Skip to content

Move mmap gap hints for per-guest isolation#4

Merged
jserv merged 1 commit intomainfrom
static-audit
May 4, 2026
Merged

Move mmap gap hints for per-guest isolation#4
jserv merged 1 commit intomainfrom
static-audit

Conversation

@jserv
Copy link
Copy Markdown
Contributor

@jserv jserv commented May 4, 2026

Two static globals in src/syscall/mem.c, mmap_r{w,x}_gap_hint, described a specific guest's region layout and would alias if 2 guest_t instances ever coexisted in one process (test harnesses, future multi-VM use). Move both fields into guest_t.

guest_reset zeroes them; guest_{init,init_from_shm} zero them via memset. The public mmap_reset_hints() helper and its callers in src/syscall/exec.c (right after guest_reset) and src/runtime/fork-state.c (right after syscall_init in fork_ipc_recv_fd_table) are no longer needed and removed. find_free_gap loses const on its guest_t argument to mutate the per-guest hints; it is static so the change has no cross-TU API impact. The four munmap/mremap rewind sites point at g->mmap_*_gap_hint instead.

Audited the rest of the module-level state in src/. Host-derived caches (sysinfo, host_port, totalram, getloadavg, cached uname/groups/affinity/ rlimits) stay process-global by design: any future second guest in this process would share the same host stats. Other process-scoped tables (proc_table, next_guest_pid, pidfd/inotify/netlink/sysv-ipc/abstract- socket tables, futex buckets, thread_table, signal state, procemu temp dirs, log state) remain global because the current architecture is one VM per macOS process (HVF restriction) and fork uses posix_spawn into a fresh process. Documented the sysinfo cache inline as intentionally process-scoped.


Summary by cubic

Isolate mmap gap-finder hints per guest to prevent cross-guest allocator state leaks and remove unnecessary global cleanup. This fixes aliasing in multi-guest test setups and prepares for future multi-VM scenarios.

  • Refactors
    • Moved mmap_rw_gap_hint and mmap_rx_gap_hint into guest_t; zeroed in guest_reset and init paths.
    • Removed mmap_reset_hints() and its calls in exec.c and fork-state.c.
    • Changed find_free_gap to take a non-const guest_t * to update per-guest hints; remains static.
    • Updated sys_munmap/sys_mremap to rewind g->mmap_*_gap_hint instead of globals.
    • Documented sysinfo cache as intentionally process-scoped; no behavior change.

Written for commit f1c1a63. Summary will update on new commits.

Two static globals in src/syscall/mem.c, mmap_r{w,x}_gap_hint, described
a specific guest's region layout and would alias if 2 guest_t instances
ever coexisted in one process (test harnesses, future multi-VM use).
Move both fields into guest_t.

guest_reset zeroes them; guest_{init,init_from_shm} zero them via memset.
The public mmap_reset_hints() helper and its callers in src/syscall/exec.c
(right after guest_reset) and src/runtime/fork-state.c (right after
syscall_init in fork_ipc_recv_fd_table) are no longer needed and removed.
find_free_gap loses const on its guest_t argument to mutate the per-guest
hints; it is static so the change has no cross-TU API impact. The four
munmap/mremap rewind sites point at g->mmap_*_gap_hint instead.

Audited the rest of the module-level state in src/. Host-derived caches
(sysinfo, host_port, totalram, getloadavg, cached uname/groups/affinity/
rlimits) stay process-global by design: any future second guest in this
process would share the same host stats. Other process-scoped tables
(proc_table, next_guest_pid, pidfd/inotify/netlink/sysv-ipc/abstract-
socket tables, futex buckets, thread_table, signal state, procemu temp
dirs, log state) remain global because the current architecture is one
VM per macOS process (HVF restriction) and fork uses posix_spawn into a
fresh process. Documented the sysinfo cache inline as intentionally
process-scoped.
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 7 files

@jserv jserv merged commit 038bc93 into main May 4, 2026
5 checks passed
@jserv jserv deleted the static-audit branch May 4, 2026 21:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant