@threadedstack/wmd-web 0.0.0-stage → 0.1.13

package/src/host/wasi.js

@@ -0,0 +1,335 @@
+// The WASI preview1 subset vm.wasm imports (web/docs/host-interface.md §1.2, §2.5),
+// modelled on the reference host runner/src/wasi.rs.
+//
+// One instance of these functions exists per Worker; everything that must be
+// process-wide (fd table, clock base, exit flag) lives in shared buffers.
+
+import { E } from './errno.js'
+import { CTL_EXIT, CTL_EXIT_CODE } from './layout.js'
+
+const FILETYPE_OFF = 16 // filestat.filetype
+const CHUNK = 1 << 20
+
+/** Thrown out of proc_exit to unwind the calling Worker's wasm stack. */
+export class WasiExit extends Error {
+  constructor(code) {
+    super(`proc_exit(${code})`)
+    this.code = code
+  }
+}
+
+const enc = new TextEncoder()
+
+/** NUL-terminated strings packed back to back, plus their offsets (args/environ layout). */
+export function encodeStrings(list) {
+  const parts = list.map(s => enc.encode(s))
+  const size = parts.reduce((n, p) => n + p.length + 1, 0)
+  const buf = new Uint8Array(size)
+  const offsets = []
+  let o = 0
+  for (const p of parts) {
+    offsets.push(o)
+    buf.set(p, o)
+    o += p.length + 1 // trailing 0 already there
+  }
+  return { buf, offsets, size }
+}
+
+/**
+ * @param {object} o
+ * @param {WebAssembly.Memory} o.memory
+ * @param {string[]} o.args argv, argv[0] included
+ * @param {string[]} o.env  "K=V" strings
+ * @param {ReturnType<import('./fs.js').createFs>} o.fs
+ * @param {ReturnType<import('./clock.js').createClock>} o.clock
+ * @param {Int32Array} o.ctl control cells
+ * @param {(fd:number, bytes:Uint8Array)=>void} o.write stdout/stderr sink
+ * @param {(code:number)=>void} [o.onExit] called once before WasiExit is thrown
+ * @param {(ms:number)=>void} [o.sleep] blocking sleep (Atomics.wait in Workers)
+ */
+export function createWasi({ memory, args, env, fs, clock, ctl, write, onExit, sleep }) {
+  const argv = encodeStrings(args)
+  const envv = encodeStrings(env)
+  const sleepCell = new Int32Array(new SharedArrayBuffer(4))
+  const doSleep = sleep || (ms => Atomics.wait(sleepCell, 0, 0, ms))
+
+  let buf = null
+  let u8, dv
+  const views = () => {
+    const b = memory.buffer
+    if (b !== buf || b.byteLength !== u8.length) {
+      buf = b
+      u8 = new Uint8Array(b)
+      dv = new DataView(b)
+    }
+  }
+  // Initialise eagerly so views() can compare lengths.
+  buf = memory.buffer
+  u8 = new Uint8Array(buf)
+  dv = new DataView(buf)
+
+  const inRange = (ptr, len) => ptr >= 0 && len >= 0 && ptr + len <= u8.length
+  const u32 = x => x >>> 0
+
+  function putStrings(vec, ptrs, bufPtr) {
+    views()
+    ptrs = u32(ptrs)
+    bufPtr = u32(bufPtr)
+    if (!inRange(bufPtr, vec.size) || !inRange(ptrs, 4 * vec.offsets.length)) return E.FAULT
+    u8.set(vec.buf, bufPtr)
+    vec.offsets.forEach((o, i) => dv.setUint32(ptrs + 4 * i, bufPtr + o, true))
+    return E.SUCCESS
+  }
+  function putSizes(vec, countPtr, sizePtr) {
+    views()
+    countPtr = u32(countPtr)
+    sizePtr = u32(sizePtr)
+    if (!inRange(countPtr, 4) || !inRange(sizePtr, 4)) return E.FAULT
+    dv.setUint32(countPtr, vec.offsets.length, true)
+    dv.setUint32(sizePtr, vec.size, true)
+    return E.SUCCESS
+  }
+
+  // Walk an iovec array: calls fn(ptr, len) for each entry; stops early when fn
+  // returns false. Returns an errno.
+  function iovecs(iovs, n, fn) {
+    iovs = u32(iovs)
+    if (!inRange(iovs, 8 * n)) return E.FAULT
+    for (let i = 0; i < n; i++) {
+      const ptr = dv.getUint32(iovs + 8 * i, true)
+      const len = dv.getUint32(iovs + 8 * i + 4, true)
+      if (!inRange(ptr, len)) return E.FAULT
+      if (fn(ptr, len) === false) break
+    }
+    return E.SUCCESS
+  }
+
+  const wasi = {
+    args_sizes_get: (c, s) => putSizes(argv, c, s),
+    args_get: (p, b) => putStrings(argv, p, b),
+    environ_sizes_get: (c, s) => putSizes(envv, c, s),
+    environ_get: (p, b) => putStrings(envv, p, b),
+
+    // W40: no allocation here (clock.js): vm.wasm calls it thousands of times a second.
+    clock_time_get(id, _precision, out) {
+      // 0 realtime; 1-3 monotonic, process and thread CPU time: ns since start (as the runner)
+      if (id < 0 || id > 3) return E.INVAL
+      views()
+      out = u32(out)
+      if (!inRange(out, 8)) return E.FAULT
+      clock.writeNs(dv, out, id)
+      return E.SUCCESS
+    },
+
+    fd_close: fd => fs.close(fd),
+
+    fd_fdstat_get(fd, out) {
+      const type = fs.fdType(fd)
+      if (type < 0) return E.BADF
+      views()
+      out = u32(out)
+      if (!inRange(out, 24)) return E.FAULT
+      u8.fill(0, out, out + 24)
+      u8[out] = type
+      dv.setBigUint64(out + 8, 0xffffffffffffffffn, true)
+      dv.setBigUint64(out + 16, 0xffffffffffffffffn, true)
+      return E.SUCCESS
+    },
+
+    fd_fdstat_set_flags: () => E.SUCCESS,
+
+    fd_filestat_get(fd, out) {
+      const st = fs.stat(fd)
+      if (!st) return E.BADF
+      views()
+      out = u32(out)
+      if (!inRange(out, 64)) return E.FAULT
+      u8.fill(0, out, out + 64)
+      u8[out + FILETYPE_OFF] = st.type
+      dv.setBigUint64(out + 24, 1n, true) // nlink
+      dv.setBigUint64(out + 32, BigInt(st.size), true)
+      return E.SUCCESS
+    },
+
+    fd_prestat_get(fd, out) {
+      const name = fs.prestatName(fd)
+      if (name === null) return E.BADF
+      views()
+      out = u32(out)
+      if (!inRange(out, 8)) return E.FAULT
+      dv.setUint32(out, 0, true) // pr_type 0 = directory
+      dv.setUint32(out + 4, enc.encode(name).length, true)
+      return E.SUCCESS
+    },
+
+    fd_prestat_dir_name(fd, path, len) {
+      const name = fs.prestatName(fd)
+      if (name === null) return E.BADF
+      const b = enc.encode(name)
+      if (u32(len) < b.length) return E.INVAL
+      views()
+      path = u32(path)
+      if (!inRange(path, b.length)) return E.FAULT
+      u8.set(b, path)
+      return E.SUCCESS
+    },
+
+    fd_read(fd, iovs, n, nread) {
+      views()
+      let total = 0
+      let err = E.SUCCESS
+      const e = iovecs(iovs, n, (ptr, len) => {
+        const got = fs.read(fd, u8.subarray(ptr, ptr + len))
+        if (got < 0) {
+          err = -got
+          return false
+        }
+        total += got
+        return got === len // short read: stop
+      })
+      if (e) return e
+      if (err) return err
+      nread = u32(nread)
+      if (!inRange(nread, 4)) return E.FAULT
+      dv.setUint32(nread, total, true)
+      return E.SUCCESS
+    },
+
+    fd_seek(fd, offset, whence, out) {
+      const r = fs.seek(fd, offset, whence)
+      if (r.errno) return r.errno
+      views()
+      out = u32(out)
+      if (!inRange(out, 8)) return E.FAULT
+      dv.setBigUint64(out, BigInt(r.pos), true)
+      return E.SUCCESS
+    },
+
+    fd_write(fd, iovs, n, nwritten) {
+      if (fd !== 1 && fd !== 2) return fs.fdType(fd) < 0 ? E.BADF : E.NOTCAPABLE
+      views()
+      let total = 0
+      const chunks = []
+      const e = iovecs(iovs, n, (ptr, len) => {
+        for (let o = 0; o < len; o += CHUNK) {
+          // slice(): copy out of shared memory before handing the bytes away.
+          chunks.push(u8.slice(ptr + o, ptr + Math.min(len, o + CHUNK)))
+        }
+        total += len
+      })
+      if (e) return e
+      if (chunks.length === 1) write(fd, chunks[0])
+      else if (chunks.length > 1) {
+        const all = new Uint8Array(total)
+        let o = 0
+        for (const c of chunks) {
+          all.set(c, o)
+          o += c.length
+        }
+        write(fd, all)
+      }
+      nwritten = u32(nwritten)
+      if (!inRange(nwritten, 4)) return E.FAULT
+      dv.setUint32(nwritten, total, true)
+      return E.SUCCESS
+    },
+
+    path_open(dirfd, _dirflags, path, pathLen, oflags, _rb, _ri, _fdflags, outFd) {
+      views()
+      path = u32(path)
+      pathLen = u32(pathLen)
+      if (pathLen > 4096) return E.INVAL
+      if (!inRange(path, pathLen)) return E.FAULT
+      let p
+      try {
+        p = new TextDecoder('utf-8', { fatal: true }).decode(u8.slice(path, path + pathLen))
+      } catch {
+        return E.INVAL
+      }
+      const r = fs.open(dirfd, p, oflags)
+      if (r.errno) return r.errno
+      outFd = u32(outFd)
+      if (!inRange(outFd, 4)) return E.FAULT
+      dv.setUint32(outFd, r.fd, true)
+      return E.SUCCESS
+    },
+
+    // Clock subscriptions only, like the runner: sleep for the smallest timeout and
+    // report that one subscription.
+    poll_oneoff(subs, events, nsubs, nevents) {
+      views()
+      subs = u32(subs)
+      if (!inRange(subs, 48 * nsubs)) return E.FAULT
+      // W40: Numbers, not BigInts (no garbage per call: D-417, D-419); a timeout
+      // only needs to be right to the nanoseconds a sleep can tell apart.
+      let best = -1
+      let bestTimeout = 0
+      for (let i = 0; i < nsubs; i++) {
+        const s = subs + 48 * i
+        if (u8[s + 8] !== 0) continue // not a clock subscription
+        const id = dv.getUint32(s + 16, true)
+        let timeout = dv.getUint32(s + 28, true) * 4294967296 + dv.getUint32(s + 24, true)
+        const flags = dv.getUint16(s + 40, true)
+        if (flags & 1) {
+          const now = clock.nowNum(id === 0 ? 0 : 1)
+          timeout = timeout > now ? timeout - now : 0
+        }
+        if (best < 0 || timeout < bestTimeout) {
+          best = s
+          bestTimeout = timeout
+        }
+      }
+      nevents = u32(nevents)
+      if (!inRange(nevents, 4)) return E.FAULT
+      if (best < 0) {
+        dv.setUint32(nevents, 0, true)
+        return E.NOTSUP
+      }
+      // the userdata, before the sleep: the subscription memory is the guest's
+      const udLo = dv.getUint32(best, true)
+      const udHi = dv.getUint32(best + 4, true)
+      const ms = bestTimeout / 1e6
+      if (ms > 0) doSleep(ms)
+      views()
+      events = u32(events)
+      if (!inRange(events, 32)) return E.FAULT
+      u8.fill(0, events, events + 32)
+      dv.setUint32(events, udLo, true) // error 0, type 0 (clock)
+      dv.setUint32(events + 4, udHi, true)
+      dv.setUint32(nevents, 1, true)
+      return E.SUCCESS
+    },
+
+    proc_exit(code) {
+      code = code & 0xff
+      // First caller wins: later exits (other threads racing) keep the first code.
+      if (Atomics.compareExchange(ctl, CTL_EXIT, 0, 1) === 0) {
+        Atomics.store(ctl, CTL_EXIT_CODE, code)
+        Atomics.notify(ctl, CTL_EXIT)
+        onExit?.(code)
+      }
+      throw new WasiExit(code)
+    },
+
+    sched_yield: () => E.SUCCESS,
+
+    // vm.wasm seeds the guest kernel's pool from this (W18: the DTB's
+    // /chosen/rng-seed). getRandomValues refuses views of shared memory and
+    // takes at most 64 KiB per call, so fill a private buffer and copy.
+    random_get(ptr, len) {
+      views()
+      ptr = u32(ptr)
+      len = u32(len)
+      if (!inRange(ptr, len)) return E.FAULT
+      const tmp = new Uint8Array(Math.min(len, 65536))
+      for (let off = 0; off < len; off += tmp.length) {
+        const n = Math.min(tmp.length, len - off)
+        const part = n === tmp.length ? tmp : tmp.subarray(0, n)
+        crypto.getRandomValues(part)
+        u8.set(part, ptr + off)
+      }
+      return E.SUCCESS
+    },
+  }
+  return wasi
+}

package/src/host/wmd-imports.js

@@ -0,0 +1,71 @@
+// The 26 `wmd.*` imports of vm.wasm (web/docs/host-interface.md §1.2, §4.1, §8).
+//
+// P-B1 runs the interpreter with no channels, so only ram_map is ever called. The
+// rest are stubs with the values the guest treats as "not available":
+//   ram_map → 1 (RAM left as plain wasm memory; return value ignored, main_wasm.c:562)
+//   blk_rw → -38 (no swap disk: the browser never passes --swap, so vm.wasm makes no device, D-497)
+//   win_init → 1 (address windows off, win.c:226-253); other win_* → 0 (never called)
+//   snapshot → -1 ("continuing without it")
+//   ctl_attach → -1 (no runner control socket: the guest starts no ctl thread, W3.3)
+//   point → -38 (ENOSYS: no mid-container checkpoint; the guest goes on, W3.3); as the
+//     weak defaults in guest/vm/src/dev/chan.c
+//   jit_load/jit_compile/jit_known → -1, jit_sync/flush/note/yield → no-op when no door is
+//     given; the worker passes the P-B2 JIT door (host/jit.js) as `jit`
+//   chan_open → -111 (ECONNREFUSED, "nothing listens"; channels are P-B3)
+//   chan_send/recv/wake/shutdown/close → -9 (bad handle: no handle was ever issued)
+//
+// Stub calls are counted in the control block (`counters`, layout.js noteHostCall), not
+// reported one by one: --mode jit calls jit_compile thousands of times a second.
+//
+// `overrides` lets later proofs plug in the JIT door and channels without touching
+// the worker wiring: createWmdImports({ jit: {...}, chan: {...} }).
+
+import { noteHostCall } from './layout.js'
+
+const EBADF = -9
+const ECONNREFUSED = -111
+const ENOSYS = -38
+
+export function createWmdImports({ jit = {}, chan = {}, counters, ckpt = null, ram = null } = {}) {
+  const note = counters ? name => noteHostCall(counters, name) : () => {}
+  return {
+    // channels (P-B3)
+    chan_open: chan.open || ((_kind, _port) => (note('chan_open'), ECONNREFUSED)),
+    chan_send: chan.send || ((_h, _p, _l) => EBADF),
+    chan_recv: chan.recv || ((_h, _p, _l, _t) => EBADF),
+    chan_wake: chan.wake || (_h => EBADF),
+    chan_shutdown: chan.shutdown || (_h => EBADF),
+    chan_close: chan.close || (_h => EBADF),
+
+    // JIT door (P-B2)
+    jit_load: jit.load || ((_p, _l) => (note('jit_load'), -1)),
+    jit_compile: jit.compile || ((_p, _l) => (note('jit_compile'), -1)),
+    jit_sync: jit.sync || (() => note('jit_sync')),
+    jit_known: jit.known || (_p => (note('jit_known'), -1)),
+    jit_note: jit.note || ((_p, _n) => note('jit_note')),
+    jit_flush: jit.flush || (() => note('jit_flush')),
+    jit_evict: jit.evict || ((_m, _k, _p, _c) => -1), // D-514: no door, no budget: the guest releases instead
+    jit_yield: jit.yield || (() => {}), // W32: worker.js gives a WebKit JIT thread a yield to its event loop
+
+    snapshot: (_pp, _pl, _hp, _hl) => (note('snapshot'), -1),
+    ram_map: (_off, _len) => 1,
+    // RAM outside memory 0 (host/ram-mem.js, the flat layout): without `ram` the guest's RAM is in
+    // memory 0 and vm.wasm calls none of these (ram_map2 -1: "this host cannot hold RAM outside memory 0")
+    ram_map2: ram?.ram_map2 || ((_off, _lowLen, _total) => -1),
+    ram_rw: ram?.ram_rw || ((_off, _ptr, _len, _write) => -1),
+    ram_cas: ram?.ram_cas || ((_off, _size, _expect, _desired) => 0n),
+    blk_rw: (_op, _off, _ptr, _len) => ENOSYS,
+
+    // W3.3 checkpoints: no control socket and no checkpoint in the browser
+    // P-B9: with `ckpt` (host/ckpt-point.js) the guest starts its ctl thread and takes checkpoints
+    ctl_attach: ckpt?.ctl_attach || (_wordAddr => -1),
+    point: ckpt?.point || ((_kind, _hp, _hl) => ENOSYS),
+
+    // address windows: off in the browser
+    win_init: (_flag, _gen) => 1,
+    win_map: () => 0,
+    win_reset: () => 0,
+    win_unmap: () => 0,
+    win_protect: () => 0,
+  }
+}