miri/shims/
files.rs

1use std::any::Any;
2use std::collections::BTreeMap;
3use std::fs::{File, Metadata};
4use std::io::{IsTerminal, Seek, SeekFrom, Write};
5use std::marker::CoercePointee;
6use std::ops::Deref;
7use std::rc::{Rc, Weak};
8use std::{fs, io};
9
10use rustc_abi::Size;
11
12use crate::shims::unix::UnixFileDescription;
13use crate::*;
14
15/// A unique id for file descriptions. While we could use the address, considering that
16/// is definitely unique, the address would expose interpreter internal state when used
17/// for sorting things. So instead we generate a unique id per file description is the name
18/// for all `dup`licates and is never reused.
19#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Ord, PartialOrd)]
20pub struct FdId(usize);
21
22#[derive(Debug, Clone)]
23struct FdIdWith<T: ?Sized> {
24    id: FdId,
25    inner: T,
26}
27
28/// A refcounted pointer to a file description, also tracking the
29/// globally unique ID of this file description.
30#[repr(transparent)]
31#[derive(CoercePointee, Debug)]
32pub struct FileDescriptionRef<T: ?Sized>(Rc<FdIdWith<T>>);
33
34impl<T: ?Sized> Clone for FileDescriptionRef<T> {
35    fn clone(&self) -> Self {
36        FileDescriptionRef(self.0.clone())
37    }
38}
39
40impl<T: ?Sized> Deref for FileDescriptionRef<T> {
41    type Target = T;
42    fn deref(&self) -> &T {
43        &self.0.inner
44    }
45}
46
47impl<T: ?Sized> FileDescriptionRef<T> {
48    pub fn id(&self) -> FdId {
49        self.0.id
50    }
51}
52
53/// Holds a weak reference to the actual file description.
54#[derive(Debug)]
55pub struct WeakFileDescriptionRef<T: ?Sized>(Weak<FdIdWith<T>>);
56
57impl<T: ?Sized> Clone for WeakFileDescriptionRef<T> {
58    fn clone(&self) -> Self {
59        WeakFileDescriptionRef(self.0.clone())
60    }
61}
62
63impl<T: ?Sized> FileDescriptionRef<T> {
64    pub fn downgrade(this: &Self) -> WeakFileDescriptionRef<T> {
65        WeakFileDescriptionRef(Rc::downgrade(&this.0))
66    }
67}
68
69impl<T: ?Sized> WeakFileDescriptionRef<T> {
70    pub fn upgrade(&self) -> Option<FileDescriptionRef<T>> {
71        self.0.upgrade().map(FileDescriptionRef)
72    }
73}
74
75impl<T> VisitProvenance for WeakFileDescriptionRef<T> {
76    fn visit_provenance(&self, _visit: &mut VisitWith<'_>) {
77        // A weak reference can never be the only reference to some pointer or place.
78        // Since the actual file description is tracked by strong ref somewhere,
79        // it is ok to make this a NOP operation.
80    }
81}
82
83/// A helper trait to indirectly allow downcasting on `Rc<FdIdWith<dyn _>>`.
84/// Ideally we'd just add a `FdIdWith<Self>: Any` bound to the `FileDescription` trait,
85/// but that does not allow upcasting.
86pub trait FileDescriptionExt: 'static {
87    fn into_rc_any(self: FileDescriptionRef<Self>) -> Rc<dyn Any>;
88
89    /// We wrap the regular `close` function generically, so both handle `Rc::into_inner`
90    /// and epoll interest management.
91    fn close_ref<'tcx>(
92        self: FileDescriptionRef<Self>,
93        communicate_allowed: bool,
94        ecx: &mut MiriInterpCx<'tcx>,
95    ) -> InterpResult<'tcx, io::Result<()>>;
96}
97
98impl<T: FileDescription + 'static> FileDescriptionExt for T {
99    fn into_rc_any(self: FileDescriptionRef<Self>) -> Rc<dyn Any> {
100        self.0
101    }
102
103    fn close_ref<'tcx>(
104        self: FileDescriptionRef<Self>,
105        communicate_allowed: bool,
106        ecx: &mut MiriInterpCx<'tcx>,
107    ) -> InterpResult<'tcx, io::Result<()>> {
108        match Rc::into_inner(self.0) {
109            Some(fd) => {
110                // Remove entry from the global epoll_event_interest table.
111                ecx.machine.epoll_interests.remove(fd.id);
112
113                fd.inner.close(communicate_allowed, ecx)
114            }
115            None => {
116                // Not the last reference.
117                interp_ok(Ok(()))
118            }
119        }
120    }
121}
122
123pub type DynFileDescriptionRef = FileDescriptionRef<dyn FileDescription>;
124
125impl FileDescriptionRef<dyn FileDescription> {
126    pub fn downcast<T: FileDescription + 'static>(self) -> Option<FileDescriptionRef<T>> {
127        let inner = self.into_rc_any().downcast::<FdIdWith<T>>().ok()?;
128        Some(FileDescriptionRef(inner))
129    }
130}
131
132/// Represents an open file description.
133pub trait FileDescription: std::fmt::Debug + FileDescriptionExt {
134    fn name(&self) -> &'static str;
135
136    /// Reads as much as possible into the given buffer `ptr`.
137    /// `len` indicates how many bytes we should try to read.
138    ///
139    /// When the read is done, `finish` will be called. Note that `read` itself may return before
140    /// that happens! Everything that should happen "after" the `read` needs to happen inside
141    /// `finish`.
142    fn read<'tcx>(
143        self: FileDescriptionRef<Self>,
144        _communicate_allowed: bool,
145        _ptr: Pointer,
146        _len: usize,
147        _ecx: &mut MiriInterpCx<'tcx>,
148        _finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
149    ) -> InterpResult<'tcx> {
150        throw_unsup_format!("cannot read from {}", self.name());
151    }
152
153    /// Writes as much as possible from the given buffer `ptr`.
154    /// `len` indicates how many bytes we should try to write.
155    ///
156    /// When the write is done, `finish` will be called. Note that `write` itself may return before
157    /// that happens! Everything that should happen "after" the `write` needs to happen inside
158    /// `finish`.
159    fn write<'tcx>(
160        self: FileDescriptionRef<Self>,
161        _communicate_allowed: bool,
162        _ptr: Pointer,
163        _len: usize,
164        _ecx: &mut MiriInterpCx<'tcx>,
165        _finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
166    ) -> InterpResult<'tcx> {
167        throw_unsup_format!("cannot write to {}", self.name());
168    }
169
170    /// Seeks to the given offset (which can be relative to the beginning, end, or current position).
171    /// Returns the new position from the start of the stream.
172    fn seek<'tcx>(
173        &self,
174        _communicate_allowed: bool,
175        _offset: SeekFrom,
176    ) -> InterpResult<'tcx, io::Result<u64>> {
177        throw_unsup_format!("cannot seek on {}", self.name());
178    }
179
180    /// Close the file descriptor.
181    fn close<'tcx>(
182        self,
183        _communicate_allowed: bool,
184        _ecx: &mut MiriInterpCx<'tcx>,
185    ) -> InterpResult<'tcx, io::Result<()>>
186    where
187        Self: Sized,
188    {
189        throw_unsup_format!("cannot close {}", self.name());
190    }
191
192    fn metadata<'tcx>(&self) -> InterpResult<'tcx, io::Result<fs::Metadata>> {
193        throw_unsup_format!("obtaining metadata is only supported on file-backed file descriptors");
194    }
195
196    fn is_tty(&self, _communicate_allowed: bool) -> bool {
197        // Most FDs are not tty's and the consequence of a wrong `false` are minor,
198        // so we use a default impl here.
199        false
200    }
201
202    fn as_unix<'tcx>(&self, _ecx: &MiriInterpCx<'tcx>) -> &dyn UnixFileDescription {
203        panic!("Not a unix file descriptor: {}", self.name());
204    }
205
206    /// Implementation of fcntl(F_GETFL) for this FD.
207    fn get_flags<'tcx>(&self, _ecx: &mut MiriInterpCx<'tcx>) -> InterpResult<'tcx, Scalar> {
208        throw_unsup_format!("fcntl: {} is not supported for F_GETFL", self.name());
209    }
210
211    /// Implementation of fcntl(F_SETFL) for this FD.
212    fn set_flags<'tcx>(
213        &self,
214        _flag: i32,
215        _ecx: &mut MiriInterpCx<'tcx>,
216    ) -> InterpResult<'tcx, Scalar> {
217        throw_unsup_format!("fcntl: {} is not supported for F_SETFL", self.name());
218    }
219}
220
221impl FileDescription for io::Stdin {
222    fn name(&self) -> &'static str {
223        "stdin"
224    }
225
226    fn read<'tcx>(
227        self: FileDescriptionRef<Self>,
228        communicate_allowed: bool,
229        ptr: Pointer,
230        len: usize,
231        ecx: &mut MiriInterpCx<'tcx>,
232        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
233    ) -> InterpResult<'tcx> {
234        if !communicate_allowed {
235            // We want isolation mode to be deterministic, so we have to disallow all reads, even stdin.
236            helpers::isolation_abort_error("`read` from stdin")?;
237        }
238
239        let result = ecx.read_from_host(&*self, len, ptr)?;
240        finish.call(ecx, result)
241    }
242
243    fn is_tty(&self, communicate_allowed: bool) -> bool {
244        communicate_allowed && self.is_terminal()
245    }
246}
247
248impl FileDescription for io::Stdout {
249    fn name(&self) -> &'static str {
250        "stdout"
251    }
252
253    fn write<'tcx>(
254        self: FileDescriptionRef<Self>,
255        _communicate_allowed: bool,
256        ptr: Pointer,
257        len: usize,
258        ecx: &mut MiriInterpCx<'tcx>,
259        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
260    ) -> InterpResult<'tcx> {
261        // We allow writing to stdout even with isolation enabled.
262        let result = ecx.write_to_host(&*self, len, ptr)?;
263        // Stdout is buffered, flush to make sure it appears on the
264        // screen.  This is the write() syscall of the interpreted
265        // program, we want it to correspond to a write() syscall on
266        // the host -- there is no good in adding extra buffering
267        // here.
268        io::stdout().flush().unwrap();
269
270        finish.call(ecx, result)
271    }
272
273    fn is_tty(&self, communicate_allowed: bool) -> bool {
274        communicate_allowed && self.is_terminal()
275    }
276}
277
278impl FileDescription for io::Stderr {
279    fn name(&self) -> &'static str {
280        "stderr"
281    }
282
283    fn write<'tcx>(
284        self: FileDescriptionRef<Self>,
285        _communicate_allowed: bool,
286        ptr: Pointer,
287        len: usize,
288        ecx: &mut MiriInterpCx<'tcx>,
289        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
290    ) -> InterpResult<'tcx> {
291        // We allow writing to stderr even with isolation enabled.
292        let result = ecx.write_to_host(&*self, len, ptr)?;
293        // No need to flush, stderr is not buffered.
294        finish.call(ecx, result)
295    }
296
297    fn is_tty(&self, communicate_allowed: bool) -> bool {
298        communicate_allowed && self.is_terminal()
299    }
300}
301
302#[derive(Debug)]
303pub struct FileHandle {
304    pub(crate) file: File,
305    pub(crate) writable: bool,
306}
307
308impl FileDescription for FileHandle {
309    fn name(&self) -> &'static str {
310        "file"
311    }
312
313    fn read<'tcx>(
314        self: FileDescriptionRef<Self>,
315        communicate_allowed: bool,
316        ptr: Pointer,
317        len: usize,
318        ecx: &mut MiriInterpCx<'tcx>,
319        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
320    ) -> InterpResult<'tcx> {
321        assert!(communicate_allowed, "isolation should have prevented even opening a file");
322
323        let result = ecx.read_from_host(&self.file, len, ptr)?;
324        finish.call(ecx, result)
325    }
326
327    fn write<'tcx>(
328        self: FileDescriptionRef<Self>,
329        communicate_allowed: bool,
330        ptr: Pointer,
331        len: usize,
332        ecx: &mut MiriInterpCx<'tcx>,
333        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
334    ) -> InterpResult<'tcx> {
335        assert!(communicate_allowed, "isolation should have prevented even opening a file");
336
337        let result = ecx.write_to_host(&self.file, len, ptr)?;
338        finish.call(ecx, result)
339    }
340
341    fn seek<'tcx>(
342        &self,
343        communicate_allowed: bool,
344        offset: SeekFrom,
345    ) -> InterpResult<'tcx, io::Result<u64>> {
346        assert!(communicate_allowed, "isolation should have prevented even opening a file");
347        interp_ok((&mut &self.file).seek(offset))
348    }
349
350    fn close<'tcx>(
351        self,
352        communicate_allowed: bool,
353        _ecx: &mut MiriInterpCx<'tcx>,
354    ) -> InterpResult<'tcx, io::Result<()>> {
355        assert!(communicate_allowed, "isolation should have prevented even opening a file");
356        // We sync the file if it was opened in a mode different than read-only.
357        if self.writable {
358            // `File::sync_all` does the checks that are done when closing a file. We do this to
359            // to handle possible errors correctly.
360            let result = self.file.sync_all();
361            // Now we actually close the file and return the result.
362            drop(self.file);
363            interp_ok(result)
364        } else {
365            // We drop the file, this closes it but ignores any errors
366            // produced when closing it. This is done because
367            // `File::sync_all` cannot be done over files like
368            // `/dev/urandom` which are read-only. Check
369            // https://github.com/rust-lang/miri/issues/999#issuecomment-568920439
370            // for a deeper discussion.
371            drop(self.file);
372            interp_ok(Ok(()))
373        }
374    }
375
376    fn metadata<'tcx>(&self) -> InterpResult<'tcx, io::Result<Metadata>> {
377        interp_ok(self.file.metadata())
378    }
379
380    fn is_tty(&self, communicate_allowed: bool) -> bool {
381        communicate_allowed && self.file.is_terminal()
382    }
383
384    fn as_unix<'tcx>(&self, ecx: &MiriInterpCx<'tcx>) -> &dyn UnixFileDescription {
385        assert!(
386            ecx.target_os_is_unix(),
387            "unix file operations are only available for unix targets"
388        );
389        self
390    }
391}
392
393/// Like /dev/null
394#[derive(Debug)]
395pub struct NullOutput;
396
397impl FileDescription for NullOutput {
398    fn name(&self) -> &'static str {
399        "stderr and stdout"
400    }
401
402    fn write<'tcx>(
403        self: FileDescriptionRef<Self>,
404        _communicate_allowed: bool,
405        _ptr: Pointer,
406        len: usize,
407        ecx: &mut MiriInterpCx<'tcx>,
408        finish: DynMachineCallback<'tcx, Result<usize, IoError>>,
409    ) -> InterpResult<'tcx> {
410        // We just don't write anything, but report to the user that we did.
411        finish.call(ecx, Ok(len))
412    }
413}
414
415/// Internal type of a file-descriptor - this is what [`FdTable`] expects
416pub type FdNum = i32;
417
418/// The file descriptor table
419#[derive(Debug)]
420pub struct FdTable {
421    pub fds: BTreeMap<FdNum, DynFileDescriptionRef>,
422    /// Unique identifier for file description, used to differentiate between various file description.
423    next_file_description_id: FdId,
424}
425
426impl VisitProvenance for FdTable {
427    fn visit_provenance(&self, _visit: &mut VisitWith<'_>) {
428        // All our FileDescription instances do not have any tags.
429    }
430}
431
432impl FdTable {
433    fn new() -> Self {
434        FdTable { fds: BTreeMap::new(), next_file_description_id: FdId(0) }
435    }
436    pub(crate) fn init(mute_stdout_stderr: bool) -> FdTable {
437        let mut fds = FdTable::new();
438        fds.insert_new(io::stdin());
439        if mute_stdout_stderr {
440            assert_eq!(fds.insert_new(NullOutput), 1);
441            assert_eq!(fds.insert_new(NullOutput), 2);
442        } else {
443            assert_eq!(fds.insert_new(io::stdout()), 1);
444            assert_eq!(fds.insert_new(io::stderr()), 2);
445        }
446        fds
447    }
448
449    pub fn new_ref<T: FileDescription>(&mut self, fd: T) -> FileDescriptionRef<T> {
450        let file_handle =
451            FileDescriptionRef(Rc::new(FdIdWith { id: self.next_file_description_id, inner: fd }));
452        self.next_file_description_id = FdId(self.next_file_description_id.0.strict_add(1));
453        file_handle
454    }
455
456    /// Insert a new file description to the FdTable.
457    pub fn insert_new(&mut self, fd: impl FileDescription) -> FdNum {
458        let fd_ref = self.new_ref(fd);
459        self.insert(fd_ref)
460    }
461
462    pub fn insert(&mut self, fd_ref: DynFileDescriptionRef) -> FdNum {
463        self.insert_with_min_num(fd_ref, 0)
464    }
465
466    /// Insert a file description, giving it a file descriptor that is at least `min_fd_num`.
467    pub fn insert_with_min_num(
468        &mut self,
469        file_handle: DynFileDescriptionRef,
470        min_fd_num: FdNum,
471    ) -> FdNum {
472        // Find the lowest unused FD, starting from min_fd. If the first such unused FD is in
473        // between used FDs, the find_map combinator will return it. If the first such unused FD
474        // is after all other used FDs, the find_map combinator will return None, and we will use
475        // the FD following the greatest FD thus far.
476        let candidate_new_fd =
477            self.fds.range(min_fd_num..).zip(min_fd_num..).find_map(|((fd_num, _fd), counter)| {
478                if *fd_num != counter {
479                    // There was a gap in the fds stored, return the first unused one
480                    // (note that this relies on BTreeMap iterating in key order)
481                    Some(counter)
482                } else {
483                    // This fd is used, keep going
484                    None
485                }
486            });
487        let new_fd_num = candidate_new_fd.unwrap_or_else(|| {
488            // find_map ran out of BTreeMap entries before finding a free fd, use one plus the
489            // maximum fd in the map
490            self.fds.last_key_value().map(|(fd_num, _)| fd_num.strict_add(1)).unwrap_or(min_fd_num)
491        });
492
493        self.fds.try_insert(new_fd_num, file_handle).unwrap();
494        new_fd_num
495    }
496
497    pub fn get(&self, fd_num: FdNum) -> Option<DynFileDescriptionRef> {
498        let fd = self.fds.get(&fd_num)?;
499        Some(fd.clone())
500    }
501
502    pub fn remove(&mut self, fd_num: FdNum) -> Option<DynFileDescriptionRef> {
503        self.fds.remove(&fd_num)
504    }
505
506    pub fn is_fd_num(&self, fd_num: FdNum) -> bool {
507        self.fds.contains_key(&fd_num)
508    }
509}
510
511impl<'tcx> EvalContextExt<'tcx> for crate::MiriInterpCx<'tcx> {}
512pub trait EvalContextExt<'tcx>: crate::MiriInterpCxExt<'tcx> {
513    /// Read data from a host `Read` type, store the result into machine memory,
514    /// and return whether that worked.
515    fn read_from_host(
516        &mut self,
517        mut file: impl io::Read,
518        len: usize,
519        ptr: Pointer,
520    ) -> InterpResult<'tcx, Result<usize, IoError>> {
521        let this = self.eval_context_mut();
522
523        let mut bytes = vec![0; len];
524        let result = file.read(&mut bytes);
525        match result {
526            Ok(read_size) => {
527                // If reading to `bytes` did not fail, we write those bytes to the buffer.
528                // Crucially, if fewer than `bytes.len()` bytes were read, only write
529                // that much into the output buffer!
530                this.write_bytes_ptr(ptr, bytes[..read_size].iter().copied())?;
531                interp_ok(Ok(read_size))
532            }
533            Err(e) => interp_ok(Err(IoError::HostError(e))),
534        }
535    }
536
537    /// Write data to a host `Write` type, withthe bytes taken from machine memory.
538    fn write_to_host(
539        &mut self,
540        mut file: impl io::Write,
541        len: usize,
542        ptr: Pointer,
543    ) -> InterpResult<'tcx, Result<usize, IoError>> {
544        let this = self.eval_context_mut();
545
546        let bytes = this.read_bytes_ptr_strip_provenance(ptr, Size::from_bytes(len))?;
547        let result = file.write(bytes);
548        interp_ok(result.map_err(IoError::HostError))
549    }
550}