Add kani proofs for IoVecBuffer types
#4108
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
IoVecBuffer(Mut) are wrappers on top of guest buffers that not necessarily contiguous in memory. The types provide methods for reading/writing from/to these memory buffers. Memory accesses to buffers provided by the guest is not safe (in terms of Rust safety). For example, we cannot create slices on top of the underlying addresses because we cannot guarantee that the guest will behave in the way Rust expects it to do. As a result, IoVecBuffer(Mut) describe the underlying memory using raw pointers and implement read/write methods on them using unsafe primitives. This commit adds proof-harnesses for these read/write methods. Signed-off-by: Babis Chalios <[email protected]>
We have a IoVecSubregion type for describing sub-regions inside an initial IoVecBuffer(Mut) type. This is useful type for de-duplicating the code that finds a valid sub-region so that we can do something with it later. However, the type was essentially duplicating (some of) the state of the initial IoVecBuffer(Mut). The memory overhead should not be significant, but the book-keeping overhead (creating yet another Vec) is noticeable. Moreover, the interface was leading us to have some nested loops. This was increasing significantly the time for kani harnesses. This commit drops the IoVecSubregion type and replaces the functionality with a simple loop that performs the necessary operation on a valid sub-range. Signed-off-by: Babis Chalios <[email protected]>
bchalios
added
the
Status: Awaiting review
Codecov ReportPatch coverage:
Additional details and impacted files@@ Coverage Diff @@
## main #4108 +/- ##
==========================================
- Coverage 82.35% 82.34% -0.02%
==========================================
Files 225 225
Lines 28469 28445 -24
==========================================
- Hits 23447 23424 -23
+ Misses 5022 5021 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
☔ View full report in Codecov by Sentry. |
roypat
approved these changes
Sep 13, 2023
wearyzen
reviewed
Sep 14, 2023
wearyzen
approved these changes
Sep 14, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Add kani proofs for
IoVecBuffer::read_at()andIoVecBuffer::write_at(). The proofs check that we do not perform out-of-bounds memory accesses to/from buffers provided by the guest.Reason
These methods play around with raw pointers and use
unsafeprimitives, so they're good candidate for Kani checking.License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following
Developer Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
CHANGELOG.md.TODOs link to an issue.rust-vmm.