miri

If you found this interesting, you may also be interested to hear about some related projects with similar goals/scopes: Miri[0], Kani[1], and Creusot[2]. There looks to be some significant overlap between Verus, Kani, and Creusot but I've not used any of them so I'll refrain from trying to differentiate them. [0]https://github.com/rust-lang/miri [1]https://github.com/model-checking/kani [2]https://github.com/creusot-rs/creusot

For comparison, in Rust they track down the differences in which flags are ignored in a certain kind of `fcntl` syscall across all the architectures that have this C function, which includes Solaris, Mac OS, the BSDs, Linux, ... This is so that this is correctly handled in Miri, which can then be used to run the test-suite of the OS-specific parts of the standard library, and observe if this uses unsupported features in some way. This ensures that the standard library relies on documented features and not on whatever happens to work right now. See for example this PR comment: https://github.com/rust-lang/miri/pull/4840#discussion_r2836...

> but its code has lots of unsafe. And every instance of unsafe that I could find (except one, in test-only code) was a call to libc with a clarifying comment on why this particular use was safe. That is, all (or at least, all of it that I could find) was wrapping an unsafe API with documented (and usually straightforward and local) invariants that maintain safety, such that the calling code is safe. I'd say that the fact that miri's trophy-shelf[0] has 39 entries and is 7 years old and still regularly updated is a pretty good indicator that memory bugs are sufficiently rare in rust so as to be notable. That is the opposite of "regular" [0]: https://github.com/rust-lang/miri/blame/master/README.md

Coherence in Rust implementation interpreter where C++ designates Store_elem as integration testing in ecosystem. > https://github.com/rust-lang/miri

If you have a codebase that uses unsafe, I highly recommend running your tests through Miri (cargo miri nextest) and seeing what spills out. I ran tests for a codebase at work through Miri a while ago and found a couple of distinct classes of UB: https://github.com/rust-lang/miri/issues/1807#issuecomment-8... These can be summarized as: 1. Converting a reference to the first field of a struct to a pointer of its parents struct type 2. Functions with signature (&self) -> &mut self_inner_field_type 3. Having a mut pointer to the data inside of a Box<T> #1 and #3 were somewhat surprising to me. #2 seems to be common enough that there's even a clippy lint for it. A lot of C and C++ developers understand that undefined behavior is bad, but in practice observe its impact less. From my own experience, Rust's optimizations are pretty aggressive a

Why would Rust need formal verification tools like https://github.com/rust-lang/miri if the programming language is so safe that it prevents them[1]?! [1] Undefined Behaviors.

It does have an interpreter for the full language, that's what Miri uses [0]. In fact, Miri doesn't even have its own evaluator, it just adds additional features to the rustc const-evaluation. The big limitations are that it doesn't have much support for syscalls or other calls into non-Rust code, and it emulates all multithreaded code on a single thread. [0] https://github.com/rust-lang/miri

Here's the implementation in Miri for those interested: https://github.com/rust-lang/miri/tree/master/src/borrow_tra...

> C debuggers and tooling are vastly more powerful than Rust's static type system, and catch a much wider array of memory problems (, and bugs) than the Rust compiler can catch. Static verification is far more limited than the dynamic verification a sophisticated debugger can perform. Is there any dynamic verifier that fully validates all acesses w.r.t. the object trees specified by the C standard? Tools like ASan and UBSan won't detect a write to one field running into another field, only a write overrunning the complete object. (Compiler-level hardening might catch that to some extent, but it's limited to TU boundaries.) Not to mention things like 'misuse of restrict pointers' that I've never seen any verifiers for, except for special cases like overlapping memcpy() buffers. Meanwhile, Rust does have its own dynamic verifier, called Mir

Miri is a Rust tool with a similar function to Valgrind, it checks for undefined behavior. https://github.com/rust-lang/miri

The comparison isn't with rust today, but the long term differences between the languages. Rust has a straightforward path to rectifying the standardization issue and enough community momentum to succeed. For example, Rust has an in-progress specification, here's the (currently empty) repo: https://github.com/rust-lang/spec. There's also MIR, a de-sugared internal representation that's sufficiently well specified to build formal models of (see https://github.com/rust-lang/a-mir-formality and https://github.com/rust-lang/miri), as well as the ferrocene spec (https://spec.ferrocene.dev/general.html) that's suitable for certification authorities (if not actually useful) and of course the rust reference/RFCs that are actually usable by people. Plus, the fact that everyone in the rust community has standardized on one compiler and one package

The one link for those who think that 'Rewrite it All in Rust' will, well, settle any debates: https://github.com/rust-lang/miri/

>While we are many missing language features away from this being the case, the noalias case is also magic descended upon box itself, with no user code ever having access to it. I'm not sure why the author thinks there's magic behind Box. Box is not a special case of `noalias`. Run this snippet with miri and you'll see the same issue: https://play.rust-lang.org/?version=stable&mode=debug&editio... You don't see an assertion failure though because... dun dun dun it's UB. `Box<T>` _does_ have an expectation that its inner pointer is not aliased to another Box (even if used for readonly operations). See: https://github.com/rust-lang/miri/issues/1800#issuecomment-8...)

Miri [0] is an interpreter for the mid-level intermediate representation (MIR) generated by the Rust compiler. MIR is input for more processing steps of the compiler. However miri also runs MIR directly. This means miri is a VM. Of course it's not a bytecode VM, because MIR is not a bytecode AFAIK. I still think that miri is a interesting example. And why does miri exist? It is a lot slower. However it can check for some undefined behavior. [0]: https://github.com/rust-lang/miri