kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/guest_mem.rs

@@ -1,271 +0,0 @@
-//! Guest linear-memory I/O for the ABI's buffer handoffs, whether the
-//! invocation body drives one through its `Store` or a dispatch or yield
-//! import drives one through its `Caller`. preview1 reads and writes its
-//! arguments through its own `GuestMemory`.
-//!
-//! The two shared steps answer an error kind, and each caller words it,
-//! because depth decides what the same problem means: before the export
-//! call it is a `Trap` or an intact runtime, inside a callback it is a
-//! wire failure the guest receives.
-
-use wasmtime::{AsContext, AsContextMut, Caller, Memory};
-
-use crate::exports::{Exports, RUNTIME_INCOMPATIBLE};
-use crate::invocation::Invocation;
-use kobako_transport::abi::{unpack_ptr_len, MAX_DISPATCH_PAYLOAD};
-use kobako_transport::envelope::Downcall;
-
-// The size-limit messages here and in `io` name the cap as 16 MiB, so
-// moving the cap fails the build until they are reworded with it.
-const _: () = assert!(MAX_DISPATCH_PAYLOAD == 16 << 20);
-
-/// User-facing message for the "the loaded Wasm module is not a
-/// Kobako-shaped runtime at all" failure mode, such as an instance with no
-/// `memory` export.
-pub(crate) const SANDBOX_RUNTIME_NOT_KOBAKO: &str =
-    "the loaded Wasm module is not a Kobako-compatible runtime";
-
-/// Why a host write into guest memory failed.
-pub(crate) enum WriteError {
-    TooLarge,
-    /// The allocator or the memory is missing or mistyped; carries the
-    /// message for it.
-    Incompatible(&'static str),
-    Trapped(wasmtime::Error),
-    /// The allocator ran and answered 0.
-    OutOfMemory,
-    OutOfBounds,
-}
-
-/// Why a host read of a guest-named buffer failed.
-pub(crate) enum ReadError {
-    TooLarge,
-    OutOfBounds,
-}
-
-/// Allocate a guest buffer through `__kobako_alloc` and copy `bytes` into
-/// it, answering the buffer's address.
-pub(crate) fn alloc_and_write(
-    mut ctx: impl AsContextMut,
-    exports: &Exports,
-    bytes: &[u8],
-) -> Result<u32, WriteError> {
-    let len = checked_payload_len(bytes.len()).map_err(|_| WriteError::TooLarge)?;
-    let alloc = exports
-        .alloc
-        .as_ref()
-        .ok_or(WriteError::Incompatible(RUNTIME_INCOMPATIBLE))?;
-    let memory = exports
-        .memory
-        .ok_or(WriteError::Incompatible(SANDBOX_RUNTIME_NOT_KOBAKO))?;
-    let ptr = alloc
-        .call(&mut ctx, len as u32)
-        .map_err(WriteError::Trapped)?;
-    if ptr == 0 {
-        return Err(WriteError::OutOfMemory);
-    }
-    memory
-        .write(&mut ctx, ptr as usize, bytes)
-        .map_err(|_| WriteError::OutOfBounds)?;
-    Ok(ptr)
-}
-
-/// Copy out the buffer the guest names; a length past the 16 MiB cap is
-/// refused before memory is touched.
-pub(crate) fn read_buffer(
-    ctx: impl AsContext,
-    memory: Memory,
-    ptr: usize,
-    len: usize,
-) -> Result<Vec<u8>, ReadError> {
-    if len > MAX_DISPATCH_PAYLOAD {
-        return Err(ReadError::TooLarge);
-    }
-    let data = memory.data(&ctx);
-    let range = guest_buffer_range(ptr, len, data.len()).map_err(|_| ReadError::OutOfBounds)?;
-    Ok(data[range].to_vec())
-}
-
-/// The handles of the instance a host import runs inside.
-fn callback_exports(caller: &Caller<'_, Invocation>) -> Result<Exports, &'static str> {
-    caller.data().exports().ok_or(SANDBOX_RUNTIME_NOT_KOBAKO)
-}
-
-/// Keep a trap the guest raised during a callback into it for the dispatch
-/// import to end the invocation with, and answer the callback's own reason.
-fn keep_trap(
-    caller: &mut Caller<'_, Invocation>,
-    trap: wasmtime::Error,
-    reason: &'static str,
-) -> &'static str {
-    caller.data_mut().record_reentry_trap(trap);
-    reason
-}
-
-/// The request the guest hands the upcall import. Its `(ptr, len)` are
-/// guest addresses, so they are read unsigned.
-pub(crate) fn read_request(
-    caller: &mut Caller<'_, Invocation>,
-    req_ptr: i32,
-    req_len: i32,
-) -> Result<Vec<u8>, &'static str> {
-    let memory = callback_exports(caller)?
-        .memory
-        .ok_or(SANDBOX_RUNTIME_NOT_KOBAKO)?;
-    read_buffer(
-        &*caller,
-        memory,
-        req_ptr as u32 as usize,
-        req_len as u32 as usize,
-    )
-    .map_err(|err| match err {
-        ReadError::TooLarge => "request payload exceeds the 16 MiB limit",
-        ReadError::OutOfBounds => "the Sandbox produced an out-of-bounds request",
-    })
-}
-
-/// Write `bytes` into the guest from inside a callback. A guest that has
-/// already trapped is not called again.
-pub(crate) fn write_from_callback(
-    caller: &mut Caller<'_, Invocation>,
-    bytes: &[u8],
-) -> Result<u32, &'static str> {
-    if caller.data().reentry_trapped() {
-        return Err("the Sandbox already trapped during this invocation");
-    }
-    let exports = callback_exports(caller)?;
-    alloc_and_write(&mut *caller, &exports, bytes).map_err(|err| match err {
-        WriteError::TooLarge => "payload exceeds the 16 MiB limit",
-        WriteError::Incompatible(message) => message,
-        WriteError::Trapped(trap) => keep_trap(
-            caller,
-            trap,
-            "the Sandbox trapped while allocating memory for the request",
-        ),
-        WriteError::OutOfMemory => "the Sandbox ran out of memory while preparing the request",
-        WriteError::OutOfBounds => "could not write the request into the Sandbox's memory",
-    })
-}
-
-/// Every host write boundary routes its length through here, so the
-/// wire-violation reason is uniform.
-pub(crate) fn checked_payload_len(len: usize) -> Result<i32, &'static str> {
-    if len > MAX_DISPATCH_PAYLOAD {
-        return Err("payload exceeds the 16 MiB limit");
-    }
-    // The cap above sits below `i32::MAX`, so this conversion cannot wrap.
-    i32::try_from(len).map_err(|_| "payload exceeds the 16 MiB limit")
-}
-
-pub(crate) fn guest_buffer_range(
-    ptr: usize,
-    len: usize,
-    mem_size: usize,
-) -> Result<core::ops::Range<usize>, &'static str> {
-    let end = ptr.checked_add(len).ok_or("ptr + len overflow")?;
-    if end > mem_size {
-        return Err("range exceeds Sandbox memory size");
-    }
-    Ok(ptr..end)
-}
-
-/// The `(ptr, len)` the guest packs for any answer it hands back, the
-/// outcome and a block's result alike.
-pub(crate) fn unpack_guest_buffer(packed: u64) -> (usize, usize) {
-    let (ptr, len) = unpack_ptr_len(packed);
-    (ptr as usize, len as usize)
-}
-
-pub(crate) fn drive_yield(
-    caller: &mut Caller<'_, Invocation>,
-    frame: u32,
-    args: &[u8],
-) -> Result<Vec<u8>, &'static str> {
-    let request = Downcall::Yield {
-        frame,
-        args: args.to_vec(),
-    }
-    .encode();
-    let len_i32 = checked_payload_len(request.len())?;
-    let req_ptr = write_from_callback(caller, &request)? as i32;
-
-    let exports = callback_exports(caller)?;
-    let yield_fn = exports.downcall.ok_or(RUNTIME_INCOMPATIBLE)?;
-    let memory = exports.memory.ok_or(SANDBOX_RUNTIME_NOT_KOBAKO)?;
-    let packed = yield_fn
-        .call(&mut *caller, (req_ptr, len_i32))
-        .map_err(|trap| keep_trap(caller, trap, "the Sandbox trapped while invoking a block"))?;
-    let (reply_ptr, reply_len) = unpack_guest_buffer(packed);
-    if reply_len == 0 {
-        return Err("the Sandbox returned an empty block result");
-    }
-    read_buffer(&*caller, memory, reply_ptr, reply_len).map_err(|err| match err {
-        ReadError::TooLarge => "block result payload exceeds the 16 MiB limit",
-        ReadError::OutOfBounds => "the Sandbox returned an out-of-bounds block result",
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        checked_payload_len, guest_buffer_range, unpack_guest_buffer, MAX_DISPATCH_PAYLOAD,
-    };
-
-    // @behavior WE-059
-    #[test]
-    fn checked_payload_len_accepts_zero_and_the_cap() {
-        assert_eq!(checked_payload_len(0), Ok(0));
-        assert_eq!(
-            checked_payload_len(MAX_DISPATCH_PAYLOAD),
-            Ok(MAX_DISPATCH_PAYLOAD as i32)
-        );
-    }
-
-    // @behavior WE-060
-    #[test]
-    fn checked_payload_len_rejects_past_the_cap() {
-        assert!(checked_payload_len(MAX_DISPATCH_PAYLOAD + 1).is_err());
-        assert!(checked_payload_len(usize::MAX).is_err());
-    }
-
-    // @behavior WE-061
-    #[test]
-    fn guest_buffer_range_returns_half_open_range() {
-        assert_eq!(guest_buffer_range(10, 5, 100), Ok(10..15));
-    }
-
-    // @behavior WE-062
-    #[test]
-    fn guest_buffer_range_accepts_zero_length_at_any_in_bounds_ptr() {
-        assert_eq!(guest_buffer_range(0, 0, 0), Ok(0..0));
-        assert_eq!(guest_buffer_range(42, 0, 100), Ok(42..42));
-    }
-
-    // @behavior WE-063
-    #[test]
-    fn guest_buffer_range_rejects_ptr_plus_len_overflow() {
-        assert!(guest_buffer_range(usize::MAX, 1, usize::MAX).is_err());
-    }
-
-    // @behavior WE-064
-    #[test]
-    fn guest_buffer_range_rejects_end_past_memory() {
-        assert!(guest_buffer_range(10, 100, 50).is_err());
-        assert_eq!(guest_buffer_range(0, 50, 50), Ok(0..50));
-    }
-
-    // @behavior WE-001
-    #[test]
-    fn unpack_guest_buffer_extracts_high_ptr_low_len() {
-        assert_eq!(
-            unpack_guest_buffer(0xAABB_CCDD_1122_3344),
-            (0xAABB_CCDD, 0x1122_3344)
-        );
-    }
-
-    // @behavior WE-065
-    #[test]
-    fn unpack_guest_buffer_zero_decodes_to_zero_pair() {
-        assert_eq!(unpack_guest_buffer(0), (0, 0));
-    }
-}

data/crates/kobako-wasmtime/src/io.rs

@@ -1,89 +0,0 @@
-//! Per-invocation I/O between the host and the guest: it writes the
-//! entry's downcall into a freshly allocated guest buffer and reads the
-//! Outcome the downcall answered with.
-
-use wasmtime::Store as WtStore;
-
-use crate::exports::Exports;
-use crate::guest_mem::{self, ReadError, WriteError};
-use crate::invocation::Invocation;
-use kobako_runtime::error::{InvokeError, SetupError, Trap};
-use kobako_transport::envelope::{CompileReply, Outcome};
-
-/// A missing or trapping allocator is an engine fault, a `Trap`; one that
-/// runs but returns 0 leaves the runtime intact, so it is a `SetupError`.
-pub(crate) fn write_request(
-    store: &mut WtStore<Invocation>,
-    exports: &Exports,
-    envelope: &[u8],
-) -> Result<(i32, i32), InvokeError> {
-    let trap = |message: String| -> InvokeError { Trap::Other(message).into() };
-    let ptr =
-        guest_mem::alloc_and_write(&mut *store, exports, envelope).map_err(|err| match err {
-            WriteError::OutOfMemory => {
-                SetupError::Intact("could not allocate input buffer (out of memory)".to_string())
-                    .into()
-            }
-            WriteError::TooLarge => trap("payload exceeds the 16 MiB limit".to_string()),
-            WriteError::Incompatible(message) => trap(message.to_string()),
-            WriteError::Trapped(e) => crate::trap::cap_trap(&e)
-                .unwrap_or_else(|| Trap::Other(format!("failed to allocate input buffer: {e}")))
-                .into(),
-            WriteError::OutOfBounds => {
-                trap("the input buffer lies outside the Sandbox's memory".to_string())
-            }
-        })?;
-    // The write has already held the length to the payload cap.
-    Ok((ptr as i32, envelope.len() as i32))
-}
-
-/// A guest that answered without an Outcome the envelope can frame — an
-/// empty answer included — has nothing left to attribute, so it is a
-/// `Trap` like every other way of failing to read the result.
-pub(crate) fn read_outcome(
-    store: &WtStore<Invocation>,
-    exports: &Exports,
-    packed: u64,
-) -> Result<Outcome, Trap> {
-    let bytes = read_answer(store, exports, packed)?;
-    Outcome::decode(&bytes).map_err(|_| {
-        Trap::Other(
-            if bytes.is_empty() {
-                "Sandbox exited without producing a result"
-            } else {
-                "Sandbox produced an unrecognised result"
-            }
-            .to_string(),
-        )
-    })
-}
-
-/// Held to the same 16 MiB bound as an Outcome; an answer that does not
-/// frame is a `Trap` the caller treats like any other failed compile.
-pub(crate) fn read_compile_reply(
-    store: &WtStore<Invocation>,
-    exports: &Exports,
-    packed: u64,
-) -> Result<CompileReply, Trap> {
-    let bytes = read_answer(store, exports, packed)?;
-    CompileReply::decode(&bytes)
-        .map_err(|_| Trap::Other("Sandbox produced an unrecognised compile answer".to_string()))
-}
-
-fn read_answer(
-    store: &WtStore<Invocation>,
-    exports: &Exports,
-    packed: u64,
-) -> Result<Vec<u8>, Trap> {
-    let mem = exports.require_memory()?;
-    let (ptr, len) = guest_mem::unpack_guest_buffer(packed);
-    guest_mem::read_buffer(store, mem, ptr, len).map_err(|err| {
-        Trap::Other(
-            match err {
-                ReadError::TooLarge => "result payload exceeds the 16 MiB limit",
-                ReadError::OutOfBounds => "the Sandbox result is out of bounds",
-            }
-            .to_string(),
-        )
-    })
-}

data/crates/kobako-wasmtime/src/preview1/args.rs

@@ -1,60 +0,0 @@
-//! The checks preview1 makes on an enum or flags argument before a call
-//! looks at its descriptor: a value outside what the witx defines traps,
-//! as wasmtime-wasi's generated bindings refuse to convert it.
-
-use super::errno::{Answer, Errno, Failure};
-
-/// The bits of `fdflags`.
-pub(crate) const FDFLAGS: u64 = 0x1f;
-/// The bits of `rights`.
-pub(crate) const RIGHTS: u64 = (1 << 30) - 1;
-/// The bits of `lookupflags`.
-pub(crate) const LOOKUPFLAGS: u64 = 0x1;
-/// The bits of `oflags`.
-pub(crate) const OFLAGS: u64 = 0xf;
-/// The bits of `riflags`.
-pub(crate) const RIFLAGS: u64 = 0x3;
-/// The bits of `sdflags`.
-pub(crate) const SDFLAGS: u64 = 0x3;
-
-pub(crate) const FDFLAGS_APPEND: u32 = 1 << 0;
-pub(crate) const FDFLAGS_NONBLOCK: u32 = 1 << 2;
-/// The `fdflags` asking each write to be synchronized: `dsync`, `rsync`,
-/// and `sync`.
-pub(crate) const FDFLAGS_SYNCHRONIZED: u32 = (1 << 1) | (1 << 3) | (1 << 4);
-pub(crate) const RIGHTS_FD_READ: u64 = 1 << 1;
-pub(crate) const RIGHTS_FD_WRITE: u64 = 1 << 6;
-
-/// The highest `advice` variant.
-pub(crate) const ADVICE_MAX: u32 = 5;
-/// The highest `whence` variant.
-pub(crate) const WHENCE_MAX: u32 = 2;
-
-pub(crate) fn flags(value: impl Into<u64>, defined: u64) -> Answer {
-    if value.into() & !defined != 0 {
-        return Err(Failure::trap("flags value outside what the witx defines"));
-    }
-    Ok(())
-}
-
-pub(crate) fn variant(value: u32, max: u32) -> Answer {
-    if value > max {
-        return Err(Failure::trap("enum value outside what the witx defines"));
-    }
-    Ok(())
-}
-
-/// `fstflags`, where setting a timestamp and setting it to now are
-/// exclusive: a defined value asking both is `INVAL`.
-pub(crate) fn fstflags(value: u32) -> Answer {
-    const ATIM: u32 = 1 << 0;
-    const ATIM_NOW: u32 = 1 << 1;
-    const MTIM: u32 = 1 << 2;
-    const MTIM_NOW: u32 = 1 << 3;
-    flags(value, 0xf)?;
-    let both = |set, now| value & set != 0 && value & now != 0;
-    if both(ATIM, ATIM_NOW) || both(MTIM, MTIM_NOW) {
-        return Err(Errno::Inval.into());
-    }
-    Ok(())
-}

data/crates/kobako-wasmtime/src/preview1/beneath.rs

@@ -1,188 +0,0 @@
-//! Resolving a guest path beneath a directory descriptor.
-//!
-//! The runtime is the boundary: a path never climbs above the directory
-//! descriptor it is resolved beneath, as a capability never widens, and
-//! the Mount is asked what the guest may do there before the Filesystem
-//! is, so a Filesystem of a third party's need check neither.
-//! A `..` steps out of what the Filesystem holds rather than out of the
-//! path's text, as a host resolves it, so `missing/..` names nothing and
-//! a `..` out of a link is refused rather than taken from its text. A link
-//! is followed only within the directory the descriptor opened, as
-//! wasmtime-wasi's cap-std `Dir` follows one.
-
-use kobako_runtime::filesystem::{FileType, Filesystem, FilesystemError, Metadata};
-
-use super::errno::{Answer, Errno};
-use crate::descriptors::{Identity, OpenDirectory};
-
-/// Linux's limits on a path, its terminating NUL counted, and on one name
-/// within it.
-pub(crate) const PATH_MAX: usize = 4096;
-pub(crate) const NAME_MAX: usize = 255;
-
-/// A guest path resolved beneath a directory: relative to the mount's
-/// root, and whether it ended in `/` or `/.`, which only a directory
-/// satisfies.
-pub(crate) struct ResolvedPath {
-    pub(crate) path: String,
-    pub(crate) names_directory: bool,
-}
-
-impl ResolvedPath {
-    /// The path, refused as `NOTDIR` when it must name a directory and
-    /// `lookup` finds anything else there: `metadata` for a call that
-    /// follows a link at the end, `symlink_metadata` for one that acts on
-    /// the link itself.
-    pub(crate) fn check_directory(
-        self,
-        filesystem: &(dyn Filesystem + 'static),
-        lookup: fn(&(dyn Filesystem + 'static), &str) -> Result<Metadata, FilesystemError>,
-    ) -> Answer<String> {
-        if self.names_directory {
-            match lookup(filesystem, &self.path) {
-                Ok(metadata) if metadata.file_type != FileType::Directory => {
-                    return Err(Errno::Notdir.into())
-                }
-                Ok(_) | Err(FilesystemError::NotFound) => {}
-                Err(err) => return Err(err.into()),
-            }
-        }
-        Ok(self.path)
-    }
-
-    /// The path with a link standing at its end followed within the
-    /// directory `dir` opened, for a call following it. A link pointing
-    /// at nothing there is `LOOP` to a call that `creates`, since what it
-    /// would create could lie outside `dir`, and `NOENT` otherwise.
-    pub(crate) fn follow_last(self, dir: &OpenDirectory, creates: bool) -> Answer<Self> {
-        let Some(base) = bounded_base(dir) else {
-            return Ok(self);
-        };
-        let filesystem = dir.mount.filesystem();
-        let Some(rest) = beneath_base(base, &self.path) else {
-            return Ok(self);
-        };
-        match filesystem.symlink_metadata(&self.path) {
-            Ok(metadata) if metadata.file_type == FileType::Symlink => {}
-            _ => return Ok(self),
-        }
-        let path = match filesystem.canonicalize_beneath(base, rest) {
-            Ok(found) => join(base, &found),
-            Err(FilesystemError::NotFound) if creates => return Err(Errno::Loop.into()),
-            Err(err) => return Err(err.into()),
-        };
-        Ok(Self { path, ..self })
-    }
-}
-
-/// The directory a descriptor's links are kept within, or `None` where
-/// the Filesystem keeps them within the Mount's root already, or a Mount
-/// follows no link at all.
-fn bounded_base(dir: &OpenDirectory) -> Option<&str> {
-    (!dir.path.is_empty() && dir.mount.follows_links()).then_some(dir.path.as_str())
-}
-
-/// What `path` names beneath `base`, or `None` for `base` itself.
-fn beneath_base<'a>(base: &str, path: &'a str) -> Option<&'a str> {
-    path.strip_prefix(base)?.strip_prefix('/')
-}
-
-fn join(base: &str, path: &str) -> String {
-    if path.is_empty() {
-        base.to_string()
-    } else {
-        format!("{base}/{path}")
-    }
-}
-
-/// `path` with the links on its way to its last name followed within the
-/// directory `dir` opened, so none leads the call out of it. A way the
-/// Filesystem finds nothing on stays as given, for the call to answer.
-fn within(dir: &OpenDirectory, path: String) -> Answer<String> {
-    let Some(base) = bounded_base(dir) else {
-        return Ok(path);
-    };
-    let Some((way, name)) = beneath_base(base, &path).and_then(|rest| rest.rsplit_once('/')) else {
-        return Ok(path);
-    };
-    match dir.mount.filesystem().canonicalize_beneath(base, way) {
-        Ok(found) => Ok(join(&join(base, &found), name)),
-        Err(FilesystemError::NotFound | FilesystemError::NotADirectory) => Ok(path),
-        Err(err) => Err(err.into()),
-    }
-}
-
-/// `path`, beneath `dir`. An empty path names nothing; an absolute path or
-/// a `..` above `dir` itself is not the guest's to reach; a `..` or a final `.`
-/// after a component that is missing, no directory, or a link is `NOENT`,
-/// `NOTDIR`, or `LOOP`. A
-/// name past `NAME_MAX`, or a resolved path the Filesystem could not be
-/// handed within `PATH_MAX`, is `NAMETOOLONG`.
-pub(crate) fn resolve(dir: &OpenDirectory, path: &str) -> Answer<ResolvedPath> {
-    confirm(dir)?;
-    if path.is_empty() {
-        return Err(Errno::Noent.into());
-    }
-    if path.starts_with('/') {
-        return Err(Errno::Notcapable.into());
-    }
-    let mut components: Vec<&str> = dir.path.split('/').filter(|c| !c.is_empty()).collect();
-    let opened = components.len();
-    let mut last = "";
-    for component in path.split('/') {
-        last = component;
-        match component {
-            "" | "." => {}
-            ".." => {
-                if components.len() <= opened {
-                    return Err(Errno::Notcapable.into());
-                }
-                step_out_of(dir.mount.filesystem().as_ref(), &components.join("/"))?;
-                components.pop();
-            }
-            component if component.len() > NAME_MAX => return Err(Errno::Nametoolong.into()),
-            component => components.push(component),
-        }
-    }
-    let path = components.join("/");
-    if path.len() >= PATH_MAX {
-        return Err(Errno::Nametoolong.into());
-    }
-    // A final `.` resolves through the name before it, as a `..` does.
-    if last == "." && components.len() > opened {
-        step_out_of(dir.mount.filesystem().as_ref(), &path)?;
-    }
-    Ok(ResolvedPath {
-        path: within(dir, path)?,
-        names_directory: matches!(last, "" | "."),
-    })
-}
-
-/// `dir` still stands at its path, `NOENT` once another directory or
-/// nothing does, as a POSIX descriptor never reaches a directory made in
-/// its place. A directory opened with no identity follows its path alone.
-pub(crate) fn confirm(dir: &OpenDirectory) -> Answer {
-    let Some(identity) = dir.identity else {
-        return Ok(());
-    };
-    match dir.mount.filesystem().metadata(&dir.path) {
-        Ok(found) if Identity::of(&found) == Some(identity) => Ok(()),
-        Ok(_) | Err(FilesystemError::NotFound | FilesystemError::NotADirectory) => {
-            Err(Errno::Noent.into())
-        }
-        Err(err) => Err(err.into()),
-    }
-}
-
-/// A `..` leaves `path` only when it is a directory the Filesystem holds.
-/// A host leaves a link by the parent of where it points, which no guest
-/// is told, so a link there is refused as `LOOP`, as `openat2(2)`
-/// refuses a link it may not follow.
-fn step_out_of(filesystem: &dyn Filesystem, path: &str) -> Answer {
-    match filesystem.symlink_metadata(path) {
-        Ok(metadata) if metadata.file_type == FileType::Directory => Ok(()),
-        Ok(metadata) if metadata.file_type == FileType::Symlink => Err(Errno::Loop.into()),
-        Ok(_) => Err(Errno::Notdir.into()),
-        Err(err) => Err(err.into()),
-    }
-}