1 // Copyright 2009 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
5 // Cgo call and callback support.
10 "runtime/internal/sys"
14 // Functions called by cgo-generated code.
15 //go:linkname cgoCheckPointer runtime.cgoCheckPointer
16 //go:linkname cgoCheckResult runtime.cgoCheckResult
18 // Pointer checking for cgo code.
20 // We want to detect all cases where a program that does not use
21 // unsafe makes a cgo call passing a Go pointer to memory that
22 // contains a Go pointer. Here a Go pointer is defined as a pointer
23 // to memory allocated by the Go runtime. Programs that use unsafe
24 // can evade this restriction easily, so we don't try to catch them.
25 // The cgo program will rewrite all possibly bad pointer arguments to
26 // call cgoCheckPointer, where we can catch cases of a Go pointer
27 // pointing to a Go pointer.
29 // Complicating matters, taking the address of a slice or array
30 // element permits the C program to access all elements of the slice
31 // or array. In that case we will see a pointer to a single element,
32 // but we need to check the entire data structure.
34 // The cgoCheckPointer call takes additional arguments indicating that
35 // it was called on an address expression. An additional argument of
36 // true means that it only needs to check a single element. An
37 // additional argument of a slice or array means that it needs to
38 // check the entire slice/array, but nothing else. Otherwise, the
39 // pointer could be anything, and we check the entire heap object,
40 // which is conservative but safe.
42 // When and if we implement a moving garbage collector,
43 // cgoCheckPointer will pin the pointer for the duration of the cgo
44 // call. (This is necessary but not sufficient; the cgo program will
45 // also have to change to pin Go pointers that cannot point to Go
48 // cgoCheckPointer checks if the argument contains a Go pointer that
49 // points to a Go pointer, and panics if it does.
50 func cgoCheckPointer(ptr
interface{}, args
...interface{}) {
51 if debug
.cgocheck
== 0 {
55 ep
:= (*eface
)(unsafe
.Pointer(&ptr
))
59 if len(args
) > 0 && (t
.kind
&kindMask
== kindPtr || t
.kind
&kindMask
== kindUnsafePointer
) {
61 if t
.kind
&kindDirectIface
== 0 {
62 p
= *(*unsafe
.Pointer
)(p
)
64 if !cgoIsGoPointer(p
) {
67 aep
:= (*eface
)(unsafe
.Pointer(&args
[0]))
68 switch aep
._type
.kind
& kindMask
{
70 if t
.kind
&kindMask
== kindUnsafePointer
{
71 // We don't know the type of the element.
74 pt
:= (*ptrtype
)(unsafe
.Pointer(t
))
75 cgoCheckArg(pt
.elem
, p
, true, false, cgoCheckPointerFail
)
78 // Check the slice rather than the pointer.
82 // Check the array rather than the pointer.
83 // Pass top as false since we have a pointer
93 cgoCheckArg(t
, ep
.data
, t
.kind
&kindDirectIface
== 0, top
, cgoCheckPointerFail
)
96 const cgoCheckPointerFail
= "cgo argument has Go pointer to Go pointer"
97 const cgoResultFail
= "cgo result has Go pointer"
99 // cgoCheckArg is the real work of cgoCheckPointer. The argument p
100 // is either a pointer to the value (of type t), or the value itself,
101 // depending on indir. The top parameter is whether we are at the top
102 // level, where Go pointers are allowed.
103 func cgoCheckArg(t
*_type
, p unsafe
.Pointer
, indir
, top
bool, msg
string) {
104 if t
.kind
&kindNoPointers
!= 0 {
105 // If the type has no pointers there is nothing to do.
109 switch t
.kind
& kindMask
{
111 throw("can't happen")
113 at
:= (*arraytype
)(unsafe
.Pointer(t
))
116 throw("can't happen")
118 cgoCheckArg(at
.elem
, p
, at
.elem
.kind
&kindDirectIface
== 0, top
, msg
)
121 for i
:= uintptr(0); i
< at
.len; i
++ {
122 cgoCheckArg(at
.elem
, p
, true, top
, msg
)
123 p
= add(p
, at
.elem
.size
)
125 case kindChan
, kindMap
:
126 // These types contain internal pointers that will
127 // always be allocated in the Go heap. It's never OK
128 // to pass them to C.
129 panic(errorString(msg
))
132 p
= *(*unsafe
.Pointer
)(p
)
134 if !cgoIsGoPointer(p
) {
137 panic(errorString(msg
))
143 // A type known at compile time is OK since it's
144 // constant. A type not known at compile time will be
145 // in the heap and will not be OK.
146 if inheap(uintptr(unsafe
.Pointer(it
))) {
147 panic(errorString(msg
))
149 p
= *(*unsafe
.Pointer
)(add(p
, sys
.PtrSize
))
150 if !cgoIsGoPointer(p
) {
154 panic(errorString(msg
))
156 cgoCheckArg(it
, p
, it
.kind
&kindDirectIface
== 0, false, msg
)
158 st
:= (*slicetype
)(unsafe
.Pointer(t
))
161 if !cgoIsGoPointer(p
) {
165 panic(errorString(msg
))
167 if st
.elem
.kind
&kindNoPointers
!= 0 {
170 for i
:= 0; i
< s
.cap; i
++ {
171 cgoCheckArg(st
.elem
, p
, true, false, msg
)
172 p
= add(p
, st
.elem
.size
)
175 ss
:= (*stringStruct
)(p
)
176 if !cgoIsGoPointer(ss
.str
) {
180 panic(errorString(msg
))
183 st
:= (*structtype
)(unsafe
.Pointer(t
))
185 if len(st
.fields
) != 1 {
186 throw("can't happen")
188 cgoCheckArg(st
.fields
[0].typ
, p
, st
.fields
[0].typ
.kind
&kindDirectIface
== 0, top
, msg
)
191 for _
, f
:= range st
.fields
{
192 cgoCheckArg(f
.typ
, add(p
, f
.offset
), true, top
, msg
)
194 case kindPtr
, kindUnsafePointer
:
196 p
= *(*unsafe
.Pointer
)(p
)
199 if !cgoIsGoPointer(p
) {
203 panic(errorString(msg
))
206 cgoCheckUnknownPointer(p
, msg
)
210 // cgoCheckUnknownPointer is called for an arbitrary pointer into Go
211 // memory. It checks whether that Go memory contains any other
212 // pointer into Go memory. If it does, we panic.
213 // The return values are unused but useful to see in panic tracebacks.
214 func cgoCheckUnknownPointer(p unsafe
.Pointer
, msg
string) (base
, i
uintptr) {
215 if cgoInRange(p
, mheap_
.arena_start
, mheap_
.arena_used
) {
216 if !inheap(uintptr(p
)) {
217 // On 32-bit systems it is possible for C's allocated memory
218 // to have addresses between arena_start and arena_used.
219 // Either this pointer is a stack or an unused span or it's
220 // a C allocation. Escape analysis should prevent the first,
221 // garbage collection should prevent the second,
222 // and the third is completely OK.
226 b
, hbits
, span
, _
:= heapBitsForObject(uintptr(p
), 0, 0, false)
232 for i
= uintptr(0); i
< n
; i
+= sys
.PtrSize
{
233 if i
!= 1*sys
.PtrSize
&& !hbits
.morePointers() {
234 // No more possible pointers.
237 if hbits
.isPointer() && cgoIsGoPointer(*(*unsafe
.Pointer
)(unsafe
.Pointer(base
+ i
))) {
238 panic(errorString(msg
))
248 for j
:= 0; j
< roots
.count
; j
++ {
250 addr
:= uintptr(pr
.decl
)
251 if cgoInRange(p
, addr
, addr
+pr
.size
) {
252 cgoCheckBits(pr
.decl
, pr
.gcdata
, 0, pr
.ptrdata
)
262 // cgoIsGoPointer returns whether the pointer is a Go pointer--a
263 // pointer to Go memory. We only care about Go memory that might
266 //go:nowritebarrierrec
267 func cgoIsGoPointer(p unsafe
.Pointer
) bool {
272 if inHeapOrStack(uintptr(p
)) {
278 for i
:= 0; i
< roots
.count
; i
++ {
280 addr
:= uintptr(pr
.decl
)
281 if cgoInRange(p
, addr
, addr
+pr
.size
) {
291 // cgoInRange returns whether p is between start and end.
293 //go:nowritebarrierrec
294 func cgoInRange(p unsafe
.Pointer
, start
, end
uintptr) bool {
295 return start
<= uintptr(p
) && uintptr(p
) < end
298 // cgoCheckResult is called to check the result parameter of an
299 // exported Go function. It panics if the result is or contains a Go
301 func cgoCheckResult(val
interface{}) {
302 if debug
.cgocheck
== 0 {
306 ep
:= (*eface
)(unsafe
.Pointer(&val
))
308 cgoCheckArg(t
, ep
.data
, t
.kind
&kindDirectIface
== 0, false, cgoResultFail
)