S353 · Raw-user-ELF spawn production writer guard integration

/// M8 — ELF binary'ler için düşük seviyeli user task oluşturucu.
/// Doğrudan ELF entry point + stack ile user task oluşturur ve eret için hazırlar.
/// user_first_kernel_entry üzerinden saved_user_elr / user_sp kullanarak direkt ELF'ye eret yapar.
///
/// # Safety
/// `address_space` must be a fresh, uninstalled result from
/// `create_address_space_for_elf`. Ownership transfers to the task only after
/// its scheduler skeleton is located. The PMM-backed user stack is borrowed
/// as mapped address metadata; it is never treated as a heap allocation here.
pub unsafe fn spawn_raw_user_elf_task(
    name: &str,
    entry_point: u64,
    user_stack_top: u64,
    user_stack_pages: usize,
    priority: u8,
    time_slice: u32,
    initial_user_arg0: u64,
    address_space: crate::mm::AddressSpace,
) -> Result<u64, &'static str> {
    if user_stack_pages < 2 || user_stack_top & 0xfff != 0 {
        return Err("raw EL0 stack requires aligned guard + usable pages");
    }
    if !address_space.is_owned() {
        return Err("raw EL0 task requires an owned root and non-zero ASID");
    }
    let total_stack_size = user_stack_pages
        .checked_mul(0x1000)
        .ok_or("raw EL0 stack size overflow")?;
    let usable_stack_size = total_stack_size - 0x1000;
    let user_stack_bottom = user_stack_top
        .checked_sub(usable_stack_size as u64)
        .ok_or("raw EL0 stack address underflow")?;
    let stack_guard_page = user_stack_top
        .checked_sub(total_stack_size as u64)
        .ok_or("raw EL0 guard address underflow")?;
    let page_table_root = address_space.root_phys();
    let asid = address_space.asid();

    crate::kprintln!(
        "[M8] spawn_raw_user_elf_task: '{}' entry=0x{:x} sp=0x{:x} root=0x{:x} asid={}",
        name,
        entry_point,
        user_stack_top,
        page_table_root.as_u64(),
        asid
    );

    let s353_irq_guard = crate::arch::aarch64::IrqGuard::new();

    // Build remains entirely off-queue until the ELF root, ASID, entry, stack
    // and first-return context are installed in the same owned Task value. A
    // guarded scalar snapshot is enough for initial vruntime; no mutable
    // scheduler alias exists during this fallible private construction.
    let initial_vruntime = Scheduler::min_vruntime().saturating_sub(20);
    let mut task = Scheduler::build_unpublished_kernel_task(
        name,
        user_elf_placeholder_kernel_entry,
        32 * 1024,
        priority,
        time_slice,
        initial_vruntime,
    )?;

    let (owned_page_tables, owned_asid, owned_frames, runtime_user_frames) =
        address_space.try_into_task_parts()?;
    let owned_root = owned_page_tables.root_phys();
    debug_assert_eq!(owned_root, page_table_root);
    debug_assert_eq!(owned_asid, asid);

    task.is_user = true;
    task.saved_user_elr = entry_point;
    task.user_sp = user_stack_top;
    task.saved_user_spsr = 0; // EL0t
    task.saved_user_gprs = [0u64; 31];
    task.saved_user_gprs[0] = initial_user_arg0;
    task.page_table_root = owned_root;
    task.asid = owned_asid;
    task.address_space_quiesced = false;
    task.owns_page_table_root = false;
    task.owned_user_page_tables = Some(owned_page_tables);
    task.owned_user_frames = owned_frames;
    task.runtime_user_frames = runtime_user_frames;
    debug_assert!(task.user_stack_allocation.is_none());
    task.user_stack_bottom = user_stack_bottom as usize as *mut u8;
    task.user_stack_size = usable_stack_size;
    task.stack_guard_page = Some(stack_guard_page as usize as *mut u8);
    let kernel_stack_top = task
        .kernel_stack_allocation
        .as_ref()
        .ok_or("raw ELF task lost its kernel stack")?
        .top();
    task.context = TaskContext::new_for_user_first_entry(kernel_stack_top);
    let task_id = task.id;

    // The only publication point. Everything above is private local state and
    // all fallible preparation has finished before the exclusive lease.
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s353_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s353_raw_user_elf_spawn_writer_guard_integration::acquire_s353_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S353 raw-user-ELF spawn writer guard failed closed: {:?}",
                error
            )
        });
    let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);
    sched.ready_queue.push(PriorityTask::new(task));
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s353_writer_access);
    drop(s353_irq_guard);

    crate::kprintln!(
        "[M8] ELF task patched → id={} elr=0x{:x} sp=0x{:x}",
        task_id,
        entry_point,
        user_stack_top
    );

    crate::kprintln!(
        "[M8] ELF-style user task hazır → '{}'. Entry 0x{:x} ile user_first_kernel_entry üzerinden eret yapılacak.",
        name, entry_point
    );

    Ok(task_id)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s353_production_scheduler_writer_access(
) -> Result<G8lS353ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS353ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn raw_spawn_boundary_has_exactly_one_s353_acquire() {
    assert_eq!(
        raw_spawn_boundary()
            .matches("acquire_s353_production_scheduler_writer_access")
            .count(),
        1
    );
}

  {
    id: "g8l-s353-raw-user-elf-spawn-writer-guard-integration-partial",
    date: "2026-08-28",
    sequence: 353,
    status: "passed",
    umbrella_status: "partial",
    title: "S353 · Raw-user-ELF spawn production writer guard integration",
    summary:
      "S353, spawn_raw_user_elf_task içindeki exact tek ready-queue publication mutation'ını S352 ve 44 production reader'ın kullandığı aynı statik S247 state word'e bağlar. Stack/address-space doğrulaması, checked boyut/adres hesabı, S255 min_vruntime owned scalar snapshot'ı, allocation ve unpublished Task kurulumu, AddressSpace ownership transferi, bütün EL0 alanları ile kernel first-entry context hazırlığı writer alınmadan tamamlanır. Yalnız ardından gerçek CPU0 kimliğiyle exclusive S353 writer alınır, exact tek mutable SCHEDULER aliası kurulur ve ready_queue.push bir kez yapılır. Writer, ardından IRQ guard diagnostics ve Ok dönüşünden önce explicit bırakılır. Guarded writer 26/69, açık writer 43, provider authority 0 ve whole-scheduler exclusion false'dur. elf.rs içinde exact bir direct source callsite vardır; RPi5-only wrapper supported-profile runtime observation=0'dır. General user-task spawn sınırı S354 için ayrı açık kalır.",
    evidence: [
      "Focused S353 raw-user-ELF spawn writer-integration kapısının ilk koşusu 38/40 oldu. İki RED ürün kodundan değil, kaynak-sözleşme testinin mevcut `ok_or` metinleri ve satıra bölünmüş S354 doc cümlesi yerine fazla literal eşleşme istemesinden çıktı. Testler gerçek `)?` fallible token sınırını ve iki zorunlu S354 cümle parçasını doğrulayacak biçimde düzeltildi; ürün veya coverage assertion'ı zayıflatılmadı. Taze koşu 40/40 PASS verdi.",
      "Seçili tarihsel regresyon 7 grup / 108/108 PASS'tir: S353 40/40, S352 39/39, S255 vruntime reader 11/11, elf_loader_source 7/7, task_lifecycle_source 5/5, task_publication_source 2/2 ve task_spawn_asid_source 4/4.",
      "Production kaynak sırası stack pages/alignment → owned AddressSpace → checked stack size/bottom/guard → root+ASID snapshot → S353 IrqGuard → S255 min_vruntime owned scalar → unpublished Task build → AddressSpace ownership transfer → EL0/root/ASID/frame/context alanlarının tamamlanması → CPU0-only S353 writer → exact tek mutable scheduler aliası → exact tek ready_queue.push → writer drop → IRQ drop → diagnostics → Ok olarak kaynak-kilitlidir.",
      "Scheduler::build_unpublished_kernel_task artık scheduler referansı istemeyen associated builder'dır ve initial_vruntime owned u64 değerini parametre olarak alır. ID allocation, kernel root/stack, complete Ready Task skeleton ve kernel context bu private değer üzerinde tamamlanır; hiçbir placeholder task scheduler container'ına erken yayınlanmaz.",
      "Raw ELF task için is_user, entry ELR, user SP, SPSR, 31 GPR ve x0 arg0, owned root, nonzero ASID, page-table forest, user frame ownership, RuntimePmm frame ledger, stack bottom/size/guard, address_space_quiesced=false ve first-entry TaskContext writer acquisition'dan önce kuruludur.",
      "Writer scope'unda fallible `?;` veya `)?` yolu, early Err, allocation, AddressSpace transferi, page-table/ASID kurulumu, diagnostics ya da context switch yoktur. Exact bir S353 acquire, bir addr_of_mut!(SCHEDULER), bir ready_queue.push ve bir explicit writer drop vardır.",
      "Aynı S247 state word üzerinde CPU0-only membership, non-CPU0 callback-öncesi rejection, reader→writer, writer→reader ve writer→writer exclusion, callback-error sonrası exact release ve S352→S353 token monotonluğu doğrulandı.",
      "S353 preflight önce S352'nin 44 guarded reader / 25 guarded writer / 44 open envanterini exact doğrular; yalnız sonra 26/69 guarded writer ve 43 open sonucu üretir. Inventory drift fail-closed reddedilir. S245 request yalnız non-consuming pending view ile incelenir; take edilmez, S244 admission veya provider authority üretilmez.",
      "kernel/src/elf.rs içinde crate::task::spawn_raw_user_elf_task için exact bir direct source callsite vardır ve prepared.into_address_space() ownership handoff'u çağrıdan önce gelir. Production S353 wrapper exact AArch64 none + board-rpi5 cfg altındadır; source wiring supported-profile invocation, runtime telemetry veya fiziksel kabul değildir ve runtime observations=0'dır.",
      "Fresh izole AArch64 profilleri 4/4 exit 0 verdi. Build logları: board-qemu 111987 B / 5dbb072cd5694d0e638848c106e2b81f94bf8774cb2e68a1f3e930d308d4b676 / 293 warning header; board-rpi4 150623 B / 12934d921b71118636c64742bab917a519d51074969f6e9a30b41aa9eac9a0f9 / 391; board-rpi5 564228 B / 38d6d43d540df1bdafce7a2dae03e1e9712c20d9547634698b742ce141c0356a / 1266; board-rpi5+smp 564274 B / 3f6cbaf3c385b7250e52b120e032a0c4e2e91d83bd3792dfd5318f993a5aa155 / 1266. Zero-warning iddiası yoktur.",
      "Build log ölçüsü ELF ölçüsü gibi sunulmaz. Fresh ELF artifact'leri ayrıca board-qemu 17319112 B / c3532a69787220df285fa264d6d4df839188c232c97083a1b90597fdb0d04f64; board-rpi4 12315800 B / f857c26d74e9cf06bfce111c5b268f2e3fad4ec7de164cfaff3c15952b7e1156; board-rpi5 17643256 B / 24352faf408ab00200b8b0c6f9a37f3ec4403b7dfbf05f932982b02bafbaf4e6 ve board-rpi5+smp 17654208 B / 24b7091a343b9518d3f7e6ba7bd0626f48ce57b01eb000e83c6c9f4eb6e4b500 olarak ölçüldü.",
      "S238–S353 dependency matrisi S352'nin exact 116 hedeflik listesine yalnız S353 eklenerek iki bağımsız seri koşuda 117 grup / 2058/2058 PASS verdi. Ham özetler 27326 B ve b78fb1f0b1bed1edfd6c9134799b613e970a464f61b24c9644524d6708801a57 / bc8351607eedafc0695713376504351c0c5266b4667834e1ad66393c1a3d6c02; süre alanları nedeniyle 26 diff satırı vardır. 27443 B normalize özetler 05be28d92b00732b5d69c0c41859c7f6d3f69dd4185a2ff67481322a2373c222 ile byte-eşittir.",
      "Exact yedi tarihsel frozen assertion dışındaki seri workspace 315 sonuç grubu / 3899 PASS / 0 fail / 7 filtered verdi; 68862 B log SHA-256 3b7a247cf0b375455b03978c94ee198f0ab9c7a4e377a1b78c409704da9b77d5'tir.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope source-identity reddinde durdu; 268 sonuç grubunda 3644 PASS / 1 fail, 64084 B log SHA-256 d2c8a0436f4548d1ac06f3750b62c6d5078c56b071f5492c185c02ec97668f5d'dir ve global workspace GREEN iddia edilmez.",
      "make verify-qemu 116354 B / 87db2722bebe040570b4fd9e7e2514c95c316a0d7e0af2f9820f7711e69c7097 ile strict ELF W^X 31/31, S130–S154 Runtime-OOM/deadline zinciri, IPC reply 20/20, scheduler SEC5 ve kernel fault/panic marker 0 PASS verdi. RPi5-only S353 writer bu board-qemu koşusunda runtime-observed değildir.",
      "Yeni S353 kernel modülü ve focused test dosyası ayrı rustfmt --check altında PASS'tir. Global cargo fmt, S353 öncesinden taşınan S345+ ve manifest farklarında RED'dir; global format GREEN iddia edilmez ve tarihsel dosyalar bu kapıda topluca yeniden yazılmaz.",
      "S353 web kaynak kabulü 560/560 test, lint, boş çıktılı TypeScript ve 23/23 static route build PASS verdi. Export 194 dosya üretti; Timeline ve yol-haritasi S353 dahil 192 ayrı data-gate-policy kartı taşır. S353 promotion policy 9101 karakterdir ve 1573 karakterlik S324 yoğunluk tabanını aşar.",
      "İlk Cloudflare Pages production/main yayını ef5a5083-382c-4aff-a580-d22f9c3c86f1 kimliğiyle 110 upload + 84 existing = 194 dosya olarak tamamlandı. İlk cache-busted örneklemede yol-haritasi byte-exact iken Operations ve Timeline eski edge boyutu döndürdü; bu örnek PASS sayılmadı. Yeni cache anahtarlı tekrar Operations HTTP 200 / 11062450 B / ab0b732795ac10d09c5b13c9e213da778bc2f189de55e6d93151e791fe66155b, Timeline HTTP 200 / 3198371 B / d66dfaf5b42ca5411ba11cf6be6186b458a0c88af3a4a0f70c0364a838ebb542 ve yol-haritasi HTTP 200 / 3198119 B / 8cabc1a6ffe1235334b446f3ac989fd800386731251c49c71e8b551c407ce9e6 ile ilgili yerel out artefaktlarına byte-exact PASS verdi. Immutable ef5a5083 hostname probe'u 10 saniyede curl exit 28 / HTTP 000 verdi; custom-domain PASS bu erişim sınırını gizlemez.",
      "S353 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S353=NO.",
      "S353 bazlı bağlayıcı olmayan planlama görünümü R1 S353–S383, R2 S408–S458, R3 S537+, kaba S513–S563 ve risk paylı merkez ≈S538'dir. Bu projeksiyon yeni sıra veya ürün taahhüdü oluşturmaz.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s353_raw_user_elf_spawn_writer_guard_integration -- --test-threads=1",
      "cargo build -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo build -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
      "npm test && npm run lint && npx tsc --noEmit && npm run build && npm run deploy",
    ],
    terminalSessions: [
      {
        id: "g8l-s353-focused-raw-user-elf-spawn-writer-guard",
        title: "S353 focused raw-user-ELF spawn writer membership",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s353_raw_user_elf_spawn_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S353 focused 1 group / 40 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 26/69 guarded writers; 43 writers open",
          "validation/S255 snapshot/private Task build/ownership handoff < S353 writer < one mutable alias < one ready_queue.push < writer/IRQ release",
          "production source callsites=1; RPi5 runtime observations=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s353-production-publication",
        title: "S353 website acceptance and production publication",
        commandLines: [
          "npm test",
          "npm run lint",
          "npx tsc --noEmit",
          "npm run build",
          "npx wrangler pages deploy out --project-name=aselsan-microkernel --branch=main --commit-dirty=true",
          "curl --max-time 30 https://aselsan.kerege.net/{operations,timeline,yol-haritasi}/?s353-initial-retry=20260828-ef5a5083-b",
        ],
        outputLines: [
          "website 560/560 PASS; lint PASS; TypeScript PASS; static routes 23/23 PASS",
          "export files=194; data-gate-policy cards=192; S353 policy chars=9101",
          "deployment ef5a5083-382c-4aff-a580-d22f9c3c86f1; uploaded=110; existing=84",
          "custom-domain retry: Operations/Timeline/yol-haritasi HTTP 200 and byte-exact=true",
          "immutable ef5a5083 hostname: curl exit 28; HTTP 000",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S353 yirmi altıncı production writer'ın dar kaynak entegrasyonudur. Yalnız tamamen hazırlanmış raw-user-ELF Task değerinin tek ready-queue publication sınırı guarded'dır; private fallible preparation writer dışında kalır ve S354 general user spawn bu kapıda tamamlanmış sayılmaz.",
    limitations: [
      "43 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "elf.rs içindeki bir direct source callsite wiring kanıtıdır; RPi5-only S353 wrapper için supported-profile invocation/observation kanıtı yoktur.",
      "spawn_user_task_with_arg general user-task publication writer sınırı sıradaki ayrı S354 kapısıdır.",
      "Default-parallel PTY determinism, transient-contention liveness/soak, Generic SMP ve fiziksel RPi kabulü açık kalır.",
    ],
  },