kobako 0.29.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/overlay/exclusive.rs

@@ -1,88 +0,0 @@
-//! The lock an Overlay holds across each call, so a change that touches
-//! several Layers is never seen, nor interleaved with, half made, as the
-//! directory's lock overlayfs's changes run under.
-
-use std::sync::{Arc, Condvar, Mutex, MutexGuard};
-use std::thread::{self, ThreadId};
-
-use super::super::FilesystemError;
-
-/// How a thread waits for a lock another thread holds. A frontend whose
-/// threads share a lock of their own, as Ruby's threads share the GVL,
-/// gives that lock up for the wait, or a holder that needs it to finish
-/// never could.
-pub trait Blocking: Send + Sync {
-    /// Run `wait`, which returns once the lock is taken.
-    fn wait(&self, wait: &mut dyn FnMut());
-}
-
-/// Waiting with nothing else to give up.
-pub(super) struct Inline;
-
-impl Blocking for Inline {
-    fn wait(&self, wait: &mut dyn FnMut()) {
-        wait();
-    }
-}
-
-/// Held by one thread at a time. The thread holding it asking again is
-/// refused as a deadlock, as `fcntl` refuses a lock that could never be
-/// granted.
-pub(super) struct Exclusive {
-    holder: Mutex<Option<ThreadId>>,
-    freed: Condvar,
-    blocking: Arc<dyn Blocking>,
-}
-
-impl Exclusive {
-    pub(super) fn new(blocking: Arc<dyn Blocking>) -> Self {
-        Self {
-            holder: Mutex::new(None),
-            freed: Condvar::new(),
-            blocking,
-        }
-    }
-
-    pub(super) fn blocking(&self) -> Arc<dyn Blocking> {
-        self.blocking.clone()
-    }
-
-    fn holder(&self) -> MutexGuard<'_, Option<ThreadId>> {
-        self.holder
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-    }
-
-    pub(super) fn hold(&self) -> Result<Held<'_>, FilesystemError> {
-        let me = thread::current().id();
-        let mut holder = self.holder();
-        match *holder {
-            Some(held) if held == me => return Err(FilesystemError::Deadlock),
-            Some(_) => {
-                drop(holder);
-                self.blocking.wait(&mut || {
-                    let mut holder = self.holder();
-                    while holder.is_some() {
-                        holder = self
-                            .freed
-                            .wait(holder)
-                            .unwrap_or_else(|poisoned| poisoned.into_inner());
-                    }
-                    *holder = Some(me);
-                });
-            }
-            None => *holder = Some(me),
-        }
-        Ok(Held(self))
-    }
-}
-
-/// The lock while one call holds it, freed as the call returns.
-pub(super) struct Held<'a>(&'a Exclusive);
-
-impl Drop for Held<'_> {
-    fn drop(&mut self) {
-        *self.0.holder() = None;
-        self.0.freed.notify_one();
-    }
-}

data/crates/kobako-runtime/src/filesystem/temporary.rs

@@ -1,167 +0,0 @@
-//! `Temporary`: a Filesystem held in memory that every Invocation starts
-//! empty.
-
-use std::sync::Arc;
-
-use super::memory::Memory;
-use super::{DirEntry, File, Filesystem, FilesystemError, Hold, Metadata, OpenOptions, Rename};
-
-/// Files and directories held in memory for one Invocation. The next one
-/// is handed a new, empty Temporary in its place, so nothing one writes
-/// reaches another. Each one holds as much as a Memory does.
-#[derive(Default)]
-pub struct Temporary {
-    memory: Memory,
-}
-
-impl Temporary {
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// This Temporary, and every one handed out in its place, with its
-    /// files holding at most `limit` bytes together, or without bound for
-    /// `None`, as `Memory::with_limit` bounds a Memory.
-    pub fn with_limit(self, limit: Option<usize>) -> Self {
-        Self {
-            memory: self.memory.with_limit(limit),
-        }
-    }
-
-    /// This Temporary, and every one handed out in its place, holding at
-    /// most `inodes` entries, as `Memory::with_inodes` bounds a Memory.
-    pub fn with_inodes(self, inodes: Option<usize>) -> Self {
-        Self {
-            memory: self.memory.with_inodes(inodes),
-        }
-    }
-}
-
-impl Filesystem for Temporary {
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.memory.open(path, options)
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.memory.metadata(path)
-    }
-
-    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.memory.symlink_metadata(path)
-    }
-
-    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-        self.memory.stored_path(path)
-    }
-
-    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError> {
-        self.memory.canonicalize_beneath(base, path)
-    }
-
-    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-        self.memory.for_policy()
-    }
-
-    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError> {
-        self.memory.hold_directory(path)
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.memory.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.create_dir(path)
-    }
-
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_dir(path)
-    }
-
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_file(path)
-    }
-
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.memory.rename(from, to, rename)
-    }
-
-    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
-        Some(Arc::new(Self {
-            memory: self.memory.to_empty(),
-        }))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // @behavior FS-004
-    #[test]
-    fn a_temporary_starts_every_invocation_empty() {
-        let temporary = Temporary::new();
-        temporary
-            .open(
-                "scratch",
-                &OpenOptions {
-                    write: true,
-                    create: true,
-                    ..OpenOptions::default()
-                },
-            )
-            .expect("a new file must be created")
-            .write_at(b"gone", 0)
-            .expect("the write must land");
-
-        let next = temporary
-            .for_invocation()
-            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
-        assert_eq!(
-            next.read_dir("").expect("the root must list"),
-            Vec::new(),
-            "Temporary::for_invocation must hand the next Invocation a Filesystem holding no file"
-        );
-    }
-
-    // @behavior FS-033
-    #[test]
-    fn a_temporary_keeps_its_inodes_in_every_invocation() {
-        let next = Temporary::new()
-            .with_inodes(Some(1))
-            .for_invocation()
-            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
-        assert_eq!(
-            next.create_dir("dir"),
-            Err(FilesystemError::StorageFull),
-            "a directory past a Temporary's inodes in the Filesystem Temporary::for_invocation \
-             hands the next Invocation must answer StorageFull"
-        );
-    }
-
-    // @behavior FS-027
-    #[test]
-    fn a_temporary_keeps_its_limit_in_every_invocation() {
-        let next = Temporary::new()
-            .with_limit(Some(4))
-            .for_invocation()
-            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
-        let written = next
-            .open(
-                "scratch",
-                &OpenOptions {
-                    write: true,
-                    create: true,
-                    ..OpenOptions::default()
-                },
-            )
-            .expect("a new file must be created")
-            .write_at(b"five!", 0);
-        assert_eq!(
-            written,
-            Err(FilesystemError::StorageFull),
-            "a write past a Temporary's limit in the Filesystem Temporary::for_invocation hands \
-             the next Invocation must answer StorageFull"
-        );
-    }
-}

data/crates/kobako-wasmtime/src/capture.rs

@@ -1,96 +0,0 @@
-//! Per-channel stdout / stderr capture sizing and clipping.
-//!
-//! Two pure helpers shared by the run path: one
-//! sizes the per-run `MemoryOutputPipe`, the other clips a captured
-//! snapshot back to the configured cap and reports whether the cap was
-//! exceeded. Kept channel-agnostic (a function of `cap`, not of which
-//! channel) so a regression that only breaks one channel cannot sneak
-//! through the test that pins them.
-
-/// One byte past the cap, so "wrote exactly cap" and "exceeded cap" stay
-/// distinguishable.
-pub(crate) fn pipe_capacity(cap: Option<usize>) -> usize {
-    match cap {
-        Some(c) => c.saturating_add(1),
-        None => usize::MAX,
-    }
-}
-
-/// Takes the snapshot by value and truncates in place, so the readback
-/// costs one copy out of the pipe rather than two.
-pub(crate) fn clip_capture(mut raw: Vec<u8>, cap: Option<usize>) -> (Vec<u8>, bool) {
-    match cap {
-        Some(c) if raw.len() > c => {
-            raw.truncate(c);
-            (raw, true)
-        }
-        _ => (raw, false),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{clip_capture, pipe_capacity};
-
-    // @behavior S-108
-    #[test]
-    fn pipe_capacity_adds_one_when_cap_is_set() {
-        assert_eq!(pipe_capacity(Some(5)), 6);
-        assert_eq!(pipe_capacity(Some(0)), 1);
-    }
-
-    // @behavior S-109
-    #[test]
-    fn pipe_capacity_falls_back_to_usize_max_when_uncapped() {
-        assert_eq!(pipe_capacity(None), usize::MAX);
-    }
-
-    // @behavior S-110
-    #[test]
-    fn pipe_capacity_saturates_at_usize_max() {
-        assert_eq!(pipe_capacity(Some(usize::MAX)), usize::MAX);
-    }
-
-    // @behavior S-111
-    #[test]
-    fn clip_capture_returns_full_bytes_when_under_cap() {
-        let (bytes, truncated) = clip_capture(b"abc".to_vec(), Some(5));
-        assert_eq!(bytes, b"abc");
-        assert!(!truncated);
-    }
-
-    // @behavior S-112
-    #[test]
-    fn clip_capture_does_not_flag_truncation_at_exactly_cap_bytes() {
-        let (bytes, truncated) = clip_capture(b"abcde".to_vec(), Some(5));
-        assert_eq!(bytes, b"abcde");
-        assert!(!truncated);
-    }
-
-    // @behavior S-024
-    #[test]
-    fn clip_capture_clips_to_cap_and_flags_truncation_on_overflow() {
-        // The pipe is sized `cap + 1`, so the snapshot can be at most
-        // 6 bytes when `cap == 5`; that surface is what triggers the
-        // truncation flag.
-        let (bytes, truncated) = clip_capture(b"abcdef".to_vec(), Some(5));
-        assert_eq!(bytes, b"abcde");
-        assert!(truncated);
-    }
-
-    // @behavior S-033
-    #[test]
-    fn clip_capture_treats_none_as_uncapped() {
-        let (bytes, truncated) = clip_capture(b"abcdef".to_vec(), None);
-        assert_eq!(bytes, b"abcdef");
-        assert!(!truncated);
-    }
-
-    // @behavior S-100 S-101
-    #[test]
-    fn clip_capture_handles_empty_input() {
-        let (bytes, truncated) = clip_capture(Vec::new(), Some(5));
-        assert_eq!(bytes, b"");
-        assert!(!truncated);
-    }
-}

data/crates/kobako-wasmtime/src/dispatch.rs

@@ -1,125 +0,0 @@
-//! Host side of the `__kobako_upcall` import: hand the guest's Call to
-//! the bound `DispatchHandler` and write its Reply back into guest memory.
-//! A request under a tag the host does not serve is answered as
-//! unsupported, so a guest asking for a later operation can fall back.
-//!
-//! A failure lands on whoever is answerable for it, and always says why.
-//! A trap the guest raises during a callback into it ends the invocation
-//! as that trap. A Call the host could not answer is answered as an
-//! internal failure naming why, and an answer too large for a message as
-//! the Service's own failure. Only an answer that cannot be written into
-//! guest memory at all ends the invocation, as a trap naming why.
-
-use wasmtime::Caller;
-
-use kobako_runtime::error::Trap;
-use kobako_runtime::yielder::Yielder;
-use kobako_transport::abi::pack_ptr_len;
-use kobako_transport::envelope::{Fault, FaultKind, Reply, Unsupported, Upcall, YieldReply};
-
-use crate::guest_mem;
-use crate::invocation::Invocation;
-
-/// The wasmtime-backed `Yielder`: built per `__kobako_upcall` frame over
-/// that frame's `Caller`, so nested dispatch frames each carry their own and
-/// stack on the Rust call stack with no shared slot.
-struct CallerYielder<'a, 'c> {
-    caller: &'a mut Caller<'c, Invocation>,
-    frame: u32,
-}
-
-impl Yielder for CallerYielder<'_, '_> {
-    fn frame(&self) -> u32 {
-        self.frame
-    }
-
-    fn yield_to_block(&mut self, frame: u32, args: &[u8]) -> Result<YieldReply, Trap> {
-        let bytes = guest_mem::drive_yield(self.caller, frame, args)
-            .map_err(|msg| Trap::Other(msg.to_string()))?;
-        YieldReply::decode(&bytes).map_err(|err| Trap::Other(err.to_string()))
-    }
-}
-
-/// Answer one `__kobako_upcall` call with the packed `(ptr<<32)|len` of
-/// the Reply, or the trap a callback into the guest raised.
-pub(crate) fn handle(
-    caller: &mut Caller<'_, Invocation>,
-    req_ptr: i32,
-    req_len: i32,
-) -> wasmtime::Result<i64> {
-    let reply = reply_to(caller, req_ptr, req_len)
-        .unwrap_or_else(|reason| Reply::Fault(Fault::new(FaultKind::Internal, reason)));
-    let written = write_reply(caller, &fit_in_message(reply).encode());
-    if let Some(trap) = caller.data_mut().take_reentry_trap() {
-        return Err(trap);
-    }
-    if let Some(trap) = caller.data().abandonment() {
-        return Err(trap);
-    }
-    written.map_err(wasmtime::Error::msg)
-}
-
-/// An answer past the message cap is the Service's to change, as any other
-/// answer the host cannot write is.
-fn fit_in_message(reply: Reply) -> Reply {
-    let bytes = reply.encode().len();
-    match guest_mem::checked_payload_len(bytes) {
-        Ok(_) => reply,
-        Err(limit) => Reply::Fault(Fault::new(
-            FaultKind::Runtime,
-            format!("Sandbox could not write the Service's answer: {limit}"),
-        )),
-    }
-}
-
-fn reply_to(
-    caller: &mut Caller<'_, Invocation>,
-    req_ptr: i32,
-    req_len: i32,
-) -> Result<Reply, &'static str> {
-    let req_bytes = guest_mem::read_request(caller, req_ptr, req_len)?;
-    // The driver decodes the core envelope, here and in `CallerYielder`, so
-    // the frontend never sees a frame; the payload inside it stays bytes
-    // the whole way through.
-    let call = match Upcall::decode(&req_bytes) {
-        Ok(Upcall::Call(call)) => call,
-        Ok(_) => {
-            return Ok(Reply::Unsupported(Unsupported::new(
-                "the host does not serve this request",
-            )))
-        }
-        Err(_) => {
-            return Err(
-                "the guest sent a malformed Call envelope — please report this as a kobako bug",
-            )
-        }
-    };
-
-    // `Kobako::Sandbox` always installs the dispatch handler before
-    // invoking the runtime, so reaching this branch indicates a misuse
-    // rather than a normal control path.
-    let handler = caller
-        .data()
-        .on_dispatch()
-        .ok_or("a Sandbox callback fired outside an active invocation — please report this as a kobako bug")?;
-
-    // Build a frame-scoped yielder over this Caller and hand it to the
-    // handler. The borrow ends with the block, freeing the Caller for
-    // `write_reply`; nested dispatch frames each build their own, so
-    // the LIFO re-entry lives on the Rust stack — no shared slot.
-    let frame = caller.data_mut().open_call();
-    let reply = {
-        let mut yielder = CallerYielder { caller, frame };
-        handler.dispatch(call, &mut yielder)
-    };
-    caller.data_mut().close_call();
-    reply.ok_or(
-        "a Sandbox callback raised an exception instead of returning a fault — please report this as a kobako bug",
-    )
-}
-
-fn write_reply(caller: &mut Caller<'_, Invocation>, bytes: &[u8]) -> Result<i64, &'static str> {
-    let ptr = guest_mem::write_from_callback(caller, bytes)?;
-    // The write has already held the length to the payload cap.
-    Ok(pack_ptr_len(ptr, bytes.len() as u32) as i64)
-}