export mod loader;

//! Bounded trusted-RIL loading and unpublished physical-memory ownership.

use std::mem;

use std::lang::alloc;

use std::lang::gen::data;

use std::lang::il::binary;

use std::lang::il::binary::program;

use std::arch::rv64;

use std::arch::rv64::shared;

use std::arch::rv64::shared::catalog;

use super::abi;

use super::limits;

use super::slots;

use super::frames;

use super::pages;

use super::backing;

use super::capability;

use super::registry;

use super::sync;

/// Maximum snapshotted binary RIL size.

export constant INPUT_BYTES: u32 = 8388608;

/// Maximum native output extent per load.

constant CODE_BYTES: u32 = 8388608;

/// Maximum persistent source and metadata extent per load.

constant METADATA_BYTES: u32 = 16777216;

/// Temporary compiler storage owned by one load.

export record Workspace: Copy {

    /// Stable input bytes used throughout decoding and compilation.

    input: [u8; INPUT_BYTES],

    /// Decoded binary program and names.

    decoded: [u8; 67108864],

    /// Native emitter state and generated instructions.

    code: [u8; 16777216],

    /// Reusable per-function storage.

    scratch: [u8; 16777216],

    /// Native data layout workspace.

    data: [data::DataSym; 4096],

    /// Local package symbols.

    symbols: [shared::Symbol; 4096],

    /// Public package symbols.

    exports: [shared::Symbol; 4096],

    /// Admitted dependency symbols.

    imports: [shared::Symbol; 8192],

    /// Initialized private-state template.

    template: [u8; 1048576],

    /// Private-state pointer relocations.

    relocations: [shared::Relocation; 4096],

}

/// Physical storage retained by one runtime-loaded package.

export record Resident: Copy {

    /// Executable frames, including final-page padding.

    code: frames::Run,

    /// Packed catalog entry and retained source bytes.

    metadata: frames::Run,

}

/// Single-loader ownership and persistent frame accounting.

export record State: Copy {

    /// Workspace occupancy protected by the caller's metadata serialization.

    busy: bool,

    /// Domain generation holding the workspace while busy is true.

    owner: abi::Ref,

    /// True for package slots whose frames are owned by this loader.

    live: [bool; limits::PACKAGES],

    /// Physical extents for live runtime-loaded packages.

    resident: [Resident; limits::PACKAGES],

}

/// Arguments supplied to a trusted image load.

export record Request: Copy {

    /// Self-Domain allocation authority, including the zero sentinel.

    authority: abi::Handle,

    /// Readable page containing the binary RIL bytes.

    source: abi::Handle,

    /// Byte offset within the source page.

    offset: u64,

    /// Number of source bytes to snapshot.

    length: u64,

}

/// Workspace capacity that must be returned to the same frame pool.

export union Lease: Once {

    /// Private temporary frames owned by the active load.

    Held(frames::Run),

}

/// Global runtime-loader ownership.

export unsafe static STATE: State = State { busy: false, owner: abi::Ref { index: 0, generation: 0 },

    live: [false; limits::PACKAGES], resident: undefined };

/// Map a validated physical workspace extent to its compiler storage.

/// The caller must hold the exclusive workspace lease until the last access.

unsafe fn workspace(address: u64) -> *mut Workspace;

/// Map a validated physical byte extent.

fn memory(address: u64) -> *unsafe mut u8;

/// Read the native descriptor at a successfully packed metadata extent.

fn descriptor(address: u64) -> *unsafe catalog::Entry;

/// Reset loader metadata before any workspace or resident allocation exists.

export fn initialize(state: &mut State) {

    set state.busy = false;

    set state.owner = abi::Ref { index: 0, generation: 0 };

    for i in 0..limits::PACKAGES {

        set state.live[i] = false;

    }

}

/// Acquire the sole compiler workspace and reserve its private physical storage.

/// The caller serializes workspace ownership and frame-pool mutations.

export fn acquire(state: &mut State, pool: &mut frames::Pool, owner: abi::Ref) -> Lease throws (abi::Error) {

    if owner.index >= limits::DOMAINS or owner.generation == 0 {

        throw abi::Error::BadHandle;

    }

    if state.busy {

        throw abi::Error::Busy;

    }

    let count = (@sizeOf(Workspace) + 4095) / 4096;

    let reservation = try frames::reserve(pool, count);

    set state.busy = true;

    set state.owner = owner;

    return Lease::Held(frames::commit(reservation));

}

/// Return temporary frames and release the compiler workspace under metadata serialization.

export fn release(state: &mut State, pool: &mut frames::Pool, lease: Lease) {

    match lease {

        case Lease::Held(run) => {

            try! frames::release(pool, run);

        },

    }

    set state.owner = abi::Ref { index: 0, generation: 0 };

    set state.busy = false;

}

/// Resolve the private workspace while its lease remains held.

unsafe fn storage(pool: &frames::Pool, lease: &Lease) -> *mut Workspace {

    match lease {

        case Lease::Held(run) => {

            let extent = try! frames::extent(pool, *run);

            assert extent.end - extent.start >= @sizeOf(Workspace) as u64;

            return workspace(extent.start);

        },

    }

}

/// Validate allocation authority and a readable source range before taking resources.

fn source(store: &pages::Store, table: &capability::Table, request: Request) -> u64 throws (abi::Error) {

    let authority = try capability::authority(table, request.authority, abi::Rights(abi::ALLOCATE));

    if authority.object <> table.owner {

        throw abi::Error::Denied;

    }

    if not backing::domainLive(&store.backings, table.owner) {

        throw abi::Error::BadHandle;

    }

    let entry = try capability::lookup(table, request.source, abi::Kind::Page, abi::Rights(abi::READ));

    let page = try pages::get(store, entry.object);

    let bytes = page.count as u64 * limits::FRAME_SIZE;

    if request.length == 0 or request.offset > bytes or request.length > bytes - request.offset {

        throw abi::Error::InvalidArg;

    }

    if request.length > INPUT_BYTES as u64 {

        throw abi::Error::Exhausted;

    }

    return page.base + request.offset;

}

/// Translate bounded backend storage failures without validating trusted IL semantics.

fn backend(error: shared::Error) -> abi::Error {

    match error {

        case shared::Error::Capacity => return abi::Error::Exhausted,

        case shared::Error::Codegen(inner) => {

            if inner == rv64::Error::Allocation or inner == rv64::Error::Capacity {

                return abi::Error::Exhausted;

            }

            return abi::Error::VerifyFailed;

        },

        else => return abi::Error::VerifyFailed,

    }

}

/// Used page counts for unpublished native output.

record OutputSize: Copy {

    /// Pages occupied by generated code.

    code: u32,

    /// Pages occupied by the packed native catalog.

    metadata: u32,

}

/// Compile and pack one candidate into caller-owned physical output extents.

unsafe fn generate(work: *mut Workspace, input: &binary::Package, packages: &registry::Store,

    slot: u32, code: u64, metadata: u64, length: u32) -> OutputSize throws (abi::Error)

{

    let count = try registry::imports(packages, &input.dependencies[..], &mut work.imports[..]);

    let mut arena = alloc::new(&mut work.code[..]);

    let mut scratch = alloc::new(&mut work.scratch[..]);

    let package = try shared::compile(&*input, slot, code, &work.imports[..count],

        shared::Storage {

            data: &mut work.data[..], symbols: &mut work.symbols[..], exports: &mut work.exports[..],

            template: &mut work.template[..], relocations: &mut work.relocations[..],

        }, &mut arena, &mut scratch) catch error {

            throw backend(error);

        };

    if package.code.len > CODE_BYTES / 4 {

        throw abi::Error::Exhausted;

    }

    let codeBytes = package.code.len * 4;

    let codeMemory = @sliceOf(memory(code), CODE_BYTES);

    try! mem::copy(&mut codeMemory[..codeBytes], @sliceOf(package.code.ptr as *u8, codeBytes));

    let metadataMemory = @sliceOf(memory(metadata), METADATA_BYTES);

    let used = try catalog::pack(&[catalog::Entry { source: &work.input[..length], package }], metadata, metadataMemory)

        catch error {

            throw backend(error);

        };

    let mut codePages = (codeBytes + 4095) / 4096;

    if codePages == 0 {

        set codePages = 1;

    }

    return OutputSize { code: codePages, metadata: (used + 4095) / 4096 };

}

/// Return unused output frames while preserving at least one frame for each extent.

fn trim(pool: &mut frames::Pool, run: frames::Run, count: u32) -> frames::Run {

    assert count > 0 and count <= run.count;

    if count < run.count {

        try! frames::release(pool, frames::Run { first: run.first + count, count: run.count - count });

    }

    return frames::Run { first: run.first, count };

}

/// Snapshot, decode, compile, and publish a package while its caller remains live.

unsafe fn produce(state: &mut State, pool: &mut frames::Pool, packages: &mut registry::Store,

    work: *mut Workspace, address: u64, length: u32) -> abi::Ref throws (abi::Error)

{

    try! mem::copy(&mut work.input[..length], @sliceOf(memory(address), length));

    let mut decoder = alloc::new(&mut work.decoded[..]);

    let input = try program::decode(&work.input[..length], &mut decoder, binary::Limits { registers: 8192, blocks: 4096 }) catch err {

        if err == binary::Error::Storage {

            throw abi::Error::Exhausted;

        }

        throw abi::Error::VerifyFailed;

    };

    let existing = try registry::identify(packages, &input.name[..], &work.input[..length]);

    if let object = existing {

        return object;

    }

    let slot = try registry::reserve(packages);

    let object = slots::reference(&slot);

    let codeReservation = try frames::reserve(pool, CODE_BYTES / 4096) catch err {

        registry::cancel(packages, slot);

        throw err;

    };

    let code = frames::commit(codeReservation);

    let metadataReservation = try frames::reserve(pool, METADATA_BYTES / 4096) catch err {

        try! frames::release(pool, code); registry::cancel(packages, slot); throw err;

    };

    let metadata = frames::commit(metadataReservation);

    let codeRange = try! frames::extent(pool, code);

    let metadataRange = try! frames::extent(pool, metadata);

    let sizes = try generate(work, &input, packages, object.index, codeRange.start, metadataRange.start, length) catch err {

        try! frames::release(pool, metadata); try! frames::release(pool, code);

        registry::cancel(packages, slot); throw err;

    };

    let retainedCode = trim(pool, code, sizes.code);

    let retainedMetadata = trim(pool, metadata, sizes.metadata);

    let native = descriptor(metadataRange.start);

    sync::syncInstructions();

    let result = try registry::publish(packages, slot, native.source, native.package) catch err {

        try! frames::release(pool, retainedMetadata); try! frames::release(pool, retainedCode); throw err;

    };

    assert result == object;

    set state.resident[result.index] = Resident { code: retainedCode, metadata: retainedMetadata };

    set state.live[result.index] = true;

    return result;

}

/// Load trusted RIL and install an Image capability after complete native publication.

/// The caller keeps its domain alive and serializes shared metadata transactions.

export unsafe fn load(state: &mut State, store: &mut pages::Store, packages: &mut registry::Store,

    table: &mut capability::Table, request: Request) -> abi::Handle throws (abi::Error)

{

    let address = try source(store, table, request);

    let handle = try slots::reserve(&mut table.slots[..]);

    let lease = try acquire(state, &mut store.backings.pool, table.owner) catch err {

        try! slots::cancel(&mut table.slots[..], handle); throw err;

    };

    let work = storage(&store.backings.pool, &lease);

    let object = try produce(state, &mut store.backings.pool, packages, work, address, request.length as u32) catch err {

        release(state, &mut store.backings.pool, lease);

        try! slots::cancel(&mut table.slots[..], handle); throw err;

    };

    let result = capability::publish(table, handle, capability::Entry {

        kind: abi::Kind::Image, object, rights: abi::Rights(registry::IMAGE_RIGHTS),

    });

    release(state, &mut store.backings.pool, lease);

    return result;

}

//! Physical views of validated loader-owned extents.

.text;

.export @kernel::loader::workspace;

.export @kernel::loader::memory;

.export @kernel::loader::descriptor;

// A validated workspace run contains one complete aligned Workspace record.

@kernel::loader::workspace

    ret;

// A validated physical extent supplies the caller's mapped byte view.

@kernel::loader::memory

    ret;

// Successful packing initializes one native catalog entry at this address.

@kernel::loader::descriptor

    ret;

export mod loader;

//! Trusted binary loading, resident snapshots, and resource rollback.

use std::testing;

use std::arch::rv64::shared;

use std::lang::il;

use std::lang::il::binary;

use std::lang::il::binary::program;

use kernel::abi;

use kernel::limits;

use kernel::slots;

use kernel::pages;

use kernel::frames;

use kernel::backing;

use kernel::capability;

use kernel::registry;

use kernel::loader;

/// Mapped frames for temporary compiler storage and persistent native output.

static RAM: [u64; 18874368] = [0; 18874368];

/// Physical frame and page metadata.

unsafe static PAGES: pages::Store = undefined;

/// Resident package registry.

unsafe static PACKAGES: registry::Store = undefined;

/// Loader ownership and resident-frame accounting.

unsafe static LOADER: loader::State = undefined;

/// Calling domain's capability table.

unsafe static TABLE: capability::Table = undefined;

/// Source page allocated by the calling domain.

static SOURCE: abi::Handle = abi::Handle(0);

/// Byte offset of the first aligned test frame.

static OFFSET: u32 = 0;

/// Initialize a live domain and one source page over actual mapped memory.

unsafe fn initialize() {

    slots::initialize(&mut PAGES.slots[..]);

    backing::initialize(&mut PAGES.backings);

    registry::initialize(&mut PACKAGES);

    loader::initialize(&mut LOADER);

    let pointer = &RAM[0];

    let base = pointer as u64;

    let aligned = (base + 4095) & ~4095;

    set OFFSET = (aligned - base) as u32;

    set PAGES.backings.pool.count = (@sizeOf([u64; 18874368]) - OFFSET) / 4096;

    for i in 0..PAGES.backings.pool.count {

        set PAGES.backings.pool.addresses[i] = aligned + i as u64 * 4096;

        set PAGES.backings.pool.free[i] = true;

    }

    let owner = abi::Ref { index: 0, generation: 1 };

    capability::initialize(&mut TABLE, owner);

    try! backing::registerDomain(&mut PAGES.backings, owner);

    let authority = try! capability::install(&mut TABLE, capability::Entry {

        kind: abi::Kind::Domain, object: owner, rights: abi::Rights(abi::ALLOCATE),

    });

    set SOURCE = try! pages::allocate(&mut PAGES, &mut TABLE, abi::Handle(0), 1);

}

/// Encode one small function into the source page, optionally naming an absent export.

unsafe fn input(value: i64, badExport: bool) -> loader::Request {

    return inputWithDependencies(value, badExport, &[]);

}

/// Encode declared dependencies with a constant-return entry function.

unsafe fn inputWithDependencies(value: i64, badExport: bool, dependencies: *[*[u8]]) -> loader::Request {

    let mut instructions = [il::Instr::Ret { val: il::Val::Imm(value) }];

    let function = il::Fn {

        name: "loaded::main", params: &[], returnType: il::Type::W64, isExtern: false, isLeaf: true,

        blocks: &[il::Block { label: "entry", params: &[], instrs: &mut instructions[..], locs: &[], preds: &[], loopDepth: 0 }],

    };

    let mut name: *[u8] = "loaded::main";

    if badExport {

        set name = "missing";

    }

    let package = binary::Package {

        symbols: &["loaded", "loaded::main", "entry", "missing"], name: "loaded", dependencies: (&dependencies[..]) as *unsafe [*[u8]],

        exports: &[binary::Export { name, kind: binary::ExportKind::Function }], entry: "loaded::main",

        program: il::Program { data: &[], fns: &[&function] },

    };

    let bytes = @sliceOf(&mut RAM[0] as *mut u8, @sizeOf([u64; 18874368]));

    let length = try! program::encode(&mut bytes[OFFSET..OFFSET + 4096], &package);

    return loader::Request { authority: abi::Handle(0), source: SOURCE, offset: 0, length: length as u64 };

}

/// Count available frames to detect leaked temporary or unpublished output storage.

unsafe fn free() -> u32 {

    let mut count: u32 = 0;

    for i in 0..PAGES.backings.pool.count {

        if PAGES.backings.pool.free[i] {

            set count += 1;

        }

    }

    return count;

}

/// Resident source bytes survive mutation of the source page and workspace release.

@test unsafe fn residentSnapshot() throws (testing::TestError) {

    initialize();

    let request = input(43, false);

    let before = free();

    let handle = try! loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request);

    let object = try! registry::image(&PACKAGES, &TABLE, handle, abi::Rights(abi::EXECUTE));

    let package = try! registry::get(&PACKAGES, object);

    try testing::expect(package.code.len > 0 and package.entry <> nil);

    let retained = LOADER.resident[object.index];

    try testing::expect(free() + retained.code.count + retained.metadata.count == before);

    try testing::expect(not LOADER.busy and LOADER.owner.generation == 0);

    let bytes = @sliceOf(&mut RAM[0] as *mut u8, @sizeOf([u64; 18874368]));

    let magic = bytes[OFFSET];

    set bytes[OFFSET] = 0;

    try testing::expect(PACKAGES.entries[object.index].source[0] == magic);

    set bytes[OFFSET] = magic;

    let duplicate = try! loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request);

    try testing::expect(duplicate <> handle);

    try testing::expect(try! registry::image(&PACKAGES, &TABLE, duplicate, abi::Rights(0)) == object);

    try testing::expect(free() + retained.code.count + retained.metadata.count == before);

}

/// Decode and linking failures return all unpublished frames and capability capacity.

@test unsafe fn rollback() throws (testing::TestError) {

    initialize();

    let mut request = input(43, false);

    let before = free();

    set request.length = 3;

    let mut failures: u32 = 0;

    try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failures += 1;

    };

    set request = input(43, true);

    try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failures += 1;

    };

    try testing::expect(failures == 2 and free() == before and not LOADER.busy);

    try testing::expect(TABLE.slots[2].state == slots::State::Free and PACKAGES.slots[0].state == slots::State::Free);

    let valid = input(43, false);

    let handle = try! loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, valid);

    let object = try! registry::image(&PACKAGES, &TABLE, handle, abi::Rights(0));

    try testing::expect(object.index == 0);

}

/// Contention and workspace allocation failure preserve source authority and clear workspace occupancy.

@test unsafe fn workspaceOwnership() throws (testing::TestError) {

    initialize();

    let request = input(43, false);

    let before = free();

    let lease = try! loader::acquire(&mut LOADER, &mut PAGES.backings.pool, TABLE.owner);

    let mut busy = false;

    try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

        try testing::expect(err == abi::Error::Busy); set busy = true;

    };

    try testing::expect(busy and LOADER.busy and LOADER.owner == TABLE.owner);

    loader::release(&mut LOADER, &mut PAGES.backings.pool, lease);

    try testing::expect(free() == before);

    let count = PAGES.backings.pool.count;

    set PAGES.backings.pool.count = 32;

    let mut exhausted = false;

    try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

        try testing::expect(err == abi::Error::OutOfMemory); set exhausted = true;

    };

    set PAGES.backings.pool.count = count;

    try testing::expect(exhausted and free() == before and not LOADER.busy);

    try testing::expect(TABLE.slots[2].state == slots::State::Free);

}

/// Output allocation failures cancel registry admission and return compiler frames.

@test unsafe fn outputAllocationRollback() throws (testing::TestError) {

    initialize();

    let request = input(43, false);

    let before = free();

    let workspacePages = (@sizeOf(loader::Workspace) + 4095) / 4096;

    for extra in &[0 as u32, 2048] {

        let reservation = try! frames::reserve(&mut PAGES.backings.pool, before - workspacePages - extra);

        let held = frames::commit(reservation);

        let available = free();

        let mut failed = false;

        try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

            try testing::expect(err == abi::Error::OutOfMemory); set failed = true;

        };

        try testing::expect(failed and free() == available and not LOADER.busy);

        try testing::expect(TABLE.slots[2].state == slots::State::Free);

        try testing::expect(PACKAGES.slots[0].state == slots::State::Free);

        try! frames::release(&mut PAGES.backings.pool, held);

        try testing::expect(free() == before);

    }

    let handle = try! loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request);

    let object = try! registry::image(&PACKAGES, &TABLE, handle, abi::Rights(0));

    try testing::expect(object.index == 0);

}

/// Admission rejects duplicate dependencies after compilation and returns native output.

@test unsafe fn publicationRollback() throws (testing::TestError) {

    initialize();

    let pending = try! registry::reserve(&mut PACKAGES);

    let reference = slots::reference(&pending);

    let dependency = shared::Package {

        name: "missing", dependencies: &[], slot: reference.index, codeAddress: 0,

        code: &[], exports: &[], entry: nil, template: &[], memory: 0,

        alignment: 8, relocations: &[],

    };

    let resident = try! registry::publish(&mut PACKAGES, pending, "dependency", dependency);

    let request = inputWithDependencies(43, false, &["missing", "missing"]);

    let before = free();

    let mut failed = false;

    try loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, request) catch err {

        try testing::expect(err == abi::Error::VerifyFailed); set failed = true;

    };

    try testing::expect(failed and free() == before and not LOADER.busy);

    try testing::expect(TABLE.slots[2].state == slots::State::Free);

    try testing::expect(PACKAGES.slots[1].state == slots::State::Free and not LOADER.live[1]);

    try testing::expect(slots::matches(&PACKAGES.slots[..], resident, slots::State::Live));

    let valid = inputWithDependencies(43, false, &["missing"]);

    let handle = try! loader::load(&mut LOADER, &mut PAGES, &mut PACKAGES, &mut TABLE, valid);

    let object = try! registry::image(&PACKAGES, &TABLE, handle, abi::Rights(0));

    try testing::expect(object.index == 1 and PACKAGES.counts[1] == 1);

}

#!/bin/sh

# Compile std and a staged kernel fixture from the repository root.

# Arguments: emulator path, fixture directory.

set -eu

emulator=$1

work=$2

set -- -pkg std

while IFS= read -r source; do set -- "$@" -mod "$source"; done < std.lib

set -- "$@" -pkg kernel -mod "$work/kernel.rad"

for source in "$work"/kernel/*.rad; do

    case "$source" in */tests.rad) continue ;; esac

    set -- "$@" -mod "$source"

done

"$emulator" -memory-size=385024 -data-size=348160 -stack-size=1024 \

    -run bin/radiance.rv64.dev "$@" -entry kernel -ril "$work"

cat test/boot/machine.ras kernel/kernel/boot.ras kernel/kernel/sync.ras kernel/kernel/trap.ras kernel/kernel/pages.ras kernel/kernel/loader.ras > "$work/boot.ras"

cat test/boot/trap.ras kernel/kernel/boot.ras kernel/kernel/sync.ras kernel/kernel/trap.ras kernel/kernel/pages.ras kernel/kernel/loader.ras > "$work/trap.ras"

//! Execute runtime-loaded native code after releasing its compiler workspace.

use std::mem;

use kernel::abi;

use kernel::backing;

use kernel::capability;

use kernel::pages;

use kernel::registry;

use kernel::loader;

use kernel::loadinput;

/// Capability storage for the loading domain.

unsafe static TABLE: capability::Table = undefined;

/// View a validated source Page as mapped bytes.

fn memory(address: u64) -> *mut u8;

/// Call a published entry that does not access private package state.

fn invoke(address: u64) -> i64;

/// Load the hosted comparison package and execute its retained native instructions.

export unsafe fn run() {

    let owner = abi::Ref { index: 0, generation: 1 };

    capability::initialize(&mut TABLE, owner);

    try! backing::registerDomain(&mut pages::STORE.backings, owner);

    let authority = try! capability::install(&mut TABLE, capability::Entry {

        kind: abi::Kind::Domain, object: owner, rights: abi::Rights(abi::ALLOCATE),

    });

    let source = try! pages::allocate(&mut pages::STORE, &mut TABLE, authority, 1);

    let cap = try! capability::lookup(&TABLE, source, abi::Kind::Page, abi::Rights(abi::READ));

    let page = try! pages::get(&pages::STORE, cap.object);

    let bytes = @sliceOf(memory(page.base), 4096);

    let length = try! mem::copy(&mut bytes[..], &loadinput::INPUT[..]);

    let handle = try! loader::load(&mut loader::STATE, &mut pages::STORE, &mut registry::STORE, &mut TABLE,

        loader::Request { authority, source, offset: 0, length: length as u64 });

    assert not loader::STATE.busy;

    let object = try! registry::image(&registry::STORE, &TABLE, handle, abi::Rights(abi::EXECUTE));

    let package = try! registry::get(&registry::STORE, object);

    let entry = package.entry else panic "loaded entry";

    for i in 0..length {

        set bytes[i] = 0;

    }

    assert invoke(entry) == 43;

}

//! A package executed by both hosted compilation and the kernel loader.

/// Compute a result through a package-local call.

fn calculate(value: i64) -> i64 { return value * 6 + 1; }

/// Return the result checked by both execution paths.

@default fn main() -> i32 { return calculate(7) as i32; }

//! Run the loader fixture after all harts complete production initialization.

.text;

    call @kernel::boot::initialize;

    beqz %a0 @wait;

    call @kernel::loadcheck::run;

    li %t0 0x10001000;

    li %t1 0x5555;

    sw %t1 0(%t0);

@wait

    wfi;

    j @wait;

.export @kernel::loadcheck::memory;

.export @kernel::loadcheck::invoke;

// The caller supplies an address within its validated source Page.

@kernel::loadcheck::memory

    ret;

// Tail-call published code with no private-state accesses.

@kernel::loadcheck::invoke

    jalr %zero %a0 0;

#!/bin/sh

# Build a kernel fixture and call code produced by its runtime loader.

set -eu

emulator=${RAD_EMULATOR:-emulator}

work=$(mktemp -d)

trap 'rm -rf "$work"' EXIT HUP INT TERM

"$emulator" -memory-size=385024 -data-size=348160 -stack-size=512 \

    -run bin/radiance.rv64.dev -pkg loaded -mod test/loader/loaded.rad -entry loaded -ril "$work"

"$emulator" -memory-size=385024 -data-size=348160 -stack-size=512 \

    -run bin/radiance.rv64.dev -pkg loaded -mod test/loader/loaded.rad -entry loaded -o "$work/hosted.rv64"

status=0

"$emulator" -run "$work/hosted.rv64" || status=$?

test "$status" -eq 43

cat kernel/kernel.rad > "$work/kernel.rad"

printf '\nexport mod loadinput;\nexport mod loadcheck;\n' >> "$work/kernel.rad"

mkdir "$work/kernel"

cp kernel/kernel/*.rad "$work/kernel/"

cp test/loader/kernel/loadcheck.rad "$work/kernel/"

length=$(wc -c < "$work/loaded.ril")

printf '//! Binary package used by both execution paths.\n/// Complete trusted binary RIL input.\nexport static INPUT: [u8; %s] = [\n' "$length" > "$work/kernel/loadinput.rad"

od -An -v -tu1 "$work/loaded.ril" | awk '{ for (i = 1; i <= NF; i++) printf "%s,", $i; print "" }' >> "$work/kernel/loadinput.rad"

printf '];\n' >> "$work/kernel/loadinput.rad"

sh test/acceptance/compile "$emulator" "$work"

cat test/loader/machine.ras kernel/kernel/boot.ras kernel/kernel/sync.ras \

    kernel/kernel/trap.ras kernel/kernel/pages.ras kernel/kernel/loader.ras > "$work/loader.ras"

"$emulator" -memory-size=385024 -data-size=348160 -stack-size=512 \

    -run bin/kernel.build.rv64 -- "$work/std.ril" "$work/kernel.ril" "$work/loader.ras" "$work/loader.rv64"

"$emulator" -machine -memory-size=262144 -max-steps=200000000 -run "$work/loader.rv64"

printf 'runtime loader: hosted and loaded entries agree after workspace release\n'