load_elf: change maximum memory address to SYSTEM.start() (#878)

load_elf takes a max_mem parameter. Before this change, MEM_SIZE was used
as the parameter which indicates the maximum addressable region of memory for the zkVM.
However, any memory region above `SYSTEM.start()` is intended for use
by the zkVM and is not to be used by the ELF. Rather passing MEM_SIZE as a parameter,
use GUEST_MAX_MEM as the upper bound for memory during elf load.

This PR also restricts the loader to not load above GUEST_MAX_MEM.

bonsai/ethereum-relay/tests/e2e_test.rs

@@ -34,7 +34,7 @@ mod tests {
         alpha_async::{get_client_from_parts, upload_img},
     };
     use ethers::types::{Bytes, H256 as ethers_H256, U256};
-    use risc0_zkvm::{MemoryImage, Program, MEM_SIZE, PAGE_SIZE};
+    use risc0_zkvm::{MemoryImage, Program, GUEST_MAX_MEM, PAGE_SIZE};
     use risc0_zkvm_methods::{SLICE_IO_ELF, SLICE_IO_ID};
     use tokio::time::{sleep, Duration};
 
@@ -161,7 +161,7 @@ mod tests {
         // create the memoryImg, upload it and return the imageId
         let image_key = {
             let program =
-                Program::load_elf(SLICE_IO_ELF, MEM_SIZE as u32).expect("unable to load elf");
+                Program::load_elf(SLICE_IO_ELF, GUEST_MAX_MEM as u32).expect("unable to load elf");
             let image = MemoryImage::new(&program, PAGE_SIZE as u32)
                 .expect("unable to create memory image");
             let image_id = hex::encode(image.compute_id());
@@ -306,7 +306,8 @@ mod tests {
         // register elf
         let bonsai_client = get_bonsai_client(get_api_key()).await;
         // create the memoryImg, upload it and return the imageId
-        let program = Program::load_elf(SLICE_IO_ELF, MEM_SIZE as u32).expect("unable to load elf");
+        let program =
+            Program::load_elf(SLICE_IO_ELF, GUEST_MAX_MEM as u32).expect("unable to load elf");
         let image =
             MemoryImage::new(&program, PAGE_SIZE as u32).expect("unable to create memory image");
         let image_id = hex::encode(image.compute_id());

bonsai/examples/governance/relay/src/lib.rs

@@ -17,7 +17,7 @@ use std::time::Duration;
 use anyhow::{anyhow, bail, Context, Result};
 use bonsai_sdk::alpha::{responses::SnarkReceipt, Client};
 use risc0_build::GuestListEntry;
-use risc0_zkvm::{Executor, ExecutorEnv, MemoryImage, Program, Receipt, MEM_SIZE, PAGE_SIZE};
+use risc0_zkvm::{Executor, ExecutorEnv, MemoryImage, Program, Receipt, GUEST_MAX_MEM, PAGE_SIZE};
 
 /// Result of executing a guest image, possibly containing a proof.
 pub enum Output {
@@ -47,7 +47,7 @@ pub fn execute_locally(elf: &[u8], input: Vec<u8>) -> Result<Output> {
 pub const POLL_INTERVAL_SEC: u64 = 4;
 
 fn get_digest(elf: &[u8]) -> Result<String> {
-    let program = Program::load_elf(elf, MEM_SIZE as u32)?;
+    let program = Program::load_elf(elf, GUEST_MAX_MEM as u32)?;
     let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
     Ok(hex::encode(image.compute_id()))
 }

bonsai/rest-api-mock/src/lib.rs

@@ -93,7 +93,7 @@ mod test {
 
     use anyhow::{bail, Result};
     use bonsai_sdk::alpha_async as bonsai_sdk;
-    use risc0_zkvm::{MemoryImage, Program, MEM_SIZE, PAGE_SIZE};
+    use risc0_zkvm::{MemoryImage, Program, GUEST_MAX_MEM, PAGE_SIZE};
     use risc0_zkvm_methods::HELLO_COMMIT_ELF;
 
     use crate::serve;
@@ -107,7 +107,7 @@ mod test {
 
         // create the memoryImg, upload it and return the imageId
         let img_id = {
-            let program = Program::load_elf(method, MEM_SIZE as u32)?;
+            let program = Program::load_elf(method, GUEST_MAX_MEM as u32)?;
             let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
             let image_id = hex::encode(image.compute_id());
             let image = bincode::serialize(&image).expect("Failed to serialize memory img");

bonsai/rest-api-mock/src/prover.rs

@@ -19,7 +19,7 @@ use std::{
 
 use anyhow::Context;
 use risc0_zkvm::{
-    Executor, ExecutorEnv, InnerReceipt, MemoryImage, Program, Receipt, MEM_SIZE, PAGE_SIZE,
+    Executor, ExecutorEnv, InnerReceipt, MemoryImage, Program, Receipt, GUEST_MAX_MEM, PAGE_SIZE,
 };
 use tokio::sync::mpsc;
 
@@ -87,7 +87,7 @@ impl Prover {
                 let mem_img = image.as_slice();
                 let mem_img = if mem_img[0..ELFMAGIC.len()] == ELFMAGIC {
                     tracing::info!("Loading guest image form ELF file");
-                    let program = Program::load_elf(mem_img, MEM_SIZE as u32)?;
+                    let program = Program::load_elf(mem_img, GUEST_MAX_MEM as u32)?;
                     MemoryImage::new(&program, PAGE_SIZE as u32)?
                 } else {
                     bincode::deserialize(mem_img).context("failed to decode memory image")?

bonsai/sdk/README.md

@@ -9,7 +9,7 @@ use anyhow::Result;
 use bonsai_sdk::alpha as bonsai_sdk;
 use methods::{METHOD_NAME_ELF, METHOD_NAME_ID};
 use risc0_zkvm::{
-    Receipt, serde::to_vec, MemoryImage, Program, MEM_SIZE, PAGE_SIZE,
+    Receipt, serde::to_vec, MemoryImage, Program, GUEST_MAX_MEM, PAGE_SIZE,
 };
 use std::time::Duration;
 
@@ -18,7 +18,7 @@ fn run_bonsai(input_data: Vec<u8>) -> Result<()> {
 
     // create the memoryImg, upload it and return the imageId
     let img_id = {
-        let program = Program::load_elf(METHOD_NAME_ELF, MEM_SIZE as u32)?;
+        let program = Program::load_elf(METHOD_NAME_ELF, GUEST_MAX_MEM as u32)?;
         let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
         let image_id = hex::encode(image.compute_id());
         let image = bincode::serialize(&image).expect("Failed to serialize memory img");
@@ -100,4 +100,4 @@ fn run_stark2snark(session_id: String) -> Result<()> {
 }
 
 run_stark2snark(session_id)?;
-```
+```

risc0/binfmt/src/elf.rs

@@ -84,6 +84,9 @@ impl Program {
                 .map_err(|err| anyhow!("offset is larger than 32 bits. {err}"))?;
             for i in (0..mem_size).step_by(WORD_SIZE) {
                 let addr = vaddr.checked_add(i).context("Invalid segment vaddr")?;
+                if addr >= max_mem {
+                    bail!("Address [0x{addr:08x}] exceeds maximum address for guest programs [0x{max_mem:08x}]");
+                }
                 if i >= file_size {
                     // Past the file size, all zeros.
                     image.insert(addr, 0);

risc0/binfmt/src/image.rs

@@ -22,7 +22,7 @@ use risc0_zkp::core::{
     hash::sha::{cpu::Impl, Sha256, BLOCK_BYTES, SHA256_INIT},
 };
 use risc0_zkvm_platform::{
-    memory::{MEM_SIZE, PAGE_TABLE},
+    memory::{GUEST_MAX_MEM, MEM_SIZE, PAGE_TABLE},
     syscall::DIGEST_BYTES,
 };
 use serde::{Deserialize, Serialize};
@@ -175,8 +175,8 @@ impl MemoryImage {
 
         // Load the ELF into the memory image.
         for (&addr, &data) in program.image.iter() {
-            if addr as usize >= MEM_SIZE {
-                anyhow::bail!("Invalid Elf Program, address outside MEM_SIZE");
+            if addr as usize >= GUEST_MAX_MEM {
+                anyhow::bail!("Invalid Elf Program, address outside GUEST_MAX_MEM");
             }
             img.store_region_in_page(addr, &data.to_le_bytes());
         }
@@ -320,7 +320,7 @@ fn hash_page_bytes(page: &[u8]) -> Digest {
 mod tests {
     use risc0_zkvm_methods::MULTI_TEST_ELF;
     use risc0_zkvm_platform::{
-        memory::{MEM_SIZE, PAGE_TABLE, STACK_TOP, SYSTEM, TEXT_START},
+        memory::{GUEST_MAX_MEM, PAGE_TABLE, STACK_TOP, SYSTEM, TEXT_START},
         syscall::DIGEST_BYTES,
     };
     use test_log::test;
@@ -334,7 +334,7 @@ mod tests {
     #[test]
     fn check_integrity() {
         const PAGE_SIZE: u32 = 1024;
-        let program = Program::load_elf(MULTI_TEST_ELF, MEM_SIZE as u32).unwrap();
+        let program = Program::load_elf(MULTI_TEST_ELF, GUEST_MAX_MEM as u32).unwrap();
         let prog_pc = program.entry;
         let image = MemoryImage::new(&program, PAGE_SIZE).unwrap();
         assert_eq!(image.pc, prog_pc);
@@ -452,11 +452,11 @@ mod tests {
     }
 
     #[test]
-    #[should_panic(expected = "Invalid Elf Program, address outside MEM_SIZE")]
+    #[should_panic(expected = "exceeds maximum address for guest programs")]
     fn test_fuzzing_oob_idx_bug() {
         let data = b"\x7f\x45\x4c\x46\x01\x01\x01\x01\x01\x01\xff\xff\x00\x00\x00\x00\x02\x00\xf3\x00\x00\x00\x00\x00\x00\x00\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x20\x00\x08\x00\x00\x00\x96\x96\x00\x94\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xff\x00\x00\x94\x00\x00\x00\xff\xf6\x12\xa9\x00\x00\x00\x00\x00\x00\xfe\x00\x00\x00\x00\x00\x0a\x9a\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x96\x4c\x46\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x0a\x9d\xd8\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x40\x1e\x00\x00\x46\x4c\x00\x00\x00\x00\x00\x02\x00\x40\x00\x01\x01\x01\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x05\x00\x00\x07\x78\xc1\x0a\x00\x00\xba\x00\x00\x00\x00\xe3\x04\x00\x00\x31\x35\x32\x37\x38\x31\x46\x01\x01\x01\x01\x01\x01\xff\xff\x00\x00\x00\x00\x02\x00\xe5\x00\x00\x00\x00\x96\x96\x00\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x2e\xac\x00\x00\x00\x00\x00\x00\x0a\xce\x58\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x40\x1e\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x40\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x05\x00\x00\x07\x00\xba\xe8\xad\x0a\x00\xe3\x04\x00\x00\x00\x00\x12\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x05\x00\x00\x00\x01\x01\x01\x50\xcf\x0a\x00\x01\x01\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x04\x01\x01\x01\x01\x01\x01\x01\x00\x00\x31\x35\x31\x35\x32\x37\x38\x31\x30\x34\x02\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x05\x00\x00\x00\x01\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\x04\x92\x01\x01\x01\x01\x01\x01\xa2\xf8\x00\x20\x00\x00\x00\x00\xff\x00\x40\x00\x04\x00\x00\x00\x38\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0a\x40\x40\x00\x1a\x00\x19\x00";
         const PAGE_SIZE: u32 = 1024;
-        let prog = Program::load_elf(data, MEM_SIZE as u32).unwrap();
+        let prog = Program::load_elf(data, GUEST_MAX_MEM as u32).unwrap();
         MemoryImage::new(&prog, PAGE_SIZE).unwrap();
     }
 }

risc0/build/src/lib.rs

@@ -77,7 +77,7 @@ impl Risc0Method {
         }
 
         let elf = fs::read(&self.elf_path).unwrap();
-        let program = Program::load_elf(&elf, memory::MEM_SIZE as u32).unwrap();
+        let program = Program::load_elf(&elf, memory::GUEST_MAX_MEM as u32).unwrap();
         let image = MemoryImage::new(&program, PAGE_SIZE as u32).unwrap();
         image.compute_id()
     }

risc0/cargo-risczero/src/commands/build_guest.rs

@@ -24,7 +24,7 @@ use clap::Parser;
 use docker_generate::DockerFile;
 use risc0_binfmt::{MemoryImage, Program};
 use risc0_zkvm_platform::{
-    memory::{MEM_SIZE, TEXT_START},
+    memory::{GUEST_MAX_MEM, TEXT_START},
     PAGE_SIZE,
 };
 use tempfile::tempdir;
@@ -166,7 +166,8 @@ impl BuildGuest {
     /// Compute the image ID for a given ELF.
     fn compute_image_id(&self, elf_path: &Path) -> Result<String> {
         let elf = fs::read(elf_path)?;
-        let program = Program::load_elf(&elf, MEM_SIZE as u32).context("unable to load elf")?;
+        let program =
+            Program::load_elf(&elf, GUEST_MAX_MEM as u32).context("unable to load elf")?;
         let image = MemoryImage::new(&program, PAGE_SIZE as u32)
             .context("unable to create memory image")?;
         Ok(image.compute_id().to_string())

risc0/tools/src/bin/make_id.rs

@@ -25,7 +25,7 @@
 use std::fs;
 
 use clap::Parser;
-use risc0_zkvm::{MemoryImage, Program, MEM_SIZE, PAGE_SIZE};
+use risc0_zkvm::{MemoryImage, Program, GUEST_MAX_MEM, PAGE_SIZE};
 
 /// Generates an ImageID for a given RISC-V ELF binary.
 #[derive(Parser)]
@@ -41,7 +41,7 @@ struct Args {
 fn main() {
     let args = Args::parse();
     let elf_contents = fs::read(args.elf).unwrap();
-    let program = Program::load_elf(&elf_contents, MEM_SIZE as u32).unwrap();
+    let program = Program::load_elf(&elf_contents, GUEST_MAX_MEM as u32).unwrap();
     let image = MemoryImage::new(&program, PAGE_SIZE as u32).unwrap();
     let image_id = image.compute_id();
     std::fs::write(args.out, image_id.as_bytes()).unwrap();

risc0/zkvm/platform/src/memory.rs

@@ -16,6 +16,7 @@ use super::WORD_SIZE;
 
 pub const MEM_BITS: usize = 28;
 pub const MEM_SIZE: usize = 1 << MEM_BITS;
+pub const GUEST_MAX_MEM: usize = SYSTEM.start;
 
 pub struct Region {
     start: usize,

risc0/zkvm/src/host/api/server.rs

@@ -21,7 +21,7 @@ use std::{
 use anyhow::{anyhow, bail, Result};
 use bytes::Bytes;
 use risc0_binfmt::{MemoryImage, Program};
-use risc0_zkvm_platform::{memory::MEM_SIZE, PAGE_SIZE};
+use risc0_zkvm_platform::{memory::GUEST_MAX_MEM, PAGE_SIZE};
 use serde::{Deserialize, Serialize};
 
 use super::{malformed_err, path_to_string, pb, ConnectionWrapper, Connector, TcpConnector};
@@ -52,7 +52,7 @@ impl pb::Binary {
             pb::binary::Kind::Unspecified => bail!(malformed_err()),
             pb::binary::Kind::Image => bincode::deserialize(&bytes)?,
             pb::binary::Kind::Elf => {
-                let program = Program::load_elf(&bytes, MEM_SIZE as u32)?;
+                let program = Program::load_elf(&bytes, GUEST_MAX_MEM as u32)?;
                 MemoryImage::new(&program, PAGE_SIZE as u32)?
             }
         };

risc0/zkvm/src/host/client/prove/mod.rs

@@ -21,7 +21,7 @@ use std::{path::PathBuf, rc::Rc};
 
 use anyhow::Result;
 use risc0_binfmt::{MemoryImage, Program};
-use risc0_zkvm_platform::{memory::MEM_SIZE, PAGE_SIZE};
+use risc0_zkvm_platform::{memory::GUEST_MAX_MEM, PAGE_SIZE};
 use serde::{Deserialize, Serialize};
 
 use self::{bonsai::BonsaiProver, external::ExternalProver};
@@ -40,7 +40,7 @@ use crate::{is_dev_mode, ExecutorEnv, Receipt, VerifierContext};
 /// use risc0_zkvm::{
 ///     default_prover,
 ///     ExecutorEnv,
-///     MEM_SIZE,
+///     GUEST_MAX_MEM,
 ///     MemoryImage,
 ///     PAGE_SIZE,
 ///     Program,
@@ -65,7 +65,7 @@ use crate::{is_dev_mode, ExecutorEnv, Receipt, VerifierContext};
 /// // Or you can prove from a `MemoryImage`
 /// // (generating a `MemoryImage` from an ELF file in this way is equivalent
 /// // to the above code.)
-/// let program = Program::load_elf(FIB_ELF, MEM_SIZE as u32).unwrap();
+/// let program = Program::load_elf(FIB_ELF, GUEST_MAX_MEM as u32).unwrap();
 /// let image = MemoryImage::new(&program, PAGE_SIZE as u32).unwrap();
 /// let env = ExecutorEnv::builder().add_input(&[20]).build().unwrap();
 /// let ctx = VerifierContext::default();
@@ -104,7 +104,7 @@ pub trait Prover {
         elf: &[u8],
         opts: &ProverOpts,
     ) -> Result<Receipt> {
-        let program = Program::load_elf(elf, MEM_SIZE as u32)?;
+        let program = Program::load_elf(elf, GUEST_MAX_MEM as u32)?;
         let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
         self.prove(env, ctx, opts, image)
     }

risc0/zkvm/src/host/server/exec/executor.rs

@@ -34,7 +34,7 @@ use risc0_zkp::{
 };
 use risc0_zkvm_platform::{
     fileno,
-    memory::MEM_SIZE,
+    memory::GUEST_MAX_MEM,
     syscall::{
         bigint, ecall, halt,
         reg_abi::{REG_A0, REG_A1, REG_A2, REG_A3, REG_A4, REG_T0},
@@ -196,7 +196,7 @@ impl<'a> Executor<'a> {
     /// let mut exec = Executor::from_elf(env, BENCH_ELF).unwrap();
     /// ```
     pub fn from_elf(env: ExecutorEnv<'a>, elf: &[u8]) -> Result<Self> {
-        let program = Program::load_elf(elf, MEM_SIZE as u32)?;
+        let program = Program::load_elf(elf, GUEST_MAX_MEM as u32)?;
         let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
         let obj_ctx = if log::log_enabled!(log::Level::Trace) {
             let file = addr2line::object::read::File::parse(elf)?;

risc0/zkvm/src/host/server/prove/mod.rs

@@ -37,7 +37,7 @@ use risc0_zkp::{
     core::digest::DIGEST_WORDS,
     hal::{CircuitHal, Hal},
 };
-use risc0_zkvm_platform::{memory::MEM_SIZE, PAGE_SIZE, WORD_SIZE};
+use risc0_zkvm_platform::{memory::GUEST_MAX_MEM, PAGE_SIZE, WORD_SIZE};
 
 use self::{dev_mode::DevModeProver, prover_impl::ProverImpl};
 use crate::{
@@ -72,7 +72,7 @@ pub trait ProverServer {
         ctx: &VerifierContext,
         elf: &[u8],
     ) -> Result<Receipt> {
-        let program = Program::load_elf(elf, MEM_SIZE as u32)?;
+        let program = Program::load_elf(elf, GUEST_MAX_MEM as u32)?;
         let image = MemoryImage::new(&program, PAGE_SIZE as u32)?;
         self.prove(env, ctx, image)
     }

risc0/zkvm/src/host/server/prove/tests.rs

@@ -304,7 +304,7 @@ mod riscv {
         use std::io::Read;
 
         use flate2::read::GzDecoder;
-        use risc0_zkvm_platform::{memory::MEM_SIZE, PAGE_SIZE};
+        use risc0_zkvm_platform::{memory::GUEST_MAX_MEM, PAGE_SIZE};
         use tar::Archive;
 
         let bytes = include_bytes!("../testdata/riscv-tests.tgz");
@@ -323,7 +323,7 @@ mod riscv {
             let mut elf = Vec::new();
             entry.read_to_end(&mut elf).unwrap();
 
-            let program = Program::load_elf(elf.as_slice(), MEM_SIZE as u32).unwrap();
+            let program = Program::load_elf(elf.as_slice(), GUEST_MAX_MEM as u32).unwrap();
             let image = MemoryImage::new(&program, PAGE_SIZE as u32).unwrap();
 
             let env = ExecutorEnv::default();

risc0/zkvm/src/lib.rs

@@ -38,7 +38,7 @@ pub use anyhow::Result;
 pub use bytes::Bytes;
 #[cfg(not(target_os = "zkvm"))]
 pub use risc0_binfmt::{MemoryImage, Program, SystemState};
-pub use risc0_zkvm_platform::{declare_syscall, memory::MEM_SIZE, PAGE_SIZE};
+pub use risc0_zkvm_platform::{declare_syscall, memory::GUEST_MAX_MEM, PAGE_SIZE};
 
 #[cfg(not(target_os = "zkvm"))]
 #[cfg(feature = "profiler")]