feat(rust): identify native imports by module#name via a host resolver

Replaces the per-import __wit_bindgen_register_* hooks with a single
__wit_bindgen_set_import_resolver entry point in the runtime crate, adds
a per-world __wit_bindgen_world_* marker symbol so hosts can verify the
world before calling anything, and un-prefixes __wit_bindgen_cabi_realloc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: BjornTheProgrammer

crates/guest-rust/src/lib.rs

@@ -906,21 +906,59 @@ extern crate std;
 /// Imports are not resolved by the native linker. Each import calls through
 /// a function pointer that starts out null and is looked up on first use
 /// from a host-installed resolver: after loading the library a host calls
-/// the exported `__wit_bindgen_set_import_resolver` function (see
-/// `wit_bindgen::rt::ImportResolver`) with a callback that maps an import's
-/// core module and function names to a function pointer with the import's
-/// core signature. This means everything links whether or not a host is
-/// present, the bindings themselves define no global symbols (so any number
-/// of `generate!` invocations can coexist in one binary), and a host only
-/// needs to implement the imports it cares about — calling an import the
-/// resolver doesn't provide aborts with a message naming it.
+/// the exported `__wit_bindgen_set_import_resolver` function with a callback
+/// that maps an import's core module and function names to a function
+/// pointer with the import's core signature. Its signature is
+///
+/// ```c
+/// void __wit_bindgen_set_import_resolver(
+///     void *(*resolver)(void *ctx, const char *import),
+///     void *ctx);
+/// ```
+///
+/// where `import` is the import's core module and function name joined by
+/// `#` as one NUL-terminated string, e.g. `my:pkg/iface@1.0.0#[method]res.frob`
+/// (see `wit_bindgen::rt::ImportResolver`). Passing a null `resolver`
+/// uninstalls the current one.
+///
+/// This means everything links whether or not a host is present, the import
+/// shims define no global symbols at all, and a host only needs to implement
+/// the imports it cares about — calling an import the resolver doesn't
+/// provide aborts with a message naming it.
+///
+/// The resolver should be installed once, before any export is called: each
+/// import caches the pointer it was given, so a later
+/// `__wit_bindgen_set_import_resolver` call won't be seen by imports that
+/// have already been resolved. The resolver is also shared by every
+/// `generate!` invocation linked into the library and is keyed only by core
+/// module and function name, so two worlds importing the same core name
+/// necessarily get the same implementation.
 ///
 /// Exports, including post-return functions, async callbacks, and resource
 /// destructors, are exported under their hex-encoded core export names. A
 /// `__wit_bindgen_cabi_realloc` function is also exported so hosts can
 /// allocate guest-owned memory when lowering arguments, as the canonical ABI
-/// requires. These two symbols and `__wit_bindgen_set_import_resolver` are
-/// defined once in the `wit-bindgen` runtime crate rather than per world.
+/// requires. That symbol and `__wit_bindgen_set_import_resolver` are defined
+/// once in the `wit-bindgen` runtime crate rather than per world.
+///
+/// Each world additionally exports a marker function
+/// `const char *__wit_bindgen_world_<world>(void)`, where `<world>` is the
+/// hex-encoded fully qualified world name including its package version and
+/// `type_section_suffix`, e.g. `my:pkg@1.0.0/my-world`. Since `dlsym` can't
+/// tell a host whether the library it opened implements the world it expects
+/// — and the canonical ABI lowering of a world changes with the world, so
+/// guessing wrong corrupts memory instead of failing cleanly — a host should
+/// look this symbol up before installing a resolver or calling an export, and
+/// treat a missing symbol as the wrong plugin. Calling it returns the world
+/// name as a NUL-terminated string, for the resulting error message.
+///
+/// This marker is keyed the same way as the `component-type` custom section a
+/// wasm build emits, so the rules are the ones a wasm build already imposes.
+/// Binding the same world twice needs a `type_section_suffix` to tell the
+/// markers apart (plus `export_prefix` for the core export names). Two
+/// *different* worlds sharing one fully qualified name is not a supported
+/// configuration at all: here the linker rejects the duplicate marker, and on
+/// wasm `wit-component` refuses to merge the two packages.
 ///
 /// [WIT package]: https://component-model.bytecodealliance.org/design/packages.html
 #[cfg(feature = "macros")]

crates/guest-rust/src/rt/mod.rs

@@ -198,67 +198,79 @@ pub unsafe fn cabi_realloc(
 /// import shim instead asks a host-installed resolver for its implementation
 /// the first time it's called, identifying the import by its core module and
 /// function name as plain strings. The host installs the resolver once per
-/// loaded library through `__wit_bindgen_set_import_resolver`, so the
-/// bindings themselves define no global symbols at all — any number of
-/// `generate!` invocations (even of the same world) can coexist in one
-/// binary.
+/// loaded library through `__wit_bindgen_set_import_resolver`, so the import
+/// shims define no global symbols at all and any number of `generate!`
+/// invocations can share one resolver. (Export symbols and world markers are
+/// a separate matter: those are global, so binding the same world twice in
+/// one binary needs `export_prefix` and `type_section_suffix` respectively to
+/// avoid duplicate symbols.)
+///
+/// Because each shim caches the pointer the resolver handed it, installing a
+/// resolver a second time has no effect on imports that have already been
+/// called. Hosts are expected to install one before calling any export.
 #[cfg(not(target_arch = "wasm32"))]
 mod native_imports {
+    use core::ffi::{CStr, c_char};
     use core::sync::atomic::{AtomicPtr, Ordering};
 
     /// A host-provided callback returning the implementation of the import
-    /// named by `module`/`name` (the canonical ABI core import names, e.g.
-    /// `my:pkg/iface` and `[method]res.frob`), or null if the host doesn't
-    /// implement it. The returned pointer must be a function with the
-    /// import's core signature. `ctx` is the value passed alongside the
-    /// resolver, returned to the host on every call.
-    pub type ImportResolver = unsafe extern "C" fn(
-        ctx: *mut (),
-        module: *const u8,
-        module_len: usize,
-        name: *const u8,
-        name_len: usize,
-    ) -> *mut ();
+    /// named by `import`, or null if the host doesn't implement it. The
+    /// returned pointer must be a function with the import's core signature.
+    /// `ctx` is the value passed alongside the resolver, returned to the host
+    /// on every call.
+    ///
+    /// `import` is the import's canonical ABI core module and function name
+    /// joined by `#`, as a single NUL-terminated string — for example
+    /// `my:pkg/iface@1.0.0#[method]res.frob`, or `$root#some-func` for a
+    /// function imported at the top level of a world. (Note the package
+    /// version trails the interface name here, unlike in a world name.) It
+    /// points into the guest's static data and stays valid for as long as the
+    /// library is loaded, so a host may use it as a lookup key without
+    /// copying it.
+    pub type ImportResolver = unsafe extern "C" fn(ctx: *mut (), import: *const c_char) -> *mut ();
 
     static RESOLVER: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
     static RESOLVER_CTX: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
 
     /// Installs the import resolver for this linkage unit. Hosts call this
     /// (typically via `dlsym`) after loading the library and before calling
     /// any export.
+    ///
+    /// Passing `None` for `resolver` uninstalls the current one. That only
+    /// affects imports which haven't been resolved yet; imports already
+    /// called keep the pointer they cached.
     #[unsafe(no_mangle)]
     pub unsafe extern "C" fn __wit_bindgen_set_import_resolver(
-        resolver: ImportResolver,
+        resolver: Option<ImportResolver>,
         ctx: *mut (),
     ) {
+        let resolver = match resolver {
+            Some(resolver) => resolver as *mut (),
+            None => core::ptr::null_mut(),
+        };
         RESOLVER_CTX.store(ctx, Ordering::Relaxed);
         // The release store of the resolver publishes the context above.
-        RESOLVER.store(resolver as *mut (), Ordering::Release);
+        RESOLVER.store(resolver, Ordering::Release);
     }
 
     /// Called by generated import shims on their first invocation.
-    pub fn resolve_import(module: &str, name: &str) -> *mut () {
+    ///
+    /// `import` is the `module#name` string described on [`ImportResolver`].
+    pub fn resolve_import(import: &CStr) -> *mut () {
+        let display = import.to_str().unwrap_or("<invalid utf-8>");
         let resolver = RESOLVER.load(Ordering::Acquire);
         assert!(
             !resolver.is_null(),
-            "import `{module}#{name}` was called before the host installed an \
+            "import `{display}` was called before the host installed an \
              import resolver via `__wit_bindgen_set_import_resolver`"
         );
         let ctx = RESOLVER_CTX.load(Ordering::Relaxed);
         let resolver: ImportResolver = unsafe { core::mem::transmute(resolver) };
-        let ptr = unsafe {
-            resolver(
-                ctx,
-                module.as_ptr(),
-                module.len(),
-                name.as_ptr(),
-                name.len(),
-            )
-        };
+        let ptr = unsafe { resolver(ctx, import.as_ptr()) };
         assert!(
             !ptr.is_null(),
             "the host's import resolver provided no implementation for \
-             import `{module}#{name}`"
+             import `{display}`"
         );
         ptr
     }

crates/rust/src/bindgen.rs

@@ -67,7 +67,7 @@ impl<'a, 'b> FunctionBindgen<'a, 'b> {
             &rust_name,
             params,
             results,
-            &self.r#gen.r#gen.runtime_path().to_string(),
+            self.r#gen.r#gen.runtime_path(),
         ));
         rust_name
     }

crates/rust/src/interface.rs

@@ -218,15 +218,15 @@ impl<'i> InterfaceGenerator<'i> {
                 "new",
                 &[abi::WasmType::Pointer],
                 &[abi::WasmType::I32],
-                &self.r#gen.runtime_path().to_string(),
+                self.r#gen.runtime_path(),
             );
             let import_rep = crate::declare_import(
                 &wasm_import_module,
                 &format!("[resource-rep]{resource_name}"),
                 "rep",
                 &[abi::WasmType::I32],
                 &[abi::WasmType::Pointer],
-                &self.r#gen.runtime_path().to_string(),
+                self.r#gen.runtime_path(),
             );
             uwriteln!(
                 self.src,
@@ -1037,7 +1037,7 @@ fn abi_layout(&mut self) -> ::core::alloc::Layout {{
             "call",
             &sig.params,
             &sig.results,
-            &self.r#gen.runtime_path().to_string(),
+            self.r#gen.runtime_path(),
         );
         let mut args = String::new();
         for i in 0..params_lower.len() {
@@ -3005,7 +3005,7 @@ impl<'a> {camel}Borrow<'a>{{
             "drop",
             &[abi::WasmType::I32],
             &[],
-            &self.r#gen.runtime_path().to_string(),
+            self.r#gen.runtime_path(),
         );
         uwriteln!(
             self.src,

crates/rust/src/lib.rs

@@ -11,7 +11,8 @@ use std::str::FromStr;
 use wit_bindgen_core::abi::{Bitcast, WasmType};
 use wit_bindgen_core::{
     AsyncFilterSet, ChainableMethodFilterSet, ChainingMode, Files, InterfaceGenerator as _, Source,
-    Types, WorldGenerator, dealias, name_package_module, uwrite, uwriteln, wit_parser::*,
+    Types, WorldGenerator, dealias, name_package_module, symbol_name, uwrite, uwriteln,
+    wit_parser::*,
 };
 
 mod bindgen;
@@ -549,6 +550,46 @@ impl RustWasm {
         Ok(remapped)
     }
 
+    /// Emits this world's native marker symbol.
+    ///
+    /// Native bindings are loaded by `dlsym`, which gives a host no way to
+    /// tell whether the library it opened implements the WIT world it expects
+    /// or something else — and the canonical ABI lowering of a world changes
+    /// with the world, so guessing wrong corrupts memory rather than failing
+    /// cleanly. So each world exports a marker function named for the world,
+    /// which a host looks up before calling anything else, treating a missing
+    /// symbol as the wrong plugin. Calling it returns the world name as a
+    /// NUL-terminated string, for the error message.
+    ///
+    /// The symbol is keyed on the world's name and `type_section_suffix`,
+    /// exactly like the `component-type` custom section is on wasm, so the
+    /// rules match what a wasm build already imposes: binding the same world
+    /// twice needs a `type_section_suffix` to tell the two apart, and two
+    /// different worlds sharing a fully qualified name is not a supported
+    /// configuration in the first place — on wasm `wit-component` refuses to
+    /// merge them, and here the linker refuses to define the symbol twice.
+    fn finish_native_world_marker(&mut self, resolve: &Resolve, world: WorldId) {
+        let world = &resolve.worlds[world];
+        let pkg = world
+            .package
+            .map(|p| resolve.packages[p].name.to_string())
+            .unwrap_or_default();
+        let name = format!("{pkg}/{}", world.name);
+        let suffix = self.opts.type_section_suffix.as_deref().unwrap_or("");
+        let symbol = symbol_name::make_external_component(&format!("{name}{suffix}"));
+        uwriteln!(
+            self.src,
+            r#"
+#[cfg(not(target_arch = "wasm32"))]
+#[unsafe(no_mangle)]
+#[allow(non_snake_case)]
+pub extern "C" fn __wit_bindgen_world_{symbol}() -> *const ::core::ffi::c_char {{
+    c"{name}".as_ptr()
+}}
+"#
+        );
+    }
+
     fn finish_runtime_module(&mut self) {
         if !self.rt_module.is_empty() {
             // As above, disable rustfmt, as we use prettyplease.
@@ -1501,7 +1542,7 @@ impl WorldGenerator for RustWasm {
         let exports = mem::take(&mut self.export_modules);
         self.emit_modules(exports);
 
-
+        self.finish_native_world_marker(resolve, world);
         self.finish_runtime_module();
         self.finish_export_macro(resolve, world);
 
@@ -1884,8 +1925,8 @@ fn wasm_type(ty: WasmType) -> &'static str {
 /// first use from the host's import resolver (see `rt::resolve_import` and
 /// the exported `__wit_bindgen_set_import_resolver`), identified by its core
 /// module and function names as plain strings. Everything links whether or
-/// not a host is present — the shim defines no global symbols, so any number
-/// of `generate!` invocations can coexist in one binary — and calling an
+/// not a host is present — the shim defines no global symbols, so import
+/// shims never collide between `generate!` invocations — and calling an
 /// import with no resolver (or one the host doesn't implement) aborts with a
 /// message naming the import, just as the old `unreachable!()` stubs
 /// aborted.
@@ -1940,7 +1981,7 @@ fn declare_import(
                     ::core::sync::atomic::AtomicPtr::new(::core::ptr::null_mut());
                 let mut ptr = CACHE.load(::core::sync::atomic::Ordering::Acquire);
                 if ptr.is_null() {{
-                    ptr = {rt}::resolve_import("{wasm_import_module}", "{wasm_import_name}");
+                    ptr = {rt}::resolve_import(c"{wasm_import_module}#{wasm_import_name}");
                     CACHE.store(ptr, ::core::sync::atomic::Ordering::Release);
                 }}
                 let f: unsafe extern "C" fn{sig} = unsafe {{ ::core::mem::transmute(ptr) }};