Repository: bytecodealliance/wasmtime
Pull request #7344 (2023-10-24 07:43:50)

refactor: using emit_cmp helper to refactor lowering of selection ins…
This PR implements the second part of issue #5869 .

As lowering the `select` instruction based on  [`fcmp`](https://github.com/bytecodealliance/wasmtime/blob/9d8ca828d1888013b45570a94267778962846ad6/cranelift/codegen/src/isa/x64/lower.isle#L2073). I declare a helper function for lowering `icmp`-based select instruction.


<!--
Please make sure you include the following information:

- If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

- Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->



Patch:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 92c5ae06e..280ceba43 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -281,6 +281,9 @@ jobs:
     # Check that benchmarks of the cranelift project build
     - run: cargo check --benches -p cranelift-codegen
 
+    # Check that the bench-api compiles
+    - run: cargo check -p wasmtime-bench-api
+
     # Check some feature combinations of the `wasmtime-c-api` crate
     - run: cargo check -p wasmtime-c-api --no-default-features
     - run: cargo check -p wasmtime-c-api --no-default-features --features wat
@@ -384,7 +387,7 @@ jobs:
     env:
       QEMU_BUILD_VERSION: 8.1.1
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix: ${{ fromJson(needs.determine.outputs.test-matrix) }}
     steps:
     - uses: actions/checkout@v3
diff --git a/Cargo.lock b/Cargo.lock
index 9399c8538..bc06be362 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -194,9 +194,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.3.3"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "block-buffer"
@@ -257,7 +257,7 @@ checksum = "b779b2d0a001c125b4584ad586268fb4b92d957bff8d26d7fe0dd78283faa814"
 dependencies = [
  "cap-primitives",
  "cap-std",
- "io-lifetimes 2.0.2",
+ "io-lifetimes",
  "windows-sys",
 ]
 
@@ -269,7 +269,7 @@ checksum = "6ffc30dee200c20b4dcb80572226f42658e1d9c4b668656d7cc59c33d50e396e"
 dependencies = [
  "cap-primitives",
  "cap-std",
- "rustix 0.38.8",
+ "rustix",
  "smallvec",
 ]
 
@@ -282,10 +282,10 @@ dependencies = [
  "ambient-authority",
  "fs-set-times",
  "io-extras",
- "io-lifetimes 2.0.2",
+ "io-lifetimes",
  "ipnet",
  "maybe-owned",
- "rustix 0.38.8",
+ "rustix",
  "windows-sys",
  "winx",
 ]
@@ -308,8 +308,8 @@ checksum = "84bade423fa6403efeebeafe568fdb230e8c590a275fba2ba978dd112efcf6e9"
 dependencies = [
  "cap-primitives",
  "io-extras",
- "io-lifetimes 2.0.2",
- "rustix 0.38.8",
+ "io-lifetimes",
+ "rustix",
 ]
 
 [[package]]
@@ -320,7 +320,7 @@ checksum = "7b9e3348a3510c4619b4c7a7bcdef09a71221da18f266bda3ed6b9aea2c509e2"
 dependencies = [
  "cap-std",
  "rand",
- "rustix 0.38.8",
+ "rustix",
  "uuid",
 ]
 
@@ -332,7 +332,7 @@ checksum = "f8f52b3c8f4abfe3252fd0a071f3004aaa3b18936ec97bdbd8763ce03aff6247"
 dependencies = [
  "cap-primitives",
  "once_cell",
- "rustix 0.38.8",
+ "rustix",
  "winx",
 ]
 
@@ -1115,12 +1115,9 @@ checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 
 [[package]]
 name = "fastrand"
-version = "1.9.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "fd-lock"
@@ -1129,7 +1126,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b0377f1edc77dbd1118507bc7a66e4ab64d2b90c66f90726dc801e73a8c68f9"
 dependencies = [
  "cfg-if",
- "rustix 0.38.8",
+ "rustix",
  "windows-sys",
 ]
 
@@ -1192,8 +1189,8 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd738b84894214045e8414eaded76359b4a5773f0a0a56b16575110739cdcf39"
 dependencies = [
- "io-lifetimes 2.0.2",
- "rustix 0.38.8",
+ "io-lifetimes",
+ "rustix",
  "windows-sys",
 ]
 
@@ -1283,7 +1280,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "debugid",
  "fxhash",
  "serde",
@@ -1563,18 +1560,7 @@ version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d3c230ee517ee76b1cc593b52939ff68deda3fae9e41eca426c6b4993df51c4"
 dependencies = [
- "io-lifetimes 2.0.2",
- "windows-sys",
-]
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c66c74d2ae7e79a5a8f7ac924adbe38ee42a859c6539ad869eb51f0b52dc220"
-dependencies = [
- "hermit-abi 0.3.0",
- "libc",
+ "io-lifetimes",
  "windows-sys",
 ]
 
@@ -1592,13 +1578,12 @@ checksum = "879d54834c8c76457ef4293a689b2a8c59b076067ad77b15efafbb05f92a592b"
 
 [[package]]
 name = "is-terminal"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
+checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi 0.3.0",
- "io-lifetimes 1.0.10",
- "rustix 0.37.13",
+ "rustix",
  "windows-sys",
 ]
 
@@ -1688,9 +1673,9 @@ checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
 
 [[package]]
 name = "libfuzzer-sys"
@@ -1721,15 +1706,9 @@ checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b085a4f2cde5781fc4b1717f2e86c62f5cda49de7ba99a7c2eae02b61c9064c"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.3"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
 
 [[package]]
 name = "listenfd"
@@ -1783,11 +1762,11 @@ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
 
 [[package]]
 name = "memfd"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffc89ccdc6e10d6907450f753537ebc5c5d3460d2e4e62ea74bd571db62c0f9e"
+checksum = "b2cffa4ad52c6f791f4f8b15f0c05f9824b2ced1160e88cc393d64fff9a8ac64"
 dependencies = [
- "rustix 0.37.13",
+ "rustix",
 ]
 
 [[package]]
@@ -2283,29 +2262,15 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.37.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79bef90eb6d984c72722595b5b1348ab39275a5e5123faca6863bf07d75a4e0"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes 1.0.10",
- "libc",
- "linux-raw-sys 0.3.3",
- "windows-sys",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.8"
+version = "0.38.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f"
+checksum = "747c788e9ce8e92b12cd485c49ddf90723550b654b32508f979b71a7b1ecda4f"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "errno",
  "itoa",
  "libc",
- "linux-raw-sys 0.4.3",
+ "linux-raw-sys",
  "once_cell",
  "windows-sys",
 ]
@@ -2593,12 +2558,12 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27ce32341b2c0b70c144bbf35627fdc1ef18c76ced5e5e7b3ee8b5ba6b2ab6a0"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "cap-fs-ext",
  "cap-std",
  "fd-lock",
- "io-lifetimes 2.0.2",
- "rustix 0.38.8",
+ "io-lifetimes",
+ "rustix",
  "windows-sys",
  "winx",
 ]
@@ -2611,15 +2576,14 @@ checksum = "d7fa7e55043acb85fca6b3c01485a2eeb6b69c5d21002e273c79e465f43b7ac1"
 
 [[package]]
 name = "tempfile"
-version = "3.6.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c0432476357e58790aaa47a8efb0c5138f137343f3b5f23bd36a27e3b0a6d6"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
 dependencies = [
- "autocfg",
  "cfg-if",
  "fastrand",
  "redox_syscall 0.3.5",
- "rustix 0.37.13",
+ "rustix",
  "windows-sys",
 ]
 
@@ -3019,9 +2983,9 @@ dependencies = [
  "cap-time-ext",
  "fs-set-times",
  "io-extras",
- "io-lifetimes 2.0.2",
+ "io-lifetimes",
  "once_cell",
- "rustix 0.38.8",
+ "rustix",
  "system-interface",
  "tempfile",
  "tracing",
@@ -3034,12 +2998,12 @@ name = "wasi-common"
 version = "15.0.0"
 dependencies = [
  "anyhow",
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "cap-rand",
  "cap-std",
  "io-extras",
  "log",
- "rustix 0.38.8",
+ "rustix",
  "tempfile",
  "test-log",
  "test-programs-artifacts",
@@ -3072,8 +3036,8 @@ dependencies = [
  "cap-std",
  "cap-tempfile",
  "io-extras",
- "io-lifetimes 2.0.2",
- "rustix 0.38.8",
+ "io-lifetimes",
+ "rustix",
  "tempfile",
  "tokio",
  "wasi-cap-std-sync",
@@ -3323,6 +3287,13 @@ dependencies = [
 [[package]]
 name = "wasmtime-c-api"
 version = "15.0.0"
+dependencies = [
+ "wasmtime-c-api-impl",
+]
+
+[[package]]
+name = "wasmtime-c-api-impl"
+version = "15.0.0"
 dependencies = [
  "anyhow",
  "cap-std",
@@ -3359,7 +3330,7 @@ dependencies = [
  "log",
  "once_cell",
  "pretty_env_logger 0.5.0",
- "rustix 0.38.8",
+ "rustix",
  "serde",
  "serde_derive",
  "sha2",
@@ -3376,6 +3347,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "bstr",
+ "bytes",
  "clap",
  "component-macro-test",
  "component-test-util",
@@ -3391,7 +3363,7 @@ dependencies = [
  "num_cpus",
  "once_cell",
  "rayon",
- "rustix 0.38.8",
+ "rustix",
  "serde",
  "serde_derive",
  "serde_json",
@@ -3550,7 +3522,7 @@ dependencies = [
  "backtrace",
  "cc",
  "cfg-if",
- "rustix 0.38.8",
+ "rustix",
  "wasmtime-asm-macros",
  "wasmtime-versioned-export-macros",
  "windows-sys",
@@ -3625,7 +3597,7 @@ dependencies = [
  "log",
  "object",
  "rustc-demangle",
- "rustix 0.38.8",
+ "rustix",
  "serde",
  "serde_derive",
  "target-lexicon",
@@ -3642,7 +3614,7 @@ version = "15.0.0"
 dependencies = [
  "object",
  "once_cell",
- "rustix 0.38.8",
+ "rustix",
  "wasmtime-versioned-export-macros",
 ]
 
@@ -3673,7 +3645,7 @@ dependencies = [
  "paste",
  "proptest",
  "rand",
- "rustix 0.38.8",
+ "rustix",
  "sptr",
  "wasm-encoder",
  "wasmtime-asm-macros",
@@ -3711,7 +3683,7 @@ version = "15.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "bytes",
  "cap-fs-ext",
  "cap-net-ext",
@@ -3721,11 +3693,11 @@ dependencies = [
  "fs-set-times",
  "futures",
  "io-extras",
- "io-lifetimes 2.0.2",
+ "io-lifetimes",
  "libc",
  "log",
  "once_cell",
- "rustix 0.38.8",
+ "rustix",
  "system-interface",
  "tempfile",
  "test-log",
@@ -3896,7 +3868,7 @@ version = "15.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "proptest",
  "thiserror",
  "tokio",
@@ -4110,7 +4082,7 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4857cedf8371f690bb6782a3e2b065c54d1b6661be068aaf3eac8b45e813fdf8"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "windows-sys",
 ]
 
@@ -4120,7 +4092,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7d92ce0ca6b6074059413a9581a637550c3a740581c854f9847ec293c8aed71"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "wit-bindgen-rust-macro",
 ]
 
@@ -4170,7 +4142,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e87488b57a08e2cbbd076b325acbe7f8666965af174d69d5929cd373bd54547f"
 dependencies = [
  "anyhow",
- "bitflags 2.3.3",
+ "bitflags 2.4.1",
  "indexmap 2.0.0",
  "log",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index b2b3f3b3c..4a7248fe0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -50,6 +50,7 @@ tracing = { workspace = true }
 log = { workspace = true }
 
 async-trait = { workspace = true }
+bytes = { workspace = true }
 tokio = { workspace = true, optional = true, features = [ "signal", "macros" ] }
 hyper = { workspace = true, optional = true }
 http-body-util = { workspace = true, optional = true }
@@ -101,7 +102,7 @@ members = [
   "cranelift/isle/islec",
   "cranelift/serde",
   "crates/bench-api",
-  "crates/c-api",
+  "crates/c-api/artifact",
   "crates/environ/fuzz",
   "crates/test-programs",
   "crates/wasi-preview1-component-adapter",
@@ -166,7 +167,7 @@ wasmtime-wit-bindgen = { path = "crates/wit-bindgen", version = "=15.0.0" }
 test-programs-artifacts = { path = 'crates/test-programs/artifacts' }
 
 cranelift-wasm = { path = "cranelift/wasm", version = "0.102.0" }
-cranelift-codegen = { path = "cranelift/codegen", version = "0.102.0" }
+cranelift-codegen = { path = "cranelift/codegen", version = "0.102.0", default-features = false, features = ["std", "unwind"] }
 cranelift-frontend = { path = "cranelift/frontend", version = "0.102.0" }
 cranelift-entity = { path = "cranelift/entity", version = "0.102.0" }
 cranelift-native = { path = "cranelift/native", version = "0.102.0" }
diff --git a/RELEASES.md b/RELEASES.md
index 35c8e9c18..296ee1357 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -10,6 +10,35 @@ Unreleased.
 
 --------------------------------------------------------------------------------
 
+## 14.0.2
+
+Released 2023-10-26
+
+### Fixed
+
+* Make the `wasmtime::unix` module accessible on macOS again.
+  [#7360](https://github.com/bytecodealliance/wasmtime/pull/7360)
+
+* Inter-crate dependencies between `cranelift-*` crates now disable the
+  `default` feature meaning that it's possible for embedders to depend on
+  `cranelift-codegen` as well without the `default` feature.
+  [#7369](https://github.com/bytecodealliance/wasmtime/pull/7369)
+
+--------------------------------------------------------------------------------
+
+## 14.0.1
+
+Released 2023-10-23
+
+### Fixed
+
+* Cranelift: preserve uext and sext flags for parameters on x86\_64 and apple
+  aarch64. Note that this does not affect Wasmtime and is only intended for
+  Cranelift embedders such as `rustc_codegen_cranelift`.
+  [#7333](https://github.com/bytecodealliance/wasmtime/pull/7333)
+
+--------------------------------------------------------------------------------
+
 ## 14.0.0
 
 Released 2023-10-20
@@ -168,6 +197,17 @@ More information about this change can be found on
 
 --------------------------------------------------------------------------------
 
+## 13.0.1
+
+Released 2023-10-26
+
+### Fixed
+
+* Make the `wasmtime::unix` module accessible on macOS again.
+  [#7360](https://github.com/bytecodealliance/wasmtime/pull/7360)
+
+--------------------------------------------------------------------------------
+
 ## 13.0.0
 
 Released 2023-09-20
diff --git a/cranelift/codegen/src/isa/riscv64/inst/emit.rs b/cranelift/codegen/src/isa/riscv64/inst/emit.rs
index cdc7619f8..936037d77 100644
--- a/cranelift/codegen/src/isa/riscv64/inst/emit.rs
+++ b/cranelift/codegen/src/isa/riscv64/inst/emit.rs
@@ -482,7 +482,7 @@ impl Inst {
                 rd,
                 rs,
                 imm12,
-            } if rd.to_reg() != zero_reg() && rs == zero_reg() && imm12.as_i16() != 0 => {
+            } if rd.to_reg() != zero_reg() && rs == zero_reg() => {
                 let imm6 = Imm6::maybe_from_imm12(imm12)?;
                 sink.put2(encode_ci_type(CiOp::CLi, rd, imm6));
             }
diff --git a/cranelift/codegen/src/isa/x64/lower.isle b/cranelift/codegen/src/isa/x64/lower.isle
index af11e659d..e0d17fe62 100644
--- a/cranelift/codegen/src/isa/x64/lower.isle
+++ b/cranelift/codegen/src/isa/x64/lower.isle
@@ -2082,8 +2082,7 @@
 ;; than one instruction for certain types (e.g., XMM-held, I128).
 
 (rule (lower (has_type ty (select (maybe_uextend (icmp cc a @ (value_type (fits_in_64 a_ty)) b)) x y)))
-      (let ((size OperandSize (raw_operand_size_of_type a_ty)))
-           (with_flags (x64_cmp size b a) (cmove_from_values ty cc x y))))
+      (lower_select_icmp ty (emit_cmp cc a b) x y))
 
 ;; Finally, we lower `select` from a condition value `c`. These rules are meant
 ;; to be the final, default lowerings if no other patterns matched above.
@@ -2099,6 +2098,10 @@
       (let ((cond_result IcmpCondResult (cmp_zero_i128 (CC.Z) c)))
         (select_icmp cond_result x y)))
 
+(decl lower_select_icmp (Type IcmpCondResult Value Value) InstOutput)
+(rule (lower_select_icmp ty (IcmpCondResult.Condition flags cc) x y)
+      (with_flags flags (cmove_from_values ty cc x y)))
+
 ;; Specializations for floating-point compares to generate a `mins*` or a
 ;; `maxs*` instruction. These are equivalent to the "pseudo-m{in,ax}"
 ;; specializations for vectors.
diff --git a/cranelift/wasm/src/code_translator/bounds_checks.rs b/cranelift/wasm/src/code_translator/bounds_checks.rs
index 6e236165b..464417b51 100644
--- a/cranelift/wasm/src/code_translator/bounds_checks.rs
+++ b/cranelift/wasm/src/code_translator/bounds_checks.rs
@@ -85,8 +85,8 @@ where
         //
         //            index + 1 > bound
         //        ==> index >= bound
-        HeapStyle::Dynamic { bound_gv } if offset_and_size == 1 => {
-            let bound = builder.ins().global_value(env.pointer_type(), bound_gv);
+        HeapStyle::Dynamic { .. } if offset_and_size == 1 => {
+            let bound = get_dynamic_heap_bound(builder, env, heap);
             let oob = builder
                 .ins()
                 .icmp(IntCC::UnsignedGreaterThanOrEqual, index, bound);
@@ -127,8 +127,8 @@ where
         //    offset immediates -- which is a common code pattern when accessing
         //    multiple fields in the same struct that is in linear memory --
         //    will all emit the same `index > bound` check, which we can GVN.
-        HeapStyle::Dynamic { bound_gv } if offset_and_size <= heap.offset_guard_size => {
-            let bound = builder.ins().global_value(env.pointer_type(), bound_gv);
+        HeapStyle::Dynamic { .. } if offset_and_size <= heap.offset_guard_size => {
+            let bound = get_dynamic_heap_bound(builder, env, heap);
             let oob = builder.ins().icmp(IntCC::UnsignedGreaterThan, index, bound);
             Reachable(explicit_check_oob_condition_and_compute_addr(
                 &mut builder.cursor(),
@@ -149,8 +149,8 @@ where
         //
         //            index + offset + access_size > bound
         //        ==> index > bound - (offset + access_size)
-        HeapStyle::Dynamic { bound_gv } if offset_and_size <= heap.min_size.into() => {
-            let bound = builder.ins().global_value(env.pointer_type(), bound_gv);
+        HeapStyle::Dynamic { .. } if offset_and_size <= heap.min_size.into() => {
+            let bound = get_dynamic_heap_bound(builder, env, heap);
             let adjusted_bound = builder.ins().iadd_imm(bound, -(offset_and_size as i64));
             let oob = builder
                 .ins()
@@ -172,7 +172,7 @@ where
         //        index + offset + access_size > bound
         //
         //    And we have to handle the overflow case in the left-hand side.
-        HeapStyle::Dynamic { bound_gv } => {
+        HeapStyle::Dynamic { .. } => {
             let access_size_val = builder
                 .ins()
                 .iconst(env.pointer_type(), offset_and_size as i64);
@@ -181,7 +181,7 @@ where
                 access_size_val,
                 ir::TrapCode::HeapOutOfBounds,
             );
-            let bound = builder.ins().global_value(env.pointer_type(), bound_gv);
+            let bound = get_dynamic_heap_bound(builder, env, heap);
             let oob = builder
                 .ins()
                 .icmp(IntCC::UnsignedGreaterThan, adjusted_index, bound);
@@ -297,6 +297,30 @@ where
     })
 }
 
+/// Get the bound of a dynamic heap as an `ir::Value`.
+fn get_dynamic_heap_bound<Env>(
+    builder: &mut FunctionBuilder,
+    env: &mut Env,
+    heap: &HeapData,
+) -> ir::Value
+where
+    Env: FuncEnvironment + ?Sized,
+{
+    match (heap.max_size, &heap.style) {
+        // The heap has a constant size, no need to actually load the bound.
+        (Some(max_size), _) if heap.min_size == max_size => {
+            builder.ins().iconst(env.pointer_type(), max_size as i64)
+        }
+
+        // Load the heap bound from its global variable.
+        (_, HeapStyle::Dynamic { bound_gv }) => {
+            builder.ins().global_value(env.pointer_type(), *bound_gv)
+        }
+
+        (_, HeapStyle::Static { .. }) => unreachable!("not a dynamic heap"),
+    }
+}
+
 fn cast_index_to_pointer_ty(
     index: ir::Value,
     index_ty: ir::Type,
diff --git a/cranelift/wasm/src/environ/dummy.rs b/cranelift/wasm/src/environ/dummy.rs
index aacaeb18a..f27ffc702 100644
--- a/cranelift/wasm/src/environ/dummy.rs
+++ b/cranelift/wasm/src/environ/dummy.rs
@@ -307,6 +307,7 @@ impl<'dummy_environment> FuncEnvironment for DummyFuncEnvironment<'dummy_environ
         Ok(self.heaps.push(HeapData {
             base: gv,
             min_size: 0,
+            max_size: None,
             offset_guard_size: 0x8000_0000,
             style: HeapStyle::Static {
                 bound: 0x1_0000_0000,
diff --git a/cranelift/wasm/src/heap.rs b/cranelift/wasm/src/heap.rs
index bab1f7e9a..85d5f1d68 100644
--- a/cranelift/wasm/src/heap.rs
+++ b/cranelift/wasm/src/heap.rs
@@ -74,6 +74,11 @@ pub struct HeapData {
     /// don't need bounds checking.
     pub min_size: u64,
 
+    /// The maximum heap size in bytes.
+    ///
+    /// Heap accesses larger than this will always trap.
+    pub max_size: Option<u64>,
+
     /// Size in bytes of the offset-guard pages following the heap.
     pub offset_guard_size: u64,
 
diff --git a/crates/bench-api/Cargo.toml b/crates/bench-api/Cargo.toml
index 83cce9065..ebfdeb871 100644
--- a/crates/bench-api/Cargo.toml
+++ b/crates/bench-api/Cargo.toml
@@ -18,8 +18,10 @@ doctest = false
 anyhow = { workspace = true }
 shuffling-allocator = { version = "1.1.1", optional = true }
 target-lexicon = { workspace = true }
-wasmtime = { workspace = true }
-wasmtime-cli-flags = { workspace = true, default-features = true }
+wasmtime = { workspace = true, default-features = true }
+wasmtime-cli-flags = { workspace = true, default-features = true, features = [
+    "cranelift",
+] }
 wasmtime-wasi = { workspace = true, default-features = true }
 wasmtime-wasi-nn = { workspace = true, optional = true }
 wasi-cap-std-sync = { workspace = true }
diff --git a/crates/c-api/CMakeLists.txt b/crates/c-api/CMakeLists.txt
index 782a9aa78..b5fb5e085 100644
--- a/crates/c-api/CMakeLists.txt
+++ b/crates/c-api/CMakeLists.txt
@@ -100,7 +100,7 @@ ExternalProject_Add(
 	CONFIGURE_COMMAND ""
 	INSTALL_COMMAND "${WASMTIME_INSTALL_COMMAND}"
         BUILD_COMMAND ${WASMTIME_PREBUILD_COMMAND} ${WASMTIME_CARGO_BINARY} build ${WASMTIME_BUILD_TYPE_FLAG} ${WASMTIME_USER_CARGO_BUILD_OPTIONS} ${WASMTIME_BUILD_TARGET}
-	BINARY_DIR ${CMAKE_CURRENT_SOURCE_DIR}
+	BINARY_DIR ${CMAKE_CURRENT_SOURCE_DIR}/artifact
         BUILD_ALWAYS ${WASMTIME_ALWAYS_BUILD}
 	BUILD_BYPRODUCTS ${WASMTIME_BUILD_PRODUCT})
 add_library(wasmtime INTERFACE)
@@ -137,5 +137,5 @@ install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/wasm-c-api/include/wasm.h
 	DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
 install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/include/wasmtime
 	DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
-install(FILES ${WASMTIME_BUILD_PRODUCT} 
+install(FILES ${WASMTIME_BUILD_PRODUCT}
 	DESTINATION ${CMAKE_INSTALL_LIBDIR})
diff --git a/crates/c-api/Cargo.toml b/crates/c-api/Cargo.toml
index 1548b0634..82d46337b 100644
--- a/crates/c-api/Cargo.toml
+++ b/crates/c-api/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "wasmtime-c-api"
+name = "wasmtime-c-api-impl"
 version.workspace = true
 authors.workspace = true
 description = "C API to expose the Wasmtime runtime"
@@ -10,8 +10,7 @@ edition.workspace = true
 publish = false
 
 [lib]
-name = "wasmtime"
-crate-type = ["staticlib", "cdylib", "rlib"]
+name = "wamstime_c_api"
 doc = false
 test = false
 doctest = false
@@ -38,16 +37,6 @@ wasi-common = { workspace = true, optional = true }
 futures = { workspace = true, optional = true }
 
 [features]
-default = [
-  'profiling',
-  'wat',
-  'wasi',
-  'cache',
-  'parallel-compilation',
-  'async',
-  'coredump',
-  'addr2line',
-]
 async = ['wasmtime/async', 'futures']
 profiling = ["wasmtime/profiling"]
 cache = ["wasmtime/cache"]
diff --git a/crates/c-api/artifact/Cargo.toml b/crates/c-api/artifact/Cargo.toml
new file mode 100644
index 000000000..0738a9df1
--- /dev/null
+++ b/crates/c-api/artifact/Cargo.toml
@@ -0,0 +1,42 @@
+[package]
+name = "wasmtime-c-api"
+version.workspace = true
+authors.workspace = true
+description = "C API to expose the Wasmtime runtime"
+license = "Apache-2.0 WITH LLVM-exception"
+repository = "https://github.com/bytecodealliance/wasmtime"
+readme = "README.md"
+edition.workspace = true
+publish = false
+
+[lib]
+name = "wasmtime"
+crate-type = ["staticlib", "cdylib"]
+doc = false
+test = false
+doctest = false
+
+[dependencies]
+wasmtime-c-api = { path = '..', package = 'wasmtime-c-api-impl' }
+
+[features]
+default = [
+  'profiling',
+  'wat',
+  'wasi',
+  'cache',
+  'parallel-compilation',
+  'async',
+  'coredump',
+  'addr2line',
+]
+async = ['wasmtime-c-api/async']
+profiling = ["wasmtime-c-api/profiling"]
+cache = ["wasmtime-c-api/cache"]
+parallel-compilation = ['wasmtime-c-api/parallel-compilation']
+wasi = ['wasmtime-c-api/wasi']
+logging = ['wasmtime-c-api/logging']
+disable-logging = ["wasmtime-c-api/disable-logging"]
+coredump = ["wasmtime-c-api/coredump"]
+addr2line = ["wasmtime-c-api/addr2line"]
+wat = ["wasmtime-c-api/wat"]
diff --git a/crates/c-api/artifact/src/lib.rs b/crates/c-api/artifact/src/lib.rs
new file mode 100644
index 000000000..43929bb86
--- /dev/null
+++ b/crates/c-api/artifact/src/lib.rs
@@ -0,0 +1,1 @@
+pub use wasmtime_c_api::*;
diff --git a/crates/cranelift/Cargo.toml b/crates/cranelift/Cargo.toml
index e7318e4ab..1ef91e7f5 100644
--- a/crates/cranelift/Cargo.toml
+++ b/crates/cranelift/Cargo.toml
@@ -15,7 +15,7 @@ anyhow = { workspace = true }
 log = { workspace = true }
 wasmtime-environ = { workspace = true }
 cranelift-wasm = { workspace = true }
-cranelift-codegen = { workspace = true }
+cranelift-codegen = { workspace = true, features = ["default"] }
 cranelift-frontend = { workspace = true }
 cranelift-entity = { workspace = true }
 cranelift-native = { workspace = true }
diff --git a/crates/cranelift/src/func_environ.rs b/crates/cranelift/src/func_environ.rs
index 189de51c2..2ea9098f0 100644
--- a/crates/cranelift/src/func_environ.rs
+++ b/crates/cranelift/src/func_environ.rs
@@ -1839,6 +1839,11 @@ impl<'module_environment> cranelift_wasm::FuncEnvironment for FuncEnvironment<'m
                 u64::MAX
             });
 
+        let max_size = self.module.memory_plans[index]
+            .memory
+            .maximum
+            .and_then(|max| max.checked_mul(u64::from(WASM_PAGE_SIZE)));
+
         let (ptr, base_offset, current_length_offset) = {
             let vmctx = self.vmctx(func);
             if let Some(def_index) = self.module.defined_memory_index(index) {
@@ -1943,6 +1948,7 @@ impl<'module_environment> cranelift_wasm::FuncEnvironment for FuncEnvironment<'m
         Ok(self.heaps.push(HeapData {
             base: heap_base,
             min_size,
+            max_size,
             offset_guard_size,
             style: heap_style,
             index_type: self.memory_index_type(index),
diff --git a/crates/runtime/src/instance/allocator/pooling.rs b/crates/runtime/src/instance/allocator/pooling.rs
index 7d00a5905..e0584726f 100644
--- a/crates/runtime/src/instance/allocator/pooling.rs
+++ b/crates/runtime/src/instance/allocator/pooling.rs
@@ -219,6 +219,8 @@ pub struct PoolingInstanceAllocatorConfig {
     pub table_keep_resident: usize,
     /// Whether to enable memory protection keys.
     pub memory_protection_keys: MpkEnabled,
+    /// How many memory protection keys to allocate.
+    pub max_memory_protection_keys: usize,
 }
 
 impl Default for PoolingInstanceAllocatorConfig {
@@ -232,6 +234,7 @@ impl Default for PoolingInstanceAllocatorConfig {
             linear_memory_keep_resident: 0,
             table_keep_resident: 0,
             memory_protection_keys: MpkEnabled::Disable,
+            max_memory_protection_keys: 16,
         }
     }
 }
diff --git a/crates/runtime/src/instance/allocator/pooling/memory_pool.rs b/crates/runtime/src/instance/allocator/pooling/memory_pool.rs
index 47455a0e3..2b25a6d07 100644
--- a/crates/runtime/src/instance/allocator/pooling/memory_pool.rs
+++ b/crates/runtime/src/instance/allocator/pooling/memory_pool.rs
@@ -156,14 +156,14 @@ impl MemoryPool {
         let pkeys = match config.memory_protection_keys {
             MpkEnabled::Auto => {
                 if mpk::is_supported() {
-                    mpk::keys()
+                    mpk::keys(config.max_memory_protection_keys)
                 } else {
                     &[]
                 }
             }
             MpkEnabled::Enable => {
                 if mpk::is_supported() {
-                    mpk::keys()
+                    mpk::keys(config.max_memory_protection_keys)
                 } else {
                     bail!("mpk is disabled on this system")
                 }
@@ -341,8 +341,9 @@ impl MemoryPool {
             // but double-check here to be sure.
             match memory_plan.style {
                 MemoryStyle::Static { bound } => {
-                    let bound = bound * u64::from(WASM_PAGE_SIZE);
-                    assert!(bound <= u64::try_from(self.layout.slot_bytes).unwrap());
+                    let pages_to_next_stripe_slot =
+                        u64::try_from(self.layout.pages_to_next_stripe_slot()).unwrap();
+                    assert!(bound <= pages_to_next_stripe_slot);
                 }
                 MemoryStyle::Dynamic { .. } => {}
             }
diff --git a/crates/runtime/src/mpk/disabled.rs b/crates/runtime/src/mpk/disabled.rs
index bbeccc80e..7f6de55bc 100644
--- a/crates/runtime/src/mpk/disabled.rs
+++ b/crates/runtime/src/mpk/disabled.rs
@@ -8,7 +8,7 @@ use anyhow::Result;
 pub fn is_supported() -> bool {
     false
 }
-pub fn keys() -> &'static [ProtectionKey] {
+pub fn keys(_: usize) -> &'static [ProtectionKey] {
     &[]
 }
 pub fn allow(_: ProtectionMask) {}
diff --git a/crates/runtime/src/mpk/enabled.rs b/crates/runtime/src/mpk/enabled.rs
index 37456ef13..f8a045d3a 100644
--- a/crates/runtime/src/mpk/enabled.rs
+++ b/crates/runtime/src/mpk/enabled.rs
@@ -9,33 +9,39 @@ pub fn is_supported() -> bool {
     cfg!(target_os = "linux") && cfg!(target_arch = "x86_64") && pkru::has_cpuid_bit_set()
 }
 
-/// Allocate all protection keys available to this process.
+/// Allocate up to `max` protection keys.
 ///
-/// This asks the kernel for all available keys (we expect 1-15; 0 is
-/// kernel-reserved) in a thread-safe way. This avoids interference when
+/// This asks the kernel for all available keys up to `max` in a thread-safe way
+/// (we can expect 1-15; 0 is kernel-reserved). This avoids interference when
 /// multiple threads try to allocate keys at the same time (e.g., during
-/// testing). It also ensures that a single copy of the keys are reserved for
-/// the lifetime of the process.
+/// testing). It also ensures that a single copy of the keys is reserved for the
+/// lifetime of the process. Because of this, `max` is only a hint to
+/// allocation: it only is effective on the first invocation of this function.
 ///
 /// TODO: this is not the best-possible design. This creates global state that
 /// would prevent any other code in the process from using protection keys; the
 /// `KEYS` are never deallocated from the system with `pkey_dealloc`.
-pub fn keys() -> &'static [ProtectionKey] {
+pub fn keys(max: usize) -> &'static [ProtectionKey] {
     let keys = KEYS.get_or_init(|| {
         let mut allocated = vec![];
         if is_supported() {
-            while let Ok(key_id) = sys::pkey_alloc(0, 0) {
-                debug_assert!(key_id < 16);
-                // UNSAFETY: here we unsafely assume that the system-allocated pkey
-                // will exist forever.
-                let pkey = ProtectionKey(key_id);
-                debug_assert_eq!(pkey.as_stripe(), allocated.len());
-                allocated.push(pkey);
+            while allocated.len() < max {
+                if let Ok(key_id) = sys::pkey_alloc(0, 0) {
+                    debug_assert!(key_id < 16);
+                    // UNSAFETY: here we unsafely assume that the
+                    // system-allocated pkey will exist forever.
+                    allocated.push(ProtectionKey {
+                        id: key_id,
+                        stripe: allocated.len().try_into().unwrap(),
+                    });
+                } else {
+                    break;
+                }
             }
         }
         allocated
     });
-    &keys
+    &keys[..keys.len().min(max)]
 }
 static KEYS: OnceLock<Vec<ProtectionKey>> = OnceLock::new();
 
@@ -58,7 +64,10 @@ pub fn allow(mask: ProtectionMask) {
 ///   [`ProtectionMask`]; any accesses to unmarked pages result in a fault
 /// - drop the key
 #[derive(Clone, Copy, Debug)]
-pub struct ProtectionKey(u32);
+pub struct ProtectionKey {
+    id: u32,
+    stripe: u32,
+}
 
 impl ProtectionKey {
     /// Mark a page as protected by this [`ProtectionKey`].
@@ -74,8 +83,8 @@ impl ProtectionKey {
     pub fn protect(&self, region: &mut [u8]) -> Result<()> {
         let addr = region.as_mut_ptr() as usize;
         let len = region.len();
-        let prot = sys::PROT_READ | sys::PROT_WRITE;
-        sys::pkey_mprotect(addr, len, prot, self.0).with_context(|| {
+        let prot = sys::PROT_NONE;
+        sys::pkey_mprotect(addr, len, prot, self.id).with_context(|| {
             format!(
                 "failed to mark region with pkey (addr = {addr:#x}, len = {len}, prot = {prot:#b})"
             )
@@ -87,8 +96,7 @@ impl ProtectionKey {
     ///
     /// This function assumes that the kernel has allocated key 0 for itself.
     pub fn as_stripe(&self) -> usize {
-        debug_assert!(self.0 != 0);
-        self.0 as usize - 1
+        self.stripe as usize
     }
 }
 
@@ -117,7 +125,7 @@ impl ProtectionMask {
     /// Include `pkey` as another allowed protection key in the mask.
     #[inline]
     pub fn or(self, pkey: ProtectionKey) -> Self {
-        let mask = pkru::DISABLE_ACCESS ^ 0b11 << (pkey.0 * 2);
+        let mask = pkru::DISABLE_ACCESS ^ 0b11 << (pkey.id * 2);
         Self(self.0 & mask)
     }
 }
@@ -149,14 +157,14 @@ mod tests {
     #[test]
     fn check_initialized_keys() {
         if is_supported() {
-            assert!(!keys().is_empty())
+            assert!(!keys(15).is_empty())
         }
     }
 
     #[test]
     fn check_invalid_mark() {
         skip_if_mpk_unavailable!();
-        let pkey = keys()[0];
+        let pkey = keys(15)[0];
         let unaligned_region = unsafe {
             let addr = 1 as *mut u8; // this is not page-aligned!
             let len = 1;
@@ -166,7 +174,7 @@ mod tests {
         assert!(result.is_err());
         assert_eq!(
             result.unwrap_err().to_string(),
-            "failed to mark region with pkey (addr = 0x1, len = 1, prot = 0b11)"
+            "failed to mark region with pkey (addr = 0x1, len = 1, prot = 0b0)"
         );
     }
 
@@ -178,13 +186,13 @@ mod tests {
         allow(ProtectionMask::all());
         assert_eq!(0, pkru::read());
 
-        allow(ProtectionMask::all().or(ProtectionKey(5)));
+        allow(ProtectionMask::all().or(ProtectionKey { id: 5, stripe: 0 }));
         assert_eq!(0, pkru::read());
 
         allow(ProtectionMask::zero());
         assert_eq!(0b11111111_11111111_11111111_11111100, pkru::read());
 
-        allow(ProtectionMask::zero().or(ProtectionKey(5)));
+        allow(ProtectionMask::zero().or(ProtectionKey { id: 5, stripe: 0 }));
         assert_eq!(0b11111111_11111111_11110011_11111100, pkru::read());
 
         // Reset the PKRU state to what we originally observed.
diff --git a/crates/runtime/src/mpk/sys.rs b/crates/runtime/src/mpk/sys.rs
index fe68decce..671ea4eb9 100644
--- a/crates/runtime/src/mpk/sys.rs
+++ b/crates/runtime/src/mpk/sys.rs
@@ -13,13 +13,10 @@ use crate::page_size;
 use anyhow::Result;
 use std::io::Error;
 
-/// Protection mask allowing reads of pkey-protected memory (see `prot` in
-/// [`pkey_mprotect`]).
-pub const PROT_READ: u32 = libc::PROT_READ as u32; // == 0b0001.
-
-/// Protection mask allowing writes of pkey-protected memory (see `prot` in
-/// [`pkey_mprotect`]).
-pub const PROT_WRITE: u32 = libc::PROT_WRITE as u32; // == 0b0010;
+/// Protection mask disallowing reads and writes of pkey-protected memory (see
+/// `prot` in [`pkey_mprotect`]); in Wasmtime we expect all MPK-protected memory
+/// to start as `PROT_NONE`.
+pub const PROT_NONE: u32 = libc::PROT_NONE as u32; // == 0b0000;
 
 /// Allocate a new protection key in the Linux kernel ([docs]); returns the
 /// key ID.
diff --git a/crates/wasi-http/wit/deps/sockets/udp-create-socket.wit b/crates/wasi-http/wit/deps/sockets/udp-create-socket.wit
index 4e61d30fa..cc58234d8 100644
--- a/crates/wasi-http/wit/deps/sockets/udp-create-socket.wit
+++ b/crates/wasi-http/wit/deps/sockets/udp-create-socket.wit
@@ -8,7 +8,7 @@ interface udp-create-socket {
     /// Similar to `socket(AF_INET or AF_INET6, SOCK_DGRAM, IPPROTO_UDP)` in POSIX.
     ///
     /// This function does not require a network capability handle. This is considered to be safe because
-    /// at time of creation, the socket is not bound to any `network` yet. Up to the moment `bind`/`connect` is called,
+    /// at time of creation, the socket is not bound to any `network` yet. Up to the moment `bind` is called,
     /// the socket is effectively an in-memory configuration object, unable to communicate with the outside world.
     ///
     /// All sockets are non-blocking. Use the wasi-poll interface to block on asynchronous operations.
diff --git a/crates/wasi-http/wit/deps/sockets/udp.wit b/crates/wasi-http/wit/deps/sockets/udp.wit
index 8641cc2c5..232c2b41c 100644
--- a/crates/wasi-http/wit/deps/sockets/udp.wit
+++ b/crates/wasi-http/wit/deps/sockets/udp.wit
@@ -3,17 +3,34 @@ interface udp {
     use wasi:io/poll@0.2.0-rc-2023-11-05.{pollable};
     use network.{network, error-code, ip-socket-address, ip-address-family};
 
+    /// A received datagram.
+    record incoming-datagram {
+        /// The payload.
+        /// 
+        /// Theoretical max size: ~64 KiB. In practice, typically less than 1500 bytes.
+        data: list<u8>,
 
-    record datagram {
-        data: list<u8>, // Theoretical max size: ~64 KiB. In practice, typically less than 1500 bytes.
+        /// The source address.
+        ///
+        /// This field is guaranteed to match the remote address the stream was initialized with, if any.
+        ///
+        /// Equivalent to the `src_addr` out parameter of `recvfrom`.
         remote-address: ip-socket-address,
+    }
+
+    /// A datagram to be sent out.
+    record outgoing-datagram {
+        /// The payload.
+        data: list<u8>,
 
-        /// Possible future additions:
-        /// local-address: ip-socket-address, // IP_PKTINFO / IP_RECVDSTADDR / IPV6_PKTINFO
-        /// local-interface: u32, // IP_PKTINFO / IP_RECVIF
-        /// ttl: u8, // IP_RECVTTL
-        /// dscp: u6, // IP_RECVTOS
-        /// ecn: u2, // IP_RECVTOS
+        /// The destination address.
+        ///
+        /// The requirements on this field depend on how the stream was initialized:
+        /// - with a remote address: this field must be None or match the stream's remote address exactly.
+        /// - without a remote address: this field is required.
+        ///
+        /// If this value is None, the send operation is equivalent to `send` in POSIX. Otherwise it is equivalent to `sendto`.
+        remote-address: option<ip-socket-address>,
     }
 
 
@@ -24,9 +41,7 @@ interface udp {
         ///
         /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
         /// network interface(s) to bind to.
-        /// If the TCP/UDP port is zero, the socket will be bound to a random free port.
-        ///
-        /// When a socket is not explicitly bound, the first invocation to connect will implicitly bind the socket.
+        /// If the port is zero, the socket will be bound to a random free port.
         ///
         /// Unlike in POSIX, this function is async. This enables interactive WASI hosts to inject permission prompts.
         ///
@@ -49,95 +64,47 @@ interface udp {
         start-bind: func(network: borrow<network>, local-address: ip-socket-address) -> result<_, error-code>;
         finish-bind: func() -> result<_, error-code>;
 
-        /// Set the destination address.
-        ///
-        /// The local-address is updated based on the best network path to `remote-address`.
-        ///
-        /// When a destination address is set:
-        /// - all receive operations will only return datagrams sent from the provided `remote-address`.
-        /// - the `send` function can only be used to send to this destination.
-        ///
-        /// Note that this function does not generate any network traffic and the peer is not aware of this "connection".
-        ///
-        /// Unlike in POSIX, this function is async. This enables interactive WASI hosts to inject permission prompts.
-        ///
-        /// # Typical `start` errors
+        /// Set up inbound & outbound communication channels, optionally to a specific peer.
+        ///
+        /// This function only changes the local socket configuration and does not generate any network traffic.
+        /// On success, the `remote-address` of the socket is updated. The `local-address` may be updated as well,
+        /// based on the best network path to `remote-address`.
+        ///
+        /// When a `remote-address` is provided, the returned streams are limited to communicating with that specific peer:
+        /// - `send` can only be used to send to this destination.
+        /// - `receive` will only return datagrams sent from the provided `remote-address`.
+        ///
+        /// This method may be called multiple times on the same socket to change its association, but
+        /// only the most recently returned pair of streams will be operational. Implementations may trap if
+        /// the streams returned by a previous invocation haven't been dropped yet before calling `stream` again.
+        /// 
+        /// The POSIX equivalent in pseudo-code is:
+        /// ```text
+        /// if (was previously connected) {
+        /// 	connect(s, AF_UNSPEC)
+        /// }
+        /// if (remote_address is Some) {
+        /// 	connect(s, remote_address)
+        /// }
+        /// ```
+        ///
+        /// Unlike in POSIX, the socket must already be explicitly bound.
+        /// 
+        /// # Typical errors
         /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
         /// - `invalid-argument`:          `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
         /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
         /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:          The socket is already bound to a different network. The `network` passed to `connect` must be identical to the one passed to `bind`.
-        ///
-        /// # Typical `finish` errors
+        /// - `invalid-state`:             The socket is not bound.
         /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
-        /// - `not-in-progress`:           A `connect` operation is not in progress.
-        /// - `would-block`:               Can't finish the operation, it is still in progress. (EWOULDBLOCK, EAGAIN)
+        /// - `remote-unreachable`:        The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
         ///
         /// # References
         /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
         /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
         /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
         /// - <https://man.freebsd.org/cgi/man.cgi?connect>
-        start-connect: func(network: borrow<network>, remote-address: ip-socket-address) -> result<_, error-code>;
-        finish-connect: func() -> result<_, error-code>;
-
-        /// Receive messages on the socket.
-        ///
-        /// This function attempts to receive up to `max-results` datagrams on the socket without blocking.
-        /// The returned list may contain fewer elements than requested, but never more.
-        /// If `max-results` is 0, this function returns successfully with an empty list.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:      The socket is not bound to any local address. (EINVAL)
-        /// - `remote-unreachable`: The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
-        /// - `would-block`:        There is no pending data available to be read at the moment. (EWOULDBLOCK, EAGAIN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
-        /// - <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms741687(v=vs.85)>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
-        receive: func(max-results: u64) -> result<list<datagram>, error-code>;
-
-        /// Send messages on the socket.
-        ///
-        /// This function attempts to send all provided `datagrams` on the socket without blocking and
-        /// returns how many messages were actually sent (or queued for sending).
-        ///
-        /// This function semantically behaves the same as iterating the `datagrams` list and sequentially
-        /// sending each individual datagram until either the end of the list has been reached or the first error occurred.
-        /// If at least one datagram has been sent successfully, this function never returns an error.
-        ///
-        /// If the input list is empty, the function returns `ok(0)`.
-        ///
-        /// The remote address option is required. To send a message to the "connected" peer,
-        /// call `remote-address` to get their address.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
-        /// - `invalid-argument`:        `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
-        /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The socket is in "connected" mode and the `datagram.remote-address` does not match the address passed to `connect`. (EISCONN)
-        /// - `invalid-state`:           The socket is not bound to any local address. Unlike POSIX, this function does not perform an implicit bind.
-        /// - `remote-unreachable`:      The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
-        /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
-        /// - `would-block`:             The send buffer is currently full. (EWOULDBLOCK, EAGAIN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
-        send: func(datagrams: list<datagram>) -> result<u64, error-code>;
+        %stream: func(remote-address: option<ip-socket-address>) -> result<tuple<incoming-datagram-stream, outgoing-datagram-stream>, error-code>;
 
         /// Get the current bound address.
         ///
@@ -146,7 +113,7 @@ interface udp {
         /// > stored in the object pointed to by `address` is unspecified.
         ///
         /// WASI is stricter and requires `local-address` to return `invalid-state` when the socket hasn't been bound yet.
-        ///
+        /// 
         /// # Typical errors
         /// - `invalid-state`: The socket is not bound to any local address.
         ///
@@ -157,10 +124,10 @@ interface udp {
         /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
         local-address: func() -> result<ip-socket-address, error-code>;
 
-        /// Get the address set with `connect`.
+        /// Get the address the socket is currently streaming to.
         ///
         /// # Typical errors
-        /// - `invalid-state`: The socket is not connected to a remote address. (ENOTCONN)
+        /// - `invalid-state`: The socket is not streaming to a specific remote address. (ENOTCONN)
         ///
         /// # References
         /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
@@ -192,11 +159,11 @@ interface udp {
         /// The kernel buffer space reserved for sends/receives on this socket.
         ///
         /// Note #1: an implementation may choose to cap or round the buffer size when setting the value.
-        ///     In other words, after setting a value, reading the same setting back may return a different value.
+        /// 	In other words, after setting a value, reading the same setting back may return a different value.
         ///
         /// Note #2: there is not necessarily a direct relationship between the kernel buffer size and the bytes of
-        ///     actual data to be sent/received by the application, because the kernel might also use the buffer space
-        ///     for internal metadata structures.
+        /// 	actual data to be sent/received by the application, because the kernel might also use the buffer space
+        /// 	for internal metadata structures.
         ///
         /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
         receive-buffer-size: func() -> result<u64, error-code>;
@@ -210,4 +177,93 @@ interface udp {
         /// It's planned to be removed when `future` is natively supported in Preview3.
         subscribe: func() -> pollable;
     }
+
+    resource incoming-datagram-stream {
+        /// Receive messages on the socket.
+        ///
+        /// This function attempts to receive up to `max-results` datagrams on the socket without blocking.
+        /// The returned list may contain fewer elements than requested, but never more.
+        ///
+        /// This function returns successfully with an empty list when either:
+        /// - `max-results` is 0, or:
+        /// - `max-results` is greater than 0, but no results are immediately available.
+        /// This function never returns `error(would-block)`.
+        ///
+        /// # Typical errors
+        /// - `remote-unreachable`: The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
+        ///
+        /// # References
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
+        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
+        /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
+        /// - <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms741687(v=vs.85)>
+        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
+        receive: func(max-results: u64) -> result<list<incoming-datagram>, error-code>;
+
+        /// Create a `pollable` which will resolve once the stream is ready to receive again.
+        ///
+        /// Note: this function is here for WASI Preview2 only.
+        /// It's planned to be removed when `future` is natively supported in Preview3.
+        subscribe: func() -> pollable;
+    }
+
+    resource outgoing-datagram-stream {
+        /// Check readiness for sending. This function never blocks.
+        ///
+        /// Returns the number of datagrams permitted for the next call to `send`,
+        /// or an error. Calling `send` with more datagrams than this function has
+        /// permitted will trap.
+        ///
+        /// When this function returns ok(0), the `subscribe` pollable will
+        /// become ready when this function will report at least ok(1), or an
+        /// error.
+        /// 
+        /// Never returns `would-block`.
+        check-send: func() -> result<u64, error-code>;
+
+        /// Send messages on the socket.
+        ///
+        /// This function attempts to send all provided `datagrams` on the socket without blocking and
+        /// returns how many messages were actually sent (or queued for sending). This function never
+        /// returns `error(would-block)`. If none of the datagrams were able to be sent, `ok(0)` is returned.
+        ///
+        /// This function semantically behaves the same as iterating the `datagrams` list and sequentially
+        /// sending each individual datagram until either the end of the list has been reached or the first error occurred.
+        /// If at least one datagram has been sent successfully, this function never returns an error.
+        ///
+        /// If the input list is empty, the function returns `ok(0)`.
+        ///
+        /// Each call to `send` must be permitted by a preceding `check-send`. Implementations must trap if
+        /// either `check-send` was not called or `datagrams` contains more items than `check-send` permitted.
+        ///
+        /// # Typical errors
+        /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
+        /// - `invalid-argument`:        `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
+        /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
+        /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
+        /// - `invalid-argument`:        The socket is in "connected" mode and `remote-address` is `some` value that does not match the address passed to `stream`. (EISCONN)
+        /// - `invalid-argument`:        The socket is not "connected" and no value for `remote-address` was provided. (EDESTADDRREQ)
+        /// - `remote-unreachable`:      The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
+        /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
+        ///
+        /// # References
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
+        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
+        /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
+        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
+        send: func(datagrams: list<outgoing-datagram>) -> result<u64, error-code>;
+        
+        /// Create a `pollable` which will resolve once the stream is ready to send again.
+        ///
+        /// Note: this function is here for WASI Preview2 only.
+        /// It's planned to be removed when `future` is natively supported in Preview3.
+        subscribe: func() -> pollable;
+    }
 }
diff --git a/crates/wasi/src/preview2/error.rs b/crates/wasi/src/preview2/error.rs
index ccae912d4..f92317c1f 100644
--- a/crates/wasi/src/preview2/error.rs
+++ b/crates/wasi/src/preview2/error.rs
@@ -61,6 +61,13 @@ impl<T> TrappableError<T> {
     {
         self.err.downcast()
     }
+
+    pub fn downcast_ref(&self) -> Option<&T>
+    where
+        T: Error + Send + Sync + 'static,
+    {
+        self.err.downcast_ref()
+    }
 }
 
 impl<T> From<T> for TrappableError<T>
diff --git a/crates/wasi/src/preview2/host/udp.rs b/crates/wasi/src/preview2/host/udp.rs
index 857925eb6..a97bd1bcd 100644
--- a/crates/wasi/src/preview2/host/udp.rs
+++ b/crates/wasi/src/preview2/host/udp.rs
@@ -5,23 +5,27 @@ use crate::preview2::{
         sockets::network::{ErrorCode, IpAddressFamily, IpSocketAddress, Network},
         sockets::udp,
     },
-    udp::UdpState,
+    udp::{IncomingDatagramStream, OutgoingDatagramStream, SendState, UdpState},
+    Subscribe,
 };
-use crate::preview2::{Pollable, SocketResult, WasiView};
+use crate::preview2::{Pollable, SocketError, SocketResult, WasiView};
+use anyhow::anyhow;
+use async_trait::async_trait;
 use cap_net_ext::{AddressFamily, PoolExt};
 use io_lifetimes::AsSocketlike;
 use rustix::io::Errno;
 use rustix::net::sockopt;
+use tokio::io::Interest;
 use wasmtime::component::Resource;
 
 /// Theoretical maximum byte size of a UDP datagram, the real limit is lower,
 /// but we do not account for e.g. the transport layer here for simplicity.
 /// In practice, datagrams are typically less than 1500 bytes.
-const MAX_UDP_DATAGRAM_SIZE: usize = 65535;
+const MAX_UDP_DATAGRAM_SIZE: usize = u16::MAX as usize;
 
 impl<T: WasiView> udp::Host for T {}
 
-impl<T: WasiView> crate::preview2::host::udp::udp::HostUdpSocket for T {
+impl<T: WasiView> udp::HostUdpSocket for T {
     fn start_bind(
         &mut self,
         this: Resource<udp::UdpSocket>,
@@ -30,16 +34,15 @@ impl<T: WasiView> crate::preview2::host::udp::udp::HostUdpSocket for T {
     ) -> SocketResult<()> {
         let table = self.table_mut();
         let socket = table.get(&this)?;
+        let network = table.get(&network)?;
+        let local_address: SocketAddr = local_address.into();
 
         match socket.udp_state {
             UdpState::Default => {}
-            UdpState::BindStarted | UdpState::Connecting(..) => {
-                return Err(ErrorCode::ConcurrencyConflict.into())
-            }
-            UdpState::Bound | UdpState::Connected(..) => return Err(ErrorCode::InvalidState.into()),
+            UdpState::BindStarted => return Err(ErrorCode::ConcurrencyConflict.into()),
+            UdpState::Bound | UdpState::Connected => return Err(ErrorCode::InvalidState.into()),
         }
 
-        let network = table.get(&network)?;
         let binder = network.pool.udp_binder(local_address)?;
 
         // Perform the OS bind call.
@@ -68,157 +71,58 @@ impl<T: WasiView> crate::preview2::host::udp::udp::HostUdpSocket for T {
         }
     }
 
-    fn start_connect(
+    fn stream(
         &mut self,
         this: Resource<udp::UdpSocket>,
-        network: Resource<Network>,
-        remote_address: IpSocketAddress,
-    ) -> SocketResult<()> {
+        remote_address: Option<IpSocketAddress>,
+    ) -> SocketResult<(
+        Resource<udp::IncomingDatagramStream>,
+        Resource<udp::OutgoingDatagramStream>,
+    )> {
         let table = self.table_mut();
-        let socket = table.get(&this)?;
-        let network = table.get(&network)?;
-
-        match socket.udp_state {
-            UdpState::Default | UdpState::Bound => {}
-            UdpState::BindStarted | UdpState::Connecting(..) => {
-                return Err(ErrorCode::ConcurrencyConflict.into())
-            }
-            UdpState::Connected(..) => return Err(ErrorCode::InvalidState.into()),
-        }
 
-        let connecter = network.pool.udp_connecter(remote_address)?;
+        let has_active_streams = table
+            .iter_children(&this)?
+            .any(|c| c.is::<IncomingDatagramStream>() || c.is::<OutgoingDatagramStream>());
 
-        // Do an OS `connect`.
-        connecter.connect_existing_udp_socket(
-            &*socket
-                .udp_socket()
-                .as_socketlike_view::<cap_std::net::UdpSocket>(),
-        )?;
-
-        let socket = table.get_mut(&this)?;
-        socket.udp_state = UdpState::Connecting(remote_address);
-        Ok(())
-    }
+        if has_active_streams {
+            return Err(SocketError::trap(anyhow!("UDP streams not dropped yet")));
+        }
 
-    fn finish_connect(&mut self, this: Resource<udp::UdpSocket>) -> SocketResult<()> {
-        let table = self.table_mut();
         let socket = table.get_mut(&this)?;
+        let remote_address = remote_address.map(SocketAddr::from);
 
         match socket.udp_state {
-            UdpState::Connecting(addr) => {
-                socket.udp_state = UdpState::Connected(addr);
-                Ok(())
-            }
-            _ => Err(ErrorCode::NotInProgress.into()),
+            UdpState::Bound | UdpState::Connected => {}
+            _ => return Err(ErrorCode::InvalidState.into()),
         }
-    }
 
-    fn receive(
-        &mut self,
-        this: Resource<udp::UdpSocket>,
-        max_results: u64,
-    ) -> SocketResult<Vec<udp::Datagram>> {
-        if max_results == 0 {
-            return Ok(vec![]);
+        if let UdpState::Connected = socket.udp_state {
+            // FIXME: Allow multiple (dis)connects. This needs to be supported by rustix first.
+            // rustix::net::disconnect(socket.udp_socket())?;
+            // socket.udp_state = UdpState::Bound;
+            return Err(ErrorCode::NotSupported.into());
         }
 
-        let table = self.table();
-        let socket = table.get(&this)?;
-
-        let udp_socket = socket.udp_socket();
-        let mut datagrams = vec![];
-        let mut buf = [0; MAX_UDP_DATAGRAM_SIZE];
-        match socket.udp_state {
-            UdpState::Default | UdpState::BindStarted => return Err(ErrorCode::InvalidState.into()),
-            UdpState::Bound | UdpState::Connecting(..) => {
-                for i in 0..max_results {
-                    match udp_socket.try_recv_from(&mut buf) {
-                        Ok((size, remote_address)) => datagrams.push(udp::Datagram {
-                            data: buf[..size].into(),
-                            remote_address: remote_address.into(),
-                        }),
-                        Err(_e) if i > 0 => {
-                            return Ok(datagrams);
-                        }
-                        Err(e) => return Err(e.into()),
-                    }
-                }
-            }
-            UdpState::Connected(remote_address) => {
-                for i in 0..max_results {
-                    match udp_socket.try_recv(&mut buf) {
-                        Ok(size) => datagrams.push(udp::Datagram {
-                            data: buf[..size].into(),
-                            remote_address,
-                        }),
-                        Err(_e) if i > 0 => {
-                            return Ok(datagrams);
-                        }
-                        Err(e) => return Err(e.into()),
-                    }
-                }
-            }
+        if let Some(connect_addr) = remote_address {
+            rustix::net::connect(socket.udp_socket(), &connect_addr)?;
+            socket.udp_state = UdpState::Connected;
         }
-        Ok(datagrams)
-    }
 
-    fn send(
-        &mut self,
-        this: Resource<udp::UdpSocket>,
-        datagrams: Vec<udp::Datagram>,
-    ) -> SocketResult<u64> {
-        if datagrams.is_empty() {
-            return Ok(0);
+        let incoming_stream = IncomingDatagramStream {
+            inner: socket.inner.clone(),
+            remote_address,
+        };
+        let outgoing_stream = OutgoingDatagramStream {
+            inner: socket.inner.clone(),
+            remote_address,
+            send_state: SendState::Idle,
         };
-        let table = self.table();
-        let socket = table.get(&this)?;
 
-        let udp_socket = socket.udp_socket();
-        let mut count = 0;
-        match socket.udp_state {
-            UdpState::Default | UdpState::BindStarted => return Err(ErrorCode::InvalidState.into()),
-            UdpState::Bound | UdpState::Connecting(..) => {
-                for udp::Datagram {
-                    data,
-                    remote_address,
-                } in datagrams
-                {
-                    match udp_socket.try_send_to(&data, remote_address.into()) {
-                        Ok(_size) => count += 1,
-                        Err(_e) if count > 0 => {
-                            return Ok(count);
-                        }
-                        Err(e) => return Err(e.into()),
-                    }
-                }
-            }
-            UdpState::Connected(addr) => {
-                let addr = SocketAddr::from(addr);
-                for udp::Datagram {
-                    data,
-                    remote_address,
-                } in datagrams
-                {
-                    if SocketAddr::from(remote_address) != addr {
-                        // From WIT documentation:
-                        // If at least one datagram has been sent successfully, this function never returns an error.
-                        if count == 0 {
-                            return Err(ErrorCode::InvalidArgument.into());
-                        } else {
-                            return Ok(count);
-                        }
-                    }
-                    match udp_socket.try_send(&data) {
-                        Ok(_size) => count += 1,
-                        Err(_e) if count > 0 => {
-                            return Ok(count);
-                        }
-                        Err(e) => return Err(e.into()),
-                    }
-                }
-            }
-        }
-        Ok(count)
+        Ok((
+            self.table_mut().push_child(incoming_stream, &this)?,
+            self.table_mut().push_child(outgoing_stream, &this)?,
+        ))
     }
 
     fn local_address(&mut self, this: Resource<udp::UdpSocket>) -> SocketResult<IpSocketAddress> {
@@ -354,3 +258,226 @@ impl<T: WasiView> crate::preview2::host::udp::udp::HostUdpSocket for T {
         Ok(())
     }
 }
+
+impl<T: WasiView> udp::HostIncomingDatagramStream for T {
+    fn receive(
+        &mut self,
+        this: Resource<udp::IncomingDatagramStream>,
+        max_results: u64,
+    ) -> SocketResult<Vec<udp::IncomingDatagram>> {
+        // Returns Ok(None) when the message was dropped.
+        fn recv_one(
+            stream: &IncomingDatagramStream,
+        ) -> SocketResult<Option<udp::IncomingDatagram>> {
+            let mut buf = [0; MAX_UDP_DATAGRAM_SIZE];
+            let (size, received_addr) = stream.inner.try_recv_from(&mut buf)?;
+
+            match stream.remote_address {
+                Some(connected_addr) if connected_addr != received_addr => {
+                    // Normally, this should have already been checked for us by the OS.
+                    return Ok(None);
+                }
+                _ => {}
+            }
+
+            // FIXME: check permission to receive from `received_addr`.
+            Ok(Some(udp::IncomingDatagram {
+                data: buf[..size].into(),
+                remote_address: received_addr.into(),
+            }))
+        }
+
+        let table = self.table();
+        let stream = table.get(&this)?;
+        let max_results: usize = max_results.try_into().unwrap_or(usize::MAX);
+
+        if max_results == 0 {
+            return Ok(vec![]);
+        }
+
+        let mut datagrams = vec![];
+
+        while datagrams.len() < max_results {
+            match recv_one(stream) {
+                Ok(Some(datagram)) => {
+                    datagrams.push(datagram);
+                }
+                Ok(None) => {
+                    // Message was dropped
+                }
+                Err(_) if datagrams.len() > 0 => {
+                    return Ok(datagrams);
+                }
+                Err(e) if matches!(e.downcast_ref(), Some(ErrorCode::WouldBlock)) => {
+                    return Ok(datagrams);
+                }
+                Err(e) => {
+                    return Err(e);
+                }
+            }
+        }
+
+        Ok(datagrams)
+    }
+
+    fn subscribe(
+        &mut self,
+        this: Resource<udp::IncomingDatagramStream>,
+    ) -> anyhow::Result<Resource<Pollable>> {
+        crate::preview2::poll::subscribe(self.table_mut(), this)
+    }
+
+    fn drop(&mut self, this: Resource<udp::IncomingDatagramStream>) -> Result<(), anyhow::Error> {
+        let table = self.table_mut();
+
+        // As in the filesystem implementation, we assume closing a socket
+        // doesn't block.
+        let dropped = table.delete(this)?;
+        drop(dropped);
+
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl Subscribe for IncomingDatagramStream {
+    async fn ready(&mut self) {
+        // FIXME: Add `Interest::ERROR` when we update to tokio 1.32.
+        self.inner
+            .ready(Interest::READABLE)
+            .await
+            .expect("failed to await UDP socket readiness");
+    }
+}
+
+impl<T: WasiView> udp::HostOutgoingDatagramStream for T {
+    fn check_send(&mut self, this: Resource<udp::OutgoingDatagramStream>) -> SocketResult<u64> {
+        let table = self.table_mut();
+        let stream = table.get_mut(&this)?;
+
+        let permit = match stream.send_state {
+            SendState::Idle => {
+                const PERMIT: usize = 16;
+                stream.send_state = SendState::Permitted(PERMIT);
+                PERMIT
+            }
+            SendState::Permitted(n) => n,
+            SendState::Waiting => 0,
+        };
+
+        Ok(permit.try_into().unwrap())
+    }
+
+    fn send(
+        &mut self,
+        this: Resource<udp::OutgoingDatagramStream>,
+        datagrams: Vec<udp::OutgoingDatagram>,
+    ) -> SocketResult<u64> {
+        fn send_one(
+            stream: &OutgoingDatagramStream,
+            datagram: &udp::OutgoingDatagram,
+        ) -> SocketResult<()> {
+            if datagram.data.len() > MAX_UDP_DATAGRAM_SIZE {
+                return Err(ErrorCode::DatagramTooLarge.into());
+            }
+
+            let provided_addr = datagram.remote_address.map(SocketAddr::from);
+            let addr = match (stream.remote_address, provided_addr) {
+                (None, Some(addr)) => addr,
+                (Some(addr), None) => addr,
+                (Some(connected_addr), Some(provided_addr)) if connected_addr == provided_addr => {
+                    connected_addr
+                }
+                _ => return Err(ErrorCode::InvalidArgument.into()),
+            };
+
+            // FIXME: check permission to send to `addr`.
+            if stream.remote_address == Some(addr) {
+                stream.inner.try_send(&datagram.data)?;
+            } else {
+                stream.inner.try_send_to(&datagram.data, addr)?;
+            }
+
+            Ok(())
+        }
+
+        let table = self.table_mut();
+        let stream = table.get_mut(&this)?;
+
+        match stream.send_state {
+            SendState::Permitted(n) if n >= datagrams.len() => {
+                stream.send_state = SendState::Idle;
+            }
+            SendState::Permitted(_) => {
+                return Err(SocketError::trap(anyhow::anyhow!(
+                    "unpermitted: argument exceeds permitted size"
+                )))
+            }
+            SendState::Idle | SendState::Waiting => {
+                return Err(SocketError::trap(anyhow::anyhow!(
+                    "unpermitted: must call check-send first"
+                )))
+            }
+        }
+
+        if datagrams.is_empty() {
+            return Ok(0);
+        }
+
+        let mut count = 0;
+
+        for datagram in datagrams {
+            match send_one(stream, &datagram) {
+                Ok(_) => count += 1,
+                Err(_) if count > 0 => {
+                    // WIT: "If at least one datagram has been sent successfully, this function never returns an error."
+                    return Ok(count);
+                }
+                Err(e) if matches!(e.downcast_ref(), Some(ErrorCode::WouldBlock)) => {
+                    stream.send_state = SendState::Waiting;
+                    return Ok(count);
+                }
+                Err(e) => {
+                    return Err(e);
+                }
+            }
+        }
+
+        Ok(count)
+    }
+
+    fn subscribe(
+        &mut self,
+        this: Resource<udp::OutgoingDatagramStream>,
+    ) -> anyhow::Result<Resource<Pollable>> {
+        crate::preview2::poll::subscribe(self.table_mut(), this)
+    }
+
+    fn drop(&mut self, this: Resource<udp::OutgoingDatagramStream>) -> Result<(), anyhow::Error> {
+        let table = self.table_mut();
+
+        // As in the filesystem implementation, we assume closing a socket
+        // doesn't block.
+        let dropped = table.delete(this)?;
+        drop(dropped);
+
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl Subscribe for OutgoingDatagramStream {
+    async fn ready(&mut self) {
+        match self.send_state {
+            SendState::Idle | SendState::Permitted(_) => {}
+            SendState::Waiting => {
+                // FIXME: Add `Interest::ERROR` when we update to tokio 1.32.
+                self.inner
+                    .ready(Interest::WRITABLE)
+                    .await
+                    .expect("failed to await UDP socket readiness");
+                self.send_state = SendState::Idle;
+            }
+        }
+    }
+}
diff --git a/crates/wasi/src/preview2/mod.rs b/crates/wasi/src/preview2/mod.rs
index abdfe4df5..f9d097745 100644
--- a/crates/wasi/src/preview2/mod.rs
+++ b/crates/wasi/src/preview2/mod.rs
@@ -161,6 +161,8 @@ pub mod bindings {
             "wasi:sockets/network/network": super::network::Network,
             "wasi:sockets/tcp/tcp-socket": super::tcp::TcpSocket,
             "wasi:sockets/udp/udp-socket": super::udp::UdpSocket,
+            "wasi:sockets/udp/incoming-datagram-stream": super::udp::IncomingDatagramStream,
+            "wasi:sockets/udp/outgoing-datagram-stream": super::udp::OutgoingDatagramStream,
             "wasi:sockets/ip-name-lookup/resolve-address-stream": super::ip_name_lookup::ResolveAddressStream,
             "wasi:filesystem/types/directory-entry-stream": super::filesystem::ReaddirIterator,
             "wasi:filesystem/types/descriptor": super::filesystem::Descriptor,
diff --git a/crates/wasi/src/preview2/table.rs b/crates/wasi/src/preview2/table.rs
index 2454fce03..444e7b25f 100644
--- a/crates/wasi/src/preview2/table.rs
+++ b/crates/wasi/src/preview2/table.rs
@@ -234,6 +234,21 @@ impl Table {
             (item, v)
         })
     }
+
+    /// Iterate over all children belonging to the provided parent
+    pub fn iter_children<T>(
+        &self,
+        parent: &Resource<T>,
+    ) -> Result<impl Iterator<Item = &(dyn Any + Send + Sync)>, TableError>
+    where
+        T: 'static,
+    {
+        let parent_entry = self.map.get(&parent.rep()).ok_or(TableError::NotPresent)?;
+        Ok(parent_entry.children.iter().map(|child_index| {
+            let child = self.map.get(child_index).expect("missing child");
+            child.entry.as_ref()
+        }))
+    }
 }
 
 impl Default for Table {
diff --git a/crates/wasi/src/preview2/udp.rs b/crates/wasi/src/preview2/udp.rs
index 2c879f99a..504dba0b1 100644
--- a/crates/wasi/src/preview2/udp.rs
+++ b/crates/wasi/src/preview2/udp.rs
@@ -1,12 +1,11 @@
-use crate::preview2::bindings::sockets::network::IpSocketAddress;
 use crate::preview2::poll::Subscribe;
 use crate::preview2::with_ambient_tokio_runtime;
 use async_trait::async_trait;
 use cap_net_ext::{AddressFamily, Blocking, UdpSocketExt};
 use io_lifetimes::raw::{FromRawSocketlike, IntoRawSocketlike};
 use std::io;
+use std::net::SocketAddr;
 use std::sync::Arc;
-use tokio::io::Interest;
 
 /// The state of a UDP socket.
 ///
@@ -23,11 +22,8 @@ pub(crate) enum UdpState {
     /// is not yet listening for connections.
     Bound,
 
-    /// A connect call is in progress.
-    Connecting(IpSocketAddress),
-
     /// The socket is "connected" to a peer address.
-    Connected(IpSocketAddress),
+    Connected,
 }
 
 /// A host UDP socket, plus associated bookkeeping.
@@ -49,44 +45,60 @@ pub struct UdpSocket {
 #[async_trait]
 impl Subscribe for UdpSocket {
     async fn ready(&mut self) {
-        // Some states are ready immediately.
-        match self.udp_state {
-            UdpState::BindStarted => return,
-            _ => {}
-        }
-
-        // FIXME: Add `Interest::ERROR` when we update to tokio 1.32.
-        self.inner
-            .ready(Interest::READABLE | Interest::WRITABLE)
-            .await
-            .expect("failed to await UDP socket readiness");
+        // None of the socket-level operations block natively
     }
 }
 
 impl UdpSocket {
     /// Create a new socket in the given family.
     pub fn new(family: AddressFamily) -> io::Result<Self> {
-        // Create a new host socket and set it to non-blocking, which is needed
-        // by our async implementation.
-        let udp_socket = cap_std::net::UdpSocket::new(family, Blocking::No)?;
-        Self::from_udp_socket(udp_socket, family)
-    }
-
-    pub fn from_udp_socket(
-        udp_socket: cap_std::net::UdpSocket,
-        family: AddressFamily,
-    ) -> io::Result<Self> {
-        let fd = udp_socket.into_raw_socketlike();
-        let std_socket = unsafe { std::net::UdpSocket::from_raw_socketlike(fd) };
-        let socket = with_ambient_tokio_runtime(|| tokio::net::UdpSocket::try_from(std_socket))?;
-        Ok(Self {
-            inner: Arc::new(socket),
+        Ok(UdpSocket {
+            inner: Arc::new(Self::new_tokio_socket(family)?),
             udp_state: UdpState::Default,
             family,
         })
     }
 
+    fn new_tokio_socket(family: AddressFamily) -> io::Result<tokio::net::UdpSocket> {
+        // Create a new host socket and set it to non-blocking, which is needed
+        // by our async implementation.
+        let cap_std_socket = cap_std::net::UdpSocket::new(family, Blocking::No)?;
+        let fd = cap_std_socket.into_raw_socketlike();
+        let std_socket = unsafe { std::net::UdpSocket::from_raw_socketlike(fd) };
+        let tokio_socket =
+            with_ambient_tokio_runtime(|| tokio::net::UdpSocket::try_from(std_socket))?;
+
+        Ok(tokio_socket)
+    }
+
     pub fn udp_socket(&self) -> &tokio::net::UdpSocket {
         &self.inner
     }
 }
+
+pub struct IncomingDatagramStream {
+    pub(crate) inner: Arc<tokio::net::UdpSocket>,
+
+    /// If this has a value, the stream is "connected".
+    pub(crate) remote_address: Option<SocketAddr>,
+}
+
+pub struct OutgoingDatagramStream {
+    pub(crate) inner: Arc<tokio::net::UdpSocket>,
+
+    /// If this has a value, the stream is "connected".
+    pub(crate) remote_address: Option<SocketAddr>,
+
+    pub(crate) send_state: SendState,
+}
+
+pub(crate) enum SendState {
+    /// Waiting for the API consumer to call `check-send`.
+    Idle,
+
+    /// Ready to send up to x datagrams.
+    Permitted(usize),
+
+    /// Waiting for the OS.
+    Waiting,
+}
diff --git a/crates/wasi/wit/deps/sockets/udp-create-socket.wit b/crates/wasi/wit/deps/sockets/udp-create-socket.wit
index 4e61d30fa..cc58234d8 100644
--- a/crates/wasi/wit/deps/sockets/udp-create-socket.wit
+++ b/crates/wasi/wit/deps/sockets/udp-create-socket.wit
@@ -8,7 +8,7 @@ interface udp-create-socket {
     /// Similar to `socket(AF_INET or AF_INET6, SOCK_DGRAM, IPPROTO_UDP)` in POSIX.
     ///
     /// This function does not require a network capability handle. This is considered to be safe because
-    /// at time of creation, the socket is not bound to any `network` yet. Up to the moment `bind`/`connect` is called,
+    /// at time of creation, the socket is not bound to any `network` yet. Up to the moment `bind` is called,
     /// the socket is effectively an in-memory configuration object, unable to communicate with the outside world.
     ///
     /// All sockets are non-blocking. Use the wasi-poll interface to block on asynchronous operations.
diff --git a/crates/wasi/wit/deps/sockets/udp.wit b/crates/wasi/wit/deps/sockets/udp.wit
index 8641cc2c5..232c2b41c 100644
--- a/crates/wasi/wit/deps/sockets/udp.wit
+++ b/crates/wasi/wit/deps/sockets/udp.wit
@@ -3,17 +3,34 @@ interface udp {
     use wasi:io/poll@0.2.0-rc-2023-11-05.{pollable};
     use network.{network, error-code, ip-socket-address, ip-address-family};
 
+    /// A received datagram.
+    record incoming-datagram {
+        /// The payload.
+        /// 
+        /// Theoretical max size: ~64 KiB. In practice, typically less than 1500 bytes.
+        data: list<u8>,
 
-    record datagram {
-        data: list<u8>, // Theoretical max size: ~64 KiB. In practice, typically less than 1500 bytes.
+        /// The source address.
+        ///
+        /// This field is guaranteed to match the remote address the stream was initialized with, if any.
+        ///
+        /// Equivalent to the `src_addr` out parameter of `recvfrom`.
         remote-address: ip-socket-address,
+    }
+
+    /// A datagram to be sent out.
+    record outgoing-datagram {
+        /// The payload.
+        data: list<u8>,
 
-        /// Possible future additions:
-        /// local-address: ip-socket-address, // IP_PKTINFO / IP_RECVDSTADDR / IPV6_PKTINFO
-        /// local-interface: u32, // IP_PKTINFO / IP_RECVIF
-        /// ttl: u8, // IP_RECVTTL
-        /// dscp: u6, // IP_RECVTOS
-        /// ecn: u2, // IP_RECVTOS
+        /// The destination address.
+        ///
+        /// The requirements on this field depend on how the stream was initialized:
+        /// - with a remote address: this field must be None or match the stream's remote address exactly.
+        /// - without a remote address: this field is required.
+        ///
+        /// If this value is None, the send operation is equivalent to `send` in POSIX. Otherwise it is equivalent to `sendto`.
+        remote-address: option<ip-socket-address>,
     }
 
 
@@ -24,9 +41,7 @@ interface udp {
         ///
         /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
         /// network interface(s) to bind to.
-        /// If the TCP/UDP port is zero, the socket will be bound to a random free port.
-        ///
-        /// When a socket is not explicitly bound, the first invocation to connect will implicitly bind the socket.
+        /// If the port is zero, the socket will be bound to a random free port.
         ///
         /// Unlike in POSIX, this function is async. This enables interactive WASI hosts to inject permission prompts.
         ///
@@ -49,95 +64,47 @@ interface udp {
         start-bind: func(network: borrow<network>, local-address: ip-socket-address) -> result<_, error-code>;
         finish-bind: func() -> result<_, error-code>;
 
-        /// Set the destination address.
-        ///
-        /// The local-address is updated based on the best network path to `remote-address`.
-        ///
-        /// When a destination address is set:
-        /// - all receive operations will only return datagrams sent from the provided `remote-address`.
-        /// - the `send` function can only be used to send to this destination.
-        ///
-        /// Note that this function does not generate any network traffic and the peer is not aware of this "connection".
-        ///
-        /// Unlike in POSIX, this function is async. This enables interactive WASI hosts to inject permission prompts.
-        ///
-        /// # Typical `start` errors
+        /// Set up inbound & outbound communication channels, optionally to a specific peer.
+        ///
+        /// This function only changes the local socket configuration and does not generate any network traffic.
+        /// On success, the `remote-address` of the socket is updated. The `local-address` may be updated as well,
+        /// based on the best network path to `remote-address`.
+        ///
+        /// When a `remote-address` is provided, the returned streams are limited to communicating with that specific peer:
+        /// - `send` can only be used to send to this destination.
+        /// - `receive` will only return datagrams sent from the provided `remote-address`.
+        ///
+        /// This method may be called multiple times on the same socket to change its association, but
+        /// only the most recently returned pair of streams will be operational. Implementations may trap if
+        /// the streams returned by a previous invocation haven't been dropped yet before calling `stream` again.
+        /// 
+        /// The POSIX equivalent in pseudo-code is:
+        /// ```text
+        /// if (was previously connected) {
+        /// 	connect(s, AF_UNSPEC)
+        /// }
+        /// if (remote_address is Some) {
+        /// 	connect(s, remote_address)
+        /// }
+        /// ```
+        ///
+        /// Unlike in POSIX, the socket must already be explicitly bound.
+        /// 
+        /// # Typical errors
         /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
         /// - `invalid-argument`:          `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
         /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
         /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:          The socket is already bound to a different network. The `network` passed to `connect` must be identical to the one passed to `bind`.
-        ///
-        /// # Typical `finish` errors
+        /// - `invalid-state`:             The socket is not bound.
         /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
-        /// - `not-in-progress`:           A `connect` operation is not in progress.
-        /// - `would-block`:               Can't finish the operation, it is still in progress. (EWOULDBLOCK, EAGAIN)
+        /// - `remote-unreachable`:        The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
         ///
         /// # References
         /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
         /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
         /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
         /// - <https://man.freebsd.org/cgi/man.cgi?connect>
-        start-connect: func(network: borrow<network>, remote-address: ip-socket-address) -> result<_, error-code>;
-        finish-connect: func() -> result<_, error-code>;
-
-        /// Receive messages on the socket.
-        ///
-        /// This function attempts to receive up to `max-results` datagrams on the socket without blocking.
-        /// The returned list may contain fewer elements than requested, but never more.
-        /// If `max-results` is 0, this function returns successfully with an empty list.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:      The socket is not bound to any local address. (EINVAL)
-        /// - `remote-unreachable`: The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
-        /// - `would-block`:        There is no pending data available to be read at the moment. (EWOULDBLOCK, EAGAIN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
-        /// - <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms741687(v=vs.85)>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
-        receive: func(max-results: u64) -> result<list<datagram>, error-code>;
-
-        /// Send messages on the socket.
-        ///
-        /// This function attempts to send all provided `datagrams` on the socket without blocking and
-        /// returns how many messages were actually sent (or queued for sending).
-        ///
-        /// This function semantically behaves the same as iterating the `datagrams` list and sequentially
-        /// sending each individual datagram until either the end of the list has been reached or the first error occurred.
-        /// If at least one datagram has been sent successfully, this function never returns an error.
-        ///
-        /// If the input list is empty, the function returns `ok(0)`.
-        ///
-        /// The remote address option is required. To send a message to the "connected" peer,
-        /// call `remote-address` to get their address.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
-        /// - `invalid-argument`:        `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
-        /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The socket is in "connected" mode and the `datagram.remote-address` does not match the address passed to `connect`. (EISCONN)
-        /// - `invalid-state`:           The socket is not bound to any local address. Unlike POSIX, this function does not perform an implicit bind.
-        /// - `remote-unreachable`:      The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
-        /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
-        /// - `would-block`:             The send buffer is currently full. (EWOULDBLOCK, EAGAIN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
-        send: func(datagrams: list<datagram>) -> result<u64, error-code>;
+        %stream: func(remote-address: option<ip-socket-address>) -> result<tuple<incoming-datagram-stream, outgoing-datagram-stream>, error-code>;
 
         /// Get the current bound address.
         ///
@@ -146,7 +113,7 @@ interface udp {
         /// > stored in the object pointed to by `address` is unspecified.
         ///
         /// WASI is stricter and requires `local-address` to return `invalid-state` when the socket hasn't been bound yet.
-        ///
+        /// 
         /// # Typical errors
         /// - `invalid-state`: The socket is not bound to any local address.
         ///
@@ -157,10 +124,10 @@ interface udp {
         /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
         local-address: func() -> result<ip-socket-address, error-code>;
 
-        /// Get the address set with `connect`.
+        /// Get the address the socket is currently streaming to.
         ///
         /// # Typical errors
-        /// - `invalid-state`: The socket is not connected to a remote address. (ENOTCONN)
+        /// - `invalid-state`: The socket is not streaming to a specific remote address. (ENOTCONN)
         ///
         /// # References
         /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
@@ -192,11 +159,11 @@ interface udp {
         /// The kernel buffer space reserved for sends/receives on this socket.
         ///
         /// Note #1: an implementation may choose to cap or round the buffer size when setting the value.
-        ///     In other words, after setting a value, reading the same setting back may return a different value.
+        /// 	In other words, after setting a value, reading the same setting back may return a different value.
         ///
         /// Note #2: there is not necessarily a direct relationship between the kernel buffer size and the bytes of
-        ///     actual data to be sent/received by the application, because the kernel might also use the buffer space
-        ///     for internal metadata structures.
+        /// 	actual data to be sent/received by the application, because the kernel might also use the buffer space
+        /// 	for internal metadata structures.
         ///
         /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
         receive-buffer-size: func() -> result<u64, error-code>;
@@ -210,4 +177,93 @@ interface udp {
         /// It's planned to be removed when `future` is natively supported in Preview3.
         subscribe: func() -> pollable;
     }
+
+    resource incoming-datagram-stream {
+        /// Receive messages on the socket.
+        ///
+        /// This function attempts to receive up to `max-results` datagrams on the socket without blocking.
+        /// The returned list may contain fewer elements than requested, but never more.
+        ///
+        /// This function returns successfully with an empty list when either:
+        /// - `max-results` is 0, or:
+        /// - `max-results` is greater than 0, but no results are immediately available.
+        /// This function never returns `error(would-block)`.
+        ///
+        /// # Typical errors
+        /// - `remote-unreachable`: The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
+        ///
+        /// # References
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
+        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
+        /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
+        /// - <https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms741687(v=vs.85)>
+        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
+        receive: func(max-results: u64) -> result<list<incoming-datagram>, error-code>;
+
+        /// Create a `pollable` which will resolve once the stream is ready to receive again.
+        ///
+        /// Note: this function is here for WASI Preview2 only.
+        /// It's planned to be removed when `future` is natively supported in Preview3.
+        subscribe: func() -> pollable;
+    }
+
+    resource outgoing-datagram-stream {
+        /// Check readiness for sending. This function never blocks.
+        ///
+        /// Returns the number of datagrams permitted for the next call to `send`,
+        /// or an error. Calling `send` with more datagrams than this function has
+        /// permitted will trap.
+        ///
+        /// When this function returns ok(0), the `subscribe` pollable will
+        /// become ready when this function will report at least ok(1), or an
+        /// error.
+        /// 
+        /// Never returns `would-block`.
+        check-send: func() -> result<u64, error-code>;
+
+        /// Send messages on the socket.
+        ///
+        /// This function attempts to send all provided `datagrams` on the socket without blocking and
+        /// returns how many messages were actually sent (or queued for sending). This function never
+        /// returns `error(would-block)`. If none of the datagrams were able to be sent, `ok(0)` is returned.
+        ///
+        /// This function semantically behaves the same as iterating the `datagrams` list and sequentially
+        /// sending each individual datagram until either the end of the list has been reached or the first error occurred.
+        /// If at least one datagram has been sent successfully, this function never returns an error.
+        ///
+        /// If the input list is empty, the function returns `ok(0)`.
+        ///
+        /// Each call to `send` must be permitted by a preceding `check-send`. Implementations must trap if
+        /// either `check-send` was not called or `datagrams` contains more items than `check-send` permitted.
+        ///
+        /// # Typical errors
+        /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
+        /// - `invalid-argument`:        `remote-address` is a non-IPv4-mapped IPv6 address, but the socket was bound to a specific IPv4-mapped IPv6 address. (or vice versa)
+        /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
+        /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
+        /// - `invalid-argument`:        The socket is in "connected" mode and `remote-address` is `some` value that does not match the address passed to `stream`. (EISCONN)
+        /// - `invalid-argument`:        The socket is not "connected" and no value for `remote-address` was provided. (EDESTADDRREQ)
+        /// - `remote-unreachable`:      The remote address is not reachable. (ECONNREFUSED, ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN)
+        /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
+        ///
+        /// # References
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
+        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
+        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
+        /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
+        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
+        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
+        send: func(datagrams: list<outgoing-datagram>) -> result<u64, error-code>;
+        
+        /// Create a `pollable` which will resolve once the stream is ready to send again.
+        ///
+        /// Note: this function is here for WASI Preview2 only.
+        /// It's planned to be removed when `future` is natively supported in Preview3.
+        subscribe: func() -> pollable;
+    }
 }
diff --git a/crates/wasmtime/src/config.rs b/crates/wasmtime/src/config.rs
index 1e26adb2c..9f6e634cb 100644
--- a/crates/wasmtime/src/config.rs
+++ b/crates/wasmtime/src/config.rs
@@ -2374,7 +2374,8 @@ impl PoolingAllocationConfig {
     ///   supported
     /// - `disable`: never use MPK
     ///
-    /// By default this value is `disabled`, but may become `auto` in future releases.
+    /// By default this value is `disabled`, but may become `auto` in future
+    /// releases.
     ///
     /// __WARNING__: this configuration options is still experimental--use at
     /// your own risk! MPK uses kernel and CPU features to protect memory
@@ -2385,6 +2386,23 @@ impl PoolingAllocationConfig {
         self
     }
 
+    /// Sets an upper limit on how many memory protection keys (MPK) Wasmtime
+    /// will use.
+    ///
+    /// This setting is only applicable when
+    /// [`PoolingAllocationConfig::memory_protection_keys`] is set to `enable`
+    /// or `auto`. Configuring this above the HW and OS limits (typically 15)
+    /// has no effect.
+    ///
+    /// If multiple Wasmtime engines are used in the same process, note that all
+    /// engines will share the same set of allocated keys; this setting will
+    /// limit how many keys are allocated initially and thus available to all
+    /// other engines.
+    pub fn max_memory_protection_keys(&mut self, max: usize) -> &mut Self {
+        self.config.max_memory_protection_keys = max;
+        self
+    }
+
     /// Check if memory protection keys (MPK) are available on the current host.
     ///
     /// This is a convenience method for determining MPK availability using the
diff --git a/crates/wasmtime/src/lib.rs b/crates/wasmtime/src/lib.rs
index 466ed2614..712d627a5 100644
--- a/crates/wasmtime/src/lib.rs
+++ b/crates/wasmtime/src/lib.rs
@@ -476,9 +476,7 @@ pub use anyhow::{Error, Result};
 pub mod component;
 
 cfg_if::cfg_if! {
-    if #[cfg(all(target_os = "macos", not(feature = "posix-signals-on-macos")))] {
-        // no extensions for macOS at this time
-    } else if #[cfg(unix)] {
+    if #[cfg(unix)] {
         pub mod unix;
     } else if #[cfg(windows)] {
         pub mod windows;
diff --git a/docs/contributing-implementing-wasm-proposals.md b/docs/contributing-implementing-wasm-proposals.md
index ce42e7e8f..13fc927be 100644
--- a/docs/contributing-implementing-wasm-proposals.md
+++ b/docs/contributing-implementing-wasm-proposals.md
@@ -124,3 +124,31 @@ default in Wasmtime, and can be used as a review checklist.
 
 [phases]: https://github.com/WebAssembly/meetings/blob/master/process/phases.md
 [WABT]: https://github.com/WebAssembly/wabt/
+
+## Adding component functionality to WASI
+The [cap-std](https://github.com/bytecodealliance/cap-std) repository contains
+crates which implement the capability-based version of the Rust standard library
+and extensions to that functionality. Once the functionality has been added to
+the relevant crates of that repository, they can be added into wasmtime by
+including them in the preview2 directory of the [wasi crate](https://github.com/bytecodealliance/wasmtime/tree/main/crates/wasi). 
+
+Currently, WebAssembly modules which rely on preview2 ABI cannot be directly
+executed by the wasmtime command. The following steps allow for testing such
+changes.
+
+1. Build wasmtime with the changes `cargo build --release`
+
+2. Create a simple Webassembly module to test the new component functionality by
+compiling your test code to the `wasm32-wasi` build target.
+
+3. Build the [wasi-preview1-component-adapter](https://github.com/bytecodealliance/wasmtime/tree/main/crates/wasi-preview1-component-adapter)
+as a command adapter. `cargo build -p wasi-preview1-component-adapter --target
+wasm32-wasi --release --features command --no-default-features`
+
+4. Use [wasm-tools](https://github.com/bytecodealliance/wasm-tools) to convert
+the test module to a component. `wasm-tools component new --adapt
+wasi_snapshot_preview1=wasi_snapshot_preview1.command.wasm -o component.wasm
+path/to/test/module`
+
+5. Run the test component created in the previous step with the locally built
+wasmtime. `wasmtime -W component-model=y -S preview2=y component.wasm`
diff --git a/docs/examples-minimal.md b/docs/examples-minimal.md
index 6c0d11cd9..e007e701c 100644
--- a/docs/examples-minimal.md
+++ b/docs/examples-minimal.md
@@ -219,25 +219,63 @@ $ ls -l ./target/aarch64-apple-darwin/release/wasmtime
 ## Minimizing further
 
 Above shows an example of taking the default `cargo build` result of 130M down
-to a 2.1M binary for the `wasmtime` executable. The remaining space in this
-binary is occupied by features which often aren't needed in all embeddings, for
-example:
-
-* Command-line argument parsing via the `clap` crate. Custom embeddings likely
-  won't use this at all and/or will have their own command line parsing
-  elsewhere. In the above 2.1M number this is about ~200k.
-
-* WASI implementations may not all be needed or may be slimmed down. For example
-  the above binary contains two implementations of `wasi_snapshot_preview1` at
-  this time and removing one of them shaves off around 300k.
-
-Most Wasmtime embeddings are unlikely to be the `wasmtime` CLI itself meaning
-that the above sources of size will be eliminated as well in a custom embedding
-of the `wasmtime` crate.
-
-If, however, after applying the above optimizations, flags, etc, results in a
-binary too large for your use case we'd be quite interested to hear about it!
-Please feel free to [open an
-issue](https://github.com/bytecodealliance/wasmtime/issues/new) and let us know.
-There's still remaining fruit to be picked to minimize Wasmtime's footprint
-further and user feedback is helpful to prioritize this work.
+to a 2.1M binary for the `wasmtime` executable. Similar steps can be done to
+reduce the size of the C API binary artifact as well which currently produces a
+~2.8M dynamic library. This is currently the smallest size with the source code
+as-is, but there are more size reductions which haven't been implemented yet.
+
+This is a listing of some example sources of binary size. Some sources of binary
+size may not apply to custom embeddings since, for example, your custom
+embedding might already not use WASI and might already not be included.
+
+* WASI in the Wasmtime CLI - currently the CLI includes all of WASI. This
+  includes two separate implementations of WASI - one for preview2 and one for
+  preview1. This accounts for 1M+ of space which is a significant chunk of the
+  remaining 2.1M.  While removing just preview2 or preview1 would be easy enough
+  with a Cargo feature, the resulting executable wouldn't be able to do
+  anything. Something like a [plugin feature for the
+  CLI](https://github.com/bytecodealliance/wasmtime/issues/7348), however, would
+  enable removing WASI while still being a usable executable.
+
+* Argument parsing in the Wasmtime CLI - as a command line executable `wasmtime`
+  contains parsing of command line arguments which currently uses the `clap`
+  crate. This contributes ~200k of binary size to the final executable which
+  would likely not be present in a custom embedding of Wasmtime. While this
+  can't be removed from Wasmtime it's something to consider when evaluating the
+  size of CI artifacts.
+
+* Cranelift in the C API - one of the features of Wasmtime is the ability to
+  have a runtime without Cranelift that only supports precompiled (AOT) wasm
+  modules. It's [not possible to build the C API without
+  Cranelift](https://github.com/bytecodealliance/wasmtime/issues/7349) though
+  because defining host functions requires Cranelift at this time to emit some
+  stubs.  This means that the C API is significantly larger than a custom Rust
+  embedding which doesn't suffer from the same restriction. This means that
+  while it's still possible to build an embedding of Wasmtime which doesn't have
+  Cranelift it's not easy to see what it might look like size-wise from
+  looking at the C API artifacts.
+
+* Formatting strings in Wasmtime - Wasmtime makes extensive use of formatting
+  strings for error messages and other purposes throughout the implementation.
+  Most of this is intended for debugging and understanding more when something
+  goes wrong, but much of this is not necessary for a truly minimal embedding.
+  In theory much of this could be conditionally compiled out of the Wasmtime
+  project to produce a smaller executable. Just how much of the final binary
+  size is accounted for by formatting string is unknown, but it's well known in
+  Rust that `std::fmt` is not the slimmest of modules.
+
+* Cranelift vs Winch - the "min" builds on CI try to exclude Cranelift from
+  their binary footprint (e.g. the CLI excludes it) but this comes at a cost of
+  the final executable not supporting compilation of wasm modules. If this is
+  required then no effort has yet been put into minimizing the code size of
+  Cranelift itself. One possible tradeoff that can be made though is to choose
+  between the Winch baseline compiler vs Cranelift. Winch should be much smaller
+  from a compiled footprint point of view while not sacrificing everything in
+  terms of performance. Note though that Winch is still under development.
+
+Above are some future avenues to take in terms of reducing the binary size of
+Wasmtime and various tradeoffs that can be made. The Wasmtime project is eager
+to hear embedder use cases/profiles if Wasmtime is not suitable for binary size
+reasons today. Please feel free to [open an
+issue](https://github.com/bytecodealliance/wasmtime/issues/new) and let us know
+and we'd be happy to discuss more how best to handle a particular use case.
diff --git a/examples/wasi/main.c b/examples/wasi/main.c
index 2a2ab0732..f55715aa6 100644
--- a/examples/wasi/main.c
+++ b/examples/wasi/main.c
@@ -3,7 +3,7 @@ Example of instantiating a WebAssembly which uses WASI imports.
 
 You can compile and run this example on Linux with:
 
-   cmake example/
+   cmake examples/
    cargo build --release -p wasmtime-c-api
    cc examples/wasi/main.c \
        -I crates/c-api/include \
diff --git a/examples/wasi/main.rs b/examples/wasi/main.rs
index 30d8e1f2a..69ff61756 100644
--- a/examples/wasi/main.rs
+++ b/examples/wasi/main.rs
@@ -2,7 +2,7 @@
 
 /*
 You can execute this example with:
-    cmake example/
+    cmake examples/
     cargo run --example wasi
 */
 
diff --git a/src/commands/serve.rs b/src/commands/serve.rs
index a064100a8..fc95f7add 100644
--- a/src/commands/serve.rs
+++ b/src/commands/serve.rs
@@ -1,17 +1,19 @@
 use crate::common::{Profile, RunCommon, RunTarget};
-use anyhow::{bail, Result};
+use anyhow::{anyhow, bail, Result};
 use clap::Parser;
 use std::{
     path::PathBuf,
     pin::Pin,
     sync::{
-        atomic::{AtomicBool, Ordering},
+        atomic::{AtomicBool, AtomicU64, Ordering},
         Arc,
     },
 };
 use wasmtime::component::{InstancePre, Linker};
 use wasmtime::{Engine, Store, StoreLimits};
-use wasmtime_wasi::preview2::{Table, WasiCtx, WasiCtxBuilder, WasiView};
+use wasmtime_wasi::preview2::{
+    self, StreamError, StreamResult, Table, WasiCtx, WasiCtxBuilder, WasiView,
+};
 use wasmtime_wasi_http::{body::HyperOutgoingBody, WasiHttpCtx, WasiHttpView};
 
 #[cfg(feature = "wasi-nn")]
@@ -135,10 +137,20 @@ impl ServeCommand {
         Ok(())
     }
 
-    fn new_store(&self, engine: &Engine) -> Result<Store<Host>> {
+    fn new_store(&self, engine: &Engine, req_id: u64) -> Result<Store<Host>> {
         let mut builder = WasiCtxBuilder::new();
 
-        // TODO: connect stdio to logging infrastructure
+        builder.envs(&[("REQUEST_ID", req_id.to_string())]);
+
+        builder.stdout(LogStream {
+            prefix: format!("stdout [{req_id}] :: "),
+            output: Output::Stdout,
+        });
+
+        builder.stderr(LogStream {
+            prefix: format!("stderr [{req_id}] :: "),
+            output: Output::Stderr,
+        });
 
         let mut host = Host {
             table: Table::new(),
@@ -244,6 +256,8 @@ impl ServeCommand {
             None
         };
 
+        log::info!("Listening on {}", self.addr);
+
         let handler = ProxyHandler::new(self, engine, instance);
 
         loop {
@@ -298,6 +312,13 @@ struct ProxyHandlerInner {
     cmd: ServeCommand,
     engine: Engine,
     instance_pre: InstancePre<Host>,
+    next_id: AtomicU64,
+}
+
+impl ProxyHandlerInner {
+    fn next_req_id(&self) -> u64 {
+        self.next_id.fetch_add(1, Ordering::Relaxed)
+    }
 }
 
 #[derive(Clone)]
@@ -309,6 +330,7 @@ impl ProxyHandler {
             cmd,
             engine,
             instance_pre,
+            next_id: AtomicU64::from(0),
         }))
     }
 }
@@ -323,13 +345,21 @@ impl hyper::service::Service<Request> for ProxyHandler {
     fn call(&mut self, req: Request) -> Self::Future {
         use http_body_util::BodyExt;
 
-        let handler = self.clone();
+        let ProxyHandler(inner) = self.clone();
 
         let (sender, receiver) = tokio::sync::oneshot::channel();
 
         // TODO: need to track the join handle, but don't want to block the response on it
         tokio::task::spawn(async move {
-            let mut store = handler.0.cmd.new_store(&handler.0.engine)?;
+            let req_id = inner.next_req_id();
+
+            log::info!(
+                "Request {req_id} handling {} to {}",
+                req.method(),
+                req.uri()
+            );
+
+            let mut store = inner.cmd.new_store(&inner.engine, req_id)?;
 
             let req = store.data_mut().new_incoming_request(
                 req.map(|body| body.map_err(|e| anyhow::anyhow!(e)).boxed()),
@@ -337,11 +367,9 @@ impl hyper::service::Service<Request> for ProxyHandler {
 
             let out = store.data_mut().new_response_outparam(sender)?;
 
-            let (proxy, _inst) = wasmtime_wasi_http::proxy::Proxy::instantiate_pre(
-                &mut store,
-                &handler.0.instance_pre,
-            )
-            .await?;
+            let (proxy, _inst) =
+                wasmtime_wasi_http::proxy::Proxy::instantiate_pre(&mut store, &inner.instance_pre)
+                    .await?;
 
             proxy
                 .wasi_http_incoming_handler()
@@ -357,3 +385,73 @@ impl hyper::service::Service<Request> for ProxyHandler {
         })
     }
 }
+
+#[derive(Clone)]
+enum Output {
+    Stdout,
+    Stderr,
+}
+
+impl Output {
+    fn write_all(&self, buf: &[u8]) -> anyhow::Result<()> {
+        use std::io::Write;
+
+        match self {
+            Output::Stdout => std::io::stdout().write_all(buf),
+            Output::Stderr => std::io::stderr().write_all(buf),
+        }
+        .map_err(|e| anyhow!(e))
+    }
+}
+
+#[derive(Clone)]
+struct LogStream {
+    prefix: String,
+    output: Output,
+}
+
+impl preview2::StdoutStream for LogStream {
+    fn stream(&self) -> Box<dyn preview2::HostOutputStream> {
+        Box::new(self.clone())
+    }
+
+    fn isatty(&self) -> bool {
+        use std::io::IsTerminal;
+
+        match &self.output {
+            Output::Stdout => std::io::stdout().is_terminal(),
+            Output::Stderr => std::io::stderr().is_terminal(),
+        }
+    }
+}
+
+impl preview2::HostOutputStream for LogStream {
+    fn write(&mut self, bytes: bytes::Bytes) -> StreamResult<()> {
+        let mut msg = Vec::new();
+
+        for line in bytes.split(|c| *c == b'\n') {
+            if !line.is_empty() {
+                msg.extend_from_slice(&self.prefix.as_bytes());
+                msg.extend_from_slice(line);
+                msg.push(b'\n');
+            }
+        }
+
+        self.output
+            .write_all(&msg)
+            .map_err(StreamError::LastOperationFailed)
+    }
+
+    fn flush(&mut self) -> StreamResult<()> {
+        Ok(())
+    }
+
+    fn check_write(&mut self) -> StreamResult<usize> {
+        Ok(1024 * 1024)
+    }
+}
+
+#[async_trait::async_trait]
+impl preview2::Subscribe for LogStream {
+    async fn ready(&mut self) {}
+}
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index 1b8a61792..8c06bd9ea 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -1162,6 +1162,15 @@ this crate has to do with iterators and `Result` and such. No `unsafe` or
 anything like that, all looks good.
 """
 
+[[audits.fastrand]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "2.0.0 -> 2.0.1"
+notes = """
+This update had a few doc updates but no otherwise-substantial source code
+updates.
+"""
+
 [[audits.fd-lock]]
 who = "Pat Hickey <phickey@fastly.com>"
 criteria = "safe-to-deploy"
@@ -1579,6 +1588,12 @@ criteria = "safe-to-deploy"
 delta = "0.6.2 -> 0.6.3"
 notes = "Just a dependency version bump and documentation update"
 
+[[audits.memfd]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.6.3 -> 0.6.4"
+notes = "This commit only updated the dependency `rustix`, so same as before."
+
 [[audits.memoffset]]
 who = "Alex Crichton <alex@alexcrichton.com>"
 criteria = "safe-to-deploy"
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 61b22132c..33559f77f 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -372,10 +372,6 @@ notes = "we are exempting tokio, hyper, and their tightly coupled dependencies b
 version = "0.13.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.instant]]
-version = "0.1.12"
-criteria = "safe-to-deploy"
-
 [[exemptions.ipnet]]
 version = "2.5.0"
 criteria = "safe-to-deploy"
@@ -506,10 +502,6 @@ criteria = "safe-to-deploy"
 version = "0.2.13"
 criteria = "safe-to-deploy"
 
-[[exemptions.redox_syscall]]
-version = "0.3.5"
-criteria = "safe-to-deploy"
-
 [[exemptions.redox_users]]
 version = "0.4.3"
 criteria = "safe-to-deploy"
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index 9a5b1830e..f8318ffec 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -3,195 +3,195 @@
 
 [[unpublished.cranelift]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-bforest]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-codegen]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-codegen-meta]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-codegen-shared]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-control]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-entity]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-frontend]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-interpreter]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-isle]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-jit]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-module]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-native]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-object]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-reader]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-serde]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.cranelift-wasm]]
 version = "0.102.0"
-audited_as = "0.100.0"
+audited_as = "0.101.1"
 
 [[unpublished.wasi-cap-std-sync]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasi-common]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasi-tokio]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-asm-macros]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-cache]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-cli]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-cli-flags]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-component-macro]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-component-util]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-cranelift]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-cranelift-shared]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-environ]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-explorer]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-fiber]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-jit]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-jit-debug]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-jit-icache-coherence]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-runtime]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-types]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wasi]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wasi-http]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wasi-nn]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wasi-threads]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wast]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-winch]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wit-bindgen]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wasmtime-wmemcheck]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wiggle]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wiggle-generate]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wiggle-macro]]
 version = "15.0.0"
-audited_as = "13.0.0"
+audited_as = "14.0.1"
 
 [[unpublished.wiggle-test]]
 version = "0.0.0"
@@ -199,7 +199,7 @@ audited_as = "0.1.0"
 
 [[unpublished.winch-codegen]]
 version = "0.13.0"
-audited_as = "0.11.0"
+audited_as = "0.12.1"
 
 [[publisher.aho-corasick]]
 version = "1.0.2"
@@ -370,104 +370,104 @@ user-login = "epage"
 user-name = "Ed Page"
 
 [[publisher.cranelift]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-bforest]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen-meta]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen-shared]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-control]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-entity]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-frontend]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-interpreter]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-isle]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-jit]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-module]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-native]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-object]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-reader]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-serde]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-wasm]]
-version = "0.100.0"
-when = "2023-09-20"
+version = "0.101.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -541,6 +541,13 @@ user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
+[[publisher.is-terminal]]
+version = "0.4.9"
+when = "2023-07-06"
+user-id = 6825
+user-login = "sunfishcode"
+user-name = "Dan Gohman"
+
 [[publisher.itoa]]
 version = "1.0.1"
 when = "2021-12-12"
@@ -563,8 +570,8 @@ user-login = "Amanieu"
 user-name = "Amanieu d'Antras"
 
 [[publisher.linux-raw-sys]]
-version = "0.4.3"
-when = "2023-06-14"
+version = "0.4.10"
+when = "2023-10-09"
 user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
@@ -633,8 +640,8 @@ user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
 [[publisher.rustix]]
-version = "0.38.8"
-when = "2023-08-10"
+version = "0.38.14"
+when = "2023-09-20"
 user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
@@ -715,6 +722,13 @@ user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
+[[publisher.target-lexicon]]
+version = "0.12.12"
+when = "2023-10-19"
+user-id = 6825
+user-login = "sunfishcode"
+user-name = "Dan Gohman"
+
 [[publisher.termcolor]]
 version = "1.1.3"
 when = "2022-03-02"
@@ -772,20 +786,20 @@ user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
 [[publisher.wasi-cap-std-sync]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasi-common]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasi-tokio]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -867,152 +881,152 @@ user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wasmtime]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-asm-macros]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cache]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cli]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cli-flags]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-component-macro]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-component-util]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cranelift]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cranelift-shared]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-environ]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-explorer]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-fiber]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit-debug]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit-icache-coherence]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-runtime]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-types]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-http]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-nn]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-threads]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wast]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-winch]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wit-bindgen]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wmemcheck]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -1031,20 +1045,20 @@ user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wiggle]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wiggle-generate]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wiggle-macro]]
-version = "13.0.0"
-when = "2023-09-20"
+version = "14.0.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -1063,8 +1077,8 @@ user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
 [[publisher.winch-codegen]]
-version = "0.11.0"
-when = "2023-09-20"
+version = "0.12.1"
+when = "2023-10-23"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -1239,6 +1253,12 @@ criteria = "safe-to-deploy"
 version = "0.3.1"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
 
+[[audits.google.audits.instant]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-run"
+version = "0.1.12"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
+
 [[audits.google.audits.libfuzzer-sys]]
 who = "ChromeOS"
 criteria = "safe-to-run"
@@ -1371,6 +1391,19 @@ criteria = "safe-to-deploy"
 delta = "2.2.1 -> 2.3.2"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.bitflags]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "2.3.3 -> 2.4.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.bitflags]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "2.4.0 -> 2.4.1"
+notes = "Only allowing new clippy lints"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.bytes]]
 who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"
@@ -1431,6 +1464,12 @@ criteria = "safe-to-deploy"
 delta = "0.9.3 -> 0.10.0"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.fastrand]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.9.0 -> 2.0.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.flagset]]
 who = "Ryan Hunt <rhunt@eqrion.net>"
 criteria = "safe-to-deploy"
@@ -1507,6 +1546,19 @@ version = "1.4.0"
 notes = "I have read over the macros, and audited the unsafe code."
 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.libc]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.147 -> 0.2.148"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.libc]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.148 -> 0.2.149"
+notes = "New defintions for a new target we don't use"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.log]]
 who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"
@@ -1625,6 +1677,18 @@ version = "1.9.3"
 notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.redox_syscall]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.13 -> 0.2.16"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.redox_syscall]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.16 -> 0.3.5"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.rustc-hash]]
 who = "Bobby Holley <bobbyholley@gmail.com>"
 criteria = "safe-to-deploy"
@@ -1648,6 +1712,12 @@ criteria = "safe-to-deploy"
 delta = "0.4.6 -> 0.4.7"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.tempfile]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "3.6.0 -> 3.8.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.toml]]
 who = "Bobby Holley <bobbyholley@gmail.com>"
 criteria = "safe-to-deploy"


Test patch:
diff --git a/cranelift/filetests/filetests/isa/riscv64/zca.clif b/cranelift/filetests/filetests/isa/riscv64/zca.clif
index 5453d4910..6d6620d52 100644
--- a/cranelift/filetests/filetests/isa/riscv64/zca.clif
+++ b/cranelift/filetests/filetests/isa/riscv64/zca.clif
@@ -576,23 +576,44 @@ block0:
 ;   c.addi16sp sp, 0x10
 ;   c.jr ra
 
-function %c_li() -> i64 {
+function %c_li() -> i64, i64, i64, i64, i64 {
 block0:
-  v0 = iconst.i64 1
-  return v0
+  v0 = iconst.i64 0
+  v1 = iconst.i64 1
+  v2 = iconst.i64 -1
+  v3 = iconst.i64 -32
+  v4 = iconst.i64 31
+  return v0, v1, v2, v3, v4
 }
 
 ; VCode:
 ; block0:
-;   li a0,1
+;   li a1,0
+;   mv a5,a1
+;   li a1,1
+;   li a2,-1
+;   li a3,-32
+;   li a4,31
+;   sd a2,0(a0)
+;   sd a3,8(a0)
+;   sd a4,16(a0)
+;   mv a0,a5
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   c.li a0, 1
+;   c.li a1, 0
+;   c.mv a5, a1
+;   c.li a1, 1
+;   c.li a2, -1
+;   c.li a3, -0x20
+;   c.li a4, 0x1f
+;   c.sd a2, 0(a0)
+;   c.sd a3, 8(a0)
+;   c.sd a4, 0x10(a0)
+;   c.mv a0, a5
 ;   c.jr ra
 
-
 function %c_lui() -> i64, i64, i64 {
 block0:
   v0 = iconst.i64 0x4000
diff --git a/cranelift/filetests/filetests/wasm/fixed-size-memory.wat b/cranelift/filetests/filetests/wasm/fixed-size-memory.wat
new file mode 100644
index 000000000..ac1de89f3
--- /dev/null
+++ b/cranelift/filetests/filetests/wasm/fixed-size-memory.wat
@@ -0,0 +1,78 @@
+;;! target = "x86_64"
+;;!
+;;! settings = ["enable_heap_access_spectre_mitigation=false"]
+;;!
+;;! compile = false
+;;!
+;;! [globals.vmctx]
+;;! type = "i64"
+;;! vmctx = true
+;;!
+;;! [globals.heap_base]
+;;! type = "i64"
+;;! load = { base = "vmctx", offset = 0, readonly = true }
+;;!
+;;! [globals.heap_bound]
+;;! type = "i64"
+;;! load = { base = "vmctx", offset = 8, readonly = true }
+;;!
+;;! [[heaps]]
+;;! base = "heap_base"
+;;! min_size = 0x10000
+;;! max_size = 0x10000
+;;! offset_guard_size = 0
+;;! index_type = "i32"
+;;! style = { kind = "dynamic", bound = "heap_bound" }
+
+;; Test that dynamic memories with `min_size == max_size` don't actually load
+;; their dynamic memory bound, since it is a constant.
+
+(module
+  (memory 1 1)
+
+  (func (export "do_store") (param i32 i32)
+    local.get 0
+    local.get 1
+    i32.store8 offset=0)
+
+  (func (export "do_load") (param i32) (result i32)
+    local.get 0
+    i32.load8_u offset=0))
+
+;; function u0:0(i32, i32, i64 vmctx) fast {
+;;     gv0 = vmctx
+;;     gv1 = load.i64 notrap aligned readonly gv0+8
+;;     gv2 = load.i64 notrap aligned readonly gv0
+;;
+;;                                 block0(v0: i32, v1: i32, v2: i64):
+;; @0041                               v3 = uextend.i64 v0
+;; @0041                               v4 = iconst.i64 0x0001_0000
+;; @0041                               v5 = icmp uge v3, v4  ; v4 = 0x0001_0000
+;; @0041                               trapnz v5, heap_oob
+;; @0041                               v6 = global_value.i64 gv2
+;; @0041                               v7 = iadd v6, v3
+;; @0041                               istore8 little heap v1, v7
+;; @0044                               jump block1
+;;
+;;                                 block1:
+;; @0044                               return
+;; }
+;;
+;; function u0:1(i32, i64 vmctx) -> i32 fast {
+;;     gv0 = vmctx
+;;     gv1 = load.i64 notrap aligned readonly gv0+8
+;;     gv2 = load.i64 notrap aligned readonly gv0
+;;
+;;                                 block0(v0: i32, v1: i64):
+;; @0049                               v3 = uextend.i64 v0
+;; @0049                               v4 = iconst.i64 0x0001_0000
+;; @0049                               v5 = icmp uge v3, v4  ; v4 = 0x0001_0000
+;; @0049                               trapnz v5, heap_oob
+;; @0049                               v6 = global_value.i64 gv2
+;; @0049                               v7 = iadd v6, v3
+;; @0049                               v8 = uload8.i32 little heap v7
+;; @004c                               jump block1(v8)
+;;
+;;                                 block1(v2: i32):
+;; @004c                               return v2
+;; }
diff --git a/cranelift/filetests/filetests/wasm/non-fixed-size-memory.wat b/cranelift/filetests/filetests/wasm/non-fixed-size-memory.wat
new file mode 100644
index 000000000..dc981fe6f
--- /dev/null
+++ b/cranelift/filetests/filetests/wasm/non-fixed-size-memory.wat
@@ -0,0 +1,78 @@
+;;! target = "x86_64"
+;;!
+;;! settings = ["enable_heap_access_spectre_mitigation=false"]
+;;!
+;;! compile = false
+;;!
+;;! [globals.vmctx]
+;;! type = "i64"
+;;! vmctx = true
+;;!
+;;! [globals.heap_base]
+;;! type = "i64"
+;;! load = { base = "vmctx", offset = 0, readonly = true }
+;;!
+;;! [globals.heap_bound]
+;;! type = "i64"
+;;! load = { base = "vmctx", offset = 8, readonly = true }
+;;!
+;;! [[heaps]]
+;;! base = "heap_base"
+;;! min_size = 0x10000
+;;! max_size = 0x20000
+;;! offset_guard_size = 0
+;;! index_type = "i32"
+;;! style = { kind = "dynamic", bound = "heap_bound" }
+
+;; Dual test to `fixed-size-memory.wat` that checks that we _don't_ use a
+;; constant for the heap bound when `min_size != max_size`.
+
+(module
+  (memory 1 2)
+
+  (func (export "do_store") (param i32 i32)
+    local.get 0
+    local.get 1
+    i32.store8 offset=0)
+
+  (func (export "do_load") (param i32) (result i32)
+    local.get 0
+    i32.load8_u offset=0))
+
+;; function u0:0(i32, i32, i64 vmctx) fast {
+;;     gv0 = vmctx
+;;     gv1 = load.i64 notrap aligned readonly gv0+8
+;;     gv2 = load.i64 notrap aligned readonly gv0
+;;
+;;                                 block0(v0: i32, v1: i32, v2: i64):
+;; @0041                               v3 = uextend.i64 v0
+;; @0041                               v4 = global_value.i64 gv1
+;; @0041                               v5 = icmp uge v3, v4
+;; @0041                               trapnz v5, heap_oob
+;; @0041                               v6 = global_value.i64 gv2
+;; @0041                               v7 = iadd v6, v3
+;; @0041                               istore8 little heap v1, v7
+;; @0044                               jump block1
+;;
+;;                                 block1:
+;; @0044                               return
+;; }
+;;
+;; function u0:1(i32, i64 vmctx) -> i32 fast {
+;;     gv0 = vmctx
+;;     gv1 = load.i64 notrap aligned readonly gv0+8
+;;     gv2 = load.i64 notrap aligned readonly gv0
+;;
+;;                                 block0(v0: i32, v1: i64):
+;; @0049                               v3 = uextend.i64 v0
+;; @0049                               v4 = global_value.i64 gv1
+;; @0049                               v5 = icmp uge v3, v4
+;; @0049                               trapnz v5, heap_oob
+;; @0049                               v6 = global_value.i64 gv2
+;; @0049                               v7 = iadd v6, v3
+;; @0049                               v8 = uload8.i32 little heap v7
+;; @004c                               jump block1(v8)
+;;
+;;                                 block1(v2: i32):
+;; @004c                               return v2
+;; }
diff --git a/cranelift/filetests/src/test_wasm/config.rs b/cranelift/filetests/src/test_wasm/config.rs
index eb9b6f60e..15ca92ec7 100644
--- a/cranelift/filetests/src/test_wasm/config.rs
+++ b/cranelift/filetests/src/test_wasm/config.rs
@@ -159,6 +159,9 @@ pub struct TestHeap {
     #[serde(default)]
     pub min_size: u64,
 
+    #[serde(default)]
+    pub max_size: Option<u64>,
+
     #[serde(default)]
     pub offset_guard_size: u64,
 
@@ -174,7 +177,8 @@ impl TestHeap {
     ) -> cranelift_wasm::HeapData {
         cranelift_wasm::HeapData {
             base: name_to_ir_global[&self.base],
-            min_size: self.min_size.into(),
+            min_size: self.min_size,
+            max_size: self.max_size,
             offset_guard_size: self.offset_guard_size.into(),
             style: self.style.to_ir(name_to_ir_global),
             index_type: match self.index_type.as_str() {
diff --git a/crates/test-programs/src/bin/preview2_tcp_bind.rs b/crates/test-programs/src/bin/preview2_tcp_bind.rs
index 824b5978e..0dadd114b 100644
--- a/crates/test-programs/src/bin/preview2_tcp_bind.rs
+++ b/crates/test-programs/src/bin/preview2_tcp_bind.rs
@@ -23,12 +23,16 @@ fn test_tcp_bind_specific_port(net: &Network, ip: IpAddress) {
     let bind_addr = IpSocketAddress::new(ip, PORT);
 
     let sock = TcpSocket::new(ip.family()).unwrap();
-    sock.blocking_bind(net, bind_addr).unwrap();
-
-    let bound_addr = sock.local_address().unwrap();
-
-    assert_eq!(bind_addr.ip(), bound_addr.ip());
-    assert_eq!(bind_addr.port(), bound_addr.port());
+    match sock.blocking_bind(net, bind_addr) {
+        Ok(()) => {
+            let bound_addr = sock.local_address().unwrap();
+
+            assert_eq!(bind_addr.ip(), bound_addr.ip());
+            assert_eq!(bind_addr.port(), bound_addr.port());
+        }
+        Err(ErrorCode::AddressInUse) => {}
+        Err(e) => panic!("error: {e}"),
+    }
 }
 
 /// Two sockets may not be actively bound to the same address at the same time.
diff --git a/crates/test-programs/src/bin/preview2_udp_sample_application.rs b/crates/test-programs/src/bin/preview2_udp_sample_application.rs
index de8a0a27c..41da701e6 100644
--- a/crates/test-programs/src/bin/preview2_udp_sample_application.rs
+++ b/crates/test-programs/src/bin/preview2_udp_sample_application.rs
@@ -1,9 +1,11 @@
 use test_programs::wasi::sockets::network::{
-    IpAddressFamily, IpSocketAddress, Ipv4SocketAddress, Ipv6SocketAddress, Network,
+    IpAddress, IpAddressFamily, IpSocketAddress, Ipv4SocketAddress, Ipv6SocketAddress, Network,
 };
-use test_programs::wasi::sockets::udp::{Datagram, UdpSocket};
+use test_programs::wasi::sockets::udp::{OutgoingDatagram, UdpSocket};
 
 fn test_sample_application(family: IpAddressFamily, bind_address: IpSocketAddress) {
+    let unspecified_addr = IpSocketAddress::new(IpAddress::new_unspecified(family), 0);
+
     let first_message = &[];
     let second_message = b"Hello, world!";
     let third_message = b"Greetings, planet!";
@@ -13,31 +15,32 @@ fn test_sample_application(family: IpAddressFamily, bind_address: IpSocketAddres
     let server = UdpSocket::new(family).unwrap();
 
     server.blocking_bind(&net, bind_address).unwrap();
+    let (server_incoming, _) = server.stream(None).unwrap();
     let addr = server.local_address().unwrap();
 
     let client_addr = {
         let client = UdpSocket::new(family).unwrap();
-        client.blocking_connect(&net, addr).unwrap();
+        client.blocking_bind(&net, unspecified_addr).unwrap();
+        let (_, client_outgoing) = client.stream(Some(addr)).unwrap();
 
         let datagrams = [
-            Datagram {
+            OutgoingDatagram {
                 data: first_message.to_vec(),
-                remote_address: addr,
+                remote_address: None,
             },
-            Datagram {
+            OutgoingDatagram {
                 data: second_message.to_vec(),
-                remote_address: addr,
+                remote_address: Some(addr),
             },
         ];
-        client.blocking_send(&datagrams).unwrap();
+        client_outgoing.blocking_send(&datagrams).unwrap();
 
         client.local_address().unwrap()
     };
 
     {
         // Check that we've received our sent messages.
-        // Not guaranteed to work but should work in practice.
-        let datagrams = server.blocking_receive(2..100).unwrap();
+        let datagrams = server_incoming.blocking_receive(2..100).unwrap();
         assert_eq!(datagrams.len(), 2);
 
         assert_eq!(datagrams[0].data, first_message);
@@ -50,21 +53,22 @@ fn test_sample_application(family: IpAddressFamily, bind_address: IpSocketAddres
     // Another client
     {
         let client = UdpSocket::new(family).unwrap();
-        client.blocking_connect(&net, addr).unwrap();
+        client.blocking_bind(&net, unspecified_addr).unwrap();
+        let (_, client_outgoing) = client.stream(None).unwrap();
 
-        let datagrams = [Datagram {
+        let datagrams = [OutgoingDatagram {
             data: third_message.to_vec(),
-            remote_address: addr,
+            remote_address: Some(addr),
         }];
-        client.blocking_send(&datagrams).unwrap();
+        client_outgoing.blocking_send(&datagrams).unwrap();
     }
 
     {
         // Check that we sent and received our message!
-        let datagrams = server.blocking_receive(1..100).unwrap();
+        let datagrams = server_incoming.blocking_receive(1..100).unwrap();
         assert_eq!(datagrams.len(), 1);
 
-        assert_eq!(datagrams[0].data, third_message); // Not guaranteed to work but should work in practice.
+        assert_eq!(datagrams[0].data, third_message);
     }
 }
 
diff --git a/crates/test-programs/src/sockets.rs b/crates/test-programs/src/sockets.rs
index 994e0e55e..3033582b6 100644
--- a/crates/test-programs/src/sockets.rs
+++ b/crates/test-programs/src/sockets.rs
@@ -7,7 +7,9 @@ use crate::wasi::sockets::network::{
     Network,
 };
 use crate::wasi::sockets::tcp::TcpSocket;
-use crate::wasi::sockets::udp::{Datagram, UdpSocket};
+use crate::wasi::sockets::udp::{
+    IncomingDatagram, IncomingDatagramStream, OutgoingDatagram, OutgoingDatagramStream, UdpSocket,
+};
 use crate::wasi::sockets::{tcp_create_socket, udp_create_socket};
 use std::ops::Range;
 
@@ -142,42 +144,42 @@ impl UdpSocket {
             }
         }
     }
+}
 
-    pub fn blocking_connect(
-        &self,
-        network: &Network,
-        remote_address: IpSocketAddress,
-    ) -> Result<(), ErrorCode> {
+impl OutgoingDatagramStream {
+    fn blocking_check_send(&self, timeout: &Pollable) -> Result<u64, ErrorCode> {
         let sub = self.subscribe();
 
-        self.start_connect(&network, remote_address)?;
-
         loop {
-            match self.finish_connect() {
-                Err(ErrorCode::WouldBlock) => sub.wait(),
+            match self.check_send() {
+                Ok(0) => sub.wait_until(timeout)?,
                 result => return result,
             }
         }
     }
 
-    pub fn blocking_send(&self, mut datagrams: &[Datagram]) -> Result<(), ErrorCode> {
+    pub fn blocking_send(&self, mut datagrams: &[OutgoingDatagram]) -> Result<(), ErrorCode> {
         let timeout = monotonic_clock::subscribe(TIMEOUT_NS, false);
-        let pollable = self.subscribe();
 
         while !datagrams.is_empty() {
-            match self.send(datagrams) {
+            let permit = self.blocking_check_send(&timeout)?;
+            let chunk_len = datagrams.len().min(permit as usize);
+            match self.send(&datagrams[..chunk_len]) {
+                Ok(0) => {}
                 Ok(packets_sent) => {
-                    datagrams = &datagrams[(packets_sent as usize)..];
+                    let packets_sent = packets_sent as usize;
+                    datagrams = &datagrams[packets_sent..];
                 }
-                Err(ErrorCode::WouldBlock) => pollable.wait_until(&timeout)?,
                 Err(err) => return Err(err),
             }
         }
 
         Ok(())
     }
+}
 
-    pub fn blocking_receive(&self, count: Range<u64>) -> Result<Vec<Datagram>, ErrorCode> {
+impl IncomingDatagramStream {
+    pub fn blocking_receive(&self, count: Range<u64>) -> Result<Vec<IncomingDatagram>, ErrorCode> {
         let timeout = monotonic_clock::subscribe(TIMEOUT_NS, false);
         let pollable = self.subscribe();
         let mut datagrams = vec![];
@@ -187,11 +189,6 @@ impl UdpSocket {
                 Ok(mut chunk) => {
                     datagrams.append(&mut chunk);
 
-                    if datagrams.len() >= count.start as usize {
-                        return Ok(datagrams);
-                    }
-                }
-                Err(ErrorCode::WouldBlock) => {
                     if datagrams.len() >= count.start as usize {
                         return Ok(datagrams);
                     } else {
diff --git a/tests/all/limits.rs b/tests/all/limits.rs
index cd357d5dc..bb8640af8 100644
--- a/tests/all/limits.rs
+++ b/tests/all/limits.rs
@@ -1,5 +1,6 @@
 use anyhow::Result;
 use wasmtime::*;
+use wasmtime_runtime::MpkEnabled;
 
 const WASM_PAGE_SIZE: usize = wasmtime_environ::WASM_PAGE_SIZE as usize;
 
@@ -355,7 +356,8 @@ fn test_pooling_allocator_initial_limits_exceeded() -> Result<()> {
     let mut pool = crate::small_pool_config();
     pool.total_memories(2)
         .max_memories_per_module(2)
-        .memory_pages(5);
+        .memory_pages(5)
+        .memory_protection_keys(MpkEnabled::Disable);
     let mut config = Config::new();
     config.wasm_multi_memory(true);
     config.allocation_strategy(InstanceAllocationStrategy::Pooling(pool));
diff --git a/tests/all/memory.rs b/tests/all/memory.rs
index 637585450..4e2920200 100644
--- a/tests/all/memory.rs
+++ b/tests/all/memory.rs
@@ -3,6 +3,7 @@ use rayon::prelude::*;
 use std::sync::atomic::{AtomicU32, Ordering::SeqCst};
 use std::time::{Duration, Instant};
 use wasmtime::*;
+use wasmtime_runtime::{mpk, MpkEnabled};
 
 fn module(engine: &Engine) -> Result<Module> {
     let mut wat = format!("(module\n");
@@ -192,7 +193,72 @@ fn guards_present_pooling() -> Result<()> {
     const GUARD_SIZE: u64 = 65536;
 
     let mut pool = crate::small_pool_config();
-    pool.total_memories(2).memory_pages(10);
+    pool.total_memories(2)
+        .memory_pages(10)
+        .memory_protection_keys(MpkEnabled::Disable);
+    let mut config = Config::new();
+    config.static_memory_maximum_size(1 << 20);
+    config.dynamic_memory_guard_size(GUARD_SIZE);
+    config.static_memory_guard_size(GUARD_SIZE);
+    config.guard_before_linear_memory(true);
+    config.allocation_strategy(InstanceAllocationStrategy::Pooling(pool));
+    let engine = Engine::new(&config)?;
+
+    let mut store = Store::new(&engine, ());
+
+    let mem1 = {
+        let m = Module::new(&engine, "(module (memory (export \"\") 1 2))")?;
+        Instance::new(&mut store, &m, &[])?
+            .get_memory(&mut store, "")
+            .unwrap()
+    };
+    let mem2 = {
+        let m = Module::new(&engine, "(module (memory (export \"\") 1))")?;
+        Instance::new(&mut store, &m, &[])?
+            .get_memory(&mut store, "")
+            .unwrap()
+    };
+
+    unsafe fn assert_guards(store: &Store<()>, mem: &Memory) {
+        // guards before
+        println!("check pre-mem");
+        assert_faults(mem.data_ptr(&store).offset(-(GUARD_SIZE as isize)));
+
+        // unmapped just after memory
+        println!("check mem");
+        assert_faults(mem.data_ptr(&store).add(mem.data_size(&store)));
+
+        // guards after memory
+        println!("check post-mem");
+        assert_faults(mem.data_ptr(&store).add(1 << 20));
+    }
+    unsafe {
+        assert_guards(&store, &mem1);
+        assert_guards(&store, &mem2);
+        println!("growing");
+        mem1.grow(&mut store, 1).unwrap();
+        mem2.grow(&mut store, 1).unwrap();
+        assert_guards(&store, &mem1);
+        assert_guards(&store, &mem2);
+    }
+
+    Ok(())
+}
+
+#[test]
+#[cfg_attr(miri, ignore)]
+fn guards_present_pooling_mpk() -> Result<()> {
+    if !mpk::is_supported() {
+        println!("skipping `guards_present_pooling_mpk` test; mpk is not supported");
+        return Ok(());
+    }
+
+    const GUARD_SIZE: u64 = 65536;
+    let mut pool = crate::small_pool_config();
+    pool.total_memories(4)
+        .memory_pages(10)
+        .memory_protection_keys(MpkEnabled::Enable)
+        .max_memory_protection_keys(2);
     let mut config = Config::new();
     config.static_memory_maximum_size(1 << 20);
     config.dynamic_memory_guard_size(GUARD_SIZE);
diff --git a/tests/all/pooling_allocator.rs b/tests/all/pooling_allocator.rs
index dc23686de..b79f10d6a 100644
--- a/tests/all/pooling_allocator.rs
+++ b/tests/all/pooling_allocator.rs
@@ -1,6 +1,7 @@
 use super::skip_pooling_allocator_tests;
 use anyhow::Result;
 use wasmtime::*;
+use wasmtime_runtime::MpkEnabled;
 
 #[test]
 fn successful_instantiation() -> Result<()> {
@@ -1151,7 +1152,8 @@ fn total_memories_limit() -> Result<()> {
 
     let mut pool = crate::small_pool_config();
     pool.total_memories(TOTAL_MEMORIES)
-        .total_core_instances(TOTAL_MEMORIES + 1);
+        .total_core_instances(TOTAL_MEMORIES + 1)
+        .memory_protection_keys(MpkEnabled::Disable);
     let mut config = Config::new();
     config.allocation_strategy(InstanceAllocationStrategy::Pooling(pool));
 
diff --git a/tests/all/wast.rs b/tests/all/wast.rs
index 8f2f357be..5b93799ab 100644
--- a/tests/all/wast.rs
+++ b/tests/all/wast.rs
@@ -123,11 +123,13 @@ fn run_wast(wast: &str, strategy: Strategy, pooling: bool) -> anyhow::Result<()>
         }
 
         // The limits here are crafted such that the wast tests should pass.
-        // However, these limits may become insufficient in the future as the wast tests change.
-        // If a wast test fails because of a limit being "exceeded" or if memory/table
-        // fails to grow, the values here will need to be adjusted.
+        // However, these limits may become insufficient in the future as the
+        // wast tests change. If a wast test fails because of a limit being
+        // "exceeded" or if memory/table fails to grow, the values here will
+        // need to be adjusted.
         let mut pool = PoolingAllocationConfig::default();
-        pool.total_memories(450)
+        pool.total_memories(450 * 2)
+            .max_memory_protection_keys(2)
             .memory_pages(805)
             .max_memories_per_module(if multi_memory { 9 } else { 1 })
             .max_tables_per_module(4);
@@ -180,7 +182,7 @@ fn feature_found_src(bytes: &[u8], name: &str) -> bool {
 // specified maximum we can put a cap on the virtual address space reservations
 // made.
 fn lock_pooling() -> impl Drop {
-    const MAX_CONCURRENT_POOLING: u32 = 8;
+    const MAX_CONCURRENT_POOLING: u32 = 4;
 
     static ACTIVE: Lazy<MyState> = Lazy::new(MyState::default);