1 // Copyright 2018 The Rust Project Developers. See the COPYRIGHT
2 // file at the top-level directory of this distribution and at
3 // http://rust-lang.org/COPYRIGHT.
5 // Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
6 // http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
7 // <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
8 // option. This file may not be copied, modified, or distributed
9 // except according to those terms.
11 //! The memory subsystem.
13 //! Generally, we use `Pointer` to denote memory addresses. However, some operations
14 //! have a "size"-like parameter, and they take `Scalar` for the address because
15 //! if the size is 0, then the pointer can also be a (properly aligned, non-NULL)
16 //! integer. It is crucial that these operations call `check_align` *before*
17 //! short-circuiting the empty case!
19 use std::collections::VecDeque;
23 use rustc::ty::{self, Instance, ParamEnv, query::TyCtxtAt};
24 use rustc::ty::layout::{Align, TargetDataLayout, Size, HasDataLayout};
25 pub use rustc::mir::interpret::{truncate, write_target_uint, read_target_uint};
26 use rustc_data_structures::fx::{FxHashSet, FxHashMap};
28 use syntax::ast::Mutability;
31 Pointer, AllocId, Allocation, GlobalId, AllocationExtra, InboundsCheck,
32 EvalResult, Scalar, EvalErrorKind, AllocType, PointerArithmetic,
33 Machine, AllocMap, MayLeak, ErrorHandled,
36 #[derive(Debug, PartialEq, Eq, Copy, Clone, Hash)]
37 pub enum MemoryKind<T> {
38 /// Error if deallocated except during a stack pop
40 /// Error if ever deallocated
42 /// Additional memory kinds a machine wishes to distinguish from the builtin ones
46 impl<T: MayLeak> MayLeak for MemoryKind<T> {
48 fn may_leak(self) -> bool {
50 MemoryKind::Stack => false,
51 MemoryKind::Vtable => true,
52 MemoryKind::Machine(k) => k.may_leak()
57 // `Memory` has to depend on the `Machine` because some of its operations
58 // (e.g. `get`) call a `Machine` hook.
59 pub struct Memory<'a, 'mir, 'tcx: 'a + 'mir, M: Machine<'a, 'mir, 'tcx>> {
60 /// Allocations local to this instance of the miri engine. The kind
61 /// helps ensure that the same mechanism is used for allocation and
62 /// deallocation. When an allocation is not found here, it is a
63 /// static and looked up in the `tcx` for read access. Some machines may
64 /// have to mutate this map even on a read-only access to a static (because
65 /// they do pointer provenance tracking and the allocations in `tcx` have
66 /// the wrong type), so we let the machine override this type.
67 /// Either way, if the machine allows writing to a static, doing so will
68 /// create a copy of the static allocation here.
69 alloc_map: M::MemoryMap,
71 /// To be able to compare pointers with NULL, and to check alignment for accesses
72 /// to ZSTs (where pointers may dangle), we keep track of the size even for allocations
73 /// that do not exist any more.
74 dead_alloc_map: FxHashMap<AllocId, (Size, Align)>,
76 /// Lets us implement `HasDataLayout`, which is awfully convenient.
77 pub(super) tcx: TyCtxtAt<'a, 'tcx, 'tcx>,
80 impl<'a, 'mir, 'tcx, M: Machine<'a, 'mir, 'tcx>> HasDataLayout
81 for Memory<'a, 'mir, 'tcx, M>
84 fn data_layout(&self) -> &TargetDataLayout {
89 // FIXME: Really we shouldn't clone memory, ever. Snapshot machinery should instead
90 // carefully copy only the reachable parts.
91 impl<'a, 'mir, 'tcx: 'a + 'mir, M: Machine<'a, 'mir, 'tcx>>
92 Clone for Memory<'a, 'mir, 'tcx, M>
94 fn clone(&self) -> Self {
96 alloc_map: self.alloc_map.clone(),
97 dead_alloc_map: self.dead_alloc_map.clone(),
103 impl<'a, 'mir, 'tcx, M: Machine<'a, 'mir, 'tcx>> Memory<'a, 'mir, 'tcx, M> {
104 pub fn new(tcx: TyCtxtAt<'a, 'tcx, 'tcx>) -> Self {
106 alloc_map: Default::default(),
107 dead_alloc_map: FxHashMap::default(),
112 pub fn create_fn_alloc(&mut self, instance: Instance<'tcx>) -> Pointer {
113 Pointer::from(self.tcx.alloc_map.lock().create_fn_alloc(instance))
116 pub fn allocate_static_bytes(&mut self, bytes: &[u8]) -> Pointer {
117 Pointer::from(self.tcx.allocate_bytes(bytes))
120 pub fn allocate_with(
122 alloc: Allocation<M::PointerTag, M::AllocExtra>,
123 kind: MemoryKind<M::MemoryKinds>,
124 ) -> EvalResult<'tcx, AllocId> {
125 let id = self.tcx.alloc_map.lock().reserve();
126 self.alloc_map.insert(id, (kind, alloc));
134 kind: MemoryKind<M::MemoryKinds>,
135 ) -> EvalResult<'tcx, Pointer> {
136 Ok(Pointer::from(self.allocate_with(Allocation::undef(size, align), kind)?))
141 ptr: Pointer<M::PointerTag>,
146 kind: MemoryKind<M::MemoryKinds>,
147 ) -> EvalResult<'tcx, Pointer> {
148 if ptr.offset.bytes() != 0 {
149 return err!(ReallocateNonBasePtr);
152 // For simplicities' sake, we implement reallocate as "alloc, copy, dealloc".
153 // This happens so rarely, the perf advantage is outweighed by the maintenance cost.
154 let new_ptr = self.allocate(new_size, new_align, kind)?;
158 new_ptr.with_default_tag().into(),
160 old_size.min(new_size),
161 /*nonoverlapping*/ true,
163 self.deallocate(ptr, Some((old_size, old_align)), kind)?;
168 /// Deallocate a local, or do nothing if that local has been made into a static
169 pub fn deallocate_local(&mut self, ptr: Pointer<M::PointerTag>) -> EvalResult<'tcx> {
170 // The allocation might be already removed by static interning.
171 // This can only really happen in the CTFE instance, not in miri.
172 if self.alloc_map.contains_key(&ptr.alloc_id) {
173 self.deallocate(ptr, None, MemoryKind::Stack)
181 ptr: Pointer<M::PointerTag>,
182 size_and_align: Option<(Size, Align)>,
183 kind: MemoryKind<M::MemoryKinds>,
184 ) -> EvalResult<'tcx> {
185 trace!("deallocating: {}", ptr.alloc_id);
187 if ptr.offset.bytes() != 0 {
188 return err!(DeallocateNonBasePtr);
191 let (alloc_kind, mut alloc) = match self.alloc_map.remove(&ptr.alloc_id) {
192 Some(alloc) => alloc,
194 // Deallocating static memory -- always an error
195 return match self.tcx.alloc_map.lock().get(ptr.alloc_id) {
196 Some(AllocType::Function(..)) => err!(DeallocatedWrongMemoryKind(
197 "function".to_string(),
198 format!("{:?}", kind),
200 Some(AllocType::Static(..)) |
201 Some(AllocType::Memory(..)) => err!(DeallocatedWrongMemoryKind(
202 "static".to_string(),
203 format!("{:?}", kind),
205 None => err!(DoubleFree)
210 if alloc_kind != kind {
211 return err!(DeallocatedWrongMemoryKind(
212 format!("{:?}", alloc_kind),
213 format!("{:?}", kind),
216 if let Some((size, align)) = size_and_align {
217 if size.bytes() != alloc.bytes.len() as u64 || align != alloc.align {
218 let bytes = Size::from_bytes(alloc.bytes.len() as u64);
219 return err!(IncorrectAllocationInformation(size,
226 // Let the machine take some extra action
227 let size = Size::from_bytes(alloc.bytes.len() as u64);
228 AllocationExtra::memory_deallocated(&mut alloc, ptr, size)?;
230 // Don't forget to remember size and align of this now-dead allocation
231 let old = self.dead_alloc_map.insert(
233 (Size::from_bytes(alloc.bytes.len() as u64), alloc.align)
236 bug!("Nothing can be deallocated twice");
242 /// Check that the pointer is aligned AND non-NULL. This supports ZSTs in two ways:
243 /// You can pass a scalar, and a `Pointer` does not have to actually still be allocated.
246 ptr: Scalar<M::PointerTag>,
247 required_align: Align
248 ) -> EvalResult<'tcx> {
249 // Check non-NULL/Undef, extract offset
250 let (offset, alloc_align) = match ptr {
251 Scalar::Ptr(ptr) => {
252 // check this is not NULL -- which we can ensure only if this is in-bounds
253 // of some (potentially dead) allocation.
254 self.check_bounds_ptr(ptr, InboundsCheck::MaybeDead)?;
255 // data required for alignment check
256 let (_, align) = self.get_size_and_align(ptr.alloc_id);
257 (ptr.offset.bytes(), align)
259 Scalar::Bits { bits, size } => {
260 assert_eq!(size as u64, self.pointer_size().bytes());
261 assert!(bits < (1u128 << self.pointer_size().bits()));
262 // check this is not NULL
264 return err!(InvalidNullPointerUsage);
266 // the "base address" is 0 and hence always aligned
267 (bits as u64, required_align)
271 if alloc_align.bytes() < required_align.bytes() {
272 return err!(AlignmentCheckFailed {
274 required: required_align,
277 if offset % required_align.bytes() == 0 {
280 let has = offset % required_align.bytes();
281 err!(AlignmentCheckFailed {
282 has: Align::from_bytes(has).unwrap(),
283 required: required_align,
289 /// Allocation accessors
290 impl<'a, 'mir, 'tcx, M: Machine<'a, 'mir, 'tcx>> Memory<'a, 'mir, 'tcx, M> {
291 /// Helper function to obtain the global (tcx) allocation for a static.
292 /// This attempts to return a reference to an existing allocation if
293 /// one can be found in `tcx`. That, however, is only possible if `tcx` and
294 /// this machine use the same pointer tag, so it is indirected through
295 /// `M::static_with_default_tag`.
297 tcx: TyCtxtAt<'a, 'tcx, 'tcx>,
299 ) -> EvalResult<'tcx, Cow<'tcx, Allocation<M::PointerTag, M::AllocExtra>>> {
300 let alloc = tcx.alloc_map.lock().get(id);
301 let def_id = match alloc {
302 Some(AllocType::Memory(mem)) => {
303 // We got tcx memory. Let the machine figure out whether and how to
304 // turn that into memory with the right pointer tag.
305 return Ok(M::adjust_static_allocation(mem))
307 Some(AllocType::Function(..)) => {
308 return err!(DerefFunctionPointer)
310 Some(AllocType::Static(did)) => {
314 return err!(DanglingPointerDeref),
316 // We got a "lazy" static that has not been computed yet, do some work
317 trace!("static_alloc: Need to compute {:?}", def_id);
318 if tcx.is_foreign_item(def_id) {
319 return M::find_foreign_static(tcx, def_id);
321 let instance = Instance::mono(tcx.tcx, def_id);
326 // use the raw query here to break validation cycles. Later uses of the static will call the
328 tcx.const_eval_raw(ty::ParamEnv::reveal_all().and(gid)).map_err(|err| {
329 // no need to report anything, the const_eval call takes care of that for statics
330 assert!(tcx.is_static(def_id).is_some());
332 ErrorHandled::Reported => EvalErrorKind::ReferencedConstant.into(),
333 ErrorHandled::TooGeneric => EvalErrorKind::TooGeneric.into(),
336 let allocation = tcx.alloc_map.lock().unwrap_memory(raw_const.alloc_id);
337 // We got tcx memory. Let the machine figure out whether and how to
338 // turn that into memory with the right pointer tag.
339 M::adjust_static_allocation(allocation)
343 pub fn get(&self, id: AllocId) -> EvalResult<'tcx, &Allocation<M::PointerTag, M::AllocExtra>> {
344 // The error type of the inner closure here is somewhat funny. We have two
345 // ways of "erroring": An actual error, or because we got a reference from
346 // `get_static_alloc` that we can actually use directly without inserting anything anywhere.
347 // So the error type is `EvalResult<'tcx, &Allocation<M::PointerTag>>`.
348 let a = self.alloc_map.get_or(id, || {
349 let alloc = Self::get_static_alloc(self.tcx, id).map_err(Err)?;
351 Cow::Borrowed(alloc) => {
352 // We got a ref, cheaply return that as an "error" so that the
353 // map does not get mutated.
356 Cow::Owned(alloc) => {
357 // Need to put it into the map and return a ref to that
358 let kind = M::STATIC_KIND.expect(
359 "I got an owned allocation that I have to copy but the machine does \
360 not expect that to happen"
362 Ok((MemoryKind::Machine(kind), alloc))
366 // Now unpack that funny error type
376 ) -> EvalResult<'tcx, &mut Allocation<M::PointerTag, M::AllocExtra>> {
378 let a = self.alloc_map.get_mut_or(id, || {
379 // Need to make a copy, even if `get_static_alloc` is able
380 // to give us a cheap reference.
381 let alloc = Self::get_static_alloc(tcx, id)?;
382 if alloc.mutability == Mutability::Immutable {
383 return err!(ModifiedConstantMemory);
385 let kind = M::STATIC_KIND.expect(
386 "An allocation is being mutated but the machine does not expect that to happen"
388 Ok((MemoryKind::Machine(kind), alloc.into_owned()))
390 // Unpack the error type manually because type inference doesn't
391 // work otherwise (and we cannot help it because `impl Trait`)
396 if a.mutability == Mutability::Immutable {
397 return err!(ModifiedConstantMemory);
404 pub fn get_size_and_align(&self, id: AllocId) -> (Size, Align) {
405 if let Ok(alloc) = self.get(id) {
406 return (Size::from_bytes(alloc.bytes.len() as u64), alloc.align);
408 // Could also be a fn ptr or extern static
409 match self.tcx.alloc_map.lock().get(id) {
410 Some(AllocType::Function(..)) => (Size::ZERO, Align::from_bytes(1).unwrap()),
411 Some(AllocType::Static(did)) => {
412 // The only way `get` couldn't have worked here is if this is an extern static
413 assert!(self.tcx.is_foreign_item(did));
414 // Use size and align of the type
415 let ty = self.tcx.type_of(did);
416 let layout = self.tcx.layout_of(ParamEnv::empty().and(ty)).unwrap();
417 (layout.size, layout.align.abi)
420 // Must be a deallocated pointer
421 *self.dead_alloc_map.get(&id).expect(
422 "allocation missing in dead_alloc_map"
428 pub fn get_fn(&self, ptr: Pointer<M::PointerTag>) -> EvalResult<'tcx, Instance<'tcx>> {
429 if ptr.offset.bytes() != 0 {
430 return err!(InvalidFunctionPointer);
432 trace!("reading fn ptr: {}", ptr.alloc_id);
433 match self.tcx.alloc_map.lock().get(ptr.alloc_id) {
434 Some(AllocType::Function(instance)) => Ok(instance),
435 _ => Err(EvalErrorKind::ExecuteMemory.into()),
439 pub fn mark_immutable(&mut self, id: AllocId) -> EvalResult<'tcx> {
440 self.get_mut(id)?.mutability = Mutability::Immutable;
444 /// For debugging, print an allocation and all allocations it points to, recursively.
445 pub fn dump_alloc(&self, id: AllocId) {
446 self.dump_allocs(vec![id]);
449 fn dump_alloc_helper<Tag, Extra>(
451 allocs_seen: &mut FxHashSet<AllocId>,
452 allocs_to_print: &mut VecDeque<AllocId>,
454 alloc: &Allocation<Tag, Extra>,
459 let prefix_len = msg.len();
460 let mut relocations = vec![];
462 for i in 0..(alloc.bytes.len() as u64) {
463 let i = Size::from_bytes(i);
464 if let Some(&(_, target_id)) = alloc.relocations.get(&i) {
465 if allocs_seen.insert(target_id) {
466 allocs_to_print.push_back(target_id);
468 relocations.push((i, target_id));
470 if alloc.undef_mask.is_range_defined(i, i + Size::from_bytes(1)).is_ok() {
471 // this `as usize` is fine, since `i` came from a `usize`
472 write!(msg, "{:02x} ", alloc.bytes[i.bytes() as usize]).unwrap();
479 "{}({} bytes, alignment {}){}",
486 if !relocations.is_empty() {
488 write!(msg, "{:1$}", "", prefix_len).unwrap(); // Print spaces.
489 let mut pos = Size::ZERO;
490 let relocation_width = (self.pointer_size().bytes() - 1) * 3;
491 for (i, target_id) in relocations {
492 // this `as usize` is fine, since we can't print more chars than `usize::MAX`
493 write!(msg, "{:1$}", "", ((i - pos) * 3).bytes() as usize).unwrap();
494 let target = format!("({})", target_id);
495 // this `as usize` is fine, since we can't print more chars than `usize::MAX`
496 write!(msg, "└{0:─^1$}┘ ", target, relocation_width as usize).unwrap();
497 pos = i + self.pointer_size();
503 /// For debugging, print a list of allocations and all allocations they point to, recursively.
504 pub fn dump_allocs(&self, mut allocs: Vec<AllocId>) {
505 if !log_enabled!(::log::Level::Trace) {
510 let mut allocs_to_print = VecDeque::from(allocs);
511 let mut allocs_seen = FxHashSet::default();
513 while let Some(id) = allocs_to_print.pop_front() {
514 let msg = format!("Alloc {:<5} ", format!("{}:", id));
517 match self.alloc_map.get_or(id, || Err(())) {
518 Ok((kind, alloc)) => {
519 let extra = match kind {
520 MemoryKind::Stack => " (stack)".to_owned(),
521 MemoryKind::Vtable => " (vtable)".to_owned(),
522 MemoryKind::Machine(m) => format!(" ({:?})", m),
524 self.dump_alloc_helper(
525 &mut allocs_seen, &mut allocs_to_print,
531 match self.tcx.alloc_map.lock().get(id) {
532 Some(AllocType::Memory(alloc)) => {
533 self.dump_alloc_helper(
534 &mut allocs_seen, &mut allocs_to_print,
535 msg, alloc, " (immutable)".to_owned()
538 Some(AllocType::Function(func)) => {
539 trace!("{} {}", msg, func);
541 Some(AllocType::Static(did)) => {
542 trace!("{} {:?}", msg, did);
545 trace!("{} (deallocated)", msg);
554 pub fn leak_report(&self) -> usize {
555 trace!("### LEAK REPORT ###");
556 let leaks: Vec<_> = self.alloc_map.filter_map_collect(|&id, &(kind, _)| {
557 if kind.may_leak() { None } else { Some(id) }
560 self.dump_allocs(leaks);
564 /// This is used by [priroda](https://github.com/oli-obk/priroda)
565 pub fn alloc_map(&self) -> &M::MemoryMap {
570 /// Interning (for CTFE)
571 impl<'a, 'mir, 'tcx, M> Memory<'a, 'mir, 'tcx, M>
573 M: Machine<'a, 'mir, 'tcx, PointerTag=(), AllocExtra=()>,
574 M::MemoryMap: AllocMap<AllocId, (MemoryKind<M::MemoryKinds>, Allocation)>,
576 /// mark an allocation as static and initialized, either mutable or not
577 pub fn intern_static(
580 mutability: Mutability,
581 ) -> EvalResult<'tcx> {
583 "mark_static_initialized {:?}, mutability: {:?}",
588 let (kind, mut alloc) = self.alloc_map.remove(&alloc_id).unwrap();
590 MemoryKind::Machine(_) => bug!("Static cannot refer to machine memory"),
591 MemoryKind::Stack | MemoryKind::Vtable => {},
593 // ensure llvm knows not to put this into immutable memory
594 alloc.mutability = mutability;
595 let alloc = self.tcx.intern_const_alloc(alloc);
596 self.tcx.alloc_map.lock().set_id_memory(alloc_id, alloc);
597 // recurse into inner allocations
598 for &(_, alloc) in alloc.relocations.values() {
599 // FIXME: Reusing the mutability here is likely incorrect. It is originally
600 // determined via `is_freeze`, and data is considered frozen if there is no
601 // `UnsafeCell` *immediately* in that data -- however, this search stops
602 // at references. So whenever we follow a reference, we should likely
603 // assume immutability -- and we should make sure that the compiler
604 // does not permit code that would break this!
605 if self.alloc_map.contains_key(&alloc) {
606 // Not yet interned, so proceed recursively
607 self.intern_static(alloc, mutability)?;
608 } else if self.dead_alloc_map.contains_key(&alloc) {
610 return err!(ValidationFailure(
611 "encountered dangling pointer in final constant".into(),
619 /// Reading and writing
620 impl<'a, 'mir, 'tcx, M: Machine<'a, 'mir, 'tcx>> Memory<'a, 'mir, 'tcx, M> {
623 src: Scalar<M::PointerTag>,
625 dest: Scalar<M::PointerTag>,
628 nonoverlapping: bool,
629 ) -> EvalResult<'tcx> {
630 self.copy_repeatedly(src, src_align, dest, dest_align, size, 1, nonoverlapping)
633 pub fn copy_repeatedly(
635 src: Scalar<M::PointerTag>,
637 dest: Scalar<M::PointerTag>,
641 nonoverlapping: bool,
642 ) -> EvalResult<'tcx> {
643 if size.bytes() == 0 {
644 // Nothing to do for ZST, other than checking alignment and non-NULLness.
645 self.check_align(src, src_align)?;
646 self.check_align(dest, dest_align)?;
649 let src = src.to_ptr()?;
650 let dest = dest.to_ptr()?;
652 // first copy the relocations to a temporary buffer, because
653 // `get_bytes_mut` will clear the relocations, which is correct,
654 // since we don't want to keep any relocations at the target.
655 // (`get_bytes_with_undef_and_ptr` below checks that there are no
656 // relocations overlapping the edges; those would not be handled correctly).
658 let relocations = self.get(src.alloc_id)?.relocations(self, src, size)?;
659 let mut new_relocations = Vec::with_capacity(relocations.len() * (length as usize));
661 new_relocations.extend(
664 .map(|&(offset, reloc)| {
665 (offset + dest.offset - src.offset + (i * size * relocations.len() as u64),
674 let tcx = self.tcx.tcx;
676 // This also checks alignment, and relocation edges on the src.
677 let src_bytes = self.get(src.alloc_id)?
678 .get_bytes_with_undef_and_ptr(&tcx, src, size, src_align)?
680 let dest_bytes = self.get_mut(dest.alloc_id)?
681 .get_bytes_mut(&tcx, dest, size * length, dest_align)?
684 // SAFE: The above indexing would have panicked if there weren't at least `size` bytes
685 // behind `src` and `dest`. Also, we use the overlapping-safe `ptr::copy` if `src` and
686 // `dest` could possibly overlap.
687 // The pointers above remain valid even if the `HashMap` table is moved around because they
688 // point into the `Vec` storing the bytes.
690 assert_eq!(size.bytes() as usize as u64, size.bytes());
691 if src.alloc_id == dest.alloc_id {
693 if (src.offset <= dest.offset && src.offset + size > dest.offset) ||
694 (dest.offset <= src.offset && dest.offset + size > src.offset)
696 return err!(Intrinsic(
697 "copy_nonoverlapping called on overlapping ranges".to_string(),
704 dest_bytes.offset((size.bytes() * i) as isize),
705 size.bytes() as usize);
709 ptr::copy_nonoverlapping(src_bytes,
710 dest_bytes.offset((size.bytes() * i) as isize),
711 size.bytes() as usize);
716 // copy definedness to the destination
717 self.copy_undef_mask(src, dest, size, length)?;
718 // copy the relocations to the destination
719 self.get_mut(dest.alloc_id)?.relocations.insert_presorted(relocations);
726 impl<'a, 'mir, 'tcx, M: Machine<'a, 'mir, 'tcx>> Memory<'a, 'mir, 'tcx, M> {
727 // FIXME: Add a fast version for the common, nonoverlapping case
730 src: Pointer<M::PointerTag>,
731 dest: Pointer<M::PointerTag>,
734 ) -> EvalResult<'tcx> {
735 // The bits have to be saved locally before writing to dest in case src and dest overlap.
736 assert_eq!(size.bytes() as usize as u64, size.bytes());
738 let undef_mask = self.get(src.alloc_id)?.undef_mask.clone();
739 let dest_allocation = self.get_mut(dest.alloc_id)?;
741 for i in 0..size.bytes() {
742 let defined = undef_mask.get(src.offset + Size::from_bytes(i));
745 dest_allocation.undef_mask.set(
746 dest.offset + Size::from_bytes(i + (size.bytes() * j)),