You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

75 lines
1.9 KiB

use proptest::prelude::*;
use wiggle::{GuestMemory, GuestType};
use wiggle_test::{impl_errno, HostMemory, MemArea, WasiCtx};
const FD_VAL: u32 = 123;
wiggle::from_witx!({
witx: ["tests/handles.witx"],
ctx: WasiCtx,
});
impl_errno!(types::Errno, types::GuestErrorConversion);
impl<'a> handle_examples::HandleExamples for WasiCtx<'a> {
fn fd_create(&self) -> Result<types::Fd, types::Errno> {
Ok(types::Fd::from(FD_VAL))
}
fn fd_consume(&self, fd: types::Fd) -> Result<(), types::Errno> {
println!("FD_CONSUME {}", fd);
if fd == types::Fd::from(FD_VAL) {
Ok(())
} else {
Err(types::Errno::InvalidArg)
}
}
}
#[derive(Debug)]
struct HandleExercise {
pub return_loc: MemArea,
}
impl HandleExercise {
pub fn test(&self) {
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
let ctx = WasiCtx::new();
let host_memory = HostMemory::new();
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
let e = handle_examples::fd_create(&ctx, &host_memory, self.return_loc.ptr as i32);
assert_eq!(e, types::Errno::Ok.into(), "fd_create error");
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
let h_got: u32 = host_memory
.ptr(self.return_loc.ptr)
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
.read()
.expect("return ref_mut");
assert_eq!(h_got, 123, "fd_create return val");
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
let e = handle_examples::fd_consume(&ctx, &host_memory, h_got as i32);
assert_eq!(e, types::Errno::Ok.into(), "fd_consume error");
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
let e = handle_examples::fd_consume(&ctx, &host_memory, h_got as i32 + 1);
assert_eq!(
e,
types::Errno::InvalidArg.into(),
"fd_consume invalid error"
);
}
pub fn strat() -> BoxedStrategy<Self> {
Rewrite for recursive safety This commit rewrites the runtime crate to provide safety in the face of recursive calls to the guest. The basic principle is that `GuestMemory` is now a trait which dynamically returns the pointer/length pair. This also has an implicit contract (hence the `unsafe` trait) that the pointer/length pair point to a valid list of bytes in host memory &#34;until something is reentrant&#34;. After this changes the various suite of `Guest*` types were rewritten. `GuestRef` and `GuestRefMut` were both removed since they cannot safely exist. The `GuestPtrMut` type was removed for simplicity, and the final `GuestPtr` type subsumes `GuestString` and `GuestArray`. This means that there&#39;s only one guest pointer type, `GuestPtr&lt;&#39;a, T&gt;`, where `&#39;a` is the borrow into host memory, basically borrowing the `GuestMemory` trait object itself. Some core utilities are exposed on `GuestPtr`, but they&#39;re all 100% safe. Unsafety is now entirely contained within a few small locations: * Implementations of the `GuestType` for primitive types (e.g. `i8`, `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of `GuestMemory` though should prove that they&#39;re safe. * `GuestPtr&lt;&#39;_, str&gt;` has a method which validates utf-8 contents, and this requires `unsafe` internally to read all the bytes. This is guaranteed to be safe however given the contract of `GuestMemory`. And that&#39;s it! Everything else is a bunch of safe combinators all built up on the various utilities provided by `GuestPtr`. The general idioms are roughly the same as before, with various tweaks here and there. A summary of expected idioms are: * For small values you&#39;d `.read()` or `.write()` very quickly. You&#39;d pass around the type itself. * For strings, you&#39;d pass `GuestPtr&lt;&#39;_, str&gt;` down to the point where it&#39;s actually consumed. At that moment you&#39;d either decide to copy it out (a safe operation) or you&#39;d get a raw view to the string (an unsafe operation) and assert that you won&#39;t call back into wasm while you&#39;re holding that pointer. * Arrays are similar to strings, passing around `GuestPtr&lt;&#39;_, [T]&gt;`. Arrays also have a `iter()` method which yields an iterator of `GuestPtr&lt;&#39;_, T&gt;` for convenience. Overall there&#39;s still a lot of missing documentation on the runtime crate specifically around the safety of the `GuestMemory` trait as well as how the utilities/methods are expected to be used. Additionally there&#39;s utilities which aren&#39;t currently implemented which would be easy to implement. For example there&#39;s no method to copy out a string or a slice, although that would be pretty easy to add. In any case I&#39;m curious to get feedback on this approach and see what y&#39;all think!
5 years ago
(HostMemory::mem_area_strat(types::Fd::guest_size()))
.prop_map(|return_loc| HandleExercise { return_loc })
.boxed()
}
}
proptest! {
#[test]
fn handle_exercise(e in HandleExercise::strat()) {
e.test()
}
}