mikros/rust
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rename ptr::from_exposed_addr -> ptr::with_exposed_provenance

Browse Source
This commit is contained in:
Ralf Jung 2024-03-23 11:47:11 +01:00
parent c3b05c6e5b
commit 67b9d7d184
31 changed files with 85 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
compiler/rustc_hir_typeck/messages.ftl
View File

@ -86,7 +86,7 @@ hir_typeck_invalid_callee = expected function, found {$ty}
hir_typeck_lossy_provenance_int2ptr =
strict provenance disallows casting integer `{$expr_ty}` to pointer `{$cast_ty}`
.suggestion = use `.with_addr()` to adjust a valid pointer in the same allocation, to this address
.help = if you can't comply with strict provenance and don't have a pointer with the correct provenance you can use `std::ptr::from_exposed_addr()` instead
.help = if you can't comply with strict provenance and don't have a pointer with the correct provenance you can use `std::ptr::with_exposed_provenance()` instead
hir_typeck_lossy_provenance_ptr2int =
under strict provenance it is considered bad style to cast pointer `{$expr_ty}` to integer `{$cast_ty}`

6
compiler/rustc_lint_defs/src/builtin.rs
View File

@ -2749,7 +2749,7 @@
/// memory the pointer is allowed to read/write. Casting an integer, which
/// doesn't have provenance, to a pointer requires the compiler to assign
/// (guess) provenance. The compiler assigns "all exposed valid" (see the
/// docs of [`ptr::from_exposed_addr`] for more information about this
/// docs of [`ptr::with_exposed_provenance`] for more information about this
/// "exposing"). This penalizes the optimiser and is not well suited for
/// dynamic analysis/dynamic program verification (e.g. Miri or CHERI
/// platforms).
@ -2757,11 +2757,11 @@
/// It is much better to use [`ptr::with_addr`] instead to specify the
/// provenance you want. If using this function is not possible because the
/// code relies on exposed provenance then there is as an escape hatch
/// [`ptr::from_exposed_addr`].
/// [`ptr::with_exposed_provenance`].
///
/// [issue #95228]: https://github.com/rust-lang/rust/issues/95228
/// [`ptr::with_addr`]: https://doc.rust-lang.org/core/primitive.pointer.html#method.with_addr
/// [`ptr::from_exposed_addr`]: https://doc.rust-lang.org/core/ptr/fn.from_exposed_addr.html
/// [`ptr::with_exposed_provenance`]: https://doc.rust-lang.org/core/ptr/fn.with_exposed_provenance.html
pub FUZZY_PROVENANCE_CASTS,
Allow,
"a fuzzy integer to pointer cast is used",

2
compiler/rustc_middle/src/mir/syntax.rs
View File

@ -1318,7 +1318,7 @@ pub enum CastKind {
/// See the docs on `expose_addr` for more details.
PointerExposeAddress,
/// An address-to-pointer cast that picks up an exposed provenance.
/// See the docs on `from_exposed_addr` for more details.
/// See the docs on `with_exposed_provenance` for more details.
PointerFromExposedAddress,
/// Pointer related casts that are done by coercions. Note that reference-to-raw-ptr casts are
/// translated into `&raw mut/const *r`, i.e., they are not actually casts.

14
library/core/src/ptr/const_ptr.rs
View File

@ -165,7 +165,7 @@ pub fn to_bits(self) -> usize
#[unstable(feature = "ptr_to_from_bits", issue = "91126")]
#[deprecated(
since = "1.67.0",
note = "replaced by the `ptr::from_exposed_addr` function, or update \
note = "replaced by the `ptr::with_exposed_provenance` function, or update \
your code to follow the strict provenance rules using its APIs"
)]
#[allow(fuzzy_provenance_casts)] // this is an unstable and semi-deprecated cast function
@ -187,7 +187,7 @@ pub fn from_bits(bits: usize) -> Self
///
/// If using those APIs is not possible because there is no way to preserve a pointer with the
/// required provenance, then Strict Provenance might not be for you. Use pointer-integer casts
/// or [`expose_addr`][pointer::expose_addr] and [`from_exposed_addr`][from_exposed_addr]
/// or [`expose_addr`][pointer::expose_addr] and [`with_exposed_provenance`][with_exposed_provenance]
/// instead. However, note that this makes your code less portable and less amenable to tools
/// that check for compliance with the Rust memory model.
///
@ -211,30 +211,30 @@ pub fn addr(self) -> usize {
}
/// Gets the "address" portion of the pointer, and 'exposes' the "provenance" part for future
/// use in [`from_exposed_addr`][].
/// use in [`with_exposed_provenance`][].
///
/// This is equivalent to `self as usize`, which semantically discards *provenance* and
/// *address-space* information. Furthermore, this (like the `as` cast) has the implicit
/// side-effect of marking the provenance as 'exposed', so on platforms that support it you can
/// later call [`from_exposed_addr`][] to reconstitute the original pointer including its
/// later call [`with_exposed_provenance`][] to reconstitute the original pointer including its
/// provenance. (Reconstructing address space information, if required, is your responsibility.)
///
/// Using this method means that code is *not* following [Strict
/// Provenance][super#strict-provenance] rules. Supporting
/// [`from_exposed_addr`][] complicates specification and reasoning and may not be supported by
/// [`with_exposed_provenance`][] complicates specification and reasoning and may not be supported by
/// tools that help you to stay conformant with the Rust memory model, so it is recommended to
/// use [`addr`][pointer::addr] wherever possible.
///
/// On most platforms this will produce a value with the same bytes as the original pointer,
/// because all the bytes are dedicated to describing the address. Platforms which need to store
/// additional information in the pointer may not support this operation, since the 'expose'
/// side-effect which is required for [`from_exposed_addr`][] to work is typically not
/// side-effect which is required for [`with_exposed_provenance`][] to work is typically not
/// available.
///
/// It is unclear whether this method can be given a satisfying unambiguous specification. This
/// API and its claimed semantics are part of [Exposed Provenance][super#exposed-provenance].
///
/// [`from_exposed_addr`]: from_exposed_addr
/// [`with_exposed_provenance`]: with_exposed_provenance
#[must_use]
#[inline(always)]
#[unstable(feature = "exposed_provenance", issue = "95228")]

24
library/core/src/ptr/mod.rs
View File

@ -340,13 +340,13 @@
//! clear where a satisfying unambiguous semantics can be defined for Exposed Provenance.
//! Furthermore, Exposed Provenance will not work (well) with tools like [Miri] and [CHERI].
//!
//! Exposed Provenance is provided by the [`expose_addr`] and [`from_exposed_addr`] methods, which
//! Exposed Provenance is provided by the [`expose_addr`] and [`with_exposed_provenance`] methods, which
//! are meant to replace `as` casts between pointers and integers. [`expose_addr`] is a lot like
//! [`addr`], but additionally adds the provenance of the pointer to a global list of 'exposed'
//! provenances. (This list is purely conceptual, it exists for the purpose of specifying Rust but
//! is not materialized in actual executions, except in tools like [Miri].) [`from_exposed_addr`]
//! is not materialized in actual executions, except in tools like [Miri].) [`with_exposed_provenance`]
//! can be used to construct a pointer with one of these previously 'exposed' provenances.
//! [`from_exposed_addr`] takes only `addr: usize` as arguments, so unlike in [`with_addr`] there is
//! [`with_exposed_provenance`] takes only `addr: usize` as arguments, so unlike in [`with_addr`] there is
//! no indication of what the correct provenance for the returned pointer is -- and that is exactly
//! what makes pointer-usize-pointer roundtrips so tricky to rigorously specify! There is no
//! algorithm that decides which provenance will be used. You can think of this as "guessing" the
@ -355,10 +355,10 @@
//! there is *no* previously 'exposed' provenance that justifies the way the returned pointer will
//! be used, the program has undefined behavior.
//!
//! Using [`expose_addr`] or [`from_exposed_addr`] (or the `as` casts) means that code is
//! Using [`expose_addr`] or [`with_exposed_provenance`] (or the `as` casts) means that code is
//! *not* following Strict Provenance rules. The goal of the Strict Provenance experiment is to
//! determine how far one can get in Rust without the use of [`expose_addr`] and
//! [`from_exposed_addr`], and to encourage code to be written with Strict Provenance APIs only.
//! [`with_exposed_provenance`], and to encourage code to be written with Strict Provenance APIs only.
//! Maximizing the amount of such code is a major win for avoiding specification complexity and to
//! facilitate adoption of tools like [CHERI] and [Miri] that can be a big help in increasing the
//! confidence in (unsafe) Rust code.
@ -375,7 +375,7 @@
//! [`addr`]: pointer::addr
//! [`ptr::dangling`]: core::ptr::dangling
//! [`expose_addr`]: pointer::expose_addr
//! [`from_exposed_addr`]: from_exposed_addr
//! [`with_exposed_provenance`]: with_exposed_provenance
//! [Miri]: https://github.com/rust-lang/miri
//! [CHERI]: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
//! [Strict Provenance]: https://github.com/rust-lang/rust/issues/95228
@ -582,7 +582,7 @@ pub const fn null_mut<T: ?Sized + Thin>() -> *mut T {
/// little more than a usize address in disguise.
///
/// This is different from `addr as *const T`, which creates a pointer that picks up a previously
/// exposed provenance. See [`from_exposed_addr`] for more details on that operation.
/// exposed provenance. See [`with_exposed_provenance`] for more details on that operation.
///
/// This API and its claimed semantics are part of the Strict Provenance experiment,
/// see the [module documentation][crate::ptr] for details.
@ -593,7 +593,7 @@ pub const fn null_mut<T: ?Sized + Thin>() -> *mut T {
pub const fn without_provenance<T>(addr: usize) -> *const T {
// FIXME(strict_provenance_magic): I am magic and should be a compiler intrinsic.
// We use transmute rather than a cast so tools like Miri can tell that this
// is *not* the same as from_exposed_addr.
// is *not* the same as with_exposed_provenance.
// SAFETY: every valid integer is also a valid pointer (as long as you don't dereference that
// pointer).
unsafe { mem::transmute(addr) }
@ -626,7 +626,7 @@ pub const fn dangling<T>() -> *const T {
/// little more than a usize address in disguise.
///
/// This is different from `addr as *mut T`, which creates a pointer that picks up a previously
/// exposed provenance. See [`from_exposed_addr_mut`] for more details on that operation.
/// exposed provenance. See [`with_exposed_provenance_mut`] for more details on that operation.
///
/// This API and its claimed semantics are part of the Strict Provenance experiment,
/// see the [module documentation][crate::ptr] for details.
@ -637,7 +637,7 @@ pub const fn dangling<T>() -> *const T {
pub const fn without_provenance_mut<T>(addr: usize) -> *mut T {
// FIXME(strict_provenance_magic): I am magic and should be a compiler intrinsic.
// We use transmute rather than a cast so tools like Miri can tell that this
// is *not* the same as from_exposed_addr.
// is *not* the same as with_exposed_provenance.
// SAFETY: every valid integer is also a valid pointer (as long as you don't dereference that
// pointer).
unsafe { mem::transmute(addr) }
@ -700,7 +700,7 @@ pub const fn dangling_mut<T>() -> *mut T {
#[unstable(feature = "exposed_provenance", issue = "95228")]
#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
#[allow(fuzzy_provenance_casts)] // this *is* the explicit provenance API one should use instead
pub fn from_exposed_addr<T>(addr: usize) -> *const T
pub fn with_exposed_provenance<T>(addr: usize) -> *const T
where
T: Sized,
{
@ -740,7 +740,7 @@ pub fn from_exposed_addr<T>(addr: usize) -> *const T
#[unstable(feature = "exposed_provenance", issue = "95228")]
#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
#[allow(fuzzy_provenance_casts)] // this *is* the explicit provenance API one should use instead
pub fn from_exposed_addr_mut<T>(addr: usize) -> *mut T
pub fn with_exposed_provenance_mut<T>(addr: usize) -> *mut T
where
T: Sized,
{

14
library/core/src/ptr/mut_ptr.rs
View File

@ -171,7 +171,7 @@ pub fn to_bits(self) -> usize
#[unstable(feature = "ptr_to_from_bits", issue = "91126")]
#[deprecated(
since = "1.67.0",
note = "replaced by the `ptr::from_exposed_addr_mut` function, or \
note = "replaced by the `ptr::with_exposed_provenance_mut` function, or \
update your code to follow the strict provenance rules using its APIs"
)]
#[allow(fuzzy_provenance_casts)] // this is an unstable and semi-deprecated cast function
@ -194,7 +194,7 @@ pub fn from_bits(bits: usize) -> Self
///
/// If using those APIs is not possible because there is no way to preserve a pointer with the
/// required provenance, then Strict Provenance might not be for you. Use pointer-integer casts
/// or [`expose_addr`][pointer::expose_addr] and [`from_exposed_addr`][from_exposed_addr]
/// or [`expose_addr`][pointer::expose_addr] and [`with_exposed_provenance`][with_exposed_provenance]
/// instead. However, note that this makes your code less portable and less amenable to tools
/// that check for compliance with the Rust memory model.
///
@ -218,30 +218,30 @@ pub fn addr(self) -> usize {
}
/// Gets the "address" portion of the pointer, and 'exposes' the "provenance" part for future
/// use in [`from_exposed_addr`][].
/// use in [`with_exposed_provenance`][].
///
/// This is equivalent to `self as usize`, which semantically discards *provenance* and
/// *address-space* information. Furthermore, this (like the `as` cast) has the implicit
/// side-effect of marking the provenance as 'exposed', so on platforms that support it you can
/// later call [`from_exposed_addr_mut`][] to reconstitute the original pointer including its
/// later call [`with_exposed_provenance_mut`][] to reconstitute the original pointer including its
/// provenance. (Reconstructing address space information, if required, is your responsibility.)
///
/// Using this method means that code is *not* following [Strict
/// Provenance][super#strict-provenance] rules. Supporting
/// [`from_exposed_addr_mut`][] complicates specification and reasoning and may not be supported
/// [`with_exposed_provenance_mut`][] complicates specification and reasoning and may not be supported
/// by tools that help you to stay conformant with the Rust memory model, so it is recommended
/// to use [`addr`][pointer::addr] wherever possible.
///
/// On most platforms this will produce a value with the same bytes as the original pointer,
/// because all the bytes are dedicated to describing the address. Platforms which need to store
/// additional information in the pointer may not support this operation, since the 'expose'
/// side-effect which is required for [`from_exposed_addr_mut`][] to work is typically not
/// side-effect which is required for [`with_exposed_provenance_mut`][] to work is typically not
/// available.
///
/// It is unclear whether this method can be given a satisfying unambiguous specification. This
/// API and its claimed semantics are part of [Exposed Provenance][super#exposed-provenance].
///
/// [`from_exposed_addr_mut`]: from_exposed_addr_mut
/// [`with_exposed_provenance_mut`]: with_exposed_provenance_mut
#[must_use]
#[inline(always)]
#[unstable(feature = "exposed_provenance", issue = "95228")]

8
library/portable-simd/crates/core_simd/src/simd/ptr/const_ptr.rs
View File

@ -51,13 +51,13 @@ pub trait SimdConstPtr: Copy + Sealed {
fn with_addr(self, addr: Self::Usize) -> Self;
/// Gets the "address" portion of the pointer, and "exposes" the provenance part for future use
/// in [`Self::from_exposed_addr`].
/// in [`Self::with_exposed_provenance`].
fn expose_addr(self) -> Self::Usize;
/// Convert an address back to a pointer, picking up a previously "exposed" provenance.
///
/// Equivalent to calling [`core::ptr::from_exposed_addr`] on each element.
fn from_exposed_addr(addr: Self::Usize) -> Self;
/// Equivalent to calling [`core::ptr::with_exposed_provenance`] on each element.
fn with_exposed_provenance(addr: Self::Usize) -> Self;
/// Calculates the offset from a pointer using wrapping arithmetic.
///
@ -137,7 +137,7 @@ fn expose_addr(self) -> Self::Usize {
}
#[inline]
fn from_exposed_addr(addr: Self::Usize) -> Self {
fn with_exposed_provenance(addr: Self::Usize) -> Self {
// Safety: `self` is a pointer vector
unsafe { core::intrinsics::simd::simd_from_exposed_addr(addr) }
}

8
library/portable-simd/crates/core_simd/src/simd/ptr/mut_ptr.rs
View File

@ -48,13 +48,13 @@ pub trait SimdMutPtr: Copy + Sealed {
fn with_addr(self, addr: Self::Usize) -> Self;
/// Gets the "address" portion of the pointer, and "exposes" the provenance part for future use
/// in [`Self::from_exposed_addr`].
/// in [`Self::with_exposed_provenance`].
fn expose_addr(self) -> Self::Usize;
/// Convert an address back to a pointer, picking up a previously "exposed" provenance.
///
/// Equivalent to calling [`core::ptr::from_exposed_addr_mut`] on each element.
fn from_exposed_addr(addr: Self::Usize) -> Self;
/// Equivalent to calling [`core::ptr::with_exposed_provenance_mut`] on each element.
fn with_exposed_provenance(addr: Self::Usize) -> Self;
/// Calculates the offset from a pointer using wrapping arithmetic.
///
@ -134,7 +134,7 @@ fn expose_addr(self) -> Self::Usize {
}
#[inline]
fn from_exposed_addr(addr: Self::Usize) -> Self {
fn with_exposed_provenance(addr: Self::Usize) -> Self {
// Safety: `self` is a pointer vector
unsafe { core::intrinsics::simd::simd_from_exposed_addr(addr) }
}

12
library/portable-simd/crates/core_simd/tests/pointers.rs
View File

@ -80,10 +80,10 @@ fn cast_mut<const LANES: usize>() {
);
}
fn from_exposed_addr<const LANES: usize>() {
fn with_exposed_provenance<const LANES: usize>() {
test_helpers::test_unary_elementwise(
&Simd::<*const u32, LANES>::from_exposed_addr,
&core::ptr::from_exposed_addr::<u32>,
&Simd::<*const u32, LANES>::with_exposed_provenance,
&core::ptr::with_exposed_provenance::<u32>,
&|_| true,
);
}
@ -103,10 +103,10 @@ fn cast_const<const LANES: usize>() {
);
}
fn from_exposed_addr<const LANES: usize>() {
fn with_exposed_provenance<const LANES: usize>() {
test_helpers::test_unary_elementwise(
&Simd::<*mut u32, LANES>::from_exposed_addr,
&core::ptr::from_exposed_addr_mut::<u32>,
&Simd::<*mut u32, LANES>::with_exposed_provenance,
&core::ptr::with_exposed_provenance_mut::<u32>,
&|_| true,
);
}

2
library/std/src/os/xous/ffi.rs
View File

@ -389,7 +389,7 @@ pub(crate) unsafe fn map_memory<T>(
let result = a0;
if result == SyscallResult::MemoryRange as usize {
let start = core::ptr::from_exposed_addr_mut::<T>(a1);
let start = core::ptr::with_exposed_provenance_mut::<T>(a1);
let len = a2 / core::mem::size_of::<T>();
let end = unsafe { start.add(len) };
Ok(unsafe { core::slice::from_raw_parts_mut(start, len) })

2
library/std/src/sys/pal/hermit/thread.rs
View File

@ -47,7 +47,7 @@ pub unsafe fn new_with_coreid(
extern "C" fn thread_start(main: usize) {
unsafe {
// Finally, let's run some code.
Box::from_raw(ptr::from_exposed_addr::<Box<dyn FnOnce()>>(main).cast_mut())();
Box::from_raw(ptr::with_exposed_provenance::<Box<dyn FnOnce()>>(main).cast_mut())();
// run all destructors
run_dtors();

2
library/std/src/sys/pal/itron/thread.rs
View File

@ -98,7 +98,7 @@ pub unsafe fn new(stack: usize, p: Box<dyn FnOnce()>) -> io::Result<Thread> {
});
unsafe extern "C" fn trampoline(exinf: isize) {
let p_inner: *mut ThreadInner = crate::ptr::from_exposed_addr_mut(exinf as usize);
let p_inner: *mut ThreadInner = crate::ptr::with_exposed_provenance_mut(exinf as usize);
// Safety: `ThreadInner` is alive at this point
let inner = unsafe { &*p_inner };

2
library/std/src/sys/pal/xous/thread_local_key.rs
View File

@ -49,7 +49,7 @@ fn tls_ptr_addr() -> *mut *mut u8 {
out(reg) tp,
);
}
core::ptr::from_exposed_addr_mut::<*mut u8>(tp)
core::ptr::with_exposed_provenance_mut::<*mut u8>(tp)
}
/// Create an area of memory that's unique per thread. This area will

4
library/std/src/sys/pal/zkvm/thread_local_key.rs
View File

@ -9,13 +9,13 @@ pub unsafe fn create(_dtor: Option<unsafe extern "C" fn(*mut u8)>) -> Key {
#[inline]
pub unsafe fn set(key: Key, value: *mut u8) {
let key: *mut *mut u8 = core::ptr::from_exposed_addr_mut(key);
let key: *mut *mut u8 = core::ptr::with_exposed_provenance_mut(key);
*key = value;
}
#[inline]
pub unsafe fn get(key: Key) -> *mut u8 {
let key: *mut *mut u8 = core::ptr::from_exposed_addr_mut(key);
let key: *mut *mut u8 = core::ptr::with_exposed_provenance_mut(key);
*key
}

2
library/std/src/sys/personality/dwarf/eh.rs
View File

@ -125,7 +125,7 @@ pub unsafe fn find_eh_action(lsda: *const u8, context: &EHContext<'_>) -> Result
// Can never have null landing pad for sjlj -- that would have
// been indicated by a -1 call site index.
// FIXME(strict provenance)
let lpad = ptr::from_exposed_addr((cs_lpad + 1) as usize);
let lpad = ptr::with_exposed_provenance((cs_lpad + 1) as usize);
return Ok(interpret_cs_action(action_table, cs_action_entry, lpad));
}
}

2
src/tools/miri/README.md
View File

@ -324,7 +324,7 @@ environment variable. We first document the most relevant and most commonly used
number of available CPUs is `1`. Note that this flag does not affect how miri handles threads in
any way.
* `-Zmiri-permissive-provenance` disables the warning for integer-to-pointer casts and
[`ptr::from_exposed_addr`](https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html).
[`ptr::with_exposed_provenance`](https://doc.rust-lang.org/nightly/std/ptr/fn.with_exposed_provenance.html).
This will necessarily miss some bugs as those operations are not efficiently and accurately
implementable in a sanitizer, but it will only miss bugs that concern memory/pointers which is
subject to these operations.

6
src/tools/miri/src/alloc_addresses/mod.rs
View File

@ -18,12 +18,12 @@
#[derive(Copy, Clone, Debug, PartialEq, Eq)]
pub enum ProvenanceMode {
/// We support `expose_addr`/`from_exposed_addr` via "wildcard" provenance.
/// However, we want on `from_exposed_addr` to alert the user of the precision loss.
/// We support `expose_addr`/`with_exposed_provenance` via "wildcard" provenance.
/// However, we want on `with_exposed_provenance` to alert the user of the precision loss.
Default,
/// Like `Default`, but without the warning.
Permissive,
/// We error on `from_exposed_addr`, ensuring no precision loss.
/// We error on `with_exposed_provenance`, ensuring no precision loss.
Strict,
}

8
src/tools/miri/src/diagnostics.rs
View File

@ -65,7 +65,7 @@ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
Int2PtrWithStrictProvenance =>
write!(
f,
"integer-to-pointer casts and `ptr::from_exposed_addr` are not supported with `-Zmiri-strict-provenance`"
"integer-to-pointer casts and `ptr::with_exposed_provenance` are not supported with `-Zmiri-strict-provenance`"
),
StackedBorrowsUb { msg, .. } => write!(f, "{msg}"),
TreeBorrowsUb { title, .. } => write!(f, "{title}"),
@ -587,7 +587,7 @@ pub fn emit_diagnostic(&self, e: NonHaltingDiagnostic) {
(
None,
format!(
"This program is using integer-to-pointer casts or (equivalently) `ptr::from_exposed_addr`,"
"This program is using integer-to-pointer casts or (equivalently) `ptr::with_exposed_provenance`,"
),
),
(
@ -597,7 +597,7 @@ pub fn emit_diagnostic(&self, e: NonHaltingDiagnostic) {
(
None,
format!(
"See https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html for more details on that operation."
"See https://doc.rust-lang.org/nightly/std/ptr/fn.with_exposed_provenance.html for more details on that operation."
),
),
(
@ -609,7 +609,7 @@ pub fn emit_diagnostic(&self, e: NonHaltingDiagnostic) {
(
None,
format!(
"You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `from_exposed_addr` semantics."
"You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `with_exposed_provenance` semantics."
),
),
(

2
src/tools/miri/tests/fail/provenance/ptr_int_unexposed.rs
View File

@ -7,6 +7,6 @@ fn main() {
let x_usize: usize = x_ptr.addr();
// Cast back an address that did *not* get exposed.
let ptr = std::ptr::from_exposed_addr::<i32>(x_usize);
let ptr = std::ptr::with_exposed_provenance::<i32>(x_usize);
assert_eq!(unsafe { *ptr }, 3); //~ ERROR: is a dangling pointer
}

2
src/tools/miri/tests/fail/provenance/strict_provenance_cast.rs
View File

@ -3,5 +3,5 @@
fn main() {
let addr = &0 as *const i32 as usize;
let _ptr = std::ptr::from_exposed_addr::<i32>(addr); //~ ERROR: integer-to-pointer casts and `ptr::from_exposed_addr` are not supported
let _ptr = std::ptr::with_exposed_provenance::<i32>(addr); //~ ERROR: integer-to-pointer casts and `ptr::with_exposed_provenance` are not supported
}

6
src/tools/miri/tests/fail/provenance/strict_provenance_cast.stderr
View File

@ -1,8 +1,8 @@
error: unsupported operation: integer-to-pointer casts and `ptr::from_exposed_addr` are not supported with `-Zmiri-strict-provenance`
error: unsupported operation: integer-to-pointer casts and `ptr::with_exposed_provenance` are not supported with `-Zmiri-strict-provenance`
--> $DIR/strict_provenance_cast.rs:LL:CC
|
LL | let _ptr = std::ptr::from_exposed_addr::<i32>(addr);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ integer-to-pointer casts and `ptr::from_exposed_addr` are not supported with `-Zmiri-strict-provenance`
LL | let _ptr = std::ptr::with_exposed_provenance::<i32>(addr);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ integer-to-pointer casts and `ptr::with_exposed_provenance` are not supported with `-Zmiri-strict-provenance`
|
= help: use Strict Provenance APIs (https://doc.rust-lang.org/nightly/std/ptr/index.html#strict-provenance, https://crates.io/crates/sptr) instead
= note: BACKTRACE:

2
src/tools/miri/tests/fail/stacked_borrows/exposed_only_ro.rs
View File

@ -7,6 +7,6 @@ fn main() {
let mut x = 0;
let _fool = &mut x as *mut i32; // this would have fooled the old untagged pointer logic
let addr = (&x as *const i32).expose_addr();
let ptr = std::ptr::from_exposed_addr_mut::<i32>(addr);
let ptr = std::ptr::with_exposed_provenance_mut::<i32>(addr);
unsafe { *ptr = 0 }; //~ ERROR: /write access using <wildcard> .* no exposed tags have suitable permission in the borrow stack/
}

6
src/tools/miri/tests/pass/box.stack.stderr
View File

@ -4,11 +4,11 @@ warning: integer-to-pointer cast
LL | let r2 = ((r as usize) + 0) as *mut i32;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ integer-to-pointer cast
|
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::from_exposed_addr`,
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::with_exposed_provenance`,
= help: which means that Miri might miss pointer bugs in this program.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html for more details on that operation.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.with_exposed_provenance.html for more details on that operation.
= help: To ensure that Miri does not miss bugs in your program, use Strict Provenance APIs (https://doc.rust-lang.org/nightly/std/ptr/index.html#strict-provenance, https://crates.io/crates/sptr) instead.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `from_exposed_addr` semantics.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `with_exposed_provenance` semantics.
= help: Alternatively, the `-Zmiri-permissive-provenance` flag disables this warning.
= note: BACKTRACE:
= note: inside `into_raw` at $DIR/box.rs:LL:CC

6
src/tools/miri/tests/pass/extern_types.stack.stderr
View File

@ -4,11 +4,11 @@ warning: integer-to-pointer cast
LL | let x: &Foo = unsafe { &*(16 as *const Foo) };
| ^^^^^^^^^^^^^^^^^^ integer-to-pointer cast
|
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::from_exposed_addr`,
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::with_exposed_provenance`,
= help: which means that Miri might miss pointer bugs in this program.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html for more details on that operation.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.with_exposed_provenance.html for more details on that operation.
= help: To ensure that Miri does not miss bugs in your program, use Strict Provenance APIs (https://doc.rust-lang.org/nightly/std/ptr/index.html#strict-provenance, https://crates.io/crates/sptr) instead.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `from_exposed_addr` semantics.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `with_exposed_provenance` semantics.
= help: Alternatively, the `-Zmiri-permissive-provenance` flag disables this warning.
= note: BACKTRACE:
= note: inside `main` at $DIR/extern_types.rs:LL:CC

2
src/tools/miri/tests/pass/portable-simd-ptrs.rs
View File

@ -8,5 +8,5 @@ fn main() {
// Pointer casts
let _val: Simd<*const u8, 4> = Simd::<*const i32, 4>::splat(ptr::null()).cast();
let addrs = Simd::<*const i32, 4>::splat(ptr::null()).expose_addr();
let _ptrs = Simd::<*const i32, 4>::from_exposed_addr(addrs);
let _ptrs = Simd::<*const i32, 4>::with_exposed_provenance(addrs);
}

8
src/tools/miri/tests/pass/ptr_int_from_exposed.rs
View File

@ -12,7 +12,7 @@ fn ptr_roundtrip_out_of_bounds() {
let x_usize = x_ptr.wrapping_offset(128).expose_addr();
let ptr = ptr::from_exposed_addr::<i32>(x_usize).wrapping_offset(-128);
let ptr = ptr::with_exposed_provenance::<i32>(x_usize).wrapping_offset(-128);
assert_eq!(unsafe { *ptr }, 3);
}
@ -27,7 +27,7 @@ fn ptr_roundtrip_confusion() {
let x_usize = x_ptr.expose_addr();
let y_usize = y_ptr.expose_addr();
let ptr = ptr::from_exposed_addr::<i32>(y_usize);
let ptr = ptr::with_exposed_provenance::<i32>(y_usize);
let ptr = ptr.with_addr(x_usize);
assert_eq!(unsafe { *ptr }, 0);
}
@ -39,7 +39,7 @@ fn ptr_roundtrip_imperfect() {
let x_usize = x_ptr.expose_addr() + 128;
let ptr = ptr::from_exposed_addr::<u8>(x_usize).wrapping_offset(-128);
let ptr = ptr::with_exposed_provenance::<u8>(x_usize).wrapping_offset(-128);
assert_eq!(unsafe { *ptr }, 3);
}
@ -51,7 +51,7 @@ fn ptr_roundtrip_null() {
let null = x_null_ptr.expose_addr();
assert_eq!(null, 0);
let x_null_ptr_copy = ptr::from_exposed_addr::<i32>(null); // just a roundtrip, so has provenance of x (angelically)
let x_null_ptr_copy = ptr::with_exposed_provenance::<i32>(null); // just a roundtrip, so has provenance of x (angelically)
let x_ptr_copy = x_null_ptr_copy.with_addr(x_ptr.addr()); // addr of x and provenance of x
assert_eq!(unsafe { *x_ptr_copy }, 42);
}

2
src/tools/miri/tests/pass/stacked-borrows/int-to-ptr.rs
View File

@ -39,7 +39,7 @@ fn not_so_innocent(x: &mut u32) -> usize {
// 4 is the "obvious" choice (topmost tag, what we used to do with untagged pointers).
// And indeed if `variant == true` it is the only possible choice.
// But if `variant == false` then 2 is the only possible choice!
let x_wildcard = ptr::from_exposed_addr_mut::<i32>(x_raw2_addr);
let x_wildcard = ptr::with_exposed_provenance_mut::<i32>(x_raw2_addr);
if variant {
// If we picked 2, this will invalidate 3.

6
src/tools/miri/tests/pass/stacked-borrows/issue-miri-2389.stderr
View File

@ -4,11 +4,11 @@ warning: integer-to-pointer cast
LL | let wildcard = &root0 as *const Cell<i32> as usize as *const Cell<i32>;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ integer-to-pointer cast
|
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::from_exposed_addr`,
= help: This program is using integer-to-pointer casts or (equivalently) `ptr::with_exposed_provenance`,
= help: which means that Miri might miss pointer bugs in this program.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html for more details on that operation.
= help: See https://doc.rust-lang.org/nightly/std/ptr/fn.with_exposed_provenance.html for more details on that operation.
= help: To ensure that Miri does not miss bugs in your program, use Strict Provenance APIs (https://doc.rust-lang.org/nightly/std/ptr/index.html#strict-provenance, https://crates.io/crates/sptr) instead.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `from_exposed_addr` semantics.
= help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `with_exposed_provenance` semantics.
= help: Alternatively, the `-Zmiri-permissive-provenance` flag disables this warning.
= note: BACKTRACE:
= note: inside `main` at $DIR/issue-miri-2389.rs:LL:CC

2
src/tools/miri/tests/pass/stacked-borrows/unknown-bottom-gc.rs
View File

@ -9,7 +9,7 @@ fn main() {
// Expose the allocation and use the exposed pointer, creating an unknown bottom
unsafe {
let p: *mut u8 = ptr::from_exposed_addr::<u8>(ptr.expose_addr()) as *mut u8;
let p: *mut u8 = ptr::with_exposed_provenance::<u8>(ptr.expose_addr()) as *mut u8;
*p = 1;
}

2
tests/ui/lint/lint-strict-provenance-fuzzy-casts.stderr
View File

@ -4,7 +4,7 @@ error: strict provenance disallows casting integer `usize` to pointer `*const u8
LL | let dangling = 16_usize as *const u8;
| ^^^^^^^^^^^^^^^^^^^^^
|
= help: if you can't comply with strict provenance and don't have a pointer with the correct provenance you can use `std::ptr::from_exposed_addr()` instead
= help: if you can't comply with strict provenance and don't have a pointer with the correct provenance you can use `std::ptr::with_exposed_provenance()` instead
note: the lint level is defined here
--> $DIR/lint-strict-provenance-fuzzy-casts.rs:2:9
|

4
tests/ui/simd/intrinsic/ptr-cast.rs
View File

@ -24,10 +24,10 @@ fn main() {
let exposed_addr: V<usize> = simd_expose_addr(const_ptrs);
let from_exposed_addr: V<*mut i8> = simd_from_exposed_addr(exposed_addr);
let with_exposed_provenance: V<*mut i8> = simd_from_exposed_addr(exposed_addr);
assert!(const_ptrs.0 == [ptr as *const u8, core::ptr::null()]);
assert!(exposed_addr.0 == [ptr as usize, 0]);
assert!(from_exposed_addr.0 == ptrs.0);
assert!(with_exposed_provenance.0 == ptrs.0);
}
}