lib.rs

//! Zero-OS G.2 Live Patching (no_std)
//!
//! This crate implements a minimal livepatch mechanism:
//! - Patch authenticity check: **ECDSA P-256 + SHA-256** (KAT-gated verification)
//! - Detour: overwrite first byte of a target function with **INT3 (0xCC)**
//! - Redirect: a **#BP** handler rewrites `RIP` to the patch handler address
//! - Lifecycle: register / enable / disable with an explicit state machine
//!
//! # Patch image format
//!
//! All integers are little-endian. Signature is a fixed 64-byte `(r||s)` blob.
//!
//! ```text
//! 0x00 4  magic              = "ZLP2"
//! 0x04 2  version            = 1
//! 0x06 2  header_len         = 72
//! 0x08 4  flags              (bit 0: HAS_DEPS)
//! 0x0C 4  reserved0          = 0
//! 0x10 8  target_addr        (kernel VA of function entry)
//! 0x18 8  handler_addr       (kernel VA; 0 means handler is in patch_data)
//! 0x20 4  patch_data_len     (bytes)
//! 0x24 4  reserved1          = 0
//! 0x28 32 patch_data_sha256  (SHA-256 of patch_data)
//! 0x48 64 signature          (ECDSA P-256, r||s; covers header||patch_data)
//! 0x88 .. patch_data         (dep table if HAS_DEPS + handler code blob)
//! ```
//!
//! # SMP safety
//!
//! - The detour write is a **single-byte atomic store**.
//! - The handler lookup is lock-free (fixed patch table; atomics only).
//! - Cross-core instruction stream synchronization is delegated to `KernelOps::sync_cores()`.

#![no_std]
#![feature(abi_x86_interrupt)]

extern crate alloc;
#[macro_use]
extern crate klog;

// R93-2 FIX: Never allow the insecure ECDSA stub in production builds.
// R94-7 FIX: Use `not(debug_assertions)` instead of `feature = "release"`.
// Cargo's `--release` flag does NOT automatically enable a "release" feature,
// but it DOES disable debug_assertions. This ensures the guard actually fires
// in production builds regardless of explicit feature configuration.
#[cfg(all(feature = "insecure-ecdsa-stub", not(any(test, debug_assertions))))]
compile_error!("livepatch: feature `insecure-ecdsa-stub` must not be enabled in release builds");

use alloc::boxed::Box;
use alloc::vec;
use alloc::vec::Vec;
use core::sync::atomic::{AtomicU32, AtomicU64, AtomicU8, AtomicUsize, Ordering};
use spin::{Mutex, Once};
use x86_64::structures::idt::InterruptStackFrame;
use x86_64::VirtAddr;

// Expose only the KAT function for compliance module, not the full verification API.
// This minimizes API surface while allowing FIPS self-tests to use the existing ECDSA KAT.
pub mod ecdsa_p256;

// ============================================================================
// Public constants / syscall numbers
// ============================================================================

pub const SYS_KPATCH_LOAD: u64 = 509;
pub const SYS_KPATCH_ENABLE: u64 = 510;
pub const SYS_KPATCH_DISABLE: u64 = 511;
pub const SYS_KPATCH_UNLOAD: u64 = 512;
/// P1-4: Enable all loaded patches in topological dependency order.
pub const SYS_KPATCH_ENABLE_ALL: u64 = 514;
/// P1-4: Disable all enabled patches in reverse topological dependency order.
pub const SYS_KPATCH_DISABLE_ALL: u64 = 515;

// ============================================================================
// Error model (minimal errno subset)
// ============================================================================

#[repr(i64)]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Errno {
    EPERM = -1,
    ENOENT = -2,
    E2BIG = -7,
    ENOMEM = -12,
    EACCES = -13,
    EFAULT = -14,
    EBUSY = -16,
    EEXIST = -17,
    EINVAL = -22,
    ENOSYS = -38,
    EOVERFLOW = -75,
    EALREADY = -114,
}

impl Errno {
    #[inline]
    pub const fn as_i64(self) -> i64 {
        self as i64
    }
}

// ============================================================================
// Kernel hooks
// ============================================================================

/// Kernel-provided operations required by the livepatch module.
pub trait KernelOps: Sync {
    /// Returns true if the calling task is privileged (CAP_ADMIN or equivalent).
    fn is_privileged(&self) -> bool;

    // ========================================================================
    // R102-13 FIX: LSM hook delegates for livepatch operations.
    //
    // The livepatch crate does not depend on the `lsm` crate directly.
    // Instead, the KernelOps implementor (in kernel_core or the main kernel)
    // is responsible for calling `lsm::hook_kpatch_*` and translating
    // `LsmError` to `Errno`. R103-5 FIX: Default implementations now DENY
    // all operations (fail-closed). Implementors must explicitly wire in
    // the LSM hooks to permit livepatch operations.
    // ========================================================================

    /// LSM check before loading a livepatch module.
    ///
    /// Implementors should call `lsm::hook_kpatch_load(task, patch_len)`
    /// and return `Err(Errno::EPERM)` on denial.
    ///
    /// R103-5 FIX: Default to `Err(EPERM)` (fail-closed).
    ///
    /// The previous default `Ok(())` silently permitted all livepatch operations
    /// whenever the KernelOps implementor did not override these methods.  Since
    /// livepatch introduces arbitrary kernel code, the fail-safe default must
    /// DENY operations until the implementor explicitly wires in the LSM hooks.
    fn check_lsm_kpatch_load(&self, _patch_len: usize) -> Result<(), Errno> {
        Err(Errno::EPERM)
    }

    /// LSM check before enabling a livepatch.
    ///
    /// R103-5 FIX: Fail-closed default.
    fn check_lsm_kpatch_enable(&self, _patch_id: u64) -> Result<(), Errno> {
        Err(Errno::EPERM)
    }

    /// LSM check before disabling a livepatch.
    ///
    /// R103-5 FIX: Fail-closed default.
    fn check_lsm_kpatch_disable(&self, _patch_id: u64) -> Result<(), Errno> {
        Err(Errno::EPERM)
    }

    /// LSM check before unloading a livepatch.
    ///
    /// R103-5 FIX: Fail-closed default.
    fn check_lsm_kpatch_unload(&self, _patch_id: u64) -> Result<(), Errno> {
        Err(Errno::EPERM)
    }

    /// Copy from user memory into a kernel buffer.
    ///
    /// # Safety
    /// Implementations must validate that `user_src..user_src+len` is readable user memory.
    unsafe fn copy_from_user(&self, dst: *mut u8, user_src: usize, len: usize)
        -> Result<(), Errno>;

    /// Allocate an executable region and return its kernel VA.
    ///
    /// # Safety
    ///
    /// SECURITY: The returned mapping must be kernel-only (not user-accessible).
    /// Prefer W^X: allocate RW, copy bytes, then transition to RX via `seal_exec`.
    unsafe fn alloc_exec(&self, len: usize) -> Result<usize, Errno>;

    /// Tighten permissions on an exec region after initialization (e.g., RW->RX).
    ///
    /// # Safety
    ///
    /// R93-11 FIX: This method is now REQUIRED. A no-op implementation would silently
    /// violate W^X, leaving handler memory both writable and executable.
    /// Implementations MUST transition the region from RW to RX.
    unsafe fn seal_exec(&self, addr: usize, len: usize) -> Result<(), Errno>;

    /// Free an executable region previously allocated with `alloc_exec`.
    ///
    /// # Safety
    ///
    /// Caller must ensure the region is no longer in use and addr/len match a prior alloc_exec.
    unsafe fn free_exec(&self, addr: usize, len: usize);

    /// Temporarily make kernel text writable for patching.
    ///
    /// # Safety
    ///
    /// SECURITY: Must only permit kernel text pages, and must be safe against
    /// concurrent calls (or callers must serialize externally).
    unsafe fn make_text_writable(&self, addr: usize, len: usize) -> Result<(), Errno>;

    /// Restore .text to read-only+executable after patching.
    ///
    /// # Safety
    ///
    /// Caller must ensure the range matches a prior make_text_writable call.
    unsafe fn make_text_readonly(&self, addr: usize, len: usize);

    /// Ensure instruction stream synchronization across all CPUs after text modification.
    ///
    /// SECURITY: After this returns, no CPU may execute stale instruction bytes from
    /// the modified region. Implementations must use IPI + serializing instructions.
    fn sync_cores(&self);

    /// Flush/serialize instruction fetch for the given region.
    fn flush_icache(&self, addr: usize, len: usize);
}

static KERNEL_OPS: Once<&'static dyn KernelOps> = Once::new();

/// KSA-009: live patching is unsupported until kernel hooks, provisioned trust
/// keys and cross-core patch/rollback validation are supplied together.
pub const SUPPORTED: bool = false;
pub const UNSUPPORTED_REASON: &str = "kernel hooks and production trust keys are not provisioned";

/// Initialize the livepatch module and install kernel hooks.
pub fn init(ops: &'static dyn KernelOps) -> Result<(), Errno> {
    if !SUPPORTED {
        return Err(Errno::ENOSYS);
    }
    let _ = KERNEL_OPS.call_once(|| ops);
    let _ = PATCH_TABLE.call_once(init_patch_table);
    Ok(())
}

// ============================================================================
// P1-4: Tamper-evident audit integration
//
// Livepatch must not depend on the `audit` crate directly to avoid circular
// dependencies. Instead, the kernel wires in a callback after audit::init()
// so livepatch lifecycle events (load/enable/disable/unload) are recorded in
// the hash-chained audit log.
// ============================================================================

/// Callback signature for emitting tamper-evident audit events.
///
/// # Arguments
/// * `action` — 0=load, 1=enable, 2=disable, 3=unload
/// * `patch_id` — Patch identifier returned by `kpatch_load`
/// * `target_addr` — Target function address
/// * `extra` — Action-specific data: \[handler_addr, dep_count, 0\] for load; \[0;3\] otherwise
/// * `timestamp` — TSC value at the time of the transition
pub type LivepatchAuditFn =
    fn(action: u64, patch_id: u64, target_addr: u64, extra: [u64; 3], timestamp: u64);

/// Registered audit callback. Protected by `Mutex` for IRQ-safe access.
static LIVEPATCH_AUDIT_CB: Mutex<Option<LivepatchAuditFn>> = Mutex::new(None);

/// Register the tamper-evident audit callback for livepatch lifecycle events.
///
/// Called from `main.rs` after the audit subsystem is initialized.
pub fn register_audit_callback(cb: LivepatchAuditFn) {
    *LIVEPATCH_AUDIT_CB.lock() = Some(cb);
}

/// Emit a livepatch lifecycle audit event via the registered callback.
///
/// Copies the function pointer out of the lock before invoking it to avoid
/// holding the callback lock across the audit subsystem call path.
#[inline]
fn emit_livepatch_audit(action: u64, patch_id: u64, target_addr: u64, extra: [u64; 3]) {
    let cb = { *LIVEPATCH_AUDIT_CB.lock() };
    if let Some(emit) = cb {
        emit(action, patch_id, target_addr, extra, read_tsc());
    }
}

/// R101-4 FIX: Check whether all ECDSA key slots are empty placeholders.
///
/// Returns `true` if all key slots contain all-zero bytes, meaning livepatch
/// signature verification is non-functional. The kernel entry point should call
/// this at boot and emit a warning via its own `kprintln!` macro.
pub fn has_placeholder_keys() -> bool {
    TRUSTED_P256_PUBKEYS_UNCOMPRESSED
        .iter()
        .all(|k| k.iter().all(|&b| b == 0))
}

#[inline]
fn ops() -> Result<&'static dyn KernelOps, Errno> {
    if !SUPPORTED {
        return Err(Errno::ENOSYS);
    }
    KERNEL_OPS.get().copied().ok_or(Errno::ENOSYS)
}

// ============================================================================
// Patch format constants
// ============================================================================

const PATCH_MAGIC: [u8; 4] = *b"ZLP2";
const PATCH_VERSION: u16 = 1;
const PATCH_HEADER_LEN: usize = 72;
const PATCH_SIGNATURE_LEN: usize = 64;
const INT3: u8 = 0xCC;

/// Flag bit 0: patch_data starts with a dependency table.
const PATCH_FLAG_HAS_DEPS: u32 = 1;

/// Maximum number of dependencies a single patch may declare.
const MAX_PATCH_DEPS: usize = 4;

/// Limit patch image size copied from userspace.
pub const MAX_PATCH_BYTES: usize = 64 * 1024;

#[derive(Clone, Copy, Debug)]
#[allow(dead_code)]
struct PatchHeader {
    #[allow(dead_code)]
    flags: u32,
    target_addr: u64,
    handler_addr: u64,
    patch_data_len: u32,
    patch_data_sha256: [u8; 32],
}

#[derive(Debug)]
struct PatchImage<'a> {
    raw_header: &'a [u8],
    header: PatchHeader,
    signature: &'a [u8; 64],
    patch_data: &'a [u8],
}

impl<'a> PatchImage<'a> {
    fn parse(buf: &'a [u8]) -> Result<Self, Errno> {
        if buf.len() < PATCH_HEADER_LEN + PATCH_SIGNATURE_LEN {
            return Err(Errno::EINVAL);
        }

        let raw_header = &buf[..PATCH_HEADER_LEN];

        // magic
        if raw_header[0..4] != PATCH_MAGIC {
            return Err(Errno::EINVAL);
        }

        let version = read_le_u16(raw_header, 0x04)?;
        if version != PATCH_VERSION {
            return Err(Errno::EINVAL);
        }

        let header_len = read_le_u16(raw_header, 0x06)? as usize;
        if header_len != PATCH_HEADER_LEN {
            return Err(Errno::EINVAL);
        }

        let flags = read_le_u32(raw_header, 0x08)?;
        let target_addr = read_le_u64(raw_header, 0x10)?;
        let handler_addr = read_le_u64(raw_header, 0x18)?;
        let patch_data_len = read_le_u32(raw_header, 0x20)?;

        let mut patch_data_sha256 = [0u8; 32];
        patch_data_sha256.copy_from_slice(&raw_header[0x28..0x48]);

        let total_len = PATCH_HEADER_LEN
            .checked_add(PATCH_SIGNATURE_LEN)
            .and_then(|v| v.checked_add(patch_data_len as usize))
            .ok_or(Errno::EINVAL)?;

        // Require exact length to avoid hidden bytes not covered by signature.
        if buf.len() != total_len {
            return Err(Errno::EINVAL);
        }

        let sig_off = PATCH_HEADER_LEN;
        let data_off = PATCH_HEADER_LEN + PATCH_SIGNATURE_LEN;

        let signature: &'a [u8; 64] = buf[sig_off..sig_off + PATCH_SIGNATURE_LEN]
            .try_into()
            .map_err(|_| Errno::EINVAL)?;

        let patch_data = &buf[data_off..data_off + patch_data_len as usize];

        let header = PatchHeader {
            flags,
            target_addr,
            handler_addr,
            patch_data_len,
            patch_data_sha256,
        };

        Ok(Self {
            raw_header,
            header,
            signature,
            patch_data,
        })
    }
}

// ============================================================================
// Dependency metadata
// ============================================================================

/// Per-patch dependency metadata, immutable after registration.
///
/// Stored in a parallel table alongside `PatchSlot`, protected by `PATCH_REG_LOCK`.
#[derive(Clone, Copy, Debug)]
struct PatchMeta {
    /// Unique identifier for this patch: SHA-256 of patch_data from the ZLPM header.
    patch_uid: [u8; 32],
    /// Number of valid entries in `deps` (0..=MAX_PATCH_DEPS).
    dep_count: u8,
    /// UIDs of patches that must be in `Enabled` state before this patch can be enabled.
    deps: [[u8; 32]; MAX_PATCH_DEPS],
}

/// Extract dependency metadata from a parsed patch image.
///
/// If `PATCH_FLAG_HAS_DEPS` is set in the header flags, `patch_data` is prefixed with:
///
/// ```text
/// [0]       dep_count   (1..=4)
/// [1..33]   dep_uid[0]  (SHA-256)
/// [33..65]  dep_uid[1]  (if dep_count >= 2)
/// ...
/// ```
///
/// Returns `(meta, handler_offset)` where `handler_offset` is the byte offset within
/// `patch_data` where the actual handler code begins (past the dep table).
fn extract_patch_meta(img: &PatchImage<'_>) -> Result<(PatchMeta, usize), Errno> {
    let patch_uid = img.header.patch_data_sha256;
    let mut meta = PatchMeta {
        patch_uid,
        dep_count: 0,
        deps: [[0u8; 32]; MAX_PATCH_DEPS],
    };

    if (img.header.flags & PATCH_FLAG_HAS_DEPS) == 0 {
        return Ok((meta, 0));
    }

    // HAS_DEPS requires at least 1 byte for dep_count.
    if img.patch_data.is_empty() {
        return Err(Errno::EINVAL);
    }

    let dep_count = img.patch_data[0] as usize;
    if dep_count == 0 || dep_count > MAX_PATCH_DEPS {
        return Err(Errno::EINVAL);
    }

    // dep table = 1 byte count + dep_count * 32 bytes UIDs.
    let table_len = 1usize
        .checked_add(dep_count.checked_mul(32).ok_or(Errno::EINVAL)?)
        .ok_or(Errno::EINVAL)?;
    if img.patch_data.len() < table_len {
        return Err(Errno::EINVAL);
    }

    for i in 0..dep_count {
        let start = 1 + i * 32;
        meta.deps[i].copy_from_slice(&img.patch_data[start..start + 32]);
    }
    meta.dep_count = dep_count as u8;

    // Self-dependency is structurally invalid.
    for dep_uid in meta.deps.iter().take(dep_count) {
        if ct_eq(dep_uid, &meta.patch_uid) {
            return Err(Errno::EINVAL);
        }
    }

    Ok((meta, table_len))
}

// ============================================================================
// Patch state machine + fixed patch table
// ============================================================================

const MAX_PATCHES: usize = 64;

/// Retired handler regions are quarantined instead of being freed immediately.
/// A signed handler is arbitrary kernel code and cannot be trusted to execute
/// the optional return hook, so reclamation must never depend on cooperation
/// from that code.  The fixed bound keeps unload/reload memory use finite; once
/// the quarantine is full, a further unload fails closed with `EBUSY`.
const MAX_RETIRED_EXEC: usize = MAX_PATCHES;

#[derive(Clone, Copy)]
struct RetiredExec {
    addr: usize,
    len: usize,
}

#[repr(u8)]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum PatchState {
    Empty = 0,
    Loading = 1,
    Registered = 2,
    Enabling = 3,
    Enabled = 4,
    Disabling = 5,
    Disabled = 6,
    Failed = 7,
    /// The slot has been unloaded but its executable blob is quarantined.
    /// It is intentionally never reused: a signed handler may return late
    /// through an old slot index, and reusing the index would let that stale
    /// callback mutate a newer patch's in-flight accounting.
    Retired = 8,
}

impl PatchState {
    #[inline]
    fn from_u8(v: u8) -> PatchState {
        match v {
            0 => PatchState::Empty,
            1 => PatchState::Loading,
            2 => PatchState::Registered,
            3 => PatchState::Enabling,
            4 => PatchState::Enabled,
            5 => PatchState::Disabling,
            6 => PatchState::Disabled,
            8 => PatchState::Retired,
            _ => PatchState::Failed,
        }
    }

    #[inline]
    fn is_bp_active(self) -> bool {
        matches!(
            self,
            PatchState::Enabling | PatchState::Enabled | PatchState::Disabling
        )
    }
}

struct PatchSlot {
    state: AtomicU8,
    id: AtomicU64,
    target: AtomicUsize,
    handler: AtomicUsize,

    // Saved original first byte for rollback.
    orig_valid: AtomicU8,
    orig_byte: AtomicU8,

    // Optional allocated handler blob region.
    exec_addr: AtomicUsize,
    exec_len: AtomicUsize,

    // TSC tick (RDTSC) when the patch transitioned to Enabled; 0 = never/unknown.
    // Used for panic-time rollback of recently-enabled patches.
    enabled_tsc: AtomicU64,

    // R103-2 FIX: In-flight dispatch counter.
    //
    // Incremented by `breakpoint_dispatch` before redirecting RIP into the handler
    // and optionally decremented by a cooperative return hook.  Unload safety does
    // not depend on this counter: executable blobs and their slot indices are both
    // retired permanently, because signed handler code may omit or delay the hook.
    in_flight: AtomicU32,
}

impl PatchSlot {
    const fn new() -> Self {
        Self {
            state: AtomicU8::new(PatchState::Empty as u8),
            id: AtomicU64::new(0),
            target: AtomicUsize::new(0),
            handler: AtomicUsize::new(0),
            orig_valid: AtomicU8::new(0),
            orig_byte: AtomicU8::new(0),
            exec_addr: AtomicUsize::new(0),
            exec_len: AtomicUsize::new(0),
            enabled_tsc: AtomicU64::new(0),
            in_flight: AtomicU32::new(0), // R103-2 FIX
        }
    }
}

static PATCH_TABLE: Once<&'static [PatchSlot]> = Once::new();
static NEXT_PATCH_ID: AtomicU64 = AtomicU64::new(1);

/// R94-3 FIX: Serialize patch registration to prevent duplicate-target races.
static PATCH_REG_LOCK: Mutex<()> = Mutex::new(());
/// R94-5 FIX: Serialize text patching to prevent concurrent page-permission conflicts.
static TEXT_PATCH_LOCK: Mutex<()> = Mutex::new(());

/// Per-slot dependency metadata, parallel to PATCH_TABLE.
///
/// P2-3 FIX: Replaced `static mut` with `Mutex` to eliminate undefined behavior
/// from unsynchronized mutable access.  All reads and writes are serialized by
/// both `PATCH_REG_LOCK` (for the patch lifecycle) and this inner `Mutex` (for
/// memory safety).  The double-lock is acceptable because `PATCH_META_TABLE` is
/// only accessed in cold registration/unload/dependency-check paths.
static PATCH_META_TABLE: Mutex<[Option<PatchMeta>; MAX_PATCHES]> = Mutex::new([None; MAX_PATCHES]);
static RETIRED_EXEC: Mutex<[Option<RetiredExec>; MAX_RETIRED_EXEC]> =
    Mutex::new([None; MAX_RETIRED_EXEC]);

/// Place an executable region in the never-reused quarantine.  This is the
/// safety backstop for handlers that do not call `kpatch_handler_return` (or
/// call it too late): an in-flight CPU can continue executing valid bytes even
/// after the slot is cleared and reused.
fn quarantine_exec(addr: usize, len: usize) -> bool {
    if addr == 0 || len == 0 {
        return true;
    }
    let mut retired = RETIRED_EXEC.lock();
    if retired
        .iter()
        .flatten()
        .any(|entry| entry.addr == addr && entry.len == len)
    {
        return true;
    }
    if let Some(slot) = retired.iter_mut().find(|entry| entry.is_none()) {
        *slot = Some(RetiredExec { addr, len });
        true
    } else {
        false
    }
}

fn init_patch_table() -> &'static [PatchSlot] {
    let mut v = Vec::with_capacity(MAX_PATCHES);
    for _ in 0..MAX_PATCHES {
        v.push(PatchSlot::new());
    }
    Box::leak(v.into_boxed_slice())
}

#[inline]
fn patch_table() -> &'static [PatchSlot] {
    PATCH_TABLE.call_once(init_patch_table);
    PATCH_TABLE.get().copied().unwrap_or(&[])
}

#[inline]
fn patch_table_get() -> Option<&'static [PatchSlot]> {
    PATCH_TABLE.get().copied()
}

fn find_slot_index_by_id(id: u64) -> Option<(usize, &'static PatchSlot)> {
    for (idx, slot) in patch_table().iter().enumerate() {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        if st != PatchState::Empty && slot.id.load(Ordering::Acquire) == id {
            return Some((idx, slot));
        }
    }
    None
}

fn find_slot_by_id(id: u64) -> Option<&'static PatchSlot> {
    find_slot_index_by_id(id).map(|(_, slot)| slot)
}

/// Query current state for a loaded patch id.
pub fn patch_state(id: u64) -> Option<PatchState> {
    if !SUPPORTED {
        return None;
    }
    find_slot_by_id(id).map(|s| PatchState::from_u8(s.state.load(Ordering::Acquire)))
}

// ============================================================================
// Dependency enforcement
// ============================================================================

/// Verify that all dependencies of the patch at `slot_index` are currently `Enabled`.
///
/// Returns `ENOENT` if a required dependency UID is not loaded at all,
/// or `EBUSY` if a dependency is loaded but not in `Enabled` state.
///
/// Must be called before transitioning a patch to `Enabled`.
fn check_dependencies(slot_index: usize) -> Result<(), Errno> {
    let table = patch_table();
    let _guard = PATCH_REG_LOCK.lock();
    let meta_table = PATCH_META_TABLE.lock();

    let meta = match meta_table.get(slot_index).copied().flatten() {
        Some(m) => m,
        None => return Err(Errno::EINVAL),
    };

    let dep_count = meta.dep_count as usize;
    if dep_count == 0 {
        return Ok(());
    }

    for dep_uid in meta.deps.iter().take(dep_count) {
        let mut found = false;
        let mut enabled = false;

        for (other_idx, other_slot) in table.iter().enumerate() {
            if other_idx == slot_index {
                continue;
            }
            let st = PatchState::from_u8(other_slot.state.load(Ordering::Acquire));
            if st == PatchState::Empty {
                continue;
            }
            // SAFETY: PATCH_REG_LOCK is held.
            let other_meta = match meta_table.get(other_idx).copied().flatten() {
                Some(m) => m,
                None => continue,
            };
            if ct_eq(&other_meta.patch_uid, dep_uid) {
                found = true;
                if st == PatchState::Enabled {
                    enabled = true;
                }
                break;
            }
        }

        if !found {
            return Err(Errno::ENOENT);
        }
        if !enabled {
            return Err(Errno::EBUSY);
        }
    }

    Ok(())
}

/// Verify that no `Enabled`/`Enabling` patch depends on the patch at `slot_index`.
///
/// Returns `EBUSY` if any active patch lists this patch's UID as a dependency.
///
/// Must be called before transitioning a patch to `Disabled` or unloading it.
fn check_no_dependents(slot_index: usize) -> Result<(), Errno> {
    let table = patch_table();
    let _guard = PATCH_REG_LOCK.lock();
    let meta_table = PATCH_META_TABLE.lock();

    let meta = match meta_table.get(slot_index).copied().flatten() {
        Some(m) => m,
        None => return Err(Errno::EINVAL),
    };
    let patch_uid = meta.patch_uid;

    for (other_idx, other_slot) in table.iter().enumerate() {
        if other_idx == slot_index {
            continue;
        }

        let st = PatchState::from_u8(other_slot.state.load(Ordering::Acquire));
        if !matches!(st, PatchState::Enabled | PatchState::Enabling) {
            continue;
        }

        // SAFETY: PATCH_REG_LOCK is held.
        let other_meta = match meta_table.get(other_idx).copied().flatten() {
            Some(m) => m,
            None => continue,
        };

        let dep_count = other_meta.dep_count as usize;
        for dep_uid in other_meta.deps.iter().take(dep_count) {
            if ct_eq(dep_uid, &patch_uid) {
                return Err(Errno::EBUSY);
            }
        }
    }

    Ok(())
}

// ============================================================================
// P1-4: Topological ordering for batch enable/disable
// ============================================================================

/// Collect all non-empty patch slots into a (slot_index, id, meta) list.
///
/// Requires `PATCH_REG_LOCK` to be held by the caller.
/// Returns `EBUSY` if any slot is in a transitional state.
fn collect_patch_nodes(table: &'static [PatchSlot]) -> Result<Vec<(usize, u64, PatchMeta)>, Errno> {
    let meta_table = PATCH_META_TABLE.lock();
    let mut nodes = Vec::new();
    for (slot_index, slot) in table.iter().enumerate() {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        if st == PatchState::Empty {
            continue;
        }
        if matches!(
            st,
            PatchState::Loading | PatchState::Enabling | PatchState::Disabling
        ) {
            return Err(Errno::EBUSY);
        }
        if matches!(st, PatchState::Failed | PatchState::Retired) {
            continue; // Skip failed patches — they cannot participate in batch ops.
        }
        // R110-1 FIX: Treat missing metadata on a non-empty, non-failed slot as an
        // internal consistency error rather than silently skipping it.  A slot that
        // is Registered/Enabled/Disabled MUST have associated PatchMeta.
        let meta = match meta_table.get(slot_index).copied().flatten() {
            Some(m) => m,
            None => return Err(Errno::EINVAL),
        };
        let id = slot.id.load(Ordering::Acquire);
        nodes.push((slot_index, id, meta));
    }
    Ok(nodes)
}

/// Build a topological order of all non-empty patches by UID dependency.
///
/// Uses Kahn's algorithm.  Returns patch IDs in dependency-first order
/// (roots first, leaves last).
///
/// - Returns `ENOENT` if a dependency UID is not loaded.
/// - Returns `EINVAL` on dependency cycle.
/// - Returns `EBUSY` if any patch is in a transitional state.
fn topo_sort_patch_ids() -> Result<Vec<u64>, Errno> {
    let table = patch_table();
    let _guard = PATCH_REG_LOCK.lock();

    let nodes = collect_patch_nodes(table)?;
    let n = nodes.len();
    if n == 0 {
        return Ok(Vec::new());
    }

    // Build adjacency: for each node, compute in-degree and dependents list.
    let mut indegree = vec![0u16; n];
    let mut dependents: Vec<Vec<usize>> = vec![Vec::new(); n];

    for (i, (_, _, meta)) in nodes.iter().enumerate() {
        let dep_count = meta.dep_count as usize;
        for dep_uid in meta.deps.iter().take(dep_count) {
            let dep_idx = nodes
                .iter()
                .position(|(_, _, m)| ct_eq(&m.patch_uid, dep_uid))
                .ok_or(Errno::ENOENT)?;
            dependents[dep_idx].push(i);
            indegree[i] = indegree[i].checked_add(1).ok_or(Errno::EINVAL)?;
        }
    }

    // Kahn's algorithm: repeatedly pick a zero-indegree node.
    let mut processed = vec![false; n];
    let mut order: Vec<usize> = Vec::with_capacity(n);

    for _ in 0..n {
        let next = (0..n).find(|&i| !processed[i] && indegree[i] == 0);
        let i = next.ok_or(Errno::EINVAL)?; // Cycle detected
        processed[i] = true;
        order.push(i);
        for &child in dependents[i].iter() {
            indegree[child] = indegree[child].saturating_sub(1);
        }
    }

    let ids: Vec<u64> = order.iter().map(|&idx| nodes[idx].1).collect();
    Ok(ids)
}

/// P1-4: Enable all loaded patches in topological dependency order.
///
/// Patches that are already `Enabled` are skipped.  On failure, all patches
/// enabled by this batch are rolled back (disabled) in reverse order.
///
/// Returns `EPERM` if the caller is not privileged.
pub fn sys_kpatch_enable_all() -> i64 {
    match do_sys_kpatch_enable_all() {
        Ok(()) => 0,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_enable_all() -> Result<(), Errno> {
    let ops = ops()?;
    let _ = patch_table();

    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }

    let order = topo_sort_patch_ids()?;
    let mut enabled_by_batch: Vec<u64> = Vec::new();

    for &id in order.iter() {
        // Recheck state — another thread could have changed it.
        let st = match patch_state(id) {
            Some(s) => s,
            None => {
                // Patch disappeared (unloaded concurrently); rollback and fail.
                rollback_batch(&enabled_by_batch);
                return Err(Errno::ENOENT);
            }
        };

        if st == PatchState::Enabled {
            continue; // Already enabled — skip.
        }
        if !matches!(st, PatchState::Registered | PatchState::Disabled) {
            // Not in an enable-able state — rollback and fail.
            rollback_batch(&enabled_by_batch);
            return Err(Errno::EBUSY);
        }

        ops.check_lsm_kpatch_enable(id)?;
        if let Err(e) = kpatch_enable(id) {
            rollback_batch(&enabled_by_batch);
            return Err(e);
        }
        enabled_by_batch.push(id);
    }

    Ok(())
}

/// P1-4: Disable all enabled patches in reverse topological dependency order.
///
/// Patches that are not `Enabled` are skipped.  On failure, all patches
/// disabled by this batch are re-enabled in reverse order.
///
/// Returns `EPERM` if the caller is not privileged.
pub fn sys_kpatch_disable_all() -> i64 {
    match do_sys_kpatch_disable_all() {
        Ok(()) => 0,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_disable_all() -> Result<(), Errno> {
    let ops = ops()?;
    let _ = patch_table();

    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }

    let order = topo_sort_patch_ids()?;
    let mut disabled_by_batch: Vec<u64> = Vec::new();

    // Disable in reverse topological order (leaves first, roots last).
    for &id in order.iter().rev() {
        let st = match patch_state(id) {
            Some(s) => s,
            None => {
                reenable_batch(&disabled_by_batch);
                return Err(Errno::ENOENT);
            }
        };

        if st != PatchState::Enabled {
            continue; // Not enabled — skip.
        }

        ops.check_lsm_kpatch_disable(id)?;
        if let Err(e) = kpatch_disable(id) {
            reenable_batch(&disabled_by_batch);
            return Err(e);
        }
        disabled_by_batch.push(id);
    }

    Ok(())
}

/// Rollback helper: disable patches enabled by a failed enable-all batch.
fn rollback_batch(enabled_ids: &[u64]) {
    for &id in enabled_ids.iter().rev() {
        let _ = kpatch_disable(id);
    }
}

/// Rollback helper: re-enable patches disabled by a failed disable-all batch.
fn reenable_batch(disabled_ids: &[u64]) {
    for &id in disabled_ids.iter().rev() {
        let _ = kpatch_enable(id);
    }
}

// ============================================================================
// Panic/fault rollback policy
// ============================================================================

/// Read the Time Stamp Counter (RDTSC) for timestamp tracking.
///
/// Returns TSC ticks since CPU reset. This is a monotonic counter on modern x86_64
/// CPUs with invariant TSC. Used for panic-time rollback window calculation.
#[inline]
fn read_tsc() -> u64 {
    #[cfg(target_arch = "x86_64")]
    {
        let low: u32;
        let high: u32;
        // SAFETY: RDTSC is a safe instruction on x86_64.
        unsafe {
            core::arch::asm!(
                "rdtsc",
                out("eax") low,
                out("edx") high,
                options(nomem, nostack, preserves_flags)
            );
        }
        ((high as u64) << 32) | (low as u64)
    }

    #[cfg(not(target_arch = "x86_64"))]
    {
        0
    }
}

/// Best-effort rollback of patches enabled within the last `max_age_ticks` TSC ticks.
///
/// Intended for fault/panic paths:
/// - Does not allocate.
/// - Uses `try_lock()` to avoid deadlocking if patching is already in progress.
/// - Skips cross-core sync to avoid hanging while other CPUs may be wedged.
///
/// # Arguments
///
/// * `max_age_ticks` - Maximum TSC tick age for rollback eligibility.
///   For ~60s window at 2GHz: 120_000_000_000 (120 billion ticks).
///
/// # Returns
///
/// Number of patches successfully disabled. Zero if lock acquisition failed
/// or no recent patches needed rollback.
///
/// # Safety Note
///
/// Caller must ensure this is called from a fault/panic context where
/// skipping cross-core TLB/icache sync is acceptable. Without sync_cores(),
/// other CPUs may retain stale INT3 in their instruction caches.
///
/// **Stale INT3 behavior**: If another CPU executes a stale INT3 after rollback,
/// `breakpoint_dispatch()` will not find an active patch and won't rewrite RIP.
/// Execution continues at RIP (after INT3), potentially causing a crash.
/// This is acceptable only if the system is halting or other CPUs are stopped.
///
/// **Best-effort guarantee**: Rollback is opportunistic due to try_lock().
/// It can be suppressed when TEXT_PATCH_LOCK is held during panic.
pub fn rollback_recent_patches(max_age_ticks: u64) -> usize {
    let table = match patch_table_get() {
        Some(t) => t,
        None => return 0,
    };

    let ops = match ops() {
        Ok(ops) => ops,
        Err(_) => return 0,
    };

    // Panic-safety: never spin waiting for the text patch lock.
    // If another thread holds it, we're likely in a deadlock-prone situation.
    let Some(_guard) = TEXT_PATCH_LOCK.try_lock() else {
        return 0;
    };

    // Read TSC AFTER acquiring lock to avoid race where a patch is enabled
    // between reading TSC and acquiring lock. This prevents TSC skew from
    // causing recently-enabled patches to appear "ancient" and skip rollback.
    let now = read_tsc();

    let mut rolled_back = 0usize;

    for slot in table.iter() {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        if st != PatchState::Enabled {
            continue;
        }

        let enabled_at = slot.enabled_tsc.load(Ordering::Acquire);
        if enabled_at == 0 {
            // Never recorded enable time (legacy or edge case); skip.
            continue;
        }

        // Calculate age with wrapping subtraction (TSC never resets during uptime).
        let age = now.wrapping_sub(enabled_at);
        if age > max_age_ticks {
            // Patch has been enabled too long; it's not a rollback candidate.
            continue;
        }

        // Atomically transition to Disabling to claim ownership.
        if slot
            .state
            .compare_exchange(
                PatchState::Enabled as u8,
                PatchState::Disabling as u8,
                Ordering::AcqRel,
                Ordering::Acquire,
            )
            .is_err()
        {
            continue;
        }

        // Attempt to restore the original byte (panic-safe path, no sync_cores).
        // SAFETY: We hold TEXT_PATCH_LOCK and have transitioned state.
        match unsafe { restore_original_byte_inner(slot, ops, false) } {
            Ok(()) => {
                slot.enabled_tsc.store(0, Ordering::Release);
                slot.state
                    .store(PatchState::Disabled as u8, Ordering::Release);
                rolled_back += 1;
            }
            Err(_) => {
                // Restore to Enabled state so INT3 dispatch continues to work.
                slot.state
                    .store(PatchState::Enabled as u8, Ordering::Release);
            }
        }
    }

    rolled_back
}

// ============================================================================
// Signature verification (SHA-256 + ECDSA P-256)
// ============================================================================

// Trusted public keys for livepatch signature verification.
//
// SECURITY: These are SEC1 uncompressed format (65 bytes: 0x04 || X || Y).
// Populate with real keys at build time from kernel configuration.
// All-zero placeholders are rejected at runtime (fail-closed).
// Multiple keys supported for key rotation scenarios.
//
// R101-4 FIX: Build-time assertion ensures insecure-ecdsa-stub is only used in tests.
#[cfg(all(feature = "insecure-ecdsa-stub", not(test)))]
compile_error!(
    "SECURITY: `insecure-ecdsa-stub` feature must only be enabled in test builds. \
     Remove this feature flag from production Cargo.toml to enable real ECDSA verification."
);
#[allow(dead_code)]
const TRUSTED_P256_PUBKEYS_UNCOMPRESSED: &[[u8; 65]] = &[
    [0u8; 65], // Slot 0: Current production key (replace with real key)
    [0u8; 65], // Slot 1: Next key for staged rotation
];

/// Production signature verifier: SHA-256 integrity + ECDSA P-256 authenticity.
///
/// This function performs:
/// 1. Integrity check: Verifies patch_data matches the SHA-256 hash in the header.
/// 2. Authenticity check: Verifies ECDSA-P256(SHA-256(header||patch_data)) signature.
///
/// The verification is KAT-gated: signature checks are disabled until the FIPS
/// Known Answer Test passes (see `ecdsa_p256::ensure_kat()`).
///
/// # Security
///
/// - Fail-closed: Returns ENOSYS if no valid public keys are configured.
/// - Constant-time operations where applicable.
/// - Supports key rotation via multiple trusted keys.
#[cfg(not(feature = "insecure-ecdsa-stub"))]
fn verify_patch_authenticity(img: &PatchImage<'_>) -> Result<(), Errno> {
    // SECURITY: Fail-closed if all trusted public keys are all-zero placeholders.
    if TRUSTED_P256_PUBKEYS_UNCOMPRESSED
        .iter()
        .all(|k| k.iter().all(|&b| b == 0))
    {
        return Err(Errno::ENOSYS);
    }

    // 1) Integrity check: Verify patch_data matches the SHA-256 hash in the header.
    let data_hash = sha256::sha256(img.patch_data);
    if !ct_eq(&data_hash, &img.header.patch_data_sha256) {
        return Err(Errno::EACCES);
    }

    // 2) Authenticity check: Verify ECDSA signature over header||patch_data.
    // The signature covers the concatenation of header and patch_data, prehashed with SHA-256.
    let mut h = sha256::Sha256::new();
    h.update(img.raw_header);
    h.update(img.patch_data);
    let digest = h.finalize();

    // Verify against any trusted public key (key rotation support).
    match ecdsa_p256::verify_prehash_any(TRUSTED_P256_PUBKEYS_UNCOMPRESSED, &digest, img.signature)
    {
        Ok(()) => Ok(()),
        // Invalid signature = access denied (cryptographic verification failed).
        Err(ecdsa_p256::VerifyError::SignatureInvalid)
        | Err(ecdsa_p256::VerifyError::InvalidSignature) => Err(Errno::EACCES),
        // KAT failure / no trusted keys = crypto subsystem unavailable.
        Err(ecdsa_p256::VerifyError::KatFailed)
        | Err(ecdsa_p256::VerifyError::NoTrustedPublicKeys)
        | Err(ecdsa_p256::VerifyError::InvalidPublicKey) => Err(Errno::ENOSYS),
    }
}

/// Insecure development-only verifier. Never enable in production.
#[cfg(feature = "insecure-ecdsa-stub")]
fn verify_patch_authenticity(img: &PatchImage<'_>) -> Result<(), Errno> {
    // R94-2 FIX: Refuse to run with an unconfigured (all-zero) public key.
    if TRUSTED_P256_PUBKEYS_UNCOMPRESSED
        .iter()
        .all(|k| k.iter().all(|&b| b == 0))
    {
        return Err(Errno::ENOSYS);
    }

    // 1) Integrity check: header carries patch_data sha256.
    let data_hash = sha256::sha256(img.patch_data);
    if !ct_eq(&data_hash, &img.header.patch_data_sha256) {
        return Err(Errno::EACCES);
    }

    // 2) Authenticity check: signature over header||patch_data.
    let mut h = sha256::Sha256::new();
    h.update(img.raw_header);
    h.update(img.patch_data);
    let digest = h.finalize();

    #[allow(deprecated)]
    if !verify_ecdsa_p256_sha256_stub(
        &TRUSTED_P256_PUBKEYS_UNCOMPRESSED[0],
        &digest,
        img.signature,
    ) {
        return Err(Errno::EACCES);
    }

    Ok(())
}

/// STUB verifier for ECDSA-P256(SHA-256).
///
/// SECURITY: This is NOT real ECDSA verification and is **not secure**.
/// Replace with a constant-time big-int P-256 verifier before production use.
#[cfg(feature = "insecure-ecdsa-stub")]
#[deprecated(note = "SECURITY: insecure signature stub; do not enable in production")]
fn verify_ecdsa_p256_sha256_stub(
    _pubkey_uncompressed: &[u8; 65],
    digest: &[u8; 32],
    sig_rs: &[u8; 64],
) -> bool {
    // Accept only if r == digest and s == digest (placeholder check).
    ct_eq(&sig_rs[0..32], digest) && ct_eq(&sig_rs[32..64], digest)
}

// ============================================================================
// Public API: register / enable / disable
// ============================================================================

#[derive(Debug)]
struct LoadedPatch {
    target: usize,
    handler: usize,
    exec_addr: usize,
    exec_len: usize,
    /// Dependency metadata extracted from the ZLPM image.
    meta: PatchMeta,
}

fn load_patch_from_bytes(patch_bytes: &[u8]) -> Result<LoadedPatch, Errno> {
    // R94-8 FIX: Enforce MAX_PATCH_BYTES for all callers (not just syscall path).
    if patch_bytes.len() > MAX_PATCH_BYTES {
        return Err(Errno::E2BIG);
    }

    let img = PatchImage::parse(patch_bytes)?;
    verify_patch_authenticity(&img)?;

    // R93-10 FIX: Target must be within the kernel .text section.
    if img.header.target_addr == 0 || !is_kernel_canonical_u64(img.header.target_addr) {
        return Err(Errno::EINVAL);
    }
    let target = img.header.target_addr as usize;
    validate_patch_target(target)?;

    // P1-4 FIX: Extract dependency metadata from the ZLPM image.
    // handler_offset is the byte offset past the dep table within patch_data.
    let (meta, handler_offset) = extract_patch_meta(&img)?;

    let mut exec_addr = 0usize;
    let mut exec_len = 0usize;

    let handler = if img.header.handler_addr != 0 {
        // R93-10 FIX: Explicit handler must be within the kernel .text section.
        if !is_kernel_canonical_u64(img.header.handler_addr) {
            return Err(Errno::EINVAL);
        }
        let h = img.header.handler_addr as usize;
        if !is_in_kernel_text(h) {
            return Err(Errno::EINVAL);
        }
        h
    } else {
        // Handler code is provided by patch_data (after optional dep table).
        let handler_blob = img.patch_data.get(handler_offset..).ok_or(Errno::EINVAL)?;
        if handler_blob.is_empty() {
            return Err(Errno::EINVAL);
        }
        let ops = ops()?;
        let len = handler_blob.len();
        let addr = unsafe { ops.alloc_exec(len)? };
        // R94-4 FIX: Validate allocated address is in kernel space.
        if addr == 0 || !is_kernel_canonical_u64(addr as u64) {
            if addr != 0 {
                unsafe { ops.free_exec(addr, len) };
            }
            return Err(Errno::ENOMEM);
        }
        unsafe {
            core::ptr::copy_nonoverlapping(handler_blob.as_ptr(), addr as *mut u8, len);
            // R94-4: Seal executable region (W^X transition).
            if let Err(e) = ops.seal_exec(addr, len) {
                ops.free_exec(addr, len);
                return Err(e);
            }
        }
        ops.flush_icache(addr, len);
        exec_addr = addr;
        exec_len = len;
        addr
    };

    // R93-10 FIX: Handler must be in kernel .text or within this patch's exec allocation.
    if let Err(e) = validate_patch_handler(handler, exec_addr, exec_len) {
        if exec_len != 0 {
            let ops = ops()?;
            unsafe { ops.free_exec(exec_addr, exec_len) };
        }
        return Err(e);
    }

    Ok(LoadedPatch {
        target,
        handler,
        exec_addr,
        exec_len,
        meta,
    })
}

fn register_loaded_patch(p: &LoadedPatch) -> Result<u64, Errno> {
    let _ = ops()?;
    let table = patch_table();

    // R94-3 FIX: Serialize registration to prevent duplicate-target races.
    let _guard = PATCH_REG_LOCK.lock();
    let mut meta_table = PATCH_META_TABLE.lock();

    // Reject multiple patches to the same target (now race-free under lock).
    // P1-4: Also reject duplicate patch UIDs to ensure UID-based dependency
    // lookup is unambiguous.
    for (idx, slot) in table.iter().enumerate() {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        if st != PatchState::Empty {
            if slot.target.load(Ordering::Acquire) == p.target {
                return Err(Errno::EBUSY);
            }
            // SAFETY: PATCH_REG_LOCK is held.
            if let Some(existing_meta) = meta_table.get(idx).copied().flatten() {
                if ct_eq(&existing_meta.patch_uid, &p.meta.patch_uid) {
                    return Err(Errno::EEXIST);
                }
            }
        }
    }

    for (slot_index, slot) in table.iter().enumerate() {
        if slot
            .state
            .compare_exchange(
                PatchState::Empty as u8,
                PatchState::Loading as u8,
                Ordering::AcqRel,
                Ordering::Acquire,
            )
            .is_ok()
        {
            // P2-8 FIX: Use fetch_update + checked_add for overflow safety.
            // Codex review: if ID exhaustion occurs, we must reset the slot from
            // Loading back to Empty to avoid a stuck-slot state leak.
            let id = match NEXT_PATCH_ID
                .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |id| id.checked_add(1))
            {
                Ok(prev) => prev,
                Err(_) => {
                    slot.state.store(PatchState::Empty as u8, Ordering::Release);
                    return Err(Errno::EOVERFLOW);
                }
            };
            slot.id.store(id, Ordering::Release);
            slot.target.store(p.target, Ordering::Release);
            slot.handler.store(p.handler, Ordering::Release);
            slot.exec_addr.store(p.exec_addr, Ordering::Release);
            slot.exec_len.store(p.exec_len, Ordering::Release);
            slot.orig_valid.store(0, Ordering::Release);
            slot.orig_byte.store(0, Ordering::Release);
            slot.enabled_tsc.store(0, Ordering::Release);
            // P1-4: Store immutable dependency metadata (PATCH_REG_LOCK is held).
            meta_table[slot_index] = Some(p.meta);
            slot.state
                .store(PatchState::Registered as u8, Ordering::Release);
            // R110-3 FIX: Log lifecycle event without raw kernel addresses.
            // R120-2 FIX: Gate address detail behind #[cfg(debug_assertions)]
            // to prevent KASLR leaks in release builds. The address-free line
            // provides sufficient operational information; the structured audit
            // log (emit_livepatch_audit) records addresses separately.
            klog!(
                Info,
                "livepatch: loaded id={} deps={}",
                id,
                p.meta.dep_count
            );
            #[cfg(debug_assertions)]
            klog!(
                Info,
                "livepatch: loaded id={} target={:#x} handler={:#x}",
                id,
                p.target,
                p.handler
            );
            // R121-5 FIX: Redact kernel addresses from audit channel in release
            // builds to prevent KASLR slide recovery via CAP_AUDIT_READ.
            // Audit event is still emitted (preserving audit chain integrity)
            // but with zeroed address fields.
            #[cfg(debug_assertions)]
            emit_livepatch_audit(
                0,
                id,
                p.target as u64,
                [p.handler as u64, p.meta.dep_count as u64, 0],
            );
            #[cfg(not(debug_assertions))]
            emit_livepatch_audit(0, id, 0, [0, p.meta.dep_count as u64, 0]);
            return Ok(id);
        }
    }

    Err(Errno::ENOMEM)
}

/// Register a patch image already present in kernel memory.
pub fn kpatch_register(patch_bytes: &[u8]) -> Result<u64, Errno> {
    let ops = ops()?;
    let loaded = load_patch_from_bytes(patch_bytes)?;
    match register_loaded_patch(&loaded) {
        Ok(id) => Ok(id),
        Err(e) => {
            if loaded.exec_len != 0 {
                unsafe { ops.free_exec(loaded.exec_addr, loaded.exec_len) };
            }
            Err(e)
        }
    }
}

/// Enable a previously loaded patch by id (installs INT3 at target entry).
///
/// P1-4: Before enabling, verifies all declared dependencies are in `Enabled` state.
/// Returns `ENOENT` if a dependency UID is not loaded, `EBUSY` if not yet enabled.
pub fn kpatch_enable(id: u64) -> Result<(), Errno> {
    let _ = ops()?;
    let (slot_index, slot) = find_slot_index_by_id(id).ok_or(Errno::ENOENT)?;

    let prev = loop {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        match st {
            PatchState::Registered | PatchState::Disabled => {
                if slot
                    .state
                    .compare_exchange(
                        st as u8,
                        PatchState::Enabling as u8,
                        Ordering::AcqRel,
                        Ordering::Acquire,
                    )
                    .is_ok()
                {
                    break st;
                }
            }
            PatchState::Enabled => return Ok(()),
            PatchState::Enabling | PatchState::Disabling | PatchState::Loading => {
                return Err(Errno::EBUSY);
            }
            PatchState::Empty => return Err(Errno::ENOENT),
            PatchState::Failed => return Err(Errno::EINVAL),
            PatchState::Retired => return Err(Errno::ENOENT),
        }
    };

    // P1-4: Dependency gate — all declared deps must be Enabled.
    if let Err(e) = check_dependencies(slot_index) {
        slot.state.store(prev as u8, Ordering::Release);
        return Err(e);
    }

    let res = unsafe { install_int3_detour(slot) };
    match res {
        Ok(()) => {
            // Record enable timestamp for rollback policy.
            slot.enabled_tsc.store(read_tsc(), Ordering::Release);
            slot.state
                .store(PatchState::Enabled as u8, Ordering::Release);
            // R110-3 FIX: Avoid raw address in profile-visible output.
            // R120-2 FIX: Gate address detail behind #[cfg(debug_assertions)].
            let target = slot.target.load(Ordering::Acquire);
            klog!(Info, "livepatch: enabled id={}", id);
            #[cfg(debug_assertions)]
            klog!(Info, "livepatch: enabled id={} target={:#x}", id, target);
            // R121-5 FIX: Redact kernel addresses in release builds.
            #[cfg(debug_assertions)]
            emit_livepatch_audit(1, id, target as u64, [0, 0, 0]);
            #[cfg(not(debug_assertions))]
            emit_livepatch_audit(1, id, 0, [0, 0, 0]);
            Ok(())
        }
        Err(e) => {
            slot.enabled_tsc.store(0, Ordering::Release);
            slot.state.store(prev as u8, Ordering::Release);
            Err(e)
        }
    }
}

/// Disable a previously enabled patch by id (restores original first byte).
///
/// P1-4: Before disabling, verifies no `Enabled`/`Enabling` patch depends on this one.
/// Returns `EBUSY` if active dependents exist.
pub fn kpatch_disable(id: u64) -> Result<(), Errno> {
    let _ = ops()?;
    let (slot_index, slot) = find_slot_index_by_id(id).ok_or(Errno::ENOENT)?;

    let prev = loop {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        match st {
            PatchState::Enabled => {
                if slot
                    .state
                    .compare_exchange(
                        PatchState::Enabled as u8,
                        PatchState::Disabling as u8,
                        Ordering::AcqRel,
                        Ordering::Acquire,
                    )
                    .is_ok()
                {
                    break st;
                }
            }
            PatchState::Disabled | PatchState::Registered => return Ok(()),
            PatchState::Enabling | PatchState::Disabling | PatchState::Loading => {
                return Err(Errno::EBUSY);
            }
            PatchState::Empty => return Err(Errno::ENOENT),
            PatchState::Failed => return Err(Errno::EINVAL),
            PatchState::Retired => return Err(Errno::ENOENT),
        }
    };

    // P1-4: Dependent gate — refuse disable while active patches depend on us.
    if let Err(e) = check_no_dependents(slot_index) {
        slot.state.store(prev as u8, Ordering::Release);
        return Err(e);
    }

    let res = unsafe { restore_original_byte(slot) };
    match res {
        Ok(()) => {
            // Clear enable timestamp since patch is no longer active.
            slot.enabled_tsc.store(0, Ordering::Release);
            slot.state
                .store(PatchState::Disabled as u8, Ordering::Release);
            // R110-3 FIX: Avoid raw address in profile-visible output.
            // R120-2 FIX: Gate address detail behind #[cfg(debug_assertions)].
            let target = slot.target.load(Ordering::Acquire);
            klog!(Info, "livepatch: disabled id={}", id);
            #[cfg(debug_assertions)]
            klog!(Info, "livepatch: disabled id={} target={:#x}", id, target);
            // R121-5 FIX: Redact kernel addresses in release builds.
            #[cfg(debug_assertions)]
            emit_livepatch_audit(2, id, target as u64, [0, 0, 0]);
            #[cfg(not(debug_assertions))]
            emit_livepatch_audit(2, id, 0, [0, 0, 0]);
            Ok(())
        }
        Err(e) => {
            slot.state.store(prev as u8, Ordering::Release);
            Err(e)
        }
    }
}

/// R93-13 FIX: Unload a previously disabled patch by id. Executable memory and
/// the historical slot index are quarantined rather than reused.
///
/// P1-4: Before unloading, verifies no `Enabled`/`Enabling` patch depends on this one.
pub fn kpatch_unload(id: u64) -> Result<(), Errno> {
    let ops = ops()?;
    let (slot_index, slot) = find_slot_index_by_id(id).ok_or(Errno::ENOENT)?;
    let target_addr = slot.target.load(Ordering::Acquire);

    // P1-4: Dependent gate — refuse unload while active patches depend on us.
    check_no_dependents(slot_index)?;

    // R93-13 FIX: Require patch be fully disabled before freeing exec memory / clearing state.
    let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
    match st {
        PatchState::Disabled => {}
        PatchState::Registered => {
            // Never-enabled patches can be unloaded directly; transition to Disabled first.
            if slot
                .state
                .compare_exchange(
                    PatchState::Registered as u8,
                    PatchState::Disabled as u8,
                    Ordering::AcqRel,
                    Ordering::Acquire,
                )
                .is_err()
            {
                return Err(Errno::EBUSY);
            }
        }
        _ => return Err(Errno::EBUSY),
    }

    // Block concurrent enable/disable by moving to a busy state while we tear down.
    if slot
        .state
        .compare_exchange(
            PatchState::Disabled as u8,
            PatchState::Loading as u8,
            Ordering::AcqRel,
            Ordering::Acquire,
        )
        .is_err()
    {
        return Err(Errno::EBUSY);
    }

    let exec_addr = slot.exec_addr.swap(0, Ordering::AcqRel);
    let exec_len = slot.exec_len.swap(0, Ordering::AcqRel);

    // R103-2 FIX: Quiescence barrier before retiring handler memory.
    //
    // After kpatch_disable restores the original instruction, no NEW breakpoint
    // dispatches can start for this slot. However, a CPU that was already inside
    // `breakpoint_dispatch` may have loaded `slot.handler` and is about to (or
    // has already) rewritten its stack frame's RIP to point into the handler blob.
    //
    // Step 1: IPI + serializing barrier — ensures every CPU has retired any
    //         in-progress breakpoint_dispatch that read the old handler address.
    // Step 2 used to spin on `in_flight` and trust a signed handler to call a
    // return hook.  That is not a valid safety boundary: malformed-but-validly
    // signed code can omit the hook forever.  The executable region is now
    // quarantined, so this barrier is advisory only and unload never depends
    // on handler cooperation.
    ops.sync_cores();

    // R188-U43-3 FIX: never free a blob whose lifetime could still be observed
    // by a redirected interrupt frame.  If the bounded quarantine is full,
    // restore the slot and fail closed; no state or allocation is lost.
    if !quarantine_exec(exec_addr, exec_len) {
        slot.exec_addr.store(exec_addr, Ordering::Release);
        slot.exec_len.store(exec_len, Ordering::Release);
        slot.state
            .store(PatchState::Disabled as u8, Ordering::Release);
        return Err(Errno::EBUSY);
    }

    slot.id.store(0, Ordering::Release);
    slot.target.store(0, Ordering::Release);
    slot.handler.store(0, Ordering::Release);
    slot.orig_valid.store(0, Ordering::Release);
    slot.orig_byte.store(0, Ordering::Release);
    slot.enabled_tsc.store(0, Ordering::Release);
    // Do not reset `in_flight`: a handler that was redirected before the
    // quiescence barrier may still execute its late return hook.  The slot is
    // retired below, so that hook is ignored instead of decrementing a new
    // generation's counter.

    // P1-4: Clear dependency metadata BEFORE advertising the slot as Empty.
    //
    // CRITICAL ORDERING: We must hold PATCH_REG_LOCK across both metadata
    // clear and the Empty transition. Otherwise, a concurrent register_loaded_patch
    // could claim the slot (sees Empty) and store new metadata, which we would
    // then overwrite with None.
    {
        let _guard = PATCH_REG_LOCK.lock();
        let mut meta_table = PATCH_META_TABLE.lock();
        meta_table[slot_index] = None;
        // Do not make a slot carrying quarantined executable code reusable.
        // A late signed-handler callback only has the historical slot index;
        // retaining a terminal state prevents cross-generation accounting
        // corruption.  The bounded table therefore fails closed once all
        // slots have been retired.
        slot.state
            .store(PatchState::Retired as u8, Ordering::Release);
    }

    // `exec_addr/exec_len` are intentionally retained in RETIRED_EXEC.  They
    // may only be reclaimed by a stop-the-world teardown that can prove no
    // redirected frame remains; ordinary unload has no such proof.

    // R110-3 FIX: Avoid raw address in profile-visible output.
    // R120-2 FIX: Gate address detail behind #[cfg(debug_assertions)].
    klog!(Info, "livepatch: unloaded id={}", id);
    #[cfg(debug_assertions)]
    klog!(
        Info,
        "livepatch: unloaded id={} target={:#x}",
        id,
        target_addr
    );
    // R121-5 FIX: Redact kernel addresses in release builds.
    #[cfg(debug_assertions)]
    emit_livepatch_audit(3, id, target_addr as u64, [0, 0, 0]);
    #[cfg(not(debug_assertions))]
    emit_livepatch_audit(3, id, 0, [0, 0, 0]);
    Ok(())
}

// ============================================================================
// INT3 detour plumbing
// ============================================================================

unsafe fn install_int3_detour(slot: &PatchSlot) -> Result<(), Errno> {
    let ops = ops()?;
    // R94-5 FIX: Serialize text patching to avoid concurrent page-permission conflicts.
    let _guard = TEXT_PATCH_LOCK.lock();
    let target = slot.target.load(Ordering::Acquire);

    // R93-12 FIX: Validate target is within mapped kernel .text before dereferencing.
    validate_patch_target(target)?;

    unsafe { ops.make_text_writable(target, 1)? };

    // Read current byte at target address.
    let current = unsafe { core::ptr::read_volatile(target as *const u8) };
    if current == INT3 {
        unsafe { ops.make_text_readonly(target, 1) };
        return Err(Errno::EBUSY);
    }

    // Capture original byte once; on re-enable, verify text hasn't changed unexpectedly.
    if slot.orig_valid.load(Ordering::Acquire) == 0 {
        slot.orig_byte.store(current, Ordering::Release);
        slot.orig_valid.store(1, Ordering::Release);
    } else {
        let orig = slot.orig_byte.load(Ordering::Acquire);
        if current != orig {
            unsafe { ops.make_text_readonly(target, 1) };
            return Err(Errno::EBUSY);
        }
    }

    // Atomic single-byte write for SMP safety.
    unsafe { atomic_write_u8(target, INT3) };

    ops.flush_icache(target, 1);
    ops.sync_cores();

    unsafe { ops.make_text_readonly(target, 1) };
    Ok(())
}

unsafe fn restore_original_byte(slot: &PatchSlot) -> Result<(), Errno> {
    let ops = ops()?;
    // R94-5 FIX: Serialize text patching.
    let _guard = TEXT_PATCH_LOCK.lock();
    // Normal path: sync cores after restoration.
    unsafe { restore_original_byte_inner(slot, ops, true) }
}

/// Inner implementation of original byte restoration.
///
/// # Arguments
///
/// * `slot` - The patch slot to restore.
/// * `ops` - Kernel operations provider.
/// * `sync_cores` - Whether to call sync_cores() after restoration.
///   Set to `false` in panic paths where other CPUs may be wedged.
///
/// # Safety
///
/// Caller must hold TEXT_PATCH_LOCK.
unsafe fn restore_original_byte_inner(
    slot: &PatchSlot,
    ops: &dyn KernelOps,
    sync_cores: bool,
) -> Result<(), Errno> {
    let target = slot.target.load(Ordering::Acquire);

    // R93-12 FIX: Validate target is within mapped kernel .text before dereferencing.
    validate_patch_target(target)?;

    if slot.orig_valid.load(Ordering::Acquire) == 0 {
        return Err(Errno::EINVAL);
    }
    let orig = slot.orig_byte.load(Ordering::Acquire);

    unsafe { ops.make_text_writable(target, 1)? };

    // R94-5: Verify current byte is still INT3 before restoring
    // (defends against double-disable or external text modification).
    let current = unsafe { core::ptr::read_volatile(target as *const u8) };
    if current != INT3 {
        unsafe { ops.make_text_readonly(target, 1) };
        return Err(Errno::EINVAL);
    }

    unsafe { atomic_write_u8(target, orig) };

    ops.flush_icache(target, 1);
    if sync_cores {
        ops.sync_cores();
    }

    unsafe { ops.make_text_readonly(target, 1) };
    Ok(())
}

#[inline]
unsafe fn atomic_write_u8(addr: usize, value: u8) {
    let p = addr as *mut AtomicU8;
    (*p).store(value, Ordering::SeqCst);
}

// ============================================================================
// #BP handler / dispatch
// ============================================================================

/// Fast-path dispatch for breakpoint exceptions.
///
/// Returns `true` if the breakpoint was a livepatch INT3 and `RIP` was rewritten.
///
/// # Safety
/// This function modifies the stack frame's instruction pointer through raw pointer
/// manipulation. It must only be called from a breakpoint exception handler context.
///
/// # R102-L4: State Machine Safety Invariant
///
/// The handler/exec memory referenced by `slot.handler` is valid IFF the patch is in
/// `Enabled` or `Enabling` state (`is_bp_active() == true`). The following invariants
/// MUST be maintained by the state transition logic:
///
/// 1. **Enabling → Enabled**: INT3 is written to target; handler memory is live.
///    `breakpoint_dispatch` may redirect RIP to handler.
/// 2. **Enabled → Disabling**: INT3 is replaced with original byte; handler memory
///    is still live (in-flight dispatches may still be executing handler code).
/// 3. **Disabling → Disabled**: Full IPI synchronization prevents new stale
///    dispatcher reads, but already-redirected signed code may still run.
/// 4. **Disabled → Retired**: executable memory and the slot index are
///    quarantined permanently; ordinary unload never frees/reuses either.
///
/// **Critical**: `kpatch_unload` never frees exec memory and never reuses its
/// slot, because a concurrent `breakpoint_dispatch` may already have redirected
/// RIP and the signed handler is not trusted to cooperate with reclamation.
pub fn breakpoint_dispatch(stack_frame: &mut InterruptStackFrame) -> bool {
    let table = match patch_table_get() {
        Some(t) => t,
        None => return false,
    };

    // For INT3, the CPU-pushed RIP points to the next instruction,
    // so the actual INT3 address is RIP-1.
    let rip = stack_frame.instruction_pointer.as_u64() as usize;
    if rip == 0 {
        return false;
    }
    let hit = rip.wrapping_sub(1);

    for slot in table.iter() {
        let st = PatchState::from_u8(slot.state.load(Ordering::Acquire));
        if !st.is_bp_active() {
            continue;
        }
        if slot.target.load(Ordering::Acquire) != hit {
            continue;
        }

        let handler = slot.handler.load(Ordering::Acquire);
        if handler == 0 {
            return false;
        }

        // R103-2 FIX: Track in-flight dispatches for diagnostics and cooperative
        // handlers. Reclamation is independently protected by retirement.
        if slot
            .in_flight
            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |count| {
                count.checked_add(1)
            })
            .is_err()
        {
            // Saturation is fail-closed: do not redirect another frame when
            // the lifetime accounting cannot represent it.
            return false;
        }

        // Rewrite RIP to patch handler using Volatile::update().
        // The x86_64 crate's InterruptStackFrame wraps the value in Volatile
        // to prevent optimizations that could break exception handling.
        //
        // NOTE: A cooperative handler may call `kpatch_handler_return`, but
        // unload does not trust that call for memory or slot lifetime safety.
        unsafe {
            stack_frame.as_mut().update(|frame| {
                frame.instruction_pointer = VirtAddr::new(handler as u64);
            });
        }
        return true;
    }
    false
}

/// R103-2 FIX: Decrement the in-flight dispatch counter for a patch slot.
///
/// May be called by cooperative livepatch handler epilogues to signal that the
/// handler has finished executing. Unload safety does not depend on the hook.
///
/// # Arguments
///
/// * `slot_index` - Index into the patch table (0-based)
///
/// # Safety
///
/// Calling with an out-of-bounds index is a no-op (silently ignored).
pub fn kpatch_handler_return(slot_index: usize) {
    if let Some(table) = patch_table_get() {
        if let Some(slot) = table.get(slot_index) {
            let state = PatchState::from_u8(slot.state.load(Ordering::Acquire));
            if matches!(state, PatchState::Empty | PatchState::Retired) {
                // The callback belongs to an unloaded generation.  Retired
                // slots are never reused, so ignoring it is both safe and
                // deterministic.
                return;
            }
            let _ = slot
                .in_flight
                .fetch_update(Ordering::AcqRel, Ordering::Acquire, |count| {
                    count.checked_sub(1)
                });
        }
    }
}

/// A ready-to-install #BP handler for livepatch.
pub extern "x86-interrupt" fn kpatch_breakpoint_handler(mut stack_frame: InterruptStackFrame) {
    let _ = breakpoint_dispatch(&mut stack_frame);
}

// ============================================================================
// Syscall entry points (CAP_ADMIN required)
// ============================================================================

/// sys_kpatch_load (509): Load patch from userspace buffer.
pub fn sys_kpatch_load(user_ptr: usize, len: usize) -> i64 {
    match do_sys_kpatch_load(user_ptr, len) {
        Ok(id) => id as i64,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_load(user_ptr: usize, len: usize) -> Result<u64, Errno> {
    let ops = ops()?;
    let _ = patch_table();

    // R102-13 FIX: Authorization gate for livepatch operations.
    //
    // SECURITY: `is_privileged()` MUST check euid == 0 AND an equivalent of
    // CAP_SYS_MODULE. Livepatch load redirects arbitrary kernel functions,
    // making it the most powerful privilege escalation vector if mis-gated.
    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }
    // R102-13 FIX: LSM policy check — the implementor delegates to lsm::hook_kpatch_load().
    ops.check_lsm_kpatch_load(len)?;

    if user_ptr == 0 {
        return Err(Errno::EFAULT);
    }

    if len > MAX_PATCH_BYTES {
        return Err(Errno::E2BIG);
    }
    if len < PATCH_HEADER_LEN + PATCH_SIGNATURE_LEN {
        return Err(Errno::EINVAL);
    }

    // R94-7 FIX: Defense-in-depth — reject user_ptr+len overflow.
    if user_ptr.checked_add(len).is_none() {
        return Err(Errno::EFAULT);
    }

    // LOW-17 FIX: Reserve fallibly before resizing to return ENOMEM instead of panic.
    //
    // SAFETY (Safety > Efficiency): Privileged livepatch operation under memory pressure
    // should fail gracefully with errno, not kernel panic. len is bounded by MAX_PATCH_BYTES
    // (64 KiB), so this allocation is bounded and safe.
    let mut buf = Vec::new();
    buf.try_reserve_exact(len).map_err(|_| Errno::ENOMEM)?;
    buf.resize(len, 0);
    unsafe { ops.copy_from_user(buf.as_mut_ptr(), user_ptr, len)? };

    let loaded = load_patch_from_bytes(&buf)?;
    match register_loaded_patch(&loaded) {
        Ok(id) => Ok(id),
        Err(e) => {
            if loaded.exec_len != 0 {
                unsafe { ops.free_exec(loaded.exec_addr, loaded.exec_len) };
            }
            Err(e)
        }
    }
}

/// sys_kpatch_enable (510): Activate a loaded patch.
pub fn sys_kpatch_enable(patch_id: u64) -> i64 {
    match do_sys_kpatch_enable(patch_id) {
        Ok(()) => 0,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_enable(patch_id: u64) -> Result<(), Errno> {
    let ops = ops()?;
    let _ = patch_table();

    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }
    // R102-13 FIX: LSM policy check.
    ops.check_lsm_kpatch_enable(patch_id)?;
    kpatch_enable(patch_id)
}

/// sys_kpatch_disable (511): Deactivate a patch (rollback).
pub fn sys_kpatch_disable(patch_id: u64) -> i64 {
    match do_sys_kpatch_disable(patch_id) {
        Ok(()) => 0,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_disable(patch_id: u64) -> Result<(), Errno> {
    let ops = ops()?;
    let _ = patch_table();

    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }
    // R102-13 FIX: LSM policy check.
    ops.check_lsm_kpatch_disable(patch_id)?;
    kpatch_disable(patch_id)
}

/// sys_kpatch_unload (512): Unload a disabled patch and free any exec allocations.
pub fn sys_kpatch_unload(patch_id: u64) -> i64 {
    match do_sys_kpatch_unload(patch_id) {
        Ok(()) => 0,
        Err(e) => e.as_i64(),
    }
}

fn do_sys_kpatch_unload(patch_id: u64) -> Result<(), Errno> {
    let ops = ops()?;
    let _ = patch_table();

    if !ops.is_privileged() {
        return Err(Errno::EPERM);
    }
    // R102-13 FIX: LSM policy check.
    ops.check_lsm_kpatch_unload(patch_id)?;
    kpatch_unload(patch_id)
}

// ============================================================================
// Helpers
// ============================================================================

#[inline]
fn read_le_u16(buf: &[u8], off: usize) -> Result<u16, Errno> {
    let b: [u8; 2] = read_bytes(buf, off)?;
    Ok(u16::from_le_bytes(b))
}

#[inline]
fn read_le_u32(buf: &[u8], off: usize) -> Result<u32, Errno> {
    let b: [u8; 4] = read_bytes(buf, off)?;
    Ok(u32::from_le_bytes(b))
}

#[inline]
fn read_le_u64(buf: &[u8], off: usize) -> Result<u64, Errno> {
    let b: [u8; 8] = read_bytes(buf, off)?;
    Ok(u64::from_le_bytes(b))
}

#[inline]
fn read_bytes<const N: usize>(buf: &[u8], off: usize) -> Result<[u8; N], Errno> {
    let end = off.checked_add(N).ok_or(Errno::EINVAL)?;
    if end > buf.len() {
        return Err(Errno::EINVAL);
    }
    let out: [u8; N] = buf[off..end].try_into().map_err(|_| Errno::EINVAL)?;
    Ok(out)
}

#[inline]
fn ct_eq(a: &[u8], b: &[u8]) -> bool {
    if a.len() != b.len() {
        return false;
    }
    let mut diff = 0u8;
    for i in 0..a.len() {
        diff |= a[i] ^ b[i];
    }
    diff == 0
}

#[inline]
fn is_canonical_u64(addr: u64) -> bool {
    let sign = (addr >> 47) & 1;
    let upper = addr >> 48;
    if sign == 0 {
        upper == 0
    } else {
        upper == 0xFFFF
    }
}

/// R94-4 FIX: Require address to be in kernel high-half (bit 63 set + canonical).
#[inline]
fn is_kernel_canonical_u64(addr: u64) -> bool {
    is_canonical_u64(addr) && ((addr >> 63) != 0)
}

// ============================================================================
// R93-10/R93-12: Kernel .text bounds validation
// ============================================================================

// R93-10/R93-12: Kernel .text bounds (from linker script) for address validation.
#[cfg(target_os = "none")]
extern "C" {
    // Defined by kernel/kernel.ld
    static text_start: u8;
    static text_end: u8;
}

// Hosted unit tests do not link the bare-metal kernel linker script.  Provide
// inert section markers so validation tests can execute without unresolved
// kernel image symbols; the production build continues to use the real
// linker-provided bounds.
#[cfg(not(target_os = "none"))]
static text_start: u8 = 0;
#[cfg(not(target_os = "none"))]
static text_end: u8 = 0;

#[inline]
fn kernel_text_bounds() -> (usize, usize) {
    let start = core::ptr::addr_of!(text_start) as usize;
    let end = core::ptr::addr_of!(text_end) as usize;
    (start, end)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn unsupported_syscalls_fail_before_usercopy_or_patch_state() {
        struct DisabledOps;
        impl KernelOps for DisabledOps {
            fn is_privileged(&self) -> bool {
                panic!("disabled hook called")
            }
            unsafe fn copy_from_user(&self, _: *mut u8, _: usize, _: usize) -> Result<(), Errno> {
                panic!("disabled hook called")
            }
            unsafe fn alloc_exec(&self, _: usize) -> Result<usize, Errno> {
                panic!("disabled hook called")
            }
            unsafe fn seal_exec(&self, _: usize, _: usize) -> Result<(), Errno> {
                panic!("disabled hook called")
            }
            unsafe fn free_exec(&self, _: usize, _: usize) {
                panic!("disabled hook called")
            }
            unsafe fn make_text_writable(&self, _: usize, _: usize) -> Result<(), Errno> {
                panic!("disabled hook called")
            }
            unsafe fn make_text_readonly(&self, _: usize, _: usize) {
                panic!("disabled hook called")
            }
            fn sync_cores(&self) {
                panic!("disabled hook called")
            }
            fn flush_icache(&self, _: usize, _: usize) {
                panic!("disabled hook called")
            }
        }
        assert!(!SUPPORTED);
        assert!(matches!(init(&DisabledOps), Err(Errno::ENOSYS)));
        assert_eq!(
            sys_kpatch_load(usize::MAX, usize::MAX),
            Errno::ENOSYS.as_i64()
        );
        assert_eq!(sys_kpatch_enable(u64::MAX), Errno::ENOSYS.as_i64());
        assert_eq!(sys_kpatch_disable(u64::MAX), Errno::ENOSYS.as_i64());
        assert_eq!(sys_kpatch_unload(u64::MAX), Errno::ENOSYS.as_i64());
        assert_eq!(sys_kpatch_enable_all(), Errno::ENOSYS.as_i64());
        assert_eq!(sys_kpatch_disable_all(), Errno::ENOSYS.as_i64());
        assert!(matches!(kpatch_register(&[]), Err(Errno::ENOSYS)));
        assert!(matches!(kpatch_enable(u64::MAX), Err(Errno::ENOSYS)));
        assert!(matches!(kpatch_disable(u64::MAX), Err(Errno::ENOSYS)));
        assert!(matches!(kpatch_unload(u64::MAX), Err(Errno::ENOSYS)));
        assert!(patch_state(u64::MAX).is_none());
        assert!(KERNEL_OPS.get().is_none());
        assert!(PATCH_TABLE.get().is_none());
    }

    #[test]
    fn r188_retired_state_is_terminal_and_round_trips() {
        assert_eq!(
            PatchState::from_u8(PatchState::Retired as u8),
            PatchState::Retired
        );
        assert_eq!(PatchState::from_u8(0xff), PatchState::Failed);
    }

    #[test]
    fn r188_retired_exec_quarantine_deduplicates_regions() {
        let before = RETIRED_EXEC
            .lock()
            .iter()
            .filter(|entry| entry.is_some())
            .count();
        assert!(quarantine_exec(0x1000_0000, 0x1000));
        assert!(quarantine_exec(0x1000_0000, 0x1000));
        let after = RETIRED_EXEC
            .lock()
            .iter()
            .filter(|entry| entry.is_some())
            .count();
        assert_eq!(after, before + 1);
    }
}

/// R93-10 FIX: Check if address is within kernel .text section.
#[inline]
fn is_in_kernel_text(addr: usize) -> bool {
    let (start, end) = kernel_text_bounds();
    start != 0 && start < end && addr >= start && addr < end
}

/// R93-10 FIX: Check if address is within a patch's exec allocation.
#[inline]
fn is_in_exec_alloc(addr: usize, exec_addr: usize, exec_len: usize) -> bool {
    if exec_addr == 0 || exec_len == 0 {
        return false;
    }
    match exec_addr.checked_add(exec_len) {
        Some(end) => addr >= exec_addr && addr < end,
        None => false,
    }
}

/// R93-10/R93-12 FIX: Validate patch target is within mapped kernel .text.
#[inline]
fn validate_patch_target(target: usize) -> Result<(), Errno> {
    // Target must always be within mapped kernel .text.
    if target == 0 || !is_kernel_canonical_u64(target as u64) || !is_in_kernel_text(target) {
        return Err(Errno::EINVAL);
    }
    Ok(())
}

/// R93-10 FIX: Validate handler is in kernel .text or within this patch's exec allocation.
#[inline]
fn validate_patch_handler(handler: usize, exec_addr: usize, exec_len: usize) -> Result<(), Errno> {
    // Handler must be in kernel .text or within this patch's approved exec allocation.
    if handler == 0 || !is_kernel_canonical_u64(handler as u64) {
        return Err(Errno::EINVAL);
    }
    if is_in_kernel_text(handler) || is_in_exec_alloc(handler, exec_addr, exec_len) {
        return Ok(());
    }
    Err(Errno::EINVAL)
}

// ============================================================================
// Minimal SHA-256 (no_std)
// ============================================================================

// R148-I9 FIX: Use shared crypto crate instead of duplicate SHA-256 implementation.
// The previous inline `mod sha256` has been replaced by the canonical implementation
// in the `crypto` crate, ensuring both livepatch and audit use the same KAT-validated
// code path.
mod sha256 {
    pub use crypto::sha256::Sha256;

    /// Convenience function matching the original API.
    pub fn sha256(data: &[u8]) -> [u8; 32] {
        Sha256::digest(data)
    }
}