rustfs_uring/lib.rs
1// Copyright 2024 RustFS Team
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#![deny(missing_docs)]
16#![deny(rustdoc::broken_intra_doc_links)]
17
18//! Cancel-safe async io_uring read backend for RustFS
19//! (rustfs/backlog#894, hardened per the #1048/#1051 audit).
20//!
21//! This crate proves and enforces the ownership model any production io_uring
22//! integration in RustFS must follow:
23//!
24//! - The read buffer and the file handle are owned by the driver's pending
25//! (orphan) table from SQE submission until the CQE arrives. The kernel may
26//! write into the buffer at any point in that window, so nothing else is
27//! allowed to free or move its heap allocation.
28//! - Dropping the caller-side future only abandons the *result*. It never
29//! touches the buffer. Optionally it submits `IORING_OP_ASYNC_CANCEL` to
30//! accelerate the CQE; reclamation still happens only at the CQE.
31//! - Driver shutdown cancels all in-flight ops and drains the ring to
32//! `in_flight == 0` (with a bounded escape hatch) before the ring is
33//! unmapped.
34//!
35//! Status: read path only, Linux only. The driver supports positioned buffered
36//! reads, `O_DIRECT` reads with internal alignment, stream (`read(2)`) reads,
37//! sharded rings, async backpressure, eventfd-driven reaping, graceful
38//! restricted-environment detection, and bounded shutdown drain. The write path
39//! is intentionally out of scope. See the crate README and the per-item docs
40//! below for the invariant details.
41//!
42//! On Linux, call `UringDriver::probe_and_start` (or the sharded variant)
43//! before issuing reads. A probe failure is returned to the caller so a storage
44//! layer can select its blocking/std backend. Once started, reads are submitted
45//! eagerly while capacity is available; when all permits are occupied, the
46//! returned `ReadHandle` waits asynchronously for capacity on its first poll.
47
48#[cfg(target_os = "linux")]
49mod driver;
50
51#[cfg(target_os = "linux")]
52pub use driver::{ProbeFailure, ReadHandle, StatsSnapshot, UringDriver};