1 // Copyright 2015 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
5 // Code to check that pointer writes follow the cgo rules.
6 // These functions are invoked when GOEXPERIMENT=cgocheck2 is enabled.
15 const cgoWriteBarrierFail = "unpinned Go pointer stored into non-Go memory"
17 // cgoCheckPtrWrite is called whenever a pointer is stored into memory.
18 // It throws if the program is storing an unpinned Go pointer into non-Go
21 // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
25 func cgoCheckPtrWrite(dst *unsafe.Pointer, src unsafe.Pointer) {
27 // Something early in startup hates this function.
28 // Don't start doing any actual checking until the
29 // runtime has set itself up.
32 if !cgoIsGoPointer(src) {
35 if cgoIsGoPointer(unsafe.Pointer(dst)) {
39 // If we are running on the system stack then dst might be an
40 // address on the stack, which is OK.
42 if gp == gp.m.g0 || gp == gp.m.gsignal {
46 // Allocating memory can write to various mfixalloc structs
47 // that look like they are non-Go memory.
48 if gp.m.mallocing != 0 {
52 // If the object is pinned, it's safe to store it in C memory. The GC
53 // ensures it will not be moved or freed.
58 // It's OK if writing to memory allocated by persistentalloc.
59 // Do this check last because it is more expensive and rarely true.
60 // If it is false the expense doesn't matter since we are crashing.
61 if inPersistentAlloc(uintptr(unsafe.Pointer(dst))) {
66 println("write of unpinned Go pointer", hex(uintptr(src)), "to non-Go memory", hex(uintptr(unsafe.Pointer(dst))))
67 throw(cgoWriteBarrierFail)
71 // cgoCheckMemmove is called when moving a block of memory.
72 // It throws if the program is copying a block that contains an unpinned Go
73 // pointer into non-Go memory.
75 // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
79 func cgoCheckMemmove(typ *_type, dst, src unsafe.Pointer) {
80 cgoCheckMemmove2(typ, dst, src, 0, typ.Size_)
83 // cgoCheckMemmove2 is called when moving a block of memory.
84 // dst and src point off bytes into the value to copy.
85 // size is the number of bytes to copy.
86 // It throws if the program is copying a block that contains an unpinned Go
87 // pointer into non-Go memory.
91 func cgoCheckMemmove2(typ *_type, dst, src unsafe.Pointer, off, size uintptr) {
92 if typ.PtrBytes == 0 {
95 if !cgoIsGoPointer(src) {
98 if cgoIsGoPointer(dst) {
101 cgoCheckTypedBlock(typ, src, off, size)
104 // cgoCheckSliceCopy is called when copying n elements of a slice.
105 // src and dst are pointers to the first element of the slice.
106 // typ is the element type of the slice.
107 // It throws if the program is copying slice elements that contain unpinned Go
108 // pointers into non-Go memory.
112 func cgoCheckSliceCopy(typ *_type, dst, src unsafe.Pointer, n int) {
113 if typ.PtrBytes == 0 {
116 if !cgoIsGoPointer(src) {
119 if cgoIsGoPointer(dst) {
123 for i := 0; i < n; i++ {
124 cgoCheckTypedBlock(typ, p, 0, typ.Size_)
125 p = add(p, typ.Size_)
129 // cgoCheckTypedBlock checks the block of memory at src, for up to size bytes,
130 // and throws if it finds an unpinned Go pointer. The type of the memory is typ,
131 // and src is off bytes into that type.
135 func cgoCheckTypedBlock(typ *_type, src unsafe.Pointer, off, size uintptr) {
136 // Anything past typ.PtrBytes is not a pointer.
137 if typ.PtrBytes <= off {
140 if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
144 if typ.Kind_&kindGCProg == 0 {
145 cgoCheckBits(src, typ.GCData, off, size)
149 // The type has a GC program. Try to find GC bits somewhere else.
150 for _, datap := range activeModules() {
151 if cgoInRange(src, datap.data, datap.edata) {
152 doff := uintptr(src) - datap.data
153 cgoCheckBits(add(src, -doff), datap.gcdatamask.bytedata, off+doff, size)
156 if cgoInRange(src, datap.bss, datap.ebss) {
157 boff := uintptr(src) - datap.bss
158 cgoCheckBits(add(src, -boff), datap.gcbssmask.bytedata, off+boff, size)
163 s := spanOfUnchecked(uintptr(src))
164 if s.state.get() == mSpanManual {
165 // There are no heap bits for value stored on the stack.
166 // For a channel receive src might be on the stack of some
167 // other goroutine, so we can't unwind the stack even if
169 // We can't expand the GC program without extra storage
170 // space we can't easily get.
171 // Fortunately we have the type information.
173 cgoCheckUsingType(typ, src, off, size)
178 // src must be in the regular heap.
180 hbits := heapBitsForAddr(uintptr(src), size)
183 if hbits, addr = hbits.next(); addr == 0 {
186 v := *(*unsafe.Pointer)(unsafe.Pointer(addr))
187 if cgoIsGoPointer(v) && !isPinned(v) {
188 throw(cgoWriteBarrierFail)
193 // cgoCheckBits checks the block of memory at src, for up to size
194 // bytes, and throws if it finds an unpinned Go pointer. The gcbits mark each
195 // pointer value. The src pointer is off bytes into the gcbits.
199 func cgoCheckBits(src unsafe.Pointer, gcbits *byte, off, size uintptr) {
200 skipMask := off / goarch.PtrSize / 8
201 skipBytes := skipMask * goarch.PtrSize * 8
202 ptrmask := addb(gcbits, skipMask)
203 src = add(src, skipBytes)
207 for i := uintptr(0); i < size; i += goarch.PtrSize {
208 if i&(goarch.PtrSize*8-1) == 0 {
209 bits = uint32(*ptrmask)
210 ptrmask = addb(ptrmask, 1)
215 off -= goarch.PtrSize
218 v := *(*unsafe.Pointer)(add(src, i))
219 if cgoIsGoPointer(v) && !isPinned(v) {
220 throw(cgoWriteBarrierFail)
227 // cgoCheckUsingType is like cgoCheckTypedBlock, but is a last ditch
228 // fall back to look for pointers in src using the type information.
229 // We only use this when looking at a value on the stack when the type
230 // uses a GC program, because otherwise it's more efficient to use the
231 // GC bits. This is called on the system stack.
235 func cgoCheckUsingType(typ *_type, src unsafe.Pointer, off, size uintptr) {
236 if typ.PtrBytes == 0 {
240 // Anything past typ.PtrBytes is not a pointer.
241 if typ.PtrBytes <= off {
244 if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
248 if typ.Kind_&kindGCProg == 0 {
249 cgoCheckBits(src, typ.GCData, off, size)
252 switch typ.Kind_ & kindMask {
254 throw("can't happen")
256 at := (*arraytype)(unsafe.Pointer(typ))
257 for i := uintptr(0); i < at.Len; i++ {
258 if off < at.Elem.Size_ {
259 cgoCheckUsingType(at.Elem, src, off, size)
261 src = add(src, at.Elem.Size_)
263 if skipped > at.Elem.Size_ {
264 skipped = at.Elem.Size_
266 checked := at.Elem.Size_ - skipped
274 st := (*structtype)(unsafe.Pointer(typ))
275 for _, f := range st.Fields {
276 if off < f.Typ.Size_ {
277 cgoCheckUsingType(f.Typ, src, off, size)
279 src = add(src, f.Typ.Size_)
281 if skipped > f.Typ.Size_ {
282 skipped = f.Typ.Size_
284 checked := f.Typ.Size_ - skipped