Implementation of streaming process slice

[Ioan-Cristian]

The new Ethernet TAP driver uses streaming process slices. I have a minimal implementation here. However, I was unable to use the standard libtock-rs system calls (TockSyscalls), so raw system calls are used instead. My use case is libtock-rs + smoltcp.

Handle<AllowRw<...>> forces the code to allow than disallow the buffer when the handle goes out of scope. Furthermore, depending on the configuration, it even checks whether the pointer and the length returned by the disallow are null, which is not true in the case of the streaming process slice, which constantly swaps between two buffers. I have tried a theoretical implementation of the streaming process slice with two Handle<Allow<...>>, but the code became quickly too contrived. I decided to give up, since that implementation is anyway inefficient.

Is my understanding of the libtock-rs too poor? Can streaming process slices be implemented efficiently using TockSyscalls, and thus avoid unsafe code?

[alexandruradovici]

Can you detail the issue that is preventing you from using the system calls?

[Ioan-Cristian]

1. Trying to create a structure that owns two buffers that need to be shared alternatively.
2. Syscalls::allow_rw() requires a Handle<'_, AllowRw<'_, Syscalls, DRIVER_NUMBER, ALLOW_NUMBER>>

[1], [2] ==> the structure needs to own a handle.

This code does this. The compiler emits the following error:

error[E0521]: borrowed data escapes outside of closure
  --> examples/blabla.rs:41:27
   |
40 |     >(|handle| {
   |        ------
   |        |
   |        `handle` declared here, outside of the closure body
   |        `handle` is a reference that is only valid in the closure body
41 |         let (allow_rw,) = handle.split();
   |                           ^^^^^^^^^^^^^^ `handle` escapes the closure body here
   |
   = note: requirement occurs because of the type `AllowRw<'_, TockSyscalls, 1, 1>`, which makes the generic argument `'_` invariant
   = note: the struct `AllowRw<'share, S, DRIVER_NUM, BUFFER_NUM>` is invariant over the parameter `'share`
   = help: see <https://doc.rust-lang.org/nomicon/subtyping.html> for more information about variance

You might propose the following solution. The problem is that the buffer is unallowed at the end of do_stuff, but in the case of streaming data, it needs to stay allowed.

You might suggest the following improvement. The problem is that do_stuff() waits until the buffer is filled, making Blabla::do_stuff() synchronous. I want do_stuff() just to allow the buffer and keep it allowed until a further call to another Blabla method.

Again, you might suggest something as this. This code does compile, but what if Blabla needs two buffers to be shared alternatively? Couldn't make an working example.

Furthermore, the design of Syscalls::allow_rw() assumes no "reentrant" calls, that is, the same allow slot (same driver number and same allow number), is not used twice without an interleaving Syscalls::disallow_rw(). For the streaming process slice, that is a problem, since the core idea is to use the read-write allow to allow a buffer while regaining access to the previous one in the same system call. You might say: "Issue a disallow_rw(), then allow_rw()", but that means two system calls instead of one. Even if you say "Tock ecosystem is not focused on performance, but rather on security and safety", I couldn't code any example as stated in the previous paragraph.

Am I missing something? Is my understanding of the libtock-rs API poor?

[jrvanwhy]

Our Allow APIs definitely need "swap" functionality in addition to their "allow" and "unallow" functions.

It's not immediately clear to me whether adding swap to the existing share API would solve your problem, or if this would require a Pin-based Allow API.