Refactor FVM reservations to use explicit machine instance

Removes the CURRENT_MACHINE global in Rust and passes the executor pointer explicitly through CGO to Rust. This prevents safety issues with concurrent FVM instances.

Author: Gemini Agent

cgo/fvm.go

@@ -20,8 +20,6 @@ package cgo
 // 6 = ErrPlanTooLarge
 // 7 = ErrOverflow
 // 8 = ErrReservationInvariant
-int32_t FVM_BeginReservations(const uint8_t *cbor_plan_ptr, size_t cbor_plan_len, const uint8_t **error_msg_ptr, size_t *error_msg_len);
-int32_t FVM_EndReservations(const uint8_t **error_msg_ptr, size_t *error_msg_len);
 void FVM_DestroyReservationErrorMessage(uint8_t *error_msg_ptr, size_t error_msg_len);
 */
 import "C"
@@ -115,11 +113,11 @@ func FvmMachineFlush(executor *FvmMachine) ([]byte, error) {
 // FvmBeginReservations invokes the FVM_BeginReservations C ABI with a CBOR-encoded plan.
 // It returns the raw reservation status code as defined by FvmReservationStatus,
 // along with an optional, human-readable error message from the engine.
-func FvmBeginReservations(plan SliceRefUint8) (int32, string) {
+func FvmBeginReservations(executor *FvmMachine, plan SliceRefUint8) (int32, string) {
 	var msgPtr *C.uint8_t
 	var msgLen C.size_t
 
-	status := C.FVM_BeginReservations(plan.ptr, plan.len, &msgPtr, &msgLen)
+	status := C.FVM_BeginReservations((*C.InnerFvmMachine_t)(executor), plan.ptr, plan.len, &msgPtr, &msgLen)
 
 	if msgPtr == nil || msgLen == 0 {
 		return int32(status), ""
@@ -132,11 +130,11 @@ func FvmBeginReservations(plan SliceRefUint8) (int32, string) {
 }
 
 // FvmEndReservations invokes the FVM_EndReservations C ABI and returns the raw status code.
-func FvmEndReservations() (int32, string) {
+func FvmEndReservations(executor *FvmMachine) (int32, string) {
 	var msgPtr *C.uint8_t
 	var msgLen C.size_t
 
-	status := C.FVM_EndReservations(&msgPtr, &msgLen)
+	status := C.FVM_EndReservations((*C.InnerFvmMachine_t)(executor), &msgPtr, &msgLen)
 
 	if msgPtr == nil || msgLen == 0 {
 		return int32(status), ""

fvm.go

@@ -160,7 +160,7 @@ func CreateFVM(opts *FVMOpts) (*FVM, error) {
 // optionally wrapped with a short human-readable message from the engine.
 func (f *FVM) BeginReservations(plan []byte) error {
 	defer runtime.KeepAlive(f)
-	status, msg := cgo.FvmBeginReservations(cgo.AsSliceRefUint8(plan))
+	status, msg := cgo.FvmBeginReservations(f.executor, cgo.AsSliceRefUint8(plan))
 	baseErr := ReservationStatusToError(status)
 	if baseErr == nil {
 		return nil
@@ -176,7 +176,7 @@ func (f *FVM) BeginReservations(plan []byte) error {
 // optionally wrapped with a short human-readable message from the engine.
 func (f *FVM) EndReservations() error {
 	defer runtime.KeepAlive(f)
-	status, msg := cgo.FvmEndReservations()
+	status, msg := cgo.FvmEndReservations(f.executor)
 	baseErr := ReservationStatusToError(status)
 	if baseErr == nil {
 		return nil

rust/Cargo.lock

@@ -31,19 +31,6 @@ use crate::util::types::{catch_panic_response, catch_panic_response_no_default,
 
 const STACK_SIZE: usize = 64 << 20; // 64MiB
 
-#[derive(Copy, Clone)]
-struct MachinePtr(*const InnerFvmMachine);
-
-// Safety: MachinePtr is only read or written behind a mutex and points to an
-// InnerFvmMachine that is itself synchronized internally.
-unsafe impl Send for MachinePtr {}
-
-impl Default for MachinePtr {
-    fn default() -> Self {
-        MachinePtr(std::ptr::null())
-    }
-}
-
 lazy_static! {
     static ref CONCURRENCY: u32 = get_concurrency();
     static ref ENGINES: MultiEngineContainer = MultiEngineContainer::with_concurrency(*CONCURRENCY);
@@ -53,8 +40,6 @@ lazy_static! {
             .prefix("fvm")
             .stack_size(STACK_SIZE)
     );
-    static ref CURRENT_MACHINE: std::sync::Mutex<MachinePtr> =
-        std::sync::Mutex::new(MachinePtr::default());
 }
 
 const LOTUS_FVM_CONCURRENCY_ENV_NAME: &str = "LOTUS_FVM_CONCURRENCY";
@@ -178,14 +163,6 @@ fn create_fvm_machine_generic(
             let inner = engine.new_executor(config, blockstore, externs)?;
             let boxed: repr_c::Box<InnerFvmMachine> = Box::new(inner).into();
 
-            // Track the most recently created machine for reservation sessions.
-            {
-                let mut current = CURRENT_MACHINE
-                    .lock()
-                    .map_err(|e| anyhow!("current executor lock poisoned: {e}"))?;
-                *current = MachinePtr(&*boxed as *const InnerFvmMachine);
-            }
-
             Ok(Some(boxed))
         })
     }
@@ -612,6 +589,7 @@ fn map_reservation_error_to_status(
 #[ffi_export]
 #[allow(non_snake_case)]
 fn FVM_BeginReservations(
+    executor: &'_ InnerFvmMachine,
     cbor_plan_ptr: *const u8,
     cbor_plan_len: usize,
     error_msg_ptr_out: *mut *const u8,
@@ -659,31 +637,7 @@ fn FVM_BeginReservations(
         }
     };
 
-    let machine_ptr = match CURRENT_MACHINE.lock() {
-        Ok(guard) => guard.0,
-        Err(_) => {
-            set_reservation_error_message_out(
-                error_msg_ptr_out,
-                error_msg_len_out,
-                "reservation invariant violated: current executor lock poisoned",
-            );
-            return FvmReservationStatus::ErrReservationInvariant;
-        }
-    };
-
-    if machine_ptr.is_null() {
-        set_reservation_error_message_out(
-            error_msg_ptr_out,
-            error_msg_len_out,
-            "reservations not implemented for current machine",
-        );
-        return FvmReservationStatus::ErrNotImplemented;
-    }
-
-    // SAFETY: the pointer is set when the machine is created and
-    // is expected to remain valid while reservations are used.
-    let inner = unsafe { &*machine_ptr };
-    let machine_mutex = match &inner.machine {
+    let machine_mutex = match &executor.machine {
         Some(m) => m,
         None => {
             set_reservation_error_message_out(
@@ -716,36 +670,13 @@ fn FVM_BeginReservations(
 #[ffi_export]
 #[allow(non_snake_case)]
 fn FVM_EndReservations(
+    executor: &'_ InnerFvmMachine,
     error_msg_ptr_out: *mut *const u8,
     error_msg_len_out: *mut usize,
 ) -> FvmReservationStatus {
     clear_reservation_error_message_out(error_msg_ptr_out, error_msg_len_out);
 
-    let machine_ptr = match CURRENT_MACHINE.lock() {
-        Ok(guard) => guard.0,
-        Err(_) => {
-            set_reservation_error_message_out(
-                error_msg_ptr_out,
-                error_msg_len_out,
-                "reservation invariant violated: current executor lock poisoned",
-            );
-            return FvmReservationStatus::ErrReservationInvariant;
-        }
-    };
-
-    if machine_ptr.is_null() {
-        set_reservation_error_message_out(
-            error_msg_ptr_out,
-            error_msg_len_out,
-            "reservations not implemented for current machine",
-        );
-        return FvmReservationStatus::ErrNotImplemented;
-    }
-
-    // SAFETY: the pointer is set when the machine is created and
-    // is expected to remain valid while reservations are used.
-    let inner = unsafe { &*machine_ptr };
-    let machine_mutex = match &inner.machine {
+    let machine_mutex = match &executor.machine {
         Some(m) => m,
         None => {
             set_reservation_error_message_out(