miri/shims/
foreign_items.rs

1use std::collections::hash_map::Entry;
2use std::io::Write;
3use std::path::Path;
4
5use rustc_abi::{Align, AlignFromBytesError, CanonAbi, Size};
6use rustc_apfloat::Float;
7use rustc_ast::expand::allocator::alloc_error_handler_name;
8use rustc_hir::def::DefKind;
9use rustc_hir::def_id::CrateNum;
10use rustc_middle::middle::codegen_fn_attrs::CodegenFnAttrFlags;
11use rustc_middle::mir::interpret::AllocInit;
12use rustc_middle::ty::{Instance, Ty};
13use rustc_middle::{mir, ty};
14use rustc_span::Symbol;
15use rustc_target::callconv::FnAbi;
16
17use self::helpers::{ToHost, ToSoft};
18use super::alloc::EvalContextExt as _;
19use super::backtrace::EvalContextExt as _;
20use crate::*;
21
22/// Type of dynamic symbols (for `dlsym` et al)
23#[derive(Debug, Copy, Clone)]
24pub struct DynSym(Symbol);
25
26#[expect(clippy::should_implement_trait)]
27impl DynSym {
28    pub fn from_str(name: &str) -> Self {
29        DynSym(Symbol::intern(name))
30    }
31}
32
33impl<'tcx> EvalContextExt<'tcx> for crate::MiriInterpCx<'tcx> {}
34pub trait EvalContextExt<'tcx>: crate::MiriInterpCxExt<'tcx> {
35    /// Emulates calling a foreign item, failing if the item is not supported.
36    /// This function will handle `goto_block` if needed.
37    /// Returns Ok(None) if the foreign item was completely handled
38    /// by this function.
39    /// Returns Ok(Some(body)) if processing the foreign item
40    /// is delegated to another function.
41    fn emulate_foreign_item(
42        &mut self,
43        link_name: Symbol,
44        abi: &FnAbi<'tcx, Ty<'tcx>>,
45        args: &[OpTy<'tcx>],
46        dest: &PlaceTy<'tcx>,
47        ret: Option<mir::BasicBlock>,
48        unwind: mir::UnwindAction,
49    ) -> InterpResult<'tcx, Option<(&'tcx mir::Body<'tcx>, ty::Instance<'tcx>)>> {
50        let this = self.eval_context_mut();
51
52        // Some shims forward to other MIR bodies.
53        match link_name.as_str() {
54            name if name == this.mangle_internal_symbol("__rust_alloc_error_handler") => {
55                // Forward to the right symbol that implements this function.
56                let Some(handler_kind) = this.tcx.alloc_error_handler_kind(()) else {
57                    // in real code, this symbol does not exist without an allocator
58                    throw_unsup_format!(
59                        "`__rust_alloc_error_handler` cannot be called when no alloc error handler is set"
60                    );
61                };
62                let name = Symbol::intern(
63                    this.mangle_internal_symbol(alloc_error_handler_name(handler_kind)),
64                );
65                let handler =
66                    this.lookup_exported_symbol(name)?.expect("missing alloc error handler symbol");
67                return interp_ok(Some(handler));
68            }
69            _ => {}
70        }
71
72        // FIXME: avoid allocating memory
73        let dest = this.force_allocation(dest)?;
74
75        // The rest either implements the logic, or falls back to `lookup_exported_symbol`.
76        match this.emulate_foreign_item_inner(link_name, abi, args, &dest)? {
77            EmulateItemResult::NeedsReturn => {
78                trace!("{:?}", this.dump_place(&dest.clone().into()));
79                this.return_to_block(ret)?;
80            }
81            EmulateItemResult::NeedsUnwind => {
82                // Jump to the unwind block to begin unwinding.
83                this.unwind_to_block(unwind)?;
84            }
85            EmulateItemResult::AlreadyJumped => (),
86            EmulateItemResult::NotSupported => {
87                if let Some(body) = this.lookup_exported_symbol(link_name)? {
88                    return interp_ok(Some(body));
89                }
90
91                throw_machine_stop!(TerminationInfo::UnsupportedForeignItem(format!(
92                    "can't call foreign function `{link_name}` on OS `{os}`",
93                    os = this.tcx.sess.target.os,
94                )));
95            }
96        }
97
98        interp_ok(None)
99    }
100
101    fn is_dyn_sym(&self, name: &str) -> bool {
102        let this = self.eval_context_ref();
103        match this.tcx.sess.target.os.as_ref() {
104            os if this.target_os_is_unix() => shims::unix::foreign_items::is_dyn_sym(name, os),
105            "wasi" => shims::wasi::foreign_items::is_dyn_sym(name),
106            "windows" => shims::windows::foreign_items::is_dyn_sym(name),
107            _ => false,
108        }
109    }
110
111    /// Emulates a call to a `DynSym`.
112    fn emulate_dyn_sym(
113        &mut self,
114        sym: DynSym,
115        abi: &FnAbi<'tcx, Ty<'tcx>>,
116        args: &[OpTy<'tcx>],
117        dest: &PlaceTy<'tcx>,
118        ret: Option<mir::BasicBlock>,
119        unwind: mir::UnwindAction,
120    ) -> InterpResult<'tcx> {
121        let res = self.emulate_foreign_item(sym.0, abi, args, dest, ret, unwind)?;
122        assert!(res.is_none(), "DynSyms that delegate are not supported");
123        interp_ok(())
124    }
125
126    /// Lookup the body of a function that has `link_name` as the symbol name.
127    fn lookup_exported_symbol(
128        &mut self,
129        link_name: Symbol,
130    ) -> InterpResult<'tcx, Option<(&'tcx mir::Body<'tcx>, ty::Instance<'tcx>)>> {
131        let this = self.eval_context_mut();
132        let tcx = this.tcx.tcx;
133
134        // If the result was cached, just return it.
135        // (Cannot use `or_insert` since the code below might have to throw an error.)
136        let entry = this.machine.exported_symbols_cache.entry(link_name);
137        let instance = *match entry {
138            Entry::Occupied(e) => e.into_mut(),
139            Entry::Vacant(e) => {
140                // Find it if it was not cached.
141                let mut instance_and_crate: Option<(ty::Instance<'_>, CrateNum)> = None;
142                helpers::iter_exported_symbols(tcx, |cnum, def_id| {
143                    let attrs = tcx.codegen_fn_attrs(def_id);
144                    // Skip over imports of items.
145                    if tcx.is_foreign_item(def_id) {
146                        return interp_ok(());
147                    }
148                    // Skip over items without an explicitly defined symbol name.
149                    if !(attrs.export_name.is_some()
150                        || attrs.flags.contains(CodegenFnAttrFlags::NO_MANGLE)
151                        || attrs.flags.contains(CodegenFnAttrFlags::RUSTC_STD_INTERNAL_SYMBOL))
152                    {
153                        return interp_ok(());
154                    }
155
156                    let instance = Instance::mono(tcx, def_id);
157                    let symbol_name = tcx.symbol_name(instance).name;
158                    if symbol_name == link_name.as_str() {
159                        if let Some((original_instance, original_cnum)) = instance_and_crate {
160                            // Make sure we are consistent wrt what is 'first' and 'second'.
161                            let original_span = tcx.def_span(original_instance.def_id()).data();
162                            let span = tcx.def_span(def_id).data();
163                            if original_span < span {
164                                throw_machine_stop!(TerminationInfo::MultipleSymbolDefinitions {
165                                    link_name,
166                                    first: original_span,
167                                    first_crate: tcx.crate_name(original_cnum),
168                                    second: span,
169                                    second_crate: tcx.crate_name(cnum),
170                                });
171                            } else {
172                                throw_machine_stop!(TerminationInfo::MultipleSymbolDefinitions {
173                                    link_name,
174                                    first: span,
175                                    first_crate: tcx.crate_name(cnum),
176                                    second: original_span,
177                                    second_crate: tcx.crate_name(original_cnum),
178                                });
179                            }
180                        }
181                        if !matches!(tcx.def_kind(def_id), DefKind::Fn | DefKind::AssocFn) {
182                            throw_ub_format!(
183                                "attempt to call an exported symbol that is not defined as a function"
184                            );
185                        }
186                        instance_and_crate = Some((ty::Instance::mono(tcx, def_id), cnum));
187                    }
188                    interp_ok(())
189                })?;
190
191                e.insert(instance_and_crate.map(|ic| ic.0))
192            }
193        };
194        match instance {
195            None => interp_ok(None), // no symbol with this name
196            Some(instance) => interp_ok(Some((this.load_mir(instance.def, None)?, instance))),
197        }
198    }
199}
200
201impl<'tcx> EvalContextExtPriv<'tcx> for crate::MiriInterpCx<'tcx> {}
202trait EvalContextExtPriv<'tcx>: crate::MiriInterpCxExt<'tcx> {
203    /// Check some basic requirements for this allocation request:
204    /// non-zero size, power-of-two alignment.
205    fn check_rustc_alloc_request(&self, size: u64, align: u64) -> InterpResult<'tcx> {
206        let this = self.eval_context_ref();
207        if size == 0 {
208            throw_ub_format!("creating allocation with size 0");
209        }
210        if size > this.max_size_of_val().bytes() {
211            throw_ub_format!("creating an allocation larger than half the address space");
212        }
213        if let Err(e) = Align::from_bytes(align) {
214            match e {
215                AlignFromBytesError::TooLarge(_) => {
216                    throw_unsup_format!(
217                        "creating allocation with alignment {align} exceeding rustc's maximum \
218                         supported value"
219                    );
220                }
221                AlignFromBytesError::NotPowerOfTwo(_) => {
222                    throw_ub_format!("creating allocation with non-power-of-two alignment {align}");
223                }
224            }
225        }
226
227        interp_ok(())
228    }
229
230    fn emulate_foreign_item_inner(
231        &mut self,
232        link_name: Symbol,
233        abi: &FnAbi<'tcx, Ty<'tcx>>,
234        args: &[OpTy<'tcx>],
235        dest: &MPlaceTy<'tcx>,
236    ) -> InterpResult<'tcx, EmulateItemResult> {
237        let this = self.eval_context_mut();
238
239        // First deal with any external C functions in linked .so file.
240        #[cfg(all(unix, feature = "native-lib"))]
241        if !this.machine.native_lib.is_empty() {
242            use crate::shims::native_lib::EvalContextExt as _;
243            // An Ok(false) here means that the function being called was not exported
244            // by the specified `.so` file; we should continue and check if it corresponds to
245            // a provided shim.
246            if this.call_native_fn(link_name, dest, args)? {
247                return interp_ok(EmulateItemResult::NeedsReturn);
248            }
249        }
250        // When adding a new shim, you should follow the following pattern:
251        // ```
252        // "shim_name" => {
253        //     let [arg1, arg2, arg3] = this.check_shim(abi, CanonAbi::C , link_name, args)?;
254        //     let result = this.shim_name(arg1, arg2, arg3)?;
255        //     this.write_scalar(result, dest)?;
256        // }
257        // ```
258        // and then define `shim_name` as a helper function in an extension trait in a suitable file
259        // (see e.g. `unix/fs.rs`):
260        // ```
261        // fn shim_name(
262        //     &mut self,
263        //     arg1: &OpTy<'tcx>,
264        //     arg2: &OpTy<'tcx>,
265        //     arg3: &OpTy<'tcx>,
266        //     arg4: &OpTy<'tcx>)
267        // -> InterpResult<'tcx, Scalar> {
268        //     let this = self.eval_context_mut();
269        //
270        //     // First thing: load all the arguments. Details depend on the shim.
271        //     let arg1 = this.read_scalar(arg1)?.to_u32()?;
272        //     let arg2 = this.read_pointer(arg2)?; // when you need to work with the pointer directly
273        //     let arg3 = this.deref_pointer_as(arg3, this.libc_ty_layout("some_libc_struct"))?; // when you want to load/store
274        //         // through the pointer and supply the type information yourself
275        //     let arg4 = this.deref_pointer(arg4)?; // when you want to load/store through the pointer and trust
276        //         // the user-given type (which you shouldn't usually do)
277        //
278        //     // ...
279        //
280        //     interp_ok(Scalar::from_u32(42))
281        // }
282        // ```
283        // You might find existing shims not following this pattern, most
284        // likely because they predate it or because for some reason they cannot be made to fit.
285
286        // Here we dispatch all the shims for foreign functions. If you have a platform specific
287        // shim, add it to the corresponding submodule.
288        match link_name.as_str() {
289            // Miri-specific extern functions
290            "miri_start_unwind" => {
291                let [payload] =
292                    this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
293                this.handle_miri_start_unwind(payload)?;
294                return interp_ok(EmulateItemResult::NeedsUnwind);
295            }
296            "miri_run_provenance_gc" => {
297                let [] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
298                this.run_provenance_gc();
299            }
300            "miri_get_alloc_id" => {
301                let [ptr] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
302                let ptr = this.read_pointer(ptr)?;
303                let (alloc_id, _, _) = this.ptr_get_alloc_id(ptr, 0).map_err_kind(|_e| {
304                    err_machine_stop!(TerminationInfo::Abort(format!(
305                        "pointer passed to `miri_get_alloc_id` must not be dangling, got {ptr:?}"
306                    )))
307                })?;
308                this.write_scalar(Scalar::from_u64(alloc_id.0.get()), dest)?;
309            }
310            "miri_print_borrow_state" => {
311                let [id, show_unnamed] =
312                    this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
313                let id = this.read_scalar(id)?.to_u64()?;
314                let show_unnamed = this.read_scalar(show_unnamed)?.to_bool()?;
315                if let Some(id) = std::num::NonZero::new(id).map(AllocId)
316                    && this.get_alloc_info(id).kind == AllocKind::LiveData
317                {
318                    this.print_borrow_state(id, show_unnamed)?;
319                } else {
320                    eprintln!("{id} is not the ID of a live data allocation");
321                }
322            }
323            "miri_pointer_name" => {
324                // This associates a name to a tag. Very useful for debugging, and also makes
325                // tests more strict.
326                let [ptr, nth_parent, name] =
327                    this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
328                let ptr = this.read_pointer(ptr)?;
329                let nth_parent = this.read_scalar(nth_parent)?.to_u8()?;
330                let name = this.read_immediate(name)?;
331
332                let name = this.read_byte_slice(&name)?;
333                // We must make `name` owned because we need to
334                // end the shared borrow from `read_byte_slice` before we can
335                // start the mutable borrow for `give_pointer_debug_name`.
336                let name = String::from_utf8_lossy(name).into_owned();
337                this.give_pointer_debug_name(ptr, nth_parent, &name)?;
338            }
339            "miri_static_root" => {
340                let [ptr] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
341                let ptr = this.read_pointer(ptr)?;
342                let (alloc_id, offset, _) = this.ptr_get_alloc_id(ptr, 0)?;
343                if offset != Size::ZERO {
344                    throw_unsup_format!(
345                        "pointer passed to `miri_static_root` must point to beginning of an allocated block"
346                    );
347                }
348                this.machine.static_roots.push(alloc_id);
349            }
350            "miri_host_to_target_path" => {
351                let [ptr, out, out_size] =
352                    this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
353                let ptr = this.read_pointer(ptr)?;
354                let out = this.read_pointer(out)?;
355                let out_size = this.read_scalar(out_size)?.to_target_usize(this)?;
356
357                // The host affects program behavior here, so this requires isolation to be disabled.
358                this.check_no_isolation("`miri_host_to_target_path`")?;
359
360                // We read this as a plain OsStr and write it as a path, which will convert it to the target.
361                let path = this.read_os_str_from_c_str(ptr)?.to_owned();
362                let (success, needed_size) =
363                    this.write_path_to_c_str(Path::new(&path), out, out_size)?;
364                // Return value: 0 on success, otherwise the size it would have needed.
365                this.write_int(if success { 0 } else { needed_size }, dest)?;
366            }
367            // Obtains the size of a Miri backtrace. See the README for details.
368            "miri_backtrace_size" => {
369                this.handle_miri_backtrace_size(abi, link_name, args, dest)?;
370            }
371            // Obtains a Miri backtrace. See the README for details.
372            "miri_get_backtrace" => {
373                // `check_shim` happens inside `handle_miri_get_backtrace`.
374                this.handle_miri_get_backtrace(abi, link_name, args)?;
375            }
376            // Resolves a Miri backtrace frame. See the README for details.
377            "miri_resolve_frame" => {
378                // `check_shim` happens inside `handle_miri_resolve_frame`.
379                this.handle_miri_resolve_frame(abi, link_name, args, dest)?;
380            }
381            // Writes the function and file names of a Miri backtrace frame into a user provided buffer. See the README for details.
382            "miri_resolve_frame_names" => {
383                this.handle_miri_resolve_frame_names(abi, link_name, args)?;
384            }
385            // Writes some bytes to the interpreter's stdout/stderr. See the
386            // README for details.
387            "miri_write_to_stdout" | "miri_write_to_stderr" => {
388                let [msg] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
389                let msg = this.read_immediate(msg)?;
390                let msg = this.read_byte_slice(&msg)?;
391                // Note: we're ignoring errors writing to host stdout/stderr.
392                let _ignore = match link_name.as_str() {
393                    "miri_write_to_stdout" => std::io::stdout().write_all(msg),
394                    "miri_write_to_stderr" => std::io::stderr().write_all(msg),
395                    _ => unreachable!(),
396                };
397            }
398            // Promises that a pointer has a given symbolic alignment.
399            "miri_promise_symbolic_alignment" => {
400                use rustc_abi::AlignFromBytesError;
401
402                let [ptr, align] =
403                    this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
404                let ptr = this.read_pointer(ptr)?;
405                let align = this.read_target_usize(align)?;
406                if !align.is_power_of_two() {
407                    throw_unsup_format!(
408                        "`miri_promise_symbolic_alignment`: alignment must be a power of 2, got {align}"
409                    );
410                }
411                let align = Align::from_bytes(align).unwrap_or_else(|err| {
412                    match err {
413                        AlignFromBytesError::NotPowerOfTwo(_) => unreachable!(),
414                        // When the alignment is a power of 2 but too big, clamp it to MAX.
415                        AlignFromBytesError::TooLarge(_) => Align::MAX,
416                    }
417                });
418                let addr = ptr.addr();
419                // Cannot panic since `align` is a power of 2 and hence non-zero.
420                if addr.bytes().strict_rem(align.bytes()) != 0 {
421                    throw_unsup_format!(
422                        "`miri_promise_symbolic_alignment`: pointer is not actually aligned"
423                    );
424                }
425                if let Ok((alloc_id, offset, ..)) = this.ptr_try_get_alloc_id(ptr, 0) {
426                    let alloc_align = this.get_alloc_info(alloc_id).align;
427                    // If the newly promised alignment is bigger than the native alignment of this
428                    // allocation, and bigger than the previously promised alignment, then set it.
429                    if align > alloc_align
430                        && this
431                            .machine
432                            .symbolic_alignment
433                            .get_mut()
434                            .get(&alloc_id)
435                            .is_none_or(|&(_, old_align)| align > old_align)
436                    {
437                        this.machine.symbolic_alignment.get_mut().insert(alloc_id, (offset, align));
438                    }
439                }
440            }
441
442            // Aborting the process.
443            "exit" => {
444                let [code] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
445                let code = this.read_scalar(code)?.to_i32()?;
446                throw_machine_stop!(TerminationInfo::Exit { code, leak_check: false });
447            }
448            "abort" => {
449                let [] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
450                throw_machine_stop!(TerminationInfo::Abort(
451                    "the program aborted execution".to_owned()
452                ))
453            }
454
455            // Standard C allocation
456            "malloc" => {
457                let [size] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
458                let size = this.read_target_usize(size)?;
459                if size <= this.max_size_of_val().bytes() {
460                    let res = this.malloc(size, AllocInit::Uninit)?;
461                    this.write_pointer(res, dest)?;
462                } else {
463                    // If this does not fit in an isize, return null and, on Unix, set errno.
464                    if this.target_os_is_unix() {
465                        this.set_last_error(LibcError("ENOMEM"))?;
466                    }
467                    this.write_null(dest)?;
468                }
469            }
470            "calloc" => {
471                let [items, elem_size] =
472                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
473                let items = this.read_target_usize(items)?;
474                let elem_size = this.read_target_usize(elem_size)?;
475                if let Some(size) = this.compute_size_in_bytes(Size::from_bytes(elem_size), items) {
476                    let res = this.malloc(size.bytes(), AllocInit::Zero)?;
477                    this.write_pointer(res, dest)?;
478                } else {
479                    // On size overflow, return null and, on Unix, set errno.
480                    if this.target_os_is_unix() {
481                        this.set_last_error(LibcError("ENOMEM"))?;
482                    }
483                    this.write_null(dest)?;
484                }
485            }
486            "free" => {
487                let [ptr] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
488                let ptr = this.read_pointer(ptr)?;
489                this.free(ptr)?;
490            }
491            "realloc" => {
492                let [old_ptr, new_size] =
493                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
494                let old_ptr = this.read_pointer(old_ptr)?;
495                let new_size = this.read_target_usize(new_size)?;
496                if new_size <= this.max_size_of_val().bytes() {
497                    let res = this.realloc(old_ptr, new_size)?;
498                    this.write_pointer(res, dest)?;
499                } else {
500                    // If this does not fit in an isize, return null and, on Unix, set errno.
501                    if this.target_os_is_unix() {
502                        this.set_last_error(LibcError("ENOMEM"))?;
503                    }
504                    this.write_null(dest)?;
505                }
506            }
507
508            // Rust allocation
509            name if name == this.mangle_internal_symbol("__rust_alloc") || name == "miri_alloc" => {
510                let default = |ecx: &mut MiriInterpCx<'tcx>| {
511                    // Only call `check_shim` when `#[global_allocator]` isn't used. When that
512                    // macro is used, we act like no shim exists, so that the exported function can run.
513                    let [size, align] =
514                        ecx.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
515                    let size = ecx.read_target_usize(size)?;
516                    let align = ecx.read_target_usize(align)?;
517
518                    ecx.check_rustc_alloc_request(size, align)?;
519
520                    let memory_kind = match link_name.as_str() {
521                        "miri_alloc" => MiriMemoryKind::Miri,
522                        _ => MiriMemoryKind::Rust,
523                    };
524
525                    let ptr = ecx.allocate_ptr(
526                        Size::from_bytes(size),
527                        Align::from_bytes(align).unwrap(),
528                        memory_kind.into(),
529                        AllocInit::Uninit,
530                    )?;
531
532                    ecx.write_pointer(ptr, dest)
533                };
534
535                match link_name.as_str() {
536                    "miri_alloc" => {
537                        default(this)?;
538                        return interp_ok(EmulateItemResult::NeedsReturn);
539                    }
540                    _ => return this.emulate_allocator(default),
541                }
542            }
543            name if name == this.mangle_internal_symbol("__rust_alloc_zeroed") => {
544                return this.emulate_allocator(|this| {
545                    // See the comment for `__rust_alloc` why `check_shim` is only called in the
546                    // default case.
547                    let [size, align] =
548                        this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
549                    let size = this.read_target_usize(size)?;
550                    let align = this.read_target_usize(align)?;
551
552                    this.check_rustc_alloc_request(size, align)?;
553
554                    let ptr = this.allocate_ptr(
555                        Size::from_bytes(size),
556                        Align::from_bytes(align).unwrap(),
557                        MiriMemoryKind::Rust.into(),
558                        AllocInit::Zero,
559                    )?;
560                    this.write_pointer(ptr, dest)
561                });
562            }
563            name if name == this.mangle_internal_symbol("__rust_dealloc")
564                || name == "miri_dealloc" =>
565            {
566                let default = |ecx: &mut MiriInterpCx<'tcx>| {
567                    // See the comment for `__rust_alloc` why `check_shim` is only called in the
568                    // default case.
569                    let [ptr, old_size, align] =
570                        ecx.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
571                    let ptr = ecx.read_pointer(ptr)?;
572                    let old_size = ecx.read_target_usize(old_size)?;
573                    let align = ecx.read_target_usize(align)?;
574
575                    let memory_kind = match link_name.as_str() {
576                        "miri_dealloc" => MiriMemoryKind::Miri,
577                        _ => MiriMemoryKind::Rust,
578                    };
579
580                    // No need to check old_size/align; we anyway check that they match the allocation.
581                    ecx.deallocate_ptr(
582                        ptr,
583                        Some((Size::from_bytes(old_size), Align::from_bytes(align).unwrap())),
584                        memory_kind.into(),
585                    )
586                };
587
588                match link_name.as_str() {
589                    "miri_dealloc" => {
590                        default(this)?;
591                        return interp_ok(EmulateItemResult::NeedsReturn);
592                    }
593                    _ => return this.emulate_allocator(default),
594                }
595            }
596            name if name == this.mangle_internal_symbol("__rust_realloc") => {
597                return this.emulate_allocator(|this| {
598                    // See the comment for `__rust_alloc` why `check_shim` is only called in the
599                    // default case.
600                    let [ptr, old_size, align, new_size] =
601                        this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
602                    let ptr = this.read_pointer(ptr)?;
603                    let old_size = this.read_target_usize(old_size)?;
604                    let align = this.read_target_usize(align)?;
605                    let new_size = this.read_target_usize(new_size)?;
606                    // No need to check old_size; we anyway check that they match the allocation.
607
608                    this.check_rustc_alloc_request(new_size, align)?;
609
610                    let align = Align::from_bytes(align).unwrap();
611                    let new_ptr = this.reallocate_ptr(
612                        ptr,
613                        Some((Size::from_bytes(old_size), align)),
614                        Size::from_bytes(new_size),
615                        align,
616                        MiriMemoryKind::Rust.into(),
617                        AllocInit::Uninit,
618                    )?;
619                    this.write_pointer(new_ptr, dest)
620                });
621            }
622            name if name == this.mangle_internal_symbol("__rust_no_alloc_shim_is_unstable_v2") => {
623                // This is a no-op shim that only exists to prevent making the allocator shims instantly stable.
624                let [] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
625            }
626            name if name
627                == this.mangle_internal_symbol("__rust_alloc_error_handler_should_panic_v2") =>
628            {
629                // Gets the value of the `oom` option.
630                let [] = this.check_shim_sig_lenient(abi, CanonAbi::Rust, link_name, args)?;
631                let val = this.tcx.sess.opts.unstable_opts.oom.should_panic();
632                this.write_int(val, dest)?;
633            }
634
635            // C memory handling functions
636            "memcmp" => {
637                let [left, right, n] =
638                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
639                let left = this.read_pointer(left)?;
640                let right = this.read_pointer(right)?;
641                let n = Size::from_bytes(this.read_target_usize(n)?);
642
643                // C requires that this must always be a valid pointer (C18 ยง7.1.4).
644                this.ptr_get_alloc_id(left, 0)?;
645                this.ptr_get_alloc_id(right, 0)?;
646
647                let result = {
648                    let left_bytes = this.read_bytes_ptr_strip_provenance(left, n)?;
649                    let right_bytes = this.read_bytes_ptr_strip_provenance(right, n)?;
650
651                    use std::cmp::Ordering::*;
652                    match left_bytes.cmp(right_bytes) {
653                        Less => -1i32,
654                        Equal => 0,
655                        Greater => 1,
656                    }
657                };
658
659                this.write_scalar(Scalar::from_i32(result), dest)?;
660            }
661            "memrchr" => {
662                let [ptr, val, num] =
663                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
664                let ptr = this.read_pointer(ptr)?;
665                let val = this.read_scalar(val)?.to_i32()?;
666                let num = this.read_target_usize(num)?;
667                // The docs say val is "interpreted as unsigned char".
668                #[expect(clippy::as_conversions)]
669                let val = val as u8;
670
671                // C requires that this must always be a valid pointer (C18 ยง7.1.4).
672                this.ptr_get_alloc_id(ptr, 0)?;
673
674                if let Some(idx) = this
675                    .read_bytes_ptr_strip_provenance(ptr, Size::from_bytes(num))?
676                    .iter()
677                    .rev()
678                    .position(|&c| c == val)
679                {
680                    let idx = u64::try_from(idx).unwrap();
681                    #[expect(clippy::arithmetic_side_effects)] // idx < num, so this never wraps
682                    let new_ptr = ptr.wrapping_offset(Size::from_bytes(num - idx - 1), this);
683                    this.write_pointer(new_ptr, dest)?;
684                } else {
685                    this.write_null(dest)?;
686                }
687            }
688            "memchr" => {
689                let [ptr, val, num] =
690                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
691                let ptr = this.read_pointer(ptr)?;
692                let val = this.read_scalar(val)?.to_i32()?;
693                let num = this.read_target_usize(num)?;
694                // The docs say val is "interpreted as unsigned char".
695                #[expect(clippy::as_conversions)]
696                let val = val as u8;
697
698                // C requires that this must always be a valid pointer (C18 ยง7.1.4).
699                this.ptr_get_alloc_id(ptr, 0)?;
700
701                let idx = this
702                    .read_bytes_ptr_strip_provenance(ptr, Size::from_bytes(num))?
703                    .iter()
704                    .position(|&c| c == val);
705                if let Some(idx) = idx {
706                    let new_ptr = ptr.wrapping_offset(Size::from_bytes(idx), this);
707                    this.write_pointer(new_ptr, dest)?;
708                } else {
709                    this.write_null(dest)?;
710                }
711            }
712            "strlen" => {
713                let [ptr] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
714                let ptr = this.read_pointer(ptr)?;
715                // This reads at least 1 byte, so we are already enforcing that this is a valid pointer.
716                let n = this.read_c_str(ptr)?.len();
717                this.write_scalar(
718                    Scalar::from_target_usize(u64::try_from(n).unwrap(), this),
719                    dest,
720                )?;
721            }
722            "wcslen" => {
723                let [ptr] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
724                let ptr = this.read_pointer(ptr)?;
725                // This reads at least 1 byte, so we are already enforcing that this is a valid pointer.
726                let n = this.read_wchar_t_str(ptr)?.len();
727                this.write_scalar(
728                    Scalar::from_target_usize(u64::try_from(n).unwrap(), this),
729                    dest,
730                )?;
731            }
732            "memcpy" => {
733                let [ptr_dest, ptr_src, n] =
734                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
735                let ptr_dest = this.read_pointer(ptr_dest)?;
736                let ptr_src = this.read_pointer(ptr_src)?;
737                let n = this.read_target_usize(n)?;
738
739                // C requires that this must always be a valid pointer, even if `n` is zero, so we better check that.
740                // (This is more than Rust requires, so `mem_copy` is not sufficient.)
741                this.ptr_get_alloc_id(ptr_dest, 0)?;
742                this.ptr_get_alloc_id(ptr_src, 0)?;
743
744                this.mem_copy(ptr_src, ptr_dest, Size::from_bytes(n), true)?;
745                this.write_pointer(ptr_dest, dest)?;
746            }
747            "strcpy" => {
748                let [ptr_dest, ptr_src] =
749                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
750                let ptr_dest = this.read_pointer(ptr_dest)?;
751                let ptr_src = this.read_pointer(ptr_src)?;
752
753                // We use `read_c_str` to determine the amount of data to copy,
754                // and then use `mem_copy` for the actual copy. This means
755                // pointer provenance is preserved by this implementation of `strcpy`.
756                // That is probably overly cautious, but there also is no fundamental
757                // reason to have `strcpy` destroy pointer provenance.
758                // This reads at least 1 byte, so we are already enforcing that this is a valid pointer.
759                let n = this.read_c_str(ptr_src)?.len().strict_add(1);
760                this.mem_copy(ptr_src, ptr_dest, Size::from_bytes(n), true)?;
761                this.write_pointer(ptr_dest, dest)?;
762            }
763
764            // math functions (note that there are also intrinsics for some other functions)
765            #[rustfmt::skip]
766            | "cbrtf"
767            | "coshf"
768            | "sinhf"
769            | "tanf"
770            | "tanhf"
771            | "acosf"
772            | "asinf"
773            | "atanf"
774            | "log1pf"
775            | "expm1f"
776            | "tgammaf"
777            | "erff"
778            | "erfcf"
779            => {
780                let [f] = this.check_shim_sig_lenient(abi, CanonAbi::C , link_name, args)?;
781                let f = this.read_scalar(f)?.to_f32()?;
782                // Using host floats (but it's fine, these operations do not have guaranteed precision).
783                let f_host = f.to_host();
784                let res = match link_name.as_str() {
785                    "cbrtf" => f_host.cbrt(),
786                    "coshf" => f_host.cosh(),
787                    "sinhf" => f_host.sinh(),
788                    "tanf" => f_host.tan(),
789                    "tanhf" => f_host.tanh(),
790                    "acosf" => f_host.acos(),
791                    "asinf" => f_host.asin(),
792                    "atanf" => f_host.atan(),
793                    "log1pf" => f_host.ln_1p(),
794                    "expm1f" => f_host.exp_m1(),
795                    "tgammaf" => f_host.gamma(),
796                    "erff" => f_host.erf(),
797                    "erfcf" => f_host.erfc(),
798                    _ => bug!(),
799                };
800                let res = res.to_soft();
801                // Apply a relative error of 16ULP to introduce some non-determinism
802                // simulating imprecise implementations and optimizations.
803                // FIXME: temporarily disabled as it breaks std tests.
804                // let res = math::apply_random_float_error_ulp(
805                //     this,
806                //     res,
807                //     4, // log2(16)
808                // );
809                let res = this.adjust_nan(res, &[f]);
810                this.write_scalar(res, dest)?;
811            }
812            #[rustfmt::skip]
813            | "_hypotf"
814            | "hypotf"
815            | "atan2f"
816            | "fdimf"
817            => {
818                let [f1, f2] = this.check_shim_sig_lenient(abi, CanonAbi::C , link_name, args)?;
819                let f1 = this.read_scalar(f1)?.to_f32()?;
820                let f2 = this.read_scalar(f2)?.to_f32()?;
821                // underscore case for windows, here and below
822                // (see https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/floating-point-primitives?view=vs-2019)
823                // Using host floats (but it's fine, these operations do not have guaranteed precision).
824                let res = match link_name.as_str() {
825                    "_hypotf" | "hypotf" => f1.to_host().hypot(f2.to_host()).to_soft(),
826                    "atan2f" => f1.to_host().atan2(f2.to_host()).to_soft(),
827                    #[allow(deprecated)]
828                    "fdimf" => f1.to_host().abs_sub(f2.to_host()).to_soft(),
829                    _ => bug!(),
830                };
831                // Apply a relative error of 16ULP to introduce some non-determinism
832                // simulating imprecise implementations and optimizations.
833                // FIXME: temporarily disabled as it breaks std tests.
834                // let res = math::apply_random_float_error_ulp(
835                //     this,
836                //     res,
837                //     4, // log2(16)
838                // );
839                let res = this.adjust_nan(res, &[f1, f2]);
840                this.write_scalar(res, dest)?;
841            }
842            #[rustfmt::skip]
843            | "cbrt"
844            | "cosh"
845            | "sinh"
846            | "tan"
847            | "tanh"
848            | "acos"
849            | "asin"
850            | "atan"
851            | "log1p"
852            | "expm1"
853            | "tgamma"
854            | "erf"
855            | "erfc"
856            => {
857                let [f] = this.check_shim_sig_lenient(abi, CanonAbi::C , link_name, args)?;
858                let f = this.read_scalar(f)?.to_f64()?;
859                // Using host floats (but it's fine, these operations do not have guaranteed precision).
860                let f_host = f.to_host();
861                let res = match link_name.as_str() {
862                    "cbrt" => f_host.cbrt(),
863                    "cosh" => f_host.cosh(),
864                    "sinh" => f_host.sinh(),
865                    "tan" => f_host.tan(),
866                    "tanh" => f_host.tanh(),
867                    "acos" => f_host.acos(),
868                    "asin" => f_host.asin(),
869                    "atan" => f_host.atan(),
870                    "log1p" => f_host.ln_1p(),
871                    "expm1" => f_host.exp_m1(),
872                    "tgamma" => f_host.gamma(),
873                    "erf" => f_host.erf(),
874                    "erfc" => f_host.erfc(),
875                    _ => bug!(),
876                };
877                let res = res.to_soft();
878                // Apply a relative error of 16ULP to introduce some non-determinism
879                // simulating imprecise implementations and optimizations.
880                // FIXME: temporarily disabled as it breaks std tests.
881                // let res = math::apply_random_float_error_ulp(
882                //     this,
883                //     res.to_soft(),
884                //     4, // log2(16)
885                // );
886                let res = this.adjust_nan(res, &[f]);
887                this.write_scalar(res, dest)?;
888            }
889            #[rustfmt::skip]
890            | "_hypot"
891            | "hypot"
892            | "atan2"
893            | "fdim"
894            => {
895                let [f1, f2] = this.check_shim_sig_lenient(abi, CanonAbi::C , link_name, args)?;
896                let f1 = this.read_scalar(f1)?.to_f64()?;
897                let f2 = this.read_scalar(f2)?.to_f64()?;
898                // underscore case for windows, here and below
899                // (see https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/floating-point-primitives?view=vs-2019)
900                // Using host floats (but it's fine, these operations do not have guaranteed precision).
901                let res = match link_name.as_str() {
902                    "_hypot" | "hypot" => f1.to_host().hypot(f2.to_host()).to_soft(),
903                    "atan2" => f1.to_host().atan2(f2.to_host()).to_soft(),
904                    #[allow(deprecated)]
905                    "fdim" => f1.to_host().abs_sub(f2.to_host()).to_soft(),
906                    _ => bug!(),
907                };
908                // Apply a relative error of 16ULP to introduce some non-determinism
909                // simulating imprecise implementations and optimizations.
910                // FIXME: temporarily disabled as it breaks std tests.
911                // let res = math::apply_random_float_error_ulp(
912                //     this,
913                //     res,
914                //     4, // log2(16)
915                // );
916                let res = this.adjust_nan(res, &[f1, f2]);
917                this.write_scalar(res, dest)?;
918            }
919            #[rustfmt::skip]
920            | "_ldexp"
921            | "ldexp"
922            | "scalbn"
923            => {
924                let [x, exp] = this.check_shim_sig_lenient(abi, CanonAbi::C , link_name, args)?;
925                // For radix-2 (binary) systems, `ldexp` and `scalbn` are the same.
926                let x = this.read_scalar(x)?.to_f64()?;
927                let exp = this.read_scalar(exp)?.to_i32()?;
928
929                let res = x.scalbn(exp);
930                let res = this.adjust_nan(res, &[x]);
931                this.write_scalar(res, dest)?;
932            }
933            "lgammaf_r" => {
934                let [x, signp] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
935                let x = this.read_scalar(x)?.to_f32()?;
936                let signp = this.deref_pointer_as(signp, this.machine.layouts.i32)?;
937
938                // Using host floats (but it's fine, these operations do not have guaranteed precision).
939                let (res, sign) = x.to_host().ln_gamma();
940                this.write_int(sign, &signp)?;
941                let res = res.to_soft();
942                // Apply a relative error of 16ULP to introduce some non-determinism
943                // simulating imprecise implementations and optimizations.
944                // FIXME: temporarily disabled as it breaks std tests.
945                // let res = math::apply_random_float_error_ulp(this, res, 4 /* log2(16) */);
946                let res = this.adjust_nan(res, &[x]);
947                this.write_scalar(res, dest)?;
948            }
949            "lgamma_r" => {
950                let [x, signp] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
951                let x = this.read_scalar(x)?.to_f64()?;
952                let signp = this.deref_pointer_as(signp, this.machine.layouts.i32)?;
953
954                // Using host floats (but it's fine, these operations do not have guaranteed precision).
955                let (res, sign) = x.to_host().ln_gamma();
956                this.write_int(sign, &signp)?;
957                let res = res.to_soft();
958                // Apply a relative error of 16ULP to introduce some non-determinism
959                // simulating imprecise implementations and optimizations.
960                // FIXME: temporarily disabled as it breaks std tests.
961                // let res = math::apply_random_float_error_ulp(this, res, 4 /* log2(16) */);
962                let res = this.adjust_nan(res, &[x]);
963                this.write_scalar(res, dest)?;
964            }
965
966            // LLVM intrinsics
967            "llvm.prefetch" => {
968                let [p, rw, loc, ty] =
969                    this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
970
971                let _ = this.read_pointer(p)?;
972                let rw = this.read_scalar(rw)?.to_i32()?;
973                let loc = this.read_scalar(loc)?.to_i32()?;
974                let ty = this.read_scalar(ty)?.to_i32()?;
975
976                if ty == 1 {
977                    // Data cache prefetch.
978                    // Notably, we do not have to check the pointer, this operation is never UB!
979
980                    if !matches!(rw, 0 | 1) {
981                        throw_unsup_format!("invalid `rw` value passed to `llvm.prefetch`: {}", rw);
982                    }
983                    if !matches!(loc, 0..=3) {
984                        throw_unsup_format!(
985                            "invalid `loc` value passed to `llvm.prefetch`: {}",
986                            loc
987                        );
988                    }
989                } else {
990                    throw_unsup_format!("unsupported `llvm.prefetch` type argument: {}", ty);
991                }
992            }
993            // Used to implement the x86 `_mm{,256,512}_popcnt_epi{8,16,32,64}` and wasm
994            // `{i,u}8x16_popcnt` functions.
995            name if name.starts_with("llvm.ctpop.v") => {
996                let [op] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
997
998                let (op, op_len) = this.project_to_simd(op)?;
999                let (dest, dest_len) = this.project_to_simd(dest)?;
1000
1001                assert_eq!(dest_len, op_len);
1002
1003                for i in 0..dest_len {
1004                    let op = this.read_immediate(&this.project_index(&op, i)?)?;
1005                    // Use `to_uint` to get a zero-extended `u128`. Those
1006                    // extra zeros will not affect `count_ones`.
1007                    let res = op.to_scalar().to_uint(op.layout.size)?.count_ones();
1008
1009                    this.write_scalar(
1010                        Scalar::from_uint(res, op.layout.size),
1011                        &this.project_index(&dest, i)?,
1012                    )?;
1013                }
1014            }
1015
1016            // Target-specific shims
1017            name if name.starts_with("llvm.x86.")
1018                && (this.tcx.sess.target.arch == "x86"
1019                    || this.tcx.sess.target.arch == "x86_64") =>
1020            {
1021                return shims::x86::EvalContextExt::emulate_x86_intrinsic(
1022                    this, link_name, abi, args, dest,
1023                );
1024            }
1025            name if name.starts_with("llvm.aarch64.") && this.tcx.sess.target.arch == "aarch64" => {
1026                return shims::aarch64::EvalContextExt::emulate_aarch64_intrinsic(
1027                    this, link_name, abi, args, dest,
1028                );
1029            }
1030            // FIXME: Move this to an `arm` submodule.
1031            "llvm.arm.hint" if this.tcx.sess.target.arch == "arm" => {
1032                let [arg] = this.check_shim_sig_lenient(abi, CanonAbi::C, link_name, args)?;
1033                let arg = this.read_scalar(arg)?.to_i32()?;
1034                // Note that different arguments might have different target feature requirements.
1035                match arg {
1036                    // YIELD
1037                    1 => {
1038                        this.expect_target_feature_for_intrinsic(link_name, "v6")?;
1039                        this.yield_active_thread();
1040                    }
1041                    _ => {
1042                        throw_unsup_format!("unsupported llvm.arm.hint argument {}", arg);
1043                    }
1044                }
1045            }
1046
1047            // Platform-specific shims
1048            _ =>
1049                return match this.tcx.sess.target.os.as_ref() {
1050                    _ if this.target_os_is_unix() =>
1051                        shims::unix::foreign_items::EvalContextExt::emulate_foreign_item_inner(
1052                            this, link_name, abi, args, dest,
1053                        ),
1054                    "wasi" =>
1055                        shims::wasi::foreign_items::EvalContextExt::emulate_foreign_item_inner(
1056                            this, link_name, abi, args, dest,
1057                        ),
1058                    "windows" =>
1059                        shims::windows::foreign_items::EvalContextExt::emulate_foreign_item_inner(
1060                            this, link_name, abi, args, dest,
1061                        ),
1062                    _ => interp_ok(EmulateItemResult::NotSupported),
1063                },
1064        };
1065        // We only fall through to here if we did *not* hit the `_` arm above,
1066        // i.e., if we actually emulated the function with one of the shims.
1067        interp_ok(EmulateItemResult::NeedsReturn)
1068    }
1069}