Skip to content

native-lib/trace: Intercept allocating calls, but do nothing #4792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nia-e wants to merge 2 commits into
base: master
Choose a base branch
from
+544 −95
Open

native-lib/trace: Intercept allocating calls, but do nothing #4792

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
066aa78
native-lib/trace: Intercept allocating calls, but do nothing
nia-e Dec 27, 2025
966775e
native-lib/trace: Handle accesses during libc fn calls also
nia-e Dec 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
156 changes: 155 additions & 1 deletion Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ serde = { version = "1.0.219", features = ["derive"], optional = true }
nix = { version = "0.30.1", features = ["mman", "ptrace", "signal"], optional = true }
ipc-channel = { version = "0.20.0", optional = true }
capstone = { version = "0.13", optional = true }
proc-maps = { version = "0.4.0", optional = true }
Copy link
Copy Markdown
Member

@RalfJung RalfJung Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a huge pile of new dependencies. :/ and some duplicated ones, like libloading.

How long does this build script take? We just managed to finally get rid of the capstone overhead for check builds, I don't want to add back any new slow build scripts.

Copy link
Copy Markdown
Member Author

@nia-e nia-e Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it? It seems like the only dependency on linux is libc: https://github.com/rbspy/proc-maps/blob/master/Cargo.toml

Copy link
Copy Markdown
Member

@RalfJung RalfJung Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The lockfile has a load of new stuff in it -- that has to come from somewhere?


[target.'cfg(all(target_os = "linux", target_pointer_width = "64", target_endian = "little"))'.dependencies]
genmc-sys = { path = "./genmc-sys/", version = "0.1.0", optional = true }
Expand All @@ -66,8 +67,8 @@ genmc = ["dep:genmc-sys"]
stack-cache = []
expensive-consistency-checks = ["stack-cache"]
tracing = ["serde_json"]
native-lib = ["dep:libffi", "dep:libloading", "dep:capstone", "dep:ipc-channel", "dep:nix", "dep:serde"]
jemalloc = []
native-lib = ["dep:libffi", "dep:libloading", "dep:capstone", "dep:ipc-channel", "dep:nix", "dep:serde", "dep:proc-maps"]

[lints.rust.unexpected_cfgs]
level = "warn"
Expand Down
35 changes: 22 additions & 13 deletions src/shims/native_lib/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ mod ffi;
pub mod trace;

use self::ffi::OwnedArg;
use self::trace::EvalContextExt as _;
use crate::*;

/// The final results of an FFI trace, containing every relevant event detected
Expand Down Expand Up @@ -85,13 +86,9 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
libffi_args: &mut [OwnedArg],
) -> InterpResult<'tcx, (crate::ImmTy<'tcx>, Option<MemEvents>)> {
let this = self.eval_context_mut();
#[cfg(target_os = "linux")]
let alloc = this.machine.allocator.as_ref().unwrap();
#[cfg(not(target_os = "linux"))]
// Placeholder value.
let alloc = ();

trace::Supervisor::do_ffi(alloc, || {
let ty_is_sized = dest.layout.ty.is_sized(*this.tcx, this.typing_env());
Copy link
Copy Markdown
Member

@RalfJung RalfJung Jan 22, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not support unsized return types for FFI calls.^^ So what is this about?

EDIT: Ah, it is factoring out the RawPtr check below -- but this is incorrect, it checks sizedness of the wrong thing. Anyway this logic looks quite different on master so hopefully a rebase will make this all go away.

this.do_ffi(|| {
// Call the function (`ptr`) with arguments `libffi_args`, and obtain the return value
// as the specified primitive integer type
let scalar = match dest.layout.ty.kind() {
Expand All @@ -117,7 +114,12 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
}
ty::Int(IntTy::Isize) => {
let x = unsafe { ffi::call::<isize>(fun, libffi_args) };
Scalar::from_target_isize(x.try_into().unwrap(), this)
// We already know native-lib mode means target == host, so
// this is ok.
Scalar::from_int(
i128::try_from(x).unwrap(),
Size::from_bytes(size_of::<isize>()),
)
}
// uints
ty::Uint(UintTy::U8) => {
Expand All @@ -138,7 +140,10 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
}
ty::Uint(UintTy::Usize) => {
let x = unsafe { ffi::call::<usize>(fun, libffi_args) };
Scalar::from_target_usize(x.try_into().unwrap(), this)
Scalar::from_uint(
u128::try_from(x).unwrap(),
Size::from_bytes(size_of::<usize>()),
)
}
ty::Float(FloatTy::F32) => {
let x = unsafe { ffi::call::<f32>(fun, libffi_args) };
Expand All @@ -154,10 +159,10 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
unsafe { ffi::call::<()>(fun, libffi_args) };
return interp_ok(ImmTy::uninit(dest.layout));
}
ty::RawPtr(ty, ..) if ty.is_sized(*this.tcx, this.typing_env()) => {
ty::RawPtr(ty, ..) if ty_is_sized => {
Copy link
Copy Markdown
Member

@RalfJung RalfJung Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This changes what is being checked. Previously it checked whether the pointee is sized, now you are checking of the pointer is sized (which obviously it always is).

let x = unsafe { ffi::call::<*const ()>(fun, libffi_args) };
let ptr = StrictPointer::new(Provenance::Wildcard, Size::from_bytes(x.addr()));
Scalar::from_pointer(ptr, this)
Scalar::Ptr(ptr, u8::try_from(size_of::<*const ()>()).unwrap())
}
_ =>
return Err(err_unsup_format!(
Expand Down Expand Up @@ -225,7 +230,6 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
/// assumed to be exact.
fn tracing_apply_accesses(&mut self, events: MemEvents) -> InterpResult<'tcx> {
let this = self.eval_context_mut();

for evt in events.acc_events {
let evt_rg = evt.get_range();
// LLVM at least permits vectorising accesses to adjacent allocations,
Expand All @@ -235,7 +239,11 @@ trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
let Some(alloc_id) =
this.alloc_id_from_addr(curr.to_u64(), rg.len().try_into().unwrap())
else {
throw_ub_format!("Foreign code did an out-of-bounds access!")
throw_ub_format!(
"Foreign code did an out-of-bounds access at {:#0x} for {:#0x} bytes!",
curr,
rg.len(),
);
};
let alloc = this.get_alloc_raw(alloc_id)?;
// The logical and physical address of the allocation coincide, so we can use
Expand Down Expand Up @@ -526,7 +534,8 @@ pub trait EvalContextExt<'tcx>: crate::MiriInterpCxExt<'tcx> {
this.call_native_with_args(link_name, dest, code_ptr, &mut libffi_args)?;

if tracing {
this.tracing_apply_accesses(maybe_memevents.unwrap())?;
let mm = maybe_memevents.unwrap();
Copy link
Copy Markdown
Member

@RalfJung RalfJung Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's mm for? After unwrapping they are not "maybe" any more.

this.tracing_apply_accesses(mm)?;
}

this.write_immediate(*ret, dest)?;
Expand Down
Loading
Loading