diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4f155f96acab..9d64ba405913 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -498,28 +498,6 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-  # Build and test the wasi-crypto module.
-  test_wasi_crypto:
-    needs: determine
-    if: needs.determine.outputs.run-full
-    name: Test wasi-crypto module
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-      with:
-        submodules: true
-    - run: rustup update stable && rustup default stable
-    - run: rustup target add wasm32-wasi
-    - run: ./ci/run-wasi-crypto-example.sh
-      env:
-        RUST_BACKTRACE: 1
-
-    # common logic to cancel the entire run if this job fails
-    - run: gh run cancel ${{ github.run_id }}
-      if: failure() && github.event_name != 'pull_request'
-      env:
-        GH_TOKEN: ${{ github.token }}
-
   build-preview1-component-adapter:
     name: Build wasi-preview1-component-adapter
     needs: determine
@@ -768,7 +746,6 @@ jobs:
       - checks_winarm64
       - fuzz_targets
       - test_wasi_nn
-      - test_wasi_crypto
       - bench
       - meta_deterministic_check
       - verify-publish
diff --git a/.gitmodules b/.gitmodules
index 70ad96ad7fa3..80d7961bfecb 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -10,9 +10,6 @@
 [submodule "crates/wasi-nn/spec"]
 	path = crates/wasi-nn/spec
 	url = https://github.com/WebAssembly/wasi-nn
-[submodule "crates/wasi-crypto/spec"]
-	path = crates/wasi-crypto/spec
-	url = https://github.com/WebAssembly/wasi-crypto.git
 [submodule "tests/wasi_testsuite/wasi-threads"]
 	path = tests/wasi_testsuite/wasi-threads
 	url = https://github.com/WebAssembly/wasi-threads
diff --git a/Cargo.lock b/Cargo.lock
index 8f8a0c3981a9..7f2719356887 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,41 +17,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
-[[package]]
-name = "aead"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b613b8e1e3cf911a086f53f03bf286f52fd7a7258e4fa606f0ef220d39d8877"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "aes"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e8b47f52ea9bae42228d07ec09eb676433d7c4ed1ebdf0f1d1c29ed446f1ab8"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures",
- "opaque-debug",
-]
-
-[[package]]
-name = "aes-gcm"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df5f85a83a7d8b0442b6aa7b504b8212c1733da07b98aae43d4bc21b2cb3cdf6"
-dependencies = [
- "aead",
- "aes",
- "cipher",
- "ctr",
- "ghash",
- "subtle",
-]
-
 [[package]]
 name = "ahash"
 version = "0.8.3"
@@ -65,9 +30,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+checksum = "86b8f9420f797f2d9e935edf629310eb938a0d839f984e25327f3c7eed22300c"
 dependencies = [
  "memchr",
 ]
@@ -125,9 +90,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+checksum = "c677ab05e09154296dd37acecd46420c17b9713e8366facafa8fc0885167cf4c"
 dependencies = [
  "anstyle",
  "windows-sys 0.48.0",
@@ -156,7 +121,7 @@ checksum = "cc6dde6e4ed435a4c1ee4e73592f5ba9da2151af10076cc04858746af9352d09"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -197,12 +162,6 @@ version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
 
-[[package]]
-name = "base64ct"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b4d9b1225d28d360ec6a231d65af1fd99a2a095154c8040689617290569c5c"
-
 [[package]]
 name = "bincode"
 version = "1.3.3"
@@ -235,18 +194,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
-
-[[package]]
-name = "block-buffer"
-version = "0.9.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
-dependencies = [
- "generic-array",
-]
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
 
 [[package]]
 name = "block-buffer"
@@ -264,7 +214,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6798148dccfbff0fae41c7574d2fa8f1ef3492fba0face179de5d8d447d67b05"
 dependencies = [
  "memchr",
- "regex-automata 0.3.3",
+ "regex-automata 0.3.6",
  "serde",
 ]
 
@@ -276,7 +226,7 @@ checksum = "a3e2c3daef883ecc1b5d58c15adae93470a91d425f3532ba1695849656af3fc1"
 
 [[package]]
 name = "byte-array-literals"
-version = "12.0.0"
+version = "13.0.0"
 
 [[package]]
 name = "byteorder"
@@ -323,7 +273,7 @@ dependencies = [
  "io-lifetimes 2.0.2",
  "ipnet",
  "maybe-owned",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
  "winx",
 ]
@@ -335,7 +285,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "577de6cff7c2a47d6b13efe5dd28bf116bd7f8f7db164ea95b7cc2640711f522"
 dependencies = [
  "ambient-authority",
- "rand 0.8.5",
+ "rand",
 ]
 
 [[package]]
@@ -347,7 +297,7 @@ dependencies = [
  "cap-primitives",
  "io-extras",
  "io-lifetimes 2.0.2",
- "rustix 0.38.4",
+ "rustix 0.38.8",
 ]
 
 [[package]]
@@ -357,8 +307,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b9e3348a3510c4619b4c7a7bcdef09a71221da18f266bda3ed6b9aea2c509e2"
 dependencies = [
  "cap-std",
- "rand 0.8.5",
- "rustix 0.38.4",
+ "rand",
+ "rustix 0.38.8",
  "uuid",
 ]
 
@@ -370,7 +320,7 @@ checksum = "f8f52b3c8f4abfe3252fd0a071f3004aaa3b18936ec97bdbd8763ce03aff6247"
 dependencies = [
  "cap-primitives",
  "once_cell",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "winx",
 ]
 
@@ -425,11 +375,12 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "305fe645edc1442a0fa8b6726ba61d422798d37a52e12eaecf4b022ebbb88f01"
 dependencies = [
  "jobserver",
+ "libc",
 ]
 
 [[package]]
@@ -438,31 +389,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
-[[package]]
-name = "chacha20"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c80e5460aa66fe3b91d40bcbdab953a597b60053e34d684ac6903f863b680a6"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures",
- "zeroize",
-]
-
-[[package]]
-name = "chacha20poly1305"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18446b09be63d457bbec447509e85f662f32952b035ce892290396bc0b0cff5"
-dependencies = [
- "aead",
- "chacha20",
- "cipher",
- "poly1305",
- "zeroize",
-]
-
 [[package]]
 name = "ciborium"
 version = "0.2.1"
@@ -490,20 +416,11 @@ dependencies = [
  "half",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ee52072ec15386f770805afd189a01c8841be8696bed250fa2f13c4c0d6dfb7"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "clap"
-version = "4.3.17"
+version = "4.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0827b011f6f8ab38590295339817b0d26f344aa4932c3ced71b45b0c54b4a9"
+checksum = "c27cdf28c0f604ba3f512b0c9a409f8de8513e4816705deb0498b627e7c3a3fd"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -512,9 +429,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.3.17"
+version = "4.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9441b403be87be858db6a23edb493e7f694761acdc3343d5a0fcaafd304cbc9e"
+checksum = "08a9f1ab5e9f01a9b81f202e8562eb9a10de70abf9eaeac1be465c28b75aa4aa"
 dependencies = [
  "anstream",
  "anstyle",
@@ -531,7 +448,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -561,7 +478,7 @@ name = "command-tests"
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "getrandom 0.2.10",
+ "getrandom",
  "wit-bindgen",
 ]
 
@@ -582,7 +499,7 @@ version = "0.0.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -616,12 +533,6 @@ dependencies = [
  "windows-sys 0.45.0",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d6f2aa4d0537bcc1c74df8755072bd31c1ef1a3a1b85a68e8404a8c353b7b8b"
-
 [[package]]
 name = "cpp_demangle"
 version = "0.3.5"
@@ -642,7 +553,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-frontend",
@@ -650,14 +561,14 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "anyhow",
  "bincode",
@@ -675,7 +586,7 @@ dependencies = [
  "log",
  "regalloc2",
  "serde",
- "sha2 0.10.7",
+ "sha2",
  "similar",
  "smallvec",
  "souper-ir",
@@ -684,25 +595,25 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen-shared",
 ]
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.99.0"
+version = "0.100.0"
 
 [[package]]
 name = "cranelift-control"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "serde",
 ]
@@ -739,7 +650,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen",
  "hashbrown 0.13.2",
@@ -763,7 +674,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-interpreter"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-entity",
@@ -777,7 +688,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "codespan-reporting",
  "log",
@@ -786,7 +697,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-jit"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "anyhow",
  "cranelift",
@@ -807,7 +718,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-module"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -818,7 +729,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-native"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -827,7 +738,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-object"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -842,7 +753,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-reader"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -852,7 +763,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-serde"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "clap",
  "cranelift-codegen",
@@ -899,7 +810,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-wasm"
-version = "0.99.0"
+version = "0.100.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-entity",
@@ -1003,18 +914,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crypto-bigint"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f83bd3bb4314701c568e340cd8cf78c975aa0ca79e03d3f6d1677d5b0c9c0c03"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -1025,44 +924,12 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "crypto-mac"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
-dependencies = [
- "generic-array",
- "subtle",
-]
-
-[[package]]
-name = "ctr"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "049bb91fb4aaf0e3c7efa6cd5ef877dbbbd15b39dad06d9948de4ec8a75761ea"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "cty"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b365fabc795046672053e29c954733ec3b05e4be654ab130fe8f1f94d7051f35"
 
-[[package]]
-name = "curve25519-dalek"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9fdf9972b2bd6af2d913799d9ebc165ea4d2e65878e329d9c6b372c4491b61"
-dependencies = [
- "byteorder",
- "digest 0.9.0",
- "rand_core 0.5.1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "debugid"
 version = "0.8.0"
@@ -1072,27 +939,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "der"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79b71cca7d95d7681a4b3b9cdf63c8dbc3730d0584c2c74e31416d64a90493f4"
-dependencies = [
- "const-oid",
- "crypto-bigint",
-]
-
-[[package]]
-name = "derivative"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "derive_arbitrary"
 version = "1.3.1"
@@ -1101,16 +947,7 @@ checksum = "53e0efad4403bfc52dc201159c4b842a246a14b98c64b55dfd0f2d89729dfeb8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
-]
-
-[[package]]
-name = "digest"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
-dependencies = [
- "generic-array",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -1119,7 +956,7 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.4",
+ "block-buffer",
  "crypto-common",
 ]
 
@@ -1170,47 +1007,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
 
-[[package]]
-name = "dunce"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
-
-[[package]]
-name = "ecdsa"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43ee23aa5b4f68c7a092b5c3beb25f50c406adc75e2363634f242f28ab255372"
-dependencies = [
- "der",
- "elliptic-curve",
- "hmac",
- "signature",
-]
-
-[[package]]
-name = "ed25519"
-version = "1.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91cff35c70bba8a626e3185d8cd48cc11b5437e1a5bcd15b9b5fa3c64b6dfee7"
-dependencies = [
- "signature",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c762bae6dcaf24c4c84667b8579785430908723d5c889f469d76a41d59cc7a9d"
-dependencies = [
- "curve25519-dalek",
- "ed25519",
- "rand 0.7.3",
- "serde",
- "sha2 0.9.9",
- "zeroize",
-]
-
 [[package]]
 name = "egg"
 version = "0.6.0"
@@ -1227,25 +1023,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
-
-[[package]]
-name = "elliptic-curve"
-version = "0.10.6"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beca177dcb8eb540133e7680baff45e7cc4d93bf22002676cec549f82343721b"
-dependencies = [
- "crypto-bigint",
- "ff",
- "generic-array",
- "group",
- "pkcs8",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "encode_unicode"
@@ -1296,9 +1076,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "6b30f669a7961ef1631673d2766cc92f52d64f7ef354d4fe0ddfd30ed52f0f4f"
 dependencies = [
  "errno-dragonfly",
  "libc",
@@ -1346,20 +1126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b0377f1edc77dbd1118507bc7a66e4ab64d2b90c66f90726dc801e73a8c68f9"
 dependencies = [
  "cfg-if",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "ff"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f40b2dcd8bc322217a5f6559ae5f9e9d1de202a2ecee2e9eafcbece7562a4f"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "file-per-thread-logger"
 version = "0.2.0"
@@ -1382,13 +1152,13 @@ dependencies = [
 
 [[package]]
 name = "filetime"
-version = "0.2.21"
+version = "0.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cbc844cecaee9d4443931972e1289c8ff485cb4cc2767cb03ca139ed6885153"
+checksum = "d4029edd3e734da6fe05b6cd7bd2960760a616bd2ddd0d59a0124746d6272af0"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.2.16",
+ "redox_syscall 0.3.5",
  "windows-sys 0.48.0",
 ]
 
@@ -1420,7 +1190,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd738b84894214045e8414eaded76359b4a5773f0a0a56b16575110739cdcf39"
 dependencies = [
  "io-lifetimes 2.0.2",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -1436,9 +1206,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.27"
+version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531ac96c6ff5fd7c62263c5e3c67a603af4fcaee2e1a0ae5565ba3a11e69e549"
+checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1510,7 +1280,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "debugid",
  "fxhash",
  "serde",
@@ -1527,17 +1297,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "getrandom"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.10"
@@ -1546,17 +1305,7 @@ checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "ghash"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1583cc1656d7839fd3732b80cf4f38850336cdb9b8ded1cd399ca62958de3c99"
-dependencies = [
- "opaque-debug",
- "polyval",
+ "wasi",
 ]
 
 [[package]]
@@ -1576,17 +1325,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
-[[package]]
-name = "group"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c363a5301b8f153d80747126a04b3c82073b9fe3130571a9d170cacdeaf7912"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "h2"
 version = "0.3.20"
@@ -1657,26 +1395,6 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
-[[package]]
-name = "hkdf"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01706d578d5c281058480e673ae4086a9f4710d8df1ad80a5b03e39ece5f886b"
-dependencies = [
- "digest 0.9.0",
- "hmac",
-]
-
-[[package]]
-name = "hmac"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
-dependencies = [
- "crypto-mac",
- "digest 0.9.0",
-]
-
 [[package]]
 name = "http"
 version = "0.2.9"
@@ -1784,7 +1502,6 @@ checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
  "hashbrown 0.12.3",
- "serde",
 ]
 
 [[package]]
@@ -1865,7 +1582,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi 0.3.2",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -1905,9 +1622,9 @@ checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "ittapi"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e648c437172ce7d3ac35ca11a068755072054826fa455a916b43524fa4a62a7"
+checksum = "41e0d0b7b3b53d92a7e8b80ede3400112a6b8b4c98d1f5b8b16bb787c780582c"
 dependencies = [
  "anyhow",
  "ittapi-sys",
@@ -1916,9 +1633,9 @@ dependencies = [
 
 [[package]]
 name = "ittapi-sys"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9b32a4d23f72548178dde54f3c12c6b6a08598e25575c0d0fa5bd861e0dc1a5"
+checksum = "f2f8763c96e54e6d6a0dccc2990d8b5e33e3313aaeae6185921a3f4c1614a77c"
 dependencies = [
  "cc",
 ]
@@ -1941,26 +1658,11 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "k256"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "903ae2481bcdfdb7b68e0a9baa4b7c9aff600b9ae2e8e5bb5833b8c91ab851ea"
-dependencies = [
- "cfg-if",
- "ecdsa",
- "elliptic-curve",
- "sha2 0.9.9",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-dependencies = [
- "spin 0.5.2",
-]
 
 [[package]]
 name = "leb128"
@@ -1976,9 +1678,9 @@ checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "libfuzzer-sys"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beb09950ae85a0a94b27676cccf37da5ff13f27076aa1adbc6545dd0d0e1bd4e"
+checksum = "a96cfd5557eb82f2b83fed4955246c988d331975a002961b07c81584d107e7f7"
 dependencies = [
  "arbitrary",
  "cc",
@@ -2009,9 +1711,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.3"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
+checksum = "57bcfdad1b858c2db7c38303a6d2ad4dfaf5eb53dfeb0910128b2c26d6158503"
 
 [[package]]
 name = "listenfd"
@@ -2024,16 +1726,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "lock_api"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
 [[package]]
 name = "log"
 version = "0.4.19"
@@ -2113,49 +1805,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "num-bigint-dig"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9bc3e36fd683e004fd59c64a425e0e991616f5a8b617c3b9a933a93c168facc"
-dependencies = [
- "byteorder",
- "lazy_static",
- "libm",
- "num-integer",
- "num-iter",
- "num-traits",
- "rand 0.8.5",
- "serde",
- "smallvec",
- "zeroize",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
-dependencies = [
- "autocfg",
- "num-traits",
-]
-
-[[package]]
-name = "num-iter"
-version = "0.1.43"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.16"
@@ -2235,12 +1888,6 @@ version = "11.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
-
 [[package]]
 name = "openvino"
 version = "0.5.0"
@@ -2274,57 +1921,12 @@ dependencies = [
  "pretty_env_logger 0.4.0",
 ]
 
-[[package]]
-name = "p256"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d053368e1bae4c8a672953397bd1bd7183dde1c72b0b7612a15719173148d186"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "sha2 0.9.9",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall 0.2.16",
- "smallvec",
- "winapi",
-]
-
 [[package]]
 name = "paste"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
 
-[[package]]
-name = "pem-rfc7468"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84e93a3b1cc0510b03020f33f21e62acdde3dcaef432edc95bea377fbd4c2cd4"
-dependencies = [
- "base64ct",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.3.0"
@@ -2333,9 +1935,9 @@ checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.10"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c40d25201921e5ff0c862a505c6557ea88568a4e3ace775ab55e93f2f4f9d57"
+checksum = "12cc1b0bf1727a77a54b6654e7b5f1af8604923edc8b81885f8ec92f9e3f0a05"
 
 [[package]]
 name = "pin-utils"
@@ -2343,30 +1945,6 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
-[[package]]
-name = "pkcs1"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "116bee8279d783c0cf370efa1a94632f2108e5ef0bb32df31f051647810a4e2c"
-dependencies = [
- "der",
- "pem-rfc7468",
- "zeroize",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee3ef9b64d26bad0536099c816c6734379e45bbd5f14798def6809e5cc350447"
-dependencies = [
- "der",
- "pem-rfc7468",
- "pkcs1",
- "spki",
- "zeroize",
-]
-
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@@ -2401,76 +1979,12 @@ dependencies = [
  "plotters-backend",
 ]
 
-[[package]]
-name = "poly1305"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "048aeb476be11a4b6ca432ca569e375810de9294ae78f4774e78ea98a9246ede"
-dependencies = [
- "cpufeatures",
- "opaque-debug",
- "universal-hash",
-]
-
-[[package]]
-name = "polyval"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8419d2b623c7c0896ff2d5d96e2cb4ede590fed28fcc34934f4c33c036e620a1"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
-[[package]]
-name = "pqcrypto"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9da39bd0587bff4189521766c34f3203263926f7527906578a96d22a81a700d5"
-dependencies = [
- "pqcrypto-kyber",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-internals"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0127cbc0239f585139a56effd7867921eae3425a000a72dde2b0a156062346b2"
-dependencies = [
- "cc",
- "dunce",
- "getrandom 0.2.10",
- "libc",
-]
-
-[[package]]
-name = "pqcrypto-kyber"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe9d9695c19e525d5366c913562a331fbeef9a2ad801d9a9ded61a0e4c2fe0fb"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-traits"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97e91cb6af081c6daad5fa705f8adb0634c027662052cb3174bdf2957bf07e25"
-
 [[package]]
 name = "pretty_env_logger"
 version = "0.4.0"
@@ -2511,8 +2025,8 @@ dependencies = [
  "byteorder",
  "lazy_static",
  "num-traits",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
+ "rand",
+ "rand_chacha",
  "rand_xorshift",
  "regex-syntax 0.6.29",
  "rusty-fork",
@@ -2529,17 +2043,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "pulldown-cmark"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffade02495f22453cd593159ea2f59827aae7f53fa8323f756799b670881dcf8"
-dependencies = [
- "bitflags 1.3.2",
- "memchr",
- "unicase",
-]
-
 [[package]]
 name = "pulldown-cmark"
 version = "0.9.3"
@@ -2559,26 +2062,13 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.31"
+version = "1.0.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fe8a65d69dd0808184ebb5f836ab526bb259db23c657efa38711b1072ee47f0"
+checksum = "50f3b39ccfb720540debaa0164757101c08ecb8d326b15358ce76a62c7e85965"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -2586,18 +2076,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -2607,16 +2087,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
+ "rand_core",
 ]
 
 [[package]]
@@ -2625,16 +2096,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.10",
-]
-
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
+ "getrandom",
 ]
 
 [[package]]
@@ -2643,15 +2105,9 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
-[[package]]
-name = "rawbytes"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04d0088f16afb86d12c7f239d8de4637fa68ecc99a3db227e1ab58a294713e60"
-
 [[package]]
 name = "rayon"
 version = "1.7.0"
@@ -2705,7 +2161,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
- "getrandom 0.2.10",
+ "getrandom",
  "redox_syscall 0.2.16",
  "thiserror",
 ]
@@ -2726,13 +2182,13 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.3.3",
+ "regex-automata 0.3.6",
  "regex-syntax 0.7.4",
 ]
 
@@ -2747,9 +2203,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.3"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39354c10dd07468c2e73926b23bb9c2caca74c5501e38a35da70406f1d923310"
+checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2795,27 +2251,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "rsa"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c2603e2823634ab331437001b411b9ed11660fbc4066f3908c84a9439260d"
-dependencies = [
- "byteorder",
- "digest 0.9.0",
- "lazy_static",
- "num-bigint-dig",
- "num-integer",
- "num-iter",
- "num-traits",
- "pkcs1",
- "pkcs8",
- "rand 0.8.5",
- "serde",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@@ -2844,28 +2279,28 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.4"
+version = "0.38.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a962918ea88d644592894bc6dc55acc6c0956488adcebbfb6e273506b7fd6e5"
+checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "errno",
  "itoa",
  "libc",
- "linux-raw-sys 0.4.3",
+ "linux-raw-sys 0.4.5",
  "once_cell",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.21.5"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79ea77c539259495ce8ca47f53e66ae0330a8819f67e23ac96ca02f50e7b7d36"
+checksum = "07180898a28ed6a7f7ba2311594308f595e3dd2e3c3812fa0a80a47b45f17e5d"
 dependencies = [
  "log",
  "ring",
- "rustls-webpki 0.101.1",
+ "rustls-webpki",
  "sct",
 ]
 
@@ -2879,16 +2314,6 @@ dependencies = [
  "untrusted",
 ]
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f36a6828982f422756984e47912a7a51dcbc2a197aa791158f8ca61cd8204e"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "rusty-fork"
 version = "0.3.0"
@@ -2943,48 +2368,35 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.174"
+version = "1.0.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b88756493a5bd5e5395d53baa70b194b05764ab85b59e43e4b8f4e1192fa9b1"
+checksum = "32ac8da02677876d532745a130fc9d8e6edfa81a269b107c5b00829b91d8eb3c"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.174"
+version = "1.0.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e5c3a298c7f978e53536f95a63bdc4c4a64550582f31a0359a9afda6aede62e"
+checksum = "aafe972d60b0b9bee71a91b92fee2d4fb3c9d7e8f6b179aa99f27203d99a4816"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d03b412469450d4404fe8499a268edd7f8b79fecb074b0d812ad64ca21f4031b"
+checksum = "076066c5f1078eac5b722a31827a8832fe108bed65dfa75e233c89f8206e976c"
 dependencies = [
  "itoa",
  "ryu",
  "serde",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
-dependencies = [
- "block-buffer 0.9.0",
- "cfg-if",
- "cpufeatures",
- "digest 0.9.0",
- "opaque-debug",
-]
-
 [[package]]
 name = "sha2"
 version = "0.10.7"
@@ -2993,7 +2405,7 @@ checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -3022,20 +2434,10 @@ checksum = "4ee9977fa98489d9006f4ab26fc5cbe2a139985baed09d2ec08dee6e506fc496"
 dependencies = [
  "cfg-if",
  "libc",
- "rand 0.8.5",
+ "rand",
  "winapi",
 ]
 
-[[package]]
-name = "signature"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2807892cfa58e081aa1f1111391c7a0649d4fa127a4ffbe34bcbfb35a1171a4"
-dependencies = [
- "digest 0.9.0",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "similar"
 version = "2.2.1"
@@ -3068,12 +2470,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+checksum = "2538b18701741680e0322a2302176d3253a35388e2e62f172f64f4f16605f877"
 dependencies = [
  "libc",
- "winapi",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -3106,15 +2508,6 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
-[[package]]
-name = "spki"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c01a0c15da1b0b0e1494112e7af814a678fec9bd157881b49beac661e9b6f32"
-dependencies = [
- "der",
-]
-
 [[package]]
 name = "sptr"
 version = "0.3.2"
@@ -3139,12 +2532,6 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
-[[package]]
-name = "subtle"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
-
 [[package]]
 name = "symbolic_expressions"
 version = "5.0.3"
@@ -3164,9 +2551,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.27"
+version = "2.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b60f673f44a8255b9c8c657daf66a596d435f2da81a555b06dc644d080ba45e0"
+checksum = "04361975b3f5e348b2189d8dc55bc942f278b2d482a6a0365de5bdd62d351567"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3179,32 +2566,32 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27ce32341b2c0b70c144bbf35627fdc1ef18c76ced5e5e7b3ee8b5ba6b2ab6a0"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "cap-fs-ext",
  "cap-std",
  "fd-lock",
  "io-lifetimes 2.0.2",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
  "winx",
 ]
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.10"
+version = "0.12.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2faeef5759ab89935255b1a4cd98e0baf99d1085e37d36599c625dac49ae8e"
+checksum = "9d0e916b1148c8e263850e1ebcbd046f333e0683c724876bb0da63ea4373dc8a"
 
 [[package]]
 name = "tempfile"
-version = "3.7.0"
+version = "3.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5486094ee78b2e5038a6382ed7645bc084dc2ec433426ca4c3cb61e2007b8998"
+checksum = "dc02fddf48964c42031a0b3fe0428320ecf3a73c401040fc0096f97794310651"
 dependencies = [
  "cfg-if",
  "fastrand",
  "redox_syscall 0.3.5",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -3273,7 +2660,7 @@ checksum = "090198534930841fab3a5d1bb637cde49e339654e606195f8d9c76eeb081dc96"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -3313,11 +2700,10 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.29.1"
+version = "1.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "532826ff75199d5833b9d2c5fe410f29235e25704ee5f0ef599fb51c21f4a4da"
+checksum = "2d3ce25f50619af8b0aec2eb23deebe84249e19e2ddd393a6e16e3300a6dadfd"
 dependencies = [
- "autocfg",
  "backtrace",
  "bytes",
  "libc",
@@ -3337,7 +2723,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -3394,7 +2780,7 @@ checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -3487,16 +2873,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
-[[package]]
-name = "universal-hash"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f214e8f697e925001e66ec2c6e37a4ef93f0f78c2eed7814394e10c62025b05"
-dependencies = [
- "generic-array",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.7.1"
@@ -3526,14 +2902,14 @@ version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79daa5ed5740825c40b389c5e50312b9c86df53fccd33f281df655642b43869d"
 dependencies = [
- "getrandom 0.2.10",
+ "getrandom",
 ]
 
 [[package]]
 name = "v8"
-version = "0.74.2"
+version = "0.74.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7568bf38565bd5b350d96abbf3d09417e8c9dd74fbb38860e91b759e46f9009c"
+checksum = "2eedac634b8dd39b889c5b62349cbc55913780226239166435c5cf66771792ea"
 dependencies = [
  "bitflags 1.3.2",
  "fslock",
@@ -3543,7 +2919,7 @@ dependencies = [
 
 [[package]]
 name = "verify-component-adapter"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "wasmparser 0.92.0",
@@ -3584,12 +2960,6 @@ dependencies = [
  "try-lock",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -3598,7 +2968,7 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasi-cap-std-sync"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3611,7 +2981,7 @@ dependencies = [
  "io-lifetimes 2.0.2",
  "is-terminal",
  "once_cell",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "system-interface",
  "tempfile",
  "tracing",
@@ -3621,15 +2991,15 @@ dependencies = [
 
 [[package]]
 name = "wasi-common"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "cap-rand",
  "cap-std",
  "io-extras",
  "log",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "thiserror",
  "tracing",
  "wasmtime",
@@ -3637,35 +3007,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "wasi-crypto"
-version = "0.1.5"
-dependencies = [
- "aes-gcm",
- "anyhow",
- "bincode",
- "byteorder",
- "chacha20poly1305",
- "curve25519-dalek",
- "derivative",
- "ed25519-dalek",
- "hkdf",
- "hmac",
- "k256",
- "p256",
- "parking_lot",
- "pqcrypto",
- "rand_core 0.5.1",
- "rand_core 0.6.4",
- "rsa",
- "serde",
- "sha2 0.9.9",
- "subtle",
- "thiserror",
- "xoodyak",
- "zeroize",
-]
-
 [[package]]
 name = "wasi-http-tests"
 version = "0.0.0"
@@ -3676,11 +3017,11 @@ dependencies = [
 
 [[package]]
 name = "wasi-preview1-component-adapter"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "byte-array-literals",
  "object",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "wasm-encoder 0.31.1 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
  "wit-bindgen",
 ]
@@ -3691,19 +3032,19 @@ version = "0.0.0"
 dependencies = [
  "libc",
  "once_cell",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
 ]
 
 [[package]]
 name = "wasi-tokio"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cap-std",
  "cap-tempfile",
  "io-extras",
  "io-lifetimes 2.0.2",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "tempfile",
  "tokio",
  "wasi-cap-std-sync",
@@ -3732,7 +3073,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
  "wasm-bindgen-shared",
 ]
 
@@ -3754,7 +3095,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3767,9 +3108,9 @@ checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "wasm-encoder"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18c41dbd92eaebf3612a39be316540b8377c871cb9bde6b064af962984912881"
+checksum = "b2f8e9778e04cbf44f58acc301372577375a666b966c50b03ef46144f80436a8"
 dependencies = [
  "leb128",
 ]
@@ -3793,15 +3134,17 @@ dependencies = [
 
 [[package]]
 name = "wasm-metadata"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36e5156581ff4a302405c44ca7c85347563ca431d15f1a773f12c9c7b9a6cdc9"
+checksum = "d51db59397fc650b5f2fc778e4a5c4456cd856bed7fc1ec15f8d3e28229dc463"
 dependencies = [
  "anyhow",
- "indexmap 1.9.3",
+ "indexmap 2.0.0",
  "serde",
- "wasm-encoder 0.29.0",
- "wasmparser 0.107.0",
+ "serde_json",
+ "spdx",
+ "wasm-encoder 0.30.0",
+ "wasmparser 0.108.0",
 ]
 
 [[package]]
@@ -3825,7 +3168,7 @@ source = "git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0
 dependencies = [
  "egg",
  "log",
- "rand 0.8.5",
+ "rand",
  "thiserror",
  "wasm-encoder 0.31.1 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
  "wasmparser 0.110.0",
@@ -3893,11 +3236,11 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.107.0"
+version = "0.108.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29e3ac9b780c7dda0cac7a52a5d6d2d6707cc6e3451c9db209b6c758f40d7acb"
+checksum = "76c956109dcb41436a39391139d9b6e2d0a5e0b158e1293ef352ec977e5e36c5"
 dependencies = [
- "indexmap 1.9.3",
+ "indexmap 2.0.0",
  "semver",
 ]
 
@@ -3930,7 +3273,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3971,14 +3314,14 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-asm-macros"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "wasmtime-bench-api"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cap-std",
@@ -3989,14 +3332,13 @@ dependencies = [
  "wasmtime",
  "wasmtime-cli-flags",
  "wasmtime-wasi",
- "wasmtime-wasi-crypto",
  "wasmtime-wasi-nn",
  "wat 1.0.69 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
 ]
 
 [[package]]
 name = "wasmtime-c-api"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cap-std",
@@ -4020,7 +3362,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cache"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -4031,9 +3373,9 @@ dependencies = [
  "log",
  "once_cell",
  "pretty_env_logger 0.5.0",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "serde",
- "sha2 0.10.7",
+ "sha2",
  "tempfile",
  "toml",
  "windows-sys 0.48.0",
@@ -4042,7 +3384,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cli"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -4061,7 +3403,7 @@ dependencies = [
  "num_cpus",
  "once_cell",
  "rayon",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "serde",
  "serde_json",
  "target-lexicon",
@@ -4080,7 +3422,6 @@ dependencies = [
  "wasmtime-explorer",
  "wasmtime-runtime",
  "wasmtime-wasi",
- "wasmtime-wasi-crypto",
  "wasmtime-wasi-http",
  "wasmtime-wasi-nn",
  "wasmtime-wasi-threads",
@@ -4092,7 +3433,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cli-flags"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -4104,27 +3445,27 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-component-macro"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "component-macro-test-helpers",
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
  "tracing",
  "wasmtime",
  "wasmtime-component-util",
  "wasmtime-wit-bindgen",
- "wit-parser 0.9.2",
+ "wit-parser 0.9.2 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
 ]
 
 [[package]]
 name = "wasmtime-component-util"
-version = "12.0.0"
+version = "13.0.0"
 
 [[package]]
 name = "wasmtime-cranelift"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -4146,7 +3487,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cranelift-shared"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -4160,7 +3501,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "atty",
@@ -4198,7 +3539,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-explorer"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "capstone",
@@ -4211,12 +3552,12 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-fiber"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "backtrace",
  "cc",
  "cfg-if",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "wasmtime-asm-macros",
  "wasmtime-versioned-export-macros",
  "windows-sys 0.48.0",
@@ -4224,12 +3565,12 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-fibre"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "backtrace",
  "cc",
  "cfg-if",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "wasmtime-asm-macros",
  "windows-sys 0.48.0",
 ]
@@ -4254,7 +3595,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "rand 0.8.5",
+ "rand",
  "smallvec",
  "target-lexicon",
  "wasmparser 0.110.0",
@@ -4272,7 +3613,7 @@ dependencies = [
  "component-test-util",
  "env_logger 0.10.0",
  "log",
- "rand 0.8.5",
+ "rand",
  "rayon",
  "target-lexicon",
  "tempfile",
@@ -4291,7 +3632,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-jit"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "addr2line",
  "anyhow",
@@ -4303,7 +3644,7 @@ dependencies = [
  "log",
  "object",
  "rustc-demangle",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "serde",
  "target-lexicon",
  "wasmtime-environ",
@@ -4315,17 +3656,17 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-jit-debug"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "object",
  "once_cell",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "wasmtime-versioned-export-macros",
 ]
 
 [[package]]
 name = "wasmtime-jit-icache-coherence"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "cfg-if",
  "libc",
@@ -4334,7 +3675,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-runtime"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cc",
@@ -4348,8 +3689,8 @@ dependencies = [
  "memoffset",
  "once_cell",
  "paste",
- "rand 0.8.5",
- "rustix 0.38.4",
+ "rand",
+ "rustix 0.38.8",
  "sptr",
  "wasm-encoder 0.31.1 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
  "wasmtime-asm-macros",
@@ -4363,7 +3704,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-types"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "cranelift-entity",
  "serde",
@@ -4373,20 +3714,20 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-versioned-export-macros"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
 name = "wasmtime-wasi"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "bytes",
  "cap-fs-ext",
  "cap-rand",
@@ -4397,7 +3738,7 @@ dependencies = [
  "io-extras",
  "libc",
  "once_cell",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "system-interface",
  "thiserror",
  "tokio",
@@ -4410,19 +3751,9 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "wasmtime-wasi-crypto"
-version = "12.0.0"
-dependencies = [
- "anyhow",
- "wasi-crypto",
- "wasmtime",
- "wiggle",
-]
-
 [[package]]
 name = "wasmtime-wasi-http"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -4440,7 +3771,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-nn"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "openvino",
@@ -4451,11 +3782,11 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-threads"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "log",
- "rand 0.8.5",
+ "rand",
  "wasi-common",
  "wasmtime",
  "wasmtime-wasi",
@@ -4463,7 +3794,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wast"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "log",
@@ -4473,7 +3804,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-winch"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -4488,11 +3819,12 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wit-bindgen"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "heck",
- "wit-parser 0.9.2",
+ "indexmap 2.0.0",
+ "wit-parser 0.9.2 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
 ]
 
 [[package]]
@@ -4560,7 +3892,7 @@ version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b03058f88386e5ff5310d9111d53f48b17d732b401aeb83a8d5190f2ac459338"
 dependencies = [
- "rustls-webpki 0.100.1",
+ "rustls-webpki",
 ]
 
 [[package]]
@@ -4576,11 +3908,11 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "proptest",
  "thiserror",
  "tokio",
@@ -4593,24 +3925,24 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "anyhow",
  "heck",
  "proc-macro2",
  "quote",
  "shellexpand",
- "syn 2.0.27",
+ "syn 2.0.28",
  "witx",
 ]
 
 [[package]]
 name = "wiggle-macro"
-version = "12.0.0"
+version = "13.0.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
  "wiggle",
  "wiggle-generate",
 ]
@@ -4661,7 +3993,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -4697,7 +4029,7 @@ dependencies = [
  "glob",
  "proc-macro2",
  "quote",
- "syn 2.0.27",
+ "syn 2.0.28",
 ]
 
 [[package]]
@@ -4859,49 +4191,49 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4857cedf8371f690bb6782a3e2b065c54d1b6661be068aaf3eac8b45e813fdf8"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "wit-bindgen"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a628591b3905328e886462f75de3b2af1e546b19af5f4c359086b26bec29c4bd"
+checksum = "f5c3d15a04ce994fad2c5442a754b404ab1fee23c903a04a560f84f94fdf63c0"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "wit-bindgen-rust-macro",
 ]
 
 [[package]]
 name = "wit-bindgen-core"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34a19aa69c4f33cb5ac10e55880a899f4d52ec85d4cde4d593b575e7a97e2b08"
+checksum = "c9658ec54d4a3c9e2f079bc65a131093337595b595fbf82f805008469838cdea"
 dependencies = [
  "anyhow",
- "wit-component 0.11.0",
- "wit-parser 0.8.0",
+ "wit-component 0.12.0",
+ "wit-parser 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
 name = "wit-bindgen-rust"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a50274c0cf2f8e33fc967825cef0114cdfe222d474c1d78aa77a6a801abaadf"
+checksum = "21ae6a6198ba9765771b977e2af985a0d5ac71b59f999da5c4ee1c7bbd8ca8dc"
 dependencies = [
  "heck",
- "wasm-metadata 0.8.0",
+ "wasm-metadata 0.9.0",
  "wit-bindgen-core",
  "wit-bindgen-rust-lib",
- "wit-component 0.11.0",
+ "wit-component 0.12.0",
 ]
 
 [[package]]
 name = "wit-bindgen-rust-lib"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d3d58b5ced269f1a1cdcecfe0317c059fe158da9b670fff9907903b244bb89a"
+checksum = "5c31de8c6c77cac1fd4927c7584d1314cd5e838cfb40b53333d6dffc7a132dda"
 dependencies = [
  "heck",
  "wit-bindgen-core",
@@ -4909,32 +4241,33 @@ dependencies = [
 
 [[package]]
 name = "wit-bindgen-rust-macro"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78cce32dd08007af45dbaa00e225eb73d05524096f93933d7ecba852d50d8af3"
+checksum = "0a2abe5c7c4c08468d01590aa96c8a684dd94fb9241a248af88eef7edac61e43"
 dependencies = [
  "anyhow",
  "proc-macro2",
- "syn 2.0.27",
+ "syn 2.0.28",
  "wit-bindgen-core",
  "wit-bindgen-rust",
- "wit-component 0.11.0",
+ "wit-bindgen-rust-lib",
+ "wit-component 0.12.0",
 ]
 
 [[package]]
 name = "wit-component"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cbd4c7f8f400327c482c88571f373844b7889e61460650d650fc5881bb3575c"
+checksum = "253bd426c532f1cae8c633c517c63719920535f3a7fada3589de40c5b734e393"
 dependencies = [
  "anyhow",
  "bitflags 1.3.2",
- "indexmap 1.9.3",
+ "indexmap 2.0.0",
  "log",
- "wasm-encoder 0.29.0",
- "wasm-metadata 0.8.0",
- "wasmparser 0.107.0",
- "wit-parser 0.8.0",
+ "wasm-encoder 0.30.0",
+ "wasm-metadata 0.9.0",
+ "wasmparser 0.108.0",
+ "wit-parser 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
@@ -4943,26 +4276,26 @@ version = "0.13.1"
 source = "git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38#83ec1b60e01048abbc4a6783dd90847857877013"
 dependencies = [
  "anyhow",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "indexmap 2.0.0",
  "log",
  "wasm-encoder 0.31.1 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
  "wasm-metadata 0.10.1",
  "wasmparser 0.110.0",
- "wit-parser 0.9.2",
+ "wit-parser 0.9.2 (git+https://github.com/effect-handlers/wasm-tools?tag=wasmfx-tools-1.0.38)",
 ]
 
 [[package]]
 name = "wit-parser"
-version = "0.8.0"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6daec9f093dbaea0e94043eeb92ece327bbbe70c86b1f41aca9bbfefd7f050f0"
+checksum = "541efa2046e544de53a9da1e2f6299e63079840360c9e106f1f8275a97771318"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 1.9.3",
+ "indexmap 2.0.0",
  "log",
- "pulldown-cmark 0.8.0",
+ "pulldown-cmark",
  "semver",
  "unicode-xid",
  "url",
@@ -4977,7 +4310,7 @@ dependencies = [
  "id-arena",
  "indexmap 2.0.0",
  "log",
- "pulldown-cmark 0.9.3",
+ "pulldown-cmark",
  "semver",
  "unicode-xid",
  "url",
@@ -4994,36 +4327,6 @@ dependencies = [
  "wast 35.0.2",
 ]
 
-[[package]]
-name = "xoodyak"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b52dbbb9ca4862dcd5e33383af1610db2f28d081e0803e3a3b2bbdfab5eeed"
-dependencies = [
- "rawbytes",
- "zeroize",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d68d9dcec5f9b43a30d38c49f91dfedfaac384cb8f085faca366c26207dd1619"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.27",
-]
-
 [[package]]
 name = "zstd"
 version = "0.11.2+zstd.1.5.2"
diff --git a/Cargo.toml b/Cargo.toml
index 6fd58bdd141c..2db9e65944db 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,7 +30,6 @@ wasmtime-environ = { workspace = true }
 wasmtime-explorer = { workspace = true }
 wasmtime-wast = { workspace = true }
 wasmtime-wasi = { workspace = true, features = ["exit"] }
-wasmtime-wasi-crypto = { workspace = true, optional = true }
 wasmtime-wasi-nn = { workspace = true, optional = true }
 wasmtime-wasi-threads = { workspace = true, optional = true }
 wasmtime-wasi-http = { workspace = true, optional = true }
@@ -117,65 +116,64 @@ exclude = [
 ]
 
 [workspace.package]
-version = "12.0.0"
+version = "13.0.0"
 authors = ["The Wasmtime Project Developers"]
 edition = "2021"
 rust-version = "1.66.0"
 
 [workspace.dependencies]
-wasmtime = { path = "crates/wasmtime", version = "12.0.0", default-features = false }
-wasmtime-cache = { path = "crates/cache", version = "=12.0.0" }
-wasmtime-cli-flags = { path = "crates/cli-flags", version = "=12.0.0" }
-wasmtime-cranelift = { path = "crates/cranelift", version = "=12.0.0" }
-wasmtime-cranelift-shared = { path = "crates/cranelift-shared", version = "=12.0.0" }
-wasmtime-winch = { path = "crates/winch", version = "=12.0.0" }
-wasmtime-environ = { path = "crates/environ", version = "=12.0.0" }
-wasmtime-explorer = { path = "crates/explorer", version = "=12.0.0" }
-wasmtime-fiber = { path = "crates/fiber", version = "=12.0.0" }
-wasmtime-fibre = { path = "crates/fibre", version = "=12.0.0" }
-wasmtime-types = { path = "crates/types", version = "12.0.0" }
-wasmtime-jit = { path = "crates/jit", version = "=12.0.0" }
-wasmtime-jit-debug = { path = "crates/jit-debug", version = "=12.0.0" }
-wasmtime-runtime = { path = "crates/runtime", version = "=12.0.0" }
-wasmtime-wast = { path = "crates/wast", version = "=12.0.0" }
-wasmtime-wasi = { path = "crates/wasi", version = "12.0.0" }
-wasmtime-wasi-crypto = { path = "crates/wasi-crypto", version = "12.0.0" }
-wasmtime-wasi-http = { path = "crates/wasi-http", version = "=12.0.0" }
-wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "12.0.0" }
-wasmtime-wasi-threads = { path = "crates/wasi-threads", version = "12.0.0" }
-wasmtime-component-util = { path = "crates/component-util", version = "=12.0.0" }
-wasmtime-component-macro = { path = "crates/component-macro", version = "=12.0.0" }
-wasmtime-asm-macros = { path = "crates/asm-macros", version = "=12.0.0" }
-wasmtime-versioned-export-macros = { path = "crates/versioned-export-macros", version = "=12.0.0" }
+wasmtime = { path = "crates/wasmtime", version = "13.0.0", default-features = false }
+wasmtime-cache = { path = "crates/cache", version = "=13.0.0" }
+wasmtime-cli-flags = { path = "crates/cli-flags", version = "=13.0.0" }
+wasmtime-cranelift = { path = "crates/cranelift", version = "=13.0.0" }
+wasmtime-cranelift-shared = { path = "crates/cranelift-shared", version = "=13.0.0" }
+wasmtime-winch = { path = "crates/winch", version = "=13.0.0" }
+wasmtime-environ = { path = "crates/environ", version = "=13.0.0" }
+wasmtime-explorer = { path = "crates/explorer", version = "=13.0.0" }
+wasmtime-fiber = { path = "crates/fiber", version = "=13.0.0" }
+wasmtime-fibre = { path = "crates/fibre", version = "=13.0.0" }
+wasmtime-types = { path = "crates/types", version = "13.0.0" }
+wasmtime-jit = { path = "crates/jit", version = "=13.0.0" }
+wasmtime-jit-debug = { path = "crates/jit-debug", version = "=13.0.0" }
+wasmtime-runtime = { path = "crates/runtime", version = "=13.0.0" }
+wasmtime-wast = { path = "crates/wast", version = "=13.0.0" }
+wasmtime-wasi = { path = "crates/wasi", version = "13.0.0" }
+wasmtime-wasi-http = { path = "crates/wasi-http", version = "=13.0.0" }
+wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "13.0.0" }
+wasmtime-wasi-threads = { path = "crates/wasi-threads", version = "13.0.0" }
+wasmtime-component-util = { path = "crates/component-util", version = "=13.0.0" }
+wasmtime-component-macro = { path = "crates/component-macro", version = "=13.0.0" }
+wasmtime-asm-macros = { path = "crates/asm-macros", version = "=13.0.0" }
+wasmtime-versioned-export-macros = { path = "crates/versioned-export-macros", version = "=13.0.0" }
 component-test-util = { path = "crates/misc/component-test-util" }
 component-fuzz-util = { path = "crates/misc/component-fuzz-util" }
-wiggle = { path = "crates/wiggle", version = "=12.0.0", default-features = false }
-wiggle-macro = { path = "crates/wiggle/macro", version = "=12.0.0" }
-wiggle-generate = { path = "crates/wiggle/generate", version = "=12.0.0" }
-wasi-common = { path = "crates/wasi-common", version = "=12.0.0" }
-wasi-tokio = { path = "crates/wasi-common/tokio", version = "=12.0.0" }
-wasi-cap-std-sync = { path = "crates/wasi-common/cap-std-sync", version = "=12.0.0" }
+wiggle = { path = "crates/wiggle", version = "=13.0.0", default-features = false }
+wiggle-macro = { path = "crates/wiggle/macro", version = "=13.0.0" }
+wiggle-generate = { path = "crates/wiggle/generate", version = "=13.0.0" }
+wasi-common = { path = "crates/wasi-common", version = "=13.0.0" }
+wasi-tokio = { path = "crates/wasi-common/tokio", version = "=13.0.0" }
+wasi-cap-std-sync = { path = "crates/wasi-common/cap-std-sync", version = "=13.0.0" }
 wasmtime-fuzzing = { path = "crates/fuzzing" }
-wasmtime-jit-icache-coherence = { path = "crates/jit-icache-coherence", version = "=12.0.0" }
-wasmtime-wit-bindgen = { path = "crates/wit-bindgen", version = "=12.0.0" }
+wasmtime-jit-icache-coherence = { path = "crates/jit-icache-coherence", version = "=13.0.0" }
+wasmtime-wit-bindgen = { path = "crates/wit-bindgen", version = "=13.0.0" }
 
-cranelift-wasm = { path = "cranelift/wasm", version = "0.99.0" }
-cranelift-codegen = { path = "cranelift/codegen", version = "0.99.0" }
-cranelift-frontend = { path = "cranelift/frontend", version = "0.99.0" }
-cranelift-entity = { path = "cranelift/entity", version = "0.99.0" }
-cranelift-native = { path = "cranelift/native", version = "0.99.0" }
-cranelift-module = { path = "cranelift/module", version = "0.99.0" }
-cranelift-interpreter = { path = "cranelift/interpreter", version = "0.99.0" }
-cranelift-reader = { path = "cranelift/reader", version = "0.99.0" }
+cranelift-wasm = { path = "cranelift/wasm", version = "0.100.0" }
+cranelift-codegen = { path = "cranelift/codegen", version = "0.100.0" }
+cranelift-frontend = { path = "cranelift/frontend", version = "0.100.0" }
+cranelift-entity = { path = "cranelift/entity", version = "0.100.0" }
+cranelift-native = { path = "cranelift/native", version = "0.100.0" }
+cranelift-module = { path = "cranelift/module", version = "0.100.0" }
+cranelift-interpreter = { path = "cranelift/interpreter", version = "0.100.0" }
+cranelift-reader = { path = "cranelift/reader", version = "0.100.0" }
 cranelift-filetests = { path = "cranelift/filetests" }
-cranelift-object = { path = "cranelift/object", version = "0.99.0" }
-cranelift-jit = { path = "cranelift/jit", version = "0.99.0" }
+cranelift-object = { path = "cranelift/object", version = "0.100.0" }
+cranelift-jit = { path = "cranelift/jit", version = "0.100.0" }
 cranelift-fuzzgen = { path = "cranelift/fuzzgen" }
-cranelift-bforest = { path = "cranelift/bforest", version = "0.99.0" }
-cranelift-control = { path = "cranelift/control", version = "0.99.0" }
-cranelift = { path = "cranelift/umbrella", version = "0.99.0" }
+cranelift-bforest = { path = "cranelift/bforest", version = "0.100.0" }
+cranelift-control = { path = "cranelift/control", version = "0.100.0" }
+cranelift = { path = "cranelift/umbrella", version = "0.100.0" }
 
-winch-codegen = { path = "winch/codegen", version = "=0.10.0" }
+winch-codegen = { path = "winch/codegen", version = "=0.11.0" }
 winch-filetests = { path = "winch/filetests" }
 winch-test-macros = { path = "winch/test-macros" }
 
@@ -200,7 +198,7 @@ io-extras = "0.18.0"
 rustix = "0.38.4"
 
 # wit-bindgen:
-wit-bindgen = { version = "0.7.0", default-features = false }
+wit-bindgen = { version = "0.9.0", default-features = false }
 
 # wasm-tools family:
 wasmparser = { git = "https://github.com/effect-handlers/wasm-tools", tag = "wasmfx-tools-1.0.38" }
@@ -263,13 +261,11 @@ default = [
 ]
 jitdump = ["wasmtime/jitdump"]
 vtune = ["wasmtime/vtune"]
-wasi-crypto = ["dep:wasmtime-wasi-crypto"]
 wasi-nn = ["dep:wasmtime-wasi-nn"]
 wasi-threads = ["dep:wasmtime-wasi-threads"]
 wasi-http = ["dep:wasmtime-wasi-http"]
 pooling-allocator = ["wasmtime/pooling-allocator", "wasmtime-cli-flags/pooling-allocator"]
 all-arch = ["wasmtime/all-arch"]
-posix-signals-on-macos = ["wasmtime/posix-signals-on-macos"]
 component-model = [
   "wasmtime/component-model",
   "wasmtime-wast/component-model",
diff --git a/RELEASES.md b/RELEASES.md
index 0ea9bc52c3b2..0df39e52b8c6 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -1,13 +1,83 @@
 --------------------------------------------------------------------------------
 
+## 13.0.0
+
+Unreleased.
+
+### Added
+
+### Changed
+
+--------------------------------------------------------------------------------
+
 ## 12.0.0
 
 Unreleased.
 
 ### Added
 
+* Wasmtime now supports having multiple different versions of itself being
+  linked into the same final executable by mangling some C symbols used by
+  Wasmtime.
+  [#6673](https://github.com/bytecodealliance/wasmtime/pull/6673)
+
+* The `perfmap` profiling option is now supported on any Unix platform instead
+  of just Linux.
+  [#6701](https://github.com/bytecodealliance/wasmtime/pull/6701)
+
+* The `wasmtime` CLI now supports `--env FOO` to inherit the value of the
+  environment variable `FOO` which avoids needing to do `--env FOO=$FOO` for
+  example.
+  [#6746](https://github.com/bytecodealliance/wasmtime/pull/6746)
+
+* Wasmtime now supports component model resources, although support has not yet
+  been added to `bindgen!`.
+  [#6691](https://github.com/bytecodealliance/wasmtime/pull/6691)
+
+* Wasmtime now supports configuration to enable the tail calls proposal.
+  Platform support now also includes AArch64 and RISC-V in addition to the
+  previous x86\_64 support.
+  [#6723](https://github.com/bytecodealliance/wasmtime/pull/6723)
+  [#6749](https://github.com/bytecodealliance/wasmtime/pull/6749)
+  [#6774](https://github.com/bytecodealliance/wasmtime/pull/6774)
+
+* Wasmtime's implementation of WASI Preview 2 now supports streams/pollables
+  with host objects that are all backed by Rust `async`.
+  [#6556](https://github.com/bytecodealliance/wasmtime/pull/6556)
+
+* Support for core dumps has now been added to the `wasmtime` crate.
+  [#6513](https://github.com/bytecodealliance/wasmtime/pull/6513)
+
+* New `{Module,Component}::resources_required` APIs allow inspecting what will
+  be required when instantiating the module or component.
+  [#6789](https://github.com/bytecodealliance/wasmtime/pull/6789)
+
+### Fixed
+
+* Functions on instances defined through `component::Linker::func_new` are now
+  defined correctly.
+  [#6637](https://github.com/bytecodealliance/wasmtime/pull/6637)
+
+* The `async_stack_size` configuration option is no longer inspected when
+  `async_support` is disabled at runtime.
+  [#6771](https://github.com/bytecodealliance/wasmtime/pull/6771)
+
+* WASI Preview 1 APIs will now trap on misaligned or out-of-bounds pointers
+  instead of returning an error.
+  [#6776](https://github.com/bytecodealliance/wasmtime/pull/6776)
+
 ### Changed
 
+* Options to the `wasmtime` CLI for Wasmtime itself must now come before the
+  WebAssembly module. For example `wasmtime run foo.wasm --disable-cache` now
+  must be specified as `wasmtime run --disable-cache foo.wasm`. Any
+  argument/option after the WebAssembly module is now interpreted as an argument
+  to the wasm module itself.
+  [#6737](https://github.com/bytecodealliance/wasmtime/pull/6737)
+
+* Empty types are no longer allowed in the component model.
+  [#6777](https://github.com/bytecodealliance/wasmtime/pull/6777)
+
 --------------------------------------------------------------------------------
 
 ## 11.0.0
diff --git a/benches/wasi.rs b/benches/wasi.rs
index ae8a7c8c171d..41dc25e3bd8a 100644
--- a/benches/wasi.rs
+++ b/benches/wasi.rs
@@ -61,26 +61,29 @@ fn instantiate(wat: &[u8]) -> (Store<WasiCtx>, TypedFunc<u64, u64>) {
 
 /// Build a WASI context with some actual data to retrieve.
 fn wasi_context() -> WasiCtx {
-    let wasi = WasiCtxBuilder::new();
-    wasi.envs(&[
-        ("a".to_string(), "b".to_string()),
-        ("b".to_string(), "c".to_string()),
-        ("c".to_string(), "d".to_string()),
-    ])
-    .unwrap()
-    .args(&[
-        "exe".to_string(),
-        "--flag1".to_string(),
-        "--flag2".to_string(),
-        "--flag3".to_string(),
-        "--flag4".to_string(),
-    ])
-    .unwrap()
-    .preopened_dir(
-        wasmtime_wasi::Dir::open_ambient_dir("benches/wasi", wasmtime_wasi::ambient_authority())
+    WasiCtxBuilder::new()
+        .envs(&[
+            ("a".to_string(), "b".to_string()),
+            ("b".to_string(), "c".to_string()),
+            ("c".to_string(), "d".to_string()),
+        ])
+        .unwrap()
+        .args(&[
+            "exe".to_string(),
+            "--flag1".to_string(),
+            "--flag2".to_string(),
+            "--flag3".to_string(),
+            "--flag4".to_string(),
+        ])
+        .unwrap()
+        .preopened_dir(
+            wasmtime_wasi::Dir::open_ambient_dir(
+                "benches/wasi",
+                wasmtime_wasi::ambient_authority(),
+            )
             .unwrap(),
-        "/",
-    )
-    .unwrap()
-    .build()
+            "/",
+        )
+        .unwrap()
+        .build()
 }
diff --git a/ci/run-tests.sh b/ci/run-tests.sh
index 6d7df3866cb2..4fac7b1cfb09 100755
--- a/ci/run-tests.sh
+++ b/ci/run-tests.sh
@@ -6,7 +6,6 @@ cargo test \
     --features wasi-http \
     --workspace \
     --exclude 'wasmtime-wasi-*' \
-    --exclude wasi-crypto \
     --exclude wasi-tests \
     --exclude command-tests \
     --exclude reactor-tests \
diff --git a/ci/run-wasi-crypto-example.sh b/ci/run-wasi-crypto-example.sh
deleted file mode 100755
index 30bbada3c76a..000000000000
--- a/ci/run-wasi-crypto-example.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#! /bin/bash
-
-set -e
-
-RUST_BINDINGS="crates/wasi-crypto/spec/implementations/bindings/rust"
-pushd "$RUST_BINDINGS"
-cargo build --release --target=wasm32-wasi
-popd
-
-cargo run --features wasi-crypto -- run --wasi-modules=experimental-wasi-crypto "$RUST_BINDINGS/target/wasm32-wasi/release/wasi-crypto-guest.wasm"
diff --git a/cranelift/bforest/Cargo.toml b/cranelift/bforest/Cargo.toml
index 008e295bfb03..ea1453c52fe7 100644
--- a/cranelift/bforest/Cargo.toml
+++ b/cranelift/bforest/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-bforest"
-version = "0.99.0"
+version = "0.100.0"
 description = "A forest of B+-trees"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-bforest"
diff --git a/cranelift/codegen/Cargo.toml b/cranelift/codegen/Cargo.toml
index a0a78ba867c4..15d2a1c6c108 100644
--- a/cranelift/codegen/Cargo.toml
+++ b/cranelift/codegen/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen"
-version = "0.99.0"
+version = "0.100.0"
 description = "Low-level code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-codegen"
@@ -16,7 +16,7 @@ edition.workspace = true
 anyhow = { workspace = true, optional = true }
 bumpalo = "3"
 capstone = { workspace = true, optional = true }
-cranelift-codegen-shared = { path = "./shared", version = "0.99.0" }
+cranelift-codegen-shared = { path = "./shared", version = "0.100.0" }
 cranelift-entity = { workspace = true }
 cranelift-bforest = { workspace = true }
 cranelift-control = { workspace = true }
@@ -40,8 +40,8 @@ criterion = { version = "0.5.0", features = ["html_reports"] }
 similar = "2.1.0"
 
 [build-dependencies]
-cranelift-codegen-meta = { path = "meta", version = "0.99.0" }
-cranelift-isle = { path = "../isle/isle", version = "=0.99.0" }
+cranelift-codegen-meta = { path = "meta", version = "0.100.0" }
+cranelift-isle = { path = "../isle/isle", version = "=0.100.0" }
 
 [features]
 default = ["std", "unwind", "host-arch"]
diff --git a/cranelift/codegen/meta/Cargo.toml b/cranelift/codegen/meta/Cargo.toml
index 75303fa4d211..a4fbe21b12f5 100644
--- a/cranelift/codegen/meta/Cargo.toml
+++ b/cranelift/codegen/meta/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "cranelift-codegen-meta"
 authors = ["The Cranelift Project Developers"]
-version = "0.99.0"
+version = "0.100.0"
 description = "Metaprogram for cranelift-codegen code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -12,4 +12,4 @@ edition.workspace = true
 rustdoc-args = [ "--document-private-items" ]
 
 [dependencies]
-cranelift-codegen-shared = { path = "../shared", version = "0.99.0" }
+cranelift-codegen-shared = { path = "../shared", version = "0.100.0" }
diff --git a/cranelift/codegen/shared/Cargo.toml b/cranelift/codegen/shared/Cargo.toml
index 6137d0d2f357..3aed6545e6f6 100644
--- a/cranelift/codegen/shared/Cargo.toml
+++ b/cranelift/codegen/shared/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen-shared"
-version = "0.99.0"
+version = "0.100.0"
 description = "For code shared between cranelift-codegen-meta and cranelift-codegen"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/codegen/src/isa/aarch64/abi.rs b/cranelift/codegen/src/isa/aarch64/abi.rs
index 961e8216e50f..320f7d5bcc14 100644
--- a/cranelift/codegen/src/isa/aarch64/abi.rs
+++ b/cranelift/codegen/src/isa/aarch64/abi.rs
@@ -396,27 +396,21 @@ impl ABIMachineSpec for AArch64MachineDeps {
     fn gen_ret(
         setup_frame: bool,
         isa_flags: &aarch64_settings::Flags,
+        call_conv: isa::CallConv,
         rets: Vec<RetPair>,
         stack_bytes_to_pop: u32,
     ) -> Inst {
-        if isa_flags.sign_return_address() && (setup_frame || isa_flags.sign_return_address_all()) {
-            let key = if isa_flags.sign_return_address_with_bkey() {
-                APIKey::B
-            } else {
-                APIKey::A
-            };
-
-            Inst::AuthenticatedRet {
+        match select_api_key(isa_flags, call_conv, setup_frame) {
+            Some(key) => Inst::AuthenticatedRet {
                 key,
                 is_hint: !isa_flags.has_pauth(),
                 rets,
                 stack_bytes_to_pop,
-            }
-        } else {
-            Inst::Ret {
+            },
+            None => Inst::Ret {
                 rets,
                 stack_bytes_to_pop,
-            }
+            },
         }
     }
 
@@ -558,36 +552,32 @@ impl ABIMachineSpec for AArch64MachineDeps {
     ) -> SmallInstVec<Inst> {
         let mut insts = SmallVec::new();
 
-        if isa_flags.sign_return_address() && (setup_frame || isa_flags.sign_return_address_all()) {
-            let key = if isa_flags.sign_return_address_with_bkey() {
-                APIKey::B
-            } else {
-                APIKey::A
-            };
-
-            insts.push(Inst::Pacisp { key });
-
-            if flags.unwind_info() {
-                insts.push(Inst::Unwind {
-                    inst: UnwindInst::Aarch64SetPointerAuth {
-                        return_addresses: true,
-                    },
-                });
-            }
-        } else {
-            if isa_flags.use_bti() {
-                insts.push(Inst::Bti {
-                    targets: BranchTargetType::C,
-                });
+        match select_api_key(isa_flags, call_conv, setup_frame) {
+            Some(key) => {
+                insts.push(Inst::Paci { key });
+                if flags.unwind_info() {
+                    insts.push(Inst::Unwind {
+                        inst: UnwindInst::Aarch64SetPointerAuth {
+                            return_addresses: true,
+                        },
+                    });
+                }
             }
+            None => {
+                if isa_flags.use_bti() {
+                    insts.push(Inst::Bti {
+                        targets: BranchTargetType::C,
+                    });
+                }
 
-            if flags.unwind_info() && call_conv.extends_apple_aarch64() {
-                // The macOS unwinder seems to require this.
-                insts.push(Inst::Unwind {
-                    inst: UnwindInst::Aarch64SetPointerAuth {
-                        return_addresses: false,
-                    },
-                });
+                if flags.unwind_info() && call_conv.extends_apple_aarch64() {
+                    // The macOS unwinder seems to require this.
+                    insts.push(Inst::Unwind {
+                        inst: UnwindInst::Aarch64SetPointerAuth {
+                            return_addresses: false,
+                        },
+                    });
+                }
             }
         }
 
@@ -601,7 +591,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
         insts.push(Inst::StoreP64 {
             rt: fp_reg(),
             rt2: link_reg(),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-16, types::I64).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-16, types::I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         });
 
@@ -639,7 +631,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
         insts.push(Inst::LoadP64 {
             rt: writable_fp_reg(),
             rt2: writable_link_reg(),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(16, types::I64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(16, types::I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         });
         insts
@@ -796,9 +790,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
             insts.push(Inst::StoreP64 {
                 rt,
                 rt2,
-                mem: PairAMode::SPPreIndexed(
-                    SImm7Scaled::maybe_from_i64(-clobber_offset_change, types::I64).unwrap(),
-                ),
+                mem: PairAMode::SPPreIndexed {
+                    simm7: SImm7Scaled::maybe_from_i64(-clobber_offset_change, types::I64).unwrap(),
+                },
                 flags: MemFlags::trusted(),
             });
 
@@ -852,9 +846,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
                 Inst::FpuStoreP64 {
                     rt,
                     rt2,
-                    mem: PairAMode::SPPreIndexed(
-                        SImm7Scaled::maybe_from_i64(-clobber_offset_change, F64).unwrap(),
-                    ),
+                    mem: PairAMode::SPPreIndexed {
+                        simm7: SImm7Scaled::maybe_from_i64(-clobber_offset_change, F64).unwrap(),
+                    },
                     flags: MemFlags::trusted(),
                 },
                 clobber_offset_change as u32,
@@ -925,7 +919,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
         let load_vec_reg_pair = |rt, rt2| Inst::FpuLoadP64 {
             rt,
             rt2,
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(16, F64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(16, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         };
 
@@ -961,7 +957,9 @@ impl ABIMachineSpec for AArch64MachineDeps {
             insts.push(Inst::LoadP64 {
                 rt,
                 rt2,
-                mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(16, I64).unwrap()),
+                mem: PairAMode::SPPostIndexed {
+                    simm7: SImm7Scaled::maybe_from_i64(16, I64).unwrap(),
+                },
                 flags: MemFlags::trusted(),
             });
         }
@@ -1161,8 +1159,39 @@ impl ABIMachineSpec for AArch64MachineDeps {
     }
 }
 
+fn select_api_key(
+    isa_flags: &aarch64_settings::Flags,
+    call_conv: isa::CallConv,
+    setup_frame: bool,
+) -> Option<APIKey> {
+    if isa_flags.sign_return_address() && (setup_frame || isa_flags.sign_return_address_all()) {
+        // The `tail` calling convention uses a zero modifier rather than SP
+        // because tail calls may happen with a different stack pointer than
+        // when the function was entered, meaning that it won't be the same when
+        // the return address is decrypted.
+        Some(if isa_flags.sign_return_address_with_bkey() {
+            match call_conv {
+                isa::CallConv::Tail => APIKey::BZ,
+                _ => APIKey::BSP,
+            }
+        } else {
+            match call_conv {
+                isa::CallConv::Tail => APIKey::AZ,
+                _ => APIKey::ASP,
+            }
+        })
+    } else {
+        None
+    }
+}
+
 impl AArch64CallSite {
-    pub fn emit_return_call(mut self, ctx: &mut Lower<Inst>, args: isle::ValueSlice) {
+    pub fn emit_return_call(
+        mut self,
+        ctx: &mut Lower<Inst>,
+        args: isle::ValueSlice,
+        isa_flags: &aarch64_settings::Flags,
+    ) {
         let (new_stack_arg_size, old_stack_arg_size) =
             self.emit_temporary_tail_call_frame(ctx, args);
 
@@ -1174,6 +1203,7 @@ impl AArch64CallSite {
             opcode,
             old_stack_arg_size,
             new_stack_arg_size,
+            key: select_api_key(isa_flags, isa::CallConv::Tail, true),
         });
 
         match dest {
diff --git a/cranelift/codegen/src/isa/aarch64/inst.isle b/cranelift/codegen/src/isa/aarch64/inst.isle
index 47a85cf59f4b..806387d9183a 100644
--- a/cranelift/codegen/src/isa/aarch64/inst.isle
+++ b/cranelift/codegen/src/isa/aarch64/inst.isle
@@ -902,7 +902,7 @@
        ;; Pointer authentication code for instruction address with modifier in SP;
        ;; equivalent to a no-op if Pointer authentication (FEAT_PAuth) is not
        ;; supported.
-       (Pacisp
+       (Paci
         (key APIKey))
 
        ;; Strip pointer authentication code from instruction address in LR;
@@ -1037,6 +1037,7 @@
 (type NZCV (primitive NZCV))
 (type ASIMDFPModImm (primitive ASIMDFPModImm))
 (type ASIMDMovModImm (primitive ASIMDMovModImm))
+(type SImm7Scaled (primitive SImm7Scaled))
 
 (type BoxCallInfo (primitive BoxCallInfo))
 (type BoxCallIndInfo (primitive BoxCallIndInfo))
@@ -1179,7 +1180,20 @@
          (off i64)
          (ty Type))))
 
-(type PairAMode extern (enum))
+;; A memory argument to a load/store-pair.
+(type PairAMode (enum
+  ;; Signed, scaled 7-bit offset from a register.
+  (SignedOffset
+    (reg Reg)
+    (simm7 SImm7Scaled))
+
+  ;; Pre-increment register before address computation.
+  (SPPreIndexed (simm7 SImm7Scaled))
+
+  ;; Post-increment register after address computation.
+  (SPPostIndexed (simm7 SImm7Scaled))
+))
+
 (type FPUOpRI extern (enum))
 (type FPUOpRIMod extern (enum))
 
@@ -1645,8 +1659,14 @@
 ;; Keys for instruction address PACs
 (type APIKey
   (enum
-    (A)
-    (B)
+    ;; API key A with the modifier of SP
+    (ASP)
+    ;; API key B with the modifier of SP
+    (BSP)
+    ;; API key A with the modifier of zero
+    (AZ)
+    ;; API key B with the modifier of zero
+    (BZ)
 ))
 
 ;; Branch target types
@@ -1796,9 +1816,6 @@
 (decl cond_br_cond (Cond) CondBrKind)
 (extern constructor cond_br_cond cond_br_cond)
 
-(decl pair_amode (Value u32) PairAMode)
-(extern constructor pair_amode pair_amode)
-
 ;; Instruction creation helpers ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ;; Helper for creating the zero register.
@@ -3066,14 +3083,95 @@
         dst))
 
 ;; Lower the address of a load or a store.
-(decl amode (Type Value u32) AMode)
-;; TODO: Port lower_address() to ISLE.
-(extern constructor amode amode)
+;;
+;; This will create an `AMode` representing the address of the `Value` provided
+;; at runtime plus the immediate offset `i32` provided. The `Type` here is used
+;; to represent the size of the value being loaded or stored for offset scaling
+;; if necessary.
+(decl amode (Type Value i32) AMode)
+
+;; Base case: move the `offset` into a register and add it to `val` via the
+;; amode
+(rule 0 (amode ty val offset)
+        (AMode.RegReg val (imm $I64 (ImmExtend.Zero) (i64_as_u64 offset))))
+
+;; Optimize cases where the `offset` provided fits into a immediates of
+;; various kinds of addressing modes.
+(rule 1 (amode ty val offset)
+        (if-let simm9 (simm9_from_i64 offset))
+        (AMode.Unscaled val simm9))
+(rule 2 (amode ty val offset)
+        (if-let uimm12 (uimm12_scaled_from_i64 offset ty))
+        (AMode.UnsignedOffset val uimm12))
+
+;; Optimizations where addition can fold some operations into the `amode`.
+;;
+;; Note that here these take higher priority than constants because an
+;; add-of-extend can be folded into an amode, representing 2 otherwise emitted
+;; instructions. Constants on the other hand added to the amode represent only
+;; a single instruction folded in, so fewer instructions should be generated
+;; with these higher priority than the rules above.
+(rule 3 (amode ty (iadd x y) offset)
+        (AMode.RegReg (amode_add x offset) y))
+(rule 4 (amode ty (iadd x (uextend y @ (value_type $I32))) offset)
+        (AMode.RegExtended (amode_add x offset) y (ExtendOp.UXTW)))
+(rule 4 (amode ty (iadd x (sextend y @ (value_type $I32))) offset)
+        (AMode.RegExtended (amode_add x offset) y (ExtendOp.SXTW)))
+(rule 5 (amode ty (iadd (uextend x @ (value_type $I32)) y) offset)
+        (AMode.RegExtended (amode_add y offset) x (ExtendOp.UXTW)))
+(rule 5 (amode ty (iadd (sextend x @ (value_type $I32)) y) offset)
+        (AMode.RegExtended (amode_add y offset) x (ExtendOp.SXTW)))
+
+;; Small optimizations where constants found in `iadd` are folded into the
+;; `offset` immediate.
+;;
+;; NB: this should probably be done by mid-end optimizations rather than here
+;; in the backend, but currently Cranelift doesn't do that.
+(rule 6 (amode ty (iadd x (iconst (simm32 y))) offset)
+        (if-let new_offset (s32_add_fallible y offset))
+        (amode ty x new_offset))
+(rule 7 (amode ty (iadd (iconst (simm32 x)) y) offset)
+        (if-let new_offset (s32_add_fallible x offset))
+        (amode ty y new_offset))
+
+;; Helper to add a 32-bit signed immediate to the register provided. This will
+;; select an appropriate `add` instruction to use.
+(decl amode_add (Reg i32) Reg)
+(rule 0 (amode_add x y)
+        (add $I64 x (imm $I64 (ImmExtend.Zero) (i64_as_u64 y))))
+(rule 1 (amode_add x y)
+        (if-let (imm12_from_u64 imm12) (i64_as_u64 y))
+        (add_imm $I64 x imm12))
+(rule 2 (amode_add x 0) x)
+
+;; Creates a `PairAMode` for the `Value` provided plus the `i32` constant
+;; offset provided.
+(decl pair_amode (Value i32) PairAMode)
+
+;; Base case where `val` and `offset` are combined with an `add`
+(rule 0 (pair_amode val offset)
+        (if-let simm7 (simm7_scaled_from_i64 0 $I64))
+        (PairAMode.SignedOffset (amode_add val offset) simm7))
+
+;; Optimization when `offset` can fit into a `SImm7Scaled`.
+(rule 1 (pair_amode val offset)
+        (if-let simm7 (simm7_scaled_from_i64 offset $I64))
+        (PairAMode.SignedOffset val simm7))
+
+(decl pure partial simm7_scaled_from_i64 (i64 Type) SImm7Scaled)
+(extern constructor simm7_scaled_from_i64 simm7_scaled_from_i64)
+
+(decl pure partial uimm12_scaled_from_i64 (i64 Type) UImm12Scaled)
+(extern constructor uimm12_scaled_from_i64 uimm12_scaled_from_i64)
+
+(decl pure partial simm9_from_i64 (i64) SImm9)
+(extern constructor simm9_from_i64 simm9_from_i64)
+
 
 (decl sink_load_into_addr (Type Inst) Reg)
 (rule (sink_load_into_addr ty x @ (load _ addr (offset32 offset)))
       (let ((_ Unit (sink_inst x)))
-        (add_imm_to_addr addr offset)))
+        (add_imm_to_addr addr (i64_as_u64 offset))))
 
 (decl add_imm_to_addr (Reg u64) Reg)
 (rule 2 (add_imm_to_addr val 0) val)
diff --git a/cranelift/codegen/src/isa/aarch64/inst/args.rs b/cranelift/codegen/src/isa/aarch64/inst/args.rs
index 1c29591ba2d0..cf1d6d05a671 100644
--- a/cranelift/codegen/src/isa/aarch64/inst/args.rs
+++ b/cranelift/codegen/src/isa/aarch64/inst/args.rs
@@ -203,25 +203,17 @@ impl AMode {
     }
 }
 
-/// A memory argument to a load/store-pair.
-#[derive(Clone, Debug)]
-pub enum PairAMode {
-    /// Signed, scaled 7-bit offset from a register.
-    SignedOffset(Reg, SImm7Scaled),
-    /// Pre-increment register before address computation.
-    SPPreIndexed(SImm7Scaled),
-    /// Post-increment register after address computation.
-    SPPostIndexed(SImm7Scaled),
-}
+pub use crate::isa::aarch64::lower::isle::generated_code::PairAMode;
 
 impl PairAMode {
     pub(crate) fn with_allocs(&self, allocs: &mut AllocationConsumer<'_>) -> Self {
         // Should match `pairmemarg_operands()`.
         match self {
-            &PairAMode::SignedOffset(reg, simm7scaled) => {
-                PairAMode::SignedOffset(allocs.next(reg), simm7scaled)
-            }
-            &PairAMode::SPPreIndexed(..) | &PairAMode::SPPostIndexed(..) => self.clone(),
+            &PairAMode::SignedOffset { reg, simm7 } => PairAMode::SignedOffset {
+                reg: allocs.next(reg),
+                simm7,
+            },
+            &PairAMode::SPPreIndexed { .. } | &PairAMode::SPPostIndexed { .. } => self.clone(),
         }
     }
 }
@@ -486,7 +478,7 @@ impl PrettyPrint for AMode {
 impl PrettyPrint for PairAMode {
     fn pretty_print(&self, _: u8, allocs: &mut AllocationConsumer<'_>) -> String {
         match self {
-            &PairAMode::SignedOffset(reg, simm7) => {
+            &PairAMode::SignedOffset { reg, simm7 } => {
                 let reg = pretty_print_reg(reg, allocs);
                 if simm7.value != 0 {
                     let simm7 = simm7.pretty_print(8, allocs);
@@ -495,11 +487,11 @@ impl PrettyPrint for PairAMode {
                     format!("[{}]", reg)
                 }
             }
-            &PairAMode::SPPreIndexed(simm7) => {
+            &PairAMode::SPPreIndexed { simm7 } => {
                 let simm7 = simm7.pretty_print(8, allocs);
                 format!("[sp, {}]!", simm7)
             }
-            &PairAMode::SPPostIndexed(simm7) => {
+            &PairAMode::SPPostIndexed { simm7 } => {
                 let simm7 = simm7.pretty_print(8, allocs);
                 format!("[sp], {}", simm7)
             }
@@ -739,3 +731,17 @@ impl VectorSize {
         }
     }
 }
+
+impl APIKey {
+    /// Returns the encoding of the `auti{key}` instruction used to decrypt the
+    /// `lr` register.
+    pub fn enc_auti_hint(&self) -> u32 {
+        let (crm, op2) = match self {
+            APIKey::AZ => (0b0011, 0b100),
+            APIKey::ASP => (0b0011, 0b101),
+            APIKey::BZ => (0b0011, 0b110),
+            APIKey::BSP => (0b0011, 0b111),
+        };
+        0xd503201f | (crm << 8) | (op2 << 5)
+    }
+}
diff --git a/cranelift/codegen/src/isa/aarch64/inst/emit.rs b/cranelift/codegen/src/isa/aarch64/inst/emit.rs
index 085daaf27153..a9afd6b0463c 100644
--- a/cranelift/codegen/src/isa/aarch64/inst/emit.rs
+++ b/cranelift/codegen/src/isa/aarch64/inst/emit.rs
@@ -1219,17 +1219,17 @@ impl MachInstEmit for Inst {
                     sink.add_trap(TrapCode::HeapOutOfBounds);
                 }
                 match &mem {
-                    &PairAMode::SignedOffset(reg, simm7) => {
+                    &PairAMode::SignedOffset { reg, simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = allocs.next(reg);
                         sink.put4(enc_ldst_pair(0b1010100100, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPreIndexed(simm7) => {
+                    &PairAMode::SPPreIndexed { simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_pair(0b1010100110, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPostIndexed(simm7) => {
+                    &PairAMode::SPPostIndexed { simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_pair(0b1010100010, simm7, reg, rt, rt2));
@@ -1252,17 +1252,17 @@ impl MachInstEmit for Inst {
                 }
 
                 match &mem {
-                    &PairAMode::SignedOffset(reg, simm7) => {
+                    &PairAMode::SignedOffset { reg, simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = allocs.next(reg);
                         sink.put4(enc_ldst_pair(0b1010100101, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPreIndexed(simm7) => {
+                    &PairAMode::SPPreIndexed { simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_pair(0b1010100111, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPostIndexed(simm7) => {
+                    &PairAMode::SPPostIndexed { simm7 } => {
                         assert_eq!(simm7.scale_ty, I64);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_pair(0b1010100011, simm7, reg, rt, rt2));
@@ -1298,17 +1298,17 @@ impl MachInstEmit for Inst {
                 };
 
                 match &mem {
-                    &PairAMode::SignedOffset(reg, simm7) => {
+                    &PairAMode::SignedOffset { reg, simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = allocs.next(reg);
                         sink.put4(enc_ldst_vec_pair(opc, 0b10, true, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPreIndexed(simm7) => {
+                    &PairAMode::SPPreIndexed { simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_vec_pair(opc, 0b11, true, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPostIndexed(simm7) => {
+                    &PairAMode::SPPostIndexed { simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_vec_pair(opc, 0b01, true, simm7, reg, rt, rt2));
@@ -1344,17 +1344,17 @@ impl MachInstEmit for Inst {
                 };
 
                 match &mem {
-                    &PairAMode::SignedOffset(reg, simm7) => {
+                    &PairAMode::SignedOffset { reg, simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = allocs.next(reg);
                         sink.put4(enc_ldst_vec_pair(opc, 0b10, false, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPreIndexed(simm7) => {
+                    &PairAMode::SPPreIndexed { simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_vec_pair(opc, 0b11, false, simm7, reg, rt, rt2));
                     }
-                    &PairAMode::SPPostIndexed(simm7) => {
+                    &PairAMode::SPPostIndexed { simm7 } => {
                         assert!(simm7.scale_ty == F64 || simm7.scale_ty == I8X16);
                         let reg = stack_reg();
                         sink.put4(enc_ldst_vec_pair(opc, 0b01, false, simm7, reg, rt, rt2));
@@ -3139,35 +3139,38 @@ impl MachInstEmit for Inst {
                 stack_bytes_to_pop,
                 ..
             } => {
-                let key = match key {
-                    APIKey::A => 0b0,
-                    APIKey::B => 0b1,
+                if stack_bytes_to_pop != 0 {
+                    // The requirement that `stack_bytes_to_pop` fit in an
+                    // `Imm12` isn't fundamental, but lifting it is left for
+                    // future PRs.
+                    let imm12 = Imm12::maybe_from_u64(u64::from(stack_bytes_to_pop))
+                        .expect("stack bytes to pop must fit in Imm12");
+                    Inst::AluRRImm12 {
+                        alu_op: ALUOp::Add,
+                        size: OperandSize::Size64,
+                        rd: writable_stack_reg(),
+                        rn: stack_reg(),
+                        imm12,
+                    }
+                    .emit(&[], sink, emit_info, state);
+                }
+
+                let (op2, is_hint) = match key {
+                    APIKey::AZ => (0b100, true),
+                    APIKey::ASP => (0b101, is_hint),
+                    APIKey::BZ => (0b110, true),
+                    APIKey::BSP => (0b111, is_hint),
                 };
 
                 if is_hint {
-                    sink.put4(0xd50323bf | key << 6); // autiasp / autibsp
+                    sink.put4(key.enc_auti_hint());
                     Inst::Ret {
                         rets: vec![],
-                        stack_bytes_to_pop,
+                        stack_bytes_to_pop: 0,
                     }
                     .emit(&[], sink, emit_info, state);
                 } else {
-                    if stack_bytes_to_pop != 0 {
-                        // The requirement that `stack_bytes_to_pop` fit in an
-                        // `Imm12` isn't fundamental, but lifting it is left for
-                        // future PRs.
-                        let imm12 = Imm12::maybe_from_u64(u64::from(stack_bytes_to_pop))
-                            .expect("stack bytes to pop must fit in Imm12");
-                        Inst::AluRRImm12 {
-                            alu_op: ALUOp::Add,
-                            size: OperandSize::Size64,
-                            rd: writable_stack_reg(),
-                            rn: stack_reg(),
-                            imm12,
-                        }
-                        .emit(&[], sink, emit_info, state);
-                    }
-                    sink.put4(0xd65f0bff | key << 10); // retaa / retab
+                    sink.put4(0xd65f0bff | (op2 << 9)); // reta{key}
                 }
             }
             &Inst::Call { ref info } => {
@@ -3208,15 +3211,7 @@ impl MachInstEmit for Inst {
                 ref callee,
                 ref info,
             } => {
-                emit_return_call_common_sequence(
-                    &mut allocs,
-                    sink,
-                    emit_info,
-                    state,
-                    info.new_stack_arg_size,
-                    info.old_stack_arg_size,
-                    &info.uses,
-                );
+                emit_return_call_common_sequence(&mut allocs, sink, emit_info, state, info);
 
                 // Note: this is not `Inst::Jump { .. }.emit(..)` because we
                 // have different metadata in this case: we don't have a label
@@ -3233,15 +3228,7 @@ impl MachInstEmit for Inst {
             &Inst::ReturnCallInd { callee, ref info } => {
                 let callee = allocs.next(callee);
 
-                emit_return_call_common_sequence(
-                    &mut allocs,
-                    sink,
-                    emit_info,
-                    state,
-                    info.new_stack_arg_size,
-                    info.old_stack_arg_size,
-                    &info.uses,
-                );
+                emit_return_call_common_sequence(&mut allocs, sink, emit_info, state, info);
 
                 Inst::IndirectBr {
                     rn: callee,
@@ -3556,13 +3543,15 @@ impl MachInstEmit for Inst {
                     add.emit(&[], sink, emit_info, state);
                 }
             }
-            &Inst::Pacisp { key } => {
-                let key = match key {
-                    APIKey::A => 0b0,
-                    APIKey::B => 0b1,
+            &Inst::Paci { key } => {
+                let (crm, op2) = match key {
+                    APIKey::AZ => (0b0011, 0b000),
+                    APIKey::ASP => (0b0011, 0b001),
+                    APIKey::BZ => (0b0011, 0b010),
+                    APIKey::BSP => (0b0011, 0b011),
                 };
 
-                sink.put4(0xd503233f | key << 6);
+                sink.put4(0xd503211f | (crm << 8) | (op2 << 5));
             }
             &Inst::Xpaclri => sink.put4(0xd50320ff),
             &Inst::Bti { targets } => {
@@ -3590,7 +3579,7 @@ impl MachInstEmit for Inst {
                         dest: BranchTarget::Label(jump_around_label),
                     };
                     jmp.emit(&[], sink, emit_info, state);
-                    sink.emit_island(needed_space + 4, &mut state.ctrl_plane);
+                    sink.emit_island(&mut state.ctrl_plane);
                     sink.bind_label(jump_around_label, &mut state.ctrl_plane);
                 }
             }
@@ -3768,18 +3757,16 @@ fn emit_return_call_common_sequence(
     sink: &mut MachBuffer<Inst>,
     emit_info: &EmitInfo,
     state: &mut EmitState,
-    new_stack_arg_size: u32,
-    old_stack_arg_size: u32,
-    uses: &CallArgList,
+    info: &ReturnCallInfo,
 ) {
-    for u in uses {
+    for u in info.uses.iter() {
         let _ = allocs.next(u.vreg);
     }
 
     // We are emitting a dynamic number of instructions and might need an
     // island. We emit four instructions regardless of how many stack arguments
     // we have, and then two instructions per word of stack argument space.
-    let new_stack_words = new_stack_arg_size / 8;
+    let new_stack_words = info.new_stack_arg_size / 8;
     let insts = 4 + 2 * new_stack_words;
     let size_of_inst = 4;
     let space_needed = insts * size_of_inst;
@@ -3789,7 +3776,7 @@ fn emit_return_call_common_sequence(
             dest: BranchTarget::Label(jump_around_label),
         };
         jmp.emit(&[], sink, emit_info, state);
-        sink.emit_island(space_needed + 4, &mut state.ctrl_plane);
+        sink.emit_island(&mut state.ctrl_plane);
         sink.bind_label(jump_around_label, &mut state.ctrl_plane);
     }
 
@@ -3820,7 +3807,7 @@ fn emit_return_call_common_sequence(
     // actual jump happens outside this helper function.
 
     assert_eq!(
-        new_stack_arg_size % 8,
+        info.new_stack_arg_size % 8,
         0,
         "size of new stack arguments must be 8-byte aligned"
     );
@@ -3830,7 +3817,8 @@ fn emit_return_call_common_sequence(
     // arguments as well as accounting for the two words we pushed onto the
     // stack upon entry to this function (the return address and old frame
     // pointer).
-    let fp_to_callee_sp = i64::from(old_stack_arg_size) - i64::from(new_stack_arg_size) + 16;
+    let fp_to_callee_sp =
+        i64::from(info.old_stack_arg_size) - i64::from(info.new_stack_arg_size) + 16;
 
     let tmp1 = regs::writable_spilltmp_reg();
     let tmp2 = regs::writable_tmp2_reg();
@@ -3849,10 +3837,10 @@ fn emit_return_call_common_sequence(
     Inst::LoadP64 {
         rt: tmp1,
         rt2: writable_link_reg(),
-        mem: PairAMode::SignedOffset(
-            regs::fp_reg(),
-            SImm7Scaled::maybe_from_i64(0, types::I64).unwrap(),
-        ),
+        mem: PairAMode::SignedOffset {
+            reg: regs::fp_reg(),
+            simm7: SImm7Scaled::maybe_from_i64(0, types::I64).unwrap(),
+        },
         flags: MemFlags::trusted(),
     }
     .emit(&[], sink, emit_info, state);
@@ -3910,10 +3898,14 @@ fn emit_return_call_common_sequence(
     }
     .emit(&[], sink, emit_info, state);
 
-    state.virtual_sp_offset -= i64::from(new_stack_arg_size);
+    state.virtual_sp_offset -= i64::from(info.new_stack_arg_size);
     trace!(
         "return_call[_ind] adjusts virtual sp offset by {} -> {}",
-        new_stack_arg_size,
+        info.new_stack_arg_size,
         state.virtual_sp_offset
     );
+
+    if let Some(key) = info.key {
+        sink.put4(key.enc_auti_hint());
+    }
 }
diff --git a/cranelift/codegen/src/isa/aarch64/inst/emit_tests.rs b/cranelift/codegen/src/isa/aarch64/inst/emit_tests.rs
index 118bce980970..b70f429e79d7 100644
--- a/cranelift/codegen/src/isa/aarch64/inst/emit_tests.rs
+++ b/cranelift/codegen/src/isa/aarch64/inst/emit_tests.rs
@@ -55,7 +55,7 @@ fn test_aarch64_binemit() {
     ));
     insns.push((
         Inst::AuthenticatedRet {
-            key: APIKey::A,
+            key: APIKey::ASP,
             is_hint: true,
             rets: vec![],
             stack_bytes_to_pop: 0,
@@ -65,25 +65,25 @@ fn test_aarch64_binemit() {
     ));
     insns.push((
         Inst::AuthenticatedRet {
-            key: APIKey::B,
+            key: APIKey::BSP,
             is_hint: false,
             rets: vec![],
             stack_bytes_to_pop: 0,
         },
         "FF0F5FD6",
-        "retab",
+        "retabsp",
     ));
     insns.push((
         Inst::AuthenticatedRet {
-            key: APIKey::A,
+            key: APIKey::ASP,
             is_hint: false,
             rets: vec![],
             stack_bytes_to_pop: 16,
         },
         "FF430091FF0B5FD6",
-        "add sp, sp, #16 ; retaa",
+        "add sp, sp, #16 ; retaasp",
     ));
-    insns.push((Inst::Pacisp { key: APIKey::B }, "7F2303D5", "pacibsp"));
+    insns.push((Inst::Paci { key: APIKey::BSP }, "7F2303D5", "pacibsp"));
     insns.push((Inst::Xpaclri, "FF2003D5", "xpaclri"));
     insns.push((
         Inst::Bti {
@@ -2097,7 +2097,10 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(8),
             rt2: xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), simm7_scaled_zero(I64)),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: simm7_scaled_zero(I64),
+            },
             flags: MemFlags::trusted(),
         },
         "482500A9",
@@ -2107,7 +2110,10 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(8),
             rt2: xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), SImm7Scaled::maybe_from_i64(504, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: SImm7Scaled::maybe_from_i64(504, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "48A51FA9",
@@ -2117,7 +2123,10 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(8),
             rt2: xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), SImm7Scaled::maybe_from_i64(-64, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: SImm7Scaled::maybe_from_i64(-64, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "48253CA9",
@@ -2127,7 +2136,10 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(21),
             rt2: xreg(28),
-            mem: PairAMode::SignedOffset(xreg(1), SImm7Scaled::maybe_from_i64(-512, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(1),
+                simm7: SImm7Scaled::maybe_from_i64(-512, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "357020A9",
@@ -2137,7 +2149,9 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(8),
             rt2: xreg(9),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-64, I64).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-64, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E827BCA9",
@@ -2147,7 +2161,9 @@ fn test_aarch64_binemit() {
         Inst::StoreP64 {
             rt: xreg(15),
             rt2: xreg(16),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(504, I64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(504, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "EFC39FA8",
@@ -2158,7 +2174,10 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), simm7_scaled_zero(I64)),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: simm7_scaled_zero(I64),
+            },
             flags: MemFlags::trusted(),
         },
         "482540A9",
@@ -2168,7 +2187,10 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), SImm7Scaled::maybe_from_i64(504, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: SImm7Scaled::maybe_from_i64(504, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "48A55FA9",
@@ -2178,7 +2200,10 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), SImm7Scaled::maybe_from_i64(-64, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: SImm7Scaled::maybe_from_i64(-64, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "48257CA9",
@@ -2188,7 +2213,10 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(9),
-            mem: PairAMode::SignedOffset(xreg(10), SImm7Scaled::maybe_from_i64(-512, I64).unwrap()),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(10),
+                simm7: SImm7Scaled::maybe_from_i64(-512, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "482560A9",
@@ -2198,7 +2226,9 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(9),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-64, I64).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-64, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E827FCA9",
@@ -2208,7 +2238,9 @@ fn test_aarch64_binemit() {
         Inst::LoadP64 {
             rt: writable_xreg(8),
             rt2: writable_xreg(25),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(504, I64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(504, I64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E8E7DFA8",
@@ -6810,7 +6842,10 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP64 {
             rt: writable_vreg(0),
             rt2: writable_vreg(31),
-            mem: PairAMode::SignedOffset(xreg(0), simm7_scaled_zero(F64)),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(0),
+                simm7: simm7_scaled_zero(F64),
+            },
             flags: MemFlags::trusted(),
         },
         "007C406D",
@@ -6821,7 +6856,9 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP64 {
             rt: writable_vreg(19),
             rt2: writable_vreg(11),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-512, F64).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-512, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "F32FE06D",
@@ -6832,7 +6869,9 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP64 {
             rt: writable_vreg(7),
             rt2: writable_vreg(20),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(64, F64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(64, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E753C46C",
@@ -6843,10 +6882,10 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP64 {
             rt: vreg(4),
             rt2: vreg(26),
-            mem: PairAMode::SignedOffset(
-                stack_reg(),
-                SImm7Scaled::maybe_from_i64(504, F64).unwrap(),
-            ),
+            mem: PairAMode::SignedOffset {
+                reg: stack_reg(),
+                simm7: SImm7Scaled::maybe_from_i64(504, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E4EB1F6D",
@@ -6857,7 +6896,9 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP64 {
             rt: vreg(16),
             rt2: vreg(8),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(48, F64).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(48, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "F023836D",
@@ -6868,7 +6909,9 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP64 {
             rt: vreg(5),
             rt2: vreg(6),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(-32, F64).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-32, F64).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E51BBE6C",
@@ -6879,7 +6922,10 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP128 {
             rt: writable_vreg(0),
             rt2: writable_vreg(17),
-            mem: PairAMode::SignedOffset(xreg(3), simm7_scaled_zero(I8X16)),
+            mem: PairAMode::SignedOffset {
+                reg: xreg(3),
+                simm7: simm7_scaled_zero(I8X16),
+            },
             flags: MemFlags::trusted(),
         },
         "604440AD",
@@ -6890,7 +6936,9 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP128 {
             rt: writable_vreg(29),
             rt2: writable_vreg(9),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-1024, I8X16).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-1024, I8X16).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "FD27E0AD",
@@ -6901,7 +6949,9 @@ fn test_aarch64_binemit() {
         Inst::FpuLoadP128 {
             rt: writable_vreg(10),
             rt2: writable_vreg(20),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(256, I8X16).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(256, I8X16).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "EA53C8AC",
@@ -6912,10 +6962,10 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP128 {
             rt: vreg(9),
             rt2: vreg(31),
-            mem: PairAMode::SignedOffset(
-                stack_reg(),
-                SImm7Scaled::maybe_from_i64(1008, I8X16).unwrap(),
-            ),
+            mem: PairAMode::SignedOffset {
+                reg: stack_reg(),
+                simm7: SImm7Scaled::maybe_from_i64(1008, I8X16).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "E9FF1FAD",
@@ -6926,7 +6976,9 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP128 {
             rt: vreg(27),
             rt2: vreg(13),
-            mem: PairAMode::SPPreIndexed(SImm7Scaled::maybe_from_i64(-192, I8X16).unwrap()),
+            mem: PairAMode::SPPreIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(-192, I8X16).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "FB37BAAD",
@@ -6937,7 +6989,9 @@ fn test_aarch64_binemit() {
         Inst::FpuStoreP128 {
             rt: vreg(18),
             rt2: vreg(22),
-            mem: PairAMode::SPPostIndexed(SImm7Scaled::maybe_from_i64(304, I8X16).unwrap()),
+            mem: PairAMode::SPPostIndexed {
+                simm7: SImm7Scaled::maybe_from_i64(304, I8X16).unwrap(),
+            },
             flags: MemFlags::trusted(),
         },
         "F2DB89AC",
diff --git a/cranelift/codegen/src/isa/aarch64/inst/mod.rs b/cranelift/codegen/src/isa/aarch64/inst/mod.rs
index bcbe1fb84c5c..006a6b807d3d 100644
--- a/cranelift/codegen/src/isa/aarch64/inst/mod.rs
+++ b/cranelift/codegen/src/isa/aarch64/inst/mod.rs
@@ -136,6 +136,8 @@ pub struct ReturnCallInfo {
     /// for copying the frame over our current frame. It must already be
     /// allocated on the stack.
     pub new_stack_arg_size: u32,
+    /// API key to use to restore the return address, if any.
+    pub key: Option<APIKey>,
 }
 
 /// Additional information for JTSequence instructions, left out of line to lower the size of the Inst
@@ -410,10 +412,10 @@ fn pairmemarg_operands<F: Fn(VReg) -> VReg>(
 ) {
     // This should match `PairAMode::with_allocs()`.
     match pairmemarg {
-        &PairAMode::SignedOffset(reg, ..) => {
+        &PairAMode::SignedOffset { reg, .. } => {
             collector.reg_use(reg);
         }
-        &PairAMode::SPPreIndexed(..) | &PairAMode::SPPostIndexed(..) => {}
+        &PairAMode::SPPreIndexed { .. } | &PairAMode::SPPostIndexed { .. } => {}
     }
 }
 
@@ -939,7 +941,7 @@ fn aarch64_get_operands<F: Fn(VReg) -> VReg>(inst: &Inst, collector: &mut Operan
             collector.reg_def(rd);
             memarg_operands(mem, collector);
         }
-        &Inst::Pacisp { .. } | &Inst::Xpaclri => {
+        &Inst::Paci { .. } | &Inst::Xpaclri => {
             // Neither LR nor SP is an allocatable register, so there is no need
             // to do anything.
         }
@@ -2613,15 +2615,17 @@ impl Inst {
                 ref rets,
             } => {
                 let key = match key {
-                    APIKey::A => "a",
-                    APIKey::B => "b",
+                    APIKey::AZ => "az",
+                    APIKey::BZ => "bz",
+                    APIKey::ASP => "asp",
+                    APIKey::BSP => "bsp",
                 };
                 let mut s = match (is_hint, stack_bytes_to_pop) {
                     (false, 0) => format!("reta{key}"),
                     (false, n) => {
                         format!("add sp, sp, #{n} ; reta{key}")
                     }
-                    (true, 0) => format!("auti{key}sp ; ret"),
+                    (true, 0) => format!("auti{key} ; ret"),
                     (true, n) => {
                         format!("add sp, sp, #{n} ; auti{key} ; ret")
                     }
@@ -2814,13 +2818,15 @@ impl Inst {
                 }
                 ret
             }
-            &Inst::Pacisp { key } => {
+            &Inst::Paci { key } => {
                 let key = match key {
-                    APIKey::A => "a",
-                    APIKey::B => "b",
+                    APIKey::AZ => "az",
+                    APIKey::BZ => "bz",
+                    APIKey::ASP => "asp",
+                    APIKey::BSP => "bsp",
                 };
 
-                "paci".to_string() + key + "sp"
+                "paci".to_string() + key
             }
             &Inst::Xpaclri => "xpaclri".to_string(),
             &Inst::Bti { targets } => {
diff --git a/cranelift/codegen/src/isa/aarch64/lower.isle b/cranelift/codegen/src/isa/aarch64/lower.isle
index b35ae2461f85..9d51812f2fc5 100644
--- a/cranelift/codegen/src/isa/aarch64/lower.isle
+++ b/cranelift/codegen/src/isa/aarch64/lower.isle
@@ -2305,7 +2305,7 @@
 (rule -1 (lower
        (has_type (ty_vec64 _)
                         (load flags address offset)))
-      (aarch64_fpuload128 (amode $F64 address offset) flags))
+      (aarch64_fpuload64 (amode $F64 address offset) flags))
 (rule -3 (lower
        (has_type (ty_vec128 _)
                         (load flags address offset)))
diff --git a/cranelift/codegen/src/isa/aarch64/lower.rs b/cranelift/codegen/src/isa/aarch64/lower.rs
index fcc38d0d5982..02c841d1b2f9 100644
--- a/cranelift/codegen/src/isa/aarch64/lower.rs
+++ b/cranelift/codegen/src/isa/aarch64/lower.rs
@@ -8,137 +8,20 @@
 //! - Floating-point immediates (FIMM instruction).
 
 use crate::ir::condcodes::{FloatCC, IntCC};
-use crate::ir::types::*;
 use crate::ir::Inst as IRInst;
-use crate::ir::{Opcode, Type, Value};
+use crate::ir::{Opcode, Value};
 use crate::isa::aarch64::inst::*;
 use crate::isa::aarch64::AArch64Backend;
 use crate::machinst::lower::*;
-use crate::machinst::{Reg, Writable};
-use crate::{machinst::*, trace};
-use smallvec::{smallvec, SmallVec};
+use crate::machinst::Reg;
+use crate::machinst::*;
 
 pub mod isle;
 
 //============================================================================
 // Lowering: convert instruction inputs to forms that we can use.
 
-/// How to handle narrow values loaded into registers; see note on `narrow_mode`
-/// parameter to `put_input_in_*` below.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum NarrowValueMode {
-    None,
-    /// Zero-extend to 64 bits if original is < 64 bits.
-    ZeroExtend64,
-}
-
-impl NarrowValueMode {
-    fn is_32bit(&self) -> bool {
-        match self {
-            NarrowValueMode::None => false,
-            NarrowValueMode::ZeroExtend64 => false,
-        }
-    }
-}
-
-/// Extends a register according to `narrow_mode`.
-/// If extended, the value is always extended to 64 bits, for simplicity.
-fn extend_reg(
-    ctx: &mut Lower<Inst>,
-    ty: Type,
-    in_reg: Reg,
-    is_const: bool,
-    narrow_mode: NarrowValueMode,
-) -> Reg {
-    let from_bits = ty_bits(ty) as u8;
-    match (narrow_mode, from_bits) {
-        (NarrowValueMode::None, _) => in_reg,
-
-        (NarrowValueMode::ZeroExtend64, n) if n < 64 => {
-            if is_const {
-                // Constants are zero-extended to full 64-bit width on load already.
-                in_reg
-            } else {
-                let tmp = ctx.alloc_tmp(I32).only_reg().unwrap();
-                ctx.emit(Inst::Extend {
-                    rd: tmp,
-                    rn: in_reg,
-                    signed: false,
-                    from_bits,
-                    to_bits: 64,
-                });
-                tmp.to_reg()
-            }
-        }
-        (_, 64) => in_reg,
-        (_, 128) => in_reg,
-
-        _ => panic!(
-            "Unsupported input width: input ty {} bits {} mode {:?}",
-            ty, from_bits, narrow_mode
-        ),
-    }
-}
-
-/// Lowers an instruction input to multiple regs
-fn lower_value_to_regs(ctx: &mut Lower<Inst>, value: Value) -> (ValueRegs<Reg>, Type, bool) {
-    trace!("lower_value_to_regs: value {:?}", value);
-    let ty = ctx.value_ty(value);
-    let inputs = ctx.get_value_as_source_or_const(value);
-    let is_const = inputs.constant.is_some();
-
-    let in_regs = if let Some(c) = inputs.constant {
-        // Generate constants fresh at each use to minimize long-range register pressure.
-        let from_bits = ty_bits(ty);
-        let c = if from_bits < 64 {
-            c & ((1u64 << from_bits) - 1)
-        } else {
-            c
-        };
-        match ty {
-            I8 | I16 | I32 | I64 | R32 | R64 => {
-                let cst_copy = ctx.alloc_tmp(ty);
-                lower_constant_u64(ctx, cst_copy.only_reg().unwrap(), c);
-                non_writable_value_regs(cst_copy)
-            }
-            _ => unreachable!(), // Only used for addresses.
-        }
-    } else {
-        ctx.put_value_in_regs(value)
-    };
-
-    (in_regs, ty, is_const)
-}
-
-/// Lower an instruction input to a register
-///
-/// The given register will be extended appropriately, according to
-/// `narrow_mode` and the input's type. If extended, the value is
-/// always extended to 64 bits, for simplicity.
-pub(crate) fn put_input_in_reg(
-    ctx: &mut Lower<Inst>,
-    input: InsnInput,
-    narrow_mode: NarrowValueMode,
-) -> Reg {
-    let value = ctx.input_as_value(input.insn, input.input);
-    put_value_in_reg(ctx, value, narrow_mode)
-}
-
-/// Like above, only for values
-fn put_value_in_reg(ctx: &mut Lower<Inst>, value: Value, narrow_mode: NarrowValueMode) -> Reg {
-    let (in_regs, ty, is_const) = lower_value_to_regs(ctx, value);
-    let reg = in_regs
-        .only_reg()
-        .expect("Multi-register value not expected");
-
-    extend_reg(ctx, ty, reg, is_const, narrow_mode)
-}
-
-fn get_as_extended_value(
-    ctx: &mut Lower<Inst>,
-    val: Value,
-    narrow_mode: NarrowValueMode,
-) -> Option<(Value, ExtendOp)> {
+fn get_as_extended_value(ctx: &mut Lower<Inst>, val: Value) -> Option<(Value, ExtendOp)> {
     let inputs = ctx.get_value_as_source_or_const(val);
     let (insn, n) = inputs.inst.as_inst()?;
     if n != 0 {
@@ -154,420 +37,19 @@ fn get_as_extended_value(
         let inner_ty = ctx.input_ty(insn, 0);
         let inner_bits = ty_bits(inner_ty);
         assert!(inner_bits < out_bits);
-        if match (sign_extend, narrow_mode) {
-            // A single zero-extend or sign-extend is equal to itself.
-            (_, NarrowValueMode::None) => true,
-            // Two zero-extends or sign-extends in a row is equal to a single zero-extend or sign-extend.
-            (false, NarrowValueMode::ZeroExtend64) => true,
-            (true, NarrowValueMode::ZeroExtend64) => false,
-        } {
-            let extendop = match (sign_extend, inner_bits) {
-                (true, 8) => ExtendOp::SXTB,
-                (false, 8) => ExtendOp::UXTB,
-                (true, 16) => ExtendOp::SXTH,
-                (false, 16) => ExtendOp::UXTH,
-                (true, 32) => ExtendOp::SXTW,
-                (false, 32) => ExtendOp::UXTW,
-                _ => unreachable!(),
-            };
-            return Some((ctx.input_as_value(insn, 0), extendop));
-        }
-    }
-
-    // If `out_ty` is smaller than 32 bits and we need to zero- or sign-extend,
-    // then get the result into a register and return an Extend-mode operand on
-    // that register.
-    if narrow_mode != NarrowValueMode::None
-        && ((narrow_mode.is_32bit() && out_bits < 32) || (!narrow_mode.is_32bit() && out_bits < 64))
-    {
-        let extendop = match (narrow_mode, out_bits) {
-            (NarrowValueMode::ZeroExtend64, 1) => ExtendOp::UXTB,
-            (NarrowValueMode::ZeroExtend64, 8) => ExtendOp::UXTB,
-            (NarrowValueMode::ZeroExtend64, 16) => ExtendOp::UXTH,
-            (NarrowValueMode::ZeroExtend64, 32) => ExtendOp::UXTW,
+        let extendop = match (sign_extend, inner_bits) {
+            (true, 8) => ExtendOp::SXTB,
+            (false, 8) => ExtendOp::UXTB,
+            (true, 16) => ExtendOp::SXTH,
+            (false, 16) => ExtendOp::UXTH,
+            (true, 32) => ExtendOp::SXTW,
+            (false, 32) => ExtendOp::UXTW,
             _ => unreachable!(),
         };
-        return Some((val, extendop));
-    }
-    None
-}
-
-//============================================================================
-// Lowering: addressing mode support. Takes instruction directly, rather
-// than an `InsnInput`, to do more introspection.
-
-/// 32-bit addends that make up an address: an input, and an extension mode on that
-/// input.
-type AddressAddend32List = SmallVec<[(Reg, ExtendOp); 4]>;
-/// 64-bit addends that make up an address: just an input.
-type AddressAddend64List = SmallVec<[Reg; 4]>;
-
-/// Collect all addends that feed into an address computation, with extend-modes
-/// on each.  Note that a load/store may have multiple address components (and
-/// the CLIF semantics are that these components are added to form the final
-/// address), but sometimes the CLIF that we receive still has arguments that
-/// refer to `iadd` instructions. We also want to handle uextend/sextend below
-/// the add(s).
-///
-/// We match any 64-bit add (and descend into its inputs), and we match any
-/// 32-to-64-bit sign or zero extension. The returned addend-list will use
-/// NarrowValueMode values to indicate how to extend each input:
-///
-/// - NarrowValueMode::None: the associated input is 64 bits wide; no extend.
-/// - NarrowValueMode::SignExtend64: the associated input is 32 bits wide;
-///                                  do a sign-extension.
-/// - NarrowValueMode::ZeroExtend64: the associated input is 32 bits wide;
-///                                  do a zero-extension.
-///
-/// We do not descend further into the inputs of extensions (unless it is a constant),
-/// because supporting (e.g.) a 32-bit add that is later extended would require
-/// additional masking of high-order bits, which is too complex. So, in essence, we
-/// descend any number of adds from the roots, collecting all 64-bit address addends;
-/// then possibly support extensions at these leaves.
-fn collect_address_addends(
-    ctx: &mut Lower<Inst>,
-    root: Value,
-) -> (AddressAddend64List, AddressAddend32List, i64) {
-    let mut result32: AddressAddend32List = SmallVec::new();
-    let mut result64: AddressAddend64List = SmallVec::new();
-    let mut offset: i64 = 0;
-
-    let mut workqueue: SmallVec<[Value; 4]> = smallvec![root];
-
-    while let Some(value) = workqueue.pop() {
-        debug_assert_eq!(ty_bits(ctx.value_ty(value)), 64);
-        if let Some((op, insn)) = maybe_value_multi(
-            ctx,
-            value,
-            &[
-                Opcode::Uextend,
-                Opcode::Sextend,
-                Opcode::Iadd,
-                Opcode::Iconst,
-            ],
-        ) {
-            match op {
-                Opcode::Uextend | Opcode::Sextend if ty_bits(ctx.input_ty(insn, 0)) == 32 => {
-                    let extendop = if op == Opcode::Uextend {
-                        ExtendOp::UXTW
-                    } else {
-                        ExtendOp::SXTW
-                    };
-                    let extendee_input = InsnInput { insn, input: 0 };
-                    // If the input is a zero-extension of a constant, add the value to the known
-                    // offset.
-                    // Only do this for zero-extension, as generating a sign-extended
-                    // constant may be more instructions than using the 'SXTW' addressing mode.
-                    if let (Some(insn), ExtendOp::UXTW) = (
-                        maybe_input_insn(ctx, extendee_input, Opcode::Iconst),
-                        extendop,
-                    ) {
-                        let value = (ctx.get_constant(insn).unwrap() & 0xFFFF_FFFF_u64) as i64;
-                        offset += value;
-                    } else {
-                        let reg = put_input_in_reg(ctx, extendee_input, NarrowValueMode::None);
-                        result32.push((reg, extendop));
-                    }
-                }
-                Opcode::Uextend | Opcode::Sextend => {
-                    let reg = put_value_in_reg(ctx, value, NarrowValueMode::None);
-                    result64.push(reg);
-                }
-                Opcode::Iadd => {
-                    for input in 0..ctx.num_inputs(insn) {
-                        let addend = ctx.input_as_value(insn, input);
-                        workqueue.push(addend);
-                    }
-                }
-                Opcode::Iconst => {
-                    let value: i64 = ctx.get_constant(insn).unwrap() as i64;
-                    offset += value;
-                }
-                _ => panic!("Unexpected opcode from maybe_input_insn_multi"),
-            }
-        } else {
-            let reg = put_value_in_reg(ctx, value, NarrowValueMode::ZeroExtend64);
-            result64.push(reg);
-        }
-    }
-
-    (result64, result32, offset)
-}
-
-/// Lower the address of a pair load or store.
-pub(crate) fn lower_pair_address(ctx: &mut Lower<Inst>, addr: Value, offset: i32) -> PairAMode {
-    // Collect addends through an arbitrary tree of 32-to-64-bit sign/zero
-    // extends and addition ops. We update these as we consume address
-    // components, so they represent the remaining addends not yet handled.
-    let (mut addends64, mut addends32, args_offset) = collect_address_addends(ctx, addr);
-    let offset = args_offset + (offset as i64);
-
-    trace!(
-        "lower_pair_address: addends64 {:?}, addends32 {:?}, offset {}",
-        addends64,
-        addends32,
-        offset
-    );
-
-    // Pairs basically only have reg + imm formats so we only have to worry about those
-
-    let base_reg = if let Some(reg64) = addends64.pop() {
-        reg64
-    } else if let Some((reg32, extendop)) = addends32.pop() {
-        let tmp = ctx.alloc_tmp(I64).only_reg().unwrap();
-        let signed = match extendop {
-            ExtendOp::SXTW => true,
-            ExtendOp::UXTW => false,
-            _ => unreachable!(),
-        };
-        ctx.emit(Inst::Extend {
-            rd: tmp,
-            rn: reg32,
-            signed,
-            from_bits: 32,
-            to_bits: 64,
-        });
-        tmp.to_reg()
-    } else {
-        zero_reg()
-    };
-
-    // We have the base register, if we have any others, we need to add them
-    let addr = lower_add_addends(ctx, base_reg, addends64, addends32);
-
-    // Figure out what offset we should emit
-    let (addr, imm7) = if let Some(imm7) = SImm7Scaled::maybe_from_i64(offset, I64) {
-        (addr, imm7)
-    } else {
-        let res = lower_add_immediate(ctx, addr, offset);
-        (res, SImm7Scaled::maybe_from_i64(0, I64).unwrap())
-    };
-
-    PairAMode::SignedOffset(addr, imm7)
-}
-
-/// Lower the address of a load or store.
-pub(crate) fn lower_address(
-    ctx: &mut Lower<Inst>,
-    elem_ty: Type,
-    addr: Value,
-    offset: i32,
-) -> AMode {
-    // TODO: support base_reg + scale * index_reg. For this, we would need to
-    // pattern-match shl or mul instructions.
-
-    // Collect addends through an arbitrary tree of 32-to-64-bit sign/zero
-    // extends and addition ops. We update these as we consume address
-    // components, so they represent the remaining addends not yet handled.
-    let (mut addends64, mut addends32, args_offset) = collect_address_addends(ctx, addr);
-    let mut offset = args_offset + (offset as i64);
-
-    trace!(
-        "lower_address: addends64 {:?}, addends32 {:?}, offset {}",
-        addends64,
-        addends32,
-        offset
-    );
-
-    // First, decide what the `AMode` will be. Take one extendee and one 64-bit
-    // reg, or two 64-bit regs, or a 64-bit reg and a 32-bit reg with extension,
-    // or some other combination as appropriate.
-    let memarg = if addends64.len() > 0 {
-        if addends32.len() > 0 {
-            let (reg32, extendop) = addends32.pop().unwrap();
-            let reg64 = addends64.pop().unwrap();
-            AMode::RegExtended {
-                rn: reg64,
-                rm: reg32,
-                extendop,
-            }
-        } else if offset > 0 && offset < 0x1000 {
-            let reg64 = addends64.pop().unwrap();
-            let off = offset;
-            offset = 0;
-            AMode::RegOffset {
-                rn: reg64,
-                off,
-                ty: elem_ty,
-            }
-        } else if addends64.len() >= 2 {
-            let reg1 = addends64.pop().unwrap();
-            let reg2 = addends64.pop().unwrap();
-            AMode::RegReg { rn: reg1, rm: reg2 }
-        } else {
-            let reg1 = addends64.pop().unwrap();
-            AMode::reg(reg1)
-        }
-    } else
-    /* addends64.len() == 0 */
-    {
-        if addends32.len() > 0 {
-            let tmp = ctx.alloc_tmp(I64).only_reg().unwrap();
-            let (reg1, extendop) = addends32.pop().unwrap();
-            let signed = match extendop {
-                ExtendOp::SXTW => true,
-                ExtendOp::UXTW => false,
-                _ => unreachable!(),
-            };
-            ctx.emit(Inst::Extend {
-                rd: tmp,
-                rn: reg1,
-                signed,
-                from_bits: 32,
-                to_bits: 64,
-            });
-            if let Some((reg2, extendop)) = addends32.pop() {
-                AMode::RegExtended {
-                    rn: tmp.to_reg(),
-                    rm: reg2,
-                    extendop,
-                }
-            } else {
-                AMode::reg(tmp.to_reg())
-            }
-        } else
-        /* addends32.len() == 0 */
-        {
-            let off_reg = ctx.alloc_tmp(I64).only_reg().unwrap();
-            lower_constant_u64(ctx, off_reg, offset as u64);
-            offset = 0;
-            AMode::reg(off_reg.to_reg())
-        }
-    };
-
-    // At this point, if we have any remaining components, we need to allocate a
-    // temp, replace one of the registers in the AMode with the temp, and emit
-    // instructions to add together the remaining components. Return immediately
-    // if this is *not* the case.
-    if offset == 0 && addends32.len() == 0 && addends64.len() == 0 {
-        return memarg;
-    }
-
-    // Extract the first register from the memarg so that we can add all the
-    // immediate values to it.
-    let addr = match memarg {
-        AMode::RegExtended { rn, .. } => rn,
-        AMode::RegOffset { rn, .. } => rn,
-        AMode::RegReg { rm, .. } => rm,
-        AMode::UnsignedOffset { rn, .. } => rn,
-        _ => unreachable!(),
-    };
-
-    // If there is any offset, load that first into `addr`, and add the `reg`
-    // that we kicked out of the `AMode`; otherwise, start with that reg.
-    let addr = if offset != 0 {
-        lower_add_immediate(ctx, addr, offset)
-    } else {
-        addr
-    };
-
-    // Now handle reg64 and reg32-extended components.
-    let addr = lower_add_addends(ctx, addr, addends64, addends32);
-
-    // Shoehorn addr into the AMode.
-    match memarg {
-        AMode::RegExtended { rm, extendop, .. } => AMode::RegExtended {
-            rn: addr,
-            rm,
-            extendop,
-        },
-        AMode::RegOffset { off, ty, .. } => AMode::RegOffset { rn: addr, off, ty },
-        AMode::RegReg { rn, .. } => AMode::RegReg { rn: addr, rm: rn },
-        AMode::UnsignedOffset { uimm12, .. } => AMode::UnsignedOffset { rn: addr, uimm12 },
-        _ => unreachable!(),
-    }
-}
-
-fn lower_add_addends(
-    ctx: &mut Lower<Inst>,
-    init: Reg,
-    addends64: AddressAddend64List,
-    addends32: AddressAddend32List,
-) -> Reg {
-    let init = addends64.into_iter().fold(init, |prev, reg| {
-        // If the register is the stack reg, we must move it to another reg
-        // before adding it.
-        let reg = if reg == stack_reg() {
-            let tmp = ctx.alloc_tmp(I64).only_reg().unwrap();
-            ctx.emit(Inst::gen_move(tmp, stack_reg(), I64));
-            tmp.to_reg()
-        } else {
-            reg
-        };
-
-        let rd = ctx.alloc_tmp(I64).only_reg().unwrap();
-
-        ctx.emit(Inst::AluRRR {
-            alu_op: ALUOp::Add,
-            size: OperandSize::Size64,
-            rd,
-            rn: prev,
-            rm: reg,
-        });
-
-        rd.to_reg()
-    });
-
-    addends32.into_iter().fold(init, |prev, (reg, extendop)| {
-        assert!(reg != stack_reg());
-
-        let rd = ctx.alloc_tmp(I64).only_reg().unwrap();
-
-        ctx.emit(Inst::AluRRRExtend {
-            alu_op: ALUOp::Add,
-            size: OperandSize::Size64,
-            rd,
-            rn: prev,
-            rm: reg,
-            extendop,
-        });
-
-        rd.to_reg()
-    })
-}
-
-/// Adds into `rd` a signed imm pattern matching the best instruction for it.
-// TODO: This function is duplicated in ctx.gen_add_imm
-fn lower_add_immediate(ctx: &mut Lower<Inst>, src: Reg, imm: i64) -> Reg {
-    let dst = ctx.alloc_tmp(I64).only_reg().unwrap();
-
-    // If we can fit offset or -offset in an imm12, use an add-imm
-    // Otherwise, lower the constant first then add.
-    if let Some(imm12) = Imm12::maybe_from_u64(imm as u64) {
-        ctx.emit(Inst::AluRRImm12 {
-            alu_op: ALUOp::Add,
-            size: OperandSize::Size64,
-            rd: dst,
-            rn: src,
-            imm12,
-        });
-    } else if let Some(imm12) = Imm12::maybe_from_u64(imm.wrapping_neg() as u64) {
-        ctx.emit(Inst::AluRRImm12 {
-            alu_op: ALUOp::Sub,
-            size: OperandSize::Size64,
-            rd: dst,
-            rn: src,
-            imm12,
-        });
-    } else {
-        let tmp = ctx.alloc_tmp(I64).only_reg().unwrap();
-        lower_constant_u64(ctx, tmp, imm as u64);
-        ctx.emit(Inst::AluRRR {
-            alu_op: ALUOp::Add,
-            size: OperandSize::Size64,
-            rd: dst,
-            rn: tmp.to_reg(),
-            rm: src,
-        });
+        return Some((ctx.input_as_value(insn, 0), extendop));
     }
 
-    dst.to_reg()
-}
-
-pub(crate) fn lower_constant_u64(ctx: &mut Lower<Inst>, rd: Writable<Reg>, value: u64) {
-    for inst in Inst::load_constant(rd, value, &mut |ty| ctx.alloc_tmp(ty).only_reg().unwrap()) {
-        ctx.emit(inst);
-    }
+    None
 }
 
 pub(crate) fn lower_condcode(cc: IntCC) -> Cond {
@@ -625,58 +107,6 @@ pub(crate) fn lower_fp_condcode(cc: FloatCC) -> Cond {
     }
 }
 
-//=============================================================================
-// Helpers for instruction lowering.
-
-/// Checks for an instance of `op` feeding the given input.
-pub(crate) fn maybe_input_insn(
-    c: &mut Lower<Inst>,
-    input: InsnInput,
-    op: Opcode,
-) -> Option<IRInst> {
-    let inputs = c.get_input_as_source_or_const(input.insn, input.input);
-    trace!(
-        "maybe_input_insn: input {:?} has options {:?}; looking for op {:?}",
-        input,
-        inputs,
-        op
-    );
-    if let Some((src_inst, _)) = inputs.inst.as_inst() {
-        let data = c.data(src_inst);
-        trace!(" -> input inst {:?}", data);
-        if data.opcode() == op {
-            return Some(src_inst);
-        }
-    }
-    None
-}
-
-/// Checks for an instance of `op` defining the given value.
-pub(crate) fn maybe_value(c: &mut Lower<Inst>, value: Value, op: Opcode) -> Option<IRInst> {
-    let inputs = c.get_value_as_source_or_const(value);
-    if let Some((src_inst, _)) = inputs.inst.as_inst() {
-        let data = c.data(src_inst);
-        if data.opcode() == op {
-            return Some(src_inst);
-        }
-    }
-    None
-}
-
-/// Checks for an instance of any one of `ops` defining the given value.
-pub(crate) fn maybe_value_multi(
-    c: &mut Lower<Inst>,
-    value: Value,
-    ops: &[Opcode],
-) -> Option<(Opcode, IRInst)> {
-    for &op in ops {
-        if let Some(inst) = maybe_value(c, value, op) {
-            return Some((op, inst));
-        }
-    }
-    None
-}
-
 //=============================================================================
 // Lowering-backend trait implementation.
 
diff --git a/cranelift/codegen/src/isa/aarch64/lower/isle.rs b/cranelift/codegen/src/isa/aarch64/lower/isle.rs
index 72f843372524..ffea0fc42595 100644
--- a/cranelift/codegen/src/isa/aarch64/lower/isle.rs
+++ b/cranelift/codegen/src/isa/aarch64/lower/isle.rs
@@ -8,16 +8,14 @@ use smallvec::SmallVec;
 // Types that the generated ISLE code uses via `use super::*`.
 use super::{
     fp_reg, lower_condcode, lower_fp_condcode, stack_reg, writable_link_reg, writable_zero_reg,
-    zero_reg, AMode, ASIMDFPModImm, ASIMDMovModImm, BranchTarget, CallIndInfo, CallInfo, Cond,
-    CondBrKind, ExtendOp, FPUOpRI, FPUOpRIMod, FloatCC, Imm12, ImmLogic, ImmShift, Inst as MInst,
-    IntCC, JTSequenceInfo, MachLabel, MemLabel, MoveWideConst, MoveWideOp, NarrowValueMode, Opcode,
-    OperandSize, PairAMode, Reg, SImm9, ScalarSize, ShiftOpAndAmt, UImm12Scaled, UImm5, VecMisc2,
-    VectorSize, NZCV,
+    zero_reg, ASIMDFPModImm, ASIMDMovModImm, BranchTarget, CallIndInfo, CallInfo, Cond, CondBrKind,
+    ExtendOp, FPUOpRI, FPUOpRIMod, FloatCC, Imm12, ImmLogic, ImmShift, Inst as MInst, IntCC,
+    JTSequenceInfo, MachLabel, MemLabel, MoveWideConst, MoveWideOp, Opcode, OperandSize, Reg,
+    SImm9, ScalarSize, ShiftOpAndAmt, UImm12Scaled, UImm5, VecMisc2, VectorSize, NZCV,
 };
 use crate::ir::condcodes;
 use crate::isa;
 use crate::isa::aarch64::inst::{FPULeftShiftImm, FPURightShiftImm, ReturnCallInfo};
-use crate::isa::aarch64::lower::{lower_address, lower_pair_address};
 use crate::isa::aarch64::AArch64Backend;
 use crate::machinst::valueregs;
 use crate::machinst::{isle::*, InputSourceInst};
@@ -29,6 +27,7 @@ use crate::{
     },
     isa::aarch64::abi::AArch64CallSite,
     isa::aarch64::inst::args::{ShiftOp, ShiftOpShiftImm},
+    isa::aarch64::inst::SImm7Scaled,
     isa::unwind::UnwindInst,
     machinst::{
         abi::ArgPair, ty_bits, InstOutput, Lower, MachInst, VCodeConstant, VCodeConstantData,
@@ -110,7 +109,7 @@ impl Context for IsleContext<'_, '_, MInst, AArch64Backend> {
             caller_conv,
             self.backend.flags().clone(),
         );
-        call_site.emit_return_call(self.lower_ctx, args);
+        call_site.emit_return_call(self.lower_ctx, args, &self.backend.isa_flags);
 
         InstOutput::new()
     }
@@ -138,7 +137,7 @@ impl Context for IsleContext<'_, '_, MInst, AArch64Backend> {
             caller_conv,
             self.backend.flags().clone(),
         );
-        call_site.emit_return_call(self.lower_ctx, args);
+        call_site.emit_return_call(self.lower_ctx, args, &self.backend.isa_flags);
 
         InstOutput::new()
     }
@@ -414,8 +413,7 @@ impl Context for IsleContext<'_, '_, MInst, AArch64Backend> {
     }
 
     fn extended_value_from_value(&mut self, val: Value) -> Option<ExtendedValue> {
-        let (val, extend) =
-            super::get_as_extended_value(self.lower_ctx, val, NarrowValueMode::None)?;
+        let (val, extend) = super::get_as_extended_value(self.lower_ctx, val)?;
         Some(ExtendedValue { val, extend })
     }
 
@@ -571,18 +569,6 @@ impl Context for IsleContext<'_, '_, MInst, AArch64Backend> {
         }
     }
 
-    fn amode(&mut self, ty: Type, addr: Value, offset: u32) -> AMode {
-        let addr_ty = self.value_type(addr);
-        assert!(addr_ty == I64 || addr_ty == R64);
-        lower_address(self.lower_ctx, ty, addr, offset as i32)
-    }
-
-    fn pair_amode(&mut self, addr: Value, offset: u32) -> PairAMode {
-        let addr_ty = self.value_type(addr);
-        assert!(addr_ty == I64 || addr_ty == R64);
-        lower_pair_address(self.lower_ctx, addr, offset as i32)
-    }
-
     fn fp_cond_code(&mut self, cc: &condcodes::FloatCC) -> Cond {
         lower_fp_condcode(*cc)
     }
@@ -870,4 +856,16 @@ impl Context for IsleContext<'_, '_, MInst, AArch64Backend> {
     fn shift_masked_imm(&mut self, ty: Type, imm: u64) -> u8 {
         (imm as u8) & ((ty.lane_bits() - 1) as u8)
     }
+
+    fn simm7_scaled_from_i64(&mut self, val: i64, ty: Type) -> Option<SImm7Scaled> {
+        SImm7Scaled::maybe_from_i64(val, ty)
+    }
+
+    fn simm9_from_i64(&mut self, val: i64) -> Option<SImm9> {
+        SImm9::maybe_from_i64(val)
+    }
+
+    fn uimm12_scaled_from_i64(&mut self, val: i64, ty: Type) -> Option<UImm12Scaled> {
+        UImm12Scaled::maybe_from_i64(val, ty)
+    }
 }
diff --git a/cranelift/codegen/src/isa/riscv64/abi.rs b/cranelift/codegen/src/isa/riscv64/abi.rs
index e4cfb0e101c7..8a8c807c19c5 100644
--- a/cranelift/codegen/src/isa/riscv64/abi.rs
+++ b/cranelift/codegen/src/isa/riscv64/abi.rs
@@ -253,6 +253,7 @@ impl ABIMachineSpec for Riscv64MachineDeps {
     fn gen_ret(
         _setup_frame: bool,
         _isa_flags: &Self::F,
+        _call_conv: isa::CallConv,
         rets: Vec<RetPair>,
         stack_bytes_to_pop: u32,
     ) -> Inst {
diff --git a/cranelift/codegen/src/isa/riscv64/inst.isle b/cranelift/codegen/src/isa/riscv64/inst.isle
index 264880d0def9..b7576a55317b 100644
--- a/cranelift/codegen/src/isa/riscv64/inst.isle
+++ b/cranelift/codegen/src/isa/riscv64/inst.isle
@@ -334,6 +334,15 @@
       (probe_count u32)
       (tmp WritableReg))
 
+    (VecAluRRRR
+      (op VecAluOpRRRR)
+      (vd WritableReg)
+      (vd_src Reg)
+      (vs2 Reg)
+      (vs1 Reg)
+      (mask VecOpMasking)
+      (vstate VState))
+
     (VecAluRRRImm5
       (op VecAluOpRRRImm5)
       (vd WritableReg)
diff --git a/cranelift/codegen/src/isa/riscv64/inst/emit.rs b/cranelift/codegen/src/isa/riscv64/inst/emit.rs
index 348007d2ffb0..38276c05b4fd 100644
--- a/cranelift/codegen/src/isa/riscv64/inst/emit.rs
+++ b/cranelift/codegen/src/isa/riscv64/inst/emit.rs
@@ -473,6 +473,7 @@ impl Inst {
 
             Inst::VecAluRR { vstate, .. } |
             Inst::VecAluRRR { vstate, .. } |
+            Inst::VecAluRRRR { vstate, .. } |
             Inst::VecAluRImm5 { vstate, .. } |
             Inst::VecAluRRImm5 { vstate, .. } |
             Inst::VecAluRRRImm5 { vstate, .. } |
@@ -1189,7 +1190,7 @@ impl MachInstEmit for Inst {
                 // we need to emit a jump table here to support that jump.
                 let distance = (targets.len() * 2 * Inst::INSTRUCTION_SIZE as usize) as u32;
                 if sink.island_needed(distance) {
-                    sink.emit_island(distance, &mut state.ctrl_plane);
+                    sink.emit_island(&mut state.ctrl_plane);
                 }
 
                 // Emit the jumps back to back
@@ -2909,6 +2910,25 @@ impl MachInstEmit for Inst {
 
                 sink.put4(encode_valu_rrr_imm(op, vd, imm, vs2, mask));
             }
+            &Inst::VecAluRRRR {
+                op,
+                vd,
+                vd_src,
+                vs1,
+                vs2,
+                ref mask,
+                ..
+            } => {
+                let vs1 = allocs.next(vs1);
+                let vs2 = allocs.next(vs2);
+                let vd_src = allocs.next(vd_src);
+                let vd = allocs.next_writable(vd);
+                let mask = mask.with_allocs(&mut allocs);
+
+                debug_assert_eq!(vd.to_reg(), vd_src);
+
+                sink.put4(encode_valu_rrrr(op, vd, vs1, vs2, mask));
+            }
             &Inst::VecAluRRR {
                 op,
                 vd,
@@ -3132,7 +3152,7 @@ fn emit_return_call_common_sequence(
             dest: BranchTarget::Label(jump_around_label),
         }
         .emit(&[], sink, emit_info, state);
-        sink.emit_island(space_needed + 4, &mut state.ctrl_plane);
+        sink.emit_island(&mut state.ctrl_plane);
         sink.bind_label(jump_around_label, &mut state.ctrl_plane);
     }
 
diff --git a/cranelift/codegen/src/isa/riscv64/inst/encode.rs b/cranelift/codegen/src/isa/riscv64/inst/encode.rs
index bf7c469901ff..cff00cecabbf 100644
--- a/cranelift/codegen/src/isa/riscv64/inst/encode.rs
+++ b/cranelift/codegen/src/isa/riscv64/inst/encode.rs
@@ -9,8 +9,8 @@
 use super::{Imm12, Imm5, UImm5, VType};
 use crate::isa::riscv64::inst::reg_to_gpr_num;
 use crate::isa::riscv64::lower::isle::generated_code::{
-    VecAluOpRImm5, VecAluOpRR, VecAluOpRRImm5, VecAluOpRRR, VecAluOpRRRImm5, VecElementWidth,
-    VecOpCategory, VecOpMasking,
+    VecAluOpRImm5, VecAluOpRR, VecAluOpRRImm5, VecAluOpRRR, VecAluOpRRRImm5, VecAluOpRRRR,
+    VecElementWidth, VecOpCategory, VecOpMasking,
 };
 use crate::machinst::isle::WritableReg;
 use crate::Reg;
@@ -146,6 +146,24 @@ pub fn encode_valu_rr_imm(
     )
 }
 
+pub fn encode_valu_rrrr(
+    op: VecAluOpRRRR,
+    vd: WritableReg,
+    vs2: Reg,
+    vs1: Reg,
+    masking: VecOpMasking,
+) -> u32 {
+    let funct7 = (op.funct6() << 1) | masking.encode();
+    encode_r_type_bits(
+        op.opcode(),
+        reg_to_gpr_num(vd.to_reg()),
+        op.funct3(),
+        reg_to_gpr_num(vs1),
+        reg_to_gpr_num(vs2),
+        funct7,
+    )
+}
+
 pub fn encode_valu_rrr_imm(
     op: VecAluOpRRRImm5,
     vd: WritableReg,
diff --git a/cranelift/codegen/src/isa/riscv64/inst/mod.rs b/cranelift/codegen/src/isa/riscv64/inst/mod.rs
index ca6bfe4fb537..786c958ad4da 100644
--- a/cranelift/codegen/src/isa/riscv64/inst/mod.rs
+++ b/cranelift/codegen/src/isa/riscv64/inst/mod.rs
@@ -685,6 +685,26 @@ fn riscv64_get_operands<F: Fn(VReg) -> VReg>(inst: &Inst, collector: &mut Operan
             // gen_prologue is called at emit stage.
             // no need let reg alloc know.
         }
+        &Inst::VecAluRRRR {
+            op,
+            vd,
+            vd_src,
+            vs1,
+            vs2,
+            ref mask,
+            ..
+        } => {
+            debug_assert_eq!(vd_src.class(), RegClass::Vector);
+            debug_assert_eq!(vd.to_reg().class(), RegClass::Vector);
+            debug_assert_eq!(vs2.class(), RegClass::Vector);
+            debug_assert_eq!(vs1.class(), op.vs1_regclass());
+
+            collector.reg_late_use(vs1);
+            collector.reg_late_use(vs2);
+            collector.reg_use(vd_src);
+            collector.reg_reuse_def(vd, 2); // `vd` == `vd_src`.
+            vec_mask_late_operands(mask, collector);
+        }
         &Inst::VecAluRRRImm5 {
             op,
             vd,
@@ -1754,6 +1774,31 @@ impl Inst {
             &MInst::Udf { trap_code } => format!("udf##trap_code={}", trap_code),
             &MInst::EBreak {} => String::from("ebreak"),
             &MInst::ECall {} => String::from("ecall"),
+            &Inst::VecAluRRRR {
+                op,
+                vd,
+                vd_src,
+                vs1,
+                vs2,
+                ref mask,
+                ref vstate,
+            } => {
+                let vs1_s = format_reg(vs1, allocs);
+                let vs2_s = format_reg(vs2, allocs);
+                let vd_src_s = format_reg(vd_src, allocs);
+                let vd_s = format_reg(vd.to_reg(), allocs);
+                let mask = format_mask(mask, allocs);
+
+                let vd_fmt = if vd_s != vd_src_s {
+                    format!("{},{}", vd_s, vd_src_s)
+                } else {
+                    vd_s
+                };
+
+                // Note: vs2 and vs1 here are opposite to the standard scalar ordering.
+                // This is noted in Section 10.1 of the RISC-V Vector spec.
+                format!("{op} {vd_fmt},{vs2_s},{vs1_s}{mask} {vstate}")
+            }
             &Inst::VecAluRRRImm5 {
                 op,
                 vd,
diff --git a/cranelift/codegen/src/isa/riscv64/inst/vector.rs b/cranelift/codegen/src/isa/riscv64/inst/vector.rs
index 19e4b2216339..09d9e28795ea 100644
--- a/cranelift/codegen/src/isa/riscv64/inst/vector.rs
+++ b/cranelift/codegen/src/isa/riscv64/inst/vector.rs
@@ -1,5 +1,6 @@
 use crate::isa::riscv64::inst::AllocationConsumer;
 use crate::isa::riscv64::inst::EmitState;
+use crate::isa::riscv64::lower::isle::generated_code::VecAluOpRRRR;
 use crate::isa::riscv64::lower::isle::generated_code::{
     VecAMode, VecAluOpRImm5, VecAluOpRR, VecAluOpRRImm5, VecAluOpRRR, VecAluOpRRRImm5, VecAvl,
     VecElementWidth, VecLmul, VecMaskMode, VecOpCategory, VecOpMasking, VecTailMode,
@@ -252,6 +253,49 @@ impl VecOpMasking {
     }
 }
 
+impl VecAluOpRRRR {
+    pub fn opcode(&self) -> u32 {
+        // Vector Opcode
+        0x57
+    }
+    pub fn funct3(&self) -> u32 {
+        self.category().encode()
+    }
+
+    pub fn funct6(&self) -> u32 {
+        // See: https://github.com/riscv/riscv-v-spec/blob/master/inst-table.adoc
+        match self {
+            VecAluOpRRRR::VmaccVV | VecAluOpRRRR::VmaccVX => 0b101101,
+            VecAluOpRRRR::VnmsacVV | VecAluOpRRRR::VnmsacVX => 0b101111,
+        }
+    }
+
+    pub fn category(&self) -> VecOpCategory {
+        match self {
+            VecAluOpRRRR::VmaccVV | VecAluOpRRRR::VnmsacVV => VecOpCategory::OPMVV,
+            VecAluOpRRRR::VmaccVX | VecAluOpRRRR::VnmsacVX => VecOpCategory::OPMVX,
+        }
+    }
+
+    // vs1 is the only variable source, vs2 is fixed.
+    pub fn vs1_regclass(&self) -> RegClass {
+        match self.category() {
+            VecOpCategory::OPMVV => RegClass::Vector,
+            VecOpCategory::OPMVX => RegClass::Int,
+            _ => unreachable!(),
+        }
+    }
+}
+
+impl fmt::Display for VecAluOpRRRR {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        let mut s = format!("{self:?}");
+        s.make_ascii_lowercase();
+        let (opcode, category) = s.split_at(s.len() - 2);
+        f.write_str(&format!("{opcode}.{category}"))
+    }
+}
+
 impl VecAluOpRRRImm5 {
     pub fn opcode(&self) -> u32 {
         // Vector Opcode
diff --git a/cranelift/codegen/src/isa/riscv64/inst_vector.isle b/cranelift/codegen/src/isa/riscv64/inst_vector.isle
index 49133a2ae2fb..20491c89ca2a 100644
--- a/cranelift/codegen/src/isa/riscv64/inst_vector.isle
+++ b/cranelift/codegen/src/isa/riscv64/inst_vector.isle
@@ -212,6 +212,17 @@
   (VslideupVI)
 ))
 
+;; Register-Register ALU Ops that modify the destination register
+(type VecAluOpRRRR (enum
+  ;; Vector-Vector Opcodes
+  (VmaccVV)
+  (VnmsacVV)
+
+  ;; Vector-Scalar Opcodes
+  (VmaccVX)
+  (VnmsacVX)
+))
+
 ;; Register-Imm ALU Ops
 (type VecAluOpRRImm5 (enum
   ;; Regular VI Opcodes
@@ -335,6 +346,14 @@
 ;; See Section 10.1 of the RISC-V Vector Extension Specification.
 
 
+;; Helper for emitting `MInst.VecAluRRRR` instructions.
+;; These instructions modify the destination register.
+(decl vec_alu_rrrr (VecAluOpRRRR VReg VReg Reg VecOpMasking  VState) VReg)
+(rule (vec_alu_rrrr op vd_src vs2 vs1 mask vstate)
+      (let ((vd WritableVReg (temp_writable_vreg))
+            (_ Unit (emit (MInst.VecAluRRRR op vd vd_src vs2 vs1 mask vstate))))
+        vd))
+
 ;; Helper for emitting `MInst.VecAluRRRImm5` instructions.
 ;; These instructions modify the destination register.
 (decl vec_alu_rrr_imm5 (VecAluOpRRRImm5 VReg VReg Imm5 VecOpMasking  VState) VReg)
@@ -645,6 +664,38 @@
 (rule (rv_vsmul_vx vs2 vs1 mask vstate)
   (vec_alu_rrr (VecAluOpRRR.VsmulVX) vs2 vs1 mask vstate))
 
+;; Helper for emitting the `vmacc.vv` instruction.
+;;
+;; Integer multiply-add, overwrite addend
+;; # vd[i] = +(vs1[i] * vs2[i]) + vd[i]
+(decl rv_vmacc_vv (VReg VReg VReg VecOpMasking VState) VReg)
+(rule (rv_vmacc_vv vd vs2 vs1 mask vstate)
+  (vec_alu_rrrr (VecAluOpRRRR.VmaccVV) vd vs2 vs1 mask vstate))
+
+;; Helper for emitting the `vmacc.vx` instruction.
+;;
+;; Integer multiply-add, overwrite addend
+;; # vd[i] = +(x[rs1] * vs2[i]) + vd[i]
+(decl rv_vmacc_vx (VReg VReg XReg VecOpMasking VState) VReg)
+(rule (rv_vmacc_vx vd vs2 vs1 mask vstate)
+  (vec_alu_rrrr (VecAluOpRRRR.VmaccVX) vd vs2 vs1 mask vstate))
+
+;; Helper for emitting the `vnmsac.vv` instruction.
+;;
+;; Integer multiply-sub, overwrite minuend
+;; # vd[i] = -(vs1[i] * vs2[i]) + vd[i]
+(decl rv_vnmsac_vv (VReg VReg VReg VecOpMasking VState) VReg)
+(rule (rv_vnmsac_vv vd vs2 vs1 mask vstate)
+  (vec_alu_rrrr (VecAluOpRRRR.VnmsacVV) vd vs2 vs1 mask vstate))
+
+;; Helper for emitting the `vnmsac.vx` instruction.
+;;
+;; Integer multiply-sub, overwrite minuend
+;; # vd[i] = -(x[rs1] * vs2[i]) + vd[i]
+(decl rv_vnmsac_vx (VReg VReg XReg VecOpMasking VState) VReg)
+(rule (rv_vnmsac_vx vd vs2 vs1 mask vstate)
+  (vec_alu_rrrr (VecAluOpRRRR.VnmsacVX) vd vs2 vs1 mask vstate))
+
 ;; Helper for emitting the `sll.vv` instruction.
 (decl rv_vsll_vv (VReg VReg VecOpMasking VState) VReg)
 (rule (rv_vsll_vv vs2 vs1 mask vstate)
diff --git a/cranelift/codegen/src/isa/riscv64/lower.isle b/cranelift/codegen/src/isa/riscv64/lower.isle
index 926d8609ab5e..27632e102195 100644
--- a/cranelift/codegen/src/isa/riscv64/lower.isle
+++ b/cranelift/codegen/src/isa/riscv64/lower.isle
@@ -249,6 +249,49 @@
                                                             (uwiden_low y))))
   (rv_vwaddu_vv (gen_slidedown_half in_ty x) y (unmasked) (vstate_mf2 (ty_half_lanes in_ty))))
 
+;; Fused Multiply Accumulate Rules `vmacc`
+;;
+;; I dont think we can use `vmadd`/`vmnsub` here since it just modifies the multiplication
+;; register instead of the addition one. The actual pattern matched seems to be
+;; exactly the same.
+
+(rule 9 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (imul y z))))
+  (rv_vmacc_vv x y z (unmasked) ty))
+
+(rule 10 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (imul y (splat z)))))
+  (rv_vmacc_vx x y z (unmasked) ty))
+
+(rule 11 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (imul (splat y) z))))
+  (rv_vmacc_vx x z y (unmasked) ty))
+
+(rule 12 (lower (has_type (ty_vec_fits_in_register ty) (iadd (imul x y) z)))
+  (rv_vmacc_vv z x y (unmasked) ty))
+
+(rule 13 (lower (has_type (ty_vec_fits_in_register ty) (iadd (imul x (splat y)) z)))
+  (rv_vmacc_vx z x y (unmasked) ty))
+
+(rule 14 (lower (has_type (ty_vec_fits_in_register ty) (iadd (imul (splat x) y) z)))
+  (rv_vmacc_vx z y x (unmasked) ty))
+
+;; Fused Multiply Subtract Rules `vnmsac`
+
+(rule 9 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (ineg (imul y z)))))
+  (rv_vnmsac_vv x y z (unmasked) ty))
+
+(rule 10 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (ineg (imul y (splat z))))))
+  (rv_vnmsac_vx x y z (unmasked) ty))
+
+(rule 11 (lower (has_type (ty_vec_fits_in_register ty) (iadd x (ineg (imul (splat y) z)))))
+  (rv_vnmsac_vx x z y (unmasked) ty))
+
+(rule 12 (lower (has_type (ty_vec_fits_in_register ty) (iadd (ineg (imul x y)) z)))
+  (rv_vnmsac_vv z x y (unmasked) ty))
+
+(rule 13 (lower (has_type (ty_vec_fits_in_register ty) (iadd (ineg (imul x (splat y))) z)))
+  (rv_vnmsac_vx z x y (unmasked) ty))
+
+(rule 14 (lower (has_type (ty_vec_fits_in_register ty) (iadd (ineg (imul (splat x) y)) z)))
+  (rv_vnmsac_vx z y x (unmasked) ty))
 
 ;;; Rules for `uadd_overflow_trap` ;;;;;;;;;;;;;
 (rule
diff --git a/cranelift/codegen/src/isa/s390x/abi.rs b/cranelift/codegen/src/isa/s390x/abi.rs
index 8c0fd25f1bd7..fdfae057eefb 100644
--- a/cranelift/codegen/src/isa/s390x/abi.rs
+++ b/cranelift/codegen/src/isa/s390x/abi.rs
@@ -443,6 +443,7 @@ impl ABIMachineSpec for S390xMachineDeps {
     fn gen_ret(
         _setup_frame: bool,
         _isa_flags: &s390x_settings::Flags,
+        _call_conv: isa::CallConv,
         rets: Vec<RetPair>,
         stack_bytes_to_pop: u32,
     ) -> Inst {
diff --git a/cranelift/codegen/src/isa/x64/abi.rs b/cranelift/codegen/src/isa/x64/abi.rs
index feb3d447276c..947cb0d76dac 100644
--- a/cranelift/codegen/src/isa/x64/abi.rs
+++ b/cranelift/codegen/src/isa/x64/abi.rs
@@ -351,6 +351,7 @@ impl ABIMachineSpec for X64ABIMachineSpec {
     fn gen_ret(
         _setup_frame: bool,
         _isa_flags: &x64_settings::Flags,
+        _call_conv: isa::CallConv,
         rets: Vec<RetPair>,
         stack_bytes_to_pop: u32,
     ) -> Self::I {
@@ -411,14 +412,12 @@ impl ABIMachineSpec for X64ABIMachineSpec {
         // Only ever used for I64s and vectors; if that changes, see if the
         // ExtKind below needs to be changed.
         assert!(ty == I64 || ty.is_vector());
-        let simm32 = offset as u32;
-        let mem = Amode::imm_reg(simm32, base);
+        let mem = Amode::imm_reg(offset, base);
         Inst::load(ty, mem, into_reg, ExtKind::None)
     }
 
     fn gen_store_base_offset(base: Reg, offset: i32, from_reg: Reg, ty: Type) -> Self::I {
-        let simm32 = offset as u32;
-        let mem = Amode::imm_reg(simm32, base);
+        let mem = Amode::imm_reg(offset, base);
         Inst::store(ty, from_reg, mem)
     }
 
@@ -574,7 +573,7 @@ impl ABIMachineSpec for X64ABIMachineSpec {
                     insts.push(Inst::store(
                         types::I64,
                         r_reg.into(),
-                        Amode::imm_reg(cur_offset, regs::rsp()),
+                        Amode::imm_reg(cur_offset.try_into().unwrap(), regs::rsp()),
                     ));
                     cur_offset += 8;
                 }
@@ -583,7 +582,7 @@ impl ABIMachineSpec for X64ABIMachineSpec {
                     insts.push(Inst::store(
                         types::I8X16,
                         r_reg.into(),
-                        Amode::imm_reg(cur_offset, regs::rsp()),
+                        Amode::imm_reg(cur_offset.try_into().unwrap(), regs::rsp()),
                     ));
                     cur_offset += 16;
                 }
@@ -625,7 +624,7 @@ impl ABIMachineSpec for X64ABIMachineSpec {
             match rreg.class() {
                 RegClass::Int => {
                     insts.push(Inst::mov64_m_r(
-                        Amode::imm_reg(cur_offset, regs::rsp()),
+                        Amode::imm_reg(cur_offset.try_into().unwrap(), regs::rsp()),
                         Writable::from_reg(rreg.into()),
                     ));
                     cur_offset += 8;
@@ -634,7 +633,7 @@ impl ABIMachineSpec for X64ABIMachineSpec {
                     cur_offset = align_to(cur_offset, 16);
                     insts.push(Inst::load(
                         types::I8X16,
-                        Amode::imm_reg(cur_offset, regs::rsp()),
+                        Amode::imm_reg(cur_offset.try_into().unwrap(), regs::rsp()),
                         Writable::from_reg(rreg.into()),
                         ExtKind::None,
                     ));
@@ -917,9 +916,8 @@ impl From<StackAMode> for SyntheticAmode {
             StackAMode::FPOffset(off, _ty) => {
                 let off = i32::try_from(off)
                     .expect("Offset in FPOffset is greater than 2GB; should hit impl limit first");
-                let simm32 = off as u32;
                 SyntheticAmode::Real(Amode::ImmReg {
-                    simm32,
+                    simm32: off,
                     base: regs::rbp(),
                     flags: MemFlags::trusted(),
                 })
@@ -928,15 +926,13 @@ impl From<StackAMode> for SyntheticAmode {
                 let off = i32::try_from(off).expect(
                     "Offset in NominalSPOffset is greater than 2GB; should hit impl limit first",
                 );
-                let simm32 = off as u32;
-                SyntheticAmode::nominal_sp_offset(simm32)
+                SyntheticAmode::nominal_sp_offset(off)
             }
             StackAMode::SPOffset(off, _ty) => {
                 let off = i32::try_from(off)
                     .expect("Offset in SPOffset is greater than 2GB; should hit impl limit first");
-                let simm32 = off as u32;
                 SyntheticAmode::Real(Amode::ImmReg {
-                    simm32,
+                    simm32: off,
                     base: regs::rsp(),
                     flags: MemFlags::trusted(),
                 })
diff --git a/cranelift/codegen/src/isa/x64/encoding/evex.rs b/cranelift/codegen/src/isa/x64/encoding/evex.rs
index 80626de29bb6..03a3ac6c7b0e 100644
--- a/cranelift/codegen/src/isa/x64/encoding/evex.rs
+++ b/cranelift/codegen/src/isa/x64/encoding/evex.rs
@@ -641,7 +641,7 @@ mod tests {
             (
                 regs::xmm10(),
                 Amode::ImmReg {
-                    simm32: (-16i32) as u32,
+                    simm32: -16,
                     base: regs::r14(),
                     flags: MemFlags::trusted(),
                 }
@@ -652,7 +652,7 @@ mod tests {
             (
                 regs::xmm11(),
                 Amode::ImmReg {
-                    simm32: (-5i32) as u32,
+                    simm32: -5,
                     base: regs::r15(),
                     flags: MemFlags::trusted(),
                 }
@@ -663,7 +663,7 @@ mod tests {
             (
                 regs::xmm12(),
                 Amode::ImmReg {
-                    simm32: (-2048i32) as u32,
+                    simm32: -2048,
                     base: regs::rdx(),
                     flags: MemFlags::trusted(),
                 }
@@ -674,7 +674,7 @@ mod tests {
             (
                 regs::xmm13(),
                 Amode::ImmReg {
-                    simm32: (-2064i32) as u32,
+                    simm32: -2064,
                     base: regs::rsi(),
                     flags: MemFlags::trusted(),
                 }
diff --git a/cranelift/codegen/src/isa/x64/encoding/rex.rs b/cranelift/codegen/src/isa/x64/encoding/rex.rs
index 70a61425cbcc..ab989a5f261d 100644
--- a/cranelift/codegen/src/isa/x64/encoding/rex.rs
+++ b/cranelift/codegen/src/isa/x64/encoding/rex.rs
@@ -455,13 +455,12 @@ impl Imm {
     /// The `evex_scaling` factor provided here is `Some(N)` for EVEX
     /// instructions.  This is taken into account where the `Imm` value
     /// contained is the raw byte offset.
-    fn new(val: u32, evex_scaling: Option<i8>) -> Imm {
+    fn new(val: i32, evex_scaling: Option<i8>) -> Imm {
         if val == 0 {
             return Imm::None;
         }
         match evex_scaling {
             Some(scaling) => {
-                let val = val as i32;
                 if val % i32::from(scaling) == 0 {
                     let scaled = val / i32::from(scaling);
                     if low8_will_sign_extend_to_32(scaled as u32) {
@@ -470,8 +469,10 @@ impl Imm {
                 }
                 Imm::Imm32(val)
             }
-            None if low8_will_sign_extend_to_32(val) => Imm::Imm8(val as i8),
-            None => Imm::Imm32(val as i32),
+            None => match i8::try_from(val) {
+                Ok(val) => Imm::Imm8(val),
+                Err(_) => Imm::Imm32(val),
+            },
         }
     }
 
diff --git a/cranelift/codegen/src/isa/x64/inst.isle b/cranelift/codegen/src/isa/x64/inst.isle
index 1398caa846f5..e7999bd3254b 100644
--- a/cranelift/codegen/src/isa/x64/inst.isle
+++ b/cranelift/codegen/src/isa/x64/inst.isle
@@ -1006,12 +1006,12 @@
 ;; in instructions. These denote a 64-bit value only.
 (type Amode (enum
              ;; Immediate sign-extended and a register
-             (ImmReg (simm32 u32)
+             (ImmReg (simm32 i32)
                      (base Reg)
                      (flags MemFlags))
 
              ;; Sign-extend-32-to-64(simm32) + base + (index << shift)
-             (ImmRegRegShift (simm32 u32)
+             (ImmRegRegShift (simm32 i32)
                              (base Gpr)
                              (index Gpr)
                              (shift u8)
@@ -1087,7 +1087,7 @@
 
 ;; Offsetting an Amode. Used when we need to do consecutive
 ;; loads/stores to adjacent addresses.
-(decl amode_offset (Amode u32) Amode)
+(decl amode_offset (Amode i32) Amode)
 (extern constructor amode_offset amode_offset)
 
 ;; Return a zero offset as an `Offset32`.
diff --git a/cranelift/codegen/src/isa/x64/inst/args.rs b/cranelift/codegen/src/isa/x64/inst/args.rs
index 40a00dc665a3..7ffc2c072897 100644
--- a/cranelift/codegen/src/isa/x64/inst/args.rs
+++ b/cranelift/codegen/src/isa/x64/inst/args.rs
@@ -291,7 +291,7 @@ pub use crate::isa::x64::lower::isle::generated_code::Amode;
 
 impl Amode {
     /// Create an immediate sign-extended and register addressing mode.
-    pub fn imm_reg(simm32: u32, base: Reg) -> Self {
+    pub fn imm_reg(simm32: i32, base: Reg) -> Self {
         debug_assert!(base.class() == RegClass::Int);
         Self::ImmReg {
             simm32,
@@ -301,7 +301,7 @@ impl Amode {
     }
 
     /// Create a sign-extended-32-to-64 with register and shift addressing mode.
-    pub fn imm_reg_reg_shift(simm32: u32, base: Gpr, index: Gpr, shift: u8) -> Self {
+    pub fn imm_reg_reg_shift(simm32: i32, base: Gpr, index: Gpr, shift: u8) -> Self {
         debug_assert!(base.class() == RegClass::Int);
         debug_assert!(index.class() == RegClass::Int);
         debug_assert!(shift <= 3);
@@ -435,7 +435,7 @@ impl Amode {
     }
 
     /// Offset the amode by a fixed offset.
-    pub(crate) fn offset(&self, offset: u32) -> Self {
+    pub(crate) fn offset(&self, offset: i32) -> Self {
         let mut ret = self.clone();
         match &mut ret {
             &mut Amode::ImmReg { ref mut simm32, .. } => *simm32 += offset,
@@ -456,7 +456,7 @@ impl PrettyPrint for Amode {
             Amode::ImmReg { simm32, base, .. } => {
                 // Note: size is always 8; the address is 64 bits,
                 // even if the addressed operand is smaller.
-                format!("{}({})", *simm32 as i32, pretty_print_reg(*base, 8, allocs))
+                format!("{}({})", *simm32, pretty_print_reg(*base, 8, allocs))
             }
             Amode::ImmRegRegShift {
                 simm32,
@@ -466,7 +466,7 @@ impl PrettyPrint for Amode {
                 ..
             } => format!(
                 "{}({},{},{})",
-                *simm32 as i32,
+                *simm32,
                 pretty_print_reg(base.to_reg(), 8, allocs),
                 pretty_print_reg(index.to_reg(), 8, allocs),
                 1 << shift
@@ -488,7 +488,7 @@ pub enum SyntheticAmode {
     /// within the function.
     NominalSPOffset {
         /// The nominal stack pointer value.
-        simm32: u32,
+        simm32: i32,
     },
 
     /// A virtual offset to a constant that will be emitted in the constant section of the buffer.
@@ -501,7 +501,7 @@ impl SyntheticAmode {
         Self::Real(amode)
     }
 
-    pub(crate) fn nominal_sp_offset(simm32: u32) -> Self {
+    pub(crate) fn nominal_sp_offset(simm32: i32) -> Self {
         SyntheticAmode::NominalSPOffset { simm32 }
     }
 
@@ -538,12 +538,7 @@ impl SyntheticAmode {
             SyntheticAmode::Real(addr) => addr.clone(),
             SyntheticAmode::NominalSPOffset { simm32 } => {
                 let off = *simm32 as i64 + state.virtual_sp_offset();
-                // TODO will require a sequence of add etc.
-                assert!(
-                    off <= u32::max_value() as i64,
-                    "amode finalize: add sequence NYI"
-                );
-                Amode::imm_reg(off as u32, regs::rsp())
+                Amode::imm_reg(off.try_into().expect("invalid sp offset"), regs::rsp())
             }
             SyntheticAmode::ConstantOffset(c) => {
                 Amode::rip_relative(buffer.get_label_for_constant(*c))
@@ -586,7 +581,7 @@ impl PrettyPrint for SyntheticAmode {
             // See note in `Amode` regarding constant size of `8`.
             SyntheticAmode::Real(addr) => addr.pretty_print(8, allocs),
             SyntheticAmode::NominalSPOffset { simm32 } => {
-                format!("rsp({} + virtual offset)", *simm32 as i32)
+                format!("rsp({} + virtual offset)", *simm32)
             }
             SyntheticAmode::ConstantOffset(c) => format!("const({})", c.as_u32()),
         }
diff --git a/cranelift/codegen/src/isa/x64/inst/emit.rs b/cranelift/codegen/src/isa/x64/inst/emit.rs
index 5676fe6b11ce..9360fc039566 100644
--- a/cranelift/codegen/src/isa/x64/inst/emit.rs
+++ b/cranelift/codegen/src/isa/x64/inst/emit.rs
@@ -985,7 +985,7 @@ pub(crate) fn emit(
                     let inst = Inst::alu_rmi_r(
                         *size,
                         AluRmiROpcode::Add,
-                        RegMemImm::imm(simm32),
+                        RegMemImm::imm(simm32 as u32),
                         Writable::from_reg(dst),
                     );
                     inst.emit(&[], sink, info, state);
@@ -4227,7 +4227,7 @@ fn emit_return_call_common_sequence(
     // The new lowest address (top of stack) -- relative to FP -- for
     // our tail callee. We compute this now so that we can move our
     // stack arguments into place.
-    let callee_sp_relative_to_fp = old_stack_arg_size.wrapping_sub(new_stack_arg_size);
+    let callee_sp_relative_to_fp = i64::from(old_stack_arg_size) - i64::from(new_stack_arg_size);
 
     // Copy over each word, using `tmp` as a temporary register.
     //
@@ -4244,7 +4244,7 @@ fn emit_return_call_common_sequence(
     for i in (0..new_stack_arg_size / 8).rev() {
         Inst::Mov64MR {
             src: SyntheticAmode::Real(Amode::ImmReg {
-                simm32: i * 8,
+                simm32: (i * 8).try_into().unwrap(),
                 base: regs::rsp(),
                 flags: MemFlags::trusted(),
             }),
@@ -4257,7 +4257,9 @@ fn emit_return_call_common_sequence(
             dst: SyntheticAmode::Real(Amode::ImmReg {
                 // Add 2 because we need to skip over the old FP and the
                 // return address.
-                simm32: callee_sp_relative_to_fp.wrapping_add((i + 2) * 8),
+                simm32: (callee_sp_relative_to_fp + i64::from((i + 2) * 8))
+                    .try_into()
+                    .unwrap(),
                 base: fp,
                 flags: MemFlags::trusted(),
             }),
@@ -4272,7 +4274,7 @@ fn emit_return_call_common_sequence(
         addr: SyntheticAmode::Real(Amode::ImmReg {
             // NB: We add a word to `callee_sp_relative_to_fp` here because the
             // callee will push FP, not us.
-            simm32: callee_sp_relative_to_fp.wrapping_add(8),
+            simm32: callee_sp_relative_to_fp.wrapping_add(8).try_into().unwrap(),
             base: fp,
             flags: MemFlags::trusted(),
         }),
diff --git a/cranelift/codegen/src/isa/x64/inst/emit_tests.rs b/cranelift/codegen/src/isa/x64/inst/emit_tests.rs
index f8d4f6cfec13..9aff9d2f0555 100644
--- a/cranelift/codegen/src/isa/x64/inst/emit_tests.rs
+++ b/cranelift/codegen/src/isa/x64/inst/emit_tests.rs
@@ -399,82 +399,82 @@ fn test_x64_emit() {
     // ========================================================
     // Addr_IR, offset min simm8
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rax), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rax), w_rdi),
         "488B7880",
         "movq    -128(%rax), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rbx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rbx), w_rdi),
         "488B7B80",
         "movq    -128(%rbx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rcx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rcx), w_rdi),
         "488B7980",
         "movq    -128(%rcx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rdx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rdx), w_rdi),
         "488B7A80",
         "movq    -128(%rdx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rbp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rbp), w_rdi),
         "488B7D80",
         "movq    -128(%rbp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rsp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rsp), w_rdi),
         "488B7C2480",
         "movq    -128(%rsp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rsi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rsi), w_rdi),
         "488B7E80",
         "movq    -128(%rsi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, rdi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, rdi), w_rdi),
         "488B7F80",
         "movq    -128(%rdi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r8), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r8), w_rdi),
         "498B7880",
         "movq    -128(%r8), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r9), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r9), w_rdi),
         "498B7980",
         "movq    -128(%r9), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r10), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r10), w_rdi),
         "498B7A80",
         "movq    -128(%r10), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r11), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r11), w_rdi),
         "498B7B80",
         "movq    -128(%r11), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r12), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r12), w_rdi),
         "498B7C2480",
         "movq    -128(%r12), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r13), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r13), w_rdi),
         "498B7D80",
         "movq    -128(%r13), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r14), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r14), w_rdi),
         "498B7E80",
         "movq    -128(%r14), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-128i32 as u32, r15), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-128, r15), w_rdi),
         "498B7F80",
         "movq    -128(%r15), %rdi",
     ));
@@ -565,82 +565,82 @@ fn test_x64_emit() {
     // ========================================================
     // Addr_IR, offset smallest negative simm32
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rax), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rax), w_rdi),
         "488BB87FFFFFFF",
         "movq    -129(%rax), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rbx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rbx), w_rdi),
         "488BBB7FFFFFFF",
         "movq    -129(%rbx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rcx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rcx), w_rdi),
         "488BB97FFFFFFF",
         "movq    -129(%rcx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rdx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rdx), w_rdi),
         "488BBA7FFFFFFF",
         "movq    -129(%rdx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rbp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rbp), w_rdi),
         "488BBD7FFFFFFF",
         "movq    -129(%rbp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rsp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rsp), w_rdi),
         "488BBC247FFFFFFF",
         "movq    -129(%rsp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rsi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rsi), w_rdi),
         "488BBE7FFFFFFF",
         "movq    -129(%rsi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, rdi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, rdi), w_rdi),
         "488BBF7FFFFFFF",
         "movq    -129(%rdi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r8), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r8), w_rdi),
         "498BB87FFFFFFF",
         "movq    -129(%r8), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r9), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r9), w_rdi),
         "498BB97FFFFFFF",
         "movq    -129(%r9), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r10), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r10), w_rdi),
         "498BBA7FFFFFFF",
         "movq    -129(%r10), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r11), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r11), w_rdi),
         "498BBB7FFFFFFF",
         "movq    -129(%r11), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r12), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r12), w_rdi),
         "498BBC247FFFFFFF",
         "movq    -129(%r12), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r13), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r13), w_rdi),
         "498BBD7FFFFFFF",
         "movq    -129(%r13), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r14), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r14), w_rdi),
         "498BBE7FFFFFFF",
         "movq    -129(%r14), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-129i32 as u32, r15), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-129i32, r15), w_rdi),
         "498BBF7FFFFFFF",
         "movq    -129(%r15), %rdi",
     ));
@@ -731,82 +731,82 @@ fn test_x64_emit() {
     // ========================================================
     // Addr_IR, offset large negative simm32
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rax), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rax), w_rdi),
         "488BB8D9A6BECE",
         "movq    -826366247(%rax), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rbx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rbx), w_rdi),
         "488BBBD9A6BECE",
         "movq    -826366247(%rbx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rcx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rcx), w_rdi),
         "488BB9D9A6BECE",
         "movq    -826366247(%rcx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rdx), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rdx), w_rdi),
         "488BBAD9A6BECE",
         "movq    -826366247(%rdx), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rbp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rbp), w_rdi),
         "488BBDD9A6BECE",
         "movq    -826366247(%rbp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rsp), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rsp), w_rdi),
         "488BBC24D9A6BECE",
         "movq    -826366247(%rsp), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rsi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rsi), w_rdi),
         "488BBED9A6BECE",
         "movq    -826366247(%rsi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, rdi), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, rdi), w_rdi),
         "488BBFD9A6BECE",
         "movq    -826366247(%rdi), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r8), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r8), w_rdi),
         "498BB8D9A6BECE",
         "movq    -826366247(%r8), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r9), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r9), w_rdi),
         "498BB9D9A6BECE",
         "movq    -826366247(%r9), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r10), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r10), w_rdi),
         "498BBAD9A6BECE",
         "movq    -826366247(%r10), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r11), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r11), w_rdi),
         "498BBBD9A6BECE",
         "movq    -826366247(%r11), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r12), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r12), w_rdi),
         "498BBC24D9A6BECE",
         "movq    -826366247(%r12), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r13), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r13), w_rdi),
         "498BBDD9A6BECE",
         "movq    -826366247(%r13), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r14), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r14), w_rdi),
         "498BBED9A6BECE",
         "movq    -826366247(%r14), %rdi",
     ));
     insns.push((
-        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32 as u32, r15), w_rdi),
+        Inst::mov64_m_r(Amode::imm_reg(-0x31415927i32, r15), w_rdi),
         "498BBFD9A6BECE",
         "movq    -826366247(%r15), %rdi",
     ));
@@ -886,12 +886,7 @@ fn test_x64_emit() {
     // Addr_IRRS, offset min simm8
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(rax).unwrap(),
-                Gpr::new(r8).unwrap(),
-                2,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(rax).unwrap(), Gpr::new(r8).unwrap(), 2),
             w_r11,
         ),
         "4E8B5C8080",
@@ -899,12 +894,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(rdi).unwrap(),
-                Gpr::new(r8).unwrap(),
-                3,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(rdi).unwrap(), Gpr::new(r8).unwrap(), 3),
             w_r11,
         ),
         "4E8B5CC780",
@@ -912,12 +902,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(r8).unwrap(),
-                Gpr::new(r8).unwrap(),
-                0,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(r8).unwrap(), Gpr::new(r8).unwrap(), 0),
             w_r11,
         ),
         "4F8B5C0080",
@@ -925,12 +910,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(r15).unwrap(),
-                Gpr::new(r8).unwrap(),
-                1,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(r15).unwrap(), Gpr::new(r8).unwrap(), 1),
             w_r11,
         ),
         "4F8B5C4780",
@@ -938,12 +918,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(rax).unwrap(),
-                Gpr::new(r15).unwrap(),
-                1,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(rax).unwrap(), Gpr::new(r15).unwrap(), 1),
             w_r11,
         ),
         "4E8B5C7880",
@@ -951,12 +926,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(rdi).unwrap(),
-                Gpr::new(r15).unwrap(),
-                0,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(rdi).unwrap(), Gpr::new(r15).unwrap(), 0),
             w_r11,
         ),
         "4E8B5C3F80",
@@ -964,12 +934,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(r8).unwrap(),
-                Gpr::new(r15).unwrap(),
-                3,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(r8).unwrap(), Gpr::new(r15).unwrap(), 3),
             w_r11,
         ),
         "4F8B5CF880",
@@ -977,12 +942,7 @@ fn test_x64_emit() {
     ));
     insns.push((
         Inst::mov64_m_r(
-            Amode::imm_reg_reg_shift(
-                -128i32 as u32,
-                Gpr::new(r15).unwrap(),
-                Gpr::new(r15).unwrap(),
-                2,
-            ),
+            Amode::imm_reg_reg_shift(-128i32, Gpr::new(r15).unwrap(), Gpr::new(r15).unwrap(), 2),
             w_r11,
         ),
         "4F8B5CBF80",
@@ -1091,7 +1051,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(rax).unwrap(),
                 Gpr::new(r8).unwrap(),
                 2,
@@ -1104,7 +1064,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(rdi).unwrap(),
                 Gpr::new(r8).unwrap(),
                 3,
@@ -1117,7 +1077,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(r8).unwrap(),
                 Gpr::new(r8).unwrap(),
                 0,
@@ -1130,7 +1090,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(r15).unwrap(),
                 Gpr::new(r8).unwrap(),
                 1,
@@ -1143,7 +1103,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(rax).unwrap(),
                 Gpr::new(r15).unwrap(),
                 1,
@@ -1156,7 +1116,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(rdi).unwrap(),
                 Gpr::new(r15).unwrap(),
                 0,
@@ -1169,7 +1129,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(r8).unwrap(),
                 Gpr::new(r15).unwrap(),
                 3,
@@ -1182,7 +1142,7 @@ fn test_x64_emit() {
     insns.push((
         Inst::mov64_m_r(
             Amode::imm_reg_reg_shift(
-                -0x264d1690i32 as u32,
+                -0x264d1690i32,
                 Gpr::new(r15).unwrap(),
                 Gpr::new(r15).unwrap(),
                 2,
@@ -2502,38 +2462,22 @@ fn test_x64_emit() {
         "movzbl  %r15b, %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movzx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "0FB671F9",
         "movzbl  -7(%rcx), %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movzx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "410FB658F9",
         "movzbl  -7(%r8), %ebx",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movzx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "450FB64AF9",
         "movzbl  -7(%r10), %r9d",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movzx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "410FB653F9",
         "movzbl  -7(%r11), %edx",
     ));
@@ -2548,38 +2492,22 @@ fn test_x64_emit() {
         "movzbq  %r10b, %rsi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movzx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "480FB671F9",
         "movzbq  -7(%rcx), %rsi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movzx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "490FB658F9",
         "movzbq  -7(%r8), %rbx",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movzx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "4D0FB64AF9",
         "movzbq  -7(%r10), %r9",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movzx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "490FB653F9",
         "movzbq  -7(%r11), %rdx",
     ));
@@ -2594,38 +2522,22 @@ fn test_x64_emit() {
         "movzwl  %r10w, %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movzx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "0FB771F9",
         "movzwl  -7(%rcx), %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movzx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "410FB758F9",
         "movzwl  -7(%r8), %ebx",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movzx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "450FB74AF9",
         "movzwl  -7(%r10), %r9d",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movzx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "410FB753F9",
         "movzwl  -7(%r11), %edx",
     ));
@@ -2640,38 +2552,22 @@ fn test_x64_emit() {
         "movzwq  %r11w, %rsi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movzx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "480FB771F9",
         "movzwq  -7(%rcx), %rsi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movzx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "490FB758F9",
         "movzwq  -7(%r8), %rbx",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movzx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "4D0FB74AF9",
         "movzwq  -7(%r10), %r9",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movzx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "490FB753F9",
         "movzwq  -7(%r11), %rdx",
     ));
@@ -2681,38 +2577,22 @@ fn test_x64_emit() {
         "movl    %ecx, %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movzx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "8B71F9",
         "movl    -7(%rcx), %esi",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movzx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "418B58F9",
         "movl    -7(%r8), %ebx",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movzx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "458B4AF9",
         "movl    -7(%r10), %r9d",
     ));
     insns.push((
-        Inst::movzx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movzx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "418B53F9",
         "movl    -7(%r11), %edx",
     ));
@@ -2831,38 +2711,22 @@ fn test_x64_emit() {
         "movsbl  %r14b, %esi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movsx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "0FBE71F9",
         "movsbl  -7(%rcx), %esi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movsx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "410FBE58F9",
         "movsbl  -7(%r8), %ebx",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movsx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "450FBE4AF9",
         "movsbl  -7(%r10), %r9d",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movsx_rm_r(ExtMode::BL, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "410FBE53F9",
         "movsbl  -7(%r11), %edx",
     ));
@@ -2877,38 +2741,22 @@ fn test_x64_emit() {
         "movsbq  %r15b, %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movsx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "480FBE71F9",
         "movsbq  -7(%rcx), %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movsx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "490FBE58F9",
         "movsbq  -7(%r8), %rbx",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movsx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "4D0FBE4AF9",
         "movsbq  -7(%r10), %r9",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::BQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movsx_rm_r(ExtMode::BQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "490FBE53F9",
         "movsbq  -7(%r11), %rdx",
     ));
@@ -2923,38 +2771,22 @@ fn test_x64_emit() {
         "movswl  %r14w, %esi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movsx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "0FBF71F9",
         "movswl  -7(%rcx), %esi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movsx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "410FBF58F9",
         "movswl  -7(%r8), %ebx",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movsx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "450FBF4AF9",
         "movswl  -7(%r10), %r9d",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WL,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movsx_rm_r(ExtMode::WL, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "410FBF53F9",
         "movswl  -7(%r11), %edx",
     ));
@@ -2969,38 +2801,22 @@ fn test_x64_emit() {
         "movswq  %r13w, %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movsx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "480FBF71F9",
         "movswq  -7(%rcx), %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movsx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "490FBF58F9",
         "movswq  -7(%r8), %rbx",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movsx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "4D0FBF4AF9",
         "movswq  -7(%r10), %r9",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::WQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movsx_rm_r(ExtMode::WQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "490FBF53F9",
         "movswq  -7(%r11), %rdx",
     ));
@@ -3015,38 +2831,22 @@ fn test_x64_emit() {
         "movslq  %r15d, %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, rcx)),
-            w_rsi,
-        ),
+        Inst::movsx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, rcx)), w_rsi),
         "486371F9",
         "movslq  -7(%rcx), %rsi",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r8)),
-            w_rbx,
-        ),
+        Inst::movsx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r8)), w_rbx),
         "496358F9",
         "movslq  -7(%r8), %rbx",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r10)),
-            w_r9,
-        ),
+        Inst::movsx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r10)), w_r9),
         "4D634AF9",
         "movslq  -7(%r10), %r9",
     ));
     insns.push((
-        Inst::movsx_rm_r(
-            ExtMode::LQ,
-            RegMem::mem(Amode::imm_reg(-7i32 as u32, r11)),
-            w_rdx,
-        ),
+        Inst::movsx_rm_r(ExtMode::LQ, RegMem::mem(Amode::imm_reg(-7i32, r11)), w_rdx),
         "496353F9",
         "movslq  -7(%r11), %rdx",
     ));
@@ -3057,7 +2857,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size8,
             simm64: i8::MIN as u64,
-            dst: Amode::imm_reg(99u32, rax).into(),
+            dst: Amode::imm_reg(99, rax).into(),
         },
         "C6406380",
         "movb    $-128, 99(%rax)",
@@ -3067,7 +2867,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size8,
             simm64: i8::MAX as u64,
-            dst: Amode::imm_reg(99u32, r8).into(),
+            dst: Amode::imm_reg(99, r8).into(),
         },
         "41C640637F",
         "movb    $127, 99(%r8)",
@@ -3077,7 +2877,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size16,
             simm64: i16::MIN as u64,
-            dst: Amode::imm_reg(99u32, rcx).into(),
+            dst: Amode::imm_reg(99, rcx).into(),
         },
         "66C741630080",
         "movw    $-32768, 99(%rcx)",
@@ -3087,7 +2887,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size16,
             simm64: i16::MAX as u64,
-            dst: Amode::imm_reg(99u32, r9).into(),
+            dst: Amode::imm_reg(99, r9).into(),
         },
         "6641C74163FF7F",
         "movw    $32767, 99(%r9)",
@@ -3097,7 +2897,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size32,
             simm64: i32::MIN as u64,
-            dst: Amode::imm_reg(99u32, rdx).into(),
+            dst: Amode::imm_reg(99, rdx).into(),
         },
         "C7426300000080",
         "movl    $-2147483648, 99(%rdx)",
@@ -3107,7 +2907,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size32,
             simm64: i32::MAX as u64,
-            dst: Amode::imm_reg(99u32, r10).into(),
+            dst: Amode::imm_reg(99, r10).into(),
         },
         "41C74263FFFFFF7F",
         "movl    $2147483647, 99(%r10)",
@@ -3117,7 +2917,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size64,
             simm64: i32::MIN as u64,
-            dst: Amode::imm_reg(99u32, rbx).into(),
+            dst: Amode::imm_reg(99, rbx).into(),
         },
         "48C7436300000080",
         "movq    $-2147483648, 99(%rbx)",
@@ -3127,7 +2927,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size64,
             simm64: i32::MAX as u64,
-            dst: Amode::imm_reg(99u32, r11).into(),
+            dst: Amode::imm_reg(99, r11).into(),
         },
         "49C74363FFFFFF7F",
         "movq    $2147483647, 99(%r11)",
@@ -3137,7 +2937,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size8,
             simm64: 0u64,
-            dst: Amode::imm_reg(99u32, rsp).into(),
+            dst: Amode::imm_reg(99, rsp).into(),
         },
         "C644246300",
         "movb    $0, 99(%rsp)",
@@ -3147,7 +2947,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size16,
             simm64: 0u64,
-            dst: Amode::imm_reg(99u32, r12).into(),
+            dst: Amode::imm_reg(99, r12).into(),
         },
         "6641C74424630000",
         "movw    $0, 99(%r12)",
@@ -3157,7 +2957,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size32,
             simm64: 0u64,
-            dst: Amode::imm_reg(99u32, rbp).into(),
+            dst: Amode::imm_reg(99, rbp).into(),
         },
         "C7456300000000",
         "movl    $0, 99(%rbp)",
@@ -3167,7 +2967,7 @@ fn test_x64_emit() {
         Inst::MovImmM {
             size: OperandSize::Size64,
             simm64: 0u64,
-            dst: Amode::imm_reg(99u32, r13).into(),
+            dst: Amode::imm_reg(99, r13).into(),
         },
         "49C7456300000000",
         "movq    $0, 99(%r13)",
@@ -5379,13 +5179,9 @@ fn test_x64_emit() {
         Amode::imm_reg_reg_shift(321, Gpr::new(r10).unwrap(), Gpr::new(rdx).unwrap(), 2).into();
     // `am2` doesn't contribute any 1 bits to the rex prefix, so we must use it when testing
     // for retention of the apparently-redundant rex prefix in the 8-bit case.
-    let am2: SyntheticAmode = Amode::imm_reg_reg_shift(
-        -12345i32 as u32,
-        Gpr::new(rcx).unwrap(),
-        Gpr::new(rsi).unwrap(),
-        3,
-    )
-    .into();
+    let am2: SyntheticAmode =
+        Amode::imm_reg_reg_shift(-12345i32, Gpr::new(rcx).unwrap(), Gpr::new(rsi).unwrap(), 3)
+            .into();
     // Use `r9` with a 0 offset.
     let am3: SyntheticAmode = Amode::imm_reg(0, r9).into();
 
diff --git a/cranelift/codegen/src/isa/x64/lower.rs b/cranelift/codegen/src/isa/x64/lower.rs
index b13d291573da..c76a57f7c3fc 100644
--- a/cranelift/codegen/src/isa/x64/lower.rs
+++ b/cranelift/codegen/src/isa/x64/lower.rs
@@ -278,9 +278,9 @@ fn lower_to_amode(ctx: &mut Lower<Inst>, spec: InsnInput, offset: i32) -> Amode
                         let uext_cst: u64 = (cst << shift) >> shift;
 
                         let final_offset = (offset as i64).wrapping_add(uext_cst as i64);
-                        if low32_will_sign_extend_to_64(final_offset as u64) {
+                        if let Ok(final_offset) = i32::try_from(final_offset) {
                             let base = put_input_in_reg(ctx, add_inputs[1 - i]);
-                            return Amode::imm_reg(final_offset as u32, base).with_flags(flags);
+                            return Amode::imm_reg(final_offset, base).with_flags(flags);
                         }
                     }
                 }
@@ -288,9 +288,9 @@ fn lower_to_amode(ctx: &mut Lower<Inst>, spec: InsnInput, offset: i32) -> Amode
                 // If it's a constant, add it directly!
                 if let Some(cst) = ctx.get_input_as_source_or_const(add, i).constant {
                     let final_offset = (offset as i64).wrapping_add(cst as i64);
-                    if low32_will_sign_extend_to_64(final_offset as u64) {
+                    if let Ok(final_offset) = i32::try_from(final_offset) {
                         let base = put_input_in_reg(ctx, add_inputs[1 - i]);
-                        return Amode::imm_reg(final_offset as u32, base).with_flags(flags);
+                        return Amode::imm_reg(final_offset, base).with_flags(flags);
                     }
                 }
             }
@@ -303,7 +303,7 @@ fn lower_to_amode(ctx: &mut Lower<Inst>, spec: InsnInput, offset: i32) -> Amode
         };
 
         return Amode::imm_reg_reg_shift(
-            offset as u32,
+            offset,
             Gpr::new(base).unwrap(),
             Gpr::new(index).unwrap(),
             shift,
@@ -312,7 +312,7 @@ fn lower_to_amode(ctx: &mut Lower<Inst>, spec: InsnInput, offset: i32) -> Amode
     }
 
     let input = put_input_in_reg(ctx, spec);
-    Amode::imm_reg(offset as u32, input).with_flags(flags)
+    Amode::imm_reg(offset, input).with_flags(flags)
 }
 
 //=============================================================================
diff --git a/cranelift/codegen/src/isa/x64/lower/isle.rs b/cranelift/codegen/src/isa/x64/lower/isle.rs
index 3890400bfb61..b242d3907e19 100644
--- a/cranelift/codegen/src/isa/x64/lower/isle.rs
+++ b/cranelift/codegen/src/isa/x64/lower/isle.rs
@@ -654,7 +654,7 @@ impl Context for IsleContext<'_, '_, MInst, X64Backend> {
     }
 
     #[inline]
-    fn amode_offset(&mut self, addr: &Amode, offset: u32) -> Amode {
+    fn amode_offset(&mut self, addr: &Amode, offset: i32) -> Amode {
         addr.offset(offset)
     }
 
diff --git a/cranelift/codegen/src/isle_prelude.rs b/cranelift/codegen/src/isle_prelude.rs
index c36650247ab2..dcfdd543918b 100644
--- a/cranelift/codegen/src/isle_prelude.rs
+++ b/cranelift/codegen/src/isle_prelude.rs
@@ -43,6 +43,11 @@ macro_rules! isle_common_prelude_methods {
             x as i32
         }
 
+        #[inline]
+        fn i32_as_i64(&mut self, x: i32) -> i64 {
+            x.into()
+        }
+
         #[inline]
         fn i64_neg(&mut self, x: i64) -> i64 {
             x.wrapping_neg()
@@ -647,10 +652,8 @@ macro_rules! isle_common_prelude_methods {
         }
 
         #[inline]
-        fn s32_add_fallible(&mut self, a: u32, b: u32) -> Option<u32> {
-            let a = a as i32;
-            let b = b as i32;
-            a.checked_add(b).map(|sum| sum as u32)
+        fn s32_add_fallible(&mut self, a: i32, b: i32) -> Option<i32> {
+            a.checked_add(b)
         }
 
         #[inline]
@@ -700,10 +703,8 @@ macro_rules! isle_common_prelude_methods {
         }
 
         #[inline]
-        fn simm32(&mut self, x: Imm64) -> Option<u32> {
-            let x64: i64 = x.into();
-            let x32: i32 = x64.try_into().ok()?;
-            Some(x32 as u32)
+        fn simm32(&mut self, x: Imm64) -> Option<i32> {
+            i64::from(x).try_into().ok()
         }
 
         #[inline]
@@ -714,9 +715,8 @@ macro_rules! isle_common_prelude_methods {
         }
 
         #[inline]
-        fn offset32(&mut self, x: Offset32) -> u32 {
-            let x: i32 = x.into();
-            x as u32
+        fn offset32(&mut self, x: Offset32) -> i32 {
+            x.into()
         }
 
         #[inline]
@@ -767,14 +767,13 @@ macro_rules! isle_common_prelude_methods {
         }
 
         #[inline]
-        fn offset32_to_u32(&mut self, offset: Offset32) -> u32 {
-            let offset: i32 = offset.into();
-            offset as u32
+        fn offset32_to_i32(&mut self, offset: Offset32) -> i32 {
+            offset.into()
         }
 
         #[inline]
-        fn u32_to_offset32(&mut self, offset: u32) -> Offset32 {
-            Offset32::new(offset as i32)
+        fn i32_to_offset32(&mut self, offset: i32) -> Offset32 {
+            Offset32::new(offset)
         }
 
         fn range(&mut self, start: usize, end: usize) -> Range {
diff --git a/cranelift/codegen/src/machinst/abi.rs b/cranelift/codegen/src/machinst/abi.rs
index e3b40d583088..2511e1994904 100644
--- a/cranelift/codegen/src/machinst/abi.rs
+++ b/cranelift/codegen/src/machinst/abi.rs
@@ -451,6 +451,7 @@ pub trait ABIMachineSpec {
     fn gen_ret(
         setup_frame: bool,
         isa_flags: &Self::F,
+        call_conv: isa::CallConv,
         rets: Vec<RetPair>,
         stack_bytes_to_pop: u32,
     ) -> Self::I;
@@ -1713,6 +1714,7 @@ impl<M: ABIMachineSpec> Callee<M> {
         M::gen_ret(
             self.setup_frame,
             &self.isa_flags,
+            self.call_conv,
             rets,
             self.stack_bytes_to_pop(sigs),
         )
@@ -1980,6 +1982,7 @@ impl<M: ABIMachineSpec> Callee<M> {
         insts.push(M::gen_ret(
             self.setup_frame,
             &self.isa_flags,
+            self.call_conv,
             vec![],
             self.stack_bytes_to_pop(sigs),
         ));
diff --git a/cranelift/codegen/src/machinst/buffer.rs b/cranelift/codegen/src/machinst/buffer.rs
index 9f458052e185..72460136e3f5 100644
--- a/cranelift/codegen/src/machinst/buffer.rs
+++ b/cranelift/codegen/src/machinst/buffer.rs
@@ -139,6 +139,52 @@
 //!
 //! Given these invariants, we argue why each optimization preserves execution
 //! semantics below (grep for "Preserves execution semantics").
+//!
+//! # Avoiding Quadratic Behavior
+//!
+//! There are two cases where we've had to take some care to avoid
+//! quadratic worst-case behavior:
+//!
+//! - The "labels at this branch" list can grow unboundedly if the
+//!   code generator binds many labels at one location. If the count
+//!   gets too high (defined by the `LABEL_LIST_THRESHOLD` constant), we
+//!   simply abort an optimization early in a way that is always correct
+//!   but is conservative.
+//!
+//! - The fixup list can interact with island emission to create
+//!   "quadratic island behvior". In a little more detail, one can hit
+//!   this behavior by having some pending fixups (forward label
+//!   references) with long-range label-use kinds, and some others
+//!   with shorter-range references that nonetheless still are pending
+//!   long enough to trigger island generation. In such a case, we
+//!   process the fixup list, generate veneers to extend some forward
+//!   references' ranges, but leave the other (longer-range) ones
+//!   alone. The way this was implemented put them back on a list and
+//!   resulted in quadratic behavior.
+//!
+//!   To avoid this, we could use a better data structure that allows
+//!   us to query for fixups with deadlines "coming soon" and generate
+//!   veneers for only those fixups. However, there is some
+//!   interaction with the branch peephole optimizations: the
+//!   invariant there is that branches in the "most recent branches
+//!   contiguous with end of buffer" list have corresponding fixups in
+//!   order (so that when we chomp the branch, we can chomp its fixup
+//!   too).
+//!
+//!   So instead, when we generate an island, for now we create
+//!   veneers for *all* pending fixups, then if upgraded to a kind
+//!   that no longer supports veneers (is at "max range"), kick the
+//!   fixups off to a list that is *not* processed at islands except
+//!   for one last pass after emission. This allows us to skip the
+//!   work and avoids the quadratic behvior. We expect that this is
+//!   fine-ish for now: islands are relatively rare, and if they do
+//!   happen and generate unnecessary veneers (as will now happen for
+//!   the case above) we'll only get one unnecessary veneer per
+//!   branch (then they are at max range already).
+//!
+//!   Longer-term, we could use a data structure that allows querying
+//!   by deadline, as long as we can properly chomp just-added fixups
+//!   when chomping branches.
 
 use crate::binemit::{Addend, CodeOffset, Reloc, StackMap};
 use crate::ir::{ExternalName, Opcode, RelSourceLoc, SourceLoc, TrapCode};
@@ -150,7 +196,7 @@ use crate::timing;
 use crate::trace;
 use cranelift_control::ControlPlane;
 use cranelift_entity::{entity_impl, PrimaryMap};
-use smallvec::SmallVec;
+use smallvec::{smallvec, SmallVec};
 use std::convert::TryFrom;
 use std::mem;
 use std::string::String;
@@ -190,6 +236,18 @@ impl CompilePhase for Final {
     type SourceLocType = SourceLoc;
 }
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum ForceVeneers {
+    Yes,
+    No,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum IsLastIsland {
+    Yes,
+    No,
+}
+
 /// A buffer of output to be produced, fixed up, and then emitted to a CodeSink
 /// in bulk.
 ///
@@ -234,6 +292,10 @@ pub struct MachBuffer<I: VCodeInst> {
     pending_traps: SmallVec<[MachLabelTrap; 16]>,
     /// Fixups that must be performed after all code is emitted.
     fixup_records: SmallVec<[MachLabelFixup<I>; 16]>,
+    /// Fixups whose labels are at maximum range already: these need
+    /// not be considered in island emission until we're done
+    /// emitting.
+    fixup_records_max_range: SmallVec<[MachLabelFixup<I>; 16]>,
     /// Current deadline at which all constants are flushed and all code labels
     /// are extended by emitting long-range jumps in an island. This flush
     /// should be rare (e.g., on AArch64, the shortest-range PC-rel references
@@ -389,6 +451,7 @@ impl<I: VCodeInst> MachBuffer<I> {
             pending_constants: SmallVec::new(),
             pending_traps: SmallVec::new(),
             fixup_records: SmallVec::new(),
+            fixup_records_max_range: SmallVec::new(),
             island_deadline: UNKNOWN_LABEL_OFFSET,
             island_worst_case_size: 0,
             latest_branches: SmallVec::new(),
@@ -1157,16 +1220,16 @@ impl<I: VCodeInst> MachBuffer<I> {
     /// Should only be called if `island_needed()` returns true, i.e., if we
     /// actually reach a deadline. It's not necessarily a problem to do so
     /// otherwise but it may result in unnecessary work during emission.
-    pub fn emit_island(&mut self, distance: CodeOffset, ctrl_plane: &mut ControlPlane) {
-        self.emit_island_maybe_forced(false, distance, ctrl_plane);
+    pub fn emit_island(&mut self, ctrl_plane: &mut ControlPlane) {
+        self.emit_island_maybe_forced(ForceVeneers::No, IsLastIsland::No, ctrl_plane);
     }
 
     /// Same as `emit_island`, but an internal API with a `force_veneers`
     /// argument to force all veneers to always get emitted for debugging.
     fn emit_island_maybe_forced(
         &mut self,
-        force_veneers: bool,
-        distance: CodeOffset,
+        force_veneers: ForceVeneers,
+        last_island: IsLastIsland,
         ctrl_plane: &mut ControlPlane,
     ) {
         // We're going to purge fixups, so no latest-branch editing can happen
@@ -1174,10 +1237,7 @@ impl<I: VCodeInst> MachBuffer<I> {
         self.latest_branches.clear();
 
         // Reset internal calculations about islands since we're going to
-        // change the calculus as we apply fixups. The `forced_threshold` is
-        // used here to determine whether jumps to unknown labels will require
-        // a veneer or not.
-        let forced_threshold = self.worst_case_end_of_island(distance);
+        // change the calculus as we apply fixups.
         self.island_deadline = UNKNOWN_LABEL_OFFSET;
         self.island_worst_case_size = 0;
 
@@ -1232,7 +1292,14 @@ impl<I: VCodeInst> MachBuffer<I> {
             self.get_appended_space(size);
         }
 
-        for fixup in mem::take(&mut self.fixup_records) {
+        let last_island_fixups = match last_island {
+            IsLastIsland::Yes => mem::take(&mut self.fixup_records_max_range),
+            IsLastIsland::No => smallvec![],
+        };
+        for fixup in mem::take(&mut self.fixup_records)
+            .into_iter()
+            .chain(last_island_fixups.into_iter())
+        {
             trace!("emit_island: fixup {:?}", fixup);
             let MachLabelFixup {
                 label,
@@ -1275,7 +1342,8 @@ impl<I: VCodeInst> MachBuffer<I> {
                     kind.max_neg_range()
                 );
 
-                if (force_veneers && kind.supports_veneer()) || veneer_required {
+                if (force_veneers == ForceVeneers::Yes && kind.supports_veneer()) || veneer_required
+                {
                     self.emit_veneer(label, offset, kind);
                 } else {
                     let slice = &mut self.data[start..end];
@@ -1284,21 +1352,43 @@ impl<I: VCodeInst> MachBuffer<I> {
                 }
             } else {
                 // If the offset of this label is not known at this time then
-                // there's one of two possibilities:
+                // there are three possibilities:
                 //
-                // * First we may be about to exceed the maximum jump range of
-                //   this fixup. In that case a veneer is inserted to buy some
-                //   more budget for the forward-jump. It's guaranteed that the
-                //   label will eventually come after where we're at, so we know
-                //   that the forward jump is necessary.
+                // 1. It's possible that the label is already a "max
+                //    range" label: a veneer would not help us any,
+                //    and so we need not consider the label during
+                //    island emission any more until the very end (the
+                //    last "island" pass). In this case we kick the
+                //    label into a separate list to process once at
+                //    the end, to avoid quadratic behavior (see
+                //    "quadratic island behavior" above, and issue
+                //    #6798).
                 //
-                // * Otherwise we're still within range of the forward jump but
-                //   the precise target isn't known yet. In that case we
-                //   enqueue the fixup to get processed later.
-                if forced_threshold - offset > kind.max_pos_range() {
-                    self.emit_veneer(label, offset, kind);
+                // 2. Or, we may be about to exceed the maximum jump range of
+                //    this fixup. In that case a veneer is inserted to buy some
+                //    more budget for the forward-jump. It's guaranteed that the
+                //    label will eventually come after where we're at, so we know
+                //    that the forward jump is necessary.
+                //
+                // 3. Otherwise, we're still within range of the
+                //    forward jump but the precise target isn't known
+                //    yet. In that case, to avoid quadratic behavior
+                //    (again, see above), we emit a veneer and if the
+                //    resulting label-use fixup is then max-range, we
+                //    put it in the max-range list. We could enqueue
+                //    the fixup for processing later, and this would
+                //    enable slightly fewer veneers, but islands are
+                //    relatively rare and the cost of "upgrading" all
+                //    forward label refs that cross an island should
+                //    be relatively low.
+                if !kind.supports_veneer() {
+                    self.fixup_records_max_range.push(MachLabelFixup {
+                        label,
+                        offset,
+                        kind,
+                    });
                 } else {
-                    self.use_label_at_offset(offset, label, kind);
+                    self.emit_veneer(label, offset, kind);
                 }
             }
         }
@@ -1346,25 +1436,36 @@ impl<I: VCodeInst> MachBuffer<I> {
             veneer_fixup_off,
             veneer_label_use
         );
-        // Register a new use of `label` with our new veneer fixup and offset.
-        // This'll recalculate deadlines accordingly and enqueue this fixup to
-        // get processed at some later time.
-        self.use_label_at_offset(veneer_fixup_off, label, veneer_label_use);
+        // Register a new use of `label` with our new veneer fixup and
+        // offset. This'll recalculate deadlines accordingly and
+        // enqueue this fixup to get processed at some later
+        // time. Note that if we now have a max-range, we instead skip
+        // the usual fixup list to avoid quadratic behavior.
+        if veneer_label_use.supports_veneer() {
+            self.use_label_at_offset(veneer_fixup_off, label, veneer_label_use);
+        } else {
+            self.fixup_records_max_range.push(MachLabelFixup {
+                label,
+                offset: veneer_fixup_off,
+                kind: veneer_label_use,
+            });
+        }
     }
 
     fn finish_emission_maybe_forcing_veneers(
         &mut self,
-        force_veneers: bool,
+        force_veneers: ForceVeneers,
         ctrl_plane: &mut ControlPlane,
     ) {
         while !self.pending_constants.is_empty()
             || !self.pending_traps.is_empty()
             || !self.fixup_records.is_empty()
+            || !self.fixup_records_max_range.is_empty()
         {
             // `emit_island()` will emit any pending veneers and constants, and
             // as a side-effect, will also take care of any fixups with resolved
             // labels eagerly.
-            self.emit_island_maybe_forced(force_veneers, u32::MAX, ctrl_plane);
+            self.emit_island_maybe_forced(force_veneers, IsLastIsland::Yes, ctrl_plane);
         }
 
         // Ensure that all labels have been fixed up after the last island is emitted. This is a
@@ -1385,7 +1486,7 @@ impl<I: VCodeInst> MachBuffer<I> {
         // had bound one last label.
         self.optimize_branches(ctrl_plane);
 
-        self.finish_emission_maybe_forcing_veneers(false, ctrl_plane);
+        self.finish_emission_maybe_forcing_veneers(ForceVeneers::No, ctrl_plane);
 
         let alignment = self.finish_constants(constants);
 
@@ -1734,7 +1835,7 @@ impl MachBranch {
 pub struct MachTextSectionBuilder<I: VCodeInst> {
     buf: MachBuffer<I>,
     next_func: usize,
-    force_veneers: bool,
+    force_veneers: ForceVeneers,
 }
 
 impl<I: VCodeInst> MachTextSectionBuilder<I> {
@@ -1746,7 +1847,7 @@ impl<I: VCodeInst> MachTextSectionBuilder<I> {
         MachTextSectionBuilder {
             buf,
             next_func: 0,
-            force_veneers: false,
+            force_veneers: ForceVeneers::No,
         }
     }
 }
@@ -1762,9 +1863,9 @@ impl<I: VCodeInst> TextSectionBuilder for MachTextSectionBuilder<I> {
         // Conditionally emit an island if it's necessary to resolve jumps
         // between functions which are too far away.
         let size = func.len() as u32;
-        if self.force_veneers || self.buf.island_needed(size) {
+        if self.force_veneers == ForceVeneers::Yes || self.buf.island_needed(size) {
             self.buf
-                .emit_island_maybe_forced(self.force_veneers, size, ctrl_plane);
+                .emit_island_maybe_forced(self.force_veneers, IsLastIsland::No, ctrl_plane);
         }
 
         self.buf.align_to(align);
@@ -1796,7 +1897,7 @@ impl<I: VCodeInst> TextSectionBuilder for MachTextSectionBuilder<I> {
     }
 
     fn force_veneers(&mut self) {
-        self.force_veneers = true;
+        self.force_veneers = ForceVeneers::Yes;
     }
 
     fn finish(&mut self, ctrl_plane: &mut ControlPlane) -> Vec<u8> {
@@ -1946,7 +2047,7 @@ mod test {
         buf.bind_label(label(1), state.ctrl_plane_mut());
         while buf.cur_offset() < 2000000 {
             if buf.island_needed(0) {
-                buf.emit_island(0, state.ctrl_plane_mut());
+                buf.emit_island(state.ctrl_plane_mut());
             }
             let inst = Inst::Nop4;
             inst.emit(&[], &mut buf, &info, &mut state);
@@ -1983,9 +2084,15 @@ mod test {
             // before the deadline.
             taken: BranchTarget::ResolvedOffset((1 << 20) - 4 - 20),
 
-            // This branch is in-range so no veneers should be needed, it should
-            // go directly to the target.
-            not_taken: BranchTarget::ResolvedOffset(2000000 + 4 - 4),
+            // This branch is in-range so no veneers are technically
+            // be needed; however because we resolve *all* pending
+            // fixups that cross an island when that island occurs, it
+            // will have a veneer as well. This veneer comes just
+            // after the one above. (Note that because the CondBr has
+            // two instructions, the conditinoal and unconditional,
+            // this offset is the same, though the veneer is four
+            // bytes later.)
+            not_taken: BranchTarget::ResolvedOffset((1 << 20) - 4 - 20),
         };
         inst.emit(&[], &mut buf2, &info, &mut state);
 
diff --git a/cranelift/codegen/src/machinst/vcode.rs b/cranelift/codegen/src/machinst/vcode.rs
index 6b05b38c8bd3..59c7328c3aa8 100644
--- a/cranelift/codegen/src/machinst/vcode.rs
+++ b/cranelift/codegen/src/machinst/vcode.rs
@@ -1050,7 +1050,7 @@ impl<I: VCodeInst> VCode<I> {
                 bb_padding.len() as u32 + I::LabelUse::ALIGN - 1
             };
             if buffer.island_needed(padding + worst_case_next_bb) {
-                buffer.emit_island(padding + worst_case_next_bb, ctrl_plane);
+                buffer.emit_island(ctrl_plane);
             }
 
             // Insert padding, if configured, to stress the `MachBuffer`'s
diff --git a/cranelift/codegen/src/prelude.isle b/cranelift/codegen/src/prelude.isle
index 906711ee8ed0..03369be48f0a 100644
--- a/cranelift/codegen/src/prelude.isle
+++ b/cranelift/codegen/src/prelude.isle
@@ -47,9 +47,9 @@
 (decl u32_nonnegative (u32) u32)
 (extern extractor u32_nonnegative u32_nonnegative)
 
-;; Extractor that pulls apart an Offset32 into a u32 with the raw
+;; Extractor that pulls apart an Offset32 into a i32 with the raw
 ;; signed-32-bit twos-complement bits.
-(decl offset32 (u32) Offset32)
+(decl offset32 (i32) Offset32)
 (extern extractor infallible offset32 offset32)
 
 ;; Pure/fallible constructor that tests if one u32 is less than or
@@ -68,7 +68,7 @@
 (extern constructor u8_lt u8_lt)
 
 ;; Get a signed 32-bit immediate in an u32 from an Imm64, if possible.
-(decl simm32 (u32) Imm64)
+(decl simm32 (i32) Imm64)
 (extern extractor simm32 simm32)
 
 ;; Get an unsigned 8-bit immediate in a u8 from an Imm64, if possible.
@@ -92,6 +92,10 @@
 (extern constructor u32_as_u64 u32_as_u64)
 (convert u32 u64 u32_as_u64)
 
+(decl pure i32_as_i64 (i32) i64)
+(extern constructor i32_as_i64 i32_as_i64)
+(convert i32 i64 i32_as_i64)
+
 (decl pure i64_as_u64 (i64) u64)
 (extern constructor i64_as_u64 i64_as_u64)
 
@@ -129,7 +133,7 @@
 
 ;; Pure/fallible constructor that tries to add two `u32`s, interpreted
 ;; as signed values, and fails to match on overflow.
-(decl pure partial s32_add_fallible (u32 u32) u32)
+(decl pure partial s32_add_fallible (i32 i32) i32)
 (extern constructor s32_add_fallible s32_add_fallible)
 
 (decl pure u64_add (u64 u64) u64)
@@ -532,12 +536,12 @@
 (extern extractor ty_dyn128_int ty_dyn128_int)
 
 ;; Convert an `Offset32` to a primitive number.
-(decl pure offset32_to_u32 (Offset32) u32)
-(extern constructor offset32_to_u32 offset32_to_u32)
+(decl pure offset32_to_i32 (Offset32) i32)
+(extern constructor offset32_to_i32 offset32_to_i32)
 
 ;; Convert a number to an `Offset32`
-(decl pure u32_to_offset32 (u32) Offset32)
-(extern constructor u32_to_offset32 u32_to_offset32)
+(decl pure i32_to_offset32 (i32) Offset32)
+(extern constructor i32_to_offset32 i32_to_offset32)
 
 ;; This is a direct import of `IntCC::unsigned`.
 ;; Get the corresponding IntCC with the signed component removed.
@@ -590,5 +594,5 @@
 
 ;;;; Automatic conversions ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(convert Offset32 u32 offset32_to_u32)
-(convert u32 Offset32 u32_to_offset32)
+(convert Offset32 i32 offset32_to_i32)
+(convert i32 Offset32 i32_to_offset32)
diff --git a/cranelift/control/Cargo.toml b/cranelift/control/Cargo.toml
index 0cd32a45733e..6e1c69a2aa5f 100644
--- a/cranelift/control/Cargo.toml
+++ b/cranelift/control/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-control"
-version = "0.99.0"
+version = "0.100.0"
 description = "White-box fuzz testing framework"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/entity/Cargo.toml b/cranelift/entity/Cargo.toml
index b1383a03d4c4..d0da5df18025 100644
--- a/cranelift/entity/Cargo.toml
+++ b/cranelift/entity/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-entity"
-version = "0.99.0"
+version = "0.100.0"
 description = "Data structures using entity references as mapping keys"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-entity"
diff --git a/cranelift/filetests/filetests/isa/aarch64/amodes.clif b/cranelift/filetests/filetests/isa/aarch64/amodes.clif
index aa5a6029eca7..1bb7e0b2333e 100644
--- a/cranelift/filetests/filetests/isa/aarch64/amodes.clif
+++ b/cranelift/filetests/filetests/isa/aarch64/amodes.clif
@@ -49,14 +49,14 @@ block0(v0: i32, v1: i32):
 
 ; VCode:
 ; block0:
-;   mov w3, w0
-;   ldr w0, [x3, w1, UXTW]
+;   mov w4, w1
+;   ldr w0, [x4, w0, UXTW]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov w3, w0
-;   ldr w0, [x3, w1, uxtw]
+;   mov w4, w1
+;   ldr w0, [x4, w0, uxtw]
 ;   ret
 
 function %f8(i64, i32) -> i32 {
@@ -72,18 +72,20 @@ block0(v0: i64, v1: i32):
 
 ; VCode:
 ; block0:
-;   add x3, x0, #68
-;   add x5, x3, x0
-;   add x7, x5, x1, SXTW
-;   ldr w0, [x7, w1, SXTW]
+;   sxtw x7, w1
+;   add x7, x7, #32
+;   add x7, x7, x0
+;   add x6, x7, #4
+;   ldr w0, [x6, x7]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   add x3, x0, #0x44
-;   add x5, x3, x0
-;   add x7, x5, w1, sxtw
-;   ldr w0, [x7, w1, sxtw]
+;   sxtw x7, w1
+;   add x7, x7, #0x20
+;   add x7, x7, x0
+;   add x6, x7, #4
+;   ldr w0, [x6, x7]
 ;   ret
 
 function %f9(i64, i64, i64) -> i32 {
@@ -98,16 +100,16 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
-;   add x4, x0, x2
-;   add x6, x4, x1
-;   ldr w0, [x6, #48]
+;   add x6, x0, x1
+;   add x5, x6, #48
+;   ldr w0, [x5, x2]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   add x4, x0, x2
-;   add x6, x4, x1
-;   ldur w0, [x6, #0x30]
+;   add x6, x0, x1
+;   add x5, x6, #0x30
+;   ldr w0, [x5, x2]
 ;   ret
 
 function %f10(i64, i64, i64) -> i32 {
@@ -122,18 +124,18 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
+;   add x7, x0, x1
 ;   movz x5, #4100
-;   add x5, x5, x1
-;   add x8, x5, x2
-;   ldr w0, [x8, x0]
+;   add x7, x7, x5
+;   ldr w0, [x7, x2]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
+;   add x7, x0, x1
 ;   mov x5, #0x1004
-;   add x5, x5, x1
-;   add x8, x5, x2
-;   ldr w0, [x8, x0]
+;   add x7, x7, x5
+;   ldr w0, [x7, x2]
 ;   ret
 
 function %f10() -> i32 {
@@ -145,14 +147,14 @@ block0:
 
 ; VCode:
 ; block0:
-;   movz x0, #1234
-;   ldr w0, [x0]
+;   movz x1, #1234
+;   ldr w0, [x1]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov x0, #0x4d2
-;   ldr w0, [x0]
+;   mov x1, #0x4d2
+;   ldr w0, [x1]
 ;   ret
 
 function %f11(i64) -> i32 {
@@ -165,14 +167,14 @@ block0(v0: i64):
 
 ; VCode:
 ; block0:
-;   add x2, x0, #8388608
-;   ldr w0, [x2]
+;   movz x2, #128, LSL #16
+;   ldr w0, [x0, x2]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   add x2, x0, #0x800, lsl #12
-;   ldr w0, [x2]
+;   mov x2, #0x800000
+;   ldr w0, [x0, x2]
 ;   ret
 
 function %add_imm12_max_shifted(i64) -> i32 {
@@ -185,14 +187,14 @@ block0(v0: i64):
 
 ; VCode:
 ; block0:
-;   add x2, x0, #16773120
-;   ldr w0, [x2]
+;   orr x2, xzr, #16773120
+;   ldr w0, [x0, x2]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   add x2, x0, #0xfff, lsl #12
-;   ldr w0, [x2]
+;   orr x2, xzr, #0xfff000
+;   ldr w0, [x0, x2]
 ;   ret
 
 function %f12(i64) -> i32 {
@@ -205,14 +207,12 @@ block0(v0: i64):
 
 ; VCode:
 ; block0:
-;   sub x2, x0, #4
-;   ldr w0, [x2]
+;   ldur w0, [x0, #-4]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   sub x2, x0, #4
-;   ldr w0, [x2]
+;   ldur w0, [x0, #-4]
 ;   ret
 
 function %f13(i64) -> i32 {
@@ -227,16 +227,14 @@ block0(v0: i64):
 ; block0:
 ;   movz w3, #51712
 ;   movk w3, w3, #15258, LSL #16
-;   add x4, x3, x0
-;   ldr w0, [x4]
+;   ldr w0, [x0, x3]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
 ;   mov w3, #0xca00
 ;   movk w3, #0x3b9a, lsl #16
-;   add x4, x3, x0
-;   ldr w0, [x4]
+;   ldr w0, [x0, x3]
 ;   ret
 
 function %f14(i32) -> i32 {
@@ -248,14 +246,14 @@ block0(v0: i32):
 
 ; VCode:
 ; block0:
-;   sxtw x2, w0
-;   ldr w0, [x2]
+;   sxtw x3, w0
+;   ldr w0, [x3]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   sxtw x2, w0
-;   ldr w0, [x2]
+;   sxtw x3, w0
+;   ldr w0, [x3]
 ;   ret
 
 function %f15(i32, i32) -> i32 {
@@ -269,14 +267,14 @@ block0(v0: i32, v1: i32):
 
 ; VCode:
 ; block0:
-;   sxtw x3, w0
-;   ldr w0, [x3, w1, SXTW]
+;   sxtw x4, w1
+;   ldr w0, [x4, w0, SXTW]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   sxtw x3, w0
-;   ldr w0, [x3, w1, sxtw]
+;   sxtw x4, w1
+;   ldr w0, [x4, w0, sxtw]
 ;   ret
 
 function %f18(i64, i64, i64) -> i32 {
@@ -289,14 +287,16 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
-;   movn w4, #4097
-;   ldrsh x0, [x4]
+;   movn w6, #4097
+;   mov w6, w6
+;   ldrsh x0, [x6]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov w4, #-0x1002
-;   ldrsh x0, [x4]
+;   mov w6, #-0x1002
+;   mov w6, w6
+;   ldrsh x0, [x6]
 ;   ret
 
 function %f19(i64, i64, i64) -> i32 {
@@ -309,14 +309,16 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
-;   movz x4, #4098
-;   ldrsh x0, [x4]
+;   movz w6, #4098
+;   mov w6, w6
+;   ldrsh x0, [x6]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov x4, #0x1002
-;   ldrsh x0, [x4]
+;   mov w6, #0x1002
+;   mov w6, w6
+;   ldrsh x0, [x6]
 ;   ret
 
 function %f20(i64, i64, i64) -> i32 {
@@ -329,15 +331,15 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
-;   movn w4, #4097
-;   sxtw x6, w4
+;   movn w6, #4097
+;   sxtw x6, w6
 ;   ldrsh x0, [x6]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov w4, #-0x1002
-;   sxtw x6, w4
+;   mov w6, #-0x1002
+;   sxtw x6, w6
 ;   ldrsh x0, [x6]
 ;   ret
 
@@ -351,15 +353,15 @@ block0(v0: i64, v1: i64, v2: i64):
 
 ; VCode:
 ; block0:
-;   movz x4, #4098
-;   sxtw x6, w4
+;   movz w6, #4098
+;   sxtw x6, w6
 ;   ldrsh x0, [x6]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov x4, #0x1002
-;   sxtw x6, w4
+;   mov w6, #0x1002
+;   sxtw x6, w6
 ;   ldrsh x0, [x6]
 ;   ret
 
@@ -457,16 +459,16 @@ block0(v0: i64):
 
 ; VCode:
 ; block0:
-;   mov x5, x0
-;   ldp x0, x1, [x5, #32]
-;   stp x0, x1, [x5, #32]
+;   add x4, x0, #32
+;   ldp x0, x1, [x4]
+;   stp x0, x1, [x4]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   mov x5, x0
-;   ldp x0, x1, [x5, #0x20]
-;   stp x0, x1, [x5, #0x20]
+;   add x4, x0, #0x20
+;   ldp x0, x1, [x4]
+;   stp x0, x1, [x4]
 ;   ret
 
 function %i128_32bit_sextend_simple(i32) -> i128 {
@@ -479,19 +481,15 @@ block0(v0: i32):
 
 ; VCode:
 ; block0:
-;   sxtw x3, w0
-;   mov x8, x0
-;   ldp x0, x1, [x3]
-;   sxtw x4, w8
+;   sxtw x4, w0
+;   ldp x0, x1, [x4]
 ;   stp x0, x1, [x4]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   sxtw x3, w0
-;   mov x8, x0
-;   ldp x0, x1, [x3]
-;   sxtw x4, w8
+;   sxtw x4, w0
+;   ldp x0, x1, [x4]
 ;   stp x0, x1, [x4]
 ;   ret
 
@@ -507,21 +505,17 @@ block0(v0: i64, v1: i32):
 
 ; VCode:
 ; block0:
-;   add x4, x0, x1, SXTW
-;   mov x11, x0
-;   mov x9, x1
-;   ldp x0, x1, [x4, #24]
-;   add x5, x11, x9, SXTW
-;   stp x0, x1, [x5, #24]
+;   add x6, x0, x1, SXTW
+;   add x6, x6, #24
+;   ldp x0, x1, [x6]
+;   stp x0, x1, [x6]
 ;   ret
 ;
 ; Disassembled:
 ; block0: ; offset 0x0
-;   add x4, x0, w1, sxtw
-;   mov x11, x0
-;   mov x9, x1
-;   ldp x0, x1, [x4, #0x18]
-;   add x5, x11, w9, sxtw
-;   stp x0, x1, [x5, #0x18]
+;   add x6, x0, w1, sxtw
+;   add x6, x6, #0x18
+;   ldp x0, x1, [x6]
+;   stp x0, x1, [x6]
 ;   ret
 
diff --git a/cranelift/filetests/filetests/isa/aarch64/call-pauth-bkey.clif b/cranelift/filetests/filetests/isa/aarch64/call-pauth-bkey.clif
new file mode 100644
index 000000000000..06e6ecc54e48
--- /dev/null
+++ b/cranelift/filetests/filetests/isa/aarch64/call-pauth-bkey.clif
@@ -0,0 +1,120 @@
+test compile precise-output
+set unwind_info=false
+target aarch64 sign_return_address sign_return_address_with_bkey has_pauth
+
+function %f1(i64) -> i64 {
+    fn0 = %g(i64) -> i64
+
+block0(v0: i64):
+    v1 = call fn0(v0)
+    return v1
+}
+
+; VCode:
+;   pacibsp
+;   stp fp, lr, [sp, #-16]!
+;   mov fp, sp
+; block0:
+;   load_ext_name x3, TestCase(%g)+0
+;   blr x3
+;   ldp fp, lr, [sp], #16
+;   retabsp
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   pacibsp
+;   stp x29, x30, [sp, #-0x10]!
+;   mov x29, sp
+; block1: ; offset 0xc
+;   ldr x3, #0x14
+;   b #0x1c
+;   .byte 0x00, 0x00, 0x00, 0x00 ; reloc_external Abs8 %g 0
+;   .byte 0x00, 0x00, 0x00, 0x00
+;   blr x3
+;   ldp x29, x30, [sp], #0x10
+;   retab
+
+function %f2(i64, i64) -> i64 {
+block0(v0: i64, v1: i64):
+    v2 = iadd.i64 v0, v1
+    return v2
+}
+
+; VCode:
+; block0:
+;   add x0, x0, x1
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   add x0, x0, x1
+;   ret
+
+function %tail_convention(i64) -> i64 tail {
+    fn0 = %g(i64) -> i64
+
+block0(v0: i64):
+    v1 = call fn0(v0)
+    return v1
+}
+
+; VCode:
+;   pacibz
+;   stp fp, lr, [sp, #-16]!
+;   mov fp, sp
+; block0:
+;   mov x0, x2
+;   load_ext_name x3, TestCase(%g)+0
+;   blr x3
+;   mov x2, x0
+;   ldp fp, lr, [sp], #16
+;   retabz
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   pacibz
+;   stp x29, x30, [sp, #-0x10]!
+;   mov x29, sp
+; block1: ; offset 0xc
+;   mov x0, x2
+;   ldr x3, #0x18
+;   b #0x20
+;   .byte 0x00, 0x00, 0x00, 0x00 ; reloc_external Abs8 %g 0
+;   .byte 0x00, 0x00, 0x00, 0x00
+;   blr x3
+;   mov x2, x0
+;   ldp x29, x30, [sp], #0x10
+;   autibz
+;   ret
+
+function %tail_call(i64) -> i64 tail {
+    fn0 = %g(i64) -> i64 tail
+
+block0(v0: i64):
+    return_call fn0(v0)
+}
+
+; VCode:
+;   pacibz
+;   stp fp, lr, [sp, #-16]!
+;   mov fp, sp
+; block0:
+;   load_ext_name x3, TestCase(%g)+0
+;   return_call_ind x3 old_stack_arg_size:0 new_stack_arg_size:0 x2=x2
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   pacibz
+;   stp x29, x30, [sp, #-0x10]!
+;   mov x29, sp
+; block1: ; offset 0xc
+;   ldr x3, #0x14
+;   b #0x1c
+;   .byte 0x00, 0x00, 0x00, 0x00 ; reloc_external Abs8 %g 0
+;   .byte 0x00, 0x00, 0x00, 0x00
+;   ldp x16, x30, [x29]
+;   add sp, x29, #0x10
+;   mov x29, x16
+;   autibz
+;   br x3
+
diff --git a/cranelift/filetests/filetests/isa/aarch64/call-pauth.clif b/cranelift/filetests/filetests/isa/aarch64/call-pauth.clif
index 4de61e59a9dd..74dbb2cfd82c 100644
--- a/cranelift/filetests/filetests/isa/aarch64/call-pauth.clif
+++ b/cranelift/filetests/filetests/isa/aarch64/call-pauth.clif
@@ -51,3 +51,71 @@ block0(v0: i64, v1: i64):
 ;   add x0, x0, x1
 ;   ret
 
+function %tail_convention(i64) -> i64 tail {
+    fn0 = %g(i64) -> i64
+
+block0(v0: i64):
+    v1 = call fn0(v0)
+    return v1
+}
+
+; VCode:
+;   paciaz
+;   stp fp, lr, [sp, #-16]!
+;   mov fp, sp
+; block0:
+;   mov x0, x2
+;   load_ext_name x3, TestCase(%g)+0
+;   blr x3
+;   mov x2, x0
+;   ldp fp, lr, [sp], #16
+;   autiaz ; ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   paciaz
+;   stp x29, x30, [sp, #-0x10]!
+;   mov x29, sp
+; block1: ; offset 0xc
+;   mov x0, x2
+;   ldr x3, #0x18
+;   b #0x20
+;   .byte 0x00, 0x00, 0x00, 0x00 ; reloc_external Abs8 %g 0
+;   .byte 0x00, 0x00, 0x00, 0x00
+;   blr x3
+;   mov x2, x0
+;   ldp x29, x30, [sp], #0x10
+;   autiaz
+;   ret
+
+function %tail_call(i64) -> i64 tail {
+    fn0 = %g(i64) -> i64 tail
+
+block0(v0: i64):
+    return_call fn0(v0)
+}
+
+; VCode:
+;   paciaz
+;   stp fp, lr, [sp, #-16]!
+;   mov fp, sp
+; block0:
+;   load_ext_name x3, TestCase(%g)+0
+;   return_call_ind x3 old_stack_arg_size:0 new_stack_arg_size:0 x2=x2
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   paciaz
+;   stp x29, x30, [sp, #-0x10]!
+;   mov x29, sp
+; block1: ; offset 0xc
+;   ldr x3, #0x14
+;   b #0x1c
+;   .byte 0x00, 0x00, 0x00, 0x00 ; reloc_external Abs8 %g 0
+;   .byte 0x00, 0x00, 0x00, 0x00
+;   ldp x16, x30, [x29]
+;   add sp, x29, #0x10
+;   mov x29, x16
+;   autiaz
+;   br x3
+
diff --git a/cranelift/filetests/filetests/isa/aarch64/simd.clif b/cranelift/filetests/filetests/isa/aarch64/simd.clif
index 0b99e24fe691..499bd2b75bda 100644
--- a/cranelift/filetests/filetests/isa/aarch64/simd.clif
+++ b/cranelift/filetests/filetests/isa/aarch64/simd.clif
@@ -200,3 +200,20 @@ block0:
 ;   fmov v0.4s, #1.31250000
 ;   ret
 
+
+function %load8(i64) -> i8x8 {
+block0(v0: i64):
+  v1 = load.i8x8 v0+0x800
+  return v1
+}
+
+; VCode:
+; block0:
+;   ldr d0, [x0, #2048]
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   ldr d0, [x0, #0x800]
+;   ret
+
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
index d17c797d022b..0238c249d9f4 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
@@ -50,9 +50,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x13, [x2]
+;;   add x13, x13, x0, UXTW
 ;;   movz x14, #65535, LSL #16
-;;   add x13, x14, x13
-;;   str w1, [x13, w0, UXTW]
+;;   str w1, [x13, x14]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -70,9 +70,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x13, [x1]
-;;   movz x12, #65535, LSL #16
-;;   add x12, x12, x13
-;;   ldr w0, [x12, w0, UXTW]
+;;   add x13, x13, x0, UXTW
+;;   movz x14, #65535, LSL #16
+;;   ldr w0, [x13, x14]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
index 50e8749f752b..c867fbe749f2 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
@@ -50,9 +50,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x13, [x2]
+;;   add x13, x13, x0, UXTW
 ;;   movz x14, #65535, LSL #16
-;;   add x13, x14, x13
-;;   strb w1, [x13, w0, UXTW]
+;;   strb w1, [x13, x14]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -70,9 +70,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x13, [x1]
-;;   movz x12, #65535, LSL #16
-;;   add x12, x12, x13
-;;   ldrb w0, [x12, w0, UXTW]
+;;   add x13, x13, x0, UXTW
+;;   movz x14, #65535, LSL #16
+;;   ldrb w0, [x13, x14]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
index 57f0052f60db..5e98e3ab470a 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
@@ -47,9 +47,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x2]
+;;   add x10, x10, x0, UXTW
 ;;   movz x11, #65535, LSL #16
-;;   add x10, x11, x10
-;;   str w1, [x10, w0, UXTW]
+;;   str w1, [x10, x11]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -64,9 +64,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x1]
-;;   movz x9, #65535, LSL #16
-;;   add x9, x9, x10
-;;   ldr w0, [x9, w0, UXTW]
+;;   add x10, x10, x0, UXTW
+;;   movz x11, #65535, LSL #16
+;;   ldr w0, [x10, x11]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
index ea43a47c1bd4..21d00ae4207e 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
@@ -47,9 +47,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x2]
+;;   add x10, x10, x0, UXTW
 ;;   movz x11, #65535, LSL #16
-;;   add x10, x11, x10
-;;   strb w1, [x10, w0, UXTW]
+;;   strb w1, [x10, x11]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -64,9 +64,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x1]
-;;   movz x9, #65535, LSL #16
-;;   add x9, x9, x10
-;;   ldrb w0, [x9, w0, UXTW]
+;;   add x10, x10, x0, UXTW
+;;   movz x11, #65535, LSL #16
+;;   ldrb w0, [x10, x11]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
index c6cf304ee999..f3de9844911d 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
@@ -48,8 +48,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x2]
-;;   add x11, x0, #4096
-;;   str w1, [x11, x10]
+;;   add x10, x10, #4096
+;;   str w1, [x10, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -65,8 +65,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x1]
-;;   add x9, x0, #4096
-;;   ldr w0, [x9, x10]
+;;   add x9, x10, #4096
+;;   ldr w0, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
index 7e17f62ff72a..8579f91a0bca 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i32_access_0xffff0000_offset.wat
@@ -49,9 +49,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x12, [x2]
+;;   add x12, x12, x0
 ;;   movz x13, #65535, LSL #16
-;;   add x13, x13, x0
-;;   str w1, [x13, x12]
+;;   str w1, [x12, x13]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -68,9 +68,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x12, [x1]
-;;   movz x11, #65535, LSL #16
-;;   add x11, x11, x0
-;;   ldr w0, [x11, x12]
+;;   add x12, x12, x0
+;;   movz x13, #65535, LSL #16
+;;   ldr w0, [x12, x13]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
index f2ab9ee4df52..5a15eb207f0f 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
@@ -48,8 +48,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x2]
-;;   add x11, x0, #4096
-;;   strb w1, [x11, x10]
+;;   add x10, x10, #4096
+;;   strb w1, [x10, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -65,8 +65,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x10, [x1]
-;;   add x9, x0, #4096
-;;   ldrb w0, [x9, x10]
+;;   add x9, x10, #4096
+;;   ldrb w0, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
index 1f78f515dff9..f5c183221ca5 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0_guard_no_spectre_i8_access_0xffff0000_offset.wat
@@ -49,9 +49,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x12, [x2]
+;;   add x12, x12, x0
 ;;   movz x13, #65535, LSL #16
-;;   add x13, x13, x0
-;;   strb w1, [x13, x12]
+;;   strb w1, [x12, x13]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -68,9 +68,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x12, [x1]
-;;   movz x11, #65535, LSL #16
-;;   add x11, x11, x0
-;;   ldrb w0, [x11, x12]
+;;   add x12, x12, x0
+;;   movz x13, #65535, LSL #16
+;;   ldrb w0, [x12, x13]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
index 4a7110ba3751..6b383ae8abc2 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
@@ -46,8 +46,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x8, [x2]
-;;   add x9, x0, #4096
-;;   str w1, [x9, x8]
+;;   add x8, x8, #4096
+;;   str w1, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x8, [x1]
-;;   add x7, x0, #4096
-;;   ldr w0, [x7, x8]
+;;   add x7, x8, #4096
+;;   ldr w0, [x7, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
index fa61559c57f9..72d7e0999cd3 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0xffff0000_offset.wat
@@ -46,9 +46,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
+;;   add x9, x9, x0
 ;;   movz x10, #65535, LSL #16
-;;   add x10, x10, x0
-;;   str w1, [x10, x9]
+;;   str w1, [x9, x10]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -62,9 +62,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   movz x8, #65535, LSL #16
-;;   add x8, x8, x0
-;;   ldr w0, [x8, x9]
+;;   add x9, x9, x0
+;;   movz x10, #65535, LSL #16
+;;   ldr w0, [x9, x10]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
index a36c081777e4..4a23e244afec 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
@@ -46,8 +46,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x8, [x2]
-;;   add x9, x0, #4096
-;;   strb w1, [x9, x8]
+;;   add x8, x8, #4096
+;;   strb w1, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x8, [x1]
-;;   add x7, x0, #4096
-;;   ldrb w0, [x7, x8]
+;;   add x7, x8, #4096
+;;   ldrb w0, [x7, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
index ff9cb1f5c3f7..bca2c0388607 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_dynamic_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0xffff0000_offset.wat
@@ -46,9 +46,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
+;;   add x9, x9, x0
 ;;   movz x10, #65535, LSL #16
-;;   add x10, x10, x0
-;;   strb w1, [x10, x9]
+;;   strb w1, [x9, x10]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -62,9 +62,9 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   movz x8, #65535, LSL #16
-;;   add x8, x8, x0
-;;   ldrb w0, [x8, x9]
+;;   add x9, x9, x0
+;;   movz x10, #65535, LSL #16
+;;   ldrb w0, [x9, x10]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0_offset.wat
index 0247a4acf308..c62f5ffe7a68 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0_offset.wat
@@ -51,4 +51,4 @@
 ;;   ldr w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
index d33617eca912..832f76671cb4 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
@@ -53,4 +53,4 @@
 ;;   ldr w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0_offset.wat
index 985fcdf14012..035b3a9793f5 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0_offset.wat
@@ -51,4 +51,4 @@
 ;;   ldrb w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
index 77d6d0598c03..c7a0b8d71efc 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
@@ -53,4 +53,4 @@
 ;;   ldrb w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0_offset.wat
index 62b9dec59e47..4cd63f73a6ce 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0_offset.wat
@@ -51,4 +51,4 @@
 ;;   ldr w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0x1000_offset.wat
index 7b610d167dac..f5aa7bed193e 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i32_access_0x1000_offset.wat
@@ -53,4 +53,4 @@
 ;;   ldr w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0_offset.wat
index 6be5ab693394..36dc09c694c6 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0_offset.wat
@@ -51,4 +51,4 @@
 ;;   ldrb w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0x1000_offset.wat
index d8b759dc5739..0f77e69103d2 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i32_index_0xffffffff_guard_yes_spectre_i8_access_0x1000_offset.wat
@@ -53,4 +53,4 @@
 ;;   ldrb w0, [x4, w0, UXTW]
 ;;   b label1
 ;; block1:
-;;   ret
\ No newline at end of file
+;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
index 6a2ac43c90e8..356a25cd37e9 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i32_access_0x1000_offset.wat
@@ -45,8 +45,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
-;;   add x10, x0, #4096
-;;   str w1, [x10, x9]
+;;   add x9, x9, #4096
+;;   str w1, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   add x8, x0, #4096
-;;   ldr w0, [x8, x9]
+;;   add x8, x9, #4096
+;;   ldr w0, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
index a1c5d31ae44f..95a0b0c354d7 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0_guard_no_spectre_i8_access_0x1000_offset.wat
@@ -45,8 +45,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
-;;   add x10, x0, #4096
-;;   strb w1, [x10, x9]
+;;   add x9, x9, #4096
+;;   strb w1, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   add x8, x0, #4096
-;;   ldrb w0, [x8, x9]
+;;   add x8, x9, #4096
+;;   ldrb w0, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
index 9a2c925988e8..d6f23c3acf3e 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i32_access_0x1000_offset.wat
@@ -45,8 +45,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
-;;   add x10, x0, #4096
-;;   str w1, [x10, x9]
+;;   add x9, x9, #4096
+;;   str w1, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   add x8, x0, #4096
-;;   ldr w0, [x8, x9]
+;;   add x8, x9, #4096
+;;   ldr w0, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
index 6ba25be468c0..4ce8d4ecada8 100644
--- a/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
+++ b/cranelift/filetests/filetests/isa/aarch64/wasm/load_store_static_kind_i64_index_0xffffffff_guard_no_spectre_i8_access_0x1000_offset.wat
@@ -45,8 +45,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x2]
-;;   add x10, x0, #4096
-;;   strb w1, [x10, x9]
+;;   add x9, x9, #4096
+;;   strb w1, [x9, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
@@ -61,8 +61,8 @@
 ;;   b.hi label3 ; b label1
 ;; block1:
 ;;   ldr x9, [x1]
-;;   add x8, x0, #4096
-;;   ldrb w0, [x8, x9]
+;;   add x8, x9, #4096
+;;   ldrb w0, [x8, x0]
 ;;   b label2
 ;; block2:
 ;;   ret
diff --git a/cranelift/filetests/filetests/isa/riscv64/simd-ifma.clif b/cranelift/filetests/filetests/isa/riscv64/simd-ifma.clif
new file mode 100644
index 000000000000..f50d2e8a4d54
--- /dev/null
+++ b/cranelift/filetests/filetests/isa/riscv64/simd-ifma.clif
@@ -0,0 +1,285 @@
+test compile precise-output
+set unwind_info=false
+target riscv64 has_v
+
+
+function %iadd_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = iadd v2, v3
+    return v4
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v7,48(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vmacc.vv v7,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v7,0(a0) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   addi t6, s0, 0x30
+;   .byte 0x87, 0x83, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0xd7, 0xa3, 0x30, 0xb6
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0xa7, 0x03, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
+function %iadd_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = iadd v4, v3
+    return v5
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vmv.v.x v7,a0 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vmacc.vv v7,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v7,0(a1) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0xd7, 0x43, 0x05, 0x5e
+;   .byte 0xd7, 0xa3, 0x30, 0xb6
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0xa7, 0x83, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
+function %iadd_ineg_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = ineg v3
+    v5 = iadd v2, v4
+    return v5
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v7,48(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vnmsac.vv v7,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v7,0(a0) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   addi t6, s0, 0x30
+;   .byte 0x87, 0x83, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0xd7, 0xa3, 0x30, 0xbe
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0xa7, 0x03, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
+function %iadd_ineg_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = ineg v4
+    v6 = iadd v5, v3
+    return v6
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vmv.v.x v7,a0 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vnmsac.vv v7,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v7,0(a1) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0xd7, 0x43, 0x05, 0x5e
+;   .byte 0xd7, 0xa3, 0x30, 0xbe
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0xa7, 0x83, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
+function %isub_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = isub v2, v3
+    return v4
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v5,48(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vmul.vv v9,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vsub.vv v9,v5,v9 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v9,0(a0) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   addi t6, s0, 0x30
+;   .byte 0x87, 0x82, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0xd7, 0xa4, 0x11, 0x96
+;   .byte 0xd7, 0x84, 0x54, 0x0a
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0xa7, 0x04, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
+function %isub_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = isub v4, v3
+    return v5
+}
+
+; VCode:
+;   add sp,-16
+;   sd ra,8(sp)
+;   sd fp,0(sp)
+;   mv fp,sp
+; block0:
+;   vle8.v v1,16(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vle8.v v3,32(fp) #avl=16, #vtype=(e8, m1, ta, ma)
+;   vmul.vv v8,v1,v3 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vsub.vx v8,v8,a0 #avl=2, #vtype=(e64, m1, ta, ma)
+;   vse8.v v8,0(a1) #avl=16, #vtype=(e8, m1, ta, ma)
+;   ld ra,8(sp)
+;   ld fp,0(sp)
+;   add sp,+16
+;   ret
+;
+; Disassembled:
+; block0: ; offset 0x0
+;   addi sp, sp, -0x10
+;   sd ra, 8(sp)
+;   sd s0, 0(sp)
+;   ori s0, sp, 0
+; block1: ; offset 0x10
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   addi t6, s0, 0x10
+;   .byte 0x87, 0x80, 0x0f, 0x02
+;   addi t6, s0, 0x20
+;   .byte 0x87, 0x81, 0x0f, 0x02
+;   .byte 0x57, 0x70, 0x81, 0xcd
+;   .byte 0x57, 0xa4, 0x11, 0x96
+;   .byte 0x57, 0x44, 0x85, 0x0a
+;   .byte 0x57, 0x70, 0x08, 0xcc
+;   .byte 0x27, 0x84, 0x05, 0x02
+;   ld ra, 8(sp)
+;   ld s0, 0(sp)
+;   addi sp, sp, 0x10
+;   ret
+
diff --git a/cranelift/filetests/filetests/runtests/simd-ifma.clif b/cranelift/filetests/filetests/runtests/simd-ifma.clif
new file mode 100644
index 000000000000..cf4c1162a2cd
--- /dev/null
+++ b/cranelift/filetests/filetests/runtests/simd-ifma.clif
@@ -0,0 +1,74 @@
+test run
+target aarch64
+target s390x
+target x86_64
+target x86_64 skylake
+target riscv64 has_v
+
+;; These tests test integer fused multiply add/subtract instructions.
+
+function %iadd_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = iadd v2, v3
+    return v4
+}
+; run: %iadd_imul_i64x2([0 1], [10 10], [20 20]) == [20 30]
+; run: %iadd_imul_i64x2([0 1], [0 0x80000000_00000000], [0 -1]) == [0 0x7FFFFFFF_FFFFFFFF]
+; run: %iadd_imul_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], [0 1]) == [0 0]
+
+function %iadd_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = iadd v4, v3
+    return v5
+}
+; run: %iadd_imul_splat_i64x2([0 1], [10 10], 20) == [20 30]
+; run: %iadd_imul_splat_i64x2([0 1], [0 0x80000000_00000000], -1) == [-1 0x7FFFFFFF_FFFFFFFF]
+; run: %iadd_imul_splat_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], 1) == [1 0]
+
+function %iadd_ineg_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = ineg v3
+    v5 = iadd v2, v4
+    return v5
+}
+; run: %iadd_ineg_imul_i64x2([0 1], [10 10], [20 20]) == [20 10]
+; run: %iadd_ineg_imul_i64x2([0 1], [0 0x80000000_00000000], [0 -1]) == [0 0x7FFFFFFF_FFFFFFFF]
+; run: %iadd_ineg_imul_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], [0 1]) == [0 2]
+
+function %iadd_ineg_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = ineg v4
+    v6 = iadd v5, v3
+    return v6
+}
+; run: %iadd_ineg_imul_splat_i64x2([0 1], [10 10], 20) == [20 10]
+; run: %iadd_ineg_imul_splat_i64x2([0 1], [0 0x80000000_00000000], -1) == [-1 0x7FFFFFFF_FFFFFFFF]
+; run: %iadd_ineg_imul_splat_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], 1) == [1 2]
+
+function %isub_imul_i64x2(i64x2, i64x2, i64x2) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64x2):
+    v3 = imul v0, v1
+    v4 = isub v2, v3
+    return v4
+}
+; run: %isub_imul_i64x2([0 1], [10 10], [20 20]) == [20 10]
+; run: %isub_imul_i64x2([0 1], [0 0x80000000_00000000], [0 -1]) == [0 0x7FFFFFFF_FFFFFFFF]
+; run: %isub_imul_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], [0 1]) == [0 2]
+
+
+function %isub_imul_splat_i64x2(i64x2, i64x2, i64) -> i64x2 {
+block0(v0: i64x2, v1: i64x2, v2: i64):
+    v3 = splat.i64x2 v2
+    v4 = imul v0, v1
+    v5 = isub v4, v3
+    return v5
+}
+; run: %isub_imul_splat_i64x2([0 1], [10 10], 20) == [-20 -10]
+; run: %isub_imul_splat_i64x2([0 1], [0 0x80000000_00000000], -1) == [1 0x80000000_00000001]
+; run: %isub_imul_splat_i64x2([0 1], [0 0xFFFFFFFF_FFFFFFFF], 1) == [-1 -2]
diff --git a/cranelift/filetests/src/test_run.rs b/cranelift/filetests/src/test_run.rs
index 8b80ae99efcf..bf0fafe97929 100644
--- a/cranelift/filetests/src/test_run.rs
+++ b/cranelift/filetests/src/test_run.rs
@@ -73,23 +73,40 @@ fn is_isa_compatible(
     // we can't natively support on the host.
     let requested_flags = requested.isa_flags();
     for req_value in requested_flags {
-        if let Some(requested) = req_value.as_bool() {
-            let available_in_host = host
-                .isa_flags()
-                .iter()
-                .find(|val| val.name == req_value.name)
-                .and_then(|val| val.as_bool())
-                .unwrap_or(false);
-
-            if requested && !available_in_host {
-                return Err(format!(
-                    "skipped {}: host does not support ISA flag {}",
-                    file_path, req_value.name
-                ));
-            }
-        } else {
-            unimplemented!("ISA flag {} of kind {:?}", req_value.name, req_value.kind());
+        let requested = match req_value.as_bool() {
+            Some(requested) => requested,
+            None => unimplemented!("ISA flag {} of kind {:?}", req_value.name, req_value.kind()),
+        };
+        let available_in_host = host
+            .isa_flags()
+            .iter()
+            .find(|val| val.name == req_value.name)
+            .and_then(|val| val.as_bool())
+            .unwrap_or(false);
+
+        if !requested || available_in_host {
+            continue;
         }
+
+        // The AArch64 feature `sign_return_address` is supported on all AArch64
+        // hosts, regardless of whether `cranelift-native` infers it or not. The
+        // instructions emitted with this feature enabled are interpreted as
+        // "hint" noop instructions on CPUs which don't support address
+        // authentication.
+        //
+        // Note that at this time `cranelift-native` will only enable
+        // `sign_return_address` for macOS (notably not Linux) because of a
+        // historical bug in libunwind which causes pointer address signing,
+        // when run on hardware that supports it, so segfault during unwinding.
+        if req_value.name == "sign_return_address" && matches!(host_arch, Architecture::Aarch64(_))
+        {
+            continue;
+        }
+
+        return Err(format!(
+            "skipped {}: host does not support ISA flag {}",
+            file_path, req_value.name
+        ));
     }
 
     Ok(())
diff --git a/cranelift/frontend/Cargo.toml b/cranelift/frontend/Cargo.toml
index 68f29ec720c5..8c0de80095ae 100644
--- a/cranelift/frontend/Cargo.toml
+++ b/cranelift/frontend/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-frontend"
-version = "0.99.0"
+version = "0.100.0"
 description = "Cranelift IR builder helper"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-frontend"
diff --git a/cranelift/interpreter/Cargo.toml b/cranelift/interpreter/Cargo.toml
index 9648a7ccbd2d..0bb41480cab8 100644
--- a/cranelift/interpreter/Cargo.toml
+++ b/cranelift/interpreter/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-interpreter"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Interpret Cranelift IR"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/isle/isle/Cargo.toml b/cranelift/isle/isle/Cargo.toml
index dfd84f84dba2..20b1ff03b98e 100644
--- a/cranelift/isle/isle/Cargo.toml
+++ b/cranelift/isle/isle/Cargo.toml
@@ -6,7 +6,7 @@ license = "Apache-2.0 WITH LLVM-exception"
 name = "cranelift-isle"
 readme = "../README.md"
 repository = "https://github.com/bytecodealliance/wasmtime/tree/main/cranelift/isle"
-version = "0.99.0"
+version = "0.100.0"
 
 [dependencies]
 codespan-reporting = { version = "0.11.1", optional = true }
diff --git a/cranelift/jit/Cargo.toml b/cranelift/jit/Cargo.toml
index 73905f9089ed..a9057a9304ef 100644
--- a/cranelift/jit/Cargo.toml
+++ b/cranelift/jit/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-jit"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "A JIT library backed by Cranelift"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/module/Cargo.toml b/cranelift/module/Cargo.toml
index b5c850f3b2e9..e83a04224ca9 100644
--- a/cranelift/module/Cargo.toml
+++ b/cranelift/module/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-module"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Support for linking functions and data with Cranelift"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/native/Cargo.toml b/cranelift/native/Cargo.toml
index e37e998ee344..bc8a6ea1800c 100644
--- a/cranelift/native/Cargo.toml
+++ b/cranelift/native/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-native"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Support for targeting the host with Cranelift"
 documentation = "https://docs.rs/cranelift-native"
diff --git a/cranelift/object/Cargo.toml b/cranelift/object/Cargo.toml
index c576f310e282..783835d18ea7 100644
--- a/cranelift/object/Cargo.toml
+++ b/cranelift/object/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-object"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Emit Cranelift output to native object files with `object`"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/reader/Cargo.toml b/cranelift/reader/Cargo.toml
index 3ec07ce9c962..ccf4d214fc2b 100644
--- a/cranelift/reader/Cargo.toml
+++ b/cranelift/reader/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-reader"
-version = "0.99.0"
+version = "0.100.0"
 description = "Cranelift textual IR reader"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-reader"
diff --git a/cranelift/serde/Cargo.toml b/cranelift/serde/Cargo.toml
index 2846623ec770..c51d4fc3d9bf 100644
--- a/cranelift/serde/Cargo.toml
+++ b/cranelift/serde/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-serde"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Serializer/Deserializer for Cranelift IR"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/umbrella/Cargo.toml b/cranelift/umbrella/Cargo.toml
index 2fdd8afdec74..0a5646740997 100644
--- a/cranelift/umbrella/Cargo.toml
+++ b/cranelift/umbrella/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift"
-version = "0.99.0"
+version = "0.100.0"
 description = "Umbrella for commonly-used cranelift crates"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift"
diff --git a/cranelift/wasm/Cargo.toml b/cranelift/wasm/Cargo.toml
index 4657744ab976..d7eb9f42df9c 100644
--- a/cranelift/wasm/Cargo.toml
+++ b/cranelift/wasm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-wasm"
-version = "0.99.0"
+version = "0.100.0"
 authors = ["The Cranelift Project Developers"]
 description = "Translator from WebAssembly to Cranelift IR"
 documentation = "https://docs.rs/cranelift-wasm"
diff --git a/crates/bench-api/Cargo.toml b/crates/bench-api/Cargo.toml
index 150886297134..3a617b821313 100644
--- a/crates/bench-api/Cargo.toml
+++ b/crates/bench-api/Cargo.toml
@@ -22,7 +22,6 @@ target-lexicon = { workspace = true }
 wasmtime = { workspace = true }
 wasmtime-cli-flags = { workspace = true, default-features = true }
 wasmtime-wasi = { workspace = true }
-wasmtime-wasi-crypto = { workspace = true, optional = true }
 wasmtime-wasi-nn = { workspace = true, optional = true }
 wasi-cap-std-sync = { workspace = true }
 cap-std = { workspace = true }
@@ -33,5 +32,4 @@ wat = { workspace = true }
 
 [features]
 default = ["shuffling-allocator", "wasi-nn"]
-wasi-crypto = ["wasmtime-wasi-crypto"]
 wasi-nn = ["wasmtime-wasi-nn"]
diff --git a/crates/bench-api/src/lib.rs b/crates/bench-api/src/lib.rs
index a998bc22f64c..d293d81664b1 100644
--- a/crates/bench-api/src/lib.rs
+++ b/crates/bench-api/src/lib.rs
@@ -419,8 +419,6 @@ struct HostState {
     wasi: WasiCtx,
     #[cfg(feature = "wasi-nn")]
     wasi_nn: wasmtime_wasi_nn::WasiNnCtx,
-    #[cfg(feature = "wasi-crypto")]
-    wasi_crypto: wasmtime_wasi_crypto::WasiCryptoCtx,
 }
 
 impl BenchState {
@@ -472,11 +470,6 @@ impl BenchState {
             wasmtime_wasi_nn::add_to_linker(&mut linker, |cx| &mut cx.wasi_nn)?;
         }
 
-        #[cfg(feature = "wasi-crypto")]
-        if wasi_modules.wasi_crypto {
-            wasmtime_wasi_crypto::add_to_linker(&mut linker, |cx| &mut cx.wasi_crypto)?;
-        }
-
         Ok(Self {
             linker,
             compilation_timer,
@@ -517,8 +510,6 @@ impl BenchState {
             wasi: (self.make_wasi_cx)().context("failed to create a WASI context")?,
             #[cfg(feature = "wasi-nn")]
             wasi_nn: wasmtime_wasi_nn::WasiNnCtx::new()?,
-            #[cfg(feature = "wasi-crypto")]
-            wasi_crypto: wasmtime_wasi_crypto::WasiCryptoCtx::new(),
         };
 
         // NB: Start measuring instantiation time *after* we've created the WASI
diff --git a/crates/c-api/include/wasmtime.h b/crates/c-api/include/wasmtime.h
index cd7cc353c3ff..9bd78b8b5d0a 100644
--- a/crates/c-api/include/wasmtime.h
+++ b/crates/c-api/include/wasmtime.h
@@ -199,11 +199,11 @@
 /**
  * \brief Wasmtime version string.
  */
-#define WASMTIME_VERSION "12.0.0"
+#define WASMTIME_VERSION "13.0.0"
 /**
  * \brief Wasmtime major version number.
  */
-#define WASMTIME_VERSION_MAJOR 12
+#define WASMTIME_VERSION_MAJOR 13
 /**
  * \brief Wasmtime minor version number.
  */
diff --git a/crates/c-api/src/wasi.rs b/crates/c-api/src/wasi.rs
index e02063ed2124..848409bcc866 100644
--- a/crates/c-api/src/wasi.rs
+++ b/crates/c-api/src/wasi.rs
@@ -70,17 +70,17 @@ impl wasi_config_t {
     pub fn into_wasi_ctx(self) -> Result<WasiCtx> {
         let mut builder = WasiCtxBuilder::new();
         if self.inherit_args {
-            builder = builder.inherit_args()?;
+            builder.inherit_args()?;
         } else if !self.args.is_empty() {
             let args = self
                 .args
                 .into_iter()
                 .map(|bytes| Ok(String::from_utf8(bytes)?))
                 .collect::<Result<Vec<String>>>()?;
-            builder = builder.args(&args)?;
+            builder.args(&args)?;
         }
         if self.inherit_env {
-            builder = builder.inherit_env()?;
+            builder.inherit_env()?;
         } else if !self.env.is_empty() {
             let env = self
                 .env
@@ -91,44 +91,50 @@ impl wasi_config_t {
                     Ok((k, v))
                 })
                 .collect::<Result<Vec<(String, String)>>>()?;
-            builder = builder.envs(&env)?;
+            builder.envs(&env)?;
         }
-        builder = match self.stdin {
-            WasiConfigReadPipe::None => builder,
-            WasiConfigReadPipe::Inherit => builder.inherit_stdin(),
+        match self.stdin {
+            WasiConfigReadPipe::None => {}
+            WasiConfigReadPipe::Inherit => {
+                builder.inherit_stdin();
+            }
             WasiConfigReadPipe::File(file) => {
                 let file = cap_std::fs::File::from_std(file);
                 let file = wasi_cap_std_sync::file::File::from_cap_std(file);
-                builder.stdin(Box::new(file))
+                builder.stdin(Box::new(file));
             }
             WasiConfigReadPipe::Bytes(binary) => {
                 let binary = ReadPipe::from(binary);
-                builder.stdin(Box::new(binary))
+                builder.stdin(Box::new(binary));
             }
         };
-        builder = match self.stdout {
-            WasiConfigWritePipe::None => builder,
-            WasiConfigWritePipe::Inherit => builder.inherit_stdout(),
+        match self.stdout {
+            WasiConfigWritePipe::None => {}
+            WasiConfigWritePipe::Inherit => {
+                builder.inherit_stdout();
+            }
             WasiConfigWritePipe::File(file) => {
                 let file = cap_std::fs::File::from_std(file);
                 let file = wasi_cap_std_sync::file::File::from_cap_std(file);
-                builder.stdout(Box::new(file))
+                builder.stdout(Box::new(file));
             }
         };
-        builder = match self.stderr {
-            WasiConfigWritePipe::None => builder,
-            WasiConfigWritePipe::Inherit => builder.inherit_stderr(),
+        match self.stderr {
+            WasiConfigWritePipe::None => {}
+            WasiConfigWritePipe::Inherit => {
+                builder.inherit_stderr();
+            }
             WasiConfigWritePipe::File(file) => {
                 let file = cap_std::fs::File::from_std(file);
                 let file = wasi_cap_std_sync::file::File::from_cap_std(file);
-                builder.stderr(Box::new(file))
+                builder.stderr(Box::new(file));
             }
         };
         for (dir, path) in self.preopen_dirs {
-            builder = builder.preopened_dir(dir, path)?;
+            builder.preopened_dir(dir, path)?;
         }
         for (fd_num, listener) in self.preopen_sockets {
-            builder = builder.preopened_socket(fd_num, listener)?;
+            builder.preopened_socket(fd_num, listener)?;
         }
         Ok(builder.build())
     }
diff --git a/crates/cli-flags/Cargo.toml b/crates/cli-flags/Cargo.toml
index 1b1f1e2a91b5..a2254f0a7e8d 100644
--- a/crates/cli-flags/Cargo.toml
+++ b/crates/cli-flags/Cargo.toml
@@ -25,4 +25,4 @@ default = [
     "wasmtime/parallel-compilation",
 ]
 pooling-allocator = []
-component-model = []
+component-model = ["wasmtime/component-model"]
diff --git a/crates/cli-flags/src/lib.rs b/crates/cli-flags/src/lib.rs
index dcaaf92de165..439d79ae3599 100644
--- a/crates/cli-flags/src/lib.rs
+++ b/crates/cli-flags/src/lib.rs
@@ -64,10 +64,6 @@ pub const SUPPORTED_WASI_MODULES: &[(&str, &str)] = &[
         "wasi-common",
         "enables support for the WASI common APIs, see https://github.com/WebAssembly/WASI",
     ),
-    (
-        "experimental-wasi-crypto",
-        "enables support for the WASI cryptography APIs (experimental), see https://github.com/WebAssembly/wasi-crypto",
-    ),
     (
         "experimental-wasi-nn",
         "enables support for the WASI neural network API (experimental), see https://github.com/WebAssembly/wasi-nn",
@@ -538,7 +534,6 @@ fn parse_wasi_modules(modules: &str) -> Result<WasiModules> {
             let mut set = |module: &str, enable: bool| match module {
                 "" => Ok(()),
                 "wasi-common" => Ok(wasi_modules.wasi_common = enable),
-                "experimental-wasi-crypto" => Ok(wasi_modules.wasi_crypto = enable),
                 "experimental-wasi-nn" => Ok(wasi_modules.wasi_nn = enable),
                 "experimental-wasi-threads" => Ok(wasi_modules.wasi_threads = enable),
                 "experimental-wasi-http" => Ok(wasi_modules.wasi_http = enable),
@@ -568,9 +563,6 @@ pub struct WasiModules {
     /// parts once the implementation allows for it (e.g. wasi-fs, wasi-clocks, etc.).
     pub wasi_common: bool,
 
-    /// Enable the experimental wasi-crypto implementation.
-    pub wasi_crypto: bool,
-
     /// Enable the experimental wasi-nn implementation.
     pub wasi_nn: bool,
 
@@ -585,7 +577,6 @@ impl Default for WasiModules {
     fn default() -> Self {
         Self {
             wasi_common: true,
-            wasi_crypto: false,
             wasi_nn: false,
             wasi_threads: false,
             wasi_http: false,
@@ -599,7 +590,6 @@ impl WasiModules {
         Self {
             wasi_common: false,
             wasi_nn: false,
-            wasi_crypto: false,
             wasi_threads: false,
             wasi_http: false,
         }
@@ -642,6 +632,8 @@ mod test {
             function_references,
             exceptions: _,
             typed_continuations,
+            #[cfg(feature = "component-model")]
+            component_model,
         } = options.wasm_features.unwrap();
 
         assert_eq!(reference_types, Some(true));
@@ -655,6 +647,8 @@ mod test {
         assert_eq!(function_references, Some(true));
         assert_eq!(relaxed_simd, Some(true));
         assert_eq!(typed_continuations, Some(true));
+        #[cfg(feature = "component-model")]
+        assert_eq!(component_model, Some(true));
 
         Ok(())
     }
@@ -676,6 +670,8 @@ mod test {
             function_references,
             exceptions,
             typed_continuations,
+            #[cfg(feature = "component-model")]
+            component_model,
         } = options.wasm_features.unwrap();
 
         assert_eq!(reference_types, Some(false));
@@ -690,6 +686,8 @@ mod test {
         assert_eq!(relaxed_simd, Some(false));
         assert_eq!(exceptions, Some(false));
         assert_eq!(typed_continuations, Some(false));
+        #[cfg(feature = "component-model")]
+        assert_eq!(component_model, Some(false));
 
         Ok(())
     }
@@ -714,6 +712,8 @@ mod test {
             function_references,
             exceptions,
             typed_continuations,
+            #[cfg(feature = "component-model")]
+            component_model,
         } = options.wasm_features.unwrap();
 
         assert_eq!(reference_types, Some(false));
@@ -728,6 +728,8 @@ mod test {
         assert_eq!(relaxed_simd, None);
         assert_eq!(exceptions, None);
         assert_eq!(typed_continuations, None);
+        #[cfg(feature = "component-model")]
+        assert_eq!(component_model, None);
 
         Ok(())
     }
@@ -778,7 +780,6 @@ mod test {
             options.wasi_modules.unwrap(),
             WasiModules {
                 wasi_common: true,
-                wasi_crypto: false,
                 wasi_nn: false,
                 wasi_threads: false,
                 wasi_http: false,
@@ -793,7 +794,6 @@ mod test {
             options.wasi_modules.unwrap(),
             WasiModules {
                 wasi_common: true,
-                wasi_crypto: false,
                 wasi_nn: false,
                 wasi_threads: false,
                 wasi_http: false
@@ -812,7 +812,6 @@ mod test {
             options.wasi_modules.unwrap(),
             WasiModules {
                 wasi_common: false,
-                wasi_crypto: false,
                 wasi_nn: true,
                 wasi_threads: false,
                 wasi_http: false,
@@ -828,7 +827,6 @@ mod test {
             options.wasi_modules.unwrap(),
             WasiModules {
                 wasi_common: false,
-                wasi_crypto: false,
                 wasi_nn: false,
                 wasi_threads: false,
                 wasi_http: false,
diff --git a/crates/component-macro/src/bindgen.rs b/crates/component-macro/src/bindgen.rs
index 7415241fe191..3dfd7f846ea4 100644
--- a/crates/component-macro/src/bindgen.rs
+++ b/crates/component-macro/src/bindgen.rs
@@ -251,18 +251,9 @@ impl Parse for Opt {
             input.parse::<Token![:]>()?;
             let contents;
             let _lbrace = braced!(contents in input);
-            let fields: Punctuated<(String, String, String), Token![,]> =
+            let fields: Punctuated<_, Token![,]> =
                 contents.parse_terminated(trappable_error_field_parse, Token![,])?;
-            Ok(Opt::TrappableErrorType(
-                fields
-                    .into_iter()
-                    .map(|(wit_owner, wit_name, rust_name)| TrappableError {
-                        wit_owner: Some(wit_owner),
-                        wit_name,
-                        rust_name,
-                    })
-                    .collect(),
-            ))
+            Ok(Opt::TrappableErrorType(Vec::from_iter(fields.into_iter())))
         } else if l.peek(kw::interfaces) {
             input.parse::<kw::interfaces>()?;
             input.parse::<Token![:]>()?;
@@ -281,7 +272,7 @@ impl Parse for Opt {
     }
 }
 
-fn trappable_error_field_parse(input: ParseStream<'_>) -> Result<(String, String, String)> {
+fn trappable_error_field_parse(input: ParseStream<'_>) -> Result<TrappableError> {
     // Accept a Rust identifier or a string literal. This is required
     // because not all wit identifiers are Rust identifiers, so we can
     // smuggle the invalid ones inside quotes.
@@ -296,12 +287,16 @@ fn trappable_error_field_parse(input: ParseStream<'_>) -> Result<(String, String
         }
     }
 
-    let interface = ident_or_str(input)?;
+    let wit_package_path = input.parse::<syn::LitStr>()?.value();
     input.parse::<Token![::]>()?;
-    let type_ = ident_or_str(input)?;
+    let wit_type_name = ident_or_str(input)?;
     input.parse::<Token![:]>()?;
-    let rust_type = input.parse::<Ident>()?.to_string();
-    Ok((interface, type_, rust_type))
+    let rust_type_name = input.parse::<Ident>()?.to_string();
+    Ok(TrappableError {
+        wit_package_path,
+        wit_type_name,
+        rust_type_name,
+    })
 }
 
 fn with_field_parse(input: ParseStream<'_>) -> Result<(String, String)> {
diff --git a/crates/fuzzing/src/generators/config.rs b/crates/fuzzing/src/generators/config.rs
index f65e22c62f6f..07daebc8083d 100644
--- a/crates/fuzzing/src/generators/config.rs
+++ b/crates/fuzzing/src/generators/config.rs
@@ -208,34 +208,6 @@ impl Config {
             }
         }
 
-        // Try to configure cranelift to insert padding between basic blocks to
-        // stress code layout mechanisms within Cranelift. This padding can get
-        // unwieldy quickly, however, generating a 4G+ function which isn't
-        // particularly interesting at this time.
-        //
-        // To keep this setting under control there are a few limits in place:
-        //
-        // * Cranelift will generate at most 150M of padding per-function,
-        //   regardless of how many basic blocks there are.
-        // * Here it's limited to enable this setting only when there's at most
-        //   10 functions to ensure that the overhead for all functions is <1G
-        //   ish or otherwise doesn't run away.
-        // * The `bb_padding_log2_minus_one` setting isn't allowed to be
-        //   larger than 26 as that allows for `1<<25` maximum padding size
-        //   which is 32M.
-        //
-        // With all that combined this is intended to still be enabled,
-        // although perhaps not all the time, and stress enough interesting test
-        // cases in cranelift.
-        if self.module_config.config.max_funcs < 5 {
-            unsafe {
-                cfg.cranelift_flag_set(
-                    "bb_padding_log2_minus_one",
-                    &(self.wasmtime.bb_padding_log2 % 27).to_string(),
-                );
-            }
-        }
-
         // Vary the memory configuration, but only if threads are not enabled.
         // When the threads proposal is enabled we might generate shared memory,
         // which is less amenable to different memory configurations:
@@ -426,7 +398,6 @@ pub struct WasmtimeConfig {
     native_unwind_info: bool,
     /// Configuration for the compiler to use.
     pub compiler_strategy: CompilerStrategy,
-    bb_padding_log2: u8,
 }
 
 impl WasmtimeConfig {
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index 1cb9520da467..380382648bea 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -61,11 +61,6 @@ async = ["wasmtime-fiber"]
 # Enables support for the pooling instance allocator
 pooling-allocator = []
 
-# Enables trap handling using POSIX signals instead of Mach exceptions on MacOS.
-# It is useful for applications that do not bind their own exception ports and
-# need portable signal handling.
-posix-signals-on-macos = []
-
 component-model = [
   "wasmtime-environ/component-model",
   "dep:encoding_rs",
diff --git a/crates/runtime/src/traphandlers.rs b/crates/runtime/src/traphandlers.rs
index 512e0789bf20..21a7a519a1d1 100644
--- a/crates/runtime/src/traphandlers.rs
+++ b/crates/runtime/src/traphandlers.rs
@@ -71,10 +71,7 @@ cfg_if::cfg_if! {
 }
 
 cfg_if::cfg_if! {
-    if #[cfg(all(target_os = "macos", not(feature = "posix-signals-on-macos")))] {
-        mod macos;
-        use macos as sys;
-    } else if #[cfg(unix)] {
+    if #[cfg(unix)] {
         mod unix;
         use unix as sys;
     } else if #[cfg(target_os = "windows")] {
@@ -83,6 +80,9 @@ cfg_if::cfg_if! {
     }
 }
 
+#[cfg(target_os = "macos")]
+mod macos;
+
 pub use sys::SignalHandler;
 
 /// Globally-set callback to determine whether a program counter is actually a
@@ -92,6 +92,10 @@ pub use sys::SignalHandler;
 /// `wasmtime` currently.
 static mut IS_WASM_PC: fn(usize) -> bool = |_| false;
 
+/// Whether or not macOS is using mach ports.
+#[cfg(target_os = "macos")]
+static mut MACOS_USE_MACH_PORTS: bool = false;
+
 /// This function is required to be called before any WebAssembly is entered.
 /// This will configure global state such as signal handlers to prepare the
 /// process to receive wasm traps.
@@ -105,12 +109,41 @@ static mut IS_WASM_PC: fn(usize) -> bool = |_| false;
 /// program counter is the pc of an actual wasm trap or not. This is then used
 /// to disambiguate faults that happen due to wasm and faults that happen due to
 /// bugs in Rust or elsewhere.
-pub fn init_traps(is_wasm_pc: fn(usize) -> bool) {
+pub fn init_traps(is_wasm_pc: fn(usize) -> bool, macos_use_mach_ports: bool) {
     static INIT: Once = Once::new();
+
+    // only used on macos, so squelch warnings about this not being used on
+    // other platform.
+    let _ = macos_use_mach_ports;
+
     INIT.call_once(|| unsafe {
         IS_WASM_PC = is_wasm_pc;
+        #[cfg(target_os = "macos")]
+        if macos_use_mach_ports {
+            MACOS_USE_MACH_PORTS = macos_use_mach_ports;
+            return macos::platform_init();
+        }
         sys::platform_init();
     });
+
+    #[cfg(target_os = "macos")]
+    unsafe {
+        assert_eq!(
+            MACOS_USE_MACH_PORTS, macos_use_mach_ports,
+            "cannot configure two different methods of signal handling in the same process"
+        );
+    }
+}
+
+fn lazy_per_thread_init() {
+    #[cfg(target_os = "macos")]
+    unsafe {
+        if MACOS_USE_MACH_PORTS {
+            return macos::lazy_per_thread_init();
+        }
+    }
+
+    sys::lazy_per_thread_init();
 }
 
 /// Raises a trap immediately.
@@ -592,7 +625,7 @@ mod tls {
                 // performed per-thread initialization for traps.
                 let (prev, initialized) = p.get();
                 if !initialized {
-                    super::super::sys::lazy_per_thread_init();
+                    super::super::lazy_per_thread_init();
                 }
                 p.set((val, true));
                 prev
@@ -609,7 +642,7 @@ mod tls {
                 if initialized {
                     return;
                 }
-                super::super::sys::lazy_per_thread_init();
+                super::super::lazy_per_thread_init();
                 p.set((state, true));
             })
         }
diff --git a/crates/runtime/src/traphandlers/macos.rs b/crates/runtime/src/traphandlers/macos.rs
index 092be819ece5..493d4b5dbcaf 100644
--- a/crates/runtime/src/traphandlers/macos.rs
+++ b/crates/runtime/src/traphandlers/macos.rs
@@ -161,16 +161,21 @@ mod mach_addons {
 
 use mach_addons::*;
 
-/// Just used below
-pub enum Void {}
-/// For now this is basically unused, we don't expose this any more for
-/// Wasmtime on macOS.
-pub type SignalHandler<'a> = dyn Fn(Void) -> bool + Send + Sync + 'a;
-
 /// Process-global port that we use to route thread-level exceptions to.
 static mut WASMTIME_PORT: mach_port_name_t = MACH_PORT_NULL;
 
+static mut CHILD_OF_FORKED_PROCESS: bool = false;
+
 pub unsafe fn platform_init() {
+    // Mach ports do not currently work across forks, so configure Wasmtime to
+    // panic in `lazy_per_thread_init` if the child attempts to invoke
+    // WebAssembly.
+    unsafe extern "C" fn child() {
+        CHILD_OF_FORKED_PROCESS = true;
+    }
+    let rc = libc::pthread_atfork(None, None, Some(child));
+    assert_eq!(rc, 0, "failed to configure `pthread_atfork` handler");
+
     // Allocate our WASMTIME_PORT and make sure that it can be sent to so we
     // can receive exceptions.
     let me = mach_task_self();
@@ -461,6 +466,11 @@ unsafe extern "C" fn unwind(
 #[cold]
 pub fn lazy_per_thread_init() {
     unsafe {
+        assert!(
+            !CHILD_OF_FORKED_PROCESS,
+            "cannot use Wasmtime in a forked process when mach ports are \
+             configured, see `Config::macos_use_mach_ports`"
+        );
         assert!(WASMTIME_PORT != MACH_PORT_NULL);
         let this_thread = mach_thread_self();
         let kret = thread_set_exception_ports(
diff --git a/crates/runtime/src/traphandlers/unix.rs b/crates/runtime/src/traphandlers/unix.rs
index 969041a56eec..4a7e2027b679 100644
--- a/crates/runtime/src/traphandlers/unix.rs
+++ b/crates/runtime/src/traphandlers/unix.rs
@@ -173,6 +173,21 @@ unsafe extern "C" fn trap_handler(
     }
 }
 
+// FIXME(rust-lang/libc#3312) the currenty definition of `ucontext_t` in the
+// `libc` crate is incorrect on aarch64-apple-drawin so it's defined here with a
+// more accurate definition. When that PR and/or issue is resolved then this
+// should no longer be necessary.
+#[repr(C)]
+#[cfg(all(target_arch = "aarch64", target_os = "macos"))]
+struct ucontext_t {
+    uc_onstack: libc::c_int,
+    uc_sigmask: libc::sigset_t,
+    uc_stack: libc::stack_t,
+    uc_link: *mut libc::ucontext_t,
+    uc_mcsize: usize,
+    uc_mcontext: libc::mcontext_t,
+}
+
 unsafe fn get_pc_and_fp(cx: *mut libc::c_void, _signum: libc::c_int) -> (*const u8, usize) {
     cfg_if::cfg_if! {
         if #[cfg(all(target_os = "linux", target_arch = "x86_64"))] {
@@ -214,7 +229,7 @@ unsafe fn get_pc_and_fp(cx: *mut libc::c_void, _signum: libc::c_int) -> (*const
                 (*cx.uc_mcontext).__ss.__rbp as usize,
             )
         } else if #[cfg(all(target_os = "macos", target_arch = "aarch64"))] {
-            let cx = &*(cx as *const libc::ucontext_t);
+            let cx = &*(cx as *const ucontext_t);
             (
                 (*cx.uc_mcontext).__ss.__pc as *const u8,
                 (*cx.uc_mcontext).__ss.__fp as usize,
@@ -270,7 +285,7 @@ unsafe fn set_pc(cx: *mut libc::c_void, pc: usize, arg1: usize) {
                 (*cx.uc_mcontext).__ss.__rsp -= 8;
             }
         } else if #[cfg(target_arch = "aarch64")] {
-            let cx = &mut *(cx as *mut libc::ucontext_t);
+            let cx = &mut *(cx as *mut ucontext_t);
             (*cx.uc_mcontext).__ss.__pc = pc as u64;
             (*cx.uc_mcontext).__ss.__x[0] = arg1 as u64;
         } else {
diff --git a/crates/test-programs/reactor-tests/src/lib.rs b/crates/test-programs/reactor-tests/src/lib.rs
index ff1c0cab78ff..532dda77f4e1 100644
--- a/crates/test-programs/reactor-tests/src/lib.rs
+++ b/crates/test-programs/reactor-tests/src/lib.rs
@@ -31,7 +31,7 @@ impl TestReactor for T {
             Ok(())
         }
     }
-    fn pass_an_imported_record(stat: wasi::filesystem::filesystem::DescriptorStat) -> String {
+    fn pass_an_imported_record(stat: wasi::filesystem::types::DescriptorStat) -> String {
         format!("{stat:?}")
     }
 }
diff --git a/crates/test-programs/tests/command.rs b/crates/test-programs/tests/command.rs
index c779b998abfd..7b5877e9da51 100644
--- a/crates/test-programs/tests/command.rs
+++ b/crates/test-programs/tests/command.rs
@@ -63,7 +63,7 @@ async fn instantiate(
 async fn hello_stdout() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_args(&["gussie", "sparky", "willa"])
+        .args(&["gussie", "sparky", "willa"])
         .build(&mut table)?;
     let (mut store, command) =
         instantiate(get_component("hello_stdout"), CommandCtx { table, wasi }).await?;
@@ -77,7 +77,7 @@ async fn hello_stdout() -> Result<()> {
 async fn panic() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_args(&[
+        .args(&[
             "diesel",
             "the",
             "cat",
@@ -100,7 +100,7 @@ async fn panic() -> Result<()> {
 async fn args() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_args(&["hello", "this", "", "is an argument", "with 🚩 emoji"])
+        .args(&["hello", "this", "", "is an argument", "with 🚩 emoji"])
         .build(&mut table)?;
     let (mut store, command) =
         instantiate(get_component("args"), CommandCtx { table, wasi }).await?;
@@ -156,8 +156,8 @@ async fn time() -> Result<()> {
 
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_monotonic_clock(FakeMonotonicClock { now: Mutex::new(0) })
-        .set_wall_clock(FakeWallClock)
+        .monotonic_clock(FakeMonotonicClock { now: Mutex::new(0) })
+        .wall_clock(FakeWallClock)
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -173,7 +173,7 @@ async fn time() -> Result<()> {
 async fn stdin() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_stdin(MemoryInputPipe::new(
+        .stdin(MemoryInputPipe::new(
             "So rested he by the Tumtum tree".into(),
         ))
         .build(&mut table)?;
@@ -191,7 +191,7 @@ async fn stdin() -> Result<()> {
 async fn poll_stdin() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .set_stdin(MemoryInputPipe::new(
+        .stdin(MemoryInputPipe::new(
             "So rested he by the Tumtum tree".into(),
         ))
         .build(&mut table)?;
@@ -209,8 +209,8 @@ async fn poll_stdin() -> Result<()> {
 async fn env() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .push_env("frabjous", "day")
-        .push_env("callooh", "callay")
+        .env("frabjous", "day")
+        .env("callooh", "callay")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -232,7 +232,7 @@ async fn file_read() -> Result<()> {
 
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .push_preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
+        .preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -255,7 +255,7 @@ async fn file_append() -> Result<()> {
 
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .push_preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
+        .preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -287,7 +287,7 @@ async fn file_dir_sync() -> Result<()> {
 
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .push_preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
+        .preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -380,7 +380,7 @@ async fn directory_list() -> Result<()> {
     let wasi = WasiCtxBuilder::new()
         .inherit_stdout()
         .inherit_stderr()
-        .push_preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
+        .preopened_dir(open_dir, DirPerms::all(), FilePerms::all(), "/")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -432,7 +432,7 @@ async fn read_only() -> Result<()> {
     let mut table = Table::new();
     let open_dir = Dir::open_ambient_dir(dir.path(), ambient_authority())?;
     let wasi = WasiCtxBuilder::new()
-        .push_preopened_dir(open_dir, DirPerms::READ, FilePerms::READ, "/")
+        .preopened_dir(open_dir, DirPerms::READ, FilePerms::READ, "/")
         .build(&mut table)?;
 
     let (mut store, command) =
@@ -451,8 +451,8 @@ async fn stream_pollable_lifetimes() -> Result<()> {
         // Correct execution: should succeed
         let mut table = Table::new();
         let wasi = WasiCtxBuilder::new()
-            .set_args(&["correct"])
-            .set_stdin(MemoryInputPipe::new(" ".into()))
+            .args(&["correct"])
+            .stdin(MemoryInputPipe::new(" ".into()))
             .build(&mut table)?;
 
         let (mut store, command) = instantiate(
@@ -470,8 +470,8 @@ async fn stream_pollable_lifetimes() -> Result<()> {
         // Incorrect execution: should trap with a TableError::HasChildren
         let mut table = Table::new();
         let wasi = WasiCtxBuilder::new()
-            .set_args(&["trap"])
-            .set_stdin(MemoryInputPipe::new(" ".into()))
+            .args(&["trap"])
+            .stdin(MemoryInputPipe::new(" ".into()))
             .build(&mut table)?;
 
         let (mut store, command) = instantiate(
diff --git a/crates/test-programs/tests/reactor.rs b/crates/test-programs/tests/reactor.rs
index 87e1a6925e0d..b9e4c56ca2d7 100644
--- a/crates/test-programs/tests/reactor.rs
+++ b/crates/test-programs/tests/reactor.rs
@@ -4,7 +4,7 @@ use wasmtime::{
     Config, Engine, Store,
 };
 use wasmtime_wasi::preview2::bindings::clocks::wall_clock;
-use wasmtime_wasi::preview2::bindings::filesystem::filesystem;
+use wasmtime_wasi::preview2::bindings::filesystem::types as filesystem;
 use wasmtime_wasi::preview2::{self, Table, WasiCtx, WasiCtxBuilder, WasiView};
 
 lazy_static::lazy_static! {
@@ -28,9 +28,9 @@ wasmtime::component::bindgen!({
     async: true,
     with: {
        "wasi:io/streams": preview2::bindings::io::streams,
-       "wasi:filesystem/filesystem": preview2::bindings::filesystem::filesystem,
+       "wasi:filesystem/types": preview2::bindings::filesystem::types,
+       "wasi:filesystem/preopens": preview2::bindings::filesystem::preopens,
        "wasi:cli-base/environment": preview2::bindings::cli_base::environment,
-       "wasi:cli-base/preopens": preview2::bindings::cli_base::preopens,
        "wasi:cli-base/exit": preview2::bindings::cli_base::exit,
        "wasi:cli-base/stdin": preview2::bindings::cli_base::stdin,
        "wasi:cli-base/stdout": preview2::bindings::cli_base::stdout,
@@ -68,10 +68,10 @@ async fn instantiate(
     let mut linker = Linker::new(&ENGINE);
 
     // All of the imports available to the world are provided by the wasi-common crate:
-    preview2::bindings::filesystem::filesystem::add_to_linker(&mut linker, |x| x)?;
+    preview2::bindings::filesystem::types::add_to_linker(&mut linker, |x| x)?;
+    preview2::bindings::filesystem::preopens::add_to_linker(&mut linker, |x| x)?;
     preview2::bindings::io::streams::add_to_linker(&mut linker, |x| x)?;
     preview2::bindings::cli_base::environment::add_to_linker(&mut linker, |x| x)?;
-    preview2::bindings::cli_base::preopens::add_to_linker(&mut linker, |x| x)?;
     preview2::bindings::cli_base::exit::add_to_linker(&mut linker, |x| x)?;
     preview2::bindings::cli_base::stdin::add_to_linker(&mut linker, |x| x)?;
     preview2::bindings::cli_base::stdout::add_to_linker(&mut linker, |x| x)?;
@@ -88,7 +88,7 @@ async fn instantiate(
 async fn reactor_tests() -> Result<()> {
     let mut table = Table::new();
     let wasi = WasiCtxBuilder::new()
-        .push_env("GOOD_DOG", "gussie")
+        .env("GOOD_DOG", "gussie")
         .build(&mut table)?;
 
     let (mut store, reactor) =
@@ -129,8 +129,6 @@ async fn reactor_tests() -> Result<()> {
             nanoseconds: 789,
             seconds: 10,
         },
-        device: 0,
-        inode: 0,
         link_count: 0,
         size: 0,
         status_change_timestamp: wall_clock::Datetime {
diff --git a/crates/test-programs/tests/wasi-cap-std-sync.rs b/crates/test-programs/tests/wasi-cap-std-sync.rs
index 3e1ba3d15cce..f373b33dff2b 100644
--- a/crates/test-programs/tests/wasi-cap-std-sync.rs
+++ b/crates/test-programs/tests/wasi-cap-std-sync.rs
@@ -38,19 +38,19 @@ fn run(name: &str, inherit_stdio: bool) -> Result<()> {
         let mut builder = WasiCtxBuilder::new();
 
         if inherit_stdio {
-            builder = builder.inherit_stdio();
+            builder.inherit_stdio();
         } else {
-            builder = builder
+            builder
                 .stdout(Box::new(stdout.clone()))
                 .stderr(Box::new(stderr.clone()));
         }
-        builder = builder.arg(name)?.arg(".")?;
+        builder.arg(name)?.arg(".")?;
         println!("preopen: {:?}", workspace);
         let preopen_dir =
             cap_std::fs::Dir::open_ambient_dir(workspace.path(), cap_std::ambient_authority())?;
-        builder = builder.preopened_dir(preopen_dir, ".")?;
+        builder.preopened_dir(preopen_dir, ".")?;
         for (var, val) in test_programs::wasi_tests_environment() {
-            builder = builder.env(var, val)?;
+            builder.env(var, val)?;
         }
 
         let mut store = Store::new(&ENGINE, builder.build());
diff --git a/crates/test-programs/tests/wasi-http.rs b/crates/test-programs/tests/wasi-http.rs
index 0b1a4fd70567..e6a5480e7df8 100644
--- a/crates/test-programs/tests/wasi-http.rs
+++ b/crates/test-programs/tests/wasi-http.rs
@@ -76,12 +76,12 @@ pub fn run(name: &str) -> anyhow::Result<()> {
     wasmtime_wasi_http::add_to_linker(&mut linker, |cx: &mut Ctx| &mut cx.http)?;
 
     // Create our wasi context.
-    let builder = WasiCtxBuilder::new().inherit_stdio().arg(name)?;
+    let wasi = WasiCtxBuilder::new().inherit_stdio().arg(name)?.build();
 
     let mut store = Store::new(
         &ENGINE,
         Ctx {
-            wasi: builder.build(),
+            wasi,
             http: WasiHttp::new(),
         },
     );
diff --git a/crates/test-programs/tests/wasi-preview1-host-in-preview2.rs b/crates/test-programs/tests/wasi-preview1-host-in-preview2.rs
index 2f0f958c5aba..700cfd23454d 100644
--- a/crates/test-programs/tests/wasi-preview1-host-in-preview2.rs
+++ b/crates/test-programs/tests/wasi-preview1-host-in-preview2.rs
@@ -41,19 +41,17 @@ async fn run(name: &str, inherit_stdio: bool) -> Result<()> {
         let mut builder = WasiCtxBuilder::new();
 
         if inherit_stdio {
-            builder = builder.inherit_stdio();
+            builder.inherit_stdio();
         } else {
-            builder = builder
-                .set_stdout(stdout.clone())
-                .set_stderr(stderr.clone());
+            builder.stdout(stdout.clone()).stderr(stderr.clone());
         }
-        builder = builder.set_args(&[name, "."]);
+        builder.args(&[name, "."]);
         println!("preopen: {:?}", workspace);
         let preopen_dir =
             cap_std::fs::Dir::open_ambient_dir(workspace.path(), cap_std::ambient_authority())?;
-        builder = builder.push_preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
+        builder.preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
         for (var, val) in test_programs::wasi_tests_environment() {
-            builder = builder.push_env(var, val);
+            builder.env(var, val);
         }
 
         let mut table = Table::new();
@@ -167,7 +165,7 @@ async fn fd_flags_set() {
 }
 #[test_log::test(tokio::test(flavor = "multi_thread"))]
 async fn fd_readdir() {
-    run("fd_readdir", false).await.unwrap()
+    run("fd_readdir", true).await.unwrap()
 }
 #[test_log::test(tokio::test(flavor = "multi_thread"))]
 async fn file_allocate() {
diff --git a/crates/test-programs/tests/wasi-preview2-components-sync.rs b/crates/test-programs/tests/wasi-preview2-components-sync.rs
index 37a03d2aa862..b618b9f40373 100644
--- a/crates/test-programs/tests/wasi-preview2-components-sync.rs
+++ b/crates/test-programs/tests/wasi-preview2-components-sync.rs
@@ -41,19 +41,17 @@ fn run(name: &str, inherit_stdio: bool) -> Result<()> {
         let mut builder = WasiCtxBuilder::new();
 
         if inherit_stdio {
-            builder = builder.inherit_stdio();
+            builder.inherit_stdio();
         } else {
-            builder = builder
-                .set_stdout(stdout.clone())
-                .set_stderr(stderr.clone());
+            builder.stdout(stdout.clone()).stderr(stderr.clone());
         }
-        builder = builder.set_args(&[name, "."]);
+        builder.args(&[name, "."]);
         println!("preopen: {:?}", workspace);
         let preopen_dir =
             cap_std::fs::Dir::open_ambient_dir(workspace.path(), cap_std::ambient_authority())?;
-        builder = builder.push_preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
+        builder.preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
         for (var, val) in test_programs::wasi_tests_environment() {
-            builder = builder.push_env(var, val);
+            builder.env(var, val);
         }
 
         let mut table = Table::new();
diff --git a/crates/test-programs/tests/wasi-preview2-components.rs b/crates/test-programs/tests/wasi-preview2-components.rs
index 947a9eea04e2..c74cae9002e8 100644
--- a/crates/test-programs/tests/wasi-preview2-components.rs
+++ b/crates/test-programs/tests/wasi-preview2-components.rs
@@ -41,19 +41,17 @@ async fn run(name: &str, inherit_stdio: bool) -> Result<()> {
         let mut builder = WasiCtxBuilder::new();
 
         if inherit_stdio {
-            builder = builder.inherit_stdio();
+            builder.inherit_stdio();
         } else {
-            builder = builder
-                .set_stdout(stdout.clone())
-                .set_stderr(stderr.clone());
+            builder.stdout(stdout.clone()).stderr(stderr.clone());
         }
-        builder = builder.set_args(&[name, "."]);
+        builder.args(&[name, "."]);
         println!("preopen: {:?}", workspace);
         let preopen_dir =
             cap_std::fs::Dir::open_ambient_dir(workspace.path(), cap_std::ambient_authority())?;
-        builder = builder.push_preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
+        builder.preopened_dir(preopen_dir, DirPerms::all(), FilePerms::all(), ".");
         for (var, val) in test_programs::wasi_tests_environment() {
-            builder = builder.push_env(var, val);
+            builder.env(var, val);
         }
 
         let mut table = Table::new();
diff --git a/crates/test-programs/tests/wasi-tokio.rs b/crates/test-programs/tests/wasi-tokio.rs
index f14f273d0f2c..bd673704cca7 100644
--- a/crates/test-programs/tests/wasi-tokio.rs
+++ b/crates/test-programs/tests/wasi-tokio.rs
@@ -38,19 +38,19 @@ async fn run(name: &str, inherit_stdio: bool) -> Result<()> {
         let mut builder = WasiCtxBuilder::new();
 
         if inherit_stdio {
-            builder = builder.inherit_stdio();
+            builder.inherit_stdio();
         } else {
-            builder = builder
+            builder
                 .stdout(Box::new(stdout.clone()))
                 .stderr(Box::new(stderr.clone()));
         }
-        builder = builder.arg(name)?.arg(".")?;
+        builder.arg(name)?.arg(".")?;
         println!("preopen: {:?}", workspace);
         let preopen_dir =
             cap_std::fs::Dir::open_ambient_dir(workspace.path(), cap_std::ambient_authority())?;
-        builder = builder.preopened_dir(preopen_dir, ".")?;
+        builder.preopened_dir(preopen_dir, ".")?;
         for (var, val) in test_programs::wasi_tests_environment() {
-            builder = builder.env(var, val)?;
+            builder.env(var, val)?;
         }
 
         let mut store = Store::new(&ENGINE, builder.build());
diff --git a/crates/test-programs/wasi-http-tests/src/bin/outbound_request.rs b/crates/test-programs/wasi-http-tests/src/bin/outbound_request.rs
index 4062d370a122..7987c0dada23 100644
--- a/crates/test-programs/wasi-http-tests/src/bin/outbound_request.rs
+++ b/crates/test-programs/wasi-http-tests/src/bin/outbound_request.rs
@@ -37,8 +37,8 @@ fn request(
     body: &[u8],
 ) -> Result<Response> {
     let headers = wasi::http::types::new_fields(&[
-        ("User-agent", "WASI-HTTP/0.0.1"),
-        ("Content-type", "application/json"),
+        ("User-agent".to_string(), "WASI-HTTP/0.0.1".to_string()),
+        ("Content-type".to_string(), "application/json".to_string()),
     ]);
 
     let request = wasi::http::types::new_outgoing_request(
diff --git a/crates/test-programs/wasi-tests/src/bin/path_open_read_write.rs b/crates/test-programs/wasi-tests/src/bin/path_open_read_write.rs
index a432f50a92b2..0278fbf6d4f1 100644
--- a/crates/test-programs/wasi-tests/src/bin/path_open_read_write.rs
+++ b/crates/test-programs/wasi-tests/src/bin/path_open_read_write.rs
@@ -38,7 +38,6 @@ unsafe fn test_path_open_read_write(dir_fd: wasi::Fd) {
     );
 
     wasi::fd_close(f_readonly).expect("close readonly");
-    drop(f_readonly);
 
     // =============== WRITE ONLY ==================
     let f_writeonly = wasi::path_open(dir_fd, 0, "file", 0, wasi::RIGHTS_FD_WRITE, 0, 0)
@@ -64,7 +63,6 @@ unsafe fn test_path_open_read_write(dir_fd: wasi::Fd) {
     assert_eq!(bytes_written, write_buffer.len());
 
     wasi::fd_close(f_writeonly).expect("close writeonly");
-    drop(f_writeonly);
 
     // ============== READ WRITE =======================
 
@@ -111,7 +109,6 @@ unsafe fn test_path_open_read_write(dir_fd: wasi::Fd) {
     );
 
     wasi::fd_close(f_readwrite).expect("close readwrite");
-    drop(f_readwrite);
 
     wasi::path_unlink_file(dir_fd, "file").expect("removing a file");
 }
diff --git a/crates/wasi-common/cap-std-sync/src/lib.rs b/crates/wasi-common/cap-std-sync/src/lib.rs
index 15a5bec35aa7..832c77cfa496 100644
--- a/crates/wasi-common/cap-std-sync/src/lib.rs
+++ b/crates/wasi-common/cap-std-sync/src/lib.rs
@@ -48,90 +48,110 @@ pub use sched::sched_ctx;
 
 use crate::net::Socket;
 use cap_rand::{Rng, RngCore, SeedableRng};
+use std::mem;
 use std::path::Path;
 use wasi_common::{file::FileAccessMode, table::Table, Error, WasiCtx, WasiFile};
 
-pub struct WasiCtxBuilder(WasiCtx);
+pub struct WasiCtxBuilder {
+    ctx: WasiCtx,
+    built: bool,
+}
 
 impl WasiCtxBuilder {
     pub fn new() -> Self {
-        WasiCtxBuilder(WasiCtx::new(
-            random_ctx(),
-            clocks_ctx(),
-            sched_ctx(),
-            Table::new(),
-        ))
-    }
-    pub fn env(mut self, var: &str, value: &str) -> Result<Self, wasi_common::StringArrayError> {
-        self.0.push_env(var, value)?;
+        WasiCtxBuilder {
+            ctx: WasiCtx::new(random_ctx(), clocks_ctx(), sched_ctx(), Table::new()),
+            built: false,
+        }
+    }
+    pub fn env(
+        &mut self,
+        var: &str,
+        value: &str,
+    ) -> Result<&mut Self, wasi_common::StringArrayError> {
+        self.ctx.push_env(var, value)?;
         Ok(self)
     }
-    pub fn envs(mut self, env: &[(String, String)]) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn envs(
+        &mut self,
+        env: &[(String, String)],
+    ) -> Result<&mut Self, wasi_common::StringArrayError> {
         for (k, v) in env {
-            self.0.push_env(k, v)?;
+            self.ctx.push_env(k, v)?;
         }
         Ok(self)
     }
-    pub fn inherit_env(mut self) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn inherit_env(&mut self) -> Result<&mut Self, wasi_common::StringArrayError> {
         for (key, value) in std::env::vars() {
-            self.0.push_env(&key, &value)?;
+            self.ctx.push_env(&key, &value)?;
         }
         Ok(self)
     }
-    pub fn arg(mut self, arg: &str) -> Result<Self, wasi_common::StringArrayError> {
-        self.0.push_arg(arg)?;
+    pub fn arg(&mut self, arg: &str) -> Result<&mut Self, wasi_common::StringArrayError> {
+        self.ctx.push_arg(arg)?;
         Ok(self)
     }
-    pub fn args(mut self, arg: &[String]) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn args(&mut self, arg: &[String]) -> Result<&mut Self, wasi_common::StringArrayError> {
         for a in arg {
-            self.0.push_arg(&a)?;
+            self.ctx.push_arg(&a)?;
         }
         Ok(self)
     }
-    pub fn inherit_args(mut self) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn inherit_args(&mut self) -> Result<&mut Self, wasi_common::StringArrayError> {
         for arg in std::env::args() {
-            self.0.push_arg(&arg)?;
+            self.ctx.push_arg(&arg)?;
         }
         Ok(self)
     }
-    pub fn stdin(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stdin(f);
+    pub fn stdin(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stdin(f);
         self
     }
-    pub fn stdout(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stdout(f);
+    pub fn stdout(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stdout(f);
         self
     }
-    pub fn stderr(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stderr(f);
+    pub fn stderr(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stderr(f);
         self
     }
-    pub fn inherit_stdin(self) -> Self {
+    pub fn inherit_stdin(&mut self) -> &mut Self {
         self.stdin(Box::new(crate::stdio::stdin()))
     }
-    pub fn inherit_stdout(self) -> Self {
+    pub fn inherit_stdout(&mut self) -> &mut Self {
         self.stdout(Box::new(crate::stdio::stdout()))
     }
-    pub fn inherit_stderr(self) -> Self {
+    pub fn inherit_stderr(&mut self) -> &mut Self {
         self.stderr(Box::new(crate::stdio::stderr()))
     }
-    pub fn inherit_stdio(self) -> Self {
+    pub fn inherit_stdio(&mut self) -> &mut Self {
         self.inherit_stdin().inherit_stdout().inherit_stderr()
     }
-    pub fn preopened_dir(self, dir: Dir, guest_path: impl AsRef<Path>) -> Result<Self, Error> {
+    pub fn preopened_dir(
+        &mut self,
+        dir: Dir,
+        guest_path: impl AsRef<Path>,
+    ) -> Result<&mut Self, Error> {
         let dir = Box::new(crate::dir::Dir::from_cap_std(dir));
-        self.0.push_preopened_dir(dir, guest_path)?;
+        self.ctx.push_preopened_dir(dir, guest_path)?;
         Ok(self)
     }
-    pub fn preopened_socket(self, fd: u32, socket: impl Into<Socket>) -> Result<Self, Error> {
+    pub fn preopened_socket(
+        &mut self,
+        fd: u32,
+        socket: impl Into<Socket>,
+    ) -> Result<&mut Self, Error> {
         let socket: Socket = socket.into();
         let file: Box<dyn WasiFile> = socket.into();
-        self.0
+        self.ctx
             .insert_file(fd, file, FileAccessMode::READ | FileAccessMode::WRITE);
         Ok(self)
     }
-    pub fn build(self) -> WasiCtx {
-        self.0
+    pub fn build(&mut self) -> WasiCtx {
+        assert!(!self.built);
+        let WasiCtxBuilder { ctx, .. } = mem::replace(self, Self::new());
+        self.built = true;
+        ctx
     }
 }
 
diff --git a/crates/wasi-common/src/snapshots/preview_1/error.rs b/crates/wasi-common/src/snapshots/preview_1/error.rs
index 157cdcc83cb6..f0b7cdf4ad94 100644
--- a/crates/wasi-common/src/snapshots/preview_1/error.rs
+++ b/crates/wasi-common/src/snapshots/preview_1/error.rs
@@ -235,9 +235,19 @@ impl From<wiggle::GuestError> for Error {
         match err {
             InvalidFlagValue { .. } => Errno::Inval.into(),
             InvalidEnumValue { .. } => Errno::Inval.into(),
-            PtrOverflow { .. } => Errno::Fault.into(),
-            PtrOutOfBounds { .. } => Errno::Fault.into(),
-            PtrNotAligned { .. } => Errno::Inval.into(),
+            // As per
+            // https://github.com/WebAssembly/wasi/blob/main/legacy/tools/witx-docs.md#pointers
+            //
+            // > If a misaligned pointer is passed to a function, the function
+            // > shall trap.
+            // >
+            // > If an out-of-bounds pointer is passed to a function and the
+            // > function needs to dereference it, the function shall trap.
+            //
+            // so this turns OOB and misalignment errors into traps.
+            PtrOverflow { .. } | PtrOutOfBounds { .. } | PtrNotAligned { .. } => {
+                Error::trap(err.into())
+            }
             PtrBorrowed { .. } => Errno::Fault.into(),
             InvalidUtf8 { .. } => Errno::Ilseq.into(),
             TryFromIntError { .. } => Errno::Overflow.into(),
diff --git a/crates/wasi-common/tokio/src/lib.rs b/crates/wasi-common/tokio/src/lib.rs
index 250aaabb4f7f..a65021c19af5 100644
--- a/crates/wasi-common/tokio/src/lib.rs
+++ b/crates/wasi-common/tokio/src/lib.rs
@@ -6,103 +6,118 @@ pub mod net;
 pub mod sched;
 pub mod stdio;
 
-use std::future::Future;
-use std::path::Path;
-pub use wasi_cap_std_sync::{clocks_ctx, random_ctx};
-use wasi_common::{file::FileAccessMode, Error, Table, WasiCtx, WasiFile};
-
 use crate::sched::sched_ctx;
 pub use dir::Dir;
 pub use file::File;
 pub use net::*;
+use std::future::Future;
+use std::mem;
+use std::path::Path;
 use wasi_cap_std_sync::net::Socket;
+pub use wasi_cap_std_sync::{clocks_ctx, random_ctx};
+use wasi_common::{file::FileAccessMode, Error, Table, WasiCtx, WasiFile};
 
-pub struct WasiCtxBuilder(WasiCtx);
+pub struct WasiCtxBuilder {
+    ctx: WasiCtx,
+    built: bool,
+}
 
 impl WasiCtxBuilder {
     pub fn new() -> Self {
-        WasiCtxBuilder(WasiCtx::new(
-            random_ctx(),
-            clocks_ctx(),
-            sched_ctx(),
-            Table::new(),
-        ))
-    }
-    pub fn env(mut self, var: &str, value: &str) -> Result<Self, wasi_common::StringArrayError> {
-        self.0.push_env(var, value)?;
+        WasiCtxBuilder {
+            ctx: WasiCtx::new(random_ctx(), clocks_ctx(), sched_ctx(), Table::new()),
+            built: false,
+        }
+    }
+    pub fn env(
+        &mut self,
+        var: &str,
+        value: &str,
+    ) -> Result<&mut Self, wasi_common::StringArrayError> {
+        self.ctx.push_env(var, value)?;
         Ok(self)
     }
-    pub fn envs(mut self, env: &[(String, String)]) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn envs(
+        &mut self,
+        env: &[(String, String)],
+    ) -> Result<&mut Self, wasi_common::StringArrayError> {
         for (k, v) in env {
-            self.0.push_env(k, v)?;
+            self.ctx.push_env(k, v)?;
         }
         Ok(self)
     }
-    pub fn inherit_env(mut self) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn inherit_env(&mut self) -> Result<&mut Self, wasi_common::StringArrayError> {
         for (key, value) in std::env::vars() {
-            self.0.push_env(&key, &value)?;
+            self.ctx.push_env(&key, &value)?;
         }
         Ok(self)
     }
-    pub fn arg(mut self, arg: &str) -> Result<Self, wasi_common::StringArrayError> {
-        self.0.push_arg(arg)?;
+    pub fn arg(&mut self, arg: &str) -> Result<&mut Self, wasi_common::StringArrayError> {
+        self.ctx.push_arg(arg)?;
         Ok(self)
     }
-    pub fn args(mut self, arg: &[String]) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn args(&mut self, arg: &[String]) -> Result<&mut Self, wasi_common::StringArrayError> {
         for a in arg {
-            self.0.push_arg(&a)?;
+            self.ctx.push_arg(&a)?;
         }
         Ok(self)
     }
-    pub fn inherit_args(mut self) -> Result<Self, wasi_common::StringArrayError> {
+    pub fn inherit_args(&mut self) -> Result<&mut Self, wasi_common::StringArrayError> {
         for arg in std::env::args() {
-            self.0.push_arg(&arg)?;
+            self.ctx.push_arg(&arg)?;
         }
         Ok(self)
     }
-    pub fn stdin(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stdin(f);
+    pub fn stdin(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stdin(f);
         self
     }
-    pub fn stdout(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stdout(f);
+    pub fn stdout(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stdout(f);
         self
     }
-    pub fn stderr(self, f: Box<dyn WasiFile>) -> Self {
-        self.0.set_stderr(f);
+    pub fn stderr(&mut self, f: Box<dyn WasiFile>) -> &mut Self {
+        self.ctx.set_stderr(f);
         self
     }
-    pub fn inherit_stdin(self) -> Self {
+    pub fn inherit_stdin(&mut self) -> &mut Self {
         self.stdin(Box::new(crate::stdio::stdin()))
     }
-    pub fn inherit_stdout(self) -> Self {
+    pub fn inherit_stdout(&mut self) -> &mut Self {
         self.stdout(Box::new(crate::stdio::stdout()))
     }
-    pub fn inherit_stderr(self) -> Self {
+    pub fn inherit_stderr(&mut self) -> &mut Self {
         self.stderr(Box::new(crate::stdio::stderr()))
     }
-    pub fn inherit_stdio(self) -> Self {
+    pub fn inherit_stdio(&mut self) -> &mut Self {
         self.inherit_stdin().inherit_stdout().inherit_stderr()
     }
     pub fn preopened_dir(
-        self,
+        &mut self,
         dir: cap_std::fs::Dir,
         guest_path: impl AsRef<Path>,
-    ) -> Result<Self, Error> {
+    ) -> Result<&mut Self, Error> {
         let dir = Box::new(crate::dir::Dir::from_cap_std(dir));
-        self.0.push_preopened_dir(dir, guest_path)?;
+        self.ctx.push_preopened_dir(dir, guest_path)?;
         Ok(self)
     }
-    pub fn preopened_socket(self, fd: u32, socket: impl Into<Socket>) -> Result<Self, Error> {
+    pub fn preopened_socket(
+        &mut self,
+        fd: u32,
+        socket: impl Into<Socket>,
+    ) -> Result<&mut Self, Error> {
         let socket: Socket = socket.into();
         let file: Box<dyn WasiFile> = socket.into();
-        self.0
+        self.ctx
             .insert_file(fd, file, FileAccessMode::READ | FileAccessMode::WRITE);
         Ok(self)
     }
 
-    pub fn build(self) -> WasiCtx {
-        self.0
+    pub fn build(&mut self) -> WasiCtx {
+        assert!(!self.built);
+        let WasiCtxBuilder { ctx, .. } = mem::replace(self, Self::new());
+        self.built = true;
+        ctx
     }
 }
 
diff --git a/crates/wasi-crypto/Cargo.toml b/crates/wasi-crypto/Cargo.toml
deleted file mode 100644
index 85d1af69f428..000000000000
--- a/crates/wasi-crypto/Cargo.toml
+++ /dev/null
@@ -1,18 +0,0 @@
-[package]
-name = "wasmtime-wasi-crypto"
-version.workspace = true
-authors.workspace = true
-description = "Wasmtime implementation of the wasi-crypto API"
-documentation = "https://docs.rs/wasmtime-wasi-crypto"
-license = "Apache-2.0 WITH LLVM-exception"
-categories = ["wasm", "cryptography"]
-keywords = ["webassembly", "wasm", "crypto"]
-repository = "https://github.com/bytecodealliance/wasmtime"
-readme = "README.md"
-edition.workspace = true
-
-[dependencies]
-anyhow = { workspace = true }
-wasi-crypto = { path = "spec/implementations/hostcalls/rust", version = "0.1.5" }
-wasmtime = { workspace = true }
-wiggle = { workspace = true }
diff --git a/crates/wasi-crypto/LICENSE b/crates/wasi-crypto/LICENSE
deleted file mode 100644
index f9d81955f4bc..000000000000
--- a/crates/wasi-crypto/LICENSE
+++ /dev/null
@@ -1,220 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-
---- LLVM Exceptions to the Apache 2.0 License ----
-
-As an exception, if, as a result of your compiling your source code, portions
-of this Software are embedded into an Object form of such source code, you
-may redistribute such embedded portions in such Object form without complying
-with the conditions of Sections 4(a), 4(b) and 4(d) of the License.
-
-In addition, if you combine or link compiled forms of this Software with
-software that is licensed under the GPLv2 ("Combined Software") and if a
-court of competent jurisdiction determines that the patent provision (Section
-3), the indemnity provision (Section 9) or other Section of the License
-conflicts with the conditions of the GPLv2, you may retroactively and
-prospectively choose to deem waived or otherwise exclude such Section(s) of
-the License, but only in their entirety and only with respect to the Combined
-Software.
-
diff --git a/crates/wasi-crypto/README.md b/crates/wasi-crypto/README.md
deleted file mode 100644
index 8536437db3cb..000000000000
--- a/crates/wasi-crypto/README.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# wasmtime-wasi-crypto
-
-This crate enables support for the [wasi-crypto] APIs in Wasmtime.
-
-The sole purpose of the implementation is to allow bindings and
-application developers to test the proposed APIs. This implementation
-is not meant to be used in production. Like the specification, it is
-currently experimental and its functionality can quickly change.
-
-Since the [wasi-crypto] API is expected to be an optional feature of
-WASI, this crate is currently separate from the [wasi-common] crate.
-
-* [documentation]
-* [interfaces reference]
-* [interfaces reference (compact)]
-
-[wasi-crypto]: https://github.com/WebAssembly/wasi-crypto
-[wasi-common]: ../../wasi-common
-[documentation]: ../spec/docs/wasi-crypto.md
-[interfaces reference]: ../spec/witx/codegen/wasi_ephemeral_crypto.md
-[interfaces reference (compact)]: ../spec/witx/codegen/wasi_ephemeral_crypto.txt
-
-## Wasmtime integration
-
-Use the Wasmtime APIs to instantiate a Wasm module and link the
-`wasi-crypto` modules as follows:
-
-```rust
-use wasmtime_wasi_crypto::{
-    WasiCryptoAsymmetricCommon, WasiCryptoCommon, WasiCryptoCtx, WasiCryptoSignatures,
-    WasiCryptoSymmetric,
-};
-
-let cx_crypto = WasiCryptoCtx::new();
-WasiCryptoCommon::new(linker.store(), cx_crypto.clone()).add_to_linker(linker)?;
-WasiCryptoAsymmetricCommon::new(linker.store(), cx_crypto.clone()).add_to_linker(linker)?;
-WasiCryptoSignatures::new(linker.store(), cx_crypto.clone()).add_to_linker(linker)?;
-WasiCryptoSymmetric::new(linker.store(), cx_crypto.clone()).add_to_linker(linker)?;
-
-let wasi = wasmtime_wasi::old::snapshot_0::Wasi::new(linker.store(), mk_cx()?);
-wasi.add_to_linker(linker)?;
-```
-
-## Building Wasmtime
-
-Wasmtime must be compiled with the `wasi-crypto` feature flag
-(disabled by default) in order to include the crypto APIs.
-
-## Examples
-
-Example [rust bindings] and [assemblyscript bindings] are provided to
-demonstrate how these APIs can be used and exposed to applications in
-an idiomatic way.
-
-[rust bindings]: ../spec/implementations/bindings/rust
-[assemblyscript bindings]: ../spec/implementations/bindings/assemblyscript
diff --git a/crates/wasi-crypto/spec b/crates/wasi-crypto/spec
deleted file mode 160000
index 67d9821f2763..000000000000
--- a/crates/wasi-crypto/spec
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 67d9821f2763f4626a97c70c411ccb92a2047712
diff --git a/crates/wasi-crypto/src/lib.rs b/crates/wasi-crypto/src/lib.rs
deleted file mode 100644
index 9cd4b716bac0..000000000000
--- a/crates/wasi-crypto/src/lib.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-mod wiggle_interfaces;
-
-pub use wiggle_interfaces::WasiCryptoCtx;
-
-pub fn add_to_linker<T>(
-    linker: &mut wasmtime::Linker<T>,
-    get_cx: impl Fn(&mut T) -> &mut WasiCryptoCtx + Send + Sync + Copy + 'static,
-) -> anyhow::Result<()> {
-    use wiggle_interfaces::wasi_modules as w;
-    w::wasi_ephemeral_crypto_common::add_to_linker(linker, get_cx)?;
-    w::wasi_ephemeral_crypto_asymmetric_common::add_to_linker(linker, get_cx)?;
-    w::wasi_ephemeral_crypto_signatures::add_to_linker(linker, get_cx)?;
-    w::wasi_ephemeral_crypto_symmetric::add_to_linker(linker, get_cx)?;
-    Ok(())
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/asymmetric_common.rs b/crates/wasi-crypto/src/wiggle_interfaces/asymmetric_common.rs
deleted file mode 100644
index 00e7955ceab2..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/asymmetric_common.rs
+++ /dev/null
@@ -1,301 +0,0 @@
-use super::{guest_types, WasiCryptoCtx};
-
-use std::convert::TryInto;
-use wasi_crypto::{
-    ensure, CryptoError, KeyPairEncoding, PublicKeyEncoding, SecretKeyEncoding, Version,
-};
-
-impl super::wasi_ephemeral_crypto_asymmetric_common::WasiEphemeralCryptoAsymmetricCommon
-    for WasiCryptoCtx
-{
-    // --- keypair_manager
-
-    fn keypair_generate_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        alg_type: guest_types::AlgorithmType,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::Keypair, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .keypair_generate_managed(
-                secrets_manager_handle.into(),
-                alg_type.into(),
-                alg_str,
-                options_handle.map(Into::into),
-            )?
-            .into())
-    }
-
-    fn keypair_store_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        kp_handle: guest_types::Keypair,
-        kp_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        kp_id_max_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let key_id_buf = &mut *kp_id_ptr
-            .as_array(kp_id_max_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).keypair_store_managed(
-            secrets_manager_handle.into(),
-            kp_handle.into(),
-            key_id_buf,
-        )?)
-    }
-
-    fn keypair_replace_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        kp_old_handle: guest_types::Keypair,
-        kp_new_handle: guest_types::Keypair,
-    ) -> Result<guest_types::Version, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .keypair_replace_managed(
-                secrets_manager_handle.into(),
-                kp_old_handle.into(),
-                kp_new_handle.into(),
-            )?
-            .0)
-    }
-
-    fn keypair_from_id(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        kp_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        kp_id_len: guest_types::Size,
-        kp_version: guest_types::Version,
-    ) -> Result<guest_types::Keypair, guest_types::CryptoErrno> {
-        let kp_id = &*kp_id_ptr
-            .as_array(kp_id_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .keypair_from_id(secrets_manager_handle.into(), kp_id, Version(kp_version))?
-            .into())
-    }
-
-    // --- keypair
-
-    fn keypair_generate(
-        &mut self,
-        alg_type: guest_types::AlgorithmType,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::Keypair, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .keypair_generate(alg_type.into(), alg_str, options_handle.map(Into::into))?
-            .into())
-    }
-
-    fn keypair_import(
-        &mut self,
-        alg_type: guest_types::AlgorithmType,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        encoded_ptr: &wiggle::GuestPtr<'_, u8>,
-        encoded_len: guest_types::Size,
-        encoding: guest_types::KeypairEncoding,
-    ) -> Result<guest_types::Keypair, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let encoded = &*encoded_ptr
-            .as_array(encoded_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .keypair_import(alg_type.into(), alg_str, encoded, encoding.into())?
-            .into())
-    }
-
-    fn keypair_id(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-        kp_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        kp_id_max_len: guest_types::Size,
-    ) -> Result<(guest_types::Size, guest_types::Version), guest_types::CryptoErrno> {
-        let kp_id_buf = &mut *kp_id_ptr
-            .as_array(kp_id_max_len as _)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let (kp_id, version) = (&*self).keypair_id(kp_handle.into())?;
-        ensure!(kp_id.len() <= kp_id_buf.len(), CryptoError::Overflow.into());
-        kp_id_buf.copy_from_slice(&kp_id);
-        Ok((kp_id.len().try_into()?, version.0))
-    }
-
-    fn keypair_export(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-        encoding: guest_types::KeypairEncoding,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .keypair_export(kp_handle.into(), encoding.into())?
-            .into())
-    }
-
-    fn keypair_publickey(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-    ) -> Result<guest_types::Publickey, guest_types::CryptoErrno> {
-        Ok((&*self).keypair_publickey(kp_handle.into())?.into())
-    }
-
-    fn keypair_close(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).keypair_close(kp_handle.into())?)
-    }
-
-    // --- publickey
-
-    fn publickey_import(
-        &mut self,
-        alg_type: guest_types::AlgorithmType,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        encoded_ptr: &wiggle::GuestPtr<'_, u8>,
-        encoded_len: guest_types::Size,
-        encoding: guest_types::PublickeyEncoding,
-    ) -> Result<guest_types::Publickey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let encoded = &*encoded_ptr
-            .as_array(encoded_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .publickey_import(alg_type.into(), alg_str, encoded, encoding.into())?
-            .into())
-    }
-
-    fn publickey_export(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-        encoding: guest_types::PublickeyEncoding,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .publickey_export(pk_handle.into(), encoding.into())?
-            .into())
-    }
-
-    fn publickey_from_secretkey(
-        &mut self,
-        sk_handle: guest_types::Secretkey,
-    ) -> Result<guest_types::Publickey, guest_types::CryptoErrno> {
-        Ok((&*self).keypair_publickey(sk_handle.into())?.into())
-    }
-
-    fn publickey_verify(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).publickey_verify(pk_handle.into())?)
-    }
-
-    fn publickey_close(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).publickey_close(pk_handle.into())?)
-    }
-
-    // --- secretkey
-
-    fn secretkey_import(
-        &mut self,
-        alg_type: guest_types::AlgorithmType,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        encoded_ptr: &wiggle::GuestPtr<'_, u8>,
-        encoded_len: guest_types::Size,
-        encoding: guest_types::SecretkeyEncoding,
-    ) -> Result<guest_types::Secretkey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let encoded = &*encoded_ptr
-            .as_array(encoded_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .secretkey_import(alg_type.into(), alg_str, encoded, encoding.into())?
-            .into())
-    }
-
-    fn secretkey_export(
-        &mut self,
-        sk_handle: guest_types::Secretkey,
-        encoding: guest_types::SecretkeyEncoding,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .secretkey_export(sk_handle.into(), encoding.into())?
-            .into())
-    }
-
-    fn secretkey_close(
-        &mut self,
-        sk_handle: guest_types::Secretkey,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).secretkey_close(sk_handle.into())?)
-    }
-
-    fn keypair_from_pk_and_sk(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-        sk_handle: guest_types::Secretkey,
-    ) -> Result<guest_types::Keypair, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .keypair_from_pk_and_sk(pk_handle.into(), sk_handle.into())?
-            .into())
-    }
-
-    fn keypair_secretkey(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-    ) -> Result<guest_types::Secretkey, guest_types::CryptoErrno> {
-        Ok((&*self).keypair_secretkey(kp_handle.into())?.into())
-    }
-}
-
-impl From<guest_types::KeypairEncoding> for KeyPairEncoding {
-    fn from(encoding: guest_types::KeypairEncoding) -> Self {
-        match encoding {
-            guest_types::KeypairEncoding::Raw => KeyPairEncoding::Raw,
-            guest_types::KeypairEncoding::Pkcs8 => KeyPairEncoding::Pkcs8,
-            guest_types::KeypairEncoding::Pem => KeyPairEncoding::Pem,
-            guest_types::KeypairEncoding::Local => KeyPairEncoding::Local,
-        }
-    }
-}
-
-impl From<guest_types::PublickeyEncoding> for PublicKeyEncoding {
-    fn from(encoding: guest_types::PublickeyEncoding) -> Self {
-        match encoding {
-            guest_types::PublickeyEncoding::Raw => PublicKeyEncoding::Raw,
-            guest_types::PublickeyEncoding::Pkcs8 => PublicKeyEncoding::Pkcs8,
-            guest_types::PublickeyEncoding::Pem => PublicKeyEncoding::Pem,
-            guest_types::PublickeyEncoding::Sec => PublicKeyEncoding::Sec,
-            guest_types::PublickeyEncoding::CompressedSec => PublicKeyEncoding::CompressedSec,
-            guest_types::PublickeyEncoding::Local => PublicKeyEncoding::Local,
-        }
-    }
-}
-
-impl From<guest_types::SecretkeyEncoding> for SecretKeyEncoding {
-    fn from(encoding: guest_types::SecretkeyEncoding) -> Self {
-        match encoding {
-            guest_types::SecretkeyEncoding::Raw => SecretKeyEncoding::Raw,
-            guest_types::SecretkeyEncoding::Pkcs8 => SecretKeyEncoding::Pkcs8,
-            guest_types::SecretkeyEncoding::Pem => SecretKeyEncoding::Pem,
-            guest_types::SecretkeyEncoding::Sec => SecretKeyEncoding::Sec,
-            guest_types::SecretkeyEncoding::CompressedSec => SecretKeyEncoding::CompressedSec,
-            guest_types::SecretkeyEncoding::Local => SecretKeyEncoding::Local,
-        }
-    }
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/common.rs b/crates/wasi-crypto/src/wiggle_interfaces/common.rs
deleted file mode 100644
index 15d1754a1c05..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/common.rs
+++ /dev/null
@@ -1,148 +0,0 @@
-use super::{guest_types, WasiCryptoCtx};
-
-use std::convert::TryInto;
-use wasi_crypto::{AlgorithmType, Version};
-
-impl super::wasi_ephemeral_crypto_common::WasiEphemeralCryptoCommon for WasiCryptoCtx {
-    // --- options
-
-    fn options_open(
-        &mut self,
-        options_type: guest_types::AlgorithmType,
-    ) -> Result<guest_types::Options, guest_types::CryptoErrno> {
-        Ok((&*self).options_open(options_type.into())?.into())
-    }
-
-    fn options_close(
-        &mut self,
-        options_handle: guest_types::Options,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).options_close(options_handle.into())?)
-    }
-
-    fn options_set(
-        &mut self,
-        options_handle: guest_types::Options,
-        name_str: &wiggle::GuestPtr<'_, str>,
-        value_ptr: &wiggle::GuestPtr<'_, u8>,
-        value_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let name_str: &str = &*name_str.as_cow()?;
-        let value: &[u8] = {
-            &*value_ptr
-                .as_array(value_len)
-                .as_slice()?
-                .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)")
-        };
-        Ok((&*self).options_set(options_handle.into(), name_str, value)?)
-    }
-
-    fn options_set_guest_buffer(
-        &mut self,
-        options_handle: guest_types::Options,
-        name_str: &wiggle::GuestPtr<'_, str>,
-        buffer_ptr: &wiggle::GuestPtr<'_, u8>,
-        buffer_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let name_str: &str = &*name_str.as_cow()?;
-        let buffer: &'static mut [u8] = unsafe {
-            std::mem::transmute(
-                &mut *buffer_ptr
-                    .as_array(buffer_len)
-                    .as_slice_mut()?
-                    .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)"),
-            )
-        };
-        Ok((&*self).options_set_guest_buffer(options_handle.into(), name_str, buffer)?)
-    }
-
-    fn options_set_u64(
-        &mut self,
-        options_handle: guest_types::Options,
-        name_str: &wiggle::GuestPtr<'_, str>,
-        value: u64,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let name_str: &str = &*name_str.as_cow()?;
-        Ok((&*self).options_set_u64(options_handle.into(), name_str, value)?)
-    }
-
-    // --- array
-
-    fn array_output_len(
-        &mut self,
-        array_output_handle: guest_types::ArrayOutput,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .array_output_len(array_output_handle.into())?
-            .try_into()?)
-    }
-
-    fn array_output_pull(
-        &mut self,
-        array_output_handle: guest_types::ArrayOutput,
-        buf_ptr: &wiggle::GuestPtr<'_, u8>,
-        buf_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let buf: &mut [u8] = {
-            &mut *buf_ptr
-                .as_array(buf_len)
-                .as_slice_mut()?
-                .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)")
-        };
-        Ok((&*self)
-            .array_output_pull(array_output_handle.into(), buf)?
-            .try_into()?)
-    }
-
-    // --- secrets_manager
-
-    fn secrets_manager_open(
-        &mut self,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::SecretsManager, guest_types::CryptoErrno> {
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .secrets_manager_open(options_handle.map(Into::into))?
-            .into())
-    }
-
-    fn secrets_manager_close(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).secrets_manager_close(secrets_manager_handle.into())?)
-    }
-
-    fn secrets_manager_invalidate(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        key_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        key_id_len: guest_types::Size,
-        key_version: guest_types::Version,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let key_id: &[u8] = {
-            &*key_id_ptr
-                .as_array(key_id_len)
-                .as_slice()?
-                .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)")
-        };
-        Ok((&*self).secrets_manager_invalidate(
-            secrets_manager_handle.into(),
-            key_id,
-            Version(key_version),
-        )?)
-    }
-}
-
-impl From<guest_types::AlgorithmType> for AlgorithmType {
-    fn from(options_type: guest_types::AlgorithmType) -> Self {
-        match options_type {
-            guest_types::AlgorithmType::Signatures => AlgorithmType::Signatures,
-            guest_types::AlgorithmType::Symmetric => AlgorithmType::Symmetric,
-            guest_types::AlgorithmType::KeyExchange => AlgorithmType::KeyExchange,
-        }
-    }
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/error.rs b/crates/wasi-crypto/src/wiggle_interfaces/error.rs
deleted file mode 100644
index e54a104b030b..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/error.rs
+++ /dev/null
@@ -1,60 +0,0 @@
-use super::guest_types;
-
-use std::num::TryFromIntError;
-use wasi_crypto::CryptoError;
-
-impl From<CryptoError> for guest_types::CryptoErrno {
-    fn from(e: CryptoError) -> Self {
-        match e {
-            CryptoError::Success => guest_types::CryptoErrno::Success,
-            CryptoError::GuestError(_wiggle_error) => guest_types::CryptoErrno::GuestError,
-            CryptoError::NotImplemented => guest_types::CryptoErrno::NotImplemented,
-            CryptoError::UnsupportedFeature => guest_types::CryptoErrno::UnsupportedFeature,
-            CryptoError::ProhibitedOperation => guest_types::CryptoErrno::ProhibitedOperation,
-            CryptoError::UnsupportedEncoding => guest_types::CryptoErrno::UnsupportedEncoding,
-            CryptoError::UnsupportedAlgorithm => guest_types::CryptoErrno::UnsupportedAlgorithm,
-            CryptoError::UnsupportedOption => guest_types::CryptoErrno::UnsupportedOption,
-            CryptoError::InvalidKey => guest_types::CryptoErrno::InvalidKey,
-            CryptoError::InvalidLength => guest_types::CryptoErrno::InvalidLength,
-            CryptoError::VerificationFailed => guest_types::CryptoErrno::VerificationFailed,
-            CryptoError::RNGError => guest_types::CryptoErrno::RngError,
-            CryptoError::AlgorithmFailure => guest_types::CryptoErrno::AlgorithmFailure,
-            CryptoError::InvalidSignature => guest_types::CryptoErrno::InvalidSignature,
-            CryptoError::Closed => guest_types::CryptoErrno::Closed,
-            CryptoError::InvalidHandle => guest_types::CryptoErrno::InvalidHandle,
-            CryptoError::Overflow => guest_types::CryptoErrno::Overflow,
-            CryptoError::InternalError => guest_types::CryptoErrno::InternalError,
-            CryptoError::TooManyHandles => guest_types::CryptoErrno::TooManyHandles,
-            CryptoError::KeyNotSupported => guest_types::CryptoErrno::KeyNotSupported,
-            CryptoError::KeyRequired => guest_types::CryptoErrno::KeyRequired,
-            CryptoError::InvalidTag => guest_types::CryptoErrno::InvalidTag,
-            CryptoError::InvalidOperation => guest_types::CryptoErrno::InvalidOperation,
-            CryptoError::NonceRequired => guest_types::CryptoErrno::NonceRequired,
-            CryptoError::InvalidNonce => guest_types::CryptoErrno::InvalidNonce,
-            CryptoError::OptionNotSet => guest_types::CryptoErrno::OptionNotSet,
-            CryptoError::NotFound => guest_types::CryptoErrno::NotFound,
-            CryptoError::ParametersMissing => guest_types::CryptoErrno::ParametersMissing,
-            CryptoError::IncompatibleKeys => guest_types::CryptoErrno::IncompatibleKeys,
-            CryptoError::Expired => guest_types::CryptoErrno::Expired,
-        }
-    }
-}
-
-impl From<TryFromIntError> for guest_types::CryptoErrno {
-    fn from(_: TryFromIntError) -> Self {
-        CryptoError::Overflow.into()
-    }
-}
-
-impl<'a> wiggle::GuestErrorType for guest_types::CryptoErrno {
-    fn success() -> Self {
-        guest_types::CryptoErrno::Success
-    }
-}
-
-impl From<wiggle::GuestError> for guest_types::CryptoErrno {
-    fn from(e: wiggle::GuestError) -> Self {
-        eprintln!("GuestError (impl) {:?}", e);
-        guest_types::CryptoErrno::GuestError
-    }
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/key_exchange.rs b/crates/wasi-crypto/src/wiggle_interfaces/key_exchange.rs
deleted file mode 100644
index e7fb1a927ce1..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/key_exchange.rs
+++ /dev/null
@@ -1,40 +0,0 @@
-use super::{guest_types, WasiCryptoCtx};
-
-impl super::wasi_ephemeral_crypto_kx::WasiEphemeralCryptoKx for WasiCryptoCtx {
-    // --- key exchange
-
-    fn kx_dh(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-        sk_handle: guest_types::Secretkey,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self).kx_dh(pk_handle.into(), sk_handle.into())?.into())
-    }
-
-    // --- Key encapsulation
-
-    fn kx_encapsulate(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-    ) -> Result<(guest_types::ArrayOutput, guest_types::ArrayOutput), guest_types::CryptoErrno>
-    {
-        let (secret_handle, encapsulated_secret_handle) =
-            (&*self).kx_encapsulate(pk_handle.into())?;
-        Ok((secret_handle.into(), encapsulated_secret_handle.into()))
-    }
-
-    fn kx_decapsulate(
-        &mut self,
-        sk_handle: guest_types::Secretkey,
-        encapsulated_secret_ptr: &wiggle::GuestPtr<'_, u8>,
-        encapsulated_secret_len: guest_types::Size,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        let encapsulated_secret = &*encapsulated_secret_ptr
-            .as_array(encapsulated_secret_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .kx_decapsulate(sk_handle.into(), encapsulated_secret)?
-            .into())
-    }
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/mod.rs b/crates/wasi-crypto/src/wiggle_interfaces/mod.rs
deleted file mode 100644
index 41119300c0dc..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/mod.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-pub use wasi_crypto::CryptoCtx as WasiCryptoCtx;
-
-wiggle::from_witx!({
-    witx: ["$CARGO_MANIFEST_DIR/spec/witx/wasi_ephemeral_crypto.witx"],
-});
-
-pub mod wasi_modules {
-    pub use super::{
-        wasi_ephemeral_crypto_asymmetric_common, wasi_ephemeral_crypto_common,
-        wasi_ephemeral_crypto_kx, wasi_ephemeral_crypto_signatures,
-        wasi_ephemeral_crypto_symmetric,
-    };
-}
-
-pub use types as guest_types;
-
-mod asymmetric_common;
-mod common;
-mod error;
-mod key_exchange;
-mod signatures;
-mod symmetric;
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/signatures.rs b/crates/wasi-crypto/src/wiggle_interfaces/signatures.rs
deleted file mode 100644
index 3cbe649d6b43..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/signatures.rs
+++ /dev/null
@@ -1,129 +0,0 @@
-use super::{guest_types, WasiCryptoCtx};
-
-use wasi_crypto::SignatureEncoding;
-
-impl super::wasi_ephemeral_crypto_signatures::WasiEphemeralCryptoSignatures for WasiCryptoCtx {
-    // --- signature
-
-    fn signature_export(
-        &mut self,
-        signature_handle: guest_types::Signature,
-        encoding: guest_types::SignatureEncoding,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .signature_export(signature_handle.into(), encoding.into())?
-            .into())
-    }
-
-    fn signature_import(
-        &mut self,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        encoded_ptr: &wiggle::GuestPtr<'_, u8>,
-        encoded_len: guest_types::Size,
-        encoding: guest_types::SignatureEncoding,
-    ) -> Result<guest_types::Signature, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let encoded = &*encoded_ptr
-            .as_array(encoded_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .signature_import(alg_str, encoded, encoding.into())?
-            .into())
-    }
-
-    fn signature_state_open(
-        &mut self,
-        kp_handle: guest_types::Keypair,
-    ) -> Result<guest_types::SignatureState, guest_types::CryptoErrno> {
-        Ok((&*self).signature_state_open(kp_handle.into())?.into())
-    }
-
-    fn signature_state_update(
-        &mut self,
-        state_handle: guest_types::SignatureState,
-        input_ptr: &wiggle::GuestPtr<'_, u8>,
-        input_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let input = &*input_ptr
-            .as_array(input_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).signature_state_update(state_handle.into(), input)?)
-    }
-
-    fn signature_state_sign(
-        &mut self,
-        signature_state_handle: guest_types::SignatureState,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .signature_state_sign(signature_state_handle.into())?
-            .into())
-    }
-
-    fn signature_state_close(
-        &mut self,
-        signature_state_handle: guest_types::SignatureState,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).signature_state_close(signature_state_handle.into())?)
-    }
-
-    fn signature_verification_state_open(
-        &mut self,
-        pk_handle: guest_types::Publickey,
-    ) -> Result<guest_types::SignatureVerificationState, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .signature_verification_state_open(pk_handle.into())?
-            .into())
-    }
-
-    fn signature_verification_state_update(
-        &mut self,
-        verification_state_handle: guest_types::SignatureVerificationState,
-        input_ptr: &wiggle::GuestPtr<'_, u8>,
-        input_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let input: &[u8] = &*input_ptr
-            .as_array(input_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok(
-            (&*self)
-                .signature_verification_state_update(verification_state_handle.into(), input)?,
-        )
-    }
-
-    fn signature_verification_state_verify(
-        &mut self,
-        verification_state_handle: guest_types::SignatureVerificationState,
-        signature_handle: guest_types::Signature,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).signature_verification_state_verify(
-            verification_state_handle.into(),
-            signature_handle.into(),
-        )?)
-    }
-
-    fn signature_verification_state_close(
-        &mut self,
-        verification_state_handle: guest_types::SignatureVerificationState,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).signature_verification_state_close(verification_state_handle.into())?)
-    }
-
-    fn signature_close(
-        &mut self,
-        signature_handle: guest_types::Signature,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).signature_close(signature_handle.into())?)
-    }
-}
-
-impl From<guest_types::SignatureEncoding> for SignatureEncoding {
-    fn from(encoding: guest_types::SignatureEncoding) -> Self {
-        match encoding {
-            guest_types::SignatureEncoding::Raw => SignatureEncoding::Raw,
-            guest_types::SignatureEncoding::Der => SignatureEncoding::Der,
-        }
-    }
-}
diff --git a/crates/wasi-crypto/src/wiggle_interfaces/symmetric.rs b/crates/wasi-crypto/src/wiggle_interfaces/symmetric.rs
deleted file mode 100644
index be9258c98b42..000000000000
--- a/crates/wasi-crypto/src/wiggle_interfaces/symmetric.rs
+++ /dev/null
@@ -1,404 +0,0 @@
-use super::{guest_types, WasiCryptoCtx};
-
-use std::convert::TryInto;
-use wasi_crypto::{ensure, CryptoError, Version};
-
-impl super::wasi_ephemeral_crypto_symmetric::WasiEphemeralCryptoSymmetric for WasiCryptoCtx {
-    // --- secrets_manager
-
-    fn symmetric_key_generate_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::SymmetricKey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .symmetric_key_generate_managed(
-                secrets_manager_handle.into(),
-                alg_str,
-                options_handle.map(Into::into),
-            )?
-            .into())
-    }
-
-    fn symmetric_key_store_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        symmetric_key_handle: guest_types::SymmetricKey,
-        symmetric_key_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        symmetric_key_id_max_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let key_id_buf = &mut *symmetric_key_id_ptr
-            .as_array(symmetric_key_id_max_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).symmetric_key_store_managed(
-            secrets_manager_handle.into(),
-            symmetric_key_handle.into(),
-            key_id_buf,
-        )?)
-    }
-
-    fn symmetric_key_replace_managed(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        symmetric_key_old_handle: guest_types::SymmetricKey,
-        symmetric_key_new_handle: guest_types::SymmetricKey,
-    ) -> Result<guest_types::Version, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .symmetric_key_replace_managed(
-                secrets_manager_handle.into(),
-                symmetric_key_old_handle.into(),
-                symmetric_key_new_handle.into(),
-            )?
-            .0)
-    }
-
-    fn symmetric_key_from_id(
-        &mut self,
-        secrets_manager_handle: guest_types::SecretsManager,
-        symmetric_key_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        symmetric_key_id_len: guest_types::Size,
-        symmetric_key_version: guest_types::Version,
-    ) -> Result<guest_types::SymmetricKey, guest_types::CryptoErrno> {
-        let symmetric_key_id = &*symmetric_key_id_ptr
-            .as_array(symmetric_key_id_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_key_from_id(
-                secrets_manager_handle.into(),
-                symmetric_key_id,
-                Version(symmetric_key_version),
-            )?
-            .into())
-    }
-
-    // --- key
-
-    fn symmetric_key_generate(
-        &mut self,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::SymmetricKey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .symmetric_key_generate(alg_str, options_handle.map(Into::into))?
-            .into())
-    }
-
-    fn symmetric_key_import(
-        &mut self,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        raw_ptr: &wiggle::GuestPtr<'_, u8>,
-        raw_len: guest_types::Size,
-    ) -> Result<guest_types::SymmetricKey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let raw = &*raw_ptr
-            .as_array(raw_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).symmetric_key_import(alg_str, raw)?.into())
-    }
-
-    fn symmetric_key_export(
-        &mut self,
-        symmetric_key_handle: guest_types::SymmetricKey,
-    ) -> Result<guest_types::ArrayOutput, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .symmetric_key_export(symmetric_key_handle.into())?
-            .into())
-    }
-
-    fn symmetric_key_id(
-        &mut self,
-        symmetric_key_handle: guest_types::SymmetricKey,
-        symmetric_key_id_ptr: &wiggle::GuestPtr<'_, u8>,
-        symmetric_key_id_max_len: guest_types::Size,
-    ) -> Result<(guest_types::Size, guest_types::Version), guest_types::CryptoErrno> {
-        let key_id_buf = &mut *symmetric_key_id_ptr
-            .as_array(symmetric_key_id_max_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let (key_id, version) = (&*self).symmetric_key_id(symmetric_key_handle.into())?;
-        ensure!(
-            key_id.len() <= key_id_buf.len(),
-            CryptoError::Overflow.into()
-        );
-        key_id_buf.copy_from_slice(&key_id);
-        Ok((key_id.len().try_into()?, version.0))
-    }
-
-    fn symmetric_key_close(
-        &mut self,
-        key_handle: guest_types::SymmetricKey,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).symmetric_key_close(key_handle.into())?)
-    }
-
-    // --- state
-
-    fn symmetric_state_open(
-        &mut self,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-        key_handle: &guest_types::OptSymmetricKey,
-        options_handle: &guest_types::OptOptions,
-    ) -> Result<guest_types::SymmetricState, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        let key_handle = match *key_handle {
-            guest_types::OptSymmetricKey::Some(key_handle) => Some(key_handle),
-            guest_types::OptSymmetricKey::None => None,
-        };
-        let options_handle = match *options_handle {
-            guest_types::OptOptions::Some(options_handle) => Some(options_handle),
-            guest_types::OptOptions::None => None,
-        };
-        Ok((&*self)
-            .symmetric_state_open(
-                alg_str,
-                key_handle.map(Into::into),
-                options_handle.map(Into::into),
-            )?
-            .into())
-    }
-
-    fn symmetric_state_options_get(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        name_str: &wiggle::GuestPtr<'_, str>,
-        value_ptr: &wiggle::GuestPtr<'_, u8>,
-        value_max_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let name_str: &str = &*name_str.as_cow()?;
-        let value = &mut *value_ptr
-            .as_array(value_max_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .options_get(symmetric_state_handle.into(), name_str, value)?
-            .try_into()?)
-    }
-
-    fn symmetric_state_options_get_u64(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        name_str: &wiggle::GuestPtr<'_, str>,
-    ) -> Result<u64, guest_types::CryptoErrno> {
-        let name_str: &str = &*name_str.as_cow()?;
-        Ok((&*self).options_get_u64(symmetric_state_handle.into(), name_str)?)
-    }
-
-    fn symmetric_state_close(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).symmetric_state_close(symmetric_state_handle.into())?)
-    }
-
-    fn symmetric_state_absorb(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        data_ptr: &wiggle::GuestPtr<'_, u8>,
-        data_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let data = &*data_ptr
-            .as_array(data_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).symmetric_state_absorb(symmetric_state_handle.into(), data)?)
-    }
-
-    fn symmetric_state_squeeze(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        out_ptr: &wiggle::GuestPtr<'_, u8>,
-        out_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let out = &mut *out_ptr
-            .as_array(out_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).symmetric_state_squeeze(symmetric_state_handle.into(), out)?)
-    }
-
-    fn symmetric_state_squeeze_tag(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-    ) -> Result<guest_types::SymmetricTag, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .symmetric_state_squeeze_tag(symmetric_state_handle.into())?
-            .into())
-    }
-
-    fn symmetric_state_squeeze_key(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        alg_str: &wiggle::GuestPtr<'_, str>,
-    ) -> Result<guest_types::SymmetricKey, guest_types::CryptoErrno> {
-        let alg_str = &*alg_str.as_cow()?;
-        Ok((&*self)
-            .symmetric_state_squeeze_key(symmetric_state_handle.into(), alg_str)?
-            .into())
-    }
-
-    fn symmetric_state_max_tag_len(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .symmetric_state_max_tag_len(symmetric_state_handle.into())?
-            .try_into()?)
-    }
-
-    fn symmetric_state_encrypt(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        out_ptr: &wiggle::GuestPtr<'_, u8>,
-        out_len: guest_types::Size,
-        data_ptr: &wiggle::GuestPtr<'_, u8>,
-        data_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let out = &mut *out_ptr
-            .as_array(out_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let data = &*data_ptr
-            .as_array(data_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_state_encrypt(symmetric_state_handle.into(), out, data)?
-            .try_into()?)
-    }
-
-    fn symmetric_state_encrypt_detached(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        out_ptr: &wiggle::GuestPtr<'_, u8>,
-        out_len: guest_types::Size,
-        data_ptr: &wiggle::GuestPtr<'_, u8>,
-        data_len: guest_types::Size,
-    ) -> Result<guest_types::SymmetricTag, guest_types::CryptoErrno> {
-        let out = &mut *out_ptr
-            .as_array(out_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let data = &*data_ptr
-            .as_array(data_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_state_encrypt_detached(symmetric_state_handle.into(), out, data)?
-            .into())
-    }
-
-    fn symmetric_state_decrypt(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        out_ptr: &wiggle::GuestPtr<'_, u8>,
-        out_len: guest_types::Size,
-        data_ptr: &wiggle::GuestPtr<'_, u8>,
-        data_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let out = &mut *out_ptr
-            .as_array(out_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let data = &*data_ptr
-            .as_array(data_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_state_decrypt(symmetric_state_handle.into(), out, data)?
-            .try_into()?)
-    }
-
-    fn symmetric_state_decrypt_detached(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-        out_ptr: &wiggle::GuestPtr<'_, u8>,
-        out_len: guest_types::Size,
-        data_ptr: &wiggle::GuestPtr<'_, u8>,
-        data_len: guest_types::Size,
-        raw_tag_ptr: &wiggle::GuestPtr<'_, u8>,
-        raw_tag_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let out = &mut *out_ptr
-            .as_array(out_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let data = &*data_ptr
-            .as_array(data_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        let raw_tag: &[u8] = &*raw_tag_ptr
-            .as_array(raw_tag_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_state_decrypt_detached(symmetric_state_handle.into(), out, data, raw_tag)?
-            .try_into()?)
-    }
-
-    fn symmetric_state_ratchet(
-        &mut self,
-        symmetric_state_handle: guest_types::SymmetricState,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).symmetric_state_ratchet(symmetric_state_handle.into())?)
-    }
-
-    // --- tag
-
-    fn symmetric_tag_len(
-        &mut self,
-        symmetric_tag_handle: guest_types::SymmetricTag,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        Ok((&*self)
-            .symmetric_tag_len(symmetric_tag_handle.into())?
-            .try_into()?)
-    }
-
-    fn symmetric_tag_pull(
-        &mut self,
-        symmetric_tag_handle: guest_types::SymmetricTag,
-        buf_ptr: &wiggle::GuestPtr<'_, u8>,
-        buf_len: guest_types::Size,
-    ) -> Result<guest_types::Size, guest_types::CryptoErrno> {
-        let buf = &mut *buf_ptr
-            .as_array(buf_len)
-            .as_slice_mut()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self)
-            .symmetric_tag_pull(symmetric_tag_handle.into(), buf)?
-            .try_into()?)
-    }
-
-    fn symmetric_tag_verify(
-        &mut self,
-        symmetric_tag_handle: guest_types::SymmetricTag,
-        expected_raw_ptr: &wiggle::GuestPtr<'_, u8>,
-        expected_raw_len: guest_types::Size,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        let expected_raw = &*expected_raw_ptr
-            .as_array(expected_raw_len)
-            .as_slice()?
-            .expect("cannot use with shared memories; see https://github.com/bytecodealliance/wasmtime/issues/5235 (TODO)");
-        Ok((&*self).symmetric_tag_verify(symmetric_tag_handle.into(), expected_raw)?)
-    }
-
-    fn symmetric_tag_close(
-        &mut self,
-        symmetric_tag_handle: guest_types::SymmetricTag,
-    ) -> Result<(), guest_types::CryptoErrno> {
-        Ok((&*self).symmetric_tag_close(symmetric_tag_handle.into())?)
-    }
-}
diff --git a/crates/wasi-preview1-component-adapter/src/descriptors.rs b/crates/wasi-preview1-component-adapter/src/descriptors.rs
index 2a0f7928b832..e8412eb01631 100644
--- a/crates/wasi-preview1-component-adapter/src/descriptors.rs
+++ b/crates/wasi-preview1-component-adapter/src/descriptors.rs
@@ -1,5 +1,5 @@
 use crate::bindings::wasi::cli_base::{stderr, stdin, stdout};
-use crate::bindings::wasi::filesystem::filesystem;
+use crate::bindings::wasi::filesystem::types as filesystem;
 use crate::bindings::wasi::io::streams::{self, InputStream, OutputStream};
 use crate::bindings::wasi::sockets::tcp;
 use crate::{set_stderr_stream, BumpArena, File, ImportAlloc, TrappingUnwrap, WasmStr};
@@ -166,7 +166,7 @@ impl Descriptors {
         }))
         .trapping_unwrap();
 
-        #[link(wasm_import_module = "wasi:cli-base/preopens")]
+        #[link(wasm_import_module = "wasi:filesystem/preopens")]
         extern "C" {
             #[link_name = "get-directories"]
             fn get_preopens_import(rval: *mut PreopenList);
diff --git a/crates/wasi-preview1-component-adapter/src/lib.rs b/crates/wasi-preview1-component-adapter/src/lib.rs
index 69aa91959724..67179891cf5b 100644
--- a/crates/wasi-preview1-component-adapter/src/lib.rs
+++ b/crates/wasi-preview1-component-adapter/src/lib.rs
@@ -2,7 +2,7 @@
 
 use crate::bindings::wasi::cli_base::exit;
 use crate::bindings::wasi::clocks::{monotonic_clock, wall_clock};
-use crate::bindings::wasi::filesystem::filesystem;
+use crate::bindings::wasi::filesystem::types as filesystem;
 use crate::bindings::wasi::io::streams;
 use crate::bindings::wasi::poll::poll;
 use crate::bindings::wasi::random::random;
@@ -380,21 +380,20 @@ pub unsafe extern "C" fn clock_time_get(
         get_allocation_state(),
         AllocationState::StackAllocated | AllocationState::StateAllocated
     ) {
-        State::with(|state| {
-            match id {
-                CLOCKID_MONOTONIC => {
-                    *time = monotonic_clock::now();
-                }
-                CLOCKID_REALTIME => {
-                    let res = wall_clock::now();
-                    *time = Timestamp::from(res.seconds)
-                        .checked_mul(1_000_000_000)
-                        .and_then(|ns| ns.checked_add(res.nanoseconds.into()))
-                        .ok_or(ERRNO_OVERFLOW)?;
-                }
-                _ => unreachable!(),
+        State::with(|state| match id {
+            CLOCKID_MONOTONIC => {
+                *time = monotonic_clock::now();
+                Ok(())
             }
-            Ok(())
+            CLOCKID_REALTIME => {
+                let res = wall_clock::now();
+                *time = Timestamp::from(res.seconds)
+                    .checked_mul(1_000_000_000)
+                    .and_then(|ns| ns.checked_add(res.nanoseconds.into()))
+                    .ok_or(ERRNO_OVERFLOW)?;
+                Ok(())
+            }
+            _ => Err(ERRNO_BADF),
         })
     } else {
         *time = Timestamp::from(0u64);
@@ -642,10 +641,11 @@ pub unsafe extern "C" fn fd_filestat_get(fd: Fd, buf: *mut Filestat) -> Errno {
                 ..
             }) => {
                 let stat = filesystem::stat(file.fd)?;
+                let metadata_hash = filesystem::metadata_hash(file.fd)?;
                 let filetype = stat.type_.into();
                 *buf = Filestat {
-                    dev: stat.device,
-                    ino: stat.inode,
+                    dev: 1,
+                    ino: metadata_hash.lower,
                     filetype,
                     nlink: stat.link_count,
                     size: stat.size,
@@ -960,8 +960,6 @@ pub unsafe extern "C" fn fd_readdir(
         // for it.
         let ds = state.descriptors();
         let dir = ds.get_dir(fd)?;
-        let stat = filesystem::stat(dir.fd)?;
-        let dot_inode = stat.inode;
 
         let mut iter;
         match stream {
@@ -975,7 +973,7 @@ pub unsafe extern "C" fn fd_readdir(
                     state,
                     cookie,
                     use_cache: true,
-                    dot_inode,
+                    dir_descriptor: dir.fd,
                 }
             }
 
@@ -990,7 +988,7 @@ pub unsafe extern "C" fn fd_readdir(
                     cookie: wasi::DIRCOOKIE_START,
                     use_cache: false,
                     stream: DirectoryEntryStream(filesystem::read_directory(dir.fd)?),
-                    dot_inode,
+                    dir_descriptor: dir.fd,
                 };
 
                 // Skip to the entry that is requested by the `cookie`
@@ -1069,7 +1067,7 @@ pub unsafe extern "C" fn fd_readdir(
         use_cache: bool,
         cookie: Dircookie,
         stream: DirectoryEntryStream,
-        dot_inode: wasi::Inode,
+        dir_descriptor: filesystem::Descriptor,
     }
 
     impl<'a> Iterator for DirectoryEntryIterator<'a> {
@@ -1086,9 +1084,13 @@ pub unsafe extern "C" fn fd_readdir(
             // Preview2 excludes them, so re-add them.
             match current_cookie {
                 0 => {
+                    let metadata_hash = match filesystem::metadata_hash(self.dir_descriptor) {
+                        Ok(h) => h,
+                        Err(e) => return Some(Err(e.into())),
+                    };
                     let dirent = wasi::Dirent {
                         d_next: self.cookie,
-                        d_ino: self.dot_inode,
+                        d_ino: metadata_hash.lower,
                         d_type: wasi::FILETYPE_DIRECTORY,
                         d_namlen: 1,
                     };
@@ -1128,11 +1130,18 @@ pub unsafe extern "C" fn fd_readdir(
                 Err(e) => return Some(Err(e.into())),
             };
 
-            let filesystem::DirectoryEntry { inode, type_, name } = entry;
+            let filesystem::DirectoryEntry { type_, name } = entry;
+            let d_ino = filesystem::metadata_hash_at(
+                self.dir_descriptor,
+                filesystem::PathFlags::empty(),
+                &name,
+            )
+            .map(|h| h.lower)
+            .unwrap_or(0);
             let name = ManuallyDrop::new(name);
             let dirent = wasi::Dirent {
                 d_next: self.cookie,
-                d_ino: inode.unwrap_or(0),
+                d_ino,
                 d_namlen: u32::try_from(name.len()).trapping_unwrap(),
                 d_type: type_.into(),
             };
@@ -1331,10 +1340,11 @@ pub unsafe extern "C" fn path_filestat_get(
         let ds = state.descriptors();
         let file = ds.get_dir(fd)?;
         let stat = filesystem::stat_at(file.fd, at_flags, path)?;
+        let metadata_hash = filesystem::metadata_hash_at(file.fd, at_flags, path)?;
         let filetype = stat.type_.into();
         *buf = Filestat {
-            dev: stat.device,
-            ino: stat.inode,
+            dev: 1,
+            ino: metadata_hash.lower,
             filetype,
             nlink: stat.link_count,
             size: stat.size,
diff --git a/crates/wasi/src/preview2/command.rs b/crates/wasi/src/preview2/command.rs
index fccfeaf52ed6..e213f3e4bfcf 100644
--- a/crates/wasi/src/preview2/command.rs
+++ b/crates/wasi/src/preview2/command.rs
@@ -5,11 +5,12 @@ wasmtime::component::bindgen!({
     tracing: true,
     async: true,
     trappable_error_type: {
-        "filesystem"::"error-code": Error,
-        "streams"::"stream-error": Error,
+        "wasi:filesystem/types"::"error-code": Error,
+        "wasi:io/streams"::"stream-error": Error,
     },
     with: {
-       "wasi:filesystem/filesystem": crate::preview2::bindings::filesystem::filesystem,
+       "wasi:filesystem/types": crate::preview2::bindings::filesystem::types,
+       "wasi:filesystem/preopens": crate::preview2::bindings::filesystem::preopens,
        "wasi:clocks/monotonic_clock": crate::preview2::bindings::clocks::monotonic_clock,
        "wasi:poll/poll": crate::preview2::bindings::poll::poll,
        "wasi:io/streams": crate::preview2::bindings::io::streams,
@@ -18,7 +19,6 @@ wasmtime::component::bindgen!({
        "wasi:random/random": crate::preview2::bindings::random::random,
        "wasi:cli_base/environment": crate::preview2::bindings::cli_base::environment,
        "wasi:cli_base/exit": crate::preview2::bindings::cli_base::exit,
-       "wasi:cli_base/preopens": crate::preview2::bindings::cli_base::preopens,
        "wasi:cli_base/stdin": crate::preview2::bindings::cli_base::stdin,
        "wasi:cli_base/stdout": crate::preview2::bindings::cli_base::stdout,
        "wasi:cli_base/stderr": crate::preview2::bindings::cli_base::stderr,
@@ -29,13 +29,13 @@ pub fn add_to_linker<T: WasiView>(l: &mut wasmtime::component::Linker<T>) -> any
     crate::preview2::bindings::clocks::wall_clock::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::clocks::monotonic_clock::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::clocks::timezone::add_to_linker(l, |t| t)?;
-    crate::preview2::bindings::filesystem::filesystem::add_to_linker(l, |t| t)?;
+    crate::preview2::bindings::filesystem::types::add_to_linker(l, |t| t)?;
+    crate::preview2::bindings::filesystem::preopens::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::poll::poll::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::io::streams::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::random::random::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::cli_base::exit::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::cli_base::environment::add_to_linker(l, |t| t)?;
-    crate::preview2::bindings::cli_base::preopens::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::cli_base::stdin::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::cli_base::stdout::add_to_linker(l, |t| t)?;
     crate::preview2::bindings::cli_base::stderr::add_to_linker(l, |t| t)?;
@@ -50,11 +50,12 @@ pub mod sync {
         tracing: true,
         async: false,
         trappable_error_type: {
-            "filesystem"::"error-code": Error,
-            "streams"::"stream-error": Error,
+            "wasi:filesystem/types"::"error-code": Error,
+            "wasi:io/streams"::"stream-error": Error,
         },
         with: {
-           "wasi:filesystem/filesystem": crate::preview2::bindings::sync_io::filesystem::filesystem,
+           "wasi:filesystem/types": crate::preview2::bindings::sync_io::filesystem::types,
+           "wasi:filesystem/preopens": crate::preview2::bindings::filesystem::preopens,
            "wasi:clocks/monotonic_clock": crate::preview2::bindings::clocks::monotonic_clock,
            "wasi:poll/poll": crate::preview2::bindings::sync_io::poll::poll,
            "wasi:io/streams": crate::preview2::bindings::sync_io::io::streams,
@@ -63,7 +64,6 @@ pub mod sync {
            "wasi:random/random": crate::preview2::bindings::random::random,
            "wasi:cli_base/environment": crate::preview2::bindings::cli_base::environment,
            "wasi:cli_base/exit": crate::preview2::bindings::cli_base::exit,
-           "wasi:cli_base/preopens": crate::preview2::bindings::cli_base::preopens,
            "wasi:cli_base/stdin": crate::preview2::bindings::cli_base::stdin,
            "wasi:cli_base/stdout": crate::preview2::bindings::cli_base::stdout,
            "wasi:cli_base/stderr": crate::preview2::bindings::cli_base::stderr,
@@ -76,13 +76,13 @@ pub mod sync {
         crate::preview2::bindings::clocks::wall_clock::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::clocks::monotonic_clock::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::clocks::timezone::add_to_linker(l, |t| t)?;
-        crate::preview2::bindings::sync_io::filesystem::filesystem::add_to_linker(l, |t| t)?;
+        crate::preview2::bindings::sync_io::filesystem::types::add_to_linker(l, |t| t)?;
+        crate::preview2::bindings::filesystem::preopens::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::sync_io::poll::poll::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::sync_io::io::streams::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::random::random::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::cli_base::exit::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::cli_base::environment::add_to_linker(l, |t| t)?;
-        crate::preview2::bindings::cli_base::preopens::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::cli_base::stdin::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::cli_base::stdout::add_to_linker(l, |t| t)?;
         crate::preview2::bindings::cli_base::stderr::add_to_linker(l, |t| t)?;
diff --git a/crates/wasi/src/preview2/ctx.rs b/crates/wasi/src/preview2/ctx.rs
index e2d05ff4bb66..10408fbf2dee 100644
--- a/crates/wasi/src/preview2/ctx.rs
+++ b/crates/wasi/src/preview2/ctx.rs
@@ -1,3 +1,4 @@
+use super::clocks::host::{monotonic_clock, wall_clock};
 use crate::preview2::{
     clocks::{self, HostMonotonicClock, HostWallClock},
     filesystem::{Dir, TableFsExt},
@@ -6,8 +7,7 @@ use crate::preview2::{
     DirPerms, FilePerms, Table,
 };
 use cap_rand::{Rng, RngCore, SeedableRng};
-
-use super::clocks::host::{monotonic_clock, wall_clock};
+use std::mem;
 
 pub struct WasiCtxBuilder {
     stdin: Box<dyn HostInputStream>,
@@ -22,9 +22,29 @@ pub struct WasiCtxBuilder {
     insecure_random_seed: u128,
     wall_clock: Box<dyn HostWallClock + Send + Sync>,
     monotonic_clock: Box<dyn HostMonotonicClock + Send + Sync>,
+    built: bool,
 }
 
 impl WasiCtxBuilder {
+    /// Creates a builder for a new context with default parameters set.
+    ///
+    /// The current defaults are:
+    ///
+    /// * stdin is closed
+    /// * stdout and stderr eat all input but it doesn't go anywhere
+    /// * no env vars
+    /// * no arguments
+    /// * no preopens
+    /// * clocks use the host implementation of wall/monotonic clocks
+    /// * RNGs are all initialized with random state and suitable generator
+    ///   quality to satisfy the requirements of WASI APIs.
+    ///
+    /// These defaults can all be updated via the various builder configuration
+    /// methods below.
+    ///
+    /// Note that each builder can only be used once to produce a [`WasiCtx`].
+    /// Invoking the [`build`](WasiCtxBuilder::build) method will panic on the
+    /// second attempt.
     pub fn new() -> Self {
         // For the insecure random API, use `SmallRng`, which is fast. It's
         // also insecure, but that's the deal here.
@@ -47,129 +67,130 @@ impl WasiCtxBuilder {
             insecure_random_seed,
             wall_clock: wall_clock(),
             monotonic_clock: monotonic_clock(),
+            built: false,
         }
     }
 
-    pub fn set_stdin(mut self, stdin: impl HostInputStream + 'static) -> Self {
+    pub fn stdin(&mut self, stdin: impl HostInputStream + 'static) -> &mut Self {
         self.stdin = Box::new(stdin);
         self
     }
 
-    pub fn set_stdout(mut self, stdout: impl HostOutputStream + 'static) -> Self {
+    pub fn stdout(&mut self, stdout: impl HostOutputStream + 'static) -> &mut Self {
         self.stdout = Box::new(stdout);
         self
     }
 
-    pub fn set_stderr(mut self, stderr: impl HostOutputStream + 'static) -> Self {
+    pub fn stderr(&mut self, stderr: impl HostOutputStream + 'static) -> &mut Self {
         self.stderr = Box::new(stderr);
         self
     }
 
-    pub fn inherit_stdin(self) -> Self {
-        self.set_stdin(stdio::stdin())
+    pub fn inherit_stdin(&mut self) -> &mut Self {
+        self.stdin(stdio::stdin())
     }
 
-    pub fn inherit_stdout(self) -> Self {
-        self.set_stdout(stdio::stdout())
+    pub fn inherit_stdout(&mut self) -> &mut Self {
+        self.stdout(stdio::stdout())
     }
 
-    pub fn inherit_stderr(self) -> Self {
-        self.set_stderr(stdio::stderr())
+    pub fn inherit_stderr(&mut self) -> &mut Self {
+        self.stderr(stdio::stderr())
     }
 
-    pub fn inherit_stdio(self) -> Self {
+    pub fn inherit_stdio(&mut self) -> &mut Self {
         self.inherit_stdin().inherit_stdout().inherit_stderr()
     }
 
-    pub fn set_env(mut self, env: &[(impl AsRef<str>, impl AsRef<str>)]) -> Self {
-        self.env = env
-            .iter()
-            .map(|(k, v)| (k.as_ref().to_owned(), v.as_ref().to_owned()))
-            .collect();
+    pub fn envs(&mut self, env: &[(impl AsRef<str>, impl AsRef<str>)]) -> &mut Self {
+        self.env.extend(
+            env.iter()
+                .map(|(k, v)| (k.as_ref().to_owned(), v.as_ref().to_owned())),
+        );
         self
     }
 
-    pub fn push_env(mut self, k: impl AsRef<str>, v: impl AsRef<str>) -> Self {
+    pub fn env(&mut self, k: impl AsRef<str>, v: impl AsRef<str>) -> &mut Self {
         self.env
             .push((k.as_ref().to_owned(), v.as_ref().to_owned()));
         self
     }
 
-    pub fn set_args(mut self, args: &[impl AsRef<str>]) -> Self {
-        self.args = args.iter().map(|a| a.as_ref().to_owned()).collect();
+    pub fn args(&mut self, args: &[impl AsRef<str>]) -> &mut Self {
+        self.args.extend(args.iter().map(|a| a.as_ref().to_owned()));
         self
     }
 
-    pub fn push_arg(mut self, arg: impl AsRef<str>) -> Self {
+    pub fn arg(&mut self, arg: impl AsRef<str>) -> &mut Self {
         self.args.push(arg.as_ref().to_owned());
         self
     }
 
-    pub fn push_preopened_dir(
-        mut self,
+    pub fn preopened_dir(
+        &mut self,
         dir: cap_std::fs::Dir,
         perms: DirPerms,
         file_perms: FilePerms,
         path: impl AsRef<str>,
-    ) -> Self {
+    ) -> &mut Self {
         self.preopens
             .push((Dir::new(dir, perms, file_perms), path.as_ref().to_owned()));
         self
     }
 
-    /// Set the generator for the secure random number generator.
+    /// Set the generator for the secure random number generator to the custom
+    /// generator specified.
     ///
-    /// This initializes the random number generator using
-    /// [`cap_rand::thread_rng`].
-    pub fn set_secure_random(mut self) -> Self {
-        self.random = random::thread_rng();
-        self
-    }
-
-    /// Set the generator for the secure random number generator to a custom
-    /// generator.
-    ///
-    /// This function is usually not needed; use [`set_secure_random`] to
-    /// install the default generator, which is intended to be sufficient for
-    /// most use cases.
+    /// Note that contexts have a default RNG configured which is a suitable
+    /// generator for WASI and is configured with a random seed per-context.
     ///
     /// Guest code may rely on this random number generator to produce fresh
     /// unpredictable random data in order to maintain its security invariants,
     /// and ideally should use the insecure random API otherwise, so using any
     /// prerecorded or otherwise predictable data may compromise security.
-    ///
-    /// [`set_secure_random`]: Self::set_secure_random
-    pub fn set_secure_random_to_custom_generator(
-        mut self,
-        random: impl RngCore + Send + Sync + 'static,
-    ) -> Self {
+    pub fn secure_random(&mut self, random: impl RngCore + Send + Sync + 'static) -> &mut Self {
         self.random = Box::new(random);
         self
     }
 
-    pub fn set_insecure_random(
-        mut self,
+    pub fn insecure_random(
+        &mut self,
         insecure_random: impl RngCore + Send + Sync + 'static,
-    ) -> Self {
+    ) -> &mut Self {
         self.insecure_random = Box::new(insecure_random);
         self
     }
-    pub fn set_insecure_random_seed(mut self, insecure_random_seed: u128) -> Self {
+    pub fn insecure_random_seed(&mut self, insecure_random_seed: u128) -> &mut Self {
         self.insecure_random_seed = insecure_random_seed;
         self
     }
 
-    pub fn set_wall_clock(mut self, clock: impl clocks::HostWallClock + 'static) -> Self {
+    pub fn wall_clock(&mut self, clock: impl clocks::HostWallClock + 'static) -> &mut Self {
         self.wall_clock = Box::new(clock);
         self
     }
 
-    pub fn set_monotonic_clock(mut self, clock: impl clocks::HostMonotonicClock + 'static) -> Self {
+    pub fn monotonic_clock(
+        &mut self,
+        clock: impl clocks::HostMonotonicClock + 'static,
+    ) -> &mut Self {
         self.monotonic_clock = Box::new(clock);
         self
     }
 
-    pub fn build(self, table: &mut Table) -> Result<WasiCtx, anyhow::Error> {
+    /// Uses the configured context so far to construct the final `WasiCtx`.
+    ///
+    /// This will insert resources into the provided `table`.
+    ///
+    /// Note that each `WasiCtxBuilder` can only be used to "build" once, and
+    /// calling this method twice will panic.
+    ///
+    /// # Panics
+    ///
+    /// Panics if this method is called twice.
+    pub fn build(&mut self, table: &mut Table) -> Result<WasiCtx, anyhow::Error> {
+        assert!(!self.built);
+
         use anyhow::Context;
         let Self {
             stdin,
@@ -183,7 +204,9 @@ impl WasiCtxBuilder {
             insecure_random_seed,
             wall_clock,
             monotonic_clock,
-        } = self;
+            built: _,
+        } = mem::replace(self, Self::new());
+        self.built = true;
 
         let stdin = table.push_input_stream(stdin).context("stdin")?;
         let stdout = table.push_output_stream(stdout).context("stdout")?;
diff --git a/crates/wasi/src/preview2/mod.rs b/crates/wasi/src/preview2/mod.rs
index 7ab0a1b430b7..f336acbff060 100644
--- a/crates/wasi/src/preview2/mod.rs
+++ b/crates/wasi/src/preview2/mod.rs
@@ -49,12 +49,12 @@ pub mod bindings {
                 interfaces: "
               import wasi:poll/poll
               import wasi:io/streams
-              import wasi:filesystem/filesystem
+              import wasi:filesystem/types
             ",
                 tracing: true,
                 trappable_error_type: {
-                    "streams"::"stream-error": Error,
-                    "filesystem"::"error-code": Error,
+                    "wasi:io/streams"::"stream-error": Error,
+                    "wasi:filesystem/types"::"error-code": Error,
                 },
                 with: {
                     "wasi:clocks/wall-clock": crate::preview2::bindings::clocks::wall_clock,
@@ -99,33 +99,30 @@ pub mod bindings {
             interfaces: "
               import wasi:poll/poll
               import wasi:io/streams
-              import wasi:filesystem/filesystem
+              import wasi:filesystem/types
             ",
             tracing: true,
             async: true,
             trappable_error_type: {
-                "streams"::"stream-error": Error,
-                "filesystem"::"error-code": Error,
+                "wasi:io/streams"::"stream-error": Error,
+                "wasi:filesystem/types"::"error-code": Error,
             },
             with: {
                 "wasi:clocks/wall-clock": crate::preview2::bindings::clocks::wall_clock,
             }
         });
     }
-    pub use self::_internal_io::wasi::{filesystem, io, poll};
+    pub use self::_internal_io::wasi::{io, poll};
 
     pub(crate) mod _internal_rest {
         wasmtime::component::bindgen!({
         path: "wit",
         interfaces: "
-              import wasi:clocks/wall-clock
-              import wasi:clocks/monotonic-clock
-              import wasi:clocks/timezone
+              import wasi:filesystem/preopens
               import wasi:random/random
               import wasi:random/insecure
               import wasi:random/insecure-seed
               import wasi:cli-base/environment
-              import wasi:cli-base/preopens
               import wasi:cli-base/exit
               import wasi:cli-base/stdin
               import wasi:cli-base/stdout
@@ -133,19 +130,23 @@ pub mod bindings {
             ",
         tracing: true,
         trappable_error_type: {
-            "filesystem"::"error-code": Error,
-            "streams"::"stream-error": Error,
+            "wasi:filesystem/types"::"error-code": Error,
+            "wasi:io/streams"::"stream-error": Error,
         },
         with: {
             "wasi:clocks/wall-clock": crate::preview2::bindings::clocks::wall_clock,
             "wasi:poll/poll": crate::preview2::bindings::poll::poll,
             "wasi:io/streams": crate::preview2::bindings::io::streams,
-            "wasi:filesystem/filesystem": crate::preview2::bindings::filesystem::filesystem
+            "wasi:filesystem/types": crate::preview2::bindings::filesystem::types,
         }
         });
     }
 
-    pub use self::_internal_rest::wasi::*;
+    pub use self::_internal_rest::wasi::{cli_base, random};
+    pub mod filesystem {
+        pub use super::_internal_io::wasi::filesystem::types;
+        pub use super::_internal_rest::wasi::filesystem::preopens;
+    }
 }
 
 pub(crate) static RUNTIME: once_cell::sync::Lazy<tokio::runtime::Runtime> =
diff --git a/crates/wasi/src/preview2/preview1/mod.rs b/crates/wasi/src/preview2/preview1/mod.rs
index 6d4c07023db0..8cd1e798ea9e 100644
--- a/crates/wasi/src/preview2/preview1/mod.rs
+++ b/crates/wasi/src/preview2/preview1/mod.rs
@@ -1,6 +1,6 @@
-use crate::preview2::bindings::cli_base::{preopens, stderr, stdin, stdout};
+use crate::preview2::bindings::cli_base::{stderr, stdin, stdout};
 use crate::preview2::bindings::clocks::{monotonic_clock, wall_clock};
-use crate::preview2::bindings::filesystem::filesystem;
+use crate::preview2::bindings::filesystem::{preopens, types as filesystem};
 use crate::preview2::bindings::io::streams;
 use crate::preview2::filesystem::TableFsExt;
 use crate::preview2::preview2::filesystem::TableReaddirExt;
@@ -15,7 +15,7 @@ use std::slice;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
 use wiggle::tracing::instrument;
-use wiggle::{GuestPtr, GuestSliceMut, GuestStrCow, GuestType};
+use wiggle::{GuestError, GuestPtr, GuestSliceMut, GuestStrCow, GuestType};
 
 #[derive(Clone, Debug)]
 struct File {
@@ -36,9 +36,9 @@ struct File {
 
 #[derive(Clone, Debug)]
 enum Descriptor {
-    Stdin(preopens::InputStream),
-    Stdout(preopens::OutputStream),
-    Stderr(preopens::OutputStream),
+    Stdin(streams::InputStream),
+    Stdout(streams::OutputStream),
+    Stderr(streams::OutputStream),
     PreopenDirectory((filesystem::Descriptor, String)),
     File(File),
 }
@@ -101,14 +101,14 @@ impl Descriptors {
     }
 
     /// Returns next descriptor number, which was never assigned
-    fn unused(&self) -> ErrnoResult<u32> {
+    fn unused(&self) -> Result<u32> {
         match self.last_key_value() {
             Some((fd, _)) => {
                 if let Some(fd) = fd.checked_add(1) {
                     return Ok(fd);
                 }
                 if self.len() == u32::MAX as usize {
-                    return Err(types::Errno::Loop);
+                    return Err(types::Errno::Loop.into());
                 }
                 // TODO: Optimize
                 Ok((0..u32::MAX)
@@ -131,7 +131,7 @@ impl Descriptors {
     /// Pushes the [Descriptor] returning corresponding number.
     /// This operation will try to reuse numbers previously removed via [`Self::remove`]
     /// and rely on [`Self::unused`] if no free numbers are recorded
-    fn push(&mut self, desc: Descriptor) -> ErrnoResult<u32> {
+    fn push(&mut self, desc: Descriptor) -> Result<u32> {
         let fd = if let Some(fd) = self.free.pop() {
             fd
         } else {
@@ -142,7 +142,7 @@ impl Descriptors {
     }
 
     /// Like [Self::push], but for [`File`]
-    fn push_file(&mut self, file: File) -> ErrnoResult<u32> {
+    fn push_file(&mut self, file: File) -> Result<u32> {
         self.push(Descriptor::File(file))
     }
 }
@@ -188,33 +188,35 @@ impl<T: WasiPreview1View + ?Sized> Transaction<'_, T> {
     /// # Errors
     ///
     /// Returns [`types::Errno::Badf`] if no [`Descriptor`] is found
-    fn get_descriptor(&mut self, fd: types::Fd) -> ErrnoResult<&Descriptor> {
+    fn get_descriptor(&mut self, fd: types::Fd) -> Result<&Descriptor> {
         let fd = fd.into();
-        self.descriptors
+        let desc = self
+            .descriptors
             .get_mut()
             .get(&fd)
-            .ok_or(types::Errno::Badf)
+            .ok_or(types::Errno::Badf)?;
+        Ok(desc)
     }
 
     /// Borrows [`File`] corresponding to `fd`
     /// if it describes a [`Descriptor::File`] of [`crate::preview2::filesystem::File`] type
-    fn get_file(&mut self, fd: types::Fd) -> ErrnoResult<&File> {
+    fn get_file(&mut self, fd: types::Fd) -> Result<&File> {
         let fd = fd.into();
         match self.descriptors.get_mut().get(&fd) {
             Some(Descriptor::File(file @ File { fd, .. })) if self.view.table().is_file(*fd) => {
                 Ok(file)
             }
-            _ => Err(types::Errno::Badf),
+            _ => Err(types::Errno::Badf.into()),
         }
     }
 
     /// Mutably borrows [`File`] corresponding to `fd`
     /// if it describes a [`Descriptor::File`] of [`crate::preview2::filesystem::File`] type
-    fn get_file_mut(&mut self, fd: types::Fd) -> ErrnoResult<&mut File> {
+    fn get_file_mut(&mut self, fd: types::Fd) -> Result<&mut File> {
         let fd = fd.into();
         match self.descriptors.get_mut().get_mut(&fd) {
             Some(Descriptor::File(file)) if self.view.table().is_file(file.fd) => Ok(file),
-            _ => Err(types::Errno::Badf),
+            _ => Err(types::Errno::Badf.into()),
         }
     }
 
@@ -224,7 +226,7 @@ impl<T: WasiPreview1View + ?Sized> Transaction<'_, T> {
     /// # Errors
     ///
     /// Returns [`types::Errno::Spipe`] if the descriptor corresponds to stdio
-    fn get_seekable(&mut self, fd: types::Fd) -> ErrnoResult<&File> {
+    fn get_seekable(&mut self, fd: types::Fd) -> Result<&File> {
         let fd = fd.into();
         match self.descriptors.get_mut().get(&fd) {
             Some(Descriptor::File(file @ File { fd, .. })) if self.view.table().is_file(*fd) => {
@@ -232,14 +234,14 @@ impl<T: WasiPreview1View + ?Sized> Transaction<'_, T> {
             }
             Some(Descriptor::Stdin(..) | Descriptor::Stdout(..) | Descriptor::Stderr(..)) => {
                 // NOTE: legacy implementation returns SPIPE here
-                Err(types::Errno::Spipe)
+                Err(types::Errno::Spipe.into())
             }
-            _ => Err(types::Errno::Badf),
+            _ => Err(types::Errno::Badf.into()),
         }
     }
 
     /// Returns [`filesystem::Descriptor`] corresponding to `fd`
-    fn get_fd(&mut self, fd: types::Fd) -> ErrnoResult<filesystem::Descriptor> {
+    fn get_fd(&mut self, fd: types::Fd) -> Result<filesystem::Descriptor> {
         match self.get_descriptor(fd)? {
             Descriptor::File(File { fd, .. }) => Ok(*fd),
             Descriptor::PreopenDirectory((fd, _)) => Ok(*fd),
@@ -250,19 +252,19 @@ impl<T: WasiPreview1View + ?Sized> Transaction<'_, T> {
 
     /// Returns [`filesystem::Descriptor`] corresponding to `fd`
     /// if it describes a [`Descriptor::File`] of [`crate::preview2::filesystem::File`] type
-    fn get_file_fd(&mut self, fd: types::Fd) -> ErrnoResult<filesystem::Descriptor> {
+    fn get_file_fd(&mut self, fd: types::Fd) -> Result<filesystem::Descriptor> {
         self.get_file(fd).map(|File { fd, .. }| *fd)
     }
 
     /// Returns [`filesystem::Descriptor`] corresponding to `fd`
     /// if it describes a [`Descriptor::File`] or [`Descriptor::PreopenDirectory`]
     /// of [`crate::preview2::filesystem::Dir`] type
-    fn get_dir_fd(&mut self, fd: types::Fd) -> ErrnoResult<filesystem::Descriptor> {
+    fn get_dir_fd(&mut self, fd: types::Fd) -> Result<filesystem::Descriptor> {
         let fd = fd.into();
         match self.descriptors.get_mut().get(&fd) {
             Some(Descriptor::File(File { fd, .. })) if self.view.table().is_dir(*fd) => Ok(*fd),
             Some(Descriptor::PreopenDirectory((fd, _))) => Ok(*fd),
-            _ => Err(types::Errno::Badf),
+            _ => Err(types::Errno::Badf.into()),
         }
     }
 }
@@ -319,8 +321,8 @@ pub fn add_to_linker<
     T: WasiPreview1View
         + bindings::cli_base::environment::Host
         + bindings::cli_base::exit::Host
-        + bindings::cli_base::preopens::Host
-        + bindings::filesystem::filesystem::Host
+        + bindings::filesystem::types::Host
+        + bindings::filesystem::preopens::Host
         + bindings::sync_io::poll::poll::Host
         + bindings::random::random::Host
         + bindings::io::streams::Host
@@ -356,13 +358,9 @@ impl wiggle::GuestErrorType for types::Errno {
     }
 }
 
-fn systimespec(
-    set: bool,
-    ts: types::Timestamp,
-    now: bool,
-) -> ErrnoResult<filesystem::NewTimestamp> {
+fn systimespec(set: bool, ts: types::Timestamp, now: bool) -> Result<filesystem::NewTimestamp> {
     if set && now {
-        Err(types::Errno::Inval)
+        Err(types::Errno::Inval.into())
     } else if set {
         Ok(filesystem::NewTimestamp::Timestamp(filesystem::Datetime {
             seconds: ts / 1_000_000_000,
@@ -499,6 +497,41 @@ impl From<filesystem::ErrorCode> for types::Errno {
     }
 }
 
+impl From<std::num::TryFromIntError> for types::Error {
+    fn from(_: std::num::TryFromIntError) -> Self {
+        types::Errno::Overflow.into()
+    }
+}
+
+impl From<GuestError> for types::Error {
+    fn from(err: GuestError) -> Self {
+        use wiggle::GuestError::*;
+        match err {
+            InvalidFlagValue { .. } => types::Errno::Inval.into(),
+            InvalidEnumValue { .. } => types::Errno::Inval.into(),
+            // As per
+            // https://github.com/WebAssembly/wasi/blob/main/legacy/tools/witx-docs.md#pointers
+            //
+            // > If a misaligned pointer is passed to a function, the function
+            // > shall trap.
+            // >
+            // > If an out-of-bounds pointer is passed to a function and the
+            // > function needs to dereference it, the function shall trap.
+            //
+            // so this turns OOB and misalignment errors into traps.
+            PtrOverflow { .. } | PtrOutOfBounds { .. } | PtrNotAligned { .. } => {
+                types::Error::trap(err.into())
+            }
+            PtrBorrowed { .. } => types::Errno::Fault.into(),
+            InvalidUtf8 { .. } => types::Errno::Ilseq.into(),
+            TryFromIntError { .. } => types::Errno::Overflow.into(),
+            SliceLengthsDiffer { .. } => types::Errno::Fault.into(),
+            BorrowCheckerOutOfHandles { .. } => types::Errno::Fault.into(),
+            InFunc { err, .. } => types::Error::from(*err),
+        }
+    }
+}
+
 impl From<filesystem::ErrorCode> for types::Error {
     fn from(code: filesystem::ErrorCode) -> Self {
         types::Errno::from(code).into()
@@ -533,78 +566,63 @@ impl From<TableError> for types::Error {
     }
 }
 
-type ErrnoResult<T> = Result<T, types::Errno>;
+type Result<T, E = types::Error> = std::result::Result<T, E>;
 
 fn write_bytes<'a>(
     ptr: impl Borrow<GuestPtr<'a, u8>>,
     buf: impl AsRef<[u8]>,
-) -> ErrnoResult<GuestPtr<'a, u8>> {
+) -> Result<GuestPtr<'a, u8>, types::Error> {
     // NOTE: legacy implementation always returns Inval errno
 
     let buf = buf.as_ref();
-    let len = buf.len().try_into().or(Err(types::Errno::Inval))?;
+    let len = buf.len().try_into()?;
 
     let ptr = ptr.borrow();
-    ptr.as_array(len)
-        .copy_from_slice(buf)
-        .or(Err(types::Errno::Inval))?;
-    ptr.add(len).or(Err(types::Errno::Inval))
+    ptr.as_array(len).copy_from_slice(buf)?;
+    let next = ptr.add(len)?;
+    Ok(next)
 }
 
-fn write_byte<'a>(ptr: impl Borrow<GuestPtr<'a, u8>>, byte: u8) -> ErrnoResult<GuestPtr<'a, u8>> {
+fn write_byte<'a>(ptr: impl Borrow<GuestPtr<'a, u8>>, byte: u8) -> Result<GuestPtr<'a, u8>> {
     let ptr = ptr.borrow();
-    ptr.write(byte).or(Err(types::Errno::Inval))?;
-    ptr.add(1).or(Err(types::Errno::Inval))
+    ptr.write(byte)?;
+    let next = ptr.add(1)?;
+    Ok(next)
 }
 
-fn read_str<'a>(ptr: impl Borrow<GuestPtr<'a, str>>) -> ErrnoResult<GuestStrCow<'a>> {
-    // NOTE: legacy implementation always returns Inval errno
-    ptr.borrow().as_cow().or(Err(types::Errno::Inval))
+fn read_str<'a>(ptr: impl Borrow<GuestPtr<'a, str>>) -> Result<GuestStrCow<'a>> {
+    let s = ptr.borrow().as_cow()?;
+    Ok(s)
 }
 
-fn read_string<'a>(ptr: impl Borrow<GuestPtr<'a, str>>) -> ErrnoResult<String> {
+fn read_string<'a>(ptr: impl Borrow<GuestPtr<'a, str>>) -> Result<String> {
     read_str(ptr).map(|s| s.to_string())
 }
 
 // Find first non-empty buffer.
-fn first_non_empty_ciovec(ciovs: &types::CiovecArray<'_>) -> ErrnoResult<Option<Vec<u8>>> {
-    ciovs
-        .iter()
-        .map(|iov| {
-            let iov = iov
-                .or(Err(types::Errno::Inval))?
-                .read()
-                .or(Err(types::Errno::Inval))?;
-            if iov.buf_len == 0 {
-                return Ok(None);
-            }
-            iov.buf
-                .as_array(iov.buf_len)
-                .to_vec()
-                .or(Err(types::Errno::Inval))
-                .map(Some)
-        })
-        .find_map(Result::transpose)
-        .transpose()
+fn first_non_empty_ciovec(ciovs: &types::CiovecArray<'_>) -> Result<Option<Vec<u8>>> {
+    for iov in ciovs.iter() {
+        let iov = iov?.read()?;
+        if iov.buf_len == 0 {
+            continue;
+        }
+        return Ok(Some(iov.buf.as_array(iov.buf_len).to_vec()?));
+    }
+    Ok(None)
 }
 
 // Find first non-empty buffer.
 fn first_non_empty_iovec<'a>(
     iovs: &types::IovecArray<'a>,
-) -> ErrnoResult<Option<GuestSliceMut<'a, u8>>> {
+) -> Result<Option<GuestSliceMut<'a, u8>>> {
     iovs.iter()
         .map(|iov| {
-            let iov = iov
-                .or(Err(types::Errno::Inval))?
-                .read()
-                .or(Err(types::Errno::Inval))?;
+            let iov = iov?.read()?;
             if iov.buf_len == 0 {
                 return Ok(None);
             }
-            iov.buf
-                .as_array(iov.buf_len)
-                .as_slice_mut()
-                .map_err(|_| types::Errno::Inval)
+            let slice = iov.buf.as_array(iov.buf_len).as_slice_mut()?;
+            Ok(slice)
         })
         .find_map(Result::transpose)
         .transpose()
@@ -618,9 +636,9 @@ impl<
         T: WasiPreview1View
             + bindings::cli_base::environment::Host
             + bindings::cli_base::exit::Host
-            + bindings::cli_base::preopens::Host
-            + bindings::filesystem::filesystem::Host
-            + bindings::sync_io::poll::poll::Host
+            + bindings::filesystem::preopens::Host
+            + bindings::filesystem::types::Host
+            + bindings::poll::poll::Host
             + bindings::random::random::Host
             + bindings::io::streams::Host
             + bindings::clocks::monotonic_clock::Host
@@ -637,20 +655,15 @@ impl<
             .context("failed to call `get-arguments`")
             .map_err(types::Error::trap)?
             .into_iter()
-            .try_fold(
-                (*argv, *argv_buf),
-                |(argv, argv_buf), arg| -> ErrnoResult<_> {
-                    // NOTE: legacy implementation always returns Inval errno
+            .try_fold((*argv, *argv_buf), |(argv, argv_buf), arg| -> Result<_> {
+                argv.write(argv_buf)?;
+                let argv = argv.add(1)?;
 
-                    argv.write(argv_buf).map_err(|_| types::Errno::Inval)?;
-                    let argv = argv.add(1).map_err(|_| types::Errno::Inval)?;
+                let argv_buf = write_bytes(argv_buf, arg)?;
+                let argv_buf = write_byte(argv_buf, 0)?;
 
-                    let argv_buf = write_bytes(argv_buf, arg)?;
-                    let argv_buf = write_byte(argv_buf, 0)?;
-
-                    Ok((argv, argv_buf))
-                },
-            )?;
+                Ok((argv, argv_buf))
+            })?;
         Ok(())
     }
 
@@ -682,13 +695,9 @@ impl<
             .into_iter()
             .try_fold(
                 (*environ, *environ_buf),
-                |(environ, environ_buf), (k, v)| -> ErrnoResult<_> {
-                    // NOTE: legacy implementation always returns Inval errno
-
-                    environ
-                        .write(environ_buf)
-                        .map_err(|_| types::Errno::Inval)?;
-                    let environ = environ.add(1).map_err(|_| types::Errno::Inval)?;
+                |(environ, environ_buf), (k, v)| -> Result<_, types::Error> {
+                    environ.write(environ_buf)?;
+                    let environ = environ.add(1)?;
 
                     let environ_buf = write_bytes(environ_buf, k)?;
                     let environ_buf = write_byte(environ_buf, b'=')?;
@@ -707,16 +716,12 @@ impl<
             .get_environment()
             .context("failed to call `get-environment`")
             .map_err(types::Error::trap)?;
-        let num = environ
-            .len()
-            .try_into()
-            .map_err(|_| types::Errno::Overflow)?;
+        let num = environ.len().try_into()?;
         let len = environ
             .iter()
             .map(|(k, v)| k.len() + 1 + v.len() + 1) // Key/value pairs are expected to be joined with `=`s, and terminated with `\0`s.
             .sum::<usize>()
-            .try_into()
-            .map_err(|_| types::Errno::Overflow)?;
+            .try_into()?;
         Ok((num, len))
     }
 
@@ -1005,8 +1010,6 @@ impl<
             }
             Descriptor::PreopenDirectory((fd, _)) | Descriptor::File(File { fd, .. }) => {
                 let filesystem::DescriptorStat {
-                    device: dev,
-                    inode: ino,
                     type_,
                     link_count: nlink,
                     size,
@@ -1018,13 +1021,18 @@ impl<
                         .context("failed to call `stat`")
                         .unwrap_or_else(types::Error::trap)
                 })?;
+                let metadata_hash = self.metadata_hash(fd).await.map_err(|e| {
+                    e.try_into()
+                        .context("failed to call `metadata_hash`")
+                        .unwrap_or_else(types::Error::trap)
+                })?;
                 let filetype = type_.try_into().map_err(types::Error::trap)?;
                 let atim = data_access_timestamp.try_into()?;
                 let mtim = data_modification_timestamp.try_into()?;
                 let ctim = status_change_timestamp.try_into()?;
                 Ok(types::Filestat {
-                    dev,
-                    ino,
+                    dev: 1,
+                    ino: metadata_hash.lower,
                     filetype,
                     nlink,
                     size,
@@ -1115,7 +1123,7 @@ impl<
                 }
                 .map_err(|_| types::Errno::Io)?;
 
-                let n = read.len().try_into().or(Err(types::Errno::Overflow))?;
+                let n = read.len().try_into()?;
                 let pos = pos.checked_add(n).ok_or(types::Errno::Overflow)?;
                 position.store(pos, Ordering::Relaxed);
 
@@ -1141,7 +1149,7 @@ impl<
         }
         let (buf, _) = buf.split_at_mut(read.len());
         buf.copy_from_slice(&read);
-        let n = read.len().try_into().or(Err(types::Errno::Overflow))?;
+        let n = read.len().try_into()?;
         Ok(n)
     }
 
@@ -1190,7 +1198,7 @@ impl<
         }
         let (buf, _) = buf.split_at_mut(read.len());
         buf.copy_from_slice(&read);
-        let n = read.len().try_into().or(Err(types::Errno::Overflow))?;
+        let n = read.len().try_into()?;
         Ok(n)
     }
 
@@ -1252,7 +1260,7 @@ impl<
             }
             _ => return Err(types::Errno::Badf.into()),
         };
-        let n = n.try_into().or(Err(types::Errno::Overflow))?;
+        let n = n.try_into()?;
         Ok(n)
     }
 
@@ -1289,7 +1297,7 @@ impl<
             }
             _ => return Err(types::Errno::Badf.into()),
         };
-        let n = n.try_into().or(Err(types::Errno::Overflow))?;
+        let n = n.try_into()?;
         Ok(n)
     }
 
@@ -1297,7 +1305,7 @@ impl<
     #[instrument(skip(self))]
     fn fd_prestat_get(&mut self, fd: types::Fd) -> Result<types::Prestat, types::Error> {
         if let Descriptor::PreopenDirectory((_, p)) = self.transact()?.get_descriptor(fd)? {
-            let pr_name_len = p.len().try_into().or(Err(types::Errno::Overflow))?;
+            let pr_name_len = p.len().try_into()?;
             return Ok(types::Prestat::Dir(types::PrestatDir { pr_name_len }));
         }
         Err(types::Errno::Badf.into()) // NOTE: legacy implementation returns BADF here
@@ -1311,7 +1319,7 @@ impl<
         path: &GuestPtr<'a, u8>,
         path_max_len: types::Size,
     ) -> Result<(), types::Error> {
-        let path_max_len = path_max_len.try_into().or(Err(types::Errno::Overflow))?;
+        let path_max_len = path_max_len.try_into()?;
         if let Descriptor::PreopenDirectory((_, p)) = self.transact()?.get_descriptor(fd)? {
             if p.len() > path_max_len {
                 return Err(types::Errno::Nametoolong.into());
@@ -1403,11 +1411,9 @@ impl<
                 .context("failed to call `read-directory`")
                 .unwrap_or_else(types::Error::trap)
         })?;
-        let filesystem::DescriptorStat {
-            inode: fd_inode, ..
-        } = self.stat(fd).await.map_err(|e| {
+        let dir_metadata_hash = self.metadata_hash(fd).await.map_err(|e| {
             e.try_into()
-                .context("failed to call `stat`")
+                .context("failed to call `metadata-hash`")
                 .unwrap_or_else(types::Error::trap)
         })?;
         let cookie = cookie.try_into().map_err(|_| types::Errno::Overflow)?;
@@ -1416,7 +1422,7 @@ impl<
             (
                 types::Dirent {
                     d_next: 1u64.to_le(),
-                    d_ino: fd_inode.to_le(),
+                    d_ino: dir_metadata_hash.lower.to_le(),
                     d_type: types::Filetype::Directory,
                     d_namlen: 1u32.to_le(),
                 },
@@ -1425,40 +1431,47 @@ impl<
             (
                 types::Dirent {
                     d_next: 2u64.to_le(),
-                    d_ino: fd_inode.to_le(), // NOTE: incorrect, but legacy implementation returns `fd` inode here
+                    d_ino: dir_metadata_hash.lower.to_le(), // NOTE: incorrect, but legacy implementation returns `fd` inode here
                     d_type: types::Filetype::Directory,
                     d_namlen: 2u32.to_le(),
                 },
                 "..".into(),
             ),
-        ]
-        .into_iter()
-        .map(Ok::<_, types::Error>);
+        ];
 
-        let dir = self
+        let mut dir = Vec::new();
+        for (entry, d_next) in self
             .table_mut()
             // remove iterator from table and use it directly:
             .delete_readdir(stream)?
             .into_iter()
             .zip(3u64..)
-            .map(|(entry, d_next)| {
-                let filesystem::DirectoryEntry { inode, type_, name } = entry.map_err(|e| {
+        {
+            let filesystem::DirectoryEntry { type_, name } = entry.map_err(|e| {
+                e.try_into()
+                    .context("failed to inspect `read-directory` entry")
+                    .unwrap_or_else(types::Error::trap)
+            })?;
+            let metadata_hash = self
+                .metadata_hash_at(fd, filesystem::PathFlags::empty(), name.clone())
+                .await
+                .map_err(|e| {
                     e.try_into()
-                        .context("failed to inspect `read-directory` entry")
+                        .context("failed to call `metadata-hash-at`")
                         .unwrap_or_else(types::Error::trap)
                 })?;
-                let d_type = type_.try_into().map_err(types::Error::trap)?;
-                let d_namlen: u32 = name.len().try_into().map_err(|_| types::Errno::Overflow)?;
-                Ok((
-                    types::Dirent {
-                        d_next: d_next.to_le(),
-                        d_ino: inode.unwrap_or_default().to_le(),
-                        d_type, // endian-invariant
-                        d_namlen: d_namlen.to_le(),
-                    },
-                    name,
-                ))
-            });
+            let d_type = type_.try_into().map_err(types::Error::trap)?;
+            let d_namlen: u32 = name.len().try_into().map_err(|_| types::Errno::Overflow)?;
+            dir.push((
+                types::Dirent {
+                    d_next: d_next.to_le(),
+                    d_ino: metadata_hash.lower.to_le(),
+                    d_type, // endian-invariant
+                    d_namlen: d_namlen.to_le(),
+                },
+                name,
+            ))
+        }
 
         // assume that `types::Dirent` size always fits in `u32`
         const DIRENT_SIZE: u32 = size_of::<types::Dirent>() as _;
@@ -1469,9 +1482,7 @@ impl<
         );
         let mut buf = *buf;
         let mut cap = buf_len;
-        for entry in head.chain(dir).skip(cookie) {
-            let (ref entry, mut path) = entry?;
-
+        for (ref entry, mut path) in head.into_iter().chain(dir.into_iter()).skip(cookie) {
             assert_eq!(
                 1,
                 size_of_val(&entry.d_type),
@@ -1526,26 +1537,35 @@ impl<
         let dirfd = self.get_dir_fd(dirfd)?;
         let path = read_string(path)?;
         let filesystem::DescriptorStat {
-            device: dev,
-            inode: ino,
             type_,
             link_count: nlink,
             size,
             data_access_timestamp,
             data_modification_timestamp,
             status_change_timestamp,
-        } = self.stat_at(dirfd, flags.into(), path).await.map_err(|e| {
-            e.try_into()
-                .context("failed to call `stat-at`")
-                .unwrap_or_else(types::Error::trap)
-        })?;
+        } = self
+            .stat_at(dirfd, flags.into(), path.clone())
+            .await
+            .map_err(|e| {
+                e.try_into()
+                    .context("failed to call `stat-at`")
+                    .unwrap_or_else(types::Error::trap)
+            })?;
+        let metadata_hash = self
+            .metadata_hash_at(dirfd, flags.into(), path)
+            .await
+            .map_err(|e| {
+                e.try_into()
+                    .context("failed to call `metadata-hash-at`")
+                    .unwrap_or_else(types::Error::trap)
+            })?;
         let filetype = type_.try_into().map_err(types::Error::trap)?;
         let atim = data_access_timestamp.try_into()?;
         let mtim = data_modification_timestamp.try_into()?;
         let ctim = status_change_timestamp.try_into()?;
         Ok(types::Filestat {
-            dev,
-            ino,
+            dev: 1,
+            ino: metadata_hash.lower,
             filetype,
             nlink,
             size,
@@ -1769,7 +1789,7 @@ impl<
         path: &GuestPtr<'a, str>,
     ) -> Result<(), types::Error> {
         let dirfd = self.get_dir_fd(dirfd)?;
-        let path = path.as_cow().map_err(|_| types::Errno::Inval)?.to_string();
+        let path = path.as_cow()?.to_string();
         self.unlink_file_at(dirfd, path).await.map_err(|e| {
             e.try_into()
                 .context("failed to call `unlink-file-at`")
diff --git a/crates/wasi/src/preview2/preview2/env.rs b/crates/wasi/src/preview2/preview2/env.rs
index 329c0dd08fe1..edb4d118d979 100644
--- a/crates/wasi/src/preview2/preview2/env.rs
+++ b/crates/wasi/src/preview2/preview2/env.rs
@@ -1,5 +1,4 @@
-use crate::preview2::bindings::cli_base::{environment, preopens, stderr, stdin, stdout};
-use crate::preview2::bindings::filesystem::filesystem;
+use crate::preview2::bindings::cli_base::{environment, stderr, stdin, stdout};
 use crate::preview2::bindings::io::streams;
 use crate::preview2::WasiView;
 
@@ -12,12 +11,6 @@ impl<T: WasiView> environment::Host for T {
     }
 }
 
-impl<T: WasiView> preopens::Host for T {
-    fn get_directories(&mut self) -> Result<Vec<(filesystem::Descriptor, String)>, anyhow::Error> {
-        Ok(self.ctx().preopens.clone())
-    }
-}
-
 impl<T: WasiView> stdin::Host for T {
     fn get_stdin(&mut self) -> Result<streams::InputStream, anyhow::Error> {
         Ok(self.ctx().stdin)
diff --git a/crates/wasi/src/preview2/preview2/filesystem.rs b/crates/wasi/src/preview2/preview2/filesystem.rs
index 27f40c7d9393..1fc1e17e22f8 100644
--- a/crates/wasi/src/preview2/preview2/filesystem.rs
+++ b/crates/wasi/src/preview2/preview2/filesystem.rs
@@ -1,30 +1,36 @@
 use crate::preview2::bindings::clocks::wall_clock;
-use crate::preview2::bindings::filesystem::filesystem;
+use crate::preview2::bindings::filesystem::{preopens, types};
 use crate::preview2::bindings::io::streams;
 use crate::preview2::filesystem::{Dir, File, TableFsExt};
 use crate::preview2::{DirPerms, FilePerms, Table, TableError, WasiView};
 
-use filesystem::ErrorCode;
+use types::ErrorCode;
 
 mod sync;
 
-impl From<TableError> for filesystem::Error {
+impl From<TableError> for types::Error {
     fn from(error: TableError) -> Self {
         Self::trap(error.into())
     }
 }
 
+impl<T: WasiView> preopens::Host for T {
+    fn get_directories(&mut self) -> Result<Vec<(types::Descriptor, String)>, anyhow::Error> {
+        Ok(self.ctx().preopens.clone())
+    }
+}
+
 #[async_trait::async_trait]
-impl<T: WasiView> filesystem::Host for T {
+impl<T: WasiView> types::Host for T {
     async fn advise(
         &mut self,
-        fd: filesystem::Descriptor,
-        offset: filesystem::Filesize,
-        len: filesystem::Filesize,
-        advice: filesystem::Advice,
-    ) -> Result<(), filesystem::Error> {
-        use filesystem::Advice;
+        fd: types::Descriptor,
+        offset: types::Filesize,
+        len: types::Filesize,
+        advice: types::Advice,
+    ) -> Result<(), types::Error> {
         use system_interface::fs::{Advice as A, FileIoExt};
+        use types::Advice;
 
         let advice = match advice {
             Advice::Normal => A::Normal,
@@ -41,7 +47,7 @@ impl<T: WasiView> filesystem::Host for T {
         Ok(())
     }
 
-    async fn sync_data(&mut self, fd: filesystem::Descriptor) -> Result<(), filesystem::Error> {
+    async fn sync_data(&mut self, fd: types::Descriptor) -> Result<(), types::Error> {
         let table = self.table();
         if table.is_file(fd) {
             let f = table.get_file(fd)?;
@@ -70,10 +76,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn get_flags(
         &mut self,
-        fd: filesystem::Descriptor,
-    ) -> Result<filesystem::DescriptorFlags, filesystem::Error> {
-        use filesystem::DescriptorFlags;
+        fd: types::Descriptor,
+    ) -> Result<types::DescriptorFlags, types::Error> {
         use system_interface::fs::{FdFlags, GetSetFdFlags};
+        use types::DescriptorFlags;
 
         fn get_from_fdflags(flags: FdFlags) -> DescriptorFlags {
             let mut out = DescriptorFlags::empty();
@@ -119,8 +125,8 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn get_type(
         &mut self,
-        fd: filesystem::Descriptor,
-    ) -> Result<filesystem::DescriptorType, filesystem::Error> {
+        fd: types::Descriptor,
+    ) -> Result<types::DescriptorType, types::Error> {
         let table = self.table();
 
         if table.is_file(fd) {
@@ -128,7 +134,7 @@ impl<T: WasiView> filesystem::Host for T {
             let meta = f.spawn_blocking(|f| f.metadata()).await?;
             Ok(descriptortype_from(meta.file_type()))
         } else if table.is_dir(fd) {
-            Ok(filesystem::DescriptorType::Directory)
+            Ok(types::DescriptorType::Directory)
         } else {
             Err(ErrorCode::BadDescriptor.into())
         }
@@ -136,9 +142,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn set_size(
         &mut self,
-        fd: filesystem::Descriptor,
-        size: filesystem::Filesize,
-    ) -> Result<(), filesystem::Error> {
+        fd: types::Descriptor,
+        size: types::Filesize,
+    ) -> Result<(), types::Error> {
         let f = self.table().get_file(fd)?;
         if !f.perms.contains(FilePerms::WRITE) {
             Err(ErrorCode::NotPermitted)?;
@@ -149,10 +155,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn set_times(
         &mut self,
-        fd: filesystem::Descriptor,
-        atim: filesystem::NewTimestamp,
-        mtim: filesystem::NewTimestamp,
-    ) -> Result<(), filesystem::Error> {
+        fd: types::Descriptor,
+        atim: types::NewTimestamp,
+        mtim: types::NewTimestamp,
+    ) -> Result<(), types::Error> {
         use fs_set_times::SetTimes;
 
         let table = self.table();
@@ -181,10 +187,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn read(
         &mut self,
-        fd: filesystem::Descriptor,
-        len: filesystem::Filesize,
-        offset: filesystem::Filesize,
-    ) -> Result<(Vec<u8>, bool), filesystem::Error> {
+        fd: types::Descriptor,
+        len: types::Filesize,
+        offset: types::Filesize,
+    ) -> Result<(Vec<u8>, bool), types::Error> {
         use std::io::IoSliceMut;
         use system_interface::fs::FileIoExt;
 
@@ -216,10 +222,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn write(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         buf: Vec<u8>,
-        offset: filesystem::Filesize,
-    ) -> Result<filesystem::Filesize, filesystem::Error> {
+        offset: types::Filesize,
+    ) -> Result<types::Filesize, types::Error> {
         use std::io::IoSlice;
         use system_interface::fs::FileIoExt;
 
@@ -233,15 +239,13 @@ impl<T: WasiView> filesystem::Host for T {
             .spawn_blocking(move |f| f.write_vectored_at(&[IoSlice::new(&buf)], offset))
             .await?;
 
-        Ok(filesystem::Filesize::try_from(bytes_written).expect("usize fits in Filesize"))
+        Ok(types::Filesize::try_from(bytes_written).expect("usize fits in Filesize"))
     }
 
     async fn read_directory(
         &mut self,
-        fd: filesystem::Descriptor,
-    ) -> Result<filesystem::DirectoryEntryStream, filesystem::Error> {
-        use cap_fs_ext::{DirEntryExt, MetadataExt};
-
+        fd: types::Descriptor,
+    ) -> Result<types::DirectoryEntryStream, types::Error> {
         let table = self.table_mut();
         let d = table.get_dir(fd)?;
         if !d.perms.contains(DirPerms::READ) {
@@ -260,23 +264,22 @@ impl<T: WasiView> filesystem::Host for T {
 
         let entries = d
             .spawn_blocking(|d| {
-                // Both `entries` and `full_metadata` perform syscalls, which is why they are done
-                // within this `block` call, rather than delay calculating the full metadata
+                // Both `entries` and `metadata` perform syscalls, which is why they are done
+                // within this `block` call, rather than delay calculating the metadata
                 // for entries when they're demanded later in the iterator chain.
                 Ok::<_, std::io::Error>(
                     d.entries()?
                         .map(|entry| {
                             let entry = entry?;
-                            let meta = entry.full_metadata()?;
-                            let inode = Some(meta.ino());
+                            let meta = entry.metadata()?;
                             let type_ = descriptortype_from(meta.file_type());
                             let name = entry
                                 .file_name()
                                 .into_string()
                                 .map_err(|_| ReaddirError::IllegalSequence)?;
-                            Ok(filesystem::DirectoryEntry { inode, type_, name })
+                            Ok(types::DirectoryEntry { type_, name })
                         })
-                        .collect::<Vec<Result<filesystem::DirectoryEntry, ReaddirError>>>(),
+                        .collect::<Vec<Result<types::DirectoryEntry, ReaddirError>>>(),
                 )
             })
             .await?
@@ -298,7 +301,7 @@ impl<T: WasiView> filesystem::Host for T {
         });
         let entries = entries.map(|r| match r {
             Ok(r) => Ok(r),
-            Err(ReaddirError::Io(e)) => Err(filesystem::Error::from(e)),
+            Err(ReaddirError::Io(e)) => Err(types::Error::from(e)),
             Err(ReaddirError::IllegalSequence) => Err(ErrorCode::IllegalByteSequence.into()),
         });
         Ok(table.push_readdir(ReaddirIterator::new(entries))?)
@@ -306,8 +309,8 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn read_directory_entry(
         &mut self,
-        stream: filesystem::DirectoryEntryStream,
-    ) -> Result<Option<filesystem::DirectoryEntry>, filesystem::Error> {
+        stream: types::DirectoryEntryStream,
+    ) -> Result<Option<types::DirectoryEntry>, types::Error> {
         let table = self.table();
         let readdir = table.get_readdir(stream)?;
         readdir.next()
@@ -315,13 +318,13 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn drop_directory_entry_stream(
         &mut self,
-        stream: filesystem::DirectoryEntryStream,
+        stream: types::DirectoryEntryStream,
     ) -> anyhow::Result<()> {
         self.table_mut().delete_readdir(stream)?;
         Ok(())
     }
 
-    async fn sync(&mut self, fd: filesystem::Descriptor) -> Result<(), filesystem::Error> {
+    async fn sync(&mut self, fd: types::Descriptor) -> Result<(), types::Error> {
         let table = self.table();
         if table.is_file(fd) {
             let f = table.get_file(fd)?;
@@ -350,9 +353,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn create_directory_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         let table = self.table();
         let d = table.get_dir(fd)?;
         if !d.perms.contains(DirPerms::MUTATE) {
@@ -362,10 +365,7 @@ impl<T: WasiView> filesystem::Host for T {
         Ok(())
     }
 
-    async fn stat(
-        &mut self,
-        fd: filesystem::Descriptor,
-    ) -> Result<filesystem::DescriptorStat, filesystem::Error> {
+    async fn stat(&mut self, fd: types::Descriptor) -> Result<types::DescriptorStat, types::Error> {
         let table = self.table();
         if table.is_file(fd) {
             let f = table.get_file(fd)?;
@@ -384,10 +384,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn stat_at(
         &mut self,
-        fd: filesystem::Descriptor,
-        path_flags: filesystem::PathFlags,
+        fd: types::Descriptor,
+        path_flags: types::PathFlags,
         path: String,
-    ) -> Result<filesystem::DescriptorStat, filesystem::Error> {
+    ) -> Result<types::DescriptorStat, types::Error> {
         let table = self.table();
         let d = table.get_dir(fd)?;
         if !d.perms.contains(DirPerms::READ) {
@@ -404,12 +404,12 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn set_times_at(
         &mut self,
-        fd: filesystem::Descriptor,
-        path_flags: filesystem::PathFlags,
+        fd: types::Descriptor,
+        path_flags: types::PathFlags,
         path: String,
-        atim: filesystem::NewTimestamp,
-        mtim: filesystem::NewTimestamp,
-    ) -> Result<(), filesystem::Error> {
+        atim: types::NewTimestamp,
+        mtim: types::NewTimestamp,
+    ) -> Result<(), types::Error> {
         use cap_fs_ext::DirExt;
 
         let table = self.table();
@@ -443,13 +443,13 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn link_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         // TODO delete the path flags from this function
-        old_path_flags: filesystem::PathFlags,
+        old_path_flags: types::PathFlags,
         old_path: String,
-        new_descriptor: filesystem::Descriptor,
+        new_descriptor: types::Descriptor,
         new_path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         let table = self.table();
         let old_dir = table.get_dir(fd)?;
         if !old_dir.perms.contains(DirPerms::MUTATE) {
@@ -471,18 +471,18 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn open_at(
         &mut self,
-        fd: filesystem::Descriptor,
-        path_flags: filesystem::PathFlags,
+        fd: types::Descriptor,
+        path_flags: types::PathFlags,
         path: String,
-        oflags: filesystem::OpenFlags,
-        flags: filesystem::DescriptorFlags,
+        oflags: types::OpenFlags,
+        flags: types::DescriptorFlags,
         // TODO: These are the permissions to use when creating a new file.
         // Not implemented yet.
-        _mode: filesystem::Modes,
-    ) -> Result<filesystem::Descriptor, filesystem::Error> {
+        _mode: types::Modes,
+    ) -> Result<types::Descriptor, types::Error> {
         use cap_fs_ext::{FollowSymlinks, OpenOptionsFollowExt, OpenOptionsMaybeDirExt};
-        use filesystem::{DescriptorFlags, OpenFlags};
         use system_interface::fs::{FdFlags, GetSetFdFlags};
+        use types::{DescriptorFlags, OpenFlags};
 
         let table = self.table_mut();
         if table.is_file(fd) {
@@ -587,7 +587,7 @@ impl<T: WasiView> filesystem::Host for T {
         }
     }
 
-    async fn drop_descriptor(&mut self, fd: filesystem::Descriptor) -> anyhow::Result<()> {
+    async fn drop_descriptor(&mut self, fd: types::Descriptor) -> anyhow::Result<()> {
         let table = self.table_mut();
 
         // The Drop will close the file/dir, but if the close syscall
@@ -604,9 +604,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn readlink_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         path: String,
-    ) -> Result<String, filesystem::Error> {
+    ) -> Result<String, types::Error> {
         let table = self.table();
         let d = table.get_dir(fd)?;
         if !d.perms.contains(DirPerms::READ) {
@@ -621,9 +621,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn remove_directory_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         let table = self.table();
         let d = table.get_dir(fd)?;
         if !d.perms.contains(DirPerms::MUTATE) {
@@ -634,11 +634,11 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn rename_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         old_path: String,
-        new_fd: filesystem::Descriptor,
+        new_fd: types::Descriptor,
         new_path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         let table = self.table();
         let old_dir = table.get_dir(fd)?;
         if !old_dir.perms.contains(DirPerms::MUTATE) {
@@ -656,10 +656,10 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn symlink_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         src_path: String,
         dest_path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         // On windows, Dir.symlink is provided by DirExt
         #[cfg(windows)]
         use cap_fs_ext::DirExt;
@@ -675,9 +675,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn unlink_file_at(
         &mut self,
-        fd: filesystem::Descriptor,
+        fd: types::Descriptor,
         path: String,
-    ) -> Result<(), filesystem::Error> {
+    ) -> Result<(), types::Error> {
         use cap_fs_ext::DirExt;
 
         let table = self.table();
@@ -691,68 +691,59 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn access_at(
         &mut self,
-        _fd: filesystem::Descriptor,
-        _path_flags: filesystem::PathFlags,
+        _fd: types::Descriptor,
+        _path_flags: types::PathFlags,
         _path: String,
-        _access: filesystem::AccessType,
-    ) -> Result<(), filesystem::Error> {
+        _access: types::AccessType,
+    ) -> Result<(), types::Error> {
         todo!("filesystem access_at is not implemented")
     }
 
     async fn change_file_permissions_at(
         &mut self,
-        _fd: filesystem::Descriptor,
-        _path_flags: filesystem::PathFlags,
+        _fd: types::Descriptor,
+        _path_flags: types::PathFlags,
         _path: String,
-        _mode: filesystem::Modes,
-    ) -> Result<(), filesystem::Error> {
+        _mode: types::Modes,
+    ) -> Result<(), types::Error> {
         todo!("filesystem change_file_permissions_at is not implemented")
     }
 
     async fn change_directory_permissions_at(
         &mut self,
-        _fd: filesystem::Descriptor,
-        _path_flags: filesystem::PathFlags,
+        _fd: types::Descriptor,
+        _path_flags: types::PathFlags,
         _path: String,
-        _mode: filesystem::Modes,
-    ) -> Result<(), filesystem::Error> {
+        _mode: types::Modes,
+    ) -> Result<(), types::Error> {
         todo!("filesystem change_directory_permissions_at is not implemented")
     }
 
-    async fn lock_shared(&mut self, _fd: filesystem::Descriptor) -> Result<(), filesystem::Error> {
+    async fn lock_shared(&mut self, _fd: types::Descriptor) -> Result<(), types::Error> {
         todo!("filesystem lock_shared is not implemented")
     }
 
-    async fn lock_exclusive(
-        &mut self,
-        _fd: filesystem::Descriptor,
-    ) -> Result<(), filesystem::Error> {
+    async fn lock_exclusive(&mut self, _fd: types::Descriptor) -> Result<(), types::Error> {
         todo!("filesystem lock_exclusive is not implemented")
     }
 
-    async fn try_lock_shared(
-        &mut self,
-        _fd: filesystem::Descriptor,
-    ) -> Result<(), filesystem::Error> {
+    async fn try_lock_shared(&mut self, _fd: types::Descriptor) -> Result<(), types::Error> {
         todo!("filesystem try_lock_shared is not implemented")
     }
 
-    async fn try_lock_exclusive(
-        &mut self,
-        _fd: filesystem::Descriptor,
-    ) -> Result<(), filesystem::Error> {
+    async fn try_lock_exclusive(&mut self, _fd: types::Descriptor) -> Result<(), types::Error> {
         todo!("filesystem try_lock_exclusive is not implemented")
     }
 
-    async fn unlock(&mut self, _fd: filesystem::Descriptor) -> Result<(), filesystem::Error> {
+    async fn unlock(&mut self, _fd: types::Descriptor) -> Result<(), types::Error> {
         todo!("filesystem unlock is not implemented")
     }
 
     async fn read_via_stream(
         &mut self,
-        fd: filesystem::Descriptor,
-        offset: filesystem::Filesize,
-    ) -> Result<streams::InputStream, filesystem::Error> {
+        fd: types::Descriptor,
+        offset: types::Filesize,
+    ) -> Result<streams::InputStream, types::Error> {
         use crate::preview2::{
             filesystem::FileInputStream,
             stream::{InternalInputStream, InternalTableStreamExt},
@@ -762,7 +753,7 @@ impl<T: WasiView> filesystem::Host for T {
         let f = self.table().get_file(fd)?;
 
         if !f.perms.contains(FilePerms::READ) {
-            Err(filesystem::ErrorCode::BadDescriptor)?;
+            Err(types::ErrorCode::BadDescriptor)?;
         }
         // Duplicate the file descriptor so that we get an indepenent lifetime.
         let clone = std::sync::Arc::clone(&f.file);
@@ -780,9 +771,9 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn write_via_stream(
         &mut self,
-        fd: filesystem::Descriptor,
-        offset: filesystem::Filesize,
-    ) -> Result<streams::OutputStream, filesystem::Error> {
+        fd: types::Descriptor,
+        offset: types::Filesize,
+    ) -> Result<streams::OutputStream, types::Error> {
         use crate::preview2::{
             filesystem::FileOutputStream,
             stream::{InternalOutputStream, InternalTableStreamExt},
@@ -792,7 +783,7 @@ impl<T: WasiView> filesystem::Host for T {
         let f = self.table().get_file(fd)?;
 
         if !f.perms.contains(FilePerms::WRITE) {
-            Err(filesystem::ErrorCode::BadDescriptor)?;
+            Err(types::ErrorCode::BadDescriptor)?;
         }
 
         // Duplicate the file descriptor so that we get an indepenent lifetime.
@@ -811,8 +802,8 @@ impl<T: WasiView> filesystem::Host for T {
 
     async fn append_via_stream(
         &mut self,
-        fd: filesystem::Descriptor,
-    ) -> Result<streams::OutputStream, filesystem::Error> {
+        fd: types::Descriptor,
+    ) -> Result<streams::OutputStream, types::Error> {
         use crate::preview2::{
             filesystem::FileOutputStream,
             stream::{InternalOutputStream, InternalTableStreamExt},
@@ -822,7 +813,7 @@ impl<T: WasiView> filesystem::Host for T {
         let f = self.table().get_file(fd)?;
 
         if !f.perms.contains(FilePerms::WRITE) {
-            Err(filesystem::ErrorCode::BadDescriptor)?;
+            Err(types::ErrorCode::BadDescriptor)?;
         }
         // Duplicate the file descriptor so that we get an indepenent lifetime.
         let clone = std::sync::Arc::clone(&f.file);
@@ -837,10 +828,106 @@ impl<T: WasiView> filesystem::Host for T {
 
         Ok(index)
     }
+
+    async fn is_same_object(
+        &mut self,
+        a: types::Descriptor,
+        b: types::Descriptor,
+    ) -> anyhow::Result<bool> {
+        use cap_fs_ext::MetadataExt;
+        let table = self.table();
+        let meta_a = get_descriptor_metadata(table, a).await?;
+        let meta_b = get_descriptor_metadata(table, b).await?;
+        if meta_a.dev() == meta_b.dev() && meta_a.ino() == meta_b.ino() {
+            // MetadataHashValue does not derive eq, so use a pair of
+            // comparisons to check equality:
+            debug_assert_eq!(
+                calculate_metadata_hash(&meta_a).upper,
+                calculate_metadata_hash(&meta_b).upper
+            );
+            debug_assert_eq!(
+                calculate_metadata_hash(&meta_a).lower,
+                calculate_metadata_hash(&meta_b).lower
+            );
+            Ok(true)
+        } else {
+            // Hash collisions are possible, so don't assert the negative here
+            Ok(false)
+        }
+    }
+    async fn metadata_hash(
+        &mut self,
+        fd: types::Descriptor,
+    ) -> Result<types::MetadataHashValue, types::Error> {
+        let table = self.table();
+        let meta = get_descriptor_metadata(table, fd).await?;
+        Ok(calculate_metadata_hash(&meta))
+    }
+    async fn metadata_hash_at(
+        &mut self,
+        fd: types::Descriptor,
+        path_flags: types::PathFlags,
+        path: String,
+    ) -> Result<types::MetadataHashValue, types::Error> {
+        let table = self.table();
+        let d = table.get_dir(fd)?;
+        // No permissions check on metadata: if dir opened, allowed to stat it
+        let meta = d
+            .spawn_blocking(move |d| {
+                if symlink_follow(path_flags) {
+                    d.metadata(path)
+                } else {
+                    d.symlink_metadata(path)
+                }
+            })
+            .await?;
+        Ok(calculate_metadata_hash(&meta))
+    }
+}
+
+async fn get_descriptor_metadata(
+    table: &Table,
+    fd: types::Descriptor,
+) -> Result<cap_std::fs::Metadata, types::Error> {
+    if table.is_file(fd) {
+        let f = table.get_file(fd)?;
+        // No permissions check on metadata: if opened, allowed to stat it
+        Ok(f.spawn_blocking(|f| f.metadata()).await?)
+    } else if table.is_dir(fd) {
+        let d = table.get_dir(fd)?;
+        // No permissions check on metadata: if opened, allowed to stat it
+        Ok(d.spawn_blocking(|d| d.dir_metadata()).await?)
+    } else {
+        Err(ErrorCode::BadDescriptor.into())
+    }
+}
+
+fn calculate_metadata_hash(meta: &cap_std::fs::Metadata) -> types::MetadataHashValue {
+    use cap_fs_ext::MetadataExt;
+    // Without incurring any deps, std provides us with a 64 bit hash
+    // function:
+    use std::hash::Hasher;
+    // Note that this means that the metadata hash (which becomes a preview1 ino) may
+    // change when a different rustc release is used to build this host implementation:
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    hasher.write_u64(meta.dev());
+    hasher.write_u64(meta.ino());
+    let lower = hasher.finish();
+    // MetadataHashValue has a pair of 64-bit members for representing a
+    // single 128-bit number. However, we only have 64 bits of entropy. To
+    // synthesize the upper 64 bits, lets xor the lower half with an arbitrary
+    // constant, in this case the 64 bit integer corresponding to the IEEE
+    // double representation of (a number as close as possible to) pi.
+    // This seems better than just repeating the same bits in the upper and
+    // lower parts outright, which could make folks wonder if the struct was
+    // mangled in the ABI, or worse yet, lead to consumers of this interface
+    // expecting them to be equal.
+    let upper = lower ^ 4614256656552045848u64;
+    types::MetadataHashValue { lower, upper }
 }
 
 #[cfg(unix)]
-fn from_raw_os_error(err: Option<i32>) -> Option<filesystem::Error> {
+fn from_raw_os_error(err: Option<i32>) -> Option<types::Error> {
     use rustix::io::Errno as RustixErrno;
     if err.is_none() {
         return None;
@@ -880,7 +967,7 @@ fn from_raw_os_error(err: Option<i32>) -> Option<filesystem::Error> {
     })
 }
 #[cfg(windows)]
-fn from_raw_os_error(raw_os_error: Option<i32>) -> Option<filesystem::Error> {
+fn from_raw_os_error(raw_os_error: Option<i32>) -> Option<types::Error> {
     use windows_sys::Win32::Foundation;
     Some(match raw_os_error.map(|code| code as u32) {
         Some(Foundation::ERROR_FILE_NOT_FOUND) => ErrorCode::NoEntry.into(),
@@ -909,8 +996,8 @@ fn from_raw_os_error(raw_os_error: Option<i32>) -> Option<filesystem::Error> {
     })
 }
 
-impl From<std::io::Error> for filesystem::Error {
-    fn from(err: std::io::Error) -> filesystem::Error {
+impl From<std::io::Error> for types::Error {
+    fn from(err: std::io::Error) -> types::Error {
         match from_raw_os_error(err.raw_os_error()) {
             Some(errno) => errno,
             None => match err.kind() {
@@ -918,29 +1005,28 @@ impl From<std::io::Error> for filesystem::Error {
                 std::io::ErrorKind::PermissionDenied => ErrorCode::NotPermitted.into(),
                 std::io::ErrorKind::AlreadyExists => ErrorCode::Exist.into(),
                 std::io::ErrorKind::InvalidInput => ErrorCode::Invalid.into(),
-                _ => filesystem::Error::trap(anyhow::anyhow!(err).context("Unknown OS error")),
+                _ => types::Error::trap(anyhow::anyhow!(err).context("Unknown OS error")),
             },
         }
     }
 }
 
-impl From<cap_rand::Error> for filesystem::Error {
-    fn from(err: cap_rand::Error) -> filesystem::Error {
+impl From<cap_rand::Error> for types::Error {
+    fn from(err: cap_rand::Error) -> types::Error {
         // I picked Error::Io as a 'reasonable default', FIXME dan is this ok?
-        from_raw_os_error(err.raw_os_error())
-            .unwrap_or_else(|| filesystem::Error::from(ErrorCode::Io))
+        from_raw_os_error(err.raw_os_error()).unwrap_or_else(|| types::Error::from(ErrorCode::Io))
     }
 }
 
-impl From<std::num::TryFromIntError> for filesystem::Error {
-    fn from(_err: std::num::TryFromIntError) -> filesystem::Error {
+impl From<std::num::TryFromIntError> for types::Error {
+    fn from(_err: std::num::TryFromIntError) -> types::Error {
         ErrorCode::Overflow.into()
     }
 }
 
-fn descriptortype_from(ft: cap_std::fs::FileType) -> filesystem::DescriptorType {
+fn descriptortype_from(ft: cap_std::fs::FileType) -> types::DescriptorType {
     use cap_fs_ext::FileTypeExt;
-    use filesystem::DescriptorType;
+    use types::DescriptorType;
     if ft.is_dir() {
         DescriptorType::Directory
     } else if ft.is_symlink() {
@@ -957,10 +1043,10 @@ fn descriptortype_from(ft: cap_std::fs::FileType) -> filesystem::DescriptorType
 }
 
 fn systemtimespec_from(
-    t: filesystem::NewTimestamp,
-) -> Result<Option<fs_set_times::SystemTimeSpec>, filesystem::Error> {
-    use filesystem::NewTimestamp;
+    t: types::NewTimestamp,
+) -> Result<Option<fs_set_times::SystemTimeSpec>, types::Error> {
     use fs_set_times::SystemTimeSpec;
+    use types::NewTimestamp;
     match t {
         NewTimestamp::NoChange => Ok(None),
         NewTimestamp::Now => Ok(Some(SystemTimeSpec::SymbolicNow)),
@@ -968,7 +1054,7 @@ fn systemtimespec_from(
     }
 }
 
-fn systemtime_from(t: wall_clock::Datetime) -> Result<std::time::SystemTime, filesystem::Error> {
+fn systemtime_from(t: wall_clock::Datetime) -> Result<std::time::SystemTime, types::Error> {
     use std::time::{Duration, SystemTime};
     SystemTime::UNIX_EPOCH
         .checked_add(Duration::new(t.seconds, t.nanoseconds))
@@ -980,13 +1066,9 @@ fn datetime_from(t: std::time::SystemTime) -> wall_clock::Datetime {
     wall_clock::Datetime::try_from(cap_std::time::SystemTime::from_std(t)).unwrap()
 }
 
-fn descriptorstat_from(meta: cap_std::fs::Metadata) -> filesystem::DescriptorStat {
+fn descriptorstat_from(meta: cap_std::fs::Metadata) -> types::DescriptorStat {
     use cap_fs_ext::MetadataExt;
-    filesystem::DescriptorStat {
-        // FIXME didn't we agree that the wit could be changed to make the device and ino fields
-        // optional?
-        device: meta.dev(),
-        inode: meta.ino(),
+    types::DescriptorStat {
         type_: descriptortype_from(meta.file_type()),
         link_count: meta.nlink(),
         size: meta.len(),
@@ -1015,34 +1097,30 @@ fn descriptorstat_from(meta: cap_std::fs::Metadata) -> filesystem::DescriptorSta
     }
 }
 
-fn symlink_follow(path_flags: filesystem::PathFlags) -> bool {
-    path_flags.contains(filesystem::PathFlags::SYMLINK_FOLLOW)
+fn symlink_follow(path_flags: types::PathFlags) -> bool {
+    path_flags.contains(types::PathFlags::SYMLINK_FOLLOW)
 }
 
 pub(crate) struct ReaddirIterator(
     std::sync::Mutex<
-        Box<
-            dyn Iterator<Item = Result<filesystem::DirectoryEntry, filesystem::Error>>
-                + Send
-                + 'static,
-        >,
+        Box<dyn Iterator<Item = Result<types::DirectoryEntry, types::Error>> + Send + 'static>,
     >,
 );
 
 impl ReaddirIterator {
     fn new(
-        i: impl Iterator<Item = Result<filesystem::DirectoryEntry, filesystem::Error>> + Send + 'static,
+        i: impl Iterator<Item = Result<types::DirectoryEntry, types::Error>> + Send + 'static,
     ) -> Self {
         ReaddirIterator(std::sync::Mutex::new(Box::new(i)))
     }
-    fn next(&self) -> Result<Option<filesystem::DirectoryEntry>, filesystem::Error> {
+    fn next(&self) -> Result<Option<types::DirectoryEntry>, types::Error> {
         self.0.lock().unwrap().next().transpose()
     }
 }
 
 impl IntoIterator for ReaddirIterator {
-    type Item = Result<filesystem::DirectoryEntry, filesystem::Error>;
-    type IntoIter = Box<dyn Iterator<Item = Self::Item>>;
+    type Item = Result<types::DirectoryEntry, types::Error>;
+    type IntoIter = Box<dyn Iterator<Item = Self::Item> + Send>;
 
     fn into_iter(self) -> Self::IntoIter {
         self.0.into_inner().unwrap()
@@ -1068,8 +1146,8 @@ impl TableReaddirExt for Table {
     }
 }
 
-fn mask_file_perms(p: FilePerms, flags: filesystem::DescriptorFlags) -> FilePerms {
-    use filesystem::DescriptorFlags;
+fn mask_file_perms(p: FilePerms, flags: types::DescriptorFlags) -> FilePerms {
+    use types::DescriptorFlags;
     let mut out = FilePerms::empty();
     if p.contains(FilePerms::READ) && flags.contains(DescriptorFlags::READ) {
         out |= FilePerms::READ;
diff --git a/crates/wasi/src/preview2/preview2/filesystem/sync.rs b/crates/wasi/src/preview2/preview2/filesystem/sync.rs
index 64f5973b32ef..d535f76b7a0f 100644
--- a/crates/wasi/src/preview2/preview2/filesystem/sync.rs
+++ b/crates/wasi/src/preview2/preview2/filesystem/sync.rs
@@ -1,5 +1,5 @@
-use crate::preview2::bindings::filesystem::filesystem as async_filesystem;
-use crate::preview2::bindings::sync_io::filesystem::filesystem as sync_filesystem;
+use crate::preview2::bindings::filesystem::types as async_filesystem;
+use crate::preview2::bindings::sync_io::filesystem::types as sync_filesystem;
 use crate::preview2::bindings::sync_io::io::streams;
 use crate::preview2::in_tokio;
 
@@ -388,6 +388,33 @@ impl<T: async_filesystem::Host> sync_filesystem::Host for T {
             async_filesystem::Host::append_via_stream(self, fd).await
         })?)
     }
+
+    fn is_same_object(
+        &mut self,
+        a: sync_filesystem::Descriptor,
+        b: sync_filesystem::Descriptor,
+    ) -> anyhow::Result<bool> {
+        Ok(in_tokio(async {
+            async_filesystem::Host::is_same_object(self, a, b).await
+        })?)
+    }
+    fn metadata_hash(
+        &mut self,
+        fd: sync_filesystem::Descriptor,
+    ) -> Result<sync_filesystem::MetadataHashValue, sync_filesystem::Error> {
+        Ok(in_tokio(async { async_filesystem::Host::metadata_hash(self, fd).await })?.into())
+    }
+    fn metadata_hash_at(
+        &mut self,
+        fd: sync_filesystem::Descriptor,
+        path_flags: sync_filesystem::PathFlags,
+        path: String,
+    ) -> Result<sync_filesystem::MetadataHashValue, sync_filesystem::Error> {
+        Ok(in_tokio(async {
+            async_filesystem::Host::metadata_hash_at(self, fd, path_flags.into(), path).await
+        })?
+        .into())
+    }
 }
 
 impl From<async_filesystem::ErrorCode> for sync_filesystem::ErrorCode {
@@ -502,7 +529,6 @@ impl From<async_filesystem::DescriptorType> for sync_filesystem::DescriptorType
 impl From<async_filesystem::DirectoryEntry> for sync_filesystem::DirectoryEntry {
     fn from(other: async_filesystem::DirectoryEntry) -> Self {
         Self {
-            inode: other.inode,
             type_: other.type_.into(),
             name: other.name,
         }
@@ -512,8 +538,6 @@ impl From<async_filesystem::DirectoryEntry> for sync_filesystem::DirectoryEntry
 impl From<async_filesystem::DescriptorStat> for sync_filesystem::DescriptorStat {
     fn from(other: async_filesystem::DescriptorStat) -> Self {
         Self {
-            device: other.device,
-            inode: other.inode,
             type_: other.type_.into(),
             link_count: other.link_count,
             size: other.size,
@@ -611,3 +635,11 @@ impl From<sync_filesystem::AccessType> for async_filesystem::AccessType {
         }
     }
 }
+impl From<async_filesystem::MetadataHashValue> for sync_filesystem::MetadataHashValue {
+    fn from(other: async_filesystem::MetadataHashValue) -> Self {
+        Self {
+            lower: other.lower,
+            upper: other.upper,
+        }
+    }
+}
diff --git a/crates/wasi/wit/deps/filesystem/preopens.wit b/crates/wasi/wit/deps/filesystem/preopens.wit
new file mode 100644
index 000000000000..f45661b8a849
--- /dev/null
+++ b/crates/wasi/wit/deps/filesystem/preopens.wit
@@ -0,0 +1,6 @@
+interface preopens {
+    use types.{descriptor}
+
+    /// Return the set of preopened directories, and their path.
+    get-directories: func() -> list<tuple<descriptor, string>>
+}
diff --git a/crates/wasi/wit/deps/filesystem/filesystem.wit b/crates/wasi/wit/deps/filesystem/types.wit
similarity index 89%
rename from crates/wasi/wit/deps/filesystem/filesystem.wit
rename to crates/wasi/wit/deps/filesystem/types.wit
index 930f37567044..e72a742de6c8 100644
--- a/crates/wasi/wit/deps/filesystem/filesystem.wit
+++ b/crates/wasi/wit/deps/filesystem/types.wit
@@ -1,5 +1,3 @@
-package wasi:filesystem
-
 /// WASI filesystem is a filesystem API primarily intended to let users run WASI
 /// programs that access their files on their existing filesystems, without
 /// significant overhead.
@@ -19,7 +17,7 @@ package wasi:filesystem
 /// `..` and symbolic link steps, reaches a directory outside of the base
 /// directory, or reaches a symlink to an absolute or rooted path in the
 /// underlying filesystem, the function fails with `error-code::not-permitted`.
-interface filesystem {
+interface types {
     use wasi:io/streams.{input-stream, output-stream}
     use wasi:clocks/wall-clock.{datetime}
 
@@ -96,10 +94,6 @@ interface filesystem {
     ///
     /// Note: This was called `filestat` in earlier versions of WASI.
     record descriptor-stat {
-        /// Device ID of device containing the file.
-        device: device,
-        /// File serial number.
-        inode: inode,
         /// File type.
         %type: descriptor-type,
         /// Number of hard links to the file.
@@ -160,14 +154,6 @@ interface filesystem {
     /// Number of hard links to an inode.
     type link-count = u64
 
-    /// Identifier for a device containing a file system. Can be used in
-    /// combination with `inode` to uniquely identify a file or directory in
-    /// the filesystem.
-    type device = u64
-
-    /// Filesystem object serial number that is unique within its file system.
-    type inode = u64
-
     /// When setting a timestamp, this gives the value to set it to.
     variant new-timestamp {
         /// Leave the timestamp set to its previous value.
@@ -181,14 +167,6 @@ interface filesystem {
 
     /// A directory entry.
     record directory-entry {
-        /// The serial number of the object referred to by this directory entry.
-        /// May be none if the inode value is not known.
-        ///
-        /// When this is none, libc implementations might do an extra `stat-at`
-        /// call to retrieve the inode number to fill their `d_ino` fields, so
-        /// implementations which can set this to a non-none value should do so.
-        inode: option<inode>,
-
         /// The type of the file referred to by this directory entry.
         %type: descriptor-type,
 
@@ -306,21 +284,34 @@ interface filesystem {
     /// This [represents a resource](https://github.com/WebAssembly/WASI/blob/main/docs/WitInWasi.md#Resources).
     type descriptor = u32
 
-    /// Return a stream for reading from a file.
+    /// A 128-bit hash value, split into parts because wasm doesn't have a
+    /// 128-bit integer type.
+    record metadata-hash-value {
+       /// 64 bits of a 128-bit hash value.
+       lower: u64,
+       /// Another 64 bits of a 128-bit hash value.
+       upper: u64,
+    }
+
+    /// Return a stream for reading from a file, if available.
+    ///
+    /// May fail with an error-code describing why the file cannot be read.
     ///
     /// Multiple read, write, and append streams may be active on the same open
     /// file and they do not interfere with each other.
     ///
-    /// Note: This allows using `wasi:io/streams.read`, which is similar to `read` in POSIX.
+    /// Note: This allows using `read-stream`, which is similar to `read` in POSIX.
     read-via-stream: func(
         this: descriptor,
         /// The offset within the file at which to start reading.
         offset: filesize,
     ) -> result<input-stream, error-code>
 
-    /// Return a stream for writing to a file.
+    /// Return a stream for writing to a file, if available.
+    ///
+    /// May fail with an error-code describing why the file cannot be written.
     ///
-    /// Note: This allows using `wasi:io/streams.write`, which is similar to `write` in
+    /// Note: This allows using `write-stream`, which is similar to `write` in
     /// POSIX.
     write-via-stream: func(
         this: descriptor,
@@ -328,9 +319,11 @@ interface filesystem {
         offset: filesize,
     ) -> result<output-stream, error-code>
 
-    /// Return a stream for appending to a file.
+    /// Return a stream for appending to a file, if available.
+    ///
+    /// May fail with an error-code describing why the file cannot be appended.
     ///
-    /// Note: This allows using `wasi:io/streams.write`, which is similar to `write` with
+    /// Note: This allows using `write-stream`, which is similar to `write` with
     /// `O_APPEND` in in POSIX.
     append-via-stream: func(
         this: descriptor,
@@ -464,14 +457,20 @@ interface filesystem {
 
     /// Return the attributes of an open file or directory.
     ///
-    /// Note: This is similar to `fstat` in POSIX.
+    /// Note: This is similar to `fstat` in POSIX, except that it does not return
+    /// device and inode information. For testing whether two descriptors refer to
+    /// the same underlying filesystem object, use `is-same-object`. To obtain
+    /// additional data that can be used do determine whether a file has been
+    /// modified, use `metadata-hash`.
     ///
     /// Note: This was called `fd_filestat_get` in earlier versions of WASI.
     stat: func(this: descriptor) -> result<descriptor-stat, error-code>
 
     /// Return the attributes of a file or directory.
     ///
-    /// Note: This is similar to `fstatat` in POSIX.
+    /// Note: This is similar to `fstatat` in POSIX, except that it does not
+    /// return device and inode information. See the `stat` description for a
+    /// discussion of alternatives.
     ///
     /// Note: This was called `path_filestat_get` in earlier versions of WASI.
     stat-at: func(
@@ -779,4 +778,47 @@ interface filesystem {
     /// Dispose of the specified `directory-entry-stream`, after which it may no longer
     /// be used.
     drop-directory-entry-stream: func(this: directory-entry-stream)
+
+    /// Test whether two descriptors refer to the same filesystem object.
+    ///
+    /// In POSIX, this corresponds to testing whether the two descriptors have the
+    /// same device (`st_dev`) and inode (`st_ino` or `d_ino`) numbers.
+    /// wasi-filesystem does not expose device and inode numbers, so this function
+    /// may be used instead.
+    is-same-object: func(this: descriptor, other: descriptor) -> bool
+
+    /// Return a hash of the metadata associated with a filesystem object referred
+    /// to by a descriptor.
+    ///
+    /// This returns a hash of the last-modification timestamp and file size, and
+    /// may also include the inode number, device number, birth timestamp, and
+    /// other metadata fields that may change when the file is modified or
+    /// replaced. It may also include a secret value chosen by the
+    /// implementation and not otherwise exposed.
+    ///
+    /// Implementations are encourated to provide the following properties:
+    ///
+    ///  - If the file is not modified or replaced, the computed hash value should
+    ///    usually not change.
+    ///  - If the object is modified or replaced, the computed hash value should
+    ///    usually change.
+    ///  - The inputs to the hash should not be easily computable from the
+    ///    computed hash.
+    ///
+    /// However, none of these is required.
+    metadata-hash: func(
+        this: descriptor,
+    ) -> result<metadata-hash-value, error-code>
+
+    /// Return a hash of the metadata associated with a filesystem object referred
+    /// to by a directory descriptor and a relative path.
+    ///
+    /// This performs the same hash computation as `metadata-hash`.
+    metadata-hash-at: func(
+        this: descriptor,
+        /// Flags determining the method of how the path is resolved.
+        path-flags: path-flags,
+        /// The relative path of the file or directory to inspect.
+        path: string,
+    ) -> result<metadata-hash-value, error-code>
 }
diff --git a/crates/wasi/wit/deps/filesystem/world.wit b/crates/wasi/wit/deps/filesystem/world.wit
new file mode 100644
index 000000000000..b51f484f8383
--- /dev/null
+++ b/crates/wasi/wit/deps/filesystem/world.wit
@@ -0,0 +1,6 @@
+package wasi:filesystem
+
+world example-world {
+    import types
+    import preopens
+}
diff --git a/crates/wasi/wit/deps/preview/command-extended.wit b/crates/wasi/wit/deps/preview/command-extended.wit
index 2beb119da319..8fe716038e28 100644
--- a/crates/wasi/wit/deps/preview/command-extended.wit
+++ b/crates/wasi/wit/deps/preview/command-extended.wit
@@ -4,7 +4,8 @@ world command-extended {
   import wasi:clocks/wall-clock
   import wasi:clocks/monotonic-clock
   import wasi:clocks/timezone
-  import wasi:filesystem/filesystem
+  import wasi:filesystem/types
+  import wasi:filesystem/preopens
   import wasi:sockets/instance-network
   import wasi:sockets/ip-name-lookup
   import wasi:sockets/network
@@ -18,7 +19,6 @@ world command-extended {
   import wasi:poll/poll
   import wasi:io/streams
   import wasi:cli-base/environment
-  import wasi:cli-base/preopens
   import wasi:cli-base/exit
   import wasi:cli-base/stdin
   import wasi:cli-base/stdout
diff --git a/crates/wasi/wit/deps/preview/command.wit b/crates/wasi/wit/deps/preview/command.wit
index 62608a05ccf9..dcd06d795753 100644
--- a/crates/wasi/wit/deps/preview/command.wit
+++ b/crates/wasi/wit/deps/preview/command.wit
@@ -2,7 +2,8 @@ world command {
   import wasi:clocks/wall-clock
   import wasi:clocks/monotonic-clock
   import wasi:clocks/timezone
-  import wasi:filesystem/filesystem
+  import wasi:filesystem/types
+  import wasi:filesystem/preopens
   import wasi:sockets/instance-network
   import wasi:sockets/ip-name-lookup
   import wasi:sockets/network
@@ -16,7 +17,6 @@ world command {
   import wasi:poll/poll
   import wasi:io/streams
   import wasi:cli-base/environment
-  import wasi:cli-base/preopens
   import wasi:cli-base/exit
   import wasi:cli-base/stdin
   import wasi:cli-base/stdout
diff --git a/crates/wasi/wit/deps/preview/reactor.wit b/crates/wasi/wit/deps/preview/reactor.wit
index 4a262c551d3f..aff49ea4d186 100644
--- a/crates/wasi/wit/deps/preview/reactor.wit
+++ b/crates/wasi/wit/deps/preview/reactor.wit
@@ -2,7 +2,8 @@ world reactor {
   import wasi:clocks/wall-clock
   import wasi:clocks/monotonic-clock
   import wasi:clocks/timezone
-  import wasi:filesystem/filesystem
+  import wasi:filesystem/types
+  import wasi:filesystem/preopens
   import wasi:sockets/instance-network
   import wasi:sockets/ip-name-lookup
   import wasi:sockets/network
@@ -16,7 +17,6 @@ world reactor {
   import wasi:logging/handler
   import wasi:http/outgoing-handler
   import wasi:cli-base/environment
-  import wasi:cli-base/preopens
   import wasi:cli-base/exit
   import wasi:cli-base/stdin
   import wasi:cli-base/stdout
diff --git a/crates/wasi/wit/deps/wasi-cli-base/preopens.wit b/crates/wasi/wit/deps/wasi-cli-base/preopens.wit
deleted file mode 100644
index f268f6b0b2e6..000000000000
--- a/crates/wasi/wit/deps/wasi-cli-base/preopens.wit
+++ /dev/null
@@ -1,7 +0,0 @@
-interface preopens {
-  use wasi:filesystem/filesystem.{descriptor}
-  use wasi:io/streams.{input-stream, output-stream}
-
-  /// Return the set of of preopened directories, and their path.
-  get-directories: func() -> list<tuple<descriptor, string>>
-}
diff --git a/crates/wasi/wit/test.wit b/crates/wasi/wit/test.wit
index 9c0fda58d0b8..09498f62cf8f 100644
--- a/crates/wasi/wit/test.wit
+++ b/crates/wasi/wit/test.wit
@@ -3,8 +3,8 @@ world test-reactor {
 
   import wasi:cli-base/environment
   import wasi:io/streams
-  import wasi:cli-base/preopens
-  import wasi:filesystem/filesystem
+  import wasi:filesystem/types
+  import wasi:filesystem/preopens
   import wasi:cli-base/exit
 
   export add-strings: func(s: list<string>) -> u32
@@ -14,7 +14,7 @@ world test-reactor {
 
   export write-strings-to: func(o: output-stream) -> result
 
-  use wasi:filesystem/filesystem.{descriptor-stat}
+  use wasi:filesystem/types.{descriptor-stat}
   export pass-an-imported-record: func(d: descriptor-stat) -> string
 }
 
diff --git a/crates/wasmtime/Cargo.toml b/crates/wasmtime/Cargo.toml
index b50eeadca947..443e65d53885 100644
--- a/crates/wasmtime/Cargo.toml
+++ b/crates/wasmtime/Cargo.toml
@@ -119,11 +119,6 @@ all-arch = [
   "wasmtime-winch?/all-arch",
 ]
 
-# Enables trap handling using POSIX signals instead of Mach exceptions on MacOS.
-# It is useful for applications that do not bind their own exception ports and
-# need portable signal handling.
-posix-signals-on-macos = ["wasmtime-runtime/posix-signals-on-macos"]
-
 # Enables in-progress support for the component model. Note that this feature is
 # in-progress, buggy, and incomplete. This is primarily here for internal
 # testing purposes.
diff --git a/crates/wasmtime/README.md b/crates/wasmtime/README.md
index a1b29d7fe344..8552c90bcccd 100644
--- a/crates/wasmtime/README.md
+++ b/crates/wasmtime/README.md
@@ -94,7 +94,7 @@ fn main() -> Result<()> {
     // this case we're using `4` for.
     let mut store = Store::new(&engine, 4);
     let instance = linker.instantiate(&mut store, &module)?;
-    let hello = instance.get_typed_func::<(), (), _>(&mut store, "hello")?;
+    let hello = instance.get_typed_func::<(), ()>(&mut store, "hello")?;
 
     // And finally we can call the wasm!
     hello.call(&mut store, ())?;
diff --git a/crates/wasmtime/src/config.rs b/crates/wasmtime/src/config.rs
index 0ac1291ef42e..1ed7c7b9c4b3 100644
--- a/crates/wasmtime/src/config.rs
+++ b/crates/wasmtime/src/config.rs
@@ -111,6 +111,7 @@ pub struct Config {
     pub(crate) memory_guaranteed_dense_image_size: u64,
     pub(crate) force_memory_init_memfd: bool,
     pub(crate) coredump_on_trap: bool,
+    pub(crate) macos_use_mach_ports: bool,
 }
 
 /// User-provided configuration for the compiler.
@@ -201,6 +202,7 @@ impl Config {
             memory_guaranteed_dense_image_size: 16 << 20,
             force_memory_init_memfd: false,
             coredump_on_trap: false,
+            macos_use_mach_ports: true,
         };
         #[cfg(any(feature = "cranelift", feature = "winch"))]
         {
@@ -1715,8 +1717,41 @@ impl Config {
 
     /// Enables clif output when compiling a WebAssembly module.
     #[cfg(any(feature = "cranelift", feature = "winch"))]
-    pub fn emit_clif(&mut self, path: &Path) {
+    pub fn emit_clif(&mut self, path: &Path) -> &mut Self {
         self.compiler_config.clif_dir = Some(path.to_path_buf());
+        self
+    }
+
+    /// Configures whether, when on macOS, Mach ports are used for exception
+    /// handling instead of traditional Unix-based signal handling.
+    ///
+    /// WebAssembly traps in Wasmtime are implemented with native faults, for
+    /// example a `SIGSEGV` will occur when a WebAssembly guest accesses
+    /// out-of-bounds memory. Handling this can be configured to either use Unix
+    /// signals or Mach ports on macOS. By default Mach ports are used.
+    ///
+    /// Mach ports enable Wasmtime to work by default with foreign
+    /// error-handling systems such as breakpad which also use Mach ports to
+    /// handle signals. In this situation Wasmtime will continue to handle guest
+    /// faults gracefully while any non-guest faults will get forwarded to
+    /// process-level handlers such as breakpad. Some more background on this
+    /// can be found in #2456.
+    ///
+    /// A downside of using mach ports, however, is that they don't interact
+    /// well with `fork()`. Forking a Wasmtime process on macOS will produce a
+    /// child process that cannot successfully run WebAssembly. In this
+    /// situation traditional Unix signal handling should be used as that's
+    /// inherited and works across forks.
+    ///
+    /// If your embedding wants to use a custom error handler which leverages
+    /// Mach ports and you additionally wish to `fork()` the process and use
+    /// Wasmtime in the child process that's not currently possible. Please
+    /// reach out to us if you're in this bucket!
+    ///
+    /// This option defaults to `true`, using Mach ports by default.
+    pub fn macos_use_mach_ports(&mut self, mach_ports: bool) -> &mut Self {
+        self.macos_use_mach_ports = mach_ports;
+        self
     }
 }
 
diff --git a/crates/wasmtime/src/engine.rs b/crates/wasmtime/src/engine.rs
index f1bb44d6e508..e940ae34d057 100644
--- a/crates/wasmtime/src/engine.rs
+++ b/crates/wasmtime/src/engine.rs
@@ -77,7 +77,7 @@ impl Engine {
         // Ensure that wasmtime_runtime's signal handlers are configured. This
         // is the per-program initialization required for handling traps, such
         // as configuring signals, vectored exception handlers, etc.
-        wasmtime_runtime::init_traps(crate::module::is_wasm_trap_pc);
+        wasmtime_runtime::init_traps(crate::module::is_wasm_trap_pc, config.macos_use_mach_ports);
         debug_builtins::ensure_exported();
 
         let registry = SignatureRegistry::new();
@@ -629,6 +629,26 @@ impl Engine {
         code.publish()?;
         Ok(Arc::new(code))
     }
+
+    /// Detects whether the bytes provided are a precompiled object produced by
+    /// Wasmtime.
+    ///
+    /// This function will inspect the header of `bytes` to determine if it
+    /// looks like a precompiled core wasm module or a precompiled component.
+    /// This does not validate the full structure or guarantee that
+    /// deserialization will succeed, instead it helps higher-levels of the
+    /// stack make a decision about what to do next when presented with the
+    /// `bytes` as an input module.
+    ///
+    /// If the `bytes` looks like a precompiled object previously produced by
+    /// [`Module::serialize`](crate::Module::serialize),
+    /// [`Component::serialize`](crate::component::Component::serialize),
+    /// [`Engine::precompile_module`], or [`Engine::precompile_component`], then
+    /// this will return `Some(...)` indicating so. Otherwise `None` is
+    /// returned.
+    pub fn detect_precompiled(&self, bytes: &[u8]) -> Option<Precompiled> {
+        serialization::detect_precompiled(bytes)
+    }
 }
 
 impl Default for Engine {
@@ -637,6 +657,15 @@ impl Default for Engine {
     }
 }
 
+/// Return value from the [`Engine::detect_precompiled`] API.
+#[derive(PartialEq, Eq, Copy, Clone, Debug)]
+pub enum Precompiled {
+    /// The input bytes look like a precompiled core wasm module.
+    Module,
+    /// The input bytes look like a precompiled wasm component.
+    Component,
+}
+
 #[cfg(test)]
 mod tests {
     use std::{
diff --git a/crates/wasmtime/src/engine/serialization.rs b/crates/wasmtime/src/engine/serialization.rs
index d3e2ce0c0f69..ad4956932de6 100644
--- a/crates/wasmtime/src/engine/serialization.rs
+++ b/crates/wasmtime/src/engine/serialization.rs
@@ -21,7 +21,7 @@
 //! other random ELF files, as well as provide better error messages for
 //! using wasmtime artifacts across versions.
 
-use crate::{Engine, ModuleVersionStrategy};
+use crate::{Engine, ModuleVersionStrategy, Precompiled};
 use anyhow::{anyhow, bail, Context, Result};
 use object::write::{Object, StandardSegment};
 use object::{File, FileFlags, Object as _, ObjectSection, SectionKind};
@@ -145,6 +145,23 @@ pub fn check_compatible(engine: &Engine, mmap: &MmapVec, expected: ObjectKind) -
     bincode::deserialize::<Metadata>(data)?.check_compatible(engine)
 }
 
+pub fn detect_precompiled(bytes: &[u8]) -> Option<Precompiled> {
+    let obj = File::parse(bytes).ok()?;
+    match obj.flags() {
+        FileFlags::Elf {
+            os_abi: obj::ELFOSABI_WASMTIME,
+            abi_version: 0,
+            e_flags: obj::EF_WASMTIME_MODULE,
+        } => Some(Precompiled::Module),
+        FileFlags::Elf {
+            os_abi: obj::ELFOSABI_WASMTIME,
+            abi_version: 0,
+            e_flags: obj::EF_WASMTIME_COMPONENT,
+        } => Some(Precompiled::Component),
+        _ => None,
+    }
+}
+
 #[derive(Serialize, Deserialize)]
 struct Metadata {
     target: String,
diff --git a/crates/wiggle/src/lib.rs b/crates/wiggle/src/lib.rs
index 581e7132d284..7bad7f20ee07 100644
--- a/crates/wiggle/src/lib.rs
+++ b/crates/wiggle/src/lib.rs
@@ -810,7 +810,7 @@ impl<'a, T> std::ops::Deref for GuestSlice<'a, T> {
 
     fn deref(&self) -> &Self::Target {
         // SAFETY: The presence of `GuestSlice` indicates that this is an
-        // unshared memory meaning concurrent acceses will not happen.
+        // unshared memory meaning concurrent accesses will not happen.
         // Furthermore the validity of the slice has already been established
         // and a runtime borrow has been recorded to prevent conflicting views.
         // This all adds up to the ability to return a safe slice from this
diff --git a/crates/wit-bindgen/Cargo.toml b/crates/wit-bindgen/Cargo.toml
index fc50af8b42fa..cc4b27260bbe 100644
--- a/crates/wit-bindgen/Cargo.toml
+++ b/crates/wit-bindgen/Cargo.toml
@@ -12,3 +12,4 @@ edition.workspace = true
 anyhow = { workspace = true }
 heck = { workspace = true }
 wit-parser = { workspace = true }
+indexmap = { workspace = true }
diff --git a/crates/wit-bindgen/src/lib.rs b/crates/wit-bindgen/src/lib.rs
index ff2ca10a437b..2d86124f1a8d 100644
--- a/crates/wit-bindgen/src/lib.rs
+++ b/crates/wit-bindgen/src/lib.rs
@@ -1,6 +1,8 @@
 use crate::rust::{to_rust_ident, to_rust_upper_camel_case, RustGenerator, TypeMode};
 use crate::types::{TypeInfo, Types};
+use anyhow::{anyhow, bail, Context};
 use heck::*;
+use indexmap::IndexMap;
 use std::collections::{BTreeMap, HashMap};
 use std::fmt::Write as _;
 use std::io::{Read, Write};
@@ -110,19 +112,14 @@ pub struct Opts {
 
 #[derive(Debug, Clone)]
 pub struct TrappableError {
-    /// The name of the error in WIT that is being mapped.
-    pub wit_name: String,
+    /// The package and interface that define the error type being mapped.
+    pub wit_package_path: String,
 
-    /// The owner container of the error in WIT of the error that's being
-    /// mapped.
-    ///
-    /// This is, for example, the name of the WIT interface or the WIT world
-    /// which owns the type. If this is set to `None` then any error type with
-    /// `wit_name` is remapped to `rust_name`.
-    pub wit_owner: Option<String>,
+    /// The name of the error type in WIT that is being mapped.
+    pub wit_type_name: String,
 
     /// The name, in Rust, of the error type to generate.
-    pub rust_name: String,
+    pub rust_type_name: String,
 }
 
 impl Opts {
@@ -191,7 +188,7 @@ impl Wasmtime {
         let mut gen = InterfaceGenerator::new(self, resolve);
         match item {
             WorldItem::Function(func) => {
-                gen.generate_function_trait_sig(TypeOwner::None, func);
+                gen.generate_function_trait_sig(func);
                 let sig = mem::take(&mut gen.src).into();
                 gen.generate_add_function_to_linker(TypeOwner::None, func, "linker");
                 let add_to_linker = gen.src.into();
@@ -204,7 +201,6 @@ impl Wasmtime {
                 }
                 gen.current_interface = Some((*id, name, false));
                 gen.types(*id);
-                gen.generate_trappable_error_types(TypeOwner::Interface(*id));
                 let key_name = resolve.name_world_key(name);
                 gen.generate_add_to_linker(*id, &key_name);
 
@@ -271,7 +267,6 @@ impl Wasmtime {
                 gen.gen.name_interface(resolve, *id, name);
                 gen.current_interface = Some((*id, name, true));
                 gen.types(*id);
-                gen.generate_trappable_error_types(TypeOwner::Interface(*id));
                 let iface = &resolve.interfaces[*id];
                 let iface_name = match name {
                     WorldKey::Name(name) => name,
@@ -643,26 +638,120 @@ impl Wasmtime {
     }
 }
 
+fn resolve_type_in_package(
+    resolve: &Resolve,
+    package_path: &str,
+    type_name: &str,
+) -> anyhow::Result<TypeId> {
+    // foo:bar/baz
+
+    let (namespace, rest) = package_path
+        .split_once(':')
+        .ok_or_else(|| anyhow!("Invalid package path: missing package identifier"))?;
+
+    let (package_name, iface_name) = rest
+        .split_once('/')
+        .ok_or_else(|| anyhow!("Invalid package path: missing namespace separator"))?;
+
+    // TODO: we should handle version annotations
+    if package_name.contains('@') {
+        bail!("Invalid package path: version parsing is not currently handled");
+    }
+
+    let packages = Vec::from_iter(
+        resolve
+            .package_names
+            .iter()
+            .filter(|(pname, _)| pname.namespace == namespace && pname.name == package_name),
+    );
+
+    if packages.len() != 1 {
+        if packages.is_empty() {
+            bail!("No package named `{}`", namespace);
+        } else {
+            // Getting here is a bug, parsing version identifiers would disambiguate the intended
+            // package.
+            bail!(
+                "Multiple packages named `{}` found ({:?})",
+                namespace,
+                packages
+            );
+        }
+    }
+
+    let (_, &package_id) = packages[0];
+    let package = &resolve.packages[package_id];
+
+    let (_, &iface_id) = package
+        .interfaces
+        .iter()
+        .find(|(name, _)| name.as_str() == iface_name)
+        .ok_or_else(|| {
+            anyhow!(
+                "Unknown interface `{}` in package `{}`",
+                iface_name,
+                package_path
+            )
+        })?;
+
+    let iface = &resolve.interfaces[iface_id];
+
+    let (_, &type_id) = iface
+        .types
+        .iter()
+        .find(|(n, _)| n.as_str() == type_name)
+        .ok_or_else(|| {
+            anyhow!(
+                "No type named `{}` in package `{}`",
+                package_name,
+                package_path
+            )
+        })?;
+
+    Ok(type_id)
+}
+
 struct InterfaceGenerator<'a> {
     src: Source,
     gen: &'a mut Wasmtime,
     resolve: &'a Resolve,
     current_interface: Option<(InterfaceId, &'a WorldKey, bool)>,
+
+    /// A mapping of wit types to their rust type name equivalent. This is the pre-processed
+    /// version of `gen.opts.trappable_error_types`, where the types have been eagerly resolved.
+    trappable_errors: IndexMap<TypeId, String>,
 }
 
 impl<'a> InterfaceGenerator<'a> {
     fn new(gen: &'a mut Wasmtime, resolve: &'a Resolve) -> InterfaceGenerator<'a> {
+        let trappable_errors = gen
+            .opts
+            .trappable_error_type
+            .iter()
+            .map(|te| {
+                let id = resolve_type_in_package(resolve, &te.wit_package_path, &te.wit_type_name)
+                    .context(format!("resolving {:?}", te))?;
+                Ok((id, te.rust_type_name.clone()))
+            })
+            .collect::<anyhow::Result<IndexMap<_, _>>>()
+            .unwrap();
+
         InterfaceGenerator {
             src: Source::default(),
             gen,
             resolve,
             current_interface: None,
+            trappable_errors,
         }
     }
 
     fn types(&mut self, id: InterfaceId) {
         for (name, id) in self.resolve.interfaces[id].types.iter() {
             self.define_type(name, *id);
+
+            if let Some(rust_name) = self.trappable_errors.get(id) {
+                self.define_trappable_error_type(*id, rust_name.clone())
+            }
         }
     }
 
@@ -1140,9 +1229,8 @@ impl<'a> InterfaceGenerator<'a> {
 
     fn special_case_trappable_error(
         &self,
-        owner: TypeOwner,
         results: &Results,
-    ) -> Option<(&'a Result_, String)> {
+    ) -> Option<(&'a Result_, TypeId, String)> {
         // We fillin a special trappable error type in the case when a function has just one
         // result, which is itself a `result<a, e>`, and the `e` is *not* a primitive
         // (i.e. defined in std) type, and matches the typename given by the user.
@@ -1163,9 +1251,9 @@ impl<'a> InterfaceGenerator<'a> {
             _ => return None,
         };
 
-        self.trappable_error_types(owner)
-            .find(|(wit_error_typeid, _)| error_typeid == *wit_error_typeid)
-            .map(|(_, rust_errortype)| (result, rust_errortype))
+        let rust_type = self.trappable_errors.get(&error_typeid)?;
+
+        Some((result, error_typeid, rust_type.clone()))
     }
 
     fn generate_add_to_linker(&mut self, id: InterfaceId, name: &str) {
@@ -1179,7 +1267,7 @@ impl<'a> InterfaceGenerator<'a> {
         // this import.
         uwriteln!(self.src, "pub trait Host {{");
         for (_, func) in iface.functions.iter() {
-            self.generate_function_trait_sig(owner, func);
+            self.generate_function_trait_sig(func);
         }
         uwriteln!(self.src, "}}");
 
@@ -1302,10 +1390,7 @@ impl<'a> InterfaceGenerator<'a> {
             );
         }
 
-        if self
-            .special_case_trappable_error(owner, &func.results)
-            .is_some()
-        {
+        if self.special_case_trappable_error(&func.results).is_some() {
             uwrite!(
                 self.src,
                 "match r {{
@@ -1330,7 +1415,7 @@ impl<'a> InterfaceGenerator<'a> {
         }
     }
 
-    fn generate_function_trait_sig(&mut self, owner: TypeOwner, func: &Function) {
+    fn generate_function_trait_sig(&mut self, func: &Function) {
         self.rustdoc(&func.docs);
 
         if self.gen.opts.async_ {
@@ -1349,7 +1434,9 @@ impl<'a> InterfaceGenerator<'a> {
         self.push_str(")");
         self.push_str(" -> ");
 
-        if let Some((r, error_typename)) = self.special_case_trappable_error(owner, &func.results) {
+        if let Some((r, error_id, error_typename)) =
+            self.special_case_trappable_error(&func.results)
+        {
             // Functions which have a single result `result<ok,err>` get special
             // cased to use the host_wasmtime_rust::Error<err>, making it possible
             // for them to trap or use `?` to propogate their errors
@@ -1360,6 +1447,12 @@ impl<'a> InterfaceGenerator<'a> {
                 self.push_str("()");
             }
             self.push_str(",");
+            if let TypeOwner::Interface(id) = self.resolve.types[error_id].owner {
+                if let Some(path) = self.path_to_interface(id) {
+                    self.push_str(&path);
+                    self.push_str("::");
+                }
+            }
             self.push_str(&error_typename);
             self.push_str(">");
         } else {
@@ -1498,68 +1591,31 @@ impl<'a> InterfaceGenerator<'a> {
         self.src.push_str("}\n");
     }
 
-    fn trappable_error_types(
-        &self,
-        owner: TypeOwner,
-    ) -> impl Iterator<Item = (TypeId, String)> + '_ {
-        let resolve = self.resolve;
-        self.gen
-            .opts
-            .trappable_error_type
-            .iter()
-            .filter_map(move |trappable| {
-                if let Some(name) = &trappable.wit_owner {
-                    let owner_name = match owner {
-                        TypeOwner::Interface(id) => resolve.interfaces[id].name.as_deref()?,
-                        TypeOwner::World(id) => &resolve.worlds[id].name,
-                        TypeOwner::None => return None,
-                    };
-                    if owner_name != name {
-                        return None;
-                    }
-                }
-                let id = match owner {
-                    TypeOwner::Interface(id) => {
-                        *resolve.interfaces[id].types.get(&trappable.wit_name)?
-                    }
-                    // TODO: right now worlds can't have types defined within
-                    // them but that's just a temporary limitation of
-                    // `wit-parser`. Once that's filled in this should be
-                    // replaced with a type-lookup in the world.
-                    TypeOwner::World(_id) => unimplemented!(),
-                    TypeOwner::None => return None,
-                };
-
-                Some((id, trappable.rust_name.clone()))
-            })
-    }
-
-    fn generate_trappable_error_types(&mut self, owner: TypeOwner) {
-        for (wit_type, trappable_type) in self.trappable_error_types(owner).collect::<Vec<_>>() {
-            let info = self.info(wit_type);
-            if self.lifetime_for(&info, TypeMode::Owned).is_some() {
-                panic!("wit error for {trappable_type} is not 'static")
-            }
-            let abi_type = self.param_name(wit_type);
+    fn define_trappable_error_type(&mut self, id: TypeId, rust_name: String) {
+        let info = self.info(id);
+        if self.lifetime_for(&info, TypeMode::Owned).is_some() {
+            panic!("wit error for {rust_name} is not 'static")
+        }
+        let abi_type = self.param_name(id);
 
-            uwriteln!(
-                self.src,
-                "
+        uwriteln!(
+            self.src,
+            "
                 #[derive(Debug)]
-                pub struct {trappable_type} {{
+                pub struct {rust_name} {{
                     inner: anyhow::Error,
                 }}
-                impl std::fmt::Display for {trappable_type} {{
+                impl std::fmt::Display for {rust_name} {{
                     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {{
                         write!(f, \"{{}}\", self.inner)
                     }}
                 }}
-                impl std::error::Error for {trappable_type} {{
+                impl std::error::Error for {rust_name} {{
                     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {{
                         self.inner.source()
                     }}
                 }}
-                impl {trappable_type} {{
+                impl {rust_name} {{
                     pub fn trap(inner: anyhow::Error) -> Self {{
                         Self {{ inner }}
                     }}
@@ -1573,14 +1629,13 @@ impl<'a> InterfaceGenerator<'a> {
                         Self {{ inner: self.inner.context(s.into()) }}
                     }}
                 }}
-                impl From<{abi_type}> for {trappable_type} {{
-                    fn from(abi: {abi_type}) -> {trappable_type} {{
-                        {trappable_type} {{ inner: anyhow::Error::from(abi) }}
+                impl From<{abi_type}> for {rust_name} {{
+                    fn from(abi: {abi_type}) -> {rust_name} {{
+                        {rust_name} {{ inner: anyhow::Error::from(abi) }}
                     }}
                 }}
            "
-            );
-        }
+        );
     }
 
     fn rustdoc(&mut self, docs: &Docs) {
diff --git a/crates/wit-bindgen/src/rust.rs b/crates/wit-bindgen/src/rust.rs
index 38f7f89c1bfd..ec9f729c5835 100644
--- a/crates/wit-bindgen/src/rust.rs
+++ b/crates/wit-bindgen/src/rust.rs
@@ -17,7 +17,7 @@ pub trait RustGenerator<'a> {
     fn info(&self, ty: TypeId) -> TypeInfo;
     fn path_to_interface(&self, interface: InterfaceId) -> Option<String>;
 
-    /// This determines whether we generate owning types or (where appopriate)
+    /// This determines whether we generate owning types or (where appropriate)
     /// borrowing types.
     ///
     /// For example, when generating a type which is only used as a parameter to
diff --git a/docs/stability-tiers.md b/docs/stability-tiers.md
index b12a6a4724f7..d67c946cd277 100644
--- a/docs/stability-tiers.md
+++ b/docs/stability-tiers.md
@@ -49,7 +49,6 @@ For explanations of what each tier means see below.
 | Target               | `aarch64-pc-windows-msvc`         | CI testing, unwinding, full-time maintainer |
 | Target               | `riscv64gc-unknown-linux-gnu`     | full-time maintainer        |
 | WASI Proposal        | `wasi-nn`                         | More expansive CI testing   |
-| WASI Proposal        | `wasi-crypto`                     | CI testing, clear owner     |
 | WebAssembly Proposal | `threads`                         | Complete implementation     |
 | WebAssembly Proposal | `component-model`                 | Complete implementation     |
 | *misc*               | Non-Wasmtime Cranelift usage [^1] | CI testing, full-time maintainer |
diff --git a/docs/stability-wasi-proposals-support.md b/docs/stability-wasi-proposals-support.md
index ce8121e2452b..a3964bf5ebc5 100644
--- a/docs/stability-wasi-proposals-support.md
+++ b/docs/stability-wasi-proposals-support.md
@@ -14,7 +14,7 @@ proposal is not listed, then it is not supported by Wasmtime.
 | [Poll][wasi-poll]                      | **Yes**                 | **Yes**              | `wasi-common`               |
 | [Machine Learning (wasi-nn)][wasi-nn]  | **Yes**                 | No                   | `experimental-wasi-nn`      |
 | [Blob Store][wasi-blob-store]          | No                      | No                   | N/A                         |
-| [Crypto][wasi-crypto]                  | **Yes** [^crypto]       | No                   | `experimental-wasi-crypto`  |
+| [Crypto][wasi-crypto]                  | No                      | No                   | N/A                         |
 | [Distributed Lock Service][wasi-distributed-lock-service] | No   | No                   | N/A                         |
 | [gRPC][wasi-grpc]                      | No                      | No                   | N/A                         |
 | [HTTP][wasi-http]                      | No                      | No                   | N/A                         |
diff --git a/scripts/publish.rs b/scripts/publish.rs
index 29ccf1372ecf..1f3ebdafe617 100644
--- a/scripts/publish.rs
+++ b/scripts/publish.rs
@@ -67,7 +67,6 @@ const CRATES_TO_PUBLISH: &[&str] = &[
     "wasi-tokio",
     // other misc wasmtime crates
     "wasmtime-wasi",
-    "wasmtime-wasi-crypto",
     "wasmtime-wasi-http",
     "wasmtime-wasi-nn",
     "wasmtime-wasi-threads",
@@ -84,13 +83,11 @@ const CRATES_TO_PUBLISH: &[&str] = &[
 const PUBLIC_CRATES: &[&str] = &[
     // just here to appease the script because these are submodules of this
     // repository.
-    "wasi-crypto",
     "witx",
     // these are actually public crates which we cannot break the API of in
     // patch releases.
     "wasmtime",
     "wasmtime-wasi",
-    "wasmtime-wasi-crypto",
     "wasmtime-wasi-nn",
     "wasmtime-wasi-threads",
     "wasmtime-cli",
@@ -255,7 +252,7 @@ fn read_crate(ws: Option<&Workspace>, manifest: &Path) -> Crate {
     }
     let name = name.unwrap();
     let version = version.unwrap();
-    if ["witx", "witx-cli", "wasi-crypto"].contains(&&name[..]) {
+    if ["witx", "witx-cli"].contains(&&name[..]) {
         publish = false;
     }
     Crate {
@@ -501,10 +498,6 @@ fn verify(crates: &[Crate]) {
         .unwrap();
     verify_and_vendor(&witx);
 
-    // Vendor wasi-crypto which is also a path dependency
-    let wasi_crypto = crates.iter().find(|c| c.name == "wasi-crypto").unwrap();
-    verify_and_vendor(&wasi_crypto);
-
     for krate in crates {
         if !krate.publish {
             continue;
diff --git a/src/commands/run.rs b/src/commands/run.rs
index a655521a9b59..caf44ec76a2f 100644
--- a/src/commands/run.rs
+++ b/src/commands/run.rs
@@ -6,6 +6,7 @@ use once_cell::sync::Lazy;
 use std::fs::File;
 use std::io::Write;
 use std::path::{Path, PathBuf};
+use std::sync::Arc;
 use std::thread;
 use std::time::Duration;
 use wasmtime::{
@@ -16,20 +17,9 @@ use wasmtime_cli_flags::{CommonOptions, WasiModules};
 use wasmtime_wasi::maybe_exit_on_error;
 use wasmtime_wasi::sync::{ambient_authority, Dir, TcpListener, WasiCtxBuilder};
 
-#[cfg(any(
-    feature = "wasi-crypto",
-    feature = "wasi-nn",
-    feature = "wasi-threads",
-    feature = "wasi-http"
-))]
-use std::sync::Arc;
-
 #[cfg(feature = "wasi-nn")]
 use wasmtime_wasi_nn::WasiNnCtx;
 
-#[cfg(feature = "wasi-crypto")]
-use wasmtime_wasi_crypto::WasiCryptoCtx;
-
 #[cfg(feature = "wasi-threads")]
 use wasmtime_wasi_threads::WasiThreadsCtx;
 
@@ -670,8 +660,6 @@ impl RunCommand {
 #[derive(Default, Clone)]
 struct Host {
     wasi: Option<wasmtime_wasi::WasiCtx>,
-    #[cfg(feature = "wasi-crypto")]
-    wasi_crypto: Option<Arc<WasiCryptoCtx>>,
     #[cfg(feature = "wasi-nn")]
     wasi_nn: Option<Arc<WasiNnCtx>>,
     #[cfg(feature = "wasi-threads")]
@@ -698,7 +686,7 @@ fn populate_with_wasi(
         wasmtime_wasi::add_to_linker(linker, |host| host.wasi.as_mut().unwrap())?;
 
         let mut builder = WasiCtxBuilder::new();
-        builder = builder.inherit_stdio().args(argv)?;
+        builder.inherit_stdio().args(argv)?;
 
         for (key, value) in vars {
             let value = match value {
@@ -706,37 +694,35 @@ fn populate_with_wasi(
                 None => std::env::var(key)
                     .map_err(|_| anyhow!("environment varialbe `{key}` not found"))?,
             };
-            builder = builder.env(key, &value)?;
+            builder.env(key, &value)?;
         }
 
         let mut num_fd: usize = 3;
 
         if listenfd {
-            let (n, b) = ctx_set_listenfd(num_fd, builder)?;
-            num_fd = n;
-            builder = b;
+            num_fd = ctx_set_listenfd(num_fd, &mut builder)?;
         }
 
         for listener in tcplisten.drain(..) {
-            builder = builder.preopened_socket(num_fd as _, listener)?;
+            builder.preopened_socket(num_fd as _, listener)?;
             num_fd += 1;
         }
 
         for (name, dir) in preopen_dirs.into_iter() {
-            builder = builder.preopened_dir(dir, name)?;
+            builder.preopened_dir(dir, name)?;
         }
 
         store.data_mut().wasi = Some(builder.build());
     }
 
-    if wasi_modules.wasi_crypto {
-        #[cfg(not(feature = "wasi-crypto"))]
+    if wasi_modules.wasi_nn {
+        #[cfg(not(feature = "wasi-nn"))]
         {
-            bail!("Cannot enable wasi-crypto when the binary is not compiled with this feature.");
+            bail!("Cannot enable wasi-nn when the binary is not compiled with this feature.");
         }
-        #[cfg(feature = "wasi-crypto")]
+        #[cfg(feature = "wasi-nn")]
         {
-            wasmtime_wasi_crypto::add_to_linker(linker, |host| {
+            wasmtime_wasi_nn::add_to_linker(linker, |host| {
                 // This WASI proposal is currently not protected against
                 // concurrent access--i.e., when wasi-threads is actively
                 // spawning new threads, we cannot (yet) safely allow access and
@@ -744,22 +730,6 @@ fn populate_with_wasi(
                 // context. Once this proposal is updated (as wasi-common has
                 // been) to allow concurrent access, this `Arc::get_mut`
                 // limitation can be removed.
-                Arc::get_mut(host.wasi_crypto.as_mut().unwrap())
-                    .expect("wasi-crypto is not implemented with multi-threading support")
-            })?;
-            store.data_mut().wasi_crypto = Some(Arc::new(WasiCryptoCtx::new()));
-        }
-    }
-
-    if wasi_modules.wasi_nn {
-        #[cfg(not(feature = "wasi-nn"))]
-        {
-            bail!("Cannot enable wasi-nn when the binary is not compiled with this feature.");
-        }
-        #[cfg(feature = "wasi-nn")]
-        {
-            wasmtime_wasi_nn::add_to_linker(linker, |host| {
-                // See documentation for wasi-crypto for why this is needed.
                 Arc::get_mut(host.wasi_nn.as_mut().unwrap())
                     .expect("wasi-nn is not implemented with multi-threading support")
             })?;
@@ -807,20 +777,17 @@ fn populate_with_wasi(
 }
 
 #[cfg(not(unix))]
-fn ctx_set_listenfd(num_fd: usize, builder: WasiCtxBuilder) -> Result<(usize, WasiCtxBuilder)> {
-    Ok((num_fd, builder))
+fn ctx_set_listenfd(num_fd: usize, _builder: &mut WasiCtxBuilder) -> Result<usize> {
+    Ok(num_fd)
 }
 
 #[cfg(unix)]
-fn ctx_set_listenfd(num_fd: usize, builder: WasiCtxBuilder) -> Result<(usize, WasiCtxBuilder)> {
+fn ctx_set_listenfd(mut num_fd: usize, builder: &mut WasiCtxBuilder) -> Result<usize> {
     use listenfd::ListenFd;
 
-    let mut builder = builder;
-    let mut num_fd = num_fd;
-
     for env in ["LISTEN_FDS", "LISTEN_FDNAMES"] {
         if let Ok(val) = std::env::var(env) {
-            builder = builder.env(env, &val)?;
+            builder.env(env, &val)?;
         }
     }
 
@@ -830,12 +797,12 @@ fn ctx_set_listenfd(num_fd: usize, builder: WasiCtxBuilder) -> Result<(usize, Wa
         if let Some(stdlistener) = listenfd.take_tcp_listener(i)? {
             let _ = stdlistener.set_nonblocking(true)?;
             let listener = TcpListener::from_std(stdlistener);
-            builder = builder.preopened_socket((3 + i) as _, listener)?;
+            builder.preopened_socket((3 + i) as _, listener)?;
             num_fd = 3 + i;
         }
     }
 
-    Ok((num_fd, builder))
+    Ok(num_fd)
 }
 
 fn generate_coredump(err: &anyhow::Error, source_name: &str, coredump_path: &str) -> Result<()> {
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index e1cdc7d4cf6b..3532b776b806 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -171,7 +171,7 @@ notes = "We (Bytecode Alliance) are the primary authors of regalloc2 and co-deve
 [[wildcard-audits.regalloc2]]
 who = "Trevor Elliott <telliott@fastly.com>"
 criteria = "safe-to-deploy"
-user-id = 187138 # Trevor Elliott (elliottt)
+user-id = 187138
 start = "2022-11-29"
 end = "2024-05-02"
 notes = """
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index edfcac4c389b..683f4da23a82 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -82,9 +82,6 @@ audit-as-crates-io = true
 [policy.wasi-common]
 audit-as-crates-io = true
 
-[policy.wasi-crypto]
-audit-as-crates-io = false
-
 [policy.wasi-tokio]
 audit-as-crates-io = true
 
@@ -154,9 +151,6 @@ audit-as-crates-io = false
 [policy.wasmtime-wasi]
 audit-as-crates-io = true
 
-[policy.wasmtime-wasi-crypto]
-audit-as-crates-io = true
-
 [policy.wasmtime-wasi-http]
 audit-as-crates-io = true
 
@@ -197,30 +191,10 @@ audit-as-crates-io = false
 version = "0.17.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.aead]]
-version = "0.4.3"
-criteria = "safe-to-deploy"
-
-[[exemptions.aes]]
-version = "0.7.5"
-criteria = "safe-to-deploy"
-
-[[exemptions.aes-gcm]]
-version = "0.9.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.ahash]]
 version = "0.7.6"
 criteria = "safe-to-deploy"
 
-[[exemptions.autocfg]]
-version = "0.1.8"
-criteria = "safe-to-deploy"
-
-[[exemptions.base64ct]]
-version = "1.1.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.bincode]]
 version = "1.3.3"
 criteria = "safe-to-deploy"
@@ -245,26 +219,10 @@ criteria = "safe-to-deploy"
 version = "0.2.7"
 criteria = "safe-to-run"
 
-[[exemptions.chacha20]]
-version = "0.8.1"
-criteria = "safe-to-deploy"
-
-[[exemptions.chacha20poly1305]]
-version = "0.9.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.cipher]]
-version = "0.3.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.console]]
 version = "0.15.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.const-oid]]
-version = "0.6.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.cpp_demangle]]
 version = "0.3.5"
 criteria = "safe-to-deploy"
@@ -301,30 +259,6 @@ criteria = "safe-to-deploy"
 version = "0.8.10"
 criteria = "safe-to-deploy"
 
-[[exemptions.crypto-bigint]]
-version = "0.2.11"
-criteria = "safe-to-deploy"
-
-[[exemptions.crypto-mac]]
-version = "0.11.1"
-criteria = "safe-to-deploy"
-
-[[exemptions.ctr]]
-version = "0.8.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.curve25519-dalek]]
-version = "3.2.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.der]]
-version = "0.4.5"
-criteria = "safe-to-deploy"
-
-[[exemptions.derivative]]
-version = "2.2.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.digest]]
 version = "0.9.0"
 criteria = "safe-to-deploy"
@@ -345,30 +279,10 @@ criteria = "safe-to-deploy"
 version = "1.2.0"
 criteria = "safe-to-run"
 
-[[exemptions.dunce]]
-version = "1.0.2"
-criteria = "safe-to-deploy"
-
-[[exemptions.ecdsa]]
-version = "0.12.4"
-criteria = "safe-to-deploy"
-
-[[exemptions.ed25519]]
-version = "1.4.1"
-criteria = "safe-to-deploy"
-
-[[exemptions.ed25519-dalek]]
-version = "1.0.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.egg]]
 version = "0.6.0"
 criteria = "safe-to-run"
 
-[[exemptions.elliptic-curve]]
-version = "0.10.6"
-criteria = "safe-to-deploy"
-
 [[exemptions.encode_unicode]]
 version = "0.3.6"
 criteria = "safe-to-deploy"
@@ -385,10 +299,6 @@ criteria = "safe-to-deploy"
 version = "0.2.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.ff]]
-version = "0.10.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.filetime]]
 version = "0.2.16"
 criteria = "safe-to-run"
@@ -411,26 +321,14 @@ notes = "this is 25k lines and contains over 149 uses of the substring unsafe. i
 version = "0.14.5"
 criteria = "safe-to-deploy"
 
-[[exemptions.getrandom]]
-version = "0.1.16"
-criteria = "safe-to-deploy"
-
 [[exemptions.getrandom]]
 version = "0.2.6"
 criteria = "safe-to-deploy"
 
-[[exemptions.ghash]]
-version = "0.4.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.gimli]]
 version = "0.26.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.group]]
-version = "0.10.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.h2]]
 version = "0.3.19"
 criteria = "safe-to-deploy"
@@ -444,14 +342,6 @@ criteria = "safe-to-deploy"
 version = "0.2.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.hkdf]]
-version = "0.11.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.hmac]]
-version = "0.11.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.http]]
 version = "0.2.9"
 criteria = "safe-to-deploy"
@@ -500,10 +390,6 @@ version = "0.3.57"
 criteria = "safe-to-deploy"
 notes = "dependency of ring for wasm32 browser platform, which our project does not target"
 
-[[exemptions.k256]]
-version = "0.9.6"
-criteria = "safe-to-deploy"
-
 [[exemptions.libloading]]
 version = "0.7.3"
 criteria = "safe-to-deploy"
@@ -533,10 +419,6 @@ version = "0.8.6"
 criteria = "safe-to-deploy"
 notes = "we are exempting tokio, hyper, and their tightly coupled dependencies by the same authors, expecting that the authors at aws will publish attestions we can import at some point soon"
 
-[[exemptions.num-bigint-dig]]
-version = "0.7.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.num_cpus]]
 version = "1.13.1"
 criteria = "safe-to-deploy"
@@ -573,30 +455,6 @@ criteria = "safe-to-deploy"
 version = "0.4.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.os_str_bytes]]
-version = "6.0.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.p256]]
-version = "0.9.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.pem-rfc7468]]
-version = "0.2.4"
-criteria = "safe-to-deploy"
-
-[[exemptions.pin-project-lite]]
-version = "0.2.9"
-criteria = "safe-to-deploy"
-
-[[exemptions.pkcs1]]
-version = "0.2.4"
-criteria = "safe-to-deploy"
-
-[[exemptions.pkcs8]]
-version = "0.7.6"
-criteria = "safe-to-deploy"
-
 [[exemptions.plotters]]
 version = "0.3.1"
 criteria = "safe-to-run"
@@ -609,42 +467,14 @@ criteria = "safe-to-run"
 version = "0.3.1"
 criteria = "safe-to-run"
 
-[[exemptions.poly1305]]
-version = "0.7.2"
-criteria = "safe-to-deploy"
-
-[[exemptions.polyval]]
-version = "0.5.3"
-criteria = "safe-to-deploy"
-
 [[exemptions.ppv-lite86]]
 version = "0.2.16"
 criteria = "safe-to-deploy"
 
-[[exemptions.pqcrypto]]
-version = "0.14.2"
-criteria = "safe-to-deploy"
-
-[[exemptions.pqcrypto-internals]]
-version = "0.2.4"
-criteria = "safe-to-deploy"
-
-[[exemptions.pqcrypto-kyber]]
-version = "0.7.5"
-criteria = "safe-to-deploy"
-
-[[exemptions.pqcrypto-traits]]
-version = "0.3.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.pretty_env_logger]]
 version = "0.4.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.proc-macro-error]]
-version = "1.0.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.proptest]]
 version = "1.0.0"
 criteria = "safe-to-deploy"
@@ -661,42 +491,18 @@ criteria = "safe-to-deploy"
 version = "2.0.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.rand]]
-version = "0.7.3"
-criteria = "safe-to-deploy"
-
 [[exemptions.rand]]
 version = "0.8.5"
 criteria = "safe-to-deploy"
 
-[[exemptions.rand_chacha]]
-version = "0.2.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.rand_chacha]]
 version = "0.3.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.rand_core]]
-version = "0.5.1"
-criteria = "safe-to-deploy"
-
-[[exemptions.rand_core]]
-version = "0.6.3"
-criteria = "safe-to-deploy"
-
-[[exemptions.rand_hc]]
-version = "0.2.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.rand_xorshift]]
 version = "0.3.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.rawbytes]]
-version = "0.1.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.redox_syscall]]
 version = "0.2.13"
 criteria = "safe-to-deploy"
@@ -718,18 +524,10 @@ version = "0.16.20"
 criteria = "safe-to-deploy"
 notes = "contains assembly language and object file implementations of crypto primitives for a very large number of platforms"
 
-[[exemptions.rsa]]
-version = "0.5.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.rusty-fork]]
 version = "0.3.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.sha2]]
-version = "0.9.9"
-criteria = "safe-to-deploy"
-
 [[exemptions.sharded-slab]]
 version = "0.1.4"
 criteria = "safe-to-run"
@@ -742,10 +540,6 @@ criteria = "safe-to-deploy"
 version = "1.1.2"
 criteria = "safe-to-deploy"
 
-[[exemptions.signature]]
-version = "1.3.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.slice-group-by]]
 version = "0.3.0"
 criteria = "safe-to-deploy"
@@ -766,10 +560,6 @@ criteria = "safe-to-deploy"
 version = "0.5.2"
 criteria = "safe-to-deploy"
 
-[[exemptions.spki]]
-version = "0.4.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.stable_deref_trait]]
 version = "1.2.0"
 criteria = "safe-to-deploy"
@@ -778,10 +568,6 @@ criteria = "safe-to-deploy"
 version = "0.10.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.subtle]]
-version = "2.4.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.symbolic_expressions]]
 version = "5.0.3"
 criteria = "safe-to-run"
@@ -794,10 +580,6 @@ criteria = "safe-to-deploy"
 version = "0.1.17"
 criteria = "safe-to-deploy"
 
-[[exemptions.textwrap]]
-version = "0.15.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.thread_local]]
 version = "1.1.4"
 criteria = "safe-to-run"
@@ -847,10 +629,6 @@ criteria = "safe-to-run"
 version = "0.2.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.wasi]]
-version = "0.9.0+wasi-snapshot-preview1"
-criteria = "safe-to-deploy"
-
 [[exemptions.wasi]]
 version = "0.11.0+wasi-snapshot-preview1"
 criteria = "safe-to-deploy"
@@ -876,18 +654,6 @@ criteria = "safe-to-deploy"
 version = "0.4.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.xoodyak]]
-version = "0.7.3"
-criteria = "safe-to-deploy"
-
-[[exemptions.zeroize]]
-version = "1.4.3"
-criteria = "safe-to-deploy"
-
-[[exemptions.zeroize_derive]]
-version = "1.3.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.zstd]]
 version = "0.11.1+zstd.1.5.2"
 criteria = "safe-to-deploy"
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index 0befa606d7c2..ca06104a07c9 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -2,400 +2,200 @@
 # cargo-vet imports lock
 
 [[unpublished.cranelift]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-bforest]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-bforest]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-codegen]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-codegen]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-codegen-meta]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-codegen-meta]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-codegen-shared]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-codegen-shared]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-control]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-control]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-entity]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-entity]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-frontend]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-frontend]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-interpreter]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-interpreter]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-isle]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-isle]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-jit]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-jit]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-module]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-module]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-native]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-native]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-object]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-object]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-reader]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-reader]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-serde]]
-version = "0.98.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-serde]]
-version = "0.99.0"
-audited_as = "0.97.1"
-
-[[unpublished.cranelift-wasm]]
-version = "0.98.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.cranelift-wasm]]
-version = "0.99.0"
-audited_as = "0.97.1"
+version = "0.100.0"
+audited_as = "0.98.1"
 
 [[unpublished.wasi-cap-std-sync]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasi-cap-std-sync]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasi-common]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasi-common]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasi-tokio]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasi-tokio]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-asm-macros]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-asm-macros]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-cache]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-cache]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-cli]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-cli]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-cli-flags]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-cli-flags]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-component-macro]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-component-macro]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-component-util]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-component-util]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-cranelift]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-cranelift]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-cranelift-shared]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-cranelift-shared]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-environ]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-environ]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-explorer]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-explorer]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-fiber]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-fiber]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-jit]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-jit]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-jit-debug]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-jit-debug]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-jit-icache-coherence]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-jit-icache-coherence]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-runtime]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-runtime]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-types]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-types]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wasi]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi-crypto]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi-crypto]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wasi-http]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi-http]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wasi-nn]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi-nn]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wasi-threads]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wasi-threads]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wast]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wast]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-winch]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-winch]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wasmtime-wit-bindgen]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wasmtime-wit-bindgen]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wiggle]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wiggle]]
-version = "12.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wiggle-generate]]
-version = "11.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wiggle-generate]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wiggle-macro]]
-version = "11.0.0"
-audited_as = "10.0.1"
-
-[[unpublished.wiggle-macro]]
-version = "12.0.0"
-audited_as = "10.0.1"
+version = "13.0.0"
+audited_as = "11.0.1"
 
 [[unpublished.wiggle-test]]
 version = "0.0.0"
 audited_as = "0.1.0"
 
 [[unpublished.winch-codegen]]
-version = "0.9.0"
-audited_as = "0.8.1"
-
-[[unpublished.winch-codegen]]
-version = "0.10.0"
-audited_as = "0.8.1"
+version = "0.11.0"
+audited_as = "0.9.1"
 
 [[publisher.aho-corasick]]
 version = "1.0.2"
@@ -446,13 +246,6 @@ user-id = 696
 user-login = "fitzgen"
 user-name = "Nick Fitzgerald"
 
-[[publisher.async-trait]]
-version = "0.1.53"
-when = "2022-03-25"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.async-trait]]
 version = "0.1.71"
 when = "2023-07-05"
@@ -530,13 +323,6 @@ user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
-[[publisher.clap]]
-version = "3.2.8"
-when = "2022-06-30"
-user-id = 6743
-user-login = "epage"
-user-name = "Ed Page"
-
 [[publisher.clap]]
 version = "4.3.12"
 when = "2023-07-14"
@@ -551,13 +337,6 @@ user-id = 6743
 user-login = "epage"
 user-name = "Ed Page"
 
-[[publisher.clap_derive]]
-version = "3.2.7"
-when = "2022-06-28"
-user-id = 6743
-user-login = "epage"
-user-name = "Ed Page"
-
 [[publisher.clap_derive]]
 version = "4.3.12"
 when = "2023-07-14"
@@ -565,13 +344,6 @@ user-id = 6743
 user-login = "epage"
 user-name = "Ed Page"
 
-[[publisher.clap_lex]]
-version = "0.2.4"
-when = "2022-06-28"
-user-id = 6743
-user-login = "epage"
-user-name = "Ed Page"
-
 [[publisher.clap_lex]]
 version = "0.5.0"
 when = "2023-05-19"
@@ -580,104 +352,104 @@ user-login = "epage"
 user-name = "Ed Page"
 
 [[publisher.cranelift]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-bforest]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen-meta]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-codegen-shared]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-control]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-entity]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-frontend]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-interpreter]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-isle]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-jit]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-module]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-native]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-object]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-reader]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-serde]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.cranelift-wasm]]
-version = "0.97.1"
-when = "2023-06-21"
+version = "0.98.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -751,13 +523,6 @@ user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
-[[publisher.is-terminal]]
-version = "0.4.9"
-when = "2023-07-06"
-user-id = 6825
-user-login = "sunfishcode"
-user-name = "Dan Gohman"
-
 [[publisher.itoa]]
 version = "1.0.1"
 when = "2021-12-12"
@@ -765,13 +530,6 @@ user-id = 3618
 user-login = "dtolnay"
 user-name = "David Tolnay"
 
-[[publisher.libc]]
-version = "0.2.132"
-when = "2022-08-16"
-user-id = 2915
-user-login = "Amanieu"
-user-name = "Amanieu d'Antras"
-
 [[publisher.libc]]
 version = "0.2.146"
 when = "2023-06-06"
@@ -793,13 +551,6 @@ user-id = 6825
 user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
-[[publisher.lock_api]]
-version = "0.4.7"
-when = "2022-03-30"
-user-id = 2915
-user-login = "Amanieu"
-user-name = "Amanieu d'Antras"
-
 [[publisher.memchr]]
 version = "2.5.0"
 when = "2022-04-30"
@@ -807,20 +558,6 @@ user-id = 189
 user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
-[[publisher.parking_lot]]
-version = "0.11.2"
-when = "2021-08-27"
-user-id = 2915
-user-login = "Amanieu"
-user-name = "Amanieu d'Antras"
-
-[[publisher.parking_lot_core]]
-version = "0.8.5"
-when = "2021-08-28"
-user-id = 2915
-user-login = "Amanieu"
-user-name = "Amanieu d'Antras"
-
 [[publisher.paste]]
 version = "1.0.7"
 when = "2022-03-27"
@@ -835,13 +572,6 @@ user-id = 3618
 user-login = "dtolnay"
 user-name = "David Tolnay"
 
-[[publisher.regalloc2]]
-version = "0.9.1"
-when = "2023-05-31"
-user-id = 187138
-user-login = "elliottt"
-user-name = "Trevor Elliott"
-
 [[publisher.regalloc2]]
 version = "0.9.2"
 when = "2023-07-14"
@@ -912,13 +642,6 @@ user-id = 2915
 user-login = "Amanieu"
 user-name = "Amanieu d'Antras"
 
-[[publisher.serde]]
-version = "1.0.137"
-when = "2022-05-01"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.serde]]
 version = "1.0.171"
 when = "2023-07-10"
@@ -926,13 +649,6 @@ user-id = 3618
 user-login = "dtolnay"
 user-name = "David Tolnay"
 
-[[publisher.serde_derive]]
-version = "1.0.137"
-when = "2022-05-01"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.serde_derive]]
 version = "1.0.171"
 when = "2023-07-10"
@@ -960,13 +676,6 @@ user-id = 3618
 user-login = "dtolnay"
 user-name = "David Tolnay"
 
-[[publisher.syn]]
-version = "2.0.16"
-when = "2023-05-14"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.syn]]
 version = "2.0.25"
 when = "2023-07-09"
@@ -995,13 +704,6 @@ user-id = 189
 user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
-[[publisher.thiserror]]
-version = "1.0.31"
-when = "2022-04-30"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.thiserror]]
 version = "1.0.43"
 when = "2023-07-07"
@@ -1009,13 +711,6 @@ user-id = 3618
 user-login = "dtolnay"
 user-name = "David Tolnay"
 
-[[publisher.thiserror-impl]]
-version = "1.0.31"
-when = "2022-04-30"
-user-id = 3618
-user-login = "dtolnay"
-user-name = "David Tolnay"
-
 [[publisher.thiserror-impl]]
 version = "1.0.43"
 when = "2023-07-07"
@@ -1059,20 +754,20 @@ user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
 [[publisher.wasi-cap-std-sync]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasi-common]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasi-tokio]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -1111,13 +806,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-encoder]]
-version = "0.29.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-encoder]]
 version = "0.30.0"
 when = "2023-07-11"
@@ -1125,13 +813,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-encoder]]
-version = "0.31.0"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-encoder]]
 version = "0.31.1"
 when = "2023-07-26"
@@ -1139,13 +820,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-metadata]]
-version = "0.8.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-metadata]]
 version = "0.9.0"
 when = "2023-07-11"
@@ -1153,13 +827,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-metadata]]
-version = "0.10.0"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-metadata]]
 version = "0.10.1"
 when = "2023-07-26"
@@ -1167,27 +834,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-mutate]]
-version = "0.2.27"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasm-mutate]]
-version = "0.2.28"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasm-mutate]]
-version = "0.2.29"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-mutate]]
 version = "0.2.30"
 when = "2023-07-26"
@@ -1195,27 +841,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasm-smith]]
-version = "0.12.10"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasm-smith]]
-version = "0.12.11"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasm-smith]]
-version = "0.12.12"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasm-smith]]
 version = "0.12.13"
 when = "2023-07-26"
@@ -1223,13 +848,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasmparser]]
-version = "0.107.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasmparser]]
 version = "0.108.0"
 when = "2023-07-11"
@@ -1237,13 +855,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasmparser]]
-version = "0.109.0"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasmparser]]
 version = "0.110.0"
 when = "2023-07-26"
@@ -1251,27 +862,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wasmprinter]]
-version = "0.2.59"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasmprinter]]
-version = "0.2.60"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wasmprinter]]
-version = "0.2.61"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wasmprinter]]
 version = "0.2.62"
 when = "2023-07-26"
@@ -1280,176 +870,149 @@ user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wasmtime]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-asm-macros]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cache]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cli]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cli-flags]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-component-macro]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-component-util]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cranelift]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-cranelift-shared]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-environ]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-explorer]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-fiber]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit-debug]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-jit-icache-coherence]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-runtime]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-types]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi]]
-version = "10.0.1"
-when = "2023-06-21"
-user-id = 73222
-user-login = "wasmtime-publish"
-
-[[publisher.wasmtime-wasi-crypto]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-http]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-nn]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wasi-threads]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wast]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-winch]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wasmtime-wit-bindgen]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
-[[publisher.wast]]
-version = "60.0.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wast]]
-version = "61.0.0"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wast]]
-version = "62.0.0"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wast]]
 version = "62.0.1"
 when = "2023-07-26"
@@ -1457,27 +1020,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wat]]
-version = "1.0.66"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wat]]
-version = "1.0.67"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wat]]
-version = "1.0.68"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wat]]
 version = "1.0.69"
 when = "2023-07-26"
@@ -1486,20 +1028,20 @@ user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wiggle]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wiggle-generate]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
 [[publisher.wiggle-macro]]
-version = "10.0.1"
-when = "2023-06-21"
+version = "11.0.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
@@ -1518,18 +1060,11 @@ user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
 [[publisher.winch-codegen]]
-version = "0.8.1"
-when = "2023-06-21"
+version = "0.9.1"
+when = "2023-07-24"
 user-id = 73222
 user-login = "wasmtime-publish"
 
-[[publisher.windows-sys]]
-version = "0.45.0"
-when = "2023-01-21"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows-sys]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1537,13 +1072,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows-targets]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows-targets]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1551,13 +1079,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_aarch64_gnullvm]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_aarch64_gnullvm]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1565,13 +1086,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_aarch64_msvc]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_aarch64_msvc]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1579,13 +1093,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_i686_gnu]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_i686_gnu]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1593,13 +1100,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_i686_msvc]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_i686_msvc]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1607,13 +1107,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_x86_64_gnu]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_x86_64_gnu]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1621,13 +1114,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_x86_64_gnullvm]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_x86_64_gnullvm]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1635,13 +1121,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows_x86_64_msvc]]
-version = "0.42.1"
-when = "2023-01-12"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows_x86_64_msvc]]
 version = "0.48.0"
 when = "2023-03-31"
@@ -1657,43 +1136,36 @@ user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
 [[publisher.wit-bindgen]]
-version = "0.7.0"
-when = "2023-05-26"
+version = "0.9.0"
+when = "2023-07-15"
 user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wit-bindgen-core]]
-version = "0.7.0"
-when = "2023-05-26"
+version = "0.9.0"
+when = "2023-07-15"
 user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wit-bindgen-rust]]
-version = "0.7.0"
-when = "2023-05-26"
+version = "0.9.0"
+when = "2023-07-15"
 user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wit-bindgen-rust-lib]]
-version = "0.7.0"
-when = "2023-05-26"
+version = "0.9.0"
+when = "2023-07-15"
 user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
 [[publisher.wit-bindgen-rust-macro]]
-version = "0.7.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wit-component]]
-version = "0.11.0"
-when = "2023-05-26"
+version = "0.9.0"
+when = "2023-07-15"
 user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
@@ -1705,13 +1177,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wit-component]]
-version = "0.13.0"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wit-component]]
 version = "0.13.1"
 when = "2023-07-26"
@@ -1719,27 +1184,6 @@ user-id = 1
 user-login = "alexcrichton"
 user-name = "Alex Crichton"
 
-[[publisher.wit-parser]]
-version = "0.8.0"
-when = "2023-05-26"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wit-parser]]
-version = "0.9.0"
-when = "2023-07-11"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
-[[publisher.wit-parser]]
-version = "0.9.1"
-when = "2023-07-17"
-user-id = 1
-user-login = "alexcrichton"
-user-name = "Alex Crichton"
-
 [[publisher.wit-parser]]
 version = "0.9.2"
 when = "2023-07-26"
@@ -1794,12 +1238,6 @@ criteria = "safe-to-deploy"
 version = "0.2.1"
 notes = "Single unsafe usage that looks sound, no ambient capabilities"
 
-[[audits.embark-studios.audits.valuable]]
-who = "Johan Andersson <opensource@embark-studios.com>"
-criteria = "safe-to-deploy"
-version = "0.1.0"
-notes = "No unsafe usage or ambient capabilities, sane build script"
-
 [[audits.embark-studios.audits.webpki-roots]]
 who = "Johan Andersson <opensource@embark-studios.com>"
 criteria = "safe-to-deploy"
@@ -1833,23 +1271,12 @@ criteria = "safe-to-run"
 version = "0.4.4"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
 
-[[audits.google.audits.miniz_oxide]]
-who = "George Burgess IV <gbiv@google.com>"
-criteria = "safe-to-run"
-version = "0.6.2"
-aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
-
-[[audits.google.audits.miniz_oxide]]
-who = "George Burgess IV <gbiv@google.com>"
-criteria = "safe-to-run"
-delta = "0.6.2 -> 0.7.1"
-aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
-
-[[audits.google.audits.proc-macro-error-attr]]
-who = "George Burgess IV <gbiv@google.com>"
+[[audits.google.audits.pin-project-lite]]
+who = "David Koloski <dkoloski@google.com>"
 criteria = "safe-to-deploy"
-version = "1.0.4"
-aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
+version = "0.2.9"
+notes = "Reviewed on https://fxrev.dev/824504"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
 
 [[audits.google.audits.static_assertions]]
 who = "ChromeOS"
@@ -1873,11 +1300,6 @@ who = "Brandon Pitman <bran@bran.land>"
 criteria = "safe-to-run"
 delta = "0.4.0 -> 0.5.1"
 
-[[audits.isrg.audits.libc]]
-who = "Brandon Pitman <bran@bran.land>"
-criteria = "safe-to-deploy"
-delta = "0.2.139 -> 0.2.141"
-
 [[audits.isrg.audits.once_cell]]
 who = "Brandon Pitman <bran@bran.land>"
 criteria = "safe-to-deploy"
@@ -1888,26 +1310,21 @@ who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
 delta = "1.17.2 -> 1.18.0"
 
-[[audits.isrg.audits.opaque-debug]]
+[[audits.isrg.audits.rand_core]]
 who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
-version = "0.3.0"
+version = "0.6.3"
 
-[[audits.isrg.audits.universal-hash]]
+[[audits.isrg.audits.sha2]]
 who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
-version = "0.4.1"
+version = "0.10.2"
 
 [[audits.isrg.audits.untrusted]]
 who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
 version = "0.7.1"
 
-[[audits.isrg.audits.wasm-bindgen-shared]]
-who = "David Cook <dcook@divviup.org>"
-criteria = "safe-to-deploy"
-version = "0.2.83"
-
 [[audits.mozilla.wildcard-audits.unicode-segmentation]]
 who = "Manish Goregaokar <manishsmail@gmail.com>"
 criteria = "safe-to-deploy"
@@ -2142,18 +1559,6 @@ version = "1.4.0"
 notes = "I have read over the macros, and audited the unsafe code."
 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
 
-[[audits.mozilla.audits.libc]]
-who = "Mike Hommey <mh+mozilla@glandium.org>"
-criteria = "safe-to-deploy"
-delta = "0.2.132 -> 0.2.138"
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
-[[audits.mozilla.audits.libc]]
-who = "Mike Hommey <mh+mozilla@glandium.org>"
-criteria = "safe-to-deploy"
-delta = "0.2.138 -> 0.2.139"
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
 [[audits.mozilla.audits.log]]
 who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"
@@ -2166,20 +1571,6 @@ criteria = "safe-to-deploy"
 delta = "0.6.5 -> 0.7.1"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
-[[audits.mozilla.audits.num-integer]]
-who = "Josh Stone <jistone@redhat.com>"
-criteria = "safe-to-deploy"
-version = "0.1.45"
-notes = "All code written or reviewed by Josh Stone."
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
-[[audits.mozilla.audits.num-iter]]
-who = "Josh Stone <jistone@redhat.com>"
-criteria = "safe-to-deploy"
-version = "0.1.43"
-notes = "All code written or reviewed by Josh Stone."
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
 [[audits.mozilla.audits.num-traits]]
 who = "Josh Stone <jistone@redhat.com>"
 criteria = "safe-to-deploy"
@@ -2272,34 +1663,6 @@ delta = "1.0.57 -> 1.0.59"
 notes = "Enabled on Wasm"
 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
 
-[[audits.mozilla.audits.quote]]
-who = "Nika Layzell <nika@thelayzells.com>"
-criteria = "safe-to-deploy"
-version = "1.0.18"
-notes = """
-`quote` is a utility crate used by proc-macros to generate TokenStreams
-conveniently from source code. The bulk of the logic is some complex
-interlocking `macro_rules!` macros which are used to parse and build the
-`TokenStream` within the proc-macro.
-
-This crate contains no unsafe code, and the internal logic, while difficult to
-read, is generally straightforward. I have audited the the quote macros, ident
-formatter, and runtime logic.
-"""
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
-[[audits.mozilla.audits.quote]]
-who = "Mike Hommey <mh+mozilla@glandium.org>"
-criteria = "safe-to-deploy"
-delta = "1.0.18 -> 1.0.21"
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
-[[audits.mozilla.audits.quote]]
-who = "Mike Hommey <mh+mozilla@glandium.org>"
-criteria = "safe-to-deploy"
-delta = "1.0.21 -> 1.0.23"
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
 [[audits.mozilla.audits.rayon]]
 who = "Josh Stone <jistone@redhat.com>"
 criteria = "safe-to-deploy"
@@ -2343,17 +1706,6 @@ criteria = "safe-to-deploy"
 delta = "0.4.4 -> 0.4.7"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
-[[audits.mozilla.audits.synstructure]]
-who = "Nika Layzell <nika@thelayzells.com>"
-criteria = "safe-to-deploy"
-version = "0.12.6"
-notes = """
-I am the primary author of the `synstructure` crate, and its current
-maintainer. The one use of `unsafe` is unnecessary, but documented and
-harmless. It will be removed in the next version.
-"""
-aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
-
 [[audits.mozilla.audits.toml]]
 who = "Bobby Holley <bobbyholley@gmail.com>"
 criteria = "safe-to-deploy"
diff --git a/tests/all/cli_tests.rs b/tests/all/cli_tests.rs
index b5a33f59226d..d7fd98cc103f 100644
--- a/tests/all/cli_tests.rs
+++ b/tests/all/cli_tests.rs
@@ -717,3 +717,17 @@ fn wasm_flags_without_subcommand() -> Result<()> {
     );
     Ok(())
 }
+
+#[test]
+fn wasi_misaligned_pointer() -> Result<()> {
+    let output = get_wasmtime_command()?
+        .arg("./tests/all/cli_tests/wasi_misaligned_pointer.wat")
+        .output()?;
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("Pointer not aligned"),
+        "bad stderr: {stderr}",
+    );
+    Ok(())
+}
diff --git a/tests/all/cli_tests/wasi_misaligned_pointer.wat b/tests/all/cli_tests/wasi_misaligned_pointer.wat
new file mode 100644
index 000000000000..99b43f976108
--- /dev/null
+++ b/tests/all/cli_tests/wasi_misaligned_pointer.wat
@@ -0,0 +1,16 @@
+(module
+  (import "wasi_snapshot_preview1" "fd_write" (func $write (param i32 i32 i32 i32) (result i32)))
+
+  (memory (export "memory") 1)
+
+  (func (export "_start")
+    (call $write
+      (i32.const 1) ;; fd=1
+      (i32.const 1) ;; ciovec_base=1 (misaligned)
+      (i32.const 1) ;; ciovec_len=1
+      (i32.const 0) ;; retptr=0
+    )
+    drop
+
+  )
+)
diff --git a/tests/all/component_model/aot.rs b/tests/all/component_model/aot.rs
index df6e0b66318c..5fc5c8890a6d 100644
--- a/tests/all/component_model/aot.rs
+++ b/tests/all/component_model/aot.rs
@@ -1,6 +1,6 @@
 use anyhow::Result;
 use wasmtime::component::{Component, Linker};
-use wasmtime::{Module, Store};
+use wasmtime::{Module, Precompiled, Store};
 
 #[test]
 fn module_component_mismatch() -> Result<()> {
@@ -119,3 +119,17 @@ fn usable_exported_modules() -> Result<()> {
     core_linker.instantiate(&mut store, &module)?;
     Ok(())
 }
+
+#[test]
+#[cfg_attr(miri, ignore)]
+fn detect_precompiled() -> Result<()> {
+    let engine = super::engine();
+    let buffer = Component::new(&engine, "(component)")?.serialize()?;
+    assert_eq!(engine.detect_precompiled(&[]), None);
+    assert_eq!(engine.detect_precompiled(&buffer[..5]), None);
+    assert_eq!(
+        engine.detect_precompiled(&buffer),
+        Some(Precompiled::Component)
+    );
+    Ok(())
+}
diff --git a/tests/all/component_model/bindgen/results.rs b/tests/all/component_model/bindgen/results.rs
index d0c49e40245e..6c0b3f8b6472 100644
--- a/tests/all/component_model/bindgen/results.rs
+++ b/tests/all/component_model/bindgen/results.rs
@@ -238,7 +238,7 @@ mod enum_error {
                 enum-error: func(a: float64) -> result<float64, e1>
             }
         }",
-        trappable_error_type: { imports::e1: TrappableE1 }
+        trappable_error_type: { "inline:inline/imports"::e1: TrappableE1 }
     });
 
     #[test]
@@ -402,7 +402,7 @@ mod record_error {
         }",
         // Literal strings can be used for the interface and typename fields instead of
         // identifiers, because wit identifiers arent always Rust identifiers.
-        trappable_error_type: { "imports"::"e2": TrappableE2 }
+        trappable_error_type: { "inline:inline/imports"::"e2": TrappableE2 }
     });
 
     #[test]
@@ -556,7 +556,7 @@ mod variant_error {
                 variant-error: func(a: float64) -> result<float64, e3>
             }
         }",
-        trappable_error_type: { imports::e3: TrappableE3 }
+        trappable_error_type: { "inline:inline/imports"::e3: TrappableE3 }
     });
 
     #[test]
@@ -710,6 +710,187 @@ mod variant_error {
     }
 }
 
+mod multiple_interfaces_error {
+    use super::*;
+    use exports::foo;
+    use inline::inline::imports;
+    use inline::inline::types;
+
+    wasmtime::component::bindgen!({
+        inline: "
+        package inline:inline
+        interface types {
+            enum e1 { a, b, c }
+            enum-error: func(a: float64) -> result<float64, e1>
+        }
+        interface imports {
+            use types.{e1}
+            enum-error: func(a: float64) -> result<float64, e1>
+        }
+        world result-playground {
+            import imports
+            export foo: interface {
+                enum e1 { a, b, c }
+                enum-error: func(a: float64) -> result<float64, e1>
+            }
+        }",
+        trappable_error_type: { "inline:inline/types"::e1: TrappableE1 }
+    });
+
+    #[test]
+    fn run() -> Result<(), Error> {
+        let engine = engine();
+        // NOTE: this component doesn't make use of a types import, and relies instead on
+        // subtyping.
+        let component = Component::new(
+            &engine,
+            format!(
+                r#"
+            (component
+                (type $err' (enum "a" "b" "c"))
+                (import (interface "inline:inline/imports") (instance $i
+                    (export $e1 "e1" (type (eq $err')))
+                    (export "enum-error" (func (param "a" float64) (result (result float64 (error $e1)))))
+                ))
+                (core module $libc
+                    (memory (export "memory") 1)
+                    {REALLOC_AND_FREE}
+                )
+                (core instance $libc (instantiate $libc))
+                (core module $m
+                    (import "" "core_enum_error" (func $f (param f64 i32)))
+                    (import "libc" "memory" (memory 0))
+                    (import "libc" "realloc" (func $realloc (param i32 i32 i32 i32) (result i32)))
+                    (func (export "core_enum_error_export") (param f64) (result i32)
+                        (local $retptr i32)
+                        (local.set $retptr
+                            (call $realloc
+                                (i32.const 0)
+                                (i32.const 0)
+                                (i32.const 4)
+                                (i32.const 16)))
+                        (call $f (local.get 0) (local.get $retptr))
+                        (local.get $retptr)
+                    )
+                )
+                (core func $core_enum_error
+                    (canon lower (func $i "enum-error") (memory $libc "memory") (realloc (func $libc "realloc")))
+                )
+                (core instance $i (instantiate $m
+                    (with "" (instance (export "core_enum_error" (func $core_enum_error))))
+                    (with "libc" (instance $libc))
+                ))
+                (func $f_enum_error
+                    (param "a" float64)
+                    (result (result float64 (error $err')))
+                    (canon lift (core func $i "core_enum_error_export") (memory $libc "memory"))
+                )
+
+                (component $nested
+                    (import "f-err" (type $err (eq $err')))
+                    (import "f" (func $f (param "a" float64) (result (result float64 (error $err)))))
+                    (export $err2 "err" (type $err'))
+                    (export "enum-error" (func $f) (func (param "a" float64) (result (result float64 (error $err2)))))
+                )
+
+                (instance $n (instantiate $nested
+                    (with "f-err" (type $err'))
+                    (with "f" (func $f_enum_error))
+                ))
+                (export "foo" (instance $n))
+            )
+        "#
+            ),
+        )?;
+
+        // You can create concrete trap types which make it all the way out to the
+        // host caller, via downcast_ref below.
+        #[derive(Debug)]
+        struct MyTrap;
+
+        impl std::fmt::Display for MyTrap {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                write!(f, "{:?}", self)
+            }
+        }
+        impl std::error::Error for MyTrap {}
+
+        // It is possible to define From impls that target these generated trappable
+        // types. This allows you to integrate libraries with other error types, or
+        // use your own more descriptive error types, and use ? to convert them at
+        // their throw site.
+        impl From<MyTrap> for types::TrappableE1 {
+            fn from(t: MyTrap) -> types::TrappableE1 {
+                types::TrappableE1::trap(anyhow!(t))
+            }
+        }
+
+        #[derive(Default)]
+        struct MyImports {}
+
+        impl types::Host for MyImports {
+            fn enum_error(&mut self, a: f64) -> Result<f64, types::TrappableE1> {
+                if a == 0.0 {
+                    Ok(a)
+                } else if a == 1.0 {
+                    Err(imports::E1::A)?
+                } else {
+                    Err(MyTrap)?
+                }
+            }
+        }
+
+        impl imports::Host for MyImports {
+            fn enum_error(&mut self, a: f64) -> Result<f64, types::TrappableE1> {
+                if a == 0.0 {
+                    Ok(a)
+                } else if a == 1.0 {
+                    Err(imports::E1::A)?
+                } else {
+                    Err(MyTrap)?
+                }
+            }
+        }
+
+        let mut linker = Linker::new(&engine);
+        imports::add_to_linker(&mut linker, |f: &mut MyImports| f)?;
+
+        let mut store = Store::new(&engine, MyImports::default());
+        let (results, _) = ResultPlayground::instantiate(&mut store, &component, &linker)?;
+
+        assert_eq!(
+            results
+                .foo()
+                .call_enum_error(&mut store, 0.0)
+                .expect("no trap")
+                .expect("no error returned"),
+            0.0
+        );
+
+        let e = results
+            .foo()
+            .call_enum_error(&mut store, 1.0)
+            .expect("no trap")
+            .err()
+            .expect("error returned");
+        assert_eq!(e, foo::E1::A);
+
+        let e = results
+            .foo()
+            .call_enum_error(&mut store, 2.0)
+            .err()
+            .expect("trap");
+        assert_eq!(
+            format!("{}", e.source().expect("trap message is stored in source")),
+            "MyTrap"
+        );
+        e.downcast_ref::<MyTrap>()
+            .expect("downcast trap to concrete MyTrap type");
+
+        Ok(())
+    }
+}
+
 mod with_remapping {
     use super::*;
 
diff --git a/tests/all/module_serialize.rs b/tests/all/module_serialize.rs
index 023018528f60..6f83b3b3b0fc 100644
--- a/tests/all/module_serialize.rs
+++ b/tests/all/module_serialize.rs
@@ -119,3 +119,20 @@ fn deserialize_from_serialized() -> Result<()> {
     assert!(buffer1 == buffer2);
     Ok(())
 }
+
+#[test]
+#[cfg_attr(miri, ignore)]
+fn detect_precompiled() -> Result<()> {
+    let engine = Engine::default();
+    let buffer = serialize(
+        &engine,
+        "(module (func (export \"run\") (result i32) i32.const 42))",
+    )?;
+    assert_eq!(engine.detect_precompiled(&[]), None);
+    assert_eq!(engine.detect_precompiled(&buffer[..5]), None);
+    assert_eq!(
+        engine.detect_precompiled(&buffer),
+        Some(Precompiled::Module)
+    );
+    Ok(())
+}
diff --git a/winch/codegen/Cargo.toml b/winch/codegen/Cargo.toml
index e9aa457acbde..673ddc86ddb6 100644
--- a/winch/codegen/Cargo.toml
+++ b/winch/codegen/Cargo.toml
@@ -4,7 +4,7 @@ name = "winch-codegen"
 description = "Winch code generation library"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
-version = "0.10.0"
+version = "0.11.0"
 edition.workspace = true
 
 [dependencies]
diff --git a/winch/codegen/src/isa/aarch64/address.rs b/winch/codegen/src/isa/aarch64/address.rs
index 8024b8ea25c5..11521e5ce516 100644
--- a/winch/codegen/src/isa/aarch64/address.rs
+++ b/winch/codegen/src/isa/aarch64/address.rs
@@ -102,9 +102,9 @@ impl TryFrom<Address> for PairAMode {
                 })?;
 
                 if indexing == Pre {
-                    Ok(PairAMode::SPPreIndexed(simm7))
+                    Ok(PairAMode::SPPreIndexed { simm7 })
                 } else {
-                    Ok(PairAMode::SPPostIndexed(simm7))
+                    Ok(PairAMode::SPPostIndexed { simm7 })
                 }
             }
             other => Err(anyhow!(
diff --git a/winch/codegen/src/isa/x64/asm.rs b/winch/codegen/src/isa/x64/asm.rs
index 0a8e06e30591..0d0ab67d800d 100644
--- a/winch/codegen/src/isa/x64/asm.rs
+++ b/winch/codegen/src/isa/x64/asm.rs
@@ -225,7 +225,7 @@ impl Assembler {
 
     /// Register-to-memory move.
     pub fn mov_rm(&mut self, src: Reg, base: Reg, disp: u32, size: OperandSize) {
-        let dst = Amode::imm_reg(disp, base.into());
+        let dst = Amode::imm_reg(disp as i32, base.into());
 
         self.emit(Inst::MovRM {
             size: size.into(),
@@ -236,7 +236,7 @@ impl Assembler {
 
     /// Immediate-to-memory move.
     pub fn mov_im(&mut self, src: u64, base: Reg, disp: u32, size: OperandSize) {
-        let dst = Amode::imm_reg(disp, base.into());
+        let dst = Amode::imm_reg(disp as i32, base.into());
         self.emit(Inst::MovImmM {
             size: size.into(),
             simm64: src,
@@ -260,7 +260,7 @@ impl Assembler {
     pub fn mov_mr(&mut self, base: Reg, disp: u32, dst: Reg, size: OperandSize) {
         use OperandSize::S64;
 
-        let amode = Amode::imm_reg(disp, base.into());
+        let amode = Amode::imm_reg(disp as i32, base.into());
         let src = SyntheticAmode::real(amode);
 
         if size == S64 {