|
| 1 | +//! Best-effort dependency-free memory cleanup helpers. |
| 2 | +
|
| 3 | +#[inline(never)] |
| 4 | +#[allow(unsafe_code)] |
| 5 | +pub(crate) fn wipe_bytes(bytes: &mut [u8]) { |
| 6 | + for byte in bytes.iter_mut() { |
| 7 | + // SAFETY: `byte` comes from a unique mutable slice iterator, so the |
| 8 | + // pointer is non-null, aligned, valid for one `u8` write, and does not |
| 9 | + // alias another live mutable reference during this iteration. |
| 10 | + unsafe { |
| 11 | + core::ptr::write_volatile(byte, 0); |
| 12 | + } |
| 13 | + } |
| 14 | + wipe_barrier(bytes.as_mut_ptr(), bytes.len()); |
| 15 | +} |
| 16 | + |
| 17 | +#[inline(never)] |
| 18 | +#[allow(unsafe_code)] |
| 19 | +fn wipe_barrier(ptr: *mut u8, len: usize) { |
| 20 | + let _ = (ptr, len); |
| 21 | + |
| 22 | + #[cfg(all(not(miri), any(target_arch = "x86", target_arch = "x86_64")))] |
| 23 | + { |
| 24 | + // `mfence` orders prior stores before later memory operations on |
| 25 | + // x86/x86_64, while the pointer and length are opaque optimizer inputs. |
| 26 | + // SAFETY: the assembly block does not read or write through the pointer. |
| 27 | + unsafe { |
| 28 | + core::arch::asm!( |
| 29 | + "mfence", |
| 30 | + "/* {0} {1} */", |
| 31 | + in(reg) ptr, |
| 32 | + in(reg) len, |
| 33 | + options(nostack, preserves_flags) |
| 34 | + ); |
| 35 | + } |
| 36 | + } |
| 37 | + |
| 38 | + #[cfg(all(not(miri), target_arch = "aarch64"))] |
| 39 | + { |
| 40 | + // `dsb sy` completes prior explicit memory accesses before later |
| 41 | + // instructions, and `isb sy` flushes subsequent instruction context. |
| 42 | + // SAFETY: the assembly block does not read or write through the pointer. |
| 43 | + unsafe { |
| 44 | + core::arch::asm!( |
| 45 | + "dsb sy", |
| 46 | + "isb sy", |
| 47 | + "hint #20", |
| 48 | + "/* {0} {1} */", |
| 49 | + in(reg) ptr, |
| 50 | + in(reg) len, |
| 51 | + options(nostack, preserves_flags) |
| 52 | + ); |
| 53 | + } |
| 54 | + } |
| 55 | + |
| 56 | + #[cfg(all(not(miri), target_arch = "arm"))] |
| 57 | + { |
| 58 | + // `dsb sy` completes prior explicit memory accesses before later |
| 59 | + // instructions, and `isb sy` flushes subsequent instruction context. |
| 60 | + // SAFETY: the assembly block does not read or write through the pointer. |
| 61 | + unsafe { |
| 62 | + core::arch::asm!( |
| 63 | + "dsb sy", |
| 64 | + "isb sy", |
| 65 | + "/* {0} {1} */", |
| 66 | + in(reg) ptr, |
| 67 | + in(reg) len, |
| 68 | + options(nostack, preserves_flags) |
| 69 | + ); |
| 70 | + } |
| 71 | + } |
| 72 | + |
| 73 | + #[cfg(all(not(miri), any(target_arch = "riscv32", target_arch = "riscv64")))] |
| 74 | + { |
| 75 | + // `fence rw, rw` orders prior reads/writes before later reads/writes. |
| 76 | + // SAFETY: the assembly block does not read or write through the pointer. |
| 77 | + unsafe { |
| 78 | + core::arch::asm!( |
| 79 | + "fence rw, rw", |
| 80 | + "/* {0} {1} */", |
| 81 | + in(reg) ptr, |
| 82 | + in(reg) len, |
| 83 | + options(nostack, preserves_flags) |
| 84 | + ); |
| 85 | + } |
| 86 | + } |
| 87 | + |
| 88 | + core::sync::atomic::compiler_fence(core::sync::atomic::Ordering::SeqCst); |
| 89 | +} |
| 90 | + |
| 91 | +pub(crate) fn wipe_tail(bytes: &mut [u8], start: usize) { |
| 92 | + wipe_bytes(&mut bytes[start..]); |
| 93 | +} |
| 94 | + |
| 95 | +#[cfg(feature = "alloc")] |
| 96 | +#[allow(unsafe_code)] |
| 97 | +pub(crate) fn wipe_vec_spare_capacity(bytes: &mut alloc::vec::Vec<u8>) { |
| 98 | + let ptr = bytes.as_mut_ptr(); |
| 99 | + let len = bytes.len(); |
| 100 | + let capacity = bytes.capacity(); |
| 101 | + let spare = capacity - len; |
| 102 | + if spare == 0 { |
| 103 | + return; |
| 104 | + } |
| 105 | + |
| 106 | + let mut offset = len; |
| 107 | + while offset < capacity { |
| 108 | + // SAFETY: `offset` is within the vector allocation's spare capacity, so |
| 109 | + // the pointer is valid, aligned, and writable for one `u8`. This writes |
| 110 | + // a zero byte without reading the prior uninitialized value. |
| 111 | + unsafe { |
| 112 | + core::ptr::write_volatile(ptr.add(offset), 0); |
| 113 | + } |
| 114 | + offset += 1; |
| 115 | + } |
| 116 | + // SAFETY: `spare > 0`, so `len < capacity` and `ptr.add(len)` points |
| 117 | + // inside the vector allocation at the first spare-capacity byte. |
| 118 | + let spare_ptr = unsafe { ptr.add(len) }; |
| 119 | + wipe_barrier(spare_ptr, spare); |
| 120 | +} |
| 121 | + |
| 122 | +#[cfg(feature = "alloc")] |
| 123 | +pub(crate) fn wipe_vec_all(bytes: &mut alloc::vec::Vec<u8>) { |
| 124 | + wipe_bytes(bytes); |
| 125 | + wipe_vec_spare_capacity(bytes); |
| 126 | +} |
0 commit comments