public/kaptan
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(firmware): centralize configuration and diagnostics

Browse Source
This commit is contained in:
Onur Özkan committed 2026-08-22 18:37:18 +03:00
1 parent 7048ed89d0
commit 387fdaad23
140 files changed
+6891 -4541
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

firmware/libs/kaptan-mavlink/definitions/kaptan/config.xml
+27 -60
View File
@@ -13,11 +13,6 @@
<entry value="5" name="KAPTAN_CONFIG_VALUE_KIND_F32"/>
<entry value="6" name="KAPTAN_CONFIG_VALUE_KIND_F64"/>
</enum>
<enum name="KAPTAN_CONFIG_POLICY">
<entry value="1" name="KAPTAN_CONFIG_POLICY_LIVE"/>
<entry value="2" name="KAPTAN_CONFIG_POLICY_DISARMED_RESET"/>
<entry value="3" name="KAPTAN_CONFIG_POLICY_RESTART_REQUIRED"/>
</enum>
<enum name="KAPTAN_CONFIG_STATE">
<entry value="0" name="KAPTAN_CONFIG_STATE_ACTIVE"/>
<entry value="1" name="KAPTAN_CONFIG_STATE_EDITING"/>
@@ -35,7 +30,6 @@
<entry value="4" name="KAPTAN_CONFIG_OPERATION_VALIDATE"/>
<entry value="5" name="KAPTAN_CONFIG_OPERATION_COMMIT"/>
<entry value="6" name="KAPTAN_CONFIG_OPERATION_ABORT"/>
<entry value="7" name="KAPTAN_CONFIG_OPERATION_IMPORT"/>
</enum>
<enum name="KAPTAN_CONFIG_RESULT">
<entry value="0" name="KAPTAN_CONFIG_RESULT_ACCEPTED"/>
@@ -45,9 +39,9 @@
<enum name="KAPTAN_CONFIG_ERROR">
<entry value="0" name="KAPTAN_CONFIG_ERROR_NONE"/>
<entry value="1" name="KAPTAN_CONFIG_ERROR_BAD_TARGET"/>
<entry value="2" name="KAPTAN_CONFIG_ERROR_AUTHORIZATION_DENIED"/>
<entry value="3" name="KAPTAN_CONFIG_ERROR_GENERATION_CONFLICT"/>
<entry value="4" name="KAPTAN_CONFIG_ERROR_SESSION_BUSY"/>
<entry value="4" name="KAPTAN_CONFIG_ERROR_SESSION_BUSY">
<description>The target configuration lease or transaction slot belongs to a client.</description>
</entry>
<entry value="5" name="KAPTAN_CONFIG_ERROR_INVALID_SESSION"/>
<entry value="6" name="KAPTAN_CONFIG_ERROR_STALE_REVISION"/>
<entry value="7" name="KAPTAN_CONFIG_ERROR_BAD_STATE"/>
@@ -58,30 +52,22 @@
<entry value="12" name="KAPTAN_CONFIG_ERROR_ABOVE_MAXIMUM"/>
<entry value="13" name="KAPTAN_CONFIG_ERROR_CROSS_FIELD"/>
<entry value="14" name="KAPTAN_CONFIG_ERROR_UNSUPPORTED_CAPABILITY"/>
<entry value="15" name="KAPTAN_CONFIG_ERROR_UNSUPPORTED_FORMAT"/>
<entry value="16" name="KAPTAN_CONFIG_ERROR_STORAGE_FAILURE"/>
<entry value="17" name="KAPTAN_CONFIG_ERROR_INTERNAL"/>
<entry value="18" name="KAPTAN_CONFIG_ERROR_REQUEST_CONFLICT"/>
<entry value="19" name="KAPTAN_CONFIG_ERROR_CBOR_MALFORMED"/>
<entry value="20" name="KAPTAN_CONFIG_ERROR_CBOR_TOO_LARGE"/>
<entry value="21" name="KAPTAN_CONFIG_ERROR_BLOB_CRC"/>
<entry value="22" name="KAPTAN_CONFIG_ERROR_SCHEMA_MISMATCH"/>
<entry value="23" name="KAPTAN_CONFIG_ERROR_IMPORT_UNAVAILABLE"/>
<entry value="24" name="KAPTAN_CONFIG_ERROR_INVALID_QUERY"/>
<entry value="25" name="KAPTAN_CONFIG_ERROR_INVALID_ENUM_VALUE"/>
</enum>
</enums>
<messages>
<message id="51000" name="KAPTAN_CONFIG_INFO">
<description>Correlated configuration protocol and active snapshot metadata.</description>
<field type="uint64_t" name="active_generation"/>
<field type="uint64_t" name="committed_generation"/>
<description>Correlated configuration protocol and schema metadata.</description>
<field type="uint32_t" name="request_id"/>
<field type="uint8_t[16]" name="schema_id"/>
<field type="uint16_t" name="profile_format"/>
<field type="uint16_t" name="field_count"/>
<field type="uint8_t" name="protocol_major"/>
<field type="uint8_t" name="protocol_minor"/>
<field type="uint8_t" name="config_state" enum="KAPTAN_CONFIG_STATE"/>
<field type="uint8_t" name="capability_flags"/>
</message>
<message id="51014" name="KAPTAN_CONFIG_INFO_REQUEST">
<description>Requests correlated configuration protocol and schema metadata.</description>
@@ -90,10 +76,9 @@
<field type="uint8_t" name="target_component"/>
</message>
<message id="51001" name="KAPTAN_CONFIG_DESCRIPTOR_REQUEST">
<description>Requests a bounded page of field descriptors.</description>
<description>Requests one field descriptor by stable schema index.</description>
<field type="uint32_t" name="request_id"/>
<field type="uint16_t" name="first"/>
<field type="uint16_t" name="count"/>
<field type="uint16_t" name="descriptor_index"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
@@ -105,11 +90,28 @@
<field type="uint32_t" name="request_id"/>
<field type="uint16_t" name="descriptor_index"/>
<field type="uint16_t" name="field_id"/>
<field type="uint8_t" name="enum_option_count">Number of named enum choices available for indexed retrieval.</field>
<field type="char[48]" name="display_key"/>
<field type="char[16]" name="unit"/>
<field type="uint8_t" name="value_kind" enum="KAPTAN_CONFIG_VALUE_KIND"/>
<field type="uint8_t" name="apply_policy" enum="KAPTAN_CONFIG_POLICY"/>
<field type="uint8_t" name="flags"/>
<field type="uint8_t" name="flags">Bit 0 marks minimum_bits present; bit 1 marks maximum_bits present. Other bits are reserved.</field>
</message>
<message id="51023" name="KAPTAN_CONFIG_ENUM_OPTION">
<description>One named choice for the explicitly identified enum-backed descriptor.</description>
<field type="uint8_t" name="value"/>
<field type="uint32_t" name="request_id"/>
<field type="uint16_t" name="descriptor_index"/>
<field type="uint16_t" name="field_id"/>
<field type="uint8_t" name="option_index"/>
<field type="char[32]" name="label"/>
</message>
<message id="51024" name="KAPTAN_CONFIG_ENUM_OPTION_REQUEST">
<description>Requests one named choice by descriptor and option index.</description>
<field type="uint32_t" name="request_id"/>
<field type="uint16_t" name="descriptor_index"/>
<field type="uint8_t" name="option_index"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
<message id="51003" name="KAPTAN_CONFIG_VALUE_REQUEST">
<description>Reads one active, committed, or transaction value.</description>
@@ -131,7 +133,6 @@
</message>
<message id="51005" name="KAPTAN_CONFIG_BEGIN">
<description>Opens the one lease-bound edit transaction.</description>
<field type="uint64_t" name="expected_generation"/>
<field type="uint32_t" name="request_id"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
@@ -186,7 +187,6 @@
</message>
<message id="51011" name="KAPTAN_CONFIG_COMMIT">
<description>Validates then atomically persists the open transaction.</description>
<field type="uint64_t" name="expected_generation"/>
<field type="uint32_t" name="request_id"/>
<field type="uint32_t" name="session_id"/>
<field type="uint32_t" name="expected_revision"/>
@@ -202,10 +202,8 @@
</message>
<message id="51013" name="KAPTAN_CONFIG_RESULT">
<description>Authoritative typed completion for a configuration request.</description>
<field type="uint64_t" name="generation"/>
<field type="uint32_t" name="request_id"/>
<field type="uint32_t" name="session_id"/>
<field type="uint32_t" name="transfer_id"/>
<field type="uint32_t" name="revision"/>
<field type="uint16_t" name="primary_field"/>
<field type="uint16_t" name="related_field"/>
@@ -235,36 +233,5 @@
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
<message id="51017" name="KAPTAN_CONFIG_IMPORT_BEGIN">
<description>Starts a fixed-bounded CBOR import inside an open transaction.</description>
<field type="uint32_t" name="crc32c"/>
<field type="uint32_t" name="request_id"/>
<field type="uint32_t" name="session_id"/>
<field type="uint32_t" name="expected_revision"/>
<field type="uint16_t" name="length"/>
<field type="uint8_t[16]" name="schema_id"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
<message id="51018" name="KAPTAN_CONFIG_IMPORT_CHUNK">
<description>One aligned, idempotent 192-byte-or-final CBOR import chunk. Chunks may arrive out of order.</description>
<field type="uint8_t[192]" name="data"/>
<field type="uint32_t" name="request_id"/>
<field type="uint32_t" name="session_id"/>
<field type="uint32_t" name="transfer_id"/>
<field type="uint16_t" name="offset"/>
<field type="uint8_t" name="length"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
<message id="51019" name="KAPTAN_CONFIG_IMPORT_FINISH">
<description>Validates a complete received CBOR import into the transaction.</description>
<field type="uint32_t" name="request_id"/>
<field type="uint32_t" name="session_id"/>
<field type="uint32_t" name="transfer_id"/>
<field type="uint32_t" name="expected_revision"/>
<field type="uint8_t" name="target_system"/>
<field type="uint8_t" name="target_component"/>
</message>
</messages>
</mavlink>
firmware/libs/kaptan-mavlink/definitions/kaptan/error.xml
+2 -1
View File
@@ -9,13 +9,14 @@
<description>The path or additional-information UTF-8 prefix was truncated to its bounded on-wire field.</description>
</entry>
<entry value="4" name="KAPTAN_ERROR_FLAG_COALESCED">
<description>Error represents repeated adjacent observations with the same path and additional information.</description>
<description>One or more later observations from the same source mailbox were folded while this first error was pending.</description>
</entry>
</enum>
</enums>
<messages>
<message id="51021" name="KAPTAN_ERROR">
<description>Bounded derived or explicit runtime error. This is distinct from ordinary KAPTAN_LOG records. The display identity is generated from the Rust error type and variant when a KaptanError-derived value is available; structured configuration failures remain authoritative in KAPTAN_CONFIG_RESULT.</description>
<field type="uint8_t" name="level">MAV_SEVERITY-compatible error level from Emergency=0 through Error=3.</field>
<field type="uint8_t" name="flags" enum="KAPTAN_ERROR_FLAGS">Known bits are TRUNCATED=2 and COALESCED=4. Receivers ignore unknown future bits.</field>
<field type="uint8_t" name="path_length">Number of valid UTF-8 bytes in path; no more than 96.</field>
<field type="uint8_t" name="additional_information_length">Number of valid UTF-8 bytes in additional_information; no more than 64.</field>
firmware/libs/kaptan-mavlink/definitions/kaptan/log.xml
+2 -5
View File
@@ -11,16 +11,13 @@
<entry value="2" name="KAPTAN_LOG_FLAG_TRUNCATED">
<description>Message text was truncated to the bounded on-wire buffer.</description>
</entry>
<entry value="4" name="KAPTAN_LOG_FLAG_COALESCED">
<description>Message represents repeated adjacent observations.</description>
</entry>
</enum>
</enums>
<messages>
<message id="51020" name="KAPTAN_LOG">
<description>Bounded human-readable runtime log. The receiver needs only level, flags, and the valid UTF-8 text prefix. MAVLink framing, bounded admission, DMA, retries, and local loss accounting remain platform-owned.</description>
<description>Bounded human-readable runtime log. The receiver needs only level, flags, and the valid UTF-8 text prefix. MAVLink framing, bounded admission, DMA, and retries remain platform-owned.</description>
<field type="uint8_t" name="level">MAV_SEVERITY-compatible level. Rust TRACE uses DEBUG plus the TRACE flag.</field>
<field type="uint8_t" name="flags" enum="KAPTAN_LOG_FLAGS">Known bits are TRACE=1, TRUNCATED=2, and COALESCED=4. Receivers ignore unknown future bits.</field>
<field type="uint8_t" name="flags" enum="KAPTAN_LOG_FLAGS">Known bits are TRACE=1 and TRUNCATED=2. Receivers ignore unknown future bits.</field>
<field type="uint8_t" name="message_length">Number of valid UTF-8 bytes in message; at most 160.</field>
<field type="uint8_t[160]" name="message">Bounded UTF-8 message bytes. Bytes after message_length are zero.</field>
</message>
firmware/libs/kaptan-mavlink/definitions/kaptan/shutdown.xml
+2 -2
View File
@@ -5,8 +5,8 @@
<!-- Kaptan-reserved development block. Register these IDs before release. -->
<enums>
<enum name="KAPTAN_SHUTDOWN_REASON">
<entry value="1" name="KAPTAN_SHUTDOWN_REASON_OPERATOR">
<description>An operator initiated the completed controlled firmware shutdown.</description>
<entry value="1" name="KAPTAN_SHUTDOWN_REASON_USER">
<description>A user initiated the completed controlled firmware shutdown.</description>
</entry>
<entry value="2" name="KAPTAN_SHUTDOWN_REASON_SAFETY">
<description>The safety owner initiated the completed controlled firmware shutdown.</description>
firmware/libs/kaptan-mavlink/src/encoder.rs
-9
View File
@@ -81,15 +81,6 @@ impl MavlinkEncoder {
self.serialize(&heartbeat)
}
/// Acknowledges a supported MAVLink command.
pub fn command_ack(
&mut self,
command: message::MavCmd,
result: message::MavResult,
) -> MavlinkFrame {
self.serialize(&message::COMMAND_ACK_DATA { command, result })
}
/// Encodes a standard `RAW_IMU` frame.
#[cfg(feature = "sensor-telemetry")]
pub fn raw_imu_snapshot(&mut self, snapshot: &ImuSnapshot) -> MavlinkFrame {
firmware/libs/kaptan-mavlink/src/lib.rs
+2
View File
@@ -13,6 +13,8 @@ pub mod transmitter;
/// An owned MAVLink 2 frame suitable for UART transmission.
pub type MavlinkFrame = message::MAVLinkV2MessageRaw;
/// MAVLink framing version used when parsing an integrity-checked payload.
pub use mavlink_core::MavlinkVersion;
/// Supported MAVLink message types for Kaptan.
pub mod message {
firmware/libs/kaptan-mavlink/src/receiver.rs
+79 -71
View File
@@ -2,58 +2,28 @@
use crate::{MavlinkFrame, message};
/// Bounded MAVLink 2 receiver for a board's serial-byte interrupt.
///
/// Boards pass UART bytes to [`Self::receive_byte`] and take complete frames
/// from [`Self::take_received`]. Production has no signing verifier or replay
/// state, so it never exposes an inbound MAVLink frame as an authority record.
pub struct MavlinkReceiver<const N: usize> {
struct IntegrityFramer {
frame: MavlinkFrame,
received: usize,
expected: usize,
frames: [Option<MavlinkFrame>; N],
front: usize,
length: usize,
}
impl<const N: usize> Default for MavlinkReceiver<N> {
fn default() -> Self {
Self::new()
}
}
impl<const N: usize> MavlinkReceiver<N> {
/// Creates a production receiver with space for `N` complete frames.
///
/// TODO(signing): accept a frame only after verified MAVLink-v2 signing,
/// configured sender/target binding, persistent anti-replay state, and
/// provisioning/rotation policy exist together. A V2 CRC only detects
/// corruption; it is not authentication.
pub const fn new() -> Self {
impl IntegrityFramer {
const fn new() -> Self {
Self {
frame: MavlinkFrame::new(),
received: 0,
expected: 0,
frames: [None; N],
front: 0,
length: 0,
}
}
/// Receives one UART byte and returns whether it queued a complete frame.
///
/// Bytes outside MAVLink 2 frames and frames with invalid CRCs are
/// discarded. Signed frames are also discarded because this receiver has
/// no verifier or replay state. Until the TODO(signing) work is complete,
/// unsigned frames are deliberately not promoted to received records
/// either.
pub fn receive_byte(&mut self, byte: u8) -> bool {
fn receive_byte(&mut self, byte: u8) -> Option<MavlinkFrame> {
if self.received == 0 {
if byte == 0xfd {
self.frame.as_mut_slice()[0] = byte;
self.received = 1;
}
return false;
return None;
}
self.frame.as_mut_slice()[self.received] = byte;
@@ -61,43 +31,80 @@ impl<const N: usize> MavlinkReceiver<N> {
if self.received == 10 {
let header = self.frame.as_slice();
// MAVLink's bit 0 means the packet carries a signature. Reject all
// nonzero incompatibility flags until a reviewed signature verifier
// and persistent replay policy exist.
// MAVLink incompatibility bit zero adds a signature. This framer
// has neither a signing verifier nor persistent replay state, so
// every nonzero incompatibility flag is rejected at the header.
if header[2] != 0 {
self.reset();
return false;
return None;
}
self.expected = 1 + 9 + usize::from(header[1]) + 2;
}
if self.expected != 0 && self.received == self.expected {
let frame = core::mem::replace(&mut self.frame, MavlinkFrame::new());
self.received = 0;
self.expected = 0;
// The production receiver still drops every inbound frame until
// signing/replay verification exists. Validate either known
// dialect here so a future verifier receives no CRC-corrupt
// custom configuration message.
if !has_valid_known_crc(&frame) {
return false;
}
if self.expected == 0 || self.received != self.expected {
return None;
}
false
let frame = core::mem::replace(&mut self.frame, MavlinkFrame::new());
self.received = 0;
self.expected = 0;
has_valid_known_crc(&frame).then_some(frame)
}
/// Discards the in-progress frame after a UART transport fault.
pub fn reset(&mut self) {
fn reset(&mut self) {
self.frame = MavlinkFrame::new();
self.received = 0;
self.expected = 0;
}
}
/// Takes the oldest complete received frame, if one is available.
///
/// The production receiver returns no frame until signing verification is
/// implemented, but retaining this API keeps dispatch ownership explicit.
/// Bounded integrity-only MAVLink 2 receiver.
///
/// It rejects signed, incompatible, corrupt, and MAVLink 1 frames, but an
/// accepted frame is still unauthenticated. The composition decides whether
/// and how a received command may be admitted.
pub struct IntegrityMavlinkReceiver<const N: usize> {
framer: IntegrityFramer,
frames: [Option<MavlinkFrame>; N],
front: usize,
length: usize,
}
impl<const N: usize> IntegrityMavlinkReceiver<N> {
/// Creates an empty integrity-only receiver.
pub const fn new() -> Self {
assert!(N != 0, "integrity receiver capacity must be nonzero");
Self {
framer: IntegrityFramer::new(),
frames: [None; N],
front: 0,
length: 0,
}
}
/// Queues one complete CRC-valid unsigned frame when capacity remains.
pub fn receive_byte(&mut self, byte: u8) -> bool {
let Some(frame) = self.framer.receive_byte(byte) else {
return false;
};
if self.length == N {
return false;
}
let index = (self.front + self.length) % N;
self.frames[index] = Some(frame);
self.length += 1;
true
}
/// Discards partial framing state and all queued unauthenticated frames.
pub fn reset(&mut self) {
self.framer.reset();
self.frames = [None; N];
self.front = 0;
self.length = 0;
}
/// Takes the oldest integrity-checked frame.
pub fn take_received(&mut self) -> Option<MavlinkFrame> {
if self.length == 0 {
return None;
@@ -107,10 +114,11 @@ impl<const N: usize> MavlinkReceiver<N> {
self.length -= 1;
frame
}
}
/// Returns whether at least one complete frame awaits dispatch.
pub const fn has_received(&self) -> bool {
self.length != 0
impl<const N: usize> Default for IntegrityMavlinkReceiver<N> {
fn default() -> Self {
Self::new()
}
}
@@ -128,7 +136,7 @@ fn has_valid_known_crc(frame: &MavlinkFrame) -> bool {
#[cfg(test)]
mod tests {
use super::MavlinkReceiver;
use super::IntegrityMavlinkReceiver;
use crate::{MavlinkFrame, message};
fn heartbeat(sequence: u8) -> MavlinkFrame {
@@ -173,7 +181,7 @@ mod tests {
#[test]
fn discards_a_crc_valid_mavlink_v1_frame() {
let mut receiver = MavlinkReceiver::<1>::new();
let mut receiver = IntegrityMavlinkReceiver::<1>::new();
let v1 = heartbeat_v1(3);
assert_eq!(v1.raw_bytes()[0], 0xfe);
@@ -185,26 +193,26 @@ mod tests {
}
#[test]
fn production_rejects_unsigned_frames_without_a_signing_verifier() {
let frame = heartbeat(0);
let mut receiver = MavlinkReceiver::<1>::new();
fn queues_a_complete_crc_valid_unsigned_frame() {
let frame = heartbeat(9);
let mut receiver = IntegrityMavlinkReceiver::<1>::new();
for byte in frame.raw_bytes() {
assert!(!receiver.receive_byte(*byte));
receiver.receive_byte(*byte);
}
assert!(!receiver.has_received());
assert_eq!(receiver.take_received(), Some(frame));
assert_eq!(receiver.take_received(), None);
}
#[test]
fn rejects_signed_v2_before_accepting_any_payload() {
let mut receiver = MavlinkReceiver::<1>::new();
let mut receiver = IntegrityMavlinkReceiver::<1>::new();
// The first ten bytes contain the complete MAVLink 2 header. This
// frame advertises a signature (incompatibility bit 0), so rejection
// happens before its payload can be considered.
for byte in [0xfd, 0, 1, 0, 0, 1, 1, 0, 0, 0] {
assert!(!receiver.receive_byte(byte));
}
assert!(!receiver.has_received());
assert_eq!(receiver.take_received(), None);
}
#[test]
@@ -213,11 +221,11 @@ mod tests {
let mut bytes = frame.into_inner();
bytes[10] ^= 1;
let corrupt = MavlinkFrame::from_bytes_unparsed(bytes);
let mut receiver = MavlinkReceiver::<1>::new();
let mut receiver = IntegrityMavlinkReceiver::<1>::new();
for byte in corrupt.raw_bytes() {
assert!(!receiver.receive_byte(*byte));
}
assert!(!receiver.has_received());
assert_eq!(receiver.take_received(), None);
}
}
firmware/libs/kaptan-mavlink/src/transmitter.rs
+5 -28
View File
@@ -18,32 +18,10 @@ pub enum MavlinkTransmitFault<MemoryError, EngineError> {
Engine(EngineError),
}
/// Transport-neutral class of a terminal link fault.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum TransmitFaultKind {
/// DMA-visible frame preparation failed.
Memory,
/// The UART DMA engine rejected a transfer start.
Engine,
/// An active DMA transfer ended with a terminal fault or halt.
Terminal,
}
impl<MemoryError, EngineError> MavlinkTransmitFault<MemoryError, EngineError> {
/// Returns the bounded category a platform may convert to a static log
/// message without exposing a generic HAL error value on the wire.
pub const fn kind(&self) -> TransmitFaultKind {
match self {
Self::Memory(_) => TransmitFaultKind::Memory,
Self::Engine(_) => TransmitFaultKind::Engine,
}
}
}
/// Combined bounded-admission and DMA-start outcome.
///
/// The two outcomes stay distinct so a platform can account for a failed DMA
/// start without falsely treating a queue-full source frame as retained.
/// The outcomes stay distinct because admission decides whether the source may
/// acknowledge its frame, while a failed start keeps reserved work for retry.
#[must_use]
pub struct AdmissionStart<MemoryError, EngineError> {
/// Queue admission for the source frame.
@@ -94,10 +72,9 @@ where
}
/// Admits one frame and attempts one bounded DMA start while preserving
/// both outcomes. Platform policy uses this to account for a failed DMA
/// start without mistaking an admission rejection for a retained frame.
/// A start failure retains the selected frame in the queue reservation for
/// a later service-turn retry.
/// both outcomes. A start failure retains the selected frame in the queue
/// reservation for a later service-turn retry; it does not change whether
/// the newly submitted source frame was admitted.
pub fn admit_and_start(
&mut self,
class: FrameClass,