hibana 0.9.6

Choreography-derived runtime enforcement kernel for no_std Rust multiparty protocols
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

use core::{cell::Cell, ptr::NonNull};

#[repr(u8)]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum RecvFrameReceiptPhase {
    Idle,
    Outstanding,
}

pub(in crate::rendezvous) struct RecvFrameReceiptState {
    phase: Cell<RecvFrameReceiptPhase>,
}

#[derive(Clone, Copy)]
struct RecvFrameReceiptOwner {
    port_key: NonNull<()>,
    state: NonNull<RecvFrameReceiptState>,
}

pub(in crate::rendezvous) struct PortRecvFrameReceipt {
    owner: Option<RecvFrameReceiptOwner>,
}

impl RecvFrameReceiptState {
    #[inline]
    pub(in crate::rendezvous) const fn new() -> Self {
        Self {
            phase: Cell::new(RecvFrameReceiptPhase::Idle),
        }
    }

    #[inline]
    pub(in crate::rendezvous) fn issue(&self, port_key: NonNull<()>) -> PortRecvFrameReceipt {
        if self.phase.replace(RecvFrameReceiptPhase::Outstanding) != RecvFrameReceiptPhase::Idle {
            crate::invariant();
        }
        PortRecvFrameReceipt {
            owner: Some(RecvFrameReceiptOwner {
                port_key,
                state: NonNull::from(self),
            }),
        }
    }

    #[inline]
    fn resolve(&self) {
        if self.phase.replace(RecvFrameReceiptPhase::Idle) != RecvFrameReceiptPhase::Outstanding {
            crate::invariant();
        }
    }

    #[inline]
    fn assert_current(&self) {
        if self.phase.get() != RecvFrameReceiptPhase::Outstanding {
            crate::invariant();
        }
    }

    #[inline]
    pub(in crate::rendezvous) fn has_outstanding(&self) -> bool {
        self.phase.get() == RecvFrameReceiptPhase::Outstanding
    }
}

impl PortRecvFrameReceipt {
    #[inline]
    pub(in crate::rendezvous) const fn is_current(&self) -> bool {
        self.owner.is_some()
    }

    #[inline]
    pub(in crate::rendezvous) fn resolve(&mut self) {
        let owner = match self.owner.take() {
            Some(owner) => owner,
            None => crate::invariant(),
        };
        // SAFETY: receipt construction stores a non-null pointer to the
        // port-local state. Taking the owner makes resolution one-shot.
        unsafe { owner.state.as_ref() }.resolve();
    }

    #[inline]
    pub(in crate::rendezvous) fn assert_matches(
        &self,
        port_key: NonNull<()>,
        receipt_state: NonNull<RecvFrameReceiptState>,
    ) {
        let owner = match self.owner {
            Some(owner) => owner,
            None => crate::invariant(),
        };
        if owner.port_key != port_key {
            crate::invariant();
        }
        if owner.state != receipt_state {
            crate::invariant();
        }
        // SAFETY: the receipt stores a pointer to this port's receipt state.
        // `assert_matches` has just proven both the port identity and the
        // state pointer identity before reading the state.
        unsafe { owner.state.as_ref() }.assert_current();
    }
}

#[cfg(kani)]
mod kani;

#[cfg(all(test, hibana_repo_tests))]
mod tests;