1 #![feature(rustc_private)]
3 #![allow(clippy::cast_lossless)]
9 extern crate rustc_apfloat;
10 #[macro_use] extern crate rustc;
11 extern crate rustc_data_structures;
12 extern crate rustc_mir;
13 extern crate rustc_target;
26 use std::collections::HashMap;
28 use std::cell::RefCell;
31 use rand::rngs::StdRng;
32 use rand::SeedableRng;
34 use rustc::ty::{self, TyCtxt, query::TyCtxtAt};
35 use rustc::ty::layout::{LayoutOf, Size, Align};
36 use rustc::hir::def_id::DefId;
38 pub use rustc_mir::interpret::*;
40 pub use rustc_mir::interpret::{self, AllocMap, PlaceTy};
42 use syntax::source_map::DUMMY_SP;
43 use syntax::symbol::sym;
45 pub use crate::fn_call::EvalContextExt as MissingFnsEvalContextExt;
46 pub use crate::operator::EvalContextExt as OperatorEvalContextExt;
47 pub use crate::intrinsic::EvalContextExt as IntrinsicEvalContextExt;
48 pub use crate::tls::{EvalContextExt as TlsEvalContextExt, TlsData};
49 use crate::range_map::RangeMap;
50 #[allow(unused_imports)] // FIXME: rustc bug, issue <https://github.com/rust-lang/rust/issues/53682>.
51 pub use crate::helpers::{EvalContextExt as HelpersEvalContextExt};
52 use crate::mono_hash_map::MonoHashMap;
53 pub use crate::stacked_borrows::{EvalContextExt as StackedBorEvalContextExt};
54 use crate::memory::AllocExtra;
57 pub use crate::stacked_borrows::{Tag, Permission, Stack, Stacks, Item};
59 /// Insert rustc arguments at the beginning of the argument list that Miri wants to be
60 /// set per default, for maximal validation power.
61 pub fn miri_default_args() -> &'static [&'static str] {
62 // The flags here should be kept in sync with what bootstrap adds when `test-miri` is
63 // set, which happens in `bootstrap/bin/rustc.rs` in the rustc sources.
64 &["-Zalways-encode-mir", "-Zmir-emit-retag", "-Zmir-opt-level=0", "--cfg=miri"]
67 /// Configuration needed to spawn a Miri instance.
69 pub struct MiriConfig {
71 pub args: Vec<String>,
73 // The seed to use when non-determinism is required (e.g. getrandom())
78 pub fn create_ecx<'mir, 'tcx: 'mir>(
82 ) -> InterpResult<'tcx, InterpretCx<'mir, 'tcx, Evaluator<'tcx>>> {
83 let mut ecx = InterpretCx::new(
84 tcx.at(syntax::source_map::DUMMY_SP),
85 ty::ParamEnv::reveal_all(),
86 Evaluator::new(config.validate, config.seed),
89 let main_instance = ty::Instance::mono(ecx.tcx.tcx, main_id);
90 let main_mir = ecx.load_mir(main_instance.def)?;
92 if !main_mir.return_ty().is_unit() || main_mir.arg_count != 0 {
93 return err!(Unimplemented(
94 "miri does not support main functions without `fn()` type signatures"
99 let start_id = tcx.lang_items().start_fn().unwrap();
100 let main_ret_ty = tcx.fn_sig(main_id).output();
101 let main_ret_ty = main_ret_ty.no_bound_vars().unwrap();
102 let start_instance = ty::Instance::resolve(
104 ty::ParamEnv::reveal_all(),
107 ::std::iter::once(ty::subst::Kind::from(main_ret_ty)))
109 let start_mir = ecx.load_mir(start_instance.def)?;
111 if start_mir.arg_count != 3 {
112 return err!(AbiViolation(format!(
113 "'start' lang item should have three arguments, but has {}",
118 // Return value (in static memory so that it does not count as leak).
119 let ret = ecx.layout_of(start_mir.return_ty())?;
120 let ret_ptr = ecx.allocate(ret, MiriMemoryKind::Static.into());
122 // Push our stack frame.
123 ecx.push_stack_frame(
125 // There is no call site.
128 Some(ret_ptr.into()),
129 StackPopCleanup::None { cleanup: true },
132 let mut args = ecx.frame().body.args_iter();
134 // First argument: pointer to `main()`.
135 let main_ptr = ecx.memory_mut().create_fn_alloc(main_instance);
136 let dest = ecx.eval_place(&mir::Place::Base(mir::PlaceBase::Local(args.next().unwrap())))?;
137 ecx.write_scalar(Scalar::Ptr(main_ptr), dest)?;
139 // Second argument (argc): `1`.
140 let dest = ecx.eval_place(&mir::Place::Base(mir::PlaceBase::Local(args.next().unwrap())))?;
141 let argc = Scalar::from_uint(config.args.len() as u128, dest.layout.size);
142 ecx.write_scalar(argc, dest)?;
143 // Store argc for macOS's `_NSGetArgc`.
145 let argc_place = ecx.allocate(dest.layout, MiriMemoryKind::Env.into());
146 ecx.write_scalar(argc, argc_place.into())?;
147 ecx.machine.argc = Some(argc_place.ptr.to_ptr()?);
150 // FIXME: extract main source file path.
151 // Third argument (`argv`): created from `config.args`.
152 let dest = ecx.eval_place(&mir::Place::Base(mir::PlaceBase::Local(args.next().unwrap())))?;
153 // For Windows, construct a command string with all the aguments.
154 let mut cmd = String::new();
155 for arg in config.args.iter() {
159 cmd.push_str(&*shell_escape::windows::escape(arg.as_str().into()));
161 // Don't forget `0` terminator.
162 cmd.push(std::char::from_u32(0).unwrap());
163 // Collect the pointers to the individual strings.
164 let mut argvs = Vec::<Pointer<Tag>>::new();
165 for arg in config.args {
166 // Add `0` terminator.
167 let mut arg = arg.into_bytes();
169 argvs.push(ecx.memory_mut().allocate_static_bytes(arg.as_slice(), MiriMemoryKind::Static.into()));
171 // Make an array with all these pointers, in the Miri memory.
172 let argvs_layout = ecx.layout_of(ecx.tcx.mk_array(ecx.tcx.mk_imm_ptr(ecx.tcx.types.u8), argvs.len() as u64))?;
173 let argvs_place = ecx.allocate(argvs_layout, MiriMemoryKind::Env.into());
174 for (idx, arg) in argvs.into_iter().enumerate() {
175 let place = ecx.mplace_field(argvs_place, idx as u64)?;
176 ecx.write_scalar(Scalar::Ptr(arg), place.into())?;
178 ecx.memory_mut().mark_immutable(argvs_place.to_ptr()?.alloc_id)?;
179 // Write a pointer to that place as the argument.
180 let argv = argvs_place.ptr;
181 ecx.write_scalar(argv, dest)?;
182 // Store `argv` for macOS `_NSGetArgv`.
184 let argv_place = ecx.allocate(dest.layout, MiriMemoryKind::Env.into());
185 ecx.write_scalar(argv, argv_place.into())?;
186 ecx.machine.argv = Some(argv_place.ptr.to_ptr()?);
188 // Store command line as UTF-16 for Windows `GetCommandLineW`.
190 let tcx = &{ecx.tcx.tcx};
191 let cmd_utf16: Vec<u16> = cmd.encode_utf16().collect();
192 let cmd_ptr = ecx.memory_mut().allocate(
193 Size::from_bytes(cmd_utf16.len() as u64 * 2),
194 Align::from_bytes(2).unwrap(),
195 MiriMemoryKind::Env.into(),
197 ecx.machine.cmd_line = Some(cmd_ptr);
198 // Store the UTF-16 string.
199 let char_size = Size::from_bytes(2);
200 let cmd_alloc = ecx.memory_mut().get_mut(cmd_ptr.alloc_id)?;
201 let mut cur_ptr = cmd_ptr;
202 for &c in cmd_utf16.iter() {
203 cmd_alloc.write_scalar(
206 Scalar::from_uint(c, char_size).into(),
209 cur_ptr = cur_ptr.offset(char_size, tcx)?;
213 ecx.memory_mut().extra.seed = config.seed.clone();
215 assert!(args.next().is_none(), "start lang item has more arguments than expected");
220 pub fn eval_main<'tcx>(
225 let mut ecx = match create_ecx(tcx, main_id, config) {
228 err.print_backtrace();
229 panic!("Miri initialziation error: {}", err.kind)
233 // Perform the main execution.
234 let res: InterpResult = (|| {
239 // Process the result.
242 let leaks = ecx.memory().leak_report();
243 // Disable the leak test on some platforms where we do not
244 // correctly implement TLS destructors.
245 let target_os = ecx.tcx.tcx.sess.target.target.target_os.to_lowercase();
246 let ignore_leaks = target_os == "windows" || target_os == "macos";
247 if !ignore_leaks && leaks != 0 {
248 tcx.sess.err("the evaluated program leaked memory");
252 // Special treatment for some error kinds
253 let msg = match e.kind {
254 InterpError::Exit(code) => std::process::exit(code),
255 InterpError::NoMirFor(..) =>
256 format!("{}. Did you set `MIRI_SYSROOT` to a Miri-enabled sysroot? You can prepare one with `cargo miri setup`.", e),
260 if let Some(frame) = ecx.stack().last() {
261 let block = &frame.body.basic_blocks()[frame.block];
262 let span = if frame.stmt < block.statements.len() {
263 block.statements[frame.stmt].source_info.span
265 block.terminator().source_info.span
268 let msg = format!("Miri evaluation error: {}", msg);
269 let mut err = struct_error(ecx.tcx.tcx.at(span), msg.as_str());
270 let frames = ecx.generate_stacktrace(None);
271 err.span_label(span, msg);
272 // We iterate with indices because we need to look at the next frame (the caller).
273 for idx in 0..frames.len() {
274 let frame_info = &frames[idx];
275 let call_site_is_local = frames.get(idx+1).map_or(false,
276 |caller_info| caller_info.instance.def_id().is_local());
277 if call_site_is_local {
278 err.span_note(frame_info.call_site, &frame_info.to_string());
280 err.note(&frame_info.to_string());
285 ecx.tcx.sess.err(&msg);
288 for (i, frame) in ecx.stack().iter().enumerate() {
289 trace!("-------------------");
290 trace!("Frame {}", i);
291 trace!(" return: {:?}", frame.return_place.map(|p| *p));
292 for (i, local) in frame.locals.iter().enumerate() {
293 trace!(" local {}: {:?}", i, local.value);
300 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
301 pub enum MiriMemoryKind {
302 /// `__rust_alloc` memory.
306 /// Part of env var emulation.
312 impl Into<MemoryKind<MiriMemoryKind>> for MiriMemoryKind {
314 fn into(self) -> MemoryKind<MiriMemoryKind> {
315 MemoryKind::Machine(self)
319 impl MayLeak for MiriMemoryKind {
321 fn may_leak(self) -> bool {
322 use self::MiriMemoryKind::*;
325 Env | Static => true,
330 pub struct Evaluator<'tcx> {
331 /// Environment variables set by `setenv`.
332 /// Miri does not expose env vars from the host to the emulated program.
333 pub(crate) env_vars: HashMap<Vec<u8>, Pointer<Tag>>,
335 /// Program arguments (`Option` because we can only initialize them after creating the ecx).
336 /// These are *pointers* to argc/argv because macOS.
337 /// We also need the full command line as one string because of Windows.
338 pub(crate) argc: Option<Pointer<Tag>>,
339 pub(crate) argv: Option<Pointer<Tag>>,
340 pub(crate) cmd_line: Option<Pointer<Tag>>,
343 pub(crate) last_error: u32,
346 pub(crate) tls: TlsData<'tcx>,
348 /// Whether to enforce the validity invariant.
349 pub(crate) validate: bool,
351 /// The random number generator to use if Miri
352 /// is running in non-deterministic mode
353 pub(crate) rng: Option<StdRng>
356 impl<'tcx> Evaluator<'tcx> {
357 fn new(validate: bool, seed: Option<u64>) -> Self {
359 env_vars: HashMap::default(),
364 tls: TlsData::default(),
366 rng: seed.map(|s| StdRng::seed_from_u64(s))
371 // FIXME: rustc issue <https://github.com/rust-lang/rust/issues/47131>.
373 type MiriEvalContext<'mir, 'tcx> = InterpretCx<'mir, 'tcx, Evaluator<'tcx>>;
375 // A little trait that's useful to be inherited by extension traits.
376 pub trait MiriEvalContextExt<'mir, 'tcx> {
377 fn eval_context_ref(&self) -> &MiriEvalContext<'mir, 'tcx>;
378 fn eval_context_mut(&mut self) -> &mut MiriEvalContext<'mir, 'tcx>;
380 impl<'mir, 'tcx> MiriEvalContextExt<'mir, 'tcx> for MiriEvalContext<'mir, 'tcx> {
382 fn eval_context_ref(&self) -> &MiriEvalContext<'mir, 'tcx> {
386 fn eval_context_mut(&mut self) -> &mut MiriEvalContext<'mir, 'tcx> {
391 impl<'mir, 'tcx> Machine<'mir, 'tcx> for Evaluator<'tcx> {
392 type MemoryKinds = MiriMemoryKind;
394 type FrameExtra = stacked_borrows::CallId;
395 type MemoryExtra = memory::MemoryState;
396 type AllocExtra = memory::AllocExtra;
397 type PointerTag = Tag;
399 type MemoryMap = MonoHashMap<AllocId, (MemoryKind<MiriMemoryKind>, Allocation<Tag, Self::AllocExtra>)>;
401 const STATIC_KIND: Option<MiriMemoryKind> = Some(MiriMemoryKind::Static);
404 fn enforce_validity(ecx: &InterpretCx<'mir, 'tcx, Self>) -> bool {
408 /// Returns `Ok()` when the function was handled; fail otherwise.
411 ecx: &mut InterpretCx<'mir, 'tcx, Self>,
412 instance: ty::Instance<'tcx>,
413 args: &[OpTy<'tcx, Tag>],
414 dest: Option<PlaceTy<'tcx, Tag>>,
415 ret: Option<mir::BasicBlock>,
416 ) -> InterpResult<'tcx, Option<&'mir mir::Body<'tcx>>> {
417 ecx.find_fn(instance, args, dest, ret)
422 ecx: &mut rustc_mir::interpret::InterpretCx<'mir, 'tcx, Self>,
423 instance: ty::Instance<'tcx>,
424 args: &[OpTy<'tcx, Tag>],
425 dest: PlaceTy<'tcx, Tag>,
426 ) -> InterpResult<'tcx> {
427 ecx.call_intrinsic(instance, args, dest)
432 ecx: &rustc_mir::interpret::InterpretCx<'mir, 'tcx, Self>,
434 left: ImmTy<'tcx, Tag>,
435 right: ImmTy<'tcx, Tag>,
436 ) -> InterpResult<'tcx, (Scalar<Tag>, bool)> {
437 ecx.ptr_op(bin_op, left, right)
441 ecx: &mut InterpretCx<'mir, 'tcx, Self>,
442 dest: PlaceTy<'tcx, Tag>,
443 ) -> InterpResult<'tcx> {
444 trace!("box_alloc for {:?}", dest.layout.ty);
445 // Call the `exchange_malloc` lang item.
446 let malloc = ecx.tcx.lang_items().exchange_malloc_fn().unwrap();
447 let malloc = ty::Instance::mono(ecx.tcx.tcx, malloc);
448 let malloc_mir = ecx.load_mir(malloc.def)?;
449 ecx.push_stack_frame(
454 // Don't do anything when we are done. The `statement()` function will increment
455 // the old stack frame's stmt counter to the next statement, which means that when
456 // `exchange_malloc` returns, we go on evaluating exactly where we want to be.
457 StackPopCleanup::None { cleanup: true },
460 let mut args = ecx.frame().body.args_iter();
461 let layout = ecx.layout_of(dest.layout.ty.builtin_deref(false).unwrap().ty)?;
463 // First argument: `size`.
464 // (`0` is allowed here -- this is expected to be handled by the lang item).
465 let arg = ecx.eval_place(&mir::Place::Base(mir::PlaceBase::Local(args.next().unwrap())))?;
466 let size = layout.size.bytes();
467 ecx.write_scalar(Scalar::from_uint(size, arg.layout.size), arg)?;
469 // Second argument: `align`.
470 let arg = ecx.eval_place(&mir::Place::Base(mir::PlaceBase::Local(args.next().unwrap())))?;
471 let align = layout.align.abi.bytes();
472 ecx.write_scalar(Scalar::from_uint(align, arg.layout.size), arg)?;
474 // No more arguments.
476 args.next().is_none(),
477 "`exchange_malloc` lang item has more arguments than expected"
482 fn find_foreign_static(
485 ) -> InterpResult<'tcx, Cow<'tcx, Allocation>> {
486 let attrs = tcx.get_attrs(def_id);
487 let link_name = match attr::first_attr_value_str_by_name(&attrs, sym::link_name) {
488 Some(name) => name.as_str(),
489 None => tcx.item_name(def_id).as_str(),
492 let alloc = match link_name.get() {
493 "__cxa_thread_atexit_impl" => {
494 // This should be all-zero, pointer-sized.
495 let size = tcx.data_layout.pointer_size;
496 let data = vec![0; size.bytes() as usize];
497 Allocation::from_bytes(&data, tcx.data_layout.pointer_align.abi)
499 _ => return err!(Unimplemented(
500 format!("can't access foreign static: {}", link_name),
503 Ok(Cow::Owned(alloc))
507 fn before_terminator(_ecx: &mut InterpretCx<'mir, 'tcx, Self>) -> InterpResult<'tcx>
509 // We are not interested in detecting loops.
513 fn tag_allocation<'b>(
515 alloc: Cow<'b, Allocation>,
516 kind: Option<MemoryKind<Self::MemoryKinds>>,
517 memory: &Memory<'mir, 'tcx, Self>,
518 ) -> (Cow<'b, Allocation<Self::PointerTag, Self::AllocExtra>>, Self::PointerTag) {
519 let kind = kind.expect("we set our STATIC_KIND so this cannot be None");
520 let alloc = alloc.into_owned();
521 let (extra, base_tag) = Stacks::new_allocation(
523 Size::from_bytes(alloc.bytes.len() as u64),
524 Rc::clone(&memory.extra.stacked),
527 if kind != MiriMemoryKind::Static.into() {
528 assert!(alloc.relocations.is_empty(), "Only statics can come initialized with inner pointers");
529 // Now we can rely on the inner pointers being static, too.
531 let mut memory_extra = memory.extra.stacked.borrow_mut();
532 let alloc: Allocation<Tag, Self::AllocExtra> = Allocation {
534 relocations: Relocations::from_presorted(
535 alloc.relocations.iter()
536 // The allocations in the relocations (pointers stored *inside* this allocation)
537 // all get the base pointer tag.
538 .map(|&(offset, ((), alloc))| (offset, (memory_extra.static_base_ptr(alloc), alloc)))
541 undef_mask: alloc.undef_mask,
543 mutability: alloc.mutability,
546 base_addr: RefCell::new(None),
549 (Cow::Owned(alloc), base_tag)
553 fn tag_static_base_pointer(
555 memory: &Memory<'mir, 'tcx, Self>,
556 ) -> Self::PointerTag {
557 memory.extra.stacked.borrow_mut().static_base_ptr(id)
562 ecx: &mut InterpretCx<'mir, 'tcx, Self>,
563 kind: mir::RetagKind,
564 place: PlaceTy<'tcx, Tag>,
565 ) -> InterpResult<'tcx> {
566 if !ecx.tcx.sess.opts.debugging_opts.mir_emit_retag || !Self::enforce_validity(ecx) {
567 // No tracking, or no retagging. The latter is possible because a dependency of ours
568 // might be called with different flags than we are, so there are `Retag`
569 // statements but we do not want to execute them.
570 // Also, honor the whitelist in `enforce_validity` because otherwise we might retag
571 // uninitialized data.
574 ecx.retag(kind, place)
580 ecx: &mut InterpretCx<'mir, 'tcx, Self>,
581 ) -> InterpResult<'tcx, stacked_borrows::CallId> {
582 Ok(ecx.memory().extra.stacked.borrow_mut().new_call())
587 ecx: &mut InterpretCx<'mir, 'tcx, Self>,
588 extra: stacked_borrows::CallId,
589 ) -> InterpResult<'tcx> {
590 Ok(ecx.memory().extra.stacked.borrow_mut().end_call(extra))
595 memory: &Memory<'mir, 'tcx, Self>,
596 ) -> InterpResult<'tcx, Pointer<Self::PointerTag>> {
598 return err!(InvalidNullPointerUsage);
601 if memory.extra.seed.is_none() {
602 return err!(ReadBytesAsPointer);
605 let extra = memory.extra.intptrcast.borrow();
607 match extra.vec.binary_search_by_key(&int, |(int, _)| *int) {
609 let (_, alloc_id) = extra.vec[pos];
610 Ok(Pointer::new_with_tag(alloc_id, Size::from_bytes(0), Tag::Untagged))
614 let (glb, alloc_id) = extra.vec[pos - 1];
615 let offset = int - glb;
616 if offset <= memory.get(alloc_id)?.bytes.len() as u64 {
617 Ok(Pointer::new_with_tag(alloc_id, Size::from_bytes(offset), Tag::Untagged))
619 return err!(DanglingPointerDeref);
622 return err!(DanglingPointerDeref);
629 ptr: Pointer<Self::PointerTag>,
630 memory: &Memory<'mir, 'tcx, Self>,
631 ) -> InterpResult<'tcx, u64> {
632 if memory.extra.seed.is_none() {
633 return err!(ReadPointerAsBytes);
636 let mut extra = memory.extra.intptrcast.borrow_mut();
638 let alloc = memory.get(ptr.alloc_id)?;
640 let base_addr = match alloc.extra.base_addr.borrow().clone() {
641 Some(base_addr) => base_addr,
643 let base_addr = extra.addr;
644 extra.addr += alloc.bytes.len() as u64;
646 *alloc.extra.base_addr.borrow_mut() = Some(base_addr);
648 let elem = (base_addr, ptr.alloc_id);
650 if let Err(pos) = extra.vec.binary_search(&elem) {
651 extra.vec.insert(pos, elem);
653 return err!(Unreachable);
660 Ok(base_addr + ptr.offset.bytes())