G8l: context-switch old-ASID read-access guard genişletmesi

/// M8.2 (18-agent audit fix) — TTBR0 switch policy.
///
/// KRİTİK: KERNEL_ROOT sabiti (0x4020_0000) `ROOT_PAGE_TABLE` statik
/// adresini garanti etmez (linker layout'a bağlı). Bu yüzden hardcoded
/// adrese write_ttbr0_to çağrısı kernel'in kendi mapping'lerini
/// kaybetmesine → silent hung'a neden oluyordu.
///
/// Yeni politika:
///   - is_user=false → TTBR0'a HİÇ dokunma (kernel zaten kendi root'unu
///     yüklü tutuyor; switch yapmaya gerek yok).
///   - is_user=true → write_ttbr0_to(task.page_table_root, task.asid)
///     ve eski user ASID'i invalidate et.
#[inline]
pub unsafe fn maybe_switch_to_task_address_space(task: &Task) {
    if !task.is_user {
        // Kernel task'leri her zaman kernel TTBR0'unu kullanır — switch ETME.
        return;
    }

    #[cfg(feature = "board-rpi5")]
    let s265_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s264_context_switch_old_asid_read_access_guard_expansion::acquire_s265_production_scheduler_read_access()
        .unwrap_or_else(|error| {
            panic!(
                "S265 context-switch old-ASID scheduler read access failed closed: {:?}",
                error
            )
        });
    let old_asid = (&*core::ptr::addr_of!(SCHEDULER))
        .current_task
        .as_ref()
        .map_or(0, |t| t.asid);
    #[cfg(feature = "board-rpi5")]
    drop(s265_scheduler_read_access);

    if old_asid != 0 && old_asid != task.asid {
        crate::arch::aarch64::mmu::invalidate_asid(old_asid);
    }
    crate::arch::aarch64::mmu::write_ttbr0_to(task.page_table_root, task.asid);
    // SP_EL0 is banked architectural state, not part of TaskContext. A task
    // resuming through the assembly exception epilogue therefore needs its
    // saved user stack installed at every scheduler transition.
    core::arch::asm!(
        "msr sp_el0, {user_sp}",
        user_sp = in(reg) task.user_sp,
        options(nomem, nostack, preserves_flags)
    );
    crate::kprintln!(
        "[M8.2] TTBR0 switched → '{}' (root=0x{:x}, asid={}) [old_asid={}]",
        task.name,
        task.page_table_root.as_u64(),
        task.asid,
        old_asid
    );
}

#[test]
fn s265_old_asid_snapshot_is_owned_and_guard_drops_before_mmu_side_effects() {
    let scheduler = include_str!("../../kernel/src/task/scheduler.rs");
    let path = function_slice(
        scheduler,
        "pub unsafe fn maybe_switch_to_task_address_space(",
        "pub unsafe fn switch_to_kernel_address_space()",
    );
    let guard = path
        .find("let s265_scheduler_read_access")
        .expect("S265 reader guard");
    let read = path.find("addr_of!(SCHEDULER)").expect("old-ASID read");
    let drop_guard = path
        .find("drop(s265_scheduler_read_access)")
        .expect("S265 reader drop");
    let invalidate = path
        .find("invalidate_asid(old_asid)")
        .expect("old-ASID invalidation");
    let ttbr0 = path
        .find("write_ttbr0_to(task.page_table_root, task.asid)")
        .expect("TTBR0 switch");
    assert!(guard < read && read < drop_guard && drop_guard < invalidate && drop_guard < ttbr0);
    assert_eq!(path.matches("addr_of!(SCHEDULER)").count(), 1);
    assert!(!path.contains("addr_of_mut!("));
    assert!(!path.contains("&'static"));
}

  {
    id: "g8l-s265-context-switch-old-asid-read-access-guard-expansion-partial",
    date: "2026-08-26",
    sequence: 265,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: context-switch old-ASID read-access guard genişletmesi",
    summary:
      "S265 12/12 PASS ile maybe_switch_to_task_address_space içindeki tek immutable old_asid scheduler okumasını mevcut production reader gate'ine aldı. old_asid scalar snapshot olarak reader altında kopyalanıyor; reader MMU invalidation, TTBR0 kurulumu ve diğer context-switch yan etkilerinden önce düşüyor. Coverage 36/111'den 37/111'e çıktı, 74 site unrouted kaldı. Writer'lar, exclusive wrapper ve whole-scheduler exclusion açık olduğundan umbrella PARTIAL kalır.",
    evidence: [
      "S265 focused kaynak kapısı iki byte-equal koşuda 12/12 PASS verdi: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "Exact source coverage: 7 audit unit / 111 direct SCHEDULER site; previous=36, additional=1, guarded=37, unrouted=74. Routed read yalnız maybe_switch_to_task_address_space içindeki old_asid snapshot'ıdır.",
      "old_asid reader altında scalar Copy olarak alınır; reader explicit drop ile invalidate_asid ve write_ttbr0_to öncesinde kapanır. Mutable scheduler alias'ı ve scheduler referans escape'i yoktur.",
      "S238–S265 exact dependency matrisi iki bağımsız koşuda 29 grup / 387/387 PASS verdi: raw 2754 B / SHA-256 9473bb625533af635eeee9191ab5fdaa52864dd0e2bc156728d19679759439f9; süre-normalize 2899 B / SHA-256 5990cb989d44938da75bd58450025e45c757169d0bc06bc2b7c077376809af92.",
      "Default/QEMU AArch64 check iki byte-equal koşuda PASS: 110646 B / 291 warning başlığı / SHA-256 c8c9d6ab3044d497d3ec207f203c5f5e53d2b3bb906f827f763b1989edb3e726. Zero-warning iddiası yoktur.",
      "RPi5 normal/SMP profilleri ikişer byte-equal PASS: normal 360361 B / 701 warning / SHA-256 4741eb01d39023a2a2f45ef3a2c4666e230849098f3e139dedf45ad3f675007d; SMP 360303 B / 701 warning / SHA-256 edeea7bc0d17563c82689741d151596986aaaee44fd5c6d38589e623a93acac6.",
      "make verify-qemu iki bağımsız koşuda PASS verdi: ilk 116084 B / SHA-256 1a63faa6464f6c069b8cd6cb744dc36612aaf191c655fefdc2e8a4a7051192cf, ikinci 116084 B / SHA-256 6cf281f402b4c0972fc1f7ea33cb57c3ced9ad261be1664be9a9f7baccdb8336. W^X 31/31, S130–S154, S154 1024 retirement, IPC 20/20, SEC5 ve kernel faults=0 korunur; QEMU board-rpi5-only reader route'unu çalıştırmaz.",
      "Manifest-aware workspace audit'inde exact 7 tarihsel G8h assertion filtrelenerek 227 grup / 2141 PASS, 0 fail ölçüldü; filtresiz koşu frozen S96 exceptions.S identity mismatch nedeniyle exit 101 kaldı. Beklentiler gevşetilmedi ve full-workspace GREEN iddia edilmez.",
      "S265 physical/device operations=0; RUNBOOK_EXECUTED_IN_S265=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S265_12_OF_12_OLD_ASID_SCALAR_SNAPSHOT_READER_DROPPED_BEFORE_MMIO_CONTEXT_SWITCH_EFFECTS_PREVIOUS_36_OF_111_TOTAL_37_OF_111_GUARDED_74_UNROUTED_NO_WRITER_COVERAGE_NO_PRODUCTION_EXCLUSIVE_WRAPPER_NO_WHOLE_SCHEDULER_EXCLUSION_NO_RPI5_RUNTIME_INVOCATION_WORKSPACE_2141_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_NO_RUNBOOK_EXECUTED_IN_S265_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s264_context_switch_old_asid_read_access_guard_expansion -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s265-g8l-context-switch-old-asid-read-access-guard-expansion",
        title:
          "G8l S265 context-switch old-ASID read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s264_context_switch_old_asid_read_access_guard_expansion -- --test-threads=1",
          "make verify-qemu",
        ],
        outputLines: [
          "test result: ok; S265 focused 1 group / 12 passed; 0 failed",
          "coverage: previous 36 + additional 1 = 37/111 guarded; 74 unrouted",
          "old_asid scalar snapshot copied under reader; reader dropped before invalidate_asid/write_ttbr0_to",
          "QEMU common regression PASS: W^X 31/31 · S130–S154 · S154 retired 1024 · IPC 20/20 · SEC5 · kernel faults 0",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S265 yalnız bir immutable scalar snapshot route'unu guard'lar; QEMU ortak regresyondur ve RPi5-only reader route'unun runtime invocation kanıtı değildir.",
    limitations: [
      "Toplam 37/111 scheduler erişimi guarded, 74 erişim unrouted kalır.",
      "Bütün scheduler writer yolları, production exclusive wrapper, provider authority ve whole-scheduler exclusion proof yoktur.",
      "QEMU ortak runtime regresyonudur; board-rpi5-only S265 reader route'unu çalıştırmaz.",
      "Exact yedi tarihsel G8h assertion filtresiz workspace'i kırmızı tutar; full-workspace GREEN iddia edilmez.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S265 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S265=NO.",
    ],
  },