//! The big kernel lock (BKL) — the coarse mutual exclusion that lets more than one
//! CPU run kernel code safely.
//!
//! Until SMP, the kernel's mutual exclusion *was* the interrupt flag: a critical
//! section did `cli`, and since only one core existed, nothing else could touch
//! kernel state (the discipline in docs/scheduling.md). That invariant dies the
//! instant a second core runs kernel code — `cli` on one core does nothing to
//! another. So the kernel's shared state (the scheduler queues, IPC channels) is
//! guarded by a spinlock, and the lock is **always held with local interrupts
//! disabled**, so a core's own timer interrupt can't re-enter the kernel and
//! deadlock against the lock it already holds.
//!
//! This is deliberately *one coarse lock*, not many fine ones: it's philosophically
//! aligned with a tiny kernel and it keeps the single-core correctness model
//! (docs/scheduling.md) largely intact — one lock around kernel entry instead of
//! rethinking every critical section. It's the first-design choice seL4 makes and
//! docs/smp.md endorses; per-core run queues + fine-grained locking come later, if
//! contention ever bites. Because the kernel does little, the lock is held briefly.
//!
//! **The hand-off rule.** The lock is held *across* a context switch and released
//! by whichever task resumes, not by the one that switched away. A task that blocks
//! or yields calls `enter`, mutates the queues, `schedule()`s — switching to another
//! task *with the lock still held* — and only calls `leave` once it is eventually
//! resumed and its critical section runs to the end. So every call into `schedule()`
//! (and thus `switch_context`) happens with the lock held, and every task resumes
//! from a switch holding it. A freshly-spawned task has no `enter`/`leave` frame to
//! resume into, so `task_trampoline` releases the lock explicitly on its behalf via
//! `releaseForFreshTask` before running the task body.

const std = @import("std");
const architecture = @import("architecture");

/// 0 = free, 1 = held. A single global lock for the whole kernel.
var held = std.atomic.Value(u32).init(0);

/// Enter the kernel: disable interrupts on this core, then spin until we own the
/// lock. Returns the caller's prior interrupt flags for `leave` to restore.
/// Interrupts stay off for the whole critical section so this core's timer tick
/// can't try to re-acquire the lock we're holding.
pub fn enter() u64 {
    const flags = architecture.saveInterrupts();
    acquire();
    return flags;
}

/// Release the lock and restore the interrupt flags `enter` returned (re-enabling
/// interrupts only if they were on beforehand). The normal exit for a critical
/// section reached from task context (`yield`, `sleep`, `wait`, `wake`, IPC).
pub fn leave(flags: u64) void {
    release();
    architecture.restoreInterrupts(flags);
}

/// Release the lock but leave interrupts as they are. The exit for a critical
/// section running inside an interrupt handler (the timer `tick`): the handler's
/// `iretq` is what restores the interrupted context's flags, so restoring them
/// here too would open a nested-interrupt window before the return. Release only.
pub fn leaveIsr() void {
    release();
}

/// Release the lock on behalf of a freshly-spawned task. Such a task is switched to
/// (with the lock held) but has no `enter`/`leave` frame of its own to release
/// through — `task_trampoline` calls this before running the task body. Interrupts
/// are enabled separately by the trampoline. Exported for the assembly trampoline.
export fn releaseForFreshTask() callconv(.c) void {
    release();
}

fn acquire() void {
    // Test-and-test-and-set: try once, then spin read-only until the lock looks
    // free before retrying the (bus-locked) swap — cheaper on the coherency fabric.
    while (held.swap(1, .acquire) != 0) {
        while (held.load(.monotonic) != 0) architecture.cpuRelax();
    }
}

fn release() void {
    held.store(0, .release);
}