// license that can be found in the LICENSE file.
// Code to check that pointer writes follow the cgo rules.
-// These functions are invoked via the write barrier when debug.cgocheck > 1.
+// These functions are invoked when GOEXPERIMENT=cgocheck2 is enabled.
package runtime
import (
"internal/goarch"
+ "internal/goexperiment"
"unsafe"
)
-const cgoWriteBarrierFail = "Go pointer stored into non-Go memory"
+const cgoWriteBarrierFail = "unpinned Go pointer stored into non-Go memory"
-// cgoCheckWriteBarrier is called whenever a pointer is stored into memory.
-// It throws if the program is storing a Go pointer into non-Go memory.
+// cgoCheckPtrWrite is called whenever a pointer is stored into memory.
+// It throws if the program is storing an unpinned Go pointer into non-Go
+// memory.
//
-// This is called from the write barrier, so its entire call tree must
-// be nosplit.
+// This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
//
//go:nosplit
//go:nowritebarrier
-func cgoCheckWriteBarrier(dst *uintptr, src uintptr) {
- if !cgoIsGoPointer(unsafe.Pointer(src)) {
+func cgoCheckPtrWrite(dst *unsafe.Pointer, src unsafe.Pointer) {
+ if !mainStarted {
+ // Something early in startup hates this function.
+ // Don't start doing any actual checking until the
+ // runtime has set itself up.
+ return
+ }
+ if !cgoIsGoPointer(src) {
return
}
if cgoIsGoPointer(unsafe.Pointer(dst)) {
// If we are running on the system stack then dst might be an
// address on the stack, which is OK.
- g := getg()
- if g == g.m.g0 || g == g.m.gsignal {
+ gp := getg()
+ if gp == gp.m.g0 || gp == gp.m.gsignal {
return
}
// Allocating memory can write to various mfixalloc structs
// that look like they are non-Go memory.
- if g.m.mallocing != 0 {
+ if gp.m.mallocing != 0 {
+ return
+ }
+
+ // If the object is pinned, it's safe to store it in C memory. The GC
+ // ensures it will not be moved or freed.
+ if isPinned(src) {
return
}
}
systemstack(func() {
- println("write of Go pointer", hex(src), "to non-Go memory", hex(uintptr(unsafe.Pointer(dst))))
+ println("write of unpinned Go pointer", hex(uintptr(src)), "to non-Go memory", hex(uintptr(unsafe.Pointer(dst))))
throw(cgoWriteBarrierFail)
})
}
// cgoCheckMemmove is called when moving a block of memory.
+// It throws if the program is copying a block that contains an unpinned Go
+// pointer into non-Go memory.
+//
+// This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
+//
+//go:nosplit
+//go:nowritebarrier
+func cgoCheckMemmove(typ *_type, dst, src unsafe.Pointer) {
+ cgoCheckMemmove2(typ, dst, src, 0, typ.Size_)
+}
+
+// cgoCheckMemmove2 is called when moving a block of memory.
// dst and src point off bytes into the value to copy.
// size is the number of bytes to copy.
-// It throws if the program is copying a block that contains a Go pointer
-// into non-Go memory.
+// It throws if the program is copying a block that contains an unpinned Go
+// pointer into non-Go memory.
//
//go:nosplit
//go:nowritebarrier
-func cgoCheckMemmove(typ *_type, dst, src unsafe.Pointer, off, size uintptr) {
- if typ.ptrdata == 0 {
+func cgoCheckMemmove2(typ *_type, dst, src unsafe.Pointer, off, size uintptr) {
+ if typ.PtrBytes == 0 {
return
}
if !cgoIsGoPointer(src) {
// cgoCheckSliceCopy is called when copying n elements of a slice.
// src and dst are pointers to the first element of the slice.
// typ is the element type of the slice.
-// It throws if the program is copying slice elements that contain Go pointers
-// into non-Go memory.
+// It throws if the program is copying slice elements that contain unpinned Go
+// pointers into non-Go memory.
//
//go:nosplit
//go:nowritebarrier
func cgoCheckSliceCopy(typ *_type, dst, src unsafe.Pointer, n int) {
- if typ.ptrdata == 0 {
+ if typ.PtrBytes == 0 {
return
}
if !cgoIsGoPointer(src) {
}
p := src
for i := 0; i < n; i++ {
- cgoCheckTypedBlock(typ, p, 0, typ.size)
- p = add(p, typ.size)
+ cgoCheckTypedBlock(typ, p, 0, typ.Size_)
+ p = add(p, typ.Size_)
}
}
// cgoCheckTypedBlock checks the block of memory at src, for up to size bytes,
-// and throws if it finds a Go pointer. The type of the memory is typ,
+// and throws if it finds an unpinned Go pointer. The type of the memory is typ,
// and src is off bytes into that type.
//
//go:nosplit
//go:nowritebarrier
func cgoCheckTypedBlock(typ *_type, src unsafe.Pointer, off, size uintptr) {
- // Anything past typ.ptrdata is not a pointer.
- if typ.ptrdata <= off {
+ // Anything past typ.PtrBytes is not a pointer.
+ if typ.PtrBytes <= off {
return
}
- if ptrdataSize := typ.ptrdata - off; size > ptrdataSize {
+ if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
size = ptrdataSize
}
- if typ.kind&kindGCProg == 0 {
- cgoCheckBits(src, typ.gcdata, off, size)
+ if typ.Kind_&kindGCProg == 0 {
+ cgoCheckBits(src, typ.GCData, off, size)
return
}
}
// src must be in the regular heap.
-
- hbits := heapBitsForAddr(uintptr(src))
- for i := uintptr(0); i < off+size; i += goarch.PtrSize {
- bits := hbits.bits()
- if i >= off && bits&bitPointer != 0 {
- v := *(*unsafe.Pointer)(add(src, i))
- if cgoIsGoPointer(v) {
+ if goexperiment.AllocHeaders {
+ tp := s.typePointersOf(uintptr(src), size)
+ for {
+ var addr uintptr
+ if tp, addr = tp.next(uintptr(src) + size); addr == 0 {
+ break
+ }
+ v := *(*unsafe.Pointer)(unsafe.Pointer(addr))
+ if cgoIsGoPointer(v) && !isPinned(v) {
+ throw(cgoWriteBarrierFail)
+ }
+ }
+ } else {
+ hbits := heapBitsForAddr(uintptr(src), size)
+ for {
+ var addr uintptr
+ if hbits, addr = hbits.next(); addr == 0 {
+ break
+ }
+ v := *(*unsafe.Pointer)(unsafe.Pointer(addr))
+ if cgoIsGoPointer(v) && !isPinned(v) {
throw(cgoWriteBarrierFail)
}
}
- hbits = hbits.next()
}
}
// cgoCheckBits checks the block of memory at src, for up to size
-// bytes, and throws if it finds a Go pointer. The gcbits mark each
+// bytes, and throws if it finds an unpinned Go pointer. The gcbits mark each
// pointer value. The src pointer is off bytes into the gcbits.
//
//go:nosplit
} else {
if bits&1 != 0 {
v := *(*unsafe.Pointer)(add(src, i))
- if cgoIsGoPointer(v) {
+ if cgoIsGoPointer(v) && !isPinned(v) {
throw(cgoWriteBarrierFail)
}
}
//go:nowritebarrier
//go:systemstack
func cgoCheckUsingType(typ *_type, src unsafe.Pointer, off, size uintptr) {
- if typ.ptrdata == 0 {
+ if typ.PtrBytes == 0 {
return
}
- // Anything past typ.ptrdata is not a pointer.
- if typ.ptrdata <= off {
+ // Anything past typ.PtrBytes is not a pointer.
+ if typ.PtrBytes <= off {
return
}
- if ptrdataSize := typ.ptrdata - off; size > ptrdataSize {
+ if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
size = ptrdataSize
}
- if typ.kind&kindGCProg == 0 {
- cgoCheckBits(src, typ.gcdata, off, size)
+ if typ.Kind_&kindGCProg == 0 {
+ cgoCheckBits(src, typ.GCData, off, size)
return
}
- switch typ.kind & kindMask {
+ switch typ.Kind_ & kindMask {
default:
throw("can't happen")
case kindArray:
at := (*arraytype)(unsafe.Pointer(typ))
- for i := uintptr(0); i < at.len; i++ {
- if off < at.elem.size {
- cgoCheckUsingType(at.elem, src, off, size)
+ for i := uintptr(0); i < at.Len; i++ {
+ if off < at.Elem.Size_ {
+ cgoCheckUsingType(at.Elem, src, off, size)
}
- src = add(src, at.elem.size)
+ src = add(src, at.Elem.Size_)
skipped := off
- if skipped > at.elem.size {
- skipped = at.elem.size
+ if skipped > at.Elem.Size_ {
+ skipped = at.Elem.Size_
}
- checked := at.elem.size - skipped
+ checked := at.Elem.Size_ - skipped
off -= skipped
if size <= checked {
return
}
case kindStruct:
st := (*structtype)(unsafe.Pointer(typ))
- for _, f := range st.fields {
- if off < f.typ.size {
- cgoCheckUsingType(f.typ, src, off, size)
+ for _, f := range st.Fields {
+ if off < f.Typ.Size_ {
+ cgoCheckUsingType(f.Typ, src, off, size)
}
- src = add(src, f.typ.size)
+ src = add(src, f.Typ.Size_)
skipped := off
- if skipped > f.typ.size {
- skipped = f.typ.size
+ if skipped > f.Typ.Size_ {
+ skipped = f.Typ.Size_
}
- checked := f.typ.size - skipped
+ checked := f.Typ.Size_ - skipped
off -= skipped
if size <= checked {
return