G8l: S179 SGI2 sender CPU1 timer-IRQ request service

use super::{gic, timer};

/// Global tick sayacı. Drift ölçümü + scheduler tick için.
pub static TICKS: AtomicU64 = AtomicU64::new(0);

/// Trampoline'ın stack üzerine kaydettiği register seti.
/// `exceptions.S` içindeki layout ile birebir aynı olmalı.
///
/// TODO(M3.4-real / Audit #19): Exception'lar için ayrı bir IRQ stack ayır
/// (şu an her task'in kendi stack'ini kullanıyor → 16 KiB task stack üzerinde
/// 272 byte trap frame + Rust handler local'leri = nested IRQ veya derin
/// scheduler çağrısı stack overflow yapabilir). Çözüm: per-CPU `IRQ_STACK`
/// statik (4 KiB), trampoline başında SP_EL0 swap.
///
/// TODO(M3.4-real / Audit #12): TaskContext'e ELR_EL1, SPSR_EL1, DAIF, TPIDR
/// alanları eklenmeli. Şu anda cooperative scheduler bunlara ihtiyaç duymuyor
/// (yield_now bir fonksiyon çağrısı, callee-saved registerlar yeter); ama
/// gerçek IRQ-driven preemption (timer IRQ → context_switch) exception
/// frame'inin tamamını task'e bağlamak zorunda.
#[repr(C)]
pub struct ExceptionContext {
    pub gpr: [u64; 30], // x0..x29
    pub lr: u64,        // x30
    pub elr_el1: u64,   // dönüş PC
    pub spsr_el1: u64,  // dönüş PSTATE
}

const _: () = assert!(
    core::mem::size_of::<ExceptionContext>() == 264,
    "exceptions.S expects the integer exception context to occupy 264 bytes",
);

/// ESR_EL1.EC alanını (bits 31:26) decode et.
fn decode_ec(esr: u64) -> &'static str {
    match (esr >> 26) & 0x3f {
        0x00 => "Unknown reason",
        0x01 => "Trapped WFI/WFE",
        0x07 => "SIMD/FP access trapped",
        0x0e => "Illegal Execution state",
        0x15 => "SVC (AArch64)",
        0x18 => "MSR/MRS/system trap",
        0x20 => "Instruction Abort, lower EL",
        0x21 => "Instruction Abort, same EL",
        0x22 => "PC alignment fault",
        0x24 => "Data Abort, lower EL",
        0x25 => "Data Abort, same EL",
        0x26 => "SP alignment fault",
        0x2c => "FP trapped exception (AArch64)",
        0x2f => "SError",
        0x30 => "Breakpoint (lower EL)",
        0x31 => "Breakpoint (same EL)",
        0x32 => "Software Step (lower EL)",
        0x33 => "Software Step (same EL)",
        0x34 => "Watchpoint (lower EL)",
        0x35 => "Watchpoint (same EL)",
        0x3c => "BRK instruction (AArch64)",
        _ => "<bilinmeyen EC>",
    }
}

#[test]
fn s242_timer_irq_callsite_is_after_eoi_and_before_existing_cpu1_services() {
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let service = exceptions
        .find("service_s242_sender_runtime_callsite_request_on_cpu1")
        .expect("S242 IRQ service");
    let eoi = exceptions[..service]
        .rfind("gic::end_of_interrupt(ack)")
        .expect("EOI before S242");
    let s212 = exceptions[service..]
        .find("service_runtime_owner_s197_tuple_from_current_scheduler_task")
        .map(|offset| service + offset)
        .expect("S212 after S242");
    assert!(eoi < service && service < s212);
    assert!(exceptions.contains("S242 CPU1 sender request service failed closed"));
}

  {
    id: "g8l-s242-production-migration-lifecycle-s179-execution-caller-notification-sgi-sender-runtime-callsite-request-partial",
    date: "2026-08-25",
    sequence: 242,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: S179 SGI2 sender CPU1 timer-IRQ request service",
    summary:
      "S242 26/26 PASS ile S241 source-callsite adaptörünü gerçek CPU1 timer-IRQ servis noktasına bağlayan allocation-free, non-Copy tek-slot request sınırını kurdu. Request runtime authority, scheduler-owner authority ve exact S177 permit'i birlikte taşır; boş slot Idle, dolu slot take-before-delegate ile bir kez tüketilir ve runtime/owner dönüşü CPU0 için tek seferlik ayrılır. Upstream migration producer henüz request yayınlamıyor; production request invocation, CPU0 wake, hardware delivery, deferred S236 invocation, scheduler mutation, ERET veya fiziksel runtime gözlenmedi.",
    evidence: [
      "S242 focused host grubu iki bağımsız koşuda 26/26 PASS verdi: canonical test-result satırları 95 B / SHA-256 be2367d1df51941fa7fe5efa6278106d034d3241d0d264ce1c4d9d9a115cae56.",
      "S238 + S239 + S240 receipt/SGI + S241 + S242 dependency matrisi iki bağımsız koşuda 6 grup / 113/113 PASS verdi: canonical summary 570 B / SHA-256 f0b37752802f0a90553f728b04d0060f3f91d783d86861209b249b7b6ea64b7a.",
      "RPi5 AArch64 normal/SMP compile iki canonical-byte-equal koşuda PASS: normal 338612 B / SHA-256 35ee1b882f954aa5e2a4f45194c667689e32f731b1764c934cddde75df7d971d ve SMP 338554 B / SHA-256 bee9360a8bd8f88376c95e6719e1eee823a5c110443093e5b832a86db5520b9f; 652 warning başlığı/651 kernel warning envanterlendi, zero-warning iddiası yoktur.",
      "Exact kaynak sırası: runtime + scheduler-owner + S177 permit publication → CPU1 timer-IRQ gate → request take ve return-slot reserve → S241 source-callsite adapter → S240 S237 publish/arm → SGIR=0x00010002 → başarıda veya hatada runtime/owner CPU0 return slot'una exact-once iade. Empty queue Idle; tüketilmemiş return yeni publication'ı backpressure eder; replacement, retry ve reset yoktur.",
      "CPU1 timer-IRQ service callsite'ı ve CPU0 return extractor source-wired/AArch64-compiled'dır; S242 upstream producer kurmadığı ve CPU0 extractor'ı invoke etmediği için request publication/runtime invocation, S236 tüketimi, CPU0 wake veya hardware delivery gözlenmedi.",
      "Tam workspace'in yedi tarihsel G8h assertion'ı isim isim değiştirilmeden dışlandığında taze audit 204 grup / 1845 PASS / 0 fail / 7 filtered verdi: log 54036 B / SHA-256 8fea892ff9b90ba008f89297ba442fdf8a003a52f5eac47a323711552f9c8327. Kırmızılar S96/S97 kaynak kimliği, frozen S100 package/Make closure ve S90/S100 arşiv kimliği kapılarıdır; full-workspace GREEN iddia edilmez.",
      "S242 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S242=NO.",
      "Canlı marker: S242_26_OF_26_RUNTIME_OWNER_S177_NONCOPY_UNIT_CPU1_TIMER_IRQ_REQUEST_SERVICE_RETURN_SLOT_RESERVED_RUNTIME_OWNER_RETURNED_CPU0_EXTRACTOR_SOURCE_WIRED_S241_SOURCE_CALLSITE_S240_SGI2_DELEGATE_EXACT_SGIR_0X00010002_EMPTY_IDLE_TAKE_BEFORE_DELEGATE_NO_PRODUCER_REQUEST_NOT_OBSERVED_WAKE_HARDWARE_NOT_OBSERVED_DEFERRED_S236_NOT_INVOKED_AARCH64_COMPILED_WORKSPACE_1845_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_PHYSICAL_QEMU_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S402_TO_S452_S427_NO_RUNBOOK_EXECUTED_IN_S242_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite_request -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s242-g8l-s179-execution-caller-notification-sgi-sender-runtime-callsite-request",
        title: "G8l S242 S179 SGI2 sender CPU1 timer-IRQ request service",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite_request -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S242 focused 1 group / 26 passed; 0 failed",
          "runtime + scheduler-owner + S177 permit unit → CPU1 timer-IRQ gate → reserve-return-before-delegate → S241/S240 sender",
          "runtime/owner return on success/error is source-proven; producer, CPU0 extraction, S236 invocation and hardware delivery remain unobserved",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S242 timer-IRQ request service sınırını doğrular; upstream producer veya fiziksel interrupt/wake kanıtı değildir.",
    limitations: [
      "S242 CPU1 timer-IRQ service callsite'ını ve one-slot publication API'sini source-wired eder; upstream migration producer henüz publish etmez.",
      "Request empty olduğundan S241/S240 production runtime sender invocation, CPU0 wake ve hardware delivery gözlenmemiştir.",
      "Runtime/scheduler-owner authority çifti return slot'una taşınır; CPU0 extractor invocation, deferred S236 consumption, scheduler mutation, ERET/context-switch ve present tuple açık kalır.",
      "QEMU RPi5 GICv2 SGI MMIO yolunu doğrulamaz; fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S242 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S242=NO.",
    ],
  },