mod.rs - source
Description: Source of the Rust file `library/core/src/ptr/mod.rs`.

#
core/ptr/
mod.rs

    1//! Manually manage memory through raw pointers.
    2//!
    3//! *[See also the pointer primitive types](pointer).*
    4//!
    5//! # Safety
    6//!
    7//! Many functions in this module take raw pointers as arguments and read from or write to them. For
    8//! this to be safe, these pointers must be *valid* for the given access. Whether a pointer is valid
    9//! depends on the operation it is used for (read or write), and the extent of the memory that is
    10//! accessed (i.e., how many bytes are read/written) -- it makes no sense to ask "is this pointer
    11//! valid"; one has to ask "is this pointer valid for a given access". Most functions use `*mut T`
    12//! and `*const T` to access only a single value, in which case the documentation omits the size and
    13//! implicitly assumes it to be `size_of::<T>()` bytes.
    14//!
    15//! The precise rules for validity are not determined yet. The guarantees that are
    16//! provided at this point are very minimal:
    17//!
    18//! * For memory accesses of [size zero][zst], *every* pointer is valid, including the [null]
    19//!   pointer. The following points are only concerned with non-zero-sized accesses.
    20//! * A [null] pointer is *never* valid.
    21//! * For a pointer to be valid, it is necessary, but not always sufficient, that the pointer be
    22//!   *dereferenceable*. The [provenance] of the pointer is used to determine which [allocation]
    23//!   it is derived from; a pointer is dereferenceable if the memory range of the given size
    24//!   starting at the pointer is entirely contained within the bounds of that allocation. Note
    25//!   that in Rust, every (stack-allocated) variable is considered a separate allocation.
    26//! * All accesses performed by functions in this module are *non-atomic* in the sense
    27//!   of [atomic operations] used to synchronize between threads. This means it is
    28//!   undefined behavior to perform two concurrent accesses to the same location from different
    29//!   threads unless both accesses only read from memory. Notice that this explicitly
    30//!   includes [`read_volatile`] and [`write_volatile`]: Volatile accesses cannot
    31//!   be used for inter-thread synchronization, regardless of whether they are acting on
    32//!   Rust memory or not.
    33//! * The result of casting a reference to a pointer is valid for as long as the
    34//!   underlying allocation is live and no reference (just raw pointers) is used to
    35//!   access the same memory. That is, reference and pointer accesses cannot be
    36//!   interleaved.
    37//!
    38//! These axioms, along with careful use of [`offset`] for pointer arithmetic,
    39//! are enough to correctly implement many useful things in unsafe code. Stronger guarantees
    40//! will be provided eventually, as the [aliasing] rules are being determined. For more
    41//! information, see the [book] as well as the section in the reference devoted
    42//! to [undefined behavior][ub].
    43//!
    44//! We say that a pointer is "dangling" if it is not valid for any non-zero-sized accesses. This
    45//! means out-of-bounds pointers, pointers to freed memory, null pointers, and pointers created with
    46//! [`NonNull::dangling`] are all dangling.
    47//!
    48//! ## Alignment
    49//!
    50//! Valid raw pointers as defined above are not necessarily properly aligned (where
    51//! "proper" alignment is defined by the pointee type, i.e., `*const T` must be
    52//! aligned to `align_of::<T>()`). However, most functions require their
    53//! arguments to be properly aligned, and will explicitly state
    54//! this requirement in their documentation. Notable exceptions to this are
    55//! [`read_unaligned`] and [`write_unaligned`].
    56//!
    57//! When a function requires proper alignment, it does so even if the access
    58//! has size 0, i.e., even if memory is not actually touched. Consider using
    59//! [`NonNull::dangling`] in such cases.
    60//!
    61//! ## Pointer to reference conversion
    62//!
    63//! When converting a pointer to a reference (e.g. via `&*ptr` or `&mut *ptr`),
    64//! there are several rules that must be followed:
    65//!
    66//! * The pointer must be properly aligned.
    67//!
    68//! * It must be non-null.
    69//!
    70//! * It must be "dereferenceable" in the sense defined above.
    71//!
    72//! * The pointer must point to a [valid value] of type `T`.
    73//!
    74//! * You must enforce Rust's aliasing rules. The exact aliasing rules are not decided yet, so we
    75//!   only give a rough overview here. The rules also depend on whether a mutable or a shared
    76//!   reference is being created.
    77//!   * When creating a mutable reference, then while this reference exists, the memory it points to
    78//!     must not get accessed (read or written) through any other pointer or reference not derived
    79//!     from this reference.
    80//!   * When creating a shared reference, then while this reference exists, the memory it points to
    81//!     must not get mutated (except inside `UnsafeCell`).
    82//!
    83//! If a pointer follows all of these rules, it is said to be
    84//! *convertible to a (mutable or shared) reference*.
    85// ^ we use this term instead of saying that the produced reference must
    86// be valid, as the validity of a reference is easily confused for the
    87// validity of the thing it refers to, and while the two concepts are
    88// closely related, they are not identical.
    89//!
    90//! These rules apply even if the result is unused!
    91//! (The part about being initialized is not yet fully decided, but until
    92//! it is, the only safe approach is to ensure that they are indeed initialized.)
    93//!
    94//! An example of the implications of the above rules is that an expression such
    95//! as `unsafe { &*(0 as *const u8) }` is Immediate Undefined Behavior.
    96//!
    97//! [valid value]: ../../reference/behavior-considered-undefined.html#invalid-values
    98//!
    99//! ## Allocation
    100//!
    101//! <a id="allocated-object"></a> <!-- keep old URLs working -->
    102//!
    103//! An *allocation* is a subset of program memory which is addressable
    104//! from Rust, and within which pointer arithmetic is possible. Examples of
    105//! allocations include heap allocations, stack-allocated variables,
    106//! statics, and consts. The safety preconditions of some Rust operations -
    107//! such as `offset` and field projections (`expr.field`) - are defined in
    108//! terms of the allocations on which they operate.
    109//!
    110//! An allocation has a base address, a size, and a set of memory
    111//! addresses. It is possible for an allocation to have zero size, but
    112//! such an allocation will still have a base address. The base address
    113//! of an allocation is not necessarily unique. While it is currently the
    114//! case that an allocation always has a set of memory addresses which is
    115//! fully contiguous (i.e., has no "holes"), there is no guarantee that this
    116//! will not change in the future.
    117//!
    118//! Allocations must behave like "normal" memory: in particular, reads must not have
    119//! side-effects, and writes must become visible to other threads using the usual synchronization
    120//! primitives.
    121//!
    122//! For any allocation with `base` address, `size`, and a set of
    123//! `addresses`, the following are guaranteed:
    124//! - For all addresses `a` in `addresses`, `a` is in the range `base .. (base +
    125//!   size)` (note that this requires `a < base + size`, not `a <= base + size`)
    126//! - `base` is not equal to [`null()`] (i.e., the address with the numerical
    127//!   value 0)
    128//! - `base + size <= usize::MAX`
    129//! - `size <= isize::MAX`
    130//!
    131//! As a consequence of these guarantees, given any address `a` within the set
    132//! of addresses of an allocation:
    133//! - It is guaranteed that `a - base` does not overflow `isize`
    134//! - It is guaranteed that `a - base` is non-negative
    135//! - It is guaranteed that, given `o = a - base` (i.e., the offset of `a` within
    136//!   the allocation), `base + o` will not wrap around the address space (in
    137//!   other words, will not overflow `usize`)
    138//!
    139//! [`null()`]: null
    140//!
    141//! # Provenance
    142//!
    143//! Pointers are not *simply* an "integer" or "address". For instance, it's uncontroversial
    144//! to say that a Use After Free is clearly Undefined Behavior, even if you "get lucky"
    145//! and the freed memory gets reallocated before your read/write (in fact this is the
    146//! worst-case scenario, UAFs would be much less concerning if this didn't happen!).
    147//! As another example, consider that [`wrapping_offset`] is documented to "remember"
    148//! the allocation that the original pointer points to, even if it is offset far
    149//! outside the memory range occupied by that allocation.
    150//! To rationalize claims like this, pointers need to somehow be *more* than just their addresses:
    151//! they must have **provenance**.
    152//!
    153//! A pointer value in Rust semantically contains the following information:
    154//!
    155//! * The **address** it points to, which can be represented by a `usize`.
    156//! * The **provenance** it has, defining the memory it has permission to access. Provenance can be
    157//!   absent, in which case the pointer does not have permission to access any memory.
    158//!
    159//! The exact structure of provenance is not yet specified, but the permission defined by a
    160//! pointer's provenance have a *spatial* component, a *temporal* component, and a *mutability*
    161//! component:
    162//!
    163//! * Spatial: The set of memory addresses that the pointer is allowed to access.
    164//! * Temporal: The timespan during which the pointer is allowed to access those memory addresses.
    165//! * Mutability: Whether the pointer may only access the memory for reads, or also access it for
    166//!   writes. Note that this can interact with the other components, e.g. a pointer might permit
    167//!   mutation only for a subset of addresses, or only for a subset of its maximal timespan.
    168//!
    169//! When an [allocation] is created, it has a unique Original Pointer. For alloc
    170//! APIs this is literally the pointer the call returns, and for local variables and statics,
    171//! this is the name of the variable/static. (This is mildly overloading the term "pointer"
    172//! for the sake of brevity/exposition.)
    173//!
    174//! The Original Pointer for an allocation has provenance that constrains the *spatial*
    175//! permissions of this pointer to the memory range of the allocation, and the *temporal*
    176//! permissions to the lifetime of the allocation. Provenance is implicitly inherited by all
    177//! pointers transitively derived from the Original Pointer through operations like [`offset`],
    178//! borrowing, and pointer casts. Some operations may *shrink* the permissions of the derived
    179//! provenance, limiting how much memory it can access or how long it's valid for (i.e. borrowing a
    180//! subfield and subslicing can shrink the spatial component of provenance, and all borrowing can
    181//! shrink the temporal component of provenance). However, no operation can ever *grow* the
    182//! permissions of the derived provenance: even if you "know" there is a larger allocation, you
    183//! can't derive a pointer with a larger provenance. Similarly, you cannot "recombine" two
    184//! contiguous provenances back into one (i.e. with a `fn merge(&[T], &[T]) -> &[T]`).
    185//!
    186//! A reference to a place always has provenance over at least the memory that place occupies.
    187//! A reference to a slice always has provenance over at least the range that slice describes.
    188//! Whether and when exactly the provenance of a reference gets "shrunk" to *exactly* fit
    189//! the memory it points to is not yet determined.
    190//!
    191//! A *shared* reference only ever has provenance that permits reading from memory,
    192//! and never permits writes, except inside [`UnsafeCell`].
    193//!
    194//! Provenance can affect whether a program has undefined behavior:
    195//!
    196//! * It is undefined behavior to access memory through a pointer that does not have provenance over
    197//!   that memory. Note that a pointer "at the end" of its provenance is not actually outside its
    198//!   provenance, it just has 0 bytes it can load/store. Zero-sized accesses do not require any
    199//!   provenance since they access an empty range of memory.
    200//!
    201//! * It is undefined behavior to [`offset`] a pointer across a memory range that is not contained
    202//!   in the allocation it is derived from, or to [`offset_from`] two pointers not derived
    203//!   from the same allocation. Provenance is used to say what exactly "derived from" even
    204//!   means: the lineage of a pointer is traced back to the Original Pointer it descends from, and
    205//!   that identifies the relevant allocation. In particular, it's always UB to offset a
    206//!   pointer derived from something that is now deallocated, except if the offset is 0.
    207//!
    208//! But it *is* still sound to:
    209//!
    210//! * Create a pointer without provenance from just an address (see [`without_provenance`]). Such a
    211//!   pointer cannot be used for memory accesses (except for zero-sized accesses). This can still be
    212//!   useful for sentinel values like `null` *or* to represent a tagged pointer that will never be
    213//!   dereferenceable. In general, it is always sound for an integer to pretend to be a pointer "for
    214//!   fun" as long as you don't use operations on it which require it to be valid (non-zero-sized
    215//!   offset, read, write, etc).
    216//!
    217//! * Forge an allocation of size zero at any sufficiently aligned non-null address.
    218//!   i.e. the usual "ZSTs are fake, do what you want" rules apply.
    219//!
    220//! * [`wrapping_offset`] a pointer outside its provenance. This includes pointers
    221//!   which have "no" provenance. In particular, this makes it sound to do pointer tagging tricks.
    222//!
    223//! * Compare arbitrary pointers by address. Pointer comparison ignores provenance and addresses
    224//!   *are* just integers, so there is always a coherent answer, even if the pointers are dangling
    225//!   or from different provenances. Note that if you get "lucky" and notice that a pointer at the
    226//!   end of one allocation is the "same" address as the start of another allocation,
    227//!   anything you do with that fact is *probably* going to be gibberish. The scope of that
    228//!   gibberish is kept under control by the fact that the two pointers *still* aren't allowed to
    229//!   access the other's allocation (bytes), because they still have different provenance.
    230//!
    231//! Note that the full definition of provenance in Rust is not decided yet, as this interacts
    232//! with the as-yet undecided [aliasing] rules.
    233//!
    234//! ## Pointers Vs Integers
    235//!
    236//! From this discussion, it becomes very clear that a `usize` *cannot* accurately represent a pointer,
    237//! and converting from a pointer to a `usize` is generally an operation which *only* extracts the
    238//! address. Converting this address back into pointer requires somehow answering the question:
    239//! which provenance should the resulting pointer have?
    240//!
    241//! Rust provides two ways of dealing with this situation: *Strict Provenance* and *Exposed Provenance*.
    242//!
    243//! Note that a pointer *can* represent a `usize` (via [`without_provenance`]), so the right type to
    244//! use in situations where a value is "sometimes a pointer and sometimes a bare `usize`" is a
    245//! pointer type.
    246//!
    247//! ## Strict Provenance
    248//!
    249//! "Strict Provenance" refers to a set of APIs designed to make working with provenance more
    250//! explicit. They are intended as substitutes for casting a pointer to an integer and back.
    251//!
    252//! Entirely avoiding integer-to-pointer casts successfully side-steps the inherent ambiguity of
    253//! that operation. This benefits compiler optimizations, and it is pretty much a requirement for
    254//! using tools like [Miri] and architectures like [CHERI] that aim to detect and diagnose pointer
    255//! misuse.
    256//!
    257//! The key insight to making programming without integer-to-pointer casts *at all* viable is the
    258//! [`with_addr`] method:
    259//!
    260//! ```text
    261//!     /// Creates a new pointer with the given address.
    262//!     ///
    263//!     /// This performs the same operation as an `addr as ptr` cast, but copies
    264//!     /// the *provenance* of `self` to the new pointer.
    265//!     /// This allows us to dynamically preserve and propagate this important
    266//!     /// information in a way that is otherwise impossible with a unary cast.
    267//!     ///
    268//!     /// This is equivalent to using `wrapping_offset` to offset `self` to the
    269//!     /// given address, and therefore has all the same capabilities and restrictions.
    270//!     pub fn with_addr(self, addr: usize) -> Self;
    271//! ```
    272//!
    273//! So you're still able to drop down to the address representation and do whatever
    274//! clever bit tricks you want *as long as* you're able to keep around a pointer
    275//! into the allocation you care about that can "reconstitute" the provenance.
    276//! Usually this is very easy, because you only are taking a pointer, messing with the address,
    277//! and then immediately converting back to a pointer. To make this use case more ergonomic,
    278//! we provide the [`map_addr`] method.
    279//!
    280//! To help make it clear that code is "following" Strict Provenance semantics, we also provide an
    281//! [`addr`] method which promises that the returned address is not part of a
    282//! pointer-integer-pointer roundtrip. In the future we may provide a lint for pointer<->integer
    283//! casts to help you audit if your code conforms to strict provenance.
    284//!
    285//! ### Using Strict Provenance
    286//!
    287//! Most code needs no changes to conform to strict provenance, as the only really concerning
    288//! operation is casts from `usize` to a pointer. For code which *does* cast a `usize` to a pointer,
    289//! the scope of the change depends on exactly what you're doing.
    290//!
    291//! In general, you just need to make sure that if you want to convert a `usize` address to a
    292//! pointer and then use that pointer to read/write memory, you need to keep around a pointer
    293//! that has sufficient provenance to perform that read/write itself. In this way all of your
    294//! casts from an address to a pointer are essentially just applying offsets/indexing.
    295//!
    296//! This is generally trivial to do for simple cases like tagged pointers *as long as you
    297//! represent the tagged pointer as an actual pointer and not a `usize`*. For instance:
    298//!
    299//! ```
    300//! unsafe {
    301//!     // A flag we want to pack into our pointer
    302//!     static HAS_DATA: usize = 0x1;
    303//!     static FLAG_MASK: usize = !HAS_DATA;
    304//!
    305//!     // Our value, which must have enough alignment to have spare least-significant-bits.
    306//!     let my_precious_data: u32 = 17;
    307//!     assert!(align_of::<u32>() > 1);
    308//!
    309//!     // Create a tagged pointer
    310//!     let ptr = &my_precious_data as *const u32;
    311//!     let tagged = ptr.map_addr(|addr| addr | HAS_DATA);
    312//!
    313//!     // Check the flag:
    314//!     if tagged.addr() & HAS_DATA != 0 {
    315//!         // Untag and read the pointer
    316//!         let data = *tagged.map_addr(|addr| addr & FLAG_MASK);
    317//!         assert_eq!(data, 17);
    318//!     } else {
    319//!         unreachable!()
    320//!     }
    321//! }
    322//! ```
    323//!
    324//! (Yes, if you've been using [`AtomicUsize`] for pointers in concurrent datastructures, you should
    325//! be using [`AtomicPtr`] instead. If that messes up the way you atomically manipulate pointers,
    326//! we would like to know why, and what needs to be done to fix it.)
    327//!
    328//! Situations where a valid pointer *must* be created from just an address, such as baremetal code
    329//! accessing a memory-mapped interface at a fixed address, cannot currently be handled with strict
    330//! provenance APIs and should use [exposed provenance](#exposed-provenance).
    331//!
    332//! ## Exposed Provenance
    333//!
    334//! As discussed above, integer-to-pointer casts are not possible with Strict Provenance APIs.
    335//! This is by design: the goal of Strict Provenance is to provide a clear specification that we are
    336//! confident can be formalized unambiguously and can be subject to precise formal reasoning.
    337//! Integer-to-pointer casts do not (currently) have such a clear specification.
    338//!
    339//! However, there exist situations where integer-to-pointer casts cannot be avoided, or
    340//! where avoiding them would require major refactoring. Legacy platform APIs also regularly assume
    341//! that `usize` can capture all the information that makes up a pointer.
    342//! Bare-metal platforms can also require the synthesis of a pointer "out of thin air" without
    343//! anywhere to obtain proper provenance from.
    344//!
    345//! Rust's model for dealing with integer-to-pointer casts is called *Exposed Provenance*. However,
    346//! the semantics of Exposed Provenance are on much less solid footing than Strict Provenance, and
    347//! at this point it is not yet clear whether a satisfying unambiguous semantics can be defined for
    348//! Exposed Provenance. (If that sounds bad, be reassured that other popular languages that provide
    349//! integer-to-pointer casts are not faring any better.) Furthermore, Exposed Provenance will not
    350//! work (well) with tools like [Miri] and [CHERI].
    351//!
    352//! Exposed Provenance is provided by the [`expose_provenance`] and [`with_exposed_provenance`] methods,
    353//! which are equivalent to `as` casts between pointers and integers.
    354//! - [`expose_provenance`] is a lot like [`addr`], but additionally adds the provenance of the
    355//!   pointer to a global list of 'exposed' provenances. (This list is purely conceptual, it exists
    356//!   for the purpose of specifying Rust but is not materialized in actual executions, except in
    357//!   tools like [Miri].)
    358//!   Memory which is outside the control of the Rust abstract machine (MMIO registers, for example)
    359//!   is always considered to be exposed, so long as this memory is disjoint from memory that will
    360//!   be used by the abstract machine such as the stack, heap, and statics.
    361//! - [`with_exposed_provenance`] can be used to construct a pointer with one of these previously
    362//!   'exposed' provenances. [`with_exposed_provenance`] takes only `addr: usize` as arguments, so
    363//!   unlike in [`with_addr`] there is no indication of what the correct provenance for the returned
    364//!   pointer is -- and that is exactly what makes integer-to-pointer casts so tricky to rigorously
    365//!   specify! The compiler will do its best to pick the right provenance for you, but currently we
    366//!   cannot provide any guarantees about which provenance the resulting pointer will have. Only one
    367//!   thing is clear: if there is *no* previously 'exposed' provenance that justifies the way the
    368//!   returned pointer will be used, the program has undefined behavior.
    369//!
    370//! If at all possible, we encourage code to be ported to [Strict Provenance] APIs, thus avoiding
    371//! the need for Exposed Provenance. Maximizing the amount of such code is a major win for avoiding
    372//! specification complexity and to facilitate adoption of tools like [CHERI] and [Miri] that can be
    373//! a big help in increasing the confidence in (unsafe) Rust code. However, we acknowledge that this
    374//! is not always possible, and offer Exposed Provenance as a way to explicit "opt out" of the
    375//! well-defined semantics of Strict Provenance, and "opt in" to the unclear semantics of
    376//! integer-to-pointer casts.
    377//!
    378//! [aliasing]: ../../nomicon/aliasing.html
    379//! [allocation]: #allocation
    380//! [provenance]: #provenance
    381//! [book]: ../../book/ch19-01-unsafe-rust.html#dereferencing-a-raw-pointer
    382//! [ub]: ../../reference/behavior-considered-undefined.html
    383//! [zst]: ../../nomicon/exotic-sizes.html#zero-sized-types-zsts
    384//! [atomic operations]: crate::sync::atomic
    385//! [`offset`]: pointer::offset
    386//! [`offset_from`]: pointer::offset_from
    387//! [`wrapping_offset`]: pointer::wrapping_offset
    388//! [`with_addr`]: pointer::with_addr
    389//! [`map_addr`]: pointer::map_addr
    390//! [`addr`]: pointer::addr
    391//! [`AtomicUsize`]: crate::sync::atomic::AtomicUsize
    392//! [`AtomicPtr`]: crate::sync::atomic::AtomicPtr
    393//! [`expose_provenance`]: pointer::expose_provenance
    394//! [`with_exposed_provenance`]: with_exposed_provenance
    395//! [Miri]: https://github.com/rust-lang/miri
    396//! [CHERI]: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
    397//! [Strict Provenance]: #strict-provenance
    398//! [`UnsafeCell`]: core::cell::UnsafeCell
    399
    400#![stable(feature = "rust1", since = "1.0.0")]
    401// There are many unsafe functions taking pointers that don't dereference them.
    402#![allow(clippy::not_unsafe_ptr_arg_deref)]
    403
    404use crate::cmp::Ordering;
    405use crate::intrinsics::const_eval_select;
    406use crate::marker::{Destruct, FnPtr, PointeeSized};
    407use crate::mem::{self, MaybeUninit, SizedTypeProperties};
    408use crate::num::NonZero;
    409use crate::{fmt, hash, intrinsics, ub_checks};
    410
    411mod alignment;
    412#[unstable(feature = "ptr_alignment_type", issue = "102070")]
    413pub use alignment::Alignment;
    414
    415mod metadata;
    416#[unstable(feature = "ptr_metadata", issue = "81513")]
    417pub use metadata::{DynMetadata, Pointee, Thin, from_raw_parts, from_raw_parts_mut, metadata};
    418
    419mod non_null;
    420#[stable(feature = "nonnull", since = "1.25.0")]
    421pub use non_null::NonNull;
    422
    423mod unique;
    424#[unstable(feature = "ptr_internals", issue = "none")]
    425pub use unique::Unique;
    426
    427mod const_ptr;
    428mod mut_ptr;
    429
    430// Some functions are defined here because they accidentally got made
    431// available in this module on stable. See <https://github.com/rust-lang/rust/issues/15702>.
    432// (`transmute` also falls into this category, but it cannot be wrapped due to the
    433// check that `T` and `U` have the same size.)
    434
    435/// Copies `count * size_of::<T>()` bytes from `src` to `dst`. The source
    436/// and destination must *not* overlap.
    437///
    438/// For regions of memory which might overlap, use [`copy`] instead.
    439///
    440/// `copy_nonoverlapping` is semantically equivalent to C's [`memcpy`], but
    441/// with the source and destination arguments swapped,
    442/// and `count` counting the number of `T`s instead of bytes.
    443///
    444/// The copy is "untyped" in the sense that data may be uninitialized or otherwise violate the
    445/// requirements of `T`. The initialization state is preserved exactly.
    446///
    447/// [`memcpy`]: https://en.cppreference.com/w/c/string/byte/memcpy
    448///
    449/// # Safety
    450///
    451/// Behavior is undefined if any of the following conditions are violated:
    452///
    453/// * `src` must be [valid] for reads of `count * size_of::<T>()` bytes.
    454///
    455/// * `dst` must be [valid] for writes of `count * size_of::<T>()` bytes.
    456///
    457/// * Both `src` and `dst` must be properly aligned.
    458///
    459/// * The region of memory beginning at `src` with a size of `count *
    460///   size_of::<T>()` bytes must *not* overlap with the region of memory
    461///   beginning at `dst` with the same size.
    462///
    463/// Like [`read`], `copy_nonoverlapping` creates a bitwise copy of `T`, regardless of
    464/// whether `T` is [`Copy`]. If `T` is not [`Copy`], using *both* the values
    465/// in the region beginning at `*src` and the region beginning at `*dst` can
    466/// [violate memory safety][read-ownership].
    467///
    468/// Note that even if the effectively copied size (`count * size_of::<T>()`) is
    469/// `0`, the pointers must be properly aligned.
    470///
    471/// [`read`]: crate::ptr::read
    472/// [read-ownership]: crate::ptr::read#ownership-of-the-returned-value
    473/// [valid]: crate::ptr#safety
    474///
    475/// # Examples
    476///
    477/// Manually implement [`Vec::append`]:
    478///
    479/// ```
    480/// use std::ptr;
    481///
    482/// /// Moves all the elements of `src` into `dst`, leaving `src` empty.
    483/// fn append<T>(dst: &mut Vec<T>, src: &mut Vec<T>) {
    484///     let src_len = src.len();
    485///     let dst_len = dst.len();
    486///
    487///     // Ensure that `dst` has enough capacity to hold all of `src`.
    488///     dst.reserve(src_len);
    489///
    490///     unsafe {
    491///         // The call to add is always safe because `Vec` will never
    492///         // allocate more than `isize::MAX` bytes.
    493///         let dst_ptr = dst.as_mut_ptr().add(dst_len);
    494///         let src_ptr = src.as_ptr();
    495///
    496///         // Truncate `src` without dropping its contents. We do this first,
    497///         // to avoid problems in case something further down panics.
    498///         src.set_len(0);
    499///
    500///         // The two regions cannot overlap because mutable references do
    501///         // not alias, and two different vectors cannot own the same
    502///         // memory.
    503///         ptr::copy_nonoverlapping(src_ptr, dst_ptr, src_len);
    504///
    505///         // Notify `dst` that it now holds the contents of `src`.
    506///         dst.set_len(dst_len + src_len);
    507///     }
    508/// }
    509///
    510/// let mut a = vec!['r'];
    511/// let mut b = vec!['u', 's', 't'];
    512///
    513/// append(&mut a, &mut b);
    514///
    515/// assert_eq!(a, &['r', 'u', 's', 't']);
    516/// assert!(b.is_empty());
    517/// ```
    518///
    519/// [`Vec::append`]: ../../std/vec/struct.Vec.html#method.append
    520#[doc(alias = "memcpy")]
    521#[stable(feature = "rust1", since = "1.0.0")]
    522#[rustc_const_stable(feature = "const_intrinsic_copy", since = "1.83.0")]
    523#[inline(always)]
    524#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
    525#[rustc_diagnostic_item = "ptr_copy_nonoverlapping"]
    526pub const unsafe fn copy_nonoverlapping<T>(src: *const T, dst: *mut T, count: usize) {
    527    ub_checks::assert_unsafe_precondition!(
    528        check_language_ub,
    529        "ptr::copy_nonoverlapping requires that both pointer arguments are aligned and non-null \
    530        and the specified memory ranges do not overlap",
    531        (
    532            src: *const () = src as *const (),
    533            dst: *mut () = dst as *mut (),
    534            size: usize = size_of::<T>(),
    535            align: usize = align_of::<T>(),
    536            count: usize = count,
    537        ) => {
    538            let zero_size = count == 0 || size == 0;
    539            ub_checks::maybe_is_aligned_and_not_null(src, align, zero_size)
    540                && ub_checks::maybe_is_aligned_and_not_null(dst, align, zero_size)
    541                && ub_checks::maybe_is_nonoverlapping(src, dst, size, count)
    542        }
    543    );
    544
    545    // SAFETY: the safety contract for `copy_nonoverlapping` must be
    546    // upheld by the caller.
    547    unsafe { crate::intrinsics::copy_nonoverlapping(src, dst, count) }
    548}
    549
    550/// Copies `count * size_of::<T>()` bytes from `src` to `dst`. The source
    551/// and destination may overlap.
    552///
    553/// If the source and destination will *never* overlap,
    554/// [`copy_nonoverlapping`] can be used instead.
    555///
    556/// `copy` is semantically equivalent to C's [`memmove`], but
    557/// with the source and destination arguments swapped,
    558/// and `count` counting the number of `T`s instead of bytes.
    559/// Copying takes place as if the bytes were copied from `src`
    560/// to a temporary array and then copied from the array to `dst`.
    561///
    562/// The copy is "untyped" in the sense that data may be uninitialized or otherwise violate the
    563/// requirements of `T`. The initialization state is preserved exactly.
    564///
    565/// [`memmove`]: https://en.cppreference.com/w/c/string/byte/memmove
    566///
    567/// # Safety
    568///
    569/// Behavior is undefined if any of the following conditions are violated:
    570///
    571/// * `src` must be [valid] for reads of `count * size_of::<T>()` bytes.
    572///
    573/// * `dst` must be [valid] for writes of `count * size_of::<T>()` bytes, and must remain valid even
    574///   when `src` is read for `count * size_of::<T>()` bytes. (This means if the memory ranges
    575///   overlap, the `dst` pointer must not be invalidated by `src` reads.)
    576///
    577/// * Both `src` and `dst` must be properly aligned.
    578///
    579/// Like [`read`], `copy` creates a bitwise copy of `T`, regardless of
    580/// whether `T` is [`Copy`]. If `T` is not [`Copy`], using both the values
    581/// in the region beginning at `*src` and the region beginning at `*dst` can
    582/// [violate memory safety][read-ownership].
    583///
    584/// Note that even if the effectively copied size (`count * size_of::<T>()`) is
    585/// `0`, the pointers must be properly aligned.
    586///
    587/// [`read`]: crate::ptr::read
    588/// [read-ownership]: crate::ptr::read#ownership-of-the-returned-value
    589/// [valid]: crate::ptr#safety
    590///
    591/// # Examples
    592///
    593/// Efficiently create a Rust vector from an unsafe buffer:
    594///
    595/// ```
    596/// use std::ptr;
    597///
    598/// /// # Safety
    599/// ///
    600/// /// * `ptr` must be correctly aligned for its type and non-zero.
    601/// /// * `ptr` must be valid for reads of `elts` contiguous elements of type `T`.
    602/// /// * Those elements must not be used after calling this function unless `T: Copy`.
    603/// # #[allow(dead_code)]
    604/// unsafe fn from_buf_raw<T>(ptr: *const T, elts: usize) -> Vec<T> {
    605///     let mut dst = Vec::with_capacity(elts);
    606///
    607///     // SAFETY: Our precondition ensures the source is aligned and valid,
    608///     // and `Vec::with_capacity` ensures that we have usable space to write them.
    609///     unsafe { ptr::copy(ptr, dst.as_mut_ptr(), elts); }
    610///
    611///     // SAFETY: We created it with this much capacity earlier,
    612///     // and the previous `copy` has initialized these elements.
    613///     unsafe { dst.set_len(elts); }
    614///     dst
    615/// }
    616/// ```
    617#[doc(alias = "memmove")]
    618#[stable(feature = "rust1", since = "1.0.0")]
    619#[rustc_const_stable(feature = "const_intrinsic_copy", since = "1.83.0")]
    620#[inline(always)]
    621#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
    622#[rustc_diagnostic_item = "ptr_copy"]
    623pub const unsafe fn copy<T>(src: *const T, dst: *mut T, count: usize) {
    624    // SAFETY: the safety contract for `copy` must be upheld by the caller.
    625    unsafe {
    626        ub_checks::assert_unsafe_precondition!(
    627            check_language_ub,
    628            "ptr::copy requires that both pointer arguments are aligned and non-null",
    629            (
    630                src: *const () = src as *const (),
    631                dst: *mut () = dst as *mut (),
    632                align: usize = align_of::<T>(),
    633                zero_size: bool = T::IS_ZST || count == 0,
    634            ) =>
    635            ub_checks::maybe_is_aligned_and_not_null(src, align, zero_size)
    636                && ub_checks::maybe_is_aligned_and_not_null(dst, align, zero_size)
    637        );
    638        crate::intrinsics::copy(src, dst, count)
    639    }
    640}
    641
    642/// Sets `count * size_of::<T>()` bytes of memory starting at `dst` to
    643/// `val`.
    644///
    645/// `write_bytes` is similar to C's [`memset`], but sets `count *
    646/// size_of::<T>()` bytes to `val`.
    647///
    648/// [`memset`]: https://en.cppreference.com/w/c/string/byte/memset
    649///
    650/// # Safety
    651///
    652/// Behavior is undefined if any of the following conditions are violated:
    653///
    654/// * `dst` must be [valid] for writes of `count * size_of::<T>()` bytes.
    655///
    656/// * `dst` must be properly aligned.
    657///
    658/// Note that even if the effectively copied size (`count * size_of::<T>()`) is
    659/// `0`, the pointer must be properly aligned.
    660///
    661/// Additionally, note that changing `*dst` in this way can easily lead to undefined behavior (UB)
    662/// later if the written bytes are not a valid representation of some `T`. For instance, the
    663/// following is an **incorrect** use of this function:
    664///
    665/// ```rust,no_run
    666/// unsafe {
    667///     let mut value: u8 = 0;
    668///     let ptr: *mut bool = &mut value as *mut u8 as *mut bool;
    669///     let _bool = ptr.read(); // This is fine, `ptr` points to a valid `bool`.
    670///     ptr.write_bytes(42u8, 1); // This function itself does not cause UB...
    671///     let _bool = ptr.read(); // ...but it makes this operation UB! ⚠️
    672/// }
    673/// ```
    674///
    675/// [valid]: crate::ptr#safety
    676///
    677/// # Examples
    678///
    679/// Basic usage:
    680///
    681/// ```
    682/// use std::ptr;
    683///
    684/// let mut vec = vec![0u32; 4];
    685/// unsafe {
    686///     let vec_ptr = vec.as_mut_ptr();
    687///     ptr::write_bytes(vec_ptr, 0xfe, 2);
    688/// }
    689/// assert_eq!(vec, [0xfefefefe, 0xfefefefe, 0, 0]);
    690/// ```
    691#[doc(alias = "memset")]
    692#[stable(feature = "rust1", since = "1.0.0")]
    693#[rustc_const_stable(feature = "const_ptr_write", since = "1.83.0")]
    694#[inline(always)]
    695#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
    696#[rustc_diagnostic_item = "ptr_write_bytes"]
    697pub const unsafe fn write_bytes<T>(dst: *mut T, val: u8, count: usize) {
    698    // SAFETY: the safety contract for `write_bytes` must be upheld by the caller.
    699    unsafe {
    700        ub_checks::assert_unsafe_precondition!(
    701            check_language_ub,
    702            "ptr::write_bytes requires that the destination pointer is aligned and non-null",
    703            (
    704                addr: *const () = dst as *const (),
    705                align: usize = align_of::<T>(),
    706                zero_size: bool = T::IS_ZST || count == 0,
    707            ) => ub_checks::maybe_is_aligned_and_not_null(addr, align, zero_size)
    708        );
    709        crate::intrinsics::write_bytes(dst, val, count)
    710    }
    711}
    712
    713/// Executes the destructor (if any) of the pointed-to value.
    714///
    715/// This is almost the same as calling [`ptr::read`] and discarding
    716/// the result, but has the following advantages:
    717// FIXME: say something more useful than "almost the same"?
    718// There are open questions here: `read` requires the value to be fully valid, e.g. if `T` is a
    719// `bool` it must be 0 or 1, if it is a reference then it must be dereferenceable. `drop_in_place`
    720// only requires that `*to_drop` be "valid for dropping" and we have not defined what that means. In
    721// Miri it currently (May 2024) requires nothing at all for types without drop glue.
    722///
    723/// * It is *required* to use `drop_in_place` to drop unsized types like
    724///   trait objects, because they can't be read out onto the stack and
    725///   dropped normally.
    726///
    727/// * It is friendlier to the optimizer to do this over [`ptr::read`] when
    728///   dropping manually allocated memory (e.g., in the implementations of
    729///   `Box`/`Rc`/`Vec`), as the compiler doesn't need to prove that it's
    730///   sound to elide the copy.
    731///
    732/// * It can be used to drop [pinned] data when `T` is not `repr(packed)`
    733///   (pinned data must not be moved before it is dropped).
    734///
    735/// Unaligned values cannot be dropped in place, they must be copied to an aligned
    736/// location first using [`ptr::read_unaligned`]. For packed structs, this move is
    737/// done automatically by the compiler. This means the fields of packed structs
    738/// are not dropped in-place.
    739///
    740/// [`ptr::read`]: self::read
    741/// [`ptr::read_unaligned`]: self::read_unaligned
    742/// [pinned]: crate::pin
    743///
    744/// # Safety
    745///
    746/// Behavior is undefined if any of the following conditions are violated:
    747///
    748/// * `to_drop` must be [valid] for both reads and writes.
    749///
    750/// * `to_drop` must be properly aligned, even if `T` has size 0.
    751///
    752/// * `to_drop` must be nonnull, even if `T` has size 0.
    753///
    754/// * The value `to_drop` points to must be valid for dropping, which may mean
    755///   it must uphold additional invariants. These invariants depend on the type
    756///   of the value being dropped. For instance, when dropping a Box, the box's
    757///   pointer to the heap must be valid.
    758///
    759/// * While `drop_in_place` is executing, the only way to access parts of
    760///   `to_drop` is through the `&mut self` references supplied to the
    761///   `Drop::drop` methods that `drop_in_place` invokes.
    762///
    763/// Additionally, if `T` is not [`Copy`], using the pointed-to value after
    764/// calling `drop_in_place` can cause undefined behavior. Note that `*to_drop =
    765/// foo` counts as a use because it will cause the value to be dropped
    766/// again. [`write()`] can be used to overwrite data without causing it to be
    767/// dropped.
    768///
    769/// [valid]: self#safety
    770///
    771/// # Examples
    772///
    773/// Manually remove the last item from a vector:
    774///
    775/// ```
    776/// use std::ptr;
    777/// use std::rc::Rc;
    778///
    779/// let last = Rc::new(1);
    780/// let weak = Rc::downgrade(&last);
    781///
    782/// let mut v = vec![Rc::new(0), last];
    783///
    784/// unsafe {
    785///     // Get a raw pointer to the last element in `v`.
    786///     let ptr = &mut v[1] as *mut _;
    787///     // Shorten `v` to prevent the last item from being dropped. We do that first,
    788///     // to prevent issues if the `drop_in_place` below panics.
    789///     v.set_len(1);
    790///     // Without a call `drop_in_place`, the last item would never be dropped,
    791///     // and the memory it manages would be leaked.
    792///     ptr::drop_in_place(ptr);
    793/// }
    794///
    795/// assert_eq!(v, &[0.into()]);
    796///
    797/// // Ensure that the last item was dropped.
    798/// assert!(weak.upgrade().is_none());
    799/// ```
    800#[stable(feature = "drop_in_place", since = "1.8.0")]
    801#[lang = "drop_in_place"]
    802#[allow(unconditional_recursion)]
    803#[rustc_diagnostic_item = "ptr_drop_in_place"]
    804#[rustc_const_unstable(feature = "const_drop_in_place", issue = "109342")]
    805pub const unsafe fn drop_in_place<T: PointeeSized>(to_drop: *mut T)
    806where
    807    T: [const] Destruct,
    808{
    809    // Code here does not matter - this is replaced by the
    810    // real drop glue by the compiler.
    811
    812    // SAFETY: see comment above
    813    unsafe { drop_in_place(to_drop) }
    814}
    815
    816/// Creates a null raw pointer.
    817///
    818/// This function is equivalent to zero-initializing the pointer:
    819/// `MaybeUninit::<*const T>::zeroed().assume_init()`.
    820/// The resulting pointer has the address 0.
    821///
    822/// # Examples
    823///
    824/// ```
    825/// use std::ptr;
    826///
    827/// let p: *const i32 = ptr::null();
    828/// assert!(p.is_null());
    829/// assert_eq!(p as usize, 0); // this pointer has the address 0
    830/// ```
    831#[inline(always)]
    832#[must_use]
    833#[stable(feature = "rust1", since = "1.0.0")]
    834#[rustc_promotable]
    835#[rustc_const_stable(feature = "const_ptr_null", since = "1.24.0")]
    836#[rustc_diagnostic_item = "ptr_null"]
    837pub const fn null<T: PointeeSized + Thin>() -> *const T {
    838    from_raw_parts(without_provenance::<()>(0), ())
    839}
    840
    841/// Creates a null mutable raw pointer.
    842///
    843/// This function is equivalent to zero-initializing the pointer:
    844/// `MaybeUninit::<*mut T>::zeroed().assume_init()`.
    845/// The resulting pointer has the address 0.
    846///
    847/// # Examples
    848///
    849/// ```
    850/// use std::ptr;
    851///
    852/// let p: *mut i32 = ptr::null_mut();
    853/// assert!(p.is_null());
    854/// assert_eq!(p as usize, 0); // this pointer has the address 0
    855/// ```
    856#[inline(always)]
    857#[must_use]
    858#[stable(feature = "rust1", since = "1.0.0")]
    859#[rustc_promotable]
    860#[rustc_const_stable(feature = "const_ptr_null", since = "1.24.0")]
    861#[rustc_diagnostic_item = "ptr_null_mut"]
    862pub const fn null_mut<T: PointeeSized + Thin>() -> *mut T {
    863    from_raw_parts_mut(without_provenance_mut::<()>(0), ())
    864}
    865
    866/// Creates a pointer with the given address and no [provenance][crate::ptr#provenance].
    867///
    868/// This is equivalent to `ptr::null().with_addr(addr)`.
    869///
    870/// Without provenance, this pointer is not associated with any actual allocation. Such a
    871/// no-provenance pointer may be used for zero-sized memory accesses (if suitably aligned), but
    872/// non-zero-sized memory accesses with a no-provenance pointer are UB. No-provenance pointers are
    873/// little more than a `usize` address in disguise.
    874///
    875/// This is different from `addr as *const T`, which creates a pointer that picks up a previously
    876/// exposed provenance. See [`with_exposed_provenance`] for more details on that operation.
    877///
    878/// This is a [Strict Provenance][crate::ptr#strict-provenance] API.
    879#[inline(always)]
    880#[must_use]
    881#[stable(feature = "strict_provenance", since = "1.84.0")]
    882#[rustc_const_stable(feature = "strict_provenance", since = "1.84.0")]
    883#[rustc_diagnostic_item = "ptr_without_provenance"]
    884pub const fn without_provenance<T>(addr: usize) -> *const T {
    885    without_provenance_mut(addr)
    886}
    887
    888/// Creates a new pointer that is dangling, but non-null and well-aligned.
    889///
    890/// This is useful for initializing types which lazily allocate, like
    891/// `Vec::new` does.
    892///
    893/// Note that the address of the returned pointer may potentially
    894/// be that of a valid pointer, which means this must not be used
    895/// as a "not yet initialized" sentinel value.
    896/// Types that lazily allocate must track initialization by some other means.
    897#[inline(always)]
    898#[must_use]
    899#[stable(feature = "strict_provenance", since = "1.84.0")]
    900#[rustc_const_stable(feature = "strict_provenance", since = "1.84.0")]
    901pub const fn dangling<T>() -> *const T {
    902    dangling_mut()
    903}
    904
    905/// Creates a pointer with the given address and no [provenance][crate::ptr#provenance].
    906///
    907/// This is equivalent to `ptr::null_mut().with_addr(addr)`.
    908///
    909/// Without provenance, this pointer is not associated with any actual allocation. Such a
    910/// no-provenance pointer may be used for zero-sized memory accesses (if suitably aligned), but
    911/// non-zero-sized memory accesses with a no-provenance pointer are UB. No-provenance pointers are
    912/// little more than a `usize` address in disguise.
    913///
    914/// This is different from `addr as *mut T`, which creates a pointer that picks up a previously
    915/// exposed provenance. See [`with_exposed_provenance_mut`] for more details on that operation.
    916///
    917/// This is a [Strict Provenance][crate::ptr#strict-provenance] API.
    918#[inline(always)]
    919#[must_use]
    920#[stable(feature = "strict_provenance", since = "1.84.0")]
    921#[rustc_const_stable(feature = "strict_provenance", since = "1.84.0")]
    922#[rustc_diagnostic_item = "ptr_without_provenance_mut"]
    923#[allow(integer_to_ptr_transmutes)] // Expected semantics here.
    924pub const fn without_provenance_mut<T>(addr: usize) -> *mut T {
    925    // An int-to-pointer transmute currently has exactly the intended semantics: it creates a
    926    // pointer without provenance. Note that this is *not* a stable guarantee about transmute
    927    // semantics, it relies on sysroot crates having special status.
    928    // SAFETY: every valid integer is also a valid pointer (as long as you don't dereference that
    929    // pointer).
    930    unsafe { mem::transmute(addr) }
    931}
    932
    933/// Creates a new pointer that is dangling, but non-null and well-aligned.
    934///
    935/// This is useful for initializing types which lazily allocate, like
    936/// `Vec::new` does.
    937///
    938/// Note that the address of the returned pointer may potentially
    939/// be that of a valid pointer, which means this must not be used
    940/// as a "not yet initialized" sentinel value.
    941/// Types that lazily allocate must track initialization by some other means.
    942#[inline(always)]
    943#[must_use]
    944#[stable(feature = "strict_provenance", since = "1.84.0")]
    945#[rustc_const_stable(feature = "strict_provenance", since = "1.84.0")]
    946pub const fn dangling_mut<T>() -> *mut T {
    947    NonNull::dangling().as_ptr()
    948}
    949
    950/// Converts an address back to a pointer, picking up some previously 'exposed'
    951/// [provenance][crate::ptr#provenance].
    952///
    953/// This is fully equivalent to `addr as *const T`. The provenance of the returned pointer is that
    954/// of *some* pointer that was previously exposed by passing it to
    955/// [`expose_provenance`][pointer::expose_provenance], or a `ptr as usize` cast. In addition, memory
    956/// which is outside the control of the Rust abstract machine (MMIO registers, for example) is
    957/// always considered to be accessible with an exposed provenance, so long as this memory is disjoint
    958/// from memory that will be used by the abstract machine such as the stack, heap, and statics.
    959///
    960/// The exact provenance that gets picked is not specified. The compiler will do its best to pick
    961/// the "right" provenance for you (whatever that may be), but currently we cannot provide any
    962/// guarantees about which provenance the resulting pointer will have -- and therefore there
    963/// is no definite specification for which memory the resulting pointer may access.
    964///
    965/// If there is *no* previously 'exposed' provenance that justifies the way the returned pointer
    966/// will be used, the program has undefined behavior. In particular, the aliasing rules still apply:
    967/// pointers and references that have been invalidated due to aliasing accesses cannot be used
    968/// anymore, even if they have been exposed!
    969///
    970/// Due to its inherent ambiguity, this operation may not be supported by tools that help you to
    971/// stay conformant with the Rust memory model. It is recommended to use [Strict
    972/// Provenance][self#strict-provenance] APIs such as [`with_addr`][pointer::with_addr] wherever
    973/// possible.
    974///
    975/// On most platforms this will produce a value with the same bytes as the address. Platforms
    976/// which need to store additional information in a pointer may not support this operation,
    977/// since it is generally not possible to actually *compute* which provenance the returned
    978/// pointer has to pick up.
    979///
    980/// This is an [Exposed Provenance][crate::ptr#exposed-provenance] API.
    981#[must_use]
    982#[inline(always)]
    983#[stable(feature = "exposed_provenance", since = "1.84.0")]
    984#[rustc_const_stable(feature = "const_exposed_provenance", since = "1.91.0")]
    985#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
    986#[allow(fuzzy_provenance_casts)] // this *is* the explicit provenance API one should use instead
    987pub const fn with_exposed_provenance<T>(addr: usize) -> *const T {
    988    addr as *const T
    989}
    990
    991/// Converts an address back to a mutable pointer, picking up some previously 'exposed'
    992/// [provenance][crate::ptr#provenance].
    993///
    994/// This is fully equivalent to `addr as *mut T`. The provenance of the returned pointer is that
    995/// of *some* pointer that was previously exposed by passing it to
    996/// [`expose_provenance`][pointer::expose_provenance], or a `ptr as usize` cast. In addition, memory
    997/// which is outside the control of the Rust abstract machine (MMIO registers, for example) is
    998/// always considered to be accessible with an exposed provenance, so long as this memory is disjoint
    999/// from memory that will be used by the abstract machine such as the stack, heap, and statics.
    1000///
    1001/// The exact provenance that gets picked is not specified. The compiler will do its best to pick
    1002/// the "right" provenance for you (whatever that may be), but currently we cannot provide any
    1003/// guarantees about which provenance the resulting pointer will have -- and therefore there
    1004/// is no definite specification for which memory the resulting pointer may access.
    1005///
    1006/// If there is *no* previously 'exposed' provenance that justifies the way the returned pointer
    1007/// will be used, the program has undefined behavior. In particular, the aliasing rules still apply:
    1008/// pointers and references that have been invalidated due to aliasing accesses cannot be used
    1009/// anymore, even if they have been exposed!
    1010///
    1011/// Due to its inherent ambiguity, this operation may not be supported by tools that help you to
    1012/// stay conformant with the Rust memory model. It is recommended to use [Strict
    1013/// Provenance][self#strict-provenance] APIs such as [`with_addr`][pointer::with_addr] wherever
    1014/// possible.
    1015///
    1016/// On most platforms this will produce a value with the same bytes as the address. Platforms
    1017/// which need to store additional information in a pointer may not support this operation,
    1018/// since it is generally not possible to actually *compute* which provenance the returned
    1019/// pointer has to pick up.
    1020///
    1021/// This is an [Exposed Provenance][crate::ptr#exposed-provenance] API.
    1022#[must_use]
    1023#[inline(always)]
    1024#[stable(feature = "exposed_provenance", since = "1.84.0")]
    1025#[rustc_const_stable(feature = "const_exposed_provenance", since = "1.91.0")]
    1026#[cfg_attr(miri, track_caller)] // even without panics, this helps for Miri backtraces
    1027#[allow(fuzzy_provenance_casts)] // this *is* the explicit provenance API one should use instead
    1028pub const fn with_exposed_provenance_mut<T>(addr: usize) -> *mut T {
    1029    addr as *mut T
    1030}
    1031
    1032/// Converts a reference to a raw pointer.
    1033///
    1034/// For `r: &T`, `from_ref(r)` is equivalent to `r as *const T` (except for the caveat noted below),
    1035/// but is a bit safer since it will never silently change type or mutability, in particular if the
    1036/// code is refactored.
    1037///
    1038/// The caller must ensure that the pointee outlives the pointer this function returns, or else it
    1039/// will end up dangling.
    1040///
    1041/// The caller must also ensure that the memory the pointer (non-transitively) points to is never
    1042/// written to (except inside an `UnsafeCell`) using this pointer or any pointer derived from it. If
    1043/// you need to mutate the pointee, use [`from_mut`]. Specifically, to turn a mutable reference `m:
    1044/// &mut T` into `*const T`, prefer `from_mut(m).cast_const()` to obtain a pointer that can later be
    1045/// used for mutation.
    1046///
    1047/// ## Interaction with lifetime extension
    1048///
    1049/// Note that this has subtle interactions with the rules for lifetime extension of temporaries in
    1050/// tail expressions. This code is valid, albeit in a non-obvious way:
    1051/// ```rust
    1052/// # type T = i32;
    1053/// # fn foo() -> T { 42 }
    1054/// // The temporary holding the return value of `foo` has its lifetime extended,
    1055/// // because the surrounding expression involves no function call.
    1056/// let p = &foo() as *const T;
    1057/// unsafe { p.read() };
    1058/// ```
    1059/// Naively replacing the cast with `from_ref` is not valid:
    1060/// ```rust,no_run
    1061/// # use std::ptr;
    1062/// # type T = i32;
    1063/// # fn foo() -> T { 42 }
    1064/// // The temporary holding the return value of `foo` does *not* have its lifetime extended,
    1065/// // because the surrounding expression involves a function call.
    1066/// let p = ptr::from_ref(&foo());
    1067/// unsafe { p.read() }; // UB! Reading from a dangling pointer ⚠️
    1068/// ```
    1069/// The recommended way to write this code is to avoid relying on lifetime extension
    1070/// when raw pointers are involved:
    1071/// ```rust
    1072/// # use std::ptr;
    1073/// # type T = i32;
    1074/// # fn foo() -> T { 42 }
    1075/// let x = foo();
    1076/// let p = ptr::from_ref(&x);
    1077/// unsafe { p.read() };
    1078/// ```
    1079#[inline(always)]
    1080#[must_use]
    1081#[stable(feature = "ptr_from_ref", since = "1.76.0")]
    1082#[rustc_const_stable(feature = "ptr_from_ref", since = "1.76.0")]
    1083#[rustc_never_returns_null_ptr]
    1084#[rustc_diagnostic_item = "ptr_from_ref"]
    1085pub const fn from_ref<T: PointeeSized>(r: &T) -> *const T {
    1086    r
    1087}
    1088
    1089/// Converts a mutable reference to a raw pointer.
    1090///
    1091/// For `r: &mut T`, `from_mut(r)` is equivalent to `r as *mut T` (except for the caveat noted
    1092/// below), but is a bit safer since it will never silently change type or mutability, in particular
    1093/// if the code is refactored.
    1094///
    1095/// The caller must ensure that the pointee outlives the pointer this function returns, or else it
    1096/// will end up dangling.
    1097///
    1098/// ## Interaction with lifetime extension
    1099///
    1100/// Note that this has subtle interactions with the rules for lifetime extension of temporaries in
    1101/// tail expressions. This code is valid, albeit in a non-obvious way:
    1102/// ```rust
    1103/// # type T = i32;
    1104/// # fn foo() -> T { 42 }
    1105/// // The temporary holding the return value of `foo` has its lifetime extended,
    1106/// // because the surrounding expression involves no function call.
    1107/// let p = &mut foo() as *mut T;
    1108/// unsafe { p.write(T::default()) };
    1109/// ```
    1110/// Naively replacing the cast with `from_mut` is not valid:
    1111/// ```rust,no_run
    1112/// # use std::ptr;
    1113/// # type T = i32;
    1114/// # fn foo() -> T { 42 }
    1115/// // The temporary holding the return value of `foo` does *not* have its lifetime extended,
    1116/// // because the surrounding expression involves a function call.
    1117/// let p = ptr::from_mut(&mut foo());
    1118/// unsafe { p.write(T::default()) }; // UB! Writing to a dangling pointer ⚠️
    1119/// ```
    1120/// The recommended way to write this code is to avoid relying on lifetime extension
    1121/// when raw pointers are involved:
    1122/// ```rust
    1123/// # use std::ptr;
    1124/// # type T = i32;
    1125/// # fn foo() -> T { 42 }
    1126/// let mut x = foo();
    1127/// let p = ptr::from_mut(&mut x);
    1128/// unsafe { p.write(T::default()) };
    1129/// ```
    1130#[inline(always)]
    1131#[must_use]
    1132#[stable(feature = "ptr_from_ref", since = "1.76.0")]
    1133#[rustc_const_stable(feature = "ptr_from_ref", since = "1.76.0")]
    1134#[rustc_never_returns_null_ptr]
    1135pub const fn from_mut<T: PointeeSized>(r: &mut T) -> *mut T {
    1136    r
    1137}
    1138
    1139/// Forms a raw slice from a pointer and a length.
    1140///
    1141/// The `len` argument is the number of **elements**, not the number of bytes.
    1142///
    1143/// This function is safe, but actually using the return value is unsafe.
    1144/// See the documentation of [`slice::from_raw_parts`] for slice safety requirements.
    1145///
    1146/// [`slice::from_raw_parts`]: crate::slice::from_raw_parts
    1147///
    1148/// # Examples
    1149///
    1150/// ```rust
    1151/// use std::ptr;
    1152///
    1153/// // create a slice pointer when starting out with a pointer to the first element
    1154/// let x = [5, 6, 7];
    1155/// let raw_pointer = x.as_ptr();
    1156/// let slice = ptr::slice_from_raw_parts(raw_pointer, 3);
    1157/// assert_eq!(unsafe { &*slice }[2], 7);
    1158/// ```
    1159///
    1160/// You must ensure that the pointer is valid and not null before dereferencing
    1161/// the raw slice. A slice reference must never have a null pointer, even if it's empty.
    1162///
    1163/// ```rust,should_panic
    1164/// use std::ptr;
    1165/// let danger: *const [u8] = ptr::slice_from_raw_parts(ptr::null(), 0);
    1166/// unsafe {
    1167///     danger.as_ref().expect("references must not be null");
    1168/// }
    1169/// ```
    1170#[inline]
    1171#[stable(feature = "slice_from_raw_parts", since = "1.42.0")]
    1172#[rustc_const_stable(feature = "const_slice_from_raw_parts", since = "1.64.0")]
    1173#[rustc_diagnostic_item = "ptr_slice_from_raw_parts"]
    1174pub const fn slice_from_raw_parts<T>(data: *const T, len: usize) -> *const [T] {
    1175    from_raw_parts(data, len)
    1176}
    1177
    1178/// Forms a raw mutable slice from a pointer and a length.
    1179///
    1180/// The `len` argument is the number of **elements**, not the number of bytes.
    1181///
    1182/// Performs the same functionality as [`slice_from_raw_parts`], except that a
    1183/// raw mutable slice is returned, as opposed to a raw immutable slice.
    1184///
    1185/// This function is safe, but actually using the return value is unsafe.
    1186/// See the documentation of [`slice::from_raw_parts_mut`] for slice safety requirements.
    1187///
    1188/// [`slice::from_raw_parts_mut`]: crate::slice::from_raw_parts_mut
    1189///
    1190/// # Examples
    1191///
    1192/// ```rust
    1193/// use std::ptr;
    1194///
    1195/// let x = &mut [5, 6, 7];
    1196/// let raw_pointer = x.as_mut_ptr();
    1197/// let slice = ptr::slice_from_raw_parts_mut(raw_pointer, 3);
    1198///
    1199/// unsafe {
    1200///     (*slice)[2] = 99; // assign a value at an index in the slice
    1201/// };
    1202///
    1203/// assert_eq!(unsafe { &*slice }[2], 99);
    1204/// ```
    1205///
    1206/// You must ensure that the pointer is valid and not null before dereferencing
    1207/// the raw slice. A slice reference must never have a null pointer, even if it's empty.
    1208///
    1209/// ```rust,should_panic
    1210/// use std::ptr;
    1211/// let danger: *mut [u8] = ptr::slice_from_raw_parts_mut(ptr::null_mut(), 0);
    1212/// unsafe {
    1213///     danger.as_mut().expect("references must not be null");
    1214/// }
    1215/// ```
    1216#[inline]
    1217#[stable(feature = "slice_from_raw_parts", since = "1.42.0")]
    1218#[rustc_const_stable(feature = "const_slice_from_raw_parts_mut", since = "1.83.0")]
    1219#[rustc_diagnostic_item = "ptr_slice_from_raw_parts_mut"]
    1220pub const fn slice_from_raw_parts_mut<T>(data: *mut T, len: usize) -> *mut [T] {
    1221    from_raw_parts_mut(data, len)
    1222}
    1223
    1224/// Swaps the values at two mutable locations of the same type, without
    1225/// deinitializing either.
    1226///
    1227/// But for the following exceptions, this function is semantically
    1228/// equivalent to [`mem::swap`]:
    1229///
    1230/// * It operates on raw pointers instead of references. When references are
    1231///   available, [`mem::swap`] should be preferred.
    1232///
    1233/// * The two pointed-to values may overlap. If the values do overlap, then the
    1234///   overlapping region of memory from `x` will be used. This is demonstrated
    1235///   in the second example below.
    1236///
    1237/// * The operation is "untyped" in the sense that data may be uninitialized or otherwise violate
    1238///   the requirements of `T`. The initialization state is preserved exactly.
    1239///
    1240/// # Safety
    1241///
    1242/// Behavior is undefined if any of the following conditions are violated:
    1243///
    1244/// * Both `x` and `y` must be [valid] for both reads and writes. They must remain valid even when the
    1245///   other pointer is written. (This means if the memory ranges overlap, the two pointers must not
    1246///   be subject to aliasing restrictions relative to each other.)
    1247///
    1248/// * Both `x` and `y` must be properly aligned.
    1249///
    1250/// Note that even if `T` has size `0`, the pointers must be properly aligned.
    1251///
    1252/// [valid]: self#safety
    1253///
    1254/// # Examples
    1255///
    1256/// Swapping two non-overlapping regions:
    1257///
    1258/// ```
    1259/// use std::ptr;
    1260///
    1261/// let mut array = [0, 1, 2, 3];
    1262///
    1263/// let (x, y) = array.split_at_mut(2);
    1264/// let x = x.as_mut_ptr().cast::<[u32; 2]>(); // this is `array[0..2]`
    1265/// let y = y.as_mut_ptr().cast::<[u32; 2]>(); // this is `array[2..4]`
    1266///
    1267/// unsafe {
    1268///     ptr::swap(x, y);
    1269///     assert_eq!([2, 3, 0, 1], array);
    1270/// }
    1271/// ```
    1272///
    1273/// Swapping two overlapping regions:
    1274///
    1275/// ```
    1276/// use std::ptr;
    1277///
    1278/// let mut array: [i32; 4] = [0, 1, 2, 3];
    1279///
    1280/// let array_ptr: *mut i32 = array.as_mut_ptr();
    1281///
    1282/// let x = array_ptr as *mut [i32; 3]; // this is `array[0..3]`
    1283/// let y = unsafe { array_ptr.add(1) } as *mut [i32; 3]; // this is `array[1..4]`
    1284///
    1285/// unsafe {
    1286///     ptr::swap(x, y);
    1287///     // The indices `1..3` of the slice overlap between `x` and `y`.
    1288///     // Reasonable results would be for to them be `[2, 3]`, so that indices `0..3` are
    1289///     // `[1, 2, 3]` (matching `y` before the `swap`); or for them to be `[0, 1]`
    1290///     // so that indices `1..4` are `[0, 1, 2]` (matching `x` before the `swap`).
    1291///     // This implementation is defined to make the latter choice.
    1292///     assert_eq!([1, 0, 1, 2], array);
    1293/// }
    1294/// ```
    1295#[inline]
    1296#[stable(feature = "rust1", since = "1.0.0")]
    1297#[rustc_const_stable(feature = "const_swap", since = "1.85.0")]
    1298#[rustc_diagnostic_item = "ptr_swap"]
    1299pub const unsafe fn swap<T>(x: *mut T, y: *mut T) {
    1300    // Give ourselves some scratch space to work with.
    1301    // We do not have to worry about drops: `MaybeUninit` does nothing when dropped.
    1302    let mut tmp = MaybeUninit::<T>::uninit();
    1303
    1304    // Perform the swap
    1305    // SAFETY: the caller must guarantee that `x` and `y` are
    1306    // valid for writes and properly aligned. `tmp` cannot be
    1307    // overlapping either `x` or `y` because `tmp` was just allocated
    1308    // on the stack as a separate allocation.
    1309    unsafe {
    1310        copy_nonoverlapping(x, tmp.as_mut_ptr(), 1);
    1311        copy(y, x, 1); // `x` and `y` may overlap
    1312        copy_nonoverlapping(tmp.as_ptr(), y, 1);
    1313    }
    1314}
    1315
    1316/// Swaps `count * size_of::<T>()` bytes between the two regions of memory
    1317/// beginning at `x` and `y`. The two regions must *not* overlap.
    1318///
    1319/// The operation is "untyped" in the sense that data may be uninitialized or otherwise violate the
    1320/// requirements of `T`. The initialization state is preserved exactly.
    1321///
    1322/// # Safety
    1323///
    1324/// Behavior is undefined if any of the following conditions are violated:
    1325///
    1326/// * Both `x` and `y` must be [valid] for both reads and writes of `count *
    1327///   size_of::<T>()` bytes.
    1328///
    1329/// * Both `x` and `y` must be properly aligned.
    1330///
    1331/// * The region of memory beginning at `x` with a size of `count *
    1332///   size_of::<T>()` bytes must *not* overlap with the region of memory
    1333///   beginning at `y` with the same size.
    1334///
    1335/// Note that even if the effectively copied size (`count * size_of::<T>()`) is `0`,
    1336/// the pointers must be properly aligned.
    1337///
    1338/// [valid]: self#safety
    1339///
    1340/// # Examples
    1341///
    1342/// Basic usage:
    1343///
    1344/// ```
    1345/// use std::ptr;
    1346///
    1347/// let mut x = [1, 2, 3, 4];
    1348/// let mut y = [7, 8, 9];
    1349///
    1350/// unsafe {
    1351///     ptr::swap_nonoverlapping(x.as_mut_ptr(), y.as_mut_ptr(), 2);
    1352/// }
    1353///
    1354/// assert_eq!(x, [7, 8, 3, 4]);
    1355/// assert_eq!(y, [1, 2, 9]);
    1356/// ```
    1357#[inline]
    1358#[stable(feature = "swap_nonoverlapping", since = "1.27.0")]
    1359#[rustc_const_stable(feature = "const_swap_nonoverlapping", since = "1.88.0")]
    1360#[rustc_diagnostic_item = "ptr_swap_nonoverlapping"]
    1361#[rustc_allow_const_fn_unstable(const_eval_select)] // both implementations behave the same
    1362#[track_caller]
    1363pub const unsafe fn swap_nonoverlapping<T>(x: *mut T, y: *mut T, count: usize) {
    1364    ub_checks::assert_unsafe_precondition!(
    1365        check_library_ub,
    1366        "ptr::swap_nonoverlapping requires that both pointer arguments are aligned and non-null \
    1367        and the specified memory ranges do not overlap",
    1368        (
    1369            x: *mut () = x as *mut (),
    1370            y: *mut () = y as *mut (),
    1371            size: usize = size_of::<T>(),
    1372            align: usize = align_of::<T>(),
    1373            count: usize = count,
    1374        ) => {
    1375            let zero_size = size == 0 || count == 0;
    1376            ub_checks::maybe_is_aligned_and_not_null(x, align, zero_size)
    1377                && ub_checks::maybe_is_aligned_and_not_null(y, align, zero_size)
    1378                && ub_checks::maybe_is_nonoverlapping(x, y, size, count)
    1379        }
    1380    );
    1381
    1382    const_eval_select!(
    1383        @capture[T] { x: *mut T, y: *mut T, count: usize }:
    1384        if const {
    1385            // At compile-time we don't need all the special code below.
    1386            // SAFETY: Same preconditions as this function
    1387            unsafe { swap_nonoverlapping_const(x, y, count) }
    1388        } else {
    1389            // Going though a slice here helps codegen know the size fits in `isize`
    1390            let slice = slice_from_raw_parts_mut(x, count);
    1391            // SAFETY: This is all readable from the pointer, meaning it's one
    1392            // allocation, and thus cannot be more than isize::MAX bytes.
    1393            let bytes = unsafe { mem::size_of_val_raw::<[T]>(slice) };
    1394            if let Some(bytes) = NonZero::new(bytes) {
    1395                // SAFETY: These are the same ranges, just expressed in a different
    1396                // type, so they're still non-overlapping.
    1397                unsafe { swap_nonoverlapping_bytes(x.cast(), y.cast(), bytes) };
    1398            }
    1399        }
    1400    )
    1401}
    1402
    1403/// Same behavior and safety conditions as [`swap_nonoverlapping`]
    1404#[inline]
    1405const unsafe fn swap_nonoverlapping_const<T>(x: *mut T, y: *mut T, count: usize) {
    1406    let mut i = 0;
    1407    while i < count {
    1408        // SAFETY: By precondition, `i` is in-bounds because it's below `n`
    1409        let x = unsafe { x.add(i) };
    1410        // SAFETY: By precondition, `i` is in-bounds because it's below `n`
    1411        // and it's distinct from `x` since the ranges are non-overlapping
    1412        let y = unsafe { y.add(i) };
    1413
    1414        // SAFETY: we're only ever given pointers that are valid to read/write,
    1415        // including being aligned, and nothing here panics so it's drop-safe.
    1416        unsafe {
    1417            // Note that it's critical that these use `copy_nonoverlapping`,
    1418            // rather than `read`/`write`, to avoid #134713 if T has padding.
    1419            let mut temp = MaybeUninit::<T>::uninit();
    1420            copy_nonoverlapping(x, temp.as_mut_ptr(), 1);
    1421            copy_nonoverlapping(y, x, 1);
    1422            copy_nonoverlapping(temp.as_ptr(), y, 1);
    1423        }
    1424
    1425        i += 1;
    1426    }
    1427}
    1428
    1429// Don't let MIR inline this, because we really want it to keep its noalias metadata
    1430#[rustc_no_mir_inline]
    1431#[inline]
    1432fn swap_chunk<const N: usize>(x: &mut MaybeUninit<[u8; N]>, y: &mut MaybeUninit<[u8; N]>) {
    1433    let a = *x;
    1434    let b = *y;
    1435    *x = b;
    1436    *y = a;
    1437}
    1438
    1439#[inline]
    1440unsafe fn swap_nonoverlapping_bytes(x: *mut u8, y: *mut u8, bytes: NonZero<usize>) {
    1441    // Same as `swap_nonoverlapping::<[u8; N]>`.
    1442    unsafe fn swap_nonoverlapping_chunks<const N: usize>(
    1443        x: *mut MaybeUninit<[u8; N]>,
    1444        y: *mut MaybeUninit<[u8; N]>,
    1445        chunks: NonZero<usize>,
    1446    ) {
    1447        let chunks = chunks.get();
    1448        for i in 0..chunks {
    1449            // SAFETY: i is in [0, chunks) so the adds and dereferences are in-bounds.
    1450            unsafe { swap_chunk(&mut *x.add(i), &mut *y.add(i)) };
    1451        }
    1452    }
    1453
    1454    // Same as `swap_nonoverlapping_bytes`, but accepts at most 1+2+4=7 bytes
    1455    #[inline]
    1456    unsafe fn swap_nonoverlapping_short(x: *mut u8, y: *mut u8, bytes: NonZero<usize>) {
    1457        // Tail handling for auto-vectorized code sometimes has element-at-a-time behaviour,
    1458        // see <https://github.com/rust-lang/rust/issues/134946>.
    1459        // By swapping as different sizes, rather than as a loop over bytes,
    1460        // we make sure not to end up with, say, seven byte-at-a-time copies.
    1461
    1462        let bytes = bytes.get();
    1463        let mut i = 0;
    1464        macro_rules! swap_prefix {
    1465            ($($n:literal)+) => {$(
    1466                if (bytes & $n) != 0 {
    1467                    // SAFETY: `i` can only have the same bits set as those in bytes,
    1468                    // so these `add`s are in-bounds of `bytes`.  But the bit for
    1469                    // `$n` hasn't been set yet, so the `$n` bytes that `swap_chunk`
    1470                    // will read and write are within the usable range.
    1471                    unsafe { swap_chunk::<$n>(&mut*x.add(i).cast(), &mut*y.add(i).cast()) };
    1472                    i |= $n;
    1473                }
    1474            )+};
    1475        }
    1476        swap_prefix!(4 2 1);
    1477        debug_assert_eq!(i, bytes);
    1478    }
    1479
    1480    const CHUNK_SIZE: usize = size_of::<*const ()>();
    1481    let bytes = bytes.get();
    1482
    1483    let chunks = bytes / CHUNK_SIZE;
    1484    let tail = bytes % CHUNK_SIZE;
    1485    if let Some(chunks) = NonZero::new(chunks) {
    1486        // SAFETY: this is bytes/CHUNK_SIZE*CHUNK_SIZE bytes, which is <= bytes,
    1487        // so it's within the range of our non-overlapping bytes.
    1488        unsafe { swap_nonoverlapping_chunks::<CHUNK_SIZE>(x.cast(), y.cast(), chunks) };
    1489    }
    1490    if let Some(tail) = NonZero::new(tail) {
    1491        const { assert!(CHUNK_SIZE <= 8) };
    1492        let delta = chunks * CHUNK_SIZE;
    1493        // SAFETY: the tail length is below CHUNK SIZE because of the remainder,
    1494        // and CHUNK_SIZE is at most 8 by the const assert, so tail <= 7
    1495        unsafe { swap_nonoverlapping_short(x.add(delta), y.add(delta), tail) };
    1496    }
    1497}
    1498
    1499/// Moves `src` into the pointed `dst`, returning the previous `dst` value.
    1500///
    1501/// Neither value is dropped.
    1502///
    1503/// This function is semantically equivalent to [`mem::replace`] except that it
    1504/// operates on raw pointers instead of references. When references are
    1505/// available, [`mem::replace`] should be preferred.
    1506///
    1507/// # Safety
    1508///
    1509/// Behavior is undefined if any of the following conditions are violated:
    1510///
    1511/// * `dst` must be [valid] for both reads and writes.
    1512///
    1513/// * `dst` must be properly aligned.
    1514///
    1515/// * `dst` must point to a properly initialized value of type `T`.
    1516///
    1517/// Note that even if `T` has size `0`, the pointer must be properly aligned.
    1518///
    1519/// [valid]: self#safety
    1520///
    1521/// # Examples
    1522///
    1523/// ```
    1524/// use std::ptr;
    1525///
    1526/// let mut rust = vec!['b', 'u', 's', 't'];
    1527///
    1528/// // `mem::replace` would have the same effect without requiring the unsafe
    1529/// // block.
    1530/// let b = unsafe {
    1531///     ptr::replace(&mut rust[0], 'r')
    1532/// };
    1533///
    1534/// assert_eq!(b, 'b');
    1535/// assert_eq!(rust, &['r', 'u', 's', 't']);
    1536/// ```
    1537#[inline]
    1538#[stable(feature = "rust1", since = "1.0.0")]
    1539#[rustc_const_stable(feature = "const_replace", since = "1.83.0")]
    1540#[rustc_diagnostic_item = "ptr_replace"]
    1541#[track_caller]
    1542pub const unsafe fn replace<T>(dst: *mut T, src: T) -> T {
    1543    // SAFETY: the caller must guarantee that `dst` is valid to be
    1544    // cast to a mutable reference (valid for writes, aligned, initialized),
    1545    // and cannot overlap `src` since `dst` must point to a distinct
    1546    // allocation.
    1547    unsafe {
    1548        ub_checks::assert_unsafe_precondition!(
    1549            check_language_ub,
    1550            "ptr::replace requires that the pointer argument is aligned and non-null",
    1551            (
    1552                addr: *const () = dst as *const (),
    1553                align: usize = align_of::<T>(),
    1554                is_zst: bool = T::IS_ZST,
    1555            ) => ub_checks::maybe_is_aligned_and_not_null(addr, align, is_zst)
    1556        );
    1557        mem::replace(&mut *dst, src)
    1558    }
    1559}
    1560
    1561/// Reads the value from `src` without moving it. This leaves the
    1562/// memory in `src` unchanged.
    1563///
    1564/// # Safety
    1565///
    1566/// Behavior is undefined if any of the following conditions are violated:
    1567///
    1568/// * `src` must be [valid] for reads.
    1569///
    1570/// * `src` must be properly aligned. Use [`read_unaligned`] if this is not the
    1571///   case.
    1572///
    1573/// * `src` must point to a properly initialized value of type `T`.
    1574///
    1575/// Note that even if `T` has size `0`, the pointer must be properly aligned.
    1576///
    1577/// # Examples
    1578///
    1579/// Basic usage:
    1580///
    1581/// ```
    1582/// let x = 12;
    1583/// let y = &x as *const i32;
    1584///
    1585/// unsafe {
    1586///     assert_eq!(std::ptr::read(y), 12);
    1587/// }
    1588/// ```
    1589///
    1590/// Manually implement [`mem::swap`]:
    1591///
    1592/// ```
    1593/// use std::ptr;
    1594///
    1595/// fn swap<T>(a: &mut T, b: &mut T) {
    1596///     unsafe {
    1597///         // Create a bitwise copy of the value at `a` in `tmp`.
    1598///         let tmp = ptr::read(a);
    1599///
    1600///         // Exiting at this point (either by explicitly returning or by
    1601///         // calling a function which panics) would cause the value in `tmp` to
    1602///         // be dropped while the same value is still referenced by `a`. This
    1603///         // could trigger undefined behavior if `T` is not `Copy`.
    1604///
    1605///         // Create a bitwise copy of the value at `b` in `a`.
    1606///         // This is safe because mutable references cannot alias.
    1607///         ptr::copy_nonoverlapping(b, a, 1);
    1608///
    1609///         // As above, exiting here could trigger undefined behavior because
    1610///         // the same value is referenced by `a` and `b`.
    1611///
    1612///         // Move `tmp` into `b`.
    1613///         ptr::write(b, tmp);
    1614///
    1615///         // `tmp` has been moved (`write` takes ownership of its second argument),
    1616///         // so nothing is dropped implicitly here.
    1617///     }
    1618/// }
    1619///
    1620/// let mut foo = "foo".to_owned();
    1621/// let mut bar = "bar".to_owned();
    1622///
    1623/// swap(&mut foo, &mut bar);
    1624///
    1625/// assert_eq!(foo, "bar");
    1626/// assert_eq!(bar, "foo");
    1627/// ```
    1628///
    1629/// ## Ownership of the Returned Value
    1630///
    1631/// `read` creates a bitwise copy of `T`, regardless of whether `T` is [`Copy`].
    1632/// If `T` is not [`Copy`], using both the returned value and the value at
    1633/// `*src` can violate memory safety. Note that assigning to `*src` counts as a
    1634/// use because it will attempt to drop the value at `*src`.
    1635///
    1636/// [`write()`] can be used to overwrite data without causing it to be dropped.
    1637///
    1638/// ```
    1639/// use std::ptr;
    1640///
    1641/// let mut s = String::from("foo");
    1642/// unsafe {
    1643///     // `s2` now points to the same underlying memory as `s`.
    1644///     let mut s2: String = ptr::read(&s);
    1645///
    1646///     assert_eq!(s2, "foo");
    1647///
    1648///     // Assigning to `s2` causes its original value to be dropped. Beyond
    1649///     // this point, `s` must no longer be used, as the underlying memory has
    1650///     // been freed.
    1651///     s2 = String::default();
    1652///     assert_eq!(s2, "");
    1653///
    1654///     // Assigning to `s` would cause the old value to be dropped again,
    1655///     // resulting in undefined behavior.
    1656///     // s = String::from("bar"); // ERROR
    1657///
    1658///     // `ptr::write` can be used to overwrite a value without dropping it.
    1659///     ptr::write(&mut s, String::from("bar"));
    1660/// }
    1661///
    1662/// assert_eq!(s, "bar");
    1663/// ```
    1664///
    1665/// [valid]: self#safety
    1666#[inline]
    1667#[stable(feature = "rust1", since = "1.0.0")]
    1668#[rustc_const_stable(feature = "const_ptr_read", since = "1.71.0")]
    1669#[track_caller]
    1670#[rustc_diagnostic_item = "ptr_read"]
    1671pub const unsafe fn read<T>(src: *const T) -> T {
    1672    // It would be semantically correct to implement this via `copy_nonoverlapping`
    1673    // and `MaybeUninit`, as was done before PR #109035. Calling `assume_init`
    1674    // provides enough information to know that this is a typed operation.
    1675
    1676    // However, as of March 2023 the compiler was not capable of taking advantage
    1677    // of that information. Thus, the implementation here switched to an intrinsic,
    1678    // which lowers to `_0 = *src` in MIR, to address a few issues:
    1679    //
    1680    // - Using `MaybeUninit::assume_init` after a `copy_nonoverlapping` was not
    1681    //   turning the untyped copy into a typed load. As such, the generated
    1682    //   `load` in LLVM didn't get various metadata, such as `!range` (#73258),
    1683    //   `!nonnull`, and `!noundef`, resulting in poorer optimization.
    1684    // - Going through the extra local resulted in multiple extra copies, even
    1685    //   in optimized MIR.  (Ignoring StorageLive/Dead, the intrinsic is one
    1686    //   MIR statement, while the previous implementation was eight.)  LLVM
    1687    //   could sometimes optimize them away, but because `read` is at the core
    1688    //   of so many things, not having them in the first place improves what we
    1689    //   hand off to the backend.  For example, `mem::replace::<Big>` previously
    1690    //   emitted 4 `alloca` and 6 `memcpy`s, but is now 1 `alloc` and 3 `memcpy`s.
    1691    // - In general, this approach keeps us from getting any more bugs (like
    1692    //   #106369) that boil down to "`read(p)` is worse than `*p`", as this
    1693    //   makes them look identical to the backend (or other MIR consumers).
    1694    //
    1695    // Future enhancements to MIR optimizations might well allow this to return
    1696    // to the previous implementation, rather than using an intrinsic.
    1697
    1698    // SAFETY: the caller must guarantee that `src` is valid for reads.
    1699    unsafe {
    1700        #[cfg(debug_assertions)] // Too expensive to always enable (for now?)
    1701        ub_checks::assert_unsafe_precondition!(
    1702            check_language_ub,
    1703            "ptr::read requires that the pointer argument is aligned and non-null",
    1704            (
    1705                addr: *const () = src as *const (),
    1706                align: usize = align_of::<T>(),
    1707                is_zst: bool = T::IS_ZST,
    1708            ) => ub_checks::maybe_is_aligned_and_not_null(addr, align, is_zst)
    1709        );
    1710        crate::intrinsics::read_via_copy(src)
    1711    }
    1712}
    1713
    1714/// Reads the value from `src` without moving it. This leaves the
    1715/// memory in `src` unchanged.
    1716///
    1717/// Unlike [`read`], `read_unaligned` works with unaligned pointers.
    1718///
    1719/// # Safety
    1720///
    1721/// Behavior is undefined if any of the following conditions are violated:
    1722///
    1723/// * `src` must be [valid] for reads.
    1724///
    1725/// * `src` must point to a properly initialized value of type `T`.
    1726///
    1727/// Like [`read`], `read_unaligned` creates a bitwise copy of `T`, regardless of
    1728/// whether `T` is [`Copy`]. If `T` is not [`Copy`], using both the returned
    1729/// value and the value at `*src` can [violate memory safety][read-ownership].
    1730///
    1731/// [read-ownership]: read#ownership-of-the-returned-value
    1732/// [valid]: self#safety
    1733///
    1734/// ## On `packed` structs
    1735///
    1736/// Attempting to create a raw pointer to an `unaligned` struct field with
    1737/// an expression such as `&packed.unaligned as *const FieldType` creates an
    1738/// intermediate unaligned reference before converting that to a raw pointer.
    1739/// That this reference is temporary and immediately cast is inconsequential
    1740/// as the compiler always expects references to be properly aligned.
    1741/// As a result, using `&packed.unaligned as *const FieldType` causes immediate
    1742/// *undefined behavior* in your program.
    1743///
    1744/// Instead you must use the `&raw const` syntax to create the pointer.
    1745/// You may use that constructed pointer together with this function.
    1746///
    1747/// An example of what not to do and how this relates to `read_unaligned` is:
    1748///
    1749/// ```
    1750/// #[repr(packed, C)]
    1751/// struct Packed {
    1752///     _padding: u8,
    1753///     unaligned: u32,
    1754/// }
    1755///
    1756/// let packed = Packed {
    1757///     _padding: 0x00,
    1758///     unaligned: 0x01020304,
    1759/// };
    1760///
    1761/// // Take the address of a 32-bit integer which is not aligned.
    1762/// // In contrast to `&packed.unaligned as *const _`, this has no undefined behavior.
    1763/// let unaligned = &raw const packed.unaligned;
    1764///
    1765/// let v = unsafe { std::ptr::read_unaligned(unaligned) };
    1766/// assert_eq!(v, 0x01020304);
    1767/// ```
    1768///
    1769/// Accessing unaligned fields directly with e.g. `packed.unaligned` is safe however.
    1770///
    1771/// # Examples
    1772///
    1773/// Read a `usize` value from a byte buffer:
    1774///
    1775/// ```
    1776/// fn read_usize(x: &[u8]) -> usize {
    1777///     assert!(x.len() >= size_of::<usize>());
    1778///
    1779///     let ptr = x.as_ptr() as *const usize;
    1780///
    1781///     unsafe { ptr.read_unaligned() }
    1782/// }
    1783/// ```
    1784#[inline]
    1785#[stable(feature = "ptr_unaligned", since = "1.17.0")]
    1786#[rustc_const_stable(feature = "const_ptr_read", since = "1.71.0")]
    1787#[track_caller]
    1788#[rustc_diagnostic_item = "ptr_read_unaligned"]
    1789pub const unsafe fn read_unaligned<T>(src: *const T) -> T {
    1790    let mut tmp = MaybeUninit::<T>::uninit();
    1791    // SAFETY: the caller must guarantee that `src` is valid for reads.
    1792    // `src` cannot overlap `tmp` because `tmp` was just allocated on
    1793    // the stack as a separate allocation.
    1794    //
    1795    // Also, since we just wrote a valid value into `tmp`, it is guaranteed
    1796    // to be properly initialized.
    1797    unsafe {
    1798        copy_nonoverlapping(src as *const u8, tmp.as_mut_ptr() as *mut u8, size_of::<T>());
    1799        tmp.assume_init()
    1800    }
    1801}
    1802
    1803/// Overwrites a memory location with the given value without reading or
    1804/// dropping the old value.
    1805///
    1806/// `write` does not drop the contents of `dst`. This is safe, but it could leak
    1807/// allocations or resources, so care should be taken not to overwrite an object
    1808/// that should be dropped.
    1809///
    1810/// Additionally, it does not drop `src`. Semantically, `src` is moved into the
    1811/// location pointed to by `dst`.
    1812///
    1813/// This is appropriate for initializing uninitialized memory, or overwriting
    1814/// memory that has previously been [`read`] from.
    1815///
    1816/// # Safety
    1817///
    1818/// Behavior is undefined if any of the following conditions are violated:
    1819///
    1820/// * `dst` must be [valid] for writes.
    1821///
    1822/// * `dst` must be properly aligned. Use [`write_unaligned`] if this is not the
    1823///   case.
    1824///
    1825/// Note that even if `T` has size `0`, the pointer must be properly aligned.
    1826///
    1827/// [valid]: self#safety
    1828///
    1829/// # Examples
    1830///
    1831/// Basic usage:
    1832///
    1833/// ```
    1834/// let mut x = 0;
    1835/// let y = &mut x as *mut i32;
    1836/// let z = 12;
    1837///
    1838/// unsafe {
    1839///     std::ptr::write(y, z);
    1840///     assert_eq!(std::ptr::read(y), 12);
    1841/// }
    1842/// ```
    1843///
    1844/// Manually implement [`mem::swap`]:
    1845///
    1846/// ```
    1847/// use std::ptr;
    1848///
    1849/// fn swap<T>(a: &mut T, b: &mut T) {
    1850///     unsafe {
    1851///         // Create a bitwise copy of the value at `a` in `tmp`.
    1852///         let tmp = ptr::read(a);
    1853///
    1854///         // Exiting at this point (either by explicitly returning or by
    1855///         // calling a function which panics) would cause the value in `tmp` to
    1856///         // be dropped while the same value is still referenced by `a`. This
    1857///         // could trigger undefined behavior if `T` is not `Copy`.
    1858///
    1859///         // Create a bitwise copy of the value at `b` in `a`.
    1860///         // This is safe because mutable references cannot alias.
    1861///         ptr::copy_nonoverlapping(b, a, 1);
    1862///
    1863///         // As above, exiting here could trigger undefined behavior because
    1864///         // the same value is referenced by `a` and `b`.
    1865///
    1866///         // Move `tmp` into `b`.
    1867///         ptr::write(b, tmp);
    1868///
    1869///         // `tmp` has been moved (`write` takes ownership of its second argument),
    1870///         // so nothing is dropped implicitly here.
    1871///     }
    1872/// }
    1873///
    1874/// let mut foo = "foo".to_owned();
    1875/// let mut bar = "bar".to_owned();
    1876///
    1877/// swap(&mut foo, &mut bar);
    1878///
    1879/// assert_eq!(foo, "bar");
    1880/// assert_eq!(bar, "foo");
    1881/// ```
    1882#[inline]
    1883#[stable(feature = "rust1", since = "1.0.0")]
    1884#[rustc_const_stable(feature = "const_ptr_write", since = "1.83.0")]
    1885#[rustc_diagnostic_item = "ptr_write"]
    1886#[track_caller]
    1887pub const unsafe fn write<T>(dst: *mut T, src: T) {
    1888    // Semantically, it would be fine for this to be implemented as a
    1889    // `copy_nonoverlapping` and appropriate drop suppression of `src`.
    1890
    1891    // However, implementing via that currently produces more MIR than is ideal.
    1892    // Using an intrinsic keeps it down to just the simple `*dst = move src` in
    1893    // MIR (11 statements shorter, at the time of writing), and also allows
    1894    // `src` to stay an SSA value in codegen_ssa, rather than a memory one.
    1895
    1896    // SAFETY: the caller must guarantee that `dst` is valid for writes.
    1897    // `dst` cannot overlap `src` because the caller has mutable access
    1898    // to `dst` while `src` is owned by this function.
    1899    unsafe {
    1900        #[cfg(debug_assertions)] // Too expensive to always enable (for now?)
    1901        ub_checks::assert_unsafe_precondition!(
    1902            check_language_ub,
    1903            "ptr::write requires that the pointer argument is aligned and non-null",
    1904            (
    1905                addr: *mut () = dst as *mut (),
    1906                align: usize = align_of::<T>(),
    1907                is_zst: bool = T::IS_ZST,
    1908            ) => ub_checks::maybe_is_aligned_and_not_null(addr, align, is_zst)
    1909        );
    1910        intrinsics::write_via_move(dst, src)
    1911    }
    1912}
    1913
    1914/// Overwrites a memory location with the given value without reading or
    1915/// dropping the old value.
    1916///
    1917/// Unlike [`write()`], the pointer may be unaligned.
    1918///
    1919/// `write_unaligned` does not drop the contents of `dst`. This is safe, but it
    1920/// could leak allocations or resources, so care should be taken not to overwrite
    1921/// an object that should be dropped.
    1922///
    1923/// Additionally, it does not drop `src`. Semantically, `src` is moved into the
    1924/// location pointed to by `dst`.
    1925///
    1926/// This is appropriate for initializing uninitialized memory, or overwriting
    1927/// memory that has previously been read with [`read_unaligned`].
    1928///
    1929/// # Safety
    1930///
    1931/// Behavior is undefined if any of the following conditions are violated:
    1932///
    1933/// * `dst` must be [valid] for writes.
    1934///
    1935/// [valid]: self#safety
    1936///
    1937/// ## On `packed` structs
    1938///
    1939/// Attempting to create a raw pointer to an `unaligned` struct field with
    1940/// an expression such as `&packed.unaligned as *const FieldType` creates an
    1941/// intermediate unaligned reference before converting that to a raw pointer.
    1942/// That this reference is temporary and immediately cast is inconsequential
    1943/// as the compiler always expects references to be properly aligned.
    1944/// As a result, using `&packed.unaligned as *const FieldType` causes immediate
    1945/// *undefined behavior* in your program.
    1946///
    1947/// Instead, you must use the `&raw mut` syntax to create the pointer.
    1948/// You may use that constructed pointer together with this function.
    1949///
    1950/// An example of how to do it and how this relates to `write_unaligned` is:
    1951///
    1952/// ```
    1953/// #[repr(packed, C)]
    1954/// struct Packed {
    1955///     _padding: u8,
    1956///     unaligned: u32,
    1957/// }
    1958///
    1959/// let mut packed: Packed = unsafe { std::mem::zeroed() };
    1960///
    1961/// // Take the address of a 32-bit integer which is not aligned.
    1962/// // In contrast to `&packed.unaligned as *mut _`, this has no undefined behavior.
    1963/// let unaligned = &raw mut packed.unaligned;
    1964///
    1965/// unsafe { std::ptr::write_unaligned(unaligned, 42) };
    1966///
    1967/// assert_eq!({packed.unaligned}, 42); // `{...}` forces copying the field instead of creating a reference.
    1968/// ```
    1969///
    1970/// Accessing unaligned fields directly with e.g. `packed.unaligned` is safe however
    1971/// (as can be seen in the `assert_eq!` above).
    1972///
    1973/// # Examples
    1974///
    1975/// Write a `usize` value to a byte buffer:
    1976///
    1977/// ```
    1978/// fn write_usize(x: &mut [u8], val: usize) {
    1979///     assert!(x.len() >= size_of::<usize>());
    1980///
    1981///     let ptr = x.as_mut_ptr() as *mut usize;
    1982///
    1983///     unsafe { ptr.write_unaligned(val) }
    1984/// }
    1985/// ```
    1986#[inline]
    1987#[stable(feature = "ptr_unaligned", since = "1.17.0")]
    1988#[rustc_const_stable(feature = "const_ptr_write", since = "1.83.0")]
    1989#[rustc_diagnostic_item = "ptr_write_unaligned"]
    1990#[track_caller]
    1991pub const unsafe fn write_unaligned<T>(dst: *mut T, src: T) {
    1992    // SAFETY: the caller must guarantee that `dst` is valid for writes.
    1993    // `dst` cannot overlap `src` because the caller has mutable access
    1994    // to `dst` while `src` is owned by this function.
    1995    unsafe {
    1996        copy_nonoverlapping((&raw const src) as *const u8, dst as *mut u8, size_of::<T>());
    1997        // We are calling the intrinsic directly to avoid function calls in the generated code.
    1998        intrinsics::forget(src);
    1999    }
    2000}
    2001
    2002/// Performs a volatile read of the value from `src` without moving it.
    2003///
    2004/// Volatile operations are intended to act on I/O memory. As such, they are considered externally
    2005/// observable events (just like syscalls, but less opaque), and are guaranteed to not be elided or
    2006/// reordered by the compiler across other externally observable events. With this in mind, there
    2007/// are two cases of usage that need to be distinguished:
    2008///
    2009/// - When a volatile operation is used for memory inside an [allocation], it behaves exactly like
    2010///   [`read`], except for the additional guarantee that it won't be elided or reordered (see
    2011///   above). This implies that the operation will actually access memory and not e.g. be lowered to
    2012///   reusing data from a previous read. Other than that, all the usual rules for memory accesses
    2013///   apply (including provenance).  In particular, just like in C, whether an operation is volatile
    2014///   has no bearing whatsoever on questions involving concurrent accesses from multiple threads.
    2015///   Volatile accesses behave exactly like non-atomic accesses in that regard.
    2016///
    2017/// - Volatile operations, however, may also be used to access memory that is _outside_ of any Rust
    2018///   allocation. In this use-case, the pointer does *not* have to be [valid] for reads. This is
    2019///   typically used for CPU and peripheral registers that must be accessed via an I/O memory
    2020///   mapping, most commonly at fixed addresses reserved by the hardware. These often have special
    2021///   semantics associated to their manipulation, and cannot be used as general purpose memory.
    2022///   Here, any address value is possible, including 0 and [`usize::MAX`], so long as the semantics
    2023///   of such a read are well-defined by the target hardware. The provenance of the pointer is
    2024///   irrelevant, and it can be created with [`without_provenance`]. The access must not trap. It
    2025///   can cause side-effects, but those must not affect Rust-allocated memory in any way. This
    2026///   access is still not considered [atomic], and as such it cannot be used for inter-thread
    2027///   synchronization.
    2028///
    2029/// Note that volatile memory operations where T is a zero-sized type are noops and may be ignored.
    2030///
    2031/// [allocation]: crate::ptr#allocated-object
    2032/// [atomic]: crate::sync::atomic#memory-model-for-atomic-accesses
    2033///
    2034/// # Safety
    2035///
    2036/// Like [`read`], `read_volatile` creates a bitwise copy of `T`, regardless of whether `T` is
    2037/// [`Copy`]. If `T` is not [`Copy`], using both the returned value and the value at `*src` can
    2038/// [violate memory safety][read-ownership]. However, storing non-[`Copy`] types in volatile memory
    2039/// is almost certainly incorrect.
    2040///
    2041/// Behavior is undefined if any of the following conditions are violated:
    2042///
    2043/// * `src` must be either [valid] for reads, or it must point to memory outside of all Rust
    2044///   allocations and reading from that memory must:
    2045///   - not trap, and
    2046///   - not cause any memory inside a Rust allocation to be modified.
    2047///
    2048/// * `src` must be properly aligned.
    2049///
    2050/// * Reading from `src` must produce a properly initialized value of type `T`.
    2051///
    2052/// Note that even if `T` has size `0`, the pointer must be properly aligned.
    2053///
    2054/// [valid]: self#safety
    2055/// [read-ownership]: read#ownership-of-the-returned-value
    2056///
    2057/// # Examples
    2058///
    2059/// Basic usage:
    2060///
    2061/// ```
    2062/// let x = 12;
    2063/// let y = &x as *const i32;
    2064///
    2065/// unsafe {
    2066///     assert_eq!(std::ptr::read_volatile(y), 12);
    2067/// }
    2068/// ```
    2069#[inline]
    2070#[stable(feature = "volatile", since = "1.9.0")]
    2071#[track_caller]
    2072#[rustc_diagnostic_item = "ptr_read_volatile"]
    2073pub unsafe fn read_volatile<T>(src: *const T) -> T {
    2074    // SAFETY: the caller must uphold the safety contract for `volatile_load`.
    2075    unsafe {
    2076        ub_checks::assert_unsafe_precondition!(
    2077            check_language_ub,
    2078            "ptr::read_volatile requires that the pointer argument is aligned",
    2079            (
    2080                addr: *const () = src as *const (),
    2081                align: usize = align_of::<T>(),
    2082            ) => ub_checks::maybe_is_aligned(addr, align)
    2083        );
    2084        intrinsics::volatile_load(src)
    2085    }
    2086}
    2087
    2088/// Performs a volatile write of a memory location with the given value without reading or dropping
    2089/// the old value.
    2090///
    2091/// Volatile operations are intended to act on I/O memory. As such, they are considered externally
    2092/// observable events (just like syscalls), and are guaranteed to not be elided or reordered by the
    2093/// compiler across other externally observable events. With this in mind, there are two cases of
    2094/// usage that need to be distinguished:
    2095///
    2096/// - When a volatile operation is used for memory inside an [allocation], it behaves exactly like
    2097///   [`write`][write()], except for the additional guarantee that it won't be elided or reordered
    2098///   (see above). This implies that the operation will actually access memory and not e.g. be
    2099///   lowered to a register access. Other than that, all the usual rules for memory accesses apply
    2100///   (including provenance). In particular, just like in C, whether an operation is volatile has no
    2101///   bearing whatsoever on questions involving concurrent access from multiple threads. Volatile
    2102///   accesses behave exactly like non-atomic accesses in that regard.
    2103///
    2104/// - Volatile operations, however, may also be used to access memory that is _outside_ of any Rust
    2105///   allocation. In this use-case, the pointer does *not* have to be [valid] for writes. This is
    2106///   typically used for CPU and peripheral registers that must be accessed via an I/O memory
    2107///   mapping, most commonly at fixed addresses reserved by the hardware. These often have special
    2108///   semantics associated to their manipulation, and cannot be used as general purpose memory.
    2109///   Here, any address value is possible, including 0 and [`usize::MAX`], so long as the semantics
    2110///   of such a write are well-defined by the target hardware. The provenance of the pointer is
    2111///   irrelevant, and it can be created with [`without_provenance`]. The access must not trap. It
    2112///   can cause side-effects, but those must not affect Rust-allocated memory in any way. This
    2113///   access is still not considered [atomic], and as such it cannot be used for inter-thread
    2114///   synchronization.
    2115///
    2116/// Note that volatile memory operations on zero-sized types (e.g., if a zero-sized type is passed
    2117/// to `write_volatile`) are noops and may be ignored.
    2118///
    2119/// `write_volatile` does not drop the contents of `dst`. This is safe, but it could leak
    2120/// allocations or resources, so care should be taken not to overwrite an object that should be
    2121/// dropped when operating on Rust memory. Additionally, it does not drop `src`. Semantically, `src`
    2122/// is moved into the location pointed to by `dst`.
    2123///
    2124/// [allocation]: crate::ptr#allocated-object
    2125/// [atomic]: crate::sync::atomic#memory-model-for-atomic-accesses
    2126///
    2127/// # Safety
    2128///
    2129/// Behavior is undefined if any of the following conditions are violated:
    2130///
    2131/// * `dst` must be either [valid] for writes, or it must point to memory outside of all Rust
    2132///   allocations and writing to that memory must:
    2133///   - not trap, and
    2134///   - not cause any memory inside a Rust allocation to be modified.
    2135///
    2136/// * `dst` must be properly aligned.
    2137///
    2138/// Note that even if `T` has size `0`, the pointer must be properly aligned.
    2139///
    2140/// [valid]: self#safety
    2141///
    2142/// # Examples
    2143///
    2144/// Basic usage:
    2145///
    2146/// ```
    2147/// let mut x = 0;
    2148/// let y = &mut x as *mut i32;
    2149/// let z = 12;
    2150///
    2151/// unsafe {
    2152///     std::ptr::write_volatile(y, z);
    2153///     assert_eq!(std::ptr::read_volatile(y), 12);
    2154/// }
    2155/// ```
    2156#[inline]
    2157#[stable(feature = "volatile", since = "1.9.0")]
    2158#[rustc_diagnostic_item = "ptr_write_volatile"]
    2159#[track_caller]
    2160pub unsafe fn write_volatile<T>(dst: *mut T, src: T) {
    2161    // SAFETY: the caller must uphold the safety contract for `volatile_store`.
    2162    unsafe {
    2163        ub_checks::assert_unsafe_precondition!(
    2164            check_language_ub,
    2165            "ptr::write_volatile requires that the pointer argument is aligned",
    2166            (
    2167                addr: *mut () = dst as *mut (),
    2168                align: usize = align_of::<T>(),
    2169            ) => ub_checks::maybe_is_aligned(addr, align)
    2170        );
    2171        intrinsics::volatile_store(dst, src);
    2172    }
    2173}
    2174
    2175/// Calculate an element-offset that increases a pointer's alignment.
    2176///
    2177/// Calculate an element-offset (not byte-offset) that when added to a given pointer `p`, increases `p`'s alignment to at least the given alignment `a`.
    2178///
    2179/// # Safety
    2180/// `a` must be a power of two.
    2181///
    2182/// # Notes
    2183/// This implementation has been carefully tailored to not panic. It is UB for this to panic.
    2184/// The only real change that can be made here is change of `INV_TABLE_MOD_16` and associated
    2185/// constants.
    2186///
    2187/// If we ever decide to make it possible to call the intrinsic with `a` that is not a
    2188/// power-of-two, it will probably be more prudent to just change to a naive implementation rather
    2189/// than trying to adapt this to accommodate that change.
    2190///
    2191/// Any questions go to @nagisa.
    2192#[allow(ptr_to_integer_transmute_in_consts)]
    2193pub(crate) unsafe fn align_offset<T: Sized>(p: *const T, a: usize) -> usize {
    2194    // FIXME(#75598): Direct use of these intrinsics improves codegen significantly at opt-level <=
    2195    // 1, where the method versions of these operations are not inlined.
    2196    use intrinsics::{
    2197        assume, cttz_nonzero, exact_div, mul_with_overflow, unchecked_rem, unchecked_shl,
    2198        unchecked_shr, unchecked_sub, wrapping_add, wrapping_mul, wrapping_sub,
    2199    };
    2200
    2201    /// Calculate multiplicative modular inverse of `x` modulo `m`.
    2202    ///
    2203    /// This implementation is tailored for `align_offset` and has following preconditions:
    2204    ///
    2205    /// * `m` is a power-of-two;
    2206    /// * `x < m`; (if `x ≥ m`, pass in `x % m` instead)
    2207    ///
    2208    /// Implementation of this function shall not panic. Ever.
    2209    #[inline]
    2210    const unsafe fn mod_inv(x: usize, m: usize) -> usize {
    2211        /// Multiplicative modular inverse table modulo 2⁴ = 16.
    2212        ///
    2213        /// Note, that this table does not contain values where inverse does not exist (i.e., for
    2214        /// `0⁻¹ mod 16`, `2⁻¹ mod 16`, etc.)
    2215        const INV_TABLE_MOD_16: [u8; 8] = [1, 11, 13, 7, 9, 3, 5, 15];
    2216        /// Modulo for which the `INV_TABLE_MOD_16` is intended.
    2217        const INV_TABLE_MOD: usize = 16;
    2218
    2219        // SAFETY: `m` is required to be a power-of-two, hence non-zero.
    2220        let m_minus_one = unsafe { unchecked_sub(m, 1) };
    2221        let mut inverse = INV_TABLE_MOD_16[(x & (INV_TABLE_MOD - 1)) >> 1] as usize;
    2222        let mut mod_gate = INV_TABLE_MOD;
    2223        // We iterate "up" using the following formula:
    2224        //
    2225        // $$ xy ≡ 1 (mod 2ⁿ) → xy (2 - xy) ≡ 1 (mod 2²ⁿ) $$
    2226        //
    2227        // This application needs to be applied at least until `2²ⁿ ≥ m`, at which point we can
    2228        // finally reduce the computation to our desired `m` by taking `inverse mod m`.
    2229        //
    2230        // This computation is `O(log log m)`, which is to say, that on 64-bit machines this loop
    2231        // will always finish in at most 4 iterations.
    2232        loop {
    2233            // y = y * (2 - xy) mod n
    2234            //
    2235            // Note, that we use wrapping operations here intentionally – the original formula
    2236            // uses e.g., subtraction `mod n`. It is entirely fine to do them `mod
    2237            // usize::MAX` instead, because we take the result `mod n` at the end
    2238            // anyway.
    2239            if mod_gate >= m {
    2240                break;
    2241            }
    2242            inverse = wrapping_mul(inverse, wrapping_sub(2usize, wrapping_mul(x, inverse)));
    2243            let (new_gate, overflow) = mul_with_overflow(mod_gate, mod_gate);
    2244            if overflow {
    2245                break;
    2246            }
    2247            mod_gate = new_gate;
    2248        }
    2249        inverse & m_minus_one
    2250    }
    2251
    2252    let stride = size_of::<T>();
    2253
    2254    let addr: usize = p.addr();
    2255
    2256    // SAFETY: `a` is a power-of-two, therefore non-zero.
    2257    let a_minus_one = unsafe { unchecked_sub(a, 1) };
    2258
    2259    if stride == 0 {
    2260        // SPECIAL_CASE: handle 0-sized types. No matter how many times we step, the address will
    2261        // stay the same, so no offset will be able to align the pointer unless it is already
    2262        // aligned. This branch _will_ be optimized out as `stride` is known at compile-time.
    2263        let p_mod_a = addr & a_minus_one;
    2264        return if p_mod_a == 0 { 0 } else { usize::MAX };
    2265    }
    2266
    2267    // SAFETY: `stride == 0` case has been handled by the special case above.
    2268    let a_mod_stride = unsafe { unchecked_rem(a, stride) };
    2269    if a_mod_stride == 0 {
    2270        // SPECIAL_CASE: In cases where the `a` is divisible by `stride`, byte offset to align a
    2271        // pointer can be computed more simply through `-p (mod a)`. In the off-chance the byte
    2272        // offset is not a multiple of `stride`, the input pointer was misaligned and no pointer
    2273        // offset will be able to produce a `p` aligned to the specified `a`.
    2274        //
    2275        // The naive `-p (mod a)` equation inhibits LLVM's ability to select instructions
    2276        // like `lea`. We compute `(round_up_to_next_alignment(p, a) - p)` instead. This
    2277        // redistributes operations around the load-bearing, but pessimizing `and` instruction
    2278        // sufficiently for LLVM to be able to utilize the various optimizations it knows about.
    2279        //
    2280        // LLVM handles the branch here particularly nicely. If this branch needs to be evaluated
    2281        // at runtime, it will produce a mask `if addr_mod_stride == 0 { 0 } else { usize::MAX }`
    2282        // in a branch-free way and then bitwise-OR it with whatever result the `-p mod a`
    2283        // computation produces.
    2284
    2285        let aligned_address = wrapping_add(addr, a_minus_one) & wrapping_sub(0, a);
    2286        let byte_offset = wrapping_sub(aligned_address, addr);
    2287        // FIXME: Remove the assume after <https://github.com/llvm/llvm-project/issues/62502>
    2288        // SAFETY: Masking by `-a` can only affect the low bits, and thus cannot have reduced
    2289        // the value by more than `a-1`, so even though the intermediate values might have
    2290        // wrapped, the byte_offset is always in `[0, a)`.
    2291        unsafe { assume(byte_offset < a) };
    2292
    2293        // SAFETY: `stride == 0` case has been handled by the special case above.
    2294        let addr_mod_stride = unsafe { unchecked_rem(addr, stride) };
    2295
    2296        return if addr_mod_stride == 0 {
    2297            // SAFETY: `stride` is non-zero. This is guaranteed to divide exactly as well, because
    2298            // addr has been verified to be aligned to the original type’s alignment requirements.
    2299            unsafe { exact_div(byte_offset, stride) }
    2300        } else {
    2301            usize::MAX
    2302        };
    2303    }
    2304
    2305    // GENERAL_CASE: From here on we’re handling the very general case where `addr` may be
    2306    // misaligned, there isn’t an obvious relationship between `stride` and `a` that we can take an
    2307    // advantage of, etc. This case produces machine code that isn’t particularly high quality,
    2308    // compared to the special cases above. The code produced here is still within the realm of
    2309    // miracles, given the situations this case has to deal with.
    2310
    2311    // SAFETY: a is power-of-two hence non-zero. stride == 0 case is handled above.
    2312    // FIXME(const-hack) replace with min
    2313    let gcdpow = unsafe {
    2314        let x = cttz_nonzero(stride);
    2315        let y = cttz_nonzero(a);
    2316        if x < y { x } else { y }
    2317    };
    2318    // SAFETY: gcdpow has an upper-bound that’s at most the number of bits in a `usize`.
    2319    let gcd = unsafe { unchecked_shl(1usize, gcdpow) };
    2320    // SAFETY: gcd is always greater or equal to 1.
    2321    if addr & unsafe { unchecked_sub(gcd, 1) } == 0 {
    2322        // This branch solves for the following linear congruence equation:
    2323        //
    2324        // ` p + so = 0 mod a `
    2325        //
    2326        // `p` here is the pointer value, `s` - stride of `T`, `o` offset in `T`s, and `a` - the
    2327        // requested alignment.
    2328        //
    2329        // With `g = gcd(a, s)`, and the above condition asserting that `p` is also divisible by
    2330        // `g`, we can denote `a' = a/g`, `s' = s/g`, `p' = p/g`, then this becomes equivalent to:
    2331        //
    2332        // ` p' + s'o = 0 mod a' `
    2333        // ` o = (a' - (p' mod a')) * (s'^-1 mod a') `
    2334        //
    2335        // The first term is "the relative alignment of `p` to `a`" (divided by the `g`), the
    2336        // second term is "how does incrementing `p` by `s` bytes change the relative alignment of
    2337        // `p`" (again divided by `g`). Division by `g` is necessary to make the inverse well
    2338        // formed if `a` and `s` are not co-prime.
    2339        //
    2340        // Furthermore, the result produced by this solution is not "minimal", so it is necessary
    2341        // to take the result `o mod lcm(s, a)`. This `lcm(s, a)` is the same as `a'`.
    2342
    2343        // SAFETY: `gcdpow` has an upper-bound not greater than the number of trailing 0-bits in
    2344        // `a`.
    2345        let a2 = unsafe { unchecked_shr(a, gcdpow) };
    2346        // SAFETY: `a2` is non-zero. Shifting `a` by `gcdpow` cannot shift out any of the set bits
    2347        // in `a` (of which it has exactly one).
    2348        let a2minus1 = unsafe { unchecked_sub(a2, 1) };
    2349        // SAFETY: `gcdpow` has an upper-bound not greater than the number of trailing 0-bits in
    2350        // `a`.
    2351        let s2 = unsafe { unchecked_shr(stride & a_minus_one, gcdpow) };
    2352        // SAFETY: `gcdpow` has an upper-bound not greater than the number of trailing 0-bits in
    2353        // `a`. Furthermore, the subtraction cannot overflow, because `a2 = a >> gcdpow` will
    2354        // always be strictly greater than `(p % a) >> gcdpow`.
    2355        let minusp2 = unsafe { unchecked_sub(a2, unchecked_shr(addr & a_minus_one, gcdpow)) };
    2356        // SAFETY: `a2` is a power-of-two, as proven above. `s2` is strictly less than `a2`
    2357        // because `(s % a) >> gcdpow` is strictly less than `a >> gcdpow`.
    2358        return wrapping_mul(minusp2, unsafe { mod_inv(s2, a2) }) & a2minus1;
    2359    }
    2360
    2361    // Cannot be aligned at all.
    2362    usize::MAX
    2363}
    2364
    2365/// Compares raw pointers for equality.
    2366///
    2367/// This is the same as using the `==` operator, but less generic:
    2368/// the arguments have to be `*const T` raw pointers,
    2369/// not anything that implements `PartialEq`.
    2370///
    2371/// This can be used to compare `&T` references (which coerce to `*const T` implicitly)
    2372/// by their address rather than comparing the values they point to
    2373/// (which is what the `PartialEq for &T` implementation does).
    2374///
    2375/// When comparing wide pointers, both the address and the metadata are tested for equality.
    2376/// However, note that comparing trait object pointers (`*const dyn Trait`) is unreliable: pointers
    2377/// to values of the same underlying type can compare inequal (because vtables are duplicated in
    2378/// multiple codegen units), and pointers to values of *different* underlying type can compare equal
    2379/// (since identical vtables can be deduplicated within a codegen unit).
    2380///
    2381/// # Examples
    2382///
    2383/// ```
    2384/// use std::ptr;
    2385///
    2386/// let five = 5;
    2387/// let other_five = 5;
    2388/// let five_ref = &five;
    2389/// let same_five_ref = &five;
    2390/// let other_five_ref = &other_five;
    2391///
    2392/// assert!(five_ref == same_five_ref);
    2393/// assert!(ptr::eq(five_ref, same_five_ref));
    2394///
    2395/// assert!(five_ref == other_five_ref);
    2396/// assert!(!ptr::eq(five_ref, other_five_ref));
    2397/// ```
    2398///
    2399/// Slices are also compared by their length (fat pointers):
    2400///
    2401/// ```
    2402/// let a = [1, 2, 3];
    2403/// assert!(std::ptr::eq(&a[..3], &a[..3]));
    2404/// assert!(!std::ptr::eq(&a[..2], &a[..3]));
    2405/// assert!(!std::ptr::eq(&a[0..2], &a[1..3]));
    2406/// ```
    2407#[stable(feature = "ptr_eq", since = "1.17.0")]
    2408#[inline(always)]
    2409#[must_use = "pointer comparison produces a value"]
    2410#[rustc_diagnostic_item = "ptr_eq"]
    2411#[allow(ambiguous_wide_pointer_comparisons)] // it's actually clear here
    2412pub fn eq<T: PointeeSized>(a: *const T, b: *const T) -> bool {
    2413    a == b
    2414}
    2415
    2416/// Compares the *addresses* of the two pointers for equality,
    2417/// ignoring any metadata in fat pointers.
    2418///
    2419/// If the arguments are thin pointers of the same type,
    2420/// then this is the same as [`eq`].
    2421///
    2422/// # Examples
    2423///
    2424/// ```
    2425/// use std::ptr;
    2426///
    2427/// let whole: &[i32; 3] = &[1, 2, 3];
    2428/// let first: &i32 = &whole[0];
    2429///
    2430/// assert!(ptr::addr_eq(whole, first));
    2431/// assert!(!ptr::eq::<dyn std::fmt::Debug>(whole, first));
    2432/// ```
    2433#[stable(feature = "ptr_addr_eq", since = "1.76.0")]
    2434#[inline(always)]
    2435#[must_use = "pointer comparison produces a value"]
    2436pub fn addr_eq<T: PointeeSized, U: PointeeSized>(p: *const T, q: *const U) -> bool {
    2437    (p as *const ()) == (q as *const ())
    2438}
    2439
    2440/// Compares the *addresses* of the two function pointers for equality.
    2441///
    2442/// This is the same as `f == g`, but using this function makes clear that the potentially
    2443/// surprising semantics of function pointer comparison are involved.
    2444///
    2445/// There are **very few guarantees** about how functions are compiled and they have no intrinsic
    2446/// “identity”; in particular, this comparison:
    2447///
    2448/// * May return `true` unexpectedly, in cases where functions are equivalent.
    2449///
    2450///   For example, the following program is likely (but not guaranteed) to print `(true, true)`
    2451///   when compiled with optimization:
    2452///
    2453///   ```
    2454///   let f: fn(i32) -> i32 = |x| x;
    2455///   let g: fn(i32) -> i32 = |x| x + 0;  // different closure, different body
    2456///   let h: fn(u32) -> u32 = |x| x + 0;  // different signature too
    2457///   dbg!(std::ptr::fn_addr_eq(f, g), std::ptr::fn_addr_eq(f, h)); // not guaranteed to be equal
    2458///   ```
    2459///
    2460/// * May return `false` in any case.
    2461///
    2462///   This is particularly likely with generic functions but may happen with any function.
    2463///   (From an implementation perspective, this is possible because functions may sometimes be
    2464///   processed more than once by the compiler, resulting in duplicate machine code.)
    2465///
    2466/// Despite these false positives and false negatives, this comparison can still be useful.
    2467/// Specifically, if
    2468///
    2469/// * `T` is the same type as `U`, `T` is a [subtype] of `U`, or `U` is a [subtype] of `T`, and
    2470/// * `ptr::fn_addr_eq(f, g)` returns true,
    2471///
    2472/// then calling `f` and calling `g` will be equivalent.
    2473///
    2474///
    2475/// # Examples
    2476///
    2477/// ```
    2478/// use std::ptr;
    2479///
    2480/// fn a() { println!("a"); }
    2481/// fn b() { println!("b"); }
    2482/// assert!(!ptr::fn_addr_eq(a as fn(), b as fn()));
    2483/// ```
    2484///
    2485/// [subtype]: https://doc.rust-lang.org/reference/subtyping.html
    2486#[stable(feature = "ptr_fn_addr_eq", since = "1.85.0")]
    2487#[inline(always)]
    2488#[must_use = "function pointer comparison produces a value"]
    2489pub fn fn_addr_eq<T: FnPtr, U: FnPtr>(f: T, g: U) -> bool {
    2490    f.addr() == g.addr()
    2491}
    2492
    2493/// Hash a raw pointer.
    2494///
    2495/// This can be used to hash a `&T` reference (which coerces to `*const T` implicitly)
    2496/// by its address rather than the value it points to
    2497/// (which is what the `Hash for &T` implementation does).
    2498///
    2499/// # Examples
    2500///
    2501/// ```
    2502/// use std::hash::{DefaultHasher, Hash, Hasher};
    2503/// use std::ptr;
    2504///
    2505/// let five = 5;
    2506/// let five_ref = &five;
    2507///
    2508/// let mut hasher = DefaultHasher::new();
    2509/// ptr::hash(five_ref, &mut hasher);
    2510/// let actual = hasher.finish();
    2511///
    2512/// let mut hasher = DefaultHasher::new();
    2513/// (five_ref as *const i32).hash(&mut hasher);
    2514/// let expected = hasher.finish();
    2515///
    2516/// assert_eq!(actual, expected);
    2517/// ```
    2518#[stable(feature = "ptr_hash", since = "1.35.0")]
    2519pub fn hash<T: PointeeSized, S: hash::Hasher>(hashee: *const T, into: &mut S) {
    2520    use crate::hash::Hash;
    2521    hashee.hash(into);
    2522}
    2523
    2524#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2525#[diagnostic::on_const(
    2526    message = "pointers cannot be reliably compared during const eval",
    2527    note = "see issue #53020 <https://github.com/rust-lang/rust/issues/53020> for more information"
    2528)]
    2529impl<F: FnPtr> PartialEq for F {
    2530    #[inline]
    2531    fn eq(&self, other: &Self) -> bool {
    2532        self.addr() == other.addr()
    2533    }
    2534}
    2535#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2536#[diagnostic::on_const(
    2537    message = "pointers cannot be reliably compared during const eval",
    2538    note = "see issue #53020 <https://github.com/rust-lang/rust/issues/53020> for more information"
    2539)]
    2540impl<F: FnPtr> Eq for F {}
    2541
    2542#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2543#[diagnostic::on_const(
    2544    message = "pointers cannot be reliably compared during const eval",
    2545    note = "see issue #53020 <https://github.com/rust-lang/rust/issues/53020> for more information"
    2546)]
    2547impl<F: FnPtr> PartialOrd for F {
    2548    #[inline]
    2549    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
    2550        self.addr().partial_cmp(&other.addr())
    2551    }
    2552}
    2553#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2554#[diagnostic::on_const(
    2555    message = "pointers cannot be reliably compared during const eval",
    2556    note = "see issue #53020 <https://github.com/rust-lang/rust/issues/53020> for more information"
    2557)]
    2558impl<F: FnPtr> Ord for F {
    2559    #[inline]
    2560    fn cmp(&self, other: &Self) -> Ordering {
    2561        self.addr().cmp(&other.addr())
    2562    }
    2563}
    2564
    2565#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2566impl<F: FnPtr> hash::Hash for F {
    2567    fn hash<HH: hash::Hasher>(&self, state: &mut HH) {
    2568        state.write_usize(self.addr() as _)
    2569    }
    2570}
    2571
    2572#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2573impl<F: FnPtr> fmt::Pointer for F {
    2574    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    2575        fmt::pointer_fmt_inner(self.addr() as _, f)
    2576    }
    2577}
    2578
    2579#[stable(feature = "fnptr_impls", since = "1.4.0")]
    2580impl<F: FnPtr> fmt::Debug for F {
    2581    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    2582        fmt::pointer_fmt_inner(self.addr() as _, f)
    2583    }
    2584}
    2585
    2586/// Creates a `const` raw pointer to a place, without creating an intermediate reference.
    2587///
    2588/// `addr_of!(expr)` is equivalent to `&raw const expr`. The macro is *soft-deprecated*;
    2589/// use `&raw const` instead.
    2590///
    2591/// It is still an open question under which conditions writing through an `addr_of!`-created
    2592/// pointer is permitted. If the place `expr` evaluates to is based on a raw pointer, then the
    2593/// result of `addr_of!` inherits all permissions from that raw pointer. However, if the place is
    2594/// based on a reference, local variable, or `static`, then until all details are decided, the same
    2595/// rules as for shared references apply: it is UB to write through a pointer created with this
    2596/// operation, except for bytes located inside an `UnsafeCell`. Use `&raw mut` (or [`addr_of_mut`])
    2597/// to create a raw pointer that definitely permits mutation.
    2598///
    2599/// Creating a reference with `&`/`&mut` is only allowed if the pointer is properly aligned
    2600/// and points to initialized data. For cases where those requirements do not hold,
    2601/// raw pointers should be used instead. However, `&expr as *const _` creates a reference
    2602/// before casting it to a raw pointer, and that reference is subject to the same rules
    2603/// as all other references. This macro can create a raw pointer *without* creating
    2604/// a reference first.
    2605///
    2606/// See [`addr_of_mut`] for how to create a pointer to uninitialized data.
    2607/// Doing that with `addr_of` would not make much sense since one could only
    2608/// read the data, and that would be Undefined Behavior.
    2609///
    2610/// # Safety
    2611///
    2612/// The `expr` in `addr_of!(expr)` is evaluated as a place expression, but never loads from the
    2613/// place or requires the place to be dereferenceable. This means that `addr_of!((*ptr).field)`
    2614/// still requires the projection to `field` to be in-bounds, using the same rules as [`offset`].
    2615/// However, `addr_of!(*ptr)` is defined behavior even if `ptr` is null, dangling, or misaligned.
    2616///
    2617/// Note that `Deref`/`Index` coercions (and their mutable counterparts) are applied inside
    2618/// `addr_of!` like everywhere else, in which case a reference is created to call `Deref::deref` or
    2619/// `Index::index`, respectively. The statements above only apply when no such coercions are
    2620/// applied.
    2621///
    2622/// [`offset`]: pointer::offset
    2623///
    2624/// # Example
    2625///
    2626/// **Correct usage: Creating a pointer to unaligned data**
    2627///
    2628/// ```
    2629/// use std::ptr;
    2630///
    2631/// #[repr(packed)]
    2632/// struct Packed {
    2633///     f1: u8,
    2634///     f2: u16,
    2635/// }
    2636///
    2637/// let packed = Packed { f1: 1, f2: 2 };
    2638/// // `&packed.f2` would create an unaligned reference, and thus be Undefined Behavior!
    2639/// let raw_f2 = ptr::addr_of!(packed.f2);
    2640/// assert_eq!(unsafe { raw_f2.read_unaligned() }, 2);
    2641/// ```
    2642///
    2643/// **Incorrect usage: Out-of-bounds fields projection**
    2644///
    2645/// ```rust,no_run
    2646/// use std::ptr;
    2647///
    2648/// #[repr(C)]
    2649/// struct MyStruct {
    2650///     field1: i32,
    2651///     field2: i32,
    2652/// }
    2653///
    2654/// let ptr: *const MyStruct = ptr::null();
    2655/// let fieldptr = unsafe { ptr::addr_of!((*ptr).field2) }; // Undefined Behavior ⚠️
    2656/// ```
    2657///
    2658/// The field projection `.field2` would offset the pointer by 4 bytes,
    2659/// but the pointer is not in-bounds of an allocation for 4 bytes,
    2660/// so this offset is Undefined Behavior.
    2661/// See the [`offset`] docs for a full list of requirements for inbounds pointer arithmetic; the
    2662/// same requirements apply to field projections, even inside `addr_of!`. (In particular, it makes
    2663/// no difference whether the pointer is null or dangling.)
    2664#[stable(feature = "raw_ref_macros", since = "1.51.0")]
    2665#[rustc_macro_transparency = "semiopaque"]
    2666pub macro addr_of($place:expr) {
    2667    &raw const $place
    2668}
    2669
    2670/// Creates a `mut` raw pointer to a place, without creating an intermediate reference.
    2671///
    2672/// `addr_of_mut!(expr)` is equivalent to `&raw mut expr`. The macro is *soft-deprecated*;
    2673/// use `&raw mut` instead.
    2674///
    2675/// Creating a reference with `&`/`&mut` is only allowed if the pointer is properly aligned
    2676/// and points to initialized data. For cases where those requirements do not hold,
    2677/// raw pointers should be used instead. However, `&mut expr as *mut _` creates a reference
    2678/// before casting it to a raw pointer, and that reference is subject to the same rules
    2679/// as all other references. This macro can create a raw pointer *without* creating
    2680/// a reference first.
    2681///
    2682/// # Safety
    2683///
    2684/// The `expr` in `addr_of_mut!(expr)` is evaluated as a place expression, but never loads from the
    2685/// place or requires the place to be dereferenceable. This means that `addr_of_mut!((*ptr).field)`
    2686/// still requires the projection to `field` to be in-bounds, using the same rules as [`offset`].
    2687/// However, `addr_of_mut!(*ptr)` is defined behavior even if `ptr` is null, dangling, or misaligned.
    2688///
    2689/// Note that `Deref`/`Index` coercions (and their mutable counterparts) are applied inside
    2690/// `addr_of_mut!` like everywhere else, in which case a reference is created to call `Deref::deref`
    2691/// or `Index::index`, respectively. The statements above only apply when no such coercions are
    2692/// applied.
    2693///
    2694/// [`offset`]: pointer::offset
    2695///
    2696/// # Examples
    2697///
    2698/// **Correct usage: Creating a pointer to unaligned data**
    2699///
    2700/// ```
    2701/// use std::ptr;
    2702///
    2703/// #[repr(packed)]
    2704/// struct Packed {
    2705///     f1: u8,
    2706///     f2: u16,
    2707/// }
    2708///
    2709/// let mut packed = Packed { f1: 1, f2: 2 };
    2710/// // `&mut packed.f2` would create an unaligned reference, and thus be Undefined Behavior!
    2711/// let raw_f2 = ptr::addr_of_mut!(packed.f2);
    2712/// unsafe { raw_f2.write_unaligned(42); }
    2713/// assert_eq!({packed.f2}, 42); // `{...}` forces copying the field instead of creating a reference.
    2714/// ```
    2715///
    2716/// **Correct usage: Creating a pointer to uninitialized data**
    2717///
    2718/// ```rust
    2719/// use std::{ptr, mem::MaybeUninit};
    2720///
    2721/// struct Demo {
    2722///     field: bool,
    2723/// }
    2724///
    2725/// let mut uninit = MaybeUninit::<Demo>::uninit();
    2726/// // `&uninit.as_mut().field` would create a reference to an uninitialized `bool`,
    2727/// // and thus be Undefined Behavior!
    2728/// let f1_ptr = unsafe { ptr::addr_of_mut!((*uninit.as_mut_ptr()).field) };
    2729/// unsafe { f1_ptr.write(true); }
    2730/// let init = unsafe { uninit.assume_init() };
    2731/// ```
    2732///
    2733/// **Incorrect usage: Out-of-bounds fields projection**
    2734///
    2735/// ```rust,no_run
    2736/// use std::ptr;
    2737///
    2738/// #[repr(C)]
    2739/// struct MyStruct {
    2740///     field1: i32,
    2741///     field2: i32,
    2742/// }
    2743///
    2744/// let ptr: *mut MyStruct = ptr::null_mut();
    2745/// let fieldptr = unsafe { ptr::addr_of_mut!((*ptr).field2) }; // Undefined Behavior ⚠️
    2746/// ```
    2747///
    2748/// The field projection `.field2` would offset the pointer by 4 bytes,
    2749/// but the pointer is not in-bounds of an allocation for 4 bytes,
    2750/// so this offset is Undefined Behavior.
    2751/// See the [`offset`] docs for a full list of requirements for inbounds pointer arithmetic; the
    2752/// same requirements apply to field projections, even inside `addr_of_mut!`. (In particular, it
    2753/// makes no difference whether the pointer is null or dangling.)
    2754#[stable(feature = "raw_ref_macros", since = "1.51.0")]
    2755#[rustc_macro_transparency = "semiopaque"]
    2756pub macro addr_of_mut($place:expr) {
    2757    &raw mut $place
    2758}