1#![no_std]
2#![warn(missing_docs)]
3#![allow(unused_mut)]
4#![allow(clippy::match_like_matches_macro)]
5#![allow(clippy::uninlined_format_args)]
6#![allow(clippy::result_unit_err)]
7#![allow(clippy::type_complexity)]
8#![cfg_attr(feature = "nightly_docs", feature(doc_cfg))]
9#![cfg_attr(feature = "nightly_portable_simd", feature(portable_simd))]
10#![cfg_attr(feature = "nightly_float", feature(f16, f128))]
11#![cfg_attr(
12 all(
13 feature = "nightly_stdsimd",
14 any(target_arch = "x86_64", target_arch = "x86")
15 ),
16 feature(stdarch_x86_avx512)
17)]
18
19//! This crate gives small utilities for casting between plain data types.
20//!
21//! ## Basics
22//!
23//! Data comes in five basic forms in Rust, so we have five basic casting
24//! functions:
25//!
26//! * `T` uses [`cast`]
27//! * `&T` uses [`cast_ref`]
28//! * `&mut T` uses [`cast_mut`]
29//! * `&[T]` uses [`cast_slice`]
30//! * `&mut [T]` uses [`cast_slice_mut`]
31//!
32//! Depending on the function, the [`NoUninit`] and/or [`AnyBitPattern`] traits
33//! are used to maintain memory safety.
34//!
35//! **Historical Note:** When the crate first started the [`Pod`] trait was used
36//! instead, and so you may hear people refer to that, but it has the strongest
37//! requirements and people eventually wanted the more fine-grained system, so
38//! here we are. All types that impl `Pod` have a blanket impl to also support
39//! `NoUninit` and `AnyBitPattern`. The traits unfortunately do not have a
40//! perfectly clean hierarchy for semver reasons.
41//!
42//! ## Failures
43//!
44//! Some casts will never fail, and other casts might fail.
45//!
46//! * `cast::<u32, f32>` always works (and [`f32::from_bits`]).
47//! * `cast_ref::<[u8; 4], u32>` might fail if the specific array reference
48//! given at runtime doesn't have alignment 4.
49//!
50//! In addition to the "normal" forms of each function, which will panic on
51//! invalid input, there's also `try_` versions which will return a `Result`.
52//!
53//! If you would like to statically ensure that a cast will work at runtime you
54//! can use the `must_cast` crate feature and the `must_` casting functions. A
55//! "must cast" that can't be statically known to be valid will cause a
56//! compilation error (and sometimes a very hard to read compilation error).
57//!
58//! ## Using Your Own Types
59//!
60//! All the functions listed above are guarded by the [`Pod`] trait, which is a
61//! sub-trait of the [`Zeroable`] trait.
62//!
63//! If you enable the crate's `derive` feature then these traits can be derived
64//! on your own types. The derive macros will perform the necessary checks on
65//! your type declaration, and trigger an error if your type does not qualify.
66//!
67//! The derive macros might not cover all edge cases, and sometimes they will
68//! error when actually everything is fine. As a last resort you can impl these
69//! traits manually. However, these traits are `unsafe`, and you should
70//! carefully read the requirements before using a manual implementation.
71//!
72//! ## Cargo Features
73//!
74//! The crate supports Rust 1.34 when no features are enabled, and so there's
75//! cargo features for thing that you might consider "obvious".
76//!
77//! The cargo features **do not** promise any particular MSRV, and they may
78//! increase their MSRV in new versions.
79//!
80//! * `derive`: Provide derive macros for the various traits.
81//! * `extern_crate_alloc`: Provide utilities for `alloc` related types such as
82//! Box and Vec.
83//! * `zeroable_maybe_uninit` and `zeroable_atomics`: Provide more [`Zeroable`]
84//! impls.
85//! * `pod_saturating`: Provide more [`Pod`] and [`Zeroable`] impls.
86//! * `wasm_simd` and `aarch64_simd`: Support more SIMD types.
87//! * `min_const_generics`: Provides appropriate impls for arrays of all lengths
88//! instead of just for a select list of array lengths.
89//! * `must_cast`: Provides the `must_` functions, which will compile error if
90//! the requested cast can't be statically verified.
91//! * `const_zeroed`: Provides a const version of the `zeroed` function.
92//!
93//! ## Related Crates
94//!
95//! - [`pack1`](https://docs.rs/pack1), which contains `bytemuck`-compatible
96//! packed little-endian, big-endian and native-endian integer and floating
97//! point number types.
98
99#[cfg(all(target_arch = "aarch64", feature = "aarch64_simd"))]
100use core::arch::aarch64;
101#[cfg(all(target_arch = "wasm32", feature = "wasm_simd"))]
102use core::arch::wasm32;
103#[cfg(target_arch = "x86")]
104use core::arch::x86;
105#[cfg(target_arch = "x86_64")]
106use core::arch::x86_64;
107//
108use core::{
109 marker::*,
110 mem::{align_of, size_of},
111 num::*,
112 ptr::*,
113};
114
115// Used from macros to ensure we aren't using some locally defined name and
116// actually are referencing libcore. This also would allow pre-2018 edition
117// crates to use our macros, but I'm not sure how important that is.
118#[doc(hidden)]
119pub use ::core as __core;
120
121#[cfg(not(feature = "min_const_generics"))]
122macro_rules! impl_unsafe_marker_for_array {
123 ( $marker:ident , $( $n:expr ),* ) => {
124 $(unsafe impl<T> $marker for [T; $n] where T: $marker {})*
125 }
126}
127
128/// A macro to transmute between two types without requiring knowing size
129/// statically.
130macro_rules! transmute {
131 ($val:expr) => {
132 ::core::mem::transmute_copy(&::core::mem::ManuallyDrop::new($val))
133 };
134 // This arm is for use in const contexts, where the borrow required to use
135 // transmute_copy poses an issue since the compiler hedges that the type
136 // being borrowed could have interior mutability.
137 ($srcty:ty; $dstty:ty; $val:expr) => {{
138 #[repr(C)]
139 union Transmute<A, B> {
140 src: ::core::mem::ManuallyDrop<A>,
141 dst: ::core::mem::ManuallyDrop<B>,
142 }
143 ::core::mem::ManuallyDrop::into_inner(
144 Transmute::<$srcty, $dstty> { src: ::core::mem::ManuallyDrop::new($val) }
145 .dst,
146 )
147 }};
148}
149
150/// A macro to implement marker traits for various simd types.
151/// #[allow(unused)] because the impls are only compiled on relevant platforms
152/// with relevant cargo features enabled.
153#[allow(unused)]
154macro_rules! impl_unsafe_marker_for_simd {
155 ($(#[cfg($cfg_predicate:meta)])? unsafe impl $trait:ident for $platform:ident :: {}) => {};
156 ($(#[cfg($cfg_predicate:meta)])? unsafe impl $trait:ident for $platform:ident :: { $first_type:ident $(, $types:ident)* $(,)? }) => {
157 $( #[cfg($cfg_predicate)] )?
158 $( #[cfg_attr(feature = "nightly_docs", doc(cfg($cfg_predicate)))] )?
159 unsafe impl $trait for $platform::$first_type {}
160 $( #[cfg($cfg_predicate)] )? // To prevent recursion errors if nothing is going to be expanded anyway.
161 impl_unsafe_marker_for_simd!($( #[cfg($cfg_predicate)] )? unsafe impl $trait for $platform::{ $( $types ),* });
162 };
163}
164
165/// A macro for conditionally const-ifying a function.
166/// #[allow(unused)] because currently it is only used with the `must_cast` feature.
167#[allow(unused)]
168macro_rules! maybe_const_fn {
169 (
170 #[cfg($cfg_predicate:meta)]
171 $(#[$attr:meta])*
172 $vis:vis $(unsafe $($unsafe:lifetime)?)? fn $name:ident $($rest:tt)*
173 ) => {
174 #[cfg($cfg_predicate)]
175 $(#[$attr])*
176 $vis const $(unsafe $($unsafe)?)? fn $name $($rest)*
177
178 #[cfg(not($cfg_predicate))]
179 $(#[$attr])*
180 $vis $(unsafe $($unsafe)?)? fn $name $($rest)*
181 };
182}
183
184#[cfg(feature = "extern_crate_std")]
185extern crate std;
186
187#[cfg(feature = "extern_crate_alloc")]
188extern crate alloc;
189#[cfg(feature = "extern_crate_alloc")]
190#[cfg_attr(feature = "nightly_docs", doc(cfg(feature = "extern_crate_alloc")))]
191pub mod allocation;
192#[cfg(feature = "extern_crate_alloc")]
193pub use allocation::*;
194
195mod anybitpattern;
196pub use anybitpattern::*;
197
198pub mod checked;
199pub use checked::CheckedBitPattern;
200
201mod internal;
202
203mod zeroable;
204pub use zeroable::*;
205mod zeroable_in_option;
206pub use zeroable_in_option::*;
207
208mod pod;
209pub use pod::*;
210mod pod_in_option;
211pub use pod_in_option::*;
212
213#[cfg(feature = "must_cast")]
214mod must;
215#[cfg(feature = "must_cast")]
216#[cfg_attr(feature = "nightly_docs", doc(cfg(feature = "must_cast")))]
217pub use must::*;
218
219mod no_uninit;
220pub use no_uninit::*;
221
222mod contiguous;
223pub use contiguous::*;
224
225mod offset_of;
226// ^ no import, the module only has a macro_rules, which are cursed and don't
227// follow normal import/export rules.
228
229mod transparent;
230pub use transparent::*;
231
232#[cfg(feature = "derive")]
233#[cfg_attr(feature = "nightly_docs", doc(cfg(feature = "derive")))]
234pub use bytemuck_derive::{
235 AnyBitPattern, ByteEq, ByteHash, CheckedBitPattern, Contiguous, NoUninit,
236 Pod, TransparentWrapper, Zeroable,
237};
238
239/// The things that can go wrong when casting between [`Pod`] data forms.
240#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
241pub enum PodCastError {
242 /// You tried to cast a reference into a reference to a type with a higher
243 /// alignment requirement but the input reference wasn't aligned.
244 TargetAlignmentGreaterAndInputNotAligned,
245 /// If the element size of a slice changes, then the output slice changes
246 /// length accordingly. If the output slice wouldn't be a whole number of
247 /// elements, then the conversion fails.
248 OutputSliceWouldHaveSlop,
249 /// When casting an individual `T`, `&T`, or `&mut T` value the
250 /// source size and destination size must be an exact match.
251 SizeMismatch,
252 /// For this type of cast the alignments must be exactly the same and they
253 /// were not so now you're sad.
254 ///
255 /// This error is generated **only** by operations that cast allocated types
256 /// (such as `Box` and `Vec`), because in that case the alignment must stay
257 /// exact.
258 AlignmentMismatch,
259}
260#[cfg(not(target_arch = "spirv"))]
261impl core::fmt::Display for PodCastError {
262 fn fmt(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
263 write!(f, "{:?}", self)
264 }
265}
266#[cfg(feature = "extern_crate_std")]
267#[cfg_attr(feature = "nightly_docs", doc(cfg(feature = "extern_crate_std")))]
268impl std::error::Error for PodCastError {}
269
270/// Re-interprets `&T` as `&[u8]`.
271///
272/// Any ZST becomes an empty slice, and in that case the pointer value of that
273/// empty slice might not match the pointer value of the input reference.
274#[inline]
275pub fn bytes_of<T: NoUninit>(t: &T) -> &[u8] {
276 unsafe { internal::bytes_of(t) }
277}
278
279/// Re-interprets `&mut T` as `&mut [u8]`.
280///
281/// Any ZST becomes an empty slice, and in that case the pointer value of that
282/// empty slice might not match the pointer value of the input reference.
283#[inline]
284pub fn bytes_of_mut<T: NoUninit + AnyBitPattern>(t: &mut T) -> &mut [u8] {
285 unsafe { internal::bytes_of_mut(t) }
286}
287
288/// Re-interprets `&[u8]` as `&T`.
289///
290/// ## Panics
291///
292/// This is like [`try_from_bytes`] but will panic on error.
293#[inline]
294#[cfg_attr(feature = "track_caller", track_caller)]
295pub fn from_bytes<T: AnyBitPattern>(s: &[u8]) -> &T {
296 unsafe { internal::from_bytes(s) }
297}
298
299/// Re-interprets `&mut [u8]` as `&mut T`.
300///
301/// ## Panics
302///
303/// This is like [`try_from_bytes_mut`] but will panic on error.
304#[inline]
305#[cfg_attr(feature = "track_caller", track_caller)]
306pub fn from_bytes_mut<T: NoUninit + AnyBitPattern>(s: &mut [u8]) -> &mut T {
307 unsafe { internal::from_bytes_mut(s) }
308}
309
310/// Reads from the bytes as if they were a `T`.
311///
312/// Unlike [`from_bytes`], the slice doesn't need to respect alignment of `T`,
313/// only sizes must match.
314///
315/// ## Failure
316/// * If the `bytes` length is not equal to `size_of::<T>()`.
317#[inline]
318pub fn try_pod_read_unaligned<T: AnyBitPattern>(
319 bytes: &[u8],
320) -> Result<T, PodCastError> {
321 unsafe { internal::try_pod_read_unaligned(bytes) }
322}
323
324/// Reads the slice into a `T` value.
325///
326/// Unlike [`from_bytes`], the slice doesn't need to respect alignment of `T`,
327/// only sizes must match.
328///
329/// ## Panics
330/// * This is like `try_pod_read_unaligned` but will panic on failure.
331#[inline]
332#[cfg_attr(feature = "track_caller", track_caller)]
333pub fn pod_read_unaligned<T: AnyBitPattern>(bytes: &[u8]) -> T {
334 unsafe { internal::pod_read_unaligned(bytes) }
335}
336
337/// Re-interprets `&[u8]` as `&T`.
338///
339/// ## Failure
340///
341/// * If the slice isn't aligned for the new type
342/// * If the slice's length isn’t exactly the size of the new type
343#[inline]
344pub fn try_from_bytes<T: AnyBitPattern>(s: &[u8]) -> Result<&T, PodCastError> {
345 unsafe { internal::try_from_bytes(s) }
346}
347
348/// Re-interprets `&mut [u8]` as `&mut T`.
349///
350/// ## Failure
351///
352/// * If the slice isn't aligned for the new type
353/// * If the slice's length isn’t exactly the size of the new type
354#[inline]
355pub fn try_from_bytes_mut<T: NoUninit + AnyBitPattern>(
356 s: &mut [u8],
357) -> Result<&mut T, PodCastError> {
358 unsafe { internal::try_from_bytes_mut(s) }
359}
360
361/// Cast `A` into `B`
362///
363/// ## Panics
364///
365/// * This is like [`try_cast`], but will panic on a size mismatch.
366#[inline]
367#[cfg_attr(feature = "track_caller", track_caller)]
368pub fn cast<A: NoUninit, B: AnyBitPattern>(a: A) -> B {
369 unsafe { internal::cast(a) }
370}
371
372/// Cast `&mut A` into `&mut B`.
373///
374/// ## Panics
375///
376/// This is [`try_cast_mut`] but will panic on error.
377#[inline]
378#[cfg_attr(feature = "track_caller", track_caller)]
379pub fn cast_mut<A: NoUninit + AnyBitPattern, B: NoUninit + AnyBitPattern>(
380 a: &mut A,
381) -> &mut B {
382 unsafe { internal::cast_mut(a) }
383}
384
385/// Cast `&A` into `&B`.
386///
387/// ## Panics
388///
389/// This is [`try_cast_ref`] but will panic on error.
390#[inline]
391#[cfg_attr(feature = "track_caller", track_caller)]
392pub fn cast_ref<A: NoUninit, B: AnyBitPattern>(a: &A) -> &B {
393 unsafe { internal::cast_ref(a) }
394}
395
396/// Cast `&[A]` into `&[B]`.
397///
398/// ## Panics
399///
400/// This is [`try_cast_slice`] but will panic on error.
401#[inline]
402#[cfg_attr(feature = "track_caller", track_caller)]
403pub fn cast_slice<A: NoUninit, B: AnyBitPattern>(a: &[A]) -> &[B] {
404 unsafe { internal::cast_slice(a) }
405}
406
407/// Cast `&mut [A]` into `&mut [B]`.
408///
409/// ## Panics
410///
411/// This is [`try_cast_slice_mut`] but will panic on error.
412#[inline]
413#[cfg_attr(feature = "track_caller", track_caller)]
414pub fn cast_slice_mut<
415 A: NoUninit + AnyBitPattern,
416 B: NoUninit + AnyBitPattern,
417>(
418 a: &mut [A],
419) -> &mut [B] {
420 unsafe { internal::cast_slice_mut(a) }
421}
422
423/// As [`align_to`](https://doc.rust-lang.org/std/primitive.slice.html#method.align_to),
424/// but safe because of the [`Pod`] bound.
425#[inline]
426pub fn pod_align_to<T: NoUninit, U: AnyBitPattern>(
427 vals: &[T],
428) -> (&[T], &[U], &[T]) {
429 unsafe { vals.align_to::<U>() }
430}
431
432/// As [`align_to_mut`](https://doc.rust-lang.org/std/primitive.slice.html#method.align_to_mut),
433/// but safe because of the [`Pod`] bound.
434#[inline]
435pub fn pod_align_to_mut<
436 T: NoUninit + AnyBitPattern,
437 U: NoUninit + AnyBitPattern,
438>(
439 vals: &mut [T],
440) -> (&mut [T], &mut [U], &mut [T]) {
441 unsafe { vals.align_to_mut::<U>() }
442}
443
444/// Try to cast `A` into `B`.
445///
446/// Note that for this particular type of cast, alignment isn't a factor. The
447/// input value is semantically copied into the function and then returned to a
448/// new memory location which will have whatever the required alignment of the
449/// output type is.
450///
451/// ## Failure
452///
453/// * If the types don't have the same size this fails.
454#[inline]
455pub fn try_cast<A: NoUninit, B: AnyBitPattern>(
456 a: A,
457) -> Result<B, PodCastError> {
458 unsafe { internal::try_cast(a) }
459}
460
461/// Try to convert a `&A` into `&B`.
462///
463/// ## Failure
464///
465/// * If the reference isn't aligned in the new type
466/// * If the source type and target type aren't the same size.
467#[inline]
468pub fn try_cast_ref<A: NoUninit, B: AnyBitPattern>(
469 a: &A,
470) -> Result<&B, PodCastError> {
471 unsafe { internal::try_cast_ref(a) }
472}
473
474/// Try to convert a `&mut A` into `&mut B`.
475///
476/// As [`try_cast_ref`], but `mut`.
477#[inline]
478pub fn try_cast_mut<
479 A: NoUninit + AnyBitPattern,
480 B: NoUninit + AnyBitPattern,
481>(
482 a: &mut A,
483) -> Result<&mut B, PodCastError> {
484 unsafe { internal::try_cast_mut(a) }
485}
486
487/// Try to convert `&[A]` into `&[B]` (possibly with a change in length).
488///
489/// * `input.as_ptr() as usize == output.as_ptr() as usize`
490/// * `input.len() * size_of::<A>() == output.len() * size_of::<B>()`
491///
492/// ## Failure
493///
494/// * If the target type has a greater alignment requirement and the input slice
495/// isn't aligned.
496/// * If the target element type is a different size from the current element
497/// type, and the output slice wouldn't be a whole number of elements when
498/// accounting for the size change (eg: 3 `u16` values is 1.5 `u32` values, so
499/// that's a failure).
500/// * Similarly, you can't convert between a [ZST](https://doc.rust-lang.org/nomicon/exotic-sizes.html#zero-sized-types-zsts)
501/// and a non-ZST.
502#[inline]
503pub fn try_cast_slice<A: NoUninit, B: AnyBitPattern>(
504 a: &[A],
505) -> Result<&[B], PodCastError> {
506 unsafe { internal::try_cast_slice(a) }
507}
508
509/// Try to convert `&mut [A]` into `&mut [B]` (possibly with a change in
510/// length).
511///
512/// As [`try_cast_slice`], but `&mut`.
513#[inline]
514pub fn try_cast_slice_mut<
515 A: NoUninit + AnyBitPattern,
516 B: NoUninit + AnyBitPattern,
517>(
518 a: &mut [A],
519) -> Result<&mut [B], PodCastError> {
520 unsafe { internal::try_cast_slice_mut(a) }
521}
522
523/// Fill all bytes of `target` with zeroes (see [`Zeroable`]).
524///
525/// This is similar to `*target = Zeroable::zeroed()`, but guarantees that any
526/// padding bytes in `target` are zeroed as well.
527///
528/// See also [`fill_zeroes`], if you have a slice rather than a single value.
529#[inline]
530pub fn write_zeroes<T: Zeroable>(target: &mut T) {
531 struct EnsureZeroWrite<T>(*mut T);
532 impl<T> Drop for EnsureZeroWrite<T> {
533 #[inline(always)]
534 fn drop(&mut self) {
535 unsafe {
536 core::ptr::write_bytes(self.0, val:0u8, count:1);
537 }
538 }
539 }
540 unsafe {
541 let guard: EnsureZeroWrite = EnsureZeroWrite(target);
542 core::ptr::drop_in_place(to_drop:guard.0);
543 drop(guard);
544 }
545}
546
547/// Fill all bytes of `slice` with zeroes (see [`Zeroable`]).
548///
549/// This is similar to `slice.fill(Zeroable::zeroed())`, but guarantees that any
550/// padding bytes in `slice` are zeroed as well.
551///
552/// See also [`write_zeroes`], which zeroes all bytes of a single value rather
553/// than a slice.
554#[inline]
555pub fn fill_zeroes<T: Zeroable>(slice: &mut [T]) {
556 if core::mem::needs_drop::<T>() {
557 // If `T` needs to be dropped then we have to do this one item at a time, in
558 // case one of the intermediate drops does a panic.
559 slice.iter_mut().for_each(write_zeroes);
560 } else {
561 // Otherwise we can be really fast and just fill everthing with zeros.
562 let len: usize = slice.len();
563 unsafe { core::ptr::write_bytes(dst:slice.as_mut_ptr(), val:0u8, count:len) }
564 }
565}
566
567/// Same as [`Zeroable::zeroed`], but as a `const fn` const.
568#[cfg(feature = "const_zeroed")]
569#[inline]
570#[must_use]
571pub const fn zeroed<T: Zeroable>() -> T {
572 unsafe { core::mem::zeroed() }
573}
574