1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
#![cfg_attr(feature = "dynasm", feature(proc_macro_hygiene))]
use crate::details::ShadowLayout;
#[cfg(feature = "dynasm")]
use dynasm::dynasm;
use dynasmrt::DynasmApi;
use std::marker::PhantomData;

pub use traitor_derive::shadow;

/// This module is public so it can be used by code generated by proc macro.
#[doc(hidden)]
pub mod details {
    /// Used for discovering contents of vtables
    #[doc(hidden)]
    pub struct VTableInfo;

    #[doc(hidden)]
    pub unsafe trait VTableInfoTrait<S, T: ?Sized> {
        /// Pointers to vtable functions, in order they appear in vtable.
        /// WARNING: ordering of functions in trait object is an implementation details!
        const VTABLE_FUNCS: &'static [*const u8];
    }

    /// Layout information of the target trait
    #[doc(hidden)]
    pub struct LayoutInfo {
        /// vtable layout for the primary trait we are targeting.
        pub shadow: Vec<ShadowLayout>,
        /// vtable functions for other traits used as bound.
        pub other: Vec<&'static [*const u8]>,
    }

    #[doc(hidden)]
    pub struct ShadowLayout {
        /// How many "slots" (registers) are used for passing arguments.
        pub ret_slots: usize,
        /// How many "slots" (registers) are used for passing return value.
        pub arg_slots: usize,
        /// Pointer to the implementation function.
        pub func_ptr: *const u8,
    }

    /// Internal trait that defines vtable functions layouts
    #[doc(hidden)]
    pub trait InternalBindingInfo {
        type Data: Sized;
        type Shadow: Sized;
        /// Target trait
        type Target: ?Sized;

        fn layout() -> LayoutInfo;
        fn into_shadow(self) -> Self::Shadow;
    }
}

/// Layout info for commonly used traits (we only support these traits as super-traits).
#[doc(hidden)]
mod common {
    use std::fmt::Debug;

    unsafe impl<T: Debug> crate::details::VTableInfoTrait<T, Debug> for crate::details::VTableInfo {
        // FIXME: grab funcs from vtable instead, we only need to know the count!...
        const VTABLE_FUNCS: &'static [*const u8] = &[<T as Debug>::fmt as *const u8];
    }
}

struct VTable {
    vtable: Vec<*const u8>,
    #[allow(unused)]
    buffer: dynasmrt::ExecutableBuffer,
}

/// Every virtual table starts with these entries.
/// We use arbitrary empty trait which is implemented by every type in our system
/// to capture these entries.
#[repr(C)]
#[derive(Clone)]
struct VirtualTableHeader {
    destructor: fn(*mut ()),
    size: usize,
    align: usize,
}

/// Trait object runtime representation
#[repr(C)]
struct TraitObject {
    pub data: *mut (),
    pub vtable: *const (),
}

/// Trait used to capture destructor, align and size of our object
trait Whatever {}
impl<T> Whatever for T {}

pub struct Traitor {
    vtables: typed_arena::Arena<VTable>,
    shadows: typed_arena::Arena<Box<Whatever>>,
}

impl Traitor {
    pub fn new() -> Self {
        Traitor {
            vtables: typed_arena::Arena::new(),
            shadows: typed_arena::Arena::new(),
        }
    }
}

/// Binder allows converting provided reference to the data into the trait object by attaching
/// vtable generated via [`ShadowCaster::declare`] call.
#[repr(transparent)]
pub struct Binder<Data, Trait: ?Sized>(VTable, PhantomData<(Data, Trait)>);

impl<'sc, D, R: ?Sized> PartialEq for Binder<D, R> {
    fn eq(&self, other: &Self) -> bool {
        std::ptr::eq(self as *const Self, other)
    }
}

impl<'sc, Data, Trait: ?Sized> Eq for Binder<Data, Trait> {}

impl<'sc, Data, Trait: ?Sized> Binder<Data, Trait> {
    /// Bind given reference to the data and return a trait object
    pub fn bind<'output, 'input>(&'sc self, data: &'input Data) -> &'output Trait
    where
        'sc: 'output,
        'input: 'output,
    {
        let obj = TraitObject {
            data: data as *const Data as *mut (),
            vtable: self.0.vtable.as_ptr() as *const (),
        };
        unsafe { *(&obj as *const TraitObject as *const &Trait) }
    }

    /// Bind given mutable reference to the data and return a trait object
    pub fn bind_mut<'output, 'input>(&'sc self, data: &'input mut Data) -> &'output mut Trait
    where
        'sc: 'output,
        'input: 'output,
    {
        let mut obj = TraitObject {
            data: data as *mut Data as *mut (),
            vtable: self.0.vtable.as_ptr() as *const (),
        };
        unsafe { *(&mut obj as *mut TraitObject as *mut &mut Trait) }
    }
}

impl Traitor {
    pub fn declare<'sc, B>(&'sc self, binder: B) -> &'sc Binder<B::Data, B::Target>
    where
        B: crate::details::InternalBindingInfo,
        B::Shadow: 'sc,
    {
        unsafe {
            // Move shadow information into heap
            let shadow: Box<Whatever> = Box::new(binder.into_shadow());
            // Move box ignoring lifetimes; we require that "shadow" lives at least as `&self`, so
            // this should be fine?
            let shadow: &mut Box<Whatever> = self
                .shadows
                .alloc(std::mem::transmute::<Box<Whatever + 'sc>, Box<Whatever>>(
                    shadow,
                ));
            let shadow_ptr = shadow.as_ref() as *const Whatever as *const B::Shadow;

            // Build vtable
            let layout = B::layout();

            let other_funcs_cnt: usize = layout.other.iter().map(|o| o.len()).sum();
            // 3 is for destructor pointer, size and align, which are at the top of the vtable
            let vtable_len = 3 + layout.shadow.len() + other_funcs_cnt;
            let mut vtable: Vec<*const u8> = Vec::with_capacity(vtable_len);

            // Capture destructor, size and align for our data type from other vtable
            let data: *const B::Data = std::ptr::null();
            let whatever = data as *const dyn Whatever;
            let whatever_obj = std::mem::transmute::<*const dyn Whatever, TraitObject>(whatever);
            vtable.extend_from_slice(std::slice::from_raw_parts(
                whatever_obj.vtable as *const *const u8,
                3,
            ));

            // Compile trampoline functions and put them to the table
            let (buffer, funcs) = Self::compile_funcs(&layout.shadow, shadow_ptr as *const ());
            for offset in funcs {
                let pointer = buffer.ptr(offset);
                vtable.push(pointer);
            }

            for other in layout.other {
                vtable.extend_from_slice(other);
            }
            assert_eq!(vtable.len(), vtable_len);

            // Keep vtable and buffer with compiled code in our arena!
            let vtable = VTable { vtable, buffer };
            let vtable: &VTable = self.vtables.alloc(vtable);

            std::mem::transmute::<&VTable, &Binder<B::Data, B::Target>>(vtable)
        }
    }

    #[cfg(feature = "dynasm")]
    fn compile_funcs(
        layout: &[ShadowLayout],
        shadow_ptr: *const (),
    ) -> (dynasmrt::ExecutableBuffer, Vec<dynasmrt::AssemblyOffset>) {
        // Compile trampoline functions
        let mut ops = dynasmrt::x64::Assembler::new().unwrap();

        let mut func_offsets = Vec::new();
        for info in layout {
            func_offsets.push(ops.offset());

            // System V calling convention uses: rdi, rsi, rdx, rcx, r8, r9
            let slots = info.arg_slots + info.ret_slots;
            match slots {
                1 => {
                    dynasm!(ops
                      ; mov rsi, QWORD shadow_ptr as _
                    );
                }
                2 => {
                    dynasm!(ops
                      ; mov rdx, QWORD shadow_ptr as _
                    );
                }
                3 => {
                    dynasm!(ops
                      ; mov rcx, QWORD shadow_ptr as _
                    );
                }
                4 => {
                    dynasm!(ops
                      ; mov r8, QWORD shadow_ptr as _
                    );
                }
                _ => unimplemented!("argument count not supported"),
            }

            let impl_func = info.func_ptr;
            dynasm!(ops
              ; mov rax, QWORD impl_func as _
              ; sub rsp, BYTE 0x8 // align stack
              ; call rax
              ; add rsp, BYTE 0x8
              ; ret
            );
        }

        (ops.finalize().unwrap(), func_offsets)
    }

    #[cfg(not(feature = "dynasm"))]
    fn compile_funcs(
        layout: &[ShadowLayout],
        shadow_ptr: *const (),
    ) -> (dynasmrt::ExecutableBuffer, Vec<dynasmrt::AssemblyOffset>) {
        // Compile trampoline functions
        let mut ops = dynasmrt::x64::Assembler::new().unwrap();

        let mut func_offsets = Vec::new();
        for info in layout {
            func_offsets.push(ops.offset());

            // System V calling convention uses: rdi, rsi, rdx, rcx, r8, r9
            let slots = info.arg_slots + info.ret_slots;
            match slots {
                1 => {
                    // mov rsi, QWORD shadow_ptr as _
                    ops.push_u16(0xbe48);
                    ops.push_u64(shadow_ptr as u64);
                }
                2 => {
                    // mov rdx, QWORD shadow_ptr as _
                    ops.push_u16(0xba48);
                    ops.push_u64(shadow_ptr as u64);
                }
                3 => {
                    // mov rcx, QWORD shadow_ptr as _
                    ops.push_u16(0xb948);
                    ops.push_u64(shadow_ptr as u64);
                }
                4 => {
                    // mov r8, QWORD shadow_ptr as _
                    ops.push_u16(0xb849);
                    ops.push_u64(shadow_ptr as u64);
                }
                _ => unimplemented!("argument count not supported"),
            }

            // mov rax, QWORD info.func_ptr as _
            ops.push(0x48);
            ops.push(0xB8);
            ops.push_u64(info.func_ptr as u64);
            // align stack
            // sub rsp, BYTE 0x8
            ops.push_u32(0x08ec8348);
            // call rax
            ops.push_u16(0xd0ff);
            // add rsp, BYTE 0x8
            ops.push_u32(0x08c48348);
            // ret
            ops.push(0xc3);
        }

        (ops.finalize().unwrap(), func_offsets)
    }
}