kit

engine.c (64074B)

---

 /* The interpreter engine: an explicit-stack dispatch loop over the lowered
  * bytecode. IR-level calls push/pop InterpFrames on the InterpStack instead of
  * recursing on the host C stack, so execution can be suspended and resumed.
  *
  * Dispatch is a switch on the record opcode. (Direct threading via a computed
  * goto is reserved for a later pass; the InterpInsn keeps a `handler` slot for
  * it. A switch keeps the engine portable under -Wpedantic and self-host.) */
 
 #include <kit/config.h> /* KIT_INTERP_THREADED: dispatch default */
 #include <string.h>
 
 #include "abi/abi.h"
 #include "cg/cgir.h"
 #include "cg/type.h"
 #include "core/arena.h"
 #include "core/core.h"
 #include "core/diag.h"
 #include "interp/interp.h"
 
 #define PERM_R KIT_INTERP_PERM_READ
 #define PERM_W KIT_INTERP_PERM_WRITE
 
 static SrcLoc iloc(void) {
   SrcLoc l;
   l.file_id = 0;
   l.line = 0;
   l.col = 0;
   return l;
 }
 
 /* ---- width / fp helpers ---- */
 
 static u64 mask_w(u64 v, u32 w) {
   if (w >= 8) return v;
   if (w == 0) return v;
   return v & ((1ull << (w * 8u)) - 1ull);
 }
 
 static i64 sext_w(u64 v, u32 w) {
   u32 bits;
   u64 m;
   if (w >= 8 || w == 0) return (i64)v;
   bits = w * 8u;
   v &= ((1ull << bits) - 1ull);
   m = 1ull << (bits - 1u);
   return (i64)((v ^ m) - m);
 }
 
 /* Low `width`-bit mask (width in *bits*, 0..64). */
 static u64 bits_mask(u32 width) {
   return width >= 64u ? ~0ull : ((1ull << width) - 1ull);
 }
 
 /* Interpreter-private va_list layout: a single cursor walks a contiguous buffer
  * of the anonymous arguments, each at an 8-byte (16 for >8B types) aligned
  * slot. The interpreter owns both the call-site buffer build and
  * va_start/va_arg, so the layout is self-consistent regardless of the target
  * ABI's real va_list. */
 static u32 va_align_of(u32 size) { return size > 8u ? 16u : 8u; }
 static u32 va_stride_of(u32 size) {
   return size > 8u ? ((size + 15u) & ~15u) : 8u;
 }
 
 static double rd_f(u64 bits, u32 w) {
   if (w == 4) {
     float f;
     u32 b = (u32)bits;
     memcpy(&f, &b, 4);
     return (double)f;
   }
   {
     double d;
     memcpy(&d, &bits, 8);
     return d;
   }
 }
 
 static u64 wr_f(double d, u32 w) {
   if (w == 4) {
     float f = (float)d;
     u32 b;
     memcpy(&b, &f, 4);
     return b;
   }
   {
     u64 b;
     memcpy(&b, &d, 8);
     return b;
   }
 }
 
 /* ---- memory access (always vtable-translated) ---- */
 /* A translation miss latches st->mem_fault; the run loop converts the latch to
  * a delivered fault at the next straight-line/branch re-check point. */
 
 static u64 mem_read(InterpStack* st, u64 addr, u32 size) {
   u8* host = interp_translate(st->prog, addr, size, PERM_R);
   u64 v = 0;
   if (!host) {
     st->mem_fault = 1;
     return 0;
   }
   memcpy(&v, host, size ? size : 8u);
   return v;
 }
 
 static void mem_write(InterpStack* st, u64 addr, u32 size, u64 v) {
   u8* host = interp_translate(st->prog, addr, size, PERM_W);
   if (!host) {
     st->mem_fault = 1;
     return;
   }
   memcpy(host, &v, size ? size : 8u);
 }
 
 static void mem_copy(InterpStack* st, u64 dst, u64 src, u32 n) {
   u8* d = interp_translate(st->prog, dst, n, PERM_W);
   u8* s = interp_translate(st->prog, src, n, PERM_R);
   if (!d || !s) {
     st->mem_fault = 1;
     return;
   }
   memmove(d, s, n);
 }
 
 /* ---- operand access ---- */
 
 static u64 frame_base(InterpStack* st, u32 mem_off) {
   return (u64)(uintptr_t)(st->mem_arena + mem_off);
 }
 
 /* addr_from_operand semantics: the abstract address an lvalue operand denotes.
  */
 static u64 op_addr(InterpStack* st, InterpFunc* fn, u64* regs, u32 mem_off,
                    const Operand* op) {
   switch ((OptOperandKind)op->kind) {
     case OPT_OPK_LOCAL:
       return frame_base(st, mem_off) + fn->slot_off[op->v.frame_slot];
     case OPT_OPK_GLOBAL:
       return (u64)(uintptr_t)interp_global_base(fn, op->v.global.sym) +
              (u64)op->v.global.addend;
     case OPT_OPK_INDIRECT: {
       u64 a = regs[op->v.ind.base];
       if (op->v.ind.index != (Reg)REG_NONE)
         a += regs[op->v.ind.index] << op->v.ind.log2_scale;
       a += (u64)(i64)op->v.ind.ofs;
       return a;
     }
     case OPT_OPK_REG:
       return regs[op->v.reg];
     default:
       return 0;
   }
 }
 
 /* loc_from_operand-as-value semantics: the scalar value of a value operand. */
 static u64 op_value(InterpStack* st, InterpFunc* fn, u64* regs, u32 mem_off,
                     const Operand* op) {
   switch ((OptOperandKind)op->kind) {
     case OPT_OPK_REG:
       return regs[op->v.reg];
     case OPT_OPK_IMM:
       return (u64)op->v.imm;
     case OPT_OPK_LOCAL:
     case OPT_OPK_GLOBAL:
     case OPT_OPK_INDIRECT: {
       u64 a = op_addr(st, fn, regs, mem_off, op);
       u32 sz = abi_cg_sizeof(fn->prog->c->abi, op->type);
       return mem_read(st, a, sz ? sz : 8u);
     }
     default:
       return 0;
   }
 }
 
 /* write_loc semantics: store a scalar result into a destination operand, which
  * may be a register OR a memory location (OPK_LOCAL/GLOBAL/INDIRECT). The
  * optimizer leaves un-promoted (e.g. address-taken) destinations as memory. */
 static void write_dst(InterpStack* st, InterpFunc* fn, u64* regs, u32 mem_off,
                       const Operand* op, u64 value) {
   if (op->kind == OPK_REG) {
     regs[op->v.reg] = value;
     return;
   }
   {
     u64 a = op_addr(st, fn, regs, mem_off, op);
     u32 sz = abi_cg_sizeof(fn->prog->c->abi, op->type);
     mem_write(st, a, sz ? sz : 8u, value);
   }
 }
 
 /* pointer_addr_from_operand semantics: the address an aggregate pointer
  * operand denotes. An OPK_LOCAL of pointer type *holds* the pointer (load it);
  * otherwise the local *is* the aggregate storage (its frame home is the
  * address). Used only by AGG_COPY/AGG_SET. */
 static u64 interp_ptr_addr(InterpStack* st, InterpFunc* fn, u64* regs,
                            u32 mem_off, const Operand* op) {
   if (op->kind == OPK_LOCAL && !cg_type_is_ptr(fn->prog->c, op->type))
     return frame_base(st, mem_off) + fn->slot_off[op->v.frame_slot];
   if (op->kind == OPK_LOCAL) {
     /* pointer-typed local: the slot holds the pointer value */
     u64 slot = frame_base(st, mem_off) + fn->slot_off[op->v.frame_slot];
     return mem_read(st, slot, 8u);
   }
   return op_addr(st, fn, regs, mem_off, op);
 }
 
 /* Common compiler intrinsics. Returns 0 (and sets status) if unsupported. */
 static int interp_intrinsic(InterpStack* st, InterpFunc* fn, u64* regs,
                             u32 mem_off, InterpInsn* in);
 
 /* The register and addressable-memory arenas are FIXED reservations that never
  * move: an OP_ADDR_OF materializes a local's address as an absolute host
  * pointer into mem_arena, and that pointer can escape into a register or out to
  * another local, so reallocating (moving) the arena would dangle it. Frames
  * follow strict stack discipline (CALL bumps the top, RET rewinds it), so a
  * generous fixed reservation suffices; overflow traps cleanly as a stack
  * overflow rather than corrupting memory. */
 /* TODO(perf): these 16 MiB are allocated and freed per kit_interp_call /
  * kit_interp_call_args (each spins up a fresh InterpStack). For call-heavy
  * embeddings, reuse the arenas across calls via a per-program stack pool rather
  * than shrinking the reservation — the size must stay generous because the
  * arenas are non-relocating (escaping pointers; see above). */
 #define INTERP_REGS_RESERVE (8u * 1024u * 1024u)
 #define INTERP_MEM_RESERVE (8u * 1024u * 1024u)
 
 static u32 bump(u8* arena, u32* top, u32 cap, u32 size, u32 align) {
   u32 off = (*top + align - 1u) & ~(align - 1u);
   (void)arena;
   if (off + size > cap || off + size < off) return 0xffffffffu; /* overflow */
   *top = off + size;
   return off;
 }
 
 /* Push a fresh frame for fn; returns its index, or 0xffffffff on overflow.
  * The arenas never move, so existing frame pointers stay valid. */
 static u32 frame_push(InterpStack* st, InterpFunc* fn) {
   InterpFrame* fr;
   u32 regs_off, mem_off;
   if (st->nframes == st->frames_cap) {
     Heap* h = st->prog->c->ctx->heap;
     u32 ncap = st->frames_cap ? st->frames_cap * 2u : 32u;
     InterpFrame* nf = (InterpFrame*)h->realloc(
         h, st->frames, sizeof(InterpFrame) * st->frames_cap,
         sizeof(InterpFrame) * ncap, _Alignof(InterpFrame));
     if (!nf) return 0xffffffffu;
     st->frames = nf;
     st->frames_cap = ncap;
   }
   regs_off = bump(st->regs_arena, &st->regs_top, st->regs_cap,
                   (fn->npregs ? fn->npregs : 1u) * 8u, 8u);
   mem_off = bump(st->mem_arena, &st->mem_top, st->mem_cap,
                  fn->frame_bytes ? fn->frame_bytes : 16u, fn->frame_align);
   if (regs_off == 0xffffffffu || mem_off == 0xffffffffu) return 0xffffffffu;
   fr = &st->frames[st->nframes];
   memset(fr, 0, sizeof *fr);
   fr->fn = fn;
   fr->regs_off = regs_off;
   fr->mem_off = mem_off;
   fr->frame_bytes = fn->frame_bytes;
   fr->alloca_top = fn->frame_bytes;
   fr->ip = &fn->code[fn->block_pc[fn->f->entry] == INTERP_PC_NONE
                          ? 0u
                          : fn->block_pc[fn->f->entry]];
   /* zero the register file */
   memset(st->regs_arena + regs_off, 0, (fn->npregs ? fn->npregs : 1u) * 8u);
   st->nframes++;
   return st->nframes - 1u;
 }
 
 static void unsupported(InterpStack* st, const char* what) {
   st->status = KIT_INTERP_ERROR;
   st->trap_reason = what;
   diag_emit(st->prog->c->ctx->diag, KIT_DIAG_ERROR, iloc(),
             "interp: %s not supported", what ? what : "operation");
 }
 
 static void fault(InterpStack* st, const char* what) {
   st->status = KIT_INTERP_TRAP;
   st->trap_reason = what;
   diag_emit(st->prog->c->ctx->diag, KIT_DIAG_ERROR, iloc(), "interp: trap: %s",
             what ? what : "fault");
 }
 
 /* ---- integer/fp arithmetic ---- */
 
 /* Shift-count mask for the spec's portable "reduce modulo width" rule
  * (doc/IR.md). The engine stores every scalar in a u64, so the meaningful
  * range is the storage width (<=64 bits); 16-byte scalars are lowered to
  * memory / 64-bit-half sequences before reaching here, never as a w==16 BINOP.
  * Clamping to the storage width keeps the host C shift in range regardless and
  * is identical to (w*8-1) for every width the engine actually carries (<=8). */
 static u32 shift_mask(u32 w) { return (w >= 8u ? 64u : w * 8u) - 1u; }
 
 static u64 do_binop(InterpStack* st, u32 binop, u64 a, u64 b, u32 w, u8 fp) {
   if (fp) {
     double x = rd_f(a, w), y = rd_f(b, w), r = 0;
     switch ((BinOp)binop) {
       case BO_FADD:
         r = x + y;
         break;
       case BO_FSUB:
         r = x - y;
         break;
       case BO_FMUL:
         r = x * y;
         break;
       case BO_FDIV:
         r = x / y;
         break;
       default:
         unsupported(st, "fp binop");
         return 0;
     }
     return wr_f(r, w);
   }
   switch ((BinOp)binop) {
     case BO_IADD:
       return mask_w(a + b, w);
     case BO_ISUB:
       return mask_w(a - b, w);
     case BO_IMUL:
       return mask_w(a * b, w);
     case BO_SDIV: {
       i64 x = sext_w(a, w), y = sext_w(b, w);
       if (y == 0) {
         fault(st, "integer divide by zero");
         return 0;
       }
       /* INT_MIN / -1 overflows (UB / SIGFPE on x86) — wraps to INT_MIN. */
       if (y == -1) return mask_w(0u - (u64)x, w);
       return mask_w((u64)(x / y), w);
     }
     case BO_UDIV: {
       u64 x = mask_w(a, w), y = mask_w(b, w);
       if (y == 0) {
         fault(st, "integer divide by zero");
         return 0;
       }
       return mask_w(x / y, w);
     }
     case BO_SREM: {
       i64 x = sext_w(a, w), y = sext_w(b, w);
       if (y == 0) {
         fault(st, "integer divide by zero");
         return 0;
       }
       if (y == -1) return 0; /* INT_MIN % -1 == 0 (avoids the overflow UB) */
       return mask_w((u64)(x % y), w);
     }
     case BO_UREM: {
       u64 x = mask_w(a, w), y = mask_w(b, w);
       if (y == 0) {
         fault(st, "integer divide by zero");
         return 0;
       }
       return mask_w(x % y, w);
     }
     case BO_AND:
       return mask_w(a & b, w);
     case BO_OR:
       return mask_w(a | b, w);
     case BO_XOR:
       return mask_w(a ^ b, w);
     case BO_SHL:
       return mask_w(a << (b & shift_mask(w)), w);
     case BO_SHR_S: {
       i64 x = sext_w(a, w);
       return mask_w((u64)(x >> (b & shift_mask(w))), w);
     }
     case BO_SHR_U:
       return mask_w(mask_w(a, w) >> (b & shift_mask(w)), w);
     default:
       unsupported(st, "int binop");
       return 0;
   }
 }
 
 static int do_cmp(InterpStack* st, u32 cmp, u64 a, u64 b, u32 w) {
   /* FP-ness is self-describing from the opcode (the FP block starts at
    * CMP_OEQ_F); no operand-class sniffing needed. */
   if (cmp >= CMP_OEQ_F) {
     double x = rd_f(a, w), y = rd_f(b, w);
     int uno = (x != x) || (y != y); /* unordered: either operand is NaN */
     switch ((CmpOp)cmp) {
       case CMP_OEQ_F:
         return x == y; /* ordered: false on NaN */
       case CMP_ONE_F:
         return !uno && (x != y);
       case CMP_OLT_F:
         return x < y;
       case CMP_OLE_F:
         return x <= y;
       case CMP_OGT_F:
         return x > y;
       case CMP_OGE_F:
         return x >= y;
       case CMP_UEQ_F:
         return uno || (x == y);
       case CMP_UNE_F:
         return x != y; /* unordered: true on NaN */
       case CMP_ULT_F:
         return uno || (x < y);
       case CMP_ULE_F:
         return uno || (x <= y);
       case CMP_UGT_F:
         return uno || (x > y);
       case CMP_UGE_F:
         return uno || (x >= y);
       default:
         break;
     }
   }
   switch ((CmpOp)cmp) {
     case CMP_EQ:
       return mask_w(a, w) == mask_w(b, w);
     case CMP_NE:
       return mask_w(a, w) != mask_w(b, w);
     case CMP_LT_S:
       return sext_w(a, w) < sext_w(b, w);
     case CMP_LE_S:
       return sext_w(a, w) <= sext_w(b, w);
     case CMP_GT_S:
       return sext_w(a, w) > sext_w(b, w);
     case CMP_GE_S:
       return sext_w(a, w) >= sext_w(b, w);
     case CMP_LT_U:
       return mask_w(a, w) < mask_w(b, w);
     case CMP_LE_U:
       return mask_w(a, w) <= mask_w(b, w);
     case CMP_GT_U:
       return mask_w(a, w) > mask_w(b, w);
     case CMP_GE_U:
       return mask_w(a, w) >= mask_w(b, w);
     default:
       unsupported(st, "cmp");
       return 0;
   }
 }
 
 /* Saturating float-to-integer (NaN -> 0, out-of-range -> clamped to the
  * destination width). Matches Wasm trunc_sat semantics and, crucially, avoids
  * the UB of casting a NaN/overflowing double to an integer (which traps under
  * UBSan). For in-range values this is identical to a plain truncating cast, so
  * well-defined C float->int conversions are unaffected. Avoids <math.h>
  * (libkit is freestanding) by building the 2^k bound with a loop. */
 static u64 ftoi_sat(double d, u32 wbytes, int is_signed) {
   u32 bits, i;
   double bound;
   if (d != d) return 0; /* NaN */
   if (wbytes == 0 || wbytes > 8) wbytes = 8;
   bits = wbytes * 8u;
   if (is_signed) {
     bound = 1.0;
     for (i = 0; i + 1u < bits; ++i) bound *= 2.0; /* 2^(bits-1) */
     if (d >= bound)
       return mask_w(
           bits >= 64 ? 0x7fffffffffffffffull : (((u64)1 << (bits - 1u)) - 1u),
           wbytes);
     if (d < -bound)
       return mask_w(
           bits >= 64 ? 0x8000000000000000ull : ((u64)1 << (bits - 1u)), wbytes);
     return mask_w((u64)(i64)d, wbytes);
   }
   bound = 1.0;
   for (i = 0; i < bits; ++i) bound *= 2.0; /* 2^bits */
   if (d < 0.0) return 0;
   if (d >= bound)
     return mask_w(bits >= 64 ? ~0ull : (((u64)1 << bits) - 1u), wbytes);
   return mask_w((u64)d, wbytes);
 }
 
 static u64 do_convert(InterpStack* st, InterpInsn* in, u64 v) {
   u32 wd = in->w0, ws = in->w1;
   switch ((ConvKind)in->sub) {
     case CV_SEXT:
       return mask_w((u64)sext_w(v, ws), wd);
     case CV_ZEXT:
       return mask_w(mask_w(v, ws), wd);
     case CV_TRUNC:
       return mask_w(v, wd);
     case CV_ITOF_S:
       return wr_f((double)sext_w(v, ws), wd);
     case CV_ITOF_U:
       return wr_f((double)mask_w(v, ws), wd);
     case CV_FTOI_S:
       return ftoi_sat(rd_f(v, ws), wd, 1);
     case CV_FTOI_U:
       return ftoi_sat(rd_f(v, ws), wd, 0);
     case CV_FEXT:
       return wr_f(rd_f(v, ws), wd);
     case CV_FTRUNC:
       return wr_f(rd_f(v, ws), wd);
     case CV_BITCAST:
       return mask_w(v, wd);
     default:
       unsupported(st, "convert");
       return 0;
   }
 }
 
 static u64 do_rmw(u32 op, u64 old, u64 val, u32 w) {
   switch ((KitCgAtomicOp)op) {
     case KIT_CG_ATOMIC_XCHG:
       return mask_w(val, w);
     case KIT_CG_ATOMIC_ADD:
       return mask_w(old + val, w);
     case KIT_CG_ATOMIC_SUB:
       return mask_w(old - val, w);
     case KIT_CG_ATOMIC_AND:
       return mask_w(old & val, w);
     case KIT_CG_ATOMIC_OR:
       return mask_w(old | val, w);
     case KIT_CG_ATOMIC_XOR:
       return mask_w(old ^ val, w);
     case KIT_CG_ATOMIC_NAND:
       return mask_w(~(old & val), w);
     default:
       return old;
   }
 }
 
 static u64 do_unop(InterpStack* st, u32 unop, u64 a, u32 w, u8 fp) {
   (void)fp;
   switch ((UnOp)unop) {
     case UO_NEG:
       return mask_w(0u - a, w); /* well-defined two's-complement */
     case UO_FNEG:
       return wr_f(-rd_f(a, w), w);
     case UO_NOT:
       return mask_w(a, w) == 0 ? 1u : 0u;
     case UO_BNOT:
       return mask_w(~a, w);
     default:
       unsupported(st, "unop");
       return 0;
   }
 }
 
 /* Bind call arguments into a freshly-pushed callee frame (value semantics). */
 static void bind_args(InterpStack* st, u32 caller_idx, u32 callee_idx,
                       const OptCGCallDesc* desc) {
   InterpProgram* p = st->prog;
   InterpFrame* caller = &st->frames[caller_idx];
   InterpFrame* callee = &st->frames[callee_idx];
   InterpFunc* cfn = caller->fn;
   InterpFunc* efn = callee->fn;
   u64* cregs = (u64*)(st->regs_arena + caller->regs_off);
   u64* eregs = (u64*)(st->regs_arena + callee->regs_off);
   u32 nbind = desc->nargs < efn->f->nparams ? desc->nargs : efn->f->nparams;
   u32 i;
   for (i = 0; i < nbind; ++i) {
     OptCGABIValue* arg = &desc->args[i];
     IRParam* pr = &efn->f->params[i];
     u32 size = abi_cg_sizeof(p->c->abi, arg->type);
     if (pr->storage.kind == CG_LOCAL_STORAGE_REG) {
       eregs[pr->storage.v.reg] =
           op_value(st, cfn, cregs, caller->mem_off, &arg->storage);
     } else {
       u64 dst = frame_base(st, callee->mem_off) +
                 efn->slot_off[pr->storage.v.frame_slot];
       if (cg_type_is_aggregate(p->c, arg->type) || size > 8u) {
         u64 src = op_addr(st, cfn, cregs, caller->mem_off, &arg->storage);
         mem_copy(st, dst, src, size);
       } else {
         mem_write(st, dst, size ? size : 8u,
                   op_value(st, cfn, cregs, caller->mem_off, &arg->storage));
       }
     }
   }
 }
 
 /* Lay out the anonymous (variadic) arguments of an internal call into a
  * contiguous buffer in the callee frame's addressable region, above its static
  * frame and any future alloca. Records the buffer offset on the callee frame so
  * IOP_VA_START can hand va_arg a cursor over it. Returns 0 on stack overflow.
  */
 static int build_varargs(InterpStack* st, u32 caller_idx, u32 callee_idx,
                          const OptCGCallDesc* desc) {
   InterpProgram* p = st->prog;
   InterpFrame* caller = &st->frames[caller_idx];
   InterpFrame* callee = &st->frames[callee_idx];
   InterpFunc* cfn = caller->fn;
   InterpFunc* efn = callee->fn;
   u64* cregs = (u64*)(st->regs_arena + caller->regs_off);
   u32 nfixed = efn->f->nparams;
   u32 cur = (callee->alloca_top + 15u) & ~15u; /* 16-align buffer start */
   u32 buf_start = cur;
   u32 i;
   if (desc->nargs <= nfixed) return 1; /* no anonymous args */
   for (i = nfixed; i < desc->nargs; ++i) {
     OptCGABIValue* arg = &desc->args[i];
     u32 size = abi_cg_sizeof(p->c->abi, arg->type);
     u32 al = va_align_of(size);
     u64 dst;
     cur = (cur + al - 1u) & ~(al - 1u);
     if ((u64)callee->mem_off + cur + va_stride_of(size) > st->mem_cap) return 0;
     dst = frame_base(st, callee->mem_off) + cur;
     if (cg_type_is_aggregate(p->c, arg->type) || size > 8u) {
       u64 src = op_addr(st, cfn, cregs, caller->mem_off, &arg->storage);
       mem_copy(st, dst, src, size);
     } else {
       mem_write(st, dst, 8u,
                 op_value(st, cfn, cregs, caller->mem_off, &arg->storage));
     }
     cur += va_stride_of(size);
   }
   callee->has_varargs = 1;
   callee->vararg_off = callee->mem_off + buf_start;
   callee->alloca_top = cur;
   if (callee->mem_off + cur > st->mem_top) st->mem_top = callee->mem_off + cur;
   return 1;
 }
 
 /* ---- external (host ABI) call marshalling ---- */
 
 /* Record an integer-register argument. Returns non-zero (with *why) on
  * overflow of the supported register-thunk family. */
 static int ffi_push_int(InterpFfiArgs* fa, u64 v, const char** why) {
   if (fa->nint >= 8u) {
     *why = "external call: too many int args";
     return 1;
   }
   fa->iargs[fa->nint++] = v;
   return 0;
 }
 
 /* Record an fp-register argument, tracking single vs double precision (the two
  * occupy the fp register differently). Returns non-zero (with *why) on overflow
  * or a float/double mix within one signature. */
 static int ffi_push_fp(InterpFfiArgs* fa, u64 bits, u32 size,
                        const char** why) {
   if (fa->nfp >= 8u) {
     *why = "external call: too many fp args";
     return 1;
   }
   if (size == 4u) {
     if (fa->nfp > 0u && !fa->args_fp_is_float) {
       *why = "external call: mixed float/double args";
       return 1;
     }
     fa->args_fp_is_float = 1u;
     fa->fargs_f[fa->nfp++] = (float)rd_f(bits, 4u);
   } else {
     if (fa->nfp > 0u && fa->args_fp_is_float) {
       *why = "external call: mixed float/double args";
       return 1;
     }
     fa->fargs[fa->nfp++] = rd_f(bits, size ? size : 8u);
   }
   return 0;
 }
 
 static u64 ext_call(InterpStack* st, InterpFrame* fr, u64* regs, void* host_fp,
                     const OptCGCallDesc* desc) {
   InterpProgram* p = st->prog;
   const ABIFuncInfo* fi = desc->abi;
   InterpFfiArgs fa;
   const char* reason = NULL;
   u32 i;
 
   if (!fi) {
     unsupported(st, "external call without ABI info");
     return 0;
   }
   if (fi->vararg_on_stack && fi->variadic) {
     unsupported(st, "variadic external call (stack-routed)");
     return 0;
   }
   memset(&fa, 0, sizeof fa);
   fa.fi = fi;
 
   /* hidden struct return: pass the caller's aggregate-return slot directly.
    * When the call is a tail call its result has no local home (ret.storage is
    * void) — forward this frame's own sret destination instead. */
   if (fi->has_sret) {
     u32 rsz = abi_cg_sizeof(p->c->abi, desc->ret.type);
     if (desc->ret.storage.kind == OPK_LOCAL ||
         desc->ret.storage.kind == OPK_GLOBAL ||
         desc->ret.storage.kind == OPK_INDIRECT) {
       u64 dst = op_addr(st, fr->fn, regs, fr->mem_off, &desc->ret.storage);
       fa.sret = interp_translate(p, dst, rsz, PERM_W);
     } else {
       fa.sret = fr->sret_ptr; /* tail call: deliver to our caller's sret slot */
     }
     if (!fa.sret) {
       unsupported(st, "sret destination");
       return 0;
     }
     fa.iargs[fa.nint++] = (u64)(uintptr_t)fa.sret;
     fa.ret_is_void = 1;
   }
 
   for (i = 0; i < desc->nargs; ++i) {
     OptCGABIValue* arg = &desc->args[i];
     const ABIArgInfo* ai = (i < fi->nparams) ? &fi->params[i] : NULL;
     if (ai && ai->kind == ABI_ARG_IGNORE) continue;
     if (ai && ai->kind == ABI_ARG_INDIRECT) {
       /* byval: pass a pointer to the aggregate (caller's copy). */
       u64 a = op_addr(st, fr->fn, regs, fr->mem_off, &arg->storage);
       u8* h = interp_translate(p, a, 1, PERM_R);
       if (fa.nint >= 8) {
         unsupported(st, "external call: too many int args");
         return 0;
       }
       fa.iargs[fa.nint++] = (u64)(uintptr_t)h;
       continue;
     }
     if (ai && ai->kind == ABI_ARG_DIRECT && ai->nparts > 1) {
       /* aggregate split across registers: read each part from memory. */
       u64 base = op_addr(st, fr->fn, regs, fr->mem_off, &arg->storage);
       u32 k;
       for (k = 0; k < ai->nparts; ++k) {
         const ABIArgPart* pt = &ai->parts[k];
         u64 chunk = mem_read(st, base + pt->src_offset, pt->size);
         int bad = (pt->cls == ABI_CLASS_FP)
                       ? ffi_push_fp(&fa, chunk, pt->size, &reason)
                       : ffi_push_int(&fa, chunk, &reason);
         if (bad) {
           unsupported(st, reason);
           return 0;
         }
       }
       continue;
     }
     /* scalar (or variadic extra arg): route by type. The named-parameter
      * aggregate/large cases are handled by the INDIRECT / multi-part branches
      * above; a variadic-tail arg has no ABI classification (ai==NULL), so an
      * aggregate or >8-byte scalar here can't be marshalled (and op_value's
      * 8-byte read would overflow) — diagnose rather than corrupt. */
     if (cg_type_is_aggregate(p->c, arg->type) ||
         abi_cg_sizeof(p->c->abi, arg->type) > 8u) {
       unsupported(st, "external call: aggregate/oversized variadic argument");
       return 0;
     }
     {
       ABITypeInfo ti = abi_cg_type_info(p->c->abi, arg->type);
       u64 v = op_value(st, fr->fn, regs, fr->mem_off, &arg->storage);
       int bad = (ti.scalar_kind == ABI_SC_FLOAT)
                     ? ffi_push_fp(&fa, v, ti.size ? ti.size : 8u, &reason)
                     : ffi_push_int(&fa, v, &reason);
       if (bad) {
         unsupported(st, reason);
         return 0;
       }
     }
   }
 
   /* Return classification from the ABI's own return descriptor (robust even
    * when desc->ret.type is void, e.g. a tail call whose result is not stored
    * into any caller local). A small struct can come back in up to two
    * registers; each part's class steers which return register the thunk reads.
    */
   if (!fi->has_sret) {
     if (fi->ret.kind == ABI_ARG_IGNORE || fi->ret.nparts == 0) {
       fa.ret_is_void = 1;
       fa.ret_nparts = 0;
     } else if (fi->ret.nparts > 2) {
       unsupported(st, "external call: 3+ register struct return");
       return 0;
     } else {
       u32 k;
       fa.ret_nparts = (u8)fi->ret.nparts;
       for (k = 0; k < fi->ret.nparts; ++k) {
         fa.ret_fp[k] = (fi->ret.parts[k].cls == ABI_CLASS_FP) ? 1u : 0u;
         fa.ret_size[k] = fi->ret.parts[k].size ? fi->ret.parts[k].size : 8u;
         /* A 4-byte fp return part is a single in the low half of an fp reg; the
          * two-register thunks read fp parts as doubles, so diagnose it. */
         if (fi->ret.nparts > 1u && fa.ret_fp[k] && fa.ret_size[k] == 4u) {
           unsupported(st, "external call: 32-bit fp struct-return field");
           return 0;
         }
       }
     }
   }
 
   {
     u64 out[2] = {0, 0};
     if (interp_ffi_invoke(host_fp, &fa, out, &reason) != 0) {
       unsupported(st, reason ? reason : "external call signature");
       return 0;
     }
     if (fa.ret_is_void || fa.ret_nparts == 0) return 0;
     /* Deliver the result. A register destination (OPK_REG) takes the low
      * register; a memory destination (an address-taken result local, or a small
      * aggregate returned in registers) receives each part's bytes scattered to
      * its src_offset. A value-less tail call has no home — the low register is
      * shuttled out as the scalar result. */
     if (desc->ret.storage.kind == OPK_REG) {
       if (fa.ret_nparts == 1) regs[desc->ret.storage.v.reg] = out[0];
     } else if (desc->ret.storage.kind == OPK_LOCAL ||
                desc->ret.storage.kind == OPK_GLOBAL ||
                desc->ret.storage.kind == OPK_INDIRECT) {
       u64 dst = op_addr(st, fr->fn, regs, fr->mem_off, &desc->ret.storage);
       u32 k;
       for (k = 0; k < fi->ret.nparts && k < 2u; ++k)
         mem_write(st, dst + fi->ret.parts[k].src_offset, fa.ret_size[k],
                   out[k]);
     }
     return out[0];
   }
 }
 
 /* ---- engine ---- */
 
 /* Dispatch mechanism. With labels-as-values (GNU computed goto) the engine is
  * direct-threaded: each InterpInsn caches the &&handler of its opcode and every
  * handler tail-dispatches straight to the next via `goto *`, giving the branch
  * predictor a distinct indirect branch per opcode site. This is the default
  * (KIT_INTERP_THREADED in <kit/config.h>). GCC, clang, and kit itself
  * (__kit__) all implement labels-as-values; any other compiler transparently
  * falls back to a portable `switch`, sharing one set of handler bodies through
  * OP()/NEXT()/GO(). Force the choice with -DKIT_INTERP_THREADED=0|1. */
 #if !defined(KIT_INTERP_THREADED)
 /* Belt-and-braces: config.h normally defines this. Default on so a missed
  * include degrades to threaded-where-supported, never a silent switch. */
 #define KIT_INTERP_THREADED 1
 #endif
 /* Effective dispatch: requested AND the compiler can compile labels-as-values.
  */
 #if KIT_INTERP_THREADED && \
     (defined(__GNUC__) || defined(__clang__) || defined(__kit__))
 #define INTERP_DISPATCH_THREADED 1
 #else
 #define INTERP_DISPATCH_THREADED 0
 #endif
 
 /* The opcode roster: one entry per InterpOp with a handler, used to publish the
  * threaded dispatch table from the in-function &&labels. Must stay in sync with
  * the OP(...) handlers below (a missing/extra entry is a compile error: an
  * undefined or unused label). */
 // clang-format off
 #define INTERP_OPS(X)    \
   X(IOP_NOP)             \
   X(IOP_LOAD_IMM)        \
   X(IOP_LOAD_CONST)      \
   X(IOP_COPY)            \
   X(IOP_COPY_AGG)        \
   X(IOP_LOAD)            \
   X(IOP_LOAD_AGG)        \
   X(IOP_STORE)           \
   X(IOP_STORE_AGG)       \
   X(IOP_ADDR_OF)         \
   X(IOP_TLS_ADDR)        \
   X(IOP_BINOP)           \
   X(IOP_UNOP)            \
   X(IOP_CMP)             \
   X(IOP_CONVERT)         \
   X(IOP_CALL)            \
   X(IOP_BR)              \
   X(IOP_CONDBR)          \
   X(IOP_CMP_BRANCH)      \
   X(IOP_SWITCH)          \
   X(IOP_INDIRECT_BR)     \
   X(IOP_LOAD_LABEL_ADDR) \
   X(IOP_RET)             \
   X(IOP_RET_VOID)        \
   X(IOP_ALLOCA)          \
   X(IOP_AGG_COPY)        \
   X(IOP_AGG_SET)         \
   X(IOP_BITFIELD_LOAD)   \
   X(IOP_BITFIELD_STORE)  \
   X(IOP_VA_START)        \
   X(IOP_VA_ARG)          \
   X(IOP_VA_END)          \
   X(IOP_VA_COPY)         \
   X(IOP_ATOMIC_LOAD)     \
   X(IOP_ATOMIC_STORE)    \
   X(IOP_ATOMIC_RMW)      \
   X(IOP_ATOMIC_CAS)      \
   X(IOP_FENCE)           \
   X(IOP_INTRINSIC)       \
   X(IOP_UNREACHABLE)     \
   X(IOP_TRAP)
 // clang-format on
 
 #if INTERP_DISPATCH_THREADED
 #define OP(name) L_##name
 /* linear op: re-check the memory-fault latch, advance, dispatch the next insn
  */
 #define NEXT()                         \
   do {                                 \
     if (st->mem_fault) goto fault_mem; \
     ++ip;                              \
     in = ip;                           \
     I = in->inst;                      \
     goto * in->handler;                \
   } while (0)
 /* branch op: ip already retargeted, dispatch without advancing */
 #define GO()            \
   do {                  \
     in = ip;            \
     I = in->inst;       \
     goto * in->handler; \
   } while (0)
 #if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu-label-as-value"
 #pragma clang diagnostic ignored "-Wpedantic"
 #elif defined(__GNUC__)
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wpedantic"
 #endif
 #else
 #define OP(name) case name
 #define NEXT() break
 #define GO() continue
 #endif
 
 KitInterpStatus interp_run_stack(InterpStack* st, int64_t* out_ret) {
   InterpProgram* p = st->prog;
   InterpFrame* fr;
   InterpFunc* fn;
   u64* regs;
   u32 mem_off;
   InterpInsn* ip;
   InterpInsn* in = NULL;
   const Inst* I = NULL;
 
   if (st->nframes == 0) {
     st->status = KIT_INTERP_DONE;
     if (out_ret) *out_ret = (int64_t)st->scalar_ret;
     return KIT_INTERP_DONE;
   }
 
 #if INTERP_DISPATCH_THREADED
   /* Per-function lazy threading: copy each opcode's handler into its record on
    * first entry to the function (RELOAD runs whenever the top frame changes).
    */
 #define RELOAD()                                               \
   do {                                                         \
     fr = &st->frames[st->nframes - 1u];                        \
     fn = fr->fn;                                               \
     regs = (u64*)(st->regs_arena + fr->regs_off);              \
     mem_off = fr->mem_off;                                     \
     ip = fr->ip;                                               \
     if (!fn->threaded) {                                       \
       u32 ti_;                                                 \
       for (ti_ = 0; ti_ < fn->ncode; ++ti_) {                  \
         u32 o_ = fn->code[ti_].op;                             \
         fn->code[ti_].handler =                                \
             st->dt[o_ < (u32)IOP__COUNT ? o_ : (u32)IOP_TRAP]; \
       }                                                        \
       fn->threaded = 1;                                        \
     }                                                          \
   } while (0)
 #else
 #define RELOAD()                                  \
   do {                                            \
     fr = &st->frames[st->nframes - 1u];           \
     fn = fr->fn;                                  \
     regs = (u64*)(st->regs_arena + fr->regs_off); \
     mem_off = fr->mem_off;                        \
     ip = fr->ip;                                  \
   } while (0)
 #endif
 
 #if INTERP_DISPATCH_THREADED
   if (!st->dt_ready) {
 #define DT_ENTRY(name) st->dt[name] = &&L_##name;
     INTERP_OPS(DT_ENTRY)
 #undef DT_ENTRY
     st->dt_ready = 1;
   }
 #endif
 
   RELOAD();
   if (!fn->ok) {
     unsupported(st, fn->reject_reason ? fn->reject_reason : "function");
     return (KitInterpStatus)st->status;
   }
   st->mem_fault = 0;
 
 #if INTERP_DISPATCH_THREADED
   in = ip;
   I = in->inst;
   goto * in->handler;
 #else
   for (;;) {
     in = ip;
     I = in->inst;
     switch ((InterpOp)in->op) {
 #endif
   OP(IOP_NOP) : NEXT();
   OP(IOP_LOAD_IMM)
       : write_dst(st, fn, regs, mem_off, &I->opnds[0], (u64)in->imm);
   NEXT();
   OP(IOP_LOAD_CONST) : {
     ConstBytes cb = I->extra.cbytes;
     u64 v = 0;
     u32 n = cb.size > 8u ? 8u : cb.size;
     if (cb.bytes && n) memcpy(&v, cb.bytes, n);
     write_dst(st, fn, regs, mem_off, &I->opnds[0], v);
     NEXT();
   }
   OP(IOP_COPY)
       : write_dst(st, fn, regs, mem_off, &I->opnds[0],
                   op_value(st, fn, regs, mem_off, &I->opnds[1]));
   NEXT();
   OP(IOP_COPY_AGG) : {
     u64 d = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
     u64 s = op_addr(st, fn, regs, mem_off, &I->opnds[1]);
     mem_copy(st, d, s, abi_cg_sizeof(p->c->abi, I->opnds[0].type));
     NEXT();
   }
   OP(IOP_LOAD) : {
     u64 a = op_addr(st, fn, regs, mem_off, &I->opnds[1]);
     write_dst(st, fn, regs, mem_off, &I->opnds[0],
               mem_read(st, a, in->w0 ? in->w0 : 8u));
     NEXT();
   }
   OP(IOP_LOAD_AGG) : {
     u64 d = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
     u64 s = op_addr(st, fn, regs, mem_off, &I->opnds[1]);
     mem_copy(st, d, s, abi_cg_sizeof(p->c->abi, I->opnds[0].type));
     NEXT();
   }
   OP(IOP_STORE) : {
     u64 a = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
     u64 v = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     mem_write(st, a, in->w0 ? in->w0 : 8u, v);
     NEXT();
   }
   OP(IOP_STORE_AGG) : {
     u64 d = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
     u64 s = op_addr(st, fn, regs, mem_off, &I->opnds[1]);
     mem_copy(st, d, s, abi_cg_sizeof(p->c->abi, I->opnds[1].type));
     NEXT();
   }
   OP(IOP_ADDR_OF)
       : write_dst(st, fn, regs, mem_off, &I->opnds[0],
                   op_addr(st, fn, regs, mem_off, &I->opnds[1]));
   NEXT();
   OP(IOP_BINOP) : {
     u64 r = do_binop(st, in->sub, op_value(st, fn, regs, mem_off, &I->opnds[1]),
                      op_value(st, fn, regs, mem_off, &I->opnds[2]), in->w0,
                      in->fp0);
     if (st->status) goto stop;
     write_dst(st, fn, regs, mem_off, &I->opnds[0], r);
     NEXT();
   }
   OP(IOP_UNOP) : {
     u64 r = do_unop(st, in->sub, op_value(st, fn, regs, mem_off, &I->opnds[1]),
                     in->w0, in->fp0);
     if (st->status) goto stop;
     write_dst(st, fn, regs, mem_off, &I->opnds[0], r);
     NEXT();
   }
   OP(IOP_CMP) : {
     u64 r =
         (u64)do_cmp(st, in->sub, op_value(st, fn, regs, mem_off, &I->opnds[1]),
                     op_value(st, fn, regs, mem_off, &I->opnds[2]), in->w0);
     if (st->status) goto stop;
     write_dst(st, fn, regs, mem_off, &I->opnds[0], r);
     NEXT();
   }
   OP(IOP_CONVERT) : {
     u64 r = do_convert(st, in, op_value(st, fn, regs, mem_off, &I->opnds[1]));
     if (st->status) goto stop;
     write_dst(st, fn, regs, mem_off, &I->opnds[0], r);
     NEXT();
   }
   OP(IOP_ALLOCA) : {
     u64 size = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     u32 align = in->imm ? (u32)in->imm : 16u;
     u32 off = (fr->alloca_top + align - 1u) & ~(align - 1u);
     if ((u64)fr->mem_off + off + size > st->mem_cap) {
       fault(st, "alloca: stack overflow");
       goto stop;
     }
     write_dst(st, fn, regs, mem_off, &I->opnds[0],
               frame_base(st, fr->mem_off) + off);
     fr->alloca_top = off + (u32)size;
     /* Advance the global high-water so a nested call's frame is allocated
      * ABOVE this live alloca region (otherwise it would alias it). */
     if (fr->mem_off + fr->alloca_top > st->mem_top)
       st->mem_top = fr->mem_off + fr->alloca_top;
     NEXT();
   }
   OP(IOP_BR) : ip = &fn->code[in->t0];
   GO();
   OP(IOP_CONDBR) : {
     u64 c = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     /* A faulting selector would otherwise branch on garbage: branch ops
      * skip the straight-line fault re-check, so test the latch here. */
     if (st->mem_fault) {
       fault(st, "invalid memory access");
       goto stop;
     }
     ip = &fn->code[c ? in->t0 : in->t1];
     GO();
   }
   OP(IOP_CMP_BRANCH) : {
     int taken = do_cmp(
         st, in->sub, op_value(st, fn, regs, mem_off, &I->opnds[0]),
         op_value(st, fn, regs, mem_off, &I->opnds[1]), in->w0 ? in->w0 : 8u);
     if (st->status) goto stop;
     if (st->mem_fault) {
       fault(st, "invalid memory access");
       goto stop;
     }
     ip = &fn->code[taken ? in->t0 : in->t1];
     GO();
   }
   OP(IOP_SWITCH) : {
     InterpSwitch* sw = &fn->switches[in->t0];
     u64 sel = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     u32 ci;
     u32 target = sw->default_pc;
     u32 selw = (u32)abi_cg_sizeof(p->c->abi, sw->sel_type);
     if (st->mem_fault) {
       fault(st, "invalid memory access");
       goto stop;
     }
     for (ci = 0; ci < sw->ncases; ++ci) {
       if (mask_w(sel, selw) == mask_w(sw->aux->cases[ci].value, selw)) {
         target = sw->case_pc[ci];
         break; /* leaves the case-search loop, not the dispatch */
       }
     }
     if (target == INTERP_PC_NONE) {
       fault(st, "switch: no target");
       goto stop;
     }
     ip = &fn->code[target];
     GO();
   }
   OP(IOP_LOAD_LABEL_ADDR)
       : /* encode target pc as the label address */
         write_dst(st, fn, regs, mem_off, &I->opnds[0], (u64)in->t0);
   NEXT();
   OP(IOP_INDIRECT_BR) : {
     u64 target = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     if (st->mem_fault) {
       fault(st, "invalid memory access");
       goto stop;
     }
     if (target >= fn->ncode) {
       fault(st, "indirect branch out of range");
       goto stop;
     }
     ip = &fn->code[target];
     GO();
   }
   OP(IOP_CALL) : {
     IRCallAux* aux = (IRCallAux*)I->extra.aux;
     OptCGCallDesc* desc = &aux->desc;
     InterpFunc* callee = NULL;
     void* host_fp = NULL;
     if (desc->callee.kind == OPK_GLOBAL) {
       callee = interp_func_for_sym(p, desc->callee.v.global.sym);
       if (callee && !callee->ok) {
         /* A known internal callee we cannot interpret: propagate its
          * reason rather than silently calling the native version (the
          * --no-jit contract is that execution never falls back to JIT). */
         unsupported(st,
                     callee->reject_reason ? callee->reject_reason : "callee");
         goto stop;
       }
       if (!callee) host_fp = interp_global_base(fn, desc->callee.v.global.sym);
     } else if (desc->callee.kind == OPK_REG) {
       host_fp = (void*)(uintptr_t)regs[desc->callee.v.reg];
       /* If the function pointer targets a TU-internal function, interpret
        * it (don't run its native code) so --no-jit truly never executes
        * JITed code. External pointers fall through to the FFI path. */
       callee = interp_func_for_addr(p, host_fp);
       if (callee && !callee->ok) {
         unsupported(st,
                     callee->reject_reason ? callee->reject_reason : "callee");
         goto stop;
       }
     }
     if (callee) {
       /* internal call: push a frame and bind args. */
       u32 caller_idx = st->nframes - 1u;
       u32 callee_idx;
       if (!in->tail) fr->ip = ip + 1; /* resume after a non-tail call */
       callee_idx = frame_push(st, callee);
       if (callee_idx == 0xffffffffu) {
         fault(st, "call: stack overflow");
         goto stop;
       }
       bind_args(st, caller_idx, callee_idx, desc);
       if (!build_varargs(st, caller_idx, callee_idx, desc)) {
         fault(st, "call: stack overflow");
         goto stop;
       }
       if (st->mem_fault) {
         fault(st, "invalid memory access");
         goto stop;
       }
       {
         InterpFrame* cf = &st->frames[callee_idx];
         InterpFrame* caller = &st->frames[caller_idx];
         if (in->tail) {
           /* True O(1) tail call: the callee's result IS this function's
            * result, so inherit the tail-caller's return target and relocate
            * the freshly-built callee frame down onto the (now dead) caller's
            * register/memory region, rewinding the arenas. A tail loop then
            * runs in constant interp+host stack space instead of growing the
            * fixed reservation each iteration.
            *
            * Safe because the callee has not executed yet: no absolute
            * pointers into its own frame exist (va_start runs later; an arg
            * holding &caller_local would be UB, the caller being about to
            * return). bind_args/build_varargs already copied every argument
            * value out of the caller, so overwriting the caller is fine. */
           u32 dst_regs = caller->regs_off;
           u32 dst_mem = caller->mem_off;
           u32 nregs_bytes = (callee->npregs ? callee->npregs : 1u) * 8u;
           u32 mem_used = cf->alloca_top; /* static frame + vararg buffer */
           cf->ret_wanted = caller->ret_wanted;
           cf->ret_dst = caller->ret_dst;
           cf->sret_ptr = caller->sret_ptr;
           if (cf->regs_off != dst_regs)
             memmove(st->regs_arena + dst_regs, st->regs_arena + cf->regs_off,
                     nregs_bytes);
           if (cf->mem_off != dst_mem) {
             memmove(st->mem_arena + dst_mem, st->mem_arena + cf->mem_off,
                     mem_used);
             if (cf->has_varargs) cf->vararg_off -= (cf->mem_off - dst_mem);
           }
           cf->regs_off = dst_regs;
           cf->mem_off = dst_mem;
           *caller = *cf;
           st->nframes = caller_idx + 1u;
           st->regs_top = dst_regs + nregs_bytes;
           st->mem_top = dst_mem + mem_used;
         } else if (desc->ret.storage.kind == OPK_REG) {
           cf->ret_wanted = 1;
           cf->ret_dst = desc->ret.storage.v.reg;
         } else if (desc->ret.storage.kind == OPK_LOCAL) {
           /* aggregate return: callee writes into the caller's slot */
           u64 a = frame_base(st, caller->mem_off) +
                   caller->fn->slot_off[desc->ret.storage.v.frame_slot];
           cf->sret_ptr = interp_translate(p, a, 1, PERM_W);
         }
       }
       RELOAD();
       GO();
     }
     if (!host_fp) {
       unsupported(st, "unresolved call target");
       goto stop;
     }
     {
       u64 callret = ext_call(st, fr, regs, host_fp, desc);
       if (st->status) goto stop;
       if (in->tail) {
         /* External tail call: the call's result is this function's
          * result (desc.ret.storage may be empty for a tail call). */
         u64 rv = callret;
         u8 want = fr->ret_wanted;
         u32 rdst = fr->ret_dst;
         st->regs_top = fr->regs_off;
         st->mem_top = fr->mem_off;
         st->nframes--;
         st->scalar_ret = rv;
         if (st->nframes == 0) {
           st->status = KIT_INTERP_DONE;
           if (out_ret) *out_ret = (int64_t)rv;
           return KIT_INTERP_DONE;
         }
         if (want) {
           InterpFrame* caller = &st->frames[st->nframes - 1u];
           u64* cregs = (u64*)(st->regs_arena + caller->regs_off);
           cregs[rdst] = rv;
         }
         RELOAD();
         GO();
       }
     }
     NEXT();
   }
   OP(IOP_RET) : OP(IOP_RET_VOID) : {
     u8 is_fp = 0;
     u64 rv = 0;
     u8* sret = fr->sret_ptr;
     if (in->op == IOP_RET) {
       IRRetAux* aux = (IRRetAux*)I->extra.aux;
       OptCGABIValue* val = &aux->val;
       if (cg_type_is_aggregate(p->c, val->type) ||
           abi_cg_sizeof(p->c->abi, val->type) > 8u) {
         if (sret) {
           u64 src = op_addr(st, fn, regs, mem_off, &val->storage);
           u8* s = interp_translate(p, src, abi_cg_sizeof(p->c->abi, val->type),
                                    PERM_R);
           if (s) memcpy(sret, s, abi_cg_sizeof(p->c->abi, val->type));
         }
       } else {
         ABITypeInfo ti = abi_cg_type_info(p->c->abi, val->type);
         u32 sz = abi_cg_sizeof(p->c->abi, val->type);
         rv = op_value(st, fn, regs, mem_off, &val->storage);
         is_fp = (ti.scalar_kind == ABI_SC_FLOAT) ? 1u : 0u;
         /* A scalar result whose caller destination is a memory slot (an
          * address-taken result local) is delivered via sret_ptr, not a
          * register — write it there. */
         if (sret) memcpy(sret, &rv, sz ? (sz > 8u ? 8u : sz) : 8u);
       }
     }
     /* The popped (callee) frame records where its scalar result lands in
      * the caller — capture before popping, then rewind the arenas to the
      * frame's bases (strict stack discipline). */
     {
       u8 want = fr->ret_wanted;
       u32 dst = fr->ret_dst;
       st->regs_top = fr->regs_off;
       st->mem_top = fr->mem_off;
       st->nframes--;
       st->scalar_ret = rv;
       st->ret_is_fp = is_fp;
       if (st->nframes == 0) {
         st->status = KIT_INTERP_DONE;
         if (out_ret) *out_ret = (int64_t)rv;
         return KIT_INTERP_DONE;
       }
       if (want) {
         InterpFrame* caller = &st->frames[st->nframes - 1u];
         u64* cregs = (u64*)(st->regs_arena + caller->regs_off);
         cregs[dst] = rv;
       }
     }
     RELOAD();
     GO();
   }
   OP(IOP_INTRINSIC) : {
     if (!interp_intrinsic(st, fn, regs, mem_off, in)) goto stop;
     NEXT();
   }
   OP(IOP_FENCE) : NEXT(); /* single-thread: no-op */
   OP(IOP_AGG_SET) : OP(IOP_AGG_COPY) : {
     /* AGG_COPY/SET use pointer-deref addressing (pointer_addr_from_operand):
      * a LOCAL holding a pointer is dereferenced; otherwise it is the slot. */
     u64 d = interp_ptr_addr(st, fn, regs, mem_off, &I->opnds[0]);
     if (in->op == IOP_AGG_COPY) {
       IRAggAux* aux = (IRAggAux*)I->extra.aux;
       u64 s = interp_ptr_addr(st, fn, regs, mem_off, &I->opnds[1]);
       mem_copy(st, d, s, aux ? aux->access.size : 0u);
     } else {
       IRAggAux* aux = (IRAggAux*)I->extra.aux;
       u64 byte = op_value(st, fn, regs, mem_off, &I->opnds[1]);
       u32 n = aux ? aux->access.size : 0u;
       u8* h = interp_translate(p, d, n, PERM_W);
       if (h)
         memset(h, (int)(byte & 0xffu), n);
       else
         st->mem_fault = 1;
     }
     NEXT();
   }
   OP(IOP_TLS_ADDR) : {
     /* A thread-local's symbol does not resolve to its storage on every
      * target (a Mach-O symbol resolves to a TLV descriptor), so route
      * through interp_tls_addr / the host resolve_tls hook, which returns the
      * running thread's address of the variable (already +addend). */
     IRTlsAux* aux = (IRTlsAux*)I->extra.aux;
     void* addr = aux ? interp_tls_addr(fn, aux->sym, aux->addend) : NULL;
     if (!addr) {
       unsupported(st, "unresolved thread-local symbol");
       goto stop;
     }
     write_dst(st, fn, regs, mem_off, &I->opnds[0], (u64)(uintptr_t)addr);
     NEXT();
   }
   OP(IOP_BITFIELD_LOAD) : {
     /* opnds[1] is the record address; the field bits live in the storage
      * unit at record + storage_offset. Extract by shift+mask (target uses
      * little-endian bit numbering), sign-extending signed fields. */
     IRBitFieldAux* aux = (IRBitFieldAux*)I->extra.aux;
     u64 rec, raw, v = 0;
     u32 ssz, width;
     if (!aux) {
       unsupported(st, "bitfield access");
       goto stop;
     }
     rec = op_addr(st, fn, regs, mem_off, &I->opnds[1]);
     ssz = aux->access.storage.size ? aux->access.storage.size : 4u;
     width = aux->access.bit_width;
     if (width) {
       raw = mem_read(st, rec + aux->access.storage_offset, ssz);
       v = (raw >> aux->access.bit_offset) & bits_mask(width);
       if (aux->access.signed_ && width < 64u && (v & (1ull << (width - 1u))))
         v |= ~bits_mask(width);
     }
     write_dst(st, fn, regs, mem_off, &I->opnds[0], v);
     NEXT();
   }
   OP(IOP_BITFIELD_STORE) : {
     /* opnds[0] = record address, opnds[1] = source value. Read-modify-write
      * the storage unit: clear the field bits, then OR in the masked, shifted
      * source. A zero-width field is a layout barrier — no store. */
     IRBitFieldAux* aux = (IRBitFieldAux*)I->extra.aux;
     u64 rec, addr, ones, fmask, src, raw;
     u32 ssz, width;
     if (!aux) {
       unsupported(st, "bitfield access");
       goto stop;
     }
     width = aux->access.bit_width;
     if (width == 0) NEXT();
     rec = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
     ssz = aux->access.storage.size ? aux->access.storage.size : 4u;
     addr = rec + aux->access.storage_offset;
     ones = bits_mask(width);
     fmask = ones << aux->access.bit_offset;
     src = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     raw = mem_read(st, addr, ssz);
     raw = (raw & ~fmask) | ((src & ones) << aux->access.bit_offset);
     mem_write(st, addr, ssz, raw);
     NEXT();
   }
   OP(IOP_VA_START) : {
     /* opnds[0] is the va_list object's address (a pointer value). Seed it
      * with a cursor over this frame's anonymous-argument buffer. */
     u64 ap = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     u64 cursor = fr->has_varargs ? frame_base(st, fr->vararg_off) : 0u;
     mem_write(st, ap, 8u, cursor);
     NEXT();
   }
   OP(IOP_VA_END) : NEXT(); /* nothing to release in the cursor model */
   OP(IOP_VA_COPY) : {
     /* opnds = [dst va_list addr, src va_list addr]: duplicate the cursor. */
     u64 d = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     u64 s = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     mem_write(st, d, 8u, mem_read(st, s, 8u));
     NEXT();
   }
   OP(IOP_VA_ARG) : {
     /* opnds[0] = dst (type drives the read width), opnds[1] = va_list addr.
      * Align the cursor, read the slot, advance, store the cursor back. */
     KitCgTypeId ty = I->opnds[0].type;
     u64 ap = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     u64 cursor = mem_read(st, ap, 8u);
     u32 size = abi_cg_sizeof(p->c->abi, ty);
     u32 al = va_align_of(size);
     cursor = (cursor + al - 1u) & ~((u64)al - 1u);
     if (cg_type_is_aggregate(p->c, ty) || size > 8u) {
       u64 dstaddr = op_addr(st, fn, regs, mem_off, &I->opnds[0]);
       mem_copy(st, dstaddr, cursor, size);
     } else {
       write_dst(st, fn, regs, mem_off, &I->opnds[0],
                 mem_read(st, cursor, size ? size : 8u));
     }
     mem_write(st, ap, 8u, cursor + va_stride_of(size));
     NEXT();
   }
   /* Atomics: single-threaded interpreter, so the operation is serialized
    * and the memory order is irrelevant (treated as seq-cst). */
   OP(IOP_ATOMIC_LOAD) : {
     u64 a = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     write_dst(st, fn, regs, mem_off, &I->opnds[0],
               mem_read(st, a, in->w0 ? in->w0 : 8u));
     NEXT();
   }
   OP(IOP_ATOMIC_STORE) : {
     u64 a = op_value(st, fn, regs, mem_off, &I->opnds[0]);
     mem_write(st, a, in->w0 ? in->w0 : 8u,
               op_value(st, fn, regs, mem_off, &I->opnds[1]));
     NEXT();
   }
   OP(IOP_ATOMIC_RMW) : {
     u32 w = in->w0 ? in->w0 : 8u;
     u64 a = op_value(st, fn, regs, mem_off, &I->opnds[1]);
     u64 old = mem_read(st, a, w);
     u64 v = op_value(st, fn, regs, mem_off, &I->opnds[2]);
     mem_write(st, a, w, do_rmw(in->sub, old, v, w));
     write_dst(st, fn, regs, mem_off, &I->opnds[0], old);
     NEXT();
   }
   OP(IOP_ATOMIC_CAS) : {
     u32 w = in->w0 ? in->w0 : 8u;
     u64 a = op_value(st, fn, regs, mem_off, &I->opnds[2]);
     u64 expected = op_value(st, fn, regs, mem_off, &I->opnds[3]);
     u64 desired = op_value(st, fn, regs, mem_off, &I->opnds[4]);
     u64 old = mem_read(st, a, w);
     u64 ok = (mask_w(old, w) == mask_w(expected, w));
     if (ok) mem_write(st, a, w, desired);
     write_dst(st, fn, regs, mem_off, &I->opnds[0], old); /* prior */
     write_dst(st, fn, regs, mem_off, &I->opnds[1], ok);  /* ok flag */
     NEXT();
   }
   OP(IOP_UNREACHABLE) : fault(st, "unreachable");
   goto stop;
   OP(IOP_TRAP)
       : unsupported(st, fn->reject_reason ? fn->reject_reason : "operation");
   goto stop;
 #if !INTERP_DISPATCH_THREADED
   default:
     unsupported(st, "opcode");
     goto stop;
 }
 if (st->mem_fault) {
   fault(st, "invalid memory access");
   goto stop;
 }
 ip++;
 }
 #else
     fault_mem:
       fault(st, "invalid memory access");
       /* fall through to stop */
 #endif
 
 stop: fr->ip = ip;
 return (KitInterpStatus)st->status;
 #undef RELOAD
 }
 #if INTERP_DISPATCH_THREADED
 #if defined(__clang__)
 #pragma clang diagnostic pop
 #elif defined(__GNUC__)
 #pragma GCC diagnostic pop
 #endif
 #endif
 
 /* ---- intrinsics ---- */
 
 static u64 ipopcount(u64 v, u32 w) {
   u64 m = (w >= 8) ? ~0ull : ((1ull << (w * 8u)) - 1ull);
   u64 x = v & m;
   u64 n = 0;
   while (x) {
     n += (x & 1u);
     x >>= 1;
   }
   return n;
 }
 static u64 ictz(u64 v, u32 w) {
   u32 bits = w * 8u;
   u64 n = 0;
   if ((v & ((bits >= 64) ? ~0ull : ((1ull << bits) - 1ull))) == 0) return bits;
   while (!(v & 1u)) {
     n++;
     v >>= 1;
   }
   return n;
 }
 static u64 iclz(u64 v, u32 w) {
   u32 bits = w * 8u;
   u64 n = 0;
   u64 top = 1ull << (bits - 1u);
   v &= (bits >= 64) ? ~0ull : ((1ull << bits) - 1ull);
   if (v == 0) return bits;
   while (!(v & top)) {
     n++;
     v <<= 1;
   }
   return n;
 }
 static u64 ibswap(u64 v, u32 nbytes) {
   u64 r = 0;
   u32 i;
   for (i = 0; i < nbytes; ++i) {
     r = (r << 8) | (v & 0xffu);
     v >>= 8;
   }
   return r;
 }
 
 static u64 imul_high_u64(u64 a, u64 b) {
   u64 a0 = (u32)a, a1 = a >> 32;
   u64 b0 = (u32)b, b1 = b >> 32;
   u64 p00 = a0 * b0;
   u64 p01 = a0 * b1;
   u64 p10 = a1 * b0;
   u64 p11 = a1 * b1;
   u64 middle = (p00 >> 32) + (u32)p01 + (u32)p10;
   return p11 + (p01 >> 32) + (p10 >> 32) + (middle >> 32);
 }
 
 static int interp_intrinsic(InterpStack* st, InterpFunc* fn, u64* regs,
                             u32 mem_off, InterpInsn* in) {
   InterpProgram* p = st->prog;
   IRIntrinAux* aux = (IRIntrinAux*)in->inst->extra.aux;
   Compiler* c = p->c;
   if (!aux) {
     unsupported(st, "intrinsic");
     return 0;
   }
 #define ARGV(i) op_value(st, fn, regs, mem_off, &aux->args[i])
 #define AWID(i) ((u32)abi_cg_sizeof(c->abi, aux->args[i].type))
 #define DWID(i) ((u32)abi_cg_sizeof(c->abi, aux->dsts[i].type))
 #define DST0 \
   (aux->ndst > 0 && aux->dsts[0].kind == OPK_REG ? aux->dsts[0].v.reg : 0u)
   switch (aux->kind) {
     case INTRIN_MEMMOVE: {
       u64 d = ARGV(0), s = ARGV(1), n = ARGV(2);
       mem_copy(st, d, s, (u32)n);
       if (aux->ndst > 0 && aux->dsts[0].kind == OPK_REG) regs[DST0] = d;
       return 1;
     }
     case INTRIN_POPCOUNT:
       regs[DST0] = ipopcount(ARGV(0), AWID(0));
       return 1;
     case INTRIN_CTZ:
       regs[DST0] = ictz(ARGV(0), AWID(0));
       return 1;
     case INTRIN_CLZ:
       regs[DST0] = iclz(ARGV(0), AWID(0));
       return 1;
     case INTRIN_BSWAP:
       regs[DST0] = ibswap(ARGV(0), DWID(0));
       return 1;
     case INTRIN_SMUL_HIGH:
     case INTRIN_UMUL_HIGH: {
       u32 w = AWID(0);
       u64 a = mask_w(ARGV(0), w);
       u64 b = mask_w(ARGV(1), w);
       u64 hi;
       if (w < 8u) {
         if (aux->kind == INTRIN_SMUL_HIGH)
           hi = (u64)((i64)sext_w(a, w) * (i64)sext_w(b, w)) >> (w * 8u);
         else
           hi = (a * b) >> (w * 8u);
       } else {
         hi = imul_high_u64(a, b);
         if (aux->kind == INTRIN_SMUL_HIGH) {
           if ((i64)a < 0) hi -= b;
           if ((i64)b < 0) hi -= a;
         }
       }
       regs[DST0] = mask_w(hi, w);
       return 1;
     }
     case INTRIN_EXPECT:
       regs[DST0] = ARGV(0);
       return 1;
     case INTRIN_ASSUME_ALIGNED:
       if (aux->ndst > 0 && aux->dsts[0].kind == OPK_REG) regs[DST0] = ARGV(0);
       return 1;
     case INTRIN_PREFETCH:
       return 1;
     /* CPU hints and memory barriers have no observable effect in the
      * single-threaded interpreter model: treat them as no-ops. */
     case INTRIN_CPU_NOP:
     case INTRIN_CPU_YIELD:
     case INTRIN_ISB:
     case INTRIN_DMB:
     case INTRIN_DSB:
       return 1;
     case INTRIN_TRAP:
       fault(st, "__builtin_trap");
       return 0;
     case INTRIN_SADD_OVERFLOW:
     case INTRIN_UADD_OVERFLOW:
     case INTRIN_SSUB_OVERFLOW:
     case INTRIN_USUB_OVERFLOW:
     case INTRIN_SMUL_OVERFLOW:
     case INTRIN_UMUL_OVERFLOW: {
       u32 w = AWID(0);
       u64 a = ARGV(0), b = ARGV(1);
       u64 res = 0;
       int ovf = 0;
       switch (aux->kind) {
         /* For w<8 the operands fit in i64/u64 so the exact result is available
          * and a re-narrow comparison detects overflow; for w==8 there is no
          * wider type, so detect via sign/carry logic (the re-narrow trick would
          * always read "no overflow"). */
         case INTRIN_SADD_OVERFLOW: {
           i64 x = sext_w(a, w), y = sext_w(b, w);
           u64 r = (u64)x + (u64)y;
           res = mask_w(r, w);
           ovf = (w < 8) ? (sext_w(res, w) != x + y)
                         : (int)((((u64)x ^ r) & ((u64)y ^ r)) >> 63);
           break;
         }
         case INTRIN_UADD_OVERFLOW: {
           u64 x = mask_w(a, w), y = mask_w(b, w), r = x + y;
           res = mask_w(r, w);
           ovf = (res != r) || (mask_w(r, w) < x);
           break;
         }
         case INTRIN_SSUB_OVERFLOW: {
           i64 x = sext_w(a, w), y = sext_w(b, w);
           u64 r = (u64)x - (u64)y;
           res = mask_w(r, w);
           ovf = (w < 8) ? (sext_w(res, w) != x - y)
                         : (int)((((u64)x ^ (u64)y) & ((u64)x ^ r)) >> 63);
           break;
         }
         case INTRIN_USUB_OVERFLOW: {
           ovf = mask_w(a, w) < mask_w(b, w);
           res = mask_w(mask_w(a, w) - mask_w(b, w), w);
           break;
         }
         case INTRIN_SMUL_OVERFLOW: {
           i64 x = sext_w(a, w), y = sext_w(b, w);
           u64 r = (u64)x * (u64)y;
           res = mask_w(r, w);
           if (w < 8) {
             ovf = (sext_w(res, w) != x * y);
           } else if (x == 0 || y == 0) {
             ovf = 0;
           } else if ((x == -1 && (u64)y == 0x8000000000000000ull) ||
                      (y == -1 && (u64)x == 0x8000000000000000ull)) {
             ovf = 1; /* INT64_MIN * -1 */
           } else {
             ovf = ((i64)r / x != y);
           }
           break;
         }
         case INTRIN_UMUL_OVERFLOW: {
           u64 x = mask_w(a, w), y = mask_w(b, w), r = x * y;
           res = mask_w(r, w);
           ovf = (w < 8) ? (r != res) : (x != 0 && r / x != y);
           break;
         }
         default:
           break;
       }
       if (aux->ndst > 0 && aux->dsts[0].kind == OPK_REG)
         regs[aux->dsts[0].v.reg] = res;
       if (aux->ndst > 1 && aux->dsts[1].kind == OPK_REG)
         regs[aux->dsts[1].v.reg] = (u64)ovf;
       return 1;
     }
     default:
       unsupported(st, "intrinsic");
       return 0;
   }
 #undef ARGV
 #undef AWID
 #undef DWID
 #undef DST0
 }
 
 /* ---- public stack API ---- */
 
 KitInterpStack* kit_interp_stack_new(KitInterpProgram* pp) {
   InterpProgram* p = (InterpProgram*)pp;
   Heap* h;
   InterpStack* st;
   if (!p) return NULL;
   h = p->c->ctx->heap;
   st = (InterpStack*)h->alloc(h, sizeof(*st), _Alignof(InterpStack));
   if (!st) return NULL;
   memset(st, 0, sizeof *st);
   st->prog = p;
   /* Fixed, non-relocating arenas (see bump()/INTERP_*_RESERVE). */
   st->regs_arena = (u8*)h->alloc(h, INTERP_REGS_RESERVE, 16u);
   st->mem_arena = (u8*)h->alloc(h, INTERP_MEM_RESERVE, 16u);
   if (!st->regs_arena || !st->mem_arena) {
     if (st->regs_arena) h->free(h, st->regs_arena, INTERP_REGS_RESERVE);
     if (st->mem_arena) h->free(h, st->mem_arena, INTERP_MEM_RESERVE);
     h->free(h, st, sizeof *st);
     return NULL;
   }
   st->regs_cap = INTERP_REGS_RESERVE;
   st->mem_cap = INTERP_MEM_RESERVE;
   return (KitInterpStack*)st;
 }
 
 void kit_interp_stack_free(KitInterpStack* s) {
   InterpStack* st = (InterpStack*)s;
   Heap* h;
   if (!st) return;
   h = st->prog->c->ctx->heap;
   if (st->frames) h->free(h, st->frames, sizeof(InterpFrame) * st->frames_cap);
   if (st->regs_arena) h->free(h, st->regs_arena, st->regs_cap);
   if (st->mem_arena) h->free(h, st->mem_arena, st->mem_cap);
   h->free(h, st, sizeof *st);
 }
 
 static void bind_entry_param(InterpStack* st, InterpFunc* fn, u32 idx, u32 i,
                              u64 value) {
   InterpFrame* fr = &st->frames[idx];
   IRParam* pr;
   if (i >= fn->f->nparams) return;
   pr = &fn->f->params[i];
   if (pr->storage.kind == CG_LOCAL_STORAGE_REG) {
     u64* regs = (u64*)(st->regs_arena + fr->regs_off);
     regs[pr->storage.v.reg] = value;
   } else {
     u64 dst =
         frame_base(st, fr->mem_off) + fn->slot_off[pr->storage.v.frame_slot];
     mem_write(st, dst, 8u, value);
   }
 }
 
 KitStatus kit_interp_call_on(KitInterpStack* s, KitInterpFunc* ff, int argc,
                              char** argv) {
   InterpStack* st = (InterpStack*)s;
   InterpFunc* fn = (InterpFunc*)ff;
   u32 idx;
   if (!st || !fn) return KIT_INVALID;
   idx = frame_push(st, fn);
   if (idx == 0xffffffffu) return KIT_NOMEM;
   bind_entry_param(st, fn, idx, 0u, (u64)(unsigned)argc);
   bind_entry_param(st, fn, idx, 1u, (u64)(uintptr_t)argv);
   return KIT_OK;
 }
 
 KitInterpStatus kit_interp_resume(KitInterpStack* s, int64_t* out_ret) {
   InterpStack* st = (InterpStack*)s;
   if (!st) return KIT_INTERP_ERROR;
   return interp_run_stack(st, out_ret);
 }
 
 KitInterpStatus kit_interp_call(KitInterpProgram* pp, KitInterpFunc* ff,
                                 int argc, char** argv, int64_t* out_ret) {
   KitInterpStack* s = kit_interp_stack_new(pp);
   KitInterpStatus rc;
   if (!s) return KIT_INTERP_ERROR;
   if (kit_interp_call_on(s, ff, argc, argv) != KIT_OK) {
     kit_interp_stack_free(s);
     return KIT_INTERP_ERROR;
   }
   rc = kit_interp_resume(s, out_ret);
   kit_interp_stack_free(s);
   return rc;
 }
 
 KitInterpStatus kit_interp_call_args(KitInterpProgram* pp, KitInterpFunc* ff,
                                      const uint64_t* args, uint32_t nargs,
                                      int64_t* out_ret) {
   InterpStack* st = (InterpStack*)kit_interp_stack_new(pp);
   InterpFunc* fn = (InterpFunc*)ff;
   KitInterpStatus rc;
   u32 idx, i;
   if (!st) return KIT_INTERP_ERROR;
   if (!fn) {
     kit_interp_stack_free((KitInterpStack*)st);
     return KIT_INTERP_ERROR;
   }
   idx = frame_push(st, fn);
   if (idx == 0xffffffffu) {
     kit_interp_stack_free((KitInterpStack*)st);
     return KIT_INTERP_ERROR;
   }
   for (i = 0; i < nargs; ++i) bind_entry_param(st, fn, idx, i, args[i]);
   rc = interp_run_stack(st, out_ret);
   kit_interp_stack_free((KitInterpStack*)st);
   return rc;
 }
 
 KitStatus kit_interp_stack_reset(KitInterpStack* s) {
   InterpStack* st = (InterpStack*)s;
   if (!st) return KIT_INVALID;
   /* Keep the (fixed, non-relocating) arenas; rewind their bump tops and drop
    * all frames + the return shuttle + any prior status/trap. */
   st->nframes = 0;
   st->regs_top = 0;
   st->mem_top = 0;
   st->scalar_ret = 0;
   st->ret_is_fp = 0;
   st->status = KIT_INTERP_DONE;
   st->trap_reason = NULL;
   st->mem_fault = 0;
   return KIT_OK;
 }
 
 KitStatus kit_interp_call_args_on(KitInterpStack* s, KitInterpFunc* ff,
                                   const uint64_t* args, uint32_t nargs) {
   InterpStack* st = (InterpStack*)s;
   InterpFunc* fn = (InterpFunc*)ff;
   u32 idx, i;
   if (!st || !fn) return KIT_INVALID;
   idx = frame_push(st, fn);
   if (idx == 0xffffffffu) return KIT_NOMEM;
   for (i = 0; i < nargs; ++i) bind_entry_param(st, fn, idx, i, args[i]);
   return KIT_OK;
 }
 
 const char* kit_interp_stack_trap_reason(KitInterpStack* s) {
   InterpStack* st = (InterpStack*)s;
   return st ? st->trap_reason : NULL;
 }