// SPDX-License-Identifier: (BSD-2-Clause OR Apache-2.0) OR MIT//// Copyright 2022 The Fuchsia Authors//// Licensed under a BSD-style license <LICENSE-BSD>, Apache License, Version 2.0// <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT// license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option.// This file may not be copied, modified, or distributed except according to// those terms. //! Utilities used by macros and by `zerocopy-derive`.//!//! These are defined here `zerocopy` rather than in code generated by macros or//! by `zerocopy-derive` so that they can be compiled once rather than//! recompiled for every invocation (e.g., if they were defined in generated//! code, then deriving `IntoBytes` and `FromBytes` on three different types//! would result in the code in question being emitted and compiled six//! different times). #![allow(missing_debug_implementations)] // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove// this `cfg` when `size_of_val_raw` is stabilized.#[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[cfg(not(target_pointer_width = "16"))]use core::ptr::{self, NonNull};use core::{marker::PhantomData, mem, num::Wrapping}; use crate::{ pointer::{ cast::CastSized, invariant::{Aligned, Initialized, Valid}, BecauseImmutable, }, FromBytes, Immutable, IntoBytes, KnownLayout, Ptr, ReadOnly, TryFromBytes, ValidityError,}; /// Projects the type of the field at `Index` in `Self` without regard for field/// privacy.////// The `Index` parameter is any sort of handle that identifies the field; its/// definition is the obligation of the implementer.////// # Safety////// Unsafe code may assume that this accurately reflects the definition of/// `Self`.pub unsafe trait Field<Index> { /// The type of the field at `Index`. type Type: ?Sized;} #[cfg_attr( not(no_zerocopy_diagnostic_on_unimplemented_1_78_0), diagnostic::on_unimplemented( message = "`{T}` has {PADDING_BYTES} total byte(s) of padding", label = "types with padding cannot implement `IntoBytes`", note = "consider using `zerocopy::Unalign` to lower the alignment of individual fields", note = "consider adding explicit fields where padding would be", note = "consider using `#[repr(packed)]` to remove padding" ))]pub trait PaddingFree<T: ?Sized, const PADDING_BYTES: usize> {}impl<T: ?Sized> PaddingFree<T, 0> for () {} // FIXME(#1112): In the slice DST case, we should delegate to *both*// `PaddingFree` *and* `DynamicPaddingFree` (and probably rename `PaddingFree`// to `StaticPaddingFree` or something - or introduce a third trait with that// name) so that we can have more clear error messages. #[cfg_attr( not(no_zerocopy_diagnostic_on_unimplemented_1_78_0), diagnostic::on_unimplemented( message = "`{T}` has one or more padding bytes", label = "types with padding cannot implement `IntoBytes`", note = "consider using `zerocopy::Unalign` to lower the alignment of individual fields", note = "consider adding explicit fields where padding would be", note = "consider using `#[repr(packed)]` to remove padding" ))]pub trait DynamicPaddingFree<T: ?Sized, const HAS_PADDING: bool> {}impl<T: ?Sized> DynamicPaddingFree<T, false> for () {} #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[cfg(not(target_pointer_width = "16"))]const _64K: usize = 1 << 16; // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove// this `cfg` when `size_of_val_raw` is stabilized.#[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[cfg(not(target_pointer_width = "16"))]#[repr(C, align(65536))]struct Aligned64kAllocation([u8; _64K]); /// A pointer to an aligned allocation of size 2^16.////// # Safety////// `ALIGNED_64K_ALLOCATION` is guaranteed to point to the entirety of an/// allocation with size and alignment 2^16, and to have valid provenance.// FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove// this `cfg` when `size_of_val_raw` is stabilized.#[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[cfg(not(target_pointer_width = "16"))]pub const ALIGNED_64K_ALLOCATION: NonNull<[u8]> = { const REF: &Aligned64kAllocation = &Aligned64kAllocation([0; _64K]); let ptr: *const Aligned64kAllocation = REF; let ptr: *const [u8] = ptr::slice_from_raw_parts(ptr.cast(), _64K); // SAFETY: // - `ptr` is derived from a Rust reference, which is guaranteed to be // non-null. // - `ptr` is derived from an `&Aligned64kAllocation`, which has size and // alignment `_64K` as promised. Its length is initialized to `_64K`, // which means that it refers to the entire allocation. // - `ptr` is derived from a Rust reference, which is guaranteed to have // valid provenance. // // FIXME(#429): Once `NonNull::new_unchecked` docs document that it // preserves provenance, cite those docs. // FIXME: Replace this `as` with `ptr.cast_mut()` once our MSRV >= 1.65 #[allow(clippy::as_conversions)] unsafe { NonNull::new_unchecked(ptr as *mut _) }}; /// Computes the offset of the base of the field `$trailing_field_name` within/// the type `$ty`.////// `trailing_field_offset!` produces code which is valid in a `const` context.// FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove// this `cfg` when `size_of_val_raw` is stabilized.#[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! trailing_field_offset { ($ty:ty, $trailing_field_name:tt) => {{ let min_size = { let zero_elems: *const [()] = $crate::util::macro_util::core_reexport::ptr::slice_from_raw_parts( $crate::util::macro_util::core_reexport::ptr::NonNull::<()>::dangling() .as_ptr() .cast_const(), 0, ); // SAFETY: // - If `$ty` is `Sized`, `size_of_val_raw` is always safe to call. // - Otherwise: // - If `$ty` is not a slice DST, this pointer conversion will // fail due to "mismatched vtable kinds", and compilation will // fail. // - If `$ty` is a slice DST, we have constructed `zero_elems` to // have zero trailing slice elements. Per the `size_of_val_raw` // docs, "For the special case where the dynamic tail length is // 0, this function is safe to call." [1] // // [1] https://doc.rust-lang.org/nightly/std/mem/fn.size_of_val_raw.html unsafe { #[allow(clippy::as_conversions)] $crate::util::macro_util::core_reexport::mem::size_of_val_raw( zero_elems as *const $ty, ) } }; assert!(min_size <= _64K); #[allow(clippy::as_conversions)] let ptr = ALIGNED_64K_ALLOCATION.as_ptr() as *const $ty; // SAFETY: // - Thanks to the preceding `assert!`, we know that the value with zero // elements fits in `_64K` bytes, and thus in the allocation addressed // by `ALIGNED_64K_ALLOCATION`. The offset of the trailing field is // guaranteed to be no larger than this size, so this field projection // is guaranteed to remain in-bounds of its allocation. // - Because the minimum size is no larger than `_64K` bytes, and // because an object's size must always be a multiple of its alignment // [1], we know that `$ty`'s alignment is no larger than `_64K`. The // allocation addressed by `ALIGNED_64K_ALLOCATION` is guaranteed to // be aligned to `_64K`, so `ptr` is guaranteed to satisfy `$ty`'s // alignment. // - As required by `addr_of!`, we do not write through `field`. // // Note that, as of [2], this requirement is technically unnecessary // for Rust versions >= 1.75.0, but no harm in guaranteeing it anyway // until we bump our MSRV. // // [1] Per https://doc.rust-lang.org/reference/type-layout.html: // // The size of a value is always a multiple of its alignment. // // [2] https://github.com/rust-lang/reference/pull/1387 let field = unsafe { $crate::util::macro_util::core_reexport::ptr::addr_of!((*ptr).$trailing_field_name) }; // SAFETY: // - Both `ptr` and `field` are derived from the same allocated object. // - By the preceding safety comment, `field` is in bounds of that // allocated object. // - The distance, in bytes, between `ptr` and `field` is required to be // a multiple of the size of `u8`, which is trivially true because // `u8`'s size is 1. // - The distance, in bytes, cannot overflow `isize`. This is guaranteed // because no allocated object can have a size larger than can fit in // `isize`. [1] // - The distance being in-bounds cannot rely on wrapping around the // address space. This is guaranteed because the same is guaranteed of // allocated objects. [1] // // [1] FIXME(#429), FIXME(https://github.com/rust-lang/rust/pull/116675): // Once these are guaranteed in the Reference, cite it. let offset = unsafe { field.cast::<u8>().offset_from(ptr.cast::<u8>()) }; // Guaranteed not to be lossy: `field` comes after `ptr`, so the offset // from `ptr` to `field` is guaranteed to be positive. assert!(offset >= 0); Some( #[allow(clippy::as_conversions)] { offset as usize }, ) }};} /// Computes alignment of `$ty: ?Sized`.////// `align_of!` produces code which is valid in a `const` context.// FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove// this `cfg` when `size_of_val_raw` is stabilized.#[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)]#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! align_of { ($ty:ty) => {{ // SAFETY: `OffsetOfTrailingIsAlignment` is `repr(C)`, and its layout is // guaranteed [1] to begin with the single-byte layout for `_byte`, // followed by the padding needed to align `_trailing`, then the layout // for `_trailing`, and finally any trailing padding bytes needed to // correctly-align the entire struct. // // This macro computes the alignment of `$ty` by counting the number of // bytes preceding `_trailing`. For instance, if the alignment of `$ty` // is `1`, then no padding is required align `_trailing` and it will be // located immediately after `_byte` at offset 1. If the alignment of // `$ty` is 2, then a single padding byte is required before // `_trailing`, and `_trailing` will be located at offset 2. // This correspondence between offset and alignment holds for all valid // Rust alignments, and we confirm this exhaustively (or, at least up to // the maximum alignment supported by `trailing_field_offset!`) in // `test_align_of_dst`. // // [1]: https://doc.rust-lang.org/nomicon/other-reprs.html#reprc #[repr(C)] struct OffsetOfTrailingIsAlignment { _byte: u8, _trailing: $ty, } trailing_field_offset!(OffsetOfTrailingIsAlignment, _trailing) }};} mod size_to_tag { pub trait SizeToTag<const SIZE: usize> { type Tag; } impl SizeToTag<1> for () { type Tag = u8; } impl SizeToTag<2> for () { type Tag = u16; } impl SizeToTag<4> for () { type Tag = u32; } impl SizeToTag<8> for () { type Tag = u64; } impl SizeToTag<16> for () { type Tag = u128; }} /// An alias for the unsigned integer of the given size in bytes.#[doc(hidden)]pub type SizeToTag<const SIZE: usize> = <() as size_to_tag::SizeToTag<SIZE>>::Tag; // We put `Sized` in its own module so it can have the same name as the standard// library `Sized` without shadowing it in the parent module.#[cfg(not(no_zerocopy_diagnostic_on_unimplemented_1_78_0))]mod __size_of { #[diagnostic::on_unimplemented( message = "`{Self}` is unsized", label = "`IntoBytes` needs all field types to be `Sized` in order to determine whether there is padding", note = "consider using `#[repr(packed)]` to remove padding", note = "`IntoBytes` does not require the fields of `#[repr(packed)]` types to be `Sized`" )] pub trait Sized: core::marker::Sized {} impl<T: core::marker::Sized> Sized for T {} #[inline(always)] #[must_use] #[allow(clippy::needless_maybe_sized)] pub const fn size_of<T: Sized + ?core::marker::Sized>() -> usize { core::mem::size_of::<T>() }} #[cfg(no_zerocopy_diagnostic_on_unimplemented_1_78_0)]pub use core::mem::size_of; #[cfg(not(no_zerocopy_diagnostic_on_unimplemented_1_78_0))]pub use __size_of::size_of; /// How many padding bytes does the struct type `$t` have?////// `$ts` is the list of the type of every field in `$t`. `$t` must be a struct/// type, or else `struct_padding!`'s result may be meaningless.////// Note that `struct_padding!`'s results are independent of `repcr` since they/// only consider the size of the type and the sizes of the fields. Whatever the/// repr, the size of the type already takes into account any padding that the/// compiler has decided to add. Structs with well-defined representations (such/// as `repr(C)`) can use this macro to check for padding. Note that while this/// may yield some consistent value for some `repr(Rust)` structs, it is not/// guaranteed across platforms or compilations.#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! struct_padding { ($t:ty, $_align:expr, $_packed:expr, [$($ts:ty),*]) => {{ // The `align` and `packed` directives can be ignored here. Regardless // of if and how they are set, comparing the size of `$t` to the sum of // its field sizes is a reliable indicator of the presence of padding. $crate::util::macro_util::size_of::<$t>() - (0 $(+ $crate::util::macro_util::size_of::<$ts>())*) }};} /// Does the `repr(C)` struct type `$t` have padding?////// `$ts` is the list of the type of every field in `$t`. `$t` must be a/// `repr(C)` struct type, or else `struct_has_padding!`'s result may be/// meaningless.#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! repr_c_struct_has_padding { ($t:ty, $align:expr, $packed:expr, [$($ts:tt),*]) => {{ let layout = $crate::DstLayout::for_repr_c_struct( $align, $packed, &[$($crate::repr_c_struct_has_padding!(@field $ts),)*] ); layout.requires_static_padding() || layout.requires_dynamic_padding() }}; (@field ([$t:ty])) => { <[$t] as $crate::KnownLayout>::LAYOUT }; (@field ($t:ty)) => { $crate::DstLayout::for_unpadded_type::<$t>() }; (@field [$t:ty]) => { <[$t] as $crate::KnownLayout>::LAYOUT }; (@field $t:ty) => { $crate::DstLayout::for_unpadded_type::<$t>() };} /// Does the union type `$t` have padding?////// `$ts` is the list of the type of every field in `$t`. `$t` must be a union/// type, or else `union_padding!`'s result may be meaningless.////// Note that `union_padding!`'s results are independent of `repr` since they/// only consider the size of the type and the sizes of the fields. Whatever the/// repr, the size of the type already takes into account any padding that the/// compiler has decided to add. Unions with well-defined representations (such/// as `repr(C)`) can use this macro to check for padding. Note that while this/// may yield some consistent value for some `repr(Rust)` unions, it is not/// guaranteed across platforms or compilations.#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! union_padding { ($t:ty, $_align:expr, $_packed:expr, [$($ts:ty),*]) => {{ // The `align` and `packed` directives can be ignored here. Regardless // of if and how they are set, comparing the size of `$t` to each of its // field sizes is a reliable indicator of the presence of padding. let mut max = 0; $({ let padding = $crate::util::macro_util::size_of::<$t>() - $crate::util::macro_util::size_of::<$ts>(); if padding > max { max = padding; } })* max }};} /// How many padding bytes does the enum type `$t` have?////// `$disc` is the type of the enum tag, and `$ts` is a list of fields in each/// square-bracket-delimited variant. `$t` must be an enum, or else/// `enum_padding!`'s result may be meaningless. An enum has padding if any of/// its variant structs [1][2] contain padding, and so all of the variants of an/// enum must be "full" in order for the enum to not have padding.////// The results of `enum_padding!` require that the enum is not `repr(Rust)`, as/// `repr(Rust)` enums may niche the enum's tag and reduce the total number of/// bytes required to represent the enum as a result. As long as the enum is/// `repr(C)`, `repr(int)`, or `repr(C, int)`, this will consistently return/// whether the enum contains any padding bytes.////// [1]: https://doc.rust-lang.org/1.81.0/reference/type-layout.html#reprc-enums-with-fields/// [2]: https://doc.rust-lang.org/1.81.0/reference/type-layout.html#primitive-representation-of-enums-with-fields#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! enum_padding { ($t:ty, $_align:expr, $packed:expr, $disc:ty, $([$($ts:ty),*]),*) => {{ // The `align` and `packed` directives are irrelevant. `$align` can be // ignored because regardless of if and how it is set, comparing the // size of `$t` to each of its field sizes is a reliable indicator of // the presence of padding. `$packed` is irrelevant because it is // forbidden on enums. #[allow(clippy::as_conversions)] const _: [(); 1] = [(); $packed.is_none() as usize]; let mut max = 0; $({ let padding = $crate::util::macro_util::size_of::<$t>() - ( $crate::util::macro_util::size_of::<$disc>() $(+ $crate::util::macro_util::size_of::<$ts>())* ); if padding > max { max = padding; } })* max }};} /// Unwraps an infallible `Result`.#[doc(hidden)]#[macro_export]macro_rules! into_inner { ($e:expr) => { match $e { $crate::util::macro_util::core_reexport::result::Result::Ok(e) => e, $crate::util::macro_util::core_reexport::result::Result::Err(i) => match i {}, } };} /// Translates an identifier or tuple index into a numeric identifier.#[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`.#[macro_export]macro_rules! ident_id { ($field:ident) => { $crate::util::macro_util::hash_name(stringify!($field)) }; ($field:literal) => { $field };} /// Computes the hash of a string.////// NOTE(#2749) on hash collisions: This function's output only needs to be/// deterministic within a particular compilation. Thus, if a user ever reports/// a hash collision (very unlikely given the <= 16-byte special case), we can/// strengthen the hash function at that point and publish a new version. Since/// this is computed at compile time on small strings, we can easily use more/// expensive and higher-quality hash functions if need be.#[inline(always)]#[must_use]#[allow(clippy::as_conversions, clippy::indexing_slicing, clippy::arithmetic_side_effects)]pub const fn hash_name(name: &str) -> i128 { let name = name.as_bytes(); // We guarantee freedom from hash collisions between any two strings of // length 16 or less by having the hashes of such strings be equal to // their value. There is still a possibility that such strings will have // the same value as the hash of a string of length > 16. if name.len() <= size_of::<u128>() { let mut bytes = [0u8; 16]; let mut i = 0; while i < name.len() { bytes[i] = name[i]; i += 1; } return i128::from_ne_bytes(bytes); }; // An implementation of FxHasher, although returning a u128. Probably // not as strong as it could be, but probably more collision resistant // than normal 64-bit FxHasher.Lines 1–500 of 1310. Load more
// SPDX-License-Identifier: (BSD-2-Clause OR Apache-2.0) OR MIT // // Copyright 2022 The Fuchsia Authors // // Licensed under a BSD-style license <LICENSE-BSD>, Apache License, Version 2.0 // <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT // license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option. // This file may not be copied, modified, or distributed except according to // those terms. //! Utilities used by macros and by `zerocopy-derive`. //! //! These are defined here `zerocopy` rather than in code generated by macros or //! by `zerocopy-derive` so that they can be compiled once rather than //! recompiled for every invocation (e.g., if they were defined in generated //! code, then deriving `IntoBytes` and `FromBytes` on three different types //! would result in the code in question being emitted and compiled six //! different times). #![allow(missing_debug_implementations)] // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove // this `cfg` when `size_of_val_raw` is stabilized. #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[cfg(not(target_pointer_width = "16"))] use core::ptr::{self, NonNull}; use core::{marker::PhantomData, mem, num::Wrapping}; use crate::{ pointer::{ cast::CastSized, invariant::{Aligned, Initialized, Valid}, BecauseImmutable, }, FromBytes, Immutable, IntoBytes, KnownLayout, Ptr, ReadOnly, TryFromBytes, ValidityError, }; /// Projects the type of the field at `Index` in `Self` without regard for field /// privacy. /// /// The `Index` parameter is any sort of handle that identifies the field; its /// definition is the obligation of the implementer. /// /// # Safety /// /// Unsafe code may assume that this accurately reflects the definition of /// `Self`. pub unsafe trait Field<Index> { /// The type of the field at `Index`. type Type: ?Sized; } #[cfg_attr( not(no_zerocopy_diagnostic_on_unimplemented_1_78_0), diagnostic::on_unimplemented( message = "`{T}` has {PADDING_BYTES} total byte(s) of padding", label = "types with padding cannot implement `IntoBytes`", note = "consider using `zerocopy::Unalign` to lower the alignment of individual fields", note = "consider adding explicit fields where padding would be", note = "consider using `#[repr(packed)]` to remove padding" ) )] pub trait PaddingFree<T: ?Sized, const PADDING_BYTES: usize> {} impl<T: ?Sized> PaddingFree<T, 0> for () {} // FIXME(#1112): In the slice DST case, we should delegate to *both* // `PaddingFree` *and* `DynamicPaddingFree` (and probably rename `PaddingFree` // to `StaticPaddingFree` or something - or introduce a third trait with that // name) so that we can have more clear error messages. #[cfg_attr( not(no_zerocopy_diagnostic_on_unimplemented_1_78_0), diagnostic::on_unimplemented( message = "`{T}` has one or more padding bytes", label = "types with padding cannot implement `IntoBytes`", note = "consider using `zerocopy::Unalign` to lower the alignment of individual fields", note = "consider adding explicit fields where padding would be", note = "consider using `#[repr(packed)]` to remove padding" ) )] pub trait DynamicPaddingFree<T: ?Sized, const HAS_PADDING: bool> {} impl<T: ?Sized> DynamicPaddingFree<T, false> for () {} #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[cfg(not(target_pointer_width = "16"))] const _64K: usize = 1 << 16; // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove // this `cfg` when `size_of_val_raw` is stabilized. #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[cfg(not(target_pointer_width = "16"))] #[repr(C, align(65536))] struct Aligned64kAllocation([u8; _64K]); /// A pointer to an aligned allocation of size 2^16. /// /// # Safety /// /// `ALIGNED_64K_ALLOCATION` is guaranteed to point to the entirety of an /// allocation with size and alignment 2^16, and to have valid provenance. // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove // this `cfg` when `size_of_val_raw` is stabilized. #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[cfg(not(target_pointer_width = "16"))] pub const ALIGNED_64K_ALLOCATION: NonNull<[u8]> = { const REF: &Aligned64kAllocation = &Aligned64kAllocation([0; _64K]); let ptr: *const Aligned64kAllocation = REF; let ptr: *const [u8] = ptr::slice_from_raw_parts(ptr.cast(), _64K); // SAFETY: // - `ptr` is derived from a Rust reference, which is guaranteed to be // non-null. // - `ptr` is derived from an `&Aligned64kAllocation`, which has size and // alignment `_64K` as promised. Its length is initialized to `_64K`, // which means that it refers to the entire allocation. // - `ptr` is derived from a Rust reference, which is guaranteed to have // valid provenance. // // FIXME(#429): Once `NonNull::new_unchecked` docs document that it // preserves provenance, cite those docs. // FIXME: Replace this `as` with `ptr.cast_mut()` once our MSRV >= 1.65 #[allow(clippy::as_conversions)] unsafe { NonNull::new_unchecked(ptr as *mut _) } }; /// Computes the offset of the base of the field `$trailing_field_name` within /// the type `$ty`. /// /// `trailing_field_offset!` produces code which is valid in a `const` context. // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove // this `cfg` when `size_of_val_raw` is stabilized. #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! trailing_field_offset { ($ty:ty, $trailing_field_name:tt) => {{ let min_size = { let zero_elems: *const [()] = $crate::util::macro_util::core_reexport::ptr::slice_from_raw_parts( $crate::util::macro_util::core_reexport::ptr::NonNull::<()>::dangling() .as_ptr() .cast_const(), 0, ); // SAFETY: // - If `$ty` is `Sized`, `size_of_val_raw` is always safe to call. // - Otherwise: // - If `$ty` is not a slice DST, this pointer conversion will // fail due to "mismatched vtable kinds", and compilation will // fail. // - If `$ty` is a slice DST, we have constructed `zero_elems` to // have zero trailing slice elements. Per the `size_of_val_raw` // docs, "For the special case where the dynamic tail length is // 0, this function is safe to call." [1] // // [1] https://doc.rust-lang.org/nightly/std/mem/fn.size_of_val_raw.html unsafe { #[allow(clippy::as_conversions)] $crate::util::macro_util::core_reexport::mem::size_of_val_raw( zero_elems as *const $ty, ) } }; assert!(min_size <= _64K); #[allow(clippy::as_conversions)] let ptr = ALIGNED_64K_ALLOCATION.as_ptr() as *const $ty; // SAFETY: // - Thanks to the preceding `assert!`, we know that the value with zero // elements fits in `_64K` bytes, and thus in the allocation addressed // by `ALIGNED_64K_ALLOCATION`. The offset of the trailing field is // guaranteed to be no larger than this size, so this field projection // is guaranteed to remain in-bounds of its allocation. // - Because the minimum size is no larger than `_64K` bytes, and // because an object's size must always be a multiple of its alignment // [1], we know that `$ty`'s alignment is no larger than `_64K`. The // allocation addressed by `ALIGNED_64K_ALLOCATION` is guaranteed to // be aligned to `_64K`, so `ptr` is guaranteed to satisfy `$ty`'s // alignment. // - As required by `addr_of!`, we do not write through `field`. // // Note that, as of [2], this requirement is technically unnecessary // for Rust versions >= 1.75.0, but no harm in guaranteeing it anyway // until we bump our MSRV. // // [1] Per https://doc.rust-lang.org/reference/type-layout.html: // // The size of a value is always a multiple of its alignment. // // [2] https://github.com/rust-lang/reference/pull/1387 let field = unsafe { $crate::util::macro_util::core_reexport::ptr::addr_of!((*ptr).$trailing_field_name) }; // SAFETY: // - Both `ptr` and `field` are derived from the same allocated object. // - By the preceding safety comment, `field` is in bounds of that // allocated object. // - The distance, in bytes, between `ptr` and `field` is required to be // a multiple of the size of `u8`, which is trivially true because // `u8`'s size is 1. // - The distance, in bytes, cannot overflow `isize`. This is guaranteed // because no allocated object can have a size larger than can fit in // `isize`. [1] // - The distance being in-bounds cannot rely on wrapping around the // address space. This is guaranteed because the same is guaranteed of // allocated objects. [1] // // [1] FIXME(#429), FIXME(https://github.com/rust-lang/rust/pull/116675): // Once these are guaranteed in the Reference, cite it. let offset = unsafe { field.cast::<u8>().offset_from(ptr.cast::<u8>()) }; // Guaranteed not to be lossy: `field` comes after `ptr`, so the offset // from `ptr` to `field` is guaranteed to be positive. assert!(offset >= 0); Some( #[allow(clippy::as_conversions)] { offset as usize }, ) }}; } /// Computes alignment of `$ty: ?Sized`. /// /// `align_of!` produces code which is valid in a `const` context. // FIXME(#29), FIXME(https://github.com/rust-lang/rust/issues/69835): Remove // this `cfg` when `size_of_val_raw` is stabilized. #[cfg(__ZEROCOPY_INTERNAL_USE_ONLY_NIGHTLY_FEATURES_IN_TESTS)] #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! align_of { ($ty:ty) => {{ // SAFETY: `OffsetOfTrailingIsAlignment` is `repr(C)`, and its layout is // guaranteed [1] to begin with the single-byte layout for `_byte`, // followed by the padding needed to align `_trailing`, then the layout // for `_trailing`, and finally any trailing padding bytes needed to // correctly-align the entire struct. // // This macro computes the alignment of `$ty` by counting the number of // bytes preceding `_trailing`. For instance, if the alignment of `$ty` // is `1`, then no padding is required align `_trailing` and it will be // located immediately after `_byte` at offset 1. If the alignment of // `$ty` is 2, then a single padding byte is required before // `_trailing`, and `_trailing` will be located at offset 2. // This correspondence between offset and alignment holds for all valid // Rust alignments, and we confirm this exhaustively (or, at least up to // the maximum alignment supported by `trailing_field_offset!`) in // `test_align_of_dst`. // // [1]: https://doc.rust-lang.org/nomicon/other-reprs.html#reprc #[repr(C)] struct OffsetOfTrailingIsAlignment { _byte: u8, _trailing: $ty, } trailing_field_offset!(OffsetOfTrailingIsAlignment, _trailing) }}; } mod size_to_tag { pub trait SizeToTag<const SIZE: usize> { type Tag; } impl SizeToTag<1> for () { type Tag = u8; } impl SizeToTag<2> for () { type Tag = u16; } impl SizeToTag<4> for () { type Tag = u32; } impl SizeToTag<8> for () { type Tag = u64; } impl SizeToTag<16> for () { type Tag = u128; } } /// An alias for the unsigned integer of the given size in bytes. #[doc(hidden)] pub type SizeToTag<const SIZE: usize> = <() as size_to_tag::SizeToTag<SIZE>>::Tag; // We put `Sized` in its own module so it can have the same name as the standard // library `Sized` without shadowing it in the parent module. #[cfg(not(no_zerocopy_diagnostic_on_unimplemented_1_78_0))] mod __size_of { #[diagnostic::on_unimplemented( message = "`{Self}` is unsized", label = "`IntoBytes` needs all field types to be `Sized` in order to determine whether there is padding", note = "consider using `#[repr(packed)]` to remove padding", note = "`IntoBytes` does not require the fields of `#[repr(packed)]` types to be `Sized`" )] pub trait Sized: core::marker::Sized {} impl<T: core::marker::Sized> Sized for T {} #[inline(always)] #[must_use] #[allow(clippy::needless_maybe_sized)] pub const fn size_of<T: Sized + ?core::marker::Sized>() -> usize { core::mem::size_of::<T>() } } #[cfg(no_zerocopy_diagnostic_on_unimplemented_1_78_0)] pub use core::mem::size_of; #[cfg(not(no_zerocopy_diagnostic_on_unimplemented_1_78_0))] pub use __size_of::size_of; /// How many padding bytes does the struct type `$t` have? /// /// `$ts` is the list of the type of every field in `$t`. `$t` must be a struct /// type, or else `struct_padding!`'s result may be meaningless. /// /// Note that `struct_padding!`'s results are independent of `repcr` since they /// only consider the size of the type and the sizes of the fields. Whatever the /// repr, the size of the type already takes into account any padding that the /// compiler has decided to add. Structs with well-defined representations (such /// as `repr(C)`) can use this macro to check for padding. Note that while this /// may yield some consistent value for some `repr(Rust)` structs, it is not /// guaranteed across platforms or compilations. #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! struct_padding { ($t:ty, $_align:expr, $_packed:expr, [$($ts:ty),*]) => {{ // The `align` and `packed` directives can be ignored here. Regardless // of if and how they are set, comparing the size of `$t` to the sum of // its field sizes is a reliable indicator of the presence of padding. $crate::util::macro_util::size_of::<$t>() - (0 $(+ $crate::util::macro_util::size_of::<$ts>())*) }}; } /// Does the `repr(C)` struct type `$t` have padding? /// /// `$ts` is the list of the type of every field in `$t`. `$t` must be a /// `repr(C)` struct type, or else `struct_has_padding!`'s result may be /// meaningless. #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! repr_c_struct_has_padding { ($t:ty, $align:expr, $packed:expr, [$($ts:tt),*]) => {{ let layout = $crate::DstLayout::for_repr_c_struct( $align, $packed, &[$($crate::repr_c_struct_has_padding!(@field $ts),)*] ); layout.requires_static_padding() || layout.requires_dynamic_padding() }}; (@field ([$t:ty])) => { <[$t] as $crate::KnownLayout>::LAYOUT }; (@field ($t:ty)) => { $crate::DstLayout::for_unpadded_type::<$t>() }; (@field [$t:ty]) => { <[$t] as $crate::KnownLayout>::LAYOUT }; (@field $t:ty) => { $crate::DstLayout::for_unpadded_type::<$t>() }; } /// Does the union type `$t` have padding? /// /// `$ts` is the list of the type of every field in `$t`. `$t` must be a union /// type, or else `union_padding!`'s result may be meaningless. /// /// Note that `union_padding!`'s results are independent of `repr` since they /// only consider the size of the type and the sizes of the fields. Whatever the /// repr, the size of the type already takes into account any padding that the /// compiler has decided to add. Unions with well-defined representations (such /// as `repr(C)`) can use this macro to check for padding. Note that while this /// may yield some consistent value for some `repr(Rust)` unions, it is not /// guaranteed across platforms or compilations. #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! union_padding { ($t:ty, $_align:expr, $_packed:expr, [$($ts:ty),*]) => {{ // The `align` and `packed` directives can be ignored here. Regardless // of if and how they are set, comparing the size of `$t` to each of its // field sizes is a reliable indicator of the presence of padding. let mut max = 0; $({ let padding = $crate::util::macro_util::size_of::<$t>() - $crate::util::macro_util::size_of::<$ts>(); if padding > max { max = padding; } })* max }}; } /// How many padding bytes does the enum type `$t` have? /// /// `$disc` is the type of the enum tag, and `$ts` is a list of fields in each /// square-bracket-delimited variant. `$t` must be an enum, or else /// `enum_padding!`'s result may be meaningless. An enum has padding if any of /// its variant structs [1][2] contain padding, and so all of the variants of an /// enum must be "full" in order for the enum to not have padding. /// /// The results of `enum_padding!` require that the enum is not `repr(Rust)`, as /// `repr(Rust)` enums may niche the enum's tag and reduce the total number of /// bytes required to represent the enum as a result. As long as the enum is /// `repr(C)`, `repr(int)`, or `repr(C, int)`, this will consistently return /// whether the enum contains any padding bytes. /// /// [1]: https://doc.rust-lang.org/1.81.0/reference/type-layout.html#reprc-enums-with-fields /// [2]: https://doc.rust-lang.org/1.81.0/reference/type-layout.html#primitive-representation-of-enums-with-fields #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! enum_padding { ($t:ty, $_align:expr, $packed:expr, $disc:ty, $([$($ts:ty),*]),*) => {{ // The `align` and `packed` directives are irrelevant. `$align` can be // ignored because regardless of if and how it is set, comparing the // size of `$t` to each of its field sizes is a reliable indicator of // the presence of padding. `$packed` is irrelevant because it is // forbidden on enums. #[allow(clippy::as_conversions)] const _: [(); 1] = [(); $packed.is_none() as usize]; let mut max = 0; $({ let padding = $crate::util::macro_util::size_of::<$t>() - ( $crate::util::macro_util::size_of::<$disc>() $(+ $crate::util::macro_util::size_of::<$ts>())* ); if padding > max { max = padding; } })* max }}; } /// Unwraps an infallible `Result`. #[doc(hidden)] #[macro_export] macro_rules! into_inner { ($e:expr) => { match $e { $crate::util::macro_util::core_reexport::result::Result::Ok(e) => e, $crate::util::macro_util::core_reexport::result::Result::Err(i) => match i {}, } }; } /// Translates an identifier or tuple index into a numeric identifier. #[doc(hidden)] // `#[macro_export]` bypasses this module's `#[doc(hidden)]`. #[macro_export] macro_rules! ident_id { ($field:ident) => { $crate::util::macro_util::hash_name(stringify!($field)) }; ($field:literal) => { $field }; } /// Computes the hash of a string. /// /// NOTE(#2749) on hash collisions: This function's output only needs to be /// deterministic within a particular compilation. Thus, if a user ever reports /// a hash collision (very unlikely given the <= 16-byte special case), we can /// strengthen the hash function at that point and publish a new version. Since /// this is computed at compile time on small strings, we can easily use more /// expensive and higher-quality hash functions if need be. #[inline(always)] #[must_use] #[allow(clippy::as_conversions, clippy::indexing_slicing, clippy::arithmetic_side_effects)] pub const fn hash_name(name: &str) -> i128 { let name = name.as_bytes(); // We guarantee freedom from hash collisions between any two strings of // length 16 or less by having the hashes of such strings be equal to // their value. There is still a possibility that such strings will have // the same value as the hash of a string of length > 16. if name.len() <= size_of::<u128>() { let mut bytes = [0u8; 16]; let mut i = 0; while i < name.len() { bytes[i] = name[i]; i += 1; } return i128::from_ne_bytes(bytes); }; // An implementation of FxHasher, although returning a u128. Probably // not as strong as it could be, but probably more collision resistant // than normal 64-bit FxHasher.