You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Replace per-page RDMA sessions with persistent authenticated links and direct ODP-backed sends, using HTTP when a link cannot serve a request. Remove the staged RDMA path, obsolete verbs APIs, and unused protocol code, and require the current native adapter ABI. Reuse aligned ciphertext for memory caching and vectored disk writes, add pressure-aware buffer reclamation, update the XAES implementation without changing its wire format, and fix load-generator drain contention. Keep public documentation changes limited to removing incorrect statements and align the design documents with the implemented protocol and ownership rules.
Prevent duplicate waker registrations on exhausted pools
cmd/racer-dataplane/verbs/src/pool.rs:193
Every poll against an exhausted pool appends another waker, including repeated polls from the same task. Until a buffer returns, the vector grows with poll attempts, and returning a buffer invokes every duplicate. Links::stage also registers a noop waker before immediately falling back (src/rdma/links.rs:626-635), so production fallback attempts accumulate entries without actually waiting. Deduplicate registrations with will_wake, provide a non-registering staging attempt for that caller, and update the reentrancy test to verify safe waking without requiring duplicate notifications.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Unresolved correctness issues and hardware-sensitive memory lifetimes require corrective work and final human review.
No open issues 🎉
3 previously missed issues
In code that hasn't changed since last review
Drive crypto work cooperatively during native owner drain
cmd/racer-dataplane/src/app/native.rs:98
[P1] Keep crypto progressing while draining the native owner. This composition uses WithNative::drain and fence, which await native drainage before driving the inner service (verbs/src/lib.rs:301-318). The new owner cannot drain until every pool buffer is returned (verbs/src/node.rs:1053-1054). A queued Stage or registered-page decrypt job on this same crypto engine can still own such a buffer, but only the engine's polling/drain processes that job (security.rs:690-711). If teardown reaches this state, native drainage and the queued crypto work wait on each other; the I/O completion fence cannot finish either. Drive native teardown and crypto work cooperatively in both drain and fence, and test shutdown with queued buffer-owning jobs.
Honor peer grant limits when issuing outgoing grants
cmd/racer-dataplane/src/rdma/link_setup.rs:89
[P2] Honor the peer's advertised grant limit. Links::connect and Links::accept discard this decoded field when constructing the verbs setup (rdma/links.rs:449-452,524-527). Local grant admission uses the local limit, while incoming grants exceeding the peer's local limit break the link (verbs/src/link.rs:548-550,961-964). For example, a receiver configured for four grants can break a sender configured for two by issuing a third outstanding grant. Propagate the peer limit and constrain outgoing grants, or negotiate the minimum; test unequal configurations.
Use completion admission for registered-page copy-out
cmd/racer-dataplane/src/store.rs:650
[P2] Use completion admission for this copy-out. retainable reserves ordinary ciphertext admission, which fails after admission stops even when this fill already holds an accepted dirty charge and quota remains. This defeats the drain behavior tested in store/tests.rs:3006-3023; read/fill.rs:1950-1961 ignores the enqueue error, so the page is not persisted. Reserve the registered-page copy with reserve_completion, as disk staging does, and add a drain test using registered ciphertext.
Cancelled ambiguous writes leak tags and exhaust the waiting table
cmd/racer-dataplane/src/rdma/links.rs:614
Cancellation can arrive after the owner completes the write but before this worker polls its result. NativeRetry::wait checks the scope first (src/rdma/retry.rs:80-83), so send_native receives an error and releases an already-consumed tag (src/peer/transport.rs:330-332). That creates a Waiting::Release with no future grant and no expiry (verbs/src/link.rs:701-724,1056-1060). Repeated cancellations can fill the waiting table on an active link and reject later writes with Overloaded. Break the matching link epoch when cancellation or a deadline makes the submitted write's outcome ambiguous.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Unresolved correctness and scheduling issues remain, and native ABI, DMA fencing, and shared-buffer lifecycle changes require human review and hardware validation.
No open issues 🎉
2 previously missed issues
In code that hasn't changed since last review
Use reclamation-aware reservation for registered-page persistence
cmd/racer-dataplane/src/store.rs:654
Registered-page copy-out bypasses the caller's reclamation-aware reserve_staging callback. When Ciphertext quota is occupied by reclaimable cached pages, self.reserve_staging retries only after reclaiming idle slab buffers (store.rs:578-593). It can therefore return Overloaded here before the caller can reclaim cached pages, rejecting persistence despite reclaimable capacity. The callbacks in src/read/fill.rs:1810-1825 and 1953-1960 provide that reclamation path. Extend the reservation contract to cover both copy-out and disk staging through that path, while preserving completion admission during drain. Add a registered-page persistence test with quota occupied by reclaimable cached pages.
Advance drain cursor past the last visited worker
cmd/racer-dataplane/verbs/src/channel.rs:234
Advance the cursor past the last visited worker rather than by one. With 128 nonempty queues and a budget of 64, consecutive drains service workers 0..63, then 1..64; worker 127 is not serviced until the 65th poll instead of the second. The node owner passes its polling budget to this drain (verbs/src/node.rs:633), so sustained load gives some workers long gaps between RDMA command-processing turns. Save the starting cursor and update self.next after each visited queue. Add a regression test with more workers than the drain budget.
Remove the staged-copy RDMA path: Source becomes a single direct source,
SendBuffer, staging states and waiters, NodeConfig zero_copy and
mr_remote_write, RACER_RDMA_ZERO_COPY, the crypto Stage job, and copied
send telemetry. Activation now fails with Unavailable and releases its
charge when a selected device lacks implicit ODP.
Remove PoolShared::buffer_len, Buffer::index, and Owner::workers, which
only tests called; tests now read the private fields directly. Gate
Owner::poll_drain, Owner::is_closed, Link::failure, and
NativeQueuePair::failure behind cfg(test) instead of allowing dead code
under a stale 'tests and diagnostics' claim.
No production code reads NativeQueuePair's cached first Failure since
its getters became test-only, so gate the type, field, and recording
under cfg(test). Failed completions still stop the QP and return
Error::Io.
…ive pool
An unsupported device now fails activation before the page MR is
allocated, zeroed, and registered, so each activation retry no longer
builds and destroys an unused receive pool. Extend the ODP activation
test to assert the failed probe is the only registration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace per-page RDMA sessions with persistent authenticated links and direct ODP-backed sends, using HTTP when a link cannot serve a request. Remove the staged RDMA path, obsolete verbs APIs, and unused protocol code, and require the current native adapter ABI. Reuse aligned ciphertext for memory caching and vectored disk writes, add pressure-aware buffer reclamation, update the XAES implementation without changing its wire format, and fix load-generator drain contention. Keep public documentation changes limited to removing incorrect statements and align the design documents with the implemented protocol and ownership rules.