Gabriel Kaszewski
8d2c40cb1e
- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory - Quota per process, page tables charged to owner - Regions for shared mem + device MMIO, torn down w/ owner - Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va - RequestPages/ReleasePages/MapPage(move) checked vs kernel records - user window 0x1000..32MiB, private pts by construction - boot loader + device setup go through kernel api - kernel built in place, boot allocator bounded - isolation tests, randomized invariant test, FrameTable kani proofs - fixes: inflated release, unmapped release, dst va unchecked, heap overflow, unbounded pt alloc, unzeroed frames, double free
38 lines
778 B
Rust
38 lines
778 B
Rust
use super::quota::Quota;
|
|
|
|
#[test]
|
|
fn charge_within_limit_succeeds() {
|
|
let mut q = Quota::new(4);
|
|
assert!(q.charge(3));
|
|
assert_eq!(q.used(), 3);
|
|
assert!(q.charge(1));
|
|
assert_eq!(q.used(), 4);
|
|
}
|
|
|
|
#[test]
|
|
fn charge_past_limit_fails_and_changes_nothing() {
|
|
let mut q = Quota::new(4);
|
|
q.charge(3);
|
|
assert!(!q.charge(2));
|
|
assert_eq!(q.used(), 3);
|
|
}
|
|
|
|
#[test]
|
|
fn uncharge_cannot_underflow() {
|
|
let mut q = Quota::new(4);
|
|
q.charge(1);
|
|
assert!(!q.uncharge(2));
|
|
assert_eq!(q.used(), 1);
|
|
assert!(q.uncharge(1));
|
|
assert_eq!(q.used(), 0);
|
|
}
|
|
|
|
#[test]
|
|
fn limit_can_be_raised_but_not_below_usage() {
|
|
let mut q = Quota::new(4);
|
|
q.charge(3);
|
|
assert!(!q.set_limit(2));
|
|
assert!(q.set_limit(10));
|
|
assert!(q.charge(7));
|
|
}
|