export mod transactions;

use super::transactions;

/// Acquire page lifetime and publish an attenuated capability into a resolved table.

unsafe fn receive(store: &mut Store, target: &mut capability::Table, owner: abi::Ref,

    source: abi::Handle, entry: capability::Entry, rights: u64) -> abi::Handle throws (abi::Error)

{

    let receiver = target.owner;

    let pending = try transactions::reserve(target, owner, source, entry, rights, false);

    try retain(store, entry.object, receiver) catch err {

        transactions::cancel(target, pending); throw err;

    };

    return transactions::grant(target, pending);

}

/// Grant page authority to a separately resolved domain table.

/// The caller serializes both tables and page metadata through publication.

export unsafe fn grant(store: &mut Store, source: &capability::Table, target: &mut capability::Table,

    handle: abi::Handle, rights: u64) -> abi::Handle throws (abi::Error)

{

    let entry = try capability::lookup(source, handle, abi::Kind::Page, abi::Rights(0));

    return try receive(store, target, source.owner, handle, entry, rights);

}

/// Create a narrower page capability in the calling domain's table.

export unsafe fn selfGrant(store: &mut Store, table: &mut capability::Table, handle: abi::Handle, rights: u64)

    -> abi::Handle throws (abi::Error)

{

    let entry = try capability::lookup(table, handle, abi::Kind::Page, abi::Rights(0));

    let owner = table.owner;

    return try receive(store, table, owner, handle, entry, rights);

}

/// Move page authority without changing its handle count or ending source exposure.

/// The caller serializes the resolved domain tables and page metadata.

export unsafe fn transfer(store: &mut Store, source: &mut capability::Table, target: &mut capability::Table,

    handle: abi::Handle, rights: u64) -> abi::Handle throws (abi::Error)

{

    let entry = try capability::lookup(source, handle, abi::Kind::Page, abi::Rights(0));

    let page = try get(store, entry.object);

    let receiver = target.owner;

    let pending = try transactions::reserve(target, source.owner, handle, entry, rights, true);

    try backing::expose(&mut store.backings, page.backing, receiver) catch err {

        transactions::cancel(target, pending); throw err;

    };

    return transactions::transfer(source, target, pending);

}

/// Drop a page capability and release its object reference under serialization.

export fn drop(store: &mut Store, table: &mut capability::Table, handle: abi::Handle) throws (abi::Error) {

    let entry = try capability::lookup(table, handle, abi::Kind::Page, abi::Rights(0));

    try release(store, entry.object);

    let removed = try! capability::invalidate(table, handle);

}

export mod transactions;

/// Receiver table for page capability transactions.

unsafe static TARGET: capability::Table = undefined;

    try! pages::drop(&mut STORE, &mut TABLE, handle);

}

/// Transfers keep both domains exposed without duplicating page handles.

@test unsafe fn transferExposure() throws (testing::TestError) {

    initialize();

    let receiver = abi::Ref { index: 1, generation: 1 };

    capability::initialize(&mut TARGET, receiver);

    try! backing::registerDomain(&mut STORE.backings, receiver);

    let original = try! pages::allocate(&mut STORE, &mut TABLE, abi::Handle(0), 8);

    let entry = try! capability::get(&TABLE, original);

    let moved = try! pages::transfer(&mut STORE, &mut TABLE, &mut TARGET, original, abi::READ as u64);

    let page = try! pages::get(&STORE, entry.object);

    try testing::expect(page.handles == 1 and STORE.backings.records[page.backing.index].exposed == 2);

    let actual = try! capability::get(&TARGET, moved);

    try testing::expect(*actual.rights == abi::READ);

    try! pages::drop(&mut STORE, &mut TARGET, moved);

    try! backing::endDomain(&mut STORE.backings, receiver);

    try testing::expect(not STORE.backings.pool.free[0]);

    try! backing::endDomain(&mut STORE.backings, TABLE.owner);

    try testing::expect(STORE.backings.pool.free[0]);

}

/// Grants acquire references only after capacity and receiver checks succeed.

@test unsafe fn grantRollback() throws (testing::TestError) {

    initialize();

    let receiver = abi::Ref { index: 1, generation: 1 };

    capability::initialize(&mut TARGET, receiver);

    let original = try! pages::allocate(&mut STORE, &mut TABLE, abi::Handle(0), 2);

    let entry = try! capability::get(&TABLE, original);

    let page = try! pages::get(&STORE, entry.object);

    let mut dead = false;

    try pages::grant(&mut STORE, &TABLE, &mut TARGET, original, abi::READ as u64) catch err {

        try testing::expect(err == abi::Error::BadHandle); set dead = true;

    };

    try testing::expect(dead and TARGET.slots[0].state == slots::State::Free);

    let mut rejected = false;

    try pages::transfer(&mut STORE, &mut TABLE, &mut TARGET, original, abi::READ as u64) catch err {

        try testing::expect(err == abi::Error::BadHandle); set rejected = true;

    };

    try testing::expect(rejected and TARGET.slots[0].state == slots::State::Free);

    try testing::expect(try! capability::get(&TABLE, original) == entry);

    try! backing::registerDomain(&mut STORE.backings, receiver);

    for i in 0..limits::HANDLES {

        let filler = try! capability::install(&mut TARGET, capability::Entry {

            kind: abi::Kind::Domain, object: receiver, rights: abi::Rights(0),

        });

    }

    let mut full: u32 = 0;

    try pages::grant(&mut STORE, &TABLE, &mut TARGET, original, abi::READ as u64) catch err {

        try testing::expect(err == abi::Error::InvalidArg); set full += 1;

    };

    try pages::transfer(&mut STORE, &mut TABLE, &mut TARGET, original, abi::READ as u64) catch err {

        try testing::expect(err == abi::Error::InvalidArg); set full += 1;

    };

    try testing::expect(full == 2 and STORE.records[entry.object.index].handles == 1);

    try testing::expect(STORE.backings.records[page.backing.index].exposed == 1);

    try testing::expect(try! capability::get(&TABLE, original) == entry);

    let filler = try! capability::at(&TARGET, 0, abi::Kind::Domain);

    let removed = try! capability::invalidate(&mut TARGET, filler);

    let granted = try! pages::grant(&mut STORE, &TABLE, &mut TARGET, original, abi::READ as u64);

    try testing::expect(STORE.records[entry.object.index].handles == 2);

    try testing::expect(STORE.backings.records[page.backing.index].exposed == 2);

    drop(original);

    try! pages::drop(&mut STORE, &mut TARGET, granted);

    try! backing::endDomain(&mut STORE.backings, TABLE.owner);

    try testing::expect(not STORE.backings.pool.free[0]);

    try! backing::endDomain(&mut STORE.backings, receiver);

    try testing::expect(STORE.backings.pool.free[0]);

}

/// Self-attenuation adds one reference, preserves authority, and prevents splitting.

@test unsafe fn selfAttenuation() throws (testing::TestError) {

    initialize();

    let original = try! pages::allocate(&mut STORE, &mut TABLE, abi::Handle(0), 2);

    let copy = try! pages::selfGrant(&mut STORE, &mut TABLE, original, abi::READ as u64);

    let entry = try! capability::get(&TABLE, copy);

    try testing::expect(*entry.rights == abi::READ and STORE.records[entry.object.index].handles == 2);

    let narrowed = try! pages::selfGrant(&mut STORE, &mut TABLE, copy, abi::WRITE as u64);

    let none = try! capability::get(&TABLE, narrowed);

    try testing::expect(*none.rights == 0);

    drop(narrowed); drop(copy);

    let right = try! pages::split(&mut STORE, &mut TABLE, original, 1);

    drop(original); drop(right);

    try! backing::endDomain(&mut STORE.backings, TABLE.owner);

    try testing::expect(STORE.backings.pool.free[0] and STORE.backings.pool.free[1]);

//! Atomic capability publication and delegation rules.

use std::testing;

use kernel::abi;

use kernel::limits;

use kernel::slots;

use kernel::capability;

use kernel::transactions;

/// Sender table used by serialized transactions.

unsafe static SOURCE: capability::Table = undefined;

/// Receiver table used by serialized transactions.

unsafe static TARGET: capability::Table = undefined;

/// Initialize two independent domain tables.

unsafe fn initialize() {

    capability::initialize(&mut SOURCE, abi::Ref { index: 0, generation: 1 });

    capability::initialize(&mut TARGET, abi::Ref { index: 1, generation: 1 });

}

/// Install test authority whose object lifetime belongs to the caller.

unsafe fn install(kind: abi::Kind, rights: u16) -> abi::Handle {

    return try! capability::install(&mut SOURCE, capability::Entry {

        kind, object: abi::Ref { index: 7, generation: 1 }, rights: abi::Rights(rights),

    });

}

/// Transfer failure preserves source authority; successful publication invalidates it.

@test unsafe fn atomicTransfer() throws (testing::TestError) {

    initialize();

    let source = install(abi::Kind::Budget, abi::READ | abi::TRANSFER);

    let entry = try! capability::get(&SOURCE, source);

    for i in 0..limits::HANDLES { let filler = try! capability::install(&mut TARGET, entry); }

    let mut full = false;

    try move(source) catch err { try testing::expect(err == abi::Error::InvalidArg); set full = true; };

    try testing::expect(full and try! capability::get(&SOURCE, source) == entry);

    let first = try! capability::at(&TARGET, 0, abi::Kind::Budget);

    let removed = try! capability::invalidate(&mut TARGET, first);

    let moved = try! move(source);

    let actual = try! capability::get(&TARGET, moved);

    try testing::expect(actual.object == entry.object and *actual.rights == abi::READ);

    let mut stale = false;

    try capability::get(&SOURCE, source) catch err {

        try testing::expect(err == abi::Error::BadHandle); set stale = true;

    };

    try testing::expect(stale);

}

/// Complete a transfer after any required object-specific ownership update.

unsafe fn move(source: abi::Handle) -> abi::Handle throws (abi::Error) {

    let entry = try capability::get(&SOURCE, source);

    let owner = SOURCE.owner;

    let pending = try transactions::reserve(&mut TARGET, owner, source, entry, abi::READ as u64, true);

    return transactions::transfer(&mut SOURCE, &mut TARGET, pending);

}

/// Self-grants narrow rights without requiring Grant; budgets remain exclusive.

@test unsafe fn selfGrant() throws (testing::TestError) {

    initialize();

    let source = install(abi::Kind::Events, abi::READ | abi::WRITE);

    let entry = try! capability::get(&SOURCE, source);

    let owner = SOURCE.owner;

    let pending = try! transactions::reserve(&mut SOURCE, owner, source, entry, abi::READ as u64, false);

    let copy = transactions::grant(&mut SOURCE, pending);

    let narrowed = try! capability::get(&SOURCE, copy);

    try testing::expect(*narrowed.rights == abi::READ);

    try testing::expect(try! capability::get(&SOURCE, source) == entry);

    let budget = install(abi::Kind::Budget, abi::GRANT | abi::TRANSFER);

    let budgetEntry = try! capability::get(&SOURCE, budget);

    let mut denied = false;

    try probe(owner, budget, budgetEntry, false) catch err {

        try testing::expect(err == abi::Error::Denied); set denied = true;

    };

    try testing::expect(denied);

}

/// Reserve and cancel a policy probe without leaving an outstanding token.

unsafe fn probe(owner: abi::Ref, handle: abi::Handle, entry: capability::Entry, moving: bool) throws (abi::Error) {

    let pending = try transactions::reserve(&mut TARGET, owner, handle, entry, abi::RIGHTS_MASK as u64, moving);

    transactions::cancel(&mut TARGET, pending);

}

/// Nondelegable kinds and missing rights fail before consuming target capacity.

@test unsafe fn delegation() throws (testing::TestError) {

    initialize();

    let mut failures: u32 = 0;

    for kind in &[abi::Kind::Events, abi::Kind::Interrupt, abi::Kind::Budget, abi::Kind::Page] {

        let source = install(kind, 0);

        let entry = try! capability::get(&SOURCE, source);

        try probe(SOURCE.owner, source, entry, false) catch err {

            try testing::expect(err == abi::Error::Denied); set failures += 1;

        };

    }

    let events = install(abi::Kind::Events, abi::TRANSFER);

    let entry = try! capability::get(&SOURCE, events);

    try probe(SOURCE.owner, events, entry, true) catch err {

        try testing::expect(err == abi::Error::Denied); set failures += 1;

    };

    try testing::expect(failures == 5 and TARGET.slots[0].generation == 1);

    let interrupt = install(abi::Kind::Interrupt, abi::TRANSFER);

    let moved = try! move(interrupt);

    let actual = try! capability::get(&TARGET, moved);

    try testing::expect(actual.kind == abi::Kind::Interrupt);

}

/// Cancelled object work leaves no published capability and restores capacity.

@test unsafe fn cancellation() throws (testing::TestError) {

    initialize();

    let source = install(abi::Kind::Page, abi::GRANT | abi::READ);

    let entry = try! capability::get(&SOURCE, source);

    let owner = SOURCE.owner;

    let pending = try! transactions::reserve(&mut TARGET, owner, source, entry, abi::READ as u64, false);

    try testing::expect(TARGET.slots[0].state == slots::State::Reserved);

    transactions::cancel(&mut TARGET, pending);

    try testing::expect(TARGET.slots[0].state == slots::State::Free);

    try testing::expect(try! capability::get(&SOURCE, source) == entry);

}

/// Invalid masks, self-transfers, and budget self-grants preserve table state.

@test unsafe fn policyBoundaries() throws (testing::TestError) {

    initialize();

    let source = install(abi::Kind::Budget, abi::GRANT | abi::TRANSFER);

    let entry = try! capability::get(&SOURCE, source);

    let mut failures: u32 = 0;

    try selfProbe(source, entry, 0, true) catch err {

        try testing::expect(err == abi::Error::InvalidArg); set failures += 1;

    };

    try selfProbe(source, entry, 0, false) catch err {

        try testing::expect(err == abi::Error::Denied); set failures += 1;

    };

    try selfProbe(source, entry, 0xffffffffffffffff, false) catch err {

        try testing::expect(err == abi::Error::InvalidArg); set failures += 1;

    };

    try testing::expect(failures == 3 and SOURCE.slots[1].generation == 1);

    try testing::expect(try! capability::get(&SOURCE, source) == entry);

}

/// Consume a successful self-directed policy probe without publishing it.

unsafe fn selfProbe(handle: abi::Handle, entry: capability::Entry, rights: u64, moving: bool) throws (abi::Error) {

    let owner = SOURCE.owner;

    let pending = try transactions::reserve(&mut SOURCE, owner, handle, entry, rights, moving);

    transactions::cancel(&mut SOURCE, pending);

}

/// Only the installed Events handle is protected from drop; attenuated copies can end.

@test unsafe fn installedEvents() throws (testing::TestError) {

    initialize();

    let installed = install(abi::Kind::Events, abi::READ | abi::WRITE);

    let entry = try! capability::get(&SOURCE, installed);

    let owner = SOURCE.owner;

    let pending = try! transactions::reserve(&mut SOURCE, owner, installed, entry, abi::READ as u64, false);

    let copy = transactions::grant(&mut SOURCE, pending);

    let mut denied = false;

    try transactions::dropping(&SOURCE, installed, installed) catch err {

        try testing::expect(err == abi::Error::Denied); set denied = true;

    };

    try testing::expect(denied);

    let allowed = try! transactions::dropping(&SOURCE, copy, installed);

    let removed = try! capability::invalidate(&mut SOURCE, copy);

    try testing::expect(removed == allowed and try! capability::get(&SOURCE, installed) == entry);

    let mut stale = false;

    try transactions::dropping(&SOURCE, copy, installed) catch err {

        try testing::expect(err == abi::Error::BadHandle); set stale = true;

    };

    try testing::expect(stale);

}

//! Capability reservations held within one serialized object transaction.

use super::abi;

use super::slots;

use super::capability;

/// Metadata for unpublished authority and its source.

export record Pending: Copy {

    /// Destination domain generation.

    target: abi::Ref,

    /// Reserved slot in the destination table.

    slot: abi::Ref,

    /// Source domain generation.

    owner: abi::Ref,

    /// Source capability to invalidate on transfer.

    source: abi::Handle,

    /// Validated source entry before attenuation.

    original: capability::Entry,

    /// Attenuated entry to publish after object work succeeds.

    entry: capability::Entry,

    /// True when publication also consumes the source capability.

    moving: bool,

}

/// Unpublished capacity that must be committed or cancelled in the same table.

export union Reservation: Once {

    /// One destination slot and the authority it will receive.

    Held(Pending),

}

/// Reserve target capacity after delegation checks and rights validation.

/// The caller supplies a live source entry and keeps both tables serialized

/// through object validation, lifetime changes, and commit or cancellation.

export fn reserve(target: &mut capability::Table, owner: abi::Ref, source: abi::Handle,

    original: capability::Entry, rights: u64, moving: bool) -> Reservation throws (abi::Error)

{

    let requested = try abi::rights(rights);

    let own = owner == target.owner;

    if moving {

        if own { throw abi::Error::InvalidArg; }

        if original.kind == abi::Kind::Events or not abi::permits(original.rights, abi::Rights(abi::TRANSFER)) {

            throw abi::Error::Denied;

        }

    } else {

        if original.kind == abi::Kind::Interrupt or original.kind == abi::Kind::Budget { throw abi::Error::Denied; }

        if not own and (original.kind == abi::Kind::Events or not abi::permits(original.rights, abi::Rights(abi::GRANT))) {

            throw abi::Error::Denied;

        }

    }

    let reservation = try slots::reserve(&mut target.slots[..]) catch err { throw abi::Error::InvalidArg; };

    match reservation {

        case slots::Reservation::Held(slot) => return Reservation::Held(Pending {

            target: target.owner, slot, owner, source, original,

            entry: capability::Entry { kind: original.kind, object: original.object,

                rights: abi::Rights(*original.rights & *requested) },

            moving,

        }),

    }

}

/// Check the reserved destination before any publication or cancellation.

fn require(target: &capability::Table, pending: &Pending) {

    assert target.owner == pending.target;

    assert slots::matches(&target.slots[..], pending.slot, slots::State::Reserved);

}

/// Restore target capacity after object validation or lifetime acquisition fails.

export fn cancel(target: &mut capability::Table, reservation: Reservation) {

    match reservation {

        case Reservation::Held(pending) => {

            require(target, &pending);

            try! slots::cancel(&mut target.slots[..], slots::Reservation::Held(pending.slot));

        },

    }

}

/// Publish a grant after acquiring its object reference and lifetime exposure.

export fn grant(target: &mut capability::Table, reservation: Reservation) -> abi::Handle {

    match reservation {

        case Reservation::Held(pending) => {

            require(target, &pending);

            assert not pending.moving;

            return capability::publish(target, slots::Reservation::Held(pending.slot), pending.entry);

        },

    }

}

/// Publish a transfer after object ownership and exposure updates succeed.

/// The caller holds serialization over both tables for the complete transaction.

export fn transfer(source: &mut capability::Table, target: &mut capability::Table, reservation: Reservation) -> abi::Handle {

    match reservation {

        case Reservation::Held(pending) => {

            require(target, &pending);

            assert pending.moving and source.owner == pending.owner;

            assert try! capability::get(source, pending.source) == pending.original;

            let result = capability::publish(target, slots::Reservation::Held(pending.slot), pending.entry);

            let removed = try! capability::invalidate(source, pending.source);

            return result;

        },

    }

}

/// Validate drop authority before object-specific lifetime release.

/// installedEvents is the domain's original queue handle, or zero before installation.

export fn dropping(table: &capability::Table, handle: abi::Handle, installedEvents: abi::Handle)

    -> capability::Entry throws (abi::Error)

{

    let entry = try capability::get(table, handle);

    if handle == installedEvents { throw abi::Error::Denied; }

    return entry;

}