lcpfs 2026.1.102

// Copyright 2025 LunaOS Contributors
// SPDX-License-Identifier: Apache-2.0
//
// ZFS Intent Log (ZIL)
// Crash consistency for synchronous writes via write-ahead log.

use crate::BLOCK_DEVICES;
use crate::integrity::checksum::Checksum;
use alloc::collections::VecDeque;
use alloc::vec::Vec;
use lazy_static::lazy_static;
use spin::Mutex;

/// Size of each ZIL block on SLOG device
const ZIL_BLOCK_SIZE: usize = 512;
/// Maximum records per ZIL commit block
const ZIL_MAX_RECORDS: usize = 64; // Max records per commit block

/// SLOG device ID (configurable, falls back to main device if not present)
static ZIL_SLOG_ID: Mutex<Option<usize>> = Mutex::new(None);

// ZIL Transaction Types
/// ZIL operation type codes for different filesystem operations
#[repr(u32)]
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum ZilOpcode {
    /// Create file operation
    Create = 1,
    /// Remove file operation
    Remove = 2,
    /// Write data operation
    Write = 3,
    /// Truncate file operation
    Truncate = 4,
    /// Set attributes operation
    Setattr = 5,
    /// ACL version 0 operation
    AclV0 = 6,
    /// ACL version 1 operation
    AclV1 = 7,
    /// Create directory operation
    Mkdir = 8,
    /// Remove directory operation
    Rmdir = 9,
    /// Create hard link operation
    Link = 10,
    /// Create symbolic link operation
    Symlink = 11,
    /// Rename operation
    Rename = 12,
    /// Combined write and truncate operation
    WriteTrunc = 13, // Write + Truncate optimization
    /// Clone range operation
    CloneRange = 14,
    /// Transaction group commit marker
    Commit = 99, // Transaction group commit marker
}

// ZIL Record Header (64 bytes)
/// ZIL record header stored on SLOG device
#[repr(C, packed)]
#[derive(Debug, Clone, Copy)]
pub struct ZilHeader {
    /// Magic number (0x5A494C00 = "ZIL\0")
    pub magic: u64, // 0x5A494C00 ("ZIL\0")
    /// Transaction group number
    pub txg: u64, // Transaction group number
    /// Nanosecond timestamp
    pub timestamp: u64, // Nanosecond timestamp
    /// Operation type code
    pub opcode: u32, // ZilOpcode
    /// Payload data length
    pub len: u32, // Payload length
    /// Target object/file ID
    pub object_id: u64, // Target object/file ID
    /// File offset for write operations
    pub offset: u64, // File offset (for writes)
    /// Fletcher4 checksum of header and payload
    pub checksum: u64, // Fletcher4 of header + payload
    /// Sequence number for ordering
    pub seq: u64, // Sequence number for ordering
    /// Previous ZIL block pointer for chaining
    pub prev_blk: u64, // Previous ZIL block pointer (chaining)
    /// Reserved for future use
    pub reserved: [u64; 2], // Future use
}

/// ZIL magic number: "ZIL\0"
const ZIL_MAGIC: u64 = 0x5A494C00; // "ZIL\0"

impl ZilHeader {
    fn new(txg: u64, opcode: ZilOpcode, len: u32, object_id: u64, offset: u64, seq: u64) -> Self {
        Self {
            magic: ZIL_MAGIC,
            txg,
            timestamp: 0, // Would use RDTSC or CMOS
            opcode: opcode as u32,
            len,
            object_id,
            offset,
            checksum: 0, // Calculated after
            seq,
            prev_blk: 0,
            reserved: [0; 2],
        }
    }

    fn calculate_checksum(&self, payload: &[u8]) -> u64 {
        let mut data = Vec::new();

        // Serialize header (excluding checksum field)
        // SAFETY INVARIANTS:
        // 1. self is a valid, initialized ZilHeader reference
        // 2. ZilHeader is #[repr(C, packed)] with stable binary layout (88 bytes)
        // 3. All fields are primitive types (u64, u32) - no Drop traits
        // 4. Slice created with correct size_of::<Self>() length
        // 5. Slice lifetime scoped to this function only
        // 6. Checksum field included (zero at this point, set by caller)
        //
        // VERIFICATION: TODO - Prove ZilHeader size matches expected 88 bytes
        //
        // JUSTIFICATION:
        // Fletcher4 checksum requires serializing header + payload to bytes.
        // Binary serialization needed for on-disk ZIL format compatibility.
        // Packed struct ensures no padding between fields.
        unsafe {
            let ptr = self as *const Self as *const u8;
            data.extend_from_slice(core::slice::from_raw_parts(
                ptr,
                core::mem::size_of::<Self>(),
            ));
        }

        // Append payload
        data.extend_from_slice(payload);

        Checksum::calculate(&data).first()
    }
}

// In-memory ZIL record
/// In-memory representation of a ZIL record before persistence
#[derive(Debug, Clone)]
pub struct ZilRecord {
    /// Record header with metadata
    pub header: ZilHeader,
    /// Operation payload data
    pub payload: Vec<u8>,
}

lazy_static! {
    /// Uncommitted ZIL records (in-memory buffer before SLOG flush)
    pub static ref ZIL_BUFFER: Mutex<VecDeque<ZilRecord>> = Mutex::new(VecDeque::new());

    /// Next sequence number
    static ref ZIL_SEQ: Mutex<u64> = Mutex::new(1);

    /// Last persisted block number on SLOG
    static ref ZIL_LAST_BLK: Mutex<u64> = Mutex::new(0);
}

/// ZFS Intent Log engine for crash consistency
pub struct ZilEngine;

impl ZilEngine {
    /// Configure SLOG device (call during initialization)
    pub fn set_slog_device(dev_id: usize) {
        *ZIL_SLOG_ID.lock() = Some(dev_id);
        crate::lcpfs_println!("[ ZIL  ] SLOG device configured: {}", dev_id);
    }

    /// Get SLOG device ID (falls back to device 0 if not configured)
    fn get_slog_device() -> usize {
        ZIL_SLOG_ID.lock().unwrap_or(0)
    }

    /// Log a synchronous operation to ZIL (in-memory buffer)
    pub fn log_operation(
        txg: u64,
        opcode: ZilOpcode,
        object_id: u64,
        offset: u64,
        data: &[u8],
    ) -> Result<(), &'static str> {
        let seq = {
            let mut seq_guard = ZIL_SEQ.lock();
            let current = *seq_guard;
            *seq_guard += 1;
            current
        };

        let header = ZilHeader::new(txg, opcode, data.len() as u32, object_id, offset, seq);
        let checksum = header.calculate_checksum(data);

        let mut final_header = header;
        final_header.checksum = checksum;

        let record = ZilRecord {
            header: final_header,
            payload: data.to_vec(),
        };

        let mut buffer = ZIL_BUFFER.lock();
        buffer.push_back(record);

        // Auto-flush if buffer is full
        if buffer.len() >= ZIL_MAX_RECORDS {
            drop(buffer); // Release lock before flush
            Self::flush_to_slog()?;
        }

        Ok(())
    }

    /// Flush in-memory ZIL buffer to SLOG device
    pub fn flush_to_slog() -> Result<(), &'static str> {
        let mut buffer = ZIL_BUFFER.lock();

        if buffer.is_empty() {
            return Ok(()); // Nothing to flush
        }

        let record_count = buffer.len();

        // Serialize all records to a commit block
        let mut commit_block = Vec::new();

        while let Some(record) = buffer.pop_front() {
            // Serialize header
            // SAFETY INVARIANTS:
            // 1. record.header is a valid, initialized ZilHeader
            // 2. ZilHeader is #[repr(C, packed)] with stable binary layout (88 bytes)
            // 3. All fields are primitive types (u64, u32, [u64; 2]) - no Drop
            // 4. Slice created with correct size_of::<ZilHeader>() length
            // 5. Slice lifetime scoped to this loop iteration
            // 6. from_raw_parts creates immutable slice from valid memory
            //
            // VERIFICATION: TODO - Prove header serialization matches ZIL wire format
            //
            // JUSTIFICATION:
            // ZIL persistence requires writing header + payload to SLOG device.
            // Binary serialization needed for crash recovery on next mount.
            // Packed struct ensures consistent on-disk layout.
            unsafe {
                let header_bytes = core::slice::from_raw_parts(
                    &record.header as *const ZilHeader as *const u8,
                    core::mem::size_of::<ZilHeader>(),
                );
                commit_block.extend_from_slice(header_bytes);
            }

            // Append payload
            commit_block.extend_from_slice(&record.payload);

            // Pad to 64-byte boundary for next record
            let padding = (64 - (commit_block.len() % 64)) % 64;
            commit_block.resize(commit_block.len() + padding, 0);
        }

        drop(buffer); // Release buffer lock

        // Write to SLOG device
        let slog_id = Self::get_slog_device();
        let mut devices = BLOCK_DEVICES.lock();
        let slog = devices.get_mut(slog_id).ok_or("SLOG device not found")?;

        // Get next block number
        let mut last_blk = ZIL_LAST_BLK.lock();
        let blk_num = *last_blk + 1;

        // Write commit block to SLOG (may span multiple 512-byte blocks)
        let blocks_needed = commit_block.len().div_ceil(ZIL_BLOCK_SIZE);

        for i in 0..blocks_needed {
            let offset = i * ZIL_BLOCK_SIZE;
            let end = core::cmp::min(offset + ZIL_BLOCK_SIZE, commit_block.len());

            let mut block = [0u8; 512];
            let chunk = &commit_block[offset..end];
            block[..chunk.len()].copy_from_slice(chunk);

            slog.write_block(blk_num as usize + i, &block)?;
        }

        *last_blk = blk_num + blocks_needed as u64 - 1;
        drop(last_blk);
        drop(devices);

        crate::lcpfs_println!(
            "[ ZIL  ] Flushed {} records to SLOG (blocks {}-{})",
            record_count,
            blk_num,
            blk_num + blocks_needed as u64 - 1
        );

        Ok(())
    }

    /// Replay ZIL on mount (crash recovery)
    pub fn replay_on_mount() -> Result<usize, &'static str> {
        crate::lcpfs_println!("[ ZIL  ] Replaying intent log...");

        let slog_id = Self::get_slog_device();
        let mut devices = BLOCK_DEVICES.lock();
        let slog = devices.get_mut(slog_id).ok_or("SLOG device not found")?;

        let last_blk = *ZIL_LAST_BLK.lock();

        if last_blk == 0 {
            crate::lcpfs_println!("[ ZIL  ] No uncommitted transactions found.");
            return Ok(0);
        }

        let mut replayed = 0;

        // Read all ZIL blocks
        for blk in 1..=last_blk as usize {
            let mut block = [0u8; 512];
            slog.read_block(blk, &mut block)?;

            // Parse records from block
            let mut offset = 0;
            while offset + core::mem::size_of::<ZilHeader>() <= 512 {
                // SAFETY INVARIANTS:
                // 1. Bounds check ensures block[offset..offset+88] is accessible
                // 2. ZilHeader is #[repr(C, packed)] with stable binary layout (88 bytes)
                // 3. All fields are primitive types (u64, u32, [u64; 2]) - no Drop
                // 4. Data written by flush_to_slog() following same layout
                // 5. read_unaligned handles potentially misaligned packed struct
                // 6. Header validated by magic number check immediately after
                //
                // VERIFICATION: TODO - Prove replay deserialization matches flush format
                //
                // JUSTIFICATION:
                // ZIL replay requires reading header from SLOG device after crash.
                // Binary deserialization needed for crash recovery.
                // read_unaligned prevents UB from packed struct alignment.
                let header: ZilHeader = unsafe {
                    core::ptr::read_unaligned(block.as_ptr().add(offset) as *const ZilHeader)
                };

                // Check magic
                if header.magic != ZIL_MAGIC {
                    break; // End of valid records
                }

                // Verify checksum
                let payload_start = offset + core::mem::size_of::<ZilHeader>();
                let payload_end = payload_start + header.len as usize;

                if payload_end > 512 {
                    break; // Payload spans blocks (would need multi-block read)
                }

                let payload = &block[payload_start..payload_end];
                let expected_checksum = header.calculate_checksum(payload);

                if header.checksum != expected_checksum {
                    let seq = header.seq; // Copy to avoid packed struct reference
                    crate::lcpfs_println!("[ ZIL  ] Checksum mismatch at seq {}, skipping", seq);
                    break;
                }

                // Replay the operation
                Self::replay_record(&header, payload)?;
                replayed += 1;

                // Move to next record (64-byte aligned)
                offset = payload_end;
                offset = (offset + 63) & !63; // Round up to 64
            }
        }

        drop(devices);

        // Clear ZIL after successful replay
        Self::clear_log()?;

        crate::lcpfs_println!("[ ZIL  ] Replayed {} transactions successfully", replayed);
        Ok(replayed)
    }

    /// Replay a single ZIL record (called during mount)
    fn replay_record(header: &ZilHeader, payload: &[u8]) -> Result<(), &'static str> {
        let opcode = match header.opcode {
            1 => ZilOpcode::Create,
            2 => ZilOpcode::Remove,
            3 => ZilOpcode::Write,
            4 => ZilOpcode::Truncate,
            5 => ZilOpcode::Setattr,
            8 => ZilOpcode::Mkdir,
            9 => ZilOpcode::Rmdir,
            12 => ZilOpcode::Rename,
            _ => return Ok(()), // Skip unknown opcodes
        };

        // Copy packed struct fields to avoid alignment issues
        let object_id = header.object_id;
        let offset = header.offset;

        match opcode {
            ZilOpcode::Write => {
                // Re-apply write to object
                crate::lcpfs_println!(
                    "[ ZIL  ] Replay: WRITE obj={} offset={} len={}",
                    object_id,
                    offset,
                    payload.len()
                );
                // In real implementation: lcpfs_mount.write_at(object_id, offset, payload)
            }
            ZilOpcode::Create => {
                crate::lcpfs_println!("[ ZIL  ] Replay: CREATE obj={}", object_id);
                // Re-create file/object
            }
            ZilOpcode::Remove => {
                crate::lcpfs_println!("[ ZIL  ] Replay: REMOVE obj={}", object_id);
                // Re-delete file
            }
            ZilOpcode::Mkdir => {
                crate::lcpfs_println!("[ ZIL  ] Replay: MKDIR obj={}", object_id);
            }
            _ => {}
        }

        Ok(())
    }

    /// Clear ZIL after successful replay or clean unmount
    fn clear_log() -> Result<(), &'static str> {
        *ZIL_LAST_BLK.lock() = 0;
        *ZIL_SEQ.lock() = 1;
        ZIL_BUFFER.lock().clear();

        // Zero out SLOG header
        let slog_id = Self::get_slog_device();
        let mut devices = BLOCK_DEVICES.lock();
        if let Some(slog) = devices.get_mut(slog_id) {
            let zero_block = [0u8; 512];
            slog.write_block(0, &zero_block)?;
        }

        Ok(())
    }

    /// Commit current transaction group and clear ZIL
    pub fn commit_txg(txg: u64) -> Result<(), &'static str> {
        // Log commit marker
        Self::log_operation(txg, ZilOpcode::Commit, 0, 0, &[])?;

        // Flush to SLOG
        Self::flush_to_slog()?;

        // After TXG is safely on main pool, clear ZIL
        Self::clear_log()?;

        crate::lcpfs_println!("[ ZIL  ] Committed TXG {} and cleared log", txg);
        Ok(())
    }

    /// Get statistics
    pub fn stats() -> (usize, u64, u64) {
        let buffer_size = ZIL_BUFFER.lock().len();
        let last_blk = *ZIL_LAST_BLK.lock();
        let seq = *ZIL_SEQ.lock();
        (buffer_size, last_blk, seq)
    }
}