/* vm.h — the register interpreter (spec §5): Lua-style window-overlap * calls, dual-flavor dispatch (computed goto / WO_ISO_C switch), structured * trap errors with line lookup, drop-map unwinding on trap. */ #ifndef WO_VM_H #define WO_VM_H #include /* runtime-v2 4: the saved-termios table */ #include "loader.h" /* structured trap error (spec §6): one shape forever — the CLI prints it, * the future service layer maps it to HTTP */ typedef struct wo_err { uint32_t code; /* WO_T_* */ uint32_t line; /* source line at the trapping pc; 0 = unknown */ char method[64]; /* name of the trapping method */ char msg[96]; /* human-readable reason */ } wo_err; typedef struct wo_frame { uint32_t method; /* method index */ uint32_t pc; /* saved resume pc (next instruction) */ uint32_t base; /* register-window base in the value stack */ } wo_frame; /* One live `try` region (haxe-parity compiler Task 5, WOP_TRY). `depth` * is the frame depth that registered it, so a trap raised deeper unwinds * every frame above that one and lands here; `pc` is the handler's * instruction in that frame's method; `reg` is the window-relative * register the error record is built into. */ typedef struct wo_catch { uint32_t depth; uint32_t pc; uint32_t reg; } wo_catch; #define WO_MAX_CATCH 64u /* The concurrency arc (iterations 8+11, stage 1): a FIBER is exactly the * interpreter state the vm used to hold inline — the register window, the * frame stack, the catch stack, and the caught-error slot. The vm owns * the shard-wide pieces (module, runtime, and which fiber is live). * Stage 1 Task 1 is a pure extraction: one embedded fiber, `cur` always * points at it, behavior byte-identical. */ typedef enum { WO_FIB_RUNNABLE = 0, WO_FIB_PARKED = 1, /* stage 1 Task 4: waiting on an fd/deadline */ WO_FIB_DONE = 2, } wo_fib_state; typedef struct wo_fiber { uint64_t regs[WO_STACK_SLOTS]; wo_frame frames[WO_MAX_FRAMES]; uint32_t depth; /* the catch stack, innermost last; ncatch = 0 means every trap is * the uncaught kind and behaves exactly as it did before Task 5 */ wo_catch catches[WO_MAX_CATCH]; uint32_t ncatch; /* the error a caught trap landed with, read by WO_B_ERR_FILL while * the catch arm builds its record */ wo_err caught; wo_fib_state state; struct wo_fiber *next; /* intrusive FIFO link (run queue) */ /* parking (arc T4): what this fiber waits on while PARKED. park_done * says how it resumes — 0 = re-execute the builtin (fd readiness: * accept/read/write retry, now ready), 1 = continue PAST it (sleep: * the result was preset before parking). park_wr_at carries a partial * net.write's progress across the retry. park_ts must outlive the * ring submission (TIMEOUT reads it asynchronously). */ struct wo_fiber *pnext; /* parked-list link */ int park_fd; /* -1 = deadline-only (sleep) */ short park_events; /* POLLIN / POLLOUT */ int park_done; int64_t park_deadline; /* wall ms, sleep only */ uint32_t park_wr_at; struct { long long sec, nsec; } park_ts; /* arc actors: when this fiber is an actor's delivery fiber, `actor` * points at it and `cur_msg` is the message the current receive call * borrows — the RUNTIME owns it and drops it after the call returns. */ struct wo_actor *actor; uint64_t cur_msg; /* arc stage 3: the in-flight DB request while parked on the DB actor's * reply (a wo_db_req*, opaque here; vm.c owns the protocol) */ void *dbreq; /* iteration 24, caller side of call(): 0 = no call in flight, * 1 = parked awaiting the reply, 2 = reply landed (call_reply is the * scalar), 3 = the callee was/went dead (the re-executed builtin * traps WO_T_ACTOR). Set on the caller's own thread or under its * shard's inbox drain — never concurrently with the fiber running. */ int call_state; uint64_t call_reply; /* iteration 24, delivery side: the CURRENT message's caller (NULL for * a plain send) — where FIBER_DONE ships the receive's return value. */ struct wo_fiber *msg_caller; uint32_t msg_caller_shard; /* iteration 35: the in-flight per-CALL deadline (_dl builtins). Set on * the builtin's first entry, cleared when it answers — the park/retry * protocol re-executes the builtin, and this is how the retry knows * the original deadline. */ int dl_active; int64_t dl_at; /* wall ms */ /* iteration 42: the in-flight child while parked inside proc.run — a * slot in the vm's children table (sysio.c owns the protocol). NULL * when no run is in flight. A reaped fiber's child is killed with it * (wo_proc_abandon from fib_reap). */ struct wo_child *proc_st; } wo_fiber; /* arc stage 3: park_fd sentinel — PARKED with NO plane wait; the wake is * an inbox envelope (the DB actor's reply). Excluded from the deadline * scans, which key on park_fd == -1 exactly. */ #define WO_PARK_INBOX (-2) /* iteration 24: one mailbox slot. A plain send has caller == NULL; a * call carries the parked caller so the delivery's return value can * route home as a kind-6 envelope (or a same-shard unpark). */ typedef struct wo_msg { uint64_t payload; struct wo_fiber *caller; /* NULL = send */ uint32_t caller_shard; } wo_msg; /* An actor: moved-in state, its receive method, a FIFO mailbox, and at * most one delivery fiber at a time (one message at a time — the actor * guarantee). Death (iteration 24): a receive trapping uncaught marks * the actor dead — sends to it drop silently, calls trap, queued * callers are error-unparked; the state and mailbox are released. */ /* iteration 24 T4: one death-notice registration. The runtime owns the * moved-in notice message until delivery (or drops it if the observer is * unreachable). The list lives on the WATCHED actor, owned by its home * thread. */ typedef struct wo_monitor { struct wo_actor *observer; uint64_t msg; struct wo_monitor *next; } wo_monitor; /* iteration 24 T5: one armed one-shot timer — fires as an ordinary * runtime send of the moved message when `at` passes. The list lives on * the ARMING fiber's shard and is scanned by the same deadline machinery * that serves fd-park deadlines. */ typedef struct wo_timer { int64_t at; /* wall ms */ struct wo_actor *target; uint64_t msg; struct wo_timer *next; } wo_timer; typedef struct wo_actor { uint64_t instance; /* the moved-in state object (runtime-owned) */ uint32_t method; /* receive's method index (self + msg = 2 args) */ uint32_t home; /* the shard whose thread owns mailbox + delivery */ int dead; /* set on the home thread when a receive traps */ wo_msg *msgs; /* FIFO ring, growable up to the cap */ uint32_t mhead, mlen, mcap; /* iteration 24: sent-but-not-delivered count, incremented by the * SENDER on any shard (the cap check), decremented by the home * thread at delivery pop. Accessed ONLY through __atomic builtins * (wo_mbox_reserve/release) because senders race; the cap can * overshoot by at most the number of in-flight sends — disclosed. */ uint32_t pending; wo_fiber *active; /* the delivery fiber, NULL when idle */ wo_monitor *monitors; /* iteration 24 T4: who wants the death notice */ struct wo_actor *next_all; /* the vm's all-actors list */ } wo_actor; /* iteration 42: one live child process (proc.run in flight). The slot is * the cross-park state: the _dl retry protocol re-executes the builtin, * and this is where a re-entry finds its buffers, fds and caps. Slots * live in the owning shard's vm (no locks — one thread), capped at * WO_PROC_MAX; the claim failing closed IS the concurrency ceiling. */ typedef struct wo_child { int used; int pid; int pidfd, epfd; /* pidfd_open handle; the epoll bundle the fiber parks on */ int ofd, efd; /* pipe read ends, O_NONBLOCK; -1 once EOF-closed */ char *obuf, *ebuf; size_t olen, elen, oalloc, ealloc; uint64_t out_cap, err_cap; struct wo_fiber *owner; /* runtime-v2 1/2: the STREAMING child. The caller owns the stdio fds * (Child.stdin/stdout/stderr, closed with net.close — the slot never * touches them: fd numbers get recycled); the slot owns pid + pidfd * and, for a PTY child, a private dup of the master for resize. * `gen` makes the language-visible id ((gen << 6) | index) refuse * stale handles by name. One waiter at a time parks on the pidfd. */ int streaming; uint32_t gen; int master_dup; /* -1 = pipe child */ struct wo_fiber *waiter; /* the one wait_dl parker, NULL when none */ struct wo_actor *owner_actor; /* NULL = the program owns it */ } wo_child; #define WO_PROC_MAX 32u /* runtime-v2 9 F3c-net: this shard's live TLS connections (net.connect_tls), * capped like the child slots. sysio.c owns struct wo_tls_conn. */ #define WO_TLS_MAX 64u struct wo_tls_conn; /* sysio.c: kill+reap the fiber's in-flight child, if any (fib_reap), and * every live child on the shard (wo_vm_destroy / engine stop). * runtime-v2: abandon_actor kills the streaming children a dying actor * owns (actor_die); wo_proc_abandon also clears a dead fiber's waiter. */ struct wo_vm; void wo_proc_abandon(struct wo_vm *vm, wo_fiber *fb); void wo_proc_abandon_actor(struct wo_vm *vm, struct wo_actor *a); void wo_proc_reap_all(struct wo_vm *vm); /* runtime-v2 9 F3c-net: close every live TLS connection + free the CA bundle * on shard teardown (sysio.c owns it; wo_vm_destroy calls it). */ void wo_tls_reap_all(struct wo_vm *vm); /* runtime-v2 3 (sysio.c): turn latched signals into Signal-record sends. * Cheap when nothing arrived; called from wo_io_wait and the inbox * drain. wo_actor_notify is vm.c's runtime_notify, exported for it. */ void wo_vm_signals_drain(struct wo_vm *vm); void wo_actor_notify(struct wo_vm *vm, struct wo_actor *target, uint64_t payload, const char *what); /* runtime-v2 4 (sysio.c): restore the ttys a dying fiber raw'd (full * unwind / fib_reap), or every saved tty (wo_vm_destroy). */ void wo_term_abandon(struct wo_vm *vm, wo_fiber *fb); void wo_term_restore_all(struct wo_vm *vm); /* iteration 24: the one mailbox cap (default 1024, WO_MAILBOX overrides * at boot — soak tests shrink it to force the fail-fast policy). */ extern uint32_t wo_mailbox_cap; int wo_mbox_reserve(wo_actor *a); /* 0 = slot reserved; -1 = full */ void wo_mbox_release(wo_actor *a); /* delivery pop / failed enqueue */ typedef struct wo_vm { const wo_module *mod; wo_rt rt; /* the arc's stage 2: which shard this vm IS. Shard 0 is the primary * (runs the entry, owns the database); workers run wo_vm_serve. */ uint32_t shard_id; int is_primary; int wake_efd; /* wakes this shard's I/O wait (inbox arrivals, shutdown) */ /* the cross-shard inbox (arc T6): OTHER shards push envelopes here * under in_mu and write wake_efd; only the OWNING thread pops. A * mutex-guarded list, not the spec's lock-free ring — disclosed * deviation, rings arrive when 9e measures the mutex. */ void *in_mu; /* pthread_mutex_t*, opaque here */ struct wo_envelope *in_head, *in_tail; /* home-routed frees: objects owned by THIS shard's arena, dropped on * another shard, come back here to die (header shard_id routes) */ struct wo_envelope *free_head; wo_fiber f0; /* fiber 0: main — embedded; spawned fibers are calloc'd */ wo_fiber *cur; /* the live fiber — every interpreter access goes here */ wo_fiber *qhead, *qtail; /* RUNNABLE fibers awaiting the interpreter */ uint32_t nfibers; /* live fibers besides main */ int64_t budget0; /* reductions per slice (WO_REDUCTIONS, default 4000) */ int64_t budget; /* countdown for the live fiber */ wo_actor *actors; /* every spawned actor (torn down at destroy) */ /* the I/O plane (arc T4, park.c): io_uring primary, epoll fallback */ wo_fiber *parked; /* fibers waiting on the plane */ uint32_t nparked; /* iteration 35: dead fibers are POOLED, never freed mid-run — a stale * plane completion (the loser of a poll-vs-deadline race, consumed one * wait later) may still read the fiber's `state` word, and reading * freed memory is the UAF this prevents. Steady-state pool size = the * peak live fiber count; the pool dies with the vm. */ wo_fiber *fib_pool; /* iteration 24 T5: this shard's armed timers (unsorted list — the * deadline scan is already linear; a wheel is measured-later work) */ wo_timer *timers; /* iteration 42: this shard's live children (proc.run in flight) */ wo_child children[WO_PROC_MAX]; uint32_t nchildren; uint32_t proc_gen; /* runtime-v2 1: claim counter behind child ids */ /* runtime-v2 3: signal subscriptions (shard 0 only). The handler * latches sig_pending and bumps a sequence; the drain (called each * wo_io_wait pass and on inbox adoption) turns latches into fresh * Signal records delivered as ordinary sends. Coalescing disclosed. */ struct { int sig; uint32_t cls; /* the Signal record's class id */ struct wo_actor *target; } sigsubs[8]; uint32_t nsigsubs; uint32_t sig_seen; /* runtime-v2 4: ttys this shard put into raw mode. Restore is a * RUNTIME obligation — full unwind, fiber reap and vm destroy all * restore (newest-first) so no trap path leaves a wrecked tty. */ struct { int used; int fd; struct termios saved; wo_fiber *owner; } ttysave[8]; /* iteration 35, uring backend: the shard's ONE deadline tick — a * TIMEOUT op with a sentinel user_data armed for the nearest fd-park * deadline (fd parks keep exactly one POLL op each; expiry wakes them * from the scan and POLL_REMOVE tombstones the poll). */ int tick_armed; int64_t tick_at; struct { long long sec, nsec; } tick_ts; int io_kind; /* 0 = uring, 1 = epoll */ int efd_armed; /* wake_efd registered on the plane (uring oneshot) */ int io_fd; /* ring fd or epoll fd */ void *io_sq, *io_cq, *io_sqes; /* uring mmaps (NULL under epoll) */ size_t io_sq_len, io_cq_len, io_sqes_len; /* THIS ring's io_uring_params (opaque bytes; park.c owns the type). * Arc stage 3 fix: a single file-static params was rewritten by every * shard's lazy init while other shards read ring offsets out of it — * submits landed at garbage offsets and parked fibers lost their * wakes. Per-vm storage ends the race by construction. */ unsigned char io_params[256]; /* runtime-v2 9 F3c-net: live TLS connections keyed by fd, and the shard's * lazily-loaded read-only CA trust anchors — per-shard, no locks (one * thread), mirroring `children` above. sysio.c owns the lifecycle. */ struct wo_tls_conn *tls[WO_TLS_MAX]; uint32_t ntls; int ca_loaded; uint8_t *ca_arena; const uint8_t **ca_certs; size_t *ca_lens; size_t ca_count; void *tls_id; /* server identity cache (sysio owns it) */ } wo_vm; /* arc: the spawn/send builtins' runtime halves (vm.c owns the scheduler). */ int wo_vm_actor_spawn(wo_vm *vm, uint64_t instance, uint32_t method_idx, uint64_t *out_addr, const char **msg); int wo_vm_actor_send(wo_vm *vm, uint64_t addr, uint64_t msg_val, const char **msg); /* iteration 24: send-that-waits. First entry enqueues the message with the * caller attached and parks (WO_SYS_PARKED); the re-execution consumes the * scalar reply into R[A] (vm.c owns the protocol, builtin.c dispatches). */ int wo_vm_actor_call(wo_vm *vm, uint64_t *R, uint32_t ins, const char **msg); /* iteration 24 T4: register a death notice — monitor(watched, observer, * msg). The msg MOVES to the runtime; an already-dead watched actor * delivers it immediately. */ int wo_vm_actor_monitor(wo_vm *vm, uint64_t watched, uint64_t observer, uint64_t msg_val, const char **msg); /* iteration 24 T5: arm a one-shot timer on THIS shard — time.after(ms, * addr, msg). ms <= 0 delivers now. */ int wo_vm_timer_after(wo_vm *vm, int64_t ms, uint64_t addr, uint64_t msg_val, const char **msg); /* iteration 24 T5: fire every timer at or past `now` (park.c's deadline * machinery calls this beside the fd-park sweep). Returns fired count. */ int wo_vm_timers_fire(wo_vm *vm, int64_t now); /* The nearest armed timer's deadline, 0 = none (park.c's tick/timeout). */ int64_t wo_vm_timers_next(wo_vm *vm); /* ---- the shard engine (arc stage 2) ------------------------------------ * One pinned thread per shard, each a full wo_vm (own arena, GC, I/O * plane). Shard 0 is the caller's (main's); workers idle on their wake * eventfd until fibers arrive (stage 2 T6) or shutdown. Count: WO_SHARDS * or all cores (the arc's default). */ typedef struct wo_engine { wo_vm *shards; /* [nshards]; index 0 = primary */ void *threads; /* pthread_t[nshards-1], opaque here (libc-only header) */ uint32_t nshards; } wo_engine; extern wo_engine wo_eng; /* the process's one engine (vm.c) */ /* inbox envelope kinds (arc T6; 3/4 = stage 3's transparent DB RPC) */ typedef struct wo_envelope { struct wo_envelope *next; int kind; /* 0 = SEND (actor, payload), 1 = SPAWN-ADOPT (actor), * 2 = FREE (payload = wo_hdr*), * 3 = DB_REQ (payload = wo_db_req*, to shard 0), * 4 = DB_RESP (payload = wo_db_req*, back to the requester), * 5 = CALL (iteration 24: actor, payload = moved message, * from_shard/from_fiber = the parked caller), * 6 = CALL_REPLY (payload = the SCALAR reply, from_fiber = * the caller to unpark; status 0 = ok, WO_T_ACTOR = * the callee was/went dead — the caller traps), * 7 = MONITOR (iteration 24 T4: actor = the WATCHED one, * from_fiber REUSED as the observer wo_actor*, payload = * the moved notice — registered on the watched actor's * home thread; already-dead delivers the notice now) */ struct wo_actor *actor; uint64_t payload; uint32_t from_shard; struct wo_fiber *from_fiber; int status; } wo_envelope; /* arc stage 3: the requester half of the transparent DB RPC (vm.c). Called * by the builtin dispatcher on a worker shard whose rt.db is NULL: first * entry marshals + parks (WO_SYS_PARKED), the re-execution after the reply * consumes it. */ int wo_db_rpc(wo_vm *vm, uint64_t *R, uint32_t ins, const char **msg); /* the shard whose thread we are on (thread-local; obj.c stamps and gc.c * routes with it). NULL only before main's vm exists. */ wo_vm *wo_tls_vm(void); void wo_tls_set(wo_vm *vm); /* Start shards 1..n-1 (0 is the caller's, already init'ed in shards[0]). * 0 ok. Stop joins every worker and destroys their vms. */ int wo_engine_start(const wo_module *mod, size_t heap_cap, uint32_t nshards); int wo_engine_primary_inbox(int wake_efd); void wo_engine_stop(void); /* Spawn a fiber that will run method_idx(args) — the runtime half the * `spawn` expression lowers onto (stage 1 Task 3); Task 2's tests drive it * directly. The fiber is RUNNABLE and queued; it runs when the scheduler * reaches it. Returns NULL on allocation failure or bad method/arity. */ wo_fiber *wo_vm_spawn_fiber(wo_vm *vm, uint32_t method_idx, const uint64_t *args, uint32_t argc); /* heap_cap = arena byte capacity (the CLI's WO_HEAP_MB feeds this) */ int wo_vm_init(wo_vm *vm, const wo_module *mod, size_t heap_cap); void wo_vm_destroy(wo_vm *vm); /* Call a method with raw argument words. argc must equal the method's * declared arity. 0 = done, *ret filled; -1 = trapped, *err filled and the * stack fully unwound (depth 0); 1 = STOPPED — a blocking stdlib call was * interrupted with the stop flag set (builtin.h's WO_SYS_STOPPED), the stack * is unwound the same way, *ret and *err are untouched, and there is nothing * to report: the program was told to stop and did. */ int wo_vm_call(wo_vm *vm, uint32_t method_idx, const uint64_t *args, uint32_t argc, uint64_t *ret, wo_err *err); uint32_t wo_vm_depth(const wo_vm *vm); #endif /* WO_VM_H */