cgocheck.go

     1  // Copyright 2015 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Code to check that pointer writes follow the cgo rules.
     6  // These functions are invoked when GOEXPERIMENT=cgocheck2 is enabled.
     7  
     8  package runtime
     9  
    10  import (
    11  	"internal/goarch"
    12  	"unsafe"
    13  )
    14  
    15  const cgoWriteBarrierFail = "unpinned Go pointer stored into non-Go memory"
    16  
    17  // cgoCheckPtrWrite is called whenever a pointer is stored into memory.
    18  // It throws if the program is storing an unpinned Go pointer into non-Go
    19  // memory.
    20  //
    21  // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
    22  //
    23  //go:nosplit
    24  //go:nowritebarrier
    25  func cgoCheckPtrWrite(dst *unsafe.Pointer, src unsafe.Pointer) {
    26  	if !mainStarted {
    27  		// Something early in startup hates this function.
    28  		// Don't start doing any actual checking until the
    29  		// runtime has set itself up.
    30  		return
    31  	}
    32  	if !cgoIsGoPointer(src) {
    33  		return
    34  	}
    35  	if cgoIsGoPointer(unsafe.Pointer(dst)) {
    36  		return
    37  	}
    38  
    39  	// If we are running on the system stack then dst might be an
    40  	// address on the stack, which is OK.
    41  	gp := getg()
    42  	if gp == gp.m.g0 || gp == gp.m.gsignal {
    43  		return
    44  	}
    45  
    46  	// Allocating memory can write to various mfixalloc structs
    47  	// that look like they are non-Go memory.
    48  	if gp.m.mallocing != 0 {
    49  		return
    50  	}
    51  
    52  	// If the object is pinned, it's safe to store it in C memory. The GC
    53  	// ensures it will not be moved or freed.
    54  	if isPinned(src) {
    55  		return
    56  	}
    57  
    58  	// It's OK if writing to memory allocated by persistentalloc.
    59  	// Do this check last because it is more expensive and rarely true.
    60  	// If it is false the expense doesn't matter since we are crashing.
    61  	if inPersistentAlloc(uintptr(unsafe.Pointer(dst))) {
    62  		return
    63  	}
    64  
    65  	systemstack(func() {
    66  		println("write of unpinned Go pointer", hex(uintptr(src)), "to non-Go memory", hex(uintptr(unsafe.Pointer(dst))))
    67  		throw(cgoWriteBarrierFail)
    68  	})
    69  }
    70  
    71  // cgoCheckMemmove is called when moving a block of memory.
    72  // It throws if the program is copying a block that contains an unpinned Go
    73  // pointer into non-Go memory.
    74  //
    75  // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
    76  //
    77  //go:nosplit
    78  //go:nowritebarrier
    79  func cgoCheckMemmove(typ *_type, dst, src unsafe.Pointer) {
    80  	cgoCheckMemmove2(typ, dst, src, 0, typ.Size_)
    81  }
    82  
    83  // cgoCheckMemmove2 is called when moving a block of memory.
    84  // dst and src point off bytes into the value to copy.
    85  // size is the number of bytes to copy.
    86  // It throws if the program is copying a block that contains an unpinned Go
    87  // pointer into non-Go memory.
    88  //
    89  //go:nosplit
    90  //go:nowritebarrier
    91  func cgoCheckMemmove2(typ *_type, dst, src unsafe.Pointer, off, size uintptr) {
    92  	if !typ.Pointers() {
    93  		return
    94  	}
    95  	if !cgoIsGoPointer(src) {
    96  		return
    97  	}
    98  	if cgoIsGoPointer(dst) {
    99  		return
   100  	}
   101  	cgoCheckTypedBlock(typ, src, off, size)
   102  }
   103  
   104  // cgoCheckSliceCopy is called when copying n elements of a slice.
   105  // src and dst are pointers to the first element of the slice.
   106  // typ is the element type of the slice.
   107  // It throws if the program is copying slice elements that contain unpinned Go
   108  // pointers into non-Go memory.
   109  //
   110  //go:nosplit
   111  //go:nowritebarrier
   112  func cgoCheckSliceCopy(typ *_type, dst, src unsafe.Pointer, n int) {
   113  	if !typ.Pointers() {
   114  		return
   115  	}
   116  	if !cgoIsGoPointer(src) {
   117  		return
   118  	}
   119  	if cgoIsGoPointer(dst) {
   120  		return
   121  	}
   122  	p := src
   123  	for i := 0; i < n; i++ {
   124  		cgoCheckTypedBlock(typ, p, 0, typ.Size_)
   125  		p = add(p, typ.Size_)
   126  	}
   127  }
   128  
   129  // cgoCheckTypedBlock checks the block of memory at src, for up to size bytes,
   130  // and throws if it finds an unpinned Go pointer. The type of the memory is typ,
   131  // and src is off bytes into that type.
   132  //
   133  //go:nosplit
   134  //go:nowritebarrier
   135  func cgoCheckTypedBlock(typ *_type, src unsafe.Pointer, off, size uintptr) {
   136  	// Anything past typ.PtrBytes is not a pointer.
   137  	if typ.PtrBytes <= off {
   138  		return
   139  	}
   140  	if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
   141  		size = ptrdataSize
   142  	}
   143  
   144  	cgoCheckBits(src, getGCMask(typ), off, size)
   145  }
   146  
   147  // cgoCheckBits checks the block of memory at src, for up to size
   148  // bytes, and throws if it finds an unpinned Go pointer. The gcbits mark each
   149  // pointer value. The src pointer is off bytes into the gcbits.
   150  //
   151  //go:nosplit
   152  //go:nowritebarrier
   153  func cgoCheckBits(src unsafe.Pointer, gcbits *byte, off, size uintptr) {
   154  	skipMask := off / goarch.PtrSize / 8
   155  	skipBytes := skipMask * goarch.PtrSize * 8
   156  	ptrmask := addb(gcbits, skipMask)
   157  	src = add(src, skipBytes)
   158  	off -= skipBytes
   159  	size += off
   160  	var bits uint32
   161  	for i := uintptr(0); i < size; i += goarch.PtrSize {
   162  		if i&(goarch.PtrSize*8-1) == 0 {
   163  			bits = uint32(*ptrmask)
   164  			ptrmask = addb(ptrmask, 1)
   165  		} else {
   166  			bits >>= 1
   167  		}
   168  		if off > 0 {
   169  			off -= goarch.PtrSize
   170  		} else {
   171  			if bits&1 != 0 {
   172  				v := *(*unsafe.Pointer)(add(src, i))
   173  				if cgoIsGoPointer(v) && !isPinned(v) {
   174  					throw(cgoWriteBarrierFail)
   175  				}
   176  			}
   177  		}
   178  	}
   179  }
   180  
   181  // cgoCheckUsingType is like cgoCheckTypedBlock, but is a last ditch
   182  // fall back to look for pointers in src using the type information.
   183  // We only use this when looking at a value on the stack when the type
   184  // uses a GC program, because otherwise it's more efficient to use the
   185  // GC bits. This is called on the system stack.
   186  //
   187  //go:nowritebarrier
   188  //go:systemstack
   189  func cgoCheckUsingType(typ *_type, src unsafe.Pointer, off, size uintptr) {
   190  	if !typ.Pointers() {
   191  		return
   192  	}
   193  
   194  	// Anything past typ.PtrBytes is not a pointer.
   195  	if typ.PtrBytes <= off {
   196  		return
   197  	}
   198  	if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
   199  		size = ptrdataSize
   200  	}
   201  
   202  	cgoCheckBits(src, getGCMask(typ), off, size)
   203  }
   204
View as plain text