G8l: S245 whole-scheduler exclusion provider preflight

use super::{gic, timer};

/// Global tick sayacı. Drift ölçümü + scheduler tick için.
pub static TICKS: AtomicU64 = AtomicU64::new(0);

/// Trampoline'ın stack üzerine kaydettiği register seti.
/// `exceptions.S` içindeki layout ile birebir aynı olmalı.
///
/// TODO(M3.4-real / Audit #19): Exception'lar için ayrı bir IRQ stack ayır
/// (şu an her task'in kendi stack'ini kullanıyor → 16 KiB task stack üzerinde
/// 272 byte trap frame + Rust handler local'leri = nested IRQ veya derin
/// scheduler çağrısı stack overflow yapabilir). Çözüm: per-CPU `IRQ_STACK`
/// statik (4 KiB), trampoline başında SP_EL0 swap.
///
/// TODO(M3.4-real / Audit #12): TaskContext'e ELR_EL1, SPSR_EL1, DAIF, TPIDR
/// alanları eklenmeli. Şu anda cooperative scheduler bunlara ihtiyaç duymuyor
/// (yield_now bir fonksiyon çağrısı, callee-saved registerlar yeter); ama
/// gerçek IRQ-driven preemption (timer IRQ → context_switch) exception
/// frame'inin tamamını task'e bağlamak zorunda.
#[repr(C)]
pub struct ExceptionContext {
    pub gpr: [u64; 30], // x0..x29
    pub lr: u64,        // x30
    pub elr_el1: u64,   // dönüş PC
    pub spsr_el1: u64,  // dönüş PSTATE
}

const _: () = assert!(
    core::mem::size_of::<ExceptionContext>() == 264,
    "exceptions.S expects the integer exception context to occupy 264 bytes",
);

/// ESR_EL1.EC alanını (bits 31:26) decode et.
fn decode_ec(esr: u64) -> &'static str {
    match (esr >> 26) & 0x3f {
        0x00 => "Unknown reason",
        0x01 => "Trapped WFI/WFE",
        0x07 => "SIMD/FP access trapped",
        0x0e => "Illegal Execution state",
        0x15 => "SVC (AArch64)",
        0x18 => "MSR/MRS/system trap",
        0x20 => "Instruction Abort, lower EL",
        0x21 => "Instruction Abort, same EL",
        0x22 => "PC alignment fault",
        0x24 => "Data Abort, lower EL",
        0x25 => "Data Abort, same EL",
        0x26 => "SP alignment fault",
        0x2c => "FP trapped exception (AArch64)",
        0x2f => "SError",
        0x30 => "Breakpoint (lower EL)",
        0x31 => "Breakpoint (same EL)",
        0x32 => "Software Step (lower EL)",
        0x33 => "Software Step (same EL)",
        0x34 => "Watchpoint (lower EL)",
        0x35 => "Watchpoint (same EL)",
        0x3c => "BRK instruction (AArch64)",
        _ => "<bilinmeyen EC>",
    }
}

#[test]
fn s246_cpu1_timer_callsite_runs_before_s242_and_scheduler_dispatch() {
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let cpu1 = exceptions
        .find("if crate::percpu::current_cpu_id() == 1")
        .expect("CPU1 timer arm");
    let s246 = exceptions[cpu1..]
        .find("service_s246_whole_scheduler_exclusion_provider_preflight_on_cpu1")
        .map(|offset| cpu1 + offset)
        .expect("S246 provider preflight");
    let s242 = exceptions[s246..]
        .find("service_s242_sender_runtime_callsite_request_on_cpu1")
        .map(|offset| s246 + offset)
        .expect("S242 service after S246");
    let scheduler = exceptions[s242..]
        .find("rpi5_g7d::on_timer_irq")
        .map(|offset| s242 + offset)
        .expect("scheduler after S246");
    assert!(cpu1 < s246 && s246 < s242 && s242 < scheduler);
    assert!(
        exceptions.contains("S246 CPU1 whole-scheduler exclusion provider preflight failed closed")
    );
}

  {
    id: "g8l-s246-production-s245-whole-scheduler-exclusion-provider-preflight-partial",
    date: "2026-08-25",
    sequence: 246,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: S245 whole-scheduler exclusion provider preflight",
    summary:
      "S246 13/13 PASS ile S245'in non-authoritative CPU0→CPU1 isteğini exact request'i tüketmeden inceleyen gerçek CPU1 timer-IRQ provider preflight'ını bağladı. Source audit yedi production kaynak biriminde 111 doğrudan SCHEDULER erişimi buldu; ortak whole-scheduler guard kapsamı 0/111, unrouted toplamı 111'dir. Bu nedenle request varsa tek meşru production sonucu AwaitingCoverage'dır. Request pending kalır; provider authority, exclusion proof, S244 admission veya S243/S236 invocation üretilmez.",
    evidence: [
      "S246 focused host grubu final kaynak üzerinde iki bağımsız koşuda 13/13 PASS verdi: canonical test-result 95 B / SHA-256 77a722e477a8a66ab195b19a56513dde8937dd0e52e5ddc9a05806a2b9f8c4d7.",
      "Exact source audit: exceptions.rs 10 + production_current_task.rs 1 + request_publication.rs 1 + main.rs 24 + scheduler.rs 49 + capability.rs 25 + user_copy.rs 1 = yedi kaynak birimi / 111 doğrudan SCHEDULER erişimi. Common whole-scheduler guard 0/111; unrouted 111.",
      "S238 + S239 + S240 receipt/SGI + S241 + S242 + S243 + S244 + S245 + S246 dependency matrisi 10 grup / 171/171 PASS verdi; canonical summary 950 B / SHA-256 4d24c24c80f8a9d982897f82ec0e35e25fcc2ac220cabdd52b060578e198f690 ve iki bağımsız koşuda byte-equal.",
      "RPi5 AArch64 normal/SMP profilleri ikişer koşuda byte-equal PASS verdi. Normal: 349231 B / 675 warning başlığı / SHA-256 0f2cf5679f280cdf5ac3424bd25dd77e476d59f6a1cab2122101072128801bf5. SMP: 349173 B / 675 warning başlığı / SHA-256 0feba1626867a1e7dc8ac82e3024a7bf75985a072bed841b387c3837bcec261e. Zero-warning iddiası yoktur.",
      "Exact production sırası: CPU1 timer IRQ → GIC EOI → S246 read-only S245 request view → seven-unit/111-site coverage preflight → Idle veya AwaitingCoverage → S242 service → scheduler dispatch. Exact S245 request alınmaz ve pending kalır.",
      "Filtresiz workspace aynı frozen S96 identity kapısında exit 101 verdi: 49905 B / SHA-256 e5eda176d6c22dfcf3800fa4d87186ca213debdf90ee149bcce892535efb3722. Exact yedi tarihsel assertion dışlandığında 208 grup / 1907 PASS / 0 fail / 7 filtered oldu. Ham loglar yalnız süre alanlarında değişti; süre-normalize iki log byte-equal 56012 B / SHA-256 b5fc8c45c3f132e063824465cf2f4b98f31105d8a8574f1c5b33a361ffe061c1 verdi. Full-workspace GREEN iddia edilmez.",
      "S246 physical/device operations=0; RUNBOOK_EXECUTED_IN_S246=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S246_13_OF_13_S245_WHOLE_SCHEDULER_EXCLUSION_PROVIDER_PREFLIGHT_CPU1_TIMER_IRQ_REQUEST_INSPECTED_NONCONSUMING_NOT_TAKEN_REMAINS_PENDING_SEVEN_SOURCE_UNITS_111_DIRECT_SCHEDULER_ACCESS_SITES_0_GUARDED_111_UNROUTED_AUDIT_DRIFT_OVERFLOW_FAIL_CLOSED_AWAITING_COVERAGE_COVERAGE_COMPLETE_STILL_PREFLIGHT_ONLY_NO_PROVIDER_AUTHORITY_NO_EXCLUSION_PROOF_NO_S244_ADMISSION_NO_S243_S236_INVOCATION_NO_SGI_NO_REQUEST_OBSERVED_NO_SAFE_RUNTIME_EXECUTION_CLAIM_AARCH64_NORMAL_SMP_COMPILED_WORKSPACE_1907_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_PHYSICAL_QEMU_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S406_TO_S456_S431_NO_RUNBOOK_EXECUTED_IN_S246_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s245_whole_scheduler_exclusion_provider_preflight -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo test --workspace --quiet -- --test-threads=1 --skip wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope --skip s97_runtime_and_layout_identities_are_unchanged --skip clean_bridge_literal_include_closure_is_manifest_complete --skip clean_image_make_recipe_inputs_are_exact_and_manifested --skip s99_and_s98_are_narrowly_historically_versioned --skip s97_s98_inputs_and_make_history_are_narrowly_versioned --skip historical_s90_and_s100_inputs_remain_exact",
    ],
    terminalSessions: [
      {
        id: "s246-g8l-s245-whole-scheduler-exclusion-provider-preflight",
        title: "G8l S246 S245 whole-scheduler provider preflight",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s245_whole_scheduler_exclusion_provider_preflight -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S246 focused 1 group / 13 passed; 0 failed",
          "source audit: 7 units / 111 direct SCHEDULER sites / guarded=0 / unrouted=111",
          "CPU1 preflight inspects but does not take S245 request; outcome with request=AwaitingCoverage",
          "provider authority=false / exclusion proof=false / S244 admission=false / S243-S236 invocation=false",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S246 terminal özeti exact scheduler-access coverage açığını doğrular; preflight provider authority/proof/admission değildir ve 0/111 kapsamla yalnız fail-closed AwaitingCoverage üretir.",
    limitations: [
      "S246 provider preflight'tır; provider authority, proof, lease veya S244 admission değildir.",
      "Audit edilen 111 doğrudan SCHEDULER erişiminin 0'ı ortak whole-scheduler guard kapsamındadır; 111 site unrouted kalır.",
      "Exact S245 request yalnız read-only view ile incelenir, alınmaz ve pending kalır.",
      "S244 admission, S243/S236 production girişi, SGI, S187 handoff, scheduler mutation, ERET/context-switch veya hardware execution gözlenmedi.",
      "QEMU RPi5 whole-scheduler provider yolunu doğrulamaz; fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S246 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S246=NO.",
    ],
  },