G8g RPi5 production handoff ve IRQ wiring kapısı yeşil

/// Consume exactly two CPU1-local PPI27 interrupts while ownership is active.
#[no_mangle]
#[inline(never)]
pub fn rpi5_g8g_try_handle_secondary_irq(
    ctx: &mut ExceptionContext,
    ack: u32,
    int_id: u32,
) -> bool {
    if !rpi5_g8g_secondary_irq_active() {
        return false;
    }
    let stage = STAGE.load(Ordering::Acquire);
    if stage != STAGE_ARMED && stage != STAGE_IRQ1 {
        return consume_irq_error(ctx, ack, int_id, ERR_THIRD_IRQ, STAGE_IRQ2, stage);
    }
    if int_id != TIMER_PPI {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_IRQ_ID,
            TIMER_PPI as u64,
            int_id as u64,
        );
    }
    if ack != TIMER_PPI {
        return consume_irq_error(ctx, ack, int_id, ERR_ACK_RAW, TIMER_PPI as u64, ack as u64);
    }
    if ctx.spsr_el1 & SPSR_IRQ_MASK != 0 {
        return consume_irq_error(ctx, ack, int_id, ERR_FINAL_DAIF, 0, ctx.spsr_el1);
    }

    let expected_prior = if stage == STAGE_ARMED { 0 } else { 1 };
    if IRQ_DELIVERIES.load(Ordering::Acquire) != expected_prior
        || IRQ_ACKS.load(Ordering::Acquire) != expected_prior
        || IRQ_EOIS.load(Ordering::Acquire) != expected_prior
        || DEADLINE_ADVANCES.load(Ordering::Acquire) != expected_prior
    {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_IRQ_COUNTS,
            expected_prior,
            IRQ_DELIVERIES.load(Ordering::Relaxed),
        );
    }

    let before = match timer::rpi5_g8g_periodic_snapshot(SLOT_CPU1) {
        Ok(snapshot) => snapshot,
        Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_SNAPSHOT, 1, 0),
    };
    let fired_count = timer::read_count();
    let after = match timer::rpi5_g8g_advance_local_periodic(SLOT_CPU1) {
        Ok(snapshot) => snapshot,
        Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_ADVANCE, 1, 0),
    };
    let expected_next = match before.next_cval.checked_add(before.period) {
        Some(value) => value,
        None => {
            return consume_irq_error(
                ctx,
                ack,
                int_id,
                ERR_TIMER_ARITHMETIC,
                before.next_cval,
                before.period,
            )
        }
    };
    let expected_tick = match before.ticks.checked_add(1) {
        Some(value) => value,
        None => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_ARITHMETIC, before.ticks, 1),
    };
    if after.next_cval != expected_next
        || after.ticks != expected_tick
        || fired_count < before.next_cval
        || fired_count >= after.next_cval
    {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_TIMER_ARITHMETIC,
            expected_next,
            after.next_cval,
        );
    }
    let drift = fired_count - before.next_cval;
    let delivery = expected_prior + 1;
    let final_ctl = if delivery == EXPECTED_CPU1_DELIVERIES {
        match timer::rpi5_g8g_disable_local_timer(SLOT_CPU1) {
            Ok(control) => control,
            Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_DISABLE, 0b10, 0),
        }
    } else {
        0
    };

    gic::end_of_interrupt(ack);
    completion_barrier();
    IRQ_DELIVERIES.store(delivery, Ordering::Relaxed);
    IRQ_ACKS.store(delivery, Ordering::Relaxed);
    IRQ_EOIS.store(delivery, Ordering::Relaxed);
    DEADLINE_ADVANCES.store(delivery, Ordering::Relaxed);
    if delivery == 1 {
        IRQ1_ACK_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ1_EOI_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ1_PREV_CVAL.store(before.next_cval, Ordering::Relaxed);
        IRQ1_NEXT_CVAL.store(after.next_cval, Ordering::Relaxed);
        IRQ1_FIRED_COUNT.store(fired_count, Ordering::Relaxed);
        IRQ1_DRIFT_COUNTS.store(drift, Ordering::Relaxed);
        IRQ1_LOCAL_TICK.store(after.ticks, Ordering::Relaxed);
        ctx.spsr_el1 &= !SPSR_IRQ_MASK;
    } else {
        IRQ2_ACK_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ2_EOI_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ2_PREV_CVAL.store(before.next_cval, Ordering::Relaxed);
        IRQ2_NEXT_CVAL.store(after.next_cval, Ordering::Relaxed);
        IRQ2_FIRED_COUNT.store(fired_count, Ordering::Relaxed);
        IRQ2_DRIFT_COUNTS.store(drift, Ordering::Relaxed);
        IRQ2_LOCAL_TICK.store(after.ticks, Ordering::Relaxed);
        FINAL_TIMER_CTL.store(final_ctl, Ordering::Relaxed);
        ctx.spsr_el1 |= SPSR_IRQ_MASK;
    }
    let next_stage = if delivery == 1 {
        STAGE_IRQ1
    } else {
        STAGE_IRQ2
    };
    if STAGE
        .compare_exchange(stage, next_stage, Ordering::Release, Ordering::Acquire)
        .is_err()
    {
        ctx.spsr_el1 |= SPSR_IRQ_MASK;
        publish_secondary_error(ERR_STAGE, stage, STAGE.load(Ordering::Relaxed));
    } else {
        notify_peer();
    }
    true
}

#[test]
fn dispatcher_delegates_inactive_and_owned_fail_closed_policy_to_runtime() {
    let active = function_body(G8G, "pub extern \"C\" fn rpi5_g8g_secondary_irq_active");
    assert!(active.contains("read_mpidr() == TARGET_MPIDR"));
    assert!(active.contains("IRQ_HANDLER_ACTIVE.load(Ordering::Acquire)"));

    let handler = function_body(G8G, "pub fn rpi5_g8g_try_handle_secondary_irq");
    assert_order(
        handler,
        &[
            "if !rpi5_g8g_secondary_irq_active()",
            "return false;",
            "let stage = STAGE.load(Ordering::Acquire);",
        ],
    );
    assert!(handler.contains("return consume_irq_error("));
    assert!(handler.trim_end().ends_with("true\n}"));

    let consume = function_body(G8G, "fn consume_irq_error");
    assert!(consume.trim_end().ends_with("true\n}"));
    for token in [
        "ctx.spsr_el1 |= SPSR_IRQ_MASK",
        "crate::arch::aarch64::disable_irqs();",
        "gic::end_of_interrupt(ack);",
        "publish_secondary_error(code, expected, actual);",
    ] {
        assert!(
            consume.contains(token),
            "missing fail-closed action {token}"
        );
    }
}

  {
    id: "rpi5-g8g-production-wiring-green",
    date: "2026-08-22",
    sequence: 85,
    status: "verified",
    title: "G8g RPi5 production handoff ve IRQ wiring kapısı yeşil",
    summary:
      "Sıra 84 bounded runtime'ından sonra G8g yalnız RPi5 production akışına fail-closed bağlandı. `g8g_contract`/`rpi5_g8g` modülleri board-rpi5-only ve exact-once; CPU1 G8f terminal parkı release predicate'ini WFE'den önce poll edip true olduğunda secondary-run no-return continuation'ına giriyor, CPU0 final BOOT8F UART marker'ından sonra aynı IrqGuard içinde primary-run no-return continuation'ına geçiyor. IRQ dispatcher sahipliği G8g→G8e→G8d→G8b→generic timer/TICKS sırasındadır; inactive G8g false ile delege ederken active bütün uyuşmazlıkları fail-closed tüketir. Test-first tur 2 PASS + 4 expected RED, final integration 6/6; aggregate 47/47 + CLI + actual RPi5 build + historical G8f layout, full simulation 222/222, G8b/G8d/G8e/G8f layout regresyonları ve bağımsız reviewer GO'dur. RPi5 ELF 7.690.768 B / db66471a…c8845f6. Bu wiring kabulüdür: Sıra 86 G8g function-bounded machine-code/layout, image/package, microSD, UART ve fiziksel BOOT8G hâlâ STOP'tur.",
    evidence: [
      "Değişmeyen fiziksel prerequisite Sıra 80 BOOT8F raw'ıdır: 17.363 B, mode 0444, e70e1a9a2cf35f9079ee1b1a73d992106bf5ee9a19f1bbf2628582e836ea5068, direct validator PASS ve SCOPE=QUIESCENT_ATOMIC_HANDOFF_ONLY.",
      "İlk integration source turu mevcut sınır için 2 PASS + 4 expected RED verdi; dört RED production wiring yüzeyini istiyordu. Final `rpi5_g8g_integration_source` exact 6.880 B / c2537c7a8a90448f53cf681cdc7f694257cacda50793d0672ace17b23280149f ve 6/6 PASS'tir.",
      "RPi5-only exact-once module reachability taşıyan main exact 98.001 B / 6190d7b22bb5c46779e1ea5760d550c2a640de28572b6f751a14ee74c61942f0.",
      "CPU1 poll→true/no-return run→false/WFE döngüsü ile CPU0 BOOT8F-UART→primary-run tail seam'ini taşıyan G8f exact 23.552 B / 052829aaba61e86e6d4f941dff18df2466750c4b4876f5478dee6a7120f45e97.",
      "Bounded G8g runtime exact 37.958 B / 7f09aa1cf4df43c65ca80db7a97bff21a73e3e8a480fef4524bb44d058dc7545; Sıra 84 davranışı değişmedi, yalnız dormant olmayan production provenance yorumları güncellendi.",
      "G8g interceptor'ını G8e→G8d→G8b→generic timer/TICKS önüne alan exceptions source exact 38.579 B / 817b872615593660761bf3d8965fc726b339c020da6692820d685655ad4140f9.",
      "Per-CPU timer API production-caller sınırını taşıyan timer source exact 18.169 B / 35edb3758192aa23877962b92b6ab81e858a2523726d174069d6c17e231855d2.",
      "G8g source regression exact 22.242 B / efa713406257db874bb714b953f817e3341200675e8f771368d0d1b08541905f ve 7/7; runtime-source regression exact 18.621 B / 1a25f3848a39033cb1aa83c6471dcdaa72d7ea5dbf9b9f183196a3edf3a67337 ve 13/13 PASS'tir.",
      "Yeni `make verify-rpi5-g8g-integration` hedefini taşıyan Makefile exact 16.453 B / 25ef8219bf71ab24e93ec740f50fb6b685a08719b247cbb6b62c29bd77307753.",
      "Integration hedefi contract 27/27 + runtime source/compile 13/13+1/1 + integration 6/6 = 47/47, canonical CLI, actual AArch64/RPi5 kernel build ve historical G8f layout PASS verir.",
      "G8f layout script exact 29.793 B / cca66fb827c2b77d3308b51d91de9d0c5eb13450cb29169f0639294b1d01f8aa; G8f final UART→G8g primary, CPU1 poll/WFE/run ve forbidden-call sınırlarını korur.",
      "Tam simulation matrisi 222/222; workspace check mevcut 232 warning ile PASS. Bağımsız G8f source 7/7 ve historical G8b/G8d/G8e/G8f source toplamı 36/36 PASS'tir.",
      "Mevcut G8b, G8d, G8e ve G8f production layout kapıları PASS; dar Sıra 85 seam disassembly'sinde indirect BLR/BR yoktur.",
      "Production RPi5 ELF exact 7.690.768 B / db66471a8aed397e97cd95a27905e5066f2cbf34b91c981ef8405d1a5c8845f6; bu build kanıtıdır, immutable flat image/package değildir.",
      "LLVM release-poll loop'unu peel ettiği için `rpi5_g8g_secondary_released` predicate'i ilk anlık poll ve WFE sonrası loop poll için iki static direct BL taşır. Primary-run, secondary-run ve interceptor exact birer direct BL'dir; Sıra 86 predicate'i CFG/sıra semantiğiyle doğrulamalıdır.",
      "Bağımsız reviewer verdict'i blocker olmadan GO'dur; kabul yalnız RPi5 production wiring içindir. G8g function-bounded machine-code/layout Sıra 86'ya aittir.",
      "Sıra 85 wiring proof exact 7.094 B / 853b5e3df4555a7bcebee40182b9c52dabf845ce32c3a2259a04013c51ab1233; updated staged proof exact 9.546 B / ed513426494cf87ab6e65b4cfd398c6221061a666e8a5b2e6c8269dd55ee5961.",
      "Güncellenmiş Sıra 86–93 roadmap exact 26.951 B / f4070ee2991421fc69a5b80d16caba7b441429aa5bc6a935eebadf4cabfc4492; sıradaki tek yetkili işlem Sıra 86 machine-code + layout kapısıdır.",
    ],
    terminalSessionsNote:
      "Oturumlar production reachability, source/ELF entegrasyonu ve tarihsel layout regresyonunu gösterir. G8g'nin kendi function-bounded layout'u, image veya fiziksel BOOT8G kanıtı değildir.",
    terminalSessions: [
      {
        id: "g8g-sequence85-test-first-wiring",
        title: "RPi5-only module, CPU0/CPU1 continuation ve IRQ ownership TDD",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test rpi5_g8g_integration_source",
          "wire main, G8f CPU0/CPU1 continuations and G8g-first IRQ interception",
          "rerun rpi5_g8g_integration_source",
        ],
        outputLines: [
          "initial=2 PASS + 4 expected RED",
          "final integration source=6/6 PASS",
          "CPU1=poll→run→WFE · CPU0=BOOT8F UART→primary-run",
          "IRQ ownership=G8g→G8e→G8d→G8b→generic timer/TICKS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8g-sequence85-aggregate-build",
        title: "Aggregate host gate, actual RPi5 build ve full simulation",
        commandLines: [
          "make verify-rpi5-g8g-integration",
          "cargo test -p aselsan_microkernel_simulation",
          "cargo check --workspace",
        ],
        outputLines: [
          "contract27 + runtime14 + integration6=47/47 PASS · CLI=PASS",
          "actual AArch64/RPi5 kernel build=PASS · historical G8f layout=PASS",
          "simulation=222/222 PASS · workspace check=PASS (232 existing warnings)",
          "ELF=7690768 B · sha256=db66471a8aed397e97cd95a27905e5066f2cbf34b91c981ef8405d1a5c8845f6",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8g-sequence85-layout-review",
        title: "Historical layout regresyonu ve Sıra 86 CFG sınırı",
        commandLines: [
          "rerun G8b, G8d, G8e and G8f production layout gates",
          "inspect narrow G8g continuation/interceptor calls and indirect branches",
          "independent reviewer source/build/layout audit",
        ],
        outputLines: [
          "G8b/G8d/G8e/G8f layout=PASS · narrow BLR/BR=0",
          "primary-run/secondary-run/interceptor direct BL=1/1/1",
          "release predicate direct BL=2 · LLVM peeled first+loop polls",
          "reviewer=GO FOR WIRING · G8g own layout/image/physical=STOP",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    limitations: [
      "Bu kayıt yalnız RPi5 production module/seam/interceptor wiring, build ve tarihsel layout regresyon kanıtıdır; G8g function-bounded machine-code/layout veya fiziksel BOOT8G PASS değildir.",
      "Release predicate için iki static direct BL compiler'ın ilk poll + WFE sonrası loop poll CFG'sidir. Sıra 86 bunu kör exact-one call-count yerine CFG/sıra semantiğiyle kanıtlamalıdır.",
      "Yeni ELF flat payload/image/package olarak dondurulmadı; reproducibility, DTB/config/manifest freeze ve artifact promotion yapılmadı.",
      "microSD, UART, Debug Probe ve Pi güç durumuna dokunulmadı. Son fiziksel PASS Sıra 80 BOOT8F'tir.",
      "Generic SMP, CPU1 preemption, runqueue, migration, TLBI, CPU2/CPU3, soak ve hotplug kapalıdır.",
      "Production deployment dirty/untracked workspace ve stale 47d22c9 source etiketiyle yapılır; canlı artifact doğrulansa da Git-provider provenance kurulmuş sayılmaz.",
    ],
  },