export mod instances;

export mod domains;

use super::domains;

        domains::initialize(&mut domains::STORE);

//! Domain creation and ownership of initial contexts and private memory.

use super::abi;

use super::limits;

use super::slots;

use super::frames;

use super::backing;

use super::capability;

use super::registry;

use super::instances;

use super::events;

use super::trap;

/// Management rights returned to a domain's creator.

export constant MANAGEMENT_RIGHTS: u16 = abi::DESTROY | abi::EXECUTE | abi::GRANT | abi::TRANSFER | abi::WAKE;

/// Protection-domain lifetime independent of execution budgets.

export union Lifecycle: Copy {

    /// Resources can be installed before one-time activation.

    Pending,

    /// The domain can execute when a context has CPU authority.

    Active,

    /// Execution has stopped and the identity can remain as a tombstone.

    Dead,

}

/// Private domain metadata and its shared event ring.

export record Memory: Copy {

    /// Authoritative capabilities; only the kernel accesses this table.

    table: capability::Table,

    /// Event payload and consumer counters exposed to this domain.

    ring: events::Ring,

}

/// Saved integer state owned by one execution context.

export record Context: Copy {

    /// Domain that owns this context.

    owner: abi::Ref,

    /// Architectural state used when this context resumes.

    frame: trap::Frame,

}

/// Published domain resources and lifecycle metadata.

export record Domain: Copy {

    /// Activation and teardown state.

    state: Lifecycle,

    /// Historical creator generation.

    creator: abi::Ref,

    /// Current lifecycle-event receiver, if present.

    parent: ?abi::Ref,

    /// Root resident image for this domain's private graph.

    image: abi::Ref,

    /// Initial execution context, before additional contexts are created.

    initial: abi::Ref,

    /// Frames containing the capability table and event ring.

    allocation: frames::Run,

    /// Mapped domain metadata retained while the domain is live.

    memory: *unsafe mut Memory,

    /// Private package-state allocation and gp table.

    graph: instances::Instance,

    /// Nondelegable Events handle in the domain's own table.

    events: abi::Handle,

}

/// Fixed domain, context, and notification metadata under caller serialization.

export record Store: Copy {

    /// Domain generations, including retained dead identities.

    slots: [slots::Slot; limits::DOMAINS],

    /// Payload for each published domain.

    records: [Domain; limits::DOMAINS],

    /// Context generations shared by initial and additional contexts.

    contextSlots: [slots::Slot; limits::CONTEXTS],

    /// Payload for each published execution context.

    contexts: [Context; limits::CONTEXTS],

    /// Trusted event producers and terminal records.

    events: events::Store,

}

/// Global domain and execution-context metadata.

export unsafe static STORE: Store = undefined;

/// View an allocated physical extent that contains a complete Memory record.

fn memory(address: u64) -> *unsafe mut Memory;

/// Clear whole mapped physical frames before installing domain metadata.

fn zero(address: u64, count: u32);

/// Initialize fresh metadata before boot-domain publication.

export fn initialize(store: &mut Store) {

    slots::initialize(&mut store.slots[..]);

    slots::initialize(&mut store.contextSlots[..]);

    events::initialize(&mut store.events);

}

/// Read a domain record after validating its retained generation.

export fn get(store: &Store, object: abi::Ref) -> Domain throws (abi::Error) {

    if not slots::matches(&store.slots[..], object, slots::State::Live) {

        throw abi::Error::BadHandle;

    }

    return store.records[object.index];

}

/// Memory allocated before the domain and its context become observable.

record Prepared: Copy {

    /// Frames for capabilities and the event ring.

    allocation: frames::Run,

    /// Mapped metadata at the allocation's start.

    memory: *unsafe mut Memory,

    /// Independent package-state graph.

    graph: instances::Instance,

}

/// Allocate private storage and return all earlier allocations on failure.

unsafe fn prepare(pool: &mut frames::Pool, packages: &registry::Store, image: abi::Ref) -> Prepared throws (abi::Error) {

    let pending = try frames::reserve(pool, (@sizeOf(Memory) + 4095) / 4096);

    let allocation = frames::commit(pending);

    let graph = try instances::create(packages, pool, image) catch err {

        try! frames::release(pool, allocation); throw err;

    };

    let extent = try! frames::extent(pool, allocation);

    zero(extent.start, allocation.count);

    return Prepared { allocation, memory: memory(extent.start), graph };

}

/// Return storage that has never been exposed to a published domain.

fn discard(pool: &mut frames::Pool, prepared: Prepared) {

    try! frames::release(pool, prepared.graph.frames);

    try! frames::release(pool, prepared.allocation);

}

/// Create an unscheduled domain with Events and one initial integer context.

/// The caller serializes publication and keeps the authorizing domain alive.

export unsafe fn create(store: &mut Store, backings: &mut backing::Store, packages: &registry::Store,

    table: &mut capability::Table, authority: abi::Handle, image: abi::Handle) -> abi::Handle throws (abi::Error)

{

    let permit = try capability::authority(table, authority, abi::Rights(abi::CREATE));

    if not backing::domainLive(backings, table.owner) or not backing::domainLive(backings, permit.object) {

        throw abi::Error::BadHandle;

    }

    let root = try registry::image(packages, table, image, abi::Rights(abi::EXECUTE));

    let package = try! registry::get(packages, root);

    let entry = package.entry else {

        throw abi::Error::VerifyFailed;

    };

    let handleSlot = try slots::reserve(&mut table.slots[..]);

    let domainSlot = try slots::reserve(&mut store.slots[..]) catch err {

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let contextSlot = try slots::reserve(&mut store.contextSlots[..]) catch err {

        try! slots::cancel(&mut store.slots[..], domainSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let mut prepared = try prepare(&mut backings.pool, packages, root) catch err {

        try! slots::cancel(&mut store.contextSlots[..], contextSlot);

        try! slots::cancel(&mut store.slots[..], domainSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let object = slots::reference(&domainSlot);

    try backing::registerDomain(backings, object) catch err {

        discard(&mut backings.pool, prepared);

        try! slots::cancel(&mut store.contextSlots[..], contextSlot);

        try! slots::cancel(&mut store.slots[..], domainSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    capability::initialize(&mut prepared.memory.table, object);

    try events::open(&mut store.events, object, &mut prepared.memory.ring) catch err {

        try! backing::endDomain(backings, object);

        discard(&mut backings.pool, prepared);

        try! slots::cancel(&mut store.contextSlots[..], contextSlot);

        try! slots::cancel(&mut store.slots[..], domainSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let queue = try! capability::install(&mut prepared.memory.table, capability::Entry {

        kind: abi::Kind::Events, object, rights: abi::Rights(abi::READ | abi::WRITE),

    });

    let initial = slots::reference(&contextSlot);

    // MPIE enables interrupts after the first return into U-mode.

    let mut frame = trap::Frame { registers: [0; 32], pc: entry, status: 0x80, cause: 0, value: 0 };

    set frame.registers[3] = prepared.graph.table.ptr as u64;

    set store.contexts[initial.index] = Context { owner: object, frame };

    set store.records[object.index] = Domain {

        state: Lifecycle::Pending, creator: table.owner, parent: table.owner, image: root, initial,

        allocation: prepared.allocation, memory: prepared.memory, graph: prepared.graph, events: queue,

    };

    let context = try! slots::commit(&mut store.contextSlots[..], contextSlot);

    let domain = try! slots::commit(&mut store.slots[..], domainSlot);

    return capability::publish(table, handleSlot, capability::Entry {

        kind: abi::Kind::Domain, object: domain,

        rights: abi::Rights(MANAGEMENT_RIGHTS | (*permit.rights & (abi::CREATE | abi::ALLOCATE))),

    });

}

//! Physical domain metadata views and complete frame clearing.

.text;

.export @kernel::domains::memory;

.export @kernel::domains::zero;

// The allocated frame extent contains one complete aligned Memory record.

@kernel::domains::memory

    ret;

// The physical page implementation clears whole mapped frames.

@kernel::domains::zero

    j @kernel::pages::zero;

//! Private package-state allocation and relocation for one domain graph.

use std::arch::rv64::shared;

use super::abi;

use super::limits;

use super::frames;

use super::registry;

/// Physical storage owned by one private package graph.

export record Instance: Copy {

    /// Complete allocation retained until the domain stops.

    frames: frames::Run,

    /// Package bases indexed by resident slot; absent packages have zero bases.

    table: *unsafe [u64],

}

/// Bounded traversal and conservative storage requirement for a package graph.

record Graph: Copy {

    /// Reachable package references, each present once.

    packages: [abi::Ref; limits::PACKAGES],

    /// Number of initialized package references.

    count: u32,

    /// Bytes for the base table, private state, and worst-case alignment padding.

    bytes: u64,

}

/// Map an allocated physical extent to typed storage at the call site.

fn memory(address: u64) -> *unsafe mut opaque;

/// Collect the reachable immutable packages with a bounded queue.

unsafe fn graph(store: &registry::Store, root: abi::Ref) -> Graph throws (abi::Error) {

    let package = try registry::get(store, root);

    let mut result = Graph { packages: undefined, count: 1, bytes: limits::PACKAGES as u64 * 8 };

    let mut seen = [false; limits::PACKAGES];

    set result.packages[0] = root;

    set seen[root.index] = true;

    let mut next: u32 = 0;

    while next < result.count {

        let object = result.packages[next];

        let package = try registry::get(store, object);

        if package.alignment == 0 or (package.alignment & (package.alignment - 1)) <> 0 {

            throw abi::Error::VerifyFailed;

        }

        set result.bytes += package.memory as u64 + package.alignment as u64 - 1;

        if result.bytes > limits::FRAMES as u64 * limits::FRAME_SIZE {

            throw abi::Error::OutOfMemory;

        }

        for i in 0..store.counts[object.index] {

            let dependency = store.dependencies[object.index][i];

            let target = try registry::get(store, dependency);

            if seen[dependency.index] {

                continue;

            }

            set seen[dependency.index] = true;

            set result.packages[result.count] = dependency;

            set result.count += 1;

        }

        set next += 1;

    }

    return result;

}

/// Assign every base before initializing templates and their private pointers.

unsafe fn initialize(store: &registry::Store, graph: &Graph, base: u64) -> *unsafe [u64] throws (abi::Error) {

    let table = @sliceOf(memory(base) as *unsafe mut u64, limits::PACKAGES);

    for i in 0..table.len {

        set table[i] = 0;

    }

    let mut next = base + limits::PACKAGES as u64 * 8;

    for object in &graph.packages[..graph.count] {

        let package = try! registry::get(store, object);

        let mask = package.alignment as u64 - 1;

        set next = (next + mask) & ~mask;

        set table[object.index] = next;

        set next += package.memory as u64;

    }

    for object in &graph.packages[..graph.count] {

        let package = try! registry::get(store, object);

        let bytes = @sliceOf(memory(table[object.index]) as *unsafe mut u8, package.memory);

        try shared::instantiate(&package, &table[..], bytes) catch {

            throw abi::Error::VerifyFailed;

        };

    }

    return &table[..];

}

/// Allocate and initialize one private graph without copying resident code.

/// The caller serializes frame reservations and keeps the registry immutable.

export unsafe fn create(store: &registry::Store, pool: &mut frames::Pool, root: abi::Ref) -> Instance throws (abi::Error) {

    let layout = try graph(store, root);

    let count = ((layout.bytes + limits::FRAME_SIZE - 1) / limits::FRAME_SIZE) as u32;

    let pending = try frames::reserve(pool, count);

    let run = frames::commit(pending);

    let extent = try! frames::extent(pool, run);

    let table = try initialize(store, &layout, extent.start) catch err {

        try! frames::release(pool, run); throw err;

    };

    return Instance { frames: run, table };

}

//! Physical views of allocated private package-state storage.

.text;

.export @kernel::instances::memory;

// The caller owns a complete validated physical frame extent.

@kernel::instances::memory

    ret;

export mod instances;

export mod domains;

//! Pending domain creation, initial context state, and creation authority.

use std::testing;

use std::arch::rv64::shared;

use kernel::abi;

use kernel::slots;

use kernel::backing;

use kernel::capability;

use kernel::registry;

use kernel::domains;

use kernel::transactions;

/// Mapped physical memory for child metadata and package instances.

static RAM: [u64; 131072] = [0; 131072];

/// Domain and context metadata under test.

unsafe static DOMAINS: domains::Store = undefined;

/// Physical allocation and exposure state.

unsafe static BACKINGS: backing::Store = undefined;

/// Shared resident image registry.

unsafe static PACKAGES: registry::Store = undefined;

/// Calling bootstrap domain's capability table.

unsafe static TABLE: capability::Table = undefined;

/// Executable image capability in the calling table.

static IMAGE: abi::Handle = abi::Handle(0);

/// Initialize bootstrap authority and one executable image over mapped frames.

unsafe fn initialize(rights: u16) {

    domains::initialize(&mut DOMAINS);

    backing::initialize(&mut BACKINGS);

    registry::initialize(&mut PACKAGES);

    let pointer = &RAM[0];

    let base = pointer as u64;

    let aligned = (base + 4095) & ~4095;

    set BACKINGS.pool.count = (@sizeOf([u64; 131072]) - (aligned - base) as u32) / 4096;

    for i in 0..BACKINGS.pool.count {

        set BACKINGS.pool.addresses[i] = aligned + i as u64 * 4096;

        set BACKINGS.pool.free[i] = true;

    }

    let pending = try! slots::reserve(&mut DOMAINS.slots[..]);

    let owner = try! slots::commit(&mut DOMAINS.slots[..], pending);

    try! backing::registerDomain(&mut BACKINGS, owner);

    capability::initialize(&mut TABLE, owner);

    let authority = try! capability::install(&mut TABLE, capability::Entry {

        kind: abi::Kind::Domain, object: owner, rights: abi::Rights(rights),

    });

    let imageSlot = try! registry::reserve(&mut PACKAGES);

    let image = slots::reference(&imageSlot);

    let object = try! registry::publish(&mut PACKAGES, imageSlot, "program", shared::Package {

        name: "program", dependencies: &[], slot: image.index, codeAddress: 0x80000000,

        code: &[0x00008067 as u32], exports: &[], entry: 0x80000000,

        template: &[7], memory: 8, alignment: 8, relocations: &[],

    });

    set IMAGE = try! registry::install(&PACKAGES, &mut TABLE, object);

}

/// Creation installs only Events in the child and preserves selected authorizing rights.

@test unsafe fn pending() throws (testing::TestError) {

    initialize(abi::CREATE | abi::ALLOCATE);

    let handle = try! domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE);

    let authority = try! capability::get(&TABLE, handle);

    try testing::expect(*authority.rights == domains::MANAGEMENT_RIGHTS | abi::CREATE | abi::ALLOCATE);

    let child = try! domains::get(&DOMAINS, authority.object);

    try testing::expect(child.state == domains::Lifecycle::Pending);

    try testing::expect(child.creator == TABLE.owner and child.parent == TABLE.owner);

    try testing::expect(backing::domainLive(&BACKINGS, authority.object));

    let events = try! capability::get(&child.memory.table, child.events);

    try testing::expect(events.kind == abi::Kind::Events and events.object == authority.object);

    try testing::expect(*events.rights == abi::READ | abi::WRITE);

    try testing::expect(child.memory.table.slots[1].state == slots::State::Free);

    let context = DOMAINS.contexts[child.initial.index];

    try testing::expect(context.owner == authority.object and context.frame.pc == 0x80000000);

    try testing::expect(context.frame.registers[3] == child.graph.table.ptr as u64);

    try testing::expect(context.frame.registers[2] == 0 and context.frame.status == 0x80);

    try testing::expect(child.memory.ring.head == 0 and child.memory.ring.tail == 0);

    try testing::expect(child.memory.ring.mask == 255);

}

/// Check that a failed creation has returned all unpublished resources.

unsafe fn failed(expected: abi::Error) throws (testing::TestError) {

    let mut rejected = false;

    try domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE) catch err {

        try testing::expect(err == expected); set rejected = true;

    };

    try testing::expect(rejected);

    for i in 0..BACKINGS.pool.count {

        try testing::expect(BACKINGS.pool.free[i]);

    }

    try testing::expect(DOMAINS.slots[1].state == slots::State::Free);

    try testing::expect(DOMAINS.contextSlots[0].state == slots::State::Free);

    try testing::expect(TABLE.slots[2].state == slots::State::Free);

    try testing::expect(BACKINGS.domains[1] == 0);

}

/// Failure at each memory allocation or event opening returns every reservation.

@test unsafe fn rollback() throws (testing::TestError) {

    initialize(abi::CREATE);

    let count = BACKINGS.pool.count;

    set BACKINGS.pool.count = 0;

    try failed(abi::Error::OutOfMemory);

    set BACKINGS.pool.count = (@sizeOf(domains::Memory) + 4095) / 4096;

    try failed(abi::Error::OutOfMemory);

    set BACKINGS.pool.count = count;

    set DOMAINS.events.queues[1].generation = 99;

    try failed(abi::Error::Busy);

    try testing::expect(DOMAINS.events.queues[1].generation == 99);

    set DOMAINS.events.queues[1].generation = 0;

    let handle = try! domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE);

    let entry = try! capability::get(&TABLE, handle);

    try testing::expect(*entry.rights == domains::MANAGEMENT_RIGHTS | abi::CREATE);

}

/// Context exhaustion does not consume a domain slot, handle, or physical frame.

@test unsafe fn contextCapacity() throws (testing::TestError) {

    initialize(abi::CREATE);

    for i in 0..DOMAINS.contextSlots.len {

        set DOMAINS.contextSlots[i].state = slots::State::Retired;

    }

    let mut rejected = false;

    try domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE) catch err {

        try testing::expect(err == abi::Error::Exhausted); set rejected = true;

    };

    try testing::expect(rejected and DOMAINS.slots[1].state == slots::State::Free);

    try testing::expect(TABLE.slots[2].state == slots::State::Free);

    for i in 0..BACKINGS.pool.count {

        try testing::expect(BACKINGS.pool.free[i]);

    }

}

/// A creator can grant Create without Allocate and the next creation preserves that choice.

@test unsafe fn selectiveAuthority() throws (testing::TestError) {

    initialize(abi::CREATE | abi::ALLOCATE);

    let handle = try! domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE);

    let entry = try! capability::get(&TABLE, handle);

    let mut child = try! domains::get(&DOMAINS, entry.object);

    let owner = TABLE.owner;

    let grant = try! transactions::reserve(&mut child.memory.table, owner, handle, entry, abi::CREATE as u64, false);

    let authority = transactions::grant(&mut child.memory.table, grant);

    let image = try! capability::get(&TABLE, IMAGE);

    let imageGrant = try! transactions::reserve(&mut child.memory.table, owner, IMAGE, image, abi::EXECUTE as u64, false);

    let childImage = transactions::grant(&mut child.memory.table, imageGrant);

    let grandchild = try! domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut child.memory.table,

        abi::Handle(0), childImage);

    let returned = try! capability::get(&child.memory.table, grandchild);

    try testing::expect(*returned.rights == domains::MANAGEMENT_RIGHTS | abi::CREATE);

    let created = try! domains::get(&DOMAINS, returned.object);

    try testing::expect(created.creator == entry.object and created.parent == entry.object);

    let mut denied = false;

    try capability::authority(&child.memory.table, abi::Handle(0), abi::Rights(abi::ALLOCATE)) catch err {

        try testing::expect(err == abi::Error::Denied); set denied = true;

    };

    try testing::expect(denied);

}

/// Missing creation rights, stale authority, and non-executable images allocate nothing.

@test unsafe fn authority() throws (testing::TestError) {

    initialize(abi::ALLOCATE);

    try failed(abi::Error::Denied);

    initialize(abi::CREATE);

    set BACKINGS.domains[0] = 0;

    try failed(abi::Error::BadHandle);

    initialize(abi::CREATE);

    set TABLE.entries[1].rights = abi::Rights(abi::READ);

    try failed(abi::Error::Denied);

    initialize(abi::CREATE);

    set PACKAGES.entries[0].package.entry = nil;

    try failed(abi::Error::VerifyFailed);

}

/// Handle and domain table exhaustion preserve all physical capacity.

@test unsafe fn capacity() throws (testing::TestError) {

    initialize(abi::CREATE);

    for i in 2..TABLE.slots.len {

        set TABLE.slots[i].state = slots::State::Retired;

    }

    let mut failures: u32 = 0;

    try domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE) catch err {

        try testing::expect(err == abi::Error::Exhausted); set failures += 1;

    };

    try testing::expect(DOMAINS.slots[1].state == slots::State::Free);

    for i in 0..BACKINGS.pool.count {

        try testing::expect(BACKINGS.pool.free[i]);

    }

    initialize(abi::CREATE);

    for i in 1..DOMAINS.slots.len {

        set DOMAINS.slots[i].state = slots::State::Retired;

    }

    try domains::create(&mut DOMAINS, &mut BACKINGS, &PACKAGES, &mut TABLE, abi::Handle(0), IMAGE) catch err {

        try testing::expect(err == abi::Error::Exhausted); set failures += 1;

    };

    try testing::expect(failures == 2 and TABLE.slots[2].state == slots::State::Free);

    try testing::expect(DOMAINS.contextSlots[0].state == slots::State::Free);

    for i in 0..BACKINGS.pool.count {

        try testing::expect(BACKINGS.pool.free[i]);

    }

}

//! Private package-state graphs over shared resident code.

use std::testing;

use std::arch::rv64::shared;

use kernel::abi;

use kernel::frames;

use kernel::slots;

use kernel::registry;

use kernel::instances;

/// Mapped storage for independent private graphs.

static RAM: [u64; 131072] = [0; 131072];

/// Physical allocation metadata.

unsafe static POOL: frames::Pool = undefined;

/// Immutable package metadata shared by all instances.

unsafe static PACKAGES: registry::Store = undefined;

/// Initialize a frame pool over aligned mapped memory.

unsafe fn initialize() {

    let pointer = &RAM[0];

    let base = pointer as u64;

    let aligned = (base + 4095) & ~4095;

    set POOL.count = (@sizeOf([u64; 131072]) - (aligned - base) as u32) / 4096;

    for i in 0..POOL.count {

        set POOL.addresses[i] = aligned + i as u64 * 4096;

        set POOL.free[i] = true;

    }

    registry::initialize(&mut PACKAGES);

}

/// Publish a package with one private word and optional pointer relocation.

unsafe fn register(name: *[u8], dependencies: *[*[u8]], relocations: *[shared::Relocation]) -> abi::Ref {

    return registerLayout(name, dependencies, relocations, 8, 8);

}

/// Publish explicit private-state bounds for alignment and allocation checks.

unsafe fn registerLayout(name: *[u8], dependencies: *[*[u8]], relocations: *[shared::Relocation], size: u32, alignment: u32) -> abi::Ref {

    let pending = try! registry::reserve(&mut PACKAGES);

    let reference = slots::reference(&pending);

    return try! registry::publish(&mut PACKAGES, pending, name, shared::Package {

        name, dependencies: (&dependencies[..]) as *unsafe [*[u8]], slot: reference.index, codeAddress: 0x80000000,

        code: &[0x00008067 as u32], exports: &[], entry: 0x80000000,

        template: &[7, 0, 0, 0, 0, 0, 0, 0], memory: size, alignment, relocations,

    });

}

/// Map an instance's private word through the original test allocation.

fn word(address: u64) -> *mut u64 {

    let pointer = &RAM[0];

    return &mut RAM[((address - pointer as u64) / 8) as u32];

}

/// A diamond has one dependency instance per domain and independent relocated pointers.

@test unsafe fn diamond() throws (testing::TestError) {

    initialize();

    let base = register("base", &[], &[]);

    unsafe static relocation: [shared::Relocation; 1] = undefined;

    set relocation = [shared::Relocation { offset: 0, count: 1, target: shared::DataRef { slot: base.index, offset: 0 } }];

    let left = register("left", &["base"], &relocation[..]);

    let right = register("right", &["base"], &relocation[..]);

    let root = register("root", &["left", "right"], &[]);

    let first = try! instances::create(&PACKAGES, &mut POOL, root);

    let second = try! instances::create(&PACKAGES, &mut POOL, root);

    try testing::expect(first.table.len == 256 and second.table.len == 256);

    try testing::expect(first.table[base.index] <> second.table[base.index]);

    try testing::expect(*word(first.table[left.index]) == first.table[base.index]);

    try testing::expect(*word(first.table[right.index]) == first.table[base.index]);

    try testing::expect(*word(second.table[left.index]) == second.table[base.index]);

    set *word(first.table[base.index]) = 99;

    try testing::expect(*word(second.table[base.index]) == 7);

    try testing::expect(first.table[4] == 0 and second.table[4] == 0);

    try! frames::release(&mut POOL, first.frames);

    try! frames::release(&mut POOL, second.frames);

    for i in 0..POOL.count {

        try testing::expect(POOL.free[i]);

    }

}

/// State alignment can exceed a physical frame and zero-fill follows the template.

@test unsafe fn alignment() throws (testing::TestError) {

    initialize();

    let root = registerLayout("aligned", &[], &[], 16, 8192);

    let state = try! instances::create(&PACKAGES, &mut POOL, root);

    try testing::expect((state.table[root.index] & 8191) == 0);

    try testing::expect(*word(state.table[root.index]) == 7);

    try testing::expect(*word(state.table[root.index] + 8) == 0);

    try! frames::release(&mut POOL, state.frames);

}

/// Failed allocation and private relocation leave no retained instance frames.

@test unsafe fn rollback() throws (testing::TestError) {

    initialize();

    let root = register("valid", &[], &[]);

    let count = POOL.count;

    set POOL.count = 0;

    let mut failures: u32 = 0;

    try instances::create(&PACKAGES, &mut POOL, root) catch err {

        try testing::expect(err == abi::Error::OutOfMemory); set failures += 1;

    };

    set POOL.count = count;

    let bad = register("bad", &[], &[shared::Relocation {

        offset: 0, count: 1, target: shared::DataRef { slot: 5, offset: 0 },

    }]);

    try instances::create(&PACKAGES, &mut POOL, bad) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failures += 1;

    };

    try instances::create(&PACKAGES, &mut POOL, abi::Ref { index: root.index, generation: 2 }) catch err {

        try testing::expect(err == abi::Error::BadHandle); set failures += 1;

    };

    try testing::expect(failures == 3);

    for i in 0..POOL.count {

        try testing::expect(POOL.free[i]);

    }

    let retry = try! instances::create(&PACKAGES, &mut POOL, root);

    try testing::expect(*word(retry.table[root.index]) == 7);

    try! frames::release(&mut POOL, retry.frames);

}

cat test/boot/machine.ras kernel/kernel/boot.ras kernel/kernel/sync.ras kernel/kernel/trap.ras kernel/kernel/pages.ras kernel/kernel/loader.ras kernel/kernel/instances.ras kernel/kernel/domains.ras > "$work/boot.ras"

cat test/boot/trap.ras kernel/kernel/boot.ras kernel/kernel/sync.ras kernel/kernel/trap.ras kernel/kernel/pages.ras kernel/kernel/loader.ras kernel/kernel/instances.ras kernel/kernel/domains.ras > "$work/trap.ras"

use kernel::domains;

use kernel::slots;

/// Call a published entry with one instance's package-state table.

fn invoke(address: u64, table: u64) -> i64;

    let pending = try! slots::reserve(&mut domains::STORE.slots[..]);

    let owner = try! slots::commit(&mut domains::STORE.slots[..], pending);

        kind: abi::Kind::Domain, object: owner, rights: abi::Rights(abi::CREATE | abi::ALLOCATE),