Rust Programming Language RustFest Global 2020, 23 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Christian Poveda - Miri, Undefined Behavior and Foreign Functions — RustFest Global 2020

Description

Do you want to write unsafe Rust but don't know how to check its soundness? Do you suspect that your program has Undefined Behavior but you have no way to test it? Are you looking for a cool Rust-related project to contribute to? Then this talk is for you.

More at https://rustfest.global/session/12-miri,-undefined-behavior-and-foreign-functions/

A

Miri is rust's interpreter and christian will gladly debate her on how to bequeath her the stuff underneath, so she can run until much later.

B

Okay, thank you. So this stock install is called very undefined behavior and for rank functions so, but before even we begin, let me just introduce me at a bit myself, so I'm christian poeda, I'm colombian. uh As you already know, I'm a phd student at the india software institute. Occasionally I contribute to the ros compiler project and also to the mirror project.

B

I don't work on it like full time. I just do it like when I have free time.

B

So, first of all, I want to say what I want to give this like what I think this is important. Somehow the first thing is that unsave is a controversial topic in our community, but at the same time is something that we need is something super special that ross needs to work and to be able to do the awesome stuff. That already does so.

B

Basically, every program you have uses unsafe in one way or another, even if you don't know it, and it's very important to have awareness of the implications of what happens when you use aeon saving correctly or if someone else does and also I want to show you a super cool tool that you can use to write better and safe code.

B

That helps you when you're unsafe code is wrong, because this goes in the same direction as the empowering philosophy that the risk community has of being able to use to build reliable software and, at the same time, having a super friendly community with a bunch of tools that help you to build that. So it was in that direction.

B

uh This talk will have like four parts. Basically, first, I'm going to show you a bit: uh do a little introduction to unsafe and what's undefined behavior and how that everything works in rust, then we're going to talk about miri miri. Is this super cool tool uh I'm talking about and then we're going to talk a bit uh about following functions?

B

And if you like this, you think this is interesting for you. I can give you some ideas at the end on how can you help contributing in all of this?

B

So, let's begin by talking about unsafe, rust and undefined behavior um before even talking about undefined behavior, I think super important to know or to discuss why people use unsafe, unsafe rust in the first place.

B

There are two main reasons. The first one is that some people using safe because they are very invested in performance. They want their programs to run super fast, so they are ensuring everyone that their programs are running correctly. Even if that program, those programs don't have any check to to be sure that they're running correctly and not doing a lot of checks uh lets you squeeze a little bit more of performance when you're running when you're writing your programs- and there is a lot of controversy around this one.

B

Some people say that yeah performance matters, but safety is first. There are a lot of trade-offs. You can do there, but the second reason is a little bit more less controversial in the sense that many projects we have invest need to interact with other languages or with your operating system or with a bunch of resources that haven't written it themselves in rust.

B

So most likely you will have to interact with a c or c plus library or use a crate that interacts with a c or c plus plus library and those languages doesn't have like the same guarantees that has about safety and having sound programs and so on. So all those functions that interact with c libraries are unsafe, too.

B

So now we can discuss what onsafe can do so inside unsafe functions or on safe blocks. Any of the two. There is not much you can do. Actually you can do only five things, not anymore.

B

You can dereference raw pointers. You can call functions that are marked as unsafe. So if you have a function that is called unsafe, fn and the name of the function, you need to use unsafe to call it, you have to use, do it in an unsafe block or in another safe function.

B

There are some traits that are marked as unsafe too. So if you want to implement those traits like send and sync from the standard library you have to use in safe, if you want to mutate the statics, because you're sure that the program needs some sort of mutable global global state, even if some people don't like it, you can easily save to do that. You can use a unsafe to access fields of unions. Unions are like enumerations, but they don't have like this consistent tag to distinguish each variant.

B

So it's like you can literally join two types of the uh in a single one and use every value of that type as any of the possible variants of the at the same time. So you need to unsafe to access the fields.

B

However, for the purposes of this, we're just going to focus on the first two, because those are like the more common uh most likely. Any of us has been exposed to one of these at what at one point.

B

And, given that the first one is the referencing row pointers, uh I think it's worth to discuss for pointers for a moment.

B

So what are raw pointers? uh Many of you, uh if you have already using use rust, you know that we have references, we have ampersand mute and our prints are ampersand for mutable and immutable references. But those types have like these: two brothers or sisters, siblings. Whatever uh there are called raw pointers, we have star const and star moot story. Cons is an immutable draw, pointer and stormwood is a mutable row pointer and they exist because they don't follow the same rules as references. They don't have these liveness constraints.

B

For example, if you have some data and you create a pointer to it and you drop the data it goes out of the scope is deleted. You can still have the raw pointer to it, even though it's pointing to something that doesn't even exist anymore.

B

So, for these reasons there is something else, and you can also like offset those pointers using integers. So if you have a pointer to a particular remember particular memory address, you can add it like an integer and you size to it and you can offset it. So you can read like another part of the memory and maybe you're not supposed to for those two reasons. Those pointers might have a lot of problems and might misbehave.

B

In several reasons, you can have no pointers that are real pointers that don't point doesn't point to anything really uh they can be dangling. There are pointers that, let's say, are pointing to something that doesn't belong to us. So if you are inside a vector- and you saw a pointer from inside the vector to access something outside the vector- that's an angling pointer.

B

Also, if you have a pointer that you offset it a bit, but you didn't do it correctly. So, for example, you have a pointer between, I don't know u64s and you just moved. I don't know 16 bits. Instead, instead of 64 sweets, you will be. You will end up reading like in between values, that's an unaligned, pointer and okay. So those are all pointers. You can do like a lot of nasty stuff with them. We are not sure why that's wrong really right now we will go into that later.

B

But let me show you an example: a super tiny example of how to use these raw pointers and how to use and save and so on. um So here in my terminal, I have in my editor I have this tiny crate. It has a single struct, it's called byte array. This byte array has a mutable row pointer to and to an u8 and has a new size that represents this length.

B

You can think of this type like a and a slice or if you want like a vector, but here we only have like two simple functions: we can only read stuff from it. We cannot grow it or make it smaller. We can just read stuff from it and usually what happens in the rust ecosystem is that you have like these two.

B

These two functions you have like the unsafe, unchecked version of a function, and then you have the safe version of it.

B

Here we have the unsafe function, it's called get unchecked, it receives an index and what this function is doing is that it takes this pointer, ptr cast it into a new size.

B

Then it adds the index to it and cast that integer back to a pointer, so we are offsetting the pointer by adding index to it, and then we reference it actually all of this code. All these all these three lines are not required to be done inside an unsaved function. The only thing that isn't safe is reading from the pointer calling the reference star operator over it. So you can use your pointer.

B

However, you want, but if you are going to the reference them, you have to use them safe, and then we have like the safe counterpart of this function.

B

So we guarantee that if the index you are reading is out of bounds from the length of the of this array, then we return none and if we are sure that we are in inbounds, then we just return sum sum and do an unsafe call to this get unchecked function, and when you run this, for example, let's say this is a creating in the res ecosystem using create cio and someone else decides to use it.

B

They might just do something like this. They just import our library use. This byte array type call a function that I didn't show because it's not programmed for the purposes of the stock that is called zeros that just create an array full of zeros and they might need to use unsafe because they need to go super fast with this thing, so they are just going to use getting checked uh and zero, and if we run this, it returns zero, so it works as is as intended.

B

uh Some of you might be asking what happens if you do this there, these you call this function with a larger index, we'll get to that later.

B

um So yep, that's the demo and the big question now is well actually what can go wrong when you, when you use unsafe- and you might have heard answers like? Oh, if you doesn't save wrong, then you're causing undefined behavior or undefined behavior is so bad. Anything can happen when you're dealing with undefined behavior. So, let's discuss a bit undefined behavior.

B

Let's say the ros compiler was written under same 10 assumptions about how programs work about the programs we write. We write programs that need to meet certain conditions, so the compiler can actually compile them into what we want. If we break any of these rules, uh we say we're calling undefined behavior. As stefan said, this is a way of saying like if there is something that is not actually specified by the compiler in a clear way.

B

If the compiler is trusting that to happen, and if you break that that rule then you're causing undefined behavior, there is something super important is that undefined behavior is different in each language. So c has a lot of rules for undefined behavior and those rules are not the same for us. um For example, what stefan told you about adding uh an integer and going uh let's say going out of bounds in the interior like adding too much to an interior because it can fit a number stupid?

B

Then that's not undefined behavior in rust, but that's undefined behavior in c, um because both compilers were built with different guarantees in mind and actually the list of things that rust considers important rules when we're dealing with undefined behavior is a little bit tricky. So I'm just going to mention some of them. Your program might have undefined behavior if you are dereferencing a pointer that is dangling or unaligned.

B

um Also, if you try to produce or if you manage to produce a value that is incorrect for their type. So, for example, booleans when you look at the actual memory, let's say: booleans are represented by bytes. They take one byte exactly so you have r1 or a zero.

B

But abide has like eight bits, so you have a lot of values that you could use. So one is true. Zero is false, but for example, if you take a three and you try to put that into a boolean doing, that is undefined behavior, because three is not specified as a boolean. The compiler doesn't know. What should it do?

B

What you do if this is, if it sees a tree instead of a one or a zero um causing data races, is also undefined behavior and, as I said before, there are a lot of subtle rules that must be taken into account here.

B

So what happens? If we break these rules?

B

Basically work. Basically, rust cannot work correctly. uh We lose this guarantee that has that of producing programs that do what we want them to do. uh They ca rus can no longer compile a program correctly. So what this means is that in the best case, your program might not run.

B

Maybe it process a segmentation fold or some sort of memory out of bounds, error or something like that, but in the worst case it might run, but not as you intended to so that program might do anything.

B

uh For that reason, it's pretty common to see this kind of psychedelic image with unicorns and ray bones and a lot of colorful stuff when people discuss undefined behavior, because when we are dealing with undefined behavior, we lose track of what our programmer do is doing in the most basic level.

B

We don't even know anymore, um so there are good news for us for us developers, people in the rush community if we are using safe rust, if we promise to never never never using safe, we don't have to worry worry about undefined behavior, because undefined behavior shouldn't happen in safe rust.

B

Also, if you are using unsafe- and you are super sure- you're not causing undefined behavior, you might actually get any uh performance benefits or you can interact with c libraries and so on correctly, if you don't cause undefined behavior, that's also good.

B

There are also not so good news and is that unsafe is a super important part of our ecosystem, uh even if we are not causing undefined behavior ourselves. uh Someone else in one of our dependencies might be might be doing it uh here. I have like some super interesting statistics about this uh twenty percent. Twenty percent of all the crates that are in crates I uses, uses using save directly um and seventy four twenty. Seventy four sorry and of those 20 crates, all those crates.

B

74 of them do unsafe calls to functions that aren't in the same crate, so are crates that are using unsafe to call function that that either in the standard library or in other crits.

B

If you want to get like more information about this metrics, you can google or use your favorite web search engine to look for this paper about how the programmers using save rust.

B

um But my point here is that unsafe is everywhere not because people are not good doing our their job, but because we need it, we actually needed this everywhere.

B

So I also have a good news, actually the best news and is that there is a tool that you can use to detect undefined behavior uh in your programs and the spoiler is in the title of this stock is called bearing. So let's talk about miri.

B

If you want to take a look at the repository now or maybe later, this is the url. You can find all the code in github.com, slash, roslink miri, um so what's miri. Actually miri is a virtual machine for those programs. This means that miri doesn't compile your program. It interprets it in the same sense that the jvm interprets java code or bytecode, or that the python interpreter runs python or that drove interpreter runs, ruby and so on.

B

Mirror is like that, but for rust, and it has a super cool feature that none of the other interpreters has and is that it can detect almost all cases of underhind behavior while running our code and okay. There is also something interesting and is that some of the code that is used in miri is using the engine that does compile time function evaluation. So if you have any const item in your program, you have a constant. You have a cons function.

B

uh Part of the mirror code is used to run um that function or that or to evaluate that constant. So it's pretty common to hear stuff, like oh yeah mirror, is the constant evaluation for plus, but here we will be talking just uh as mary as just the standalone tool outside the compiler that can interpret your programs um so how to use miri. You need an elevator version of the compiler to do this.

B

So if you have restock you have to install the nightly tool chain, you can do this by running rooftop tool chain installed nightly, and then you can install miri just as a component, so it's the same as installing clippy or fmt or whatever you just have to do: browstop, component.miri and then after mirroring installs, it has to download some additional stuff. It takes a while compiling, but you can run binaries.

B

You can run your your whole program if you want with miri or you can run just your test suite if you have tests uh okay, so let's do a tiny demo with the same code. I was showing you before so again we have this super tiny use. User super super tiny program that is using an external crate. Let's say that is using the safe and maybe the person that is writing this program doesn't know about the guarantees that that trait has to be sure that these functions doesn't don't cause undefined behavior.

B

So uh you might be tempted to do something like I don't know. Why can I read the eleventh position of an array with 10 elements like who is stopping me? The compiler is not complaining, so if I, if I do cargo run, it works, it actually returns zero. That is a perfectly good value because it returns the same as before.

B

So it's fine, but if you run this with miri, you will find this super cool error that says undefined behavior pointer to allocation was the references after this allocation got freed and it points to the part of the code in the original trade that does that causes this undefined behavior and is a pointer of the reference, and you can see more information and so on. But the important part here is that what's happening in the model of execution of mirror is that this function is creating a pointer that is dangling.

B

You create a you created, a pointer that is outside the actual rainbow range of the vector. So when the vector gets deleted because rust deleted it after everyone has used, it has used it. uh You still have this dangling pointer, pointing to nothing but, for example, if we go back to the perfect case where we didn't have like any undefined behavior, we can just do cargo miri run and mirror one complain and will return the same as your regular program.

B

um Okay, so that's like how we can use miri, we can use it to detect undefined behavior if our program is causing undefined behavior in that descenary. But now I want to show you. I want to discuss a little bit like how midi works actually and to talk about how miri works. We have to dig a little bit on how the rust compiler works.

B

So this is like a super high level overview of the rose compilation pipeline. These are like more or less all the stages that a program follows when it's getting compiled.

B

So we always start like add source code with our dot rs file and end up in a in machine code, or you know in a binary, a wasn't binary or a dynamic library. Something like that and what happens in the middle are like basically, four stages. The first one is parsing, so ros reads the text of your source code, let's say and parses it to produce an abstract, syntax tree radius d.

B

Then this isd is transformed and processed to produce a high level intermediate representation or h. I r in this stage, is where most of the type inference process happens. So a lot of types are inferred here. In this stage, um then this hir is lowered to another representation, intermediate representation, but this is a middle, a mid-level intermediate representation mir, and here is where the borrow checking happens. Most of it uh in the mir also is when the compiler does some optimizations about your code and after that we start interacting with llvm.

B

That is a backend for compilers that resist, and these this llvm project also has their own intermediate representation. So we lower miri mir to mir to the other vm intermediate representation and lldm dots, a lot of optimizations over your code and finally, llvm. Does the code generation to produce your binary file or your library or so on?

B

um Melee works almost in this way. The only difference is that the code generation stages don't run, so we don't get to talk with a little well with llvm. uh What happens is that miri lets the compiler run until you have the mir of your program and miri interprets that mir as if it were by code.

B

So if java has by code in the jbm brush, has mir for the when running miri, so that's why miri is called mirror because he's some mir interpreter mere um I'm showing you this, because here is something super important is that miri cannot interpret programs that aren't ros programs. So you have a c library that you run with your ros program, where you cannot interpret that in any way.

B

That program doesn't have like the same syntax. The compiler doesn't even understand that program, so you cannot interpret that using miri and there are many limitations. Actually, there are some limitations that miri has smeared is not perfect. It's not a silver bullet for your undefined behavior problems.

B

Another limitation is that mirror is slow. So if your test or your program is performance, sensitive miri can take a while to run your program, even if you can do it.

B

This happens because miri has to do a lot of runtime checks about your pointers and about how memories manage to be able to tell you when undefined behavior is happening.

B

um And the other important point is that mirror can only attack undefined behavior if it's happening. So, as I show you in the example, we have a program that might have from behind behavior. Is someone calls a function with a certain argument, but if that doesn't actually happens, mary won't warn the user about this case.

B

uh Also, mary cannot detect data races, yet there is no way to reasonable databases and again where you can only interpret ros programs.

B

This one is super important. You might be wondering why does this matter and it's because, well you know programs don't run in isolation. We tend to use files, we can access files, get resources over the network, interact with databases create all stress, so we need to access the concurrency primitives of our operating system or whatever, and the main the mechanism that rust uses to interact with all those are foreign functions, and that's where I this last part is about frame functions.

B

Some of us might be, let's say, maybe think that we don't need frame functions at all. Maybe you we have never used external fan in our project, so we think no, that's fine. I I usually don't interact with frame functions, but I'm not sure that anyone, or almost everyone has interacted with the standard library to do any operation to read files or whatever, and that means that somehow you're using following functions, for example, this is the stack trace when you call file open the standard library function for opening files.

B

uh There are like six functions here, the first three, the first two are like rust functions. They are in the standard library, there are platform independents, so these work in any platform in windows, linux, mac os. Whatever, then we have like four functions that are specific four units unix like platform, so those only run on linux and mac, os and vsd and so on, and then we have this open 64 function at the end, the funny part about this open 64 function is that it's not even a ros function. It's a c function.

B

It's the linux system call to open a file.

B

So this is a foreign function written in c and it's an unsafe function and miri cannot interpret it. So what happens? If, in any of this process we have undefined behavior?

B

Can we run that because it cannot interpret the open, 64 function?

B

The good news is that yes, miri can actually run your program in a particularly interesting way and yes, mary cannot interpret your following function, but it can intercept this call. So when you're running your program, if you call open 64, maybe we'll say, okay, someone is calling up.64, that's a foreign function that I don't know, that's not a ras function uh and then the merry contributors can write whatever code they want to emulate that function.

B

uh We call, though, that the code that emulates a function, we call it a shim s-h-I-m and if machine needs to interact with the operating system or with any of the resources that the standard library provides, we use the standard library for that. So it's funny because the standard library uses foreign functions but miri uses the standard library to emulate some of those following functions.

B

Let me show you so. Instead, we are still in our example with the byte array crate, but in this case we have an user that is.

B

Reading the size and index that it wants to use from a config file and this config file is read using red to string bread to string. Read the string uses file open so eventually it will use open, 64.

B

um and we're doing the same, we're just printing something after using save. If we try to run this with miri, we will get an error, but it's not because we're causing undefined behavior.

B

uh We have this on support operation open it's not available when installation is enabled. So this is the open 64 function I was talking about open, is not available when installation is is enabled. Please pause the mirror disabled installation flag to disable this isolation. So if we do that.

B

And set the miriflux environment variable to merely disable insulation. We can actually run the program and in this particular case it seems that the config file is actually causing undefined behavior. It says memory access, failed pointer must be involved in bounce at 11, but it's outside of bounds for the allocation which has size 10.. So this seems to be the same problem as before that someone is reading 11 11th position of something with only 10 elements, and if we check our config file yeah, it's a salary that is reading the 10th position or the 11th.

B

If you want to think in 0 in in 0 base indexes and that's the whole problem, so yeah we can use miri to detect undefined behavior either in programs that use foreign functions. That's super cool and actually other than handling files. Where you can do a lot of stuff, you can manipulate directories, you can delete files, create symbolic links. uh You can spawn threads, you can use logs anatomics if you're doing concurrency somewhere, you can emulate some concurrency stuff.

B

You can use it to get the current time, so you can actually like run clocks inside your mute program. Your last program running miri, you can handle environment variables and each of those operations is possible because someone decided to wrote decided to rotation for that specific foreign function, and this has a super cool side effect. What not so side effect. Some people were actually targeting to get this working um and is that the standard ros library works in many platforms, you can run it.

B

You can use file opening, basically any tier one tier zero um platform. So this means that you can emulate foreign functions. Even if you are not in the platform, the program is going to be compiled on so, for example, if you have a program that is supposed to run in windows, but you don't have a windows machine, you can use miri to interpret that program as if it were a windows program. Let me show you.

B

So here we have another user of our library. This time is using environment variables to set the size and index that it wants to reach and miri can emulate an environment inside it. So we can do.

B

We can use the size environment variable to set the size of the array we set the index to one, because we want to run that and we disable this isolation and I'm using a linux machine, but I'm going to run it for a target. That is windows. I don't have windows installed here and it works, and if I want to run it in anything else, I can do it.

B

I'm running it on my regular linux target and it's working. So this is super cool because maybe you can use miri in one situation when you're not sure. If this code that you wrote specifically for windows is working correctly, maybe you can use mirror for that too. Even if you're not using save, you just want to be sure that your program runs as intended um and yeah. Basically, that's like the hard content of my talk and I want to spend like the last few minutes talking about contributing to miri.

B

So if anything of this caught your attention, I encourage you to contribute to miri. For many reasons. My personal reasons is that I always wanted to work like in compilers, because I find them super interesting. I really like rust and I didn't know where to start uh so I found miri. I say like oh yeah, I could implement like maybe some following functions for opening files or whatever it sounds not too hard. It's it was.

B

It took a while, while I understood some miri specific stuff, but it actually helped me a lot to understand how the compiler works and get involved in a lot of stuff that I wouldn't be able to do. Otherwise, even then, if you don't feel comfortable yet contributing because I don't know you can help this project by just using it.

B

Maybe you want to use it because you actually write unsafe and you want to be sure you're not causing undefined behavior. Maybe some of your dependencies use unsafe and you want to be sure that them don't cause any undefined behavior so yeah there is that you can save yourself for a lot of others. Many many headaches debugging, whereas undefined behavior books uh and maybe you're, expecting that mary catches, something and it isn't it doesn't it doesn't or maybe their way around.

B

You think this program is correct and mirror is complaining. Maybe we can you can open any issue for that? You can talk with someone from the rest from the midi contributors to discuss it or from the unsafe working group. Also, uh there is something super important, and this is not like an obligation you have with the community if your, if your program is runs really slow in miri. That's fine!

B

I mean you, don't have to to give us to give everyone anyone coverage for this, but if you are super interested in contributing to me writing a shame is super. Is a super easy way to start or if you want just request it, because you need it and you don't have the time. That's fine, too, uh if you want to write it yourself, it's super cool, because what you have to learn is actually like. You have to read your platform specification about how that following function works and the stuff that you need to learn about.

B

Miri is really small. You need to know how many words completely to do that. I don't know how miraculous works uh completely.

B

I just have like I just know some little parts here and there and I implemented a lot of games because I like them, uh even if you don't need that, if you don't need that team, maybe someone else needs it and you are not just testing uh the undefined behavior for the standard library, you're testing on the file you're helping everyone write better on safe code, because a lot of people use a bunch of chains that the standard library doesn't use.

B

For example, if you want some specifics for windows, many of the shims haven't been implemented yet and that's sort of fine because you can cross interpret like you were in windows in linux. Sorry, but yeah. For example. If I go back to the to the program that opens a file.

B

And I try to run it with the windows target.

B

It will fail, but it will fail, because this function create file. W has not been implemented yet so maybe one of you want to do it. That's super cool. There are a bunch of stuff that haven't been implemented yet, and that's all so. Thank you for your time. uh I hope you find this interesting and I think we can do some questions now. If you want where.

C

Are we yes, the questions so um where there was the demo with accessing the 11th element in the air raid airmen said about accessing allocation? It was free.

C

um This was out of bounds, so I guess this is the question: how far can it track stuff right.

B

Yeah, so uh this is not clear for me. Actually, sometimes uh this program fails, because when miri interprets it, it frees the memory for the array before you read the pointer, so it complains about memory being freed or sometimes the pointer. The array is not deleted yet so it hasn't been dropped, so it complains about it being out of bound access, even though the race is still there.

B

So the good news is that any of those are undefined behavior, so we're fine, but yeah miri tries to be deterministic as much as it can, but when you disciple isolation, for example, it's really hard to be deterministic, because if you change your file that might change how your how everything works internally,.

C

Thank you so there's a second question where, when miriam's engine is used to execute const code during compilation, does it run in fast mode with with less validation and how I just the difference between the fast and the slow mode.

B

Okay, so I'm sort of rookie in that part of the every project. I I don't know a lot of constable, but yes, mary miller, runs without a lot of the validations. It runs when you're running it, it's standalone. So in constant evaluation, I think it's faster than what I show you.

C

B

Because it has to do less checks, but let's say the the engine is the same: it's the same same engine but in a different car. Let's say.

C

Yeah, so we don't have dynamic allocations in const eval currently right, so we don't have to check for any of these kind of bugs.

B

Yeah but for example, there is this flacking nightly ros that lets you run it. I don't remember the name is it's something like maybe unleashed something you can run like. Let's say: undisrupted, constant evaluation, all powerful to run, basically whatever it wants and most of the times it breaks the compiler but yeah you can actually run like whatever you want using mirror inside the compiler. But that's like super experimental.

C

Okay, so long term, one could have a vm like a full functioning vm in miri.

B

uh In principle, yes, but there are a lot of questions about like, for example, you read a file and then you use that file to, I don't know, create some constant or you define a type using congeneric, so that might make your calculation unsound, because every time you read the file, the file might change and then you compile it or maybe you are using random number generators and you you shouldn't, allow those inside your computer.

C

So maybe I can introduce my own question here.

C

You think in the in a very distant future, it will be possible to have uh miri included in a binary to have rust as a scripting language inside your ras program.

B

Oh wow, I have no idea. Actually I remember that someone was writing an interpreter for nyr directly, so you can use it like it was a ripple. I.

C

B

Know what happened with that project.

C

Was this the python uh like thing like.

B

The jupiter notebook like no, it was a little bit different because it didn't run rust. It run miri, so you have to write the miri the mir of your program instead of the regular bus code.

C

What happened with that yeah interesting uh another question from the audience: would it be possible to do this kind of analysis on general llvm ir.

B

um I'm tempted to say yes, yes, you could. uh The thing is that you don't have a lot of the type information that you have when you're interpreting the mir. So, for example, in the yr you have the lifetimes for every single value. You can do a lot of reasoning around that. I don't know if you can do that in little vmir directly, but in principle yeah you can build, uh for example, and stack borrows model for a little vm ir. If you want.

B

Let's say I don't know how easy it is, but then principle you can.

C

I guess we would have to add a lot of metadata because, like new types, for instance, just erase and enos may become just ends.

B

C

B

It's harder, but I believe it's possible to do that.

C

Cool um is there anything you would like to show off like a final use case or like having you have like an idea of like hey. If someone is bored, maybe give a shout.

B

C

B

Yeah, actually let me let me open a new firefox window here.

C

I will share oh no, yes,.

B

So if you're bored- and you want to do something inside miri- you have a lot of issues here. In particular, we have this. Let me submit a little bit because you might be not seeing anything, but we have this chimps label.

B

So there are a lot of really tiny. Let's say really contain problems that you can solve here, for example, maybe doesn't support custom allocators and in the rash, in the last version uh now box, the heap pointer allows for a custom allocator, so.

A

B

Important now to have a way to use a custom allocator in miri just to be able to to test box with different allocators, for example, so yeah. If you're bored you, you can just grab any of these issues.

C

Yeah very cool: oh I'm, really looking forward to a stable box with custom allocator support yeah, that's very interesting!

C

Wonderful, so uh I think we have uh almost reached the end. I don't see any more questions anymore, but it was very well received and uh great talk. Thank you again. Various thank you as well. Okay, thank you.

B