test: emulator seed-test std-test bin-test kernel-test package-test native-test shared-test sync-test kernel-boot-test trap-test page-test

KERNEL_ASM := kernel/kernel/boot.ras kernel/kernel/sync.ras kernel/kernel/trap.ras kernel/kernel/pages.ras

$(BIN_DIR)/kernel.ril $(BIN_DIR)/std.ril &: $(KERNEL_SRC) $(STD_LIB) $(RAD_BIN)

	@$(RADIANCE) $(STD) $(KERNEL) -entry kernel -ril $(BIN_DIR)

$(BIN_DIR)/kernel.rv64: $(BIN_DIR)/std.ril $(BIN_DIR)/kernel.ril $(BIN_DIR)/kernel.build.rv64 $(KERNEL_ASM)

	@$(EMU) $(EMU_FLAGS) -run $(BIN_DIR)/kernel.build.rv64 -- $(BIN_DIR)/std.ril $(BIN_DIR)/kernel.ril $(BIN_DIR)/kernel.ras $@

# Physical frame zeroing at native addresses.

page-test: $(BIN_DIR)/sync.build.rv64

	@RAD_EMULATOR="$(EMU)" sh test/pages/run

export mod frames;

export mod backing;

export mod pages;

export mod boot;

@test export mod tests;

//! Allocation lifetimes shared by split pages and exposed domains.

use std::lang::gen::bitset;

use super::abi;

use super::limits;

use super::slots;

use super::frames;

/// Words required for one exposure bit per domain slot.

constant EXPOSURE_WORDS: u32 = (limits::DOMAINS + 31) / 32;

/// A physical allocation retained independently of its current page objects.

export record Allocation: Copy {

    /// Complete physical frame ownership, unchanged by page splits.

    run: frames::Run,

    /// Number of page objects with live handles.

    pages: u32,

    /// Number of live domains with lifetime exposure.

    exposed: u32,

    /// Domain-index exposure bitmap. Domain exit clears bits before slot reuse.

    exposures: [u32; EXPOSURE_WORDS],

}

/// Fixed allocation records and generation-checked exposure-domain membership.

export record Store: Copy {

    /// Physical frames owned by backing allocations.

    pool: frames::Pool,

    /// Backing-record lifetimes.

    slots: [slots::Slot; limits::ALLOCATIONS],

    /// Payloads for live backing records.

    records: [Allocation; limits::ALLOCATIONS],

    /// Live domain generation, or zero after all of that domain's exposures end.

    domains: [u32; limits::DOMAINS],

}

/// Initialize fresh backing and exposure-domain tables.

export fn initialize(store: &mut Store) {

    set store.pool.count = 0;

    slots::initialize(&mut store.slots[..]);

    for i in 0..limits::DOMAINS { set store.domains[i] = 0; }

}

/// Register a domain before it can receive allocation exposure.

export fn registerDomain(store: &mut Store, domain: abi::Ref) throws (abi::Error) {

    if domain.index >= limits::DOMAINS or domain.generation == 0 { throw abi::Error::InvalidArg; }

    if store.domains[domain.index] <> 0 { throw abi::Error::Busy; }

    set store.domains[domain.index] = domain.generation;

}

/// Test exposure-domain generation without reading beyond the fixed table.

export fn domainLive(store: &Store, domain: abi::Ref) -> bool {

    return domain.index < limits::DOMAINS and domain.generation <> 0 and store.domains[domain.index] == domain.generation;

}

/// Publish reserved metadata with one page object and its live origin exposure.

/// The caller owns the committed run and has validated the origin domain.

export unsafe fn publish(store: &mut Store, reservation: slots::Reservation, run: frames::Run, origin: abi::Ref) -> abi::Ref {

    assert domainLive(store, origin);

    let object = slots::reference(&reservation);

    assert slots::matches(&store.slots[..], object, slots::State::Reserved);

    set store.records[object.index].run = run;

    set store.records[object.index].pages = 1;

    set store.records[object.index].exposed = 1;

    let mut bits = bitset::init(&mut store.records[object.index].exposures[..]);

    bitset::put(&mut bits, origin.index);

    return try! slots::commit(&mut store.slots[..], reservation);

}

/// Require a live generation-bearing backing reference.

fn require(store: &Store, object: abi::Ref) throws (abi::Error) {

    if not slots::matches(&store.slots[..], object, slots::State::Live) { throw abi::Error::BadHandle; }

}

/// Add one split page to the allocation's lifetime count.

export fn retainPage(store: &mut Store, object: abi::Ref) throws (abi::Error) {

    try require(store, object);

    if store.records[object.index].pages == 0 { throw abi::Error::BadHandle; }

    if store.records[object.index].pages == 0xffffffff { throw abi::Error::Exhausted; }

    set store.records[object.index].pages += 1;

}

/// Record access for a domain for the rest of that domain generation's lifetime.

export unsafe fn expose(store: &mut Store, object: abi::Ref, domain: abi::Ref) throws (abi::Error) {

    try require(store, object);

    if store.records[object.index].pages == 0 or not domainLive(store, domain) { throw abi::Error::BadHandle; }

    let mut bits = bitset::new(&mut store.records[object.index].exposures[..]);

    if bitset::contains(&bits, domain.index) { return; }

    bitset::put(&mut bits, domain.index);

    set store.records[object.index].exposed += 1;

}

/// Reclaim only when no page object and no domain exposure remains.

fn reclaim(store: &mut Store, object: abi::Ref) {

    if store.records[object.index].pages <> 0 or store.records[object.index].exposed <> 0 { return; }

    let run = store.records[object.index].run;

    try! frames::release(&mut store.pool, run);

    try! slots::release(&mut store.slots[..], object);

}

/// Release one page object after its final handle disappears.

export fn releasePage(store: &mut Store, object: abi::Ref) throws (abi::Error) {

    try require(store, object);

    if store.records[object.index].pages == 0 { throw abi::Error::BadHandle; }

    set store.records[object.index].pages -= 1;

    reclaim(store, object);

}

/// End all exposure for one domain before its slot can be registered again.

/// Callers serialize this bounded scan with allocation and capability changes.

export unsafe fn endDomain(store: &mut Store, domain: abi::Ref) throws (abi::Error) {

    if not domainLive(store, domain) { throw abi::Error::BadHandle; }

    for i in 0..limits::ALLOCATIONS {

        if store.slots[i].state <> slots::State::Live { continue; }

        let mut bits = bitset::new(&mut store.records[i].exposures[..]);

        if not bitset::contains(&bits, domain.index) { continue; }

        bitset::clear(&mut bits, domain.index);

        set store.records[i].exposed -= 1;

        reclaim(store, abi::Ref { index: i, generation: store.slots[i].generation });

    }

    set store.domains[domain.index] = 0;

}

use super::pages;

        try! pages::initialize(&mut pages::STORE, &PLATFORM);

    la %t0 @kernel::boot::enter;

    jalr %ra %t0 0;

    return publish(table, reservation, entry);

}

/// Publish valid authority into a reservation from this table.

/// The caller has validated metadata and acquired the object's lifetime reference.

export fn publish(table: &mut Table, reservation: slots::Reservation, entry: Entry) -> abi::Handle {

    assert slots::matches(&table.slots[..], object, slots::State::Reserved);

//! Bounded physical-frame reservations. Callers serialize pool mutations.

use super::abi;

use super::limits;

use super::platform;

use super::range;

/// A contiguous allocation represented by indices in the physical-frame map.

export record Run: Copy {

    /// First frame-map index.

    first: u32,

    /// Number of physically adjacent frames.

    count: u32,

}

/// Reserved frames that must be committed or cancelled in the same pool.

export union Reservation: Once {

    /// Frames excluded from subsequent allocation scans.

    Held(Run),

}

/// Physical addresses and occupancy of allocatable frames, sorted by address.

export record Pool: Copy {

    /// Physical base address of each eligible frame.

    addresses: [u64; limits::FRAMES],

    /// True when the frame is available for reservation.

    free: [bool; limits::FRAMES],

    /// Number of valid frame-map entries.

    count: u32,

}

/// Insert one range into an address-sorted prefix of fixed storage.

fn insert(ranges: &mut [range::Range], count: u32, value: range::Range) {

    let mut at = count;

    while at > 0 and ranges[at - 1].start > value.start {

        set ranges[at] = ranges[at - 1]; set at -= 1;

    }

    set ranges[at] = value;

}

/// Build a fresh frame map from complete RAM pages with no reserved byte.

/// The pool has zero valid entries if initialization fails.

export unsafe fn initialize(pool: &mut Pool, machine: &platform::Platform) throws (abi::Error) {

    set pool.count = 0;

    if machine.ramCount > platform::RAM_BANKS or machine.reservedCount > platform::RESERVATIONS {

        throw abi::Error::InvalidArg;

    }

    let mut reserved: [range::Range; platform::RESERVATIONS] = undefined;

    for i in 0..machine.reservedCount {

        let value = machine.reserved[i];

        if value.start >= value.end { throw abi::Error::InvalidArg; }

        insert(&mut reserved[..], i, value);

    }

    let mut banks: [range::Range; platform::RAM_BANKS] = undefined;

    for i in 0..machine.ramCount {

        let bank = machine.ram[i];

        if bank.start >= bank.end { throw abi::Error::InvalidArg; }

        insert(&mut banks[..], i, bank);

    }

    let mut count: u32 = 0;

    let mut next: u32 = 0;

    for i in 0..machine.ramCount {

        let bank = banks[i];

        if i > 0 and banks[i - 1].end > bank.start { throw abi::Error::InvalidArg; }

        let padding = (limits::FRAME_SIZE - (bank.start & (limits::FRAME_SIZE - 1))) & (limits::FRAME_SIZE - 1);

        if padding > bank.end - bank.start { continue; }

        let mut address = bank.start + padding;

        let end = bank.end & ~(limits::FRAME_SIZE - 1);

        while address < end {

            while next < machine.reservedCount and reserved[next].end <= address { set next += 1; }

            if next < machine.reservedCount and reserved[next].start < address + limits::FRAME_SIZE {

                if reserved[next].end >= end { break; }

                set address = (reserved[next].end + limits::FRAME_SIZE - 1) & ~(limits::FRAME_SIZE - 1);

                continue;

            }

            if count == limits::FRAMES { throw abi::Error::Exhausted; }

            set pool.addresses[count] = address;

            set pool.free[count] = true;

            set count += 1;

            set address += limits::FRAME_SIZE;

        }

    }

    set pool.count = count;

}

/// Reserve the first physically contiguous free run with a bounded scan.

export fn reserve(pool: &mut Pool, count: u32) -> Reservation throws (abi::Error) {

    if count == 0 { throw abi::Error::InvalidArg; }

    let mut first: u32 = 0;

    let mut found: u32 = 0;

    let mut previous: u64 = 0;

    for i in 0..pool.count {

        if not pool.free[i] { set found = 0; continue; }

        if found == 0 or pool.addresses[i] <> previous + limits::FRAME_SIZE { set first = i; set found = 0; }

        set found += 1;

        set previous = pool.addresses[i];

        if found == count {

            for j in first..first + count { set pool.free[j] = false; }

            return Reservation::Held(Run { first, count });

        }

    }

    throw abi::Error::OutOfMemory;

}

/// Consume a reservation into a backing allocation's frame ownership.

export fn commit(reservation: Reservation) -> Run {

    match reservation { case Reservation::Held(run) => return run, }

}

/// Resolve a complete physical run and reject map gaps or invalid indices.

export fn extent(pool: &Pool, run: Run) -> range::Range throws (abi::Error) {

    if run.count == 0 or run.first >= pool.count or run.count > pool.count - run.first { throw abi::Error::BadHandle; }

    let start = pool.addresses[run.first];

    let length = run.count as u64 * limits::FRAME_SIZE;

    let result = range::new(start, length) else { throw abi::Error::BadHandle; };

    if pool.addresses[run.first + run.count - 1] <> result.end - limits::FRAME_SIZE { throw abi::Error::BadHandle; }

    return result;

}

/// Return a backing allocation's frames after all handles and exposures end.

/// Only the owner of a committed run may release it.

export fn release(pool: &mut Pool, run: Run) throws (abi::Error) {

    let memory = try extent(pool, run);

    for i in run.first..run.first + run.count { if pool.free[i] { throw abi::Error::BadHandle; } }

    for i in run.first..run.first + run.count { set pool.free[i] = true; }

}

/// Cancel unpublished frame ownership and restore its capacity.

export fn cancel(pool: &mut Pool, reservation: Reservation) throws (abi::Error) {

    match reservation { case Reservation::Held(run) => try release(pool, run), }

}

//! Physical page objects, allocation, and exclusive splitting.

use super::abi;

use super::limits;

use super::slots;

use super::frames;

use super::backing;

use super::capability;

use super::platform;

/// Page capability rights created by physical allocation.

export constant DEFAULT_RIGHTS: u16 = abi::READ | abi::WRITE | abi::GRANT | abi::TRANSFER;

/// One page-aligned segment of a retained backing allocation.

export record Page: Copy {

    /// Common backing record, including the complete allocation's exposures.

    backing: abi::Ref,

    /// First physical byte of this segment.

    base: u64,

    /// Number of contiguous frames in this segment.

    count: u32,

    /// Domain that created the original allocation.

    origin: abi::Ref,

    /// Number of live capabilities that name this page object.

    handles: u32,

}

/// Fixed physical-memory metadata. Callers serialize shared mutations.

export record Store: Copy {

    /// Page-object slot lifetimes.

    slots: [slots::Slot; limits::PAGES],

    /// Live page-object payloads.

    records: [Page; limits::PAGES],

    /// Backing allocations and domain exposures.

    backings: backing::Store,

}

/// Physical-memory state shared by the kernel.

export unsafe static STORE: Store = undefined;

/// Zero complete, mapped physical frames. The base must be page-aligned.

fn zero(base: u64, count: u32);

/// Initialize physical-memory metadata before creating domains or pages.

export unsafe fn initialize(store: &mut Store, machine: &platform::Platform) throws (abi::Error) {

    backing::initialize(&mut store.backings);

    try frames::initialize(&mut store.backings.pool, machine);

    slots::initialize(&mut store.slots[..]);

}

/// Read a live page object through its internal generation-bearing reference.

export fn get(store: &Store, object: abi::Ref) -> Page throws (abi::Error) {

    if not slots::matches(&store.slots[..], object, slots::State::Live) { throw abi::Error::BadHandle; }

    return store.records[object.index];

}

/// Allocate and zero frames before publishing a page and its capability.

/// Allocation authority must name the calling domain. Failure cancels reservations.

export unsafe fn allocate(store: &mut Store, table: &mut capability::Table, authority: abi::Handle, count: u64)

    -> abi::Handle throws (abi::Error)

{

    if count == 0 { throw abi::Error::InvalidArg; }

    if count > limits::FRAMES as u64 { throw abi::Error::OutOfMemory; }

    let owner = table.owner;

    let permission = try capability::authority(table, authority, abi::Rights(abi::ALLOCATE));

    if permission.object <> owner { throw abi::Error::Denied; }

    if not backing::domainLive(&store.backings, owner) { throw abi::Error::BadHandle; }

    let handleSlot = try slots::reserve(&mut table.slots[..]);

    let pageSlot = try slots::reserve(&mut store.slots[..]) catch err {

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let backingSlot = try slots::reserve(&mut store.backings.slots[..]) catch err {

        try! slots::cancel(&mut store.slots[..], pageSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let memory = try frames::reserve(&mut store.backings.pool, count as u32) catch err {

        try! slots::cancel(&mut store.backings.slots[..], backingSlot);

        try! slots::cancel(&mut store.slots[..], pageSlot);

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let run = frames::commit(memory);

    let extent = try! frames::extent(&store.backings.pool, run);

    zero(extent.start, run.count);

    let allocation = backing::publish(&mut store.backings, backingSlot, run, owner);

    let object = slots::reference(&pageSlot);

    set store.records[object.index] = Page { backing: allocation, base: extent.start, count: run.count, origin: owner, handles: 1 };

    let page = try! slots::commit(&mut store.slots[..], pageSlot);

    return capability::publish(table, handleSlot, capability::Entry {

        kind: abi::Kind::Page, object: page, rights: abi::Rights(DEFAULT_RIGHTS),

    });

}

/// Split an exclusive page into two segments with the same backing and rights.

export fn split(store: &mut Store, table: &mut capability::Table, handle: abi::Handle, leftCount: u64)

    -> abi::Handle throws (abi::Error)

{

    let entry = try capability::lookup(table, handle, abi::Kind::Page, abi::Rights(0));

    let source = try get(store, entry.object);

    if leftCount == 0 or leftCount >= source.count as u64 { throw abi::Error::InvalidArg; }

    if source.handles <> 1 { throw abi::Error::Busy; }

    let handleSlot = try slots::reserve(&mut table.slots[..]);

    let pageSlot = try slots::reserve(&mut store.slots[..]) catch err {

        try! slots::cancel(&mut table.slots[..], handleSlot); throw err;

    };

    let object = slots::reference(&pageSlot);

    try! backing::retainPage(&mut store.backings, source.backing);

    set store.records[object.index] = Page {

        backing: source.backing, base: source.base + leftCount * limits::FRAME_SIZE,

        count: source.count - leftCount as u32, origin: source.origin, handles: 1,

    };

    set store.records[entry.object.index].count = leftCount as u32;

    let page = try! slots::commit(&mut store.slots[..], pageSlot);

    return capability::publish(table, handleSlot, capability::Entry { kind: abi::Kind::Page, object: page, rights: entry.rights });

}

/// Add a capability reference and lifetime exposure before publishing that capability.

export unsafe fn retain(store: &mut Store, object: abi::Ref, receiver: abi::Ref) throws (abi::Error) {

    let page = try get(store, object);

    if page.handles == 0xffffffff { throw abi::Error::Exhausted; }

    try backing::expose(&mut store.backings, page.backing, receiver);

    set store.records[object.index].handles += 1;

}

/// Release a capability reference. The backing retains all lifetime exposures.

export fn release(store: &mut Store, object: abi::Ref) throws (abi::Error) {

    let page = try get(store, object);

    assert page.handles > 0;

    set store.records[object.index].handles -= 1;

    if page.handles > 1 { return; }

    try! slots::release(&mut store.slots[..], object);

    try! backing::releasePage(&mut store.backings, page.backing);

}

//! Zero physical frames before capability publication.

.text;

.export @kernel::pages::zero;

// Physical frame bases and lengths are multiples of 4096 bytes.

@kernel::pages::zero

    beqz %a1 @done;

    slli %a1 %a1 12;

    add %t0 %a0 %a1;

@clear

    sd %zero 0(%a0);

    addi %a0 %a0 8;

    bne %a0 %t0 @clear;

@done

    ret;

export mod frames;

export mod backing;

export mod pages;

//! Backing allocations outlive page objects until every exposure ends.

use std::testing;

use kernel::abi;

use kernel::frames;

use kernel::backing;

use kernel::slots;

/// Fixed backing-store workspace.

unsafe static STORE: backing::Store = undefined;

/// Initialize two domains and four synthetic physical frames.

unsafe fn initialize() {

    backing::initialize(&mut STORE);

    try! backing::registerDomain(&mut STORE, abi::Ref { index: 0, generation: 1 });

    try! backing::registerDomain(&mut STORE, abi::Ref { index: 1, generation: 1 });

    set STORE.pool.count = 4;

    for i in 0..4 { set STORE.pool.addresses[i] = 0x80000000 + i as u64 * 4096; set STORE.pool.free[i] = true; }

}

/// Publish one backing record with its initial page and origin exposure.

unsafe fn allocate() -> abi::Ref {

    let slot = try! slots::reserve(&mut STORE.slots[..]);

    let reservation = try! frames::reserve(&mut STORE.pool, 4);

    let run = frames::commit(reservation);

    return backing::publish(&mut STORE, slot, run, abi::Ref { index: 0, generation: 1 });

}

/// Dropping all page handles preserves capacity while an exposed domain lives.

@test unsafe fn exposures() throws (testing::TestError) {

    initialize();

    let object = allocate();

    let receiver = abi::Ref { index: 1, generation: 1 };

    try! backing::expose(&mut STORE, object, receiver);

    try! backing::expose(&mut STORE, object, receiver);

    try testing::expect(STORE.records[object.index].exposed == 2);

    try! backing::releasePage(&mut STORE, object);

    try! backing::endDomain(&mut STORE, abi::Ref { index: 0, generation: 1 });

    try testing::expect(not STORE.pool.free[0] and slots::matches(&STORE.slots[..], object, slots::State::Live));

    try! backing::endDomain(&mut STORE, receiver);

    for i in 0..4 { try testing::expect(STORE.pool.free[i]); }

    try testing::expect(not slots::matches(&STORE.slots[..], object, slots::State::Live));

}

/// Splits keep their common backing alive until every page object is gone.

@test unsafe fn splitLifetime() throws (testing::TestError) {

    initialize();

    let object = allocate();

    try! backing::retainPage(&mut STORE, object);

    try! backing::endDomain(&mut STORE, abi::Ref { index: 0, generation: 1 });

    try! backing::releasePage(&mut STORE, object);

    try testing::expect(not STORE.pool.free[0] and STORE.records[object.index].pages == 1);

    try! backing::releasePage(&mut STORE, object);

    try testing::expect(STORE.pool.free[0]);

    let mut stale = false;

    try backing::releasePage(&mut STORE, object) catch err {

        try testing::expect(err == abi::Error::BadHandle); set stale = true;

    };

    try testing::expect(stale);

}

/// An ended domain generation cannot gain exposures through a reused domain slot.

@test unsafe fn domainGeneration() throws (testing::TestError) {

    initialize();

    let object = allocate();

    let old = abi::Ref { index: 1, generation: 1 };

    try! backing::expose(&mut STORE, object, old);

    try! backing::endDomain(&mut STORE, old);

    try! backing::registerDomain(&mut STORE, abi::Ref { index: 1, generation: 2 });

    let mut stale = false;

    try backing::expose(&mut STORE, object, old) catch err {

        try testing::expect(err == abi::Error::BadHandle); set stale = true;

    };

    try testing::expect(stale and STORE.records[object.index].exposed == 1);

    try! backing::releasePage(&mut STORE, object);

    try! backing::endDomain(&mut STORE, abi::Ref { index: 0, generation: 1 });

    try testing::expect(STORE.pool.free[0]);

}

/// Retained backing metadata cannot create new page authority after the last page ends.

@test unsafe fn noResurrection() throws (testing::TestError) {

    initialize();

    let object = allocate();

    try! backing::releasePage(&mut STORE, object);

    let mut failures: u32 = 0;

    try backing::retainPage(&mut STORE, object) catch err {

        try testing::expect(err == abi::Error::BadHandle); set failures += 1;

    };

    try backing::expose(&mut STORE, object, abi::Ref { index: 1, generation: 1 }) catch err {

        try testing::expect(err == abi::Error::BadHandle); set failures += 1;

    };

    try testing::expect(failures == 2 and STORE.records[object.index].exposed == 1);

    try! backing::endDomain(&mut STORE, abi::Ref { index: 0, generation: 1 });

    try testing::expect(STORE.pool.free[0]);

}

//! Contiguous frame reservation and reserved-memory exclusion.

use std::testing;

use kernel::abi;

use kernel::frames;

use kernel::platform;

use kernel::range;

/// Frame-map workspace is static because its size exceeds a small kernel stack.

unsafe static POOL: frames::Pool = undefined;

/// Build eight available frames around a reserved two-frame hole.

unsafe fn initialize() {

    let mut machine: platform::Platform = undefined;

    set machine.ramCount = 1;

    set machine.ram[0] = range::Range { start: 0x80000000, end: 0x8000a000 };

    set machine.reservedCount = 1;

    set machine.reserved[0] = range::Range { start: 0x80003000, end: 0x80005000 };

    try! frames::initialize(&mut POOL, &machine);

}

/// Adjacent physical frames form runs; a reserved hole cannot be crossed.

@test unsafe fn fragmentation() throws (testing::TestError) {

    initialize();

    try testing::expect(POOL.count == 8);

    let left = try! frames::reserve(&mut POOL, 3);

    let leftRun = frames::commit(left);

    let right = try! frames::reserve(&mut POOL, 5);

    let rightRun = frames::commit(right);

    let first = try! frames::extent(&POOL, leftRun);

    let second = try! frames::extent(&POOL, rightRun);

    try testing::expect(first.start == 0x80000000 and first.end == 0x80003000);

    try testing::expect(second.start == 0x80005000 and second.end == 0x8000a000);

    try! frames::release(&mut POOL, leftRun);

    try! frames::release(&mut POOL, rightRun);

    let mut failed = false;

    try reserveAndCancel(6) catch err {

        try testing::expect(err == abi::Error::OutOfMemory); set failed = true;

    };

    try testing::expect(failed);

}

/// Consume a successful probe reservation before returning to its caller.

unsafe fn reserveAndCancel(count: u32) throws (abi::Error) {

    let token = try frames::reserve(&mut POOL, count);

    try frames::cancel(&mut POOL, token);

}

/// Full exhaustion and cancellation preserve the pool's available capacity.

@test unsafe fn capacity() throws (testing::TestError) {

    initialize();

    let mut allocated: [frames::Run; 8] = undefined;

    for i in 0..8 {

        let token = try! frames::reserve(&mut POOL, 1);

        set allocated[i] = frames::commit(token);

    }

    let mut failed = false;

    try reserveAndCancel(1) catch err {

        try testing::expect(err == abi::Error::OutOfMemory); set failed = true;

    };

    try testing::expect(failed);

    for i in 0..8 { try! frames::release(&mut POOL, allocated[i]); }

    let pending = try! frames::reserve(&mut POOL, 5);

    try! frames::cancel(&mut POOL, pending);

    let again = try! frames::reserve(&mut POOL, 5);

    try! frames::cancel(&mut POOL, again);

    let mut empty = false;

    try reserveAndCancel(0) catch err {

        try testing::expect(err == abi::Error::InvalidArg); set empty = true;

    };

    try testing::expect(empty);

}

/// A release validates every frame before mutating any occupancy state.

@test unsafe fn invalidRelease() throws (testing::TestError) {

    initialize();

    let token = try! frames::reserve(&mut POOL, 2);

    let run = frames::commit(token);

    let mut failed = false;

    try frames::release(&mut POOL, frames::Run { first: run.first, count: 3 }) catch err {

        try testing::expect(err == abi::Error::BadHandle); set failed = true;

    };

    try testing::expect(failed);

    try! frames::release(&mut POOL, run);

    let mut duplicate = false;

    try frames::release(&mut POOL, run) catch err {

        try testing::expect(err == abi::Error::BadHandle); set duplicate = true;

    };

    try testing::expect(duplicate);

}

/// Only complete, unreserved physical pages can enter the frame pool.

@test unsafe fn partialPages() throws (testing::TestError) {

    let mut machine: platform::Platform = undefined;

    set machine.ramCount = 1;

    set machine.ram[0] = range::Range { start: 0x80000001, end: 0x80006001 };

    set machine.reservedCount = 1;

    set machine.reserved[0] = range::Range { start: 0x80002fff, end: 0x80003001 };