|
340 | 340 | //! clear where a satisfying unambiguous semantics can be defined for Exposed Provenance.
|
341 | 341 | //! Furthermore, Exposed Provenance will not work (well) with tools like [Miri] and [CHERI].
|
342 | 342 | //!
|
343 |
| -//! Exposed Provenance is provided by the [`expose_addr`] and [`from_exposed_addr`] methods, which |
344 |
| -//! are meant to replace `as` casts between pointers and integers. [`expose_addr`] is a lot like |
| 343 | +//! Exposed Provenance is provided by the [`expose`] and [`from_exposed_addr`] methods, which |
| 344 | +//! are meant to replace `as` casts between pointers and integers. [`expose`] is a lot like |
345 | 345 | //! [`addr`], but additionally adds the provenance of the pointer to a global list of 'exposed'
|
346 | 346 | //! provenances. (This list is purely conceptual, it exists for the purpose of specifying Rust but
|
347 | 347 | //! is not materialized in actual executions, except in tools like [Miri].) [`from_exposed_addr`]
|
|
355 | 355 | //! there is *no* previously 'exposed' provenance that justifies the way the returned pointer will
|
356 | 356 | //! be used, the program has undefined behavior.
|
357 | 357 | //!
|
358 |
| -//! Using [`expose_addr`] or [`from_exposed_addr`] (or the `as` casts) means that code is |
| 358 | +//! Using [`expose`] or [`from_exposed_addr`] (or the `as` casts) means that code is |
359 | 359 | //! *not* following Strict Provenance rules. The goal of the Strict Provenance experiment is to
|
360 |
| -//! determine how far one can get in Rust without the use of [`expose_addr`] and |
| 360 | +//! determine how far one can get in Rust without the use of [`expose`] and |
361 | 361 | //! [`from_exposed_addr`], and to encourage code to be written with Strict Provenance APIs only.
|
362 | 362 | //! Maximizing the amount of such code is a major win for avoiding specification complexity and to
|
363 | 363 | //! facilitate adoption of tools like [CHERI] and [Miri] that can be a big help in increasing the
|
|
374 | 374 | //! [`map_addr`]: pointer::map_addr
|
375 | 375 | //! [`addr`]: pointer::addr
|
376 | 376 | //! [`ptr::dangling`]: core::ptr::dangling
|
377 |
| -//! [`expose_addr`]: pointer::expose_addr |
| 377 | +//! [`expose`]: pointer::expose |
378 | 378 | //! [`from_exposed_addr`]: from_exposed_addr
|
379 | 379 | //! [Miri]: https://github.com/rust-lang/miri
|
380 | 380 | //! [CHERI]: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
|
@@ -664,7 +664,7 @@ pub const fn dangling_mut<T>() -> *mut T {
|
664 | 664 | ///
|
665 | 665 | /// This is a more rigorously specified alternative to `addr as *const T`. The provenance of the
|
666 | 666 | /// returned pointer is that of *any* pointer that was previously exposed by passing it to
|
667 |
| -/// [`expose_addr`][pointer::expose_addr], or a `ptr as usize` cast. In addition, memory which is |
| 667 | +/// [`expose`][pointer::expose], or a `ptr as usize` cast. In addition, memory which is |
668 | 668 | /// outside the control of the Rust abstract machine (MMIO registers, for example) is always
|
669 | 669 | /// considered to be exposed, so long as this memory is disjoint from memory that will be used by
|
670 | 670 | /// the abstract machine such as the stack, heap, and statics.
|
@@ -712,7 +712,7 @@ where
|
712 | 712 | ///
|
713 | 713 | /// This is a more rigorously specified alternative to `addr as *mut T`. The provenance of the
|
714 | 714 | /// returned pointer is that of *any* pointer that was previously passed to
|
715 |
| -/// [`expose_addr`][pointer::expose_addr] or a `ptr as usize` cast. If there is no previously |
| 715 | +/// [`expose`][pointer::expose] or a `ptr as usize` cast. If there is no previously |
716 | 716 | /// 'exposed' provenance that justifies the way this pointer will be used, the program has undefined
|
717 | 717 | /// behavior. Note that there is no algorithm that decides which provenance will be used. You can
|
718 | 718 | /// think of this as "guessing" the right provenance, and the guess will be "maximally in your
|
|
0 commit comments