Go unsafe包的安全使用模式

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

func main() {
    a := 0x12345678
    fmt.Printf("0x%x\n", a)

    var p *byte = (*byte)(&a)   // 错误！不允许将&a从*int类型显式转型为*byte类型
    *p = 0x23

    var b byte = byte(a)        // b是一个新变量，有自己所解释的内存空间
    b = 0x23                    // 即便强制进行类型转换，原变量a所解释的内存空间的数据依然不变
    fmt.Printf("0x%x\n", b)     // 0x23
    fmt.Printf("0x%x\n", a)     // 0x12345678
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

var i int = 17
var j uint64 = i             // 错误：int类型值不能直接赋值给uint64类型变量
var j uint64 = uint64(i)     // 没问题

var i int = 11
var p *uint64 = (*uint64)(&i)     // 错误：*int类型不能转换为*uint64类型
type MyInt int
var p *MyInt = (*MyInt)(&i)    // 没问题，MyInt的底层类型为int

// 不支持指针运算
var a [100]int
var p *int = &a[0]
*(p+1) = 10                    // 错误：*int类型与int类型无法相加，即不能跨越数组元素的边界

1
2
3
4
5
6
7

// $GOROOT/src/unsafe/unsafe.go
package unsafe
func Alignof(x ArbitraryType) uintptr
func Offsetof(x ArbitraryType) uintptr
func Sizeof(x ArbitraryType) uintptr
type ArbitraryType int
type Pointer *ArbitraryType

1
2
3
4

var i int = 5

fmt.Println(unsafe.Sizeof(i))               // 8
fmt.Println(unsafe.Sizeof((*int)(nil)))     // 8

1
2
3
4
5
6
7
8

var x unsafe.ArbitraryType // unsafe.ArbitraryType表示任意类型
b := uintptr(unsafe.Pointer(&x)) % unsafe.Alignof(x) == 0
fmt.Println(b) // true

fmt.Println(unsafe.Alignof(i))           // 8
fmt.Println(unsafe.Alignof(struct{}{}))  // 1 (注：空结构体的对齐系数为1)
fmt.Println(unsafe.Alignof([0]int{}))    // 8 (注：长度为0的数组，其对齐系数依然与其元素
                                         // 类型的对齐系数相同)

1
2

fmt.Println(unsafe.Offsetof(f.b))     // 8
fmt.Println(unsafe.Offsetof(f.d))     // 40

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

var a int = 5
var b  float64= 5.89
var arr [10]string
var f Foo
// 1. 任意类型的指针值都可以被转换为unsafe.Pointer
p1 := (unsafe.Pointer)(&a)     // *int -> unsafe.Pointer
p2 := (unsafe.Pointer)(&b)     // *float64 -> unsafe.Pointer
p3 := (unsafe.Pointer)(&arr)     // *[10]string -> unsafe.Pointer
p4 := (unsafe.Pointer)(&f)     // *Foo -> unsafe.Pointer

// 2. unsafe.Pointer也可以被转换为任意类型的指针值
var pa = (*int)(p1)         // unsafe.Pointer -> *int
var pb = (*float64)(p2)         // unsafe.Pointer -> *float64
var parr = (*[10]string)(p3) // unsafe.Pointer -> *[10]string
var pf = (*Foo)(p4) // unsafe.Pointer -> *Foo

// 3. uintptr类型值可以被转换为一个unsafe.Pointer
var i uintptr = 0x80010203
p := unsafe.Pointer(i)

// 4. unsafe.Pointer也可以被转换为一个uintptr类型值。
p := unsafe.Pointer(&a)
var i = uintptr(p)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

func main() {
    var a uint32 = 0x12345678
    fmt.Printf("0x%x\n", a)    // 0x12345678

    p := (unsafe.Pointer)(&a) // 利用unsafe.Pointer的性质1

    b := (*[4]byte)(p)        // 利用unsafe.Pointer的性质2
    b[0] = 0x23
    b[1] = 0x45
    b[2] = 0x67
    b[3] = 0x8a

    fmt.Printf("0x%x\n", a)   // 0x8a674523 (注：在小端字节序系统中输出此值)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

。
// $GOROOT/src/reflect/value.go

// emptyInterface用于表示一个interface{}类型的值的头部
type emptyInterface struct {
    typ  *rtype
    word unsafe.Pointer
}

func ValueOf(i interface{}) Value {
    ...
    return unpackEface(i)
}

// unpackEface将empty interface变量i转换成一个reflect.Value
func unpackEface(i interface{}) Value {
    e := (*emptyInterface)(unsafe.Pointer(&i))
    ...
    return Value{t, e.word, f}
}

// $GOROOT/src/reflect/type.go

// TypeOf返回interface{}类型变量i的动态类型信息
func TypeOf(i interface{}) Type {
    eface := *(*emptyInterface)(unsafe.Pointer(&i))
    return toType(eface.typ)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// $GOROOT/src/syscall/zsyscall_linux_amd64.go
func Listen(s int, n int) (err error) {
    _, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(n), 0)
    if e1 != 0 {
        err = errnoErr(e1)
    }
    return
}

func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
    r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)),
       uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)),
       uintptr(unsafe.Pointer(timeout)), 0)
    n = int(r0)
    if e1 != 0 {
        err = errnoErr(e1)
    }
    return
}

1
2
3
4
5

// $GOROOT/src/syscall/syscall_unix.go
func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno)
func Syscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err Errno)
func RawSyscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno)
func RawSyscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err Errn

1
2
3
4
5
6

func SetIcon(iconBytes []byte) {
    // 转换成一个C char类型
    cstr := (*C.char)(unsafe.Pointer(&iconBytes[0]))
    // 调用来自systray.h的函数
    C.setIcon(cstr, (C.int)(len(iconBytes)))
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

func Bytes2String(b []byte) string {
    return *(*string)(unsafe.Pointer(&b))
}

func String2Bytes(s string) []byte {
    // 必须在一个表达式内，原因见 unsafe 的安全使用模式
    sh := (*reflect.StringHeader)(unsafe.Pointer(&s))
    bh := reflect.SliceHeader{
        Data: sh.Data,
        Len:  sh.Len,
        Cap:  sh.Len,
    }
    return *(*[]byte)(unsafe.Pointer(&bh))
}

1
2
3
4
5

// 1. 模式 1 
// $GOROOT/src/math/unsafe.go
func Float64bits(f float64) uint64 {
    return *(*uint64)(unsafe.Pointer(&f))
}

1
2
3
4

// 1. 模式 2 
var x = [10]int{1, 2, 3, 4, 5, 6, 7, 8, 9, 0}
var p = uintptr(unsafe.Pointer(&x))
println(p)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// 访问数组a的第4个元素
var p = unsafe.Pointer(uintptr(unsafe.Pointer(&a)) + 3*unsafe.Sizeof(a[0]))
fmt.Println(*(*int)(p)) // 4

// 访问Foo结构体的字段c
p = unsafe.Pointer(uintptr(unsafe.Pointer(&foo)) + unsafe.Offsetof(foo.c))
fmt.Println(*(*float64)(p)) // 3.1415

// 对数组a的第一个元素进行逐字节步进式检查
for i := uintptr(0); i < unsafe.Sizeof((*int)(nil)); i++ {
    p = unsafe.Pointer(uintptr(unsafe.Pointer(&a)) + i)
    fmt.Printf("0x%x\n", *(*byte)(p))
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

func NewArray() *[10]int {
    a := [10]int{10, 11, 12, 13, 14, 15, 16, 17, 18, 19}
    return &a
}

func main() {
    a := uintptr(unsafe.Pointer(NewArray()))
    // 存在风险：这个时间空隙，GC可能随时回收掉NewArray()返回的数组实例
    p := unsafe.Pointer(a + unsafe.Sizeof(int(0)))
    fmt.Printf("%d\n", *(*int)(p)) // 输出：???
}


// 正确做法
func main() {
    p := unsafe.Pointer(uintptr(unsafe.Pointer(NewArray())) + unsafe.Sizeof(int(0)))
    fmt.Printf("%d\n", *(*int)(p)) // 11
}

1
2
3

// $GOROOT/src/syscall/syscall_unix.go
func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno)
func Syscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err Errno)

1
2
3
4

var p *T // 待传给Syscall系列函数的指针变量
...
a := uintptr(unsafe.Pointer(p))
syscall.Syscall(SYS_READ, uintptr(fd), a, uintptr(n))

1
2

var p *T // 待传给Syscall系列函数的指针变量
syscall.Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(n))

1
2
3

// $GOROOT/src/reflect/value.go
func (v Value) Pointer() uintptr
func (v Value) UnsafeAddr() uintptr

1
2
3
4
5
6

// 错误! 在两条语句的执行间隙，T类型对象可能被垃圾回收
u := reflect.ValueOf(new(T)).Pointer()
p := (*T)(unsafe.Pointer(u)) 

// 正确
p := (*T)(unsafe.Pointer(reflect.ValueOf(new(T)).Pointer()))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

type SliceHeader struct {
	Data uintptr
	Len  int
	Cap  int
}

type StringHeader struct {
	Data uintptr
	Len  int
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

func newSlice() *[]byte {
    var b = []byte("hello, gopher")
    return &b
}

func main() {
    // 注意虽然 SliceHeader 中的 Data 是 uintptr，但是使用模式 1 的转换，引用依然有效
    bh := (*reflect.SliceHeader)(unsafe.Pointer(newSlice())) // 模式1
    var p = (*[]byte)(unsafe.Pointer(bh))
    fmt.Printf("%q\n", *p) // "hello, gopher"

    var a = [...]byte{'I', ' ', 'l', 'o', 'v', 'e', ' ', 'G', 'o', '!', '!'}
    bh.Data = uintptr(unsafe.Pointer(&a))
    bh.Len = len(a)
    bh.Cap = len(a)

    fmt.Printf("%q\n", *p) // "I love Go!!"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

func finalizer(p *[11]byte) {
    fmt.Println("数组对象被垃圾回收")
}

func newArray() *[11]byte {
    var a = [...]byte{'I', ' ', 'l', 'o', 'v', 'e', ' ', 'G', 'o', '!', '!'}
    runtime.SetFinalizer(&a, finalizer)
    return &a
}

func main() {
    var bh reflect.SliceHeader
    // 这一步转换之后，newArray() 返回的数组就已经没有对象引用了
    bh.Data = uintptr(unsafe.Pointer(newArray()))
    bh.Len = 11
    bh.Cap = 11
    var p = (*[]byte)(unsafe.Pointer(&bh))
    for i := 0; i < 3; i++ {
        runtime.GC() // 数组对象在此处被垃圾回收
        time.Sleep(1 * time.Second)
    }
    fmt.Printf("%q\n", *p) //
}

1
2
3
4
5
6
7

func StringToBytes(s string) []byte {
    return unsafe.Slice(unsafe.StringData(s), len(s))
}

func BytesToString(b []byte) string {
    return unsafe.String(&b[0], len(b))
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

func main() {
    var n = 5
    b := make([]byte, n)
    end := unsafe.Pointer(uintptr(unsafe.Pointer(&b[0])) + uintptr(n+10))
    _ = end
}

// 使用-race选项运行的结果如下（Ubuntu 18.04）：
$go run -race  go_unsafe_compile_checkptr.go
fatal error: checkptr: unsafe pointer arithmetic
...
exit status 2