1// Copyright 2024 The Fuchsia Authors
2//
3// Licensed under the 2-Clause BSD License <LICENSE-BSD or
4// https://opensource.org/license/bsd-2-clause>, Apache License, Version 2.0
5// <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT
6// license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option.
7// This file may not be copied, modified, or distributed except according to
8// those terms.
9
10use core::mem::MaybeUninit as CoreMaybeUninit;
11
12use super::*;
13
14safety_comment! {
15 /// SAFETY:
16 /// Per the reference [1], "the unit tuple (`()`) ... is guaranteed as a
17 /// zero-sized type to have a size of 0 and an alignment of 1."
18 /// - `Immutable`: `()` self-evidently does not contain any `UnsafeCell`s.
19 /// - `TryFromBytes` (with no validator), `FromZeros`, `FromBytes`: There is
20 /// only one possible sequence of 0 bytes, and `()` is inhabited.
21 /// - `IntoBytes`: Since `()` has size 0, it contains no padding bytes.
22 /// - `Unaligned`: `()` has alignment 1.
23 ///
24 /// [1] https://doc.rust-lang.org/1.81.0/reference/type-layout.html#tuple-layout
25 unsafe_impl!((): Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
26 assert_unaligned!(());
27}
28
29safety_comment! {
30 /// SAFETY:
31 /// - `Immutable`: These types self-evidently do not contain any
32 /// `UnsafeCell`s.
33 /// - `TryFromBytes` (with no validator), `FromZeros`, `FromBytes`: all bit
34 /// patterns are valid for numeric types [1]
35 /// - `IntoBytes`: numeric types have no padding bytes [1]
36 /// - `Unaligned` (`u8` and `i8` only): The reference [2] specifies the size
37 /// of `u8` and `i8` as 1 byte. We also know that:
38 /// - Alignment is >= 1 [3]
39 /// - Size is an integer multiple of alignment [4]
40 /// - The only value >= 1 for which 1 is an integer multiple is 1
41 /// Therefore, the only possible alignment for `u8` and `i8` is 1.
42 ///
43 /// [1] Per https://doc.rust-lang.org/1.81.0/reference/types/numeric.html#bit-validity:
44 ///
45 /// For every numeric type, `T`, the bit validity of `T` is equivalent to
46 /// the bit validity of `[u8; size_of::<T>()]`. An uninitialized byte is
47 /// not a valid `u8`.
48 ///
49 /// [2] https://doc.rust-lang.org/1.81.0/reference/type-layout.html#primitive-data-layout
50 ///
51 /// [3] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#size-and-alignment:
52 ///
53 /// Alignment is measured in bytes, and must be at least 1.
54 ///
55 /// [4] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#size-and-alignment:
56 ///
57 /// The size of a value is always a multiple of its alignment.
58 ///
59 /// TODO(#278): Once we've updated the trait docs to refer to `u8`s rather
60 /// than bits or bytes, update this comment, especially the reference to
61 /// [1].
62 unsafe_impl!(u8: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
63 unsafe_impl!(i8: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
64 assert_unaligned!(u8, i8);
65 unsafe_impl!(u16: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
66 unsafe_impl!(i16: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
67 unsafe_impl!(u32: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
68 unsafe_impl!(i32: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
69 unsafe_impl!(u64: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
70 unsafe_impl!(i64: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
71 unsafe_impl!(u128: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
72 unsafe_impl!(i128: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
73 unsafe_impl!(usize: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
74 unsafe_impl!(isize: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
75 unsafe_impl!(f32: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
76 unsafe_impl!(f64: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
77 #[cfg(feature = "float-nightly")]
78 unsafe_impl!(#[cfg_attr(doc_cfg, doc(cfg(feature = "float-nightly")))] f16: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
79 #[cfg(feature = "float-nightly")]
80 unsafe_impl!(#[cfg_attr(doc_cfg, doc(cfg(feature = "float-nightly")))] f128: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes);
81}
82
83safety_comment! {
84 /// SAFETY:
85 /// - `Immutable`: `bool` self-evidently does not contain any `UnsafeCell`s.
86 /// - `FromZeros`: Valid since "[t]he value false has the bit pattern 0x00"
87 /// [1].
88 /// - `IntoBytes`: Since "the boolean type has a size and alignment of 1
89 /// each" and "The value false has the bit pattern 0x00 and the value true
90 /// has the bit pattern 0x01" [1]. Thus, the only byte of the bool is
91 /// always initialized.
92 /// - `Unaligned`: Per the reference [1], "[a]n object with the boolean type
93 /// has a size and alignment of 1 each."
94 ///
95 /// [1] https://doc.rust-lang.org/1.81.0/reference/types/boolean.html
96 unsafe_impl!(bool: Immutable, FromZeros, IntoBytes, Unaligned);
97 assert_unaligned!(bool);
98 /// SAFETY:
99 /// - The safety requirements for `unsafe_impl!` with an `is_bit_valid`
100 /// closure:
101 /// - Given `t: *mut bool` and `let r = *mut u8`, `r` refers to an object
102 /// of the same size as that referred to by `t`. This is true because
103 /// `bool` and `u8` have the same size (1 byte) [1]. Neither `r` nor `t`
104 /// contain `UnsafeCell`s because neither `bool` nor `u8` do [4].
105 /// - Since the closure takes a `&u8` argument, given a `Maybe<'a,
106 /// bool>` which satisfies the preconditions of
107 /// `TryFromBytes::<bool>::is_bit_valid`, it must be guaranteed that the
108 /// memory referenced by that `MaybeValid` always contains a valid `u8`.
109 /// Since `bool`'s single byte is always initialized, `is_bit_valid`'s
110 /// precondition requires that the same is true of its argument. Since
111 /// `u8`'s only bit validity invariant is that its single byte must be
112 /// initialized, this memory is guaranteed to contain a valid `u8`.
113 /// - The impl must only return `true` for its argument if the original
114 /// `Maybe<bool>` refers to a valid `bool`. We only return true if
115 /// the `u8` value is 0 or 1, and both of these are valid values for
116 /// `bool`. [3]
117 ///
118 /// [1] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#primitive-data-layout:
119 ///
120 /// The size of most primitives is given in this table.
121 ///
122 /// | Type | `size_of::<Type>() ` |
123 /// |-----------|----------------------|
124 /// | `bool` | 1 |
125 /// | `u8`/`i8` | 1 |
126 ///
127 /// [2] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#size-and-alignment:
128 ///
129 /// The size of a value is always a multiple of its alignment.
130 ///
131 /// [3] Per https://doc.rust-lang.org/1.81.0/reference/types/boolean.html:
132 ///
133 /// The value false has the bit pattern 0x00 and the value true has the
134 /// bit pattern 0x01.
135 ///
136 /// [4] TODO(#429): Justify this claim.
137 unsafe_impl!(bool: TryFromBytes; |byte: MaybeAligned<u8>| *byte.unaligned_as_ref() < 2);
138}
139safety_comment! {
140 /// SAFETY:
141 /// - `Immutable`: `char` self-evidently does not contain any `UnsafeCell`s.
142 /// - `FromZeros`: Per reference [1], "[a] value of type char is a Unicode
143 /// scalar value (i.e. a code point that is not a surrogate), represented
144 /// as a 32-bit unsigned word in the 0x0000 to 0xD7FF or 0xE000 to
145 /// 0x10FFFF range" which contains 0x0000.
146 /// - `IntoBytes`: `char` is per reference [1] "represented as a 32-bit
147 /// unsigned word" (`u32`) which is `IntoBytes`. Note that unlike `u32`,
148 /// not all bit patterns are valid for `char`.
149 ///
150 /// [1] https://doc.rust-lang.org/1.81.0/reference/types/textual.html
151 unsafe_impl!(char: Immutable, FromZeros, IntoBytes);
152 /// SAFETY:
153 /// - The safety requirements for `unsafe_impl!` with an `is_bit_valid`
154 /// closure:
155 /// - Given `t: *mut char` and `let r = *mut u32`, `r` refers to an object
156 /// of the same size as that referred to by `t`. This is true because
157 /// `char` and `u32` have the same size [1]. Neither `r` nor `t` contain
158 /// `UnsafeCell`s because neither `char` nor `u32` do [4].
159 /// - Since the closure takes a `&u32` argument, given a `Maybe<'a,
160 /// char>` which satisfies the preconditions of
161 /// `TryFromBytes::<char>::is_bit_valid`, it must be guaranteed that the
162 /// memory referenced by that `MaybeValid` always contains a valid
163 /// `u32`. Since `char`'s bytes are always initialized [2],
164 /// `is_bit_valid`'s precondition requires that the same is true of its
165 /// argument. Since `u32`'s only bit validity invariant is that its
166 /// bytes must be initialized, this memory is guaranteed to contain a
167 /// valid `u32`.
168 /// - The impl must only return `true` for its argument if the original
169 /// `Maybe<char>` refers to a valid `char`. `char::from_u32`
170 /// guarantees that it returns `None` if its input is not a valid
171 /// `char`. [3]
172 ///
173 /// [1] Per https://doc.rust-lang.org/nightly/reference/types/textual.html#layout-and-bit-validity:
174 ///
175 /// `char` is guaranteed to have the same size and alignment as `u32` on
176 /// all platforms.
177 ///
178 /// [2] Per https://doc.rust-lang.org/core/primitive.char.html#method.from_u32:
179 ///
180 /// Every byte of a `char` is guaranteed to be initialized.
181 ///
182 /// [3] Per https://doc.rust-lang.org/core/primitive.char.html#method.from_u32:
183 ///
184 /// `from_u32()` will return `None` if the input is not a valid value for
185 /// a `char`.
186 ///
187 /// [4] TODO(#429): Justify this claim.
188 unsafe_impl!(char: TryFromBytes; |candidate: MaybeAligned<u32>| {
189 let candidate = candidate.read_unaligned::<BecauseImmutable>();
190 char::from_u32(candidate).is_some()
191 });
192}
193safety_comment! {
194 /// SAFETY:
195 /// Per the Reference [1], `str` has the same layout as `[u8]`.
196 /// - `Immutable`: `[u8]` does not contain any `UnsafeCell`s.
197 /// - `FromZeros`, `IntoBytes`, `Unaligned`: `[u8]` is `FromZeros`,
198 /// `IntoBytes`, and `Unaligned`.
199 ///
200 /// Note that we don't `assert_unaligned!(str)` because `assert_unaligned!`
201 /// uses `align_of`, which only works for `Sized` types.
202 ///
203 /// TODO(#429):
204 /// - Add quotes from documentation.
205 /// - Improve safety proof for `FromZeros` and `IntoBytes`; having the same
206 /// layout as `[u8]` isn't sufficient.
207 ///
208 /// [1] https://doc.rust-lang.org/1.81.0/reference/type-layout.html#str-layout
209 unsafe_impl!(str: Immutable, FromZeros, IntoBytes, Unaligned);
210 /// SAFETY:
211 /// - The safety requirements for `unsafe_impl!` with an `is_bit_valid`
212 /// closure:
213 /// - Given `t: *mut str` and `let r = *mut [u8]`, `r` refers to an object
214 /// of the same size as that referred to by `t`. This is true because
215 /// `str` and `[u8]` have the same representation. [1] Neither `t` nor
216 /// `r` contain `UnsafeCell`s because `[u8]` doesn't, and both `t` and
217 /// `r` have that representation.
218 /// - Since the closure takes a `&[u8]` argument, given a `Maybe<'a,
219 /// str>` which satisfies the preconditions of
220 /// `TryFromBytes::<str>::is_bit_valid`, it must be guaranteed that the
221 /// memory referenced by that `MaybeValid` always contains a valid
222 /// `[u8]`. Since `str`'s bytes are always initialized [1],
223 /// `is_bit_valid`'s precondition requires that the same is true of its
224 /// argument. Since `[u8]`'s only bit validity invariant is that its
225 /// bytes must be initialized, this memory is guaranteed to contain a
226 /// valid `[u8]`.
227 /// - The impl must only return `true` for its argument if the original
228 /// `Maybe<str>` refers to a valid `str`. `str::from_utf8`
229 /// guarantees that it returns `Err` if its input is not a valid `str`.
230 /// [2]
231 ///
232 /// [1] Per https://doc.rust-lang.org/1.81.0/reference/types/textual.html:
233 ///
234 /// A value of type `str` is represented the same was as `[u8]`.
235 ///
236 /// [2] Per https://doc.rust-lang.org/core/str/fn.from_utf8.html#errors:
237 ///
238 /// Returns `Err` if the slice is not UTF-8.
239 unsafe_impl!(str: TryFromBytes; |candidate: MaybeAligned<[u8]>| {
240 let candidate = candidate.unaligned_as_ref();
241 core::str::from_utf8(candidate).is_ok()
242 });
243}
244
245safety_comment! {
246 // `NonZeroXxx` is `IntoBytes`, but not `FromZeros` or `FromBytes`.
247 //
248 /// SAFETY:
249 /// - `IntoBytes`: `NonZeroXxx` has the same layout as its associated
250 /// primitive. Since it is the same size, this guarantees it has no
251 /// padding - integers have no padding, and there's no room for padding
252 /// if it can represent all of the same values except 0.
253 /// - `Unaligned`: `NonZeroU8` and `NonZeroI8` document that
254 /// `Option<NonZeroU8>` and `Option<NonZeroI8>` both have size 1. [1] [2]
255 /// This is worded in a way that makes it unclear whether it's meant as a
256 /// guarantee, but given the purpose of those types, it's virtually
257 /// unthinkable that that would ever change. `Option` cannot be smaller
258 /// than its contained type, which implies that, and `NonZeroX8` are of
259 /// size 1 or 0. `NonZeroX8` can represent multiple states, so they cannot
260 /// be 0 bytes, which means that they must be 1 byte. The only valid
261 /// alignment for a 1-byte type is 1.
262 ///
263 /// TODO(#429):
264 /// - Add quotes from documentation.
265 /// - Add safety comment for `Immutable`. How can we prove that `NonZeroXxx`
266 /// doesn't contain any `UnsafeCell`s? It's obviously true, but it's not
267 /// clear how we'd prove it short of adding text to the stdlib docs that
268 /// says so explicitly, which likely wouldn't be accepted.
269 ///
270 /// [1] https://doc.rust-lang.org/1.81.0/std/num/type.NonZeroU8.html
271 ///
272 /// `NonZeroU8` is guaranteed to have the same layout and bit validity as `u8` with
273 /// the exception that 0 is not a valid instance
274 ///
275 /// [2] https://doc.rust-lang.org/1.81.0/std/num/type.NonZeroI8.html
276 /// TODO(https://github.com/rust-lang/rust/pull/104082): Cite documentation
277 /// that layout is the same as primitive layout.
278 unsafe_impl!(NonZeroU8: Immutable, IntoBytes, Unaligned);
279 unsafe_impl!(NonZeroI8: Immutable, IntoBytes, Unaligned);
280 assert_unaligned!(NonZeroU8, NonZeroI8);
281 unsafe_impl!(NonZeroU16: Immutable, IntoBytes);
282 unsafe_impl!(NonZeroI16: Immutable, IntoBytes);
283 unsafe_impl!(NonZeroU32: Immutable, IntoBytes);
284 unsafe_impl!(NonZeroI32: Immutable, IntoBytes);
285 unsafe_impl!(NonZeroU64: Immutable, IntoBytes);
286 unsafe_impl!(NonZeroI64: Immutable, IntoBytes);
287 unsafe_impl!(NonZeroU128: Immutable, IntoBytes);
288 unsafe_impl!(NonZeroI128: Immutable, IntoBytes);
289 unsafe_impl!(NonZeroUsize: Immutable, IntoBytes);
290 unsafe_impl!(NonZeroIsize: Immutable, IntoBytes);
291 /// SAFETY:
292 /// - The safety requirements for `unsafe_impl!` with an `is_bit_valid`
293 /// closure:
294 /// - Given `t: *mut NonZeroXxx` and `let r = *mut xxx`, `r` refers to an
295 /// object of the same size as that referred to by `t`. This is true
296 /// because `NonZeroXxx` and `xxx` have the same size. [1] Neither `r`
297 /// nor `t` refer to any `UnsafeCell`s because neither `NonZeroXxx` [2]
298 /// nor `xxx` do.
299 /// - Since the closure takes a `&xxx` argument, given a `Maybe<'a,
300 /// NonZeroXxx>` which satisfies the preconditions of
301 /// `TryFromBytes::<NonZeroXxx>::is_bit_valid`, it must be guaranteed
302 /// that the memory referenced by that `MabyeValid` always contains a
303 /// valid `xxx`. Since `NonZeroXxx`'s bytes are always initialized [1],
304 /// `is_bit_valid`'s precondition requires that the same is true of its
305 /// argument. Since `xxx`'s only bit validity invariant is that its
306 /// bytes must be initialized, this memory is guaranteed to contain a
307 /// valid `xxx`.
308 /// - The impl must only return `true` for its argument if the original
309 /// `Maybe<NonZeroXxx>` refers to a valid `NonZeroXxx`. The only
310 /// `xxx` which is not also a valid `NonZeroXxx` is 0. [1]
311 ///
312 /// [1] Per https://doc.rust-lang.org/1.81.0/core/num/type.NonZeroU16.html:
313 ///
314 /// `NonZeroU16` is guaranteed to have the same layout and bit validity as
315 /// `u16` with the exception that `0` is not a valid instance.
316 ///
317 /// [2] `NonZeroXxx` self-evidently does not contain `UnsafeCell`s. This is
318 /// not a proof, but we are accepting this as a known risk per #1358.
319 unsafe_impl!(NonZeroU8: TryFromBytes; |n: MaybeAligned<u8>| NonZeroU8::new(n.read_unaligned::<BecauseImmutable>()).is_some());
320 unsafe_impl!(NonZeroI8: TryFromBytes; |n: MaybeAligned<i8>| NonZeroI8::new(n.read_unaligned::<BecauseImmutable>()).is_some());
321 unsafe_impl!(NonZeroU16: TryFromBytes; |n: MaybeAligned<u16>| NonZeroU16::new(n.read_unaligned::<BecauseImmutable>()).is_some());
322 unsafe_impl!(NonZeroI16: TryFromBytes; |n: MaybeAligned<i16>| NonZeroI16::new(n.read_unaligned::<BecauseImmutable>()).is_some());
323 unsafe_impl!(NonZeroU32: TryFromBytes; |n: MaybeAligned<u32>| NonZeroU32::new(n.read_unaligned::<BecauseImmutable>()).is_some());
324 unsafe_impl!(NonZeroI32: TryFromBytes; |n: MaybeAligned<i32>| NonZeroI32::new(n.read_unaligned::<BecauseImmutable>()).is_some());
325 unsafe_impl!(NonZeroU64: TryFromBytes; |n: MaybeAligned<u64>| NonZeroU64::new(n.read_unaligned::<BecauseImmutable>()).is_some());
326 unsafe_impl!(NonZeroI64: TryFromBytes; |n: MaybeAligned<i64>| NonZeroI64::new(n.read_unaligned::<BecauseImmutable>()).is_some());
327 unsafe_impl!(NonZeroU128: TryFromBytes; |n: MaybeAligned<u128>| NonZeroU128::new(n.read_unaligned::<BecauseImmutable>()).is_some());
328 unsafe_impl!(NonZeroI128: TryFromBytes; |n: MaybeAligned<i128>| NonZeroI128::new(n.read_unaligned::<BecauseImmutable>()).is_some());
329 unsafe_impl!(NonZeroUsize: TryFromBytes; |n: MaybeAligned<usize>| NonZeroUsize::new(n.read_unaligned::<BecauseImmutable>()).is_some());
330 unsafe_impl!(NonZeroIsize: TryFromBytes; |n: MaybeAligned<isize>| NonZeroIsize::new(n.read_unaligned::<BecauseImmutable>()).is_some());
331}
332safety_comment! {
333 /// SAFETY:
334 /// - `TryFromBytes` (with no validator), `FromZeros`, `FromBytes`,
335 /// `IntoBytes`: The Rust compiler reuses `0` value to represent `None`,
336 /// so `size_of::<Option<NonZeroXxx>>() == size_of::<xxx>()`; see
337 /// `NonZeroXxx` documentation.
338 /// - `Unaligned`: `NonZeroU8` and `NonZeroI8` document that
339 /// `Option<NonZeroU8>` and `Option<NonZeroI8>` both have size 1. [1] [2]
340 /// This is worded in a way that makes it unclear whether it's meant as a
341 /// guarantee, but given the purpose of those types, it's virtually
342 /// unthinkable that that would ever change. The only valid alignment for
343 /// a 1-byte type is 1.
344 ///
345 /// TODO(#429): Add quotes from documentation.
346 ///
347 /// [1] https://doc.rust-lang.org/stable/std/num/struct.NonZeroU8.html
348 /// [2] https://doc.rust-lang.org/stable/std/num/struct.NonZeroI8.html
349 ///
350 /// TODO(https://github.com/rust-lang/rust/pull/104082): Cite documentation
351 /// for layout guarantees.
352 unsafe_impl!(Option<NonZeroU8>: TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
353 unsafe_impl!(Option<NonZeroI8>: TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
354 assert_unaligned!(Option<NonZeroU8>, Option<NonZeroI8>);
355 unsafe_impl!(Option<NonZeroU16>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
356 unsafe_impl!(Option<NonZeroI16>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
357 unsafe_impl!(Option<NonZeroU32>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
358 unsafe_impl!(Option<NonZeroI32>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
359 unsafe_impl!(Option<NonZeroU64>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
360 unsafe_impl!(Option<NonZeroI64>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
361 unsafe_impl!(Option<NonZeroU128>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
362 unsafe_impl!(Option<NonZeroI128>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
363 unsafe_impl!(Option<NonZeroUsize>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
364 unsafe_impl!(Option<NonZeroIsize>: TryFromBytes, FromZeros, FromBytes, IntoBytes);
365}
366
367safety_comment! {
368 /// SAFETY:
369 /// While it's not fully documented, the consensus is that `Box<T>` does not
370 /// contain any `UnsafeCell`s for `T: Sized` [1]. This is not a complete
371 /// proof, but we are accepting this as a known risk per #1358.
372 ///
373 /// [1] https://github.com/rust-lang/unsafe-code-guidelines/issues/492
374 #[cfg(feature = "alloc")]
375 unsafe_impl!(
376 #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
377 T: Sized => Immutable for Box<T>
378 );
379}
380
381safety_comment! {
382 /// SAFETY:
383 /// The following types can be transmuted from `[0u8; size_of::<T>()]`. [1]
384 ///
385 /// [1] Per https://doc.rust-lang.org/nightly/core/option/index.html#representation:
386 ///
387 /// Rust guarantees to optimize the following types `T` such that
388 /// [`Option<T>`] has the same size and alignment as `T`. In some of these
389 /// cases, Rust further guarantees that `transmute::<_, Option<T>>([0u8;
390 /// size_of::<T>()])` is sound and produces `Option::<T>::None`. These
391 /// cases are identified by the second column:
392 ///
393 /// | `T` | `transmute::<_, Option<T>>([0u8; size_of::<T>()])` sound? |
394 /// |-----------------------|-----------------------------------------------------------|
395 /// | [`Box<U>`] | when `U: Sized` |
396 /// | `&U` | when `U: Sized` |
397 /// | `&mut U` | when `U: Sized` |
398 /// | [`ptr::NonNull<U>`] | when `U: Sized` |
399 /// | `fn`, `extern "C" fn` | always |
400 ///
401 /// TODO(#429), TODO(https://github.com/rust-lang/rust/pull/115333): Cite
402 /// the Stable docs once they're available.
403 #[cfg(feature = "alloc")]
404 unsafe_impl!(
405 #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
406 T => TryFromBytes for Option<Box<T>>;
407 |c: Maybe<Option<Box<T>>>| pointer::is_zeroed(c)
408 );
409 #[cfg(feature = "alloc")]
410 unsafe_impl!(
411 #[cfg_attr(doc_cfg, doc(cfg(feature = "alloc")))]
412 T => FromZeros for Option<Box<T>>
413 );
414 unsafe_impl!(
415 T => TryFromBytes for Option<&'_ T>;
416 |c: Maybe<Option<&'_ T>>| pointer::is_zeroed(c)
417 );
418 unsafe_impl!(T => FromZeros for Option<&'_ T>);
419 unsafe_impl!(
420 T => TryFromBytes for Option<&'_ mut T>;
421 |c: Maybe<Option<&'_ mut T>>| pointer::is_zeroed(c)
422 );
423 unsafe_impl!(T => FromZeros for Option<&'_ mut T>);
424 unsafe_impl!(
425 T => TryFromBytes for Option<NonNull<T>>;
426 |c: Maybe<Option<NonNull<T>>>| pointer::is_zeroed(c)
427 );
428 unsafe_impl!(T => FromZeros for Option<NonNull<T>>);
429 unsafe_impl_for_power_set!(A, B, C, D, E, F, G, H, I, J, K, L -> M => FromZeros for opt_fn!(...));
430 unsafe_impl_for_power_set!(
431 A, B, C, D, E, F, G, H, I, J, K, L -> M => TryFromBytes for opt_fn!(...);
432 |c: Maybe<Self>| pointer::is_zeroed(c)
433 );
434 unsafe_impl_for_power_set!(A, B, C, D, E, F, G, H, I, J, K, L -> M => FromZeros for opt_extern_c_fn!(...));
435 unsafe_impl_for_power_set!(
436 A, B, C, D, E, F, G, H, I, J, K, L -> M => TryFromBytes for opt_extern_c_fn!(...);
437 |c: Maybe<Self>| pointer::is_zeroed(c)
438 );
439}
440
441safety_comment! {
442 /// SAFETY:
443 /// `fn()` and `extern "C" fn()` self-evidently do not contain
444 /// `UnsafeCell`s. This is not a proof, but we are accepting this as a known
445 /// risk per #1358.
446 unsafe_impl_for_power_set!(A, B, C, D, E, F, G, H, I, J, K, L -> M => Immutable for opt_fn!(...));
447 unsafe_impl_for_power_set!(A, B, C, D, E, F, G, H, I, J, K, L -> M => Immutable for opt_extern_c_fn!(...));
448}
449
450#[cfg(all(
451 zerocopy_target_has_atomics_1_60_0,
452 any(
453 target_has_atomic = "8",
454 target_has_atomic = "16",
455 target_has_atomic = "32",
456 target_has_atomic = "64",
457 target_has_atomic = "ptr"
458 )
459))]
460#[cfg_attr(doc_cfg, doc(cfg(rust = "1.60.0")))]
461mod atomics {
462 use super::*;
463
464 macro_rules! impl_traits_for_atomics {
465 ($($atomics:ident),* $(,)?) => {
466 $(
467 impl_known_layout!($atomics);
468 impl_for_transparent_wrapper!(=> TryFromBytes for $atomics);
469 impl_for_transparent_wrapper!(=> FromZeros for $atomics);
470 impl_for_transparent_wrapper!(=> FromBytes for $atomics);
471 impl_for_transparent_wrapper!(=> IntoBytes for $atomics);
472 )*
473 };
474 }
475
476 #[cfg(target_has_atomic = "8")]
477 #[cfg_attr(doc_cfg, doc(cfg(target_has_atomic = "8")))]
478 mod atomic_8 {
479 use core::sync::atomic::{AtomicBool, AtomicI8, AtomicU8};
480
481 use super::*;
482
483 impl_traits_for_atomics!(AtomicU8, AtomicI8);
484
485 impl_known_layout!(AtomicBool);
486
487 impl_for_transparent_wrapper!(=> TryFromBytes for AtomicBool);
488 impl_for_transparent_wrapper!(=> FromZeros for AtomicBool);
489 impl_for_transparent_wrapper!(=> IntoBytes for AtomicBool);
490
491 safety_comment! {
492 /// SAFETY:
493 /// Per [1], `AtomicBool`, `AtomicU8`, and `AtomicI8` have the same
494 /// size as `bool`, `u8`, and `i8` respectively. Since a type's
495 /// alignment cannot be smaller than 1 [2], and since its alignment
496 /// cannot be greater than its size [3], the only possible value for
497 /// the alignment is 1. Thus, it is sound to implement `Unaligned`.
498 ///
499 /// [1] Per (for example) https://doc.rust-lang.org/1.81.0/std/sync/atomic/struct.AtomicU8.html:
500 ///
501 /// This type has the same size, alignment, and bit validity as
502 /// the underlying integer type
503 ///
504 /// [2] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#size-and-alignment:
505 ///
506 /// Alignment is measured in bytes, and must be at least 1.
507 ///
508 /// [3] Per https://doc.rust-lang.org/1.81.0/reference/type-layout.html#size-and-alignment:
509 ///
510 /// The size of a value is always a multiple of its alignment.
511 unsafe_impl!(AtomicBool: Unaligned);
512 unsafe_impl!(AtomicU8: Unaligned);
513 unsafe_impl!(AtomicI8: Unaligned);
514 assert_unaligned!(AtomicBool, AtomicU8, AtomicI8);
515
516 /// SAFETY:
517 /// All of these pass an atomic type and that type's native equivalent, as
518 /// required by the macro safety preconditions.
519 unsafe_impl_transparent_wrapper_for_atomic!(AtomicU8 [u8], AtomicI8 [i8], AtomicBool [bool]);
520 }
521 }
522
523 #[cfg(target_has_atomic = "16")]
524 #[cfg_attr(doc_cfg, doc(cfg(target_has_atomic = "16")))]
525 mod atomic_16 {
526 use core::sync::atomic::{AtomicI16, AtomicU16};
527
528 use super::*;
529
530 impl_traits_for_atomics!(AtomicU16, AtomicI16);
531
532 safety_comment! {
533 /// SAFETY:
534 /// All of these pass an atomic type and that type's native equivalent, as
535 /// required by the macro safety preconditions.
536 unsafe_impl_transparent_wrapper_for_atomic!(AtomicU16 [u16], AtomicI16 [i16]);
537 }
538 }
539
540 #[cfg(target_has_atomic = "32")]
541 #[cfg_attr(doc_cfg, doc(cfg(target_has_atomic = "32")))]
542 mod atomic_32 {
543 use core::sync::atomic::{AtomicI32, AtomicU32};
544
545 use super::*;
546
547 impl_traits_for_atomics!(AtomicU32, AtomicI32);
548
549 safety_comment! {
550 /// SAFETY:
551 /// All of these pass an atomic type and that type's native equivalent, as
552 /// required by the macro safety preconditions.
553 unsafe_impl_transparent_wrapper_for_atomic!(AtomicU32 [u32], AtomicI32 [i32]);
554 }
555 }
556
557 #[cfg(target_has_atomic = "64")]
558 #[cfg_attr(doc_cfg, doc(cfg(target_has_atomic = "64")))]
559 mod atomic_64 {
560 use core::sync::atomic::{AtomicI64, AtomicU64};
561
562 use super::*;
563
564 impl_traits_for_atomics!(AtomicU64, AtomicI64);
565
566 safety_comment! {
567 /// SAFETY:
568 /// All of these pass an atomic type and that type's native equivalent, as
569 /// required by the macro safety preconditions.
570 unsafe_impl_transparent_wrapper_for_atomic!(AtomicU64 [u64], AtomicI64 [i64]);
571 }
572 }
573
574 #[cfg(target_has_atomic = "ptr")]
575 #[cfg_attr(doc_cfg, doc(cfg(target_has_atomic = "ptr")))]
576 mod atomic_ptr {
577 use core::sync::atomic::{AtomicIsize, AtomicPtr, AtomicUsize};
578
579 use super::*;
580
581 impl_traits_for_atomics!(AtomicUsize, AtomicIsize);
582
583 impl_known_layout!(T => AtomicPtr<T>);
584
585 // TODO(#170): Implement `FromBytes` and `IntoBytes` once we implement
586 // those traits for `*mut T`.
587 impl_for_transparent_wrapper!(T => TryFromBytes for AtomicPtr<T>);
588 impl_for_transparent_wrapper!(T => FromZeros for AtomicPtr<T>);
589
590 safety_comment! {
591 /// SAFETY:
592 /// This passes an atomic type and that type's native equivalent, as
593 /// required by the macro safety preconditions.
594 unsafe_impl_transparent_wrapper_for_atomic!(AtomicUsize [usize], AtomicIsize [isize]);
595 unsafe_impl_transparent_wrapper_for_atomic!(T => AtomicPtr<T> [*mut T]);
596 }
597 }
598}
599
600safety_comment! {
601 /// SAFETY:
602 /// Per reference [1]:
603 /// "For all T, the following are guaranteed:
604 /// size_of::<PhantomData<T>>() == 0
605 /// align_of::<PhantomData<T>>() == 1".
606 /// This gives:
607 /// - `Immutable`: `PhantomData` has no fields.
608 /// - `TryFromBytes` (with no validator), `FromZeros`, `FromBytes`: There is
609 /// only one possible sequence of 0 bytes, and `PhantomData` is inhabited.
610 /// - `IntoBytes`: Since `PhantomData` has size 0, it contains no padding
611 /// bytes.
612 /// - `Unaligned`: Per the preceding reference, `PhantomData` has alignment
613 /// 1.
614 ///
615 /// [1] https://doc.rust-lang.org/1.81.0/std/marker/struct.PhantomData.html#layout-1
616 unsafe_impl!(T: ?Sized => Immutable for PhantomData<T>);
617 unsafe_impl!(T: ?Sized => TryFromBytes for PhantomData<T>);
618 unsafe_impl!(T: ?Sized => FromZeros for PhantomData<T>);
619 unsafe_impl!(T: ?Sized => FromBytes for PhantomData<T>);
620 unsafe_impl!(T: ?Sized => IntoBytes for PhantomData<T>);
621 unsafe_impl!(T: ?Sized => Unaligned for PhantomData<T>);
622 assert_unaligned!(PhantomData<()>, PhantomData<u8>, PhantomData<u64>);
623}
624
625impl_for_transparent_wrapper!(T: Immutable => Immutable for Wrapping<T>);
626impl_for_transparent_wrapper!(T: TryFromBytes => TryFromBytes for Wrapping<T>);
627impl_for_transparent_wrapper!(T: FromZeros => FromZeros for Wrapping<T>);
628impl_for_transparent_wrapper!(T: FromBytes => FromBytes for Wrapping<T>);
629impl_for_transparent_wrapper!(T: IntoBytes => IntoBytes for Wrapping<T>);
630impl_for_transparent_wrapper!(T: Unaligned => Unaligned for Wrapping<T>);
631assert_unaligned!(Wrapping<()>, Wrapping<u8>);
632
633safety_comment! {
634 /// SAFETY:
635 /// `TryFromBytes` (with no validator), `FromZeros`, `FromBytes`:
636 /// `MaybeUninit<T>` has no restrictions on its contents.
637 unsafe_impl!(T => TryFromBytes for CoreMaybeUninit<T>);
638 unsafe_impl!(T => FromZeros for CoreMaybeUninit<T>);
639 unsafe_impl!(T => FromBytes for CoreMaybeUninit<T>);
640}
641
642impl_for_transparent_wrapper!(T: Immutable => Immutable for CoreMaybeUninit<T>);
643impl_for_transparent_wrapper!(T: Unaligned => Unaligned for CoreMaybeUninit<T>);
644assert_unaligned!(CoreMaybeUninit<()>, CoreMaybeUninit<u8>);
645
646impl_for_transparent_wrapper!(T: ?Sized + Immutable => Immutable for ManuallyDrop<T>);
647impl_for_transparent_wrapper!(T: ?Sized + TryFromBytes => TryFromBytes for ManuallyDrop<T>);
648impl_for_transparent_wrapper!(T: ?Sized + FromZeros => FromZeros for ManuallyDrop<T>);
649impl_for_transparent_wrapper!(T: ?Sized + FromBytes => FromBytes for ManuallyDrop<T>);
650impl_for_transparent_wrapper!(T: ?Sized + IntoBytes => IntoBytes for ManuallyDrop<T>);
651impl_for_transparent_wrapper!(T: ?Sized + Unaligned => Unaligned for ManuallyDrop<T>);
652assert_unaligned!(ManuallyDrop<()>, ManuallyDrop<u8>);
653
654impl_for_transparent_wrapper!(T: ?Sized + FromZeros => FromZeros for UnsafeCell<T>);
655impl_for_transparent_wrapper!(T: ?Sized + FromBytes => FromBytes for UnsafeCell<T>);
656impl_for_transparent_wrapper!(T: ?Sized + IntoBytes => IntoBytes for UnsafeCell<T>);
657impl_for_transparent_wrapper!(T: ?Sized + Unaligned => Unaligned for UnsafeCell<T>);
658assert_unaligned!(UnsafeCell<()>, UnsafeCell<u8>);
659
660// SAFETY: See safety comment in `is_bit_valid` impl.
661unsafe impl<T: TryFromBytes + ?Sized> TryFromBytes for UnsafeCell<T> {
662 #[allow(clippy::missing_inline_in_public_items)]
663 fn only_derive_is_allowed_to_implement_this_trait()
664 where
665 Self: Sized,
666 {
667 }
668
669 #[inline]
670 fn is_bit_valid<A: invariant::Aliasing + invariant::AtLeast<invariant::Shared>>(
671 candidate: Maybe<'_, Self, A>,
672 ) -> bool {
673 // The only way to implement this function is using an exclusive-aliased
674 // pointer. `UnsafeCell`s cannot be read via shared-aliased pointers
675 // (other than by using `unsafe` code, which we can't use since we can't
676 // guarantee how our users are accessing or modifying the `UnsafeCell`).
677 //
678 // `is_bit_valid` is documented as panicking or failing to monomorphize
679 // if called with a shared-aliased pointer on a type containing an
680 // `UnsafeCell`. In practice, it will always be a monorphization error.
681 // Since `is_bit_valid` is `#[doc(hidden)]` and only called directly
682 // from this crate, we only need to worry about our own code incorrectly
683 // calling `UnsafeCell::is_bit_valid`. The post-monomorphization error
684 // makes it easier to test that this is truly the case, and also means
685 // that if we make a mistake, it will cause downstream code to fail to
686 // compile, which will immediately surface the mistake and give us a
687 // chance to fix it quickly.
688 let c = candidate.into_exclusive_or_post_monomorphization_error();
689
690 // SAFETY: Since `UnsafeCell<T>` and `T` have the same layout and bit
691 // validity, `UnsafeCell<T>` is bit-valid exactly when its wrapped `T`
692 // is. Thus, this is a sound implementation of
693 // `UnsafeCell::is_bit_valid`.
694 T::is_bit_valid(c.get_mut())
695 }
696}
697
698safety_comment! {
699 /// SAFETY:
700 /// Per the reference [1]:
701 ///
702 /// An array of `[T; N]` has a size of `size_of::<T>() * N` and the same
703 /// alignment of `T`. Arrays are laid out so that the zero-based `nth`
704 /// element of the array is offset from the start of the array by `n *
705 /// size_of::<T>()` bytes.
706 ///
707 /// ...
708 ///
709 /// Slices have the same layout as the section of the array they slice.
710 ///
711 /// In other words, the layout of a `[T]` or `[T; N]` is a sequence of `T`s
712 /// laid out back-to-back with no bytes in between. Therefore, `[T]` or `[T;
713 /// N]` are `Immutable`, `TryFromBytes`, `FromZeros`, `FromBytes`, and
714 /// `IntoBytes` if `T` is (respectively). Furthermore, since an array/slice
715 /// has "the same alignment of `T`", `[T]` and `[T; N]` are `Unaligned` if
716 /// `T` is.
717 ///
718 /// Note that we don't `assert_unaligned!` for slice types because
719 /// `assert_unaligned!` uses `align_of`, which only works for `Sized` types.
720 ///
721 /// [1] https://doc.rust-lang.org/1.81.0/reference/type-layout.html#array-layout
722 unsafe_impl!(const N: usize, T: Immutable => Immutable for [T; N]);
723 unsafe_impl!(const N: usize, T: TryFromBytes => TryFromBytes for [T; N]; |c: Maybe<[T; N]>| {
724 // Note that this call may panic, but it would still be sound even if it
725 // did. `is_bit_valid` does not promise that it will not panic (in fact,
726 // it explicitly warns that it's a possibility), and we have not
727 // violated any safety invariants that we must fix before returning.
728 <[T] as TryFromBytes>::is_bit_valid(c.as_slice())
729 });
730 unsafe_impl!(const N: usize, T: FromZeros => FromZeros for [T; N]);
731 unsafe_impl!(const N: usize, T: FromBytes => FromBytes for [T; N]);
732 unsafe_impl!(const N: usize, T: IntoBytes => IntoBytes for [T; N]);
733 unsafe_impl!(const N: usize, T: Unaligned => Unaligned for [T; N]);
734 assert_unaligned!([(); 0], [(); 1], [u8; 0], [u8; 1]);
735 unsafe_impl!(T: Immutable => Immutable for [T]);
736 unsafe_impl!(T: TryFromBytes => TryFromBytes for [T]; |c: Maybe<[T]>| {
737 // SAFETY: Per the reference [1]:
738 //
739 // An array of `[T; N]` has a size of `size_of::<T>() * N` and the
740 // same alignment of `T`. Arrays are laid out so that the zero-based
741 // `nth` element of the array is offset from the start of the array by
742 // `n * size_of::<T>()` bytes.
743 //
744 // ...
745 //
746 // Slices have the same layout as the section of the array they slice.
747 //
748 // In other words, the layout of a `[T] is a sequence of `T`s laid out
749 // back-to-back with no bytes in between. If all elements in `candidate`
750 // are `is_bit_valid`, so too is `candidate`.
751 //
752 // Note that any of the below calls may panic, but it would still be
753 // sound even if it did. `is_bit_valid` does not promise that it will
754 // not panic (in fact, it explicitly warns that it's a possibility), and
755 // we have not violated any safety invariants that we must fix before
756 // returning.
757 c.iter().all(<T as TryFromBytes>::is_bit_valid)
758 });
759 unsafe_impl!(T: FromZeros => FromZeros for [T]);
760 unsafe_impl!(T: FromBytes => FromBytes for [T]);
761 unsafe_impl!(T: IntoBytes => IntoBytes for [T]);
762 unsafe_impl!(T: Unaligned => Unaligned for [T]);
763}
764safety_comment! {
765 /// SAFETY:
766 /// - `Immutable`: Raw pointers do not contain any `UnsafeCell`s.
767 /// - `FromZeros`: For thin pointers (note that `T: Sized`), the zero
768 /// pointer is considered "null". [1] No operations which require
769 /// provenance are legal on null pointers, so this is not a footgun.
770 /// - `TryFromBytes`: By the same reasoning as for `FromZeroes`, we can
771 /// implement `TryFromBytes` for thin pointers provided that
772 /// [`TryFromByte::is_bit_valid`] only produces `true` for zeroed bytes.
773 ///
774 /// NOTE(#170): Implementing `FromBytes` and `IntoBytes` for raw pointers
775 /// would be sound, but carries provenance footguns. We want to support
776 /// `FromBytes` and `IntoBytes` for raw pointers eventually, but we are
777 /// holding off until we can figure out how to address those footguns.
778 ///
779 /// [1] TODO(https://github.com/rust-lang/rust/pull/116988): Cite the
780 /// documentation once this PR lands.
781 unsafe_impl!(T: ?Sized => Immutable for *const T);
782 unsafe_impl!(T: ?Sized => Immutable for *mut T);
783 unsafe_impl!(T => TryFromBytes for *const T; |c: Maybe<*const T>| {
784 pointer::is_zeroed(c)
785 });
786 unsafe_impl!(T => FromZeros for *const T);
787 unsafe_impl!(T => TryFromBytes for *mut T; |c: Maybe<*const T>| {
788 pointer::is_zeroed(c)
789 });
790 unsafe_impl!(T => FromZeros for *mut T);
791}
792
793safety_comment! {
794 /// SAFETY:
795 /// `NonNull<T>` self-evidently does not contain `UnsafeCell`s. This is not
796 /// a proof, but we are accepting this as a known risk per #1358.
797 unsafe_impl!(T: ?Sized => Immutable for NonNull<T>);
798}
799
800safety_comment! {
801 /// SAFETY:
802 /// Reference types do not contain any `UnsafeCell`s.
803 unsafe_impl!(T: ?Sized => Immutable for &'_ T);
804 unsafe_impl!(T: ?Sized => Immutable for &'_ mut T);
805}
806
807safety_comment! {
808 /// SAFETY:
809 /// `Option` is not `#[non_exhaustive]` [1], which means that the types in
810 /// its variants cannot change, and no new variants can be added.
811 /// `Option<T>` does not contain any `UnsafeCell`s outside of `T`. [1]
812 ///
813 /// [1] https://doc.rust-lang.org/core/option/enum.Option.html
814 unsafe_impl!(T: Immutable => Immutable for Option<T>);
815}
816
817// SIMD support
818//
819// Per the Unsafe Code Guidelines Reference [1]:
820//
821// Packed SIMD vector types are `repr(simd)` homogeneous tuple-structs
822// containing `N` elements of type `T` where `N` is a power-of-two and the
823// size and alignment requirements of `T` are equal:
824//
825// ```rust
826// #[repr(simd)]
827// struct Vector<T, N>(T_0, ..., T_(N - 1));
828// ```
829//
830// ...
831//
832// The size of `Vector` is `N * size_of::<T>()` and its alignment is an
833// implementation-defined function of `T` and `N` greater than or equal to
834// `align_of::<T>()`.
835//
836// ...
837//
838// Vector elements are laid out in source field order, enabling random access
839// to vector elements by reinterpreting the vector as an array:
840//
841// ```rust
842// union U {
843// vec: Vector<T, N>,
844// arr: [T; N]
845// }
846//
847// assert_eq!(size_of::<Vector<T, N>>(), size_of::<[T; N]>());
848// assert!(align_of::<Vector<T, N>>() >= align_of::<[T; N]>());
849//
850// unsafe {
851// let u = U { vec: Vector<T, N>(t_0, ..., t_(N - 1)) };
852//
853// assert_eq!(u.vec.0, u.arr[0]);
854// // ...
855// assert_eq!(u.vec.(N - 1), u.arr[N - 1]);
856// }
857// ```
858//
859// Given this background, we can observe that:
860// - The size and bit pattern requirements of a SIMD type are equivalent to the
861// equivalent array type. Thus, for any SIMD type whose primitive `T` is
862// `Immutable`, `TryFromBytes`, `FromZeros`, `FromBytes`, or `IntoBytes`, that
863// SIMD type is also `Immutable`, `TryFromBytes`, `FromZeros`, `FromBytes`, or
864// `IntoBytes` respectively.
865// - Since no upper bound is placed on the alignment, no SIMD type can be
866// guaranteed to be `Unaligned`.
867//
868// Also per [1]:
869//
870// This chapter represents the consensus from issue #38. The statements in
871// here are not (yet) "guaranteed" not to change until an RFC ratifies them.
872//
873// See issue #38 [2]. While this behavior is not technically guaranteed, the
874// likelihood that the behavior will change such that SIMD types are no longer
875// `TryFromBytes`, `FromZeros`, `FromBytes`, or `IntoBytes` is next to zero, as
876// that would defeat the entire purpose of SIMD types. Nonetheless, we put this
877// behavior behind the `simd` Cargo feature, which requires consumers to opt
878// into this stability hazard.
879//
880// [1] https://rust-lang.github.io/unsafe-code-guidelines/layout/packed-simd-vectors.html
881// [2] https://github.com/rust-lang/unsafe-code-guidelines/issues/38
882#[cfg(feature = "simd")]
883#[cfg_attr(doc_cfg, doc(cfg(feature = "simd")))]
884mod simd {
885 /// Defines a module which implements `TryFromBytes`, `FromZeros`,
886 /// `FromBytes`, and `IntoBytes` for a set of types from a module in
887 /// `core::arch`.
888 ///
889 /// `$arch` is both the name of the defined module and the name of the
890 /// module in `core::arch`, and `$typ` is the list of items from that module
891 /// to implement `FromZeros`, `FromBytes`, and `IntoBytes` for.
892 #[allow(unused_macros)] // `allow(unused_macros)` is needed because some
893 // target/feature combinations don't emit any impls
894 // and thus don't use this macro.
895 macro_rules! simd_arch_mod {
896 (#[cfg $cfg:tt] $arch:ident, $mod:ident, $($typ:ident),*) => {
897 #[cfg $cfg]
898 #[cfg_attr(doc_cfg, doc(cfg $cfg))]
899 mod $mod {
900 use core::arch::$arch::{$($typ),*};
901
902 use crate::*;
903 impl_known_layout!($($typ),*);
904 safety_comment! {
905 /// SAFETY:
906 /// See comment on module definition for justification.
907 $( unsafe_impl!($typ: Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes); )*
908 }
909 }
910 };
911 }
912
913 #[rustfmt::skip]
914 const _: () = {
915 simd_arch_mod!(
916 #[cfg(target_arch = "x86")]
917 x86, x86, __m128, __m128d, __m128i, __m256, __m256d, __m256i
918 );
919 simd_arch_mod!(
920 #[cfg(all(feature = "simd-nightly", target_arch = "x86"))]
921 x86, x86_nightly, __m512bh, __m512, __m512d, __m512i
922 );
923 simd_arch_mod!(
924 #[cfg(target_arch = "x86_64")]
925 x86_64, x86_64, __m128, __m128d, __m128i, __m256, __m256d, __m256i
926 );
927 simd_arch_mod!(
928 #[cfg(all(feature = "simd-nightly", target_arch = "x86_64"))]
929 x86_64, x86_64_nightly, __m512bh, __m512, __m512d, __m512i
930 );
931 simd_arch_mod!(
932 #[cfg(target_arch = "wasm32")]
933 wasm32, wasm32, v128
934 );
935 simd_arch_mod!(
936 #[cfg(all(feature = "simd-nightly", target_arch = "powerpc"))]
937 powerpc, powerpc, vector_bool_long, vector_double, vector_signed_long, vector_unsigned_long
938 );
939 simd_arch_mod!(
940 #[cfg(all(feature = "simd-nightly", target_arch = "powerpc64"))]
941 powerpc64, powerpc64, vector_bool_long, vector_double, vector_signed_long, vector_unsigned_long
942 );
943 #[cfg(zerocopy_aarch64_simd_1_59_0)]
944 #[cfg_attr(doc_cfg, doc(cfg(rust = "1.59.0")))]
945 simd_arch_mod!(
946 // NOTE(https://github.com/rust-lang/stdarch/issues/1484): NEON intrinsics are currently
947 // broken on big-endian platforms.
948 #[cfg(all(target_arch = "aarch64", target_endian = "little"))]
949 aarch64, aarch64, float32x2_t, float32x4_t, float64x1_t, float64x2_t, int8x8_t, int8x8x2_t,
950 int8x8x3_t, int8x8x4_t, int8x16_t, int8x16x2_t, int8x16x3_t, int8x16x4_t, int16x4_t,
951 int16x8_t, int32x2_t, int32x4_t, int64x1_t, int64x2_t, poly8x8_t, poly8x8x2_t, poly8x8x3_t,
952 poly8x8x4_t, poly8x16_t, poly8x16x2_t, poly8x16x3_t, poly8x16x4_t, poly16x4_t, poly16x8_t,
953 poly64x1_t, poly64x2_t, uint8x8_t, uint8x8x2_t, uint8x8x3_t, uint8x8x4_t, uint8x16_t,
954 uint8x16x2_t, uint8x16x3_t, uint8x16x4_t, uint16x4_t, uint16x8_t, uint32x2_t, uint32x4_t,
955 uint64x1_t, uint64x2_t
956 );
957 simd_arch_mod!(
958 #[cfg(all(feature = "simd-nightly", target_arch = "arm"))]
959 arm, arm, int8x4_t, uint8x4_t
960 );
961 };
962}
963
964#[cfg(test)]
965mod tests {
966 use super::*;
967
968 #[test]
969 fn test_impls() {
970 // A type that can supply test cases for testing
971 // `TryFromBytes::is_bit_valid`. All types passed to `assert_impls!`
972 // must implement this trait; that macro uses it to generate runtime
973 // tests for `TryFromBytes` impls.
974 //
975 // All `T: FromBytes` types are provided with a blanket impl. Other
976 // types must implement `TryFromBytesTestable` directly (ie using
977 // `impl_try_from_bytes_testable!`).
978 trait TryFromBytesTestable {
979 fn with_passing_test_cases<F: Fn(Box<Self>)>(f: F);
980 fn with_failing_test_cases<F: Fn(&mut [u8])>(f: F);
981 }
982
983 impl<T: FromBytes> TryFromBytesTestable for T {
984 fn with_passing_test_cases<F: Fn(Box<Self>)>(f: F) {
985 // Test with a zeroed value.
986 f(Self::new_box_zeroed().unwrap());
987
988 let ffs = {
989 let mut t = Self::new_zeroed();
990 let ptr: *mut T = &mut t;
991 // SAFETY: `T: FromBytes`
992 unsafe { ptr::write_bytes(ptr.cast::<u8>(), 0xFF, mem::size_of::<T>()) };
993 t
994 };
995
996 // Test with a value initialized with 0xFF.
997 f(Box::new(ffs));
998 }
999
1000 fn with_failing_test_cases<F: Fn(&mut [u8])>(_f: F) {}
1001 }
1002
1003 macro_rules! impl_try_from_bytes_testable_for_null_pointer_optimization {
1004 ($($tys:ty),*) => {
1005 $(
1006 impl TryFromBytesTestable for Option<$tys> {
1007 fn with_passing_test_cases<F: Fn(Box<Self>)>(f: F) {
1008 // Test with a zeroed value.
1009 f(Box::new(None));
1010 }
1011
1012 fn with_failing_test_cases<F: Fn(&mut [u8])>(f: F) {
1013 for pos in 0..mem::size_of::<Self>() {
1014 let mut bytes = [0u8; mem::size_of::<Self>()];
1015 bytes[pos] = 0x01;
1016 f(&mut bytes[..]);
1017 }
1018 }
1019 }
1020 )*
1021 };
1022 }
1023
1024 // Implements `TryFromBytesTestable`.
1025 macro_rules! impl_try_from_bytes_testable {
1026 // Base case for recursion (when the list of types has run out).
1027 (=> @success $($success_case:expr),* $(, @failure $($failure_case:expr),*)?) => {};
1028 // Implements for type(s) with no type parameters.
1029 ($ty:ty $(,$tys:ty)* => @success $($success_case:expr),* $(, @failure $($failure_case:expr),*)?) => {
1030 impl TryFromBytesTestable for $ty {
1031 impl_try_from_bytes_testable!(
1032 @methods @success $($success_case),*
1033 $(, @failure $($failure_case),*)?
1034 );
1035 }
1036 impl_try_from_bytes_testable!($($tys),* => @success $($success_case),* $(, @failure $($failure_case),*)?);
1037 };
1038 // Implements for multiple types with no type parameters.
1039 ($($($ty:ty),* => @success $($success_case:expr), * $(, @failure $($failure_case:expr),*)?;)*) => {
1040 $(
1041 impl_try_from_bytes_testable!($($ty),* => @success $($success_case),* $(, @failure $($failure_case),*)*);
1042 )*
1043 };
1044 // Implements only the methods; caller must invoke this from inside
1045 // an impl block.
1046 (@methods @success $($success_case:expr),* $(, @failure $($failure_case:expr),*)?) => {
1047 fn with_passing_test_cases<F: Fn(Box<Self>)>(_f: F) {
1048 $(
1049 _f(Box::<Self>::from($success_case));
1050 )*
1051 }
1052
1053 fn with_failing_test_cases<F: Fn(&mut [u8])>(_f: F) {
1054 $($(
1055 let mut case = $failure_case;
1056 _f(case.as_mut_bytes());
1057 )*)?
1058 }
1059 };
1060 }
1061
1062 impl_try_from_bytes_testable_for_null_pointer_optimization!(
1063 Box<UnsafeCell<NotZerocopy>>,
1064 &'static UnsafeCell<NotZerocopy>,
1065 &'static mut UnsafeCell<NotZerocopy>,
1066 NonNull<UnsafeCell<NotZerocopy>>,
1067 fn(),
1068 FnManyArgs,
1069 extern "C" fn(),
1070 ECFnManyArgs
1071 );
1072
1073 macro_rules! bx {
1074 ($e:expr) => {
1075 Box::new($e)
1076 };
1077 }
1078
1079 // Note that these impls are only for types which are not `FromBytes`.
1080 // `FromBytes` types are covered by a preceding blanket impl.
1081 impl_try_from_bytes_testable!(
1082 bool => @success true, false,
1083 @failure 2u8, 3u8, 0xFFu8;
1084 char => @success '\u{0}', '\u{D7FF}', '\u{E000}', '\u{10FFFF}',
1085 @failure 0xD800u32, 0xDFFFu32, 0x110000u32;
1086 str => @success "", "hello", "❤️🧡💛💚💙💜",
1087 @failure [0, 159, 146, 150];
1088 [u8] => @success vec![].into_boxed_slice(), vec![0, 1, 2].into_boxed_slice();
1089 NonZeroU8, NonZeroI8, NonZeroU16, NonZeroI16, NonZeroU32,
1090 NonZeroI32, NonZeroU64, NonZeroI64, NonZeroU128, NonZeroI128,
1091 NonZeroUsize, NonZeroIsize
1092 => @success Self::new(1).unwrap(),
1093 // Doing this instead of `0` ensures that we always satisfy
1094 // the size and alignment requirements of `Self` (whereas `0`
1095 // may be any integer type with a different size or alignment
1096 // than some `NonZeroXxx` types).
1097 @failure Option::<Self>::None;
1098 [bool; 0] => @success [];
1099 [bool; 1]
1100 => @success [true], [false],
1101 @failure [2u8], [3u8], [0xFFu8];
1102 [bool]
1103 => @success vec![true, false].into_boxed_slice(), vec![false, true].into_boxed_slice(),
1104 @failure [2u8], [3u8], [0xFFu8], [0u8, 1u8, 2u8];
1105 Unalign<bool>
1106 => @success Unalign::new(false), Unalign::new(true),
1107 @failure 2u8, 0xFFu8;
1108 ManuallyDrop<bool>
1109 => @success ManuallyDrop::new(false), ManuallyDrop::new(true),
1110 @failure 2u8, 0xFFu8;
1111 ManuallyDrop<[u8]>
1112 => @success bx!(ManuallyDrop::new([])), bx!(ManuallyDrop::new([0u8])), bx!(ManuallyDrop::new([0u8, 1u8]));
1113 ManuallyDrop<[bool]>
1114 => @success bx!(ManuallyDrop::new([])), bx!(ManuallyDrop::new([false])), bx!(ManuallyDrop::new([false, true])),
1115 @failure [2u8], [3u8], [0xFFu8], [0u8, 1u8, 2u8];
1116 ManuallyDrop<[UnsafeCell<u8>]>
1117 => @success bx!(ManuallyDrop::new([UnsafeCell::new(0)])), bx!(ManuallyDrop::new([UnsafeCell::new(0), UnsafeCell::new(1)]));
1118 ManuallyDrop<[UnsafeCell<bool>]>
1119 => @success bx!(ManuallyDrop::new([UnsafeCell::new(false)])), bx!(ManuallyDrop::new([UnsafeCell::new(false), UnsafeCell::new(true)])),
1120 @failure [2u8], [3u8], [0xFFu8], [0u8, 1u8, 2u8];
1121 Wrapping<bool>
1122 => @success Wrapping(false), Wrapping(true),
1123 @failure 2u8, 0xFFu8;
1124 *const NotZerocopy
1125 => @success ptr::null::<NotZerocopy>(),
1126 @failure [0x01; mem::size_of::<*const NotZerocopy>()];
1127 *mut NotZerocopy
1128 => @success ptr::null_mut::<NotZerocopy>(),
1129 @failure [0x01; mem::size_of::<*mut NotZerocopy>()];
1130 );
1131
1132 // Use the trick described in [1] to allow us to call methods
1133 // conditional on certain trait bounds.
1134 //
1135 // In all of these cases, methods return `Option<R>`, where `R` is the
1136 // return type of the method we're conditionally calling. The "real"
1137 // implementations (the ones defined in traits using `&self`) return
1138 // `Some`, and the default implementations (the ones defined as inherent
1139 // methods using `&mut self`) return `None`.
1140 //
1141 // [1] https://github.com/dtolnay/case-studies/blob/master/autoref-specialization/README.md
1142 mod autoref_trick {
1143 use super::*;
1144
1145 pub(super) struct AutorefWrapper<T: ?Sized>(pub(super) PhantomData<T>);
1146
1147 pub(super) trait TestIsBitValidShared<T: ?Sized> {
1148 #[allow(clippy::needless_lifetimes)]
1149 fn test_is_bit_valid_shared<
1150 'ptr,
1151 A: invariant::Aliasing + invariant::AtLeast<invariant::Shared>,
1152 >(
1153 &self,
1154 candidate: Maybe<'ptr, T, A>,
1155 ) -> Option<bool>;
1156 }
1157
1158 impl<T: TryFromBytes + Immutable + ?Sized> TestIsBitValidShared<T> for AutorefWrapper<T> {
1159 #[allow(clippy::needless_lifetimes)]
1160 fn test_is_bit_valid_shared<
1161 'ptr,
1162 A: invariant::Aliasing + invariant::AtLeast<invariant::Shared>,
1163 >(
1164 &self,
1165 candidate: Maybe<'ptr, T, A>,
1166 ) -> Option<bool> {
1167 Some(T::is_bit_valid(candidate))
1168 }
1169 }
1170
1171 pub(super) trait TestTryFromRef<T: ?Sized> {
1172 #[allow(clippy::needless_lifetimes)]
1173 fn test_try_from_ref<'bytes>(
1174 &self,
1175 bytes: &'bytes [u8],
1176 ) -> Option<Option<&'bytes T>>;
1177 }
1178
1179 impl<T: TryFromBytes + Immutable + KnownLayout + ?Sized> TestTryFromRef<T> for AutorefWrapper<T> {
1180 #[allow(clippy::needless_lifetimes)]
1181 fn test_try_from_ref<'bytes>(
1182 &self,
1183 bytes: &'bytes [u8],
1184 ) -> Option<Option<&'bytes T>> {
1185 Some(T::try_ref_from_bytes(bytes).ok())
1186 }
1187 }
1188
1189 pub(super) trait TestTryReadFrom<T> {
1190 fn test_try_read_from(&self, bytes: &[u8]) -> Option<Option<T>>;
1191 }
1192
1193 impl<T: TryFromBytes> TestTryReadFrom<T> for AutorefWrapper<T> {
1194 fn test_try_read_from(&self, bytes: &[u8]) -> Option<Option<T>> {
1195 Some(T::try_read_from_bytes(bytes).ok())
1196 }
1197 }
1198
1199 pub(super) trait TestAsBytes<T: ?Sized> {
1200 #[allow(clippy::needless_lifetimes)]
1201 fn test_as_bytes<'slf, 't>(&'slf self, t: &'t T) -> Option<&'t [u8]>;
1202 }
1203
1204 impl<T: IntoBytes + Immutable + ?Sized> TestAsBytes<T> for AutorefWrapper<T> {
1205 #[allow(clippy::needless_lifetimes)]
1206 fn test_as_bytes<'slf, 't>(&'slf self, t: &'t T) -> Option<&'t [u8]> {
1207 Some(t.as_bytes())
1208 }
1209 }
1210 }
1211
1212 use autoref_trick::*;
1213
1214 // Asserts that `$ty` is one of a list of types which are allowed to not
1215 // provide a "real" implementation for `$fn_name`. Since the
1216 // `autoref_trick` machinery fails silently, this allows us to ensure
1217 // that the "default" impls are only being used for types which we
1218 // expect.
1219 //
1220 // Note that, since this is a runtime test, it is possible to have an
1221 // allowlist which is too restrictive if the function in question is
1222 // never called for a particular type. For example, if `as_bytes` is not
1223 // supported for a particular type, and so `test_as_bytes` returns
1224 // `None`, methods such as `test_try_from_ref` may never be called for
1225 // that type. As a result, it's possible that, for example, adding
1226 // `as_bytes` support for a type would cause other allowlist assertions
1227 // to fail. This means that allowlist assertion failures should not
1228 // automatically be taken as a sign of a bug.
1229 macro_rules! assert_on_allowlist {
1230 ($fn_name:ident($ty:ty) $(: $($tys:ty),*)?) => {{
1231 use core::any::TypeId;
1232
1233 let allowlist: &[TypeId] = &[ $($(TypeId::of::<$tys>()),*)? ];
1234 let allowlist_names: &[&str] = &[ $($(stringify!($tys)),*)? ];
1235
1236 let id = TypeId::of::<$ty>();
1237 assert!(allowlist.contains(&id), "{} is not on allowlist for {}: {:?}", stringify!($ty), stringify!($fn_name), allowlist_names);
1238 }};
1239 }
1240
1241 // Asserts that `$ty` implements any `$trait` and doesn't implement any
1242 // `!$trait`. Note that all `$trait`s must come before any `!$trait`s.
1243 //
1244 // For `T: TryFromBytes`, uses `TryFromBytesTestable` to test success
1245 // and failure cases.
1246 macro_rules! assert_impls {
1247 ($ty:ty: TryFromBytes) => {
1248 // "Default" implementations that match the "real"
1249 // implementations defined in the `autoref_trick` module above.
1250 #[allow(unused, non_local_definitions)]
1251 impl AutorefWrapper<$ty> {
1252 #[allow(clippy::needless_lifetimes)]
1253 fn test_is_bit_valid_shared<'ptr, A: invariant::Aliasing + invariant::AtLeast<invariant::Shared>>(
1254 &mut self,
1255 candidate: Maybe<'ptr, $ty, A>,
1256 ) -> Option<bool> {
1257 assert_on_allowlist!(
1258 test_is_bit_valid_shared($ty):
1259 ManuallyDrop<UnsafeCell<()>>,
1260 ManuallyDrop<[UnsafeCell<u8>]>,
1261 ManuallyDrop<[UnsafeCell<bool>]>,
1262 CoreMaybeUninit<NotZerocopy>,
1263 CoreMaybeUninit<UnsafeCell<()>>,
1264 Wrapping<UnsafeCell<()>>
1265 );
1266
1267 None
1268 }
1269
1270 #[allow(clippy::needless_lifetimes)]
1271 fn test_try_from_ref<'bytes>(&mut self, _bytes: &'bytes [u8]) -> Option<Option<&'bytes $ty>> {
1272 assert_on_allowlist!(
1273 test_try_from_ref($ty):
1274 ManuallyDrop<[UnsafeCell<bool>]>
1275 );
1276
1277 None
1278 }
1279
1280 fn test_try_read_from(&mut self, _bytes: &[u8]) -> Option<Option<&$ty>> {
1281 assert_on_allowlist!(
1282 test_try_read_from($ty):
1283 str,
1284 ManuallyDrop<[u8]>,
1285 ManuallyDrop<[bool]>,
1286 ManuallyDrop<[UnsafeCell<bool>]>,
1287 [u8],
1288 [bool]
1289 );
1290
1291 None
1292 }
1293
1294 fn test_as_bytes(&mut self, _t: &$ty) -> Option<&[u8]> {
1295 assert_on_allowlist!(
1296 test_as_bytes($ty):
1297 Option<&'static UnsafeCell<NotZerocopy>>,
1298 Option<&'static mut UnsafeCell<NotZerocopy>>,
1299 Option<NonNull<UnsafeCell<NotZerocopy>>>,
1300 Option<Box<UnsafeCell<NotZerocopy>>>,
1301 Option<fn()>,
1302 Option<FnManyArgs>,
1303 Option<extern "C" fn()>,
1304 Option<ECFnManyArgs>,
1305 CoreMaybeUninit<u8>,
1306 CoreMaybeUninit<NotZerocopy>,
1307 CoreMaybeUninit<UnsafeCell<()>>,
1308 ManuallyDrop<UnsafeCell<()>>,
1309 ManuallyDrop<[UnsafeCell<u8>]>,
1310 ManuallyDrop<[UnsafeCell<bool>]>,
1311 Wrapping<UnsafeCell<()>>,
1312 *const NotZerocopy,
1313 *mut NotZerocopy
1314 );
1315
1316 None
1317 }
1318 }
1319
1320 <$ty as TryFromBytesTestable>::with_passing_test_cases(|mut val| {
1321 // TODO(#494): These tests only get exercised for types
1322 // which are `IntoBytes`. Once we implement #494, we should
1323 // be able to support non-`IntoBytes` types by zeroing
1324 // padding.
1325
1326 // We define `w` and `ww` since, in the case of the inherent
1327 // methods, Rust thinks they're both borrowed mutably at the
1328 // same time (given how we use them below). If we just
1329 // defined a single `w` and used it for multiple operations,
1330 // this would conflict.
1331 //
1332 // We `#[allow(unused_mut]` for the cases where the "real"
1333 // impls are used, which take `&self`.
1334 #[allow(unused_mut)]
1335 let (mut w, mut ww) = (AutorefWrapper::<$ty>(PhantomData), AutorefWrapper::<$ty>(PhantomData));
1336
1337 let c = Ptr::from_ref(&*val);
1338 let c = c.forget_aligned();
1339 // SAFETY: TODO(#899): This is unsound. `$ty` is not
1340 // necessarily `IntoBytes`, but that's the corner we've
1341 // backed ourselves into by using `Ptr::from_ref`.
1342 let c = unsafe { c.assume_initialized() };
1343 let res = w.test_is_bit_valid_shared(c);
1344 if let Some(res) = res {
1345 assert!(res, "{}::is_bit_valid({:?}) (shared `Ptr`): got false, expected true", stringify!($ty), val);
1346 }
1347
1348 let c = Ptr::from_mut(&mut *val);
1349 let c = c.forget_aligned();
1350 // SAFETY: TODO(#899): This is unsound. `$ty` is not
1351 // necessarily `IntoBytes`, but that's the corner we've
1352 // backed ourselves into by using `Ptr::from_ref`.
1353 let c = unsafe { c.assume_initialized() };
1354 let res = <$ty as TryFromBytes>::is_bit_valid(c);
1355 assert!(res, "{}::is_bit_valid({:?}) (exclusive `Ptr`): got false, expected true", stringify!($ty), val);
1356
1357 // `bytes` is `Some(val.as_bytes())` if `$ty: IntoBytes +
1358 // Immutable` and `None` otherwise.
1359 let bytes = w.test_as_bytes(&*val);
1360
1361 // The inner closure returns
1362 // `Some($ty::try_ref_from_bytes(bytes))` if `$ty:
1363 // Immutable` and `None` otherwise.
1364 let res = bytes.and_then(|bytes| ww.test_try_from_ref(bytes));
1365 if let Some(res) = res {
1366 assert!(res.is_some(), "{}::try_ref_from_bytes({:?}): got `None`, expected `Some`", stringify!($ty), val);
1367 }
1368
1369 if let Some(bytes) = bytes {
1370 // We need to get a mutable byte slice, and so we clone
1371 // into a `Vec`. However, we also need these bytes to
1372 // satisfy `$ty`'s alignment requirement, which isn't
1373 // guaranteed for `Vec<u8>`. In order to get around
1374 // this, we create a `Vec` which is twice as long as we
1375 // need. There is guaranteed to be an aligned byte range
1376 // of size `size_of_val(val)` within that range.
1377 let val = &*val;
1378 let size = mem::size_of_val(val);
1379 let align = mem::align_of_val(val);
1380
1381 let mut vec = bytes.to_vec();
1382 vec.extend(bytes);
1383 let slc = vec.as_slice();
1384 let offset = slc.as_ptr().align_offset(align);
1385 let bytes_mut = &mut vec.as_mut_slice()[offset..offset+size];
1386 bytes_mut.copy_from_slice(bytes);
1387
1388 let res = <$ty as TryFromBytes>::try_mut_from_bytes(bytes_mut);
1389 assert!(res.is_ok(), "{}::try_mut_from_bytes({:?}): got `Err`, expected `Ok`", stringify!($ty), val);
1390 }
1391
1392 let res = bytes.and_then(|bytes| ww.test_try_read_from(bytes));
1393 if let Some(res) = res {
1394 assert!(res.is_some(), "{}::try_read_from_bytes({:?}): got `None`, expected `Some`", stringify!($ty), val);
1395 }
1396 });
1397 #[allow(clippy::as_conversions)]
1398 <$ty as TryFromBytesTestable>::with_failing_test_cases(|c| {
1399 #[allow(unused_mut)] // For cases where the "real" impls are used, which take `&self`.
1400 let mut w = AutorefWrapper::<$ty>(PhantomData);
1401
1402 // This is `Some($ty::try_ref_from_bytes(c))` if `$ty:
1403 // Immutable` and `None` otherwise.
1404 let res = w.test_try_from_ref(c);
1405 if let Some(res) = res {
1406 assert!(res.is_none(), "{}::try_ref_from_bytes({:?}): got Some, expected None", stringify!($ty), c);
1407 }
1408
1409 let res = <$ty as TryFromBytes>::try_mut_from_bytes(c);
1410 assert!(res.is_err(), "{}::try_mut_from_bytes({:?}): got Ok, expected Err", stringify!($ty), c);
1411
1412 let res = w.test_try_read_from(c);
1413 if let Some(res) = res {
1414 assert!(res.is_none(), "{}::try_read_from_bytes({:?}): got Some, expected None", stringify!($ty), c);
1415 }
1416 });
1417
1418 #[allow(dead_code)]
1419 const _: () = { static_assertions::assert_impl_all!($ty: TryFromBytes); };
1420 };
1421 ($ty:ty: $trait:ident) => {
1422 #[allow(dead_code)]
1423 const _: () = { static_assertions::assert_impl_all!($ty: $trait); };
1424 };
1425 ($ty:ty: !$trait:ident) => {
1426 #[allow(dead_code)]
1427 const _: () = { static_assertions::assert_not_impl_any!($ty: $trait); };
1428 };
1429 ($ty:ty: $($trait:ident),* $(,)? $(!$negative_trait:ident),*) => {
1430 $(
1431 assert_impls!($ty: $trait);
1432 )*
1433
1434 $(
1435 assert_impls!($ty: !$negative_trait);
1436 )*
1437 };
1438 }
1439
1440 // NOTE: The negative impl assertions here are not necessarily
1441 // prescriptive. They merely serve as change detectors to make sure
1442 // we're aware of what trait impls are getting added with a given
1443 // change. Of course, some impls would be invalid (e.g., `bool:
1444 // FromBytes`), and so this change detection is very important.
1445
1446 assert_impls!(
1447 (): KnownLayout,
1448 Immutable,
1449 TryFromBytes,
1450 FromZeros,
1451 FromBytes,
1452 IntoBytes,
1453 Unaligned
1454 );
1455 assert_impls!(
1456 u8: KnownLayout,
1457 Immutable,
1458 TryFromBytes,
1459 FromZeros,
1460 FromBytes,
1461 IntoBytes,
1462 Unaligned
1463 );
1464 assert_impls!(
1465 i8: KnownLayout,
1466 Immutable,
1467 TryFromBytes,
1468 FromZeros,
1469 FromBytes,
1470 IntoBytes,
1471 Unaligned
1472 );
1473 assert_impls!(
1474 u16: KnownLayout,
1475 Immutable,
1476 TryFromBytes,
1477 FromZeros,
1478 FromBytes,
1479 IntoBytes,
1480 !Unaligned
1481 );
1482 assert_impls!(
1483 i16: KnownLayout,
1484 Immutable,
1485 TryFromBytes,
1486 FromZeros,
1487 FromBytes,
1488 IntoBytes,
1489 !Unaligned
1490 );
1491 assert_impls!(
1492 u32: KnownLayout,
1493 Immutable,
1494 TryFromBytes,
1495 FromZeros,
1496 FromBytes,
1497 IntoBytes,
1498 !Unaligned
1499 );
1500 assert_impls!(
1501 i32: KnownLayout,
1502 Immutable,
1503 TryFromBytes,
1504 FromZeros,
1505 FromBytes,
1506 IntoBytes,
1507 !Unaligned
1508 );
1509 assert_impls!(
1510 u64: KnownLayout,
1511 Immutable,
1512 TryFromBytes,
1513 FromZeros,
1514 FromBytes,
1515 IntoBytes,
1516 !Unaligned
1517 );
1518 assert_impls!(
1519 i64: KnownLayout,
1520 Immutable,
1521 TryFromBytes,
1522 FromZeros,
1523 FromBytes,
1524 IntoBytes,
1525 !Unaligned
1526 );
1527 assert_impls!(
1528 u128: KnownLayout,
1529 Immutable,
1530 TryFromBytes,
1531 FromZeros,
1532 FromBytes,
1533 IntoBytes,
1534 !Unaligned
1535 );
1536 assert_impls!(
1537 i128: KnownLayout,
1538 Immutable,
1539 TryFromBytes,
1540 FromZeros,
1541 FromBytes,
1542 IntoBytes,
1543 !Unaligned
1544 );
1545 assert_impls!(
1546 usize: KnownLayout,
1547 Immutable,
1548 TryFromBytes,
1549 FromZeros,
1550 FromBytes,
1551 IntoBytes,
1552 !Unaligned
1553 );
1554 assert_impls!(
1555 isize: KnownLayout,
1556 Immutable,
1557 TryFromBytes,
1558 FromZeros,
1559 FromBytes,
1560 IntoBytes,
1561 !Unaligned
1562 );
1563 #[cfg(feature = "float-nightly")]
1564 assert_impls!(
1565 f16: KnownLayout,
1566 Immutable,
1567 TryFromBytes,
1568 FromZeros,
1569 FromBytes,
1570 IntoBytes,
1571 !Unaligned
1572 );
1573 assert_impls!(
1574 f32: KnownLayout,
1575 Immutable,
1576 TryFromBytes,
1577 FromZeros,
1578 FromBytes,
1579 IntoBytes,
1580 !Unaligned
1581 );
1582 assert_impls!(
1583 f64: KnownLayout,
1584 Immutable,
1585 TryFromBytes,
1586 FromZeros,
1587 FromBytes,
1588 IntoBytes,
1589 !Unaligned
1590 );
1591 #[cfg(feature = "float-nightly")]
1592 assert_impls!(
1593 f128: KnownLayout,
1594 Immutable,
1595 TryFromBytes,
1596 FromZeros,
1597 FromBytes,
1598 IntoBytes,
1599 !Unaligned
1600 );
1601 assert_impls!(
1602 bool: KnownLayout,
1603 Immutable,
1604 TryFromBytes,
1605 FromZeros,
1606 IntoBytes,
1607 Unaligned,
1608 !FromBytes
1609 );
1610 assert_impls!(
1611 char: KnownLayout,
1612 Immutable,
1613 TryFromBytes,
1614 FromZeros,
1615 IntoBytes,
1616 !FromBytes,
1617 !Unaligned
1618 );
1619 assert_impls!(
1620 str: KnownLayout,
1621 Immutable,
1622 TryFromBytes,
1623 FromZeros,
1624 IntoBytes,
1625 Unaligned,
1626 !FromBytes
1627 );
1628
1629 assert_impls!(
1630 NonZeroU8: KnownLayout,
1631 Immutable,
1632 TryFromBytes,
1633 IntoBytes,
1634 Unaligned,
1635 !FromZeros,
1636 !FromBytes
1637 );
1638 assert_impls!(
1639 NonZeroI8: KnownLayout,
1640 Immutable,
1641 TryFromBytes,
1642 IntoBytes,
1643 Unaligned,
1644 !FromZeros,
1645 !FromBytes
1646 );
1647 assert_impls!(
1648 NonZeroU16: KnownLayout,
1649 Immutable,
1650 TryFromBytes,
1651 IntoBytes,
1652 !FromBytes,
1653 !Unaligned
1654 );
1655 assert_impls!(
1656 NonZeroI16: KnownLayout,
1657 Immutable,
1658 TryFromBytes,
1659 IntoBytes,
1660 !FromBytes,
1661 !Unaligned
1662 );
1663 assert_impls!(
1664 NonZeroU32: KnownLayout,
1665 Immutable,
1666 TryFromBytes,
1667 IntoBytes,
1668 !FromBytes,
1669 !Unaligned
1670 );
1671 assert_impls!(
1672 NonZeroI32: KnownLayout,
1673 Immutable,
1674 TryFromBytes,
1675 IntoBytes,
1676 !FromBytes,
1677 !Unaligned
1678 );
1679 assert_impls!(
1680 NonZeroU64: KnownLayout,
1681 Immutable,
1682 TryFromBytes,
1683 IntoBytes,
1684 !FromBytes,
1685 !Unaligned
1686 );
1687 assert_impls!(
1688 NonZeroI64: KnownLayout,
1689 Immutable,
1690 TryFromBytes,
1691 IntoBytes,
1692 !FromBytes,
1693 !Unaligned
1694 );
1695 assert_impls!(
1696 NonZeroU128: KnownLayout,
1697 Immutable,
1698 TryFromBytes,
1699 IntoBytes,
1700 !FromBytes,
1701 !Unaligned
1702 );
1703 assert_impls!(
1704 NonZeroI128: KnownLayout,
1705 Immutable,
1706 TryFromBytes,
1707 IntoBytes,
1708 !FromBytes,
1709 !Unaligned
1710 );
1711 assert_impls!(
1712 NonZeroUsize: KnownLayout,
1713 Immutable,
1714 TryFromBytes,
1715 IntoBytes,
1716 !FromBytes,
1717 !Unaligned
1718 );
1719 assert_impls!(
1720 NonZeroIsize: KnownLayout,
1721 Immutable,
1722 TryFromBytes,
1723 IntoBytes,
1724 !FromBytes,
1725 !Unaligned
1726 );
1727
1728 assert_impls!(Option<NonZeroU8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1729 assert_impls!(Option<NonZeroI8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1730 assert_impls!(Option<NonZeroU16>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1731 assert_impls!(Option<NonZeroI16>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1732 assert_impls!(Option<NonZeroU32>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1733 assert_impls!(Option<NonZeroI32>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1734 assert_impls!(Option<NonZeroU64>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1735 assert_impls!(Option<NonZeroI64>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1736 assert_impls!(Option<NonZeroU128>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1737 assert_impls!(Option<NonZeroI128>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1738 assert_impls!(Option<NonZeroUsize>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1739 assert_impls!(Option<NonZeroIsize>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned);
1740
1741 // Implements none of the ZC traits.
1742 struct NotZerocopy;
1743
1744 #[rustfmt::skip]
1745 type FnManyArgs = fn(
1746 NotZerocopy, u8, u8, u8, u8, u8, u8, u8, u8, u8, u8, u8,
1747 ) -> (NotZerocopy, NotZerocopy);
1748
1749 // Allowed, because we're not actually using this type for FFI.
1750 #[allow(improper_ctypes_definitions)]
1751 #[rustfmt::skip]
1752 type ECFnManyArgs = extern "C" fn(
1753 NotZerocopy, u8, u8, u8, u8, u8, u8, u8, u8, u8, u8, u8,
1754 ) -> (NotZerocopy, NotZerocopy);
1755
1756 #[cfg(feature = "alloc")]
1757 assert_impls!(Option<Box<UnsafeCell<NotZerocopy>>>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1758 assert_impls!(Option<Box<[UnsafeCell<NotZerocopy>]>>: KnownLayout, !Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1759 assert_impls!(Option<&'static UnsafeCell<NotZerocopy>>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1760 assert_impls!(Option<&'static [UnsafeCell<NotZerocopy>]>: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1761 assert_impls!(Option<&'static mut UnsafeCell<NotZerocopy>>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1762 assert_impls!(Option<&'static mut [UnsafeCell<NotZerocopy>]>: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1763 assert_impls!(Option<NonNull<UnsafeCell<NotZerocopy>>>: KnownLayout, TryFromBytes, FromZeros, Immutable, !FromBytes, !IntoBytes, !Unaligned);
1764 assert_impls!(Option<NonNull<[UnsafeCell<NotZerocopy>]>>: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1765 assert_impls!(Option<fn()>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1766 assert_impls!(Option<FnManyArgs>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1767 assert_impls!(Option<extern "C" fn()>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1768 assert_impls!(Option<ECFnManyArgs>: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1769
1770 assert_impls!(PhantomData<NotZerocopy>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1771 assert_impls!(PhantomData<UnsafeCell<()>>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1772 assert_impls!(PhantomData<[u8]>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1773
1774 assert_impls!(ManuallyDrop<u8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1775 // This test is important because it allows us to test our hand-rolled
1776 // implementation of `<ManuallyDrop<T> as TryFromBytes>::is_bit_valid`.
1777 assert_impls!(ManuallyDrop<bool>: KnownLayout, Immutable, TryFromBytes, FromZeros, IntoBytes, Unaligned, !FromBytes);
1778 assert_impls!(ManuallyDrop<[u8]>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1779 // This test is important because it allows us to test our hand-rolled
1780 // implementation of `<ManuallyDrop<T> as TryFromBytes>::is_bit_valid`.
1781 assert_impls!(ManuallyDrop<[bool]>: KnownLayout, Immutable, TryFromBytes, FromZeros, IntoBytes, Unaligned, !FromBytes);
1782 assert_impls!(ManuallyDrop<NotZerocopy>: !Immutable, !TryFromBytes, !KnownLayout, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1783 assert_impls!(ManuallyDrop<[NotZerocopy]>: KnownLayout, !Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1784 assert_impls!(ManuallyDrop<UnsafeCell<()>>: KnownLayout, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned, !Immutable);
1785 assert_impls!(ManuallyDrop<[UnsafeCell<u8>]>: KnownLayout, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned, !Immutable);
1786 assert_impls!(ManuallyDrop<[UnsafeCell<bool>]>: KnownLayout, TryFromBytes, FromZeros, IntoBytes, Unaligned, !Immutable, !FromBytes);
1787
1788 assert_impls!(CoreMaybeUninit<u8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, Unaligned, !IntoBytes);
1789 assert_impls!(CoreMaybeUninit<NotZerocopy>: KnownLayout, TryFromBytes, FromZeros, FromBytes, !Immutable, !IntoBytes, !Unaligned);
1790 assert_impls!(CoreMaybeUninit<UnsafeCell<()>>: KnownLayout, TryFromBytes, FromZeros, FromBytes, Unaligned, !Immutable, !IntoBytes);
1791
1792 assert_impls!(Wrapping<u8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1793 // This test is important because it allows us to test our hand-rolled
1794 // implementation of `<Wrapping<T> as TryFromBytes>::is_bit_valid`.
1795 assert_impls!(Wrapping<bool>: KnownLayout, Immutable, TryFromBytes, FromZeros, IntoBytes, Unaligned, !FromBytes);
1796 assert_impls!(Wrapping<NotZerocopy>: KnownLayout, !Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1797 assert_impls!(Wrapping<UnsafeCell<()>>: KnownLayout, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned, !Immutable);
1798
1799 assert_impls!(Unalign<u8>: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, Unaligned);
1800 // This test is important because it allows us to test our hand-rolled
1801 // implementation of `<Unalign<T> as TryFromBytes>::is_bit_valid`.
1802 assert_impls!(Unalign<bool>: KnownLayout, Immutable, TryFromBytes, FromZeros, IntoBytes, Unaligned, !FromBytes);
1803 assert_impls!(Unalign<NotZerocopy>: KnownLayout, Unaligned, !Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes);
1804
1805 assert_impls!(
1806 [u8]: KnownLayout,
1807 Immutable,
1808 TryFromBytes,
1809 FromZeros,
1810 FromBytes,
1811 IntoBytes,
1812 Unaligned
1813 );
1814 assert_impls!(
1815 [bool]: KnownLayout,
1816 Immutable,
1817 TryFromBytes,
1818 FromZeros,
1819 IntoBytes,
1820 Unaligned,
1821 !FromBytes
1822 );
1823 assert_impls!([NotZerocopy]: KnownLayout, !Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1824 assert_impls!(
1825 [u8; 0]: KnownLayout,
1826 Immutable,
1827 TryFromBytes,
1828 FromZeros,
1829 FromBytes,
1830 IntoBytes,
1831 Unaligned,
1832 );
1833 assert_impls!(
1834 [NotZerocopy; 0]: KnownLayout,
1835 !Immutable,
1836 !TryFromBytes,
1837 !FromZeros,
1838 !FromBytes,
1839 !IntoBytes,
1840 !Unaligned
1841 );
1842 assert_impls!(
1843 [u8; 1]: KnownLayout,
1844 Immutable,
1845 TryFromBytes,
1846 FromZeros,
1847 FromBytes,
1848 IntoBytes,
1849 Unaligned,
1850 );
1851 assert_impls!(
1852 [NotZerocopy; 1]: KnownLayout,
1853 !Immutable,
1854 !TryFromBytes,
1855 !FromZeros,
1856 !FromBytes,
1857 !IntoBytes,
1858 !Unaligned
1859 );
1860
1861 assert_impls!(*const NotZerocopy: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1862 assert_impls!(*mut NotZerocopy: KnownLayout, Immutable, TryFromBytes, FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1863 assert_impls!(*const [NotZerocopy]: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1864 assert_impls!(*mut [NotZerocopy]: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1865 assert_impls!(*const dyn Debug: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1866 assert_impls!(*mut dyn Debug: KnownLayout, Immutable, !TryFromBytes, !FromZeros, !FromBytes, !IntoBytes, !Unaligned);
1867
1868 #[cfg(feature = "simd")]
1869 {
1870 #[allow(unused_macros)]
1871 macro_rules! test_simd_arch_mod {
1872 ($arch:ident, $($typ:ident),*) => {
1873 {
1874 use core::arch::$arch::{$($typ),*};
1875 use crate::*;
1876 $( assert_impls!($typ: KnownLayout, Immutable, TryFromBytes, FromZeros, FromBytes, IntoBytes, !Unaligned); )*
1877 }
1878 };
1879 }
1880 #[cfg(target_arch = "x86")]
1881 test_simd_arch_mod!(x86, __m128, __m128d, __m128i, __m256, __m256d, __m256i);
1882
1883 #[cfg(all(feature = "simd-nightly", target_arch = "x86"))]
1884 test_simd_arch_mod!(x86, __m512bh, __m512, __m512d, __m512i);
1885
1886 #[cfg(target_arch = "x86_64")]
1887 test_simd_arch_mod!(x86_64, __m128, __m128d, __m128i, __m256, __m256d, __m256i);
1888
1889 #[cfg(all(feature = "simd-nightly", target_arch = "x86_64"))]
1890 test_simd_arch_mod!(x86_64, __m512bh, __m512, __m512d, __m512i);
1891
1892 #[cfg(target_arch = "wasm32")]
1893 test_simd_arch_mod!(wasm32, v128);
1894
1895 #[cfg(all(feature = "simd-nightly", target_arch = "powerpc"))]
1896 test_simd_arch_mod!(
1897 powerpc,
1898 vector_bool_long,
1899 vector_double,
1900 vector_signed_long,
1901 vector_unsigned_long
1902 );
1903
1904 #[cfg(all(feature = "simd-nightly", target_arch = "powerpc64"))]
1905 test_simd_arch_mod!(
1906 powerpc64,
1907 vector_bool_long,
1908 vector_double,
1909 vector_signed_long,
1910 vector_unsigned_long
1911 );
1912 #[cfg(all(target_arch = "aarch64", zerocopy_aarch64_simd_1_59_0))]
1913 #[rustfmt::skip]
1914 test_simd_arch_mod!(
1915 aarch64, float32x2_t, float32x4_t, float64x1_t, float64x2_t, int8x8_t, int8x8x2_t,
1916 int8x8x3_t, int8x8x4_t, int8x16_t, int8x16x2_t, int8x16x3_t, int8x16x4_t, int16x4_t,
1917 int16x8_t, int32x2_t, int32x4_t, int64x1_t, int64x2_t, poly8x8_t, poly8x8x2_t, poly8x8x3_t,
1918 poly8x8x4_t, poly8x16_t, poly8x16x2_t, poly8x16x3_t, poly8x16x4_t, poly16x4_t, poly16x8_t,
1919 poly64x1_t, poly64x2_t, uint8x8_t, uint8x8x2_t, uint8x8x3_t, uint8x8x4_t, uint8x16_t,
1920 uint8x16x2_t, uint8x16x3_t, uint8x16x4_t, uint16x4_t, uint16x8_t, uint32x2_t, uint32x4_t,
1921 uint64x1_t, uint64x2_t
1922 );
1923 #[cfg(all(feature = "simd-nightly", target_arch = "arm"))]
1924 #[rustfmt::skip]
1925 test_simd_arch_mod!(arm, int8x4_t, uint8x4_t);
1926 }
1927 }
1928}
1929