Struct DeviceMemRegistry 

pub struct DeviceMemRegistry { /* private fields */ }

Instance-scoped device-memory registry.

Implementations

impl DeviceMemRegistry

pub fn new() -> Self

Construct an empty registry.

Handles start at 1 so callers may reserve 0 as a sentinel; they are otherwise sequential. Cross-instance forgery is prevented by the owner-InstanceId check in Self::lookup / Self::free, so the handle space does not need the randomised-seed treatment the kernel registry uses for its ids.

pub fn with_budget(budget: Arc<DeviceMemBudget>) -> Self

Construct an empty registry charging the given process-wide DeviceMemBudget instead of the shared process_device_budget singleton.

Intended for tests that need an isolated aggregate so the process-wide caps can be exercised without the global singleton bleeding state across test cases (which run in the same process). Production code should use Self::new so every instance shares the one ceiling.

pub fn insert(&self, entry: DeviceMemEntry) -> Result<u64, AbiError>

Reserve aggregate-bytes budget for a new allocation, returning the freshly-assigned handle on success.

Enforces MAX_DEVICE_ALLOCS_PER_INSTANCE and MAX_TOTAL_DEVICE_BYTES (the per-instance caps) and the process-wide MAX_PROCESS_DEVICE_BYTES / MAX_PROCESS_DEVICE_ALLOCS caps via the shared DeviceMemBudget (all returning AbiError::QuotaExceeded) before inserting the entry. The per-call MAX_DEVICE_ALLOC_BYTES cap is the caller’s responsibility (the host function checks it before any driver call) — this method only enforces the aggregate caps so the check + add stays atomic against concurrent allocations.

The per-instance caps are checked first (defence in depth: a single runaway instance trips its own cap before it can charge the shared budget), then the process-wide budget. If the process budget refuses, the per-instance byte reservation is rolled back so the two counters never drift.

pub fn lookup( &self, handle: u64, owner: InstanceId, ) -> Result<DeviceMemHandle, AbiError>

Look up an allocation by handle, returning an independent handle copy.

Returns Err(AbiError::InvalidHandle) if the handle is unknown or belongs to a different instance.

pub fn free( &self, handle: u64, owner: InstanceId, ) -> Result<DeviceMemEntry, AbiError>

Remove an allocation owned by owner, returning its entry.

Returns Err(AbiError::InvalidHandle) when the handle is unknown or belongs to another instance — a guest cannot free a buffer it does not own. On success both the per-instance aggregate-bytes counter and the shared process-wide DeviceMemBudget are credited back.

pub fn len(&self) -> usize

Number of currently-live allocations.

pub fn is_empty(&self) -> bool

True if there are no live allocations.

pub fn total_device_bytes(&self) -> u64

Aggregate device bytes currently retained. Visible for metrics and tests.

pub fn budget(&self) -> &Arc<DeviceMemBudget>

Borrow the process-wide DeviceMemBudget this registry charges. Visible for metrics and tests.

Trait Implementations

impl Default for DeviceMemRegistry

fn default() -> Self

Returns the “default value” for a type.