K1/MEM0–MEM2/K2: gerçek lower-EL fault lifecycle recovery

//! ASELSAN Milli Telefon — gerçek aarch64 microkernel.
//!
//! M0   : bare-metal boot + PL011 UART
//! M1.1 : Exception Vector Table (VBAR_EL1) + trampolines
//! M1.2 : EC decode + BRK/SVC recover + panic on bad cases
//! M1.3 : GICv2 + ARM Virtual Timer (CNTV) using CVAL (low drift)
//! M1.4 : 100 Hz periodic tick + per-second drift measurement + irq_lock!

#![no_std]
#![no_main]
// The typed S401+ fail-closed error chain is intentionally deep.  Production
// AArch64 builds need enough query headroom to lay it out while compiling the
// post-S430 acceptance callsites.
#![recursion_limit = "256"]

extern crate alloc;

use core::panic::PanicInfo;

mod arch;
// Hands-free altyapısı (radyo değişkeni DEĞİL): PM watchdog + UART 'R'.
#[cfg(all(feature = "board-rpi5", feature = "rpi5-auto-reset"))]
mod auto_reset;
mod board; // M8.1 — Board/Platform abstraction (QEMU vs RPi4 vs future SoC)
mod driver; // M8.1.2 — Mailbox, UART driver'ları vs. (RPi4 için kritik)
mod dt; // M9.1 — Device Tree Blob parser (RPi5 + telefon SoC hazırlığı)
mod elf; // M8 — ELF64 Loader (başlangıç)
#[allow(dead_code)]
mod elf_plan; // K1 — allocation-free validator + production ELF page plan
#[cfg(feature = "board-rpi5")]
mod g7c_contract;
#[cfg(feature = "board-rpi5")]
mod g7d_contract;
#[cfg(feature = "board-rpi5")]
mod g8_contract;
#[cfg(feature = "board-rpi5")]
mod g8b_contract;
#[cfg(feature = "board-rpi5")]
mod g8c_contract;
#[cfg(feature = "board-rpi5")]
mod g8d_contract;
#[cfg(feature = "board-rpi5")]
mod g8e_contract;
#[cfg(feature = "board-rpi5")]
mod g8f_contract;
#[cfg(feature = "board-rpi5")]
mod g8g_contract;
#[cfg(feature = "board-rpi5")]
mod g8h_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_arch_execution_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_authority_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_irq_tlbi_wiring;
#[cfg(feature = "board-rpi5")]
mod g8l_runtime_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_scheduler_admission;
#[cfg(feature = "board-rpi5")]
mod g8l_target_aarch64_dispatch;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_admission;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_callsite;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_context_switch;

#[test]
fn s142_qemu_binds_the_faulting_task_and_retries_without_controller_recovery() {
    let main = source("kernel/src/main.rs");
    let run = function_window(
        &main,
        "unsafe fn run_qemu_s142_lower_el_fault_recovery(",
        20_000,
    );

    assert!(run.matches("begin_supervisor_session_for_task").count() >= 2);
    assert!(!run.contains("recover_supervisor_session("));
    assert!(!run.contains("recover_supervisor_task_exit("));
    assert!(run.contains("FAULT=EL0_DATA_ABORT_EC24"));
    assert!(run.contains("const S142_FAULT_VA: u64 = 0x0000_0000_6000_0000"));
    assert!(run.contains("FAULT_VA=0x{:016x}"));
    assert!(run.contains("RECOVERY_CALLER=FATAL_TASK_EXIT"));
    assert!(run.contains("CONTROLLER_RECOVERY_CALLS=0"));
    assert!(run.contains("OLD_LEASE_ACK=STALE"));
    assert!(run.contains("RETRY_ACK=EXACT"));
    assert!(run.contains("KERNEL_FAULTS=0"));
}

  {
    id: "k1-mem0-mem1-mem2-k2-lower-el-fault-lifecycle-recovery-partial",
    date: "2026-08-24",
    sequence: 142,
    status: "passed",
    umbrella_status: "partial",
    title: "K1/MEM0–MEM2/K2: gerçek lower-EL fault lifecycle recovery",
    summary:
      "S142, S141'in task-bound otomatik lifecycle recovery yolunu kontrollü SYS_EXIT yerine gerçek bir EL0 synchronous Data Abort ile çalıştırır. Strict RuntimePmm supervisor ordinary SYS_IPC_RECV ile production CALL'u aldıktan sonra eşlenmemiş 0x60000000 adresinden load yapar. Lower-EL vektörü EC=0x24/FAR'ı exact task'a bağlar; IPC teardown bound reply'ı iptal eder, caller InvalidCapability ile uyanır ve fatal task-exit hook'u in-flight broker lease'ini controller recovery çağrısı olmadan Pending'e döndürür. Eski lease StaleLease olur. Fresh task/session aynı immutable event'i ordinary SYS_IPC_REPLY ile exact ACK eder ve endpoint-close handoff sonrasında normal çıkar. Kernel-origin fault sayısı 0'dır; yalnız exact S142 kullanıcı fault'u kabul edilir. Broker ACK/session-close commit'i hâlâ controller-driven olduğundan K1/MEM0–MEM2/K2 PARTIAL kalır.",
    evidence: [
      "Implementation öncesi `runtime_oom_lower_el_fault_recovery` 1/7 RED verdi: yalnız S141'den var olan fatal lifecycle sırası geçti; fault attribution, iki strict image, QEMU ve smoke sözleşmeleri yoktu.",
      "İlk implementation kaynak koşusu 6/7 kaldı; test literal fault adresini dinamik `{:016x}` marker biçiminden ayırmadığı için PASS verilmedi. Sabit S142_FAULT_VA ve biçim sözleşmesi ayrı doğrulandı; final 7/7 PASS.",
      "Lower-EL handler yalnız canlı, scheduler-tracked EL0 task için EC=0x24/FAR_EL1 attribution marker'ı üretir. Same-EL kernel Data/Instruction Abort yolları panic ve smoke rejection olarak ayrı kalır.",
      "Faulting strict image gerçek SYS_IPC_RECV sonrasında `movz x25, #0x6000, lsl #16` + `ldr xzr, [x25]` çalıştırır; bu image'da SYS_EXIT yoktur. Replacement ordinary RECV/REPLY ve ikinci RECV endpoint-close handoff kullanır.",
      "İlk birleşik focused koşu, tarihsel kaynak testlerinin son bilinen W^X 17/17 toplamını araması nedeniyle fail-closed durdu. S133–S141 marker şartları gevşetilmeden yalnız birleşik strict/IPC toplamları 19/19 ve 18/18'e taşındı. S140'ın eski blanket FATAL metin testi de exact-one S142 user fatal + kernel-fault bans sözleşmesine daraltıldı.",
      "S129–S142 exact envanteri 31 binary / 168 testtir; 168/168 PASS. AArch64 board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp applicability 4/4 PASS.",
      "QEMU controller/faulting/replacement=32/48/49; domains=1330597184/1330597185, endpoint=42. EC=0x24, FAR_EL1=0x0000000060000000, fatal IPC cancelled responder replies=1 ve AUTOMATIC_RECOVERED_INFLIGHT=1; controller recovery calls=0.",
      "SESSION=3→4, RECOVERY_CALLER=FATAL_TASK_EXIT, PRE_ACK_FAULT=INVALID_CAPABILITY, OLD_LEASE_ACK=STALE, RETRY_ACK=EXACT, RESTARTED_EL0_ACK=YES, REPLACEMENT_HANDOFF=ENDPOINT_CLOSE, NORMAL_EXIT_RECOVERY=NONE ve BROKER_DRAINED=YES.",
      "İki strict supervisor quota'sı ayrı ayrı 5→0; free 6139→6134→6139→6134→6139, active 5→10→5→10→5, FAULT_RECLAIM/RESTART_RECLAIM=5/5, KERNEL_FAULTS=0, KERNEL_DIRECT_ACK=NO ve EXECUTOR=PASS.",
      "QEMU strict ELF W^X 19/19, IPC reply 18/18, final RuntimePmm 6144→6144 / active 0→0 ve scheduler SEC5 birlikte PASS.",
      "Tam workspace yalnız bağımsız frozen S96 exceptions.S SHA-256 uyuşmazlığında durdu: observed f7b47672…04fd, expected c0eed3e2…cb89; full GREEN iddia edilmedi.",
      "Fiziksel operatör runbook'u görünürdür: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → yetkili image/yazma ve read-back doğrulaması → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm/identity → Güç ver.",
      "Runbook S142'de uygulanmadı: physical/device operations=0, S124 archive/promotion STOP, son fiziksel boot/runtime PASS S92 BOOT8G ve son storage/media PASS S119.",
      "Güncel planlama tahmini S142 bazında R2 bitiş aralığı S326–382, risk-paylı merkez ≈S359'dur; taahhüt, yeni bir S143 işlemi veya fiziksel PASS değildir.",
      "Yerel web kapıları: içerik 238/238, ESLint, TypeScript --noEmit ve Next.js static export 23/23 route / 191 file PASS.",
      "İlk S142 production yayını 5844bf99.aselsan-microkernel.pages.dev kimliğiyle tamamlandı. Özel alan adı cache-bust ile yerel static çıktıya byte-exact doğrulandı: operations 4904047 B / 35d02f95…e08db, timeline 538231 B / 302bead7…9b6e, yol-haritasi 538324 B / a022f579…e59d. Üç route S142 runtime, açık fiziksel runbook, physical=0 ve S326–382 / ≈S359 marker'larını 20/20 taşıdı. Immutable deployment alt alanına current host'tan üç direct fetch connect timeout oldu ve buna dayanılarak PASS üretilmedi.",
      "Kalıcı kapsam: `docs/K1-S142-Lower-EL-Fault-Lifecycle-Recovery-Proof.md`.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test runtime_oom_lower_el_fault_recovery -- --test-threads=1",
      "cargo test -p aselsan_microkernel_simulation [31 exact focused test binary] -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none [board-qemu, board-rpi4, board-rpi5, board-rpi5+smp]",
      "make verify-qemu",
      "cargo test --workspace -- --test-threads=1",
      "python3 scripts/render-project-status.py --check",
      "cd website && npm test && npm run lint && npx tsc --noEmit && npm run build",
    ],
    terminalSessions: [
      {
        id: "s142-red-before-fault-runtime",
        title:
          "Gerçek lower-EL fault recovery kaynak kapısı: implementation öncesi RED",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test runtime_oom_lower_el_fault_recovery -- --test-threads=1",
        ],
        outputLines: [
          "runtime_oom_lower_el_fault_recovery: 1/7 before implementation",
          "missing: bounded fault attribution, strict fault/replacement images, S142 QEMU and smoke contract",
          "only the inherited fatal lifecycle ordering test passed",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s142-partial-source-marker-contract",
        title: "İlk implementation: fault adresi/marker testi fail-closed",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test runtime_oom_lower_el_fault_recovery -- --test-threads=1",
        ],
        outputLines: [
          "six source/image/smoke contracts passed",
          "one assertion incorrectly required a literal formatted address inside the Rust format string",
          "result: 6/7 · no partial PASS accepted",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s142-fail-closed-historical-smoke-inventory",
        title:
          "Birleşik focused matris: stale aggregate beklentiler reddedildi",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation [31 exact focused test binary] -- --test-threads=1",
        ],
        outputLines: [
          "first run rejected historical strict ELF W^X 17/17 expectation after S142 produced 19/19",
          "second run rejected S140's historical blanket FATAL-text assertion",
          "prior S133–S141 exact markers remained mandatory; only aggregate inventory and exact-one S142 exception policy changed",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s142-green-focused-aarch64-qemu",
        title: "Gerçek EC=0x24 containment, AArch64 ve QEMU",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation [31 exact focused test binary] -- --test-threads=1",
          "cargo check -p aselsan_kernel --target aarch64-unknown-none [4 profiles]",
          "make verify-qemu",
        ],
        outputLines: [
          "runtime_oom_lower_el_fault_recovery: 7/7 PASS",
          "combined exact focused inventory: 168/168 PASS · 31 binaries",
          "AArch64 compile profiles: 4/4 PASS",
          "[EL0-FAULT-CONTAINMENT] task#48 EC=0x24 FAR_EL1=0x0000000060000000 ACTION=TERMINATE_CURRENT_EL0_TASK",
          "[K1-MEM2-LIFECYCLE] supervisor task#48 AUTOMATIC_RECOVERED_INFLIGHT=1",
          "[K1-MEM2-S142] FAULT RECOVERY EL0 ACK=EXACT",
          "[K1-MEM2-S142] SESSION=3->4 FAULT=EL0_DATA_ABORT_EC24 RECOVERY_CALLER=FATAL_TASK_EXIT CONTROLLER_RECOVERY_CALLS=0 OLD_LEASE_ACK=STALE RETRY_ACK=EXACT KERNEL_FAULTS=0 free=6139->6134->6139->6134->6139 active=5->10->5->10->5 EXECUTOR=PASS",
          "QEMU smoke PASS: strict ELF W^X 19/19 · IPC reply 18/18 · S142 PASS",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s142-workspace-independent-history-red",
        title: "Tam workspace: S142 dışı frozen S96 identity kırmızısı",
        commandLines: ["cargo test --workspace -- --test-threads=1"],
        outputLines: [
          "rpi5_g8h_integration_source::wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope: FAILED",
          "S96 exceptions.S SHA-256: observed f7b47672...04fd, frozen expected c0eed3e2...cb89",
          "full-workspace GREEN is not claimed",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s142-local-web-gates",
        title:
          "İşlemler, Timeline, tahmin ve fiziksel runbook yerel web kapıları",
        commandLines: [
          "cd website && npm test",
          "cd website && npm run lint",
          "cd website && npx tsc --noEmit",
          "cd website && npm run build",
        ],
        outputLines: [
          "web content tests: 238/238 PASS",
          "ESLint: PASS · TypeScript --noEmit: PASS",
          "Next.js static export: 23/23 routes · 191 files PASS",
          "S142 runtime, PARTIAL/open broker bridge, S326–382 / ≈S359 forecast and exact physical operator verbs are mandatory",
          "physical/device operations=0 · S124 archive/promotion STOP",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s142-initial-production-publication",
        title: "İlk S142 production yayını ve özel alan adı exact doğrulaması",
        commandLines: [
          "cd website && npx wrangler pages deploy out --project-name=aselsan-microkernel --branch=main --commit-dirty=true",
          "curl --fail --location 'https://aselsan.kerege.net/{operations,timeline,yol-haritasi}/?s142=5844bf99-<nonce>'",
          "cmp website/out/<route>/index.html <cache-busted-live-route>",
          "curl --connect-timeout 10 --max-time 20 'https://5844bf99.aselsan-microkernel.pages.dev/<route>/'",
        ],
        outputLines: [
          "deployment: https://5844bf99.aselsan-microkernel.pages.dev",
          "custom-domain byte-exact: operations 4904047 B / 35d02f95...e08db",
          "custom-domain byte-exact: timeline 538231 B / 302bead7...9b6e",
          "custom-domain byte-exact: yol-haritasi 538324 B / a022f579...e59d",
          "live marker matrix: 20/20 on each of three routes",
          "immutable deployment direct fetch: connect timeout on all three routes · no PASS claimed from that host",
          "physical/device operations=0 · S124 archive/promotion STOP",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S142 kontrollü process exit yerine gerçek bir lower-EL Data Abort'u exact task-bound fatal lifecycle yolunda çalıştırır; kernel-origin fault yoktur. Ordinary EL0 reply'ın broker ACK/session-close commit'i controller-driven kalır. Fiziksel runbook görünürdür ve uygulanmadı.",
    limitations: [
      "Tek gerçek lower-EL Data Abort, tek sabit eşlenmemiş VA ve tek in-flight event kanıtlandı; instruction abort, alignment, undefined instruction ve çoklu fault matrisi değildir.",
      "Kernel-origin fault recovery iddia edilmez; same-EL Data/Instruction Abort hâlâ panic ve smoke rejection'dır.",
      "Ölüm sonrası broker recovery otomatikleşmiştir; ordinary EL0 reply'ın broker ACK ve session-close commit'i controller-driven kalır.",
      "Tek source event ve tek in-flight lease recovery kanıtlandı; sekiz independent concurrent victim/session recovery matrisi değildir.",
      "Deadline/race broker ve QEMU acceptance düzeyindedir; genel IPC syscall blocking/timer cancellation yoluna bağlı değildir.",
      "Product pressure eşikleri ölçülmüş veya imzalanmış değildir.",
      "CPU0-only scheduler kanıtıdır; cross-CPU stop, migration-safe runqueue, TLB shootdown ve SMP reaper açıktır.",
      "Capability transfer, shared-memory loan ve bütün legacy/kernel kaynak üreticilerinin ortak reconciliation'ı açıktır.",
      "K1, MEM0, MEM1, MEM2 ve K2 COMPLETE değildir; S124 fiziksel archive/promotion STOP kalır.",
    ],
  },