ic_storage/runtime/
mod.rs

1//! Named allocation admission and exclusive leases over the owned directory.
2mod admission;
3mod custody;
4mod directory_model;
5
6use crate::{Memory, StableKey};
7pub use admission::{
8    AdmissionError, AllocationGrants, BootstrapAdmission, GenericAllocationPolicy, MemoryAuthority,
9    MemoryRequest, PolicyIdentity, RuntimeBootstrapPolicy, SealedDeclarationSnapshot,
10};
11pub use custody::{BackingIdentity, MemoryBacking};
12pub use directory_model::Error as DirectoryError;
13use directory_model::leases::{Lease, Owner};
14pub use directory_model::{AllocationId, StorageConfig};
15use std::collections::BTreeSet;
16
17/// Construction refuses aliased or malformed backing without resetting it.
18#[derive(Debug, thiserror::Error)]
19pub enum RuntimeConstructionError {
20    /// Another runtime or detached lease retains custody.
21    #[error("backing already claimed")]
22    BackingAlreadyClaimed,
23    /// The current owned directory could not be loaded or initialized.
24    #[error(transparent)]
25    Directory(#[from] DirectoryError),
26}
27
28/// Allocation growth failures before authority publication.
29#[derive(Clone, Copy, Debug, Eq, PartialEq, thiserror::Error)]
30pub enum RuntimeGrowError {
31    /// Requested page arithmetic overflowed.
32    #[error("allocation page count overflow")]
33    ArithmeticOverflow,
34    /// The configured allocation or directory resource budget was exceeded.
35    #[error("allocation capacity exceeded")]
36    CapacityExceeded,
37    /// Physical backing capacity was refused.
38    #[error("backing refused growth by {additional_pages} pages")]
39    BackingRefused { additional_pages: u64 },
40    /// A previous backing failure poisoned this owner.
41    #[error("allocation owner is poisoned")]
42    Poisoned,
43    /// Directory validation failed at a checked boundary.
44    #[error("allocation directory validation failed")]
45    InvalidDirectory,
46}
47
48/// A key cannot be opened until current host admission succeeds.
49#[derive(Debug, thiserror::Error)]
50pub enum RuntimeOpenError {
51    /// Bootstrap has not committed current authority.
52    #[error("runtime is not bootstrapped")]
53    NotBootstrapped,
54    /// The key is absent from the current admitted declarations.
55    #[error("key is not admitted: {0}")]
56    NotAdmitted(StableKey),
57    /// An exclusive lease for this allocation is already alive.
58    #[error("allocation {id} already open")]
59    AlreadyOpen { id: u64 },
60    /// The directory refused opening.
61    #[error(transparent)]
62    Directory(#[from] DirectoryError),
63}
64
65/// Bootstrap failed before current authority could be published.
66#[derive(Debug, thiserror::Error)]
67pub enum RuntimeBootstrapError<E> {
68    /// Host declarations or namespace grants were invalid.
69    #[error(transparent)]
70    Admission(#[from] AdmissionError),
71    /// The host's policy rejected the preparation or an allocation.
72    #[error("host policy rejected allocation")]
73    Policy(E),
74    /// Current bootstrap inputs differ from the established binding.
75    #[error("bootstrap binding mismatch")]
76    BindingMismatch,
77    /// A shared verification cannot bootstrap an uninitialized owner.
78    #[error("runtime is not bootstrapped")]
79    NotBootstrapped,
80    /// Durable directory commitment failed.
81    #[error(transparent)]
82    Directory(#[from] DirectoryError),
83}
84
85struct Binding {
86    source: SealedDeclarationSnapshot,
87    grants: AllocationGrants,
88    policy: PolicyIdentity,
89    admitted: BTreeSet<StableKey>,
90}
91
92///
93/// `MemoryRuntime`
94///
95/// One custodian of named allocations on a backing. Bootstrap validates namespace
96/// grants and host policy, commits bindings, then permits exclusive leases.
97/// Omitted retained names keep their allocation, but require current admission
98/// before opening. IDs are opaque u64 values, never selected by applications.
99///
100pub struct MemoryRuntime<M: Memory> {
101    owner: Owner<M>,
102    config: StorageConfig,
103    binding: Option<Binding>,
104}
105
106impl<M: Memory> MemoryRuntime<M> {
107    /// Claim backing and create or read its owned directory. Never reset nonempty backing.
108    ///
109    /// # Errors
110    /// Rejects duplicate backing custody or invalid/non-admissible retained directory data.
111    pub fn new(memory: M) -> Result<Self, RuntimeConstructionError>
112    where
113        M: MemoryBacking,
114    {
115        Self::new_with_config(memory, StorageConfig::default())
116    }
117    /// Use explicit directory resource limits; reopening revalidates under those limits.
118    ///
119    /// # Errors
120    /// Rejects duplicate backing custody, invalid configuration, or invalid/non-admissible retained directory data.
121    pub fn new_with_config(
122        memory: M,
123        config: StorageConfig,
124    ) -> Result<Self, RuntimeConstructionError>
125    where
126        M: MemoryBacking,
127    {
128        let owner = Owner::init(memory, config).map_err(|error| match error {
129            DirectoryError::AlreadyClaimed => RuntimeConstructionError::BackingAlreadyClaimed,
130            error => RuntimeConstructionError::Directory(error),
131        })?;
132        Ok(Self {
133            owner,
134            config,
135            binding: None,
136        })
137    }
138    /// Whether current host authority has been committed.
139    #[must_use]
140    pub const fn is_bootstrapped(&self) -> bool {
141        self.binding.is_some()
142    }
143    /// Current durable directory generation, after bootstrap admission.
144    ///
145    /// # Errors
146    /// Returns `NotBootstrapped` until bootstrap establishes a binding.
147    pub fn committed_generation(&self) -> Result<u64, RuntimeOpenError> {
148        if self.binding.is_none() {
149            return Err(RuntimeOpenError::NotBootstrapped);
150        }
151        Ok(self.owner.generation())
152    }
153    /// Effective resource admission limits.
154    #[must_use]
155    pub const fn config(&self) -> StorageConfig {
156        self.config
157    }
158    /// Admit a complete declaration set, retaining omitted historical bindings.
159    ///
160    /// # Errors
161    /// Rejects invalid grants or declarations, host-policy refusal, conflicting bindings, and directory validation or commitment failures.
162    pub fn bootstrap<P: RuntimeBootstrapPolicy>(
163        &mut self,
164        source: &SealedDeclarationSnapshot,
165        grants: &AllocationGrants,
166        policy: &P,
167    ) -> Result<u64, RuntimeBootstrapError<P::Error>> {
168        if self.binding.is_some() {
169            return self.verify_bootstrap(source, grants, policy);
170        }
171        self.owner.verify()?;
172        let policy_identity = policy.runtime_bootstrap_identity();
173        let bindings = self.owner.bindings();
174        let mut admission =
175            BootstrapAdmission::new(source, grants, &bindings, self.config.allocations)?;
176        let result = policy.prepare_bootstrap(&mut admission);
177        let requests = admission.complete()?;
178        result.map_err(RuntimeBootstrapError::Policy)?;
179        for request in &requests {
180            policy
181                .validate_allocation(request.stable_key())
182                .map_err(RuntimeBootstrapError::Policy)?;
183        }
184        let admitted: BTreeSet<_> = requests
185            .into_iter()
186            .map(|request| request.stable_key().clone())
187            .collect();
188        self.owner.bind(admitted.iter().cloned().collect())?;
189        self.binding = Some(Binding {
190            source: source.clone(),
191            grants: grants.clone(),
192            policy: policy_identity,
193            admitted,
194        });
195        Ok(self.owner.generation())
196    }
197    /// Compare the complete established binding without IO or policy callbacks.
198    ///
199    /// # Errors
200    /// Returns `NotBootstrapped` or `BindingMismatch` when the supplied composition differs from the established binding.
201    pub fn verify_bootstrap<P: RuntimeBootstrapPolicy>(
202        &self,
203        source: &SealedDeclarationSnapshot,
204        grants: &AllocationGrants,
205        policy: &P,
206    ) -> Result<u64, RuntimeBootstrapError<P::Error>> {
207        let binding = self
208            .binding
209            .as_ref()
210            .ok_or(RuntimeBootstrapError::NotBootstrapped)?;
211        if binding.source != *source
212            || binding.grants != *grants
213            || binding.policy != policy.runtime_bootstrap_identity()
214        {
215            return Err(RuntimeBootstrapError::BindingMismatch);
216        }
217        Ok(self.owner.generation())
218    }
219    /// Open one currently admitted name, preserving custody through detached handles.
220    ///
221    /// # Panics
222    /// Propagates backing failures or a broken internal binding invariant.
223    ///
224    /// # Errors
225    /// Rejects unbootstrapped or unadmitted access, an existing lease, and invalid directory state.
226    pub fn open_memory(&self, key: &StableKey) -> Result<RuntimeMemory<M>, RuntimeOpenError> {
227        let binding = self
228            .binding
229            .as_ref()
230            .ok_or(RuntimeOpenError::NotBootstrapped)?;
231        if !binding.admitted.contains(key) {
232            return Err(RuntimeOpenError::NotAdmitted(key.clone()));
233        }
234        let lease = self.owner.lease(key).map_err(|error| match error {
235            DirectoryError::AlreadyOpen => RuntimeOpenError::AlreadyOpen {
236                id: self.allocation_id(key).unwrap().get(),
237            },
238            error => RuntimeOpenError::Directory(error),
239        })?;
240        Ok(RuntimeMemory { lease })
241    }
242    /// Verify component requirements against current host admission without IO.
243    ///
244    /// # Errors
245    /// Rejects unbootstrapped access or requirements not admitted under the requested authority.
246    pub fn verify_authority(
247        &self,
248        requirements: &SealedDeclarationSnapshot,
249        authority: &str,
250    ) -> Result<(), RuntimeOpenError> {
251        let binding = self
252            .binding
253            .as_ref()
254            .ok_or(RuntimeOpenError::NotBootstrapped)?;
255        for request in requirements.requests() {
256            if request.authority() != authority
257                || !binding.admitted.contains(request.stable_key())
258                || binding.grants.check(request).is_err()
259            {
260                return Err(RuntimeOpenError::NotAdmitted(request.stable_key().clone()));
261            }
262        }
263        Ok(())
264    }
265    /// Resolve a retained identity for diagnostics; this grants no access.
266    #[must_use]
267    pub fn allocation_id(&self, key: &StableKey) -> Option<AllocationId> {
268        self.owner.allocation_id(key)
269    }
270    /// Observe checked directory entries and actual logical extents.
271    ///
272    /// # Errors
273    /// Returns a directory error when ownership is poisoned or the retained directory fails validation.
274    pub fn memory_allocations(&self) -> Result<Vec<MemoryAllocation>, DirectoryError> {
275        self.owner.verify()?;
276        Ok(self
277            .owner
278            .bindings()
279            .into_iter()
280            .map(|(stable_key, id, pages)| MemoryAllocation {
281                stable_key,
282                id,
283                pages,
284            })
285            .collect())
286    }
287
288    /// Validate the current directory and report physical capacity and custody.
289    /// Available before bootstrap; collecting diagnostics never admits or opens a key.
290    /// Page totals describe reserved capacity, not application payload occupancy.
291    ///
292    /// # Errors
293    /// Rejects a poisoned owner or backing that no longer matches its directory.
294    pub fn diagnostics(&self) -> Result<StorageDiagnostics, DirectoryError> {
295        let mut report = self.owner.diagnostics()?;
296        report.admitted_allocations = self.binding.as_ref().map_or(0, |b| b.admitted.len());
297        Ok(report)
298    }
299}
300
301///
302/// `StorageDiagnostics`
303///
304/// Read-only totals from the validated current directory and physical backing.
305/// The protected root occupies one additional page: data, metadata, unassigned
306/// and root pages sum to physical pages. Unassigned pages are not reclaimable
307/// through this API. Diagnostics grant no allocation authority.
308///
309
310#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Serialize)]
311pub struct StorageDiagnostics {
312    /// Committed directory generation.
313    pub generation: u64,
314    /// Retained named allocations, including currently omitted names.
315    pub allocations: usize,
316    /// Names admitted by this runtime's bootstrap, or zero before bootstrap.
317    pub admitted_allocations: usize,
318    /// Currently live exclusive allocation leases.
319    pub live_leases: usize,
320    /// Total application data extents.
321    pub extents: usize,
322    /// Logical data capacity across retained allocations, in 64 KiB pages.
323    pub data_pages: u64,
324    /// Reserved active and inactive directory arenas, in 64 KiB pages.
325    pub metadata_pages: u64,
326    /// Encoded byte length of the active directory snapshot.
327    pub directory_bytes: u64,
328    /// Actual physical backing extent, in 64 KiB pages.
329    pub physical_pages: u64,
330    /// Physical pages outside data, metadata arenas and the protected root.
331    pub unassigned_pages: u64,
332}
333
334///
335/// `MemoryAllocation`
336///
337/// Passive diagnostic entry; no lease or allocation authority is carried.
338///
339#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize)]
340pub struct MemoryAllocation {
341    /// Durable name.
342    pub stable_key: StableKey,
343    /// Opaque identity.
344    pub id: AllocationId,
345    /// Logical extent in Wasm pages.
346    pub pages: u64,
347}
348
349///
350/// `RuntimeMemory`
351///
352/// Exclusive non-cloneable allocation lease. IO trusts custody between checked
353/// boundaries; growth commits the directory before publishing its new extent.
354/// A detached lease retains the backing claim until it is dropped.
355///
356pub struct RuntimeMemory<M: Memory> {
357    lease: Lease<M>,
358}
359impl<M: Memory> RuntimeMemory<M> {
360    #[cfg(not(target_arch = "wasm32"))]
361    pub(crate) fn poison_on_unwind(&self) -> directory_model::leases::PanicGuard<M> {
362        self.lease.poison_on_unwind()
363    }
364    /// Logical page extent.
365    #[must_use]
366    pub fn size(&self) -> u64 {
367        self.lease.size()
368    }
369    /// Reserve additional zero-filled logical pages without exposing backing.
370    ///
371    /// # Errors
372    /// Rejects arithmetic overflow, resource limits, backing refusal, poisoned ownership, or invalid directory state.
373    pub fn grow(&self, pages: u64) -> Result<u64, RuntimeGrowError> {
374        self.lease.try_grow(pages).map_err(|error| match error {
375            DirectoryError::ArithmeticOverflow => RuntimeGrowError::ArithmeticOverflow,
376            DirectoryError::Growth => RuntimeGrowError::BackingRefused {
377                additional_pages: pages,
378            },
379            DirectoryError::Budget | DirectoryError::Wire(_) => RuntimeGrowError::CapacityExceeded,
380            DirectoryError::Poisoned => RuntimeGrowError::Poisoned,
381            _ => RuntimeGrowError::InvalidDirectory,
382        })
383    }
384    /// Read a completely bounds-checked logical range.
385    pub fn read(&self, offset: u64, bytes: &mut [u8]) {
386        self.lease.read(offset, bytes);
387    }
388    /// Write a completely bounds-checked logical range.
389    pub fn write(&self, offset: u64, bytes: &[u8]) {
390        self.lease.write(offset, bytes);
391    }
392}
393impl<M: Memory> Memory for RuntimeMemory<M> {
394    fn size(&self) -> u64 {
395        self.size()
396    }
397    fn grow(&self, pages: u64) -> i64 {
398        self.grow(pages)
399            .map_or(-1, |previous| i64::try_from(previous).expect("page count"))
400    }
401    fn read(&self, offset: u64, bytes: &mut [u8]) {
402        self.read(offset, bytes);
403    }
404    #[expect(
405        unsafe_code,
406        reason = "Forward the raw-read contract through the governed lease"
407    )]
408    unsafe fn read_unsafe(&self, offset: u64, dst: *mut u8, count: usize) {
409        // SAFETY: forwarding preserves the caller's exclusive destination.
410        unsafe { self.lease.read_unsafe(offset, dst, count) }
411    }
412    fn write(&self, offset: u64, bytes: &[u8]) {
413        self.write(offset, bytes);
414    }
415}
ic_storage/runtime/mod.rs

ic_storage/runtime/
mod.rs
