export mod registry;

use super::registry;

use std::arch::rv64::shared::catalog;

export unsafe fn enter(hart: u64, tree: *u8, stackTop: u64, entries: *catalog::Entry, entryCount: u32, stateTable: *u64) -> bool {

        assert entryCount == 2;

        registry::initialize(&mut registry::STORE);

        let bootCatalog = @sliceOf(entries, entryCount);

        try! registry::boot(&mut registry::STORE, &bootCatalog[..]);

        let library = registry::find(&registry::STORE, &"std"[..]) else panic "boot std";

        let kernel = registry::find(&registry::STORE, &"kernel"[..]) else panic "boot kernel";

        assert library.index == 0 and kernel.index == 1;

        let bases = @sliceOf(stateTable, limits::PACKAGES);

        assert bases[library.index] <> 0 and bases[kernel.index] <> 0;

        print("kernel: boot catalog ready\n");

        stackTop: stack.end, stackBottom: stack.start, kernelGp: stateTable as u64, handler: unexpected,

    mv %a5 %gp;

//! Immutable resident packages shared by boot and runtime loading.

use std::mem;

use std::arch::rv64::shared;

use std::arch::rv64::shared::catalog;

use super::abi;

use super::limits;

use super::slots;

use super::capability;

/// Rights installed on a new Image capability.

export constant IMAGE_RIGHTS: u16 = abi::READ | abi::EXECUTE | abi::GRANT | abi::TRANSFER;

/// Fixed package registry. Callers serialize admission and handle publication.

export record Store: Copy {

    /// Package generations; published slots remain live until shutdown.

    slots: [slots::Slot; limits::PACKAGES],

    /// Descriptors whose backing storage remains resident until shutdown.

    entries: [catalog::Entry; limits::PACKAGES],

    /// Resolved dependencies in each package's declared order.

    dependencies: [[abi::Ref; limits::PACKAGES]; limits::PACKAGES],

    /// Number of valid resolved dependencies per live package.

    counts: [u32; limits::PACKAGES],

}

/// Global resident package registry shared by all domains.

export unsafe static STORE: Store = undefined;

/// Initialize an empty registry before loading any native package.

export fn initialize(store: &mut Store) { slots::initialize(&mut store.slots[..]); }

/// Find a resident package by its immutable name.

export fn find(store: &Store, name: &[u8]) -> ?abi::Ref {

    for i in 0..limits::PACKAGES {

        if store.slots[i].state <> slots::State::Live {

            continue;

        }

        if mem::eq(store.entries[i].package.name, &name[..]) {

            return abi::Ref { index: i, generation: store.slots[i].generation };

        }

    }

    return nil;

}

/// Reuse identical content and reject conflicting content under a resident name.

export fn identify(store: &Store, name: &[u8], source: &[u8]) -> ?abi::Ref throws (abi::Error) {

    let object = find(store, name) else {

        return nil;

    };

    if not mem::eq(store.entries[object.index].source, &source[..]) {

        throw abi::Error::VerifyFailed;

    }

    return object;

}

/// Reserve the stable package-state slot before compiling its native code.

export fn reserve(store: &mut Store) -> slots::Reservation throws (abi::Error) {

    return try slots::reserve(&mut store.slots[..]);

}

/// Return unpublished capacity after a failed load.

export fn cancel(store: &mut Store, reservation: slots::Reservation) {

    try! slots::cancel(&mut store.slots[..], reservation);

}

/// Validate dependencies without changing registry payloads.

unsafe fn validate(store: &Store, object: abi::Ref, package: &shared::Package) throws (abi::Error) {

    if package.name.len == 0 or package.slot <> object.index or package.dependencies.len > limits::PACKAGES {

        throw abi::Error::VerifyFailed;

    }

    for dependency, i in package.dependencies {

        let target = find(store, &dependency[..]) else {

            throw abi::Error::VerifyFailed;

        };

        for prior in &package.dependencies[..i] {

            if mem::eq(prior, dependency) {

                throw abi::Error::VerifyFailed;

            }

        }

    }

}

/// Publish persistent compiler output after successful admission checks.

/// All descriptor pointers and source bytes must remain immutable and resident.

/// Failure cancels the reservation; duplicate content returns its existing slot.

export unsafe fn publish(store: &mut Store, reservation: slots::Reservation, source: *[u8], package: shared::Package)

    -> abi::Ref throws (abi::Error)

{

    let existing = try identify(store, &package.name[..], &source[..]) catch err {

        cancel(store, reservation); throw err;

    };

    if let object = existing {

        cancel(store, reservation);

        return object;

    }

    let object = slots::reference(&reservation);

    try validate(store, object, &package) catch err {

        cancel(store, reservation);

        throw err;

    };

    for dependency, i in package.dependencies {

        let target = find(store, &dependency[..]) else panic "resident dependency";

        set store.dependencies[object.index][i] = target;

    }

    set store.counts[object.index] = package.dependencies.len;

    set store.entries[object.index] = catalog::Entry { source, package };

    return try! slots::commit(&mut store.slots[..], reservation);

}

/// Read resident metadata through a generation-bearing package reference.

export fn get(store: &Store, object: abi::Ref) -> shared::Package throws (abi::Error) {

    if not slots::matches(&store.slots[..], object, slots::State::Live) {

        throw abi::Error::BadHandle;

    }

    return store.entries[object.index].package;

}

/// Resolve one public symbol without searching packages outside the named image.

export fn exported(store: &Store, object: abi::Ref, name: &[u8]) -> shared::Target throws (abi::Error) {

    let package = try get(store, object);

    let target = shared::lookup(package.exports, &name[..]) else {

        throw abi::Error::VerifyFailed;

    };

    return target;

}

/// Collect exports from declared dependencies into caller-owned compiler storage.

export fn imports(store: &Store, dependencies: &[*[u8]], output: &mut [shared::Symbol]) -> u32 throws (abi::Error) {

    let mut count: u32 = 0;

    for name in dependencies {

        let object = find(store, &name[..]) else {

            throw abi::Error::VerifyFailed;

        };

        let package = try! get(store, object);

        if package.exports.len > output.len - count {

            throw abi::Error::Exhausted;

        }

        set count += package.exports.len;

    }

    set count = 0;

    for name in dependencies {

        let object = find(store, &name[..]) else panic "resident dependency";

        let package = try! get(store, object);

        for symbol in package.exports {

            set output[count] = symbol;

            set count += 1;

        }

    }

    return count;

}

/// Register a persistent boot catalog in dependency order through normal admission.

export unsafe fn boot(store: &mut Store, catalog: &[catalog::Entry]) throws (abi::Error) {

    for entry in catalog {

        let existing = try identify(store, &entry.package.name[..], &entry.source[..]);

        if existing <> nil {

            continue;

        }

        let reservation = try reserve(store);

        let object = try publish(store, reservation, entry.source, entry.package);

    }

}

/// Install an Image handle for a resident package without duplicating its code.

export fn install(store: &Store, table: &mut capability::Table, object: abi::Ref) -> abi::Handle throws (abi::Error) {

    let package = try get(store, object);

    return try capability::install(table, capability::Entry {

        kind: abi::Kind::Image, object, rights: abi::Rights(IMAGE_RIGHTS),

    });

}

/// Resolve image authority and validate its resident package generation.

export fn image(store: &Store, table: &capability::Table, handle: abi::Handle, rights: abi::Rights) -> abi::Ref throws (abi::Error) {

    let entry = try capability::lookup(table, handle, abi::Kind::Image, rights);

    let package = try get(store, entry.object);

    return entry.object;

}

export mod registry;

//! Resident package identity, dependency admission, and image capabilities.

use std::testing;

use std::arch::rv64::shared;

use std::arch::rv64::shared::catalog;

use kernel::abi;

use kernel::slots;

use kernel::capability;

use kernel::registry;

/// Resident registry metadata workspace.

unsafe static STORE: registry::Store = undefined;

/// Persistent distinct names for complete registry exhaustion.

unsafe static NAMES: [[u8; 4]; 256] = undefined;

/// Construct persistent compiled metadata for registry contract tests.

fn package(name: *[u8], dependencies: *unsafe [*[u8]], slot: u32) -> shared::Package {

    return shared::Package {

        name, dependencies, slot, codeAddress: 0x80000000 + slot as u64 * 4096,

        code: &[0x00008067 as u32], exports: &[], entry: nil,

        template: &[], memory: 0, alignment: 8, relocations: &[],

    };

}

/// Admit persistent package bytes and metadata through a reserved registry slot.

unsafe fn register(name: *[u8], dependencies: *unsafe [*[u8]], bytes: *[u8]) -> abi::Ref throws (abi::Error) {

    let pending = try registry::reserve(&mut STORE);

    let slot = slots::reference(&pending);

    return try registry::publish(&mut STORE, pending, bytes, package(name, dependencies, slot.index));

}

/// Identical bytes reuse one package; a name cannot identify different content.

@test unsafe fn identity() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    let first = try! register("a", &[], "binary a");

    let second = try! register("a", &[], "binary a");

    try testing::expect(first == second and STORE.slots[1].state == slots::State::Free);

    let found = try! registry::identify(&STORE, &"a"[..], &"binary a"[..]);

    try testing::expect(found == first);

    let mut conflict = false;

    try register("a", &[], "different") catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set conflict = true;

    };

    try testing::expect(conflict and STORE.slots[1].state == slots::State::Free);

}

/// Dependencies must already be resident and retain shared identity in a diamond.

@test unsafe fn dependencyGraph() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    let mut missing = false;

    try register("left", &["base"], "left") catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set missing = true;

    };

    try testing::expect(missing and STORE.slots[0].state == slots::State::Free);

    let base = try! register("base", &[], "base");

    let left = try! register("left", &["base"], "left");

    let right = try! register("right", &["base"], "right");

    let root = try! register("root", &["left", "right"], "root");

    try testing::expect(STORE.dependencies[left.index][0] == base and STORE.dependencies[right.index][0] == base);

    try testing::expect(STORE.dependencies[root.index][0] == left and STORE.dependencies[root.index][1] == right);

}

/// Image handles name resident packages and dropping a handle does not unload code.

@test unsafe fn images() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    let object = try! register("image", &[], "image");

    let mut table: capability::Table = undefined;

    capability::initialize(&mut table, abi::Ref { index: 0, generation: 1 });

    let handle = try! registry::install(&STORE, &mut table, object);

    let found = try! registry::image(&STORE, &table, handle, abi::Rights(abi::EXECUTE));

    try testing::expect(found == object);

    let removed = try! capability::invalidate(&mut table, handle);

    let resident = try! registry::get(&STORE, object);

    try testing::expect(resident.slot == object.index);

    let mut stale = false;

    try registry::image(&STORE, &table, handle, abi::Rights(0)) catch err {

        try testing::expect(err == abi::Error::BadHandle); set stale = true;

    };

    try testing::expect(stale);

}

/// Boot admission uses the same identity and dependency records as runtime publication.

@test unsafe fn bootCatalog() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    let catalog = [

        catalog::Entry { source: "base", package: package("base", &[], 0) },

        catalog::Entry { source: "app", package: package("app", &["base"], 1) },

    ];

    try! registry::boot(&mut STORE, &catalog[..]);

    try! registry::boot(&mut STORE, &catalog[..]);

    try testing::expect(STORE.counts[1] == 1 and STORE.dependencies[1][0].index == 0);

    try testing::expect(STORE.slots[2].state == slots::State::Free);

}

/// Export lookup and dependency import collection preserve code and private-data targets.

@test unsafe fn exports() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    let pending = try! registry::reserve(&mut STORE);

    let mut native = package("base", &[], 0);

    set native.exports = &[

        shared::Symbol { name: "base::run", target: shared::Target::Function(0x80000000) },

        shared::Symbol { name: "base::state", target: shared::Target::Data(shared::DataRef { slot: 0, offset: 8 }) },

    ];

    let object = try! registry::publish(&mut STORE, pending, "base", native);

    let target = try! registry::exported(&STORE, object, &"base::run"[..]);

    try testing::expect(target == shared::Target::Function(0x80000000));

    let mut output: [shared::Symbol; 2] = undefined;

    let count = try! registry::imports(&STORE, &["base"], &mut output[..]);

    try testing::expect(count == 2 and output[1].target == shared::Target::Data(shared::DataRef { slot: 0, offset: 8 }));

    let saved = output[0];

    let mut failures: u32 = 0;

    try registry::imports(&STORE, &["base"], &mut output[..1]) catch err {

        try testing::expect(err == abi::Error::Exhausted); set failures += 1;

    };

    try registry::exported(&STORE, object, &"base::private"[..]) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failures += 1;

    };

    try registry::imports(&STORE, &["absent"], &mut output[..]) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failures += 1;

    };

    try testing::expect(failures == 3 and output[0] == saved);

}

/// Full registry exhaustion leaves existing packages available for duplicate lookup.

@test unsafe fn capacity() throws (testing::TestError) {

    registry::initialize(&mut STORE);

    for i in 0..256 {

        set NAMES[i] = [112 as u8, (48 + i / 100) as u8, (48 + (i / 10) % 10) as u8, (48 + i % 10) as u8];

        let object = try! register(&NAMES[i][..], &[], &NAMES[i][..]);

        try testing::expect(object.index == i);

    }

    let mut full = false;

    try register("extra", &[], "extra") catch err {

        try testing::expect(err == abi::Error::Exhausted); set full = true;

    };

    try testing::expect(full);

    let found = try! registry::identify(&STORE, &NAMES[255][..], &NAMES[255][..]) else panic "resident package";

    try testing::expect(found.index == 255);

}

//! Build a native kernel image with shared packages and a persistent boot catalog.

use std::arch::rv64::emit;

use std::arch::rv64::encode;

use std::arch::rv64::shared;

use std::arch::rv64::shared::catalog;

/// Native entry page, above the platform firmware data.

/// Package code arenas retained until image output completes.

unsafe static CODE: [[u8; 16777216]; 2] = undefined;

/// Persistent decoded RIL storage.

/// Exact package bytes retained in the native catalog.

unsafe static INPUT: [[u8; 8388608]; 2] = undefined;

/// Combined startup and boundary assembly source.

/// Assembly identifiers retained through package linking.

/// Per-package data layout workspaces.

unsafe static DATA: [[data::DataSym; 4096]; 2] = undefined;

/// Local function and data definitions.

unsafe static SYMBOLS: [[shared::Symbol; 4096]; 2] = undefined;

/// Public package symbols.

unsafe static EXPORTS: [[shared::Symbol; 4096]; 2] = undefined;

/// Private-state relocation records.

unsafe static RELOCS: [[shared::Relocation; 4096]; 2] = undefined;

/// Initialized package templates.

unsafe static TEMPLATES: [[u8; 1048576]; 2] = undefined;

/// Read-only catalog and retained package payloads.

static RO: [u8; 16777216] = [0; 16777216];

/// Kernel state table and initialized private package graph.

static RW: [u8; 33554432] = [0; 33554432];

/// Contiguous native code segment, including entry trampoline and alignment padding.

static NATIVE: [u32; 4194304] = [0; 4194304];

/// Round an extent up to a power-of-two alignment.

fn aligned(value: u64, alignment: u32) -> u64 {

    assert alignment > 0 and (alignment & (alignment - 1)) == 0;

    assert value <= 0xffffffffffffffff - alignment as u64 + 1;

    return (value + alignment as u64 - 1) & ~(alignment as u64 - 1);

/// Print a bounded shared-backend failure class.

fn report(error: shared::Error) {

        case shared::Error::Codegen(_) => io::printLn("native build: code generation failed"),

        case shared::Error::Capacity => io::printLn("native build: output capacity exhausted"),

        case shared::Error::Symbol => io::printLn("native build: unresolved or duplicate symbol"),

        case shared::Error::Range => io::printLn("native build: address out of range"),

        case shared::Error::Alignment => io::printLn("native build: invalid alignment"),

        case shared::Error::Instance => io::printLn("native build: missing package instance"),

/// Compile one boot package into resident code and private-state metadata.

unsafe fn compile(input: &binary::Package, slot: u32, address: u64, imports: &[shared::Symbol], assembly: asm::Program)

    -> shared::Package throws (shared::Error)

{

    let mut arena = alloc::new(&mut CODE[slot][..]);

    let mut scratch = alloc::new(&mut SCRATCH[..]);

    return try shared::compileAssembly(shared::AssemblyInput { package: input as *unsafe binary::Package, assembly }, slot, address, imports,

        shared::Storage {

            data: &mut DATA[slot][..], symbols: &mut SYMBOLS[slot][..], exports: &mut EXPORTS[slot][..],

            template: &mut TEMPLATES[slot][..], relocations: &mut RELOCS[slot][..],

        }, &mut arena, &mut scratch);

}

/// Emit a trampoline that preserves firmware arguments and supplies the native catalog.

unsafe fn trampoline(kernel: u64, ro: u64, rw: u64) {

    let mut arena = alloc::new(&mut SCRATCH[..]);

    let mut e = try! emit::emitter(&mut arena, false);

    emit::loadImm(&mut e, rv64::GP, rw as i64);

    emit::loadImm(&mut e, rv64::A3, ro as i64);

    emit::loadImm(&mut e, rv64::A4, 2);

    emit::loadImm(&mut e, rv64::T0, kernel as i64);

    emit::emit(&mut e, encode::jalr(rv64::ZERO, rv64::T0, 0));

    assert e.codeLen <= 1024;

    for word, i in emit::getCode(&e) {

        set NATIVE[i] = word;

    }

}

/// Link shared boot packages, retain their catalog, and instantiate the kernel graph.

    let libraryBytesLength = unix::readFile(env.args[1], &mut INPUT[0][..]) else panic "std RIL";

    let libraryBytes = &INPUT[0][..libraryBytesLength];

    let libraryInput = try! program::decode(libraryBytes, &mut decoder, binary::Limits { registers: 8192, blocks: 4096 });

    let kernelBytesLength = unix::readFile(env.args[2], &mut INPUT[1][..]) else panic "kernel RIL";

    let kernelBytes = &INPUT[1][..kernelBytesLength];

    let kernelInput = try! program::decode(kernelBytes, &mut decoder, binary::Limits { registers: 8192, blocks: 4096 });

    assert mem::eq(libraryInput.name, "std") and mem::eq(kernelInput.name, "kernel");

    assert libraryInput.dependencies.len == 0;

    for dependency in kernelInput.dependencies {

    let mut assemblyArena = alloc::new(&mut ASSEMBLY[..]);

    let assembly = try! asm::assemble(asm::scanner::SourceKind::String, &SOURCE[..sourceLength],

        &mut TEXT[..], &mut empty[..], &mut assemblyArena, &mut STRINGS, 0);

    let library = try compile(&libraryInput, 0, CODE_ADDRESS + 4096, &[],

        asm::Program { text: &[], data: &[], symbols: &[], externalFixups: &[] }) catch error {

    let kernelAddress = aligned(library.codeAddress + library.code.len as u64 * 4, 4096);

    let kernel = try compile(&kernelInput, 1, kernelAddress, library.exports, assembly) catch error {

        report(error);

        return 1;

    };

    let entries = [

        catalog::Entry { source: libraryBytes, package: library },

        catalog::Entry { source: kernelBytes, package: kernel },

    ];

    let codeEnd = kernel.codeAddress + kernel.code.len as u64 * 4;

    let codeSize = (codeEnd - CODE_ADDRESS) as u32;

    assert codeEnd - CODE_ADDRESS <= @sizeOf([u32; 4194304]) as u64;

    let roAddress = aligned(codeEnd, 4096);

    let roSize = try catalog::pack(&entries[..], roAddress, &mut RO[..]) catch error {

        report(error);

        return 1;

    };

    let rwAddress = aligned(roAddress + roSize as u64, 4096);

    let mut bases: [u64; shared::MAX_PACKAGES] = [0; shared::MAX_PACKAGES];

    let mut rwSize: u32 = @sizeOf([u64; shared::MAX_PACKAGES]);

    for entry in &entries[..] {

        let at = aligned(rwAddress + rwSize as u64, entry.package.alignment);

        assert at - rwAddress <= RW.len as u64 and entry.package.memory <= RW.len - (at - rwAddress) as u32;

        set bases[entry.package.slot] = at;

        set rwSize = (at - rwAddress) as u32 + entry.package.memory;

    }

    try! mem::copy(&mut RW[..@sizeOf([u64; shared::MAX_PACKAGES])],

        @sliceOf(&bases[0] as *unsafe u8, @sizeOf([u64; shared::MAX_PACKAGES])));

    for entry in &entries[..] {

        let at = (bases[entry.package.slot] - rwAddress) as u32;

        try shared::instantiate(&entry.package, &bases[..], &mut RW[at..at + entry.package.memory])

            catch error {

                report(error);

                return 1;

            };

    }

    for i in 0..codeSize / 4 {

        set NATIVE[i] = encode::nop();

    }

    for entry in &entries[..] {

        let at = ((entry.package.codeAddress - CODE_ADDRESS) / 4) as u32;

        for word, i in entry.package.code {

            set NATIVE[at + i] = word;

        }

    }

    trampoline(kernelAddress, roAddress, rwAddress);

    let header = try! image::header(image::Layout {

        entry: CODE_ADDRESS,

        code: image::Segment { address: CODE_ADDRESS, initialized: codeSize, memory: codeSize },

        roData: image::Segment { address: roAddress, initialized: roSize, memory: roSize },

        rwData: image::Segment { address: rwAddress, initialized: rwSize, memory: rwSize },

    });

    let written = unix::writeAll(fd, &header[..]) and unix::writeAll(fd, @sliceOf(&NATIVE[0] as *u8, codeSize)) and unix::writeAll(fd, &RO[..roSize]) and unix::writeAll(fd, &RW[..rwSize]);