1 use std::cell::RefCell;
3 use std::collections::hash_map::Entry;
8 use rustc_data_structures::fx::{FxHashMap, FxHashSet};
10 use rustc_target::abi::{HasDataLayout, Size};
14 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
15 pub enum ProvenanceMode {
16 /// We support `expose_addr`/`from_exposed_addr` via "wildcard" provenance.
17 /// However, we want on `from_exposed_addr` to alert the user of the precision loss.
19 /// Like `Default`, but without the warning.
21 /// We error on `from_exposed_addr`, ensuring no precision loss.
25 pub type GlobalState = RefCell<GlobalStateInner>;
27 #[derive(Clone, Debug)]
28 pub struct GlobalStateInner {
29 /// This is used as a map between the address of each allocation and its `AllocId`.
30 /// It is always sorted
31 int_to_ptr_map: Vec<(u64, AllocId)>,
32 /// The base address for each allocation. We cannot put that into
33 /// `AllocExtra` because function pointers also have a base address, and
34 /// they do not have an `AllocExtra`.
35 /// This is the inverse of `int_to_ptr_map`.
36 base_addr: FxHashMap<AllocId, u64>,
37 /// Whether an allocation has been exposed or not. This cannot be put
38 /// into `AllocExtra` for the same reason as `base_addr`.
39 exposed: FxHashSet<AllocId>,
40 /// This is used as a memory address when a new pointer is casted to an integer. It
41 /// is always larger than any address that was previously made part of a block.
43 /// The provenance to use for int2ptr casts
44 provenance_mode: ProvenanceMode,
47 impl VisitTags for GlobalStateInner {
48 fn visit_tags(&self, _visit: &mut dyn FnMut(SbTag)) {
49 // Nothing to visit here.
53 impl GlobalStateInner {
54 pub fn new(config: &MiriConfig) -> Self {
56 int_to_ptr_map: Vec::default(),
57 base_addr: FxHashMap::default(),
58 exposed: FxHashSet::default(),
59 next_base_addr: STACK_ADDR,
60 provenance_mode: config.provenance_mode,
65 impl<'mir, 'tcx> GlobalStateInner {
66 // Returns the exposed `AllocId` that corresponds to the specified addr,
67 // or `None` if the addr is out of bounds
68 fn alloc_id_from_addr(ecx: &MiriInterpCx<'mir, 'tcx>, addr: u64) -> Option<AllocId> {
69 let global_state = ecx.machine.intptrcast.borrow();
70 assert!(global_state.provenance_mode != ProvenanceMode::Strict);
72 let pos = global_state.int_to_ptr_map.binary_search_by_key(&addr, |(addr, _)| *addr);
74 // Determine the in-bounds provenance for this pointer.
75 // (This is only called on an actual access, so in-bounds is the only possible kind of provenance.)
76 let alloc_id = match pos {
77 Ok(pos) => Some(global_state.int_to_ptr_map[pos].1),
80 // This is the largest of the adresses smaller than `int`,
81 // i.e. the greatest lower bound (glb)
82 let (glb, alloc_id) = global_state.int_to_ptr_map[pos - 1];
83 // This never overflows because `addr >= glb`
84 let offset = addr - glb;
85 // If the offset exceeds the size of the allocation, don't use this `alloc_id`.
86 let size = ecx.get_alloc_info(alloc_id).0;
87 if offset <= size.bytes() { Some(alloc_id) } else { None }
91 // We only use this provenance if it has been exposed, *and* is still live.
92 if global_state.exposed.contains(&alloc_id) {
93 let (_size, _align, kind) = ecx.get_alloc_info(alloc_id);
95 AllocKind::LiveData | AllocKind::Function | AllocKind::VTable => {
96 return Some(alloc_id);
106 ecx: &mut MiriInterpCx<'mir, 'tcx>,
109 ) -> InterpResult<'tcx> {
110 let global_state = ecx.machine.intptrcast.get_mut();
111 // In strict mode, we don't need this, so we can save some cycles by not tracking it.
112 if global_state.provenance_mode != ProvenanceMode::Strict {
113 trace!("Exposing allocation id {alloc_id:?}");
114 global_state.exposed.insert(alloc_id);
115 if ecx.machine.stacked_borrows.is_some() {
116 ecx.expose_tag(alloc_id, sb)?;
122 pub fn ptr_from_addr_transmute(
123 _ecx: &MiriInterpCx<'mir, 'tcx>,
125 ) -> Pointer<Option<Provenance>> {
126 trace!("Transmuting {:#x} to a pointer", addr);
128 // We consider transmuted pointers to be "invalid" (`None` provenance).
129 Pointer::new(None, Size::from_bytes(addr))
132 pub fn ptr_from_addr_cast(
133 ecx: &MiriInterpCx<'mir, 'tcx>,
135 ) -> InterpResult<'tcx, Pointer<Option<Provenance>>> {
136 trace!("Casting {:#x} to a pointer", addr);
138 let global_state = ecx.machine.intptrcast.borrow();
140 match global_state.provenance_mode {
141 ProvenanceMode::Default => {
142 // The first time this happens at a particular location, print a warning.
144 // `Span` is non-`Send`, so we use a thread-local instead.
145 static PAST_WARNINGS: RefCell<FxHashSet<Span>> = RefCell::default();
147 PAST_WARNINGS.with_borrow_mut(|past_warnings| {
148 let first = past_warnings.is_empty();
149 if past_warnings.insert(ecx.cur_span()) {
150 // Newly inserted, so first time we see this span.
151 ecx.emit_diagnostic(NonHaltingDiagnostic::Int2Ptr { details: first });
155 ProvenanceMode::Strict => {
156 throw_machine_stop!(TerminationInfo::Int2PtrWithStrictProvenance);
158 ProvenanceMode::Permissive => {}
161 // This is how wildcard pointers are born.
162 Ok(Pointer::new(Some(Provenance::Wildcard), Size::from_bytes(addr)))
165 fn alloc_base_addr(ecx: &MiriInterpCx<'mir, 'tcx>, alloc_id: AllocId) -> u64 {
166 let mut global_state = ecx.machine.intptrcast.borrow_mut();
167 let global_state = &mut *global_state;
169 match global_state.base_addr.entry(alloc_id) {
170 Entry::Occupied(entry) => *entry.get(),
171 Entry::Vacant(entry) => {
172 // There is nothing wrong with a raw pointer being cast to an integer only after
173 // it became dangling. Hence we allow dead allocations.
174 let (size, align, _kind) = ecx.get_alloc_info(alloc_id);
176 // This allocation does not have a base address yet, pick one.
177 // Leave some space to the previous allocation, to give it some chance to be less aligned.
179 let mut rng = ecx.machine.rng.borrow_mut();
180 // This means that `(global_state.next_base_addr + slack) % 16` is uniformly distributed.
183 // From next_base_addr + slack, round up to adjust for alignment.
184 let base_addr = global_state.next_base_addr.checked_add(slack).unwrap();
185 let base_addr = Self::align_addr(base_addr, align.bytes());
186 entry.insert(base_addr);
188 "Assigning base address {:#x} to allocation {:?} (size: {}, align: {}, slack: {})",
196 // Remember next base address. If this allocation is zero-sized, leave a gap
197 // of at least 1 to avoid two allocations having the same base address.
198 // (The logic in `alloc_id_from_addr` assumes unique addresses, and different
199 // function/vtable pointers need to be distinguishable!)
200 global_state.next_base_addr = base_addr.checked_add(max(size.bytes(), 1)).unwrap();
201 // Given that `next_base_addr` increases in each allocation, pushing the
202 // corresponding tuple keeps `int_to_ptr_map` sorted
203 global_state.int_to_ptr_map.push((base_addr, alloc_id));
210 /// Convert a relative (tcx) pointer to an absolute address.
211 pub fn rel_ptr_to_addr(ecx: &MiriInterpCx<'mir, 'tcx>, ptr: Pointer<AllocId>) -> u64 {
212 let (alloc_id, offset) = ptr.into_parts(); // offset is relative (AllocId provenance)
213 let base_addr = GlobalStateInner::alloc_base_addr(ecx, alloc_id);
215 // Add offset with the right kind of pointer-overflowing arithmetic.
216 let dl = ecx.data_layout();
217 dl.overflowing_offset(base_addr, offset.bytes()).0
220 /// When a pointer is used for a memory access, this computes where in which allocation the
222 pub fn abs_ptr_to_rel(
223 ecx: &MiriInterpCx<'mir, 'tcx>,
224 ptr: Pointer<Provenance>,
225 ) -> Option<(AllocId, Size)> {
226 let (tag, addr) = ptr.into_parts(); // addr is absolute (Tag provenance)
228 let alloc_id = if let Provenance::Concrete { alloc_id, .. } = tag {
231 // A wildcard pointer.
232 GlobalStateInner::alloc_id_from_addr(ecx, addr.bytes())?
235 let base_addr = GlobalStateInner::alloc_base_addr(ecx, alloc_id);
237 // Wrapping "addr - base_addr"
238 let dl = ecx.data_layout();
239 #[allow(clippy::cast_possible_wrap)] // we want to wrap here
240 let neg_base_addr = (base_addr as i64).wrapping_neg();
243 Size::from_bytes(dl.overflowing_signed_offset(addr.bytes(), neg_base_addr).0),
247 /// Shifts `addr` to make it aligned with `align` by rounding `addr` to the smallest multiple
248 /// of `align` that is larger or equal to `addr`
249 fn align_addr(addr: u64, align: u64) -> u64 {
252 rem => addr.checked_add(align).unwrap() - rem,
262 fn test_align_addr() {
263 assert_eq!(GlobalStateInner::align_addr(37, 4), 40);
264 assert_eq!(GlobalStateInner::align_addr(44, 4), 44);