|
| 1 | +//! This is an incomplete implementation of mmap/munmap which is restricted in order to be |
| 2 | +//! implementable on top of the existing memory system. The point of these function as-written is |
| 3 | +//! to allow memory allocators written entirely in Rust to be executed by Miri. This implementation |
| 4 | +//! does not support other uses of mmap such as file mappings. |
| 5 | +//! |
| 6 | +//! mmap/munmap behave a lot like alloc/dealloc, and for simple use they are exactly |
| 7 | +//! equivalent. That is the only part we support: no MAP_FIXED or MAP_SHARED or anything |
| 8 | +//! else that goes beyond a basic allocation API. |
| 9 | +
|
| 10 | +use crate::*; |
| 11 | +use rustc_target::abi::Size; |
| 12 | + |
| 13 | +impl<'mir, 'tcx: 'mir> EvalContextExt<'mir, 'tcx> for crate::MiriInterpCx<'mir, 'tcx> {} |
| 14 | +pub trait EvalContextExt<'mir, 'tcx: 'mir>: crate::MiriInterpCxExt<'mir, 'tcx> { |
| 15 | + fn mmap( |
| 16 | + &mut self, |
| 17 | + addr: &OpTy<'tcx, Provenance>, |
| 18 | + length: &OpTy<'tcx, Provenance>, |
| 19 | + prot: &OpTy<'tcx, Provenance>, |
| 20 | + flags: &OpTy<'tcx, Provenance>, |
| 21 | + fd: &OpTy<'tcx, Provenance>, |
| 22 | + offset: &OpTy<'tcx, Provenance>, |
| 23 | + ) -> InterpResult<'tcx, Scalar<Provenance>> { |
| 24 | + let this = self.eval_context_mut(); |
| 25 | + |
| 26 | + // We do not support MAP_FIXED, so the addr argument is always ignored (except for the MacOS hack) |
| 27 | + let addr = this.read_target_usize(addr)?; |
| 28 | + let length = this.read_target_usize(length)?; |
| 29 | + let prot = this.read_scalar(prot)?.to_i32()?; |
| 30 | + let flags = this.read_scalar(flags)?.to_i32()?; |
| 31 | + let fd = this.read_scalar(fd)?.to_i32()?; |
| 32 | + let offset = this.read_target_usize(offset)?; |
| 33 | + |
| 34 | + let map_private = this.eval_libc_i32("MAP_PRIVATE"); |
| 35 | + let map_anonymous = this.eval_libc_i32("MAP_ANONYMOUS"); |
| 36 | + let map_shared = this.eval_libc_i32("MAP_SHARED"); |
| 37 | + let map_fixed = this.eval_libc_i32("MAP_FIXED"); |
| 38 | + |
| 39 | + // This is a horrible hack, but on MacOS the guard page mechanism uses mmap |
| 40 | + // in a way we do not support. We just give it the return value it expects. |
| 41 | + if this.frame_in_std() && this.tcx.sess.target.os == "macos" && (flags & map_fixed) != 0 { |
| 42 | + return Ok(Scalar::from_maybe_pointer(Pointer::from_addr_invalid(addr), this)); |
| 43 | + } |
| 44 | + |
| 45 | + let prot_read = this.eval_libc_i32("PROT_READ"); |
| 46 | + let prot_write = this.eval_libc_i32("PROT_WRITE"); |
| 47 | + |
| 48 | + // First, we do some basic argument validation as required by mmap |
| 49 | + if (flags & (map_private | map_shared)).count_ones() != 1 { |
| 50 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 51 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 52 | + } |
| 53 | + if length == 0 { |
| 54 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 55 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 56 | + } |
| 57 | + |
| 58 | + // If a user tries to map a file, we want to loudly inform them that this is not going |
| 59 | + // to work. It is possible that POSIX gives us enough leeway to return an error, but the |
| 60 | + // outcome for the user (I need to add cfg(miri)) is the same, just more frustrating. |
| 61 | + if fd != -1 { |
| 62 | + throw_unsup_format!("Miri does not support file-backed memory mappings"); |
| 63 | + } |
| 64 | + |
| 65 | + // POSIX says: |
| 66 | + // [ENOTSUP] |
| 67 | + // * MAP_FIXED or MAP_PRIVATE was specified in the flags argument and the implementation |
| 68 | + // does not support this functionality. |
| 69 | + // * The implementation does not support the combination of accesses requested in the |
| 70 | + // prot argument. |
| 71 | + // |
| 72 | + // Miri doesn't support MAP_FIXED or any any protections other than PROT_READ|PROT_WRITE. |
| 73 | + if flags & map_fixed != 0 || prot != prot_read | prot_write { |
| 74 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("ENOTSUP")))?; |
| 75 | + return Ok(Scalar::from_maybe_pointer(Pointer::null(), this)); |
| 76 | + } |
| 77 | + |
| 78 | + // Miri does not support shared mappings, or any of the other extensions that for example |
| 79 | + // Linux has added to the flags arguments. |
| 80 | + if flags != map_private | map_anonymous { |
| 81 | + throw_unsup_format!( |
| 82 | + "Miri only supports calls to mmap which set the flags argument to MAP_PRIVATE|MAP_ANONYMOUS" |
| 83 | + ); |
| 84 | + } |
| 85 | + |
| 86 | + // This is only used for file mappings, which we don't support anyway. |
| 87 | + if offset != 0 { |
| 88 | + throw_unsup_format!("Miri does not support non-zero offsets to mmap"); |
| 89 | + } |
| 90 | + |
| 91 | + let align = this.machine.page_align(); |
| 92 | + let map_length = this.machine.round_up_to_multiple_of_page_size(length).unwrap_or(u64::MAX); |
| 93 | + |
| 94 | + let ptr = |
| 95 | + this.allocate_ptr(Size::from_bytes(map_length), align, MiriMemoryKind::Mmap.into())?; |
| 96 | + // We just allocated this, the access is definitely in-bounds and fits into our address space. |
| 97 | + // mmap guarantees new mappings are zero-init. |
| 98 | + this.write_bytes_ptr( |
| 99 | + ptr.into(), |
| 100 | + std::iter::repeat(0u8).take(usize::try_from(map_length).unwrap()), |
| 101 | + ) |
| 102 | + .unwrap(); |
| 103 | + // Memory mappings don't use provenance, and are always exposed. |
| 104 | + Machine::expose_ptr(this, ptr)?; |
| 105 | + |
| 106 | + Ok(Scalar::from_pointer(ptr, this)) |
| 107 | + } |
| 108 | + |
| 109 | + fn munmap( |
| 110 | + &mut self, |
| 111 | + addr: &OpTy<'tcx, Provenance>, |
| 112 | + length: &OpTy<'tcx, Provenance>, |
| 113 | + ) -> InterpResult<'tcx, Scalar<Provenance>> { |
| 114 | + let this = self.eval_context_mut(); |
| 115 | + |
| 116 | + let addr = this.read_target_usize(addr)?; |
| 117 | + let length = this.read_target_usize(length)?; |
| 118 | + |
| 119 | + // addr must be a multiple of the page size |
| 120 | + #[allow(clippy::arithmetic_side_effects)] // PAGE_SIZE is nonzero |
| 121 | + if addr % this.machine.page_size != 0 { |
| 122 | + this.set_last_error(Scalar::from_i32(this.eval_libc_i32("EINVAL")))?; |
| 123 | + return Ok(Scalar::from_i32(-1)); |
| 124 | + } |
| 125 | + |
| 126 | + let length = this.machine.round_up_to_multiple_of_page_size(length).unwrap_or(u64::MAX); |
| 127 | + |
| 128 | + let ptr = Machine::ptr_from_addr_cast(this, addr)?; |
| 129 | + |
| 130 | + let Ok(ptr) = ptr.into_pointer_or_addr() else { |
| 131 | + throw_unsup_format!("Miri only supports munmap on memory allocated directly by mmap"); |
| 132 | + }; |
| 133 | + let Some((alloc_id, offset, _prov)) = Machine::ptr_get_alloc(this, ptr) else { |
| 134 | + throw_unsup_format!("Miri only supports munmap on memory allocated directly by mmap"); |
| 135 | + }; |
| 136 | + |
| 137 | + // Elsewhere in this function we are careful to check what we can and throw an unsupported |
| 138 | + // error instead of Undefined Behavior when use of this function falls outside of the |
| 139 | + // narrow scope we support. We deliberately do not check the MemoryKind of this allocation, |
| 140 | + // because we want to report UB on attempting to unmap memory that Rust "understands", such |
| 141 | + // the stack, heap, or statics. |
| 142 | + let (_kind, alloc) = this.memory.alloc_map().get(alloc_id).unwrap(); |
| 143 | + if offset != Size::ZERO || alloc.len() as u64 != length { |
| 144 | + throw_unsup_format!( |
| 145 | + "Miri only supports munmap calls that exactly unmap a region previously returned by mmap" |
| 146 | + ); |
| 147 | + } |
| 148 | + |
| 149 | + let len = Size::from_bytes(alloc.len() as u64); |
| 150 | + this.deallocate_ptr( |
| 151 | + ptr.into(), |
| 152 | + Some((len, this.machine.page_align())), |
| 153 | + MemoryKind::Machine(MiriMemoryKind::Mmap), |
| 154 | + )?; |
| 155 | + |
| 156 | + Ok(Scalar::from_i32(0)) |
| 157 | + } |
| 158 | +} |
0 commit comments