;
-        for index in 0..count {
-            let entry = Self::element(array, index, 8)?;
-            let ptr = self.read_u32(entry)?;
-            let len = self.read_u32(Self::field(entry, 4)?)?;
+    /// call's fuel before it is read, as wasmtime-wasi charges it.
+    pub(crate) fn path(&self, ptr: GuestPtr<str>) -> Answer<String> {
+        self.consume(ptr.len(), 1)?;
+        let bytes = self.memory.as_cow(ptr.as_bytes())?;
+        String::from_utf8(bytes.into_owned()).map_err(|_| Errno::Ilseq.into())
+    }
+
+    /// The first non-empty buffer of `iovs`, or an empty one when every
+    /// buffer is empty. Like wasmtime-wasi, kobako moves one buffer per call,
+    /// and the buffer itself is bounded only once the call has found its
+    /// descriptor.
+    pub(crate) fn first_non_empty_iovec(&self, iovs: types::IovecArray) -> Answer<GuestPtr<[u8]>> {
+        self.first_non_empty(iovs, |iov: types::Iovec| (iov.buf, iov.buf_len))
+    }
+
+    /// The first non-empty buffer of `ciovs`, as `first_non_empty_iovec`.
+    pub(crate) fn first_non_empty_ciovec(
+        &self,
+        ciovs: types::CiovecArray,
+    ) -> Answer<GuestPtr<[u8]>> {
+        self.first_non_empty(ciovs, |ciov: types::Ciovec| (ciov.buf, ciov.buf_len))
+    }
+
+    fn first_non_empty<T: GuestType>(
+        &self,
+        array: GuestPtr<[T]>,
+        buffer: impl Fn(T) -> (GuestPtr<u8>, u32),
+    ) -> Answer<GuestPtr<[u8]>> {
+        self.consume(array.len(), T::guest_size())?;
+        for entry in array.iter() {
+            let (ptr, len) = buffer(self.memory.read(entry?)?);
             if len != 0 {
                 self.consume(len, 1)?;
-                return Ok((ptr, len));
+                return Ok(ptr.as_array(len));
             }
         }
-        Ok((0, 0))
+        Ok(GuestPtr::new((0, 0)))
     }
 }
 
@@ -169,37 +109,64 @@ impl<'a> GuestMemory<'a> {
 mod tests {
     use super::*;
 
+    /// The most of a guest's memory one call may have the host copy or walk,
+    /// which wasmtime hands each call by default.
+    const HOSTCALL_FUEL: usize = 128 << 20;
+
+    // Linux's `readv` would move all three buffers, so only the first with room
+    // being the one handed back shows the encoding moves one per call.
+    // @behavior RT-284
+    #[test]
+    fn a_read_or_write_moves_its_first_buffer_with_room() {
+        #[repr(align(8))]
+        struct AlignedBytes([u8; 64]);
+
+        // Three iovecs at 0: empty at 32, three bytes at 40, two at 48.
+        let mut bytes = AlignedBytes([0; 64]);
+        for (at, (buf, len)) in [(32u32, 0u32), (40, 3), (48, 2)].into_iter().enumerate() {
+            bytes.0[at * 8..at * 8 + 4].copy_from_slice(&buf.to_le_bytes());
+            bytes.0[at * 8 + 4..at * 8 + 8].copy_from_slice(&len.to_le_bytes());
+        }
+        let mut memory = wiggle::GuestMemory::Unshared(&mut bytes.0);
+        let taken = GuestMemory::new(&mut memory, HOSTCALL_FUEL)
+            .first_non_empty_iovec(GuestPtr::new((0, 3)))
+            .unwrap_or_else(|_| panic!("the iovecs must be read"));
+        assert_eq!(
+            (taken.offset_base(), taken.len()),
+            (40, 3),
+            "a preview1 read handed an empty buffer, then three bytes, then two, must move only \
+             the three bytes, as wasmtime-wasi does"
+        );
+    }
+
     // Neither the array nor the buffer exists in this small memory, so the
     // budget alone, spent before anything is read, refuses each.
     // @behavior RT-096
     #[test]
     fn a_call_past_its_hostcall_fuel_answers_nomem() {
-        let mut array_bytes = [0u8; 64];
-        let mut buffer_bytes = [0u8; 64];
-        buffer_bytes[4..8].copy_from_slice(&(128u32 << 20).wrapping_add(1).to_le_bytes());
-        assert!(
-            matches!(
-                (
-                    GuestMemory::new(&mut array_bytes).first_non_empty_buffer(0, (16 << 20) + 1),
-                    GuestMemory::new(&mut buffer_bytes).first_non_empty_buffer(0, 1),
-                ),
-                (
-                    Err(Failure::Errno(Errno::Nomem)),
-                    Err(Failure::Errno(Errno::Nomem))
-                )
+        // A guest's memory starts aligned, and wiggle refuses an `iovec` at a
+        // host address that is not.
+        #[repr(align(8))]
+        struct AlignedBytes([u8; 64]);
+
+        let mut array_bytes = AlignedBytes([0; 64]);
+        let mut buffer_bytes = AlignedBytes([0; 64]);
+        buffer_bytes.0[4..8].copy_from_slice(&(128u32 << 20).wrapping_add(1).to_le_bytes());
+        let answer = |bytes: &mut [u8], count: u32| {
+            let mut memory = wiggle::GuestMemory::Unshared(bytes);
+            GuestMemory::new(&mut memory, HOSTCALL_FUEL)
+                .first_non_empty_iovec(GuestPtr::new((0, count)))
+                .err()
+                .and_then(|err| err.downcast().ok())
+        };
+        assert_eq!(
+            (
+                answer(&mut array_bytes.0, (16 << 20) + 1),
+                answer(&mut buffer_bytes.0, 1)
             ),
+            (Some(Errno::Nomem), Some(Errno::Nomem)),
             "an iovec array or a buffer past 128 MiB through one preview1 call must answer \
              NOMEM before the host copies any of it"
         );
     }
-
-    // A guest memory of the full 4 GiB lets a field's address pass the end
-    // of the address space, which only the arithmetic itself can refuse.
-    #[test]
-    fn a_field_past_the_address_space_traps_rather_than_wrapping() {
-        assert!(
-            matches!(GuestMemory::field(u32::MAX - 4, 8), Err(Failure::Trap(_))),
-            "a field address past u32::MAX through GuestMemory::field must trap rather than wrap"
-        );
-    }
 }

data/crates/kobako-wasmtime/src/preview1/mount_view/wrap.rs

@@ -0,0 +1,211 @@
+//! A test's Filesystem over another: every call forwards to the entry it
+//! wraps unless its `Hook` steps in, and every entry a lookup finds is
+//! wrapped too, as a Filesystem wrapping another must. It makes a file
+//! through `create` and leaves the open to the VFS, as overlayfs does, so an
+//! open's lookup reaches the `Hook` as any lookup does. It hands the
+//! Filesystem beneath the dentry it is handed, where overlayfs hands a real
+//! one, so what that Filesystem makes is recorded unwrapped and later calls
+//! on it reach that Filesystem past the `Hook`.
+
+use std::any::Any;
+use std::marker::PhantomData;
+use std::sync::Arc;
+
+use kobako_runtime::filesystem::{
+    DentryOperations, FileOperations, FileSystemType, Filesystem, FilesystemError, InodeOperations,
+    Kstat, Lookup, OpenHow, RenameFlag,
+};
+use kobako_runtime::vfs::{Dentry, Inode};
+
+/// What a test changes of the Filesystem beneath it.
+pub(super) trait Hook: Send + Sync + 'static {
+    fn getattr(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Kstat, FilesystemError> {
+        inner.getattr(dentry)
+    }
+
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        inner.lookup(dentry)
+    }
+
+    fn fill_super(
+        &self,
+        fs: Arc<dyn FileSystemType>,
+        sb: &mut Filesystem,
+    ) -> Result<(), FilesystemError> {
+        fs.fill_super(sb)
+    }
+
+    fn open(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        inner.open(dentry, how)
+    }
+
+    fn mkdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.mkdir(dentry)
+    }
+
+    fn rmdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.rmdir(dentry)
+    }
+
+    fn unlink(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        inner.unlink(dentry)
+    }
+
+    fn rename(
+        &self,
+        inner: &dyn InodeOperations,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        inner.rename(from, to_dir, to, flag)
+    }
+}
+
+/// A Filesystem over the one `fs` makes, with `hook` stepping in.
+pub(super) struct Wrap<H> {
+    fs: Arc<dyn FileSystemType>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> Wrap<H> {
+    pub(super) fn new(fs: Arc<dyn FileSystemType>, hook: Arc<H>) -> Arc<Self> {
+        Arc::new(Self { fs, hook })
+    }
+}
+
+impl<H: Hook> FileSystemType for Wrap<H> {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        self.hook.fill_super(self.fs.clone(), sb)?;
+        if let Some(ops) = sb.d_op().cloned() {
+            sb.set_default_d_op(Arc::new(WrapDentry::<H> {
+                ops,
+                hook: PhantomData,
+            }));
+        }
+        if let Some(root) = sb.root().and_then(|root| root.inode()) {
+            let wrapped = WrapInode {
+                inner: root.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            sb.d_make_root(root.with_ops(Arc::new(wrapped)));
+        }
+        Ok(())
+    }
+}
+
+/// `inner`, an entry of the Filesystem beneath, with `hook` stepping in.
+struct WrapInode<H> {
+    inner: Arc<dyn InodeOperations>,
+    hook: Arc<H>,
+}
+
+impl<H: Hook> WrapInode<H> {
+    /// `found` with the entry it names wrapped too.
+    fn wrap(&self, found: Lookup) -> Lookup {
+        let wrapped = |inode: Arc<Inode>| {
+            let ops = Self {
+                inner: inode.ops().clone(),
+                hook: self.hook.clone(),
+            };
+            inode.with_ops(Arc::new(ops))
+        };
+        match found {
+            Lookup::Found(inode) => Lookup::Found(wrapped(inode)),
+            Lookup::Spelled { name, inode } => Lookup::Spelled {
+                name,
+                inode: wrapped(inode),
+            },
+            Lookup::Absent => Lookup::Absent,
+        }
+    }
+}
+
+/// `ops`, handed the directory a `WrapInode<H>` wraps.
+struct WrapDentry<H> {
+    ops: Arc<dyn DentryOperations>,
+    hook: PhantomData<H>,
+}
+
+impl<H: Hook> DentryOperations for WrapDentry<H> {
+    fn revalidate(
+        &self,
+        dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        let dir = (dir as &dyn Any)
+            .downcast_ref::<WrapInode<H>>()
+            .map_or(dir, |wrap| wrap.inner.as_ref());
+        self.ops.revalidate(dir, dentry)
+    }
+}
+
+impl<H: Hook> InodeOperations for WrapInode<H> {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.hook.getattr(self.inner.as_ref(), dentry)
+    }
+
+    fn setattr(
+        &self,
+        dentry: &Dentry,
+        attr: &kobako_runtime::filesystem::Iattr,
+    ) -> Result<(), FilesystemError> {
+        self.inner.setattr(dentry, attr)
+    }
+
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(self.wrap(self.hook.lookup(self.inner.as_ref(), dentry)?))
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        self.hook.open(self.inner.as_ref(), dentry, how)
+    }
+
+    fn create(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.inner.create(dentry)
+    }
+
+    fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.mkdir(self.inner.as_ref(), dentry)
+    }
+
+    fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.rmdir(self.inner.as_ref(), dentry)
+    }
+
+    fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.hook.unlink(self.inner.as_ref(), dentry)
+    }
+
+    fn rename(
+        &self,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        let target = (to_dir as &dyn Any)
+            .downcast_ref::<Self>()
+            .ok_or(FilesystemError::CrossesDevices)?;
+        self.hook
+            .rename(self.inner.as_ref(), from, target.inner.as_ref(), to, flag)
+    }
+}