miri/shims/

files.rs

use std::any::Any;
use std::collections::BTreeMap;
use std::convert::BoundedCastFromInt;
use std::fs::{Dir, File};
use std::io::{ErrorKind, IsTerminal, Read, Seek, SeekFrom, Write};
use std::marker::CoercePointee;
use std::ops::Deref;
use std::rc::{Rc, Weak};
use std::{fs, io};

use rustc_abi::Size;

use crate::shims::unix::UnixFileDescription;
use crate::*;

/// Internal type of a file-descriptor - this is what [`FdTable`] expects
pub type FdNum = i32;

/// The maximum number of open FDs.
pub const FD_LIMIT: FdNum = 524288; // default hard limit on Debian

/// Accesses this large have a higher chance of being shortened.
/// We use twice the usual page size, which means the shortened access is at least a page.
pub const BIG_ACCESS: u64 = 8 * 1024;

/// A unique id for file descriptions. While we could use the address, considering that
/// is definitely unique, the address would expose interpreter internal state when used
/// for sorting things. So instead we generate a unique id per file description which is the same
/// for all `dup`licates and is never reused.
#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Ord, PartialOrd)]
pub struct FdId(usize);

impl FdId {
    pub fn to_usize(self) -> usize {
        self.0
    }

    /// Create a new fd id from a `usize` without checking if this fd exists.
    pub fn new_unchecked(id: usize) -> Self {
        Self(id)
    }
}

#[derive(Debug, Clone)]
struct FdIdWith<T: ?Sized> {
    id: FdId,
    inner: T,
}

/// A refcounted pointer to a file description, also tracking the
/// globally unique ID of this file description.
#[repr(transparent)]
#[derive(CoercePointee, Debug)]
// Sadly `CoercePointee` does not let us keep the `FdId` *outside* the `Rc`.
pub struct FileDescriptionRef<T: ?Sized>(Rc<FdIdWith<T>>);

impl<T: ?Sized> Clone for FileDescriptionRef<T> {
    fn clone(&self) -> Self {
        FileDescriptionRef(self.0.clone())
    }
}

impl<T: ?Sized> Deref for FileDescriptionRef<T> {
    type Target = T;
    fn deref(&self) -> &T {
        &self.0.inner
    }
}

impl<T: ?Sized> FileDescriptionRef<T> {
    pub fn id(&self) -> FdId {
        self.0.id
    }
}

impl<T: ?Sized> PartialEq for FileDescriptionRef<T> {
    fn eq(&self, other: &Self) -> bool {
        self.0.id == other.0.id
    }
}

impl<T: ?Sized> Eq for FileDescriptionRef<T> {}

/// Holds a weak reference to the actual file description.
#[derive(Debug)]
pub struct WeakFileDescriptionRef<T: ?Sized>(Weak<FdIdWith<T>>);

impl<T: ?Sized> Clone for WeakFileDescriptionRef<T> {
    fn clone(&self) -> Self {
        WeakFileDescriptionRef(self.0.clone())
    }
}

impl<T: ?Sized> FileDescriptionRef<T> {
    pub fn downgrade(this: &Self) -> WeakFileDescriptionRef<T> {
        WeakFileDescriptionRef(Rc::downgrade(&this.0))
    }
}

impl<T: ?Sized> WeakFileDescriptionRef<T> {
    pub fn upgrade(&self) -> Option<FileDescriptionRef<T>> {
        self.0.upgrade().map(FileDescriptionRef)
    }

    /// Returns whether the file description that this weak reference points to
    /// has been closed, i.e., there are no more strong references.
    pub fn is_closed(&self) -> bool {
        self.0.strong_count() == 0
    }
}

impl<T> VisitProvenance for FileDescriptionRef<T> {
    fn visit_provenance(&self, _visit: &mut VisitWith<'_>) {
        // All our FileDescription instances do not have any provenance.
    }
}

/// A helper trait to indirectly allow downcasting on `Rc<FdIdWith<dyn _>>`.
/// Ideally we'd just add a `FdIdWith<Self>: Any` bound to the `FileDescription` trait,
/// but that does not allow upcasting.
pub trait FileDescriptionExt: 'static {
    fn into_rc_any(self: FileDescriptionRef<Self>) -> Rc<dyn Any>;
}

impl<T: FileDescription + 'static> FileDescriptionExt for T {
    fn into_rc_any(self: FileDescriptionRef<Self>) -> Rc<dyn Any> {
        self.0
    }
}

pub type DynFileDescriptionRef = FileDescriptionRef<dyn FileDescription>;
pub type WeakDynFileDescriptionRef = WeakFileDescriptionRef<dyn FileDescription>;

impl FileDescriptionRef<dyn FileDescription> {
    pub fn downcast<T: FileDescription + 'static>(self) -> Option<FileDescriptionRef<T>> {
        let inner = self.into_rc_any().downcast::<FdIdWith<T>>().ok()?;
        Some(FileDescriptionRef(inner))
    }
}

/// Represents an open file description.
pub trait FileDescription: std::fmt::Debug + FileDescriptionExt {
    fn name(&self) -> &'static str;

    /// Reads as much as possible into the given buffer `ptr`.
    /// `len` indicates how many bytes we should try to read.
    ///
    /// When the read is done, `finish` will be called. Note that `read` itself may return before
    /// that happens! Everything that should happen "after" the `read` needs to happen inside
    /// `finish`.
    fn read<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        _ptr: Pointer,
        _len: u64,
        _ecx: &mut MiriInterpCx<'tcx>,
        _finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        throw_unsup_format!("cannot read from {}", self.name());
    }

    /// Writes as much as possible from the given buffer `ptr`.
    /// `len` indicates how many bytes we should try to write.
    ///
    /// When the write is done, `finish` will be called. Note that `write` itself may return before
    /// that happens! Everything that should happen "after" the `write` needs to happen inside
    /// `finish`.
    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        _ptr: Pointer,
        _len: u64,
        _ecx: &mut MiriInterpCx<'tcx>,
        _finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        throw_unsup_format!("cannot write to {}", self.name());
    }

    /// Determines whether this FD non-deterministically has its reads and writes shortened.
    fn short_fd_operations(&self) -> bool {
        // We only enable this for FD kinds where we think short accesses gain useful test coverage.
        false
    }

    /// Seeks to the given offset (which can be relative to the beginning, end, or current position).
    /// Returns the new position from the start of the stream.
    fn seek<'tcx>(
        &self,
        _communicate_allowed: bool,
        _offset: SeekFrom,
    ) -> InterpResult<'tcx, io::Result<u64>> {
        throw_unsup_format!("cannot seek on {}", self.name());
    }

    /// Returns the metadata for this FD, if available.
    /// This is either host metadata, or a non-file-backed-FD type.
    /// The latter is for now represented as a string storing the `libc` name of the mode so we only
    /// support that kind of metadata on Unix targets.
    fn metadata<'tcx>(
        &self,
        _communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<fs::Metadata>, &'static str>> {
        throw_unsup_format!("obtaining metadata is not supported on {}", self.name());
    }

    fn is_tty(&self, _communicate_allowed: bool) -> bool {
        // Most FDs are not tty's and the consequence of a wrong `false` are minor,
        // so we use a default impl here.
        false
    }

    /// Converts this FD into a unix file description. Must succeed for all FD types that can be
    /// created on Unix targets!
    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        panic!("Not a unix file description: {}", self.name());
    }

    /// Get the `ReadinessWatched` of the file description.
    fn readiness_watched(&self) -> Option<&ReadinessWatched> {
        None
    }

    /// Get the current I/O readiness of the file description.
    fn readiness(&self) -> Readiness {
        panic!("FD type {} implements `readiness_watched` but not `readiness`", self.name());
    }
}

#[derive(Debug)]
pub struct Stdin {
    stdin: io::Stdin,
    watched: ReadinessWatched,
}

impl Stdin {
    fn new() -> Self {
        Self { stdin: io::stdin(), watched: ReadinessWatched::default() }
    }
}

impl FileDescription for Stdin {
    fn name(&self) -> &'static str {
        "stdin"
    }

    fn read<'tcx>(
        self: FileDescriptionRef<Self>,
        communicate_allowed: bool,
        ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        if !communicate_allowed {
            // We want isolation mode to be deterministic, so we have to disallow all reads, even stdin.
            helpers::isolation_abort_error("`read` from stdin")?;
        }

        // FIXME: this can block on the host, halting the entire interpreter.
        let result = ecx.read_from_host(ptr, len, |buf| (&mut &self.stdin).read(buf))?;
        finish.call(ecx, result)
    }

    fn metadata<'tcx>(
        &self,
        communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<std::fs::Metadata>, &'static str>> {
        let ftype = if self.is_tty(communicate_allowed) { "S_IFCHR" } else { "S_IFIFO" };
        interp_ok(Either::Right(ftype))
    }

    fn is_tty(&self, communicate_allowed: bool) -> bool {
        // Without communication we assume that it is a terminal.
        !communicate_allowed || self.stdin.is_terminal()
    }

    fn readiness_watched(&self) -> Option<&ReadinessWatched> {
        Some(&self.watched)
    }

    fn readiness(&self) -> Readiness {
        // Stdin is readable (we never return EWOULDBLOCK above) and also writable (since that never
        // blocks either). This matches what we see on Linux.
        let mut readiness = Readiness::EMPTY;
        readiness.readable = true;
        readiness.writable = true;
        readiness
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

#[derive(Debug)]
pub struct Stdout {
    stdout: io::Stdout,
    watched: ReadinessWatched,
}

impl Stdout {
    fn new() -> Self {
        Self { stdout: io::stdout(), watched: ReadinessWatched::default() }
    }
}

impl FileDescription for Stdout {
    fn name(&self) -> &'static str {
        "stdout"
    }

    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        // We allow writing to stdout even with isolation enabled.
        let result = ecx.write_to_host(ptr, len, |buf| (&self.stdout).write(buf))?;
        // Stdout is buffered, flush to make sure it appears on the
        // screen.  This is the write() syscall of the interpreted
        // program, we want it to correspond to a write() syscall on
        // the host -- there is no good in adding extra buffering
        // here.
        io::stdout().flush().unwrap();

        finish.call(ecx, result)
    }

    fn metadata<'tcx>(
        &self,
        communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<std::fs::Metadata>, &'static str>> {
        let ftype = if self.is_tty(communicate_allowed) { "S_IFCHR" } else { "S_IFIFO" };
        interp_ok(Either::Right(ftype))
    }

    fn is_tty(&self, communicate_allowed: bool) -> bool {
        // Without communication we assume that it is a terminal.
        !communicate_allowed || self.stdout.is_terminal()
    }

    fn readiness_watched(&self) -> Option<&ReadinessWatched> {
        Some(&self.watched)
    }

    fn readiness(&self) -> Readiness {
        // stdout can always be written (we never return EWOULDBLOCK there) and never be read.
        let mut readiness = Readiness::EMPTY;
        readiness.writable = true;
        readiness
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

#[derive(Debug)]
pub struct Stderr {
    stderr: io::Stderr,
    watched: ReadinessWatched,
}

impl Stderr {
    fn new() -> Self {
        Self { stderr: io::stderr(), watched: ReadinessWatched::default() }
    }
}

impl FileDescription for Stderr {
    fn name(&self) -> &'static str {
        "stderr"
    }

    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        // We allow writing to stderr even with isolation enabled.
        let result = ecx.write_to_host(ptr, len, |buf| (&self.stderr).write(buf))?;
        // No need to flush, stderr is not buffered.
        finish.call(ecx, result)
    }

    fn metadata<'tcx>(
        &self,
        communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<std::fs::Metadata>, &'static str>> {
        let ftype = if self.is_tty(communicate_allowed) { "S_IFCHR" } else { "S_IFIFO" };
        interp_ok(Either::Right(ftype))
    }

    fn is_tty(&self, communicate_allowed: bool) -> bool {
        // Without communication we assume that it is a terminal.
        !communicate_allowed || self.stderr.is_terminal()
    }

    fn readiness_watched(&self) -> Option<&ReadinessWatched> {
        Some(&self.watched)
    }

    fn readiness(&self) -> Readiness {
        // stderr can always be written (we never return EWOULDBLOCK there) and never be read.
        let mut readiness = Readiness::EMPTY;
        readiness.writable = true;
        readiness
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

/// Like /dev/null
#[derive(Debug)]
pub struct NullOutput {
    watched: ReadinessWatched,
}

impl NullOutput {
    fn new() -> Self {
        Self { watched: ReadinessWatched::default() }
    }
}

impl FileDescription for NullOutput {
    fn name(&self) -> &'static str {
        "null output"
    }

    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        _ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        // We just don't write anything, but report to the user that we did.
        finish.call(ecx, Ok(len))
    }

    fn metadata<'tcx>(
        &self,
        _communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<std::fs::Metadata>, &'static str>> {
        interp_ok(Either::Right("S_IFIFO"))
    }

    fn readiness_watched(&self) -> Option<&ReadinessWatched> {
        Some(&self.watched)
    }

    fn readiness(&self) -> Readiness {
        // null output can always be written (we never return EWOULDBLOCK there) and never be read.
        let mut readiness = Readiness::EMPTY;
        readiness.writable = true;
        readiness
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

#[derive(Debug)]
pub struct FileHandle {
    pub(crate) file: File,
    pub(crate) readable: bool,
    pub(crate) writable: bool,
    pub(crate) append: bool,
}

impl FileDescription for FileHandle {
    fn name(&self) -> &'static str {
        "file"
    }

    fn read<'tcx>(
        self: FileDescriptionRef<Self>,
        communicate_allowed: bool,
        ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        assert!(communicate_allowed, "isolation should have prevented even opening a file");

        if !self.readable {
            // Unix returns EBADF, Windows something that translates to `PermissionDenied`.
            let err = if ecx.target_os_is_unix() {
                LibcError("EBADF")
            } else {
                ErrorKind::PermissionDenied.into()
            };
            return finish.call(ecx, Err(err));
        }

        let mut file = &self.file;
        let result = ecx.read_from_host(ptr, len, |buf| file.read(buf))?;
        finish.call(ecx, result)
    }

    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        communicate_allowed: bool,
        ptr: Pointer,
        len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        assert!(communicate_allowed, "isolation should have prevented even opening a file");

        if !self.writable {
            // Unix returns EBADF, Windows something that translates to `PermissionDenied`.
            let err = if ecx.target_os_is_unix() {
                LibcError("EBADF")
            } else {
                ErrorKind::PermissionDenied.into()
            };
            return finish.call(ecx, Err(err));
        }
        let result = ecx.write_to_host(ptr, len, |buf| (&self.file).write(buf))?;
        finish.call(ecx, result)
    }

    fn seek<'tcx>(
        &self,
        communicate_allowed: bool,
        offset: SeekFrom,
    ) -> InterpResult<'tcx, io::Result<u64>> {
        assert!(communicate_allowed, "isolation should have prevented even opening a file");
        interp_ok((&mut &self.file).seek(offset))
    }

    fn metadata<'tcx>(
        &self,
        communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<fs::Metadata>, &'static str>> {
        assert!(communicate_allowed);
        interp_ok(Either::Left(self.file.metadata()))
    }

    fn is_tty(&self, communicate_allowed: bool) -> bool {
        assert!(communicate_allowed);
        self.file.is_terminal()
    }

    fn short_fd_operations(&self) -> bool {
        // While short accesses on file-backed FDs are very rare (at least for sufficiently small
        // accesses), they can realistically happen when a signal interrupts the syscall.
        // FIXME: we should return `false` if this is a named pipe...
        true
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

#[derive(Debug)]
pub struct DirHandle {
    pub(super) dir: Dir,
    #[cfg(bootstrap)]
    pub(super) fallback: std::path::PathBuf,
}

impl FileDescription for DirHandle {
    fn name(&self) -> &'static str {
        "directory"
    }

    fn metadata<'tcx>(
        &self,
        communicate_allowed: bool,
    ) -> InterpResult<'tcx, Either<io::Result<std::fs::Metadata>, &'static str>> {
        assert!(communicate_allowed);

        #[cfg(bootstrap)]
        return interp_ok(Either::Left(self.dir.metadata()));
        #[cfg(not(bootstrap))]
        return interp_ok(Either::Left(self.dir.self_metadata()));
    }

    fn read<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        _ptr: Pointer,
        _len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        if ecx.target_os_is_unix() {
            finish.call(ecx, Err(LibcError("EISDIR")))
        } else {
            // No idea what this should do on Windows.
            throw_unsup_format!("reading directories is not supported on this target");
        }
    }

    fn write<'tcx>(
        self: FileDescriptionRef<Self>,
        _communicate_allowed: bool,
        _ptr: Pointer,
        _len: u64,
        ecx: &mut MiriInterpCx<'tcx>,
        finish: DynMachineCallback<'tcx, Result<u64, IoError>>,
    ) -> InterpResult<'tcx> {
        if ecx.target_os_is_unix() {
            // Directories are opened for reading, so writing returns EBADF.
            finish.call(ecx, Err(LibcError("EBADF")))
        } else {
            // No idea what this should do on Windows.
            throw_unsup_format!("writing directories is not supported on this target");
        }
    }

    fn as_unix(self: FileDescriptionRef<Self>) -> FileDescriptionRef<dyn UnixFileDescription> {
        self
    }
}

/// The file descriptor table
#[derive(Debug)]
pub struct FdTable {
    fds: BTreeMap<FdNum, DynFileDescriptionRef>,
    /// Unique identifier for file description, used to differentiate between various file description.
    next_file_description_id: FdId,
}

impl VisitProvenance for FdTable {
    fn visit_provenance(&self, _visit: &mut VisitWith<'_>) {
        // All our FileDescription instances do not have any provenance.
    }
}

impl FdTable {
    fn new() -> Self {
        FdTable { fds: BTreeMap::new(), next_file_description_id: FdId(0) }
    }
    pub(crate) fn init(mute_stdout_stderr: bool) -> FdTable {
        let mut fds = FdTable::new();
        fds.insert_new(Stdin::new());
        if mute_stdout_stderr {
            assert_eq!(fds.insert_new(NullOutput::new()).unwrap(), 1);
            assert_eq!(fds.insert_new(NullOutput::new()).unwrap(), 2);
        } else {
            assert_eq!(fds.insert_new(Stdout::new()).unwrap(), 1);
            assert_eq!(fds.insert_new(Stderr::new()).unwrap(), 2);
        }
        fds
    }

    pub fn new_ref<T: FileDescription>(&mut self, fd: T) -> FileDescriptionRef<T> {
        let file_handle =
            FileDescriptionRef(Rc::new(FdIdWith { id: self.next_file_description_id, inner: fd }));
        self.next_file_description_id = FdId(self.next_file_description_id.0.strict_add(1));
        file_handle
    }

    pub fn fd_num_valid(fd_num: FdNum) -> bool {
        (0..FD_LIMIT).contains(&fd_num)
    }

    /// Insert a new file description to the FdTable.
    pub fn insert_new(&mut self, fd: impl FileDescription) -> Option<FdNum> {
        let fd_ref = self.new_ref(fd);
        self.insert(fd_ref)
    }

    /// Insert an alias to an existing file description to the FdTable.
    pub fn insert(&mut self, fd_ref: DynFileDescriptionRef) -> Option<FdNum> {
        self.insert_with_min_num(fd_ref, 0)
    }

    /// Insert a file description, giving it a file descriptor that is at least `min_fd_num`.
    pub fn insert_with_min_num(
        &mut self,
        file_handle: DynFileDescriptionRef,
        min_fd_num: FdNum,
    ) -> Option<FdNum> {
        let mut candidate = min_fd_num;
        for (&fd_num, _) in self.fds.range(min_fd_num..) {
            if fd_num == candidate {
                // This one is taken. Try the next one.
                candidate = candidate.strict_add(1);
            } else {
                // We found a gap! Use this candidate.
                break;
            }
        }
        // If we exhaust the loop, the table is a solid block starting at `min_fd_num` until the
        // end, and `candidate` is now the first number after that block -- exactly what we need.

        // Ensure the resulting FD number is valid.
        if !Self::fd_num_valid(candidate) {
            return None;
        }

        self.fds.try_insert(candidate, file_handle).unwrap();
        Some(candidate)
    }

    pub fn get(&self, fd_num: FdNum) -> Option<DynFileDescriptionRef> {
        let fd = self.fds.get(&fd_num)?;
        Some(fd.clone())
    }

    pub fn remove(&mut self, fd_num: FdNum) -> Option<DynFileDescriptionRef> {
        self.fds.remove(&fd_num)
    }

    pub fn is_fd_num(&self, fd_num: FdNum) -> bool {
        self.fds.contains_key(&fd_num)
    }
}

impl<'tcx> EvalContextExt<'tcx> for crate::MiriInterpCx<'tcx> {}
pub trait EvalContextExt<'tcx>: crate::MiriInterpCxExt<'tcx> {
    /// Read data from a host `Read` type, store the result into machine memory,
    /// and return whether that worked.
    fn read_from_host(
        &mut self,
        ptr: Pointer,
        len: u64,
        read_cb: impl FnOnce(&mut [u8]) -> io::Result<usize>,
    ) -> InterpResult<'tcx, Result<u64, IoError>> {
        let ecx = self.eval_context_mut();

        let len = usize::saturating_cast_from(len);
        let mut bytes = vec![0; len];
        let result = read_cb(&mut bytes);
        match result {
            Ok(read_size) => {
                // If reading to `bytes` did not fail, we write those bytes to the buffer.
                // Crucially, if fewer than `bytes.len()` bytes were read, only write
                // that much into the output buffer!
                ecx.write_bytes_ptr(ptr, bytes[..read_size].iter().copied())?;
                interp_ok(Ok(read_size.to_u64()))
            }
            Err(e) => interp_ok(Err(IoError::HostError(e))),
        }
    }

    /// Write data to a host `Write` type, with the bytes taken from machine memory.
    fn write_to_host(
        &self,
        ptr: Pointer,
        len: u64,
        write_cb: impl FnOnce(&[u8]) -> io::Result<usize>,
    ) -> InterpResult<'tcx, Result<u64, IoError>> {
        let ecx = self.eval_context_ref();

        let len = usize::saturating_cast_from(len);
        let bytes = ecx.read_bytes_ptr_strip_provenance(ptr, Size::from_bytes(len))?;
        let result = write_cb(bytes);
        interp_ok(result.map_err(IoError::HostError).map(|written_size| written_size.to_u64()))
    }
}

/// Open something for which we don't know ahead of time whether it is a file or a directory.
///
/// Note that on Windows hosts, `custom_flags` is ignored if `root` is `Some`!
pub fn open_file_or_dir(
    root: Option<&fs::Dir>,
    path: &std::path::Path,
    opts: &fs::OpenOptions,
) -> io::Result<Either<fs::File, fs::Dir>> {
    // On Unix, `open`/`openat` works for files and directories.
    // On Windows, that fails with `PermissionDenied`, so we need to open an `fs::Dir` instead.
    // (But that may succeed even on a file! So we still have to check the metadata.)
    let file = match root {
        Some(root) => root.open_file_with(path, opts),
        None => opts.open(path),
    };
    #[cfg(windows)]
    let file = file.or_else(|err| {
        use std::os::windows::io::OwnedHandle;

        if err.kind() == io::ErrorKind::PermissionDenied {
            // Retry via `fs::Dir`. Opening a directory via `Dir::open_file` does not work so we
            // have to use `open_dir`.
            let dir = match root {
                Some(root) => root.open_dir_with(path, opts),
                None => Dir::open_with(path, opts),
            };
            match dir {
                // Convert back to file so it always has the same type.
                Ok(dir) => Ok(File::from(OwnedHandle::from(dir))),
                Err(err2) => {
                    // If this 2nd attempt says "not a directory", preserve the original error. It's
                    // possible that we lost a race twice if this keeps being changed from directory
                    // to file and back. However, in that case it was entirely non-existent for a
                    // little while, so returning an error is still fine.
                    Err(if err2.kind() == io::ErrorKind::NotADirectory { err } else { err2 })
                }
            }
        } else {
            Err(err)
        }
    });
    let file = file?;

    let metadata = file.metadata().expect("just-opened file/dir should have metadata");
    if metadata.is_dir() {
        assert!(!metadata.is_symlink()); // Rust makes this mutually exclusive with `is_dir`
        // Convert to dir.
        cfg_select! {
            unix => {
                use std::os::fd::OwnedFd;
                Ok(Either::Right(OwnedFd::from(file).into()))
            }
            windows => {
                use std::os::windows::io::OwnedHandle;
                Ok(Either::Right(OwnedHandle::from(file).into()))
            }
        }
    } else {
        Ok(Either::Left(file))
    }
}