BASE_IMAGES := sample_root sample_control sample_scalars sample_memory sample_overflow sample_events sample_alias sample_instance

native.rv64: native.rad native/instances.rad arch/entry.ras core.rad $(MODULES) $(CORE_ASM) build/baseline/images.rad user/sys.ras $(COMPILER)

	$(COMPILE) $(BASE_CATALOG) $(CORE) -pkg native -start arch/entry.ras -mod native.rad -mod native/instances.rad -entry native -o $@

record the contracts established through step 18 of the 22-step plan.

## Complete image instances

- DomainCreate preflights handle, domain, and terminal-event capacity. It copies

  only the immutable initializer into owned private frames. Failed reservations

  return provisional frames without installing authority.

- Activation requires Execute, a writable target Page stack, and readable

  coverage of the complete nonempty argument range. A descending stack may start

  at a Page's exclusive end with 16-byte alignment.

- Activation owns setup of each context's immutable 80-byte Env and private

  64 KiB native stack, rather than relying on machine-fixture setup.

- Contexts in one domain share writable image state and Events; different domains

  have independent state. Creation and activation grant no budget or hart.

- Creation ancestry survives intermediate creator death. Slot reuse clears the

  old incarnation's ancestry bit without erasing surviving ancestors. Private

  frame ownership prevents reuse before reclamation.

- The eighth native image checks instance state: initial value 41 becomes 42

  and 44 across two contexts in one domain, while another domain reports 42.

Run the eight-image native workload and hosted activation checks. Check complete argument/stack coverage, independent private instances, and two contexts sharing one instance with reported values 42 and 44 versus 42 in another.

mod activation;

    activation::run();

//! Transactional activation, live Page bounds, and private context ownership.

use core::abi;

use core::activation;

use core::capabilities;

use core::contexts;

use core::domains;

use core::events;

use core::fdt;

use core::frames;

use core::handles;

use core::memory;

use core::pages;

use core::platform;

use core::resources;

use core::state;

use images;

/// Test-owned physical memory for Page and private-stack allocations.

static RAM: [u8; 64 * frames::PAGE_SIZE] = undefined;

/// Domain slots include spare creation capacity unless explicitly exhausted.

static DOMAINS: [domains::Domain; 3] = undefined;

/// Page resource metadata.

static OBJECTS: [resources::Slot; 8] = undefined;

/// Two incarnations let us distinguish initial and additional contexts.

static CONTEXTS: [contexts::Context; 2] = undefined;

/// Allocation and persistent Page lifetime metadata.

static POOL: frames::Pool = undefined;

static PINS: [u16; 64] = undefined;

static ASSIGNED: [bool; 64] = undefined;

static GRANTS: [u64; 3] = undefined;

/// Shared state for the exercised public operations.

static KERNEL: state::State = undefined;

/// Zero only the supplied simulated physical range.

fn clear(base: u64, size: u32) {

    assert base <= RAM.len as u64 and size as u64 <= RAM.len as u64 - base;

    for i in base as u32..base as u32 + size { set RAM[i] = 0; }

}

/// Creation rejection must happen before any initializer can be copied.

fn unexpectedCopy(destination: u64, source: u64, size: u32) {

    panic "unexpectedCopy: rejected creation reached initializer";

}

/// Fresh state; the low-level child supplies an admitted entry for bounds tests.

fn setup() -> abi::Handle {

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 1;

    set machine.memory[0] = fdt::Range { base: 0, size: RAM.len as u64 };

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 3);

    domains::init(&mut DOMAINS[..]);

    resources::init(&mut OBJECTS[..]);

    for i in 0..CONTEXTS.len { contexts::init(&mut CONTEXTS[i], i); }

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let handle = domains::root(&mut DOMAINS[..], images::ROOT);

    let root = try! domains::resolve(&DOMAINS[..], 0, handle, abi::CREATE);

    let child = try! domains::create(&mut DOMAINS[..], root, images::ROOT);

    return handles::install(&mut DOMAINS[0].handles, 2, child, abi::DOMAIN_RIGHTS);

}

/// Read a rejected call's public error without accepting accidental success.

fn createError(authority: abi::Handle, image: u64) -> abi::Error {

    let _handle = try activation::create(&mut KERNEL, 0, authority, image, clear, unexpectedCopy) catch error {

        return error;

    };

    panic "createError: creation unexpectedly succeeded";

}

/// Read activation errors for the initial or an additional context.

fn startError(target: abi::Handle, stack: u64, args: u64, size: u64, initial: bool) -> abi::Error {

    if initial {

        let _id = try activation::activate(&mut KERNEL, 0, target, stack, args, size, clear) catch error {

            return error;

        };

    } else {

        let _id = try activation::context(&mut KERNEL, 0, target, stack, args, size, clear) catch error {

            return error;

        };

    }

    panic "startError: context unexpectedly started";

}

/// A rejected image/capacity request cannot consume authority or an incarnation.

fn creation() {

    let target = setup();

    let self = abi::Handle { bits: 0 };

    assert createError(self, images::COUNT as u64) == abi::Error::VerifyFailed;

    assert createError(self, 0x100000000) == abi::Error::VerifyFailed;

    assert createError(target, images::ROOT as u64) == abi::Error::Denied;

    let child = try! domains::resolve(&DOMAINS[..], 0, target, abi::EXECUTE);

    let foreign = handles::install(&mut DOMAINS[0].handles, 3, child, abi::CREATE);

    assert createError(foreign, images::ROOT as u64) == abi::Error::Denied;

    set DOMAINS[0].events.reserved = events::CRITICAL;

    assert createError(self, images::ROOT as u64) == abi::Error::Exhausted;

    assert DOMAINS[0].events.reserved == events::CRITICAL;

    set DOMAINS[0].events.reserved = 1;

    let root = try! domains::authority(&DOMAINS[..], 0, self, abi::CREATE);

    for i in 4..abi::MAX_HANDLES {

        let _handle = handles::install(&mut DOMAINS[0].handles, i, root, abi::EXECUTE);

    }

    assert createError(self, images::ROOT as u64) == abi::Error::Exhausted;

    for i in 4..abi::MAX_HANDLES { let _entry = handles::remove(&mut DOMAINS[0].handles, i); }

    assert DOMAINS[2].epoch == 0 and DOMAINS[2].state == domains::Lifecycle::Dead;

    let _last = try! domains::create(&mut DOMAINS[..], root, images::ROOT);

    assert createError(self, images::ROOT as u64) == abi::Error::Exhausted;

    assert POOL.available == 64;

    assert domains::live(&DOMAINS[..], try! domains::resolve(&DOMAINS[..], 0, target, abi::EXECUTE));

}

/// Verify stack edges, adjacent args, allocation rollback, and context isolation.

export fn run() {

    creation();

    let target = setup();

    let whole = try! pages::allocate(&mut KERNEL, 0, abi::Handle { bits: 0 }, 4, clear);

    let right = try! pages::split(&mut KERNEL, 0, whole, 2);

    let _leftGrant = try! capabilities::grant(&mut KERNEL, 0, whole, target, (abi::READ | abi::WRITE) as u64);

    let rightGrant = try! capabilities::grant(&mut KERNEL, 0, right, target, abi::READ as u64);

    let restricted = handles::install(&mut DOMAINS[0].handles, try! handles::vacant(&DOMAINS[0].handles),

        try! domains::resolve(&DOMAINS[..], 0, target, abi::EXECUTE), abi::WAKE);

    assert startError(restricted, 8192, 4096, 8192, true) == abi::Error::Denied;

    assert startError(target, 8192, 4096, 8192, false) == abi::Error::Busy;

    assert startError(target, 0, 0, 0, true) == abi::Error::InvalidArg;

    assert startError(target, 8191, 0, 0, true) == abi::Error::InvalidArg;

    assert startError(target, 8208, 0, 0, true) == abi::Error::InvalidArg;

    assert startError(target, 8192, 4096, 12289, true) == abi::Error::InvalidArg;

    assert startError(target, 8192, 0xfffffffffffffff0, 32, true) == abi::Error::InvalidArg;

    // A dropped readable handle no longer authorizes args, even while its

    // persistent lifetime pin keeps the physical bytes from being reused.

    try! capabilities::drop(&mut KERNEL, 1, rightGrant);

    assert startError(target, 8192, 4096, 8192, true) == abi::Error::InvalidArg;

    let _readAgain = try! capabilities::grant(&mut KERNEL, 0, right, target, abi::READ as u64);

    set CONTEXTS[0].epoch = 0xffffffff;

    set CONTEXTS[1].epoch = 0xffffffff;

    assert startError(target, 8192, 4096, 8192, true) == abi::Error::Exhausted;

    set CONTEXTS[0].epoch = 0;

    set CONTEXTS[1].epoch = 0;

    let held = try! frames::allocate(&mut POOL, POOL.available, clear);

    assert startError(target, 8192, 4096, 8192, true) == abi::Error::OutOfMemory;

    assert DOMAINS[1].state == domains::Lifecycle::Pending and DOMAINS[1].env.context == 0;

    assert CONTEXTS[0].status == contexts::Status::Vacant and CONTEXTS[0].epoch == 0;

    assert CONTEXTS[1].status == contexts::Status::Vacant and CONTEXTS[1].epoch == 0;

    frames::discard(&mut POOL, held);

    let first = try! activation::activate(&mut KERNEL, 0, target, 8192, 4096, 8192, clear);

    assert DOMAINS[1].state == domains::Lifecycle::Active;

    let a = try! contexts::resolve(&CONTEXTS[..], first);

    assert DOMAINS[1].env.context == first;

    assert CONTEXTS[a].env.stackBase == 0 and CONTEXTS[a].env.stackTop == 8192;

    assert CONTEXTS[a].env.argsPointer == 4096 and CONTEXTS[a].env.argsSize == 8192;

    assert CONTEXTS[a].env.eventsPointer == &DOMAINS[1].events.ring as u64;

    assert CONTEXTS[a].env.privateStackTop - CONTEXTS[a].env.privateStackBase == activation::PRIVATE_STACK_SIZE as u64;

    assert CONTEXTS[a].frame.pc == images::get(images::ROOT).entry;

    assert startError(target, 8192, 0, 0, true) == abi::Error::NotPending;

    // Empty args need no Page, even for an otherwise invalid pointer.

    let second = try! activation::context(&mut KERNEL, 0, target, 4096, 0xffffffffffffffff, 0, clear);

    let b = try! contexts::resolve(&CONTEXTS[..], second);

    assert first <> second and a <> b;

    assert CONTEXTS[b].env.stackTop == 4096 and DOMAINS[1].env.stackTop == 8192;

    assert DOMAINS[1].env.context == first;

    assert CONTEXTS[a].env.privateStackTop <= CONTEXTS[b].env.privateStackBase

        or CONTEXTS[b].env.privateStackTop <= CONTEXTS[a].env.privateStackBase;

    assert CONTEXTS[a].budget.kind == abi::Kind::Empty and CONTEXTS[b].budget.kind == abi::Kind::Empty;

    assert CONTEXTS[a].hart == contexts::NO_HART and CONTEXTS[b].hart == contexts::NO_HART;

    assert startError(target, 8192, 0, 0, false) == abi::Error::Exhausted;

    assert try! contexts::resolve(&CONTEXTS[..], first) == a;

    assert try! contexts::resolve(&CONTEXTS[..], second) == b;

    assert POOL.available == 64 - 4 - 2 * (activation::PRIVATE_STACK_SIZE / frames::PAGE_SIZE);

    for i in 4..64 {

        assert not ASSIGNED[i] and PINS[i] == 0;

    }

}

export mod activation;

//! Capability-mediated image instances and private execution startup state.

//!

//! Callers hold the kernel critical section across each operation, including

//! callbacks, and supply a live caller index. Domain/context storage must not

//! move while live environments or Events pointers refer into it. Callbacks

//! cannot fail, reenter the kernel, mutate kernel metadata, or retain a range.

use core::abi;

use core::contexts;

use core::domains;

use core::events;

use core::frames;

use core::handles;

use core::pages;

use core::resources;

use core::state;

use images;

/// Fixed private native stack per context: 64 KiB for locals and saved registers.

/// The authorized Page stack has separate bounds in Env.

export constant PRIVATE_STACK_SIZE: u32 = 64 * 1024;

/// Exclusive private initializer storage for one domain instance.

export record ImageState: Copy {

    /// Owned frames, or an empty run for a stateless graph.

    run: frames::Run,

    /// Aligned mutable-state base within the owned run.

    base: u64,

}

/// Allocate and copy a checked catalog initializer before domain installation.

/// The caller installs the returned ownership or reclaims it on failure.

export fn initialize(pool: *mut frames::Pool, image: u32, clear: fn(u64, u32), copy: fn(u64, u64, u32)) -> ImageState throws (abi::Error) {

    let descriptor = images::get(image);

    let mut run = frames::Run { first: 0, count: 0 };

    let mut base: u64 = 0;

    if descriptor.stateSize <> 0 {

        let alignment = descriptor.stateAlignment as u64;

        // These are trusted compiler facts, not caller-provided metadata.

        assert alignment <> 0 and alignment & (alignment - 1) == 0;

        let mut padding: u64 = 0;

        if alignment > frames::PAGE_SIZE as u64 {

            // Every run already starts on a frame boundary.

            set padding = alignment - frames::PAGE_SIZE as u64;

        }

        let bytes = descriptor.stateSize as u64 + padding;

        let count = (bytes + frames::PAGE_SIZE as u64 - 1) / frames::PAGE_SIZE as u64;

        if count > frames::MAX_FRAMES as u64 { throw abi::Error::OutOfMemory; }

        let allocation = try frames::allocate(pool, count as u32, clear) catch {

            throw abi::Error::OutOfMemory;

        };

        set run = frames::install(allocation);

        let first = run.first as u64 * frames::PAGE_SIZE as u64;

        set base = (first + alignment - 1) & ~(alignment - 1);

        copy(base, descriptor.initial, descriptor.stateSize);

        descriptor.relocate(base);

    }

    return ImageState { run, base };

}

/// Instantiate an admitted catalog graph under the caller's Create authority.

/// image is only a catalog index, never an entry address or runtime descriptor.

/// clear(base, size) zeros exactly the supplied physical allocation;

/// copy(destination, source, size) copies exactly the immutable initializer.

/// Both callbacks obey the serialization and lifetime rules of this module.

/// All capacity checks precede allocation; failure installs no authority or

/// domain incarnation and returns any provisionally allocated private frames.

export fn create(kernel: *mut state::State, caller: u32, authority: abi::Handle, image: u64, clear: fn(u64, u32), copy: fn(u64, u64, u32)) -> abi::Handle throws (abi::Error) {

    let creator = try domains::authority(kernel.domains, caller, authority, abi::CREATE);

    if creator.index <> caller { throw abi::Error::Denied; }

    if image >= images::COUNT as u64 { throw abi::Error::VerifyFailed; }

    let slot = try handles::vacant(&kernel.domains[caller].handles);

    let _domainSlot = try domains::vacant(kernel.domains);

    // Refresh only consumed event credits; do not reserve a child until commit.

    try events::refresh(&mut kernel.domains[caller].events);

    if kernel.domains[caller].events.reserved == events::CRITICAL {

        throw abi::Error::Exhausted;

    }

    let initial = try initialize(kernel.memory.pool, image as u32, clear, copy);

    // The consumer can publish another head during allocation. Revalidate it

    // when reserving the terminal event; even that late failure returns RAM.

    let object = try domains::create(kernel.domains, creator, image as u32) catch error {

        if initial.run.count <> 0 { frames::reclaim(kernel.memory.pool, initial.run); }

        throw error;

    };

    set kernel.domains[object.index].private = initial.run;

    set kernel.domains[object.index].env.stateBase = initial.base;

    return handles::install(&mut kernel.domains[caller].handles, slot, object, abi::DOMAIN_RIGHTS);

}

/// Return the base of a live writable Page containing bytes below stack.

/// A descending stack may start at the Page's exclusive end, but not its base.

fn stackBase(kernel: *state::State, domain: u32, stack: u64) -> u64 throws (abi::Error) {

    if stack & 15 <> 0 { throw abi::Error::InvalidArg; }

    for i in 0..abi::MAX_HANDLES {

        let entry = &kernel.domains[domain].handles.entries[i];

        if entry.object.kind <> abi::Kind::Page or entry.rights & abi::WRITE == 0

            or not resources::live(kernel.resources, kernel.domains, entry.object) { continue; }

        let case resources::Value::Page(page) = kernel.resources[entry.object.index].value else { panic "stackBase: page kind mismatch"; };

        let base = page.run.first as u64 * frames::PAGE_SIZE as u64;

        let end = base + page.run.count as u64 * frames::PAGE_SIZE as u64;

        if stack > base and stack <= end { return base; }

    }

    throw abi::Error::InvalidArg;

}

/// Prepare one context without altering the domain until all fallible work ends.

fn start(kernel: *mut state::State, owner: abi::Object, stack: u64, args: u64, size: u64, clear: fn(u64, u32), initial: bool) -> u64 throws (abi::Error) {

    let lifecycle = kernel.domains[owner.index].state;

    if initial {

        if lifecycle <> domains::Lifecycle::Pending { throw abi::Error::NotPending; }

    } else {

        if lifecycle <> domains::Lifecycle::Active { throw abi::Error::Busy; }

    }

    let base = try stackBase(kernel, owner.index, stack);

    if not pages::covers(kernel, owner.index, args, size, abi::READ) {

        throw abi::Error::InvalidArg;

    }

    let mut slot = kernel.contexts.len;

    for i in 0..kernel.contexts.len {

        let context = &kernel.contexts[i];

        if context.status == contexts::Status::Vacant and context.epoch < 0xffffffff {

            set slot = i;

            break;

        }

    }

    if slot == kernel.contexts.len { throw abi::Error::Exhausted; }

    let domain = &kernel.domains[owner.index];

    assert domain.image < images::COUNT;

    let descriptor = images::get(domain.image);

    let allocation = try frames::allocate(kernel.memory.pool, PRIVATE_STACK_SIZE / frames::PAGE_SIZE, clear) catch {

        throw abi::Error::OutOfMemory;

    };

    let private = frames::install(allocation);

    let privateBase = private.first as u64 * frames::PAGE_SIZE as u64;

    let env = domains::Env {

        argsPointer: args, argsSize: size,

        eventsHandle: domain.env.eventsHandle,

        eventsPointer: &domain.events.ring as u64,

        stateBase: domain.env.stateBase,

        stackBase: base, stackTop: stack, context: 0,

        privateStackBase: privateBase,

        privateStackTop: privateBase + PRIVATE_STACK_SIZE as u64,

    };

    // Architectural sp starts at the authorized Page stack. The image entry

    // selects env.privateStackTop for native locals and saved registers.

    try contexts::prepare(&mut kernel.contexts[slot], owner, descriptor.entry, stack, env) catch error {

        frames::reclaim(kernel.memory.pool, private);

        throw error;

    };

    set kernel.contexts[slot].private = private;

    let id = contexts::identity(&kernel.contexts[slot]);

    if initial {

        set kernel.domains[owner.index].env = kernel.contexts[slot].env;

        set kernel.domains[owner.index].state = domains::Lifecycle::Active;

    }

    return id;

}

/// Activate a Pending domain at its admitted entry and return its context ID.

/// Execute is required on target. stack is 16-aligned and above the base of a

/// live writable Page held by target, at most its exclusive end. Nonempty args

/// must be wholly covered by target's live readable Pages, including adjacency.

/// Failure leaves the domain Pending and context slots unchanged. No budget is

/// minted or bound and no hart is chosen. The dispatcher may discard this ID

/// for the void DomainActivate ABI. clear zeros exactly its supplied physical

/// byte range and obeys this module's caller serialization/callback invariants.

export fn activate(kernel: *mut state::State, caller: u32, target: abi::Handle, stack: u64, args: u64, size: u64, clear: fn(u64, u32)) -> u64 throws (abi::Error) {

    let owner = try domains::resolve(kernel.domains, caller, target, abi::EXECUTE);

    return try start(kernel, owner, stack, args, size, clear, true);

}

/// Add a context to an Active domain, always at that domain's admitted entry.

/// Requires Execute and the same stack/args and serialized clear contract as

/// activate; a Pending target returns Busy. Each context owns a distinct Env

/// and private stack but shares image state and Events with its domain. The

/// first environment/identity stays in Domain.env. No budget or hart is bound.

/// Failure preserves every existing context and the target's Active state.

export fn context(kernel: *mut state::State, caller: u32, target: abi::Handle, stack: u64, args: u64, size: u64, clear: fn(u64, u32)) -> u64 throws (abi::Error) {

    let owner = try domains::resolve(kernel.domains, caller, target, abi::EXECUTE);

    return try start(kernel, owner, stack, args, size, clear, false);

}

use core::frames;

    /// Lowest address in the authorized Page stack.

    /// Exclusive upper bound of the authorized Page stack.

    /// Lowest native stack address for locals and saved registers.

    /// Creation ancestry by slot; reuse clears only that slot's historical bit.

    /// Surviving ancestor bits outlive intermediate creator incarnations.

    ancestors: [u64; abi::MAX_DOMAINS / 64],

    /// First terminal event kind: Fault=3 or ChildExit=4; zero while live.

    terminalKind: u16,

    /// First terminal fault code or exit status; immutable while Dying.

    terminalCode: u32,

    /// Exclusive image-state frames, never Page claims or lifetime pins.

    /// A zero count means empty state; reclaim and zero after quiescence.

    /// env.stateBase may be aligned inside this run rather than at its base.

    private: frames::Run,

        set domain.ancestors = [0; abi::MAX_DOMAINS / 64];

        set domain.terminalKind = 0;

        set domain.terminalCode = 0;

        set domain.private = frames::Run { first: 0, count: 0 };

    // Index bits name only the current incarnation. Remove the old incarnation

    // without erasing surviving ancestry through an exited intermediate creator.

    let word = index / 64;

    let bit = 1 as u64 << (index as u64 & 63);

    for i in 0..domains.len { set domains[i].ancestors[word] &= ~bit; }

    assert domain.private.count == 0;

    set domain.ancestors = [0; abi::MAX_DOMAINS / 64];

    if creator.kind == abi::Kind::Domain {

        set domain.ancestors = domains[creator.index].ancestors;

        set domain.ancestors[creator.index / 64] |= 1 as u64 << (creator.index as u64 & 63);

    }

    set domain.terminalKind = 0;

    set domain.terminalCode = 0;

        argsPointer: 0, argsSize: 0, eventsHandle: eventHandle.bits,

        eventsPointer: &domain.events.ring as u64,

/// Find a reusable domain slot without changing its incarnation or authority.

/// Dead slots still owning private state must be reclaimed before reuse.

export fn vacant(domains: *[Domain]) -> u32 throws (abi::Error) {

            and domain.private.count == 0 and domain.handles.entries[1].generation <> 0 {

            return index;

/// Create a pending domain after the caller has authorized image admission.

/// Reserve terminal event capacity before accepting the parent relationship.

export fn create(domains: *mut [Domain], creator: abi::Object, image: u32) -> abi::Object throws (abi::Error) {

    if not live(domains, creator) { throw abi::Error::BadHandle; }

    let index = try vacant(domains);

    try events::reserve(&mut domains[creator.index].events);

    return prepare(domains, index, creator, image);

}

mod instances;

static DOMAINS: [domains::Domain; 3] = undefined;

static CONTEXTS: [contexts::Context; 3] = undefined;

static GRANTS: [u64; 3 * frames::MAX_FRAMES / 64] = undefined;

    assert hart == 0 and images::COUNT == 8;

    for i in 0..CONTEXTS.len { contexts::init(&mut CONTEXTS[i], i); }

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut CLAIMS[..], &mut GRANTS[..], 3);

    for i in 0..expected.len { run(i, expected[i], own, i == 5); }

    instances::run(&mut KERNEL, own, machine.clint.base);

//! Native proof of independent domain state and shared same-domain contexts.

use core::abi;

use core::activation;

use core::budget_caps;

use core::budgets;

use core::capabilities;

use core::clock;

use core::contexts;

use core::cpu;

use core::handles;

use core::pages;

use core::physical;

use core::resources;

use core::state;

/// Give one explicit context its own finite budget and observe its native Exit.

unsafe fn execute(kernel: *mut state::State, target: abi::Handle, id: u64, clint: u64, expected: u32) {

    let object = try! resources::create(kernel.resources, resources::Value::Budget(try! budgets::init(0, 1000000)));

    resources::retain(kernel.resources, object);

    let handle = handles::install(&mut kernel.domains[0].handles,

        try! handles::vacant(&kernel.domains[0].handles), object, abi::EXECUTE);

    try! budget_caps::bind(kernel, 0, handle, target, id);

    let index = try! contexts::resolve(kernel.contexts, id);

    let context = &mut kernel.contexts[index];

    let budget = budget_caps::value(kernel, object);

    let running = try! contexts::begin(context, budget, clock::read(clint), 0);

    clock::arm(clint, 0, context.deadline);

    clock::interrupts(128);

    cpu::enter(&mut context.frame);

    let stopped = clock::read(clint);

    clock::interrupts(0);

    clock::arm(clint, 0, 0xffffffffffffffff);

    assert contexts::finish(context, budget, running, stopped) > 0;

    assert context.frame.cause == 8 and context.frame.registers[17] == 49;

    assert context.frame.registers[10] == expected as u64;

    set context.status = contexts::Status::Stopped;

}

/// Instantiate one graph twice, then run two contexts in the first instance.

export unsafe fn run(kernel: *mut state::State, own: abi::Handle, clint: u64) {

    let image: u64 = 7;

    let first = try! activation::create(kernel, 0, own, image, physical::clear, physical::copy);

    let second = try! activation::create(kernel, 0, own, image, physical::clear, physical::copy);

    let page = try! pages::allocate(kernel, 0, own, 1, physical::clear);

    let range = try! pages::access(kernel, 0, page, abi::READ | abi::WRITE);

    let words = @sliceOf(physical::bytes(range.base, 8).ptr as *mut u32, 2);

    set words[0] = 1;

    set words[1] = 2;

    let _firstPage = try! capabilities::grant(kernel, 0, page, first, (abi::READ | abi::WRITE) as u64);

    let _secondPage = try! capabilities::grant(kernel, 0, page, second, (abi::READ | abi::WRITE) as u64);

    let top = range.base + range.size;

    let firstId = try! activation::activate(kernel, 0, first, top, range.base, 4, physical::clear);

    let extraId = try! activation::context(kernel, 0, first, top, range.base + 4, 4, physical::clear);

    let secondId = try! activation::activate(kernel, 0, second, top, range.base, 4, physical::clear);

    execute(kernel, first, firstId, clint, 42);

    execute(kernel, first, extraId, clint, 44);