issues: the T14's 8 to 11 ms window is the xHCI spin's log write, and its firmware interrupts every CPU every 2.2 s under ToyOS by Japabu · Pull Request #681 · ToyOSOrg/ToyOS

Japabu · 2026-10-02T22:41:55Z

Issues only; no code. One T14 boot of main at c59e09ed6 with a throwaway instrument (never landed) named what opens every interrupts-off window of 2 ms or more, sampled the CPU holding it, traced each TLB shootdown's acknowledgements and read MSR_SMI_COUNT on every CPU, over forty runs of test_rs_ring_park_herd. Beside the instrument's own reports and its control, it found three causes: the xHCI spin, the firmware's interrupt and init's claim of a PCI function the machine lacks. This records each once, with an owner and an exit.

Evidence, quoted because the readback is a scratch directory:

the boot, its control and the storage windows: comment 5962618149;
the all-CPU events at 17.416 s and 21.116 s: comments 5962618492 and 5962618868;
the firmware's interrupt and the Linux count: comment 5962619169;
Linux's ACPI state: comment 5962768253;
the LOG fsd's SYS_FSYNC in the windows' trails: comment 5966523482;
the firmware scout, two T14 boots of main at 73282fa93: comment 5966817345, the one the owner ruled on. Every smi: and smi_stretch: line of each boot's kernel.log is in comment 5966982609 (nothing written) and comment 5966982752 (ACPI_ENABLE written). Its patch smi.patch, whole, sha256 582bb410…f538d6, is in comment 5966982939;
the instrument's patch, whole, in two parts that rejoin to its sha256 f5a0208c…ac458a: comments 5962629281 and 5962629511.

Machine: LENOVO 20W0003AMZ, BIOS N34ET71W (1.71). Image sha256 bead136b…6b66. verdict.txt reads passed.

What changed, per decision

The spin has one record: issues/hardware/xhci-waits-are-spins.md. The T14's 8 to 11 ms window is the LOG fsd's SYS_PARTITION_WRITE. It spins in XhciController::wait_transfer under XHCI inside a syscall, which is masked. It holds one CPU for 8.3 to 10.7 ms nine times, and twice all eight: seven herd threads in SYS_THREAD_EXIT spin, masked, on its shootdown acknowledgement. The file carries:
- the spin, and what still spins: the boot path's bring-up, the stop, a disk's bind after boot inside a scheduler pass (msc::bind, whose own doc says so), and a disk call;
- the masked disk calls: a partition claim's SYS_PARTITION_READ, SYS_PARTITION_WRITE and SYS_FSYNC, and the table SYS_DEVICE_CLAIM reads. SYS_FSYNC is a cache flush through xhci::storage_flush under XHCI (partition_fsync, kernel/src/object/ops.rs). logd's fsync is one: sync_all on its /log file is fsd's FSYNC, which the LOG fsd answers with SYS_FSYNC on its claim (userland/fsd/src/disk.rs, toyos/src/device.rs);
- the tripwire arithmetic (6.74 s against DEAF_CPU's 5 s);
- the T14 readings, init's two partition claims (cpu0's 6.0 and 6.6 ms) among them. The fsd's SYS_FSYNC follows 15 of its windows, and in 7 it spins on a contended XHCI at with_disk_by. None of the boot's 101 windows opened at syscall 15;
- Stage 6 step 2, built: the longest interrupts-off and preemption-off windows per CPU, and a held window the T14 reads back #649's readings that are this by reading.
Owner: issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md, for both exits. Exits:
- the tripwire's, owed short of step 10, as the orchestrator ruled: one operation's IF-clear spin is under DEAF_CPU by construction, because the call's bound opens where the operation opens, or a later batch starts only while a whole call's bound is still inside it. A staged boot whose first batch spends most of the budget and whose next batch breaks shows it;
- the spin's: the tree has no kernel/src/drivers/xhci. The tree reads that, so the exit needs no instrument the tree lacks. Step 10 meets both.
Deleted, folded into that file, all three on main:
- issues/kernel/some-t14-boots-carry-an-interrupts-off-window-of-9-ms-or-more.md. Its readings are the spin's, and its stop-report line is corrected.
- issues/kernel/a-disk-operation-can-spin-past-the-tlb-ack-tripwire-before-its-break.md. Its arithmetic and its exit are the spin's tripwire and first exit. Its one citation was a bare name in issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md, which now points at the spin's file.
- issues/audio/disk-wait-pins-a-cpu.md. Its one live claim is the SYS_FSYNC above. The rest is gone from the tree: log_file::SINK and fat32_adapter::VOLUMES no longer exist, the partition fsync takes no VFS, and io-depth-probe is no kernel feature. It had two citations:
  - issues/kernel/scheduler-pass-blocks-in-xhci.md sent "the disk wait that survives" to it, and now sends it to the spin's file.
  - issues/kernel/the-global-pipe-lock-spans-a-user-copy.md named it and io-depth-probe as the tools that would price its hold. That clause is deleted, and the sentence ends at "the first thing owed".
A search of the tree, dotfiles included (rg --hidden --no-ignore, and git grep at the head), finds no citation of the three or of the renamed slug below. It also found no other defect that records this spin:
- issues/kernel/every-wait-in-this-kernel-is-a-spin.md still names the disk path holding XHCI. It is an assigned track whose ordering the small-kernel track supersedes, keeping it "as the evidence each stage closes". This branch leaves it alone.
- scheduler-pass-blocks-in-xhci.md, issues/hardware/hotplug-blocks-a-scheduler-pass.md and issues/hardware/a-disk-plugged-in-after-boot-is-bound-inside-a-scheduling-pass.md are the scheduler pass's records, each with its own exit.
- issues/kernel/a-held-disk-waits-for-a-pass-no-cpu-takes-when-every-cpu-is-in-a-call-on-it.md, issues/kernel/a-shutdown-on-a-held-usb-disk-left-a-cpu-deaf-to-a-tlb-shootdown.md, issues/kernel/a-stick-that-answers-late-is-broken-by-the-two-second-abandon.md and issues/kernel/a-deliberate-wedge-inside-a-driver-panics-every-other-cpu-that-wants-its-lock.md each record a different failure of the same driver, with its own exit.
issues/kernel/cpu0-holds-interrupts-and-preemption-off-for-6-5-ms-on-the-t14.md becomes issues/kernel/inits-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md. Its 6.5 ms is init's partition claims, which belong to the spin. What is its own is init's SYS_DEVICE_CLAIM for blockd's pci:1b36:0010, which this machine lacks: 3,817,265 ns on cpu0. The claim reads 24 vendor IDs, and nothing has said what it spends 3.8 ms on. opened stays, as renames in this tracker keep it.
- Owner: the small-kernel track, whose stage 5 exits on no interrupts-off window longer than a register access.
- Exit: a T14 boot reads the longest interrupts-off window inside the claim no longer than one register access, with MSR_SMI_COUNT unmoved across that window, so a firmware step cannot fail a fixed claim. The exit bounds the masked hold the title names, not the syscall from entry to return. A fix that opens interrupts between the reads closes the defect even if the reads stay slow.
- The figure for that access comes from the claim's own reads timed on the T14, and nobody has timed them yet.
New: issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md.
- The count went from 4824 to 4841 on all eight CPUs alike. Its steps came 2.215 to 2.222 s apart.
- Each step stops every CPU for about 4.5 ms. The two lock waiters' 4.50 and 4.55 ms between two turns of their own spin show that stop.
- Linux's 0 was read only beside rtla timerlat --dma-latency 0, which holds C-states shallow and runs a 1 kHz timer. So the slug and the title claim ToyOS only, and the body names that condition.
- Linux's ACPI values are stated as read: SMI_CMD=0xb2, ACPI_ENABLE=0xf0, PM1a_CNT=0x0001, SMI_EN=0x10002033 with APMC_EN set. ToyOS makes no enable handshake.
- The cause is measured: the firmware's legacy mode. The orchestrator's scout, on the owner's go, booted main at 73282fa93 twice, each boot 30 s idle and then 30 s with a spinning thread on every CPU. With nothing written, SCI_EN read clear all boot and the count rose once every 2.2 s, idle and busy alike, 27 in 60 s. With ACPI_ENABLE written to SMI_CMD, SCI_EN read set 2.13 ms later, the write cost one firmware interrupt, and the count then stayed flat on every CPU for 61 s. The SCI's line stayed masked, and nothing in ToyOS handles an SCI. After the switch the firmware had set GPE 9's enable bit, and GPE 110's status rose and stayed set, served by nothing. The issue's ACPI_ENABLE bullet records both, with their lines in comment 5966982752, because stage 1's server meets them once it unmasks GSI 9.
Owner: the fix is stage 1 of the ACPI track below, as the owner ruled. The T14 loop (issues/hardware/the-t14-boots-toyos-unattended.md) owns only the reading, and builds the row. Exit: a T14 row reads the count on every CPU twice and the readings agree on every CPU.
- The first reading comes after init's spawn and after the boot's last write to SMI_CMD, whoever makes it. The ACPI enable is itself such a write, and raises one firmware interrupt where APMC_EN is set.
- The second comes at the stop's report, at least 4.444 s after the first. That is twice the longest period read (2 × 2,221,576,672 ns = 4,443,153,344 ns). A shorter interval could agree with nothing fixed.
New: issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md, the ACPI track, with the owner's ruling on the scout. It stays open, a track that starts no work by itself, and draws no design. It says what is missing:
- nothing writes ACPI_ENABLE to SMI_CMD and nothing handles an SCI, and the T14's firmware hands the machine over in legacy mode, which is the firmware issue above;
- nothing in the tree evaluates AML. toyos-acpi/src/dsdt.rs finds \_S5_ by a byte scan, the loader asks UEFI for the windows _CRS would name (bootloader/src/rootbridge.rs), and nothing reads _CST.
The owner's ruling, on the scout in comment 5966817345: the ACPI enable lands as the track's stage 1, together with a userland server that claims the SCI and handles the power button, a fixed event that needs no AML, so nothing the firmware does in legacy mode today is lost. He chose this over landing the write alone with the events masked, and over waiting for the AML work. The AML interpreter follows as later stages: ToyOS writes its own, battery first, his direction that main recorded in the scheduler file (0ee814f5a, from the 2026-08-16 direction conversation).

Stage 1's exit: on the T14, MSR_SMI_COUNT stays flat on every CPU over the interval the firmware issue's exit defines, and a press of the power button stops the machine cleanly, through ToyOS's own power-off path (SYS_SHUTDOWN), and the boot's log records the press and that stop, where a T14 row reads both. The power button's half is what the ruling implies, named so a row can fail it; the track does not design the server.

Two files that cited the interpreter point at it:
- issues/kernel/the-scheduler-and-the-clocks-never-talk.md cited an "ACPI/power track (task nightly: an instrument for the "Rust + QEMU is everything" premise #136 — own AML interpreter, battery first)" that has no file. The false citation goes, the direction moves to the track, and the line's AML interpreter now points there.
- issues/kernel/idle-cpus-enter-the-c-states-cst-names.md sent its reader to the scheduler file for that interpreter. That file, in turn, named no file for it. The line now points at the track.
issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md now names its two readings that belong to other causes. 2 × 5,075,290 is the log write, and 4,725,822 is a firmware step, by reading. Without them, one size reads 1.03 to 1.98 ms.

Where the log differs from the reading in the brief

The control's excess is the instrument's report, not its sampling. The 50,000,024 ns hold reads back as a 56,000,902 ns window. idle_span's report is printed inside that same SYS_EXIT, and smi at=1752151655 to end at=1758069743 is 5,918,088 ns of it. Stage 6 step 2, built: the longest interrupts-off and preemption-off windows per CPU, and a held window the T14 reads back #649's shipping kernel, whose report is a few lines, read the same hold at 50,075,527 to 50,080,844 ns. Seven windows, 2.38 to 11.93 ms, are the instrument's own reports and are counted as such. Nothing in the issues rests on this.
The windows a firmware step falls in read 4.53 to 4.76 ms, not 4.65 to 4.76 ms. Sixteen opened in a job's syscall or interrupt and read 4.65 to 4.76 ms. Nine opened in a pass leaving idle and read 4.53 to 4.71 ms; seven of those were at 9.925 s.
In the two all-CPU events the writing CPU's samples are by=cpuM. A waiting initiator sends them. by=self is the single-CPU case.
gap_ns is about a microsecond on twelve of the fourteen long shootdowns, 1,141 to 1,676 ns. The other two read 10,819 and 8,476 ns.
Each all-CPU event is followed at once by a second. The next write reads 2.82 and 2.85 ms, and fourteen more shootdowns read 2.66 to 2.84 ms. Those are the boot's fourteen 2 to 3 ms shootdowns.
The writing CPU acknowledges 130 to 264 ns before each of the fourteen long shootdowns ends.

What else the boot showed

Of the 93 interrupts-off windows, 25 cross a firmware step. The other 68 are:

fsd's USB writes (27) and reads (2);
init's claims (3): the two partition claims and the PCI claim;
herd threads waiting on a shootdown during a write (28);
the instrument's reports (7);
the hold (1).

The table is in comment 5962618149. The three lock waits of about 4.5 ms all fall on firmware steps: two at 9.925 s and one at 36.556 s. One window is named here and nowhere else: cpu5's first idle pass held preemption off for 2,454,682 ns at 1.160 s. That pass printed the i8042 line. It carries events=0 and no sample, because its interrupts were open.

Gates

cargo run -- --ci host at dfa31c8a9, this head: EXIT=0. Its last line is [ci] Host: 67 step(s), all green. Log: /Users/jan/.claude/jobs/2280e09e/tmp/scratchpad/orch/681-named/ci-host.log.
No guest test and no metal row: the branch changes only issues/.
The tracker's form is the review's to check against issues/README.md. The host gate reads an issue file only where a manifest or a build reason cites it (src/userlandhost.rs, src/build.rs), and none cites these.

Net: 14 files, +275 −265, all under issues/. On the windows' subjects that is three issue files where main had five, plus the ACPI track.

Unsure

Stage 6 step 2, built: the longest interrupts-off and preemption-off windows per CPU, and a held window the T14 reads back #649's readings are these events by reading only: those boots recorded no opener and no count.

🤖 Generated with Claude Code

https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

…are interrupts every CPU every 2.2 s One T14 boot of main at c59e09e with a throwaway instrument (never landed; scout.patch sha256 f5a0208c…ac458a) named what opens every interrupts-off window of 2 ms or more, sampled the CPU holding it, traced each shootdown's acknowledgements and read MSR_SMI_COUNT on every CPU. It ran test_rs_ring_park_herd forty times. Its lines are quoted on the pull request; the scratch readback does not outlive the session. - some-t14-boots-carry-an-interrupts-off-window-of-9-ms-or-more is renamed to what the boot shows and rewritten as present state: the LOG fsd's SYS_PARTITION_WRITE spins in XhciController::wait_transfer with interrupts masked for the whole USB transfer, 8.3 to 10.7 ms on one CPU nine times, and twice while seven herd threads in SYS_THREAD_EXIT spin masked on its shootdown acknowledgement, 7.7 to 7.85 ms. The old title's "some boots" was a sampling artefact of one herd run per boot: the write recurs every 2.0 to 4.6 s. Owners: the small-kernel track and syscall-preemption-is-incidental. The opened date stays, as renames do. - cpu0-holds-interrupts-and-preemption-off-for-6-5-ms-on-the-t14 has its opener: init in SYS_DEVICE_CLAIM, two partition claims reading the stick's table through the same wait and one PCI claim whose single sample is in PciDevice::is_id. The exit's naming half is met and goes. - New: the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and- not-under-linux. MSR_SMI_COUNT went 4824 to 4841 on all eight CPUs, each step about 4.5 ms on every CPU; under Linux perf read 0 in 120 s. The cause is not known. - a-process-lengthens-an-interrupts-off-walk…: its citation follows the rename. the-cpu-that-spawns-a-toybox-applet… is unchanged: the instrument printed only windows of 2 ms or more, so this boot says nothing new about it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-02T22:42:02Z

Evidence 2 of 4: all eight CPUs at once, 17.416 s.
The boot, the instrument's guide and the syscall numbers are in evidence 1. Cited by issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md.

Every window below opens at kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70 and closes at kernel::arch::x86_64::syscall::syscall_entry+0x88; those lines are left out.

The shootdown counter, in the report before and the report after

1275: [2026-10-02 22:16:29 16.510 cpu2] tlb: shootdowns=4137 wait=375265us max=1146us dlopen=0 pcid=0 mmio=0 unmap=4137 pipe=0 staged=0 bench=0
1544: [2026-10-02 22:16:30 17.442 cpu6] tlb: shootdowns=4394 wait=488179us max=7846us dlopen=0 pcid=0 mmio=0 unmap=4394 pipe=0 staged=0 bench=0

The sixteen windows: cpu4 is pid 4 in `sys(120)`, twice; the other seven are herd threads in `sys(5)`

1318: [2026-10-02 22:16:30 17.431 cpu6] scout: win cpu0 irqs open=17415662834 close=17423622252 span_ns=7959417 smi=4831->4831 opener=27:98 closer=27:100 events=4
1321: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu0 irqs open=17415662834 during: 17415663008:sys(5) | 17415759633:lock(src/process.rs:1272 0xffff80000034e9a0 94862ns) | 17423559648:shoot(g=4225 7777392ns) | 17423612363:to(27:100)
1322: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu0 irqs open=17415662834 after: 17423623099:irq(tlb) | 17423624471:irq(xhci) | 17423628728:sys(5) | 17423702274:lock(src/process.rs:1272 0xffff80000034e9a0 71862ns)
1323: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu0 irqs open=17423628632 close=17426455393 span_ns=2826760 smi=4831->4831 opener=27:100 closer=27:108 events=4
1326: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu0 irqs open=17423628632 during: 17423628728:sys(5) | 17423702274:lock(src/process.rs:1272 0xffff80000034e9a0 71862ns) | 17426395233:shoot(g=4234 2678006ns) | 17426450256:to(27:108)
1327: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu0 irqs open=17423628632 after: 17426456380:irq(tlb) | 17426457844:irq(xhci) | 17426462369:sys(5) | 17426542640:lock(src/process.rs:1272 0xffff80000034e9a0 75600ns)
1328: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17415801277 close=17423621551 span_ns=7820273 smi=4831->4831 opener=27:109 closer=27:119 events=3
1331: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17415801277 during: 17415801425:sys(5) | 17423559667:shoot(g=4226 7739951ns) | 17423598919:to(27:119)
1332: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17415801277 after: 17423622505:irq(tlb) | 17423625130:sys(5) | 17423668585:lock(src/process.rs:1272 0xffff80000034e9a0 41194ns) | 17426395284:shoot(g=4232 2711756ns)
1333: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17423625000 close=17426453619 span_ns=2828618 smi=4831->4831 opener=27:119 closer=27:156 events=5
1336: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17423625000 during: 17423625130:sys(5) | 17423668585:lock(src/process.rs:1272 0xffff80000034e9a0 41194ns) | 17426395284:shoot(g=4232 2711756ns) | 17426419466:to(27:156) | 17426453165:lock(src/process.rs:806 0xffff80005f5d66a0 30816ns)
1337: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu1 irqs open=17423625000 after: 17426454439:irq(tlb) | 17426457267:sys(5) | 17427267502:shoot(g=4236 792683ns) | 17427281049:to(27:181)
1338: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17415635936 close=17423626878 span_ns=7990941 smi=4831->4831 opener=27:94 closer=27:102 events=4
1341: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17415635936 during: 17415636130:sys(5) | 17415702048:lock(src/process.rs:1272 0xffff80000034e9a0 50645ns) | 17423559685:shoot(g=4222 7838797ns) | 17423623475:to(27:102)
1342: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17415635936 after: 17423627855:irq(tlb) | 17423630146:sys(5) | 17423717298:lock(src/process.rs:1272 0xffff80000034e9a0 85650ns) | 17426395320:shoot(g=4235 2660240ns)
1343: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17423630032 close=17426455048 span_ns=2825015 smi=4831->4831 opener=27:102 closer=27:123 events=5
1346: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17423630032 during: 17423630146:sys(5) | 17423717298:lock(src/process.rs:1272 0xffff80000034e9a0 85650ns) | 17426395320:shoot(g=4235 2660240ns) | 17426438431:lock(src/process.rs:1174 0xffff80005f5d66a0 20893ns) | 17426445966:to(27:123)
1347: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu2 irqs open=17423630032 after: 17426455847:irq(tlb) | 17426459023:sys(5) | 17426490013:lock(src/process.rs:1272 0xffff80000034e9a0 27007ns) | 17427267465:shoot(g=4238 759687ns)
1348: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17415643795 close=17423591189 span_ns=7947393 smi=4831->4831 opener=27:95 closer=27:103 events=4
1351: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17415643795 during: 17415643948:sys(5) | 17415720894:lock(src/process.rs:1272 0xffff80000034e9a0 67980ns) | 17423559655:shoot(g=4223 7818983ns) | 17423580358:to(27:103)
1352: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17415643795 after: 17423592264:irq(tlb) | 17423594595:sys(5) | 17426395291:shoot(g=4229 2759197ns) | 17426448720:lock(src/process.rs:1174 0xffff80005f5d66a0 30277ns)
1353: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17423594479 close=17426459280 span_ns=2864801 smi=4831->4831 opener=27:103 closer=27:106 events=4
1356: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17423594479 during: 17423594595:sys(5) | 17426395291:shoot(g=4229 2759197ns) | 17426448720:lock(src/process.rs:1174 0xffff80005f5d66a0 30277ns) | 17426456118:to(27:106)
1357: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu3 irqs open=17423594479 after: 17426460015:irq(tlb) | 17426463655:sys(5) | 17426558144:lock(src/process.rs:1272 0xffff80000034e9a0 90396ns) | 17427267525:shoot(g=4242 690902ns)
1358: [2026-10-02 22:16:30 17.432 cpu6] scout: win cpu4 irqs open=17415709092 close=17423557665 span_ns=7848573 smi=4831->4831 opener=4:0 closer=4:0 events=1
1361: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu4 irqs open=17415709092 during: 17415709207:sys(120)
1362: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu4 irqs open=17415709092 after: 17423558748:irq(tlb) | 17423569150:sys(120)
1363: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu4 irqs open=17423569009 close=17426393888 span_ns=2824878 smi=4831->4831 opener=4:0 closer=4:0 events=1
1366: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu4 irqs open=17423569009 during: 17423569150:sys(120)
1367: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu4 irqs open=17423569009 after: 17426394583:irq(tlb) | 17426396149:irq(timer) | 17426406787:sys(120) | 17426432162:lock(src/process.rs:827 0xffff80005f5d66a0 20547ns)
1368: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17415802449 close=17423620878 span_ns=7818429 smi=4831->4831 opener=27:113 closer=27:137 events=4
1371: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17415802449 during: 17415802593:sys(5) | 17423559658:shoot(g=4227 7725024ns) | 17423594198:to(27:137) | 17423620346:lock(src/process.rs:806 0xffff80005f5d66a0 23351ns)
1372: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17415802449 after: 17423621975:irq(tlb) | 17423624424:sys(5) | 17423651117:lock(src/process.rs:1272 0xffff80000034e9a0 23931ns) | 17426395274:shoot(g=4231 2726759ns)
1373: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17423624264 close=17426454112 span_ns=2829847 smi=4831->4831 opener=27:137 closer=27:172 events=5
1376: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17423624264 during: 17423624424:sys(5) | 17423651117:lock(src/process.rs:1272 0xffff80000034e9a0 23931ns) | 17426395274:shoot(g=4231 2726759ns) | 17426426572:to(27:172) | 17426453593:lock(src/process.rs:806 0xffff80005f5d66a0 24364ns)
1377: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu5 irqs open=17423624264 after: 17426455040:irq(tlb) | 17426457909:sys(5) | 17427267504:shoot(g=4237 777482ns) | 17427288294:to(27:196)
1378: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17415645005 close=17423623167 span_ns=7978162 smi=4831->4831 opener=27:82 closer=27:90 events=4
1381: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17415645005 during: 17415645141:sys(5) | 17415740677:lock(src/process.rs:1272 0xffff80000034e9a0 87414ns) | 17423559691:shoot(g=4224 7800088ns) | 17423619170:to(27:90)
1382: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17415645005 after: 17423624177:irq(tlb) | 17423627596:sys(5) | 17423683539:lock(src/process.rs:1272 0xffff80000034e9a0 54384ns) | 17426395307:shoot(g=4233 2693037ns)
1383: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17423627451 close=17426454647 span_ns=2827196 smi=4831->4831 opener=27:90 closer=27:120 events=4
1386: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17423627451 during: 17423627596:sys(5) | 17423683539:lock(src/process.rs:1272 0xffff80000034e9a0 54384ns) | 17426395307:shoot(g=4233 2693037ns) | 17426441855:to(27:120)
1387: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu6 irqs open=17423627451 after: 17426455535:irq(tlb) | 17426460127:sys(5) | 17426507830:lock(src/process.rs:1272 0xffff80000034e9a0 42185ns) | 17427267451:shoot(g=4239 743613ns)
1388: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17415807986 close=17423597001 span_ns=7789015 smi=4831->4831 opener=27:107 closer=27:116 events=4
1391: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17415807986 during: 17415808102:sys(5) | 17415834713:lock(src/process.rs:1272 0xffff80000034e9a0 25026ns) | 17423559712:shoot(g=4228 7703612ns) | 17423584784:to(27:116)
1392: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17415807986 after: 17423597940:irq(tlb) | 17423600198:sys(5) | 17423620811:lock(src/process.rs:806 0xffff80005f5d66a0 20371ns) | 17426395264:shoot(g=4230 2744172ns)
1393: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17423600088 close=17426456413 span_ns=2856324 smi=4831->4831 opener=27:116 closer=27:117 events=5
1396: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17423600088 during: 17423600198:sys(5) | 17423620811:lock(src/process.rs:806 0xffff80005f5d66a0 20371ns) | 17426395264:shoot(g=4230 2744172ns) | 17426442953:lock(src/process.rs:1174 0xffff80005f5d66a0 24819ns) | 17426453371:to(27:117)
1397: [2026-10-02 22:16:30 17.433 cpu6] scout: win cpu7 irqs open=17423600088 after: 17426457245:irq(tlb) | 17426460548:sys(5) | 17426523877:lock(src/process.rs:1272 0xffff80000034e9a0 57169ns) | 17427267537:shoot(g=4240 724930ns)

The fourteen shootdowns, and who acknowledged how

The 84 acknowledgements of the seven other targets come 486 to 23,132 ns after begin=, by poll (31), wait (42) or own (11). The 14 of cpu4 come by ipi, 2,660,081 to 7,838,622 ns after begin= and 74 to 209 ns before end=. Each target line's trail: is left out but for two of cpu4's, quoted whole first.

1402: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu4 ack=17423559491 via=ipi seen=17423559473 trail: 17415685214:irq(tlb) | 17415686595:sys(66) | 17415690305:sys(66) | 17415703060:irq(tlb) | 17415709207:sys(120) | 17423558748:irq(tlb)
1410: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu4 ack=17426395142 via=ipi seen=17426395112 trail: 17415703060:irq(tlb) | 17415709207:sys(120) | 17423558748:irq(tlb) | 17423569150:sys(120) | 17426394583:irq(tlb) | 17426396149:irq(timer)

1398: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 origin=unmap begin=17415782239 end=17423559631 span_ns=7777392 gap_ns=10819 gap_at=17416793322 probes=3
1399: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu1 ack=17415795254 via=poll seen=17415795345
1400: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu2 ack=17415783109 via=wait seen=17415795356
1401: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu3 ack=17415783246 via=wait seen=17415795368
1402: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu4 ack=17423559491 via=ipi seen=17423559473
1403: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu5 ack=17415783033 via=poll seen=17423559490
1404: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu6 ack=17415783150 via=wait seen=17423559594
1405: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4225 target=cpu7 ack=17415782918 via=poll seen=17423559607
1406: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 origin=unmap begin=17423717209 end=17426395216 span_ns=2678006 gap_ns=1011 gap_at=17426060283 probes=1
1407: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu1 ack=17423718180 via=wait seen=17423718031
1408: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu2 ack=17423735705 via=own seen=17423735660
1409: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu3 ack=17423718017 via=wait seen=17423735847
1410: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu4 ack=17426395142 via=ipi seen=17426395112
1411: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu5 ack=17423717939 via=wait seen=17426395129
1412: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu6 ack=17423718146 via=wait seen=17426395188
1413: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu0 gen=4234 target=cpu7 ack=17423717836 via=wait seen=17426395198
1414: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 origin=unmap begin=17415819697 end=17423559649 span_ns=7739951 gap_ns=1285 gap_at=17417861210 probes=3
1415: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu0 ack=17415820361 via=wait seen=17415820292
1416: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu2 ack=17415820498 via=wait seen=17415820659
1417: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu3 ack=17415820647 via=wait seen=17415820671
1418: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu4 ack=17423559491 via=ipi seen=17423559550
1419: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu5 ack=17415835078 via=own seen=17423559577
1420: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu6 ack=17415820481 via=wait seen=17423559593
1421: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4226 target=cpu7 ack=17415820305 via=poll seen=17423559608
1422: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 origin=unmap begin=17423683510 end=17426395267 span_ns=2711756 gap_ns=1140 gap_at=17423865726 probes=1
1423: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu0 ack=17423684176 via=poll seen=17423684125
1424: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu2 ack=17423684163 via=poll seen=17423684297
1425: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu3 ack=17423684354 via=wait seen=17423684326
1426: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu4 ack=17426395142 via=ipi seen=17426395167
1427: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu5 ack=17423684386 via=wait seen=17426395195
1428: [2026-10-02 22:16:30 17.433 cpu6] scout: shoot cpu1 gen=4232 target=cpu6 ack=17423702780 via=own seen=17426395209
1429: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu1 gen=4232 target=cpu7 ack=17423684225 via=wait seen=17426395224
1430: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 origin=unmap begin=17415720869 end=17423559667 span_ns=7838797 gap_ns=1222 gap_at=17415835665 probes=3
1431: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu0 ack=17415733190 via=poll seen=17415733262
1432: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu1 ack=17415721591 via=poll seen=17415733276
1433: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu3 ack=17415741136 via=own seen=17415741277
1434: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu4 ack=17423559491 via=ipi seen=17423559567
1435: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu5 ack=17415721602 via=poll seen=17423559584
1436: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu6 ack=17415721527 via=poll seen=17423559599
1437: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4222 target=cpu7 ack=17415724437 via=poll seen=17423559624
1438: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 origin=unmap begin=17423735061 end=17426395302 span_ns=2660240 gap_ns=1133 gap_at=17425954464 probes=1
1439: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu0 ack=17423735902 via=wait seen=17423735883
1440: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu1 ack=17423735605 via=wait seen=17423735908
1441: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu3 ack=17423735870 via=wait seen=17423735928
1442: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu4 ack=17426395142 via=ipi seen=17426395209
1443: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu5 ack=17423735616 via=wait seen=17426395234
1444: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu6 ack=17423735730 via=wait seen=17426395248
1445: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu2 gen=4235 target=cpu7 ack=17423735782 via=wait seen=17426395264
1446: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 origin=unmap begin=17415740638 end=17423559621 span_ns=7818983 gap_ns=1271 gap_at=17418275896 probes=3
1447: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu0 ack=17415741560 via=poll seen=17415741628
1448: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu1 ack=17415741354 via=poll seen=17415741653
1449: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu2 ack=17415741471 via=wait seen=17415741665
1450: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu4 ack=17423559491 via=ipi seen=17423559530
1451: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu5 ack=17415741344 via=poll seen=17423559553
1452: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu6 ack=17415760070 via=own seen=17423559565
1453: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4223 target=cpu7 ack=17415741332 via=poll seen=17423559578
1454: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 origin=unmap begin=17423636077 end=17426395274 span_ns=2759197 gap_ns=1067 gap_at=17426281464 probes=1
1455: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu0 ack=17423636677 via=poll seen=17423636886
1456: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu1 ack=17423636842 via=poll seen=17423636898
1457: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu2 ack=17423636796 via=poll seen=17423636922
1458: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu4 ack=17426395142 via=ipi seen=17426395179
1459: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu5 ack=17423636830 via=poll seen=17426395195
1460: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu6 ack=17423636783 via=poll seen=17426395212
1461: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu3 gen=4229 target=cpu7 ack=17423651714 via=own seen=17426395241
1462: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 origin=unmap begin=17415834602 end=17423559626 span_ns=7725024 gap_ns=1191 gap_at=17418216179 probes=3
1463: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu0 ack=17415835144 via=wait seen=17415835171
1464: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu1 ack=17415835649 via=wait seen=17415835364
1465: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu2 ack=17415835651 via=wait seen=17415835475
1466: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu3 ack=17415835599 via=wait seen=17415835611
1467: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu4 ack=17423559491 via=ipi seen=17423559547
1468: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu6 ack=17415835386 via=wait seen=17423559566
1469: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4227 target=cpu7 ack=17415856843 via=own seen=17423559581
1470: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 origin=unmap begin=17423668498 end=17426395257 span_ns=2726759 gap_ns=1058 gap_at=17426222267 probes=1
1471: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu0 ack=17423668984 via=poll seen=17423669180
1472: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu1 ack=17423683954 via=own seen=17423684282
1473: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu2 ack=17423669122 via=poll seen=17423684300
1474: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu3 ack=17423669271 via=wait seen=17423684330
1475: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu4 ack=17426395142 via=ipi seen=17426395165
1476: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu6 ack=17423669141 via=poll seen=17426395193
1477: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu5 gen=4231 target=cpu7 ack=17423669083 via=wait seen=17426395212
1478: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 origin=unmap begin=17415759586 end=17423559674 span_ns=7800088 gap_ns=1269 gap_at=17416770479 probes=3
1479: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu0 ack=17415782718 via=own seen=17415782860
1480: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu1 ack=17415760392 via=poll seen=17415782900
1481: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu2 ack=17415760490 via=wait seen=17415783017
1482: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu3 ack=17415760237 via=wait seen=17415783091
1483: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu4 ack=17423559491 via=ipi seen=17423559569
1484: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu5 ack=17415760380 via=poll seen=17423559586
1485: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4224 target=cpu7 ack=17415760244 via=poll seen=17423559629
1486: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 origin=unmap begin=17423702251 end=17426395289 span_ns=2693037 gap_ns=1014 gap_at=17425777062 probes=1
1487: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu0 ack=17423717649 via=own seen=17423718029
1488: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu1 ack=17423702883 via=wait seen=17423718077
1489: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu2 ack=17423702791 via=poll seen=17423718090
1490: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu3 ack=17423702964 via=wait seen=17423718102
1491: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu4 ack=17426395142 via=ipi seen=17426395212
1492: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu5 ack=17423702894 via=wait seen=17426395224
1493: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu6 gen=4233 target=cpu7 ack=17423702887 via=wait seen=17426395246
1494: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 origin=unmap begin=17415856087 end=17423559700 span_ns=7703612 gap_ns=1246 gap_at=17417891944 probes=3
1495: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu0 ack=17415857072 via=wait seen=17415857005
1496: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu1 ack=17415857044 via=wait seen=17415857032
1497: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu2 ack=17415856618 via=wait seen=17415857058
1498: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu3 ack=17415857020 via=wait seen=17415857070
1499: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu4 ack=17423559491 via=ipi seen=17423559610
1500: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu5 ack=17415856912 via=wait seen=17423559636
1501: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4228 target=cpu6 ack=17415856629 via=wait seen=17423559651
1502: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 origin=unmap begin=17423651073 end=17426395246 span_ns=2744172 gap_ns=1045 gap_at=17425897776 probes=1
1503: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu0 ack=17423651598 via=poll seen=17423651845
1504: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu1 ack=17423651781 via=poll seen=17423651863
1505: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu2 ack=17423651915 via=poll seen=17423651940
1506: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu3 ack=17423651857 via=wait seen=17423651952
1507: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu4 ack=17426395142 via=ipi seen=17426395182
1508: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu5 ack=17423668968 via=own seen=17426395198
1509: [2026-10-02 22:16:30 17.434 cpu6] scout: shoot cpu7 gen=4230 target=cpu6 ack=17423651905 via=poll seen=17426395215

The samples

cpu4's, sent by a CPU that had waited 2 ms on it (by=cpuM), cut after three frames:

1526: [2026-10-02 22:16:30 17.438 cpu6] scout: nmi cpu4 at=17417722328 by=cpu2 ring=0 if=0 who=4:0 masked_since=17415709092 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1527: [2026-10-02 22:16:30 17.438 cpu6] scout: nmi cpu4 at=17419722256 by=cpu2 ring=0 if=0 who=4:0 masked_since=17415709092 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1528: [2026-10-02 22:16:30 17.439 cpu6] scout: nmi cpu4 at=17421721560 by=cpu2 ring=0 if=0 who=4:0 masked_since=17415709092 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2e9 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1529: [2026-10-02 22:16:30 17.439 cpu6] scout: nmi cpu4 at=17425637831 by=cpu3 ring=0 if=0 who=4:0 masked_since=17423569009 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …

One waiter's, whole, then every waiter's cut after rip= (each continues stack: core::ptr::drop_glue::<alloc::vec::Vec<kernel::mm::unmapped::Unmapped<kernel::process::PageAlloc+0x6e < kernel::process::thread_exit+0x603 < kernel::syscall::proc::sys_thread_exit+0x9 < …):

1510: [2026-10-02 22:16:30 17.434 cpu6] scout: nmi cpu0 at=17418053897 by=self ring=0 if=0 who=27:98 masked_since=17415662834 rip=kernel::arch::x86_64::tlb::shootdown+0x522 stack: core::ptr::drop_glue::<alloc::vec::Vec<kernel::mm::unmapped::Unmapped<kernel::process::PageAlloc+0x6e < kernel::process::thread_exit+0x603 < kernel::syscall::proc::sys_thread_exit+0x9 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x2239 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e
1510: [2026-10-02 22:16:30 17.434 cpu6] scout: nmi cpu0 at=17418053897 by=self ring=0 if=0 who=27:98 masked_since=17415662834 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1511: [2026-10-02 22:16:30 17.434 cpu6] scout: nmi cpu0 at=17420055512 by=self ring=0 if=0 who=27:98 masked_since=17415662834 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1512: [2026-10-02 22:16:30 17.435 cpu6] scout: nmi cpu0 at=17422056947 by=self ring=0 if=0 who=27:98 masked_since=17415662834 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1513: [2026-10-02 22:16:30 17.435 cpu6] scout: nmi cpu0 at=17426059576 by=self ring=0 if=0 who=27:100 masked_since=17423628632 rip=kernel::arch::x86_64::tlb::shootdown+0x441
1514: [2026-10-02 22:16:30 17.435 cpu6] scout: nmi cpu1 at=17417860323 by=self ring=0 if=0 who=27:109 masked_since=17415801277 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1515: [2026-10-02 22:16:30 17.435 cpu6] scout: nmi cpu1 at=17419862035 by=self ring=0 if=0 who=27:109 masked_since=17415801277 rip=kernel::arch::x86_64::tlb::shootdown+0x52b
1516: [2026-10-02 22:16:30 17.436 cpu6] scout: nmi cpu1 at=17421863491 by=self ring=0 if=0 who=27:109 masked_since=17415801277 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1517: [2026-10-02 22:16:30 17.436 cpu6] scout: nmi cpu1 at=17425866441 by=self ring=0 if=0 who=27:119 masked_since=17423625000 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1518: [2026-10-02 22:16:30 17.436 cpu6] scout: nmi cpu2 at=17417947292 by=self ring=0 if=0 who=27:94 masked_since=17415635936 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1519: [2026-10-02 22:16:30 17.436 cpu6] scout: nmi cpu2 at=17419948928 by=self ring=0 if=0 who=27:94 masked_since=17415635936 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1520: [2026-10-02 22:16:30 17.437 cpu6] scout: nmi cpu2 at=17421950639 by=self ring=0 if=0 who=27:94 masked_since=17415635936 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1521: [2026-10-02 22:16:30 17.437 cpu6] scout: nmi cpu2 at=17425953720 by=self ring=0 if=0 who=27:102 masked_since=17423630032 rip=kernel::arch::x86_64::tlb::shootdown+0x3a2
1522: [2026-10-02 22:16:30 17.437 cpu6] scout: nmi cpu3 at=17418275029 by=self ring=0 if=0 who=27:95 masked_since=17415643795 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1523: [2026-10-02 22:16:30 17.437 cpu6] scout: nmi cpu3 at=17420276690 by=self ring=0 if=0 who=27:95 masked_since=17415643795 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1524: [2026-10-02 22:16:30 17.438 cpu6] scout: nmi cpu3 at=17422278053 by=self ring=0 if=0 who=27:95 masked_since=17415643795 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1525: [2026-10-02 22:16:30 17.438 cpu6] scout: nmi cpu3 at=17426280807 by=self ring=0 if=0 who=27:103 masked_since=17423594479 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1530: [2026-10-02 22:16:30 17.439 cpu6] scout: nmi cpu5 at=17418215397 by=self ring=0 if=0 who=27:113 masked_since=17415802449 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1531: [2026-10-02 22:16:30 17.439 cpu6] scout: nmi cpu5 at=17420217071 by=self ring=0 if=0 who=27:113 masked_since=17415802449 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1532: [2026-10-02 22:16:30 17.440 cpu6] scout: nmi cpu5 at=17422218638 by=self ring=0 if=0 who=27:113 masked_since=17415802449 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1533: [2026-10-02 22:16:30 17.440 cpu6] scout: nmi cpu5 at=17426221600 by=self ring=0 if=0 who=27:137 masked_since=17423624264 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1534: [2026-10-02 22:16:30 17.440 cpu6] scout: nmi cpu6 at=17417770534 by=self ring=0 if=0 who=27:82 masked_since=17415645005 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1535: [2026-10-02 22:16:30 17.440 cpu6] scout: nmi cpu6 at=17419772025 by=self ring=0 if=0 who=27:82 masked_since=17415645005 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1536: [2026-10-02 22:16:30 17.441 cpu6] scout: nmi cpu6 at=17421773469 by=self ring=0 if=0 who=27:82 masked_since=17415645005 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1537: [2026-10-02 22:16:30 17.441 cpu6] scout: nmi cpu6 at=17425776419 by=self ring=0 if=0 who=27:90 masked_since=17423627451 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1538: [2026-10-02 22:16:30 17.441 cpu6] scout: nmi cpu7 at=17417891023 by=self ring=0 if=0 who=27:107 masked_since=17415807986 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1539: [2026-10-02 22:16:30 17.441 cpu6] scout: nmi cpu7 at=17419892739 by=self ring=0 if=0 who=27:107 masked_since=17415807986 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1540: [2026-10-02 22:16:30 17.442 cpu6] scout: nmi cpu7 at=17421894235 by=self ring=0 if=0 who=27:107 masked_since=17415807986 rip=kernel::arch::x86_64::tlb::shootdown+0x52b
1541: [2026-10-02 22:16:30 17.442 cpu6] scout: nmi cpu7 at=17425897108 by=self ring=0 if=0 who=27:116 masked_since=17423600088 rip=kernel::arch::x86_64::tlb::shootdown+0x522

Japabu · 2026-10-02T22:42:04Z

Evidence 3 of 4: all eight CPUs at once, 21.116 s.
The boot, the instrument's guide and the syscall numbers are in evidence 1. Cited by issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md.

Every window below opens at kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70 and closes at kernel::arch::x86_64::syscall::syscall_entry+0x88; those lines are left out.

The shootdown counter, in the report before and the report after

1666: [2026-10-02 22:16:33 20.221 cpu7] tlb: shootdowns=5165 wait=511501us max=7846us dlopen=0 pcid=0 mmio=0 unmap=5165 pipe=0 staged=0 bench=0
1940: [2026-10-02 22:16:34 21.145 cpu5] tlb: shootdowns=5422 wait=609988us max=7860us dlopen=0 pcid=0 mmio=0 unmap=5422 pipe=0 staged=0 bench=0

The sixteen windows: cpu1 is pid 4 in `sys(120)`, twice; the other seven are herd threads in `sys(5)`

1709: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21116071623 close=21124026266 span_ns=7954642 smi=4833->4833 opener=31:105 closer=31:110 events=4
1712: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21116071623 during: 21116071749:sys(5) | 21116177126:lock(src/process.rs:1272 0xffff800000e9f980 103583ns) | 21123936083:shoot(g=5203 7739827ns) | 21124023017:to(31:110)
1713: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21116071623 after: 21124027127:irq(tlb) | 21124028729:irq(xhci) | 21124055484:irq(tlb) | 21124056874:irq(tlb)
1714: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21125063167 close=21127993699 span_ns=2930532 smi=4833->4833 opener=31:118 closer=31:119 events=4
1717: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21125063167 during: 21125063304:sys(5) | 21125149253:lock(src/process.rs:1272 0xffff800000e9f980 79705ns) | 21127941818:shoot(g=5254 2775044ns) | 21127979029:to(31:119)
1718: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu0 irqs open=21125063167 after: 21127994616:irq(tlb) | 21127996836:irq(xhci) | 21128001613:sys(5) | 21128083835:lock(src/process.rs:1272 0xffff800000e9f980 76647ns)
1719: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21116006613 close=21123934338 span_ns=7927725 smi=4833->4833 opener=4:0 closer=4:0 events=1
1722: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21116006613 during: 21116006769:sys(120)
1723: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21116006613 after: 21123935203:irq(tlb) | 21123937103:sys(15) | 21123947406:sys(67) | 21123982326:lock(src/process.rs:806 0xffff80005f5d66a0 23854ns)
1724: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21125093307 close=21127940090 span_ns=2846782 smi=4833->4833 opener=4:0 closer=4:0 events=1
1727: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21125093307 during: 21125093411:sys(120)
1728: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21125093307 after: 21127940952:irq(tlb) | 21127948750:sys(120) | 21128792324:irq(tlb) | 21128799895:sys(120)
1729: [2026-10-02 22:16:34 21.134 cpu5] scout: win cpu2 irqs open=21116042174 close=21124006487 span_ns=7964313 smi=4833->4833 opener=31:34 closer=31:42 events=4
1732: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu2 irqs open=21116042174 during: 21116042302:sys(5) | 21123936111:shoot(g=5198 7831929ns) | 21123974042:to(31:42) | 21124006011:lock(src/process.rs:806 0xffff80005f5d66a0 29035ns)
1733: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu2 irqs open=21116042174 after: 21124007436:irq(tlb) | 21124011168:sys(5) | 21124037669:lock(src/process.rs:1272 0xffff800000e9f980 23302ns) | 21124125208:lock(src/process.rs:1172 0xffff800000e9f980 65285ns)
1734: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu2 irqs open=21125050429 close=21127999230 span_ns=2948801 smi=4833->4833 opener=31:82 closer=31:90 events=4
1737: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu2 irqs open=21125050429 during: 21125050582:sys(5) | 21127941867:shoot(g=5250 2841370ns) | 21127986530:lock(src/process.rs:1174 0xffff80005f5d66a0 20234ns) | 21127995711:to(31:90)
1738: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu2 irqs open=21125050429 after: 21127999998:irq(tlb) | 21128003348:sys(5) | 21128100295:lock(src/process.rs:1272 0xffff800000e9f980 92243ns) | 21128793200:shoot(g=5263 673118ns)
1744: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21116053315 close=21124007944 span_ns=7954628 smi=4833->4833 opener=31:35 closer=31:43 events=5
1747: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21116053315 during: 21116053468:sys(5) | 21116104177:lock(src/process.rs:1272 0xffff800000e9f980 34310ns) | 21123936077:shoot(g=5199 7812905ns) | 21123988431:lock(src/process.rs:1174 0xffff80005f5d66a0 29093ns) | 21123996097:to(31:43)
1748: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21116053315 after: 21124009389:irq(tlb) | 21124013941:sys(5) | 21124089506:lock(src/process.rs:1272 0xffff800000e9f980 72119ns) | 21124162338:to(31:51)
1749: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21125052145 close=21127966594 span_ns=2914449 smi=4833->4833 opener=31:83 closer=31:91 events=4
1752: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21125052145 during: 21125052309:sys(5) | 21125132903:lock(src/process.rs:1272 0xffff800000e9f980 64695ns) | 21127941786:shoot(g=5253 2792535ns) | 21127956278:to(31:91)
1753: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21125052145 after: 21127967402:irq(tlb) | 21127970529:sys(5) | 21127992764:lock(src/process.rs:806 0xffff80005f5d66a0 21911ns) | 21128793215:shoot(g=5257 779718ns)
1754: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21116065154 close=21123965288 span_ns=7900134 smi=4833->4833 opener=31:28 closer=31:36 events=4
1757: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21116065154 during: 21116065291:sys(5) | 21116138294:lock(src/process.rs:1272 0xffff800000e9f980 66866ns) | 21123936106:shoot(g=5201 7778754ns) | 21123955026:to(31:36)
1758: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21116065154 after: 21123966176:irq(tlb) | 21123970071:sys(5) | 21124005126:lock(src/process.rs:806 0xffff80005f5d66a0 34765ns) | 21124124074:lock(src/process.rs:1172 0xffff800000e9f980 83340ns)
1759: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21125068964 close=21127995202 span_ns=2926237 smi=4833->4833 opener=31:68 closer=31:76 events=4
1762: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21125068964 during: 21125069077:sys(5) | 21125166782:lock(src/process.rs:1272 0xffff800000e9f980 95693ns) | 21127941829:shoot(g=5255 2759870ns) | 21127989875:to(31:76)
1763: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu4 irqs open=21125068964 after: 21127995983:irq(tlb) | 21128000587:sys(5) | 21128064874:lock(src/process.rs:1272 0xffff800000e9f980 58598ns) | 21128793174:shoot(g=5261 709345ns)
1764: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21116030264 close=21124006078 span_ns=7975814 smi=4833->4833 opener=31:37 closer=31:45 events=4
1767: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21116030264 during: 21116030365:sys(5) | 21123936087:shoot(g=5197 7852515ns) | 21123968048:to(31:45) | 21124005514:lock(src/process.rs:806 0xffff80005f5d66a0 34551ns)
1768: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21116030264 after: 21124006980:irq(tlb) | 21124010638:sys(5) | 21124124723:lock(src/process.rs:1172 0xffff800000e9f980 65109ns) | 21124137800:to(31:53)
1769: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21125194516 close=21127994632 span_ns=2800115 smi=4833->4833 opener=31:101 closer=31:164 events=3
1772: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21125194516 during: 21125194632:sys(5) | 21127941759:shoot(g=5256 2730969ns) | 21127986721:to(31:164)
1773: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu5 irqs open=21125194516 after: 21128000288:sys(5) | 21128048993:lock(src/process.rs:1272 0xffff800000e9f980 43118ns) | 21128793155:shoot(g=5260 728292ns) | 21128805673:to(31:189)
1774: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu6 irqs open=21116067720 close=21124007487 span_ns=7939767 smi=4833->4833 opener=31:38 closer=31:46 events=4
1777: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu6 irqs open=21116067720 during: 21116067857:sys(5) | 21116157354:lock(src/process.rs:1272 0xffff800000e9f980 85111ns) | 21123936076:shoot(g=5202 7758966ns) | 21123985330:to(31:46)
1778: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu6 irqs open=21116067720 after: 21124008349:irq(tlb) | 21124013277:sys(5) | 21124055107:lock(src/process.rs:1272 0xffff800000e9f980 38398ns) | 21124125641:lock(src/process.rs:1172 0xffff800000e9f980 31400ns)
1779: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu6 irqs open=21125050640 close=21127994230 span_ns=2943590 smi=4833->4833 opener=31:78 closer=31:86 events=4
1782: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu6 irqs open=21125050640 during: 21125050818:sys(5) | 21125100457:lock(src/process.rs:1272 0xffff800000e9f980 32834ns) | 21127941824:shoot(g=5251 2826311ns) | 21127984413:to(31:86)
1783: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu6 irqs open=21125050640 after: 21127995075:irq(tlb) | 21127999789:sys(5) | 21128030032:lock(src/process.rs:1272 0xffff800000e9f980 25791ns) | 21128793206:shoot(g=5259 744284ns)
1784: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21116053448 close=21124007731 span_ns=7954282 smi=4833->4833 opener=31:39 closer=31:47 events=5
1787: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21116053448 during: 21116053631:sys(5) | 21116123211:lock(src/process.rs:1272 0xffff800000e9f980 53087ns) | 21123936075:shoot(g=5200 7797800ns) | 21123982794:lock(src/process.rs:1174 0xffff80005f5d66a0 23808ns) | 21123991918:to(31:47)
1788: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21116053448 after: 21124008649:irq(tlb) | 21124013715:sys(5) | 21124072048:lock(src/process.rs:1272 0xffff800000e9f980 54827ns) | 21124125910:lock(src/process.rs:1172 0xffff800000e9f980 31388ns)
1789: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21125051946 close=21127992800 span_ns=2940854 smi=4833->4833 opener=31:87 closer=31:95 events=5
1792: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21125051946 during: 21125052096:sys(5) | 21125115548:lock(src/process.rs:1272 0xffff800000e9f980 47509ns) | 21127941796:shoot(g=5252 2808948ns) | 21127966209:to(31:95) | 21127992142:lock(src/process.rs:806 0xffff80005f5d66a0 23510ns)
1793: [2026-10-02 22:16:34 21.136 cpu5] scout: win cpu7 irqs open=21125051946 after: 21127993520:irq(tlb) | 21127997231:sys(5) | 21128793212:shoot(g=5258 763206ns) | 21128838594:to(31:97)

The fourteen shootdowns, and who acknowledged how

The 84 acknowledgements of the seven other targets come 463 to 21,204 ns after begin=, by poll (30), wait (42), own (11) or ipi (1, line 1855). The 14 of cpu1 come by ipi, 2,730,780 to 7,852,257 ns after begin= and 190 to 299 ns before end=. Each target line's trail: is left out but for two of cpu1's, quoted whole first.

1795: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu1 ack=21123935816 via=ipi seen=21123935923 trail: 21115144521:irq(tlb) | 21115149085:sys(120) | 21115999335:irq(tlb) | 21116006769:sys(120) | 21123935203:irq(tlb) | 21123937103:sys(15)
1803: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu1 ack=21127941536 via=ipi seen=21127941662 trail: 21125067204:irq(tlb) | 21125068756:sys(66) | 21125072793:sys(66) | 21125085258:irq(tlb) | 21125093411:sys(120) | 21127940952:irq(tlb)

1794: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 origin=unmap begin=21116196238 end=21123936066 span_ns=7739827 gap_ns=1676 gap_at=21118373602 probes=3
1795: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu1 ack=21123935816 via=ipi seen=21123935923
1796: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu2 ack=21116197160 via=wait seen=21123935938
1797: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu3 ack=21116197061 via=wait seen=21123935955
1798: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu4 ack=21116197310 via=wait seen=21123935971
1799: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu5 ack=21116196889 via=wait seen=21123935985
1800: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu6 ack=21116197284 via=wait seen=21123936003
1801: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5203 target=cpu7 ack=21116197076 via=wait seen=21123936019
1802: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 origin=unmap begin=21125166757 end=21127941801 span_ns=2775044 gap_ns=1071 gap_at=21125378788 probes=1
1803: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu1 ack=21127941536 via=ipi seen=21127941662
1804: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu2 ack=21125167245 via=wait seen=21127941677
1805: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu3 ack=21125167516 via=wait seen=21127941694
1806: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu4 ack=21125182582 via=own seen=21127941710
1807: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu5 ack=21125167225 via=poll seen=21127941729
1808: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu6 ack=21125167479 via=wait seen=21127941742
1809: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu0 gen=5254 target=cpu7 ack=21125167475 via=wait seen=21127941755
1810: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 origin=unmap begin=21116104150 end=21123936080 span_ns=7831929 gap_ns=1293 gap_at=21118221895 probes=3
1811: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu0 ack=21116104823 via=poll seen=21116104847
1812: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu1 ack=21123935816 via=ipi seen=21123935906
1813: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu3 ack=21116123876 via=own seen=21123935946
1814: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu4 ack=21116104811 via=poll seen=21123935985
1815: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu5 ack=21116104663 via=wait seen=21123936007
1816: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu6 ack=21116105050 via=poll seen=21123936021
1817: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5198 target=cpu7 ack=21116104899 via=poll seen=21123936037
1818: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 origin=unmap begin=21125100465 end=21127941835 span_ns=2841370 gap_ns=2783 gap_at=21126229477 probes=1
1819: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu0 ack=21125101101 via=poll seen=21125101061
1820: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu1 ack=21127941536 via=ipi seen=21127941649
1821: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu3 ack=21125101300 via=poll seen=21127941693
1822: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu4 ack=21125101089 via=poll seen=21127941719
1823: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu5 ack=21125103622 via=poll seen=21127941747
1824: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu6 ack=21125116047 via=own seen=21127941777
1825: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu2 gen=5250 target=cpu7 ack=21125101290 via=poll seen=21127941792
1826: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 origin=unmap begin=21116123138 end=21123936043 span_ns=7812905 gap_ns=1223 gap_at=21118323460 probes=3
1827: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu0 ack=21116123950 via=poll seen=21116124077
1828: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu1 ack=21123935816 via=ipi seen=21123935882
1829: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu2 ack=21116123668 via=wait seen=21123935910
1830: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu4 ack=21116123962 via=poll seen=21123935939
1831: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu5 ack=21116123623 via=wait seen=21123935958
1832: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu6 ack=21116123812 via=poll seen=21123935975
1833: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5199 target=cpu7 ack=21116138697 via=own seen=21123935994
1834: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 origin=unmap begin=21125149218 end=21127941753 span_ns=2792535 gap_ns=1089 gap_at=21127330055 probes=1
1835: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu0 ack=21125167366 via=own seen=21125167424
1836: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu1 ack=21127941536 via=ipi seen=21127941599
1837: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu2 ack=21125149712 via=wait seen=21127941627
1838: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu4 ack=21125149959 via=poll seen=21127941656
1839: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu5 ack=21125149681 via=poll seen=21127941676
1840: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu6 ack=21125149855 via=wait seen=21127941690
1841: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu3 gen=5253 target=cpu7 ack=21125149957 via=wait seen=21127941710
1842: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 origin=unmap begin=21116157319 end=21123936074 span_ns=7778754 gap_ns=1141 gap_at=21116197323 probes=3
1843: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu0 ack=21116158016 via=poll seen=21116158106
1844: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu1 ack=21123935816 via=ipi seen=21123935920
1845: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu2 ack=21116158313 via=wait seen=21123935946
1846: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu3 ack=21116157851 via=wait seen=21123935974
1847: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu5 ack=21116158321 via=wait seen=21123936009
1848: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu6 ack=21116177713 via=own seen=21123936024
1849: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5201 target=cpu7 ack=21116158128 via=wait seen=21123936039
1850: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 origin=unmap begin=21125181943 end=21127941813 span_ns=2759870 gap_ns=1037 gap_at=21125211726 probes=1
1851: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu0 ack=21125182608 via=wait seen=21125182681
1852: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu1 ack=21127941536 via=ipi seen=21127941665
1853: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu2 ack=21125182643 via=wait seen=21127941681
1854: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu3 ack=21125182501 via=wait seen=21127941697
1855: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu5 ack=21125192411 via=ipi seen=21127941734
1856: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu6 ack=21125182694 via=wait seen=21127941753
1857: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu4 gen=5255 target=cpu7 ack=21125182689 via=wait seen=21127941771
1858: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 origin=unmap begin=21116083559 end=21123936074 span_ns=7852515 gap_ns=8476 gap_at=21123347638 probes=3
1859: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu0 ack=21116084123 via=poll seen=21116084266
1860: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu1 ack=21123935816 via=ipi seen=21123935813
1861: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu2 ack=21116104763 via=own seen=21123935948
1862: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu3 ack=21116084313 via=poll seen=21123935962
1863: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu4 ack=21116084253 via=poll seen=21123935977
1864: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu6 ack=21116084511 via=poll seen=21123936011
1865: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5197 target=cpu7 ack=21116084324 via=poll seen=21123936026
1866: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 origin=unmap begin=21125210756 end=21127941726 span_ns=2730969 gap_ns=9428 gap_at=21126383368 probes=1
1867: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu0 ack=21125211545 via=wait seen=21125211624
1868: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu1 ack=21127941536 via=ipi seen=21127941534
1869: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu2 ack=21125211420 via=wait seen=21127941545
1870: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu3 ack=21125211321 via=wait seen=21127941616
1871: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu4 ack=21125211713 via=wait seen=21127941638
1872: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu6 ack=21125211606 via=wait seen=21127941657
1873: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu5 gen=5256 target=cpu7 ack=21125211488 via=wait seen=21127941681
1874: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 origin=unmap begin=21116177079 end=21123936046 span_ns=7758966 gap_ns=1247 gap_at=21118337366 probes=3
1875: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu0 ack=21116196713 via=own seen=21116197201
1876: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu1 ack=21123935816 via=ipi seen=21123935903
1877: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu2 ack=21116177822 via=wait seen=21123935929
1878: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu3 ack=21116177645 via=wait seen=21123935956
1879: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu4 ack=21116178037 via=wait seen=21123935971
1880: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu5 ack=21116178014 via=wait seen=21123935986
1881: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5202 target=cpu7 ack=21116177965 via=wait seen=21123936013
1882: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5251 origin=unmap begin=21125115500 end=21127941812 span_ns=2826311 gap_ns=1073 gap_at=21125342355 probes=1
1883: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5251 target=cpu0 ack=21125115998 via=poll seen=21125116145
1884: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5251 target=cpu1 ack=21127941536 via=ipi seen=21127941646
1885: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5251 target=cpu2 ack=21125116172 via=wait seen=21127941672
1886: [2026-10-02 22:16:34 21.136 cpu5] scout: shoot cpu6 gen=5251 target=cpu3 ack=21125116132 via=poll seen=21127941690
1887: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu6 gen=5251 target=cpu4 ack=21125116082 via=poll seen=21127941716
1888: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu6 gen=5251 target=cpu5 ack=21125117694 via=poll seen=21127941744
1889: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu6 gen=5251 target=cpu7 ack=21125133348 via=own seen=21127941775
1890: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 origin=unmap begin=21116138240 end=21123936041 span_ns=7797800 gap_ns=1180 gap_at=21118363380 probes=3
1891: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu0 ack=21116138794 via=poll seen=21116139030
1892: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu1 ack=21123935816 via=ipi seen=21123935880
1893: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu2 ack=21116139189 via=wait seen=21123935906
1894: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu3 ack=21116138978 via=wait seen=21123935932
1895: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu4 ack=21116157781 via=own seen=21123935950
1896: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu5 ack=21116139121 via=wait seen=21123935968
1897: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5200 target=cpu6 ack=21116139163 via=poll seen=21123935985
1898: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 origin=unmap begin=21125132813 end=21127941762 span_ns=2808948 gap_ns=2111 gap_at=21126369989 probes=1
1899: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu0 ack=21125133454 via=poll seen=21125133446
1900: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu1 ack=21127941536 via=ipi seen=21127941602
1901: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu2 ack=21125133445 via=wait seen=21127941623
1902: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu3 ack=21125149968 via=own seen=21127941636
1903: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu4 ack=21125133442 via=poll seen=21127941651
1904: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu5 ack=21125133293 via=poll seen=21127941679
1905: [2026-10-02 22:16:34 21.137 cpu5] scout: shoot cpu7 gen=5252 target=cpu6 ack=21125133589 via=wait seen=21127941706

The samples

cpu1's, sent by a CPU that had waited 2 ms on it (by=cpuM), cut after three frames:

1910: [2026-10-02 22:16:34 21.138 cpu5] scout: nmi cpu1 at=21118084019 by=cpu5 ring=0 if=0 who=4:0 masked_since=21116006613 rip=compiler_builtins::int::specialized_div_rem::u128_div_rem+0x8b stack: compiler_builtins::int::udiv::__udivti3+0x1d < <kernel::drivers::xhci::XhciController>::wait_transfer+0x1be < <kernel::drivers::xhci::XhciController>::bulk+0x123 < …
1911: [2026-10-02 22:16:34 21.138 cpu5] scout: nmi cpu1 at=21120084716 by=cpu5 ring=0 if=0 who=4:0 masked_since=21116006613 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1912: [2026-10-02 22:16:34 21.138 cpu5] scout: nmi cpu1 at=21122084374 by=cpu5 ring=0 if=0 who=4:0 masked_since=21116006613 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1913: [2026-10-02 22:16:34 21.139 cpu5] scout: nmi cpu1 at=21127102048 by=cpu2 ring=0 if=0 who=4:0 masked_since=21125093307 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …

One waiter's, whole, then every waiter's cut after rip= (each continues stack: core::ptr::drop_glue::<alloc::vec::Vec<kernel::mm::unmapped::Unmapped<kernel::process::PageAlloc+0x6e < kernel::process::thread_exit+0x603 < kernel::syscall::proc::sys_thread_exit+0x9 < …):

1906: [2026-10-02 22:16:34 21.137 cpu5] scout: nmi cpu0 at=21118372326 by=self ring=0 if=0 who=31:105 masked_since=21116071623 rip=kernel::arch::x86_64::tlb::shootdown+0x522 stack: core::ptr::drop_glue::<alloc::vec::Vec<kernel::mm::unmapped::Unmapped<kernel::process::PageAlloc+0x6e < kernel::process::thread_exit+0x603 < kernel::syscall::proc::sys_thread_exit+0x9 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x2239 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e
1906: [2026-10-02 22:16:34 21.137 cpu5] scout: nmi cpu0 at=21118372326 by=self ring=0 if=0 who=31:105 masked_since=21116071623 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1907: [2026-10-02 22:16:34 21.137 cpu5] scout: nmi cpu0 at=21120374413 by=self ring=0 if=0 who=31:105 masked_since=21116071623 rip=kernel::arch::x86_64::tlb::shootdown+0x3b2
1908: [2026-10-02 22:16:34 21.137 cpu5] scout: nmi cpu0 at=21122375961 by=self ring=0 if=0 who=31:105 masked_since=21116071623 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1909: [2026-10-02 22:16:34 21.138 cpu5] scout: nmi cpu0 at=21127379555 by=self ring=0 if=0 who=31:118 masked_since=21125063167 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1914: [2026-10-02 22:16:34 21.139 cpu5] scout: nmi cpu2 at=21118221012 by=self ring=0 if=0 who=31:34 masked_since=21116042174 rip=kernel::arch::x86_64::tlb::shootdown+0x317
1915: [2026-10-02 22:16:34 21.140 cpu5] scout: nmi cpu2 at=21120222681 by=self ring=0 if=0 who=31:34 masked_since=21116042174 rip=kernel::arch::x86_64::tlb::shootdown+0x52b
1916: [2026-10-02 22:16:34 21.140 cpu5] scout: nmi cpu2 at=21122224168 by=self ring=0 if=0 who=31:34 masked_since=21116042174 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1917: [2026-10-02 22:16:34 21.140 cpu5] scout: nmi cpu2 at=21127229538 by=self ring=0 if=0 who=31:82 masked_since=21125050429 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1919: [2026-10-02 22:16:34 21.141 cpu5] scout: nmi cpu3 at=21118322576 by=self ring=0 if=0 who=31:35 masked_since=21116053315 rip=kernel::arch::x86_64::tlb::shootdown+0x430
1920: [2026-10-02 22:16:34 21.141 cpu5] scout: nmi cpu3 at=21120324220 by=self ring=0 if=0 who=31:35 masked_since=21116053315 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1921: [2026-10-02 22:16:34 21.141 cpu5] scout: nmi cpu3 at=21122325603 by=self ring=0 if=0 who=31:35 masked_since=21116053315 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1922: [2026-10-02 22:16:34 21.141 cpu5] scout: nmi cpu3 at=21127329362 by=self ring=0 if=0 who=31:83 masked_since=21125052145 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1923: [2026-10-02 22:16:34 21.142 cpu5] scout: nmi cpu4 at=21118638202 by=self ring=0 if=0 who=31:28 masked_since=21116065154 rip=kernel::arch::x86_64::tlb::shootdown+0x407
1924: [2026-10-02 22:16:34 21.142 cpu5] scout: nmi cpu4 at=21120639497 by=self ring=0 if=0 who=31:28 masked_since=21116065154 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1925: [2026-10-02 22:16:34 21.142 cpu5] scout: nmi cpu4 at=21122640714 by=self ring=0 if=0 who=31:28 masked_since=21116065154 rip=kernel::arch::x86_64::tlb::shootdown+0x3a0
1926: [2026-10-02 22:16:34 21.142 cpu5] scout: nmi cpu4 at=21127643842 by=self ring=0 if=0 who=31:68 masked_since=21125068964 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1927: [2026-10-02 22:16:34 21.143 cpu5] scout: nmi cpu5 at=21118078242 by=self ring=0 if=0 who=31:37 masked_since=21116030264 rip=kernel::arch::x86_64::tlb::shootdown+0x40f
1928: [2026-10-02 22:16:34 21.143 cpu5] scout: nmi cpu5 at=21120080000 by=self ring=0 if=0 who=31:37 masked_since=21116030264 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1929: [2026-10-02 22:16:34 21.143 cpu5] scout: nmi cpu5 at=21122081477 by=self ring=0 if=0 who=31:37 masked_since=21116030264 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1930: [2026-10-02 22:16:34 21.144 cpu5] scout: nmi cpu6 at=21118336439 by=self ring=0 if=0 who=31:38 masked_since=21116067720 rip=kernel::arch::x86_64::tlb::shootdown+0x460
1931: [2026-10-02 22:16:34 21.144 cpu5] scout: nmi cpu6 at=21120338026 by=self ring=0 if=0 who=31:38 masked_since=21116067720 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1932: [2026-10-02 22:16:34 21.144 cpu5] scout: nmi cpu6 at=21122339457 by=self ring=0 if=0 who=31:38 masked_since=21116067720 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1933: [2026-10-02 22:16:34 21.144 cpu5] scout: nmi cpu6 at=21127343066 by=self ring=0 if=0 who=31:78 masked_since=21125050640 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1934: [2026-10-02 22:16:34 21.145 cpu5] scout: nmi cpu7 at=21118362589 by=self ring=0 if=0 who=31:39 masked_since=21116053448 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1935: [2026-10-02 22:16:34 21.145 cpu5] scout: nmi cpu7 at=21120364112 by=self ring=0 if=0 who=31:39 masked_since=21116053448 rip=kernel::arch::x86_64::tlb::shootdown+0x522
1936: [2026-10-02 22:16:34 21.145 cpu5] scout: nmi cpu7 at=21122365474 by=self ring=0 if=0 who=31:39 masked_since=21116053448 rip=kernel::arch::x86_64::tlb::shootdown+0x409
1937: [2026-10-02 22:16:34 21.145 cpu5] scout: nmi cpu7 at=21127370060 by=self ring=0 if=0 who=31:87 masked_since=21125051946 rip=kernel::arch::x86_64::tlb::shootdown+0x522

Japabu · 2026-10-02T22:42:05Z

Evidence 4 of 4: the firmware's interrupt. The boot and the instrument's guide are in evidence 1. Cited by issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md.

`MSR_SMI_COUNT` (MSR 0x34) on every CPU, at each of the boot's 42 reports

cpuN=C@T: the count as cpuN last read it, and when. In every line the eight counts are equal.

364: [2026-10-02 22:16:14 1.752 cpu1] scout: smi at=1752151655 cpu0=4824@1215797782 cpu1=4824@1752151643 cpu2=4824@1205411677 cpu3=4824@1746127955 cpu4=4824@1205398529 cpu5=4824@1200530131 cpu6=4824@1200529563 cpu7=4824@1215811852
444: [2026-10-02 22:16:14 1.760 cpu3] scout: smi at=1760607896 cpu0=4824@1760607706 cpu1=4824@1760608424 cpu2=4824@1758354796 cpu3=4824@1760607885 cpu4=4824@1758360048 cpu5=4824@1758338760 cpu6=4824@1758354806 cpu7=4824@1760090656
493: [2026-10-02 22:16:15 2.681 cpu3] scout: smi at=2681534182 cpu0=4824@2681533756 cpu1=4824@2681533591 cpu2=4824@2680663027 cpu3=4824@2681534172 cpu4=4824@2681452896 cpu5=4824@2680662427 cpu6=4824@2681431276 cpu7=4824@2681419277
521: [2026-10-02 22:16:16 3.620 cpu7] scout: smi at=3620887829 cpu0=4825@3620797094 cpu1=4825@3620888228 cpu2=4825@3620794277 cpu3=4825@3620883610 cpu4=4825@3620793211 cpu5=4825@3620794014 cpu6=4825@3620794088 cpu7=4825@3620887817
587: [2026-10-02 22:16:17 4.543 cpu4] scout: smi at=4543123784 cpu0=4825@4543026090 cpu1=4825@4543123682 cpu2=4825@4543027129 cpu3=4825@4543118533 cpu4=4825@4543123771 cpu5=4825@4543026603 cpu6=4825@4543027100 cpu7=4825@4543026703
625: [2026-10-02 22:16:18 5.453 cpu7] scout: smi at=5453550225 cpu0=4825@5453443619 cpu1=4825@5453551069 cpu2=4825@5453444114 cpu3=4825@5453544379 cpu4=4825@5453451569 cpu5=4825@5453443821 cpu6=4825@5453444245 cpu7=4825@5453550212
669: [2026-10-02 22:16:19 6.402 cpu2] scout: smi at=6402716000 cpu0=4826@6402593822 cpu1=4826@6402716998 cpu2=4826@6402715988 cpu3=4826@6402596930 cpu4=4826@6402596367 cpu5=4826@6402596825 cpu6=4826@6402718621 cpu7=4826@6402595974
722: [2026-10-02 22:16:20 7.322 cpu2] scout: smi at=7322339210 cpu0=4826@7322231893 cpu1=4826@7322339175 cpu2=4826@7322339198 cpu3=4826@7322232022 cpu4=4826@7322232508 cpu5=4826@7322231794 cpu6=4826@7322338555 cpu7=4826@7322230772
771: [2026-10-02 22:16:21 8.246 cpu7] scout: smi at=8246271203 cpu0=4827@8246177400 cpu1=4827@8246271742 cpu2=4827@8246177487 cpu3=4827@8246176823 cpu4=4827@8246177556 cpu5=4827@8246177457 cpu6=4827@8246267053 cpu7=4827@8246271192
805: [2026-10-02 22:16:22 9.213 cpu6] scout: smi at=9213127568 cpu0=4827@9213031642 cpu1=4827@9213127138 cpu2=4827@9213031101 cpu3=4827@9213039342 cpu4=4827@9213031257 cpu5=4827@9213031417 cpu6=4827@9213127556 cpu7=4827@9213030586
864: [2026-10-02 22:16:23 10.096 cpu2] scout: smi at=10096303373 cpu0=4828@10096198612 cpu1=4828@10096303027 cpu2=4828@10096303361 cpu3=4828@10096199088 cpu4=4828@10096198603 cpu5=4828@10096198432 cpu6=4828@10096294765 cpu7=4828@10096198129
956: [2026-10-02 22:16:24 11.027 cpu4] scout: smi at=11027676958 cpu0=4828@11027574165 cpu1=4828@11027677785 cpu2=4828@11027575096 cpu3=4828@11027574636 cpu4=4828@11027676947 cpu5=4828@11027574070 cpu6=4828@11027673946 cpu7=4828@11027574612
1024: [2026-10-02 22:16:24 11.959 cpu3] scout: smi at=11959250890 cpu0=4828@11959156829 cpu1=4828@11959247304 cpu2=4828@11959156653 cpu3=4828@11959250879 cpu4=4828@11959156824 cpu5=4828@11959157019 cpu6=4828@11959246727 cpu7=4828@11959155632
1067: [2026-10-02 22:16:25 12.876 cpu3] scout: smi at=12876433945 cpu0=4829@12876333646 cpu1=4829@12876429565 cpu2=4829@12876333283 cpu3=4829@12876433934 cpu4=4829@12876335659 cpu5=4829@12876333349 cpu6=4829@12876429678 cpu7=4829@12876332782
1117: [2026-10-02 22:16:26 13.777 cpu6] scout: smi at=13777639841 cpu0=4829@13777541224 cpu1=4829@13777640435 cpu2=4829@13777540693 cpu3=4829@13777548843 cpu4=4829@13777541205 cpu5=4829@13777540758 cpu6=4829@13777639828 cpu7=4829@13777540842
1145: [2026-10-02 22:16:27 14.664 cpu4] scout: smi at=14664036224 cpu0=4830@14663939536 cpu1=4830@14664037415 cpu2=4830@14663941119 cpu3=4830@14663940902 cpu4=4830@14664036212 cpu5=4830@14663940343 cpu6=4830@14664035713 cpu7=4830@14663939905
1240: [2026-10-02 22:16:28 15.612 cpu0] scout: smi at=15612083922 cpu0=4830@15612083911 cpu1=4830@15612083561 cpu2=4830@15611978642 cpu3=4830@15611979003 cpu4=4830@15612081403 cpu5=4830@15611978433 cpu6=4830@15611978682 cpu7=4830@15611977665
1273: [2026-10-02 22:16:29 16.510 cpu2] scout: smi at=16510856477 cpu0=4830@16510761840 cpu1=4830@16510852165 cpu2=4830@16510856466 cpu3=4830@16510761921 cpu4=4830@16510852772 cpu5=4830@16510762287 cpu6=4830@16510762211 cpu7=4830@16510761903
1317: [2026-10-02 22:16:30 17.431 cpu6] scout: smi at=17431913964 cpu0=4831@17431821070 cpu1=4831@17431913623 cpu2=4831@17431820995 cpu3=4831@17431821144 cpu4=4831@17431908130 cpu5=4831@17431821402 cpu6=4831@17431913951 cpu7=4831@17431820929
1570: [2026-10-02 22:16:31 18.340 cpu6] scout: smi at=18340065470 cpu0=4831@18339965741 cpu1=4831@18340065406 cpu2=4831@18339966210 cpu3=4831@18339965669 cpu4=4831@18340062929 cpu5=4831@18339967265 cpu6=4831@18340065459 cpu7=4831@18339964464
1630: [2026-10-02 22:16:32 19.303 cpu5] scout: smi at=19303173910 cpu0=4832@19303173896 cpu1=4832@19303065305 cpu2=4832@19303081021 cpu3=4832@19303089108 cpu4=4832@19302330658 cpu5=4832@19303173897 cpu6=4832@19303086578 cpu7=4832@19302330588
1664: [2026-10-02 22:16:33 20.221 cpu7] scout: smi at=20221469373 cpu0=4832@20221373756 cpu1=4832@20221470269 cpu2=4832@20221373685 cpu3=4832@20221373607 cpu4=4832@20221464783 cpu5=4832@20221373065 cpu6=4832@20221373972 cpu7=4832@20221469361
1708: [2026-10-02 22:16:34 21.134 cpu5] scout: smi at=21134205130 cpu0=4833@21134098853 cpu1=4833@21134205851 cpu2=4833@21134099189 cpu3=4833@21134099139 cpu4=4833@21134186833 cpu5=4833@21134205118 cpu6=4833@21134098114 cpu7=4833@21134098263
1985: [2026-10-02 22:16:35 22.085 cpu2] scout: smi at=22085297935 cpu0=4833@22085212567 cpu1=4833@22085297463 cpu2=4833@22085297922 cpu3=4833@22085213078 cpu4=4833@22085293707 cpu5=4833@22085212636 cpu6=4833@22085221366 cpu7=4833@22085214317
2046: [2026-10-02 22:16:36 23.089 cpu6] scout: smi at=23089954389 cpu0=4833@23089857173 cpu1=4833@23089954331 cpu2=4833@23089855944 cpu3=4833@23089856982 cpu4=4833@23089944741 cpu5=4833@23089856050 cpu6=4833@23089954377 cpu7=4833@23089856401
2074: [2026-10-02 22:16:37 24.039 cpu1] scout: smi at=24039933550 cpu0=4834@24039853570 cpu1=4834@24039933538 cpu2=4834@24039854025 cpu3=4834@24039858899 cpu4=4834@24039854162 cpu5=4834@24039853333 cpu6=4834@24039854015 cpu7=4834@24039853464
2138: [2026-10-02 22:16:37 24.933 cpu3] scout: smi at=24933594486 cpu0=4834@24933508697 cpu1=4834@24933595066 cpu2=4834@24933507660 cpu3=4834@24933594475 cpu4=4834@24933508850 cpu5=4834@24933508764 cpu6=4834@24933593837 cpu7=4834@24933513209
2166: [2026-10-02 22:16:38 25.881 cpu5] scout: smi at=25881212985 cpu0=4835@25881112894 cpu1=4835@25881212572 cpu2=4835@25881104853 cpu3=4835@25881105565 cpu4=4835@25881105122 cpu5=4835@25881212972 cpu6=4835@25881198495 cpu7=4835@25881104367
2216: [2026-10-02 22:16:39 26.761 cpu7] scout: smi at=26761586159 cpu0=4835@26761495782 cpu1=4835@26761582824 cpu2=4835@26761489763 cpu3=4835@26761485421 cpu4=4835@26761487008 cpu5=4835@26761485738 cpu6=4835@26761580563 cpu7=4835@26761586147
2244: [2026-10-02 22:16:40 27.702 cpu0] scout: smi at=27702963264 cpu0=4836@27702963253 cpu1=4836@27702963077 cpu2=4836@27702866075 cpu3=4836@27702866418 cpu4=4836@27702865064 cpu5=4836@27702865540 cpu6=4836@27702959561 cpu7=4836@27702865389
2294: [2026-10-02 22:16:41 28.620 cpu3] scout: smi at=28620017442 cpu0=4836@28619913889 cpu1=4836@28620017368 cpu2=4836@28619922518 cpu3=4836@28620017429 cpu4=4836@28619913745 cpu5=4836@28619914377 cpu6=4836@28619913982 cpu7=4836@28619913258
2336: [2026-10-02 22:16:42 29.510 cpu5] scout: smi at=29510098277 cpu0=4836@29509991690 cpu1=4836@29510097834 cpu2=4836@29509992154 cpu3=4836@29510085274 cpu4=4836@29509991673 cpu5=4836@29510098262 cpu6=4836@29509991583 cpu7=4836@29509990945
2380: [2026-10-02 22:16:43 30.395 cpu5] scout: smi at=30395377667 cpu0=4837@30395270040 cpu1=4837@30395377658 cpu2=4837@30395270559 cpu3=4837@30395270678 cpu4=4837@30395269777 cpu5=4837@30395377656 cpu6=4837@30395269373 cpu7=4837@30395269683
2427: [2026-10-02 22:16:44 31.321 cpu4] scout: smi at=31321268508 cpu0=4837@31321174206 cpu1=4837@31321265713 cpu2=4837@31321182593 cpu3=4837@31321174715 cpu4=4837@31321268494 cpu5=4837@31321174791 cpu6=4837@31321174306 cpu7=4837@31321174707
2486: [2026-10-02 22:16:45 32.272 cpu0] scout: smi at=32272556614 cpu0=4838@32272556601 cpu1=4838@32272551626 cpu2=4838@32272465233 cpu3=4838@32272465595 cpu4=4838@32272464120 cpu5=4838@32272464838 cpu6=4838@32272465225 cpu7=4838@32272464758
2526: [2026-10-02 22:16:46 33.190 cpu4] scout: smi at=33190730486 cpu0=4838@33190633442 cpu1=4838@33190730115 cpu2=4838@33190631673 cpu3=4838@33190636625 cpu4=4838@33190730475 cpu5=4838@33190631170 cpu6=4838@33190631719 cpu7=4838@33190631571
2570: [2026-10-02 22:16:47 34.119 cpu7] scout: smi at=34119707714 cpu0=4838@34119631428 cpu1=4838@34119702097 cpu2=4838@34119626111 cpu3=4838@34119627546 cpu4=4838@34119627822 cpu5=4838@34119627126 cpu6=4838@34119627905 cpu7=4838@34119707701
2598: [2026-10-02 22:16:48 35.108 cpu6] scout: smi at=35108545551 cpu0=4839@35108453096 cpu1=4839@35108536890 cpu2=4839@35108453412 cpu3=4839@35108453192 cpu4=4839@35108453108 cpu5=4839@35108452071 cpu6=4839@35108545538 cpu7=4839@35108453182
2657: [2026-10-02 22:16:49 36.011 cpu7] scout: smi at=36011317046 cpu0=4839@36011231749 cpu1=4839@36011312802 cpu2=4839@36011228221 cpu3=4839@36011226368 cpu4=4839@36011226033 cpu5=4839@36011234902 cpu6=4839@36011226555 cpu7=4839@36011317035
2690: [2026-10-02 22:16:49 36.930 cpu3] scout: smi at=36930177825 cpu0=4840@36930071472 cpu1=4840@36930177499 cpu2=4840@36930071817 cpu3=4840@36930177813 cpu4=4840@36930071454 cpu5=4840@36930071880 cpu6=4840@36930071674 cpu7=4840@36930169712
2751: [2026-10-02 22:16:50 37.855 cpu2] scout: smi at=37855204227 cpu0=4840@37855106985 cpu1=4840@37855204875 cpu2=4840@37855204216 cpu3=4840@37855107625 cpu4=4840@37855108014 cpu5=4840@37855107289 cpu6=4840@37855107940 cpu7=4840@37855106644
2779: [2026-10-02 22:16:51 38.792 cpu3] scout: smi at=38792853109 cpu0=4841@38792771857 cpu1=4841@38792855073 cpu2=4841@38792846916 cpu3=4841@38792853098 cpu4=4841@38792761138 cpu5=4841@38792760826 cpu6=4841@38792764003 cpu7=4841@38792770536

From 4824 (first read at 1,200,529,563 ns) to 4841 (38.79 s): 17 steps.

The 25 interrupts-off windows a step falls in

smi=A->B is the count at the window's opening and at its close. closed_at: and after: lines are left out, and opened_at: where it is kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70.

522: [2026-10-02 22:16:16 3.620 cpu7] scout: win cpu2 irqs open=3276851772 close=3281577599 span_ns=4725827 smi=4824->4825 opener=12:0 closer=12:0 events=1
525: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu2 irqs open=3276851772 during: 3276851857:sys(45)
670: [2026-10-02 22:16:19 6.402 cpu2] scout: win cpu0 irqs open=5492430336 close=5497184164 span_ns=4753828 smi=4825->4826 opener=15:0 closer=15:0 events=1
673: [2026-10-02 22:16:19 6.402 cpu2] scout: win cpu0 irqs open=5492430336 during: 5492430447:sys(63)
772: [2026-10-02 22:16:21 8.246 cpu7] scout: win cpu4 irqs open=7708598422 close=7713328706 span_ns=4730284 smi=4826->4827 opener=17:0 closer=17:0 events=1
775: [2026-10-02 22:16:21 8.246 cpu7] scout: win cpu4 irqs open=7708598422 during: 7708598509:sys(45)
865: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu0 irqs open=9925154838 close=9929853292 span_ns=4698453 smi=4827->4828 opener=idle closer=idle events=36
866: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu0 irqs open=9925154838 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
868: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu0 irqs open=9925154838 during: 9929765998:to(19:137) | 9929769946:to(19:140) | 9929775403:to(19:142) | 9929781878:to(19:143) | 9929791508:to(19:144) | 9929798201:to(19:147)
869: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu0 irqs open=9925154838 during: 9929803371:to(19:157) | 9929808444:to(19:154) | 9929813392:to(19:158) | 9929819691:to(19:160) | 9929827199:to(19:161) | 9929833517:to(19:162)
870: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu0 irqs open=9925154838 during: 9929840785:to(19:173) | 9929845185:to(19:218) | 9929849311:to(19:235) | 9929853057:to(idle)
872: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu1 irqs open=9925162847 close=9929853101 span_ns=4690254 smi=4827->4828 opener=idle closer=idle events=33
873: [2026-10-02 22:16:23 10.096 cpu2] scout: win cpu1 irqs open=9925162847 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
875: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu1 irqs open=9925162847 during: 9929766888:to(19:151) | 9929770963:to(19:156) | 9929778677:to(19:159) | 9929783499:to(19:184) | 9929792763:to(19:185) | 9929801106:to(19:188)
876: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu1 irqs open=9925162847 during: 9929806071:to(19:189) | 9929811976:to(19:191) | 9929816455:to(19:192) | 9929821254:to(19:194) | 9929826773:to(19:196) | 9929831931:to(19:204)
877: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu1 irqs open=9925162847 during: 9929838030:to(19:205) | 9929842750:to(19:207) | 9929848809:to(19:209) | 9929852808:to(idle)
879: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu2 irqs open=9925158740 close=9929850837 span_ns=4692096 smi=4827->4828 opener=idle closer=idle events=35
880: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu2 irqs open=9925158740 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
882: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu2 irqs open=9925158740 during: 9929769461:to(19:152) | 9929774182:to(19:155) | 9929781512:to(19:170) | 9929789411:to(19:174) | 9929795240:to(19:183) | 9929800161:to(19:190)
883: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu2 irqs open=9925158740 during: 9929804836:to(19:197) | 9929809629:to(19:199) | 9929814106:to(19:179) | 9929819063:to(19:195) | 9929824751:to(19:200) | 9929831198:to(19:202)
884: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu2 irqs open=9925158740 during: 9929836661:to(19:214) | 9929841505:to(19:222) | 9929846576:to(19:244) | 9929850554:to(idle)
886: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu3 irqs open=9925155435 close=9929839366 span_ns=4683930 smi=4827->4828 opener=idle closer=idle events=31
887: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu3 irqs open=9925155435 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
889: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu3 irqs open=9925155435 during: 9929749879:to(19:212) | 9929754565:to(19:216) | 9929759367:to(19:211) | 9929771187:to(19:223) | 9929778272:to(19:224) | 9929782620:to(19:237)
890: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu3 irqs open=9925155435 during: 9929791402:to(19:238) | 9929797099:to(19:226) | 9929801491:to(19:240) | 9929806272:to(19:242) | 9929812311:to(19:249) | 9929817095:to(19:251)
891: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu3 irqs open=9925155435 during: 9929821684:to(19:255) | 9929826846:to(19:256) | 9929832304:to(19:245) | 9929839089:to(idle)
893: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu4 irqs open=9925165464 close=9929848898 span_ns=4683434 smi=4827->4828 opener=idle closer=idle events=33
894: [2026-10-02 22:16:23 10.097 cpu2] scout: win cpu4 irqs open=9925165464 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
896: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu4 irqs open=9925165464 during: 9929769711:to(19:135) | 9929776741:to(19:139) | 9929781808:to(19:145) | 9929788686:to(19:148) | 9929795044:to(19:149) | 9929799803:to(19:150)
897: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu4 irqs open=9925165464 during: 9929803595:to(19:153) | 9929808915:to(19:138) | 9929813280:to(19:164) | 9929818355:to(19:165) | 9929822407:to(19:167) | 9929828929:to(19:168)
898: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu4 irqs open=9925165464 during: 9929833407:to(19:175) | 9929839607:to(19:176) | 9929843499:to(19:177) | 9929848631:to(idle)
900: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu5 irqs open=9925164162 close=9929850217 span_ns=4686055 smi=4827->4828 opener=idle closer=idle events=35
901: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu5 irqs open=9925164162 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
903: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu5 irqs open=9925164162 during: 9929771360:to(19:219) | 9929778658:to(19:220) | 9929782865:to(19:221) | 9929792675:to(19:225) | 9929797883:to(19:227) | 9929803103:to(19:228)
904: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu5 irqs open=9925164162 during: 9929807585:to(19:229) | 9929811402:to(19:230) | 9929815391:to(19:233) | 9929819488:to(19:236) | 9929825151:to(19:234) | 9929830917:to(19:241)
905: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu5 irqs open=9925164162 during: 9929835863:to(19:246) | 9929841309:to(19:247) | 9929846478:to(19:248) | 9929849950:to(idle)
907: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu6 irqs open=9925115255 close=9929880191 span_ns=4764935 smi=4827->4828 opener=19:0 closer=19:0 events=1
910: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu6 irqs open=9925115255 during: 9925115389:sys(45)
912: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu7 irqs open=9925108095 close=9929700932 span_ns=4592837 smi=4827->4828 opener=idle closer=idle events=17
913: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu7 irqs open=9925108095 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
915: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu7 irqs open=9925108095 during: 9925114292:to(19:10) | 9925121222:to(19:11) | 9925130823:to(19:19) | 9925136721:to(19:27) | 9925141630:to(19:35) | 9925146559:to(19:43)
916: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu7 irqs open=9925108095 during: 9925153410:to(19:51) | 9925159106:to(19:59) | 9925164613:to(19:67) | 9925169485:to(19:75) | 9925175274:to(19:83) | 9929685472:lock(src/sched/payload.rs:33 0xffff800008305c80 4506968ns)
917: [2026-10-02 22:16:23 10.098 cpu2] scout: win cpu7 irqs open=9925108095 during: 9929688377:to(19:90) | 9929692464:to(19:181) | 9929696918:to(19:187) | 9929700599:to(idle)
1068: [2026-10-02 22:16:25 12.876 cpu3] scout: win cpu5 irqs open=12146739691 close=12151456863 span_ns=4717172 smi=4828->4829 opener=22:0 closer=22:0 events=1
1071: [2026-10-02 22:16:25 12.876 cpu3] scout: win cpu5 irqs open=12146739691 during: 12146739789:sys(45)
1146: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu0 irqs open=14363229795 close=14367880799 span_ns=4651004 smi=4829->4830 opener=24:0 closer=idle events=18
1147: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu0 irqs open=14363229795 opened_at: kernel::arch::x86_64::idt::timer::timer_handler+0xd < kernel::arch::x86_64::idt::timer::timer_entry+0x59
1149: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu0 irqs open=14363229795 during: 14363260128:to(24:15) | 14363263440:to(24:23) | 14363266279:to(24:31) | 14363269288:to(24:63) | 14363272507:to(24:55) | 14363277770:to(24:71)
1150: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu0 irqs open=14363229795 during: 14363285170:to(24:79) | 14367816917:to(24:87) | 14367827380:to(24:95) | 14367837715:to(24:97) | 14367853248:to(24:103) | 14367860387:to(24:111)
1151: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu0 irqs open=14363229795 during: 14367866773:to(24:114) | 14367872568:to(24:121) | 14367876900:to(24:126) | 14367880514:to(idle)
1159: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu4 irqs open=14363275948 close=14368004296 span_ns=4728348 smi=4829->4830 opener=24:0 closer=24:0 events=1
1162: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu4 irqs open=14363275948 during: 14363276063:sys(45)
1168: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu5 irqs open=14363289476 close=14367818990 span_ns=4529514 smi=4829->4830 opener=idle closer=idle events=2
1169: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu5 irqs open=14363289476 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
1171: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu5 irqs open=14363289476 during: 14363289591:to(24:249) | 14367818675:to(idle)
1631: [2026-10-02 22:16:32 19.303 cpu5] scout: win cpu2 irqs open=18794036429 close=18798762258 span_ns=4725829 smi=4831->4832 opener=29:0 closer=29:0 events=1
1634: [2026-10-02 22:16:32 19.303 cpu5] scout: win cpu2 irqs open=18794036429 during: 18794036513:sys(45)
1739: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21013503522 close=21018245462 span_ns=4741940 smi=4832->4833 opener=31:0 closer=31:0 events=1
1742: [2026-10-02 22:16:34 21.135 cpu5] scout: win cpu3 irqs open=21013503522 during: 21013503646:sys(45)
2085: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu5 irqs open=23230023587 close=23234782472 span_ns=4758884 smi=4833->4834 opener=34:0 closer=34:0 events=1
2088: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu5 irqs open=23230023587 during: 23230023694:sys(40)
2167: [2026-10-02 22:16:38 25.881 cpu5] scout: win cpu3 irqs open=25445385451 close=25450110369 span_ns=4724917 smi=4834->4835 opener=36:0 closer=36:0 events=1
2170: [2026-10-02 22:16:38 25.881 cpu5] scout: win cpu3 irqs open=25445385451 during: 25445385537:sys(45)
2245: [2026-10-02 22:16:40 27.702 cpu0] scout: win cpu2 irqs open=27660934258 close=27665660867 span_ns=4726609 smi=4835->4836 opener=38:0 closer=38:0 events=1
2248: [2026-10-02 22:16:40 27.703 cpu0] scout: win cpu2 irqs open=27660934258 during: 27660934346:sys(45)
2492: [2026-10-02 22:16:45 32.272 cpu0] scout: win cpu7 irqs open=32123866829 close=32128591020 span_ns=4724191 smi=4837->4838 opener=43:0 closer=43:0 events=1
2495: [2026-10-02 22:16:45 32.273 cpu0] scout: win cpu7 irqs open=32123866829 during: 32123866914:sys(45)
2604: [2026-10-02 22:16:48 35.108 cpu6] scout: win cpu5 irqs open=34340403985 close=34345123915 span_ns=4719929 smi=4838->4839 opener=46:0 closer=46:0 events=1
2607: [2026-10-02 22:16:48 35.108 cpu6] scout: win cpu5 irqs open=34340403985 during: 34340404071:sys(45)
2691: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu5 irqs open=36555922450 close=36560656959 span_ns=4734508 smi=4839->4840 opener=48:0 closer=48:0 events=1
2694: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu5 irqs open=36555922450 during: 36555922534:sys(45)
2700: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 irqs open=36555942832 close=36560657093 span_ns=4714261 smi=4839->4840 opener=idle closer=6:0 events=2
2701: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 irqs open=36555942832 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x2b < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
2703: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 irqs open=36555942832 during: 36555943353:to(6:0) | 36560655717:lock(src/process.rs:806 0xffff80005f5d66a0 4704367ns)
2780: [2026-10-02 22:16:51 38.792 cpu3] scout: win cpu7 irqs open=38776568667 close=38781275190 span_ns=4706523 smi=4840->4841 opener=50:0 closer=50:0 events=1
2783: [2026-10-02 22:16:51 38.793 cpu3] scout: win cpu7 irqs open=38776568667 during: 38776568754:sys(45)

Sixteen open in a process's syscall or interrupt, 4,651,004 to 4,764,935 ns: sys(45) thirteen times, sys(63), sys(40), and the timer interrupt (1146). Nine open in a pass leaving idle, 4,529,514 to 4,714,261 ns. No window that opens in sys(45), sys(63), sys(40), an interrupt or a pass leaving idle is printed with the count unmoved, and the scout prints every window of 2 ms or more (long_ns=2000000, line 345).

The seven preemption-off windows at the same instants

A preempt window records no count (smi=0->0).

675: [2026-10-02 22:16:19 6.402 cpu2] scout: win cpu6 preempt open=5492433621 close=5496965130 span_ns=4531508 smi=0->0 opener=idle closer=idle events=1
676: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu6 preempt open=5492433621 opened_at: <kernel::hw::KernelHw as toyos_sched::hw::Machine>::idle_wait+0x1e < kernel::sched::driver::pass+0x1a0 < kernel::sched::driver::idle_loop+0x26
678: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu6 preempt open=5492433621 during: 5492433813:wake
1153: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu2 preempt open=14363281729 close=14367817350 span_ns=4535621 smi=0->0 opener=idle closer=idle events=0
1154: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu2 preempt open=14363281729 opened_at: kernel::sched::driver::pass+0x47 < kernel::sched::driver::idle_loop+0x26
1156: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu3 preempt open=14363287121 close=14367815946 span_ns=4528824 smi=0->0 opener=idle closer=idle events=0
1157: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu3 preempt open=14363287121 opened_at: kernel::sched::driver::pass+0x47 < kernel::sched::driver::idle_loop+0x26
1164: [2026-10-02 22:16:27 14.664 cpu4] scout: win cpu5 preempt open=14363289334 close=14367817793 span_ns=4528459 smi=0->0 opener=idle closer=24:249 events=1
1165: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu5 preempt open=14363289334 opened_at: kernel::sched::driver::pass+0x131 < kernel::sched::driver::idle_loop+0x26
1167: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu5 preempt open=14363289334 during: 14363289591:to(24:249)
1183: [2026-10-02 22:16:27 14.666 cpu4] scout: win cpu6 preempt open=14363270163 close=14367815767 span_ns=4545603 smi=0->0 opener=idle closer=idle events=0
1184: [2026-10-02 22:16:27 14.666 cpu4] scout: win cpu6 preempt open=14363270163 opened_at: kernel::sched::driver::pass+0x47 < kernel::sched::driver::idle_loop+0x26
1186: [2026-10-02 22:16:27 14.666 cpu4] scout: win cpu7 preempt open=14363273071 close=14367815283 span_ns=4542211 smi=0->0 opener=idle closer=idle events=0
1187: [2026-10-02 22:16:27 14.666 cpu4] scout: win cpu7 preempt open=14363273071 opened_at: kernel::sched::driver::pass+0x47 < kernel::sched::driver::idle_loop+0x26
2696: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 preempt open=36555942430 close=36560656433 span_ns=4714002 smi=0->0 opener=idle closer=6:0 events=2
2697: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 preempt open=36555942430 opened_at: kernel::sched::driver::pass+0x131 < kernel::sched::driver::idle_loop+0x26
2699: [2026-10-02 22:16:49 36.930 cpu3] scout: win cpu7 preempt open=36555942430 during: 36555943353:to(6:0) | 36560655717:lock(src/process.rs:806 0xffff80005f5d66a0 4704367ns)

The three lock waits

927: [2026-10-02 22:16:23 10.101 cpu2] scout: lock cpu0 lock=0xffff800008305c80 at=src/sched/payload.rs:33 begin=9925178871 end=9929686134 span_ns=4507263 gap_ns=4503694 gap_at=9929682565 holder=cpu4 held_ns=4503694 holder_at=src/sched/payload.rs:33 probes=2
928: [2026-10-02 22:16:23 10.101 cpu2] scout: lock cpu7 lock=0xffff800008305c80 at=src/sched/payload.rs:33 begin=9925178391 end=9929685360 span_ns=4506968 gap_ns=219 gap_at=9925178610 holder=cpu0 held_ns=4506749 holder_at=src/sched/payload.rs:33 probes=0
2707: [2026-10-02 22:16:49 36.931 cpu3] scout: lock cpu7 lock=0xffff80005f5d66a0 at=src/process.rs:806 begin=36555951319 end=36560655686 span_ns=4704367 gap_ns=4554675 gap_at=36560591261 holder=cpu5 held_ns=4704367 holder_at=src/syscall/machine.rs:195 probes=2

The samples in those windows, cut after three frames

One in each of the 25, taken 4,515,840 to 4,698,451 ns after its window opened and 6,811 to 221,362 ns before it closed. The control's hold (evidence 1) is sampled every 2 ms.

537: [2026-10-02 22:16:16 3.621 cpu7] scout: nmi cpu2 at=3281459674 by=self ring=0 if=0 who=12:0 masked_since=3276851772 rip=compiler_builtins::mem::memcpy+0x37 stack: toyos_userbound::segment::pieces::<<kernel::user_ptr::View>::pieces<<kernel::user_ptr::UserBytes+0xeb < <kernel::user_ptr::View>::pieces::<<kernel::user_ptr::UserBytesMut>::write_at::{closure#0}>+0x4e < kernel::syscall::machine::sys_sysinfo+0xa6d < …
689: [2026-10-02 22:16:19 6.403 cpu2] scout: nmi cpu0 at=5496962802 by=self ring=0 if=0 who=15:0 masked_since=5492430336 rip=compiler_builtins::mem::memset+0x43 stack: kernel::mm::pmm::alloc_contiguous+0x2b8 < kernel::syscall::vm::sys_mmap+0x157 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
777: [2026-10-02 22:16:21 8.246 cpu7] scout: nmi cpu4 at=7713286652 by=self ring=0 if=0 who=17:0 masked_since=7708598422 rip=<core::iter::adapters::map::Map<core::iter::adapters::filter_map::FilterMap<core::slice::iter::I+0x5d stack: kernel::syscall::machine::sys_sysinfo+0x732 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
919: [2026-10-02 22:16:23 10.099 cpu2] scout: nmi cpu0 at=9929681727 by=self ring=0 if=0 who=19:36 masked_since=9925154838 rip=<kernel::sync::Lock<alloc::vec::Vec<kernel::arch::x86_64::vtd::Live>>>::lock+0x121 stack: <kernel::sched::payload::KernelLock<toyos_sched::fair::ShareState> as toyos_sched::sync::CellLoc+0x19 < <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x87 < kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0x1fd < …
920: [2026-10-02 22:16:23 10.099 cpu2] scout: nmi cpu1 at=9929683358 by=self ring=0 if=0 who=19:21 masked_since=9925162847 rip=kernel::arch::x86_64::apic::arm_one_shot+0x8a stack: <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x1a9 < <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0xac3 < kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0x208 < …
921: [2026-10-02 22:16:23 10.099 cpu2] scout: nmi cpu2 at=9929684085 by=self ring=0 if=0 who=19:30 masked_since=9925158740 rip=<toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x4cc stack: kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0x208 < kernel::sched::driver::pass_block+0xe7 < kernel::watch::wait_inner::<kernel::watch::IrqLock<toyos_sched::watch::Waiters<toyos_sched::msg:+0x13c < …
922: [2026-10-02 22:16:23 10.100 cpu2] scout: nmi cpu3 at=9929684924 by=self ring=0 if=0 who=19:39 masked_since=9925155435 rip=<kernel::sync::Lock<kernel::arch::x86_64::vtd::interrupt::Remap>>::lock+0x4bd stack: <kernel::inbox::Inbox>::with_state::<bool, <alloc::sync::Arc<kernel::inbox::Inbox> as kernel::in+0x19 < kernel::watch::wait_until::<kernel::watch::IrqLock<toyos_sched::watch::Waiters<toyos_sched::msg:+0x19b < kernel::inbox::submit+0x836 < …
923: [2026-10-02 22:16:23 10.100 cpu2] scout: nmi cpu4 at=9929681304 by=self ring=0 if=0 who=19:24 masked_since=9925165464 rip=<alloc::collections::btree::node::Handle<alloc::collections::btree::node::NodeRef<alloc::collect+0xef stack: <toyos_sched::cpu::CpuSched<kernel::sched::payload::KernelPayload>>::fire_deadlines::<kernel::hw+0x10c < <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x253 < kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0xbf < …
924: [2026-10-02 22:16:23 10.100 cpu2] scout: nmi cpu5 at=9929682816 by=self ring=0 if=0 who=19:17 masked_since=9925164162 rip=<toyos_sched::windows::Windows>::preempt_since+0x8 stack: kernel::windows::preempt_set+0x57 < <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0xda < kernel::sched::driver::execute+0x155 < …
925: [2026-10-02 22:16:23 10.101 cpu2] scout: nmi cpu6 at=9929683535 by=self ring=0 if=0 who=19:0 masked_since=9925115255 rip=kernel::syscall::machine::sys_sysinfo+0x880 stack: kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e < …
926: [2026-10-02 22:16:23 10.101 cpu2] scout: nmi cpu7 at=9929684415 by=self ring=0 if=0 who=19:83 masked_since=9925108095 rip=<kernel::sync::Lock<alloc::vec::Vec<kernel::arch::x86_64::vtd::Live>>>::lock+0x281 stack: <kernel::sched::payload::KernelLock<toyos_sched::fair::ShareState> as toyos_sched::sync::CellLoc+0x19 < <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x87 < kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0x1fd < …
1073: [2026-10-02 22:16:25 12.876 cpu3] scout: nmi cpu5 at=12151359260 by=self ring=0 if=0 who=22:0 masked_since=12146739691 rip=compiler_builtins::mem::memcpy+0x34 stack: toyos_userbound::segment::pieces::<<kernel::user_ptr::View>::pieces<<kernel::user_ptr::UserBytes+0xeb < <kernel::user_ptr::View>::pieces::<<kernel::user_ptr::UserBytesMut>::write_at::{closure#0}>+0x4e < kernel::syscall::machine::sys_sysinfo+0xa6d < …
1189: [2026-10-02 22:16:27 14.666 cpu4] scout: nmi cpu0 at=14367810996 by=self ring=0 if=0 who=24:79 masked_since=14363229795 rip=toyos_sched::task::legal+0x0 stack: <toyos_sched::task::ReadyTask<kernel::sched::payload::KernelPayload>>::dispatch+0x68 < <toyos_sched::cpu::SchedPass<kernel::hw::KernelHw, kernel::sched::driver::PreemptOff, toyos_sche+0x463 < kernel::sched::driver::with_cpu::<(toyos_sched::cpu::Action<kernel::sched::payload::KernelPayloa+0x208 < …
1190: [2026-10-02 22:16:27 14.667 cpu4] scout: nmi cpu4 at=14367810641 by=self ring=0 if=0 who=24:0 masked_since=14363275948 rip=core::slice::sort::stable::quicksort::quicksort::<(toyos_abi::Tid, &kernel::process::ProcessEntr+0x40c stack: core::slice::sort::stable::quicksort::quicksort::<(toyos_abi::Tid, &kernel::process::ProcessEntr+0x500 < core::slice::sort::stable::drift::sort::<(toyos_abi::Tid, &kernel::process::ProcessEntry, &kerne+0x678 < core::slice::sort::stable::driftsort_main::<(toyos_abi::Tid, &kernel::process::ProcessEntry, &ke+0xf1 < …
1191: [2026-10-02 22:16:27 14.667 cpu4] scout: nmi cpu5 at=14367812179 by=self ring=0 if=0 who=24:249 masked_since=14363289476 rip=<kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x219 stack: -
1636: [2026-10-02 22:16:32 19.303 cpu5] scout: nmi cpu2 at=18798649716 by=self ring=0 if=0 who=29:0 masked_since=18794036429 rip=kernel::syscall::machine::sys_sysinfo+0xa74 stack: kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e < …
1918: [2026-10-02 22:16:34 21.140 cpu5] scout: nmi cpu3 at=21018149059 by=self ring=0 if=0 who=31:0 masked_since=21013503522 rip=<core::iter::adapters::map::Map<core::iter::adapters::filter_map::FilterMap<core::slice::iter::I+0x6c stack: kernel::syscall::machine::sys_sysinfo+0x732 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
2094: [2026-10-02 22:16:37 24.041 cpu1] scout: nmi cpu5 at=23234629118 by=self ring=0 if=0 who=34:0 masked_since=23230023587 rip=compiler_builtins::mem::memset+0x43 stack: kernel::mm::pmm::alloc_contiguous+0x2b8 < kernel::loader::tls::build_combined+0x84 < <kernel::loader::tls::TlsBlock>::build+0xbb < …
2172: [2026-10-02 22:16:38 25.881 cpu5] scout: nmi cpu3 at=25450045059 by=self ring=0 if=0 who=36:0 masked_since=25445385451 rip=compiler_builtins::mem::memcpy+0x37 stack: toyos_userbound::segment::pieces::<<kernel::user_ptr::View>::pieces<<kernel::user_ptr::UserBytes+0xeb < <kernel::user_ptr::View>::pieces::<<kernel::user_ptr::UserBytesMut>::write_at::{closure#0}>+0x4e < kernel::syscall::machine::sys_sysinfo+0xa6d < …
2250: [2026-10-02 22:16:40 27.703 cpu0] scout: nmi cpu2 at=27665505867 by=self ring=0 if=0 who=38:0 masked_since=27660934258 rip=<core::iter::adapters::map::Map<core::iter::adapters::filter_map::FilterMap<core::slice::iter::I+0x5d stack: kernel::syscall::machine::sys_sysinfo+0x732 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
2498: [2026-10-02 22:16:45 32.273 cpu0] scout: nmi cpu7 at=32128565280 by=self ring=0 if=0 who=43:0 masked_since=32123866829 rip=<core::iter::adapters::map::Map<core::iter::adapters::filter_map::FilterMap<core::slice::iter::I+0x5d stack: kernel::syscall::machine::sys_sysinfo+0x732 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
2613: [2026-10-02 22:16:48 35.110 cpu6] scout: nmi cpu5 at=34345079873 by=self ring=0 if=0 who=46:0 masked_since=34340403985 rip=compiler_builtins::mem::memcpy+0x37 stack: toyos_userbound::segment::pieces::<<kernel::user_ptr::View>::pieces<<kernel::user_ptr::UserBytes+0xeb < <kernel::user_ptr::View>::pieces::<<kernel::user_ptr::UserBytesMut>::write_at::{closure#0}>+0x4e < kernel::syscall::machine::sys_sysinfo+0xa6d < …
2705: [2026-10-02 22:16:49 36.930 cpu3] scout: nmi cpu5 at=36560589496 by=self ring=0 if=0 who=48:0 masked_since=36555922450 rip=<core::iter::adapters::map::Map<core::iter::adapters::filter_map::FilterMap<core::slice::iter::I+0x50 stack: kernel::syscall::machine::sys_sysinfo+0x732 < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x10e5 < kernel::syscall::dispatch::syscall_dispatch+0x95 < …
2706: [2026-10-02 22:16:49 36.931 cpu3] scout: nmi cpu7 at=36560590214 by=self ring=0 if=0 who=6:0 masked_since=36555942832 rip=<kernel::sync::Lock<core::option::Option<kernel::process::ProcessTable>>>::lock+0x2a2 stack: kernel::process::current_data+0x1e < kernel::process::with_current_data::<(), kernel::syscall::dispatch::syscall_dispatch::{closure#2+0x13 < kernel::syscall::dispatch::syscall_dispatch+0xeb < …
2785: [2026-10-02 22:16:51 38.793 cpu3] scout: nmi cpu7 at=38781119695 by=self ring=0 if=0 who=50:0 masked_since=38776568667 rip=compiler_builtins::mem::memcpy+0x31 stack: toyos_userbound::segment::pieces::<<kernel::user_ptr::View>::pieces<<kernel::user_ptr::UserBytes+0xeb < <kernel::user_ptr::View>::pieces::<<kernel::user_ptr::UserBytesMut>::write_at::{closure#0}>+0x4e < kernel::syscall::machine::sys_sysinfo+0xa6d < …

When

The latest close= among the windows that caught each step, and the time since the step before:

count	windows	latest `close=`, ns	since the one before, ns
4825	1	3281577599
4826	1	5497184164	2215606565
4827	1	7713328706	2216144542
4828	8	9929880191	2216551485
4829	1	12151456863	2221576672
4830	3	14368004296	2216547433
4831	0
4832	1	18798762258	4430757962 over 2 steps
4833	1	21018245462	2219483204
4834	1	23234782472	2216537010
4835	1	25450110369	2215327897
4836	1	27665660867	2215550498
4837	0
4838	1	32128591020	4462930153 over 2 steps
4839	1	34345123915	2216532895
4840	2	36560657093	2215533178
4841	1	38781275190	2220618097

Twelve single steps: 2,215,327,897 to 2,221,576,672 ns, median 2,216,534,952. From the first caught to the last, 35,499,697,591 ns over 16 steps.

Linux on the same machine

linuxcmp/smi.sh ran perf stat -a -A -e msr/smi/ -o $f -- rtla timerlat top -q -d 2m --dma-latency 0 as root on the T14's Ubuntu; linuxcmp/linux-smi.log, whole but for the terminal's colour codes:

aperf
cpu_thermal_margin
cpu_thermal_margin.snapshot
cpu_thermal_margin.unit
mperf
pperf
smi
tsc
                                     Timer Latency                                              
  0 00:02:00   |          IRQ Timer Latency (us)        |         Thread Timer Latency (us)
CPU COUNT      |      cur       min       avg       max |      cur       min       avg       max
  0 #120000    |        0         0         0         4 |        2         1         2        25
  1 #120000    |        0         0         0        53 |        2         1         2       592
  2 #120000    |        0         0         0         4 |        2         1         2        12
  3 #120000    |        0         0         0        35 |        2         1         2        40
  4 #120000    |        0         0         0        13 |        2         1         2        15
  5 #120000    |        0         0         0        39 |        2         1         2        91
  6 #120000    |        0         0         0        19 |        2         1         2        23
  7 #120000    |        0         0         0        19 |        2         1         2        49
# started on Fri Oct  2 21:30:16 2026


 Performance counter stats for 'system wide':

CPU0                    0      msr/smi/                                                              
CPU1                    0      msr/smi/                                                              
CPU2                    0      msr/smi/                                                              
CPU3                    0      msr/smi/                                                              
CPU4                    0      msr/smi/                                                              
CPU5                    0      msr/smi/                                                              
CPU6                    0      msr/smi/                                                              
CPU7                    0      msr/smi/                                                              

     120.378123249 seconds time elapsed

done

That Linux, from linuxcmp/linux-t14.log, whose script runs uname -r; nproc; grep -m1 "model name" /proc/cpuinfo; cat /sys/kernel/debug/sched/preempt first:

6.8.0-142-generic
8
model name	: 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz
none (voluntary) full

What the tree does about the firmware's interrupts

At a93067fc2:

$ rg -n -i 'smi_cmd|acpi_enable|sci_en|smi_en|0xb2\b' kernel/src bootloader/src
kernel/src/drivers/xhci/legacy.rs:22:const SMI_ENABLES: u32 = (1 << 0) | (1 << 4) | (1 << 13) | (1 << 14) | (1 << 15);
kernel/src/drivers/xhci/legacy.rs:157:    bar.write_u32(legsup + LEGCTLSTS, (ctl & !SMI_ENABLES) | SMI_STATUS);
EXIT=0
$ git grep -n -i -E 'smi_cmd|acpi_enable|sci_en|smi_en\b|SMI_EN[^A-Z]' HEAD -- . ':!issues' ':!rust'
HEAD:tests/common/power.rs:123:/// set through every write this tree makes, and what it gates is `SMI_EN.TCO_EN`
HEAD:toyos-tco/src/lib.rs:59:/// gates is `SMI_EN.TCO_EN` — not the countdown and not the reboot.
EXIT=0
$ rg -n 'inw|inl|inb' kernel/src/arch/x86_64/power.rs
EXIT=1

The first search's two hits are the xHCI legacy handoff's own enables in USBLEGCTLSTS (SMI_ENABLES matches smi_en); the second's two are doc comments about the TCO watchdog; the third finds no port read in the module that writes PM1a_CNT for soft-off. Nothing writes SMI_CMD, and nothing reads PM1a_CNT.SCI_EN or the chipset's SMI_EN. The handoff, in this boot:

16: [2026-10-02 22:16:13 0.000 cpu0 boot] ACPI: FACP at 0x90ca0000 len=276 rev=6 oem="LENOVO" checksummed
28: [2026-10-02 22:16:13 0.000 cpu0] ACPI: PM1a=0x1804 SLP_TYPa=7
167: [2026-10-02 22:16:13 0.250 cpu0] xHCI: firmware did not claim the controller (USBLEGSUP 0x01002201)
168: [2026-10-02 22:16:13 0.250 cpu0] xHCI: USBLEGCTLSTS 0xe0000000 -> 0x00000000 (SMI generation off)
187: [2026-10-02 22:16:13 0.250 cpu0] xHCI: firmware did not claim the controller (USBLEGSUP 0x01002201)
188: [2026-10-02 22:16:13 0.250 cpu0] xHCI: USBLEGCTLSTS 0xe0000000 -> 0x00000000 (SMI generation off)

Reported, with no output kept

The orchestrator reports from that Linux: the FADT's SMI_CMD=0xb2 and ACPI_ENABLE=0xf0, PM1a_CNT.SCI_EN=1, and SMI_EN=0x10002033. No file under the session's scratch directory carries the output of those reads: grep -rIl 10002033 over it finds the orchestrator's own notes and nothing else. They are quoted here as reported, not as read.

The three files that rest on the scout boot now name the comments its lines are quoted in: 5962618149 (the boot, its control, the storage windows), 5962618492 and 5962618868 (the two all-CPU events) and 5962619169 (the firmware's interrupt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-02T22:43:06Z

The scout patch, part 1 of 2. The throwaway instrument the evidence comments read (never landed): scout.patch, 1,859 lines, sha256 f5a0208c10d9a31264711539e9f70ee436609551670f01ae0bd08a6ae2ac458a, applied on c59e09ed6 for the staging and reversed. Part 1 and part 2, each taken from between the fences and joined in order with nothing between them, are that file byte for byte.

diff --git a/kernel/src/arch/x86_64/hw.rs b/kernel/src/arch/x86_64/hw.rs
index 50ed0a049..5e9266dbb 100644
--- a/kernel/src/arch/x86_64/hw.rs
+++ b/kernel/src/arch/x86_64/hw.rs
@@ -303,6 +303,8 @@ impl Hw for KernelHw {
             crate::preempt::set_count(incoming.preempt);
             percpu::set_current_tid(incoming.id.map(|id| id.1));
             percpu::set_current_pid(incoming.id.map(|id| id.0));
+            #[cfg(feature = "mask-windows")]
+            crate::windows::note_switch();
             match incoming.id {
                 Some(_) => {
                     percpu::set_kernel_stack(incoming.kernel_stack_top);
diff --git a/kernel/src/arch/x86_64/idt/mod.rs b/kernel/src/arch/x86_64/idt/mod.rs
index c7f63b304..a5a7702b1 100644
--- a/kernel/src/arch/x86_64/idt/mod.rs
+++ b/kernel/src/arch/x86_64/idt/mod.rs
@@ -391,6 +391,7 @@ fn windows_entered(frame: &TrapFrame) {
     }
     crate::windows::irqs_masked();
     crate::windows::preempt_raised();
+    crate::windows::note_trap(frame.vector, frame.rip);
 }
 
 /// This CPU's state as the black box records it, read out of the frame the stub
diff --git a/kernel/src/arch/x86_64/idt/nmi.rs b/kernel/src/arch/x86_64/idt/nmi.rs
index a9a8ab28e..3ce7c177a 100644
--- a/kernel/src/arch/x86_64/idt/nmi.rs
+++ b/kernel/src/arch/x86_64/idt/nmi.rs
@@ -49,6 +49,9 @@ pub(super) extern "sysv64" fn nmi_entry() {
         "mov rdi, [rsp + {rip_offset}]",
         "mov rsi, [rsp + {rsp_offset}]",
         "mov rdx, [rsp + {rflags_offset}]",
+        // SCOUT: the interrupted `rbp`, pushed last, and the frame's `cs`.
+        "mov rcx, [rsp]",
+        "mov r8, [rsp + {cs_offset}]",
         "mov rbp, rsp",
         "and rsp, -16",
         "call {note}",
@@ -78,6 +81,7 @@ pub(super) extern "sysv64" fn nmi_entry() {
         rip_offset = const RIP_OFFSET,
         rsp_offset = const RSP_OFFSET,
         rflags_offset = const RFLAGS_OFFSET,
+        cs_offset = const RIP_OFFSET + 8,
         nested_rip = const NESTED_RIP_OFFSET,
         nested_rsp = const NESTED_RSP_OFFSET,
         note = sym note,
@@ -85,9 +89,13 @@ pub(super) extern "sysv64" fn nmi_entry() {
     );
 }
 
-extern "sysv64" fn note(rip: u64, rsp: u64, rflags: u64) {
+extern "sysv64" fn note(rip: u64, rsp: u64, rflags: u64, rbp: u64, cs: u64) {
     crate::arch::percpu::irq_took!(Nmi);
     crate::sched::dump::note_nmi(rip);
+    #[cfg(feature = "mask-windows")]
+    crate::windows::nmi(rip, rflags, cs, rbp);
+    #[cfg(not(feature = "mask-windows"))]
+    let _ = (rbp, cs);
     // After the probe's store and before the nested-NMI staging: a hard lockup
     // ends the machine from here, so the sibling asking where this CPU is still
     // gets its answer, and nothing stages a second NMI onto a frame that is
diff --git a/kernel/src/arch/x86_64/idt/timer.rs b/kernel/src/arch/x86_64/idt/timer.rs
index 1ce8cb24f..fc25e44e1 100644
--- a/kernel/src/arch/x86_64/idt/timer.rs
+++ b/kernel/src/arch/x86_64/idt/timer.rs
@@ -97,6 +97,7 @@ pub(super) extern "sysv64" fn timer_entry() {
 #[cfg(feature = "mask-windows")]
 extern "sysv64" fn ring0_tick() {
     crate::windows::irqs_masked();
+    crate::windows::note_irq(crate::irq_census::Source::Timer);
     crate::deadline::poll();
     crate::windows::irqs_unmasking();
 }
diff --git a/kernel/src/arch/x86_64/percpu.rs b/kernel/src/arch/x86_64/percpu.rs
index 3cd57d6dd..e11be54ef 100644
--- a/kernel/src/arch/x86_64/percpu.rs
+++ b/kernel/src/arch/x86_64/percpu.rs
@@ -550,6 +550,11 @@ pub unsafe fn set_kernel_stack(rsp: u64) {
     core::ptr::write_unaligned(&raw mut (*percpu).tss.rsp0, rsp);
 }
 
+/// SCOUT: the top of the kernel stack [`set_kernel_stack`] last named.
+pub fn kernel_stack_top() -> u64 {
+    gs::read_u64::<OFF_KERNEL_RSP>()
+}
+
 /// The two words [`set_kernel_stack`] writes: `kernel_rsp` (syscall entry) and `tss.rsp0` (Ring 3 interrupt entry); read only by an instrument.
 /// # Safety: must be called from the CPU whose GS base points to the relevant PerCpu.
 #[cfg(feature = "stack-witness")]
@@ -715,6 +720,8 @@ macro_rules! irq_took {
                 options(nostack),
             );
         }
+        #[cfg(feature = "mask-windows")]
+        $crate::windows::note_irq($crate::irq_census::Source::$source);
     }};
 }
 
diff --git a/kernel/src/arch/x86_64/syscall.rs b/kernel/src/arch/x86_64/syscall.rs
index e48bd3f50..7aabce32a 100644
--- a/kernel/src/arch/x86_64/syscall.rs
+++ b/kernel/src/arch/x86_64/syscall.rs
@@ -106,6 +106,7 @@ extern "sysv64" fn syscall_handler(num: u64, a1: u64, a2: u64, _: u64, a3: u64,
     {
         crate::windows::irqs_masked();
         crate::windows::preempt_raised();
+        crate::windows::note_syscall(num);
     }
     #[cfg(feature = "df-witness")]
     cpu::df_witness("syscall_handler");
diff --git a/kernel/src/arch/x86_64/tlb.rs b/kernel/src/arch/x86_64/tlb.rs
index a6565cd2f..01fb6e987 100644
--- a/kernel/src/arch/x86_64/tlb.rs
+++ b/kernel/src/arch/x86_64/tlb.rs
@@ -75,14 +75,26 @@ pub fn shootdown(origin: Origin) {
     let began = crate::clock::nanos_since_boot();
     let me = percpu::cpu_id() as usize;
     let generation = SHOOTDOWN.issue();
+    #[cfg(feature = "mask-windows")]
+    let mut scout = crate::windows::Shoot::begin(me, generation.raw(), origin as u64);
     // This CPU answers itself locally instead of by self-IPI.
     SHOOTDOWN.serve(me, crate::mm::paging::flush_tlb_all);
+    #[cfg(feature = "mask-windows")]
+    crate::windows::served(crate::windows::VIA_OWN, SHOOTDOWN.flushed(me));
     apic::tlb_ipi();
     for cpu in 0..cpus {
         if cpu as usize != me {
+            #[cfg(not(feature = "mask-windows"))]
             wait_for(me, cpu, generation);
+            #[cfg(feature = "mask-windows")]
+            {
+                wait_for(me, cpu, generation, &mut scout);
+                scout.seen(cpu as usize);
+            }
         }
     }
+    #[cfg(feature = "mask-windows")]
+    scout.end(cpus);
     let took = crate::clock::nanos_since_boot().saturating_sub(began);
     WAIT_NS.fetch_add(took, Ordering::Relaxed);
     MAX_NS.fetch_max(took, Ordering::Relaxed);
@@ -125,10 +137,20 @@ pub fn bench() {
 
 /// Never logs: `drivers::serial`'s lock under its `IrqGuard` would deadlock a
 /// target that cannot answer while blocked on it.
-fn wait_for(me: usize, cpu: u32, generation: Generation) {
+fn wait_for(
+    me: usize,
+    cpu: u32,
+    generation: Generation,
+    #[cfg(feature = "mask-windows")] scout: &mut crate::windows::Shoot,
+) {
     let mut spins = 0u32;
     let mut deadline = None;
     while !SHOOTDOWN.wait_turn(me, cpu as usize, generation, crate::mm::paging::flush_tlb_all) {
+        #[cfg(feature = "mask-windows")]
+        {
+            crate::windows::served(crate::windows::VIA_WAIT, SHOOTDOWN.flushed(me));
+            scout.turn(cpu as usize);
+        }
         core::hint::spin_loop();
         spins += 1;
         if spins == SPINS_PER_DEADLINE_CHECK {
@@ -154,6 +176,8 @@ pub fn serve_ipi() {
         crate::mm::paging::flush_tlb_all();
         stage_ack_delay();
     });
+    #[cfg(feature = "mask-windows")]
+    crate::windows::served(crate::windows::VIA_IPI, SHOOTDOWN.flushed(cpu));
 }
 
 /// Answers a pending shootdown without taking a lock or allocating, so it is
@@ -168,6 +192,8 @@ pub fn poll() {
         crate::mm::paging::flush_tlb_all();
         stage_ack_delay();
     });
+    #[cfg(feature = "mask-windows")]
+    crate::windows::served(crate::windows::VIA_POLL, SHOOTDOWN.flushed(cpu));
 }
 
 /// Settle every shootdown issued before this CPU could answer one; called
@@ -175,6 +201,8 @@ pub fn poll() {
 pub fn join() {
     let cpu = percpu::cpu_id() as usize;
     SHOOTDOWN.serve(cpu, crate::mm::paging::flush_tlb_all);
+    #[cfg(feature = "mask-windows")]
+    crate::windows::served(crate::windows::VIA_JOIN, SHOOTDOWN.flushed(cpu));
 }
 
 #[cfg(not(feature = "test-actuators"))]
diff --git a/kernel/src/clock.rs b/kernel/src/clock.rs
index ee7795c7d..94c26bb2d 100644
--- a/kernel/src/clock.rs
+++ b/kernel/src/clock.rs
@@ -80,6 +80,11 @@ pub fn nanos_since_boot() -> u64 {
     ((delta as u128 * period_fs as u128) / 1_000_000) as u64
 }
 
+/// SCOUT: a counter reading as nanoseconds since boot, the log's own clock.
+pub fn nanos_at(counter: u64) -> u64 {
+    nanos_of_ticks(counter.saturating_sub(TSC_BOOT.load(Relaxed)))
+}
+
 /// The same reading as an [`Instant`], the type arithmetic on it is allowed in.
 /// The one bridge between hardware and `crate::time`, which stays `core`-only for `kernel-loom`.
 pub fn now() -> Instant {
diff --git a/kernel/src/hardlockup/mod.rs b/kernel/src/hardlockup/mod.rs
index 3b2e518d8..44b5534d7 100644
--- a/kernel/src/hardlockup/mod.rs
+++ b/kernel/src/hardlockup/mod.rs
@@ -75,7 +75,9 @@ pub const LOCKED_UP: &str = "a cpu locked up with interrupts off";
 
 /// Declared beside the bound it samples, so the host judging a lockup's
 /// lateness reads the same period.
-const SAMPLE_NS: u64 = toyos_tco::HARD_LOCKUP_SAMPLE_NS;
+// SCOUT: a sample every millisecond a CPU runs, where the detector takes one a second.
+const SAMPLE_NS: u64 =
+    if cfg!(feature = "mask-windows") { 1_000_000 } else { toyos_tco::HARD_LOCKUP_SAMPLE_NS };
 
 /// The bound in TSC ticks, or 0 for a boot that armed none. Written on the BSP
 /// before any AP exists.
diff --git a/kernel/src/irq_census.rs b/kernel/src/irq_census.rs
index be637d91d..d371786e1 100644
--- a/kernel/src/irq_census.rs
+++ b/kernel/src/irq_census.rs
@@ -146,4 +146,6 @@ pub fn log_census() {
         #[cfg(feature = "mask-windows")]
         crate::windows::log_cpu(cpu);
     }
+    #[cfg(feature = "mask-windows")]
+    crate::windows::log_scout();
 }
diff --git a/kernel/src/shootdown.rs b/kernel/src/shootdown.rs
index 6c453a99c..6fd8cd779 100644
--- a/kernel/src/shootdown.rs
+++ b/kernel/src/shootdown.rs
@@ -22,6 +22,13 @@ const OWED: Ordering = Ordering::Relaxed;
 #[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug)]
 pub struct Generation(u64);
 
+impl Generation {
+    /// SCOUT: the generation's number.
+    pub fn raw(self) -> u64 {
+        self.0
+    }
+}
+
 pub struct Shootdown {
     requested: AtomicU64,
     flushed: [AtomicU64; MAX_CPUS],
@@ -62,6 +69,11 @@ impl Shootdown {
         self.flushed[cpu].fetch_max(owed, Ordering::Release);
     }
 
+    /// SCOUT: the newest generation `cpu` has published a flush for.
+    pub fn flushed(&self, cpu: usize) -> u64 {
+        self.flushed[cpu].load(Ordering::Relaxed)
+    }
+
     /// Does `cpu` owe anyone a flush?
     pub fn owes(&self, cpu: usize) -> bool {
         // A hint: `serve` carries the real ordering, so a stale `false` costs nothing.
diff --git a/kernel/src/sync.rs b/kernel/src/sync.rs
index bfa85e8e8..b4d586f09 100644
--- a/kernel/src/sync.rs
+++ b/kernel/src/sync.rs
@@ -4,6 +4,8 @@ use core::ops::{Deref, DerefMut};
 use core::cell::UnsafeCell;
 #[cfg(not(feature = "loom"))]
 use core::sync::atomic::{AtomicU32, Ordering};
+#[cfg(feature = "mask-windows")]
+use core::sync::atomic::AtomicU64;
 
 #[cfg(feature = "loom")]
 use crate::cell::UnsafeCell;
@@ -77,6 +79,11 @@ impl AtomicTicket {
 pub struct Lock<T> {
     ticket: AtomicTicket,
     now: AtomicTicket,
+    /// SCOUT: the CPU that holds this, plus one, and the site it took it at.
+    #[cfg(feature = "mask-windows")]
+    held_cpu: AtomicU32,
+    #[cfg(feature = "mask-windows")]
+    held_at: AtomicU64,
     data: UnsafeCell<T>,
 }
 
@@ -92,6 +99,10 @@ impl<T> Lock<T> {
         Self {
             ticket: AtomicTicket::new(Ticket::ZERO),
             now: AtomicTicket::new(Ticket::ZERO),
+            #[cfg(feature = "mask-windows")]
+            held_cpu: AtomicU32::new(0),
+            #[cfg(feature = "mask-windows")]
+            held_at: AtomicU64::new(0),
             data: UnsafeCell::new(val),
         }
     }
@@ -126,7 +137,11 @@ impl<T> Lock<T> {
         // poll inside this spin takes locks of its own, and a nested one that
         // succeeded would otherwise clear the slot while this spin still waits.
         let mut was = None;
+        #[cfg(feature = "mask-windows")]
+        let mut watch = crate::windows::SpinWatch::new();
         while self.now.load(ACQUIRED) != my_ticket {
+            #[cfg(feature = "mask-windows")]
+            watch.turn(self.now.load(Ordering::Relaxed).raw(), &self.held_cpu, &self.held_at);
             // Inside the loop, so an uncontended acquisition writes nothing:
             // what a CPU is waiting for is the one thing a record sealed from
             // that CPU's own NMI cannot read off its registers.
@@ -156,6 +171,12 @@ impl<T> Lock<T> {
         if let Some(was) = was {
             crate::hardlockup::spinning_on_nothing(was);
         }
+        #[cfg(feature = "mask-windows")]
+        {
+            let caller = core::panic::Location::caller();
+            watch.end(self as *const Self as *const () as u64, caller);
+            crate::windows::holds(&self.held_cpu, &self.held_at, caller as *const _ as u64);
+        }
         LockGuard { lock: self }
     }
 
@@ -163,7 +184,11 @@ impl<T> Lock<T> {
         crate::preempt::disable();
         let current = self.now.load(ACQUIRED);
         match self.ticket.compare_advance(current, Ordering::Relaxed, Ordering::Relaxed) {
-            Ok(_) => Some(LockGuard { lock: self }),
+            Ok(_) => {
+                #[cfg(feature = "mask-windows")]
+                crate::windows::holds(&self.held_cpu, &self.held_at, 0);
+                Some(LockGuard { lock: self })
+            }
             Err(_) => {
                 crate::preempt::enable();
                 None
diff --git a/kernel/src/windows.rs b/kernel/src/windows.rs
index 2b7e5eef1..1afc2b767 100644
--- a/kernel/src/windows.rs
+++ b/kernel/src/windows.rs
@@ -26,8 +26,14 @@
 //! Once a boot, [`hold_once`] keeps both windows open for a span it reads off
 //! the counter and prints, which a later report of that CPU reads back.
 
-use core::sync::atomic::AtomicBool;
+// SCOUT: AArch64 has none of the sites that feed the scout's records.
+#![cfg_attr(not(target_arch = "x86_64"), allow(dead_code, unused))]
+
+use core::cell::Cell;
+use core::fmt;
+use core::panic::Location;
 use core::sync::atomic::Ordering::Relaxed;
+use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64};
 
 use toyos_sched::windows::{Unseen, Windows, HELD_NS};
 
@@ -59,12 +65,19 @@ pub fn start_here() {
     // Masked from here whatever it stood with; the guard's drop opens them
     // again, through its hook, if it found them open.
     let _masked = crate::arch::IrqGuard::close();
+    LONG.store(crate::clock::counter_ticks(LONG_NS), Relaxed);
+    NOTE.store(crate::clock::counter_ticks(NOTE_NS), Relaxed);
     CPUS[percpu::cpu_id() as usize].start(crate::preempt::count(), cpu::counter());
 }
 
 /// Interrupts were open and this CPU has just masked them.
+#[inline(never)]
 pub fn irqs_masked() {
-    on(|w| w.masked(cpu::counter));
+    let Some(me) = here() else { return };
+    if let Err(unseen) = CPUS[me].masked(cpu::counter) {
+        refuse(unseen);
+    }
+    opened(me, IRQS, cpu::frame_pointer());
 }
 
 /// This CPU took an exception in the kernel, which ends the machine: nothing
@@ -77,38 +90,85 @@ pub fn stop_here() {
 }
 
 /// Interrupts are masked and this CPU is about to open them.
+#[inline(never)]
 pub fn irqs_unmasking() {
-    on(|w| w.unmasking(cpu::counter));
+    let Some(me) = here() else { return };
+    let since = CPUS[me].irqs_since();
+    let at = Cell::new(0);
+    let now = || {
+        let t = cpu::counter();
+        at.set(t);
+        t
+    };
+    if let Err(unseen) = CPUS[me].unmasking(now) {
+        refuse(unseen);
+    }
+    closed(me, IRQS, since, at.get(), cpu::frame_pointer());
+}
+
+/// A preempt transition, and the scout's look at what it opened or closed.
+#[inline(always)]
+fn preempt(fp: u64, transition: impl FnOnce(&Windows, &dyn Fn() -> u64) -> Result<(), Unseen>) {
+    let Some(me) = here() else { return };
+    let w = &CPUS[me];
+    let before = w.preempt_since();
+    let at = Cell::new(0);
+    let now = || {
+        let t = cpu::counter();
+        at.set(t);
+        t
+    };
+    if let Err(unseen) = transition(w, &now) {
+        refuse(unseen);
+    }
+    let after = w.preempt_since();
+    if after == before {
+        return;
+    }
+    if before != 0 {
+        closed(me, PREEMPT, before, at.get(), fp);
+    }
+    if after != 0 {
+        opened(me, PREEMPT, fp);
+    }
 }
 
 /// The preempt count has just been raised by one.
+#[inline(never)]
 pub fn preempt_raised() {
-    on(|w| w.raised(crate::preempt::count(), cpu::counter));
+    preempt(cpu::frame_pointer(), |w, now| w.raised(crate::preempt::count(), now));
 }
 
 /// The preempt count is about to be lowered by one.
+#[inline(never)]
 pub fn preempt_lowering() {
-    on(|w| w.lowering(crate::preempt::count(), cpu::counter));
+    preempt(cpu::frame_pointer(), |w, now| w.lowering(crate::preempt::count(), now));
 }
 
 /// The preempt count was just set from `old` to `new` whole.
+#[inline(never)]
 pub fn preempt_set(old: u32, new: u32) {
-    on(|w| w.set(old, new, cpu::counter));
+    preempt(cpu::frame_pointer(), |w, now| w.set(old, new, now));
 }
 
 /// A scheduler pass has decided what runs here.
+#[inline(never)]
 pub fn scheduled() {
-    on(|w| w.scheduled(cpu::counter));
+    preempt(cpu::frame_pointer(), |w, now| w.scheduled(now));
 }
 
 /// This CPU halts inside a pass.
+#[inline(never)]
 pub fn halting() {
-    on(|w| w.halting(cpu::counter));
+    note(K_HALT, 0, 0, 0);
+    preempt(cpu::frame_pointer(), |w, now| w.halting(now));
 }
 
 /// The halt has ended, still inside its pass.
+#[inline(never)]
 pub fn woken() {
-    on(|w| w.woken(cpu::counter));
+    preempt(cpu::frame_pointer(), |w, now| w.woken(now));
+    note(K_WAKE, 0, 0, 0);
 }
 
 /// `cpu`'s line, taking its longest windows so the next report starts from none.
@@ -138,4 +198,1025 @@ pub fn hold_once() {
         ns = crate::clock::nanos_of_ticks(cpu::counter() - from);
     }
     crate::log!("windows: held cpu{} ns={ns}", percpu::cpu_id());
+    crate::log!(
+        "scout: armed long_ns={LONG_NS} long_ticks={} note_ns={NOTE_NS} chain={CHAIN} keep={KEEP}",
+        LONG.load(Relaxed),
+    );
+}
+
+// ---------------------------------------------------------------------------
+// SCOUT, never landing: what each CPU is doing across a long window. Every
+// fact is kept in per-CPU words and printed by `log_scout`, with the report.
+// Stamps are `cpu::counter`, printed as nanoseconds since boot, the log's clock.
+// ---------------------------------------------------------------------------
+
+/// A window or a wait longer than this is recorded.
+const LONG_NS: u64 = 2_000_000;
+/// A lock or shootdown wait shorter than this leaves no event on the trail.
+const NOTE_NS: u64 = 20_000;
+/// The two as counter ticks; zero until a CPU joins the scheduler.
+static LONG: AtomicU64 = AtomicU64::new(0);
+static NOTE: AtomicU64 = AtomicU64::new(0);
+
+const IRQS: usize = 0;
+const PREEMPT: usize = 1;
+
+/// Return addresses kept per site.
+const CHAIN: usize = 6;
+/// A trail event: at, kind, a, b, c.
+const EV: usize = 5;
+const TRAIL: usize = 64;
+/// Trail events copied into a window's record: its last `KEEP`, and the next `AFTER`.
+const KEEP: usize = 16;
+const AFTER: usize = 4;
+/// An open window's site: chain, who, trail seq, SMI count.
+const OPEN_WORDS: usize = CHAIN + 3;
+const W_HEAD: usize = 10;
+const W_WORDS: usize = W_HEAD + 2 * CHAIN + (KEEP + AFTER) * EV;
+const WREC: usize = 6;
+/// A serve: generation, at, via.
+const SERVES: usize = 64;
+/// Trail events of each target copied into a shootdown's record.
+const T_KEEP: usize = 6;
+const S_HEAD: usize = 8;
+const S_PER: usize = 3 + T_KEEP * EV;
+const S_WORDS: usize = S_HEAD + MAX_CPUS * S_PER;
+const SREC: usize = 3;
+const N_HEAD: usize = 6;
+const N_WORDS: usize = N_HEAD + CHAIN;
+const NREC: usize = 16;
+const L_WORDS: usize = 10;
+const LREC: usize = 4;
+/// NMIs one wait sends, one each further `LONG_NS` it has waited.
+const PROBES: u64 = 4;
+/// Lines one report prints at most; what is left waits for the next.
+const BUDGET: usize = 280;
+
+const K_SYS: u64 = 1;
+const K_SWITCH: u64 = 2;
+const K_IRQ: u64 = 3;
+const K_TRAP: u64 = 4;
+const K_HALT: u64 = 5;
+const K_WAKE: u64 = 6;
+const K_LOCK: u64 = 7;
+const K_SHOOT: u64 = 8;
+
+/// How a CPU answered a shootdown.
+pub const VIA_IPI: u64 = 1;
+pub const VIA_POLL: u64 = 2;
+pub const VIA_OWN: u64 = 3;
+pub const VIA_WAIT: u64 = 4;
+pub const VIA_JOIN: u64 = 5;
+const VIA: [&str; 6] = ["none", "ipi", "poll", "own", "wait", "join"];
+
+struct Words<const N: usize>([AtomicU64; N]);
+
+impl<const N: usize> Words<N> {
+    const fn new() -> Self {
+        Self([const { AtomicU64::new(0) }; N])
+    }
+    fn set(&self, i: usize, v: u64) {
+        self.0[i].store(v, Relaxed);
+    }
+    fn get(&self, i: usize) -> u64 {
+        self.0[i].load(Relaxed)
+    }
+}
+
+struct Scout {
+    trail: Words<{ TRAIL * EV }>,
+    seq: AtomicU64,
+    open: [Words<OPEN_WORDS>; 2],
+    wrecs: Words<{ WREC * W_WORDS }>,
+    w_written: AtomicU64,
+    w_printed: AtomicU64,
+    w_dropped: AtomicU64,
+    /// The record slot, plus one, the next trail events are also copied into.
+    after_of: AtomicU64,
+    after_n: AtomicU64,
+    serves: Words<{ SERVES * 3 }>,
+    serve_seq: AtomicU64,
+    served_gen: AtomicU64,
+    srecs: Words<{ SREC * S_WORDS }>,
+    s_written: AtomicU64,
+    s_printed: AtomicU64,
+    s_dropped: AtomicU64,
+    nrecs: Words<{ NREC * N_WORDS }>,
+    n_written: AtomicU64,
+    n_printed: AtomicU64,
+    n_dropped: AtomicU64,
+    lrecs: Words<{ LREC * L_WORDS }>,
+    l_written: AtomicU64,
+    l_printed: AtomicU64,
+    l_dropped: AtomicU64,
+    /// Who asked for this CPU's next NMI to be a sample, plus one.
+    probe_by: AtomicU64,
+    probed_at: AtomicU64,
+    sampled_at: AtomicU64,
+    smi: AtomicU64,
+    smi_at: AtomicU64,
+}
+
+impl Scout {
+    const fn new() -> Self {
+        Self {
+            trail: Words::new(),
+            seq: AtomicU64::new(0),
+            open: [const { Words::new() }; 2],
+            wrecs: Words::new(),
+            w_written: AtomicU64::new(0),
+            w_printed: AtomicU64::new(0),
+            w_dropped: AtomicU64::new(0),
+            after_of: AtomicU64::new(0),
+            after_n: AtomicU64::new(0),
+            serves: Words::new(),
+            serve_seq: AtomicU64::new(0),
+            served_gen: AtomicU64::new(0),
+            srecs: Words::new(),
+            s_written: AtomicU64::new(0),
+            s_printed: AtomicU64::new(0),
+            s_dropped: AtomicU64::new(0),
+            nrecs: Words::new(),
+            n_written: AtomicU64::new(0),
+            n_printed: AtomicU64::new(0),
+            n_dropped: AtomicU64::new(0),
+            lrecs: Words::new(),
+            l_written: AtomicU64::new(0),
+            l_printed: AtomicU64::new(0),
+            l_dropped: AtomicU64::new(0),
+            probe_by: AtomicU64::new(0),
+            probed_at: AtomicU64::new(0),
+            sampled_at: AtomicU64::new(0),
+            smi: AtomicU64::new(0),
+            smi_at: AtomicU64::new(0),
+        }
+    }
+}
+
+static SCOUT: [Scout; MAX_CPUS] = [const { Scout::new() }; MAX_CPUS];
+
+/// This CPU, once there is a per-CPU block to say which it is.
+fn here() -> Option<usize> {
+    crate::log::PERCPU_READY.load(Relaxed).then(|| percpu::cpu_id() as usize)
+}
+
+/// The thread this CPU runs: pid in the high half, tid in the low, all ones for none.
+fn who() -> u64 {
+    let pid = percpu::current_pid().map_or(u32::MAX, |pid| pid.raw());
+    let tid = percpu::current_tid().map_or(u32::MAX, |tid| tid.raw());
+    (u64::from(pid) << 32) | u64::from(tid)
+}
+
+/// The kernel stack this CPU stands on, as the per-CPU block names it.
+#[cfg(target_arch = "x86_64")]
+fn stack_bounds() -> (u64, u64) {
+    let top = percpu::kernel_stack_top();
+    (top.saturating_sub(crate::process::KERNEL_STACK_SIZE as u64), top)
+}
+
+#[cfg(not(target_arch = "x86_64"))]
+fn stack_bounds() -> (u64, u64) {
+    (0, 0)
+}
+
+/// `MSR_SMI_COUNT`: the SMIs this CPU has taken since reset.
+#[cfg(target_arch = "x86_64")]
+fn smi_count() -> u64 {
+    cpu::rdmsr(0x34)
+}
+
+#[cfg(not(target_arch = "x86_64"))]
+fn smi_count() -> u64 {
+    0
+}
+
+/// The return addresses up the frame chain from `fp`, zero past its end. Every
+/// frame read is inside the kernel stack this CPU stands on and above the one
+/// before it.
+fn chain_into(into: &[AtomicU64], mut fp: u64) {
+    let (low, high) = stack_bounds();
+    for slot in into {
+        let mut ret = 0;
+        if fp >= low && fp.saturating_add(16) <= high && fp.is_multiple_of(8) {
+            // SAFETY: both words are inside this CPU's own kernel stack, by the bounds above.
+            let (next, ra) = unsafe { (*(fp as *const u64), *((fp + 8) as *const u64)) };
+            ret = ra;
+            fp = if next > fp { next } else { 0 };
+        } else {
+            fp = 0;
+        }
+        slot.store(ret, Relaxed);
+    }
+}
+
+/// A window of `kind` has just opened: where, by whom, and the trail's place.
+#[inline(always)]
+fn opened(me: usize, kind: usize, fp: u64) {
+    let s = &SCOUT[me];
+    let o = &s.open[kind];
+    chain_into(&o.0[..CHAIN], fp);
+    o.set(CHAIN, who());
+    o.set(CHAIN + 1, s.seq.load(Relaxed));
+    if kind == IRQS {
+        let smi = smi_count();
+        o.set(CHAIN + 2, smi);
+        s.smi.store(smi, Relaxed);
+        s.smi_at.store(CPUS[me].irqs_since(), Relaxed);
+    }
+}
+
+/// A window of `kind` opened at `since` closed at `at`.
+#[inline(always)]
+fn closed(me: usize, kind: usize, since: u64, at: u64, fp: u64) {
+    if since == 0 || at <= since {
+        return;
+    }
+    let long = LONG.load(Relaxed);
+    if long == 0 || at - since <= long {
+        return;
+    }
+    // A preemption-off window that opened and closes inside one interrupts-off
+    // window is that window's record, not a second one.
+    if kind == PREEMPT {
+        let masked = CPUS[me].irqs_since();
+        if masked != 0 && masked <= since {
+            return;
+        }
+    }
+    record_window(me, kind, since, at, fp);
+}
+
+#[cold]
+#[inline(never)]
+fn record_window(me: usize, kind: usize, since: u64, at: u64, fp: u64) {
+    // A preempt hook may run with interrupts open, and an interrupt's own long
+    // window would take the same slot.
+    let _masked = (kind == PREEMPT).then(crate::arch::IrqGuard::close);
+    let s = &SCOUT[me];
+    let n = s.w_written.load(Relaxed);
+    if n.wrapping_sub(s.w_printed.load(Relaxed)) >= WREC as u64 {
+        s.w_dropped.fetch_add(1, Relaxed);
+        return;
+    }
+    let slot = n as usize % WREC;
+    if s.after_of.load(Relaxed) == slot as u64 + 1 {
+        s.after_of.store(0, Relaxed);
+    }
+    let base = slot * W_WORDS;
+    let o = &s.open[kind];
+    let seq_open = o.get(CHAIN + 1);
+    let seq_now = s.seq.load(Relaxed);
+    let events = seq_now.wrapping_sub(seq_open);
+    let kept = events.min(KEEP as u64);
+    let head = [
+        kind as u64 + 1,
+        since,
+        at,
+        o.get(CHAIN),
+        who(),
+        o.get(CHAIN + 2),
+        if kind == IRQS { smi_count() } else { 0 },
+        events,
+        kept,
+        0,
+    ];
+    for (i, word) in head.iter().enumerate() {
+        s.wrecs.set(base + i, *word);
+    }
+    for i in 0..CHAIN {
+        s.wrecs.set(base + W_HEAD + i, o.get(i));
+    }
+    chain_into(&s.wrecs.0[base + W_HEAD + CHAIN..base + W_HEAD + 2 * CHAIN], fp);
+    let events_at = base + W_HEAD + 2 * CHAIN;
+    for k in 0..kept as usize {
+        let from = (seq_now.wrapping_sub(kept).wrapping_add(k as u64) as usize % TRAIL) * EV;
+        for j in 0..EV {
+            s.wrecs.set(events_at + k * EV + j, s.trail.get(from + j));
+        }
+    }
+    if kind == IRQS {
+        s.after_n.store(0, Relaxed);
+        s.after_of.store(slot as u64 + 1, Relaxed);
+    }
+    s.w_written.store(n + 1, Relaxed);
+}
+
+/// One event on this CPU's trail.
+#[inline]
+fn note(kind: u64, a: u64, b: u64, c: u64) {
+    let Some(me) = here() else { return };
+    let s = &SCOUT[me];
+    let event = [cpu::counter(), kind, a, b, c];
+    let base = (s.seq.fetch_add(1, Relaxed) as usize % TRAIL) * EV;
+    for (j, word) in event.iter().enumerate() {
+        s.trail.set(base + j, *word);
+    }
+    let after_of = s.after_of.load(Relaxed);
+    if after_of != 0 {
+        let k = s.after_n.fetch_add(1, Relaxed);
+        if k < AFTER as u64 {
+            let rec = (after_of as usize - 1) * W_WORDS;
+            let to = rec + W_HEAD + 2 * CHAIN + (KEEP + k as usize) * EV;
+            for (j, word) in event.iter().enumerate() {
+                s.wrecs.set(to + j, *word);
+            }
+            s.wrecs.set(rec + 9, k + 1);
+        } else {
+            s.after_of.store(0, Relaxed);
+        }
+    }
+}
+
+/// A syscall's Rust half has begun.
+pub fn note_syscall(num: u64) {
+    note(K_SYS, num, 0, 0);
+}
+
+/// This CPU has just been told which thread it switches onto.
+pub fn note_switch() {
+    note(K_SWITCH, who(), 0, 0);
+}
+
+/// An interrupt's handler runs. The NMI leaves no event: it is the sampler.
+pub fn note_irq(source: crate::irq_census::Source) {
+    if source != crate::irq_census::Source::Nmi {
+        note(K_IRQ, source as u64, 0, 0);
+    }
+}
+
+/// An exception's dispatch runs.
+pub fn note_trap(vector: u64, rip: u64) {
+    note(K_TRAP, vector, rip, 0);
+}
+
+/// This CPU has published a flush for `generation`, by `via`.
+#[inline]
+pub fn served(via: u64, generation: u64) {
+    let Some(me) = here() else { return };
+    let s = &SCOUT[me];
+    if s.served_gen.load(Relaxed) == generation {
+        return;
+    }
+    s.served_gen.store(generation, Relaxed);
+    let base = (s.serve_seq.fetch_add(1, Relaxed) as usize % SERVES) * 3;
+    s.serves.set(base + 1, cpu::counter());
+    s.serves.set(base + 2, via);
+    s.serves.set(base, generation);
+}
+
+/// Ask `target` for a sample of itself, at most one a half `LONG_NS` whoever asks.
+fn probe(me: usize, target: usize, now: u64) {
+    if target == me || target >= MAX_CPUS || target as u32 >= crate::smp::cpu_count() {
+        return;
+    }
+    let t = &SCOUT[target];
+    if now.saturating_sub(t.probed_at.load(Relaxed)) < LONG.load(Relaxed) / 2 {
+        return;
+    }
+    t.probed_at.store(now, Relaxed);
+    t.probe_by.store(me as u64 + 1, Relaxed);
+    #[cfg(target_arch = "x86_64")]
+    crate::arch::apic::send_nmi(target as u32);
+}
+
+/// From the NMI entry: no lock and no log. A sample is taken when another CPU
+/// asked for one, or when this CPU's interrupts have been masked past `LONG_NS`.
+pub fn nmi(rip: u64, rflags: u64, cs: u64, rbp: u64) {
+    let me = percpu::cpu_id() as usize;
+    if me >= MAX_CPUS {
+        return;
+    }
+    let s = &SCOUT[me];
+    let by = s.probe_by.swap(0, Relaxed);
+    let now = cpu::counter();
+    let long = LONG.load(Relaxed);
+    let since = CPUS[me].irqs_since();
+    // The CPU printing the report samples itself for nobody: its window is the report's.
+    let own = long != 0
+        && since != 0
+        && now.saturating_sub(since) > long
+        && REPORTING.load(Relaxed) != me as u64 + 1;
+    if by == 0 && !own {
+        return;
+    }
+    if now.saturating_sub(s.sampled_at.load(Relaxed)) < long / 4 * 3 {
+        return;
+    }
+    s.sampled_at.store(now, Relaxed);
+    let n = s.n_written.load(Relaxed);
+    if n.wrapping_sub(s.n_printed.load(Relaxed)) >= NREC as u64 {
+        s.n_dropped.fetch_add(1, Relaxed);
+        return;
+    }
+    let base = (n as usize % NREC) * N_WORDS;
+    let ring = cs & 3;
+    let head = [now, by, rip, ((rflags >> 9) & 1) | (ring << 1), who(), since];
+    for (i, word) in head.iter().enumerate() {
+        s.nrecs.set(base + i, *word);
+    }
+    chain_into(&s.nrecs.0[base + N_HEAD..base + N_WORDS], if ring == 0 { rbp } else { 0 });
+    s.n_written.store(n + 1, Relaxed);
+}
+
+/// An initiator's look at its own shootdown.
+pub struct Shoot {
+    me: usize,
+    generation: u64,
+    origin: u64,
+    begin: u64,
+    last: u64,
+    gap: u64,
+    gap_at: u64,
+    probes: u64,
+    seen: [u64; MAX_CPUS],
+}
+
+impl Shoot {
+    pub fn begin(me: usize, generation: u64, origin: u64) -> Self {
+        let begin = cpu::counter();
+        Self { me, generation, origin, begin, last: begin, gap: 0, gap_at: 0, probes: 0, seen: [0; MAX_CPUS] }
+    }
+
+    /// One turn of the wait for `target`, which has not answered.
+    #[inline]
+    pub fn turn(&mut self, target: usize) {
+        let now = cpu::counter();
+        let gap = now.saturating_sub(self.last);
+        if gap > self.gap {
+            self.gap = gap;
+            self.gap_at = now;
+        }
+        self.last = now;
+        let long = LONG.load(Relaxed);
+        if long != 0 && self.probes < PROBES && now.saturating_sub(self.begin) > long * (self.probes + 1) {
+            self.probes += 1;
+            probe(self.me, target, now);
+        }
+    }
+
+    /// `cpu` has answered, as this CPU saw it.
+    pub fn seen(&mut self, cpu: usize) {
+        let now = cpu::counter();
+        self.seen[cpu] = now;
+        self.last = now;
+    }
+
+    pub fn end(self, cpus: u32) {
+        let end = cpu::counter();
+        let took = end.saturating_sub(self.begin);
+        let note_ticks = NOTE.load(Relaxed);
+        if note_ticks != 0 && took >= note_ticks {
+            note(K_SHOOT, self.generation, took, 0);
+        }
+        let long = LONG.load(Relaxed);
+        if long != 0 && took > long {
+            self.record(end, cpus);
+        }
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn record(&self, end: u64, cpus: u32) {
+        let _masked = crate::arch::IrqGuard::close();
+        let s = &SCOUT[self.me];
+        let n = s.s_written.load(Relaxed);
+        if n.wrapping_sub(s.s_printed.load(Relaxed)) >= SREC as u64 {
+            s.s_dropped.fetch_add(1, Relaxed);
+            return;
+        }
+        let base = (n as usize % SREC) * S_WORDS;
+        let head =
+            [self.generation, self.begin, end, self.gap, self.gap_at, self.probes, u64::from(cpus), self.origin];
+        for (i, word) in head.iter().enumerate() {
+            s.srecs.set(base + i, *word);
+        }
+        for cpu in 0..(cpus as usize).min(MAX_CPUS) {
+            let at = base + S_HEAD + cpu * S_PER;
+            let t = &SCOUT[cpu];
+            // The first flush this target published that covers the generation.
+            let mut ack = (u64::MAX, 0, 0);
+            for i in 0..SERVES {
+                let generation = t.serves.get(i * 3);
+                if generation >= self.generation && generation < ack.0 {
+                    ack = (generation, t.serves.get(i * 3 + 1), t.serves.get(i * 3 + 2));
+                }
+            }
+            s.srecs.set(at, self.seen[cpu]);
+            s.srecs.set(at + 1, ack.1);
+            s.srecs.set(at + 2, ack.2);
+            let seq = t.seq.load(Relaxed);
+            let kept = seq.min(T_KEEP as u64);
+            for k in 0..T_KEEP {
+                let from = (seq.wrapping_sub(kept).wrapping_add(k as u64) as usize % TRAIL) * EV;
+                for j in 0..EV {
+                    let word = if (k as u64) < kept { t.trail.get(from + j) } else { 0 };
+                    s.srecs.set(at + 3 + k * EV + j, word);
+                }
+            }
+        }
+        s.s_written.store(n + 1, Relaxed);
+    }
+}
+
+/// A contended `Lock::lock`'s look at its own spin.
+pub struct SpinWatch {
+    turns: u64,
+    begin: u64,
+    last: u64,
+    gap: u64,
+    gap_at: u64,
+    now: u32,
+    since: u64,
+    held_cpu: u32,
+    held_at: u64,
+    longest: u64,
+    longest_cpu: u32,
+    longest_at: u64,
+    probes: u64,
+}
+
+impl SpinWatch {
+    pub const fn new() -> Self {
+        Self {
+            turns: 0,
+            begin: 0,
+            last: 0,
+            gap: 0,
+            gap_at: 0,
+            now: 0,
+            since: 0,
+            held_cpu: 0,
+            held_at: 0,
+            longest: 0,
+            longest_cpu: 0,
+            longest_at: 0,
+            probes: 0,
+        }
+    }
+
+    fn tenure_ends(&mut self, at: u64) {
+        let tenure = at.saturating_sub(self.since);
+        if tenure > self.longest {
+            self.longest = tenure;
+            self.longest_cpu = self.held_cpu;
+            self.longest_at = self.held_at;
+        }
+    }
+
+    /// One turn of the spin: the lock serves ticket `now`, and its holder said who it is.
+    #[inline]
+    pub fn turn(&mut self, now: u32, held_cpu: &AtomicU32, held_at: &AtomicU64) {
+        let at = cpu::counter();
+        let mut look = self.turns & 63 == 0;
+        if self.turns == 0 {
+            self.begin = at;
+            self.now = now;
+            self.since = at;
+        } else {
+            let gap = at.saturating_sub(self.last);
+            if gap > self.gap {
+                self.gap = gap;
+                self.gap_at = at;
+            }
+            if now != self.now {
+                self.tenure_ends(at);
+                self.now = now;
+                self.since = at;
+                look = true;
+            }
+        }
+        if look {
+            self.held_cpu = held_cpu.load(Relaxed);
+            self.held_at = held_at.load(Relaxed);
+        }
+        self.last = at;
+        self.turns += 1;
+        let long = LONG.load(Relaxed);
+        if long != 0
+            && self.probes < PROBES
+            && self.held_cpu != 0
+            && at.saturating_sub(self.begin) > long * (self.probes + 1)
+        {
+            self.probes += 1;
+            if let Some(me) = here() {
+                probe(me, self.held_cpu as usize - 1, at);
+            }
+        }
+    }
+
+    /// The lock is this CPU's.
+    pub fn end(mut self, lock: u64, caller: &'static Location<'static>) {
+        if self.turns == 0 {
+            return;
+        }
+        let end = cpu::counter();
+        self.tenure_ends(end);
+        let took = end.saturating_sub(self.begin);
+        let note_ticks = NOTE.load(Relaxed);
+        if note_ticks == 0 || took < note_ticks {
+            return;
+        }
+        let caller = caller as *const Location<'static> as u64;
+        note(K_LOCK, lock, took, caller);
+        let long = LONG.load(Relaxed);
+        if long != 0 && took > long {
+            self.record(lock, caller, end);
+        }
+    }
+
+    #[cold]
+    #[inline(never)]
+    fn record(&self, lock: u64, caller: u64, end: u64) {
+        let Some(me) = here() else { return };
+        let _masked = crate::arch::IrqGuard::close();
+        let s = &SCOUT[me];
+        let n = s.l_written.load(Relaxed);
+        if n.wrapping_sub(s.l_printed.load(Relaxed)) >= LREC as u64 {
+            s.l_dropped.fetch_add(1, Relaxed);
+            return;
+        }
+        let base = (n as usize % LREC) * L_WORDS;
+        let words = [
+            lock,
+            caller,
+            self.begin,
+            end,
+            self.gap,
+            self.gap_at,
+            u64::from(self.longest_cpu),
+            self.longest_at,
+            self.longest,
+            self.probes,
+        ];
+        for (i, word) in words.iter().enumerate() {
+            s.lrecs.set(base + i, *word);
+        }
+        s.l_written.store(n + 1, Relaxed);
+    }
+}
+
+/// This CPU holds the lock these two words belong to, taken at `caller`.
+#[inline]
+pub fn holds(held_cpu: &AtomicU32, held_at: &AtomicU64, caller: u64) {
+    if let Some(me) = here() {
+        held_at.store(caller, Relaxed);
+        held_cpu.store(me as u32 + 1, Relaxed);
+    }
+}
+
+struct Ns(u64);
+
+impl fmt::Display for Ns {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", if self.0 == 0 { 0 } else { crate::clock::nanos_at(self.0) })
+    }
+}
+
+struct Who(u64);
+
+impl fmt::Display for Who {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let (pid, tid) = ((self.0 >> 32) as u32, self.0 as u32);
+        match (pid, tid) {
+            (u32::MAX, _) => f.write_str("idle"),
+            (pid, u32::MAX) => write!(f, "{pid}:-"),
+            (pid, tid) => write!(f, "{pid}:{tid}"),
+        }
+    }
+}
+
+/// A `&'static Location` as `Lock::lock` stored it, or `?` for none.
+struct Loc(u64);
+
+impl fmt::Display for Loc {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.0 == 0 {
+            return f.write_str("?");
+        }
+        // SAFETY: stored from a `&'static Location` and nothing else.
+        let at: &'static Location<'static> = unsafe { &*(self.0 as *const Location<'static>) };
+        write!(f, "{}:{}", at.file(), at.line())
+    }
+}
+
+/// At most `N` bytes of what is written to it.
+struct Clip<const N: usize> {
+    bytes: [u8; N],
+    len: usize,
+}
+
+impl<const N: usize> fmt::Write for Clip<N> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let mut fit = s.len().min(N - self.len);
+        while !s.is_char_boundary(fit) {
+            fit -= 1;
+        }
+        self.bytes[self.len..self.len + fit].copy_from_slice(&s.as_bytes()[..fit]);
+        self.len += fit;
+        Ok(())
+    }
+}
+
+/// An address by the kernel's own symbols; `ret` says it is a return address.
+struct Sym(u64, bool);
+
+impl fmt::Display for Sym {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let back = u64::from(self.1);
+        match crate::symbols::kernel_symbol(self.0.saturating_sub(back)) {
+            Some((name, offset)) => {
+                let mut clip = Clip::<96> { bytes: [0; 96], len: 0 };
+                let _ = fmt::Write::write_fmt(&mut clip, format_args!("{:#}", rustc_demangle::demangle(name)));
+                let text = core::str::from_utf8(&clip.bytes[..clip.len]).unwrap_or("?");
+                write!(f, "{text}+{:#x}", offset + back)
+            }
+            None => write!(f, "{:#x}", self.0),
+        }
+    }
+}
+
+struct Frames([u64; CHAIN]);
+
+impl fmt::Display for Frames {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.0[0] == 0 {
+            return f.write_str("-");
+        }
+        for (i, frame) in self.0.iter().take_while(|frame| **frame != 0).enumerate() {
+            if i > 0 {
+                f.write_str(" < ")?;
+            }
+            write!(f, "{}", Sym(*frame, true))?;
+        }
+        Ok(())
+    }
+}
+
+/// Trail events, `EV` words each: `<ns>:<what>`, ` | ` between.
+struct Events<'a>(&'a [u64]);
+
+impl fmt::Display for Events<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut first = true;
+        for e in self.0.chunks_exact(EV) {
+            if e[0] == 0 {
+                continue;
+            }
+            if !first {
+                f.write_str(" | ")?;
+            }
+            first = false;
+            write!(f, "{}:", Ns(e[0]))?;
+            match e[1] {
+                K_SYS => write!(f, "sys({})", e[2])?,
+                K_SWITCH => write!(f, "to({})", Who(e[2]))?,
+                K_IRQ => write!(
+                    f,
+                    "irq({})",
+                    crate::irq_census::Source::NAMES.get(e[2] as usize).copied().unwrap_or("?")
+                )?,
+                K_TRAP => write!(f, "trap({} rip={})", e[2], Sym(e[3], false))?,
+                K_HALT => f.write_str("halt")?,
+                K_WAKE => f.write_str("wake")?,
+                K_LOCK => write!(
+                    f,
+                    "lock({} {:#x} {}ns)",
+                    Loc(e[4]),
+                    e[2],
+                    crate::clock::nanos_of_ticks(e[3])
+                )?,
+                K_SHOOT => write!(f, "shoot(g={} {}ns)", e[2], crate::clock::nanos_of_ticks(e[3]))?,
+                other => write!(f, "?{other}")?,
+            }
+        }
+        if first {
+            f.write_str("-")?;
+        }
+        Ok(())
+    }
+}
+
+struct Smi(usize);
+
+impl fmt::Display for Smi {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        for (cpu, s) in SCOUT.iter().enumerate().take(self.0) {
+            write!(f, " cpu{cpu}={}@{}", s.smi.load(Relaxed), Ns(s.smi_at.load(Relaxed)))?;
+        }
+        Ok(())
+    }
+}
+
+/// The CPU printing a report, plus one.
+static REPORTING: AtomicU64 = AtomicU64::new(0);
+
+/// Everything the scout kept since the report before, after the census.
+pub fn log_scout() {
+    let Some(me) = here() else { return };
+    if REPORTING.compare_exchange(0, me as u64 + 1, Relaxed, Relaxed).is_err() {
+        return;
+    }
+    let cpus = (crate::smp::cpu_count() as usize).min(MAX_CPUS);
+    SCOUT[me].smi.store(smi_count(), Relaxed);
+    SCOUT[me].smi_at.store(cpu::counter(), Relaxed);
+    crate::log!("scout: smi at={}{}", Ns(cpu::counter()), Smi(cpus));
+    let mut left = BUDGET;
+    for cpu in 0..cpus {
+        log_windows(cpu, &mut left);
+    }
+    for cpu in 0..cpus {
+        log_shoots(cpu, &mut left);
+    }
+    for cpu in 0..cpus {
+        log_samples(cpu, &mut left);
+    }
+    for cpu in 0..cpus {
+        log_locks(cpu, &mut left);
+    }
+    let mut dropped = [0u64; 4];
+    let mut unprinted = 0;
+    for s in SCOUT.iter().take(cpus) {
+        dropped[0] += s.w_dropped.swap(0, Relaxed);
+        dropped[1] += s.s_dropped.swap(0, Relaxed);
+        dropped[2] += s.n_dropped.swap(0, Relaxed);
+        dropped[3] += s.l_dropped.swap(0, Relaxed);
+        unprinted += s.w_written.load(Relaxed).wrapping_sub(s.w_printed.load(Relaxed))
+            + s.s_written.load(Relaxed).wrapping_sub(s.s_printed.load(Relaxed))
+            + s.n_written.load(Relaxed).wrapping_sub(s.n_printed.load(Relaxed))
+            + s.l_written.load(Relaxed).wrapping_sub(s.l_printed.load(Relaxed));
+    }
+    if dropped != [0; 4] || unprinted != 0 {
+        crate::log!(
+            "scout: dropped win={} shoot={} nmi={} lock={} unprinted={unprinted}",
+            dropped[0],
+            dropped[1],
+            dropped[2],
+            dropped[3],
+        );
+    }
+    crate::log!("scout: end at={} lines={}", Ns(cpu::counter()), BUDGET - left);
+    REPORTING.store(0, Relaxed);
+}
+
+fn log_windows(cpu: usize, left: &mut usize) {
+    let s = &SCOUT[cpu];
+    let written = s.w_written.load(Relaxed);
+    let mut printed = s.w_printed.load(Relaxed);
+    while printed != written && *left >= 8 {
+        let base = (printed as usize % WREC) * W_WORDS;
+        let mut r = [0u64; W_WORDS];
+        for (i, word) in r.iter_mut().enumerate() {
+            *word = s.wrecs.get(base + i);
+        }
+        let kind = if r[0] == IRQS as u64 + 1 { "irqs" } else { "preempt" };
+        let open = crate::clock::nanos_at(r[1]);
+        crate::log!(
+            "scout: win cpu{cpu} {kind} open={open} close={} span_ns={} smi={}->{} opener={} closer={} events={}",
+            Ns(r[2]),
+            crate::clock::nanos_of_ticks(r[2].saturating_sub(r[1])),
+            r[5],
+            r[6],
+            Who(r[3]),
+            Who(r[4]),
+            r[7],
+        );
+        let mut frames = [0u64; CHAIN];
+        frames.copy_from_slice(&r[W_HEAD..W_HEAD + CHAIN]);
+        crate::log!("scout: win cpu{cpu} {kind} open={open} opened_at: {}", Frames(frames));
+        frames.copy_from_slice(&r[W_HEAD + CHAIN..W_HEAD + 2 * CHAIN]);
+        crate::log!("scout: win cpu{cpu} {kind} open={open} closed_at: {}", Frames(frames));
+        *left -= 3;
+        let events_at = W_HEAD + 2 * CHAIN;
+        let kept = (r[8] as usize).min(KEEP);
+        for line in r[events_at..events_at + kept * EV].chunks(6 * EV) {
+            crate::log!("scout: win cpu{cpu} {kind} open={open} during: {}", Events(line));
+            *left -= 1;
+        }
+        let after = (r[9] as usize).min(AFTER);
+        if after != 0 {
+            let after_at = events_at + KEEP * EV;
+            crate::log!(
+                "scout: win cpu{cpu} {kind} open={open} after: {}",
+                Events(&r[after_at..after_at + after * EV])
+            );
+            *left -= 1;
+        }
+        printed += 1;
+        s.w_printed.store(printed, Relaxed);
+    }
+}
+
+fn log_shoots(cpu: usize, left: &mut usize) {
+    let s = &SCOUT[cpu];
+    let written = s.s_written.load(Relaxed);
+    let mut printed = s.s_printed.load(Relaxed);
+    while printed != written && *left >= 1 + MAX_CPUS {
+        let base = (printed as usize % SREC) * S_WORDS;
+        let mut r = [0u64; S_WORDS];
+        for (i, word) in r.iter_mut().enumerate() {
+            *word = s.srecs.get(base + i);
+        }
+        let generation = r[0];
+        crate::log!(
+            "scout: shoot cpu{cpu} gen={generation} origin={} begin={} end={} span_ns={} gap_ns={} gap_at={} probes={}",
+            crate::invalidation::Origin::NAMES.get(r[7] as usize).copied().unwrap_or("?"),
+            Ns(r[1]),
+            Ns(r[2]),
+            crate::clock::nanos_of_ticks(r[2].saturating_sub(r[1])),
+            crate::clock::nanos_of_ticks(r[3]),
+            Ns(r[4]),
+            r[5],
+        );
+        *left -= 1;
+        for target in (0..(r[6] as usize).min(MAX_CPUS)).filter(|target| *target != cpu) {
+            let at = S_HEAD + target * S_PER;
+            crate::log!(
+                "scout: shoot cpu{cpu} gen={generation} target=cpu{target} ack={} via={} seen={} trail: {}",
+                Ns(r[at + 1]),
+                VIA.get(r[at + 2] as usize).copied().unwrap_or("?"),
+                Ns(r[at]),
+                Events(&r[at + 3..at + S_PER]),
+            );
+            *left -= 1;
+        }
+        printed += 1;
+        s.s_printed.store(printed, Relaxed);
+    }
+}
+
+fn log_samples(cpu: usize, left: &mut usize) {
+    let s = &SCOUT[cpu];
+    let written = s.n_written.load(Relaxed);
+    let mut printed = s.n_printed.load(Relaxed);
+    while printed != written && *left >= 1 {
+        let base = (printed as usize % NREC) * N_WORDS;
+        let mut r = [0u64; N_WORDS];
+        for (i, word) in r.iter_mut().enumerate() {
+            *word = s.nrecs.get(base + i);
+        }
+        let mut frames = [0u64; CHAIN];
+        frames.copy_from_slice(&r[N_HEAD..N_WORDS]);
+        struct By(u64);
+        impl fmt::Display for By {
+            fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                match self.0 {
+                    0 => f.write_str("self"),
+                    by => write!(f, "cpu{}", by - 1),
+                }
+            }
+        }
+        crate::log!(
+            "scout: nmi cpu{cpu} at={} by={} ring={} if={} who={} masked_since={} rip={} stack: {}",
+            Ns(r[0]),
+            By(r[1]),
+            r[3] >> 1,
+            r[3] & 1,
+            Who(r[4]),
+            Ns(r[5]),
+            Sym(r[2], false),
+            Frames(frames),
+        );
+        *left -= 1;
+        printed += 1;
+        s.n_printed.store(printed, Relaxed);
+    }
+}
+
+fn log_locks(cpu: usize, left: &mut usize) {
+    let s = &SCOUT[cpu];
+    let written = s.l_written.load(Relaxed);
+    let mut printed = s.l_printed.load(Relaxed);
+    while printed != written && *left >= 1 {
+        let base = (printed as usize % LREC) * L_WORDS;
+        let mut r = [0u64; L_WORDS];
+        for (i, word) in r.iter_mut().enumerate() {
+            *word = s.lrecs.get(base + i);
+        }
+        struct Holder(u64);
+        impl fmt::Display for Holder {
+            fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                match self.0 {
+                    0 => f.write_str("?"),
+                    cpu => write!(f, "cpu{}", cpu - 1),
+                }
+            }
+        }
+        crate::log!(
+            "scout: lock cpu{cpu} lock={} at={} begin={} end={} span_ns={} gap_ns={} gap_at={} holder={} held_ns={} holder_at={} probes={}",
+            Sym(r[0], false),
+            Loc(r[1]),
+            Ns(r[2]),
+            Ns(r[3]),
+            crate::clock::nanos_of_ticks(r[3].saturating_sub(r[2])),
+            crate::clock::nanos_of_ticks(r[4]),
+            Ns(r[5]),
+            Holder(r[6]),
+            crate::clock::nanos_of_ticks(r[8]),
+            Loc(r[7]),
+            r[9],
+        );
+        *left -= 1;
+        printed += 1;
+        s.l_printed.store(printed, Relaxed);
+    }
 }
diff --git a/tests/scoutcase/system.toml b/tests/scoutcase/system.toml
new file mode 100644
index 000000000..4dad7e46e
--- /dev/null
+++ b/tests/scoutcase/system.toml
@@ -0,0 +1,82 @@
+
+[boot]
+start = ["logd", "blockd", "fsd", "soundd", "test-runner"]
+
+# **Every image that carries a `TOYOS-LOG` partition runs this**, and every
+# image does. The kernel keeps the record ring and writes no file at all, so a
+# boot config without `logd` is a boot whose `/log` is empty —
+# `every_boot_config_runs_logd` is what refuses one.
+# It claims no device and serves no port: its row's authority is `logread`,
+# which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
+# it every program's output beside that.
+[programs.logd]
+service = true
+syscap = ["logread"]
+
+[programs.soundd]
+service = true
+serves = ["soundd"]
+devices = ["hda-audio", "virtio-sound"]
+syscap = ["rt"]
+
+# The test estate's authority.
+# `device` because five of the guest binaries claim the keyboard or the mouse
+# and no manifest row can name them — they are not `[programs]` keys — and `dup`
+# because a claim moves and one boot runs several of them.
+# `logread` because the log gate reads the kernel's own records and cannot be
+# a spawned binary: a `SysCap` dup is not part of the namespace test-runner
+# hands down.
+# `power` because `endowment_denied` narrows it *away* to prove the two power
+# syscalls refuse a capability without it, which a capability that never
+# carried it would make vacuous. `run shutdown` does not use it: the applet asks
+# init through the `power` connector, and init has `logd` make the log whole
+# before it stops the machine.
+# `roster` because guest binaries read `SYS_SYSINFO`'s per-thread entries —
+# soundd's, for the idle-suspend certification, and their own, which arrive in
+# the same machine-wide answer and have no narrower question in the ABI. It is
+# also what `endowment_denied` narrows *away* to prove the refusal, so an estate
+# without it would make that arm vacuous rather than red.
+[programs.test-runner]
+receives = ["soundd", "power"]
+syscap = ["device", "dup", "logread", "power", "roster"]
+args = ["--bound-ms=3600000", "test_rs_idle_span", "pwd", "test_rs_ring_park_herd"]
+
+[programs.toybox]
+receives = ["soundd"]
+
+[symlinks]
+"bin/cat" = "/system/bin/toybox"
+"bin/cp" = "/system/bin/toybox"
+"bin/echo" = "/system/bin/toybox"
+"bin/free" = "/system/bin/toybox"
+"bin/grep" = "/system/bin/toybox"
+"bin/hexdump" = "/system/bin/toybox"
+"bin/ls" = "/system/bin/toybox"
+"bin/mkdir" = "/system/bin/toybox"
+"bin/mv" = "/system/bin/toybox"
+"bin/ps" = "/system/bin/toybox"
+"bin/pwd" = "/system/bin/toybox"
+"bin/reboot" = "/system/bin/toybox"
+"bin/rm" = "/system/bin/toybox"
+"bin/shutdown" = "/system/bin/toybox"
+# The shipped audio client, and the one the T14 hangs on. The raw-API tone in
+# `toyos-rust-tests` drains the same sink perfectly, so a suite that ran only
+# that one certified a path no user takes.
+"bin/tone" = "/system/bin/toybox"
+
+# The block service: the NVMe controller this machine's DATA is on, driven
+# from userland through its claim. Started again when it ends; the claim goes
+# back with the process and is minted again for the next.
+[programs.blockd]
+service = true
+restart = true
+serves = ["block"]
+devices = ["pci:1b36:0010"]
+
+# The file servers: DATA, the log and the running slot's volume, one process
+# each, serving every program the directories of its role. Started again when
+# one ends, on the same ports.
+[programs.fsd]
+restart = true
+roles = ["data", "log", "boot"]
+receives = ["block"]

Japabu · 2026-10-02T22:43:08Z

The scout patch, part 2 of 2. The throwaway instrument the evidence comments read (never landed): scout.patch, 1,859 lines, sha256 f5a0208c10d9a31264711539e9f70ee436609551670f01ae0bd08a6ae2ac458a, applied on c59e09ed6 for the staging and reversed. Part 1 and part 2, each taken from between the fences and joined in order with nothing between them, are that file byte for byte.

diff --git a/tests/toyos.rs b/tests/toyos.rs
index 9081943e0..543a58395 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -185,6 +185,8 @@ const MACHINE_TESTS: &[&str] = &[
     // no way to turn it back on, so only a machine QEMU reports stopping can
     // be asked. `machine_soft_off_decoded` reads the T14's own decode.
     "machine_shutdown",
+    // SCOUT: the T14 row's kernel and job list under TCG, read for its lines' shape.
+    "x86_scout_probe",
 ];
 
 /// **The metal profile**: which registrations run on the ThinkPad T14, what
@@ -2312,10 +2314,193 @@ fn run_machine_test(name: &str, test_config: &Path) -> Result<(), String> {
         "iommu_virtio_platform" => common::iommu::iommu_virtio_platform(test_config),
         "nested_nmi_is_loud" => faults::nested_nmi_is_loud(test_config),
         "machine_shutdown" => power::machine_shutdown(test_config),
+        "x86_scout_probe" => scout_probe(),
         other => Err(format!("unknown machine test {other}")),
     }
 }
 
+/// SCOUT: boot the `mask_windows` row's kernel and job list on eight CPUs under
+/// TCG, wait for every run of the herd, and read every `scout:` line for its
+/// shape. No duration here is a verdict.
+fn scout_probe() -> Result<(), String> {
+    const CPUS: u32 = 8;
+    const RUNS: usize = 40;
+    let root = compile::repo_root();
+    let bin = |name: &str| {
+        (
+            format!("bin/test_rs_{name}"),
+            qemu::build_toyos_bin(toyos_build::arch::Arch::X86_64, &root.join("tests/toyos-rust-tests"), name),
+        )
+    };
+    let mut qemu = QemuInstance::boot_with_options(
+        &root.join("tests/scoutcase"),
+        &[],
+        &[],
+        BootOptions {
+            smp: CPUS,
+            kernel_features: toyos_build::build::MASK_WINDOWS_KERNEL,
+            extra_root_files: vec![bin("ring_park_herd"), bin("idle_span")],
+            ..Default::default()
+        },
+    );
+    let end = format!("===TEST_END {WINDOWS_LOAD} ");
+    let mut rest = String::new();
+    let mut from = 0;
+    let mut waited = Ok(());
+    for run in 0..RUNS {
+        waited = qemu::await_marker_new(&mut qemu, &mut rest, &end, from, &format!("run {run} of the herd to end"));
+        if waited.is_err() {
+            break;
+        }
+        from += rest[from..].find(&end).expect("the marker was awaited") + end.len();
+    }
+    if waited.is_ok() {
+        waited = await_marker(&mut qemu, &mut rest, "exit: test-runner pid=", "the runner to end");
+    }
+    let serial = format!("{}\n{rest}", qemu.boot_log());
+    for line in serial.lines().filter(|l| {
+        l.contains("scout: ") || l.contains("windows: ") || l.contains("tlb: ") || l.contains("exit: ") && l.contains(" pid=") || l.contains("===TEST_")
+    }) {
+        eprintln!("  [scout] {line}");
+    }
+    waited.map_err(|why| format!("{why}\nserial:\n{serial}"))?;
+    let exits = serial.lines().filter(|l| l.contains(&format!("===TEST_END {WINDOWS_LOAD} exit=0==="))).count();
+    if exits != RUNS {
+        return Err(format!("{exits} runs of the herd ended with exit 0, want {RUNS}"));
+    }
+    let counts = scout_lines(&serial, CPUS)?;
+    eprintln!("  [scout] parsed: {counts:?}");
+    if counts.get("smi") != counts.get("end") {
+        return Err(format!("a report that began and did not end: {counts:?}"));
+    }
+    for owed in ["armed", "smi", "win", "win.opened_at", "win.closed_at", "shoot", "shoot.target", "nmi.asked", "lock"] {
+        if counts.get(owed).copied().unwrap_or(0) == 0 {
+            return Err(format!("no `scout: {owed}` line in the capture"));
+        }
+    }
+    mask_windows(&serial, CPUS)?;
+    eprintln!("  [scout] {:?}", common::irqcensus::windows_under(&serial, CPUS, &windows_load_exited()));
+    Ok(())
+}
+
+/// Every `scout:` line of `capture` by kind, each held to its shape: the fields
+/// it owes, in order, and every number a number.
+fn scout_lines(capture: &str, cpus: u32) -> Result<std::collections::BTreeMap<String, usize>, String> {
+    let mut counts = std::collections::BTreeMap::new();
+    let number = |line: &str, rest: &str, key: &str| -> Result<u64, String> {
+        let field = rest
+            .split_whitespace()
+            .find_map(|f| f.strip_prefix(key))
+            .ok_or_else(|| format!("no `{key}` field\nline: {line}"))?;
+        field.parse().map_err(|_| format!("`{key}{field}` is no number\nline: {line}"))
+    };
+    let owes = |line: &str, rest: &str, keys: &[&str]| -> Result<(), String> {
+        let mut at = 0;
+        for key in keys {
+            at += rest[at..].find(key).ok_or_else(|| format!("no `{key}` after byte {at}\nline: {line}"))? + key.len();
+        }
+        Ok(())
+    };
+    for line in capture.lines() {
+        let Some(rest) = line.split("scout: ").nth(1) else { continue };
+        let kind = rest.split_whitespace().next().unwrap_or("");
+        let named = match kind {
+            "armed" => {
+                number(line, rest, "long_ns=")?;
+                number(line, rest, "long_ticks=")?;
+                "armed".to_string()
+            }
+            "end" => {
+                number(line, rest, "at=")?;
+                number(line, rest, "lines=")?;
+                "end".to_string()
+            }
+            "smi" => {
+                number(line, rest, "at=")?;
+                for cpu in 0..cpus {
+                    let key = format!("cpu{cpu}=");
+                    let field = rest
+                        .split_whitespace()
+                        .find_map(|f| f.strip_prefix(key.as_str()))
+                        .ok_or_else(|| format!("no `{key}` field\nline: {line}"))?;
+                    let (count, at) =
+                        field.split_once('@').ok_or_else(|| format!("no `@` in `{field}`\nline: {line}"))?;
+                    count.parse::<u64>().map_err(|_| format!("`{count}` is no number\nline: {line}"))?;
+                    at.parse::<u64>().map_err(|_| format!("`{at}` is no number\nline: {line}"))?;
+                }
+                "smi".to_string()
+            }
+            "win" if rest.contains(" close=") => {
+                owes(line, rest, &[" open=", " close=", " span_ns=", " smi=", " opener=", " closer=", " events="])?;
+                let (open, close, span) =
+                    (number(line, rest, "open=")?, number(line, rest, "close=")?, number(line, rest, "span_ns=")?);
+                if close <= open || span.abs_diff(close - open) > 1 || span <= 2_000_000 {
+                    return Err(format!("a window of {span} ns from {open} to {close}\nline: {line}"));
+                }
+                number(line, rest, "events=")?;
+                "win".to_string()
+            }
+            "win" => {
+                number(line, rest, "open=")?;
+                let part = ["opened_at:", "closed_at:", "during:", "after:"]
+                    .into_iter()
+                    .find(|part| rest.contains(part))
+                    .ok_or_else(|| format!("a window line of no known part\nline: {line}"))?;
+                if rest.split(part).nth(1).is_none_or(|said| said.trim().is_empty()) {
+                    return Err(format!("`{part}` says nothing\nline: {line}"));
+                }
+                format!("win.{}", part.trim_end_matches(':'))
+            }
+            "shoot" if rest.contains(" target=") => {
+                owes(line, rest, &[" gen=", " target=cpu", " ack=", " via=", " seen=", " trail: "])?;
+                number(line, rest, "ack=")?;
+                number(line, rest, "seen=")?;
+                "shoot.target".to_string()
+            }
+            "shoot" => {
+                owes(line, rest, &[" gen=", " origin=", " begin=", " end=", " span_ns=", " gap_ns=", " gap_at=", " probes="])?;
+                let (begin, end, span) =
+                    (number(line, rest, "begin=")?, number(line, rest, "end=")?, number(line, rest, "span_ns=")?);
+                if end <= begin || span.abs_diff(end - begin) > 1 || span <= 2_000_000 {
+                    return Err(format!("a shootdown of {span} ns from {begin} to {end}\nline: {line}"));
+                }
+                number(line, rest, "gap_ns=")?;
+                number(line, rest, "probes=")?;
+                "shoot".to_string()
+            }
+            "nmi" => {
+                owes(line, rest, &[" at=", " by=", " ring=", " if=", " who=", " masked_since=", " rip=", " stack: "])?;
+                number(line, rest, "at=")?;
+                number(line, rest, "masked_since=")?;
+                if rest.contains(" by=self ") { "nmi.self".to_string() } else { "nmi.asked".to_string() }
+            }
+            "lock" => {
+                owes(
+                    line,
+                    rest,
+                    &[" lock=", " at=", " begin=", " end=", " span_ns=", " gap_ns=", " gap_at=", " holder=", " held_ns=", " holder_at=", " probes="],
+                )?;
+                let (begin, end, span) =
+                    (number(line, rest, "begin=")?, number(line, rest, "end=")?, number(line, rest, "span_ns=")?);
+                if end <= begin || span.abs_diff(end - begin) > 1 || span <= 2_000_000 {
+                    return Err(format!("a lock wait of {span} ns from {begin} to {end}\nline: {line}"));
+                }
+                number(line, rest, "held_ns=")?;
+                "lock".to_string()
+            }
+            "dropped" => {
+                for key in ["win=", "shoot=", "nmi=", "lock=", "unprinted="] {
+                    number(line, rest, key)?;
+                }
+                "dropped".to_string()
+            }
+            other => return Err(format!("a `scout:` line of no known kind {other:?}\nline: {line}")),
+        };
+        *counts.entry(named).or_insert(0) += 1;
+    }
+    Ok(counts)
+}
+
 /// Every CPU's `CR0` and `CR4`, against what a CPU running this kernel must
 /// hold.
 ///
diff --git a/toyos-sched/src/windows.rs b/toyos-sched/src/windows.rs
index 8c80caffb..b792f8ab3 100644
--- a/toyos-sched/src/windows.rs
+++ b/toyos-sched/src/windows.rs
@@ -225,6 +225,19 @@ impl Windows {
         }
     }
 
+    /// SCOUT: the counter the open interrupts-off window opened at, or 0.
+    pub fn irqs_since(&self) -> u64 {
+        match self.irqs_off.load(Ordering::Relaxed) {
+            UNTRACKED => 0,
+            at => at,
+        }
+    }
+
+    /// SCOUT: the counter the open preemption-off window opened at, or 0.
+    pub fn preempt_since(&self) -> u64 {
+        self.preempt_off.load(Ordering::Relaxed)
+    }
+
     /// The longest interrupts-off and preemption-off windows closed since the
     /// last take, in counter ticks; the next take starts from none.
     pub fn take(&self) -> (u64, u64) {
diff --git a/userland/test-runner/src/main.rs b/userland/test-runner/src/main.rs
index ac94998b9..45eb42ef5 100644
--- a/userland/test-runner/src/main.rs
+++ b/userland/test-runner/src/main.rs
@@ -36,6 +36,10 @@ static JOB: AtomicU32 = AtomicU32::new(0);
 /// the boot its verdict.
 static STOPPING: AtomicBool = AtomicBool::new(false);
 
+/// SCOUT: how many times one boot runs the herd, each a process of its own.
+const SCOUT_HERD_RUNS: usize = 40;
+const SCOUT_HERD: &str = "test_rs_ring_park_herd";
+
 /// Nothing this process does can reach a log whose last line is already
 /// written, so the loop stops where it is.
 ///
@@ -90,14 +94,21 @@ fn main() {
             }
             *RUNNING.lock().expect("the deadline thread does not panic holding this") =
                 job.clone();
-            match run_one(job, &[], cap.as_ref()) {
-                Ran::No => {
-                    give_the_machine_back(&format!("job {job:?} did not run"))
+            let runs = if job == SCOUT_HERD { SCOUT_HERD_RUNS } else { 1 };
+            for _ in 0..runs {
+                match run_one(job, &[], cap.as_ref()) {
+                    Ran::No => {
+                        give_the_machine_back(&format!("job {job:?} did not run"))
+                    }
+                    Ran::Spawned => {}
+                }
+                if STOPPING.load(Ordering::Acquire) {
+                    stand_down();
                 }
-                Ran::Spawned => {}
             }
-            if STOPPING.load(Ordering::Acquire) {
-                stand_down();
+            if job == SCOUT_HERD {
+                println!("test-runner: the herd ran {runs} times, as the scout asks");
+                let _ = io::stdout().flush();
             }
         }
         FINISHED.store(true, Ordering::Release);

Japabu · 2026-10-02T22:56:46Z

Linux's ACPI state on the T14, read by the orchestrator under Ubuntu (6.8.0-142-generic) on the same machine, for the firmware-interrupt issue to cite. The FADT is read from /sys/firmware/acpi/tables/FACP and the two registers from /dev/port, as root; nothing was written.

FADT: SCI_INT=9 SMI_CMD=0xb2 ACPI_ENABLE=0xf0 ACPI_DISABLE=0xf1 PM1a_EVT_BLK=0x1800 PM1a_CNT_BLK=0x1804 flags=0x20c4e5 HW_REDUCED_ACPI=0
PM1a_CNT (port 0x1804) = 0x0001, SCI_EN = 1
SMI_EN (port 0x1830, PMBASE+0x30) = 0x10002033

SMI_EN bits set: 0 (GBL_SMI_EN), 1 (EOS), 4 (SLP_SMI_EN), 5 (APMC_EN), 13 (TCO_EN), 28. The firmware-interrupt count under Linux, perf stat -a -A -e msr/smi/ over 120 s beside rtla timerlat top -q -d 2m --dma-latency 0: 0 on every CPU.

Japabu · 2026-10-02T23:19:36Z

Review, round 1, head 9a2b98888. Net (git diff --shortstat origin/main...9a2b98888): 5 files, +146 −104, all under issues/; production 0, tests 0. Read against scout-1/windowscase/kernel.log and loader.log, linuxcmp/, and 649-r5/649-r6's readbacks. A number in the four files that has no line below matches the log. The five corrections in the PR body hold, and the 93 windows sum: 25 + 27 + 2 + 3 + 28 + 7 + 1.

BLOCKER

issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md:9-17: this opens a second defect for a spin the tracker already records, and cites neither record. issues/hardware/xhci-waits-are-spins.md:43-47 already records storage_read/storage_write driving a SCSI command in a spin under XHCI. It is cited nowhere and holds no T14 reading. issues/kernel/a-disk-operation-can-spin-past-the-tlb-ack-tripwire-before-its-break.md:9-18 already records a USB disk operation holding the controller lock with IF clear from its first command, while a CPU that waits on its TLB acknowledgement spins. That is this file's all-eight shape. The PR body concedes that both "also describe the spin". issues/kernel/cpu0-holds-interrupts-and-preemption-off-for-6-5-ms-on-the-t14.md:42-52 now makes init's two partition claims a third record of the same wait. Why it is a BLOCKER: it is a sibling of something the tree already has, with one cause and one fix (the track's step 10) spread over three files that do not point at each other. Fix: keep one record of the spin, holding the T14 reading and the all-eight shape. In the same diff, delete the other or reduce it to a pointer, and move every citation. The cpu0 file then keeps only what is its own, the 3.8 ms PCI claim.

NOTE

issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md:41-43: "The output of those reads was not kept" is false at this head. Comment 5962768253 quotes the FADT, PM1a_CNT and SMI_EN reads, and linuxcmp/linux-acpi-state.log holds them. Cite the comment and state the values as read. The PR body's item "The Linux ACPI state … has no output in any file" is stale for the same reason.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md:29-33: Linux's 0 was read beside rtla timerlat top -q -d 2m --dma-latency 0 (linuxcmp/smi.sh, quoted in comment 5962619169). That run holds C-states shallow and puts a 1 kHz timer on every CPU. The file leaves this out, yet lists the missing ACPI handshake as the only difference read. Name the condition: as written, the title's "and not under Linux" claims more than was measured.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md:52-53: the exit names no reader and no interval.
- No row reads MSR 0x34, and no file owes one.
- Counted from power-on, "during a boot" already stands at 4824 before the kernel's first read.
- The one difference the file names, an ACPI enable, is a write to SMI_CMD. Where APMC_EN is set (bit 5 of Linux's SMI_EN=0x10002033), that write is itself an SMI.
Name the interval the count must hold over (for example, the kernel's first report to the stop) and who builds the row.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md:1-5: no owner. It is status: open with no track or holder named. Root CLAUDE.md ("Zero silent debt") records a weakness with its ownership.
issues/kernel/cpu0-holds-interrupts-and-preemption-off-for-6-5-ms-on-the-t14.md:64-66: nothing can read the exit "no longer includes init's claims". The mask_windows row prints a span and no opener, and the scout never lands. The file also names no owner, although its partition claims go with the track's step 10. Name both.
issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md:72-75: "read by an instrument that names a window's opener" names something that is not in the tree and that nothing owes. Name that instrument and its owner, or state the exit as a span the shipping row reads.
issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md:35-36: "74 to 299 ns before each shootdown ends" is the wrong range for the fourteen 7.7 to 7.85 ms shootdowns. For them, end minus the writing target's ack reads 130 to 264 ns. 74 (gen 4234) and 299 (gen 5250) come from two of the fourteen shorter shootdowns that follow.
issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md:63-64: "one CPU at 10,214,820 to 11,645,411 in the stop's report of five boots" is wrong for one boot. In 649-r5/1-head the stop's report reads two CPUs over 10 ms: cpu7 at 11,522,834 (loader.log:57) and cpu4 at 11,645,411 (loader.log:63).
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos-and-not-under-linux.md:25-26: a single late sample does not mark a step. Init's PCI claim (cpu0, 1.162 s, 3,817,265 ns, smi=4824->4824) also has just one sample, 3.816 ms in. The other 51 windows without a step take their first sample 2.02 to 2.85 ms in. The stop is shown by the two lock gaps (:27-28), so say so.
issues/kernel/a-process-lengthens-an-interrupts-off-walk-by-the-threads-it-parks-on-one-ring.md:64-65: "one size reads 1.03 to 10.15 ms over six boots" still counts readings the branch now places elsewhere:
- 2 × 5,075,290, which :60-61 now calls the log write;
- 4,725,822, which the firmware file calls a step, by reading.
Without those two, the walk reads 1.03 to 1.98 ms.
PR body, "gap_ns is about a microsecond on twelve of the fourteen (1,141 to 1,293)": the twelve read 1,141 to 1,676 (gen 5203, cpu0, 1,676).

REMOVE

issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md:49-53: the "The instrument's control" bullet is the throwaway instrument's calibration, already quoted in comment 5962618149. Nothing in the defect rests on it.

SEND BACK

… interrupt keep their own, with owners and exits Review round 1 of #681 found the T14's log-write file a third record of the spin `issues/hardware/xhci-waits-are-spins.md` and `a-disk-operation-can-spin-past-the-tlb-ack-tripwire-before-its-break` already held, with the cpu0 file's partition claims a fourth. - xhci-waits-are-spins.md is the one record: the spin, a disk call's masked syscall, the tripwire arithmetic (folded from the deleted a-disk-operation file), the T14 readings (folded from the deleted log-write file), init's partition claims and #649's readings that are this by reading. Owner: the small-kernel track's step 10. Exit: the tree has no kernel/src/drivers/xhci. Old content dropped as no longer true of the tree: the hot-plug enumeration's ~14 ms (it is stepped now) and the "I/O thread or asynchronous block layer" choice (the track chose usbd). - The cpu0 file keeps only the 3.8 ms PCI claim and is renamed inits-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms: its 6.5 ms is the spin's. Owner: the same track (stage 5's exit, step 10 unmasking cpu0's line). Exit: the mask_windows row's first report reads cpu0 under 3,817,265 ns after step 10. - The firmware file drops "and not under Linux" from its slug: Linux's 0 was read beside rtla timerlat --dma-latency 0 only. It states the Linux ACPI values as read (comment 5962768253), shows the stop by the two lock gaps instead of a late sample, names the T14 loop as owner of the row, and its exit reads the count from init's spawn to the stop's report, after any SMI_CMD write the bring-up makes. - Corrections: the writing CPU acknowledges 130 to 264 ns before each of the fourteen long shootdowns ends; the stop's report read two CPUs over 10 ms in 649-r5/1-head; the walk reads 1.03 to 1.98 ms without the log write and the firmware step. The instrument's control bullet is removed. - a-shutdown-on-a-held-usb-disk's citation of the deleted file follows it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-02T23:51:44Z

Review, round 2, head 2529aba55.

Size (git diff --shortstat origin/main...2529aba55): 8 files, +196 −227, all under issues/. Production 0, tests 0.
Host gate: cargo run -- --ci host at this head exited 0, ending [ci] Host: 67 step(s), all green (681-r2/ci-host.log). The change reaches no guest test and no metal row.
What I checked against: scout-1/windowscase/kernel.log, linuxcmp/linux-acpi-state.log, 649-t14/6-head and 649-r6/{1-head,3-idle-halt-counted}. The numbers new at this head match these logs or the main files they were folded from.

Round 1

BLOCKER, the duplicate record of the xHCI spin: CLOSED.
- git grep at 2529aba55 for some-t14-boots, tripwire-before-its-break, cpu0-holds-interrupts, a-log-write-to-the-t14 and under-toyos-and-not-under-linux finds nothing.
- xhci-waits-are-spins.md:36-89 holds the T14 readings and both all-eight events.
- The PCI file holds only the 3.8 ms claim.
- Round 1's NOTEs 2 to 12 and its REMOVE 13 are each addressed at this head.

BLOCKER

issues/hardware/xhci-waits-are-spins.md:7-25 — a second open record of this same spin is on main: issues/audio/disk-wait-pins-a-cpu.md. — It is a sibling of a record the tree already has: round 1's BLOCKER, one file further on.
- What that file says: "this kernel cannot touch a disk without pinning a CPU for the whole device round trip" (:20), and "the pinning disk wait is logd's fsync" (:28-29).
- issues/kernel/scheduler-pass-blocks-in-xhci.md:38-39 sends a reader looking for "the disk wait that survives" to that file, not to this one.
- Neither file cites the other.
- That file has no T14 reading, no owner and no exit.
- Two of its four locks, log_file::SINK and fat32_adapter::VOLUMES, are gone from the tree.
- So the PR body's "The spin has one record" is false at this head.
Fix, all in the same diff:
- Fold that file's one live claim into this one: logd's SYS_FSYNC reaches storage_flush under XHCI inside a masked syscall (kernel/src/object/ops.rs:692-706). :17-22's list of masked disk calls lacks it too.
- Delete issues/audio/disk-wait-pins-a-cpu.md.
- Move scheduler-pass-blocks-in-xhci.md:39's citation to this file.

NOTE

issues/hardware/xhci-waits-are-spins.md:27-34, :94-95 — the fold lost no fact, but it lost the deleted file's exit. — That exit was the only one a fix before step 10 can meet.
- What it said: the call's bound opens where the operation opens, or a later batch starts only while a whole call's bound is still inside it. A staged boot shows it: its first batch spends most of the budget and its next batch breaks.
- The only exit now is "no kernel/src/drivers/xhci". Until step 10, a stick that breaks late in an operation can make another CPU's shootdown panic, and nothing owes the cheaper fix.
- Give the arithmetic that exit beside step 10's, or record the owner's ruling that it waits for step 10.
- Every other line of the three deleted files is in this file, or is one of these:
  - outdated by the tree: ROOT is read from memory, so no page cache reaches a disk (kernel/src/rootfs.rs:1-14), and enumeration is stepped;
  - a detail that told nothing apart: the fourth boot's nmi=2, and the short readings kept beside the long ones.
issues/kernel/inits-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md:29-32 — the exit's bound, "under 3,817,265 ns", is the very reading it bounds. — Nothing has read the claim twice: in every Stage 6 step 2, built: the longest interrupts-off and preemption-off windows per CPU, and a held window the T14 reads back #649 boot, cpu0's line was the partition claims'.
- A boot whose claim runs a few µs shorter meets the exit with nothing changed.
- A firmware step (4.5 ms) in any cpu0 window before idle_span's exit fails it even with the claim fixed.
- State a bound a fix must clear, with its derivation (24 vendor-ID reads), as the file's own "or" already allows.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md:63-65 — the interval opens "as init is spawned, after every write the kernel's bring-up makes". — That presumes the SMI_CMD write, if the enable is the fix, is the kernel's and comes before init.
- If a userland server makes the enable after init's spawn, the write falls inside the interval and raises the one interrupt :55-57 names. A fixed machine then fails the exit.
- Open the interval after the boot's last SMI_CMD write, whoever makes it.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md:59-61 — "Owner: the T14 loop" reads as the owner of the issue. — The loop owns only the row.
- The PR body's Unsure says the fix has no owner in the tree.
- Until the owner rules, the file has to say that too, or it is not true.

REMOVE

PR body, "There is no third cause." — The body's own first paragraph and the PCI file both record a third cause: the 3.8 ms claim. "init's claims (3)" then counts it with the spin's two.

SEND BACK

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T06:48:44Z

Evidence for the PCI claim's exit bound (issues/kernel/inits-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md): the scout boot's PCI enumeration, kernel.log lines 46 to 73, verbatim. The log's sha256 is 7c86b5f25096b7faa18e47f905d8a25e06fc3234fd2341e4b74ec9b49a8ace28.

[2026-10-02 22:16:13 0.064 cpu0] ACPI: ECAM base address: 0xc0000000
[2026-10-02 22:16:13 0.064 cpu0] mmio: 0xc0000000+0x10000000 PAT Uncacheable (MTRR UC)
[2026-10-02 22:16:13 0.064 cpu0] PCI: Enumerating devices...
[2026-10-02 22:16:13 0.064 cpu0]   PCI 00:00.0 [0600] vendor=8086 device=9a14 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.064 cpu0]   PCI 00:02.0 [0300] vendor=8086 device=9a49 prog_if=00 bars=[bar0=0x603c000000 bar2=0x4000000000 bar4=none(it is an I/O BAR at port 0x3000, not memory)]
[2026-10-02 22:16:13 0.064 cpu0]   PCI 00:04.0 [1180] vendor=8086 device=9a03 prog_if=00 bars=[bar0=0x603db80000]
[2026-10-02 22:16:13 0.064 cpu0]   PCI 00:06.0 [0604] vendor=8086 device=9a09 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.064 cpu0]   PCI 00:07.0 [0604] vendor=8086 device=9a25 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:07.2 [0604] vendor=8086 device=9a27 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:0a.0 [1180] vendor=8086 device=9a0d prog_if=00 bars=[bar0=0x603dbc0000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:0d.0 [0c03] vendor=8086 device=9a13 prog_if=30 bars=[bar0=0x603dbb0000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:0d.2 [0c03] vendor=8086 device=9a1b prog_if=40 bars=[bar0=0x603db40000 bar2=0x603dbd4000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:0d.3 [0c03] vendor=8086 device=9a1d prog_if=40 bars=[bar0=0x603db00000 bar2=0x603dbd3000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:14.0 [0c03] vendor=8086 device=a0ed prog_if=30 bars=[bar0=0x603dba0000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:14.2 [0500] vendor=8086 device=a0ef prog_if=00 bars=[bar0=0x603dbcc000 bar2=0x603dbd2000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:16.0 [0780] vendor=8086 device=a0e0 prog_if=00 bars=[bar0=0x603dbd1000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1c.0 [0604] vendor=8086 device=a0b8 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1c.4 [0604] vendor=8086 device=a0bc prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1c.7 [0604] vendor=8086 device=a0bf prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1f.0 [0601] vendor=8086 device=a082 prog_if=00 bars=[]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1f.3 [0403] vendor=8086 device=a0c8 prog_if=80 bars=[bar0=0x603dbc8000 bar4=0x603da00000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1f.4 [0c05] vendor=8086 device=a0a3 prog_if=00 bars=[bar0=0x603dbd0000 bar4=none(it is an I/O BAR at port 0xefa0, not memory)]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1f.5 [0c80] vendor=8086 device=a0a4 prog_if=00 bars=[bar0=0xfe010000]
[2026-10-02 22:16:13 0.065 cpu0]   PCI 00:1f.6 [0200] vendor=8086 device=15fc prog_if=00 bars=[bar0=0xbcf00000]
[2026-10-02 22:16:13 0.067 cpu0]   PCI 04:00.0 [0108] vendor=1c5c device=1327 prog_if=02 bars=[bar0=0xbce00000]
[2026-10-02 22:16:13 0.068 cpu0]   PCI 09:00.0 [0280] vendor=8086 device=2725 prog_if=00 bars=[bar0=0xbc300000]
[2026-10-02 22:16:13 0.072 cpu0]   PCI 0a:00.0 [0805] vendor=17a0 device=9750 prog_if=01 bars=[bar0=0xbc200000]
[2026-10-02 22:16:13 0.144 cpu0] PCI: Enumeration complete, 24 functions.

enumerate (kernel/src/drivers/pci.rs) reads function 0's vendor ID at every device of every bus 0 to 255, the rest of a multi-function device's functions, and prints each function it finds. The stamps are whole milliseconds.

The bulk rate. After PCI 0a:00.0 (0.072 s) it reads at least 31 absent devices on bus 0x0a and 245 × 32 = 7,840 on buses 0x0b to 0xff: 7,871 reads or more, with nothing printed until Enumeration complete (0.144 s), at most 73 ms later. 73,000,000 / 7,871 = 9,274 ns a read, and 24 × that = 222,589 ns.
A slower rate. Between PCI 09:00.0 (0.068 s) and PCI 0a:00.0 (0.072 s), 3 to 5 ms, it reads devices 1 to 31 of bus 9, behind 00:1c.4 (which forwards 0xbc300000..0xbc400000, where 09:00.0's BAR is), and functions 1 to 7 of 09:00.0 if it is multi-function: 31 to 38 absent reads, 3,000,000 / 38 = 78,947 to 5,000,000 / 31 = 161,290 ns a read, beside 0a:00.0's own few reads and line.
The claim. 3,817,265 / 24 = 159,052 ns a read. The claim of pci:1b36:0010 reads only the vendor ID of each of the 24 functions: PciDevice::is_id compares the vendor first, and none of the 24 is 0x1b36.

… tripwire's fix before step 10; the PCI and firmware exits are bounds a fix must clear Round 3 of #681's review (comment 5963284260). - issues/audio/disk-wait-pins-a-cpu.md was a second open record of the xHCI spin. Its one live claim is folded into issues/hardware/xhci-waits-are-spins.md: SYS_FSYNC on a partition claim (partition_fsync, kernel/src/object/ops.rs) is a cache flush through xhci::storage_flush under XHCI, inside a masked syscall, and logd's fsync is one, made by the LOG fsd on its claim (traced logd store.rs sync_all -> std fs toyos.rs Served fsync -> fsd FSYNC -> disk.rs PartitionDev::sync -> SYS_FSYNC). The rest of it is gone from the tree: log_file::SINK and fat32_adapter::VOLUMES no longer exist, the partition fsync takes no VFS, and io-depth-probe is no kernel feature. Its two citations: scheduler-pass-blocks-in-xhci.md now points at the surviving record; the-global-pipe-lock-spans-a-user-copy.md's clause naming it and io-depth-probe is deleted. In the scout boot no SYS_FSYNC window reached 2 ms (none of the 101 opened at sys(15)). - The spin's list of what still spins names a disk's bind after boot, which still blocks in a scheduler pass (msc::bind's doc, poll_if_pending's doc). - The fold's lost exit is restored beside step 10's, under the same owner: one operation's IF-clear spin under DEAF_CPU by construction, shown by a staged boot. The orchestrator ruled the cheaper fix stays owed. - The PCI claim's exit is a bound a fix must clear, 223 us, derived from 24 vendor-ID reads at the enumeration's bulk rate (7,871 absent reads in at most 73 ms), with MSR_SMI_COUNT unmoved so a firmware step cannot fail a fixed claim. The same enumeration read the 31 to 38 absent functions behind 00:1c.4 at about 80 to 160 us a read, the order of the claim's 159 us; the file says so. Lines quoted on #681, comment 5966492598. - The firmware issue's interval opens after the boot's last SMI_CMD write, whoever makes it, and its owner line says the T14 loop owns only the reading and the fix has none in the tree yet: the owner approved a scout of the switch to ACPI mode, and the fix's ownership is put to him with its result. - issues/kernel/the-scheduler-and-the-clocks-never-talk.md cited an "ACPI/power track (task #136)" that has no file; the citation goes and the AML interpreter idle-cpus-enter-the-c-states-cst-names.md points at stays. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

The scout's window trails (kernel.log, `scout: win` lines) carry the LOG fsd's SYS_FSYNC after 15 of its windows; in 7 the next event is a contended `lock(src/drivers/xhci/mod.rs:1689 …)`, which at c59e09e is `with_disk_by`'s `XHCI.lock()`. The instrument records a lock only when it spins (scout.patch, SpinWatch: "A contended `Lock::lock`'s look at its own spin"), so the other 8 say nothing either way. No window of 2 ms or more opened at syscall 15. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T06:53:27Z

Evidence for the LOG fsd's SYS_FSYNC on XHCI (issues/hardware/xhci-waits-are-spins.md): every scout: win line of the scout boot's kernel.log (sha256 7c86b5f25096b7faa18e47f905d8a25e06fc3234fd2341e4b74ec9b49a8ace28) whose trail carries sys(15), verbatim. 15 lines.

[2026-10-02 22:16:14 1.752 cpu1] scout: win cpu7 irqs open=1207515402 after: 1209884920:sys(15) | 1209915247:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 28644ns) | 1210431194:sys(67) | 1210435209:sys(90)
[2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2692012083 after: 2694667308:sys(15) | 2694702886:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 34068ns) | 2694706316:sys(67) | 2694711284:sys(90)
[2026-10-02 22:16:17 4.543 cpu4] scout: win cpu7 irqs open=3632107621 after: 3634644064:sys(15) | 3634678990:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 33613ns) | 3634681581:sys(67) | 3634685452:sys(90)
[2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5470206797 after: 5473047869:sys(15) | 5473052336:sys(67) | 5473056328:sys(90) | 5473066628:to(15:7)
[2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8257758436 after: 8260334033:sys(120) | 8260364282:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 28030ns) | 8261415689:sys(15) | 8261446289:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 29329ns)
[2026-10-02 22:16:27 14.666 cpu4] scout: win cpu6 irqs open=13793542994 after: 13796351967:sys(120) | 13797179952:sys(15) | 13797184382:sys(67) | 13797188181:sys(90)
[2026-10-02 22:16:31 18.340 cpu6] scout: win cpu4 irqs open=17442673603 after: 17445503021:sys(15) | 17445540813:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 35965ns) | 17445545513:sys(67) | 17445550416:sys(90)
[2026-10-02 22:16:34 21.134 cpu5] scout: win cpu1 irqs open=21116006613 after: 21123935203:irq(tlb) | 21123937103:sys(15) | 21123947406:sys(67) | 21123982326:lock(src/process.rs:806 0xffff80005f5d66a0 23854ns)
[2026-10-02 22:16:35 22.085 cpu2] scout: win cpu1 irqs open=21146092094 after: 21148925500:sys(15) | 21148957439:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 30610ns) | 21148960540:sys(67) | 21148964589:sys(90)
[2026-10-02 22:16:37 24.040 cpu1] scout: win cpu2 irqs open=23103928808 after: 23106759694:irq(timer) | 23106768080:sys(120) | 23107638174:sys(120) | 23108551202:sys(15)
[2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27713279089 after: 27715857852:irq(timer) | 27715868134:sys(120) | 27716795648:sys(15) | 27716800069:sys(67)
[2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31185432395 after: 31194325583:irq(timer) | 31194336778:sys(15) | 31194515666:lock(src/process.rs:806 0xffff80005f5d66a0 178598ns) | 31194519841:sys(67)
[2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31304773334 after: 31307637073:sys(120) | 31307676132:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 36173ns) | 31308615182:lock(src/process.rs:806 0xffff80005f5d66a0 139227ns) | 31308616160:sys(15)
[2026-10-02 22:16:48 35.108 cpu6] scout: win cpu3 irqs open=34128124168 after: 34136776121:irq(timer) | 34136787220:sys(15) | 34136820027:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 30630ns) | 34136824247:sys(67)
[2026-10-02 22:16:49 36.011 cpu7] scout: win cpu3 irqs open=35110451237 after: 35113099950:sys(120) | 35113912179:sys(120) | 35114768795:sys(120) | 35115679303:sys(15)

In 7 of them sys(15) is followed at once by lock(src/drivers/xhci/mod.rs:1689 …), which at c59e09ed6 is with_disk_by's XHCI.lock(). The instrument records a lock only when it spins (SpinWatch: "A contended Lock::lock's look at its own spin"), so the other 8 say nothing either way. No window of 2 ms or more opened at sys(15): the first event of each of the boot's 101 windows is sys(5) (28), sys(40) (1), sys(45) (13), sys(63) (1), sys(72) (8), sys(111) (3), sys(119) (2) or sys(120) (27), 84 to 194 ns after it opened, or, for the 18 opened in a pass, a switch, a wake or nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T07:17:11Z

Review, round 3, head 995b368f6.

Size (git diff --shortstat origin/main...995b368f6): 12 files, +223 −261, all under issues/. Production 0, tests 0.
Host gate: cargo run -- --ci host at this head exited 0 (681-r3/ci-host2.exit; ci-host2.head reads 995b368f6), ending [ci] Host: 67 step(s), all green. Its FAILED lines are its controls, each closing "verdict(s) reached". The change reaches no guest test and no metal row.
What I checked against: scout-1/windowscase/kernel.log (sha256 7c86b5f2…8ace28, the one both new comments name), lines 46-73, 293, 365 and 393; the 15 trails in comment 5966523482; kernel/src/drivers/pci.rs, kernel/src/pcidev/mod.rs and kernel/src/object/ops.rs at this head. The merge dc6e7c650 is clean: against 73282fa93 it carries only the branch's eight files.

Round 2

BLOCKER, the third record of the spin: CLOSED.
- git grep -F at 995b368f6 finds nothing for disk-wait-pins-a-cpu, io-depth-probe, task #136 or round 1's slugs.
- rg --hidden --no-ignore over the worktree finds no disk-wait-pins.
- xhci-waits-are-spins.md:24-28 carries SYS_FSYNC through storage_flush (ops.rs:696-706), and scheduler-pass-blocks-in-xhci.md:39 points at it.
- Round 2's NOTEs 2, 4 and 5 and its REMOVE 6 are addressed at this head. NOTE 3's replacement is BLOCKER 1 below.

The out-of-scope file is not a fourth record of this spin. issues/kernel/the-vfs-lock-is-held-across-a-usb-write-for-thirty-seconds.md records vfs::VFS held across ops::fsync's write-back.

At this head ops::fsync (kernel/src/object/ops.rs:635-640) takes no VFS lock.
The kernel's VFS mounts only ROOT and /tmp (kernel/src/main.rs:454-460), so no kernel VFS path reaches a USB device.
That file's exit reads met by the tree. Closing it is its own diff's job, not this branch's.

BLOCKER

issues/kernel/inits-claim-of-a-pci-function-the-t14-lacks-holds-interrupts-off-for-3-8-ms.md:29-39 — the exit bounds the syscall from entry to return at 223 µs, from a read rate this claim has never shown. — A correct fix can fail it because the hardware's reads are slow.
- The rate is the wrong population. 9.3 µs is the rate for absent functions on buses no bridge decodes: bus 0a's devices 1-31 and buses 0b-ff. The claim reads the vendor ID of 24 present functions (PciDevice::is_id, kernel/src/drivers/pci.rs:459-461), three of them behind root ports. Its one reading is 3,817,265 ns, 159 µs a read, 17 times the rate the bound assumes.
- The data contradict the premise. The same 21 bus-0 functions were each read at least six times by enumerate and print_device, and all were printed between 0.064 s and 0.065 s, under 2 ms (kernel.log:49-69). So at 1.162 s either those reads ran far slower than at enumeration, or the 3.8 ms was not spent in them. The file says nothing has said which. The bound is a guess where timing the claim's 24 reads on the T14 would answer it.
- A correct fix can fail it. The title's defect is the masked hold. The owner's stage 5 exits on "no interrupts-off window longer than a register access" (issues/kernel/the-kernel-is-small-interrupts-post-and-threads-wait.md:143-146). A fix in that shape opens interrupts between the reads and closes both the title and the owner's stage. If the reads still cost what they did at 1.162 s, the syscall still reads about 3.8 ms from entry to return, and this exit fails it. The file's last sentence concedes this: "clears this bound only by making fewer". The exit picks a design, fewer reads, instead of bounding the defect.
- Fix:
  - State the exit on what the title names: the longest interrupts-off window inside the claim, with MSR_SMI_COUNT unmoved.
  - Take any µs figure from the claim's own reads timed on the T14, not from the enumeration's absent ones.
  - Delete the enumeration-rate derivation (:30-39), along with the PR body's matching exit bullets and its Unsure line on the PCI bound.

NOTE

issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md:61-65 — the interval has no minimum length. — A row whose first reading (after the last SMI_CMD write) comes less than 2.2 s before the stop's report agrees on every CPU with nothing fixed. Require the interval to span at least two of the 2.215 to 2.222 s periods.
issues/kernel/the-scheduler-and-the-clocks-never-talk.md:22-23 — "Both wait for an AML interpreter" points at nothing. — No file records that interpreter, and issues/kernel/idle-cpus-enter-the-c-states-cst-names.md:9-11 sends its reader here for it. Removing the false task #136 left two tracks pointing at each other for work no file holds. File it (filing starts no work), or say in that line that no file records it.

SEND BACK

…rmware's spans two periods, and the missing AML interpreter has a file Round 3 of #681's review. - The PCI claim's exit bounded the syscall from entry to return at 223 us, from the enumeration's reads of absent functions on buses no bridge decodes, a population the claim never reads: it reads 24 present functions, and its one reading is 159 us a read. A fix in the owner's stage 5 shape opens interrupts between those reads, closes the title's defect, and would still have failed that bound. The exit now bounds the longest interrupts-off window inside the claim at one register access, with MSR_SMI_COUNT unmoved across it; that access's figure comes from the claim's own reads timed on the T14, which nobody has timed. The enumeration-rate derivation goes. - The firmware issue's exit had no minimum interval: two readings closer than one 2.2 s period agree with nothing fixed. The interval now spans at least 4.444 s, twice the longest period read (2,221,576,672 ns). - No file recorded that ToyOS interprets no AML, and the two tracks that wait on it pointed at each other for it. New issues/kernel/toyos-interprets-no-aml.md says what is missing and who waits; both lines point at it. Filing it starts no work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T07:29:17Z

Review, round 4, head 18335e5b1.

Size (git diff --shortstat origin/main...18335e5b1): 14 files, +237 −265, all under issues/. Production 0, tests 0. Since 995b368f6, five files changed: four modified and issues/kernel/toyos-interprets-no-aml.md added. The merge base is origin/main's tip, 73282fa93.
Host gate: cargo run -- --ci host at this head exited 0 (681-r4/ci-host.exit; ci-host.head reads 18335e5b1), ending [ci] Host: 67 step(s), all green. The change reaches no guest test and no metal row.

Round 3

BLOCKER, the PCI claim's exit derived from the enumeration's reads of absent functions: CLOSED.
- git diff 995b368f6 18335e5b1 deletes the derivation.
- inits-claim-…-3-8-ms.md:29-32 now bounds the longest interrupts-off window inside the claim at one register access, with MSR_SMI_COUNT unmoved across it. It takes the figure from the claim's own reads timed on the T14, and says nobody has timed them.
- git grep -E '223 ?µs|9\.3 ?µs|5966492598|7,871|clears this bound' 18335e5b1 exits 1.
- The PR body's Unsure carries no PCI line.

Round 3's NOTE 2 is met at the-t14s-firmware-…-under-toyos.md:61-66, with 4.444 s, twice 2,221,576,672 ns. NOTE 3 is met by the new file, except as BLOCKER 1 says.

The new file's kind is one issues/README.md allows. status: open with kind: track is a pair the README's table permits for "something to build that nobody has built". It is no question, because nobody is waiting on a ruling. It carries no design, stage table or rationale. Its claims hold at this head:

toyos-acpi/src/dsdt.rs:1-2 is a byte scan;
bootloader/src/rootbridge.rs:4-9 asks EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL for what _CRS would name;
no lockfile names an aml, acpi or uacpi package;
git grep _CST finds no reader.

BLOCKER

issues/kernel/toyos-interprets-no-aml.md:9-13 — the track drops the owner's design line that main records: "own AML interpreter, battery first". It sits at origin/main:issues/kernel/the-scheduler-and-the-clocks-never-talk.md:22-23, from 0ee814f5a, whose message says it records "the 2026-08-16 direction conversation". — After this merge no file carries that line. The README says a track carries "a design line the owner already drew". The line went at 995b368f6 with the false task #136 citation, which was only its label. This file is now its home. Without it, the next agent can take a third-party interpreter, or start from _CST, against a recorded direction. Fix: state both clauses in this file, or record the owner's ruling that withdraws them.

NOTE

None.

REMOVE

issues/kernel/toyos-interprets-no-aml.md:15-16 — "Two tracks wait on it: …" — git grep toyos-interprets-no-aml already answers who waits, and the count is already short. The touchpad track's GpioInt (issues/hardware/the-t14-touchpad-is-i2c-hid-and-unbuilt.md:11) is a descriptor in the device's _CRS. HID over I2C also takes the device's descriptor address from its _DSM.
PR body, PCI exit, "No figure is taken from the enumeration's reads: those were of absent functions, and the claim reads present ones." — It describes a derivation that never reaches main. The bullet's first sentence already says where the figure comes from.

SEND BACK

…st of who waits The owner's line "own AML interpreter, battery first" sat in issues/kernel/the-scheduler-and-the-clocks-never-talk.md beside the false "task #136" label until 995b368 removed both. It came from the 2026-08-16 direction conversation that 0ee814f records, and the AML track is now its home: without it the next agent could take a third-party interpreter or start from _CST against a recorded direction. The "Two tracks wait on it" line goes: git grep answers who waits, and the count was already short (the touchpad's GpioInt is a _CRS descriptor, and HID over I2C takes its descriptor address from _DSM). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T07:35:14Z

The firmware-interrupt scout on the T14, run by the orchestrator on the owner's go. A throwaway patch that never lands (orch/smi/smi.patch, sha256 582bb410…f538d6) on main at 73282fa93, two kernel builds, each booted once on tests/jobcase with one job that holds 30 s of plain idle and then 30 s with one spinning thread per CPU. Each image's sha256 was checked before it was flashed; toyos-metal exit 0 for both.

Arm A, nothing written (image b7f6fce44a7d67f44e5cdb451eea0e7baebab5117da93457655073d69713c329): the firmware hands ToyOS the machine in legacy mode. sci_en=0 (PM1a_CNT=0x0000) in every report from 0.156 s to 61.226 s. SMI_EN=0x10002033, the same value Linux runs with. MSR_SMI_COUNT on every CPU alike: 4817 at 1.197 s (idle mark 0), 4831 at 31.197 s (idle mark 10), 4844 at 61.224 s (busy mark 10): 14 in the idle 30 s and 13 in the busy 30 s, one every 2.2 s whether the CPUs sleep or not.
Arm B, the switch (image 6f6e6058bc3eebefe79bf58956491797ef4c79be9c3d601dee935ae100ba4fef): smi: switch: wrote 0xf0 to SMI_CMD 0xb2 at=156409452, SCI_EN read set 2129279 ns later (PM1a_CNT=0x0001); this CPU's MSR_SMI_COUNT 4817 before the write, 4818 after it. From then on sci_en=1 and the count read 4818 on every CPU at every report through 61.233 s: zero firmware interrupts in the idle 30 s and zero in the busy 30 s. The SCI's line (ISA irq 9, GSI 9, level/high) was masked throughout (sci_rte=…10000); nothing in ToyOS handles it.

So the periodic firmware interrupt is the firmware's legacy-mode work, and the ACPI enable handshake stops it. The switch itself costs one firmware interrupt and 2.13 ms until SCI_EN reads set.

Readbacks: /Users/jan/.claude/jobs/2280e09e/tmp/scratchpad/orch/smi/scout-1/{smiscout-a,smiscout-b}/kernel.log (smi: and smi_stretch: lines; the reading guide is appended to request.txt beside them).

The orchestrator's scout on the owner's go (comment 5966817345 on #681) booted main at 73282fa on the T14 twice, each boot 30 s idle then 30 s with a spinning thread per CPU. With nothing written the firmware leaves the machine in legacy mode (PM1a_CNT 0x0000, SCI_EN clear, all boot) and MSR_SMI_COUNT rises once every 2.2 s, idle and busy alike, 27 in 60 s. With ACPI_ENABLE written to SMI_CMD, SCI_EN reads set 2.13 ms later, the write costs one firmware interrupt, and the count then stays flat on every CPU for 61 s. That replaces "neither SCI_EN nor SMI_EN has been read" and "the cause is not known". Who owns the fix is still the owner's to rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

…s firmware fix The owner ruled on the firmware scout (#681, comment 5966817345): the ACPI enable lands as the first stage of the ACPI track, together with a userland server that claims the SCI and handles the power button, a fixed event that needs no AML, so nothing the firmware does in legacy mode today is lost. The AML interpreter, battery first (his direction of 0ee814f), follows as later stages. He chose this over landing the write alone with the events masked, and over waiting for the AML work. toyos-interprets-no-aml no longer says what the track is, so it becomes toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml, keeps its opened date and stays an open track. Its two citations move with it. The firmware issue's fix is owned by that track's stage 1; its exit is stage 1's first half. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T07:59:37Z

Review, round 5, head f85f659f4.

Size (git diff --shortstat origin/main...f85f659f4): 14 files, +264 −265, all under issues/. Production 0, tests 0. Since 18335e5b1, five files changed: three modified, toyos-interprets-no-aml.md deleted and toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md added. The merge base is still origin/main's tip, 73282fa93.
Host gate: cargo run -- --ci host exited 0 in this worktree after f85f659f4 was committed (681-r6/ci-host.exit), ending [ci] Host: 67 step(s), all green. The change reaches no guest test and no metal row.
The scout's numbers hold. Checked against the smi: and smi_stretch: lines of smi/scout-1/smiscout-{a,b}/kernel.log:
- arm A: sci_en=0 pm1_cnt=0x0000 and smi_en=0x10002033 in all 25 reports, 0.156 s to 61.2256 s;
- arm A's counts: 4817 at the idle-0 mark, 4831 at idle-10, 4844 at busy-10, so 14 and 13, with all eight CPUs equal in every report;
- arm B: the write at at=156409452, SCI_EN set 2129279 ns later, and the writer's count going 4817 to 4818;
- arm B, after the write: 4818 on every CPU in every report through at=61233467379, with sci_rte bit 16 set in all 26 reports of both arms.
The citations moved. git grep -n -i -e interprets-no-aml -e 'interprets no aml' f85f659f4 exits 1, and so does rg --hidden --no-ignore over the worktree. The new slug is cited at the-t14s-firmware-…-under-toyos.md:66, idle-cpus-enter-the-c-states-cst-names.md:11 and the-scheduler-and-the-clocks-never-talk.md:23, and each resolves.

Round 4

BLOCKER, the owner's "own AML interpreter, battery first" dropped: CLOSED. The track's lines 23-25 read "ToyOS writes its own, and the battery comes first (his direction of 0ee814f5a)". git show 0ee814f5a carries "own AML interpreter, battery first".

Round 4's REMOVE 2 is made: the "Two tracks wait on it" line does not survive the rename. REMOVE 3 is made too: the PR body no longer carries the enumeration-reads sentence.

BLOCKER

None.

NOTE

issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:21 — "with its events served in userland" claims more than the ruling and stage 1 (:27-29) draw, which is a server that handles the power button. — Arm B reads two events after the switch that are not fixed events:
- The firmware's enable set GPE 9's enable bit: gpe0_en byte 1 goes from 00 to 02 between smiscout-b/kernel.log:121 and :123.
- GPE 110's status rose after the switch and stayed set, served by nothing, from :298 through :759. Arm A never shows it.
Fix: state the ruling in its own words: a userland server that claims the SCI and handles the power button.
issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md:55-58 — arm B's bullet leaves out those two GPE readings. — Stage 1's server meets them as soon as it unmasks GSI 9. Comment 5966817345, the one the owner ruled on, does not carry them, and the readback is a scratch directory. Record them in that bullet. The ruling stands.
PR body, Evidence, "the firmware scout … comment 5966817345" — the body says its evidence is "quoted because the readback is a scratch directory". That comment quotes one readback line of 106 and does not quote smi.patch. — :48-58's "the cause, measured" rests on readings that go when the scratch directory goes. Fix: post on issues: the T14's 8 to 11 ms window is the xHCI spin's log write, and its firmware interrupts every CPU every 2.2 s under ToyOS #681 the smi: and smi_stretch: lines of both kernel.logs, and smi.patch (sha256 582bb410…f538d6) whole, as the c59e09ed6 scout's were.
issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md:30-31 — "a press of the power button is handled" names nothing a reading can show: what the press does, or what a row records. — No row can fail that half of the exit. Name the observable.

REMOVE

PR body, "Round 5 filed it as issues/kernel/toyos-interprets-no-aml.md. … finds no other citation of the old slug, bare or as a path." — This is the branch's own history. On main the track is a new file, and the old slug never existed there.
PR body, "or round 1's log-write file" and "Round 1's 74 and 299 ns were two of the shorter ones that follow." — This is review history. main never had that file or those figures.

LAND AFTER NAMED CHANGES

Japabu · 2026-10-03T08:00:26Z

Firmware scout, smiscout-a: every smi: and smi_stretch: line of smi/scout-1/smiscout-a/kernel.log, as the T14 read them back (the readback is a scratch directory; these lines are what the firmware issue's cause rests on).

118:[2026-10-03 07:30:12 0.156 cpu0] smi: fadt sci_int=9 smi_cmd=0xb2 acpi_enable=0xf0 acpi_disable=0xf1 pm1a_evt=0x1800 pm1_evt_len=4 pm1a_cnt=0x1804 pm_tmr=0x1808 gpe0=0x1860 gpe0_len=32 flags=0x20c4e5 hw_reduced=0
119:[2026-10-03 07:30:12 0.156 cpu0] smi: chipset 8086:a0a3, so SMI_EN at 0x1830 and the TCO block at 0x400
120:[2026-10-03 07:30:12 0.156 cpu0] smi: the SCI is ISA irq 9, gsi 9 Level/High
121:[2026-10-03 07:30:12 0.156 cpu0] smi: report=0 why=early on=cpu0 at=156110523 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4817@156110567
296:[2026-10-03 07:30:13 1.156 cpu0] smi: report=1 why=ready on=cpu0 at=1156080712 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4817@1156080767 cpu1=4817@1156104238 cpu2=4817@1156099384 cpu3=4817@1156099222 cpu4=4817@1156099306 cpu5=4817@1156099357 cpu6=4817@1156099389 cpu7=4817@1156099226
337:{2026-10-03 07:30:13 1.194 pid=8 test-runner} smi_stretch: idle mark 0 of 10
341:[2026-10-03 07:30:13 1.197 cpu0] smi: report=2 why=exit pid=9 on=cpu0 at=1197013610 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4817@1197013657 cpu1=4817@1197019399 cpu2=4817@1197019120 cpu3=4817@1197015999 cpu4=4817@1197015243 cpu5=4817@1197021404 cpu6=4817@1197021404 cpu7=4817@1197101792
355:{2026-10-03 07:30:16 4.194 pid=8 test-runner} smi_stretch: idle mark 1 of 10
359:[2026-10-03 07:30:16 4.197 cpu1] smi: report=3 why=exit pid=10 on=cpu1 at=4196991468 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@4196992117 cpu1=4818@4196991519 cpu2=4818@4196997354 cpu3=4818@4196993514 cpu4=4818@4196993225 cpu5=4818@4196993294 cpu6=4818@4196999933 cpu7=4818@4197386752
371:{2026-10-03 07:30:19 7.194 pid=8 test-runner} smi_stretch: idle mark 2 of 10
375:[2026-10-03 07:30:19 7.197 cpu2] smi: report=4 why=exit pid=11 on=cpu2 at=7196944943 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4820@7196945592 cpu1=4820@7196950537 cpu2=4820@7196944990 cpu3=4820@7196947070 cpu4=4820@7196946650 cpu5=4820@7196953089 cpu6=4820@7196946913 cpu7=4820@7197292571
387:{2026-10-03 07:30:22 10.194 pid=8 test-runner} smi_stretch: idle mark 3 of 10
391:[2026-10-03 07:30:22 10.197 cpu3] smi: report=5 why=exit pid=12 on=cpu3 at=10196929179 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4821@10196936261 cpu1=4821@10196936219 cpu2=4821@10196936645 cpu3=4821@10196929230 cpu4=4821@10196939630 cpu5=4821@10196939448 cpu6=4821@10196940032 cpu7=4821@10196932221
418:{2026-10-03 07:30:25 13.194 pid=8 test-runner} smi_stretch: idle mark 4 of 10
426:[2026-10-03 07:30:25 13.197 cpu4] smi: report=6 why=exit pid=13 on=cpu4 at=13196747368 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4823@13196748127 cpu1=4823@13196777254 cpu2=4823@13196753868 cpu3=4823@13196749233 cpu4=4823@13196747430 cpu5=4823@13196756411 cpu6=4823@13196757144 cpu7=4823@13197126274
438:{2026-10-03 07:30:28 16.194 pid=8 test-runner} smi_stretch: idle mark 5 of 10
442:[2026-10-03 07:30:28 16.199 cpu5] smi: report=7 why=exit pid=14 on=cpu5 at=16196703616 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4824@16196704297 cpu1=4824@16196705080 cpu2=4824@16196709577 cpu3=4824@16196705330 cpu4=4824@16196705540 cpu5=4824@16196703667 cpu6=4824@16196712254 cpu7=4824@16198989127
454:{2026-10-03 07:30:31 19.194 pid=8 test-runner} smi_stretch: idle mark 6 of 10
458:[2026-10-03 07:30:31 19.197 cpu6] smi: report=8 why=exit pid=15 on=cpu6 at=19196860845 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4825@19196861491 cpu1=4825@19196866432 cpu2=4825@19196862501 cpu3=4825@19196862986 cpu4=4825@19196862618 cpu5=4825@19196869053 cpu6=4825@19196860891 cpu7=4825@19197250440
485:{2026-10-03 07:30:34 22.194 pid=8 test-runner} smi_stretch: idle mark 7 of 10
489:[2026-10-03 07:30:34 22.197 cpu7] smi: report=9 why=exit pid=16 on=cpu7 at=22196910073 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4827@22196915741 cpu1=4827@22196915596 cpu2=4827@22196915993 cpu3=4827@22196911743 cpu4=4827@22196918398 cpu5=4827@22196918149 cpu6=4827@22196918592 cpu7=4827@22196910119
501:{2026-10-03 07:30:37 25.194 pid=8 test-runner} smi_stretch: idle mark 8 of 10
509:[2026-10-03 07:30:37 25.197 cpu0] smi: report=10 why=exit pid=17 on=cpu0 at=25196588463 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4828@25196588509 cpu1=4828@25196614107 cpu2=4828@25196594793 cpu3=4828@25196590597 cpu4=4828@25196590242 cpu5=4828@25196596363 cpu6=4828@25196596835 cpu7=4828@25197065362
521:{2026-10-03 07:30:40 28.194 pid=8 test-runner} smi_stretch: idle mark 9 of 10
525:[2026-10-03 07:30:40 28.197 cpu1] smi: report=11 why=exit pid=18 on=cpu1 at=28196672221 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4829@28196672946 cpu1=4829@28196672268 cpu2=4829@28196678282 cpu3=4829@28196673813 cpu4=4829@28196673967 cpu5=4829@28196674084 cpu6=4829@28196680368 cpu7=4829@28197264118
537:{2026-10-03 07:30:43 31.194 pid=8 test-runner} smi_stretch: idle mark 10 of 10
541:[2026-10-03 07:30:43 31.197 cpu2] smi: report=12 why=exit pid=19 on=cpu2 at=31196845813 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4831@31196846456 cpu1=4831@31196851442 cpu2=4831@31196845860 cpu3=4831@31196847810 cpu4=4831@31196847525 cpu5=4831@31196853959 cpu6=4831@31196847747 cpu7=4831@31197233629
553:{2026-10-03 07:30:43 31.203 pid=8 test-runner} smi_stretch: 8 spinners started
554:{2026-10-03 07:30:43 31.203 pid=8 test-runner} smi_stretch: busy mark 0 of 10
558:[2026-10-03 07:30:43 31.211 cpu3] smi: report=13 why=exit pid=20 on=cpu3 at=31210977470 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4831@31210978156 cpu1=4831@31210978274 cpu2=4831@31210978357 cpu3=4831@31210977520 cpu4=4831@31210978441 cpu5=4831@31210978641 cpu6=4831@31210978739 cpu7=4831@31210978999
570:{2026-10-03 07:30:46 34.206 pid=8 test-runner} smi_stretch: busy mark 1 of 10
574:[2026-10-03 07:30:46 34.211 cpu4] smi: report=14 why=exit pid=21 on=cpu4 at=34211615955 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4832@34211616706 cpu1=4832@34211616780 cpu2=4832@34211616866 cpu3=4832@34211617049 cpu4=4832@34211616004 cpu5=4832@34211785571 cpu6=4832@34211617307 cpu7=4832@34211617377
586:{2026-10-03 07:30:49 37.212 pid=8 test-runner} smi_stretch: busy mark 2 of 10
590:[2026-10-03 07:30:49 37.222 cpu5] smi: report=15 why=exit pid=22 on=cpu5 at=37222660266 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4833@37222660941 cpu1=4833@37222661170 cpu2=4833@37222661209 cpu3=4833@37222661397 cpu4=4833@37222661498 cpu5=4833@37222660321 cpu6=4833@37222661607 cpu7=4833@37222661723
602:{2026-10-03 07:30:52 40.208 pid=8 test-runner} smi_stretch: busy mark 3 of 10
606:[2026-10-03 07:30:52 40.214 cpu6] smi: report=16 why=exit pid=23 on=cpu6 at=40214008915 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4835@40214009524 cpu1=4835@40214009719 cpu2=4835@40214009990 cpu3=4835@40214009901 cpu4=4835@40214010047 cpu5=4835@40214010112 cpu6=4835@40214008964 cpu7=4835@40214010299
618:{2026-10-03 07:30:55 43.204 pid=8 test-runner} smi_stretch: busy mark 4 of 10
622:[2026-10-03 07:30:55 43.210 cpu0] smi: report=17 why=exit pid=24 on=cpu0 at=43209740149 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4836@43209740200 cpu1=4836@43209740773 cpu2=4836@43209740950 cpu3=4836@43209741143 cpu4=4836@43209741314 cpu5=4836@43209741356 cpu6=4836@43209741483 cpu7=4836@43209741584
634:{2026-10-03 07:30:58 46.212 pid=8 test-runner} smi_stretch: busy mark 5 of 10
638:[2026-10-03 07:30:58 46.223 cpu0] smi: report=18 why=exit pid=25 on=cpu0 at=46222950520 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4837@46222950555 cpu1=4837@46222951130 cpu2=4837@46222951213 cpu3=4837@46222951311 cpu4=4837@46222951517 cpu5=4837@46222951607 cpu6=4837@46222951703 cpu7=4837@46222951777
650:{2026-10-03 07:31:01 49.208 pid=8 test-runner} smi_stretch: busy mark 6 of 10
654:[2026-10-03 07:31:01 49.214 cpu1] smi: report=19 why=exit pid=26 on=cpu1 at=49214153193 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4839@49214153847 cpu1=4839@49214153241 cpu2=4839@49214153996 cpu3=4839@49214154173 cpu4=4839@49214154303 cpu5=4839@49214154474 cpu6=4839@49214154501 cpu7=4839@49214154629
666:{2026-10-03 07:31:04 52.204 pid=8 test-runner} smi_stretch: busy mark 7 of 10
670:[2026-10-03 07:31:04 52.214 cpu2] smi: report=20 why=exit pid=27 on=cpu2 at=52214538011 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4840@52214538648 cpu1=4840@52214538843 cpu2=4840@52214538059 cpu3=4840@52214538936 cpu4=4840@52214539014 cpu5=4840@52214539115 cpu6=4840@52214539268 cpu7=4840@52214539340
682:{2026-10-03 07:31:07 55.211 pid=8 test-runner} smi_stretch: busy mark 8 of 10
686:[2026-10-03 07:31:07 55.222 cpu3] smi: report=21 why=exit pid=28 on=cpu3 at=55222316420 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4841@55222317046 cpu1=4841@55222317207 cpu2=4841@55222317382 cpu3=4841@55222316468 cpu4=4841@55222317542 cpu5=4841@55222317643 cpu6=4841@55222317734 cpu7=4841@55222317985
698:{2026-10-03 07:31:10 58.212 pid=8 test-runner} smi_stretch: busy mark 9 of 10
702:[2026-10-03 07:31:10 58.222 cpu4] smi: report=22 why=exit pid=29 on=cpu4 at=58222636282 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4843@58222637011 cpu1=4843@58222637053 cpu2=4843@58222637177 cpu3=4843@58222637333 cpu4=4843@58222636331 cpu5=4843@58222637499 cpu6=4843@58222637588 cpu7=4843@58222637737
714:{2026-10-03 07:31:13 61.213 pid=8 test-runner} smi_stretch: busy mark 10 of 10
718:[2026-10-03 07:31:13 61.224 cpu5] smi: report=23 why=exit pid=30 on=cpu5 at=61223904456 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4844@61223905085 cpu1=4844@61223905348 cpu2=4844@61223905359 cpu3=4844@61223905500 cpu4=4844@61223905685 cpu5=4844@61223904505 cpu6=4844@61223905854 cpu7=4844@61223905950
746:{2026-10-03 07:31:13 61.225 pid=8 test-runner} smi_stretch: done
757:[2026-10-03 07:31:13 61.225 cpu7] smi: report=24 why=exit pid=8 on=cpu7 at=61225560170 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4844@61225561331 cpu1=4844@61225575916 cpu2=4844@61225561254 cpu3=4844@61225561709 cpu4=4844@61225561409 cpu5=4844@61225561584 cpu6=4844@61225562287 cpu7=4844@61225560217

Japabu · 2026-10-03T08:00:27Z

Firmware scout, smiscout-b: every smi: and smi_stretch: line of smi/scout-1/smiscout-b/kernel.log, as the T14 read them back (the readback is a scratch directory; these lines are what the firmware issue's cause rests on).

118:[2026-10-03 07:32:42 0.156 cpu0] smi: fadt sci_int=9 smi_cmd=0xb2 acpi_enable=0xf0 acpi_disable=0xf1 pm1a_evt=0x1800 pm1_evt_len=4 pm1a_cnt=0x1804 pm_tmr=0x1808 gpe0=0x1860 gpe0_len=32 flags=0x20c4e5 hw_reduced=0
119:[2026-10-03 07:32:42 0.156 cpu0] smi: chipset 8086:a0a3, so SMI_EN at 0x1830 and the TCO block at 0x400
120:[2026-10-03 07:32:42 0.156 cpu0] smi: the SCI is ISA irq 9, gsi 9 Level/High
121:[2026-10-03 07:32:42 0.156 cpu0] smi: report=0 why=early on=cpu0 at=156109430 sci_en=0 pm1_cnt=0x0000 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00000000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4817@156109476
122:[2026-10-03 07:32:42 0.158 cpu0] smi: switch: wrote 0xf0 to SMI_CMD 0xb2 at=156409452, SCI_EN read set 2129279 ns later (PM1a_CNT=0x0001); this CPU's MSR_SMI_COUNT 4817 before the write, 4818 after it, 4818 once set
123:[2026-10-03 07:32:42 0.158 cpu0] smi: report=1 why=switched on=cpu0 at=158559557 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00000000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@158559591
298:[2026-10-03 07:32:43 1.159 cpu0] smi: report=2 why=ready on=cpu0 at=1159427763 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@1159427796 cpu1=4818@1159450322 cpu2=4818@1159446558 cpu3=4818@1159446632 cpu4=4818@1159446586 cpu5=4818@1159446602 cpu6=4818@1159446561 cpu7=4818@1159446636
339:{2026-10-03 07:32:43 1.198 pid=8 test-runner} smi_stretch: idle mark 0 of 10
343:[2026-10-03 07:32:43 1.201 cpu0] smi: report=3 why=exit pid=9 on=cpu0 at=1200903203 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@1200903254 cpu1=4818@1200908566 cpu2=4818@1200908748 cpu3=4818@1200904747 cpu4=4818@1200904832 cpu5=4818@1200910995 cpu6=4818@1200911119 cpu7=4818@1200980702
357:{2026-10-03 07:32:46 4.198 pid=8 test-runner} smi_stretch: idle mark 1 of 10
361:[2026-10-03 07:32:46 4.203 cpu1] smi: report=4 why=exit pid=10 on=cpu1 at=4200780750 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@4200781359 cpu1=4818@4200780797 cpu2=4818@4200786633 cpu3=4818@4200782504 cpu4=4818@4200782413 cpu5=4818@4200782566 cpu6=4818@4200788612 cpu7=4818@4202924565
373:{2026-10-03 07:32:49 7.198 pid=8 test-runner} smi_stretch: idle mark 2 of 10
377:[2026-10-03 07:32:49 7.201 cpu2] smi: report=5 why=exit pid=11 on=cpu2 at=7200833755 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@7200834367 cpu1=4818@7200839268 cpu2=4818@7200833823 cpu3=4818@7200835833 cpu4=4818@7200835378 cpu5=4818@7200841684 cpu6=4818@7200835641 cpu7=4818@7201041065
389:{2026-10-03 07:32:52 10.198 pid=8 test-runner} smi_stretch: idle mark 3 of 10
393:[2026-10-03 07:32:52 10.201 cpu3] smi: report=6 why=exit pid=12 on=cpu3 at=10200853117 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@10200858505 cpu1=4818@10200858687 cpu2=4818@10200858799 cpu3=4818@10200853177 cpu4=4818@10200860875 cpu5=4818@10200860989 cpu6=4818@10200861171 cpu7=4818@10200855305
420:{2026-10-03 07:32:55 13.198 pid=8 test-runner} smi_stretch: idle mark 4 of 10
428:[2026-10-03 07:32:55 13.201 cpu4] smi: report=7 why=exit pid=13 on=cpu4 at=13200546335 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@13200547072 cpu1=4818@13200575597 cpu2=4818@13200552619 cpu3=4818@13200548382 cpu4=4818@13200546402 cpu5=4818@13200555217 cpu6=4818@13200555847 cpu7=4818@13200978925
440:{2026-10-03 07:32:58 16.198 pid=8 test-runner} smi_stretch: idle mark 5 of 10
444:[2026-10-03 07:32:58 16.201 cpu5] smi: report=8 why=exit pid=14 on=cpu5 at=16200612311 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@16200612907 cpu1=4818@16200613647 cpu2=4818@16200617952 cpu3=4818@16200614795 cpu4=4818@16200614150 cpu5=4818@16200612362 cpu6=4818@16200620307 cpu7=4818@16201011114
456:{2026-10-03 07:33:01 19.198 pid=8 test-runner} smi_stretch: idle mark 6 of 10
460:[2026-10-03 07:33:01 19.201 cpu6] smi: report=9 why=exit pid=15 on=cpu6 at=19200752752 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@19200753346 cpu1=4818@19200758272 cpu2=4818@19200754294 cpu3=4818@19200756666 cpu4=4818@19200754494 cpu5=4818@19200760669 cpu6=4818@19200752799 cpu7=4818@19201104831
487:{2026-10-03 07:33:04 22.198 pid=8 test-runner} smi_stretch: idle mark 7 of 10
491:[2026-10-03 07:33:04 22.201 cpu7] smi: report=10 why=exit pid=16 on=cpu7 at=22200807136 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@22200812474 cpu1=4818@22200812682 cpu2=4818@22200812933 cpu3=4818@22200808818 cpu4=4818@22200814932 cpu5=4818@22200815069 cpu6=4818@22200815408 cpu7=4818@22200807185
503:{2026-10-03 07:33:07 25.198 pid=8 test-runner} smi_stretch: idle mark 8 of 10
511:[2026-10-03 07:33:07 25.201 cpu0] smi: report=11 why=exit pid=17 on=cpu0 at=25200623765 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@25200623812 cpu1=4818@25200633656 cpu2=4818@25200629825 cpu3=4818@25200626215 cpu4=4818@25200625576 cpu5=4818@25200632918 cpu6=4818@25200633047 cpu7=4818@25201061926
523:{2026-10-03 07:33:10 28.198 pid=8 test-runner} smi_stretch: idle mark 9 of 10
527:[2026-10-03 07:33:10 28.201 cpu1] smi: report=12 why=exit pid=18 on=cpu1 at=28200600403 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@28200600977 cpu1=4818@28200600435 cpu2=4818@28200606603 cpu3=4818@28200602155 cpu4=4818@28200602006 cpu5=4818@28200602117 cpu6=4818@28200608501 cpu7=4818@28201178710
539:{2026-10-03 07:33:13 31.198 pid=8 test-runner} smi_stretch: idle mark 10 of 10
543:[2026-10-03 07:33:13 31.201 cpu2] smi: report=13 why=exit pid=19 on=cpu2 at=31200796615 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@31200797177 cpu1=4818@31200802111 cpu2=4818@31200796647 cpu3=4818@31200802263 cpu4=4818@31200798293 cpu5=4818@31200804583 cpu6=4818@31200798446 cpu7=4818@31201147831
555:{2026-10-03 07:33:13 31.207 pid=8 test-runner} smi_stretch: 8 spinners started
556:{2026-10-03 07:33:13 31.207 pid=8 test-runner} smi_stretch: busy mark 0 of 10
560:[2026-10-03 07:33:13 31.215 cpu3] smi: report=14 why=exit pid=20 on=cpu3 at=31214819027 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@31214819664 cpu1=4818@31214819883 cpu2=4818@31214819955 cpu3=4818@31214819075 cpu4=4818@31214820097 cpu5=4818@31214820256 cpu6=4818@31214820426 cpu7=4818@31214820617
572:{2026-10-03 07:33:16 34.217 pid=8 test-runner} smi_stretch: busy mark 1 of 10
576:[2026-10-03 07:33:16 34.225 cpu4] smi: report=15 why=exit pid=21 on=cpu4 at=34225571547 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@34225572305 cpu1=4818@34225572493 cpu2=4818@34225572468 cpu3=4818@34225572649 cpu4=4818@34225571598 cpu5=4818@34225700343 cpu6=4818@34225572911 cpu7=4818@34225572985
588:{2026-10-03 07:33:19 37.213 pid=8 test-runner} smi_stretch: busy mark 2 of 10
592:[2026-10-03 07:33:19 37.216 cpu5] smi: report=16 why=exit pid=22 on=cpu5 at=37216586422 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@37216587052 cpu1=4818@37216587442 cpu2=4818@37216587389 cpu3=4818@37216828515 cpu4=4818@37216587708 cpu5=4818@37216586470 cpu6=4818@37216587769 cpu7=4818@37216587915
604:{2026-10-03 07:33:22 40.208 pid=8 test-runner} smi_stretch: busy mark 3 of 10
608:[2026-10-03 07:33:22 40.217 cpu6] smi: report=17 why=exit pid=23 on=cpu6 at=40217312282 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@40217312885 cpu1=4818@40217313076 cpu2=4818@40217313309 cpu3=4818@40217576263 cpu4=4818@40217313492 cpu5=4818@40217313592 cpu6=4818@40217312316 cpu7=4818@40217313817
620:{2026-10-03 07:33:25 43.213 pid=8 test-runner} smi_stretch: busy mark 4 of 10
624:[2026-10-03 07:33:25 43.219 cpu0] smi: report=18 why=exit pid=24 on=cpu0 at=43218837992 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@43218838040 cpu1=4818@43218838676 cpu2=4818@43218926388 cpu3=4818@43218838907 cpu4=4818@43218839153 cpu5=4818@43218839185 cpu6=4818@43218839275 cpu7=4818@43218839397
636:{2026-10-03 07:33:28 46.211 pid=8 test-runner} smi_stretch: busy mark 5 of 10
640:[2026-10-03 07:33:28 46.220 cpu0] smi: report=19 why=exit pid=25 on=cpu0 at=46220121432 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@46220121465 cpu1=4818@46220122058 cpu2=4818@46220122220 cpu3=4818@46220122323 cpu4=4818@46220122597 cpu5=4818@46220122640 cpu6=4818@46220122752 cpu7=4818@46220122891
652:{2026-10-03 07:33:31 49.210 pid=8 test-runner} smi_stretch: busy mark 6 of 10
656:[2026-10-03 07:33:31 49.220 cpu1] smi: report=20 why=exit pid=26 on=cpu1 at=49219823627 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@49219824277 cpu1=4818@49219823660 cpu2=4818@49219824392 cpu3=4818@49219852400 cpu4=4818@49219824687 cpu5=4818@49219824885 cpu6=4818@49219824970 cpu7=4818@49219825067
668:{2026-10-03 07:33:34 52.210 pid=8 test-runner} smi_stretch: busy mark 7 of 10
672:[2026-10-03 07:33:34 52.220 cpu2] smi: report=21 why=exit pid=27 on=cpu2 at=52220428672 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00000000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@52220429432 cpu1=4818@52220486487 cpu2=4818@52220428705 cpu3=4818@52220605492 cpu4=4818@52220429699 cpu5=4818@52220429849 cpu6=4818@52220430068 cpu7=4818@52220430067
684:{2026-10-03 07:33:37 55.208 pid=8 test-runner} smi_stretch: busy mark 8 of 10
688:[2026-10-03 07:33:37 55.212 cpu3] smi: report=22 why=exit pid=28 on=cpu3 at=55211972596 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@55211973211 cpu1=4818@55211973421 cpu2=4818@55211973517 cpu3=4818@55211972644 cpu4=4818@55211973725 cpu5=4818@55211973880 cpu6=4818@55211974029 cpu7=4818@55211974248
700:{2026-10-03 07:33:40 58.208 pid=8 test-runner} smi_stretch: busy mark 9 of 10
704:[2026-10-03 07:33:40 58.219 cpu4] smi: report=23 why=exit pid=29 on=cpu4 at=58218926881 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@58218927672 cpu1=4818@58218927688 cpu2=4818@58218927795 cpu3=4818@58218927910 cpu4=4818@58218926927 cpu5=4818@58219197410 cpu6=4818@58218928201 cpu7=4818@58218928372
716:{2026-10-03 07:33:43 61.208 pid=8 test-runner} smi_stretch: busy mark 10 of 10
720:[2026-10-03 07:33:43 61.220 cpu5] smi: report=24 why=exit pid=30 on=cpu5 at=61220079504 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@61220080165 cpu1=4818@61220080410 cpu2=4818@61220080386 cpu3=4818@61220080572 cpu4=4818@61220080694 cpu5=4818@61220079538 cpu6=4818@61220080867 cpu7=4818@61220080940
754:{2026-10-03 07:33:43 61.233 pid=8 test-runner} smi_stretch: done
759:[2026-10-03 07:33:43 61.233 cpu7] smi: report=25 why=exit pid=8 on=cpu7 at=61233467379 sci_en=1 pm1_cnt=0x0001 pm1_sts=0x0000 pm1_en=0x0100 smi_en=0x10002033 smi_sts=0x00004000 gpe0_sts=00000000.00000000.00000200.00400000 gpe0_en=00020000.00000000.00000000.00000400 tco_rld=0x0003 tco_tmr=0x0004 tco1_cnt=0x1800 tco1_sts=0x0000 tco2_sts=0x0000 sci_rte=0x0000000000010000 cpu0=4818@61233468231 cpu1=4818@61233730251 cpu2=4818@61233468622 cpu3=4818@61233477556 cpu4=4818@61233468807 cpu5=4818@61233468977 cpu6=4818@61233469681 cpu7=4818@61233467453

Japabu · 2026-10-03T08:00:29Z

Firmware scout patch smi.patch, whole, sha256 582bb410a226dccb94187bf78aea766d18f0381bab12ee86a7298b02d4f538d6 (33,935 bytes), applied on main at 73282fa93 for each staging and reversed after it; it never lands.

diff --git a/kernel/Cargo.toml b/kernel/Cargo.toml
index b3c602b75..530d4cc19 100644
--- a/kernel/Cargo.toml
+++ b/kernel/Cargo.toml
@@ -140,6 +140,13 @@ sched-check = ["toyos-sched/check"]
 # count crossing zero, on every entry and exit: a kernel being measured for
 # anything else must not carry it.
 mask-windows = []
+# SCOUT, never landed: `arch/x86_64/smi_scout.rs` reads every CPU's
+# `MSR_SMI_COUNT` beside the ACPI, SMI and TCO registers; `smi-switch` also
+# writes `ACPI_ENABLE` to `SMI_CMD` early.
+smi-scout = []
+smi-switch = ["smi-scout"]
+# QEMU only: `ACPI_DISABLE` first, so `smi-switch`'s write runs on q35.
+smi-rehearse = ["smi-switch"]
 # The stray-write tripwire on the per-CPU `CpuSched` record: a shadow copy of its
 # bytes, taken when the driver's exclusive region is left and compared when it is
 # next entered, so a word that changed while nothing was allowed to change it is
diff --git a/kernel/src/arch/x86_64/idt/timer.rs b/kernel/src/arch/x86_64/idt/timer.rs
index 1ce8cb24f..743a63fae 100644
--- a/kernel/src/arch/x86_64/idt/timer.rs
+++ b/kernel/src/arch/x86_64/idt/timer.rs
@@ -76,10 +76,12 @@ pub(super) extern "sysv64" fn timer_entry() {
         "pop rcx",
         "pop rax",
         "iretq",
-        #[cfg(not(feature = "mask-windows"))]
+        #[cfg(not(any(feature = "mask-windows", feature = "smi-scout")))]
         deadline = sym crate::deadline::poll,
         #[cfg(feature = "mask-windows")]
         deadline = sym ring0_tick,
+        #[cfg(all(feature = "smi-scout", not(feature = "mask-windows")))]
+        deadline = sym smi_ring0_tick,
         handler = sym timer_handler,
         exit_to_user = sym crate::arch::idt::kernel_exit_to_user_check,
         armed_ticks = const crate::arch::percpu::OFF_LAST_ARMED_TICKS,
@@ -101,11 +103,20 @@ extern "sysv64" fn ring0_tick() {
     crate::windows::irqs_unmasking();
 }
 
+/// SCOUT: the Ring 0 branch's Rust half under `smi-scout`.
+#[cfg(all(feature = "smi-scout", not(feature = "mask-windows")))]
+extern "sysv64" fn smi_ring0_tick() {
+    crate::arch::smi_scout::sample();
+    crate::deadline::poll();
+}
+
 extern "sysv64" fn timer_handler() {
     // From Ring 3, so interrupts were open; `exit_to_user` opens them again.
     #[cfg(feature = "mask-windows")]
     crate::windows::irqs_masked();
     crate::arch::percpu::irq_took!(Timer);
+    #[cfg(feature = "smi-scout")]
+    crate::arch::smi_scout::sample();
     // Before anything that can take a lock: a CPU running userland is the other
     // half of the coverage the Ring 0 branch above gives a CPU holding one.
     crate::deadline::poll();
diff --git a/kernel/src/arch/x86_64/ioapic.rs b/kernel/src/arch/x86_64/ioapic.rs
index 17f797b42..0a2e9b339 100644
--- a/kernel/src/arch/x86_64/ioapic.rs
+++ b/kernel/src/arch/x86_64/ioapic.rs
@@ -301,6 +301,14 @@ pub fn route(
     Ok(())
 }
 
+/// SCOUT: `gsi`'s redirection entry as the chip holds it.
+#[cfg(feature = "smi-scout")]
+pub fn rte(gsi: Gsi) -> Option<u64> {
+    let topology = TOPOLOGY.lock();
+    let (unit, n) = locate(&topology, gsi).ok()?;
+    Some(u64::from(unit.read(REG_REDTBL + 2 * n + 1)) << 32 | u64::from(unit.read(REG_REDTBL + 2 * n)))
+}
+
 pub fn set_masked(gsi: Gsi, masked: bool) -> Result<(), RouteError> {
     let topology = TOPOLOGY.lock();
     let (unit, n) = locate(&topology, gsi)?;
diff --git a/kernel/src/arch/x86_64/mod.rs b/kernel/src/arch/x86_64/mod.rs
index 5d9a48a9a..4afc99137 100644
--- a/kernel/src/arch/x86_64/mod.rs
+++ b/kernel/src/arch/x86_64/mod.rs
@@ -31,6 +31,8 @@ pub mod percpu;
 pub mod pmu;
 pub mod power;
 pub mod rtc;
+#[cfg(feature = "smi-scout")]
+pub mod smi_scout;
 pub mod smp;
 pub mod switch;
 pub mod syscall;
diff --git a/kernel/src/arch/x86_64/smi_scout.rs b/kernel/src/arch/x86_64/smi_scout.rs
new file mode 100644
index 000000000..6230f4738
--- /dev/null
+++ b/kernel/src/arch/x86_64/smi_scout.rs
@@ -0,0 +1,331 @@
+//! SCOUT, never landed: what makes the firmware interrupt every CPU, read
+//! without writing anything but (under `smi-switch`) `ACPI_ENABLE` to
+//! `SMI_CMD`.
+//!
+//! Every CPU stores its own `MSR_SMI_COUNT` and the time it read it at each
+//! timer-vector interrupt, which a kick is too; a report kicks every other CPU,
+//! waits a bounded while for their fresh readings, and prints one `smi: report`
+//! line beside the registers that can say where an SMI comes from. Nothing here
+//! writes a TCO register or `SMI_EN`.
+
+use core::arch::asm;
+use core::fmt;
+use core::sync::atomic::{AtomicBool, AtomicU16, AtomicU32, AtomicU64, AtomicU8, Ordering::{Acquire, Relaxed, Release}};
+
+use super::{cpu, ioapic, irqchip, percpu};
+use crate::drivers::pci::PciDevice;
+use crate::log;
+
+const MSR_SMI_COUNT: u32 = 0x34;
+const MAX_CPUS: usize = crate::sched::MAX_CPUS;
+
+/// `PM1_CNT.SCI_EN`.
+const SCI_EN: u16 = 1 << 0;
+/// `SMI_EN` and `SMI_STS` from the PM1a event block's base, where Linux read
+/// `SMI_EN` on the T14 and where ICH9 keeps both.
+const SMI_EN_OFF: u16 = 0x30;
+const SMI_STS_OFF: u16 = 0x34;
+/// Past this the switch has failed.
+#[cfg(feature = "smi-switch")]
+const SWITCH_BOUND_NS: u64 = 3_000_000_000;
+/// How long a report waits for every other CPU's reading after its kick.
+const FRESH_BOUND_NS: u64 = 5_000_000;
+#[cfg(feature = "smi-switch")]
+const RTE_MASKED: u64 = 1 << 16;
+
+/// FADT offsets, ACPI 6.5 Table 5.9.
+const SCI_INT: usize = 46;
+const SMI_CMD: usize = 48;
+const ACPI_ENABLE: usize = 52;
+const ACPI_DISABLE: usize = 53;
+const PM1A_EVT_BLK: usize = 56;
+const PM1A_CNT_BLK: usize = 64;
+const PM_TMR_BLK: usize = 76;
+const GPE0_BLK: usize = 80;
+const PM1_EVT_LEN: usize = 88;
+const GPE0_BLK_LEN: usize = 92;
+const FLAGS: usize = 112;
+const HW_REDUCED_ACPI: u32 = 1 << 20;
+
+struct Slot {
+    count: AtomicU64,
+    /// Nanoseconds since boot of the read, 0 for never.
+    at: AtomicU64,
+}
+
+static SLOTS: [Slot; MAX_CPUS] = [const { Slot { count: AtomicU64::new(0), at: AtomicU64::new(0) } }; MAX_CPUS];
+
+/// Written by [`early`] on the BSP before any AP runs.
+static PM1A_EVT: AtomicU16 = AtomicU16::new(0);
+static PM1_EN_OFF: AtomicU16 = AtomicU16::new(0);
+static PM1A_CNT: AtomicU16 = AtomicU16::new(0);
+static GPE0: AtomicU16 = AtomicU16::new(0);
+static GPE0_HALF: AtomicU8 = AtomicU8::new(0);
+static SMI_EN_PORT: AtomicU16 = AtomicU16::new(0);
+static TCO_PORT: AtomicU16 = AtomicU16::new(0);
+static SCI_GSI: AtomicU32 = AtomicU32::new(u32::MAX);
+/// The chipset is q35's LPC bridge, the one machine [`rehearse`] may act on.
+static Q35: AtomicBool = AtomicBool::new(false);
+const Q35_LPC: u16 = 0x2918;
+static SEQ: AtomicU32 = AtomicU32::new(0);
+
+/// This CPU's reading, from the timer vector's entry in either ring.
+pub fn sample() {
+    let me = percpu::cpu_id() as usize;
+    let Some(slot) = SLOTS.get(me) else { return };
+    slot.count.store(cpu::rdmsr(MSR_SMI_COUNT), Relaxed);
+    slot.at.store(crate::clock::nanos_since_boot().max(1), Release);
+}
+
+fn inl(port: u16) -> u32 {
+    let value: u32;
+    // SAFETY: one `in` into the declared output, no memory operand; a read commands nothing on the ports this reads.
+    unsafe { asm!("in eax, dx", out("eax") value, in("dx") port, options(nomem, nostack, preserves_flags)) };
+    value
+}
+
+fn port_of(what: &str, block: u32) -> u16 {
+    u16::try_from(block).unwrap_or_else(|_| panic!("smi: the FADT puts {what} at {block:#x}, past the port space"))
+}
+
+/// Why a report was taken.
+#[derive(Clone, Copy)]
+pub enum Why {
+    Early,
+    #[cfg(feature = "smi-switch")]
+    Switched,
+    Ready,
+    Exit(u32),
+    Stop,
+}
+
+impl fmt::Display for Why {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Early => f.write_str("early"),
+            #[cfg(feature = "smi-switch")]
+            Self::Switched => f.write_str("switched"),
+            Self::Ready => f.write_str("ready"),
+            Self::Exit(pid) => write!(f, "exit pid={pid}"),
+            Self::Stop => f.write_str("stop"),
+        }
+    }
+}
+
+/// The FADT's power-management blocks, the chipset's SMI and TCO ports and
+/// the SCI's line, each said once; then the first report, and under
+/// `smi-switch` the switch and a report after it.
+pub fn early(rsdp_addr: u64, devices: &[PciDevice]) {
+    let fadt = toyos_acpi::find_table(crate::drivers::acpi::direct_phys(), rsdp_addr, b"FACP", FLAGS + 4)
+        .unwrap_or_else(|e| panic!("smi: the FADT is unreadable: {e:?}"));
+    let u8_at = |at| fadt.byte(at).expect("inside the length asked for");
+    let u32_at = |at| fadt.u32_at(at).expect("inside the length asked for");
+    let sci_int = fadt.u16_at(SCI_INT).expect("inside the length asked for");
+    let (smi_cmd, enable, disable) = (u32_at(SMI_CMD), u8_at(ACPI_ENABLE), u8_at(ACPI_DISABLE));
+    let (evt, evt_len, cnt) = (u32_at(PM1A_EVT_BLK), u8_at(PM1_EVT_LEN), u32_at(PM1A_CNT_BLK));
+    let (gpe0, gpe0_len, flags) = (u32_at(GPE0_BLK), u8_at(GPE0_BLK_LEN), u32_at(FLAGS));
+    log!(
+        "smi: fadt sci_int={sci_int} smi_cmd={smi_cmd:#x} acpi_enable={enable:#04x} acpi_disable={disable:#04x} \
+         pm1a_evt={evt:#x} pm1_evt_len={evt_len} pm1a_cnt={cnt:#x} pm_tmr={:#x} gpe0={gpe0:#x} gpe0_len={gpe0_len} \
+         flags={flags:#x} hw_reduced={}",
+        u32_at(PM_TMR_BLK),
+        u8::from(flags & HW_REDUCED_ACPI != 0),
+    );
+    let evt = port_of("PM1a_EVT_BLK", evt);
+    PM1A_EVT.store(evt, Relaxed);
+    PM1_EN_OFF.store(u16::from(evt_len / 2), Relaxed);
+    PM1A_CNT.store(port_of("PM1a_CNT_BLK", cnt), Relaxed);
+    GPE0.store(port_of("GPE0_BLK", gpe0), Relaxed);
+    GPE0_HALF.store(gpe0_len / 2, Relaxed);
+
+    match devices.iter().find_map(|d| toyos_tco::chipset(d.vendor_id(), d.device_id()).map(|row| (d, row))) {
+        Some((pci, row)) => {
+            SMI_EN_PORT.store(evt + SMI_EN_OFF, Relaxed);
+            let base = pci.read_config_u32(u64::from(row.base_reg));
+            let enable =
+                if row.enable.reg == row.base_reg { base } else { pci.read_config_u32(u64::from(row.enable.reg)) };
+            if row.device == Q35_LPC {
+                Q35.store(true, Relaxed);
+            }
+            let (vendor, device, smi_en) = (row.vendor, row.device, evt + SMI_EN_OFF);
+            match row.port(base, enable) {
+                Ok(port) => {
+                    TCO_PORT.store(port, Relaxed);
+                    log!("smi: chipset {vendor:04x}:{device:04x}, so SMI_EN at {smi_en:#x} and the TCO block at {port:#x}");
+                }
+                Err(why) => log!("smi: chipset {vendor:04x}:{device:04x}, so SMI_EN at {smi_en:#x}, and no TCO port ({why:?})"),
+            }
+        }
+        None => log!("smi: no chipset toyos_tco knows, so SMI_EN, SMI_STS and the TCO block go unread"),
+    }
+
+    match u8::try_from(sci_int).ok().and_then(ioapic::gsi_for_isa_irq) {
+        Some(line) => {
+            SCI_GSI.store(line.gsi.0, Relaxed);
+            log!("smi: the SCI is ISA irq {sci_int}, gsi {} {:?}/{:?}", line.gsi.0, line.trigger, line.polarity);
+        }
+        None => log!("smi: the SCI's irq {sci_int} reaches no I/O APIC line"),
+    }
+
+    report(Why::Early);
+    #[cfg(feature = "smi-switch")]
+    switch(smi_cmd, enable, disable);
+}
+
+/// ACPI's legacy-to-ACPI handshake: `ACPI_ENABLE` to `SMI_CMD`, then `SCI_EN`
+/// waited for, bounded.
+#[cfg(feature = "smi-switch")]
+fn switch(smi_cmd: u32, enable: u8, disable: u8) {
+    let cnt_port = PM1A_CNT.load(Relaxed);
+    #[cfg(feature = "smi-rehearse")]
+    rehearse(smi_cmd, disable);
+    let cnt = cpu::inw(cnt_port);
+    if cnt & SCI_EN != 0 {
+        log!("smi: switch: SCI_EN is already set (PM1a_CNT={cnt:#06x}), so nothing is written");
+        return;
+    }
+    if smi_cmd == 0 || (enable == 0 && disable == 0) {
+        log!("smi: switch: the FADT names no switch (SMI_CMD={smi_cmd:#x} ACPI_ENABLE={enable:#04x}), so nothing is written");
+        return;
+    }
+    let gsi = SCI_GSI.load(Relaxed);
+    let rte = ioapic::rte(ioapic::Gsi(gsi)).unwrap_or_else(|| panic!("smi: switch: the SCI's gsi {gsi} has no entry to hold masked"));
+    assert!(rte & RTE_MASKED != 0, "smi: switch: the SCI's entry {rte:#018x} is not masked, and nothing here handles it");
+    let port = port_of("SMI_CMD", smi_cmd);
+    let before = cpu::rdmsr(MSR_SMI_COUNT);
+    let wrote_at = crate::clock::nanos_since_boot();
+    // SAFETY: the FADT's own `SMI_CMD` and `ACPI_ENABLE`, the write ACPI has OSPM make to leave legacy mode; nothing else is written.
+    unsafe { cpu::outb(port, enable) };
+    let after = cpu::rdmsr(MSR_SMI_COUNT);
+    let set_at = loop {
+        let now = crate::clock::nanos_since_boot();
+        if cpu::inw(cnt_port) & SCI_EN != 0 {
+            break now;
+        }
+        assert!(
+            now - wrote_at < SWITCH_BOUND_NS,
+            "smi: switch: SCI_EN still clear {SWITCH_BOUND_NS} ns after {enable:#04x} went to SMI_CMD {port:#x} \
+             (PM1a_CNT={:#06x})",
+            cpu::inw(cnt_port)
+        );
+        core::hint::spin_loop();
+    };
+    log!(
+        "smi: switch: wrote {enable:#04x} to SMI_CMD {port:#x} at={wrote_at}, SCI_EN read set {} ns later \
+         (PM1a_CNT={:#06x}); this CPU's MSR_SMI_COUNT {before} before the write, {after} after it, {} once set",
+        set_at - wrote_at,
+        cpu::inw(cnt_port),
+        cpu::rdmsr(MSR_SMI_COUNT)
+    );
+    report(Why::Switched);
+}
+
+/// QEMU's alone, refused anywhere else: q35's firmware hands over with `SCI_EN`
+/// set, so `ACPI_DISABLE` clears it for [`switch`]'s write to run.
+#[cfg(feature = "smi-rehearse")]
+fn rehearse(smi_cmd: u32, disable: u8) {
+    assert!(Q35.load(Relaxed), "smi: rehearse: QEMU's q35 only, and this is not one");
+    let cnt_port = PM1A_CNT.load(Relaxed);
+    let port = port_of("SMI_CMD", smi_cmd);
+    // SAFETY: q35's own `SMI_CMD` and `ACPI_DISABLE`, on a guest.
+    unsafe { cpu::outb(port, disable) };
+    let cnt = cpu::inw(cnt_port);
+    assert!(cnt & SCI_EN == 0, "smi: rehearse: SCI_EN still set after ACPI_DISABLE (PM1a_CNT={cnt:#06x})");
+    log!("smi: rehearse: wrote {disable:#04x} to SMI_CMD {port:#x}, PM1a_CNT={cnt:#06x}");
+}
+
+/// One `smi: report` line: every register, and every CPU's count as fresh as
+/// a kick and [`FRESH_BOUND_NS`] get it. Thread context only: it takes the I/O
+/// APIC's lock.
+pub fn report(why: Why) {
+    let seq = SEQ.fetch_add(1, Relaxed);
+    let me = percpu::cpu_id();
+    let asked = crate::clock::nanos_since_boot();
+    sample();
+    let cpus = crate::smp::cpu_count().min(MAX_CPUS as u32);
+    for c in 0..cpus {
+        if c != me {
+            irqchip::kick_cpu(c);
+        }
+    }
+    let stale = |c: u32| SLOTS[c as usize].at.load(Acquire) < asked;
+    while (0..cpus).any(stale) && crate::clock::nanos_since_boot() - asked < FRESH_BOUND_NS {
+        core::hint::spin_loop();
+    }
+    log!("smi: report={seq} why={why} on=cpu{me} at={asked} {} sci_rte={}{}", Regs, Rte, Counts(cpus));
+}
+
+/// The SCI's redirection entry, `-` where it has none.
+struct Rte;
+
+impl fmt::Display for Rte {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match SCI_GSI.load(Relaxed) {
+            u32::MAX => f.write_str("-"),
+            gsi => match ioapic::rte(ioapic::Gsi(gsi)) {
+                Some(rte) => write!(f, "{rte:#018x}"),
+                None => f.write_str("-"),
+            },
+        }
+    }
+}
+
+/// Every power-management, SMI and TCO register, read now.
+struct Regs;
+
+impl fmt::Display for Regs {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let evt = PM1A_EVT.load(Relaxed);
+        let cnt = cpu::inw(PM1A_CNT.load(Relaxed));
+        write!(
+            f,
+            "sci_en={} pm1_cnt={cnt:#06x} pm1_sts={:#06x} pm1_en={:#06x}",
+            cnt & SCI_EN,
+            cpu::inw(evt),
+            cpu::inw(evt + PM1_EN_OFF.load(Relaxed))
+        )?;
+        match SMI_EN_PORT.load(Relaxed) {
+            0 => f.write_str(" smi_en=- smi_sts=-")?,
+            _ => write!(f, " smi_en={:#010x} smi_sts={:#010x}", inl(evt + SMI_EN_OFF), inl(evt + SMI_STS_OFF))?,
+        }
+        let (gpe0, half) = (GPE0.load(Relaxed), u16::from(GPE0_HALF.load(Relaxed)));
+        for (name, from) in [("gpe0_sts", gpe0), ("gpe0_en", gpe0 + half)] {
+            write!(f, " {name}=")?;
+            if gpe0 == 0 || half == 0 {
+                f.write_str("-")?;
+                continue;
+            }
+            // Byte-wide, which every GPE register answers; the lowest address first.
+            for i in 0..half.min(16) {
+                write!(f, "{}{:02x}", if i > 0 && i % 4 == 0 { "." } else { "" }, cpu::inb(from + i))?;
+            }
+        }
+        match TCO_PORT.load(Relaxed) {
+            0 => f.write_str(" tco=-"),
+            port => write!(
+                f,
+                " tco_rld={:#06x} tco_tmr={:#06x} tco1_cnt={:#06x} tco1_sts={:#06x} tco2_sts={:#06x}",
+                cpu::inw(port + toyos_tco::TCO_RLD),
+                cpu::inw(port + toyos_tco::TCO_TMR),
+                cpu::inw(port + toyos_tco::TCO1_CNT),
+                cpu::inw(port + toyos_tco::TCO1_STS),
+                cpu::inw(port + toyos_tco::TCO2_STS)
+            ),
+        }
+    }
+}
+
+/// ` cpuN=count@ns` for every CPU, `cpuN=-` for one that never read.
+struct Counts(u32);
+
+impl fmt::Display for Counts {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        for (c, slot) in SLOTS.iter().enumerate().take(self.0 as usize) {
+            match slot.at.load(Acquire) {
+                0 => write!(f, " cpu{c}=-")?,
+                at => write!(f, " cpu{c}={}@{at}", slot.count.load(Relaxed))?,
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/kernel/src/main.rs b/kernel/src/main.rs
index 91566f5c4..c2ea75cd2 100644
--- a/kernel/src/main.rs
+++ b/kernel/src/main.rs
@@ -430,6 +430,8 @@ pub(crate) unsafe extern "C" fn kernel_main(kernel_args: &KernelArgs) -> ! {
     // Before storage and everything under it: what it covers is the rest of this
     // boot, and a wedge down there is the reason to have one.
     arch::watchdog::init(&pci_devices);
+    #[cfg(feature = "smi-scout")]
+    arch::smi_scout::early(kernel_args.rsdp_addr, &pci_devices);
     file_cache::init();
     gpt::init(kernel_args);
 
@@ -561,6 +563,8 @@ pub(crate) unsafe extern "C" fn kernel_main(kernel_args: &KernelArgs) -> ! {
     if actuator::tlb_shootdown_bench() {
         arch::tlb::bench();
     }
+    #[cfg(feature = "smi-scout")]
+    arch::smi_scout::report(arch::smi_scout::Why::Ready);
 
     crate::scheduler::enter_idle_loop();
 }
diff --git a/kernel/src/process.rs b/kernel/src/process.rs
index 54ef3ee91..29fced182 100644
--- a/kernel/src/process.rs
+++ b/kernel/src/process.rs
@@ -1019,6 +1019,8 @@ fn teardown_resources(
     thread_data_arc: &Arc<Lock<ThreadData>>,
     pid: Pid,
 ) -> (u64, u64) {
+    #[cfg(feature = "smi-scout")]
+    crate::arch::smi_scout::report(crate::arch::smi_scout::Why::Exit(pid.raw()));
     // Never hold ThreadData + ProcessData at once.
     let (syscall_total, syscall_total_ns, syscall_counts) = {
         let mut tdata = thread_data_arc.lock();
diff --git a/kernel/src/syscall/machine.rs b/kernel/src/syscall/machine.rs
index e79004b43..c801d3904 100644
--- a/kernel/src/syscall/machine.rs
+++ b/kernel/src/syscall/machine.rs
@@ -73,6 +73,8 @@ fn quiesce(last: &str) -> Result<(), SyscallError> {
     // The final census: no process runs after this to report another.
     crate::irq_census::log_census();
     crate::drivers::panic_console::log_census();
+    #[cfg(feature = "smi-scout")]
+    crate::arch::smi_scout::report(crate::arch::smi_scout::Why::Stop);
     // A shortfall is the budget spent, not the reset refused: it is said at
     // alert level, and the reset lands anyway.
     if stopped.stopped_the_machine() {
diff --git a/src/build.rs b/src/build.rs
index 1c6fd4bf6..3852a0c97 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -1358,8 +1358,8 @@ fn declared_kernel_features(root: &Path) -> Vec<String> {
 pub const TEST_KERNEL: &[&str] = &["boot-actuators", "test-actuators"];
 
 /// Kernel builds the ordinary test suite is allowed to make.
-pub const TEST_SUITE_KERNEL_BUILDS: [&str; 3] =
-    ["", "boot-actuators,test-actuators", MASK_WINDOWS_KERNEL[0]];
+pub const TEST_SUITE_KERNEL_BUILDS: [&str; 6] =
+    ["", "boot-actuators,test-actuators", MASK_WINDOWS_KERNEL[0], "smi-scout", "smi-switch", "smi-rehearse"];
 
 /// The shipping kernel with the windows' instrument and nothing else, for
 /// [`SCHED_CHECK_KERNEL`]'s reason: one spelling, so one build.
diff --git a/tests/common/qemu.rs b/tests/common/qemu.rs
index 4abf78d63..c7e0b1023 100644
--- a/tests/common/qemu.rs
+++ b/tests/common/qemu.rs
@@ -158,7 +158,7 @@ pub fn boot_census() -> (u32, u32, Vec<String>) {
 /// entry and masking primitive, where a parameter would be a branch on the path
 /// they measure. Interactive debug mode is separate: it builds
 /// [`toyos_build::build::DEBUG_KERNEL_BUILD`] and returns before the suite.
-pub const DECLARED_KERNEL_BUILDS: [&str; 3] =
+pub const DECLARED_KERNEL_BUILDS: [&str; 6] =
     toyos_build::build::TEST_SUITE_KERNEL_BUILDS;
 
 /// How many guests the run may have up at once.
diff --git a/tests/smiscoutcase/system.toml b/tests/smiscoutcase/system.toml
new file mode 100644
index 000000000..3c858d3ca
--- /dev/null
+++ b/tests/smiscoutcase/system.toml
@@ -0,0 +1,28 @@
+# SCOUT, never landed: `tests/jobcase` with the `smi_scout` row's job list,
+# for its QEMU probe.
+[boot]
+start = ["logd", "blockd", "fsd", "test-runner"]
+
+[programs.logd]
+service = true
+syscap = ["logread"]
+
+[programs.test-runner]
+receives = ["power"]
+args = ["--bound-ms=110000", "test_rs_smi_stretch", "reboot"]
+
+[programs.toybox]
+
+[symlinks]
+"bin/reboot" = "/system/bin/toybox"
+
+[programs.blockd]
+service = true
+restart = true
+serves = ["block"]
+devices = ["pci:1b36:0010"]
+
+[programs.fsd]
+restart = true
+roles = ["data", "log", "boot"]
+receives = ["block"]
diff --git a/tests/toyos-rust-tests/src/bin/smi_stretch.rs b/tests/toyos-rust-tests/src/bin/smi_stretch.rs
new file mode 100644
index 000000000..5d1bd341f
--- /dev/null
+++ b/tests/toyos-rust-tests/src/bin/smi_stretch.rs
@@ -0,0 +1,55 @@
+//! SCOUT, never landed: two stretches an `smi-scout` kernel reports across,
+//! each marked every [`MARK_EVERY`] by a child of this binary whose exit is the
+//! kernel's report. First plain idle, every CPU free to halt; then every CPU
+//! kept in C0 by a spinning thread of its own.
+
+use std::process::Command;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::thread;
+use std::time::{Duration, Instant};
+
+const STRETCH: Duration = Duration::from_secs(30);
+const MARK_EVERY: Duration = Duration::from_secs(3);
+const ME: &str = "/system/bin/test_rs_smi_stretch";
+const MARK: &str = "mark";
+
+fn main() {
+    if std::env::args().nth(1).as_deref() == Some(MARK) {
+        return;
+    }
+    stretch("idle");
+    let stop = Arc::new(AtomicBool::new(false));
+    // The kernel's own count: std's `available_parallelism` answers 1 here.
+    let cpus = toyos_abi::syscall::cpu_count();
+    let spinners: Vec<_> = (0..cpus)
+        .map(|_| {
+            let stop = Arc::clone(&stop);
+            thread::spawn(move || {
+                while !stop.load(Ordering::Relaxed) {
+                    std::hint::spin_loop();
+                }
+            })
+        })
+        .collect();
+    println!("smi_stretch: {cpus} spinners started");
+    stretch("busy");
+    stop.store(true, Ordering::Relaxed);
+    for spinner in spinners {
+        spinner.join().expect("a spinner does not panic");
+    }
+    println!("smi_stretch: done");
+}
+
+fn stretch(name: &str) {
+    let start = Instant::now();
+    let marks = (STRETCH.as_millis() / MARK_EVERY.as_millis()) as u32;
+    for k in 0..=marks {
+        if let Some(left) = (start + MARK_EVERY * k).checked_duration_since(Instant::now()) {
+            thread::sleep(left);
+        }
+        println!("smi_stretch: {name} mark {k} of {marks}");
+        let status = Command::new(ME).arg(MARK).status().expect("the mark child spawns");
+        assert!(status.success(), "the mark child exited {status:?}");
+    }
+}
diff --git a/tests/toyos.rs b/tests/toyos.rs
index f1e5ee8f9..8f6837b79 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -61,6 +61,8 @@ const ACTUATOR_KERNEL: &[&str] = toyos_build::build::TEST_KERNEL;
 
 // Rust helper binaries that are spawned by tests, not tests themselves.
 const RUST_SKIP: &[&str] = &[
+    // SCOUT: the `smi_scout` row's job.
+    "smi_stretch",
     // **Its exit code is a measurement, not a verdict**, and the shared block
     // judges every member on `exit=0` alone — so it would red on every boot
     // that measured anything. It also needs the real-time band, which only
@@ -188,6 +190,11 @@ const MACHINE_TESTS: &[&str] = &[
     // no way to turn it back on, so only a machine QEMU reports stopping can
     // be asked. `machine_soft_off_decoded` reads the T14's own decode.
     "machine_shutdown",
+    // SCOUT: the `smi_scout` row's two kernels and job under TCG, read for their lines' shape.
+    "x86_smi_scout_a",
+    "x86_smi_scout_b",
+    // SCOUT: arm B's write and wait, run on q35 by clearing `SCI_EN` first.
+    "x86_smi_scout_rehearsal",
 ];
 
 /// **The metal profile**: which registrations run on the ThinkPad T14, what
@@ -255,6 +262,17 @@ const METAL: &[(&str, metal::Metal)] = &[
         "mask_windows",
         metal::Metal { arms: WINDOWSCASE, judge: |b| windows_on_metal(b[0]) },
     ),
+    (
+        // SCOUT: arm A reads, arm B switches the firmware to ACPI mode first.
+        "smi_scout",
+        metal::Metal {
+            arms: SMI_SCOUT,
+            judge: |b| {
+                smi_scout_read(b[0].kernel().text(), b[0].cpus()?, "a")?;
+                smi_scout_read(b[1].kernel().text(), b[1].cpus()?, "b")
+            },
+        },
+    ),
     (
         "mkdir_cap",
         metal::Metal {
@@ -664,6 +682,14 @@ const TESTCASES_READDIR: &[metal::Arm] =
 
 const JOBCASE: &[metal::Arm] = &[metal::once("jobcase", "tests/jobcase", &[], &[])];
 
+/// SCOUT: the quietest committed config, held up by the stretch job past the
+/// runner's own sixty seconds and inside the kernel's hundred and twenty.
+const SMI_SCOUT_JOBS: &[&str] = &["--bound-ms=110000", "test_rs_smi_stretch"];
+const SMI_SCOUT: &[metal::Arm] = &[
+    metal::Arm { features: &["smi-scout"], ..metal::once("smiscout-a", "tests/jobcase", &[], SMI_SCOUT_JOBS) },
+    metal::Arm { features: &["smi-switch"], ..metal::once("smiscout-b", "tests/jobcase", &[], SMI_SCOUT_JOBS) },
+];
+
 /// The shipping kernel with the windows' instrument and nothing else, so what
 /// it reads is that kernel under the herd. Three exits, a report each:
 /// `idle_span`'s is the boot's first, where the kernel holds; `pwd`'s reads the
@@ -2315,10 +2341,133 @@ fn run_machine_test(name: &str, test_config: &Path) -> Result<(), String> {
         "iommu_virtio_platform" => common::iommu::iommu_virtio_platform(test_config),
         "nested_nmi_is_loud" => faults::nested_nmi_is_loud(test_config),
         "machine_shutdown" => power::machine_shutdown(test_config),
+        "x86_smi_scout_a" => smi_scout_probe(&["smi-scout"], "a"),
+        "x86_smi_scout_b" => smi_scout_probe(&["smi-switch"], "b"),
+        "x86_smi_scout_rehearsal" => smi_scout_probe(&["smi-rehearse"], "rehearsal"),
         other => Err(format!("unknown machine test {other}")),
     }
 }
 
+/// SCOUT: one arm's kernel and the row's job list on eight CPUs under TCG,
+/// waited to the stop's report and read for its lines' shape. QEMU has no SMM
+/// worth the name, so no count here says anything.
+fn smi_scout_probe(features: &'static [&'static str], arm: &str) -> Result<(), String> {
+    const CPUS: u32 = 8;
+    let root = compile::repo_root();
+    let job = (
+        "bin/test_rs_smi_stretch".to_string(),
+        qemu::build_toyos_bin(toyos_build::arch::Arch::X86_64, &root.join("tests/toyos-rust-tests"), "smi_stretch"),
+    );
+    let mut qemu = QemuInstance::boot_with_options(
+        &root.join("tests/smiscoutcase"),
+        &[],
+        &[],
+        BootOptions { smp: CPUS, kernel_features: features, extra_root_files: vec![job], ..Default::default() },
+    );
+    let mut rest = String::new();
+    let waited = await_marker(&mut qemu, &mut rest, " why=stop ", "the stop's report");
+    let serial = format!("{}\n{rest}", qemu.boot_log());
+    for line in serial.lines().filter(|l| l.contains("smi: ") || l.contains("smi_stretch") || l.contains("===TEST_")) {
+        eprintln!("  [smi] {line}");
+    }
+    waited.map_err(|why| format!("{why}\nserial:\n{serial}"))?;
+    if !serial.contains("===TEST_END test_rs_smi_stretch exit=0===") {
+        return Err("the stretch job did not end with exit 0".to_string());
+    }
+    let switches = features.iter().any(|f| f.starts_with("smi-switch") || f.starts_with("smi-rehearse"));
+    if switches != serial.contains("smi: switch: ") {
+        return Err(format!("arm {arm}: a `smi: switch:` line where none is owed, or none where one is"));
+    }
+    if features.contains(&"smi-rehearse")
+        && !(serial.contains("smi: rehearse: wrote ") && serial.contains("smi: switch: wrote ") && serial.contains(" why=switched "))
+    {
+        return Err(format!("arm {arm}: the rehearsal did not run the switch's write"));
+    }
+    smi_scout_read(&serial, CPUS, arm)
+}
+
+/// SCOUT: one `smi: report=` line.
+struct SmiReport {
+    line: String,
+    why: String,
+    pid: Option<u64>,
+    at: u64,
+    /// Every CPU's `MSR_SMI_COUNT` and when it read it.
+    counts: Vec<(u64, u64)>,
+}
+
+/// SCOUT: every `smi:` line of a capture held to its shape, every report
+/// printed, and the count over each stretch the job marked: its eleven `idle`
+/// marks, then its eleven `busy` ones.
+fn smi_scout_read(capture: &str, cpus: u32, arm: &str) -> Result<(), String> {
+    for owed in ["smi: fadt ", "smi: report="] {
+        if !capture.contains(owed) {
+            return Err(format!("arm {arm}: no `{owed}` line"));
+        }
+    }
+    if !capture.contains("smi: chipset ") && !capture.contains("smi: no chipset") {
+        return Err(format!("arm {arm}: no line saying which chipset the SMI ports were read on"));
+    }
+    let mut reports = Vec::new();
+    for line in capture.lines() {
+        let Some(rest) = line.split("smi: report=").nth(1) else { continue };
+        let field = |key: &str| {
+            rest.split_whitespace()
+                .find_map(|f| f.strip_prefix(key))
+                .ok_or_else(|| format!("arm {arm}: no `{key}`\nline: {line}"))
+        };
+        let number = |s: &str| s.parse::<u64>().map_err(|_| format!("arm {arm}: `{s}` is no number\nline: {line}"));
+        let why = field("why=")?.to_string();
+        let pid = if why == "exit" { Some(number(field("pid=")?)?) } else { None };
+        let at = number(field("at=")?)?;
+        for key in ["sci_en=", "pm1_cnt=", "pm1_sts=", "pm1_en=", "smi_en=", "smi_sts=", "gpe0_sts=", "gpe0_en=", "sci_rte="] {
+            field(key)?;
+        }
+        if !rest.contains(" tco_rld=") && !rest.contains(" tco=-") {
+            return Err(format!("arm {arm}: no TCO field\nline: {line}"));
+        }
+        // Before the APs start only the BSP has read, and as they are released
+        // they may not have taken an interrupt yet.
+        let online = if why == "early" || why == "switched" { 1 } else { cpus };
+        let mut counts = Vec::new();
+        for c in 0..online {
+            let value = field(&format!("cpu{c}="))?;
+            match value.split_once('@') {
+                Some((count, read)) => counts.push((number(count)?, number(read)?)),
+                None if why == "ready" && c > 0 => {}
+                None => return Err(format!("arm {arm}: cpu{c} never read\nline: {line}")),
+            }
+        }
+        reports.push(SmiReport { line: line.to_string(), why, pid, at, counts });
+    }
+    let stretch_pids: BTreeSet<u64> = capture
+        .lines()
+        .filter_map(|l| l.split("exit: test_rs_smi_stretch pid=").nth(1))
+        .filter_map(|r| r.split_whitespace().next()?.parse().ok())
+        .collect();
+    for r in &reports {
+        let (lo, hi) = (r.counts.iter().map(|c| c.0).min(), r.counts.iter().map(|c| c.0).max());
+        let oldest = r.counts.iter().map(|c| r.at.saturating_sub(c.1)).max().unwrap_or(0);
+        let mark = if r.pid.is_some_and(|p| stretch_pids.contains(&p)) { " [stretch]" } else { "" };
+        eprintln!("  [smi] {arm} why={}{mark} at={} smi={lo:?}..{hi:?} oldest_read_ns={oldest}", r.why, r.at);
+    }
+    let marks: Vec<&SmiReport> = reports.iter().filter(|r| r.pid.is_some_and(|p| stretch_pids.contains(&p))).collect();
+    // Eleven marks a stretch, and the job's own exit after them.
+    if marks.len() != 23 {
+        return Err(format!("arm {arm}: {} reports at the stretch job's exits, want 23", marks.len()));
+    }
+    for (name, first, last) in [("idle", 0, 10), ("busy", 11, 21)] {
+        let (a, b) = (marks[first], marks[last]);
+        let smis = b.counts[0].0 - a.counts[0].0;
+        let ns = b.at - a.at;
+        let steps: Vec<u64> = marks[first..=last].windows(2).map(|w| w[1].counts[0].0 - w[0].counts[0].0).collect();
+        eprintln!("  [smi] {arm} {name}: cpu0 counted {smis} SMIs over {ns} ns, per 3 s mark {steps:?}");
+        eprintln!("  [smi] {arm} {name} opens: {}", a.line.trim());
+        eprintln!("  [smi] {arm} {name} closes: {}", b.line.trim());
+    }
+    Ok(())
+}
+
 /// Every CPU's `CR0` and `CR4`, against what a CPU running this kernel must
 /// hold.
 ///

…ames what a press does, and the firmware issue records the two GPEs the switch moved The track's ruling said stage 1 lands "with its events served in userland", which claims more than the owner ruled: he ruled a userland server that claims the SCI and handles the power button, and the ruling now says that. Stage 1's exit said a press of the power button "is handled", which names nothing a row can read. It now names what the ruling implies: the press stops the machine cleanly through ToyOS's own power-off path, SYS_SHUTDOWN, and the boot's log records the press and that stop, which is where a T14 row reads it. The firmware issue's ACPI_ENABLE bullet now records the two GPE readings the boot carried, read from its kernel.log lines quoted whole on #681 (comment 5966982752; the other boot's in 5966982609, the patch in 5966982939): the firmware's enable set GPE 9's enable bit (gpe0_en byte 1, 00 at line 121, 02 at line 123), and GPE 110's status rose after the switch and stayed set, served by nothing (gpe0_sts byte 13, 40 from line 298 through line 759, in none of the other boot's 25 reports). Stage 1's server meets both once it unmasks GSI 9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

No conflict. main's side since the merge base 4adc1c0 is #681, issues only: it does not touch issues/hardware/the-t14-boots-toyos-unattended.md, which this branch deletes, and it adds a third citation of it. issues/hardware/the-t14s-firmware-interrupts-every-cpu-every-2-2-s-under-toyos.md (new in #681) named the deleted track as the owner of its reading: "The T14 loop owns only the reading: its jobs are the measurements owed on hardware, and it builds the row." That track is gone after this merge, so the citation goes in it. The reading's owner is now the fix's: stage 1 of issues/kernel/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md (also new in #681). Its exit is "on the T14, MSR_SMI_COUNT stays flat on every CPU over the interval the firmware issue's exit defines", so the stage cannot show its exit without the row, and a row that reads the count flat cannot land green before the stage's switch to ACPI mode does. Neither track this branch adds builds measurement rows: the session track decides how rows run, and the watchdog track's readings are the TCO's. Searched in the merged index, by bare name and by path: `git grep --cached the-t14-boots-toyos-unattended` and `git grep --cached -i 'boots toyos unattended'` find nothing; before the fix the first found that one line. The same slug in every fork clone, the primary's rust/ and every ~/.cargo/git/checkouts tree: 125 searches, no hit. No file this branch adds or changes cites one of the four issues #681 deleted (disk-wait-pins-a-cpu, a-disk-operation-can-spin-past-the-tlb-ack- tripwire-before-its-break, cpu0-holds-interrupts-and-preemption-off-for-6-5- ms-on-the-t14, some-t14-boots-carry-an-interrupts-off-window-of-9-ms-or- more): `git grep --cached` of the four slugs finds nothing in the merged index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu · 2026-10-03T11:37:13Z

Evidence 1 of 4: the boot, its control, and the storage windows. Quoted because the readback lives in a scratch directory that does not outlive the session. Cited by issues/kernel/a-log-write-to-the-t14s-stick-masks-interrupts-for-its-whole-usb-transfer-on-one-cpu-or-on-all-eight.md and issues/kernel/cpu0-holds-interrupts-and-preemption-off-for-6-5-ms-on-the-t14.md.

The boot. One T14 boot (LENOVO 20W0003AMZ, BIOS N34ET71W (1.71), verdict.txt: passed) of main at c59e09ed6 with a throwaway instrument applied for the staging and reversed, never landed: scout.patch, 1,859 lines, sha256 f5a0208c10d9a31264711539e9f70ee436609551670f01ae0bd08a6ae2ac458a. Image sha256 bead136bac478311a4e13103abc06324d4c08a5ef4b6e415a4ca2d22d4196b66, kernel sha256 62f7f840809950059d09b3fef213a8ad6196566f46ef4321113259cbf4d65731 (3,222,024 bytes). Jobs: test_rs_idle_span, pwd, test_rs_ring_park_herd 40 times, reboot. Every number below is kernel.log's line number; every stamp is nanoseconds since boot. kernel.log has 2,795 lines, 981 of them scout: : 101 win records (93 irqs, 8 preempt), 28 shoot, 158 nmi, 3 lock, 42 smi.

The instrument's own guide, from the staging request's comments, verbatim:

kernel.log: every line with `scout: `. Stamps are nanoseconds since boot on the one counter, the log's own clock.
  scout: armed …                      once, beside `windows: held`
  scout: smi at=T cpuN=C@T …          each report: MSR 0x34 as cpuN last read it (at its last interrupts-off window's
                                      opening; the reporting CPU's at the report), and when
  scout: win cpuN irqs|preempt open= close= span_ns= smi=A->B opener=pid:tid closer=pid:tid events=
    then, keyed by the same `cpuN … open=`:
    opened_at: / closed_at:           return addresses, innermost first
    during:                           the window's last 16 events: sys(n) to(pid:tid) irq(source) trap(vector rip=)
                                      halt wake lock(site lock waited) shoot(g=gen waited); the last two are written
                                      when a wait of 20 us or more ends
    after:                            the next 4 events on that CPU: what was pending
  scout: shoot cpuI gen= origin= begin= end= span_ns= gap_ns= gap_at= probes=
    gap_ns: the longest the initiator went between two turns of its own wait
    … target=cpuT ack= via=ipi|poll|wait|own|join seen= trail:
    ack: stamped by T after it published its flush; seen: when I's wait for T ended (I waits cpu0 upward);
    trail: T's last 6 events when I's shootdown ended
  scout: nmi cpuN at= by=cpuM|self ring= if= who= masked_since= rip= stack:
    by=cpuM: M had waited 2 ms on N, as a shootdown target or a lock's holder, and sent it an NMI, again each
    further 2 ms; by=self: N's own performance-counter NMI (1 ms of running, this build) found its interrupts
    masked for more than 2 ms. QEMU has no such counter: by=self has never printed.
  scout: lock cpuN lock= at=site begin= end= span_ns= gap_ns= gap_at= holder=cpuH held_ns= holder_at=site probes=
    holder: whoever held it longest while N waited, and where it took it
  scout: dropped win= shoot= nmi= lock= unprinted=   only when a ring was full or the report's 280 lines ran out
  scout: end at=T lines=              a window on the reporting CPU spanning `smi at=` to `end at=` is the report

Syscall numbers, toyos-abi/src/syscall.rs at c59e09ed6: 5 SYS_THREAD_EXIT, 15 SYS_FSYNC, 40 SYS_THREAD_SPAWN, 45 SYS_SYSINFO, 63 SYS_MMAP, 72 SYS_EXIT, 111 SYS_DEVICE_CLAIM, 119 SYS_PARTITION_READ, 120 SYS_PARTITION_WRITE.

The control: a 50 ms hold

idle_span's exit holds interrupts off for a stated time, and its report is printed inside that same SYS_EXIT.

344: [2026-10-02 22:16:14 1.752 cpu1] windows: held cpu1 ns=50000024
345: [2026-10-02 22:16:14 1.752 cpu1] scout: armed long_ns=2000000 long_ticks=4837005 note_ns=20000 chain=6 keep=16
364: [2026-10-02 22:16:14 1.752 cpu1] scout: smi at=1752151655 cpu0=4824@1215797782 cpu1=4824@1752151643 cpu2=4824@1205411677 cpu3=4824@1746127955 cpu4=4824@1205398529 cpu5=4824@1200530131 cpu6=4824@1200529563 cpu7=4824@1215811852
416: [2026-10-02 22:16:14 1.758 cpu1] scout: dropped win=0 shoot=0 nmi=8 lock=0 unprinted=0
417: [2026-10-02 22:16:14 1.758 cpu1] scout: end at=1758069743 lines=51
431: [2026-10-02 22:16:14 1.760 cpu3] windows: cpu1 irqs_off_ns=56000902 preempt_off_ns=56000231
445: [2026-10-02 22:16:14 1.760 cpu3] scout: win cpu1 irqs open=1702088704 close=1758089606 span_ns=56000902 smi=4824->4824 opener=9:0 closer=1:0 events=2
446: [2026-10-02 22:16:14 1.760 cpu3] scout: win cpu1 irqs open=1702088704 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
447: [2026-10-02 22:16:14 1.761 cpu3] scout: win cpu1 irqs open=1702088704 closed_at: <kernel::hw::KernelHw as toyos_sched::hw::Hw>::switch+0x281 < kernel::sched::driver::execute+0x155 < kernel::sched::driver::pass_block+0x19f < kernel::watch::wait_inner::<kernel::sched::payload::KernelLock<toyos_sched::watch::Waiters<toyos+0x15a < kernel::log::console::body+0x376 < kernel::arch::x86_64::entry::kernel_start+0xc
448: [2026-10-02 22:16:14 1.761 cpu3] scout: win cpu1 irqs open=1702088704 during: 1702088791:sys(72) | 1758089333:to(1:0)
449: [2026-10-02 22:16:14 1.761 cpu3] scout: win cpu1 irqs open=1702088704 after: 1758090486:irq(timer) | 1758125468:to(idle) | 1758126916:halt | 1758335414:irq(tlb)

The window is 56,000,902 ns for a hold of 50,000,024. The report sits inside it: smi at=1752151655 to end at=1758069743 is 5,918,088 ns, which leaves 82,790 ns for the rest of the exit. Sixteen by=self samples of the hold were printed and eight dropped (nmi=8); the first and the last:

398: [2026-10-02 22:16:14 1.754 cpu1] scout: nmi cpu1 at=1704615199 by=self ring=0 if=0 who=9:0 masked_since=1702088704 rip=kernel::windows::hold_once+0x32 stack: kernel::syscall::proc::sys_exit+0xd < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x2241 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e < kernel::arch::x86_64::syscall::syscall_entry+0x70
413: [2026-10-02 22:16:14 1.757 cpu1] scout: nmi cpu1 at=1734629159 by=self ring=0 if=0 who=9:0 masked_since=1702088704 rip=kernel::windows::hold_once+0x32 stack: kernel::syscall::proc::sys_exit+0xd < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x2241 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e < kernel::arch::x86_64::syscall::syscall_entry+0x70

Pid 4 is the log's file server, and the log volume is on the stick

208: [2026-10-02 22:16:13 0.491 cpu0] usb-storage: slot 1 vendor "SanDisk." product "Ultra..........."
209: [2026-10-02 22:16:13 0.491 cpu0] usb-storage: slot 1 serial number "<the stick's serial>"
210: [2026-10-02 22:16:13 0.491 cpu0] usb-storage: disk 0 ready on slot 1, 7507812 blocks of 512 B (29327 MiB), msc_block +0x30000
307: [2026-10-02 22:16:14 1.178 cpu0] spawn: /system/bin/fsd pid=4 tid=0 dst=7 base=0x10000000000 entry=0x100000e7390 root=0xf6c000 symbols=2048KiB (layout=0ms relocs=0ms deps=0ms tls=0ms total=1ms)
308: {2026-10-02 22:16:14 1.178 init} init: started fsd
309: {2026-10-02 22:16:14 1.180 fsd} fsd: FAT32 mounted, 35651584 bytes, 512-byte sectors, 512-byte clusters
310: {2026-10-02 22:16:14 1.180 fsd} fsd: Log serving /log — FAT32, 0 files open; cache 1 blocks (0 dirty), 2 of 3 reads hit

Pid 4 in `SYS_PARTITION_WRITE` on one CPU alone, nine times: 8.3 to 10.7 ms

Each window opens at kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70 and closes at kernel::arch::x86_64::syscall::syscall_entry+0x88; those two lines are quoted for the first and left out of the rest.

527: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2681419277 close=2691999396 span_ns=10580118 smi=4824->4824 opener=4:0 closer=4:0 events=2
528: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2681419277 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
529: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2681419277 closed_at: kernel::arch::x86_64::syscall::syscall_entry+0x88
530: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2681419277 during: 2681419389:sys(120) | 2681466419:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 32463ns)
531: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2681419277 after: 2692001867:irq(timer) | 2692012184:sys(120)
679: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5460738023 close=5470195571 span_ns=9457548 smi=4825->4825 opener=4:0 closer=4:0 events=1
682: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5460738023 during: 5460738137:sys(120)
683: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5460738023 after: 5470197108:irq(timer) | 5470206884:sys(120)
806: [2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8247396039 close=8257748234 span_ns=10352194 smi=4827->4827 opener=4:0 closer=4:0 events=2
809: [2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8247396039 during: 8247396154:sys(120) | 8247424586:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 25836ns)
810: [2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8247396039 after: 8257749133:irq(timer) | 8257758524:sys(120) | 8257783289:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 22501ns)
1025: [2026-10-02 22:16:24 11.959 cpu3] scout: win cpu6 irqs open=11164271521 close=11174940563 span_ns=10669042 smi=4828->4828 opener=4:0 closer=4:0 events=1
1028: [2026-10-02 22:16:24 11.959 cpu3] scout: win cpu6 irqs open=11164271521 during: 11164271625:sys(120)
1029: [2026-10-02 22:16:24 11.959 cpu3] scout: win cpu6 irqs open=11164271521 after: 11174941601:irq(timer) | 11174944321:to(21:208) | 11177767292:sys(90) | 11177777351:to(4:0)
1173: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu6 irqs open=13783679119 close=13793404154 span_ns=9725035 smi=4829->4829 opener=4:0 closer=4:0 events=2
1176: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu6 irqs open=13783679119 during: 13783679223:sys(120) | 13783709260:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 27923ns)
1177: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu6 irqs open=13783679119 after: 13793405061:irq(timer) | 13793408227:to(24:5) | 13793530940:sys(90) | 13793537445:to(4:0)
2075: [2026-10-02 22:16:37 24.039 cpu1] scout: win cpu2 irqs open=23095627611 close=23103923313 span_ns=8295701 smi=4833->4833 opener=4:0 closer=4:0 events=1
2078: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu2 irqs open=23095627611 during: 23095627713:sys(120)
2079: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu2 irqs open=23095627611 after: 23103928896:sys(120)
2295: [2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27704984538 close=27713273750 span_ns=8289211 smi=4836->4836 opener=4:0 closer=4:0 events=2
2298: [2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27704984538 during: 27704984626:sys(120) | 27705012813:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 25955ns)
2299: [2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27704984538 after: 27713279189:sys(120)
2428: [2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31185432395 close=31194324673 span_ns=8892278 smi=4837->4837 opener=4:0 closer=4:0 events=2
2431: [2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31185432395 during: 31185432496:sys(120) | 31194324247:lock(src/process.rs:806 0xffff80005f5d66a0 112073ns)
2432: [2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31185432395 after: 31194325583:irq(timer) | 31194336778:sys(15) | 31194515666:lock(src/process.rs:806 0xffff80005f5d66a0 178598ns) | 31194519841:sys(67)
2599: [2026-10-02 22:16:48 35.108 cpu6] scout: win cpu3 irqs open=34128124168 close=34136774570 span_ns=8650401 smi=4838->4838 opener=4:0 closer=4:0 events=1
2602: [2026-10-02 22:16:48 35.108 cpu6] scout: win cpu3 irqs open=34128124168 during: 34128124334:sys(120)
2603: [2026-10-02 22:16:48 35.108 cpu6] scout: win cpu3 irqs open=34128124168 after: 34136776121:irq(timer) | 34136787220:sys(15) | 34136820027:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 30630ns) | 34136824247:sys(67)

Its samples. The first window's five in full:

538: [2026-10-02 22:16:16 3.621 cpu7] scout: nmi cpu7 at=2683616054 by=self ring=0 if=0 who=4:0 masked_since=2681419277 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
539: [2026-10-02 22:16:16 3.622 cpu7] scout: nmi cpu7 at=2685617618 by=self ring=0 if=0 who=4:0 masked_since=2681419277 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
540: [2026-10-02 22:16:16 3.622 cpu7] scout: nmi cpu7 at=2687620409 by=self ring=0 if=0 who=4:0 masked_since=2681419277 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
541: [2026-10-02 22:16:16 3.622 cpu7] scout: nmi cpu7 at=2689622544 by=self ring=0 if=0 who=4:0 masked_since=2681419277 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
542: [2026-10-02 22:16:16 3.622 cpu7] scout: nmi cpu7 at=2691624338 by=self ring=0 if=0 who=4:0 masked_since=2681419277 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf

The other eight windows', each cut after three frames (every one continues < …transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by… < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf but 2441, quoted whole):

690: [2026-10-02 22:16:19 6.403 cpu2] scout: nmi cpu7 at=5463272019 by=self ring=0 if=0 who=4:0 masked_since=5460738023 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
691: [2026-10-02 22:16:19 6.404 cpu2] scout: nmi cpu7 at=5465273733 by=self ring=0 if=0 who=4:0 masked_since=5460738023 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
692: [2026-10-02 22:16:19 6.404 cpu2] scout: nmi cpu7 at=5467275462 by=self ring=0 if=0 who=4:0 masked_since=5460738023 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x18e stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
693: [2026-10-02 22:16:19 6.404 cpu2] scout: nmi cpu7 at=5469277676 by=self ring=0 if=0 who=4:0 masked_since=5460738023 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
816: [2026-10-02 22:16:22 9.213 cpu6] scout: nmi cpu6 at=8249495803 by=self ring=0 if=0 who=4:0 masked_since=8247396039 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
817: [2026-10-02 22:16:22 9.213 cpu6] scout: nmi cpu6 at=8251497777 by=self ring=0 if=0 who=4:0 masked_since=8247396039 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
818: [2026-10-02 22:16:22 9.214 cpu6] scout: nmi cpu6 at=8253500850 by=self ring=0 if=0 who=4:0 masked_since=8247396039 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
819: [2026-10-02 22:16:22 9.214 cpu6] scout: nmi cpu6 at=8255502512 by=self ring=0 if=0 who=4:0 masked_since=8247396039 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2e9 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
820: [2026-10-02 22:16:22 9.214 cpu6] scout: nmi cpu6 at=8257504890 by=self ring=0 if=0 who=4:0 masked_since=8247396039 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1035: [2026-10-02 22:16:24 11.959 cpu3] scout: nmi cpu6 at=11167037141 by=self ring=0 if=0 who=4:0 masked_since=11164271521 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1036: [2026-10-02 22:16:24 11.960 cpu3] scout: nmi cpu6 at=11169040553 by=self ring=0 if=0 who=4:0 masked_since=11164271521 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1037: [2026-10-02 22:16:24 11.960 cpu3] scout: nmi cpu6 at=11171042554 by=self ring=0 if=0 who=4:0 masked_since=11164271521 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1038: [2026-10-02 22:16:24 11.960 cpu3] scout: nmi cpu6 at=11173045394 by=self ring=0 if=0 who=4:0 masked_since=11164271521 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1192: [2026-10-02 22:16:27 14.667 cpu4] scout: nmi cpu6 at=13786052766 by=self ring=0 if=0 who=4:0 masked_since=13783679119 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1193: [2026-10-02 22:16:27 14.668 cpu4] scout: nmi cpu6 at=13788054835 by=self ring=0 if=0 who=4:0 masked_since=13783679119 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1194: [2026-10-02 22:16:27 14.668 cpu4] scout: nmi cpu6 at=13790057454 by=self ring=0 if=0 who=4:0 masked_since=13783679119 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1195: [2026-10-02 22:16:27 14.668 cpu4] scout: nmi cpu6 at=13792060755 by=self ring=0 if=0 who=4:0 masked_since=13783679119 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2090: [2026-10-02 22:16:37 24.040 cpu1] scout: nmi cpu2 at=23097931892 by=self ring=0 if=0 who=4:0 masked_since=23095627611 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2091: [2026-10-02 22:16:37 24.040 cpu1] scout: nmi cpu2 at=23099934237 by=self ring=0 if=0 who=4:0 masked_since=23095627611 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2092: [2026-10-02 22:16:37 24.041 cpu1] scout: nmi cpu2 at=23101936813 by=self ring=0 if=0 who=4:0 masked_since=23095627611 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2305: [2026-10-02 22:16:41 28.620 cpu3] scout: nmi cpu2 at=27707136686 by=self ring=0 if=0 who=4:0 masked_since=27704984538 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2306: [2026-10-02 22:16:41 28.620 cpu3] scout: nmi cpu2 at=27709138512 by=self ring=0 if=0 who=4:0 masked_since=27704984538 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2e9 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2307: [2026-10-02 22:16:41 28.621 cpu3] scout: nmi cpu2 at=27711141121 by=self ring=0 if=0 who=4:0 masked_since=27704984538 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2308: [2026-10-02 22:16:41 28.621 cpu3] scout: nmi cpu2 at=27713142789 by=self ring=0 if=0 who=4:0 masked_since=27704984538 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2438: [2026-10-02 22:16:44 31.321 cpu4] scout: nmi cpu7 at=31188284786 by=self ring=0 if=0 who=4:0 masked_since=31185432395 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2439: [2026-10-02 22:16:44 31.322 cpu4] scout: nmi cpu7 at=31190286955 by=self ring=0 if=0 who=4:0 masked_since=31185432395 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2440: [2026-10-02 22:16:44 31.322 cpu4] scout: nmi cpu7 at=31192288253 by=self ring=0 if=0 who=4:0 masked_since=31185432395 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x18e stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2609: [2026-10-02 22:16:48 35.109 cpu6] scout: nmi cpu3 at=34130361189 by=self ring=0 if=0 who=4:0 masked_since=34128124168 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2610: [2026-10-02 22:16:48 35.109 cpu6] scout: nmi cpu3 at=34132363924 by=self ring=0 if=0 who=4:0 masked_since=34128124168 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2611: [2026-10-02 22:16:48 35.109 cpu6] scout: nmi cpu3 at=34134366872 by=self ring=0 if=0 who=4:0 masked_since=34128124168 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2612: [2026-10-02 22:16:48 35.109 cpu6] scout: nmi cpu3 at=34136369313 by=self ring=0 if=0 who=4:0 masked_since=34128124168 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2441: [2026-10-02 22:16:44 31.323 cpu4] scout: nmi cpu7 at=31194289967 by=self ring=0 if=0 who=4:0 masked_since=31185432395 rip=<kernel::windows::SpinWatch>::turn+0xdf stack: <kernel::sync::Lock<core::option::Option<kernel::process::ProcessTable>>>::lock+0x2a0 < kernel::process::current_data+0x1e < kernel::process::with_current_data::<(), kernel::syscall::dispatch::syscall_dispatch::{closure#2+0x13 < kernel::syscall::dispatch::syscall_dispatch+0xeb < kernel::arch::x86_64::syscall::syscall_handler+0x6e < kernel::arch::x86_64::syscall::syscall_entry+0x70

The same server's shorter windows: sixteen `SYS_PARTITION_WRITE` of 2.4 to 2.9 ms, two `SYS_PARTITION_READ` of 2.6 and 3.0 ms

Two of the sixteen (1363, 1724) are in evidence 2 and 3, inside the all-CPU events.

383: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu7 irqs open=1203729072 close=1206634789 span_ns=2905716 smi=4824->4824 opener=4:0 closer=4:0 events=1
386: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu7 irqs open=1203729072 during: 1203729176:sys(120)
388: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu7 irqs open=1207515402 close=1209883773 span_ns=2368371 smi=4824->4824 opener=4:0 closer=4:0 events=2
391: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu7 irqs open=1207515402 during: 1207515495:sys(120) | 1207542071:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 21807ns)
532: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2692012083 close=2694666609 span_ns=2654526 smi=4824->4824 opener=4:0 closer=4:0 events=1
535: [2026-10-02 22:16:16 3.621 cpu7] scout: win cpu7 irqs open=2692012083 during: 2692012184:sys(120)
593: [2026-10-02 22:16:17 4.543 cpu4] scout: win cpu7 irqs open=3632107621 close=3634643237 span_ns=2535615 smi=4825->4825 opener=4:0 closer=4:0 events=2
596: [2026-10-02 22:16:17 4.543 cpu4] scout: win cpu7 irqs open=3632107621 during: 3632107722:sys(120) | 3632135067:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 23739ns)
684: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5470206797 close=5473047066 span_ns=2840269 smi=4825->4825 opener=4:0 closer=4:0 events=1
687: [2026-10-02 22:16:19 6.403 cpu2] scout: win cpu7 irqs open=5470206797 during: 5470206884:sys(120)
811: [2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8257758436 close=8260328650 span_ns=2570213 smi=4827->4827 opener=4:0 closer=4:0 events=2
814: [2026-10-02 22:16:22 9.213 cpu6] scout: win cpu6 irqs open=8257758436 during: 8257758524:sys(120) | 8257783289:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 22501ns)
1030: [2026-10-02 22:16:24 11.959 cpu3] scout: win cpu6 irqs open=11177786854 close=11180360660 span_ns=2573805 smi=4828->4828 opener=4:0 closer=4:0 events=1
1033: [2026-10-02 22:16:24 11.959 cpu3] scout: win cpu6 irqs open=11177786854 during: 11177787020:sys(120)
1178: [2026-10-02 22:16:27 14.665 cpu4] scout: win cpu6 irqs open=13793542994 close=13796346618 span_ns=2803623 smi=4829->4829 opener=4:0 closer=4:0 events=1
1181: [2026-10-02 22:16:27 14.666 cpu4] scout: win cpu6 irqs open=13793542994 during: 13793543081:sys(120)
1571: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu4 irqs open=17437169037 close=17439765040 span_ns=2596003 smi=4831->4831 opener=4:0 closer=4:0 events=1
1574: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu4 irqs open=17437169037 during: 17437169144:sys(119)
1576: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu4 irqs open=17442673603 close=17445500768 span_ns=2827165 smi=4831->4831 opener=4:0 closer=4:0 events=1
1579: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu4 irqs open=17442673603 during: 17442673720:sys(120)
1986: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu1 irqs open=21140148455 close=21143103235 span_ns=2954780 smi=4833->4833 opener=4:0 closer=4:0 events=1
1989: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu1 irqs open=21140148455 during: 21140148634:sys(119)
1991: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu1 irqs open=21146092094 close=21148922876 span_ns=2830781 smi=4833->4833 opener=4:0 closer=4:0 events=1
1994: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu1 irqs open=21146092094 during: 21146092221:sys(120)
2080: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu2 irqs open=23103928808 close=23106759076 span_ns=2830267 smi=4833->4833 opener=4:0 closer=4:0 events=1
2083: [2026-10-02 22:16:37 24.040 cpu1] scout: win cpu2 irqs open=23103928808 during: 23103928896:sys(120)
2300: [2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27713279089 close=27715857188 span_ns=2578098 smi=4836->4836 opener=4:0 closer=4:0 events=1
2303: [2026-10-02 22:16:41 28.620 cpu3] scout: win cpu2 irqs open=27713279089 during: 27713279189:sys(120)
2433: [2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31304773334 close=31307631438 span_ns=2858103 smi=4837->4837 opener=4:0 closer=4:0 events=2
2436: [2026-10-02 22:16:44 31.321 cpu4] scout: win cpu7 irqs open=31304773334 during: 31304773477:sys(120) | 31307630922:lock(src/process.rs:806 0xffff80005f5d66a0 50908ns)
2658: [2026-10-02 22:16:49 36.011 cpu7] scout: win cpu3 irqs open=35110451237 close=35113077082 span_ns=2625844 smi=4839->4839 opener=4:0 closer=4:0 events=1
2661: [2026-10-02 22:16:49 36.011 cpu7] scout: win cpu3 irqs open=35110451237 during: 35110451377:sys(120)

414: [2026-10-02 22:16:14 1.757 cpu1] scout: nmi cpu7 at=1205797940 by=self ring=0 if=0 who=4:0 masked_since=1203729072 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x252 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
415: [2026-10-02 22:16:14 1.758 cpu1] scout: nmi cpu7 at=1209802690 by=self ring=0 if=0 who=4:0 masked_since=1207515402 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
543: [2026-10-02 22:16:16 3.623 cpu7] scout: nmi cpu7 at=2694627362 by=self ring=0 if=0 who=4:0 masked_since=2692012083 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
694: [2026-10-02 22:16:19 6.405 cpu2] scout: nmi cpu7 at=5472280415 by=self ring=0 if=0 who=4:0 masked_since=5470206797 rip=<toyos_xhci::portsc::Portsc>::connected+0x0 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1039: [2026-10-02 22:16:24 11.960 cpu3] scout: nmi cpu6 at=11180051289 by=self ring=0 if=0 who=4:0 masked_since=11177786854 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1196: [2026-10-02 22:16:27 14.669 cpu4] scout: nmi cpu6 at=13796065591 by=self ring=0 if=0 who=4:0 masked_since=13793542994 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
1586: [2026-10-02 22:16:31 18.340 cpu6] scout: nmi cpu4 at=17445170981 by=self ring=0 if=0 who=4:0 masked_since=17442673603 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2001: [2026-10-02 22:16:35 22.086 cpu2] scout: nmi cpu1 at=21142773559 by=self ring=0 if=0 who=4:0 masked_since=21140148455 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2002: [2026-10-02 22:16:35 22.086 cpu2] scout: nmi cpu1 at=21148782892 by=self ring=0 if=0 who=4:0 masked_since=21146092094 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2093: [2026-10-02 22:16:37 24.041 cpu1] scout: nmi cpu2 at=23105946484 by=self ring=0 if=0 who=4:0 masked_since=23103928808 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …
2442: [2026-10-02 22:16:44 31.323 cpu4] scout: nmi cpu7 at=31307342622 by=self ring=0 if=0 who=4:0 masked_since=31304773334 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < …

At the stop, from the black box (`loader.log`, the pass after the reset)

The header of the window opened at 38794960070 is not among the sixteen lines the black box keeps; the next event on that CPU after it is at 38802913479, 7,953,409 ns later.

57:| log-tail: [38.816 cpu0] scout: end at=38816656980 lines=14
58:| log-tail: [38.816 cpu0] scout: nmi cpu6 at=38805318348 by=self ring=0 if=0 who=4:0 masked_since=38802913377 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2e9 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
59:| log-tail: [38.816 cpu0] scout: nmi cpu6 at=38801313830 by=self ring=0 if=0 who=4:0 masked_since=38794960070 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
60:| log-tail: [38.816 cpu0] scout: nmi cpu6 at=38799311283 by=self ring=0 if=0 who=4:0 masked_since=38794960070 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
61:| log-tail: [38.815 cpu0] scout: nmi cpu6 at=38797309128 by=self ring=0 if=0 who=4:0 masked_since=38794960070 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_write::{clo+0xaf
62:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38802913377 after: 38805723447:irq(timer) | 38805731777:sys(120) | 38805758979:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 24943ns) | 38806657212:sys(15)
63:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38802913377 during: 38802913479:sys(120) | 38802942641:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 26360ns)
64:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38802913377 closed_at: kernel::arch::x86_64::syscall::syscall_entry+0x88
65:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38802913377 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
66:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38802913377 close=38805722758 span_ns=2809380 smi=4841->4841 opener=4:0 closer=4:0 events=2
67:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38794960070 after: 38802913479:sys(120) | 38802942641:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 26360ns)
68:| log-tail: [38.815 cpu0] scout: win cpu6 irqs open=38794960070 during: 38794960171:sys(120) | 38794983752:lock(src/drivers/xhci/mod.rs:1689 0xffff80005f659360 21254ns)

cpu0 before the first job's exit: init (pid 0) in `SYS_DEVICE_CLAIM`, three times

284: [2026-10-02 22:16:14 1.160 cpu0] sched: cpu=0 ready=0 dying=0 stopped=0 parked=0 current=None trips=1
293: {2026-10-02 22:16:14 1.166 init} init: blockd: no pci:1b36:0010 on this machine
349: [2026-10-02 22:16:14 1.752 cpu1] windows: cpu0 irqs_off_ns=6623907 preempt_off_ns=6623757
365: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1162332295 close=1166149560 span_ns=3817265 smi=4824->4824 opener=0:0 closer=0:0 events=1
366: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1162332295 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
367: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1162332295 closed_at: kernel::arch::x86_64::syscall::syscall_entry+0x88
368: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1162332295 during: 1162332385:sys(111)
369: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1162332295 after: 1166151792:sys(14) | 1166153977:sys(50) | 1166155203:sys(106) | 1166156671:sys(51)
370: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1170835015 close=1176837079 span_ns=6002063 smi=4824->4824 opener=0:0 closer=0:0 events=1
371: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1170835015 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
372: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1170835015 closed_at: kernel::arch::x86_64::syscall::syscall_entry+0x88
373: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1170835015 during: 1170835119:sys(111)
374: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1170835015 after: 1176838428:irq(xhci) | 1176888232:sys(101) | 1176894576:sys(50) | 1176897094:sys(105)
375: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1179486051 close=1186109958 span_ns=6623907 smi=4824->4824 opener=0:0 closer=0:0 events=2
376: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1179486051 opened_at: kernel::arch::x86_64::syscall::syscall_handler+0x22 < kernel::arch::x86_64::syscall::syscall_entry+0x70
377: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1179486051 closed_at: kernel::arch::x86_64::syscall::syscall_entry+0x88
378: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1179486051 during: 1179486144:sys(111) | 1180717533:lock(src/block.rs:252 0xffff8000005d9f18 584427ns)
379: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu0 irqs open=1179486051 after: 1186110751:irq(xhci) | 1186111743:irq(timer) | 1186161928:to(0:4) | 1186163822:sys(95)
393: [2026-10-02 22:16:14 1.753 cpu1] scout: nmi cpu0 at=1166147820 by=self ring=0 if=0 who=0:0 masked_since=1162332295 rip=<kernel::drivers::pci::PciDevice>::is_id+0x3e stack: kernel::pcidev::claim+0x8f < kernel::device::try_claim+0x5fc < kernel::syscall::device::sys_device_claim+0xfc < kernel::syscall::dispatch::syscall_dispatch::{closure#1}+0x14a1 < kernel::syscall::dispatch::syscall_dispatch+0x95 < kernel::arch::x86_64::syscall::syscall_handler+0x6e
394: [2026-10-02 22:16:14 1.753 cpu1] scout: nmi cpu0 at=1173174377 by=self ring=0 if=0 who=0:0 masked_since=1170835015 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_read::{clos+0xaf
395: [2026-10-02 22:16:14 1.753 cpu1] scout: nmi cpu0 at=1175176458 by=self ring=0 if=0 who=0:0 masked_since=1170835015 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_read::{clos+0xaf
396: [2026-10-02 22:16:14 1.754 cpu1] scout: nmi cpu0 at=1182184271 by=self ring=0 if=0 who=0:0 masked_since=1179486051 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_read::{clos+0xaf
397: [2026-10-02 22:16:14 1.754 cpu1] scout: nmi cpu0 at=1184185446 by=self ring=0 if=0 who=0:0 masked_since=1179486051 rip=<kernel::drivers::xhci::XhciController>::wait_transfer+0x2d1 stack: <kernel::drivers::xhci::XhciController>::bulk+0x123 < <kernel::drivers::xhci::XhciController>::bot+0x4a2 < <kernel::drivers::xhci::XhciController>::scsi+0x102 < <kernel::drivers::xhci::XhciController>::transfer_blocks+0x3b2 < kernel::drivers::xhci::with_disk_by::<(core::result::Result<(), kernel::block::BlockError>, bool+0x302 < kernel::drivers::xhci::wait::msc::served::<kernel::drivers::xhci::wait::msc::storage_read::{clos+0xaf

The windows that are the scout's own report, printed inside `SYS_EXIT`

Each opens in the exiting process's sys(72) on the CPU that prints the report and spans that report's smi at= to end at=.

521: [2026-10-02 22:16:16 3.620 cpu7] scout: smi at=3620887829 cpu0=4825@3620797094 cpu1=4825@3620888228 cpu2=4825@3620794277 cpu3=4825@3620883610 cpu4=4825@3620793211 cpu5=4825@3620794014 cpu6=4825@3620794088 cpu7=4825@3620887817
544: [2026-10-02 22:16:16 3.623 cpu7] scout: end at=3623214152 lines=22
588: [2026-10-02 22:16:17 4.543 cpu4] scout: win cpu7 irqs open=3620807653 close=3623385500 span_ns=2577847 smi=4825->4825 opener=12:0 closer=4:0 events=2
591: [2026-10-02 22:16:17 4.543 cpu4] scout: win cpu7 irqs open=3620807653 during: 3620807741:sys(72) | 3623380628:to(4:0)
669: [2026-10-02 22:16:19 6.402 cpu2] scout: smi at=6402716000 cpu0=4826@6402593822 cpu1=4826@6402716998 cpu2=4826@6402715988 cpu3=4826@6402596930 cpu4=4826@6402596367 cpu5=4826@6402596825 cpu6=4826@6402718621 cpu7=4826@6402595974
695: [2026-10-02 22:16:19 6.405 cpu2] scout: end at=6405101833 lines=25
723: [2026-10-02 22:16:20 7.322 cpu2] scout: win cpu2 irqs open=6402633715 close=6405301746 span_ns=2668030 smi=4826->4826 opener=15:0 closer=idle events=2
726: [2026-10-02 22:16:20 7.322 cpu2] scout: win cpu2 irqs open=6402633715 during: 6402633805:sys(72) | 6405301501:to(idle)
864: [2026-10-02 22:16:23 10.096 cpu2] scout: smi at=10096303373 cpu0=4828@10096198612 cpu1=4828@10096303027 cpu2=4828@10096303361 cpu3=4828@10096199088 cpu4=4828@10096198603 cpu5=4828@10096198432 cpu6=4828@10096294765 cpu7=4828@10096198129
929: [2026-10-02 22:16:23 10.101 cpu2] scout: end at=10101384445 lines=64
957: [2026-10-02 22:16:24 11.027 cpu4] scout: win cpu2 irqs open=10096223602 close=10101549975 span_ns=5326373 smi=4828->4828 opener=19:0 closer=idle events=2
960: [2026-10-02 22:16:24 11.027 cpu4] scout: win cpu2 irqs open=10096223602 during: 10096223686:sys(72) | 10101549697:to(idle)
1145: [2026-10-02 22:16:27 14.664 cpu4] scout: smi at=14664036224 cpu0=4830@14663939536 cpu1=4830@14664037415 cpu2=4830@14663941119 cpu3=4830@14663940902 cpu4=4830@14664036212 cpu5=4830@14663940343 cpu6=4830@14664035713 cpu7=4830@14663939905
1197: [2026-10-02 22:16:27 14.669 cpu4] scout: end at=14669172178 lines=51
1241: [2026-10-02 22:16:28 15.612 cpu0] scout: win cpu4 irqs open=14663966344 close=14669332448 span_ns=5366103 smi=4830->4830 opener=24:0 closer=idle events=2
1244: [2026-10-02 22:16:28 15.612 cpu0] scout: win cpu4 irqs open=14663966344 during: 14663966430:sys(72) | 14669332244:to(idle)
1317: [2026-10-02 22:16:30 17.431 cpu6] scout: smi at=17431913964 cpu0=4831@17431821070 cpu1=4831@17431913623 cpu2=4831@17431820995 cpu3=4831@17431821144 cpu4=4831@17431908130 cpu5=4831@17431821402 cpu6=4831@17431913951 cpu7=4831@17431820929
1543: [2026-10-02 22:16:30 17.442 cpu6] scout: end at=17442382151 lines=224
1581: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu6 irqs open=17431846006 close=17442530205 span_ns=10684199 smi=4831->4831 opener=27:0 closer=idle events=2
1584: [2026-10-02 22:16:31 18.340 cpu6] scout: win cpu6 irqs open=17431846006 during: 17431846107:sys(72) | 17442529950:to(idle)
1708: [2026-10-02 22:16:34 21.134 cpu5] scout: smi at=21134205130 cpu0=4833@21134098853 cpu1=4833@21134205851 cpu2=4833@21134099189 cpu3=4833@21134099139 cpu4=4833@21134186833 cpu5=4833@21134205118 cpu6=4833@21134098114 cpu7=4833@21134098263
1939: [2026-10-02 22:16:34 21.145 cpu5] scout: end at=21145882757 lines=229
1996: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu5 irqs open=21134124361 close=21146050847 span_ns=11926485 smi=4833->4833 opener=31:0 closer=idle events=2
1999: [2026-10-02 22:16:35 22.085 cpu2] scout: win cpu5 irqs open=21134124361 during: 21134124446:sys(72) | 21146050594:to(idle)
2427: [2026-10-02 22:16:44 31.321 cpu4] scout: smi at=31321268508 cpu0=4837@31321174206 cpu1=4837@31321265713 cpu2=4837@31321182593 cpu3=4837@31321174715 cpu4=4837@31321268494 cpu5=4837@31321174791 cpu6=4837@31321174306 cpu7=4837@31321174707
2443: [2026-10-02 22:16:44 31.323 cpu4] scout: end at=31323402564 lines=15
2487: [2026-10-02 22:16:45 32.272 cpu0] scout: win cpu4 irqs open=31321203047 close=31323583464 span_ns=2380417 smi=4837->4837 opener=42:0 closer=idle events=2
2490: [2026-10-02 22:16:45 32.272 cpu0] scout: win cpu4 irqs open=31321203047 during: 31321203132:sys(72) | 31323583228:to(idle)

One preemption-off window nothing names

cpu5's first idle pass, the one that printed the i8042 line; events=0, and no sample, since its interrupts were not masked (cpu5 irqs_off_ns=127971, line 359).

292: [2026-10-02 22:16:14 1.160 cpu5] i8042: armed at 1137ms, idle at 1160ms, 0 interrupts — the pin has never asserted (kbd GSI 1, aux GSI 12)
359: [2026-10-02 22:16:14 1.752 cpu1] windows: cpu5 irqs_off_ns=127971 preempt_off_ns=2454682
380: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu5 preempt open=1160059033 close=1162513716 span_ns=2454682 smi=0->0 opener=idle closer=idle events=0
381: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu5 preempt open=1160059033 opened_at: kernel::sched::driver::pass+0x47 < kernel::sched::driver::idle_loop+0x26
382: [2026-10-02 22:16:14 1.752 cpu1] scout: win cpu5 preempt open=1160059033 closed_at: kernel::sched::driver::pass+0x131 < kernel::sched::driver::idle_loop+0x26

Every window of the boot, counted

Of the 93 irqs windows, 25 cross a step of MSR_SMI_COUNT (evidence 4). The other 68, by opener and first event:

opener	first event	windows	span, ns
pid 4 (fsd, LOG)	`sys(120)`	11	7,848,573 to 10,669,042
pid 4	`sys(120)`	16	2,368,371 to 2,905,716
pid 4	`sys(119)`	2	2,596,003 and 2,954,780
pid 0 (init)	`sys(111)`	3	3,817,265; 6,002,063; 6,623,907
a herd thread	`sys(5)`, with a `shoot(`	14	7,789,015 to 7,990,941
a herd thread	`sys(5)`, with a `shoot(`	14	2,800,115 to 2,948,801
an exiting job	`sys(72)`, the report	7	2,380,417 to 11,926,485
`idle_span`	`sys(72)`, the hold	1	56,000,902

The 8 preempt windows: cpu5's above, and seven of 4,528,459 to 4,714,002 ns at the instants of three count steps (evidence 4).

Merge origin/main (73282fa: #680) into wt/toyos-tenms-issues

dc6e7c6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu and others added 2 commits October 3, 2026 08:49

issues: cite the fsync trails quoted on #681

995b368

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UDZQ6fSKw14e4w2TKTRfm

Japabu and others added 2 commits October 3, 2026 09:38

Japabu marked this pull request as ready for review October 3, 2026 08:07

Japabu enabled auto-merge October 3, 2026 08:07

Japabu added this pull request to the merge queue Oct 3, 2026

Merged via the queue into main with commit ec7de74 Oct 3, 2026
6 checks passed

Japabu deleted the wt/toyos-tenms-issues branch October 3, 2026 08:42

Japabu mentioned this pull request Oct 3, 2026

Tracks: the T14 runs its tests in sessions of a booted ToyOS, and every machine ships a watchdog and a hard-lockup detector #631

Merged

Japabu mentioned this pull request Oct 3, 2026

The tree names none of the owner's machines or networks, and a host gate reds on one that comes back #687

Merged

Conversation

Japabu commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed, per decision

Where the log differs from the reading in the brief

What else the boot showed

Gates

Unsure

Uh oh!

Japabu commented Oct 2, 2026

The shootdown counter, in the report before and the report after

The sixteen windows: cpu4 is pid 4 in sys(120), twice; the other seven are herd threads in sys(5)

The fourteen shootdowns, and who acknowledged how

The samples

Uh oh!

Japabu commented Oct 2, 2026

The shootdown counter, in the report before and the report after

The sixteen windows: cpu1 is pid 4 in sys(120), twice; the other seven are herd threads in sys(5)

The fourteen shootdowns, and who acknowledged how

The samples

Uh oh!

Japabu commented Oct 2, 2026

MSR_SMI_COUNT (MSR 0x34) on every CPU, at each of the boot's 42 reports

The 25 interrupts-off windows a step falls in

The seven preemption-off windows at the same instants

The three lock waits

The samples in those windows, cut after three frames

When

Linux on the same machine

What the tree does about the firmware's interrupts

Reported, with no output kept

Uh oh!

Japabu commented Oct 2, 2026

Uh oh!

Japabu commented Oct 2, 2026

Uh oh!

Japabu commented Oct 2, 2026

Uh oh!

Japabu commented Oct 2, 2026

BLOCKER

NOTE

REMOVE

Uh oh!

Japabu commented Oct 2, 2026

Round 1

BLOCKER

NOTE

REMOVE

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Japabu commented Oct 3, 2026

Round 2

BLOCKER

NOTE

Uh oh!

Japabu commented Oct 3, 2026

Round 3

BLOCKER

NOTE

REMOVE

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Japabu commented Oct 3, 2026

Round 4

BLOCKER

NOTE

REMOVE

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Japabu commented Oct 3, 2026

Uh oh!

Uh oh!

Japabu commented Oct 3, 2026

Japabu commented Oct 2, 2026 •

edited

Loading

The sixteen windows: cpu4 is pid 4 in `sys(120)`, twice; the other seven are herd threads in `sys(5)`

The sixteen windows: cpu1 is pid 4 in `sys(120)`, twice; the other seven are herd threads in `sys(5)`

`MSR_SMI_COUNT` (MSR 0x34) on every CPU, at each of the boot's 42 reports

Pid 4 in `SYS_PARTITION_WRITE` on one CPU alone, nine times: 8.3 to 10.7 ms

The same server's shorter windows: sixteen `SYS_PARTITION_WRITE` of 2.4 to 2.9 ms, two `SYS_PARTITION_READ` of 2.6 and 3.0 ms

At the stop, from the black box (`loader.log`, the pass after the reset)

cpu0 before the first job's exit: init (pid 0) in `SYS_DEVICE_CLAIM`, three times

The windows that are the scout's own report, printed inside `SYS_EXIT`