Struct Token 

pub struct Token<T: Send + 'static> { /* private fields */ }

An owned value, plus the identity of the operation the kernel may still be reading or writing through it.

Usually T is an crate::IoBuf the operation reads or writes, but nothing about this type depends on that: M5’s buffer registration reuses the same forget-unless-claimed mechanism to track a registration’s own in-flight uses, where T carries no bytes at all (see RegisteredUse in batch.rs).

Token intentionally holds no reference back to the crate::IoRing that minted its identity: outstanding-operation accounting belongs to the ring (D-4 in DESIGN-NOTES.md), driven by whoever actually pops an IORING_CQE, not by a Token merely being dropped. A dropped, unclaimed Token means the caller has given up on this handle; it says nothing about whether the kernel has finished the operation, which is exactly why dropping it forgets the value instead of freeing it – see Token’s Drop impl.

Implementations

impl<T: Send + 'static> Token<T>

pub fn id(&self) -> usize

This token’s UserData identity.

pub fn claim_if(self, completion: &Completion) -> Result<T, Self>

Claim this token’s value if completion names it, or hand it back unchanged otherwise (D-4).

Takes a popped Completion, not a bare usize: Completion has no public constructor, so the only way to produce one is crate::IoRing::try_pop actually observing a real IORING_CQE. Accepting a caller-supplied integer here instead – for example token.claim_if(token.id()) – would let safe code reclaim (and then drop, freeing) a buffer the kernel might still be reading or writing, which is exactly the use-after-free this type exists to prevent. Unlike windows-overlapped-io-sys’s OperationId, there is no storage address to also check on its own – UserData is a value this crate chose – but two different rings each hand out UserData from their own counter starting at zero, so the same value can legitimately occur on both. Requiring completion’s ring identity to match this token’s own (PR #20 review response) is what rules that out: a token can only ever be claimed by a completion popped from the exact ring that minted it.

Trait Implementations

impl<T: Send + 'static> Debug for Token<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: Send + 'static> Drop for Token<T>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.