G8l: EL0 IPC receive-timeout writer-authority audit

pub const S308_EXCEPTIONS_EXPLICIT_WRITER_SITES: usize = 8;
pub const S308_EXCEPTIONS_REMAINING_UNAUDITED_WRITER_SITES: usize = 1;
pub const S308_DIRECT_SCHEDULER_ACCESS_SITES: usize = S307_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S308_IMMUTABLE_READ_SITES: usize = S307_IMMUTABLE_READ_SITES;
pub const S308_WHOLE_SCHEDULER_GUARDED_SITES: usize = S307_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S308_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S307_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S308_OPEN_WRITER_SITES: usize = S307_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS308SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS308SchedulerWriterAuthorityAuditError {
    S307(G8lS307SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s308_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS308SchedulerWriterAuthorityAuditOutcome, G8lS308SchedulerWriterAuthorityAuditError>
{
    match preflight_s307_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS308SchedulerWriterAuthorityAuditError::S307)?
    {
        G8lS307SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS308SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS307SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S308_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S308_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS308SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS307SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS308SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S308_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s308_park_path_reserves_capacity_and_arms_deadline_before_waiter_publication() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let commit = ipc_receive_timeout_commit_boundary(source);
    for required in [
        "will_park && self.ready_queue.is_empty()",
        "self.save_current_ipc_context(ctx, user_sp)",
        "self.ipc_blocked_tasks.lock()",
        ".try_reserve(1)",
        ".register_receive(",
        "receiver_task",
        "endpoint_id",
        "expected_generation",
        "now_tick",
        "timeout_ticks",
        "endpoints[target_index].rendezvous.recv(waiter)",
    ] {
        assert!(
            commit.contains(required),
            "missing S308 parked-path token: {required}"
        );
    }
    let ready = commit
        .find("will_park && self.ready_queue.is_empty()")
        .unwrap();
    let save = commit
        .find("self.save_current_ipc_context(ctx, user_sp)")
        .unwrap();
    let blocked = commit.find("self.ipc_blocked_tasks.lock()").unwrap();
    let reserve = commit.find(".try_reserve(1)").unwrap();
    let deadline = commit.find("let deadline_record = deadlines").unwrap();
    let register = commit.find(".register_receive(").unwrap();
    let waiter = commit
        .find("endpoints[target_index].rendezvous.recv(waiter)")
        .unwrap();
    assert!(
        ready < save
            && save < blocked
            && blocked < reserve
            && reserve < deadline
            && deadline < register
            && register < waiter
    );
}

  {
    id: "g8l-s308-el0-ipc-receive-timeout-writer-authority-audit-partial",
    date: "2026-08-26",
    sequence: 308,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: EL0 IPC receive-timeout writer-authority audit",
    summary:
      "S308 focused 15/15 PASS ile arch/aarch64/exceptions.rs içindeki kaynak sırasına göre S307'den önce gelen handle_ipc_recv_timeout fonksiyonunun tek explicit mutable scheduler aliasını doğrular: ipc_recv_timeout_or_park sınırı. Geçerli relative deadline ile current-task CNode exact Endpoint generation/ENDPOINT_RECV authority writer'dan önce doğrulanır; context, user stack, endpoint id, generation, now tick ve timeout exact forward edilir. Helper existing IRQ/IPC transaction altında canlı receiver/object'i yeniden doğrular. Queued FIFO delivery immediate yolda deadline kurmadan tüketilir; parked yolda ready/blocked capacity ayrılır, exact receive deadline endpoint waiter publication'dan önce kurulur, başarısız publication exact rollback edilir ve BlockedOnIpc/push/switch/restore sırası korunur. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. Production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez; exceptions.rs içindeki 8 explicit aliasın 1'i ayrıca açık kalır ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S308 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "handle_ipc_recv_timeout içindeki tek addr_of_mut!(crate::task::scheduler::SCHEDULER) writer boundary'si audit edilir. ctx.gpr[0]/ctx.gpr[6] endpoint id/timeout olur; TICKS Acquire snapshot ve valid TickDeadline writer'dan önce gelir. Current-task CNode exact Endpoint lookup/generation ve ENDPOINT_RECV hakkı eksikse InvalidCapability ile terminal kapanır. exceptions.rs 8 explicit writer / 1 remaining unaudited'dır.",
      "ipc_recv_timeout_or_park(ctx, user_sp, endpoint_id, endpoint_cap.generation, now_tick, timeout_ticks) exact ve tek kez forward edilir. Helper IrqGuard/IPC_TRANSACTION_LOCK altında nonzero current receiver, canlı Endpoint/RECV authority/generation, exact ReceiverWaiter, deadline registry ve non-reply endpoint object'ini yeniden doğrular.",
      "Queued FIFO delivery immediate dalda exact waiter ile alınır, IMMEDIATE_DELIVERY_DEADLINE=UNARMED korunur ve register_receive çağrısından önce Ok(Some(envelope)) ile kapanır. Park dalı ready queue, saved context ve blocked capacity'yi doğrular; exact receive deadline kaydını endpoint waiter publication'dan önce kurar. Publication Deliver/Err olursa cancel_exact(deadline_record) ile rollback eder; Registered dalı exact BlockedOnIpc { is_call: false } state, blocked push, lock drop, switch_after_ipc_park ve restore_current_ipc_context sırasıyla Ok(None) döner.",
      "Handler immediate Some, parked None ve Err sonuçlarını ayrık yayınlar; yalnız immediate success exact message/reply-cap zarfını döndürür.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S307 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 360bebb8, RPi4 149371 B / d2d254b6, RPi5 429988 B / d7cb8db5 ve RPi5+SMP 429930 B / ad29f49e. Warning header'ları sırasıyla 291, 389, 899 ve 899'dur; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 2f0dba3b, 17 error ve 22 warning header ile fail-closed kaldı; S308 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S308 dependency matrisi iki koşuda 72 grup / 1004/1004 PASS; ham loglar byte-equal 9282 B / e46ae4fa5a893d9c2736b7fd0052700eb8f31a3c4badbf75df1c5fa92e5b54f4, süre-normalize özetler byte-equal 9426 B / 03df5d0b8a8d28d25717e7b2f1f18a51e3a98c5383c215dcda75d10de633c0bc. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 2218b504 ve 116139 B / 23ef8861; guest logları 2131377 B / 151d6aed ve 2113219 B / 2c91d130. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S308 production writer invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 270 sonuç grubu / 2801 PASS / 7 filtered verdi: ham loglar 320189 B / 456f33d4 ve c8183a29, sonuç özetleri 25533 B / e4e430a2 ve 4984a046, süre-normalize 26071 B özet byte-equal / SHA-256 02caf45e1d6530769890ede71b66f082a2f4b4db59d76ced09757bf5b1b1c879. Filtresiz koşu exit 101, 288629 B / c3dde4b8 ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S308 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S308=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s308_el0_ipc_receive_timeout_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s308-el0-ipc-receive-timeout-writer-authority-audit",
        title: "G8l S308 EL0 IPC receive-timeout writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s308_el0_ipc_receive_timeout_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S308 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "EL0 IPC receive-timeout writer authority remains model-only: reader blocks exclusive lease; exact Endpoint/RECV generation, immediate-unarmed FIFO delivery and deadline-before-waiter parked paths are source-audited while exceptions.rs retains 1 unaudited alias and all 69 production writer sites remain open",
          "dependency: S238–S308 · 72 groups · 1004/1004 PASS; workspace: 270 groups · 2801 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S308 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S308 exceptions.rs içindeki kaynak sırasına göre S307'den önce gelen handle_ipc_recv_timeout explicit mutable scheduler aliasını audit eder; aynı source unit'te 1 alias ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S308 dependency matrisi exact 72 grup / 1004/1004 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S308 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S308=NO.",
    ],
  },