|
| 1 | +//! This is an incomplete implementation of mmap/mremap/munmap which is restricted in order to be |
| 2 | +//! implementable on top of the existing memory system. The point of these function as-written is |
| 3 | +//! to allow memory allocators written entirely in Rust to be executed by Miri. This implementation |
| 4 | +//! does not support other uses of mmap such as file mappings. |
| 5 | +//! |
| 6 | +//! mmap/mremap/munmap behave a lot like alloc/realloc/dealloc, and for simple use they are exactly |
| 7 | +//! equivalent. That is the only part we support: no MAP_FIXED or MAP_SHARED or anything |
| 8 | +//! else that goes beyond a basic allocation API. |
| 9 | +
|
| 10 | +use crate::*; |
| 11 | +use rustc_target::abi::{Align, Size}; |
| 12 | + |
| 13 | +impl<'mir, 'tcx: 'mir> EvalContextExt<'mir, 'tcx> for crate::MiriInterpCx<'mir, 'tcx> {} |
| 14 | +pub trait EvalContextExt<'mir, 'tcx: 'mir>: crate::MiriInterpCxExt<'mir, 'tcx> { |
| 15 | + fn mmap( |
| 16 | + &mut self, |
| 17 | + addr: &OpTy<'tcx, Provenance>, |
| 18 | + length: &OpTy<'tcx, Provenance>, |
| 19 | + prot: &OpTy<'tcx, Provenance>, |
| 20 | + flags: &OpTy<'tcx, Provenance>, |
| 21 | + fd: &OpTy<'tcx, Provenance>, |
| 22 | + offset: &OpTy<'tcx, Provenance>, |
| 23 | + ) -> InterpResult<'tcx, Scalar<Provenance>> { |
| 24 | + let this = self.eval_context_mut(); |
| 25 | + |
| 26 | + // We do not support MAP_FIXED, so the addr argument is always ignored |
| 27 | + let addr = this.read_pointer(addr)?; |
| 28 | + let length = this.read_target_usize(length)?; |
| 29 | + let prot = this.read_scalar(prot)?.to_i32()?; |
| 30 | + let flags = this.read_scalar(flags)?.to_i32()?; |
| 31 | + let fd = this.read_scalar(fd)?.to_i32()?; |
| 32 | + let offset = this.read_scalar(offset)?.to_target_usize(this)?; |
| 33 | + |
| 34 | + let map_private = this.eval_libc_i32("MAP_PRIVATE"); |
| 35 | + let map_anonymous = this.eval_libc_i32("MAP_ANONYMOUS"); |
| 36 | + let map_shared = this.eval_libc_i32("MAP_SHARED"); |
| 37 | + let map_fixed = this.eval_libc_i32("MAP_FIXED"); |
| 38 | + |
| 39 | + // This is a horrible hack, but on macos the guard page mechanism uses mmap |
| 40 | + // in a way we do not support. We just give it the return value it expects. |
| 41 | + if this.frame_in_std() && this.tcx.sess.target.os == "macos" && (flags & map_fixed) != 0 { |
| 42 | + return Ok(Scalar::from_maybe_pointer(addr, this)); |
| 43 | + } |
| 44 | + |
| 45 | + let prot_read = this.eval_libc_i32("PROT_READ"); |
| 46 | + let prot_write = this.eval_libc_i32("PROT_WRITE"); |
| 47 | + |
| 48 | + // First, we do some basic argument validation as required by mmap |
| 49 | + if (flags & (map_private | map_shared)).count_ones() != 1 { |
| 50 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 51 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 52 | + } |
| 53 | + if length == 0 { |
| 54 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 55 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 56 | + } |
| 57 | + |
| 58 | + // If a user tries to map a file, we want to loudly inform them that this is not going |
| 59 | + // to work. It is possible that POSIX gives us enough leeway to return an error, but the |
| 60 | + // outcome for the user (I need to add cfg(miri)) is the same, just more frustrating. |
| 61 | + if fd != -1 { |
| 62 | + throw_unsup_format!("Miri does not support file-backed memory mappings"); |
| 63 | + } |
| 64 | + |
| 65 | + // POSIX says: |
| 66 | + // [ENOTSUP] |
| 67 | + // * MAP_FIXED or MAP_PRIVATE was specified in the flags argument and the implementation |
| 68 | + // does not support this functionality. |
| 69 | + // * The implementation does not support the combination of accesses requested in the |
| 70 | + // prot argument. |
| 71 | + // |
| 72 | + // Miri doesn't support MAP_FIXED or any any protections other than PROT_READ|PROT_WRITE. |
| 73 | + if flags & map_fixed != 0 || prot != prot_read | prot_write { |
| 74 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("ENOTSUP")))?; |
| 75 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 76 | + } |
| 77 | + |
| 78 | + // Miri does not support shared mappings, or any of the other extensions that for example |
| 79 | + // Linux has added to the flags arguments. |
| 80 | + if flags != map_private | map_anonymous { |
| 81 | + throw_unsup_format!( |
| 82 | + "Miri only supports calls to mmap which set the flags argument to MAP_PRIVATE|MAP_ANONYMOUS" |
| 83 | + ); |
| 84 | + } |
| 85 | + |
| 86 | + // This is only used for file mappings, which we don't support anyway. |
| 87 | + if offset != 0 { |
| 88 | + throw_unsup_format!("Miri does not support non-zero offsets to mmap"); |
| 89 | + } |
| 90 | + |
| 91 | + let align = Align::from_bytes(this.machine.page_size).unwrap(); |
| 92 | + let map_length = this.machine.round_up_to_multiple_of_page_size(length).unwrap_or(u64::MAX); |
| 93 | + |
| 94 | + let ptr = |
| 95 | + this.allocate_ptr(Size::from_bytes(map_length), align, MiriMemoryKind::Mmap.into())?; |
| 96 | + // We just allocated this, the access is definitely in-bounds and fits into our address space. |
| 97 | + // mmap guarantees new mappings are zero-init. |
| 98 | + this.write_bytes_ptr( |
| 99 | + ptr.into(), |
| 100 | + std::iter::repeat(0u8).take(usize::try_from(map_length).unwrap()), |
| 101 | + ) |
| 102 | + .unwrap(); |
| 103 | + // Memory mappings don't use provenance, and are always exposed. |
| 104 | + Machine::expose_ptr(this, ptr)?; |
| 105 | + |
| 106 | + Ok(Scalar::from_pointer(ptr, this)) |
| 107 | + } |
| 108 | + |
| 109 | + fn mremap( |
| 110 | + &mut self, |
| 111 | + old_address: &OpTy<'tcx, Provenance>, |
| 112 | + old_size: &OpTy<'tcx, Provenance>, |
| 113 | + new_size: &OpTy<'tcx, Provenance>, |
| 114 | + flags: &OpTy<'tcx, Provenance>, |
| 115 | + ) -> InterpResult<'tcx, Scalar<Provenance>> { |
| 116 | + let this = self.eval_context_mut(); |
| 117 | + |
| 118 | + let old_address = this.read_pointer(old_address)?; |
| 119 | + let old_size = this.read_scalar(old_size)?.to_target_usize(this)?; |
| 120 | + let new_size = this.read_scalar(new_size)?.to_target_usize(this)?; |
| 121 | + let flags = this.read_scalar(flags)?.to_i32()?; |
| 122 | + |
| 123 | + // old_address must be a multiple of the page size |
| 124 | + #[allow(clippy::arithmetic_side_effects)] // PAGE_SIZE is nonzero |
| 125 | + if old_address.addr().bytes() % this.machine.page_size != 0 || new_size == 0 { |
| 126 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 127 | + return Ok(this.eval_libc("MAP_FAILED")); |
| 128 | + } |
| 129 | + |
| 130 | + if flags & this.eval_libc_i32("MREMAP_FIXED") != 0 { |
| 131 | + throw_unsup_format!("Miri does not support mremap wth MREMAP_FIXED"); |
| 132 | + } |
| 133 | + |
| 134 | + if flags & this.eval_libc_i32("MREMAP_DONTUNMAP") != 0 { |
| 135 | + throw_unsup_format!("Miri does not support mremap wth MREMAP_DONTUNMAP"); |
| 136 | + } |
| 137 | + |
| 138 | + if flags & this.eval_libc_i32("MREMAP_MAYMOVE") == 0 { |
| 139 | + // We only support MREMAP_MAYMOVE, so not passing the flag is just a failure |
| 140 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 141 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 142 | + } |
| 143 | + |
| 144 | + let align = this.machine.page_align(); |
| 145 | + let ptr = this.reallocate_ptr( |
| 146 | + old_address, |
| 147 | + Some((Size::from_bytes(old_size), align)), |
| 148 | + Size::from_bytes(new_size), |
| 149 | + align, |
| 150 | + MiriMemoryKind::Mmap.into(), |
| 151 | + )?; |
| 152 | + if let Some(increase) = new_size.checked_sub(old_size) { |
| 153 | + // We just allocated this, the access is definitely in-bounds and fits into our address space. |
| 154 | + // mmap guarantees new mappings are zero-init. |
| 155 | + this.write_bytes_ptr( |
| 156 | + ptr.offset(Size::from_bytes(old_size), this).unwrap().into(), |
| 157 | + std::iter::repeat(0u8).take(usize::try_from(increase).unwrap()), |
| 158 | + ) |
| 159 | + .unwrap(); |
| 160 | + } |
| 161 | + // Memory mappings are always exposed |
| 162 | + Machine::expose_ptr(this, ptr)?; |
| 163 | + |
| 164 | + Ok(Scalar::from_pointer(ptr, this)) |
| 165 | + } |
| 166 | + |
| 167 | + fn munmap( |
| 168 | + &mut self, |
| 169 | + addr: &OpTy<'tcx, Provenance>, |
| 170 | + length: &OpTy<'tcx, Provenance>, |
| 171 | + ) -> InterpResult<'tcx, Scalar<Provenance>> { |
| 172 | + let this = self.eval_context_mut(); |
| 173 | + |
| 174 | + let addr = this.read_pointer(addr)?; |
| 175 | + let length = this.read_scalar(length)?.to_target_usize(this)?; |
| 176 | + |
| 177 | + // addr must be a multiple of the page size |
| 178 | + #[allow(clippy::arithmetic_side_effects)] // PAGE_SIZE is nonzero |
| 179 | + if addr.addr().bytes() % this.machine.page_size != 0 { |
| 180 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 181 | + return Ok(Scalar::from_i32(-1)); |
| 182 | + } |
| 183 | + |
| 184 | + let length = this.machine.round_up_to_multiple_of_page_size(length).unwrap_or(u64::MAX); |
| 185 | + |
| 186 | + let mut addr = addr.addr().bytes(); |
| 187 | + let mut bytes_unmapped = 0; |
| 188 | + while bytes_unmapped < length { |
| 189 | + // munmap specifies: |
| 190 | + // It is not an error if the indicated range does not contain any mapped pages. |
| 191 | + // So we make sure that if our address is not that of an exposed allocation, we just |
| 192 | + // step forward to the next page. |
| 193 | + let ptr = Machine::ptr_from_addr_cast(this, addr)?; |
| 194 | + let Ok(ptr) = ptr.into_pointer_or_addr() else { |
| 195 | + bytes_unmapped = bytes_unmapped.checked_add(this.machine.page_size).unwrap(); |
| 196 | + addr = addr.wrapping_add(this.machine.page_size); |
| 197 | + continue; |
| 198 | + }; |
| 199 | + // FIXME: This should fail if the pointer is to an unexposed allocation. But it |
| 200 | + // doesn't. |
| 201 | + let Some((alloc_id, offset, _prov)) = Machine::ptr_get_alloc(this, ptr) else { |
| 202 | + bytes_unmapped = bytes_unmapped.checked_add(this.machine.page_size).unwrap(); |
| 203 | + addr = addr.wrapping_add(this.machine.page_size); |
| 204 | + continue; |
| 205 | + }; |
| 206 | + |
| 207 | + if offset != Size::ZERO { |
| 208 | + throw_unsup_format!("Miri does not support partial munmap"); |
| 209 | + } |
| 210 | + let (_kind, alloc) = this.memory.alloc_map().get(alloc_id).unwrap(); |
| 211 | + let this_alloc_len = alloc.len() as u64; |
| 212 | + bytes_unmapped = bytes_unmapped.checked_add(this_alloc_len).unwrap(); |
| 213 | + if bytes_unmapped > length { |
| 214 | + throw_unsup_format!("Miri does not support partial munmap"); |
| 215 | + } |
| 216 | + |
| 217 | + this.deallocate_ptr( |
| 218 | + Pointer::new(Some(Provenance::Wildcard), Size::from_bytes(addr)), |
| 219 | + Some((Size::from_bytes(this_alloc_len), this.machine.page_align())), |
| 220 | + MemoryKind::Machine(MiriMemoryKind::Mmap), |
| 221 | + )?; |
| 222 | + addr = addr.wrapping_add(this_alloc_len); |
| 223 | + } |
| 224 | + |
| 225 | + Ok(Scalar::from_i32(0)) |
| 226 | + } |
| 227 | +} |
| 228 | + |
| 229 | +trait RangeExt { |
| 230 | + fn overlaps(&self, other: &Self) -> bool; |
| 231 | +} |
| 232 | +impl RangeExt for std::ops::Range<Size> { |
| 233 | + fn overlaps(&self, other: &Self) -> bool { |
| 234 | + self.start.max(other.start) <= self.end.min(other.end) |
| 235 | + } |
| 236 | +} |
0 commit comments