core/events.rad core/domains.rad core/resources.rad core/capabilities.rad \

	core/memory.rad core/state.rad core/pages.rad

	check/domains.rad check/capabilities.rad check/pages.rad

	$(EMU) -machine -no-guard-stack -max-steps=100000000 -count-instructions -run kernel.rv64

record the contracts established through step 8 of the 22-step plan.

- Dropping a handle removes authority to invoke operations through that name;

  it does not revoke memory pointers already derived from a persistent grant.

## Persistent Page lifetime and splitting

- Persistent grants pin frames for each recipient domain lifetime, not merely

  the origin lifetime. A recipient can retain a derived pointer after dropping

  its Page handle and after the origin dies. Splits preserve these pins.

- Domain-major frame bitmaps and per-frame pin counts track lifetime access.

  A frame returns to the pool only after its Page object claim and all pins

  disappear. Clear a quiescent domain's bitmap before reusing its identity.

- Allocation preflights capability/object slots before taking RAM. PageSplit

  checks exclusivity and both destination slots before changing the source.

  Readable coverage may span adjacent grants; a gap never authorizes access.

Exercise split exclusivity, failed allocation/split transactions, pointers retained after handle drop, and reclamation after the final recipient lifetime.

mod pages;

    pages::run();

use core::frames;

use core::memory;

use core::platform;

use core::state;

/// Empty RAM pool for device-only capability transactions.

static POOL: frames::Pool = undefined;

/// Frame pin backing storage.

static PINS: [u16; 1] = undefined;

/// Frame object backing storage.

static ASSIGNED: [bool; 1] = undefined;

/// Per-domain grant backing storage.

static GRANTS: [u64; 3] = undefined;

/// Shared mechanism state for each transaction.

static KERNEL: state::State = undefined;

    let _handle = try capabilities::grant(&mut KERNEL, 0, source, target, abi::RIGHTS as u64) catch error {

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 0;

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 3);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], memory: ram };

    let shared = try! capabilities::grant(&mut KERNEL, 0, source, childHandle, (abi::READ | abi::WRITE) as u64);

    let authority = try! capabilities::lookup(&KERNEL, child.index, shared);

    let _source = try! capabilities::lookup(&KERNEL, 0, source);

    let narrowed = try! capabilities::grant(&mut KERNEL, child.index, shared, abi::Handle { bits: 0 }, abi::READ as u64);

    let _local = try! capabilities::lookup(&KERNEL, child.index, narrowed);

    let readQueue = try! capabilities::grant(&mut KERNEL, 0, queue, abi::Handle { bits: 0 }, abi::READ as u64);

    try! capabilities::drop(&mut KERNEL, 0, readQueue);

    try capabilities::drop(&mut KERNEL, 0, queue) catch error {

    let _queue = try! capabilities::lookup(&KERNEL, 0, queue);

    let moved = try! capabilities::transfer(&mut KERNEL, 0, interrupt, childHandle, abi::TRANSFER as u64);

    let _receiver = try! capabilities::lookup(&KERNEL, child.index, moved);

    let _old = try capabilities::lookup(&KERNEL, 0, interrupt) catch error {

            let _copy = try! capabilities::grant(&mut KERNEL, 0, source, childHandle, abi::READ as u64);

        let _failed = try capabilities::transfer(&mut KERNEL, 0, source, childHandle, abi::READ as u64) catch full {

            let _stillLive = try! capabilities::lookup(&KERNEL, 0, source);

            try! capabilities::drop(&mut KERNEL, 0, childHandle);

//! Page authority, split exclusivity, and persistent recipient lifetime checks.

use core::abi;

use core::capabilities;

use core::domains;

use core::fdt;

use core::frames;

use core::handles;

use core::memory;

use core::pages;

use core::platform;

use core::resources;

use core::state;

/// Test-owned physical RAM.

static RAM: [u8; 16 * frames::PAGE_SIZE] = undefined;

/// Domain storage for allocator and recipient authority.

static DOMAINS: [domains::Domain; 3] = undefined;

/// Physical Page object slots.

static OBJECTS: [resources::Slot; 8] = undefined;

/// Frame availability metadata.

static POOL: frames::Pool = undefined;

/// Recipient pin counts.

static PINS: [u16; 16] = undefined;

/// Live Page claims on each frame.

static ASSIGNED: [bool; 16] = undefined;

/// Per-domain persistent grant sets.

static GRANTS: [u64; 3] = undefined;

/// State shared by all tested control-plane operations.

static KERNEL: state::State = undefined;

/// Clear a physical allocation before it is exposed through a handle.

fn clear(base: u64, size: u32) {

    assert base <= RAM.len as u64 and size as u64 <= RAM.len as u64 - base;

    for i in base as u32..base as u32 + size { set RAM[i] = 0; }

}

/// Check split metadata, attenuation, and reclamation after every recipient dies.

export fn run() {

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 1;

    set machine.memory[0] = fdt::Range { base: 0, size: RAM.len as u64 };

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 3);

    domains::init(&mut DOMAINS[..]);

    resources::init(&mut OBJECTS[..]);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], memory: ram };

    let rootHandle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, rootHandle, abi::CREATE);

    let child = try! domains::create(&mut DOMAINS[..], root, 1);

    let childHandle = handles::install(&mut DOMAINS[0].handles, 2, child, abi::DOMAIN_RIGHTS);

    let left = try! pages::allocate(&mut KERNEL, 0, abi::Handle { bits: 0 }, 4, clear);

    let right = try! pages::split(&mut KERNEL, 0, left, 2);

    let leftRange = try! pages::access(&KERNEL, 0, left, abi::WRITE);

    let rightRange = try! pages::access(&KERNEL, 0, right, abi::WRITE);

    assert leftRange.base == 0 and leftRange.size == 8192;

    assert rightRange.base == 8192 and rightRange.size == 8192;

    assert pages::covers(&KERNEL, 0, 0, 16384, abi::WRITE);

    assert not pages::covers(&KERNEL, 0, 0, 16385, abi::WRITE);

    assert not pages::covers(&KERNEL, 0, 0xfffffffffffffff0, 32, abi::READ);

    let shared = try! capabilities::grant(&mut KERNEL, 0, left, childHandle, abi::READ as u64);

    let _split = try pages::split(&mut KERNEL, 0, left, 1) catch error {

        assert error == abi::Error::Busy;

        let borrowed = try! pages::access(&KERNEL, child.index, shared, abi::READ);

        assert borrowed.base == leftRange.base and borrowed.size == leftRange.size;

        assert not pages::covers(&KERNEL, child.index, 0, 8192, abi::WRITE);

        try! capabilities::drop(&mut KERNEL, child.index, shared);

        try! capabilities::drop(&mut KERNEL, 0, left);

        try! capabilities::drop(&mut KERNEL, 0, right);

        assert POOL.available == 12;

        memory::retire(&mut KERNEL.memory, 0);

        assert POOL.available == 14;

        let allocation = try! frames::allocate(&mut POOL, 14, clear);

        let untouched = frames::install(allocation);

        assert untouched.first == 2;

        frames::reclaim(&mut POOL, untouched);

        memory::retire(&mut KERNEL.memory, child.index);

        assert POOL.available == 16;

        let entire = try! frames::allocate(&mut POOL, 16, clear);

        frames::discard(&mut POOL, entire);

        return;

    };

    panic "run: shared Page split succeeded";

}

export mod memory;

export mod state;

export mod pages;

use core::memory;

use core::state;

export fn lookup(kernel: *state::State, caller: u32, handle: abi::Handle) -> handles::Entry throws (abi::Error) {

    let slot = try handles::slot(&kernel.domains[caller].handles, handle);

    let entry = kernel.domains[caller].handles.entries[slot];

    if not resources::live(kernel.resources, kernel.domains, entry.object) { throw abi::Error::BadHandle; }

export fn grant(kernel: *mut state::State, caller: u32, source: abi::Handle, target: abi::Handle, rights: u64) -> abi::Handle throws (abi::Error) {

    let entry = try lookup(kernel, caller, source);

    let store = kernel.domains;

    let objects = kernel.resources;

    if entry.object.kind == abi::Kind::Page {

        let case resources::Value::Page(page) = objects[entry.object.index].value else { panic "grant: page kind mismatch"; };

        memory::pin(&mut kernel.memory, recipient.index, page.run);

    }

export fn transfer(kernel: *mut state::State, caller: u32, source: abi::Handle, target: abi::Handle, rights: u64) -> abi::Handle throws (abi::Error) {

    let entry = try lookup(kernel, caller, source);

    let store = kernel.domains;

    let objects = kernel.resources;

    if entry.object.kind == abi::Kind::Page {

        let case resources::Value::Page(page) = objects[entry.object.index].value else { panic "transfer: page kind mismatch"; };

        memory::pin(&mut kernel.memory, recipient.index, page.run);

    }

export fn drop(kernel: *mut state::State, caller: u32, handle: abi::Handle) throws (abi::Error) {

    let entry = try lookup(kernel, caller, handle);

    let store = kernel.domains;

    if let run = resources::release(kernel.resources, entry.object) {

        memory::release(&mut kernel.memory, run);

    }

        if node.addressCells > 2 { throw Error::Invalid; }

//! Physical frame pins for persistent domain-lifetime memory access.

use core::abi;

use core::frames;

/// Borrowed frame lifetime metadata allocated at kernel boot.

export record Memory: Copy {

    /// Global availability bitmap.

    pool: *mut frames::Pool,

    /// Number of live domain-lifetime pins for each physical frame.

    pins: *mut [u16],

    /// Whether each frame still belongs to a live Page object.

    objects: *mut [bool],

    /// Domain-major bitmaps of persistent grants.

    grants: *mut [u64],

    /// Bitmap words per domain.

    words: u32,

    /// Number of domain slots with lifetime metadata.

    domains: u32,

}

/// Initialize frame lifetime metadata before the first user allocation.

export fn init(memory: *mut Memory, pool: *mut frames::Pool, pins: *mut [u16], objects: *mut [bool], grants: *mut [u64], domainCount: u32) {

    let words = (pool.limit + 63) / 64;

    assert domainCount > 0 and domainCount <= abi::MAX_DOMAINS;

    assert pins.len >= pool.limit and objects.len >= pool.limit;

    assert grants.len >= words * domainCount;

    for i in 0..pool.limit {

        set pins[i] = 0;

        set objects[i] = false;

    }

    for i in 0..words * domainCount { set grants[i] = 0; }

    set *memory = Memory { pool, pins, objects, grants, words, domains: domainCount };

}

/// Pin each frame once for the receiving domain's complete lifetime.

export fn pin(memory: *mut Memory, domain: u32, run: frames::Run) {

    assert domain < memory.domains and run.first <= memory.pool.limit;

    assert run.count > 0 and run.count <= memory.pool.limit - run.first;

    for frame in run.first..run.first + run.count {

        let word = domain * memory.words + frame / 64;

        let bit = 1 as u64 << (frame as u64 & 63);

        if memory.grants[word] & bit == 0 {

            assert memory.objects[frame];

            assert memory.pins[frame] < memory.domains as u16;

            set memory.grants[word] |= bit;

            set memory.pins[frame] += 1;

        }

    }

}

/// Allocate cleared frames and establish the origin domain's lifetime pin.

export fn allocate(memory: *mut Memory, domain: u32, count: u32, clear: fn(u64, u32)) -> frames::Run throws (abi::Error) {

    let allocation = try frames::allocate(memory.pool, count, clear) catch error {

        if error == frames::Error::Invalid { throw abi::Error::InvalidArg; }

        throw abi::Error::OutOfMemory;

    };

    let run = frames::install(allocation);

    for frame in run.first..run.first + run.count {

        assert not memory.objects[frame] and memory.pins[frame] == 0;

        set memory.objects[frame] = true;

    }

    pin(memory, domain, run);

    return run;

}

/// Release a Page object's claim; existing domain pins still protect its data.

export fn release(memory: *mut Memory, run: frames::Run) {

    for frame in run.first..run.first + run.count {

        assert memory.objects[frame];

        set memory.objects[frame] = false;

        if memory.pins[frame] == 0 {

            frames::reclaim(memory.pool, frames::Run { first: frame, count: 1 });

        }

    }

}

/// Clear a quiescent domain's persistent grants before its slot can be reused.

export fn retire(memory: *mut Memory, domain: u32) {

    assert domain < memory.domains;

    for word in 0..memory.words {

        let index = domain * memory.words + word;

        let mut bits = memory.grants[index];

        set memory.grants[index] = 0;

        let mut bit: u32 = 0;

        while bits <> 0 {

            if bits & 1 <> 0 {

                let frame = word * 64 + bit;

                assert memory.pins[frame] > 0;

                set memory.pins[frame] -= 1;

                if memory.pins[frame] == 0 and not memory.objects[frame] {

                    frames::reclaim(memory.pool, frames::Run { first: frame, count: 1 });

                }

            }

            set bits >>= 1;

            set bit += 1;

        }

    }

}

//! Capability-authorized physical Pages and bounded access metadata.

use core::abi;

use core::capabilities;

use core::domains;

use core::fdt;

use core::frames;

use core::handles;

use core::memory;

use core::resources;

use core::state;

/// Allocate cleared frames under the caller's explicit Allocate authority.

export fn allocate(kernel: *mut state::State, caller: u32, authority: abi::Handle, count: u64, clear: fn(u64, u32)) -> abi::Handle throws (abi::Error) {

    let owner = try domains::authority(kernel.domains, caller, authority, abi::ALLOCATE);

    if owner.index <> caller { throw abi::Error::Denied; }

    if count == 0 or count > frames::MAX_FRAMES as u64 { throw abi::Error::InvalidArg; }

    let slot = try handles::vacant(&kernel.domains[caller].handles) catch { throw abi::Error::InvalidArg; };

    let objectSlot = try resources::vacant(kernel.resources) catch { throw abi::Error::OutOfMemory; };

    let run = try memory::allocate(&mut kernel.memory, caller, count as u32, clear);

    let object = resources::install(kernel.resources, objectSlot, resources::Value::Page(resources::Page { run, origin: owner }));

    resources::retain(kernel.resources, object);

    return handles::install(&mut kernel.domains[caller].handles, slot, object, abi::PAGE_RIGHTS);

}

/// Split an exclusive allocation without changing its frame lifetime pins.

export fn split(kernel: *mut state::State, caller: u32, source: abi::Handle, leftCount: u64) -> abi::Handle throws (abi::Error) {

    let entry = try capabilities::lookup(kernel, caller, source);

    if entry.object.kind <> abi::Kind::Page { throw abi::Error::BadHandle; }

    let objectSlot = entry.object.index;

    let object = &kernel.resources[objectSlot];

    let case resources::Value::Page(page) = object.value else { panic "split: page kind mismatch"; };

    if object.references <> 1 { throw abi::Error::Busy; }

    if leftCount == 0 or leftCount >= page.run.count as u64 { throw abi::Error::InvalidArg; }

    let slot = try handles::vacant(&kernel.domains[caller].handles) catch { throw abi::Error::Busy; };

    let rightSlot = try resources::vacant(kernel.resources) catch { throw abi::Error::Busy; };

    let left = leftCount as u32;

    let remainder = resources::Page {

        run: frames::Run { first: page.run.first + left, count: page.run.count - left },

        origin: page.origin,

    };

    let right = resources::install(kernel.resources, rightSlot, resources::Value::Page(remainder));

    set kernel.resources[objectSlot].value = resources::Value::Page(resources::Page {

        run: frames::Run { first: page.run.first, count: left }, origin: page.origin,

    });

    resources::retain(kernel.resources, right);

    return handles::install(&mut kernel.domains[caller].handles, slot, right, entry.rights);

}

/// Query Page metadata after a live kind and rights check.

export fn access(kernel: *state::State, caller: u32, handle: abi::Handle, rights: u16) -> fdt::Range throws (abi::Error) {

    let entry = try capabilities::lookup(kernel, caller, handle);

    if entry.object.kind <> abi::Kind::Page { throw abi::Error::BadHandle; }

    if entry.rights & rights <> rights { throw abi::Error::Denied; }

    let case resources::Value::Page(page) = kernel.resources[entry.object.index].value else { panic "access: page kind mismatch"; };

    return fdt::Range {

        base: page.run.first as u64 * frames::PAGE_SIZE as u64,

        size: page.run.count as u64 * frames::PAGE_SIZE as u64,

    };

}

/// Check that live Page grants cover an entire byte range with the given rights.

/// Adjacent granted ranges can contribute to the same checked interval.

export fn covers(kernel: *state::State, domain: u32, base: u64, size: u64, rights: u16) -> bool {

    if size == 0 { return true; }

    if base > 0xffffffffffffffff - size { return false; }

    let end = base + size;

    let mut cursor = base;

    while cursor < end {

        let mut covered = cursor;

        for i in 0..abi::MAX_HANDLES {

            let entry = &kernel.domains[domain].handles.entries[i];

            if entry.object.kind <> abi::Kind::Page or entry.rights & rights <> rights

                or not resources::live(kernel.resources, kernel.domains, entry.object) { continue; }

            let case resources::Value::Page(page) = kernel.resources[entry.object.index].value else { panic "covers: page kind mismatch"; };

            let start = page.run.first as u64 * frames::PAGE_SIZE as u64;

            let limit = start + page.run.count as u64 * frames::PAGE_SIZE as u64;

            if start <= cursor and limit > covered { set covered = limit; }

        }

        if covered == cursor { return false; }

        set cursor = covered;

    }

    return true;

}

use core::frames;

/// One contiguous physical Page object.

export record Page: Copy {

    /// Allocated physical frames.

    run: frames::Run,

    /// Allocation origin identity, independent of handle holders.

    origin: abi::Object,

}

    /// Contiguous RAM with persistent domain-lifetime grants.

    Page(Page),

        case Value::Page(_) => return abi::Kind::Page,

/// Find a reusable resource slot before a fallible allocation begins.

export fn vacant(slots: *[Slot]) -> u32 throws (abi::Error) {

        if kind(slots[i].value) == abi::Kind::Empty and slots[i].epoch < 0xffffffff {

            return i;

/// Install a resource into a preflighted empty slot.

export fn install(slots: *mut [Slot], index: u32, value: Value) -> abi::Object {

    assert kind(value) <> abi::Kind::Empty;

    let slot = &mut slots[index];

    assert kind(slot.value) == abi::Kind::Empty and slot.epoch < 0xffffffff;

    set slot.epoch += 1;

    set slot.value = value;

    set slot.references = 0;

    return abi::Object { kind: kind(value), index, epoch: slot.epoch };

}

/// Install a physical resource before its first capability is published.

export fn create(slots: *mut [Slot], value: Value) -> abi::Object throws (abi::Error) {

    let index = try vacant(slots);

    return install(slots, index, value);

}

/// Remove one resource reference and return any released Page's frames.

export fn release(slots: *mut [Slot], object: abi::Object) -> ?frames::Run {

    if object.kind == abi::Kind::Domain or object.kind == abi::Kind::Events { return nil; }

    if let case Value::Page(page) = slot.value; slot.references == 0 {

        set slot.value = Value::Free;

        return page.run;

    }