export mod shared;

    /// Data address loads use the current domain package-state table.

    sharedData: bool,

        sharedData: false,

    if e.sharedData {

        emit(e, encode::nop()); // Package offset addition.

        emit(e, encode::nop()); // Package offset low bits.

    }

//! Shared package code, private data templates, and qualified symbol linking.

@test export mod tests;

use std::mem;

use std::lang::alloc;

use std::lang::il;

use std::lang::il::binary;

use std::lang::gen;

use std::lang::gen::data;

use super::emit;

use super::encode;

use super::image;

/// Maximum number of resident package slots in a domain state table.

export constant MAX_PACKAGES: u32 = 256;

/// Package linking or instance storage failure.

export union Error: Copy {

    /// A caller-supplied output buffer is full.

    Capacity,

    /// A symbol is absent, duplicated, or has the wrong kind.

    Symbol,

    /// An address or data extent is outside the supported range.

    Range,

    /// A data or code address has invalid alignment.

    Alignment,

    /// A referenced package has no private instance.

    Instance,

}

/// Address of data within a domain's package graph.

export record DataRef: Copy {

    /// Stable global package slot.

    slot: u32,

    /// Byte offset in the package's private state.

    offset: u32,

}

/// Resolved function or domain-relative data address.

export union Target: Copy {

    /// Absolute address of shared executable code.

    Function(u64),

    /// Private data location selected through gp.

    Data(DataRef),

}

/// Resolved qualified symbol.

export record Symbol: Copy {

    /// Fully qualified symbol name.

    name: *[u8],

    /// Code address or private data location.

    target: Target,

}

/// Private pointer fixup applied when a domain is instantiated.

export record Relocation: Copy {

    /// Byte offset of the first pointer in the private template.

    offset: u32,

    /// Number of consecutive 64-bit pointers.

    count: u32,

    /// Target data location in the domain graph.

    target: DataRef,

}

/// Caller-owned storage for one package's persistent link results.

export record Storage {

    /// Local data layout workspace.

    data: *mut [data::DataSym],

    /// Local function and data definitions.

    symbols: *mut [Symbol],

    /// Public symbols for dependent packages.

    exports: *mut [Symbol],

    /// Private data initializer bytes.

    template: *mut [u8],

    /// Private pointer fixups.

    relocations: *mut [Relocation],

}

/// A resident package entry used by boot catalogs and runtime loading.

export record Package: Copy {

    /// Immutable package identity.

    name: *[u8],

    /// Required package names, in binary package order.

    dependencies: *unsafe [*[u8]],

    /// Stable slot in each domain's package-state table.

    slot: u32,

    /// Address at which the shared instructions execute.

    codeAddress: u64,

    /// Generated shared instructions.

    code: *[u32],

    /// Public function and data definitions.

    exports: *[Symbol],

    /// Exported default entry, if present.

    entry: ?u64,

    /// Initialized private bytes. The rest of memory must be zero-filled.

    template: *[u8],

    /// Total private state extent.

    memory: u32,

    /// Required private state base alignment.

    alignment: u32,

    /// Private pointers to resolve after all graph instances have storage.

    relocations: *[Relocation],

}

/// Find exactly one qualified symbol in a bounded table.

export fn lookup(symbols: &[Symbol], name: &[u8]) -> ?Target {

    for symbol in symbols {

        if mem::eq(symbol.name, name) { return symbol.target; }

    }

    return nil;

}

/// Resolve a local or imported symbol.

fn resolve(local: &[Symbol], imports: &[Symbol], name: *[u8]) -> Target throws (Error) {

    if let target = lookup(local, name) { return target; }

    let target = lookup(imports, name) else { throw Error::Symbol; };

    return target;

}

/// Append a unique local definition to bounded symbol storage.

fn define(symbols: &mut [Symbol], count: &mut u32, name: *[u8], target: Target) throws (Error) {

    if lookup(&symbols[..*count], name) <> nil { throw Error::Symbol; }

    if *count == symbols.len { throw Error::Capacity; }

    set symbols[*count] = Symbol { name, target };

    set *count += 1;

}

/// Resolve a shared function address with its required kind.

fn function(local: &[Symbol], imports: &[Symbol], name: *[u8]) -> u64 throws (Error) {

    match try resolve(local, imports, name) {

        case Target::Function(address) => return address,

        else => throw Error::Symbol,

    }

}

/// Require a private data target.

fn dataRef(target: Target) -> DataRef throws (Error) {

    match target {

        case Target::Data(location) => return location,

        else => throw Error::Symbol,

    }

}

/// Patch a PC-relative call or function address load.

unsafe fn relative(e: &mut emit::Emitter, index: u32, base: u64, target: u64, rd: gen::Reg, call: bool)

    throws (Error)

{

    let delta = image::displacement(base + index as u64 * 4, target) else { throw Error::Range; };

    let parts = emit::splitImm(delta);

    emit::patch(e, index, encode::auipc(rd, parts.hi));

    if call {

        emit::patch(e, index + 1, encode::jalr(super::RA, rd, parts.lo));

    } else {

        emit::patch(e, index + 1, encode::addi(rd, rd, parts.lo));

    }

}

/// Link shared code against local definitions and dependency exports.

unsafe fn link(e: &mut emit::Emitter, base: u64, local: &[Symbol], imports: &[Symbol]) throws (Error) {

    for i in 0..e.pendingCalls.len {

        let pending = e.pendingCalls[i];

        let address = try function(local, imports, pending.target);

        try relative(e, pending.index, base, address, super::SCRATCH1, true);

    }

    for i in 0..e.pendingJumps.len {

        let pending = e.pendingJumps[i];

        let address = try function(local, imports, pending.target);

        let delta = image::displacement(base + pending.index as u64 * 4, address) else { throw Error::Range; };

        if not encode::isJumpImm(delta) { throw Error::Range; }

        emit::patch(e, pending.index, encode::jal(pending.rd, delta));

    }

    for i in 0..e.pendingAddrLoads.len {

        let pending = e.pendingAddrLoads[i];

        if not pending.isData {

            try relative(e, pending.index, base, try function(local, imports, pending.target), pending.rd, false);

            continue;

        }

        let target = try resolve(local, imports, pending.target);

        let location = try dataRef(target);

        if location.slot >= MAX_PACKAGES or location.offset > 0x7ffff7ff { throw Error::Range; }

        if pending.rd == super::ADDR_SCRATCH or pending.rd == super::GP or pending.rd == super::ZERO {

            throw Error::Symbol;

        }

        let parts = emit::splitImm(location.offset as i32);

        emit::patch(e, pending.index, encode::ld(pending.rd, super::GP, location.slot as i32 * 8));

        emit::patch(e, pending.index + 1, encode::lui(super::ADDR_SCRATCH, parts.hi));

        emit::patch(e, pending.index + 2, encode::add(pending.rd, pending.rd, super::ADDR_SCRATCH));

        emit::patch(e, pending.index + 3, encode::addi(pending.rd, pending.rd, parts.lo));

    }

}

/// Write a little-endian integer into a validated byte extent.

fn integer(bytes: &mut [u8], offset: u32, value: u64, width: u32) {

    for i in 0..width { set bytes[offset + i] = (value >> (i as u64 * 8)) as u8; }

}

/// Initialized output extents.

record TemplateSize: Copy {

    /// Initialized byte count.

    bytes: u32,

    /// Private pointer fixup count.

    relocations: u32,

}

/// Build initialized bytes and compact private pointer fixups.

unsafe fn template(items: *[il::Data], local: &[Symbol], imports: &[Symbol], bytes: &mut [u8], relocs: &mut [Relocation])

    -> TemplateSize throws (Error)

{

    let mut initialized: u32 = 0;

    let mut count: u32 = 0;

    for item in items {

        if item.isZeroInit { continue; }

        let location = try dataRef(try resolve(local, &[], item.name));

        if location.offset > bytes.len or item.size > bytes.len - location.offset { throw Error::Capacity; }

        let end = location.offset + item.size;

        if end > initialized { set initialized = end; }

    }

    for i in 0..initialized { set bytes[i] = 0; }

    for item in items {

        if item.isZeroInit { continue; }

        let location = try dataRef(try resolve(local, &[], item.name));

        let mut offset = location.offset;

        let end = offset + item.size;

        for value in item.values {

            let mut width: u32 = 1;

            let mut number: u64 = 0;

            match value.item {

                case il::DataItem::Val { typ, val } => { set width = il::typeSize(typ); set number = val as u64; },

                case il::DataItem::Fn(name) => { set width = 8; set number = try function(local, imports, name); },

                case il::DataItem::Sym(name) => {

                    set width = 8;

                    let target = try dataRef(try resolve(local, imports, name));

                    if value.count > 0 {

                        if count == relocs.len { throw Error::Capacity; }

                        set relocs[count] = Relocation { offset, count: value.count, target };

                        set count += 1;

                    }

                },

                case il::DataItem::Str(s) => { set width = s.len; },

                case il::DataItem::Undef => {},

            }

            if width > 0 and value.count > (end - offset) / width { throw Error::Range; }

            for _ in 0..value.count {

                match value.item {

                    case il::DataItem::Str(s) => { try! mem::copy(&mut bytes[offset..offset + width], s); },

                    else => { integer(bytes, offset, number, width); },

                }

                set offset += width;

            }

        }

    }

    return TemplateSize { bytes: initialized, relocations: count };

}

/// Compile one package into caller-owned code, symbol, and private template storage.

/// Imports must contain unique exports from the package's admitted dependencies.

/// Arena storage and binary package names must outlive the returned catalog entry.

export unsafe fn compile(input: &binary::Package, slot: u32, codeAddress: u64, imports: &[Symbol],

    storage: Storage, arena: &mut alloc::Arena, scratch: &mut alloc::Arena) -> Package throws (Error)

{

    let case Storage { data: dataStorage, symbols: symbolStorage, exports: exportStorage, template: templateStorage, relocations: relocationStorage } = storage

        else panic "expected shared linker storage";

    if slot >= MAX_PACKAGES { throw Error::Range; }

    if (codeAddress & 3) <> 0 { throw Error::Alignment; }

    for imported, i in imports {

        if lookup(&imports[..i], imported.name) <> nil { throw Error::Symbol; }

    }

    let mut generator = super::beginProgram(super::ProgramOptions {

        entryPatch: super::EntryPatch::None, debug: false, placement: image::Placement::Hosted,

    }, arena);

    set generator.e.sharedData = true;

    for func in input.program.fns { super::generateFunction(&mut generator, func, scratch); }

    if codeAddress > 0xffffffffffffffff - generator.e.codeLen as u64 * 4 { throw Error::Range; }

    let mut symbols: u32 = 0;

    for func in &generator.e.funcs[..] {

        try define(symbolStorage, &mut symbols, func.name, Target::Function(codeAddress + func.index as u64 * 4));

    }

    let mut dataCount: u32 = 0;

    let roSize = try data::layoutSection(input.program.data, dataStorage, &mut dataCount, 0, true)

        catch { throw Error::Range; };

    let memory = try data::layoutSectionAtOffset(input.program.data, dataStorage, &mut dataCount, 0, roSize, false)

        catch { throw Error::Range; };

    if memory > 0x7ffff7ff { throw Error::Range; }

    for item in &dataStorage[..dataCount] {

        try define(symbolStorage, &mut symbols, item.name, Target::Data(DataRef { slot, offset: item.addr as u32 }));

    }

    let local = &symbolStorage[..symbols];

    for symbol in local { if lookup(imports, symbol.name) <> nil { throw Error::Symbol; } }

    try link(&mut generator.e, codeAddress, local, imports);

    let size = try template(input.program.data, local, imports, templateStorage, relocationStorage);

    if input.exports.len > exportStorage.len { throw Error::Capacity; }

    for exported, i in input.exports {

        let target = try resolve(local, &[], exported.name);

        match exported.kind {

            case binary::ExportKind::Function => { try function(local, &[], exported.name); },

            case binary::ExportKind::Data => { try dataRef(target); },

        }

        if lookup(&exportStorage[..i], exported.name) <> nil { throw Error::Symbol; }

        set exportStorage[i] = Symbol { name: exported.name, target };

    }

    let mut entry: ?u64 = nil;

    if let name = input.entry { set entry = try function(&exportStorage[..input.exports.len], &[], name); }

    let mut alignment: u32 = 8;

    for item in input.program.data { if item.alignment > alignment { set alignment = item.alignment; } }

    return Package {

        name: input.name, dependencies: input.dependencies, slot, codeAddress,

        code: emit::getCode(&generator.e), exports: &exportStorage[..input.exports.len], entry,

        template: &templateStorage[..size.bytes], memory, alignment,

        relocations: &relocationStorage[..size.relocations],

    };

}

/// Initialize private package memory after all graph bases have been assigned.

/// Validate every fixup before writing bytes so a rejected instance stays intact.

export fn instantiate(package: &Package, bases: &[u64], memory: &mut [u8]) throws (Error) {

    if package.slot >= bases.len or bases[package.slot] == 0 { throw Error::Instance; }

    if memory.len < package.memory or package.template.len > package.memory { throw Error::Capacity; }

    if (bases[package.slot] & (package.alignment as u64 - 1)) <> 0 { throw Error::Alignment; }

    if bases[package.slot] > 0xffffffffffffffff - package.memory as u64 { throw Error::Range; }

    for fixup in package.relocations {

        if fixup.target.slot >= bases.len or bases[fixup.target.slot] == 0 { throw Error::Instance; }

        if bases[fixup.target.slot] > 0xffffffffffffffff - fixup.target.offset as u64 { throw Error::Range; }

        if fixup.offset > package.memory or fixup.count > (package.memory - fixup.offset) / 8 { throw Error::Range; }

    }

    for i in 0..package.memory { set memory[i] = 0; }

    try! mem::copy(memory, package.template);

    for fixup in package.relocations {

        let address = bases[fixup.target.slot] + fixup.target.offset as u64;

        for i in 0..fixup.count { integer(memory, fixup.offset + i * 8, address, 8); }

    }

}

//! Private template relocation and bounded linking checks.

use std::testing;

use std::lang::alloc;

use std::lang::il;

use std::lang::il::binary;

use std::lang::gen::data;

/// Code generation workspace reused between checks.

static ARENA: [u8; 16777216] = [0; 16777216];

/// Function allocation workspace.

static SCRATCH: [u8; 16777216] = [0; 16777216];

/// Persistent catalog symbols.

unsafe static SYMBOLS: [super::Symbol; 8] = undefined;

/// Persistent exported symbols.

unsafe static EXPORTS: [super::Symbol; 8] = undefined;

/// Data layout workspace.

unsafe static DATA: [data::DataSym; 8] = undefined;

/// Persistent initialized bytes.

static TEMPLATE: [u8; 64] = [0; 64];

/// Persistent private data relocations.

unsafe static RELOCS: [super::Relocation; 8] = undefined;

/// Build a package with repeated dependency pointers and a high code pointer.

unsafe fn input() -> binary::Package {

    return binary::Package {

        symbols: &[], name: "p", dependencies: &["dep"],

        exports: &[binary::Export { name: "p::refs", kind: binary::ExportKind::Data }],

        entry: nil,

        program: il::Program {

            data: &[

                il::Data {

                    name: "p::refs", size: 32, alignment: 8, readOnly: true, isZeroInit: false,

                    values: &[

                        il::DataValue { item: il::DataItem::Sym("dep::value"), count: 2 },

                        il::DataValue { item: il::DataItem::Fn("dep::call"), count: 1 },

                    ],

                },

                il::Data {

                    name: "p::zero", size: 16, alignment: 16, readOnly: false, isZeroInit: true, values: &[],

                },

            ],

            fns: &[],

        },

    };

}

/// Compile into small persistent tables.

unsafe fn compile(imports: &[super::Symbol], capacity: u32) -> super::Package throws (super::Error) {

    let mut arena = alloc::new(&mut ARENA[..]);

    let mut scratch = alloc::new(&mut SCRATCH[..]);

    let package = input();

    return try super::compile(&package, 2, 0x180000000, imports,

        super::Storage {

            data: &mut DATA[..], symbols: &mut SYMBOLS[..], exports: &mut EXPORTS[..],

            template: &mut TEMPLATE[..capacity], relocations: &mut RELOCS[..],

        }, &mut arena, &mut scratch);

}

/// Dependency exports with a full-width function pointer and a large data offset.

fn imports() -> *[super::Symbol] {

    return &[

        super::Symbol { name: "dep::value", target: super::Target::Data(super::DataRef { slot: 1, offset: 8192 }) },

        super::Symbol { name: "dep::call", target: super::Target::Function(0x180001234) },

    ];

}

/// Read a little-endian pointer without requiring buffer alignment.

fn pointer(bytes: &[u8], offset: u32) -> u64 {

    let mut value: u64 = 0;

    for i in 0..8 { set value |= bytes[offset + i] as u64 << (i as u64 * 8); }

    return value;

}

/// Check repeated pointers, full-width code addresses, padding, and zero-filled tails.

@test unsafe fn privateRelocations() throws (testing::TestError) {

    let package = try compile(imports(), 64) catch { throw testing::TestError::Failed; };

    try testing::expect(package.template.len == 32 and package.memory == 48 and package.alignment == 16);

    try testing::expect(package.relocations.len == 1 and package.relocations[0].count == 2);

    try testing::expect(pointer(package.template, 16) == 0x180001234);

    let mut first: [u8; 48] = [255; 48];

    let mut second: [u8; 48] = [255; 48];

    try super::instantiate(&package, &[0, 0x180002000, 0x180008000], &mut first[..])

        catch { throw testing::TestError::Failed; };

    try super::instantiate(&package, &[0, 0x280002000, 0x280008000], &mut second[..])

        catch { throw testing::TestError::Failed; };

    try testing::expect(pointer(&first[..], 0) == 0x180004000 and pointer(&first[..], 8) == 0x180004000);

    try testing::expect(pointer(&second[..], 0) == 0x280004000 and pointer(&second[..], 8) == 0x280004000);

    try testing::expect(pointer(&first[..], 16) == pointer(&second[..], 16));

    for i in 24..48 { try testing::expect(first[i] == 0 and second[i] == 0); }

}

/// A missing instance, bad base, or short buffer leaves instance bytes untouched.

@test unsafe fn instanceFailures() throws (testing::TestError) {

    let package = try compile(imports(), 64) catch { throw testing::TestError::Failed; };

    let mut bytes: [u8; 48] = [255; 48];

    let mut failed: u32 = 0;

    try super::instantiate(&package, &[0, 0, 0x8000], &mut bytes[..]) catch err {

        try testing::expect(err == super::Error::Instance); set failed += 1;

    };

    try super::instantiate(&package, &[0, 0x2000, 0x8008], &mut bytes[..]) catch err {

        try testing::expect(err == super::Error::Alignment); set failed += 1;

    };

    try super::instantiate(&package, &[0, 0x2000, 0x8000], &mut bytes[..47]) catch err {

        try testing::expect(err == super::Error::Capacity); set failed += 1;

    };

    try super::instantiate(&package, &[0, 0xffffffffffffffff, 0x8000], &mut bytes[..]) catch err {

        try testing::expect(err == super::Error::Range); set failed += 1;

    };

    try testing::expect(failed == 4);

    for byte in &bytes[..] { try testing::expect(byte == 255); }

}

/// Missing symbols, duplicate imports, kind mismatches, and short output fail explicitly.

@test unsafe fn linkFailures() throws (testing::TestError) {

    let mut failed: u32 = 0;

    try compile(&[], 64) catch err {

        try testing::expect(err == super::Error::Symbol); set failed += 1;

    };

    let names = imports();

    try compile(&[names[0], names[0]], 64) catch err {

        try testing::expect(err == super::Error::Symbol); set failed += 1;

    };

    try compile(&[

        super::Symbol { name: "dep::value", target: super::Target::Function(0x8000) }, names[1],

    ], 64) catch err {

        try testing::expect(err == super::Error::Symbol); set failed += 1;

    };

    try compile(names, 31) catch err {

        try testing::expect(err == super::Error::Capacity); set failed += 1;

    };

    try testing::expect(failed == 4);

    let package = try compile(names, 64) catch { throw testing::TestError::Failed; };

    try testing::expect(package.exports.len == 1);

}

lib/std/arch/rv64/shared.rad

lib/std/arch/rv64/shared/tests.rad