//! Freestanding compilation and placement of trusted binary RIL images.

//!

//! Structural and backend-capacity checks do not establish memory safety,

//! pointer provenance, or authority confinement of generated native code.

export mod graph;

export mod native;

mod layout;

use std::mem;

use std::collections::dict;

use std::lang::alloc;

use std::lang::strings;

use std::lang::il;

use std::arch::rv64;

use std::arch::rv64::emit;

/// One explicitly permitted native function in the trusted execution environment.

export record Binding: Copy {

    /// Exact qualified external declaration name.

    name: *[u8],

    /// Callable native address using the image's register and stack ABI.

    address: u64,

}

/// Immutable native image entry and separately instantiated private state.

export record Descriptor: Copy {

    /// Native entry receiving the domain Env pointer in a0.

    entry: u64,

    /// Read-only bytes copied into each domain's private allocation.

    initial: u64,

    /// Number of private state bytes required by one domain.

    stateSize: u32,

    /// Power-of-two alignment required by the private allocation.

    stateAlignment: u32,

    /// Repair private pointers after copying the initializer to its new base.

    relocate: fn(u64),

}

/// Prepared native output borrowing caller-owned compiler storage until finish.

/// Its metadata must not be mutated by the caller; only size and alignment are

/// needed to obtain a destination allocation. No compiler storage escapes finish.

export record Prepared: Copy {

    /// Minimum destination capacity in bytes.

    size: u32,

    /// Required power-of-two destination base alignment.

    alignment: u32,

    /// Final position-independent native instruction words.

    code: *[u32],

    /// Immutable initializer bytes containing allocation-relative pointers.

    data: *[u8],

    /// Flattened initializer declarations used to identify pointer slots.

    items: *[il::Data],

    /// Allocation-relative byte offset of native code.

    codeOffset: u32,

    /// Allocation-relative byte offset of the trusted entry wrapper.

    entryOffset: u32,

    /// Allocation-relative byte offset of the private initializer.

    initialOffset: u32,

    /// Allocation-relative byte offset of the private pointer repair helper.

    relocateOffset: u32,

    /// Number of separately allocated private state bytes.

    stateSize: u32,

    /// Alignment required by separately allocated private state.

    stateAlignment: u32,

    /// Immutable source range excluded from destination placement.

    source: *[u8],

    /// Persistent compiler arena range excluded from destination placement.

    arena: *[u8],

    /// Temporary compiler arena range excluded from destination placement.

    scratch: *[u8],

    /// Caller-owned interning pool range excluded from destination placement.

    pool: *[u8],

}

/// Reject wrapping memory ranges before overlap or placement arithmetic.

fn range(bytes: *[u8]) throws (il::binary::Error) {

    let base = bytes.ptr as u64;

    if bytes.len as u64 > 0xFFFFFFFFFFFFFFFF - base {

        throw il::binary::error(0, "image memory range wraps address space");

    }

}

/// Detect overlap between already checked byte ranges without pointer ordering.

fn overlap(a: *[u8], b: *[u8]) -> bool {

    if a.len == 0 or b.len == 0 { return false; }

    let first = a.ptr as u64;

    let second = b.ptr as u64;

    return first < second + b.len as u64 and second < first + a.len as u64;

}

/// Require aligned, disjoint compiler storage and a caller-initialized empty pool.

fn storage(source: *[u8], arena: *alloc::Arena, scratch: *alloc::Arena, pool: *strings::Pool) throws (il::binary::Error) {

    try range(source); try range(arena.data); try range(scratch.data);

    let poolBytes = @sliceOf(pool as *opaque as *u8, @sizeOf(strings::Pool));

    try range(poolBytes);

    if arena.offset > arena.data.len or scratch.offset > scratch.data.len

        or arena.data.len > 0x7FFFFFFF or scratch.data.len > 0x7FFFFFFF

        or arena.data.ptr as u64 % 8 <> 0 or scratch.data.ptr as u64 % 8 <> 0 {

        throw il::binary::error(0, "invalid image compiler arena");

    }

    if overlap(arena.data, scratch.data) or overlap(source, arena.data) or overlap(source, scratch.data)

        or overlap(poolBytes, arena.data) or overlap(poolBytes, scratch.data) or overlap(poolBytes, source) {

        throw il::binary::error(0, "image compiler storage overlaps");

    }

    if pool.count <> 0 { throw il::binary::error(0, "image compiler requires an empty string pool"); }

    for i in 0..pool.table.len {

        if pool.table[i].len <> 0 { throw il::binary::error(0, "image compiler requires an empty string pool"); }

    }

}

/// Decode and compile a closed trusted image using the shared RV64 backend.

/// Source stays immutable through finish. Arena, scratch, and empty pool must

/// be disjoint and live through finish; arenas require eight-byte aligned bases.

/// The emitter reserves an eight-MiB code buffer plus fixed symbol/relocation

/// tables in arena. Remaining arena use depends on names and initialized data;

/// scratch holds the decoded graph and one function's register allocation at a

/// time. Every exhaustion is reported as a binary Error. Failed preparation may

/// consume both arenas and pool; reclaim them together before the next attempt.

export fn prepare(source: *[u8], bindings: *[Binding], arena: *mut alloc::Arena,

    scratch: *mut alloc::Arena, pool: *mut strings::Pool) -> Prepared throws (il::binary::Error) {

    if source.len > 16 * 1024 * 1024 { throw il::binary::error(0, "binary image exceeds capacity"); }

    try storage(source, arena, scratch, pool);

    if bindings.len > 4096 { throw il::binary::error(0, "too many native image bindings"); }

    let mut bindingIndex = try il::binary::dictionary(scratch, bindings.len, 0);

    for binding, i in bindings {

        if binding.name.len <= 11 or not mem::eq(&binding.name[..11], "user::sys::")

            or binding.address == 0 or binding.address % 4 <> 0 {

            throw il::binary::error(0, "invalid native image binding");

        }

        if dict::get(&bindingIndex, binding.name) <> nil { throw il::binary::error(0, "duplicate native image binding"); }

        dict::insert(&mut bindingIndex, binding.name, i as i32);

    }

    let image = try il::binary::decode(source, scratch, pool);

    let plan = try graph::plan(&image, scratch);

    let names = try graph::names(&image.program, 0, pool, arena);

    let stateName = try graph::name("images::state_", 0, "", pool, arena);

    let initial = try native::initializer(&plan, &names, stateName, arena, scratch);

    let emitter = try emit::emitter(arena, false) catch { throw il::binary::error(0, "native image emitter arena exhausted"); };

    let mut generator = rv64::Generator { e: emitter, entryPatch: rv64::EntryPatch::None };

    for function, i in image.program.fns {

        if not function.isExtern { continue; }

        if function.params.len > rv64::ARG_REGS.len { throw il::binary::error(0, "image native declaration has too many arguments"); }

        let binding = dict::get(&bindingIndex, function.name) else {

            throw il::binary::error(0, "unresolved image sys native declaration");

        };

        try native::trampoline(&mut generator, names.functions[i], bindings[binding as u32].address);

    }

    let mut offsets = try il::binary::dictionary(scratch, plan.order.len, 0);

    for item, i in plan.items {

        if not item.readOnly { dict::insert(&mut offsets, names.data[i], plan.offsets[i] as i32); }

    }

    set generator.e.instanceData = &offsets;

    for function, i in image.program.fns {

        if function.isExtern { continue; }

        let renamed = try graph::function(function, i, &plan, &names, scratch);

        try native::function(&mut generator, &renamed, scratch);

    }

    set generator.e.instanceData = nil;

    try native::helpers(&mut generator, 0, &plan, &names, &initial, pool, arena);

    let placed = try layout::prepare(&mut generator, initial.items, arena, scratch);

    let entryName = try graph::name("images::native_", 0, "", pool, arena);

    let relocateName = try graph::name("images::relocate_", 0, "", pool, arena);

    let entryOffset = placed.codeOffset + (try layout::functionOffset(&generator.e, entryName));

    let relocateOffset = placed.codeOffset + (try layout::functionOffset(&generator.e, relocateName));

    let initialOffset = dict::get(&placed.symbols.dict, stateName) else {

        throw il::binary::error(0, "unresolved native image initializer");

    };

    return Prepared { size: placed.size, alignment: placed.alignment, code: emit::getCode(&generator.e),

        data: placed.bytes, items: initial.items, codeOffset: placed.codeOffset, entryOffset,

        initialOffset: initialOffset as u32, relocateOffset, stateSize: plan.size, stateAlignment: plan.alignment,

        source, arena: arena.data, scratch: scratch.data, pool: @sliceOf(pool as *opaque as *u8, @sizeOf(strings::Pool)) };

}

/// Copy prepared native bytes and relocate persistent pointers at destination.

/// Destination must be aligned, large enough, and disjoint from compiler storage

/// and source. No allocation or compilation occurs here. The returned descriptor

/// borrows only destination, which must remain immutable for its execution life.

/// The caller must synchronize instruction fetch before any hart enters the code.

export fn finish(prepared: *mut Prepared, destination: *mut [u8]) -> Descriptor throws (il::binary::Error) {

    try range(destination);

    let base = destination.ptr as u64;

    if base == 0 or prepared.alignment == 0 or prepared.alignment & (prepared.alignment - 1) <> 0

        or base % prepared.alignment as u64 <> 0 or destination.len < prepared.size {

        throw il::binary::error(0, "invalid native image destination");

    }

    let output = &mut destination[..prepared.size];

    if overlap(output, prepared.source) or overlap(output, prepared.arena)

        or overlap(output, prepared.scratch) or overlap(output, prepared.pool) {

        throw il::binary::error(0, "native image destination overlaps compiler storage");

    }

    try! mem::copy(output, prepared.data);

    for i in prepared.data.len..prepared.codeOffset { set output[i] = 0; }

    let code = @sliceOf(prepared.code.ptr as *u8, prepared.code.len * rv64::INSTR_SIZE as u32);

    try! mem::copy(&mut output[prepared.codeOffset..], code);

    layout::rebase(prepared.items, output, base);

    let relocateAddress = base + prepared.relocateOffset as u64;

    let relocate = *(&relocateAddress as *opaque as *fn(u64));

    return Descriptor { entry: base + prepared.entryOffset as u64, initial: base + prepared.initialOffset as u64,

        stateSize: prepared.stateSize, stateAlignment: prepared.stateAlignment,

        relocate };

}