core/memory.rad core/state.rad core/pages.rad core/atomic.rad

CORE_ASM := arch/atomic.ras

CORE := -pkg core -mod core.rad $(addprefix -mod ,$(MODULES) $(CORE_ASM))

	check/domains.rad check/capabilities.rad check/pages.rad check/events.rad

kernel.rv64: main.rad arch/entry.ras core.rad $(MODULES) $(CORE_ASM) $(COMPILER)

check.rv64: check.rad core.rad $(MODULES) $(CORE_ASM) $(CHECK_MODULES) $(COMPILER)

record the contracts established through step 9 of the 22-step plan.

  outstanding in a 256-entry Events queue. Ordinary capacity is limited to

  128 entries.

## Event publication and consumption

- The 4112-byte shared ring contains 256 complete Event records followed by u32

  head, tail, mask, and consumer lock at offsets 4096, 4100, 4104, and 4108.

  Kernel producers do not acquire the user consumer lock.

- Write data before release-publishing tail. Consumers acquire tail, copy an

  entry, then release-publish head. Private positions and slot marks validate

  progress and remain authoritative despite user-writable event contents.

- Ordinary delivery returns Busy at its capacity limit. Terminal delivery uses

  relationship credits; consumption releases the credit. At most one entry per

  IRQ source is outstanding, and validated consumption permits its next event.

- Boundary checks cover full capacity, u32 wraparound, malformed head progress,

  lifecycle credit integrity, and coalescing through IRQ source 127.

Exercise all ring slots, ordinary backpressure, reserved delivery, IRQ coalescing, wraparound, and invalid consumer progress.

// Ordered, naturally aligned shared-memory accesses.

.text;

.export @"core::atomic::load";

@"core::atomic::load"

	lwu    %a0    0(%a0);

	fence;

	ret;

.export @"core::atomic::store";

@"core::atomic::store"

	fence;

	sw     %a1    0(%a0);

	ret;

mod events;

    events::run();

//! Notification ordering, reserved delivery, and untrusted consumer progress.

use core::abi;

use core::atomic;

use core::events;

/// Read one complete entry and publish consumer progress with release ordering.

fn pop(queue: *mut events::Queue) -> events::Event {

    let head = atomic::load(&queue.ring.head);

    assert head <> atomic::load(&queue.ring.tail);

    let event = queue.ring.data[head & queue.ring.mask];

    atomic::store(&mut queue.ring.head, ((head as u64 + 1) & 0xffffffff) as u32);

    return event;

}

/// Reject an ordinary notification when its bounded capacity is occupied.

fn busy(queue: *mut events::Queue, event: events::Event) {

    try events::push(queue, event, events::Class::Ordinary) catch error {

        assert error == abi::Error::Busy;

        return;

    };

    panic "busy: full ordinary ring accepted a notification";

}

/// Reject a relationship when all lifecycle credits are occupied.

fn exhausted(queue: *mut events::Queue) {

    try events::reserve(queue) catch error {

        assert error == abi::Error::Exhausted;

        return;

    };

    panic "exhausted: full lifecycle reservations accepted a child";

}

/// Reject backward or out-of-range consumer positions.

fn invalid(queue: *mut events::Queue) {

    try events::refresh(queue) catch error {

        assert error == abi::Error::InvalidArg;

        return;

    };

    panic "invalid: corrupt consumer position was accepted";

}

/// Exercise delivery through saturation, wraparound, coalescing, and corruption.

export fn run() {

    let mut queue: events::Queue = undefined;

    events::init(&mut queue);

    let ordinary = events::Event { kind: 5, reserved: 0, code: 0, value: 0 };

    for i in 0..events::CRITICAL { try! events::reserve(&mut queue); }

    exhausted(&mut queue);

    for i in 0..events::CAPACITY - events::CRITICAL {

        try! events::push(&mut queue, events::Event { kind: 5, reserved: 0, code: i, value: i as u64 }, events::Class::Ordinary);

    }

    busy(&mut queue, ordinary);

    for i in 0..events::CRITICAL {

        try! events::push(&mut queue, events::Event { kind: 4, reserved: 0, code: i, value: i as u64 + 128 }, events::Class::Critical);

    }

    for i in 0..events::CAPACITY {

        let event = pop(&mut queue);

        assert event.value == i as u64;

        if i < 128 { assert event.kind == 5; }

        else { assert event.kind == 4; }

    }

    try! events::refresh(&mut queue);

    assert not events::available(&queue);

    for i in 0..events::CRITICAL { try! events::reserve(&mut queue); }

    exhausted(&mut queue);

    events::init(&mut queue);

    let interrupt = events::Event { kind: 1, reserved: 0, code: 127, value: 0 };

    try! events::push(&mut queue, interrupt, events::Class::Interrupt(127));

    try! events::push(&mut queue, interrupt, events::Class::Interrupt(127));

    assert pop(&mut queue).code == 127;

    try! events::refresh(&mut queue);

    assert not events::available(&queue);

    try! events::push(&mut queue, interrupt, events::Class::Interrupt(127));

    assert pop(&mut queue).code == 127;

    try! events::refresh(&mut queue);

    set queue.head = 0xfffffff0;

    set queue.tail = 0xfffffff0;

    atomic::store(&mut queue.ring.head, 0xfffffff0);

    atomic::store(&mut queue.ring.tail, 0xfffffff0);

    for i in 0..32 {

        try! events::push(&mut queue, events::Event { kind: 5, reserved: 0, code: i, value: i as u64 }, events::Class::Ordinary);

    }

    for i in 0..32 { assert pop(&mut queue).code == i; }

    try! events::refresh(&mut queue);

    assert not events::available(&queue);

    atomic::store(&mut queue.ring.head, 17);

    invalid(&mut queue);

    atomic::store(&mut queue.ring.head, 15);

    invalid(&mut queue);

    atomic::store(&mut queue.ring.head, 16);

    try! events::refresh(&mut queue);

    try! events::reserve(&mut queue);

    try! events::push(&mut queue, events::Event { kind: 4, reserved: 0, code: 0, value: 1 }, events::Class::Critical);

    set queue.ring.data[16].kind = 5;

    let _event = pop(&mut queue);

    try! events::refresh(&mut queue);

    for i in 0..events::CRITICAL { try! events::reserve(&mut queue); }

    exhausted(&mut queue);

}

export mod atomic;

//! Acquire and release accesses used by shared notification memory.

/// Load one naturally aligned u32 with acquire ordering.

export fn load(pointer: *u32) -> u32;

/// Store one naturally aligned u32 with release ordering.

export fn store(pointer: *mut u32, value: u32);

            try events::reserve(&mut domains[creator.index].events);

use core::abi;

use core::atomic;

/// Largest interrupt source that can have an outstanding ring entry.

export constant MAX_IRQ: u32 = 127;

/// Private marker for a lifecycle entry.

constant LIFECYCLE: u16 = 256;

/// Notification capacity and coalescing policy.

export union Class: Copy {

    /// Ordinary notification subject to backpressure.

    Ordinary,

    /// One outstanding entry for a physical interrupt source.

    Interrupt(u32),

    /// Terminal lifecycle notification with a prior reservation.

    Critical,

}

    /// User-space consumer lock; zero means unlocked.

    consumer: u32,

    /// Zero for ordinary entries, source for IRQs, LIFECYCLE for terminal events.

    marks: [u16; CAPACITY],

    /// Interrupt sources with outstanding notifications.

    pending: [u64; 2],

        set queue.marks[i] = 0;

    set queue.ring.consumer = 0;

    set queue.pending = [0; 2];

}

/// Difference between wrapping u32 positions, evaluated without overflow.

fn distance(a: u32, b: u32) -> u32 {

    return ((a as u64 + 0x100000000 - b as u64) & 0xffffffff) as u32;

}

/// Validate consumer progress and reclaim consumed capacity.

export fn refresh(queue: *mut Queue) throws (abi::Error) {

    let head = atomic::load(&queue.ring.head);

    let count = distance(head, queue.head);

    if count > distance(queue.tail, queue.head) { throw abi::Error::InvalidArg; }

    for n in 0..count {

        let i = ((queue.head as u64 + n as u64) & (CAPACITY - 1) as u64) as u32;

        let mark = queue.marks[i];

        if mark == LIFECYCLE { set queue.reserved -= 1; }

        else {

            set queue.ordinary -= 1;

            if mark > 0 {

                let source = mark as u32;

                set queue.pending[source / 64] &= ~(1 << (source as u64 % 64));

            }

        }

        set queue.marks[i] = 0;

    }

    set queue.head = head;

}

/// Reserve a delivery credit before installing a parent relationship.

export fn reserve(queue: *mut Queue) throws (abi::Error) {

    try refresh(queue);

    if queue.reserved == CRITICAL { throw abi::Error::Exhausted; }

    set queue.reserved += 1;

}

/// Publish complete event data before the tail; coalesce outstanding IRQs.

/// The kernel serializes calls that change private producer state.

export fn push(queue: *mut Queue, event: Event, class: Class) throws (abi::Error) {

    try refresh(queue);

    let count = distance(queue.tail, queue.head);

    let mut mark: u16 = 0;

    match class {

        case Class::Ordinary => {},

        case Class::Interrupt(source) => {

            if source == 0 or source > MAX_IRQ { throw abi::Error::InvalidArg; }

            if (queue.pending[source / 64] & (1 << (source as u64 % 64))) <> 0 { return; }

            set mark = source as u16;

        },

        case Class::Critical => {

            assert queue.reserved > count - queue.ordinary;

            set mark = LIFECYCLE;

        },

    }

    if mark <> LIFECYCLE and queue.ordinary == CAPACITY - CRITICAL {

        throw abi::Error::Busy;

    }

    assert count < CAPACITY and event.reserved == 0;

    let i = queue.tail & (CAPACITY - 1);

    set queue.ring.data[i] = event;

    set queue.marks[i] = mark;

    if mark <> LIFECYCLE {

        set queue.ordinary += 1;

        if mark > 0 {

            let source = mark as u32;

            set queue.pending[source / 64] |= 1 << (source as u64 % 64);

        }

    }

    set queue.tail = ((queue.tail as u64 + 1) & 0xffffffff) as u32;

    atomic::store(&mut queue.ring.tail, queue.tail);

}

/// Test the authoritative queue after consumer progress has been validated.

export fn available(queue: *Queue) -> bool {

    return queue.head <> queue.tail;