Check safety of as_raw with a simplified borrow checker (#37)

* wiggle-runtime: add as_raw method for [T]

* add trivial borrow checker back in

* integrate runtime borrow checker with as_raw methods

* handle pointer arith overflow correctly in as_raw, create PtrOverflow error

* runtime: add validation back to GuestType

* generate: impl validate for enums, flags, handles, ints

* oops! make validate its own method on trait GuestTypeTransparent

* fix transparent impls for enum, flag, handle, int

* some structs are transparent. fix tests.

* tests: define byte_slice_strat and friends

* wiggle-tests: i believe my allocator is working now

* some type juggling around memset for ease of use

* make GuestTypeTransparent an unsafe trait

* delete redundant validation of pointer align

* fix doc

* wiggle_test: aha, you cant use sets to track memory areas

* add multi-string test

which exercises the runtime borrow checker against
HostMemory::byte_slice_strat

* oops left debug panic in

* remove redundant (& incorrect, since unchecked) length calc

* redesign validate again, and actually hook to as_raw

* makr all validate impls as inline

this should hopefully allow as_raw's check loop to be unrolled to a
no-op in most cases!

* code review fixes

crates/test/src/lib.rs

@@ -2,6 +2,45 @@ use proptest::prelude::*;
 use std::cell::UnsafeCell;
 use wiggle_runtime::GuestMemory;
 
+#[derive(Debug, Clone)]
+pub struct MemAreas(Vec<MemArea>);
+impl MemAreas {
+    pub fn new() -> Self {
+        MemAreas(Vec::new())
+    }
+    pub fn insert(&mut self, a: MemArea) {
+        // Find if `a` is already in the vector
+        match self.0.binary_search(&a) {
+            // It is present - insert it next to existing one
+            Ok(loc) => self.0.insert(loc, a),
+            // It is not present - heres where to insert it
+            Err(loc) => self.0.insert(loc, a),
+        }
+    }
+    pub fn iter(&self) -> impl Iterator<Item = &MemArea> {
+        self.0.iter()
+    }
+}
+
+impl<R> From<R> for MemAreas
+where
+    R: AsRef<[MemArea]>,
+{
+    fn from(ms: R) -> MemAreas {
+        let mut out = MemAreas::new();
+        for m in ms.as_ref().into_iter() {
+            out.insert(*m);
+        }
+        out
+    }
+}
+
+impl Into<Vec<MemArea>> for MemAreas {
+    fn into(self) -> Vec<MemArea> {
+        self.0.clone()
+    }
+}
+
 #[repr(align(4096))]
 pub struct HostMemory {
     buffer: UnsafeCell<[u8; 4096]>,
@@ -26,6 +65,42 @@ impl HostMemory {
             })
             .boxed()
     }
+
+    /// Takes a sorted list or memareas, and gives a sorted list of memareas covering
+    /// the parts of memory not covered by the previous
+    pub fn invert(regions: &MemAreas) -> MemAreas {
+        let mut out = MemAreas::new();
+        let mut start = 0;
+        for r in regions.iter() {
+            let len = r.ptr - start;
+            if len > 0 {
+                out.insert(MemArea {
+                    ptr: start,
+                    len: r.ptr - start,
+                });
+            }
+            start = r.ptr + r.len;
+        }
+        if start < 4096 {
+            out.insert(MemArea {
+                ptr: start,
+                len: 4096 - start,
+            });
+        }
+        out
+    }
+
+    pub fn byte_slice_strat(size: u32, exclude: &MemAreas) -> BoxedStrategy<MemArea> {
+        let available: Vec<MemArea> = Self::invert(exclude)
+            .iter()
+            .flat_map(|a| a.inside(size))
+            .collect();
+
+        Just(available)
+            .prop_filter("available memory for allocation", |a| !a.is_empty())
+            .prop_flat_map(|a| prop::sample::select(a))
+            .boxed()
+    }
 }
 
 unsafe impl GuestMemory for HostMemory {
@@ -37,7 +112,7 @@ unsafe impl GuestMemory for HostMemory {
     }
 }
 
-#[derive(Debug)]
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
 pub struct MemArea {
     pub ptr: u32,
     pub len: u32,
@@ -48,7 +123,7 @@ impl MemArea {
     // test.
     // So, I implemented this one with std::ops::Range so it is less likely I wrote the same bug in two
     // places.
-    pub fn overlapping(&self, b: &Self) -> bool {
+    pub fn overlapping(&self, b: Self) -> bool {
         // a_range is all elems in A
         let a_range = std::ops::Range {
             start: self.ptr,
@@ -73,18 +148,33 @@ impl MemArea {
         }
         return false;
     }
-    pub fn non_overlapping_set(areas: &[&Self]) -> bool {
-        // A is all areas
-        for (i, a) in areas.iter().enumerate() {
-            // (A, B) is every pair of areas
-            for b in areas[i + 1..].iter() {
-                if a.overlapping(b) {
-                    return false;
+    pub fn non_overlapping_set<M>(areas: M) -> bool
+    where
+        M: Into<MemAreas>,
+    {
+        let areas = areas.into();
+        for (aix, a) in areas.iter().enumerate() {
+            for (bix, b) in areas.iter().enumerate() {
+                if aix != bix {
+                    // (A, B) is every pairing of areas
+                    if a.overlapping(*b) {
+                        return false;
+                    }
                 }
             }
         }
         return true;
     }
+
+    /// Enumerate all memareas of size `len` inside a given area
+    fn inside(&self, len: u32) -> impl Iterator<Item = MemArea> {
+        let end: i64 = self.len as i64 - len as i64;
+        let start = self.ptr;
+        (0..end).into_iter().map(move |v| MemArea {
+            ptr: start + v as u32,
+            len,
+        })
+    }
 }
 
 #[cfg(test)]
@@ -97,6 +187,104 @@ mod test {
         let h = Box::new(h);
         assert_eq!(h.base().0 as usize % 4096, 0);
     }
+
+    #[test]
+    fn invert() {
+        fn invert_equality(input: &[MemArea], expected: &[MemArea]) {
+            let input: MemAreas = input.into();
+            let inverted: Vec<MemArea> = HostMemory::invert(&input).into();
+            assert_eq!(expected, inverted.as_slice());
+        }
+
+        invert_equality(&[], &[MemArea { ptr: 0, len: 4096 }]);
+        invert_equality(
+            &[MemArea { ptr: 0, len: 1 }],
+            &[MemArea { ptr: 1, len: 4095 }],
+        );
+
+        invert_equality(
+            &[MemArea { ptr: 1, len: 1 }],
+            &[MemArea { ptr: 0, len: 1 }, MemArea { ptr: 2, len: 4094 }],
+        );
+
+        invert_equality(
+            &[MemArea { ptr: 1, len: 4095 }],
+            &[MemArea { ptr: 0, len: 1 }],
+        );
+
+        invert_equality(
+            &[MemArea { ptr: 0, len: 1 }, MemArea { ptr: 1, len: 4095 }],
+            &[],
+        );
+
+        invert_equality(
+            &[MemArea { ptr: 1, len: 2 }, MemArea { ptr: 4, len: 1 }],
+            &[
+                MemArea { ptr: 0, len: 1 },
+                MemArea { ptr: 3, len: 1 },
+                MemArea { ptr: 5, len: 4091 },
+            ],
+        );
+    }
+
+    fn set_of_slices_strat(
+        s1: u32,
+        s2: u32,
+        s3: u32,
+    ) -> BoxedStrategy<(MemArea, MemArea, MemArea)> {
+        HostMemory::byte_slice_strat(s1, &MemAreas::new())
+            .prop_flat_map(move |a1| {
+                (
+                    Just(a1),
+                    HostMemory::byte_slice_strat(s2, &MemAreas::from(&[a1])),
+                )
+            })
+            .prop_flat_map(move |(a1, a2)| {
+                (
+                    Just(a1),
+                    Just(a2),
+                    HostMemory::byte_slice_strat(s3, &MemAreas::from(&[a1, a2])),
+                )
+            })
+            .boxed()
+    }
+
+    #[test]
+    fn trivial_inside() {
+        let a = MemArea { ptr: 24, len: 4072 };
+        let interior = a.inside(24).collect::<Vec<_>>();
+
+        assert!(interior.len() > 0);
+    }
+
+    proptest! {
+        #[test]
+        // For some random region of decent size
+        fn inside(r in HostMemory::mem_area_strat(123)) {
+            let set_of_r = MemAreas::from(&[r]);
+            // All regions outside of r:
+            let exterior = HostMemory::invert(&set_of_r);
+            // All regions inside of r:
+            let interior = r.inside(22);
+            for i in interior {
+                // i overlaps with r:
+                assert!(r.overlapping(i));
+                // i is inside r:
+                assert!(i.ptr >= r.ptr);
+                assert!(r.ptr + r.len >= i.ptr + i.len);
+                // the set of exterior and i is non-overlapping
+                let mut all = exterior.clone();
+                all.insert(i);
+                assert!(MemArea::non_overlapping_set(all));
+            }
+        }
+
+        #[test]
+        fn byte_slices((s1, s2, s3) in set_of_slices_strat(12, 34, 56)) {
+            let all = MemAreas::from(&[s1, s2, s3]);
+            assert!(MemArea::non_overlapping_set(all));
+        }
+    }
 }
 
 use std::cell::RefCell;