hibana 0.9.6

Choreography-derived runtime enforcement kernel for no_std Rust multiparty protocols
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167

use super::{
    AssocTable, Cell, Lane, LaneRelease, PhantomData, Rendezvous, RendezvousAccessState,
    RendezvousId, RuntimeResources, SessionId, Sidecar, TapRing, Transport, UnsafeCell, emit,
    events,
};
use crate::observe::{core::TAP_EVENTS, event::TapRecord};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct ResidentCarveLayout {
    header_start: usize,
    tap_start: usize,
    runtime_start: usize,
}

impl<'rv, 'cfg, T: Transport> Rendezvous<'rv, 'cfg, T>
where
    'cfg: 'rv,
{
    fn resident_carve_layout(slab: &[u8]) -> Option<ResidentCarveLayout> {
        let base = slab.as_ptr() as usize;
        let len = slab.len();
        let header_offset =
            crate::runtime_core::layout::checked_align_up(base, core::mem::align_of::<Self>())?;
        let header_end = header_offset.checked_add(core::mem::size_of::<Self>())?;
        let tap_offset = crate::runtime_core::layout::checked_align_up(
            header_end,
            core::mem::align_of::<TapRecord>(),
        )?;
        let tap_end = tap_offset.checked_add(core::mem::size_of::<[TapRecord; TAP_EVENTS]>())?;
        let header_start = header_offset.checked_sub(base)?;
        let tap_start = tap_offset.checked_sub(base)?;
        let runtime_start = tap_end.checked_sub(base)?;
        if runtime_start > len {
            return None;
        }
        Some(ResidentCarveLayout {
            header_start,
            tap_start,
            runtime_start,
        })
    }

    unsafe fn carve_resident_storage(
        slab: &mut [u8],
    ) -> Option<(*mut Self, &mut [TapRecord; TAP_EVENTS], &mut [u8])> {
        let layout = Self::resident_carve_layout(slab)?;
        let slab_len = slab.len();
        let slab_ptr = slab.as_mut_ptr();
        let header_ptr = /* SAFETY: `resident_carve_layout` proved the
        unpublished header range is inside `slab` and aligned for `Rendezvous`. */ unsafe {
            slab_ptr.add(layout.header_start).cast::<Self>()
        };
        let tap_ptr = /* SAFETY: `resident_carve_layout` proved `tap_start` is
        inside `slab` and aligned for `TapRecord`; `TAP_EVENTS` initialized
        cells fit before the runtime slice. */ unsafe {
            slab_ptr.add(layout.tap_start).cast::<TapRecord>()
        };
        let mut idx = 0usize;
        while idx < TAP_EVENTS {
            /* SAFETY: tap storage is carved from the caller slab with TapRecord alignment and initialized exactly once. */
            unsafe {
                tap_ptr.add(idx).write(TapRecord::zero());
            }
            idx += 1;
        }
        let tap_storage = /* SAFETY: tap storage was carved at TapRecord alignment and initialized for exactly TAP_EVENTS elements. */ unsafe {
            &mut *(tap_ptr.cast::<[TapRecord; TAP_EVENTS]>())
        };
        let runtime_ptr = /* SAFETY: `runtime_start <= slab.len()` was checked
        by `resident_carve_layout`, so this points at the runtime suffix. */ unsafe { slab_ptr.add(layout.runtime_start) };
        let runtime_len = slab_len - layout.runtime_start;
        let runtime_slab = /* SAFETY: `runtime_ptr` and `runtime_len` describe
        the suffix of the same caller slab after the rendezvous header and tap
        ring; it is disjoint from both initialized prefixes. */ unsafe { core::slice::from_raw_parts_mut(runtime_ptr, runtime_len) };
        Some((header_ptr, tap_storage, runtime_slab))
    }

    /// Materialize a rendezvous directly into the borrowed slab prefix using a
    /// public-path endpoint capacity derived from the runtime slab owner.
    ///
    /// # Safety
    /// The returned pointer is valid for as long as the borrowed slab storage lives.
    pub(crate) unsafe fn init_in_slab_auto(
        rv_id: RendezvousId,
        resources: RuntimeResources<'cfg>,
        transport: T,
    ) -> Option<*mut Self> {
        let RuntimeResources { slab } = resources;
        let lane_range = RuntimeResources::initial_lane_range();
        let (dst, tap_storage, runtime_slab) = /* SAFETY: `slab` is the
        exclusive runtime resource for this rendezvous; carving initializes the
        tap ring and returns disjoint header/runtime regions. */ unsafe { Self::carve_resident_storage(slab) }?;
        let runtime_slab_len = runtime_slab.len();
        let runtime_slab_ptr = runtime_slab.as_mut_ptr();
        let image_frontier = 0u32;
        /* SAFETY: `dst` is the unpublished rendezvous header carved from the
        caller slab. All resident fields, tables, lane range, and transport
        owners are written before the pointer is returned to the session kit. */
        unsafe {
            core::ptr::addr_of_mut!((*dst).brand_marker).write(PhantomData);
            core::ptr::addr_of_mut!((*dst).id).write(rv_id);
            core::ptr::addr_of_mut!((*dst).access_state)
                .write(Cell::new(RendezvousAccessState::Available));
            core::ptr::addr_of_mut!((*dst).registry_next).write(Cell::new(None));
            core::ptr::addr_of_mut!((*dst).resolver_bucket).write(UnsafeCell::new(
                crate::session::cluster::core::ResolverBucket::empty(),
            ));
            core::ptr::addr_of_mut!((*dst).tap).write(TapRing::from_storage(tap_storage));
            core::ptr::addr_of_mut!((*dst).slab_ptr).write(runtime_slab_ptr);
            core::ptr::addr_of_mut!((*dst).slab_len).write(runtime_slab_len);
            core::ptr::addr_of_mut!((*dst).slab_marker).write(PhantomData);
            core::ptr::addr_of_mut!((*dst).image_frontier).write(Cell::new(image_frontier));
            core::ptr::addr_of_mut!((*dst).frontier_workspace_bytes).write(Cell::new(0));
            core::ptr::addr_of_mut!((*dst).endpoint_lease_generation).write(Cell::new(0));
            core::ptr::addr_of_mut!((*dst).endpoint_lease_storage).write(Cell::new(Sidecar::EMPTY));
            core::ptr::addr_of_mut!((*dst).lane_base).write(Cell::new(lane_range.start as u32));
            core::ptr::addr_of_mut!((*dst).lane_end).write(Cell::new(lane_range.end as u32));
            core::ptr::addr_of_mut!((*dst).transport).write(transport);
            core::ptr::addr_of_mut!((*dst).assoc_storage).write(Cell::new(Sidecar::EMPTY));
            AssocTable::init_empty(core::ptr::addr_of_mut!((*dst).assoc));
        }
        Some(dst)
    }
}

impl<'rv, 'cfg, T: Transport> Rendezvous<'rv, 'cfg, T>
where
    'cfg: 'rv,
{
    pub(crate) fn session_fault(
        &self,
        sid: SessionId,
    ) -> Option<crate::rendezvous::SessionFaultKind> {
        self.assoc.session_fault(sid)
    }

    #[inline]
    pub(crate) fn poison_session(
        &self,
        sid: SessionId,
        source_role: u8,
        cause: crate::rendezvous::SessionFaultKind,
    ) -> crate::rendezvous::SessionFaultKind {
        let kind = self.assoc.poison_session(sid, cause);
        self.wake_session_endpoint_waiters(sid, source_role);
        kind
    }

    pub(crate) fn release_lane(&self, sid: SessionId, lane: Lane) -> LaneRelease {
        let remaining = self.assoc.decrement(lane, sid);
        if remaining > 0 {
            return LaneRelease::StillHeld;
        }
        LaneRelease::Released
    }

    #[inline]
    pub(crate) fn emit_lane_release(&self, sid: SessionId, lane: Lane) {
        emit(
            self.tap(),
            events::lane_release(self.id.raw() as u32, sid.raw(), lane.as_wire() as u16),
        );
    }
}

#[cfg(all(test, hibana_repo_tests))]
mod tests;