// Kernel entry point. This file connects boot information to core subsystem initialization and scheduler start.

#include <stdbool.h>
#include <stdint.h>
#include <ntlite/bootstrap_capabilities.h>
#include <string.h>
#include <intrin.h>
#pragma intrinsic(_disable)
#include <ntlite/boot_info.h>
#include <ntlite/syscall.h>
#include <kernel/ke_hal.h>
#include <kernel/mm_phys.h>
#include <kernel/mm_pfn.h>
#include <kernel/mm_virt.h>
#include <kernel/mm_swap.h>
#include <kernel/ob_object.h>
#include <kernel/ke_process.h>
#include <kernel/ke_power.h>
#include <kernel/ke_firmware.h>
#include <kernel/mm_file_cache.h>
#include <kernel/ke_thread.h>
#include <kernel/ke_sched.h>
#include <kernel/ke_cpu.h>
#include <kernel/ke_idt.h>
#include <kernel/ke_irq.h>
#include <kernel/ke_dpc.h>
#include <kernel/ke_syscall.h>
#include <ntlite/ddi/net_device.h>
#include <kernel/ke_debug.h>
#include <kernel/ldr_image.h>
#include <kernel/driver_module.h>
#include <kernel/io_pnp.h>
#include <kernel/dm_config.h>
#include <kernel/hal/hal_api.h>
#include <kernel/io_file.h>
#include <kernel/io_volume.h>
#include <kernel/io_partition.h>
#include <kernel/io_ddk.h>
#include <kernel/ke_selftest.h>
#include <kernel/ke_smp.h>
#include <kernel/ke_input.h>
#include <kernel/ke_time.h>
#include <kernel/ke_display.h>
#include <kernel/ke_audio.h>
#include <kernel/ke_settings.h>
#include <kernel/ke_work.h>
#include <kernel/ke_event.h>
#include <ntlite/atomic.h>
#include <kernel/ke_system_root.h>
#include <kernel/se_security.h>
#include <kernel/ke_system_service.h>
#include <kernel/ke_boot_config.h>

typedef struct {
    BOOT_INFO* BootInfo;
    const HAL_API* Hal;
    KE_BOOT_CONFIG BootConfig;
} SYSTEM_INIT_ARGS;

#define KI_SWAP_MIN_MB 4ull
#define KI_SWAP_MAX_MB 8192ull

// Parses a required unsigned decimal integer from settings.ini.
// Configuration errors are treated as boot-time corruption instead of guessed defaults.
static uint64_t KiParseRequiredUInt64Setting(const char* section, const char* key) {
    char value[64];
    KSTATUS s = KeGetSettingString(section, key, value, sizeof(value));
    if (!KSUCCESS(s)) {
        KePanic(KE_PANIC_CODE_INIT,
                "settings: missing required [%s] %s entry, status=0x%x\n",
                section,
                key,
                s);
    }

    uint64_t result = 0;
    const char* p = value;
    if (!*p) {
        KePanic(KE_PANIC_CODE_INIT,
                "settings: empty numeric value for [%s] %s\n",
                section,
                key);
    }

    while (*p) {
        if (*p < '0' || *p > '9') {
            KePanic(KE_PANIC_CODE_INIT,
                    "settings: invalid numeric value for [%s] %s: %s\n",
                    section,
                    key,
                    value);
        }

        uint64_t digit = (uint64_t)(*p - '0');
        if (result > (UINT64_MAX - digit) / 10ull) {
            KePanic(KE_PANIC_CODE_INIT,
                    "settings: numeric value for [%s] %s is too large: %s\n",
                    section,
                    key,
                    value);
        }

        result = result * 10ull + digit;
        ++p;
    }

    return result;
}

// Initializes swap according to settings.ini.
// A size of zero is the explicit opt-out. Any missing or invalid size is a broken configuration.
static void KiInitializeSwapFromSettings(void) {
    uint64_t swapMb = KiParseRequiredUInt64Setting("vm", "swap_size_mb");
    if (swapMb == 0) {
        DbgPrint("swap: disabled by settings\n");
        return;
    }

    if (swapMb < KI_SWAP_MIN_MB || swapMb > KI_SWAP_MAX_MB) {
        KePanic(KE_PANIC_CODE_INIT,
                "settings: [vm] swap_size_mb=%llu is outside the allowed range %llu..%llu MB\n",
                (unsigned long long)swapMb,
                (unsigned long long)KI_SWAP_MIN_MB,
                (unsigned long long)KI_SWAP_MAX_MB);
    }

    uint64_t swapBytes = swapMb * 1024ull * 1024ull;
    KSTATUS s = MmSwapInitialize("pagefile.sys", swapBytes);
    if (!KSUCCESS(s)) {
        KePanic(KE_PANIC_CODE_INIT,
                "swap: failed to initialize %llu MB system-root pagefile, status=0x%x\n",
                (unsigned long long)swapMb,
                s);
    }
}

// HAL pointer cached at boot for subsystems that still need platform services.
static const HAL_API* gKmainHal;

static bool KiPageInBootloaderRegion(const BOOT_INFO* bootInfo, PHYSICAL_ADDRESS page) {
    for (uint32_t i = 0; i < bootInfo->MemoryMap.RegionCount; i++) {
        const MEMORY_REGION* r = &bootInfo->MemoryMap.Regions[i];
        if (r->Type != MemoryBootloader) continue;

        uintptr_t start = r->Base & PAGE_MASK;
        uintptr_t end   = (r->Base + r->Length + PAGE_SIZE - 1) & PAGE_MASK;
        if ((uintptr_t)page >= start && (uintptr_t)page < end) {
            return true;
        }
    }
    return false;
}

// Reclaims one exact page-backed blob after its boot consumer has copied or materialized it.
static void KiReclaimBootBlob(const BOOT_INFO* bootInfo, uintptr_t physicalBase, uint32_t pageCount) {
    for (uint32_t index = 0; index < pageCount; ++index) {
        PHYSICAL_ADDRESS page = (PHYSICAL_ADDRESS)(physicalBase + (uintptr_t)index * PAGE_SIZE);
        if (KiPageInBootloaderRegion(bootInfo, page))
            MmPfnFree(page);
    }
}

// Reclaims raw boot-driver/configuration pages while leaving mapped kernel/HAL/page-table memory owned by bootstrap state.
static void KiReclaimBootloaderMemory(const BOOT_INFO* bootInfo) {
    const BOOT_FILE_LIST* list = &bootInfo->BootDrivers;
    const BOOT_FILE* files = list->FilesPhysical
        ? (const BOOT_FILE*)(bootInfo->PhysicalMapBase + list->FilesPhysical)
        : NULL;

    for (uint32_t index = 0; files && index < list->Count; ++index) {
        if (files[index].PhysicalBase && files[index].PageCount)
            KiReclaimBootBlob(bootInfo, files[index].PhysicalBase, files[index].PageCount);
    }

    if (list->FilesPhysical && list->PageCount)
        KiReclaimBootBlob(bootInfo, list->FilesPhysical, list->PageCount);
    if (bootInfo->BootIni.PhysicalBase && bootInfo->BootIni.PageCount)
        KiReclaimBootBlob(bootInfo, bootInfo->BootIni.PhysicalBase, bootInfo->BootIni.PageCount);
    if (bootInfo->DriversIni.PhysicalBase && bootInfo->DriversIni.PageCount)
        KiReclaimBootBlob(bootInfo, bootInfo->DriversIni.PhysicalBase, bootInfo->DriversIni.PageCount);
}

// Runs the shared module prepare/publication sequence for both image sources.
static KSTATUS KiStartLoadedDriver(const DM_DRIVER_CONFIG* driver, uintptr_t base) {
    KSTATUS status = LdrResolveImports(base);
    LDR_KERNEL_MODULE* reservation = (LDR_KERNEL_MODULE*)0;
    bool canReleaseImage = true;
    if (KSUCCESS(status))
        status = LdrRegisterModule(driver->Image, base, &reservation);
    if (KSUCCESS(status)) status = DmPrepareLoadedDriver(driver->Id, base, &canReleaseImage);
    if (KSUCCESS(status)) {
        DmCommitLoadedDriver(base, reservation);
        return NTLSTATUS_SUCCESS;
    }
    LdrDiscardModule(reservation);
    if (canReleaseImage) LdrReleaseKernelImage(base);
    else DbgPrint("driver: failed image retained for callback lifetime %s\n", driver->Image);
    return status;
}

// Loads a runtime image from the selected system root, keeping PE identity separate
// from the configured module id used for lifecycle and dependency accounting.
static KSTATUS KiLoadRuntimeDriver(const DM_DRIVER_CONFIG* driver) {
    char relative[DM_IMAGE_MAX + 8u];
    size_t length = strlen(driver->Image);
    memcpy(relative, "drivers/", 8);
    memcpy(relative + 8, driver->Image, length + 1);
    FILE_OBJECT* file = NULL;
    KSTATUS status = KeOpenSystemRootFile(relative, &file);
    if (!KSUCCESS(status)) return status;

    uint64_t size = IoGetFileSize(file);
    if (!size || size > SIZE_MAX) {
        IoCloseFile(file);
        return NTLSTATUS_INVALID_PARAMETER;
    }
    void* memory = MmAllocatePool((size_t)size);
    if (!memory) {
        IoCloseFile(file);
        return NTLSTATUS_NO_MEMORY;
    }
    size_t got = 0;
    status = IoReadFile(file, memory, (size_t)size, &got);
    IoCloseFile(file);
    if (!KSUCCESS(status) || got != (size_t)size) {
        MmFreePool(memory);
        return KSUCCESS(status) ? NTLSTATUS_FAILURE : status;
    }
    uintptr_t base = 0;
    status = LdrLoadKernelImage(memory, (size_t)size, &base);
    MmFreePool(memory);
    if (!KSUCCESS(status)) return status;
    return KiStartLoadedDriver(driver, base);
}

// Starts a preloaded boot driver by its configuration identity, not array position.
static KSTATUS KiLoadBootDriver(const BOOT_INFO* bootInfo,
                                const DM_DRIVER_CONFIG* driver) {
    const BOOT_FILE* files = (const BOOT_FILE*)(bootInfo->PhysicalMapBase +
                                               bootInfo->BootDrivers.FilesPhysical);
    const BOOT_FILE* found = NULL;
    for (uint32_t i = 0; i < bootInfo->BootDrivers.Count; ++i) {
        if (!strcmp(files[i].DriverId, driver->Id)) {
            found = &files[i];
            break;
        }
    }
    if (!found || strcmp(found->Image, driver->Image)) return NTLSTATUS_INVALID_PARAMETER;
    uintptr_t base = 0;
    KSTATUS status = LdrLoadKernelImage(
        (const void*)(bootInfo->PhysicalMapBase + found->PhysicalBase), found->Length, &base);
    if (!KSUCCESS(status)) return status;
    return KiStartLoadedDriver(driver, base);
}

// Validates that the firmware preloaded exactly the configured boot modules.
static bool KiCheckBootDriverHandoff(const BOOT_INFO* bootInfo, const DM_CONFIG* config) {
    const BOOT_FILE* files = (const BOOT_FILE*)(bootInfo->PhysicalMapBase +
                                               bootInfo->BootDrivers.FilesPhysical);
    uint32_t expected = 0;
    for (uint32_t i = 0; i < config->DriverCount; ++i) {
        const DM_DRIVER_CONFIG* driver = &config->Drivers[i];
        if (driver->Phase != DmStartBoot) continue;
        ++expected;
        uint32_t occurrences = 0;
        for (uint32_t j = 0; j < bootInfo->BootDrivers.Count; ++j) {
            if (!strcmp(files[j].DriverId, driver->Id) &&
                !strcmp(files[j].Image, driver->Image)) ++occurrences;
        }
        if (occurrences != 1) return false;
    }
    return expected == bootInfo->BootDrivers.Count;
}

// Bounded workers execute independent driver starts while the coordinator owns graph state.
#define KI_DRIVER_START_WORKERS 4u

typedef enum KI_DRIVER_WORK_STATE {
    KiDriverWorkIdle,
    KiDriverWorkQueued,
    KiDriverWorkRunning,
    KiDriverWorkFinished,
    KiDriverWorkExit,
    KiDriverWorkExited
} KI_DRIVER_WORK_STATE;

typedef struct KI_DRIVER_START_WORKER {
    EVENT* Wake;
    EVENT* Completion;
    THREAD* Thread;
    const DM_CONFIG* Config;
    const BOOT_INFO* BootInfo;
    volatile int32_t State;
    uint32_t Index;
    KSTATUS Status;
} KI_DRIVER_START_WORKER;

static void KiDriverStartWorker(void* argument) {
    KI_DRIVER_START_WORKER* worker = (KI_DRIVER_START_WORKER*)argument;
    for (;;) {
        EVENT* wake = worker->Wake;
        if (!wake)
            KePanic(KE_PANIC_CODE_INIT,
                    "Driver worker: null wake worker=0x%016llx index=%u state=%d\n",
                    (uint64_t)(uintptr_t)worker, worker->Index,
                    NtlAtomicLoad32(&worker->State));
        KSTATUS status = KeWaitForEvent(wake, false);
        if (!KSUCCESS(status)) {
            THREAD* self = KeGetCurrentThread();
            KePanic(KE_PANIC_CODE_INIT,
                    "Driver worker wait status=0x%x worker=0x%016llx index=%u state=%d\n"
                    "  wake=0x%016llx currentWake=0x%016llx thread=0x%016llx\n"
                    "  waitStatus=0x%x threadState=%u waitObject=0x%016llx\n",
                    status, (uint64_t)(uintptr_t)worker, worker->Index,
                    NtlAtomicLoad32(&worker->State),
                    (uint64_t)(uintptr_t)wake,
                    (uint64_t)(uintptr_t)worker->Wake,
                    (uint64_t)(uintptr_t)self,
                    self ? self->WaitStatus : 0u,
                    self ? (unsigned)self->State : 0u,
                    self ? (uint64_t)(uintptr_t)self->WaitObject : 0ull);
        }
        // A wake alone does not claim work; stale signals may arrive after completion.
        int32_t prior = NtlAtomicCompareExchange32(&worker->State,
                                                    KiDriverWorkRunning, KiDriverWorkQueued);
        if (prior == KiDriverWorkExit) {
            NtlAtomicExchange32(&worker->State, KiDriverWorkExited);
            return;
        }
        if (prior != KiDriverWorkQueued) continue;
        uint32_t index = worker->Index;
        if (index >= worker->Config->DriverCount)
            KePanic(KE_PANIC_CODE_INIT, "Driver worker: invalid assignment %u\n", index);
        const DM_DRIVER_CONFIG* driver = &worker->Config->Drivers[index];
        DbgPrint("driver: start id=%s image=%s\n", driver->Id, driver->Image);
        worker->Status = driver->Phase == DmStartBoot ?
            KiLoadBootDriver(worker->BootInfo, driver) : KiLoadRuntimeDriver(driver);
        NtlAtomicExchange32(&worker->State, KiDriverWorkFinished);
        KeSignalEvent(worker->Completion);
    }
}

static int KiSelectEligibleDriver(const DM_CONFIG* config, DM_START_PHASE phase) {
    int selected = -1;
    for (uint32_t i = 0; i < config->DriverCount; ++i) {
        const DM_DRIVER_CONFIG* d = &config->Drivers[i];
        if (d->Phase != phase || !DmDriverCanStart(config, i)) continue;
        if (selected < 0 || strcmp(d->Id, config->Drivers[selected].Id) < 0)
            selected = (int)i;
    }
    return selected;
}

static void KiRunDriverPhase(DM_CONFIG* config, const BOOT_INFO* bootInfo,
                             DM_START_PHASE phase) {
    config->ActivePhase = phase;
    EVENT* completion = (EVENT*)0;
    KSTATUS status = KeEventCreate(EventAutoReset, false, &completion);
    if (!KSUCCESS(status)) KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: completion event failed\n");

    // Worker threads retain these records until their exit has been acknowledged.
    KI_DRIVER_START_WORKER* workers = (KI_DRIVER_START_WORKER*)
        MmAllocatePoolTag(sizeof(KI_DRIVER_START_WORKER) * KI_DRIVER_START_WORKERS,
                          MM_POOL_TAG('d', 'r', 'w', 'k'));
    if (!workers)
        KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: worker allocation failed\n");
    memset(workers, 0, sizeof(KI_DRIVER_START_WORKER) * KI_DRIVER_START_WORKERS);
    for (uint32_t i = 0; i < KI_DRIVER_START_WORKERS; ++i) {
        KI_DRIVER_START_WORKER* worker = &workers[i];
        worker->Index = UINT32_MAX;
        worker->Config = config;
        worker->BootInfo = bootInfo;
        worker->Completion = completion;
        status = KeEventCreate(EventAutoReset, false, &worker->Wake);
        if (!KSUCCESS(status)) KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: work event failed\n");
        const KE_THREAD_CREATE_PARAMETERS parameters =
            KE_THREAD_CREATE_NAMED_NORMAL(PriorityNormal, "driver.start");
        status = KeCreateKernelThread((uintptr_t)KiDriverStartWorker,
                                     (uintptr_t)worker, &parameters, &worker->Thread);
        if (!KSUCCESS(status)) KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: worker failed\n");
    }

    uint32_t active = 0;
    for (;;) {
        for (uint32_t i = 0; i < KI_DRIVER_START_WORKERS; ++i) {
            KI_DRIVER_START_WORKER* worker = &workers[i];
            if (NtlAtomicCompareExchange32(&worker->State,
                                           KiDriverWorkIdle, KiDriverWorkFinished) !=
                KiDriverWorkFinished) continue;
            uint32_t index = worker->Index;
            if (index >= config->DriverCount)
                KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: invalid completion %u\n", index);
            DM_DRIVER_CONFIG* driver = &config->Drivers[index];
            driver->State = KSUCCESS(worker->Status) ? DmRunStarted : DmRunFailed;
            if (!KSUCCESS(worker->Status)) {
                DbgPrint("driver: failed id=%s status=0x%x\n", driver->Id, worker->Status);
                if (driver->Critical)
                    KePanic(KE_PANIC_CODE_INIT, "Critical driver %s failed (0x%x)\n",
                            driver->Id, worker->Status);
            }
            worker->Index = UINT32_MAX;
            --active;
        }

        for (uint32_t i = 0; i < KI_DRIVER_START_WORKERS; ++i) {
            KI_DRIVER_START_WORKER* worker = &workers[i];
            if (NtlAtomicLoad32(&worker->State) != KiDriverWorkIdle) continue;
            int selected = KiSelectEligibleDriver(config, phase);
            if (selected < 0) break;
            DM_DRIVER_CONFIG* driver = &config->Drivers[selected];
            driver->State = DmRunStarting;
            worker->Index = (uint32_t)selected;
            NtlAtomicExchange32(&worker->State, KiDriverWorkQueued);
            ++active;
            KeSignalEvent(worker->Wake);
        }

        if (active) {
            status = KeWaitForEvent(completion, false);
            if (!KSUCCESS(status)) KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: wait failed\n");
            continue;
        }
        bool changed = false;
        uint32_t waiting = 0;
        for (uint32_t i = 0; i < config->DriverCount; ++i) {
            DM_DRIVER_CONFIG* driver = &config->Drivers[i];
            if (driver->Phase != phase || driver->State != DmRunWaiting) continue;
            ++waiting;
            if (!DmDriverIsBlocked(config, i)) continue;
            driver->State = DmRunBlocked;
            DbgPrint("driver: blocked id=%s dependency failed\n", driver->Id);
            if (driver->Critical)
                KePanic(KE_PANIC_CODE_INIT, "Critical driver %s blocked\n", driver->Id);
            changed = true;
        }
        if (changed) continue;
        if (waiting)
            KePanic(KE_PANIC_CODE_INIT,
                    "Driver manager: deadlocked phase=%u waiting=%u\n",
                    (unsigned)phase, waiting);
        break;
    }

    for (uint32_t i = 0; i < KI_DRIVER_START_WORKERS; ++i) {
        if (NtlAtomicCompareExchange32(&workers[i].State,
                                       KiDriverWorkExit, KiDriverWorkIdle) != KiDriverWorkIdle)
            KePanic(KE_PANIC_CODE_INIT, "Driver scheduler: worker still active at shutdown\n");
        KeSignalEvent(workers[i].Wake);
    }
    for (uint32_t i = 0; i < KI_DRIVER_START_WORKERS; ++i) {
        status = KeWaitForEvent(workers[i].Thread->ExitEvent, false);
        if (!KSUCCESS(status))
            KePanic(KE_PANIC_CODE_INIT,
                    "Driver scheduler: worker %u exit wait failed (0x%x)\n", i, status);
        if (NtlAtomicLoad32(&workers[i].State) != KiDriverWorkExited)
            KePanic(KE_PANIC_CODE_INIT,
                    "Driver scheduler: worker %u exited without acknowledgment (state=%d)\n",
                    i, NtlAtomicLoad32(&workers[i].State));
        ObDereferenceObject(&workers[i].Thread->Header);
        ObDereferenceObject(&workers[i].Wake->Header);
    }
    ObDereferenceObject(&completion->Header);
    MmFreePool(workers);
}

static DM_CONFIG* gDriverConfig;

static void KiInitializeDrivers(BOOT_INFO* bootInfo, const HAL_API* hal) {
    (void)hal;
    DM_CONFIG* config = (DM_CONFIG*)MmAllocatePool(sizeof(*config));
    if (!config)
        KePanic(KE_PANIC_CODE_INIT, "Driver manager: configuration allocation failed\n");
    const char* text = (const char*)(bootInfo->PhysicalMapBase +
                                     bootInfo->DriversIni.PhysicalBase);
    char error[96] = {0};
    if (!DmConfigParse(config, text, bootInfo->DriversIni.Length, error, sizeof(error)))
        KePanic(KE_PANIC_CODE_INIT, "Driver manager: invalid drivers.ini: %s\n", error);
    if (!KiCheckBootDriverHandoff(bootInfo, config))
        KePanic(KE_PANIC_CODE_INIT, "Driver manager: boot preloads do not match drivers.ini\n");

    KSTATUS pnpStatus = IoPnpInitialize();
    if (!KSUCCESS(pnpStatus))
        KePanic(KE_PANIC_CODE_INIT, "PnP initialization failed (0x%x)\n", pnpStatus);

    KiRunDriverPhase(config, bootInfo, DmStartBoot);
    pnpStatus = IoPnpWaitForIdle(30000u);
    if (!KSUCCESS(pnpStatus))
        KePanic(KE_PANIC_CODE_INIT, "PnP boot startup did not settle (0x%x)\n", pnpStatus);

    // Root volume readiness depends on real devices, not the driver module state.
    KSTATUS status = KeInitializeSystemRootVolume();
    if (!KSUCCESS(status))
        KePanic(KE_PANIC_CODE_INIT, "Driver manager: no system root (0x%x)\n", status);
    KiRunDriverPhase(config, bootInfo, DmStartRuntime);
    // Retain the authoritative graph and module states for the shutdown slice.
    gDriverConfig = config;
}

// Phase Helper: Load and launch a process from the filesystem.
// Returns the new PROCESS* with one reference owned by the caller.
// Returns NULL on failure.
static PROCESS* KiLaunchUserProcess(const char* filePath, const char* args) {
    KSTATUS s;
    FILE_OBJECT* f;

    // Kernel-launched user images are rooted at the selected system volume.
    s = KeOpenSystemRootFile(filePath, &f);
    if (s != NTLSTATUS_SUCCESS) {
        DbgPrint("process: image load failed path=%s status=0x%x\n", filePath, s);
        return 0;
    }

    uint64_t size = IoGetFileSize(f);
    (void)size;

    // Create the process object.
    PROCESS* proc;
    THREAD* thread;

    s = KeCreateProcess(filePath, SeGetRootSecurityContext(), &proc);
    if (!KSUCCESS(s)) {
        DbgPrint("Failed to create process. System halted.\n");
        IoCloseFile(f);
        return 0;
    }
    DbgPrint("process: created pid=%u image=%s\n", proc->ProcessId, filePath);

    s = KeSetupUserProcessEnvironment(proc,
                                      SysSvFromCstr(filePath),
                                      SysSvFromCstr(args));
    if (!KSUCCESS(s)) {
        DbgPrint("process: environment failed status=0x%x\n", s);
        IoCloseFile(f);
        ObDereferenceObject(&proc->Header);
        return 0;
    }

    // The bootstrap service manager receives only the capabilities required to construct
    // the initial user-mode resource plane. Its PID is deliberately not part of this ABI.
    IO_VOLUME* systemVolume = (IO_VOLUME*)0;
    SYS_HANDLE systemVolumeHandle = SYS_HANDLE_INVALID;
    SYS_HANDLE namespaceVolumeHandle = SYS_HANDLE_INVALID;
    SYS_HANDLE volumeManagerHandle = SYS_HANDLE_INVALID;
    SYS_HANDLE inputManagerHandle = SYS_HANDLE_INVALID;
    SYS_HANDLE displayManagerHandle = SYS_HANDLE_INVALID;
    SYS_HANDLE registrationAuthorityHandle = SYS_HANDLE_INVALID;
    s = KeReferenceSystemRootVolume(&systemVolume);
    if (KSUCCESS(s)) {
        s = KeCreateHandle(proc, &systemVolume->Header,
                           SYS_RIGHT_QUERY | SYS_VOLUME_RIGHT_OPEN,
                           &systemVolumeHandle);
        if (KSUCCESS(s)) {
            s = KeCreateHandle(proc, &systemVolume->Header,
                               SYS_RIGHT_DUPLICATE | SYS_RIGHT_TRANSFER | SYS_RIGHT_QUERY |
                               SYS_VOLUME_RIGHT_OPEN | SYS_VOLUME_RIGHT_MODIFY,
                               &namespaceVolumeHandle);
        }
        IoReleaseVolume(systemVolume);
    }
    if (KSUCCESS(s)) {
        IO_VOLUME_MANAGER* volumeManager = (IO_VOLUME_MANAGER*)0;
        s = IoReferenceVolumeManager(&volumeManager);
        if (KSUCCESS(s)) {
            s = KeCreateHandle(proc, &volumeManager->Header,
                               SYS_RIGHT_DUPLICATE | SYS_RIGHT_TRANSFER | SYS_RIGHT_QUERY |
                               SYS_VOLUME_MANAGER_RIGHT_ENUMERATE | SYS_VOLUME_MANAGER_RIGHT_OPEN |
                               SYS_VOLUME_MANAGER_RIGHT_WAIT,
                               &volumeManagerHandle);
            ObDereferenceObject(&volumeManager->Header);
        }
    }
    if (KSUCCESS(s)) {
        KE_INPUT_MANAGER* inputManager = (KE_INPUT_MANAGER*)0;
        s = KeInputReferenceManager(&inputManager);
        if (KSUCCESS(s)) {
            s = KeCreateHandle(proc, &inputManager->Header,
                               SYS_RIGHT_DUPLICATE | SYS_RIGHT_TRANSFER | SYS_RIGHT_QUERY |
                               SYS_INPUT_MANAGER_RIGHT_READ | SYS_INPUT_MANAGER_RIGHT_CONFIGURE,
                               &inputManagerHandle);
            ObDereferenceObject(&inputManager->Header);
        }
    }
    if (KSUCCESS(s)) {
        KE_DISPLAY_MANAGER* displayManager = (KE_DISPLAY_MANAGER*)0;
        s = KeDisplayReferenceManager(&displayManager);
        if (KSUCCESS(s)) {
            // Init must be able to attenuate this manager again when RSSRV publishes
            // narrower display capabilities such as /Device/Display0.
            s = KeCreateHandle(proc, &displayManager->Header,
                               SYS_RIGHT_DUPLICATE | SYS_RIGHT_DERIVE | SYS_RIGHT_TRANSFER | SYS_RIGHT_QUERY |
                               SYS_DISPLAY_MANAGER_RIGHT_ENUMERATE | SYS_DISPLAY_MANAGER_RIGHT_MODESET |
                               SYS_DISPLAY_MANAGER_RIGHT_PRESENT | SYS_DISPLAY_MANAGER_RIGHT_CURSOR |
                               SYS_DISPLAY_MANAGER_RIGHT_CONSOLE,
                               &displayManagerHandle);
            ObDereferenceObject(&displayManager->Header);
        }
    }
    if (KSUCCESS(s)) {
        OBJECT* authority = (OBJECT*)0;
        s = KeSystemServiceCreateRegistrationAuthority(SYS_SERVICE_RESOURCE, &authority);
        if (KSUCCESS(s)) {
            s = KeCreateHandle(proc, authority,
                               SYS_RIGHT_DUPLICATE | SYS_RIGHT_DERIVE | SYS_RIGHT_TRANSFER |
                               SYS_RIGHT_QUERY | SYS_SERVICE_REGISTRATION_RIGHT_REGISTER |
                               SYS_SERVICE_REGISTRATION_RIGHT_UNREGISTER,
                               &registrationAuthorityHandle);
            ObDereferenceObject(authority);
        }
    }
    if (!KSUCCESS(s)) {
        DbgPrint("process: bootstrap capabilities failed status=0x%x\n", s);
        IoCloseFile(f);
        ObDereferenceObject(&proc->Header);
        return 0;
    }
    SYS_STARTUP_CAPABILITY startupCapabilities[6] = {
        { NTL_BOOT_CAP_SYSTEM_VOLUME, systemVolumeHandle },
        { NTL_BOOT_CAP_NAMESPACE_ROOT, namespaceVolumeHandle },
        { NTL_BOOT_CAP_VOLUME_MANAGER, volumeManagerHandle },
        { NTL_BOOT_CAP_INPUT_MANAGER, inputManagerHandle },
        { NTL_BOOT_CAP_DISPLAY_POLICY, displayManagerHandle },
        { NTL_BOOT_CAP_RESOURCE_REGISTRATION, registrationAuthorityHandle },
    };
    s = KeSetProcessStartupCapabilities(proc, startupCapabilities, 6);
    if (!KSUCCESS(s)) {
        DbgPrint("process: capability install failed status=0x%x\n", s);
        IoCloseFile(f);
        ObDereferenceObject(&proc->Header);
        return 0;
    }

    // Map the executable through an image section backed by the open file.
    uintptr_t imageBase = 0;
    s = LdrLoadImageFileForProcess(proc, f, &imageBase);
    IoCloseFile(f);
    if (!KSUCCESS(s)) {
        DbgPrint("process: image map failed status=0x%x\n", s);
        ObDereferenceObject(&proc->Header);
        return 0;
    }

    s = LdrRequireNoImports(imageBase);
    if (!KSUCCESS(s)) {
        DbgPrint("KiLaunchUserProcess: bootstrap image %s must be import-free (status %d)\n", filePath, s);
        ObDereferenceObject(&proc->Header);
        return 0;
    }

    s = LdrProtectImageForProcess(proc, imageBase, true);
    if (!KSUCCESS(s)) {
        DbgPrint("process: image protect failed path=%s status=0x%x\n", filePath, s);
        ObDereferenceObject(&proc->Header);
        return 0;
    }

    proc->Flags |= KE_PROCESS_FLAG_TERMINATION_PROTECTED;
    proc->ImageBase = imageBase;
    proc->ImageSize = LdrGetMappedImageSize(proc, imageBase);

    uintptr_t entryPoint = LdrGetEntryPoint(imageBase);

    KePowerSetInitProcess(proc);

    // Create the main thread last. KeCreateThread queues it before returning.
    const KE_THREAD_CREATE_PARAMETERS threadParameters =
        KE_THREAD_CREATE_NAMED_NORMAL(PriorityNormal, proc->Name);
    s = KeCreateThread(proc, (uintptr_t)entryPoint, 0, &threadParameters, &thread);
    if (!KSUCCESS(s)) {
        KePowerSetInitProcess((PROCESS*)0);
        DbgPrint("process: thread creation failed status=0x%x\n", s);
        proc->ImageBase = 0;
        proc->ImageSize = 0;
        ObDereferenceObject(&proc->Header);
        return 0;
    }
    ObDereferenceObject(&thread->Header);

    // Caller owns the reference returned by KeCreateProcess.
    return proc;
}

static void KiFlushRegisteredDisk(uint8_t disk, DEVICE_OBJECT* device, void* context) {
    (void)device;
    const char* phase = (const char*)context;
    KSTATUS st = IoFlushDisk(disk);
    if (!KSUCCESS(st) && st != NTLSTATUS_NOT_FOUND)
        DbgPrint("shutdown: %s disk %u flush status 0x%x\n", phase, (unsigned)disk, st);
}

static void KiFlushRegisteredDisks(const char* phase) {
    KSTATUS st = IoEnumerateDiskDevices(KiFlushRegisteredDisk, (void*)phase);
    if (!KSUCCESS(st))
        DbgPrint("shutdown: %s disk enumeration failed 0x%x\n", phase, st);
}

void SystemInitThread(void* arg) {
    SYSTEM_INIT_ARGS* args = (SYSTEM_INIT_ARGS*)arg;

    KSTATUS powerStatus = KePowerInitialize();
    if (!KSUCCESS(powerStatus))
        KePanic(KE_PANIC_CODE_INIT, "Power coordinator failed (0x%x)\n", powerStatus);

    KiInitializeDrivers(args->BootInfo, args->Hal);
    KePowerInitializePolicy();
    KeTimeReloadSettings();

    KiInitializeSwapFromSettings();

    KiReclaimBootloaderMemory(args->BootInfo);

    if (args->BootConfig.Debug & KE_DEBUG_SELFTEST)
        KiRunKernelSelfTests();

    // Launch the bootstrap service manager. Its allocated PID is not a system contract.
    PROCESS* initProcess = KiLaunchUserProcess("system/init.exe", "");
    if (!initProcess) {
        DbgPrint("SystemInitThread: Failed to start system/init.exe.\n");
        KePanic(KE_PANIC_CODE_INIT, "SystemInitThread: Failed to start system/init.exe.\n");
    }

    EVENT* exits[2] = { KePowerCompletionEvent(), initProcess->ExitEvent };
    uint32_t signaled = 0;
    KSTATUS waitStatus = KeWaitForMultipleEvents(exits, 2u, false,
                                                 SYS_WAIT_TIMEOUT_INFINITE, &signaled);
    if (!KSUCCESS(waitStatus) || signaled != 0u)
        KePanic(KE_PANIC_CODE_INIT, "SystemInitThread: init exited without power commit\n");
    (void)KeWaitForEvent(initProcess->ExitEvent, false);
    int exitCode = initProcess->ExitCode;
    if (exitCode != 0) {
        KePanic(KE_PANIC_CODE_INIT, "SystemInitThread: init.exe exited with code %d.\n", exitCode);
    }
    DbgPrint("shutdown: init exit=%d\n", exitCode);
    uint32_t action = KePowerCommittedAction();
    if (!action) KePanic(KE_PANIC_CODE_INIT, "SystemInitThread: missing power action\n");
    KSTATUS flush = MmFileCacheFlushAll();
    if (!KSUCCESS(flush)) DbgPrint("shutdown: cache flush status 0x%x\n", flush);
    KiFlushRegisteredDisks("initial");
    ObDereferenceObject(&initProcess->Header);

    if (args->BootConfig.Debug & (KE_DEBUG_CONSOLE | KE_DEBUG_FILE_LOG)) {
        KSTATUS logStatus = KeFlushDebugLogToSystemRoot("kernel.log");
        if (!KSUCCESS(logStatus))
            DbgPrint("debuglog: shutdown flush failed st=0x%x\n", logStatus);
    }
    flush = MmFileCacheFlushAll();
    if (!KSUCCESS(flush)) DbgPrint("shutdown: final cache flush status 0x%x\n", flush);
    KiFlushRegisteredDisks("final");
    // Firmware preparation runs while platform drivers can still execute methods.
    KSTATUS firmwarePrepare = KePowerPrepareFirmware(action);
    if (!KSUCCESS(firmwarePrepare) && firmwarePrepare != NTLSTATUS_NOT_SUPPORTED)
        DbgPrint("shutdown: firmware prepare failed 0x%x; using HAL fallback\n", firmwarePrepare);
    KSTATUS prepare = DmPrepareShutdown();
    if (!KSUCCESS(prepare)) DbgPrint("shutdown: prepare status 0x%x\n", prepare);
    KSTATUS pnpShutdown = IoPnpShutdown(10000u);
    if (!KSUCCESS(pnpShutdown))
        DbgPrint("shutdown: device stop status 0x%x\n", pnpShutdown);
    DmCommitShutdown();
    KSTATUS firmwareEnter = KePowerEnterFirmware(action);
    if (firmwareEnter != NTLSTATUS_NOT_SUPPORTED)
        DbgPrint("shutdown: firmware transition returned 0x%x; using HAL fallback\n", firmwareEnter);
    if (action == SYS_POWER_ACTION_RESTART) {
        if (!gKmainHal->Power.Reset)
            KePanic(KE_PANIC_CODE_INIT, "shutdown: reset HAL callback unavailable\n");
        gKmainHal->Power.Reset();
    }
    gKmainHal->Power.Shutdown();
    MmFreePool(args);
}

// Returns whether one page-backed boot allocation is aligned, nonempty, and does not overflow.
static bool KiValidateBootPageRange(uintptr_t physicalBase, uint32_t pageCount) {
    if (!physicalBase || (physicalBase & (PAGE_SIZE - 1u)) != 0 || pageCount == 0)
        return false;

    uint64_t byteCount = (uint64_t)pageCount * PAGE_SIZE;
    return byteCount != 0 && physicalBase <= UINTPTR_MAX - byteCount;
}

// Returns whether one page-backed raw boot file is fully contained in its recorded allocation.
static bool KiValidateBootFile(const BOOT_FILE* file) {
    if (!file || !KiValidateBootPageRange(file->PhysicalBase, file->PageCount) || file->Length == 0)
        return false;

    uint64_t capacity = (uint64_t)file->PageCount * PAGE_SIZE;
    if ((uint64_t)file->Length + 1u > capacity)
        return false;
    return file->DriverId[0] != '\0' && file->Image[0] != '\0' &&
           memchr(file->DriverId, '\0', sizeof(file->DriverId)) &&
           memchr(file->Image, '\0', sizeof(file->Image));
}

// Returns whether one fixed core-image descriptor fits inside its page-backed physical allocation.
static bool KiValidateBootImage(const BOOT_IMAGE* image, int requireEntry) {
    if (!image || !image->VirtualBase || (image->VirtualBase & (PAGE_SIZE - 1u)) != 0 ||
        !KiValidateBootPageRange(image->PhysicalBase, image->PageCount) || !image->ImageSize) {
        return false;
    }

    uint64_t capacity = (uint64_t)image->PageCount * PAGE_SIZE;
    if (image->ImageSize > capacity || image->VirtualBase > UINTPTR_MAX - image->ImageSize)
        return false;
    if (requireEntry && image->EntryRva >= image->ImageSize)
        return false;
    return true;
}

// Validates the exact bootloader/kernel handoff contract before dereferencing variable physical blobs.
static bool KiValidateBootInfo(const BOOT_INFO* bootInfo) {
    if (!bootInfo || bootInfo->Magic != BOOT_INFO_MAGIC ||
        bootInfo->Version != BOOT_INFO_VERSION || bootInfo->Size != sizeof(BOOT_INFO) ||
        bootInfo->MemoryMap.Magic != MEMORY_MAP_MAGIC ||
        bootInfo->MemoryMap.RegionCount > MEMORY_MAX_REGIONS ||
        bootInfo->PhysicalMapBase == 0) {
        return false;
    }

    uint64_t bootIniCapacity = (uint64_t)bootInfo->BootIni.PageCount * PAGE_SIZE;
    if (!KiValidateBootPageRange(bootInfo->BootIni.PhysicalBase, bootInfo->BootIni.PageCount) ||
        bootInfo->BootIni.Length == 0 || (uint64_t)bootInfo->BootIni.Length + 1u > bootIniCapacity ||
        bootInfo->BootIni.PhysicalBase > UINTPTR_MAX - bootInfo->PhysicalMapBase) {
        return false;
    }

    uint64_t driverIniCapacity = (uint64_t)bootInfo->DriversIni.PageCount * PAGE_SIZE;
    if (!KiValidateBootPageRange(bootInfo->DriversIni.PhysicalBase,
                                 bootInfo->DriversIni.PageCount) ||
        bootInfo->DriversIni.Length == 0 ||
        bootInfo->DriversIni.Length > DM_CONFIG_MAX_BYTES ||
        (uint64_t)bootInfo->DriversIni.Length + 1u > driverIniCapacity ||
        bootInfo->DriversIni.PhysicalBase > UINTPTR_MAX - bootInfo->PhysicalMapBase)
        return false;

    uint64_t driverListCapacity = (uint64_t)bootInfo->BootDrivers.PageCount * PAGE_SIZE;
    uint64_t driverListBytes = (uint64_t)bootInfo->BootDrivers.Count * sizeof(BOOT_FILE);
    if (!KiValidateBootPageRange(bootInfo->BootDrivers.FilesPhysical, bootInfo->BootDrivers.PageCount) ||
        bootInfo->BootDrivers.Count == 0 || bootInfo->BootDrivers.Count > DM_MAX_DRIVERS ||
        driverListBytes > driverListCapacity ||
        bootInfo->BootDrivers.FilesPhysical > UINTPTR_MAX - bootInfo->PhysicalMapBase) {
        return false;
    }

    const BOOT_FILE* bootFiles =
        (const BOOT_FILE*)(bootInfo->PhysicalMapBase + bootInfo->BootDrivers.FilesPhysical);
    for (uint32_t index = 0; index < bootInfo->BootDrivers.Count; ++index) {
        if (!KiValidateBootFile(&bootFiles[index]) ||
            bootFiles[index].PhysicalBase > UINTPTR_MAX - bootInfo->PhysicalMapBase) {
            return false;
        }
    }

    if (!KiValidateBootImage(&bootInfo->KernelImage, 1) ||
        !KiValidateBootImage(&bootInfo->HalImage, 0)) {
        return false;
    }

    return true;
}

// Main Kernel Entry.
extern void KernelMain(BOOT_INFO* bootInfo) {

    // Firmware is not required to transfer control with IF clear. Keep the
    // bootstrap CPU masked until the interrupt manager and scheduler are ready.
    _disable();

    if (!KiValidateBootInfo(bootInfo)) {
        for (;;)
            __halt();
    }

    if (!KSUCCESS(KeBindBootstrapHal())) {
        for (;;)
            __halt();
    }
    const HAL_API* hal = KeGetHal();

    // Physical & Virtual Memory initialization.

    if (!MmInitializePhysical(&bootInfo->MemoryMap, bootInfo->PhysicalMapBase))
        KeStopProcessor();

    PHYSICAL_ADDRESS pml4 = (PHYSICAL_ADDRESS)__readcr3();
    // The early virtual allocator starts small because it only needs bootstrap page tables before the PMM is online.
    MmInitializeVirtual(pml4, 1 * 1024 * 1024);

    // Bootstrap CPU and architecture setup (GDT/IDT/Faults).

    KeInitializeBootstrapCpu();
    KeInitializeGdt();
    KeInitializeIdt();

    // Register boot exports before resolving driver imports.
    KSTATUS moduleRegistryStatus = LdrRegisterModulesFromBootInfo(bootInfo);
    if (!KSUCCESS(moduleRegistryStatus))
        KeStopProcessor();

    // Parse the raw mandatory boot.ini handoff once before HAL policy consumes debug flags.
    KE_BOOT_CONFIG bootConfig = {0};
    const char* bootIniText = (const char*)(bootInfo->PhysicalMapBase + bootInfo->BootIni.PhysicalBase);
    KSTATUS bootConfigStatus = KeParseBootConfiguration(bootIniText, bootInfo->BootIni.Length, &bootConfig);

    // HAL Initialization.

    HAL_INIT_PARAMS halParams = {
        .Size               = sizeof(HAL_INIT_PARAMS),
        .Flags              = 0,
        .PhysicalWindowBase = bootInfo->PhysicalMapBase,
        .FramebufferBase    = bootInfo->FramebufferBase,
        .FramebufferWidth   = bootInfo->FramebufferWidth,
        .FramebufferHeight  = bootInfo->FramebufferHeight,
        .FramebufferStride  = bootInfo->FramebufferStride,
        .RsdpPhysical       = bootInfo->RsdpPhysical,
        .Debug              = KSUCCESS(bootConfigStatus) ? (int)(bootConfig.Debug & 1u) : 0,
        .AllocatePool       = MmAllocatePool
    };

    KSTATUS s = KeInitializeHal(&halParams);
    if (!KSUCCESS(s))
        KeStopProcessor();

    IoInitializeDdk(hal, bootInfo->PhysicalMapBase);
    KeFirmwareInitialize(bootInfo);
    gKmainHal = hal;

    KeInitDebug(hal, KSUCCESS(bootConfigStatus) ? bootConfig.Debug : 0);
    KeFirmwareLog();
    if (!KSUCCESS(bootConfigStatus)) {
        KePanic(KE_PANIC_CODE_INIT,
                "boot.ini: malformed or missing mandatory configuration, status=0x%x\n",
                bootConfigStatus);
    }
    DbgPrint("Boot: system volume selector=%s\n", bootConfig.SystemVolume);

    // Bind IRQ dispatch while IF remains clear. Interrupt sources are armed
    // later, after their kernel consumers have registered.
    KeIrqInitialize(hal);
    KeTimeInitialize(bootInfo, hal);
    KeDisplayInitialize(hal);

    // CPU startup intentionally lives after HAL initialization but before IRQs
    // and scheduler startup. HAL owns firmware processor discovery and platform
    // startup signaling; the kernel owns KCPU records, per-CPU stacks, GDT/TSS/IDT state, and the
    // AP park loop. External device IRQs remain routed to the boot processor during this
    // step; APs only become runnable after scheduler admission below.
    KeSetApplicationProcessorTrampoline((uint64_t)bootInfo->ApTrampolinePhys);
    KSTATUS smpStatus = KeStartApplicationProcessors();
    if (!KSUCCESS(smpStatus)) {
        KePanic(KE_PANIC_CODE_INIT, "SMP: failed to start application processors, status=0x%x\n", smpStatus);
    }

    KeInitializeDpcSystem();

    KeInputInitialize(hal);

    KeIrqRegisterLocalTimerHandler(hal->Timer.HandleInterrupt);

    KeSyscallInit(hal);

    KSTATUS securityStatus = SeInitializeSecurity();
    if (!KSUCCESS(securityStatus)) {
        KePanic(KE_PANIC_CODE_INIT,
                "security: failed to initialize root context, status=0x%x\n",
                securityStatus);
    }

    // Dynamic Linking & Driver Execution.


    // Scheduler Prep & Status Update.

    KeInitializeScheduler();
    KeIrqRegisterLocalTimerHandler(KeSchedulerTick);
    KeConfigureCurrentProcessorTimer();

    KSTATUS volumeManagerStatus = IoInitializeVolumeManager();
    if (!KSUCCESS(volumeManagerStatus)) {
        KePanic(KE_PANIC_CODE_INIT,
                "I/O: failed to initialize volume manager notifications, status=0x%x\n",
                volumeManagerStatus);
    }

    KSTATUS partitionStatus = IoInitializePartitionManager(bootConfig.SystemVolume);
    if (!KSUCCESS(partitionStatus)) {
        KePanic(KE_PANIC_CODE_INIT,
                "I/O: failed to initialize partition discovery, status=0x%x\n",
                partitionStatus);
    }

    KeAudioInitialize();

    KSTATUS workStatus = KeStartWorkQueue();
    if (!KSUCCESS(workStatus)) {
        KePanic(KE_PANIC_CODE_INIT, "workq: failed to start passive work queue, status=0x%x\n", workStatus);
    }

    KSTATUS smpSchedStatus = KeAdmitApplicationProcessorsToScheduler();
    if (!KSUCCESS(smpSchedStatus)) {
        KePanic(KE_PANIC_CODE_INIT, "SMP: failed to admit APs to scheduler, status=0x%x\n", smpSchedStatus);
    }

    if (bootConfig.Debug & KE_DEBUG_SELFTEST)
        KiCheckBootState();

    // Pack the arguments for the init thread.
    SYSTEM_INIT_ARGS* initArgs = MmAllocatePool(sizeof(SYSTEM_INIT_ARGS));
    if (!initArgs)
        KePanic(KE_PANIC_CODE_INIT, "SystemInitThread: failed to allocate initialization arguments.\n");
    initArgs->BootInfo = bootInfo;
    initArgs->Hal = hal;
    initArgs->BootConfig = bootConfig;

    // Spawn the Initialization Thread. No creator reference is needed; the
    // scheduler owns the live thread lifetime.
    const KE_THREAD_CREATE_PARAMETERS initThreadParameters =
        KE_THREAD_CREATE_NAMED_NORMAL(PriorityNormal, "system-init");
    KSTATUS st = KeCreateKernelThread((uintptr_t)SystemInitThread,
                                      (uintptr_t)initArgs,
                                      &initThreadParameters, (THREAD**)0);
    
    if (!KSUCCESS(st)) {
        KePanic(KE_PANIC_CODE_INIT, "KernelMain: Failed to create SystemInitThread (status 0x%x)\n", st);
    }
    
    // The bootstrap CPU becomes the scheduler idle context once interrupts are enabled.
    while (true)
        KeWaitForInterrupt();
}