new device model

[agoric]

new device model

[erights]

We must be very careful with synchronous effects, as the turn within which they happen may subsequently abort. In that case, all effects should be as-if never happened. Also, all synchronous perceiving of effects must be deterministically replayable.

[warner]

For the latter, we currently record all syscalls (and their return results) in the transcript. Specifically, we record all kernel-to-userspace dispatch calls, within which we record the list of syscalls made by userspace back into the kernel while that dispatch was active.

When we restore a vat from the saved state, we replay the dispatch calls but replace the syscall object with one that compares-and-ignores (and also returns the same recorded return value as before), so the kernel won't observe any outputs from the vat during the playback. But the Vat shouldn't be able to distinguish the replay from the original.

By routing userspace-to-device access through the syscall API, we get this same deterministic replay for free. The vat won't be interacting with the real device during replay, but it will get the same return values that it got the first time around. Any since the device-to-userspace pathway goes through the run-queue (albeit a higher-priority one that should always be empty in a checkpoint), all those messages are effectively captured in the vat's transcript.

Of course, the device itself must be restored to the same state too. Devices, like the kernel, will add their own state into the machine-wide state vector, right next to the vat transcripts. I think that will be sufficient, as long as we have some interlocks to prevent the device from e.g. submitting any vat messages before we've replayed all the vat transcripts.

I haven't thought so much about turn aborts. I expect this is the spot where devices must promise to buffer their effects until a checkpoint has been taken.

[warner]

Remaining tasks:

• test one device invocation returning a new device node
• test passing device nodes between vats
• liveSlots wrappers for device nodes: retval = D(devnode).method(args)
• add deviceSlots helper for writing devices
• devices can add calls to the run queue (sendOnly())
• device state management
• test vat state management in the presence of device calls

[warner]

Ok, I think that should get us started.

[warner]

in the old repo. this was SwingSet issue 26