1 //! Implementation of a data-race detector using Lamport Timestamps / Vector-clocks
2 //! based on the Dynamic Race Detection for C++:
3 //! https://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2017/POPL.pdf
4 //! which does not report false-positives when fences are used, and gives better
5 //! accuracy in presence of read-modify-write operations.
7 //! The implementation contains modifications to correctly model the changes to the memory model in C++20
8 //! regarding the weakening of release sequences: http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p0982r1.html.
9 //! Relaxed stores now unconditionally block all currently active release sequences and so per-thread tracking of release
10 //! sequences is not needed.
12 //! The implementation also models races with memory allocation and deallocation via treating allocation and
13 //! deallocation as a type of write internally for detecting data-races.
15 //! This does not explore weak memory orders and so can still miss data-races
16 //! but should not report false-positives
18 //! Data-race definition from(https://en.cppreference.com/w/cpp/language/memory_model#Threads_and_data_races):
19 //! a data race occurs between two memory accesses if they are on different threads, at least one operation
20 //! is non-atomic, at least one operation is a write and neither access happens-before the other. Read the link
21 //! for full definition.
23 //! This re-uses vector indexes for threads that are known to be unable to report data-races, this is valid
24 //! because it only re-uses vector indexes once all currently-active (not-terminated) threads have an internal
25 //! vector clock that happens-after the join operation of the candidate thread. Threads that have not been joined
26 //! on are not considered. Since the thread's vector clock will only increase and a data-race implies that
27 //! there is some index x where clock[x] > thread_clock, when this is true clock[candidate-idx] > thread_clock
28 //! can never hold and hence a data-race can never be reported in that vector index again.
29 //! This means that the thread-index can be safely re-used, starting on the next timestamp for the newly created
32 //! The sequentially consistent ordering corresponds to the ordering that the threads
33 //! are currently scheduled, this means that the data-race detector has no additional
34 //! logic for sequentially consistent accesses at the moment since they are indistinguishable
35 //! from acquire/release operations. If weak memory orderings are explored then this
36 //! may need to change or be updated accordingly.
38 //! Per the C++ spec for the memory model a sequentially consistent operation:
39 //! "A load operation with this memory order performs an acquire operation,
40 //! a store performs a release operation, and read-modify-write performs
41 //! both an acquire operation and a release operation, plus a single total
42 //! order exists in which all threads observe all modifications in the same
43 //! order (see Sequentially-consistent ordering below) "
44 //! So in the absence of weak memory effects a seq-cst load & a seq-cst store is identical
45 //! to an acquire load and a release store given the global sequentially consistent order
48 //! The timestamps used in the data-race detector assign each sequence of non-atomic operations
49 //! followed by a single atomic or concurrent operation a single timestamp.
50 //! Write, Read, Write, ThreadJoin will be represented by a single timestamp value on a thread.
51 //! This is because extra increment operations between the operations in the sequence are not
52 //! required for accurate reporting of data-race values.
54 //! As per the paper a threads timestamp is only incremented after a release operation is performed
55 //! so some atomic operations that only perform acquires do not increment the timestamp. Due to shared
56 //! code some atomic operations may increment the timestamp when not necessary but this has no effect
57 //! on the data-race detection code.
60 //! currently we have our own local copy of the currently active thread index and names, this is due
61 //! in part to the inability to access the current location of threads.active_thread inside the AllocExtra
62 //! read, write and deallocate functions and should be cleaned up in the future.
65 cell::{Cell, Ref, RefCell, RefMut},
70 use rustc_data_structures::fx::{FxHashMap, FxHashSet};
71 use rustc_index::vec::{Idx, IndexVec};
72 use rustc_middle::{mir, ty::layout::TyAndLayout};
73 use rustc_target::abi::Size;
77 pub type AllocExtra = VClockAlloc;
79 /// Valid atomic read-write operations, alias of atomic::Ordering (not non-exhaustive).
80 #[derive(Copy, Clone, PartialEq, Eq, Debug)]
89 /// Valid atomic read operations, subset of atomic::Ordering.
90 #[derive(Copy, Clone, PartialEq, Eq, Debug)]
91 pub enum AtomicReadOp {
97 /// Valid atomic write operations, subset of atomic::Ordering.
98 #[derive(Copy, Clone, PartialEq, Eq, Debug)]
99 pub enum AtomicWriteOp {
105 /// Valid atomic fence operations, subset of atomic::Ordering.
106 #[derive(Copy, Clone, PartialEq, Eq, Debug)]
107 pub enum AtomicFenceOp {
114 /// The current set of vector clocks describing the state
115 /// of a thread, contains the happens-before clock and
116 /// additional metadata to model atomic fence operations.
117 #[derive(Clone, Default, Debug)]
118 struct ThreadClockSet {
119 /// The increasing clock representing timestamps
120 /// that happen-before this thread.
123 /// The set of timestamps that will happen-before this
124 /// thread once it performs an acquire fence.
125 fence_acquire: VClock,
127 /// The last timestamp of happens-before relations that
128 /// have been released by this thread by a fence.
129 fence_release: VClock,
132 impl ThreadClockSet {
133 /// Apply the effects of a release fence to this
134 /// set of thread vector clocks.
136 fn apply_release_fence(&mut self) {
137 self.fence_release.clone_from(&self.clock);
140 /// Apply the effects of an acquire fence to this
141 /// set of thread vector clocks.
143 fn apply_acquire_fence(&mut self) {
144 self.clock.join(&self.fence_acquire);
147 /// Increment the happens-before clock at a
150 fn increment_clock(&mut self, index: VectorIdx) {
151 self.clock.increment_index(index);
154 /// Join the happens-before clock with that of
155 /// another thread, used to model thread join
157 fn join_with(&mut self, other: &ThreadClockSet) {
158 self.clock.join(&other.clock);
162 /// Error returned by finding a data race
163 /// should be elaborated upon.
164 #[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]
167 /// Externally stored memory cell clocks
168 /// explicitly to reduce memory usage for the
169 /// common case where no atomic operations
170 /// exists on the memory cell.
171 #[derive(Clone, PartialEq, Eq, Default, Debug)]
172 struct AtomicMemoryCellClocks {
173 /// The clock-vector of the timestamp of the last atomic
174 /// read operation performed by each thread.
175 /// This detects potential data-races between atomic read
176 /// and non-atomic write operations.
179 /// The clock-vector of the timestamp of the last atomic
180 /// write operation performed by each thread.
181 /// This detects potential data-races between atomic write
182 /// and non-atomic read or write operations.
183 write_vector: VClock,
185 /// Synchronization vector for acquire-release semantics
186 /// contains the vector of timestamps that will
187 /// happen-before a thread if an acquire-load is
188 /// performed on the data.
192 /// Type of write operation: allocating memory
193 /// non-atomic writes and deallocating memory
194 /// are all treated as writes for the purpose
195 /// of the data-race detector.
196 #[derive(Copy, Clone, PartialEq, Eq, Debug)]
201 /// Standard unsynchronized write.
204 /// Deallocate memory.
205 /// Note that when memory is deallocated first, later non-atomic accesses
206 /// will be reported as use-after-free, not as data races.
207 /// (Same for `Allocate` above.)
211 fn get_descriptor(self) -> &'static str {
213 WriteType::Allocate => "Allocate",
214 WriteType::Write => "Write",
215 WriteType::Deallocate => "Deallocate",
220 /// Memory Cell vector clock metadata
221 /// for data-race detection.
222 #[derive(Clone, PartialEq, Eq, Debug)]
223 struct MemoryCellClocks {
224 /// The vector-clock timestamp of the last write
225 /// corresponding to the writing threads timestamp.
228 /// The identifier of the vector index, corresponding to a thread
229 /// that performed the last write operation.
230 write_index: VectorIdx,
232 /// The type of operation that the write index represents,
233 /// either newly allocated memory, a non-atomic write or
234 /// a deallocation of memory.
235 write_type: WriteType,
237 /// The vector-clock of the timestamp of the last read operation
238 /// performed by a thread since the last write operation occurred.
239 /// It is reset to zero on each write operation.
242 /// Atomic acquire & release sequence tracking clocks.
243 /// For non-atomic memory in the common case this
244 /// value is set to None.
245 atomic_ops: Option<Box<AtomicMemoryCellClocks>>,
248 impl MemoryCellClocks {
249 /// Create a new set of clocks representing memory allocated
250 /// at a given vector timestamp and index.
251 fn new(alloc: VTimestamp, alloc_index: VectorIdx) -> Self {
253 read: VClock::default(),
255 write_index: alloc_index,
256 write_type: WriteType::Allocate,
261 /// Load the internal atomic memory cells if they exist.
263 fn atomic(&self) -> Option<&AtomicMemoryCellClocks> {
264 match &self.atomic_ops {
265 Some(op) => Some(&*op),
270 /// Load or create the internal atomic memory metadata
271 /// if it does not exist.
273 fn atomic_mut(&mut self) -> &mut AtomicMemoryCellClocks {
274 self.atomic_ops.get_or_insert_with(Default::default)
277 /// Update memory cell data-race tracking for atomic
278 /// load acquire semantics, is a no-op if this memory was
279 /// not used previously as atomic memory.
282 clocks: &mut ThreadClockSet,
284 ) -> Result<(), DataRace> {
285 self.atomic_read_detect(clocks, index)?;
286 if let Some(atomic) = self.atomic() {
287 clocks.clock.join(&atomic.sync_vector);
292 /// Update memory cell data-race tracking for atomic
293 /// load relaxed semantics, is a no-op if this memory was
294 /// not used previously as atomic memory.
297 clocks: &mut ThreadClockSet,
299 ) -> Result<(), DataRace> {
300 self.atomic_read_detect(clocks, index)?;
301 if let Some(atomic) = self.atomic() {
302 clocks.fence_acquire.join(&atomic.sync_vector);
307 /// Update the memory cell data-race tracking for atomic
308 /// store release semantics.
309 fn store_release(&mut self, clocks: &ThreadClockSet, index: VectorIdx) -> Result<(), DataRace> {
310 self.atomic_write_detect(clocks, index)?;
311 let atomic = self.atomic_mut();
312 atomic.sync_vector.clone_from(&clocks.clock);
316 /// Update the memory cell data-race tracking for atomic
317 /// store relaxed semantics.
318 fn store_relaxed(&mut self, clocks: &ThreadClockSet, index: VectorIdx) -> Result<(), DataRace> {
319 self.atomic_write_detect(clocks, index)?;
321 // The handling of release sequences was changed in C++20 and so
322 // the code here is different to the paper since now all relaxed
323 // stores block release sequences. The exception for same-thread
324 // relaxed stores has been removed.
325 let atomic = self.atomic_mut();
326 atomic.sync_vector.clone_from(&clocks.fence_release);
330 /// Update the memory cell data-race tracking for atomic
331 /// store release semantics for RMW operations.
332 fn rmw_release(&mut self, clocks: &ThreadClockSet, index: VectorIdx) -> Result<(), DataRace> {
333 self.atomic_write_detect(clocks, index)?;
334 let atomic = self.atomic_mut();
335 atomic.sync_vector.join(&clocks.clock);
339 /// Update the memory cell data-race tracking for atomic
340 /// store relaxed semantics for RMW operations.
341 fn rmw_relaxed(&mut self, clocks: &ThreadClockSet, index: VectorIdx) -> Result<(), DataRace> {
342 self.atomic_write_detect(clocks, index)?;
343 let atomic = self.atomic_mut();
344 atomic.sync_vector.join(&clocks.fence_release);
348 /// Detect data-races with an atomic read, caused by a non-atomic write that does
349 /// not happen-before the atomic-read.
350 fn atomic_read_detect(
352 clocks: &ThreadClockSet,
354 ) -> Result<(), DataRace> {
355 log::trace!("Atomic read with vectors: {:#?} :: {:#?}", self, clocks);
356 if self.write <= clocks.clock[self.write_index] {
357 let atomic = self.atomic_mut();
358 atomic.read_vector.set_at_index(&clocks.clock, index);
365 /// Detect data-races with an atomic write, either with a non-atomic read or with
366 /// a non-atomic write.
367 fn atomic_write_detect(
369 clocks: &ThreadClockSet,
371 ) -> Result<(), DataRace> {
372 log::trace!("Atomic write with vectors: {:#?} :: {:#?}", self, clocks);
373 if self.write <= clocks.clock[self.write_index] && self.read <= clocks.clock {
374 let atomic = self.atomic_mut();
375 atomic.write_vector.set_at_index(&clocks.clock, index);
382 /// Detect races for non-atomic read operations at the current memory cell
383 /// returns true if a data-race is detected.
386 clocks: &ThreadClockSet,
388 ) -> Result<(), DataRace> {
389 log::trace!("Unsynchronized read with vectors: {:#?} :: {:#?}", self, clocks);
390 if self.write <= clocks.clock[self.write_index] {
391 let race_free = if let Some(atomic) = self.atomic() {
392 atomic.write_vector <= clocks.clock
397 self.read.set_at_index(&clocks.clock, index);
407 /// Detect races for non-atomic write operations at the current memory cell
408 /// returns true if a data-race is detected.
409 fn write_race_detect(
411 clocks: &ThreadClockSet,
413 write_type: WriteType,
414 ) -> Result<(), DataRace> {
415 log::trace!("Unsynchronized write with vectors: {:#?} :: {:#?}", self, clocks);
416 if self.write <= clocks.clock[self.write_index] && self.read <= clocks.clock {
417 let race_free = if let Some(atomic) = self.atomic() {
418 atomic.write_vector <= clocks.clock && atomic.read_vector <= clocks.clock
423 self.write = clocks.clock[index];
424 self.write_index = index;
425 self.write_type = write_type;
426 self.read.set_zero_vector();
437 /// Evaluation context extensions.
438 impl<'mir, 'tcx: 'mir> EvalContextExt<'mir, 'tcx> for MiriEvalContext<'mir, 'tcx> {}
439 pub trait EvalContextExt<'mir, 'tcx: 'mir>: MiriEvalContextExt<'mir, 'tcx> {
440 /// Atomic variant of read_scalar_at_offset.
441 fn read_scalar_at_offset_atomic(
443 op: &OpTy<'tcx, Tag>,
445 layout: TyAndLayout<'tcx>,
446 atomic: AtomicReadOp,
447 ) -> InterpResult<'tcx, ScalarMaybeUninit<Tag>> {
448 let this = self.eval_context_ref();
449 let value_place = this.deref_operand_and_offset(op, offset, layout)?;
450 this.read_scalar_atomic(&value_place, atomic)
453 /// Atomic variant of write_scalar_at_offset.
454 fn write_scalar_at_offset_atomic(
456 op: &OpTy<'tcx, Tag>,
458 value: impl Into<ScalarMaybeUninit<Tag>>,
459 layout: TyAndLayout<'tcx>,
460 atomic: AtomicWriteOp,
461 ) -> InterpResult<'tcx> {
462 let this = self.eval_context_mut();
463 let value_place = this.deref_operand_and_offset(op, offset, layout)?;
464 this.write_scalar_atomic(value.into(), &value_place, atomic)
467 /// Perform an atomic read operation at the memory location.
468 fn read_scalar_atomic(
470 place: &MPlaceTy<'tcx, Tag>,
471 atomic: AtomicReadOp,
472 ) -> InterpResult<'tcx, ScalarMaybeUninit<Tag>> {
473 let this = self.eval_context_ref();
474 let scalar = this.allow_data_races_ref(move |this| this.read_scalar(&place.into()))?;
475 this.validate_atomic_load(place, atomic)?;
479 /// Perform an atomic write operation at the memory location.
480 fn write_scalar_atomic(
482 val: ScalarMaybeUninit<Tag>,
483 dest: &MPlaceTy<'tcx, Tag>,
484 atomic: AtomicWriteOp,
485 ) -> InterpResult<'tcx> {
486 let this = self.eval_context_mut();
487 this.allow_data_races_mut(move |this| this.write_scalar(val, &(*dest).into()))?;
488 this.validate_atomic_store(dest, atomic)
491 /// Perform an atomic operation on a memory location.
492 fn atomic_op_immediate(
494 place: &MPlaceTy<'tcx, Tag>,
495 rhs: &ImmTy<'tcx, Tag>,
499 ) -> InterpResult<'tcx, ImmTy<'tcx, Tag>> {
500 let this = self.eval_context_mut();
502 let old = this.allow_data_races_mut(|this| this.read_immediate(&place.into()))?;
504 // Atomics wrap around on overflow.
505 let val = this.binary_op(op, &old, rhs)?;
506 let val = if neg { this.unary_op(mir::UnOp::Not, &val)? } else { val };
507 this.allow_data_races_mut(|this| this.write_immediate(*val, &(*place).into()))?;
509 this.validate_atomic_rmw(place, atomic)?;
513 /// Perform an atomic exchange with a memory place and a new
514 /// scalar value, the old value is returned.
515 fn atomic_exchange_scalar(
517 place: &MPlaceTy<'tcx, Tag>,
518 new: ScalarMaybeUninit<Tag>,
520 ) -> InterpResult<'tcx, ScalarMaybeUninit<Tag>> {
521 let this = self.eval_context_mut();
523 let old = this.allow_data_races_mut(|this| this.read_scalar(&place.into()))?;
524 this.allow_data_races_mut(|this| this.write_scalar(new, &(*place).into()))?;
525 this.validate_atomic_rmw(place, atomic)?;
529 /// Perform an conditional atomic exchange with a memory place and a new
530 /// scalar value, the old value is returned.
531 fn atomic_min_max_scalar(
533 place: &MPlaceTy<'tcx, Tag>,
534 rhs: ImmTy<'tcx, Tag>,
537 ) -> InterpResult<'tcx, ImmTy<'tcx, Tag>> {
538 let this = self.eval_context_mut();
540 let old = this.allow_data_races_mut(|this| this.read_immediate(&place.into()))?;
541 let lt = this.binary_op(mir::BinOp::Lt, &old, &rhs)?.to_scalar()?.to_bool()?;
543 let new_val = if min {
544 if lt { &old } else { &rhs }
546 if lt { &rhs } else { &old }
549 this.allow_data_races_mut(|this| this.write_immediate(**new_val, &(*place).into()))?;
551 this.validate_atomic_rmw(place, atomic)?;
553 // Return the old value.
557 /// Perform an atomic compare and exchange at a given memory location.
558 /// On success an atomic RMW operation is performed and on failure
559 /// only an atomic read occurs. If `can_fail_spuriously` is true,
560 /// then we treat it as a "compare_exchange_weak" operation, and
561 /// some portion of the time fail even when the values are actually
563 fn atomic_compare_exchange_scalar(
565 place: &MPlaceTy<'tcx, Tag>,
566 expect_old: &ImmTy<'tcx, Tag>,
567 new: ScalarMaybeUninit<Tag>,
570 can_fail_spuriously: bool,
571 ) -> InterpResult<'tcx, Immediate<Tag>> {
573 let this = self.eval_context_mut();
575 // Failure ordering cannot be stronger than success ordering, therefore first attempt
576 // to read with the failure ordering and if successful then try again with the success
577 // read ordering and write in the success case.
578 // Read as immediate for the sake of `binary_op()`
579 let old = this.allow_data_races_mut(|this| this.read_immediate(&(place.into())))?;
580 // `binary_op` will bail if either of them is not a scalar.
581 let eq = this.binary_op(mir::BinOp::Eq, &old, expect_old)?;
582 // If the operation would succeed, but is "weak", fail some portion
583 // of the time, based on `rate`.
584 let rate = this.machine.cmpxchg_weak_failure_rate;
585 let cmpxchg_success = eq.to_scalar()?.to_bool()?
586 && (!can_fail_spuriously || this.machine.rng.get_mut().gen::<f64>() < rate);
587 let res = Immediate::ScalarPair(
588 old.to_scalar_or_uninit(),
589 Scalar::from_bool(cmpxchg_success).into(),
592 // Update ptr depending on comparison.
593 // if successful, perform a full rw-atomic validation
594 // otherwise treat this as an atomic load with the fail ordering.
596 this.allow_data_races_mut(|this| this.write_scalar(new, &(*place).into()))?;
597 this.validate_atomic_rmw(place, success)?;
599 this.validate_atomic_load(place, fail)?;
602 // Return the old value.
606 /// Update the data-race detector for an atomic read occurring at the
607 /// associated memory-place and on the current thread.
608 fn validate_atomic_load(
610 place: &MPlaceTy<'tcx, Tag>,
611 atomic: AtomicReadOp,
612 ) -> InterpResult<'tcx> {
613 let this = self.eval_context_ref();
614 this.validate_atomic_op(
618 move |memory, clocks, index, atomic| {
619 if atomic == AtomicReadOp::Relaxed {
620 memory.load_relaxed(&mut *clocks, index)
622 memory.load_acquire(&mut *clocks, index)
628 /// Update the data-race detector for an atomic write occurring at the
629 /// associated memory-place and on the current thread.
630 fn validate_atomic_store(
632 place: &MPlaceTy<'tcx, Tag>,
633 atomic: AtomicWriteOp,
634 ) -> InterpResult<'tcx> {
635 let this = self.eval_context_mut();
636 this.validate_atomic_op(
640 move |memory, clocks, index, atomic| {
641 if atomic == AtomicWriteOp::Relaxed {
642 memory.store_relaxed(clocks, index)
644 memory.store_release(clocks, index)
650 /// Update the data-race detector for an atomic read-modify-write occurring
651 /// at the associated memory place and on the current thread.
652 fn validate_atomic_rmw(
654 place: &MPlaceTy<'tcx, Tag>,
656 ) -> InterpResult<'tcx> {
658 let acquire = matches!(atomic, Acquire | AcqRel | SeqCst);
659 let release = matches!(atomic, Release | AcqRel | SeqCst);
660 let this = self.eval_context_mut();
661 this.validate_atomic_op(place, atomic, "Atomic RMW", move |memory, clocks, index, _| {
663 memory.load_acquire(clocks, index)?;
665 memory.load_relaxed(clocks, index)?;
668 memory.rmw_release(clocks, index)
670 memory.rmw_relaxed(clocks, index)
675 /// Update the data-race detector for an atomic fence on the current thread.
676 fn validate_atomic_fence(&mut self, atomic: AtomicFenceOp) -> InterpResult<'tcx> {
677 let this = self.eval_context_mut();
678 if let Some(data_race) = &mut this.machine.data_race {
679 data_race.maybe_perform_sync_operation(move |index, mut clocks| {
680 log::trace!("Atomic fence on {:?} with ordering {:?}", index, atomic);
682 // Apply data-race detection for the current fences
683 // this treats AcqRel and SeqCst as the same as an acquire
684 // and release fence applied in the same timestamp.
685 if atomic != AtomicFenceOp::Release {
686 // Either Acquire | AcqRel | SeqCst
687 clocks.apply_acquire_fence();
689 if atomic != AtomicFenceOp::Acquire {
690 // Either Release | AcqRel | SeqCst
691 clocks.apply_release_fence();
694 // Increment timestamp in case of release semantics.
695 Ok(atomic != AtomicFenceOp::Acquire)
703 /// Vector clock metadata for a logical memory allocation.
704 #[derive(Debug, Clone)]
705 pub struct VClockAlloc {
706 /// Assigning each byte a MemoryCellClocks.
707 alloc_ranges: RefCell<RangeMap<MemoryCellClocks>>,
711 /// Create a new data-race detector for newly allocated memory.
712 pub fn new_allocation(
713 global: &GlobalState,
715 kind: MemoryKind<MiriMemoryKind>,
717 let (alloc_timestamp, alloc_index) = match kind {
718 // User allocated and stack memory should track allocation.
720 MiriMemoryKind::Rust | MiriMemoryKind::C | MiriMemoryKind::WinHeap,
722 | MemoryKind::Stack => {
723 let (alloc_index, clocks) = global.current_thread_state();
724 let alloc_timestamp = clocks.clock[alloc_index];
725 (alloc_timestamp, alloc_index)
727 // Other global memory should trace races but be allocated at the 0 timestamp.
729 MiriMemoryKind::Global
730 | MiriMemoryKind::Machine
731 | MiriMemoryKind::Runtime
732 | MiriMemoryKind::ExternStatic
733 | MiriMemoryKind::Tls,
735 | MemoryKind::CallerLocation => (0, VectorIdx::MAX_INDEX),
738 alloc_ranges: RefCell::new(RangeMap::new(
740 MemoryCellClocks::new(alloc_timestamp, alloc_index),
745 // Find an index, if one exists where the value
746 // in `l` is greater than the value in `r`.
747 fn find_gt_index(l: &VClock, r: &VClock) -> Option<VectorIdx> {
748 log::trace!("Find index where not {:?} <= {:?}", l, r);
749 let l_slice = l.as_slice();
750 let r_slice = r.as_slice();
755 .find_map(|(idx, (&l, &r))| if l > r { Some(idx) } else { None })
757 if l_slice.len() > r_slice.len() {
758 // By invariant, if l_slice is longer
759 // then one element must be larger.
760 // This just validates that this is true
761 // and reports earlier elements first.
762 let l_remainder_slice = &l_slice[r_slice.len()..];
763 let idx = l_remainder_slice
766 .find_map(|(idx, &r)| if r == 0 { None } else { Some(idx) })
767 .expect("Invalid VClock Invariant");
768 Some(idx + r_slice.len())
776 /// Report a data-race found in the program.
777 /// This finds the two racing threads and the type
778 /// of data-race that occurred. This will also
779 /// return info about the memory location the data-race
783 fn report_data_race<'tcx>(
784 global: &GlobalState,
785 range: &MemoryCellClocks,
788 ptr_dbg: Pointer<AllocId>,
789 ) -> InterpResult<'tcx> {
790 let (current_index, current_clocks) = global.current_thread_state();
792 let (other_action, other_thread, other_clock) = if range.write
793 > current_clocks.clock[range.write_index]
795 // Convert the write action into the vector clock it
796 // represents for diagnostic purposes.
797 write_clock = VClock::new_with_index(range.write_index, range.write);
798 (range.write_type.get_descriptor(), range.write_index, &write_clock)
799 } else if let Some(idx) = Self::find_gt_index(&range.read, ¤t_clocks.clock) {
800 ("Read", idx, &range.read)
801 } else if !is_atomic {
802 if let Some(atomic) = range.atomic() {
803 if let Some(idx) = Self::find_gt_index(&atomic.write_vector, ¤t_clocks.clock)
805 ("Atomic Store", idx, &atomic.write_vector)
806 } else if let Some(idx) =
807 Self::find_gt_index(&atomic.read_vector, ¤t_clocks.clock)
809 ("Atomic Load", idx, &atomic.read_vector)
812 "Failed to report data-race for non-atomic operation: no race found"
817 "Failed to report data-race for non-atomic operation: no atomic component"
821 unreachable!("Failed to report data-race for atomic operation")
824 // Load elaborated thread information about the racing thread actions.
825 let current_thread_info = global.print_thread_metadata(current_index);
826 let other_thread_info = global.print_thread_metadata(other_thread);
828 // Throw the data-race detection.
830 "Data race detected between {} on {} and {} on {} at {:?} (current vector clock = {:?}, conflicting timestamp = {:?})",
836 current_clocks.clock,
841 /// Detect data-races for an unsynchronized read operation, will not perform
842 /// data-race detection if `multi-threaded` is false, either due to no threads
843 /// being created or if it is temporarily disabled during a racy read or write
844 /// operation for which data-race detection is handled separately, for example
845 /// atomic read operations.
850 global: &GlobalState,
851 ) -> InterpResult<'tcx> {
852 if global.multi_threaded.get() {
853 let (index, clocks) = global.current_thread_state();
854 let mut alloc_ranges = self.alloc_ranges.borrow_mut();
855 for (offset, range) in alloc_ranges.iter_mut(range.start, range.size) {
856 if let Err(DataRace) = range.read_race_detect(&*clocks, index) {
858 return Self::report_data_race(
863 Pointer::new(alloc_id, offset),
873 // Shared code for detecting data-races on unique access to a section of memory
874 fn unique_access<'tcx>(
878 write_type: WriteType,
879 global: &mut GlobalState,
880 ) -> InterpResult<'tcx> {
881 if global.multi_threaded.get() {
882 let (index, clocks) = global.current_thread_state();
883 for (offset, range) in self.alloc_ranges.get_mut().iter_mut(range.start, range.size) {
884 if let Err(DataRace) = range.write_race_detect(&*clocks, index, write_type) {
886 return Self::report_data_race(
889 write_type.get_descriptor(),
891 Pointer::new(alloc_id, offset),
901 /// Detect data-races for an unsynchronized write operation, will not perform
902 /// data-race threads if `multi-threaded` is false, either due to no threads
903 /// being created or if it is temporarily disabled during a racy read or write
909 global: &mut GlobalState,
910 ) -> InterpResult<'tcx> {
911 self.unique_access(alloc_id, range, WriteType::Write, global)
914 /// Detect data-races for an unsynchronized deallocate operation, will not perform
915 /// data-race threads if `multi-threaded` is false, either due to no threads
916 /// being created or if it is temporarily disabled during a racy read or write
918 pub fn deallocate<'tcx>(
922 global: &mut GlobalState,
923 ) -> InterpResult<'tcx> {
924 self.unique_access(alloc_id, range, WriteType::Deallocate, global)
928 impl<'mir, 'tcx: 'mir> EvalContextPrivExt<'mir, 'tcx> for MiriEvalContext<'mir, 'tcx> {}
929 trait EvalContextPrivExt<'mir, 'tcx: 'mir>: MiriEvalContextExt<'mir, 'tcx> {
930 // Temporarily allow data-races to occur, this should only be
931 // used if either one of the appropriate `validate_atomic` functions
932 // will be called to treat a memory access as atomic or if the memory
933 // being accessed should be treated as internal state, that cannot be
934 // accessed by the interpreted program.
936 fn allow_data_races_ref<R>(&self, op: impl FnOnce(&MiriEvalContext<'mir, 'tcx>) -> R) -> R {
937 let this = self.eval_context_ref();
938 let old = if let Some(data_race) = &this.machine.data_race {
939 data_race.multi_threaded.replace(false)
943 let result = op(this);
944 if let Some(data_race) = &this.machine.data_race {
945 data_race.multi_threaded.set(old);
950 /// Same as `allow_data_races_ref`, this temporarily disables any data-race detection and
951 /// so should only be used for atomic operations or internal state that the program cannot
954 fn allow_data_races_mut<R>(
956 op: impl FnOnce(&mut MiriEvalContext<'mir, 'tcx>) -> R,
958 let this = self.eval_context_mut();
959 let old = if let Some(data_race) = &this.machine.data_race {
960 data_race.multi_threaded.replace(false)
964 let result = op(this);
965 if let Some(data_race) = &this.machine.data_race {
966 data_race.multi_threaded.set(old);
971 /// Generic atomic operation implementation
972 fn validate_atomic_op<A: Debug + Copy>(
974 place: &MPlaceTy<'tcx, Tag>,
978 &mut MemoryCellClocks,
982 ) -> Result<(), DataRace>,
983 ) -> InterpResult<'tcx> {
984 let this = self.eval_context_ref();
985 if let Some(data_race) = &this.machine.data_race {
986 if data_race.multi_threaded.get() {
987 let size = place.layout.size;
988 let (alloc_id, base_offset, _tag) = this.ptr_get_alloc_id(place.ptr)?;
989 // Load and log the atomic operation.
990 // Note that atomic loads are possible even from read-only allocations, so `get_alloc_extra_mut` is not an option.
991 let alloc_meta = &this.get_alloc_extra(alloc_id)?.data_race.as_ref().unwrap();
993 "Atomic op({}) with ordering {:?} on {:?} (size={})",
1000 // Perform the atomic operation.
1001 data_race.maybe_perform_sync_operation(|index, mut clocks| {
1002 for (offset, range) in
1003 alloc_meta.alloc_ranges.borrow_mut().iter_mut(base_offset, size)
1005 if let Err(DataRace) = op(range, &mut *clocks, index, atomic) {
1007 return VClockAlloc::report_data_race(
1012 Pointer::new(alloc_id, offset),
1018 // This conservatively assumes all operations have release semantics
1022 // Log changes to atomic memory.
1023 if log::log_enabled!(log::Level::Trace) {
1024 for (_offset, range) in alloc_meta.alloc_ranges.borrow().iter(base_offset, size)
1027 "Updated atomic memory({:?}, size={}) to {:#?}",
1040 /// Extra metadata associated with a thread.
1041 #[derive(Debug, Clone, Default)]
1042 struct ThreadExtraState {
1043 /// The current vector index in use by the
1044 /// thread currently, this is set to None
1045 /// after the vector index has been re-used
1046 /// and hence the value will never need to be
1047 /// read during data-race reporting.
1048 vector_index: Option<VectorIdx>,
1050 /// The name of the thread, updated for better
1051 /// diagnostics when reporting detected data
1053 thread_name: Option<Box<str>>,
1055 /// Thread termination vector clock, this
1056 /// is set on thread termination and is used
1057 /// for joining on threads since the vector_index
1058 /// may be re-used when the join operation occurs.
1059 termination_vector_clock: Option<VClock>,
1062 /// Global data-race detection state, contains the currently
1063 /// executing thread as well as the vector-clocks associated
1064 /// with each of the threads.
1065 // FIXME: it is probably better to have one large RefCell, than to have so many small ones.
1066 #[derive(Debug, Clone)]
1067 pub struct GlobalState {
1068 /// Set to true once the first additional
1069 /// thread has launched, due to the dependency
1070 /// between before and after a thread launch.
1071 /// Any data-races must be recorded after this
1072 /// so concurrent execution can ignore recording
1074 multi_threaded: Cell<bool>,
1076 /// Mapping of a vector index to a known set of thread
1077 /// clocks, this is not directly mapping from a thread id
1078 /// since it may refer to multiple threads.
1079 vector_clocks: RefCell<IndexVec<VectorIdx, ThreadClockSet>>,
1081 /// Mapping of a given vector index to the current thread
1082 /// that the execution is representing, this may change
1083 /// if a vector index is re-assigned to a new thread.
1084 vector_info: RefCell<IndexVec<VectorIdx, ThreadId>>,
1086 /// The mapping of a given thread to associated thread metadata.
1087 thread_info: RefCell<IndexVec<ThreadId, ThreadExtraState>>,
1089 /// The current vector index being executed.
1090 current_index: Cell<VectorIdx>,
1092 /// Potential vector indices that could be re-used on thread creation
1093 /// values are inserted here on after the thread has terminated and
1094 /// been joined with, and hence may potentially become free
1095 /// for use as the index for a new thread.
1096 /// Elements in this set may still require the vector index to
1097 /// report data-races, and can only be re-used after all
1098 /// active vector-clocks catch up with the threads timestamp.
1099 reuse_candidates: RefCell<FxHashSet<VectorIdx>>,
1101 /// Counts the number of threads that are currently active
1102 /// if the number of active threads reduces to 1 and then
1103 /// a join operation occurs with the remaining main thread
1104 /// then multi-threaded execution may be disabled.
1105 active_thread_count: Cell<usize>,
1107 /// This contains threads that have terminated, but not yet joined
1108 /// and so cannot become re-use candidates until a join operation
1110 /// The associated vector index will be moved into re-use candidates
1111 /// after the join operation occurs.
1112 terminated_threads: RefCell<FxHashMap<ThreadId, VectorIdx>>,
1116 /// Create a new global state, setup with just thread-id=0
1117 /// advanced to timestamp = 1.
1118 pub fn new() -> Self {
1119 let mut global_state = GlobalState {
1120 multi_threaded: Cell::new(false),
1121 vector_clocks: RefCell::new(IndexVec::new()),
1122 vector_info: RefCell::new(IndexVec::new()),
1123 thread_info: RefCell::new(IndexVec::new()),
1124 current_index: Cell::new(VectorIdx::new(0)),
1125 active_thread_count: Cell::new(1),
1126 reuse_candidates: RefCell::new(FxHashSet::default()),
1127 terminated_threads: RefCell::new(FxHashMap::default()),
1130 // Setup the main-thread since it is not explicitly created:
1131 // uses vector index and thread-id 0, also the rust runtime gives
1132 // the main-thread a name of "main".
1133 let index = global_state.vector_clocks.get_mut().push(ThreadClockSet::default());
1134 global_state.vector_info.get_mut().push(ThreadId::new(0));
1135 global_state.thread_info.get_mut().push(ThreadExtraState {
1136 vector_index: Some(index),
1137 thread_name: Some("main".to_string().into_boxed_str()),
1138 termination_vector_clock: None,
1144 // Try to find vector index values that can potentially be re-used
1145 // by a new thread instead of a new vector index being created.
1146 fn find_vector_index_reuse_candidate(&self) -> Option<VectorIdx> {
1147 let mut reuse = self.reuse_candidates.borrow_mut();
1148 let vector_clocks = self.vector_clocks.borrow();
1149 let vector_info = self.vector_info.borrow();
1150 let terminated_threads = self.terminated_threads.borrow();
1151 for &candidate in reuse.iter() {
1152 let target_timestamp = vector_clocks[candidate].clock[candidate];
1153 if vector_clocks.iter_enumerated().all(|(clock_idx, clock)| {
1154 // The thread happens before the clock, and hence cannot report
1155 // a data-race with this the candidate index.
1156 let no_data_race = clock.clock[candidate] >= target_timestamp;
1158 // The vector represents a thread that has terminated and hence cannot
1159 // report a data-race with the candidate index.
1160 let thread_id = vector_info[clock_idx];
1161 let vector_terminated =
1162 reuse.contains(&clock_idx) || terminated_threads.contains_key(&thread_id);
1164 // The vector index cannot report a race with the candidate index
1165 // and hence allows the candidate index to be re-used.
1166 no_data_race || vector_terminated
1168 // All vector clocks for each vector index are equal to
1169 // the target timestamp, and the thread is known to have
1170 // terminated, therefore this vector clock index cannot
1171 // report any more data-races.
1172 assert!(reuse.remove(&candidate));
1173 return Some(candidate);
1179 // Hook for thread creation, enabled multi-threaded execution and marks
1180 // the current thread timestamp as happening-before the current thread.
1182 pub fn thread_created(&mut self, thread: ThreadId) {
1183 let current_index = self.current_index();
1185 // Increment the number of active threads.
1186 let active_threads = self.active_thread_count.get();
1187 self.active_thread_count.set(active_threads + 1);
1189 // Enable multi-threaded execution, there are now two threads
1190 // so data-races are now possible.
1191 self.multi_threaded.set(true);
1193 // Load and setup the associated thread metadata
1194 let mut thread_info = self.thread_info.borrow_mut();
1195 thread_info.ensure_contains_elem(thread, Default::default);
1197 // Assign a vector index for the thread, attempting to re-use an old
1198 // vector index that can no longer report any data-races if possible.
1199 let created_index = if let Some(reuse_index) = self.find_vector_index_reuse_candidate() {
1200 // Now re-configure the re-use candidate, increment the clock
1201 // for the new sync use of the vector.
1202 let vector_clocks = self.vector_clocks.get_mut();
1203 vector_clocks[reuse_index].increment_clock(reuse_index);
1205 // Locate the old thread the vector was associated with and update
1206 // it to represent the new thread instead.
1207 let vector_info = self.vector_info.get_mut();
1208 let old_thread = vector_info[reuse_index];
1209 vector_info[reuse_index] = thread;
1211 // Mark the thread the vector index was associated with as no longer
1212 // representing a thread index.
1213 thread_info[old_thread].vector_index = None;
1217 // No vector re-use candidates available, instead create
1218 // a new vector index.
1219 let vector_info = self.vector_info.get_mut();
1220 vector_info.push(thread)
1223 log::trace!("Creating thread = {:?} with vector index = {:?}", thread, created_index);
1225 // Mark the chosen vector index as in use by the thread.
1226 thread_info[thread].vector_index = Some(created_index);
1228 // Create a thread clock set if applicable.
1229 let vector_clocks = self.vector_clocks.get_mut();
1230 if created_index == vector_clocks.next_index() {
1231 vector_clocks.push(ThreadClockSet::default());
1234 // Now load the two clocks and configure the initial state.
1235 let (current, created) = vector_clocks.pick2_mut(current_index, created_index);
1237 // Join the created with current, since the current threads
1238 // previous actions happen-before the created thread.
1239 created.join_with(current);
1241 // Advance both threads after the synchronized operation.
1242 // Both operations are considered to have release semantics.
1243 current.increment_clock(current_index);
1244 created.increment_clock(created_index);
1247 /// Hook on a thread join to update the implicit happens-before relation
1248 /// between the joined thread and the current thread.
1250 pub fn thread_joined(&mut self, current_thread: ThreadId, join_thread: ThreadId) {
1251 let clocks_vec = self.vector_clocks.get_mut();
1252 let thread_info = self.thread_info.get_mut();
1254 // Load the vector clock of the current thread.
1255 let current_index = thread_info[current_thread]
1257 .expect("Performed thread join on thread with no assigned vector");
1258 let current = &mut clocks_vec[current_index];
1260 // Load the associated vector clock for the terminated thread.
1261 let join_clock = thread_info[join_thread]
1262 .termination_vector_clock
1264 .expect("Joined with thread but thread has not terminated");
1266 // The join thread happens-before the current thread
1267 // so update the current vector clock.
1268 // Is not a release operation so the clock is not incremented.
1269 current.clock.join(join_clock);
1271 // Check the number of active threads, if the value is 1
1272 // then test for potentially disabling multi-threaded execution.
1273 let active_threads = self.active_thread_count.get();
1274 if active_threads == 1 {
1275 // May potentially be able to disable multi-threaded execution.
1276 let current_clock = &clocks_vec[current_index];
1279 .all(|(idx, clocks)| clocks.clock[idx] <= current_clock.clock[idx])
1281 // All thread terminations happen-before the current clock
1282 // therefore no data-races can be reported until a new thread
1283 // is created, so disable multi-threaded execution.
1284 self.multi_threaded.set(false);
1288 // If the thread is marked as terminated but not joined
1289 // then move the thread to the re-use set.
1290 let termination = self.terminated_threads.get_mut();
1291 if let Some(index) = termination.remove(&join_thread) {
1292 let reuse = self.reuse_candidates.get_mut();
1293 reuse.insert(index);
1297 /// On thread termination, the vector-clock may re-used
1298 /// in the future once all remaining thread-clocks catch
1299 /// up with the time index of the terminated thread.
1300 /// This assigns thread termination with a unique index
1301 /// which will be used to join the thread
1302 /// This should be called strictly before any calls to
1303 /// `thread_joined`.
1305 pub fn thread_terminated(&mut self) {
1306 let current_index = self.current_index();
1308 // Increment the clock to a unique termination timestamp.
1309 let vector_clocks = self.vector_clocks.get_mut();
1310 let current_clocks = &mut vector_clocks[current_index];
1311 current_clocks.increment_clock(current_index);
1313 // Load the current thread id for the executing vector.
1314 let vector_info = self.vector_info.get_mut();
1315 let current_thread = vector_info[current_index];
1317 // Load the current thread metadata, and move to a terminated
1318 // vector state. Setting up the vector clock all join operations
1320 let thread_info = self.thread_info.get_mut();
1321 let current = &mut thread_info[current_thread];
1322 current.termination_vector_clock = Some(current_clocks.clock.clone());
1324 // Add this thread as a candidate for re-use after a thread join
1326 let termination = self.terminated_threads.get_mut();
1327 termination.insert(current_thread, current_index);
1329 // Reduce the number of active threads, now that a thread has
1331 let mut active_threads = self.active_thread_count.get();
1332 active_threads -= 1;
1333 self.active_thread_count.set(active_threads);
1336 /// Hook for updating the local tracker of the currently
1337 /// enabled thread, should always be updated whenever
1338 /// `active_thread` in thread.rs is updated.
1340 pub fn thread_set_active(&self, thread: ThreadId) {
1341 let thread_info = self.thread_info.borrow();
1342 let vector_idx = thread_info[thread]
1344 .expect("Setting thread active with no assigned vector");
1345 self.current_index.set(vector_idx);
1348 /// Hook for updating the local tracker of the threads name
1349 /// this should always mirror the local value in thread.rs
1350 /// the thread name is used for improved diagnostics
1351 /// during a data-race.
1353 pub fn thread_set_name(&mut self, thread: ThreadId, name: String) {
1354 let name = name.into_boxed_str();
1355 let thread_info = self.thread_info.get_mut();
1356 thread_info[thread].thread_name = Some(name);
1359 /// Attempt to perform a synchronized operation, this
1360 /// will perform no operation if multi-threading is
1361 /// not currently enabled.
1362 /// Otherwise it will increment the clock for the current
1363 /// vector before and after the operation for data-race
1364 /// detection between any happens-before edges the
1365 /// operation may create.
1366 fn maybe_perform_sync_operation<'tcx>(
1368 op: impl FnOnce(VectorIdx, RefMut<'_, ThreadClockSet>) -> InterpResult<'tcx, bool>,
1369 ) -> InterpResult<'tcx> {
1370 if self.multi_threaded.get() {
1371 let (index, clocks) = self.current_thread_state_mut();
1372 if op(index, clocks)? {
1373 let (_, mut clocks) = self.current_thread_state_mut();
1374 clocks.increment_clock(index);
1380 /// Internal utility to identify a thread stored internally
1381 /// returns the id and the name for better diagnostics.
1382 fn print_thread_metadata(&self, vector: VectorIdx) -> String {
1383 let thread = self.vector_info.borrow()[vector];
1384 let thread_name = &self.thread_info.borrow()[thread].thread_name;
1385 if let Some(name) = thread_name {
1386 let name: &str = name;
1387 format!("Thread(id = {:?}, name = {:?})", thread.to_u32(), &*name)
1389 format!("Thread(id = {:?})", thread.to_u32())
1393 /// Acquire a lock, express that the previous call of
1394 /// `validate_lock_release` must happen before this.
1395 /// As this is an acquire operation, the thread timestamp is not
1397 pub fn validate_lock_acquire(&self, lock: &VClock, thread: ThreadId) {
1398 let (_, mut clocks) = self.load_thread_state_mut(thread);
1399 clocks.clock.join(lock);
1402 /// Release a lock handle, express that this happens-before
1403 /// any subsequent calls to `validate_lock_acquire`.
1404 /// For normal locks this should be equivalent to `validate_lock_release_shared`
1405 /// since an acquire operation should have occurred before, however
1406 /// for futex & condvar operations this is not the case and this
1407 /// operation must be used.
1408 pub fn validate_lock_release(&self, lock: &mut VClock, thread: ThreadId) {
1409 let (index, mut clocks) = self.load_thread_state_mut(thread);
1410 lock.clone_from(&clocks.clock);
1411 clocks.increment_clock(index);
1414 /// Release a lock handle, express that this happens-before
1415 /// any subsequent calls to `validate_lock_acquire` as well
1416 /// as any previous calls to this function after any
1417 /// `validate_lock_release` calls.
1418 /// For normal locks this should be equivalent to `validate_lock_release`.
1419 /// This function only exists for joining over the set of concurrent readers
1420 /// in a read-write lock and should not be used for anything else.
1421 pub fn validate_lock_release_shared(&self, lock: &mut VClock, thread: ThreadId) {
1422 let (index, mut clocks) = self.load_thread_state_mut(thread);
1423 lock.join(&clocks.clock);
1424 clocks.increment_clock(index);
1427 /// Load the vector index used by the given thread as well as the set of vector clocks
1428 /// used by the thread.
1430 fn load_thread_state_mut(&self, thread: ThreadId) -> (VectorIdx, RefMut<'_, ThreadClockSet>) {
1431 let index = self.thread_info.borrow()[thread]
1433 .expect("Loading thread state for thread with no assigned vector");
1434 let ref_vector = self.vector_clocks.borrow_mut();
1435 let clocks = RefMut::map(ref_vector, |vec| &mut vec[index]);
1439 /// Load the current vector clock in use and the current set of thread clocks
1440 /// in use for the vector.
1442 fn current_thread_state(&self) -> (VectorIdx, Ref<'_, ThreadClockSet>) {
1443 let index = self.current_index();
1444 let ref_vector = self.vector_clocks.borrow();
1445 let clocks = Ref::map(ref_vector, |vec| &vec[index]);
1449 /// Load the current vector clock in use and the current set of thread clocks
1450 /// in use for the vector mutably for modification.
1452 fn current_thread_state_mut(&self) -> (VectorIdx, RefMut<'_, ThreadClockSet>) {
1453 let index = self.current_index();
1454 let ref_vector = self.vector_clocks.borrow_mut();
1455 let clocks = RefMut::map(ref_vector, |vec| &mut vec[index]);
1459 /// Return the current thread, should be the same
1460 /// as the data-race active thread.
1462 fn current_index(&self) -> VectorIdx {
1463 self.current_index.get()