The acpi claim's mediated access and the Global Lock, and acpiserver loading the machine's tables through them by Japabu · Pull Request #749 · ToyOSOrg/ToyOS

Japabu · 2026-10-07T22:08:42Z

Slice S1 of the ACPI stage, both halves, landing as one merge: the kernel's mediated access for the acpi claim's holder (SYS_ACPI) with the firmware's Global Lock, and acpiserver loading the machine's definition blocks through it and evaluating \_S5. The kernel half's account is first, kept true of this head; the server half's is under it.

Head 54e08c632. It differs from edfd5220a in issues/ only: git diff --stat edfd5220a 54e08c632 is one file, issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md, 16 insertions and 9 deletions, review round 5's NOTE. No source, test, manifest or lockfile differs, so every measurement below that names edfd5220a is of the code at this head, and "this head" below, where it speaks of code, is edfd5220a's tree. edfd5220a is review round 4's answer (9b928ca4e) and two lines written as CI's clippy asks, on 3a18a85e6. The owner's word on this machine's compute is "try to be economic": the narrowest tests that judge the change were run locally, once each, each mutation of round 4 once, and the guest probe; no whole suite was run locally, and host, toolchain / build and guest / suite are CI's, which ran them at edfd5220a.

Measured at edfd5220a:

CI run 37748731067, head edfd5220a, read with gh run view 37748731067 once it ended: completed, success, and each of its three jobs success.
- host (job 113216910123), its log read whole from a saved copy: [ci] Host: 78 step(s), all green. Of what review round 5's BLOCKER lists, all of it is there:
  - the kernel library's nine mtrr tests, each ... ok by name under [ci] the kernel's library (cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib --features sched-check, 168 passed, 0 failed), the three of round 4 among them: registers_that_are_word_for_word_the_boot_processors_are_the_same, registers_that_are_off_and_not_the_boot_processors_are_off, registers_that_are_on_and_not_the_boot_processors_are_different;
  - toyos-userbound's tests/firmware.rs, running 20 tests, each ... ok, 20 passed, 0 failed, no_unlisted_address_is_read_where_a_cpus_range_registers_differ ... ok among them, under [ci] the host workspace;
  - acpiserver's, running 26 tests, each ... ok, 26 passed, 0 failed, under [ci] userland/acpiserver (cargo test --manifest-path userland/acpiserver/Cargo.toml --target x86_64-unknown-linux-gnu), and [ci] userland/acpiserver/aml after it;
  - [ci] clippy, warnings denied: clean: the kernel library and its tests in two shapes, the kernel for x86_64-unknown-none in six and for aarch64-unknown-none-softfloat in four. Neither manual_isolate_lowest_one nor manual_is_multiple_of is anywhere in the log, and no could not compile.
  - Every FAILED in the log is between the first and the last [ci] control heading, a negative control that is to fail. The one error: outside them, unclosed table, expected ], is the output of a build-system test that feeds a malformed manifest, among tests that pass.
- toolchain / build (job 113216910735): success.
- guest / suite (job 113220132648), under KVM, QEMU 11.1.1: test result: ok. 31 passed, 31 total, PASS acpi_power_button and PASS acpi_mediated_access by name, and the probe's two lines:
```
[ 1.831 cpu0 kernel] mtrr: the boot processor's range registers: IA32_MTRR_DEF_TYPE 0xc06 and 8 variable pairs
[ 1.846 cpu1 kernel] mtrr: cpu1's range registers are the boot processor's
```
  So under KVM the second CPU's range registers are the same, where under TCG on this host they are off.
The test machine, run by the orchestrator (his comment The acpi claim's mediated access and the Global Lock, and acpiserver loading the machine's tables through them #749 (comment)), both rows booted from the images staged at edfd5220a, the hashes as the Gates table has them: acpi_tables_loaded boot exit 0 and judge exit 0, [metal] 1 passed, 0 failed, 1 boot(s); acpi_server_death the same. The acpi_tables_loaded boot printed the boot processor's line, IA32_MTRR_DEF_TYPE 0xc06 and 10 variable pairs, and a comparison line for each of its seven other CPUs, every one range registers are the boot processor's. So on that machine no CPU's registers are off or different, the one unlisted read is passed on registers every CPU shares, and the on-and-different arm has run on no machine. One earlier boot of that row in the round was of the image staged at 9b928ca4e and is not counted.

Measured at the head reviewed before it, 3a18a85e6:

The test machine, run by the orchestrator (his comment 6055496682), two unattended boots of the images staged there: acpi_tables_loaded EXIT=0, 1 passed, 0 failed, 14 of 14 tables loaded in 78 ms, the AML's 385 SystemMemory and 10 PCI_Config reads in 6 pages of type 10, 5 of type 11 and 1 of unlisted firmware memory, 241 takes of the Global Lock and none from the firmware, \_S5 7 and 7; acpi_server_death EXIT=0. So with the boot processor's range registers deciding, the one unlisted read still passes on the real machine and nothing else is refused.
CI run 37746496416, read with gh run view 37746496416 once it ended: toolchain / build success; guest / suite success under KVM, 31 passed of 31, PASS acpi_power_button and PASS acpi_mediated_access by name in its log, so the read of q35's PCI hole passes there on the boot processor's registers and the read below 1 MiB is refused; host red, and then cancelled by this round's push while it ran. Its log (job 113209106784) has error: could not compile kernel (lib) due to 1 previous error in each of the kernel's clippy shapes, 12 times, and (lib test) due to 2 previous errors twice, for two lints in round 3's kernel/pure/mtrr.rs: manual_isolate_lowest_one at (phys_mask & phys_mask.wrapping_neg()) in range_type, and manual_is_multiple_of at base % size == 0 in the tests' pair. No other error is in that log: every other FAILED there is under a [ci] control heading, a negative control that is to fail. CI's clippy is 1.99 and this machine's is 0.1.98, which raises neither, so no local run could have shown them. Fixed at edfd5220a as that clippy suggests (isolate_lowest_one(), is_multiple_of), neither changing a value: the kernel library's nine mtrr tests are green on it, and this machine's clippy, which cannot see the two lints, is green over the kernel's library and tests, the x86-64 kernel with and without the actuator features, the AArch64 kernel, and toyos-abi, toyos-userbound and the harness. CI's clippy passes at edfd5220a (above).

Earlier boots of the metal row, at 4284062c1, 2484aa3a5 and 253d4f5f4, were red each for the next thing, as the sections below say; it was green at 88f38a289 too.

Answers to review round 5


BLOCKER: `cargo run -- --ci host` and the guest tests the change reaches had no result at `edfd5220a`	Closed by run 37748731067 at `edfd5220a`, with no change to the code: `host`, `toolchain / build` and `guest / suite` success, each item the BLOCKER lists read in the logs (at the top). KVM gives the second CPU the boot processor's registers, so the probe's read of the PCI hole passes there with nothing refused.
NOTE: the issue's bullet has the TCG reading alone	`54e08c632`: the bullet carries all three readings, by count and kind: the test machine's seven other CPUs the same, KVM's second CPU the same, TCG's second CPU off. Its second open thing is now only why TCG's second CPU is off, and its exit is the firmware's source or the emulator's read for that CPU. `cargo test --test toyos-checks` at `54e08c632`: EXIT=0, 36 passed.
NOTE: the body said the rows were not booted	This body: the boots are at the top and in Gates.

Answers to review round 4


BLOCKER: an unlisted read is passed on the boot processor's registers and made on whichever CPU runs the call	Compared, said and refused; nothing asserted. `kernel::mtrr::beside`, pure over two snapshots beside `range_type`, answers `Same` (word for word), `Off` (not the same, the enable bit clear) or `Different` (not the same, and on). `arch::mtrr::init` keeps the boot processor's registers before any other CPU starts; each other CPU reads its own in `ap_entry`, before it echoes to the roster, and says one line naming which of the three it is. A CPU whose registers are off reads everything uncached by the architecture, so nothing is refused for it. Where any CPU's are on and not the boot processor's, `Memory::decide` refuses every read of an unlisted address under a name of its own, `Refused::RangeRegistersDiffer` (16), decided before the bound under 1 MiB and the cache check; listed memory and every other refusal are as they were. `acpi_mode` keeps no snapshot of its own any more. The kernel programs no range register: who owns the other CPUs' is recorded in the claim's issue as the owner's question.
BLOCKER: `host` and `guest / suite` had no result	At `3a18a85e6` `guest / suite` was success with both ACPI tests passing by name and `host` was red on two clippy lints in `kernel/pure/mtrr.rs`, fixed at `edfd5220a`. CI's run 37748731067 at `edfd5220a` has all three jobs success (at the top).
NOTE: the issue's bullet on the other CPUs' registers	Rewritten: what the kernel does, what was measured (below), and two open things each with an owner and an exit: who owns the other CPUs' range registers (the owner), and why the guest's second CPU has them off, unread (the stage).
NOTE: prose	This body.

Measured on 9b928ca4e's tree before its commit, cargo test --test toyos-build -- acpi_mediated_access, EXIT=0, QEMU 11.1.1 q35 under TCG on this host, the kernel's two lines as the test prints them:

[ 3.057 cpu0 kernel] mtrr: the boot processor's range registers: IA32_MTRR_DEF_TYPE 0xc06 and 8 variable pairs
[ 3.069 cpu1 kernel] mtrr: cpu1's range registers are off (IA32_MTRR_DEF_TYPE 0x0) and not the boot processor's: every read this CPU makes is uncached

So this host's emulation gives the second CPU off. The probe's read of the PCI hole passes and its read below 1 MiB is refused UnlistedCached, as before. The test now requires both lines and prints them, and guest / suite at edfd5220a shows which of the three KVM gives: the same (at the top).

Mutations, one per case of the comparison and one for the refusal, each applied as a checked patch, run once and reversed by one script at 9b928ca4e, the tree clean after each; every one EXIT=101 by a failed assertion (the patches are in the pull request's newest mutation comment):

Patch	Command	Red at
`c1` the same words are not the same	`cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr`	`registers_that_are_word_for_word_the_boot_processors_are_the_same`
`c2` registers that are off read as different	same	`registers_that_are_off_and_not_the_boot_processors_are_off`
`c3` only the default type is compared	same	`registers_that_are_on_and_not_the_boot_processors_are_different`
`c4` an unlisted read passes where registers differ	`cargo test -p toyos-userbound --test firmware`	`no_unlisted_address_is_read_where_a_cpus_range_registers_differ`

A first invocation of c1 to c3 handed the script its command as one word, so cargo never started (EXIT=127): no result, and the runs in the table are the first of each test.

Unsure, and reached by no tier:

The Different arm has run on no machine. Its decision is host-tested and the policy's refusal is host-tested; the two lines between them, the flag compare sets and the field acpi_mode::memory passes, are read and not run. No QEMU flag gives a CPU range registers that are on and differ, and staging it would be a write to an AP's range registers shipped for a test.
"The same" is the words whole, a pair whose valid bit is clear included. Two CPUs that type every range alike with different words in an unused pair are Different, which refuses. Chosen as the answer that cannot pass wrongly; the test machine's firmware leaves no such words: all seven of its other CPUs compared the same.
A CPU that never echoed is not compared, as it is not counted by the roster.
An unlisted read below 1 MiB on a machine whose registers differ answers RangeRegistersDiffer, not UnlistedCached: both refuse.
Not run locally at edfd5220a: cargo run -- --ci host, the AArch64 kernel and userland, acpiserver's and toyos-aml's host tests, and every guest test but the probe. CI ran them there (at the top). At 54e08c632 no CI run has a result as this is written; it differs in one issue file, and the one gate run on it locally is cargo test --test toyos-checks, EXIT=0.

Answers to review round 3

Where a choice was the reviewer's to offer, the ruling taken is the orchestrator's, not the owner's.


BLOCKER 1: nothing fails when the bound under 1 MiB is gone	The bound is `Memory::decide`'s (`firmware::FIXED_RANGE_END`): an unlisted read below it is refused `UnlistedCached` before the cache check is asked. Host case `an_unlisted_address_below_1_mib_is_refused_whatever_the_range_registers_answer`, whose cache check answers yes to everything. The review's patch, moved with the bound, is `r1`: red at that test. The probe's assertion stays, and stays unable to tell: its guest types the legacy hole write-back.
BLOCKER 2: registers that are off pass	The arm is deleted. `Effective::typed_uncacheable` is the one place that says which answer is a register's, and `registers_that_are_off_type_nothing_uncacheable` tables it on the host; `r2` puts the arm back and is red there. Deleting it turned the probe red, which is how the next section was found. No guest reaches the arm after that section's change: the decision is the boot processor's registers, which are on.
BLOCKER 3: the wait for a contended Global Lock	Gone, by the review's second option (the orchestrator's ruling). A take answered `Pending` is denied by name, `the Global Lock: the firmware holds it, and this server waits for no release yet`, and counted in the ledger. `Claim::released`, `LOCK_WAIT`, `sci::GBL`, `Claim::scis`, `Firmware::begin` and the wait's host tests are deleted; `a_lock_the_firmware_holds_is_denied_by_name_and_counted` and the Lock field's load test hold the denial, and `r3` (a pending lock reported taken) is red at both. The stage's issue records it with the 241 takes and the exit: a machine's log carries the denial, which `acpi_tables_loaded` reds on as on every refusal.
NOTE: the test's register address	`REGISTERS + 0x12_3000`, an address of the test's own.
NOTE: the range registers are not the effective type everywhere	The claim's issue records it, with the processor configuration bit that types high RAM outside them, and names the allocator's rule as what keeps kernel and process memory out. The policy's header says the same and no longer says the cache check is what no RAM is.
NOTE: `mtrr::range_type` decides a security boundary untested	Its decision is `kernel::mtrr::range_type`, pure over the default-type word and the base and mask pairs, in the kernel's host-tested library beside `pcid`; the MSR reads stay in `arch/x86_64/mtrr.rs`. Six host tests table it: the default type, a region to its last byte, a partly covered range, every overlap of two types, the undefined encodings, registers that are off. `r6` (a partly covered range takes the register's type) and `r7` (uncacheable does not win an overlap) are red. One defect found on the way: a valid mask with no address bit shifted by 64, a kernel panic by overflow check that a holder's read could now reach on firmware that sets one; it matches every address now, tabled.
NOTE: `type_of` answers the first range	`decide` refuses `UsableMemory` where any usable range of the map holds a byte of the access, and `lock_word` refuses a word any usable range holds a byte of. Host case `memory_any_usable_range_holds_is_refused_whatever_lists_it_first`, over each firmware type listed before each usable one; `r4` and `r5` are red at it. A read across two types is still `Straddles`, decided first.
NOTE: `Loaded`, and the `evaluations` ledger	The ledger is deleted. `Loaded` stays and its doc says who reads it: whoever evaluates a method after the load asks `blocks` whether there is a namespace, and the power-off through the server writes `s5`. `main` acts on neither yet; see "unsure".
NOTE: a press waits for the load	In the stage's issue, with the 77 ms, the 10 s a table may ask to sleep, and an exit.
Prose	This body.

Mutations of round 3, each applied as a checked patch, run once, and reversed by one script at e3449c6f5, the tree clean after each; every one EXIT=101 by a failed assertion:

Patch	Command	Red at
`r1` no bound below 1 MiB	`cargo test -p toyos-userbound --test firmware`	`an_unlisted_address_below_1_mib_is_refused_whatever_the_range_registers_answer`
`r2` registers that are off pass	`cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr`	`registers_that_are_off_type_nothing_uncacheable`
`r3` a pending lock is reported taken	`cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin`	`a_lock_the_firmware_holds_is_denied_by_name_and_counted`, and the Lock field's load test
`r4` the first range listed types a byte	as `r1`	`memory_any_usable_range_holds_is_refused_whatever_lists_it_first`
`r5` the lock word is typed by the first range	as `r1`	the same test
`r6` a partly covered range takes the register's type	as `r2`	`a_register_types_its_region_to_the_last_byte_and_no_further`
`r7` uncacheable does not win an overlap	as `r2`	`two_registers_over_one_range_answer_as_the_architecture_orders_them`

The boot processor's range registers decide, read once (`c62f75db4`)

At e3449c6f5, with BLOCKER 2's arm deleted and the registers still read at each access, cargo test --test toyos-build -- acpi_mediated_access was EXIT=1: the probe's read of q35's PCI hole answered UnlistedCached. Measured with one temporary log line, applied as a patch and reversed: the probe ran on the guest's second CPU, whose IA32_MTRR_DEF_TYPE read 0 — its range registers off — on QEMU 11.1.1 under TCG on this host, where the boot processor's registers type the same address uncacheable (the kernel's mmio: … (MTRR UC) lines, all on cpu0). So at 88f38a289 that read was passed by the arm the review named, and which CPU a call ran on decided the kernel's answer. Under KVM in CI the second CPU's registers are the boot processor's (read at edfd5220a, at the top); why the second CPU under TCG has them off is unread, and the claim's issue owns it.

The kernel reads the boot processor's default-type word and pairs once (in acpi_mode::init at that head; in arch::mtrr::init, before any other CPU starts, at this one), and every unlisted read is decided from them (acpi_mode::uncached over kernel::mtrr::range_type): one answer whichever CPU asks, and no MSR read at an access.
At 3a18a85e6 it was assumed that every other CPU's range registers are the boot processor's; at this head each is compared (round 4's answer, at the top).
acpi_mediated_access at c62f75db4: EXIT=0. On the test machine at 3a18a85e6 the one unlisted page still loads (the orchestrator's boot, at the top).

Outside finding T001-PR-01

An outside audit of 88f38a289 reports that SYS_ACPI can act for a replacement claim after it validated an earlier holder: a thread of process P passes the handle and row-binding checks, another thread of P closes the claim, a new claim is minted for process Q, which takes the Global Lock, and the first thread then resumes and gives Q's lock back.

It does not hold, at that head or this one. The step that fails is the new claim for Q. isa::claim_row refuses a claim (Owned) while the row's ports are bound to a process, and the binding goes back only in isa::process_ends, which the process's teardown calls once every thread of it has left (kernel/src/process.rs, after close_all). A thread of P paused inside SYS_ACPI is a thread of P that has not left, so no claim, Q's or P's own, is minted while it can still resume. When it does resume after the close, acting() finds claimed false and answers Gone. None of kernel/src/isa.rs, kernel/src/syscall/device.rs and kernel/src/device.rs differs between 88f38a289 and this head. By reading; nothing was run for it, and no test stages the interleaving. acting's doc now says what its claimed rests on.

The reviewer traced it independently in round 4 and found the same, with more than the above: the binding leaves the process only in isa::process_ends, called from teardown_resources, which process::leave runs only on its Last arm, so the thread that runs it is the last one out, and a kill only posts a retire a thread meets later; claim_row refuses Owned while the binding is anyone's, under the row's own lock. Two variations fail too: a handle moved to another process answers PermissionDenied there and never rebinds, and a claim minted and never read is bound to nobody and passes for nobody. His reason for no new test: the half a test reaches cheaply is already on main in the ISA row's guest test, which closes a claim in a child and asserts a second claim answers AlreadyExists while the binding process lives, and the ACPI claim mints through the same claim_row; staging the interleaving itself needs a pause inside the syscall, which is kernel code shipped for a test.

The read passes at an unlisted register (`88f38a289`)

The boot at 253d4f5f4 loaded 13 of 14 tables in 74 ms, and \_S5 evaluated to SLP_TYPa=7, the kernel's own. Its numbers, the first of each: the tables' bytes took 42893 reads, in 109 pages of type 6, 2 of type 9 and 1 of type 10; the AML read SystemMemory 316 times and PCI_Config 10 times, its memory in 6 pages of type 10 and 5 of type 11; the Global Lock was taken 204 times and never found with the firmware. Table 11, an SSDT, was refused for one read: a SystemMemory read the kernel refused MemoryType, in memory of no type, being unlisted.

What that address is, from the boot's own log: one byte, below 4 GiB and above everything the firmware's map lists there; outside the ECAM window the MCFG names, so no routing defect; inside the direct map; in none of the eleven windows the kernel mapped; and no function's BAR, none of which the map lists either. By its place it is the chipset's fixed register space under 4 GiB. The 5 pages of type 11 the AML read are the ECAM window's, which the firmware types memory-mapped I/O and the policy routed to configuration reads, as designed.

42893 reads, explained to the read: the fetch reads qwords, then single bytes for a range's last seven at most, and fetches each table once whole after its 36-byte header once (8 reads, repeated inside the whole). Recomputed from the lengths Linux prints for that machine's tables — the RSDP, the XSDT's header and body, a header for each of its 31 entries, and the FADT, the DSDT and the 13 SSDTs whole — the sum is 42893.

The orchestrator's ruling, not the owner's: a read at an address the map does not list passes where it is no usable RAM by construction, none of the kernel's driven pages, no decoded BAR, and reachable; a write stays refused.

toyos-userbound/src/firmware.rs: an unlisted read passes where it is inside what the kernel maps and Memory::uncached answers yes; the device pages and the ECAM window are decided before it, as before. A write is MemoryType as it was. A read the range registers do not type uncacheable is refused under a new name, Refused::UnlistedCached.
How the read is made safely: the direct map covers every 2 MiB page below its end with leaves that select the PAT's write-back entry, under which the range registers decide the effective type (Intel SDM Vol. 3A, Table 12-7, as the kernel's header cites it). At 88f38a289 the kernel read those registers at each such access and passed where they answered uncacheable or were off; at this head the boot processor's, read once, decide, and registers that are off refuse (the sections at the top). On the test machine the kernel's log gives MTRR UC for each register window it maps in the same region.
Why no kernel or process memory is read by it: the allocator hands out only memory the firmware's map lists as usable, and the policy refuses an access any usable range holds a byte of before this arm, so memory the map does not list holds nothing ToyOS put there. The range registers are not that ground: they are not the effective type everywhere (the claim's issue).
Assumed, recorded in the claim's issue: the fixed range registers are not read, so nothing unlisted below 1 MiB is read; a CPU whose range registers are on and not the boot processor's stops every such read on the machine, and nothing makes them the same; and a read of a register can have an effect in the device that the kernel cannot know.
The server's count lines call such a page unlisted firmware memory.
The probe changed with it: its read of q35's PCI hole passes and its write there is refused, and its read of the legacy video hole is refused UnlistedCached. Measured at 88f38a289: acpi_mediated_access passes on an x86-64 guest under TCG on this host. Under KVM it passes in CI, at 88f38a289, 3a18a85e6 and edfd5220a (Gates).
Host test an_unlisted_register_is_read_where_it_is_uncached_and_never_written, and three mutations run once each at 88f38a289 with cargo test -p toyos-userbound --test firmware, each EXIT=101 by failed assertions with the other 15 tests passing in the same run:

Patch	Red at
`u1` an unlisted address is written	the new test, and `every_other_type_and_an_unlisted_address_is_refused_with_its_type`
`u2` the range registers are not asked	the same two
`u3` an unlisted register is not read (the arm reverted)	the same two

Booted as staged at 88f38a289: the row green, the figures at the top of this body.

The read passes in runtime-services data (`253d4f5f4`)

The boot at 2484aa3a5 read what the first could not: acpiserver: table 1 of 31 (DSDT) refused: its bytes could not be read: a SystemMemory read the kernel refused MemoryType, in memory of type 6, and reads of the tables' bytes the kernel refused: a SystemMemory read the kernel refused MemoryType, in memory of type 6 x60. That machine's firmware keeps its FADT and every definition block its XSDT lists in EfiRuntimeServicesData. UEFI 2.10 §2.3.4 has "ACPI Tables loaded at boot time can be contained in memory of type EfiACPIReclaimMemory (recommended) or EfiACPIMemoryNVS", read from the Internet Archive's capture of 2025-01-24 of the specification's chapter 2; this firmware does otherwise.

The orchestrator's ruling, not the owner's: the mediated read passes in EfiRuntimeServicesData as it does in reserved, ACPI reclaim and ACPI NVS memory; a write there stays refused by name, TableWrite, until a machine's AML is measured making one; EfiRuntimeServicesCode stays refused both ways. His reasons: toyos_bootmap::is_usable_type never hands type 5 or 6 to the allocator, so no kernel or process memory carries either; and the kernel's own reader already reads the tables there. The cost — the holder reads whatever else a firmware keeps in runtime-services data, which nothing has listed — is recorded in issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md.

toyos-userbound/src/firmware.rs: type 6 joins the types read, and the types whose write is TableWrite. Refused::TableWrite's doc says both.
Two host tests: a read in type 6 passes to its last byte, a write is refused, a read that leaves it is refused, a device's page inside it is still a device's; type 5 is refused both ways with its type. The every-type sweep expects 6 as it expects 9.
Three mutations, run once each at 253d4f5f4 with cargo test -p toyos-userbound --test firmware, each EXIT=101 by failed assertions, the other new test ok in the same run:

Patch	Red at
`p1` a write in type 6 passes	`runtime_services_data_is_read_as_the_tables_memory_is_and_never_written`, and the sweep
`p2` a read in type 6 is refused	the same two
`p3` a read in type 5 passes	`runtime_services_code_is_refused_both_ways`, and the sweep

The server's per-type lines are as they were: the tables' pages by type, the AML's pages by type, and every refused read counted by name and type.
The server's stand-in kernel refuses type 5 where it refused type 6, so its tests still describe a refusal the policy makes.

The boot at 253d4f5f4 read the tables through: the section above has it.

The first load on the real machine, and what `2484aa3a5` changes

The server said its DSDT was refused as absent, counted 31 tables and loaded none. Read from that boot's log:

The kernel refused the first read of 30 of the XSDT's 31 entries, the FADT's and every SSDT's among them. The fetch made 63 reads: 8 for the RSDP, 8 and 39 for the XSDT's header and its 284 bytes, and 8 for the header of the one entry that was readable, which is in ACPI NVS and is no definition block. Every other entry's first qword was refused, so nothing of it was counted.
Absent was this branch's defect, not the firmware's. The walk looked for the FADT as find_table does, passing an unreadable entry over, found none, and answered that nothing names a DSDT. Neither FADT field was ever read, so which of DSDT and X_DSDT is followed did not come into it; dsdt_address is the kernel's own function and prefers a non-zero X_DSDT from revision 2 on.
31 is the DSDT's item and 30 unread entries, each answered Unmapped because nothing says an entry whose header was not read is no SSDT. Linux's 14 are the DSDT and the 13 entries whose signature is SSDT; its 8 dynamically loaded tables are no XSDT entries and the walk does not count them. With the entries readable the count is 14.
The load stopped at the DSDT before any line carried the kernel's refusal, so the log has neither its name nor the memory type. Linux's e820 print of that machine calls the range those 30 tables are in reserved, the RSDP and XSDT ACPI data, and the one readable entry ACPI NVS. e820's reserved covers several UEFI types, and the policy passes a read only in type 0, 9 and 10. Which type it is has not been read, and the kernel reads these same tables for itself through the direct map whatever their type, which is why it finds \_S5 there.

What changed:

definition_blocks refuses the DSDT as the first entry that could not be read where no FADT was found, and says Absent only where every entry was read and none is a FADT. find_table is as on main.
The server keeps each range's refusal by its address, so a table's line carries the kernel's name and the memory type of that table's own refusal, and one line counts every refused table read by name and type whether or not the load reached that table.
Host tests hold the machine's shape, crafted: a_dsdt_whose_fadt_could_not_be_read_is_refused_as_unread_and_not_as_absent (toyos-acpi), and tables_in_memory_of_a_type_the_kernel_keeps_are_refused_by_that_name_and_type (acpiserver).

The policy was not changed at 2484aa3a5, and the row was red there as expected; its lines are in the section above.

The merge with `main`, hunk by hunk

main took #747 (UserSafe proved by toyos_abi::user_safe!) and #748 (every write to SMI_CMD through kernel/src/arch/x86_64/smi_cmd.rs, on the boot processor). Four files conflicted; two more merged without a conflict and were wrong.

toyos-abi/src/acpi.rs: Block is main's. AcpiInfo is declared through user_safe! with this branch's rsdp and reserved fields. Access is declared through user_safe! too. Both pass the macro's check as they stood; neither layout changed. Their hand size assertions and AcpiInfo::as_bytes are gone, as on main.
kernel/src/user_ptr.rs: main's side whole. This branch's hand unsafe impl UserSafe for Access is deleted with every other.
kernel/src/arch/x86_64/acpi_mode.rs: main's side for the port: smi_cmd declares it, holds its lock and makes its writes, and Hardware::legacy is main's. This branch's side for the holder: HOLDER, the lock word, the mediated access. settle here keeps only the holder's half; SMI_CMD's half is smi_cmd::settle.
kernel/src/arch/x86_64/smi_cmd.rs (no conflict): its pio::declare gains the argument this branch made required, Mediated::ReadOnly. That is where a holder's write to SMI_CMD is refused now, said at the declaration.
kernel/src/arch/x86_64/power.rs (no conflict, and wrong as merged): main replaced acpi_mode::settle with smi_cmd::settle on the line this branch's wait hangs off, and git took main's line cleanly. The power-off would have stopped waiting out a mediated access. It calls both now.
kernel/src/arch/x86_64/acpi_mode.rs's imports (no conflict, did not compile): main dropped crate::sync::{Lock, LockGuard}, which this branch's HOLDER needs. Restored.
tests/toyos.rs: acpi_death_on_metal reads main's line shape for both writes, its boot-processor judgement and its "asked from another CPU" check, and this branch's lock-word line.
Everything else of main's merged as it stands on main.

What changed, per decision

One syscall, SYS_ACPI(claim, op, ptr): an access (a struct in and out), take the lock, give it back.
A refusal is an ABI enum the kernel writes back (toyos_abi::acpi::Refused), one variant a row of the policy, with the UEFI type of the address. The kernel logs no refusal.
The policy is pure, toyos-userbound/src/firmware.rs, and answers a witness or a refusal; the kernel's accessors take only witnesses (four compile_fail doctests).
- Memory, by the type firmware's map gives it: RAM refused; ACPI NVS and reserved both ways; ACPI reclaim read-only; every other type and an unlisted address refused with the type; a write to the FACS refused; an address in the ECAM window decided as a configuration access.
- Device memory is refused by the page (DeviceMemory): every window map_mmio made, every memory BAR as firmware left it, whoever drives the function, and the local APIC's range, each grown to the 4 KiB pages it lies in. A window pcidev cuts for a BAR is no longer fed to the policy (round 2's NOTE, decided: deleted, with its host case): publish seeds what is taken with every range of firmware's map, so a window is cut only at an address the map does not list, and place_bar reads every address it tries through map_mmio, so a cut window is among the driven windows before it is a BAR's; the half changed nothing the policy answers.
- Ports: every declaration says what it answers (Mediated). COM1, the 8259 pair, CMOS, 0xCF8/0xCFC, the reset register and a kernel-driven i8042 are kept; PM1a_CNT, the TCO block and SMI_CMD are read and never written; the POST port is open; another claim's row is refused; anything else passes.
- Configuration space is read and never written. The orchestrator withdrew his earlier call to build a write arm (his re-ruling on item 1): every configuration write is refused by one name, ConfigWrite, until a machine's AML makes one. The measurement behind it: no path of the real tables writes configuration space. config_write, the ConfigWrite witness, pcidev::mediated_standing, caps::programmed_len and its test, and four refusal names are deleted.
The Global Lock: toyos-acpi decodes the FACS, now held to §5.2.10's 64-byte boundary, and holds §5.2.10.1's two transitions as pure functions. The kernel exchanges the word only through a witness (firmware::lock_word) answered where all four of the word's bytes are ACPI NVS or reserved memory inside the direct map; round 1 typed the structure's first byte. A lock its holder left taken goes back at the claim's end and before the power-off. A FACS the FADT names and the kernel refuses answers every take NotSupported (round 2's NOTE): only a FADT that names no FACS answers taken, since a holder told it holds a lock that excludes nothing is told a falsehood. No tier reaches that arm: no guest has a FACS the kernel refuses.
One lock, HOLDER, across decision and act. Every access and every lock exchange is made under it and refused Gone once the claim is gone or the stop has begun; settle takes it before the power-off owns the hardware, which waits out the one in flight. The records of device memory are read under their own locks and released before the access: a window mapped after the decision is one the access was made a moment before.
Firmware memory is read through the direct map, which covers every address below its end whatever its type; past the end is refused by name. No window is mapped.
The kernel keeps firmware's map by withholding the loader's copy from the allocator (mm::firmware_map).
New dependency edges, in-tree only: toyos-userbound on toyos-abi and toyos-bootmap, so the access words, the map entry and "which types are RAM" are declared once.
Filed: issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md, now with what the review found it omitted.

Answers to review round 1


1	The write arm is deleted, by the orchestrator's re-ruling.
2	The policy grows every device range to its pages; the test that asserted the hole asserts the refusal, at the dword after the mapped bytes, the EOI register and the page's last byte.
3	The policy reads `pcidev`'s `decoded`; the `windows` half went in round 2. Measured on the test machine instead of guessed, below.
4	64-byte alignment required; the word's four bytes typed; host tests for both, the second with a firmware range ending inside, at and before the word.
5	`HOLDER`, as above; it takes the first NOTE with it.
6	Each of the three mutations has an assertion in the probe that names it; five more ride with them. None was run; round 2's answer above says where they stand.
7, 8	Ruled: one merge with the server half, which is on this head.
NOTEs	The issue carries the four omissions; `DRIVEN`'s growth is stated at its site.

The test machine's memory, read

From the kernel log of the tree's counters row on that machine and from Linux's print of the same firmware's map (types and counts only):

Its 24 functions decode 21 memory BARs. None is at an address the firmware's map lists; 16 are past the end of the direct map.
By Linux's print, the I/O APIC, the HPET and the four DMA remapping units are at unlisted addresses too.
The FACS is in ACPI NVS, the RSDP in ACPI reclaim, and the ECAM window is listed, as memory-mapped I/O.

So on that machine, and on q35, round 1 already answered a BAR and a kernel-driven window MemoryType or Unmapped. Items 2 and 3 were holes only where firmware lists such a range as reserved; the record now refuses them there.

Answers to review round 2


New BLOCKER: nothing fails when the power-off stops settling the holder	The probe's last act, once every arm has passed, is to take the Global Lock and ask for the power-off holding it (`tests/toyos-rust-tests/src/bin/acpi_mediated.rs`). A stop ends no process, so `power::off` finds a live holder's lock taken. `acpi_mediated_access` waits for the kernel's `acpi: the Global Lock given back for a holder that left it taken (the machine is stopping)` after the probe's own line, or for the job's end, which is a probe whose arm failed. The review's patch is `k1` in the mutation comment, and `k2` drops the give-back inside `settle`. Run at `88f38a289`: the review's patch as written does not build — with the call gone `acpi_mode::settle` is dead code, which the kernel's build refuses (`error: function settle is never used`), so that exact loss cannot land. `k1b` keeps the function named and drops the call, and `k2` drops the give-back inside it: each reds `acpi_mediated_access`, which stalls waiting for the kernel's line.
NOTE: a refused FACS	Answered `NotSupported`; above.
NOTE: the `windows` half	Deleted with its host case; above. `m4` is restated for it.
NOTE: three stale sentences	Replaced by the record at the top.
6: the eight mutations unrun	All eight are run and red: `m5` to `m8` at `2484aa3a5` against the host tests, `m1` to `m4` at `88f38a289` against the probe. The tables are under the checks below.
7: no reading through `SYS_ACPI` from hardware	The row `acpi_tables_loaded` is staged; below.
8: the syscall ships for a test alone	`acpiserver` calls it at this head.

Why the probe is a guest test

Its test changed at 9b928ca4e: it requires and prints the kernel's line for the boot processor's range registers and the second CPU's line beside them. How a hypervisor hands a second CPU its range registers is that hypervisor's answer and no host test has one; the metal row reads the same lines from the real machine, and this is the only reading under TCG and KVM, where the answer was measured to be other than the SDM's rule.

Its behaviour changed at 88f38a289: it ends by powering the machine off with the Global Lock held, and its test reads the kernel's line for that instead of the job's exit. That line is said inside the power-off, by the kernel, of a live process holding a claim: no host test has a kernel, and the T14 is not powered off by a row. For the rest: a type and the host tests hold the policy. What is left is the kernel between the syscall and the hardware, and the probe's red arm is the kernel making those writes for real, on a machine nothing powers on again. It boots with i8042-withheld because only there is a port another claim's row rather than the kernel's.

The kernel half: unsure, and reached by no tier

The GBL_RLS assertion rests on QEMU keeping the bit as written; CI's guest run at 377153444 passed on it.
Nothing reds on a mediated access that ignores the stop. The window is a thread already inside the syscall when the stop begins; no guest stages it. What holds it is that every accessor is reached only with the guard acting() answers.
The probe reads a BAR nothing in its boot claims, which is pcidev's decoded record.
The take a refused FACS answers NotSupported has no test: no guest's FACS is one the kernel refuses, and nothing stages one.
Which UEFI types the machine's AML addresses fall in beyond the above, and that reserved memory reads correctly under the direct map's write-back entry with the MTRRs deciding.

The server half

What changed, per decision

toyos-acpi: definition_blocks walks the DSDT the FADT names and then every SSDT the XSDT lists, in the XSDT's order, each validated (Table::open) or answered as its refusal, the walk going on past it. The DSDT's item is always first. An entry of another signature and a null entry are passed over. An entry whose header cannot be read is answered Unmapped, not passed over as find_table passes it: nothing says it is no SSDT, and the ruling is to say a refused table loudly. find_table is the same function it was, over a helper the walk shares.
acpiserver arms, then loads, then serves. A press during the load latches in PWRBTN_STS and is served when the load ends. acpi_power_button sends its press as soon as the server says it armed, so the guest suite runs that order.
The tables are fetched into the server's own memory (tables.rs): toyos_acpi::Phys over mediated reads, a range fetched whole in readable and read from what is held in byte, which is that trait's contract. Qwords, then single bytes for the last seven at most, so no read reaches past the range asked for into memory of another type. Address zero is no table's.
The Host (host.rs) is generic over a small trait, Kernel, that the claim implements in main.rs and a scripted stand-in implements in the host tests.
- A read of memory, a port or configuration space is the kernel's to make or refuse. The server holds no policy of its own over reads: the policy is toyos-userbound's, once.
- Every write is denied by name, in each space. Loading writes nothing (measured on the real tables by the scouts: 346 reads, 0 writes), and nothing else is evaluated but \_S5.
- EmbeddedControl is denied by name, both ways. SystemCMOS never reaches the host: toyos_aml refuses that space itself (field.rs, Unsupported("the SystemCMOS address space")), and its Address has no variant for it, so there is nothing to deny here.
- Ports all go through the kernel, the claim's own row included. The design had the host make those itself; the kernel answers the holder's own row Free, so one path does both and I built no second.
- The Global Lock is taken and given back through the kernel. A take answered Pending is denied by name and counted in the ledger; the access under it is not made, and the table or method that asked is refused. The server waits for no release of the firmware's (review round 3, at the top).
- Sleep is std::thread::sleep and Stall a spin, each for what the firmware asked, bounded by the interpreter. Notify is counted.
A refused SSDT is said and the load goes on; a refused DSDT leaves no namespace, no SSDT is loaded onto nothing, and the power button is served (the owner's ruling, verbatim: "Go on, say it loudly (Recommended)").
A machine that is stopping ends the load in one line. The kernel answers Gone once a stop begins, machine_shutdown can begin one while the server loads, and a server that panicked there would put a panic in every such boot's log. Any other error from a call the server formed is a panic naming it.
The ledger (ledger.rs) says a refusal the first time it is seen and counts it after; one line at the load's end gives the counts of the accesses refused. A refused \_S5 is one line.
\_S5 is evaluated after the load and said as acpiserver: \_S5 evaluated: SLP_TYPa=… SLP_TYPb=…. The server cannot see the kernel's value; the guest test and the T14 row hold the two lines against each other.
The namespace is dropped after \_S5. Nothing reads it afterwards in this slice, and a field kept for S2 would be dead code until then.
The typed error: toyos_aml::Error::Bridge { segment, bus, device, function, header_type, secondary } for the interpreter's two refusals of a bridge's registers, which were Error::Rule with a sentence.
toyos::AcpiDev gains access, lock_take and lock_release, the typed wrappers over the three calls. toyos is in the sysroot, so this rebuilds std.
The log line for a query said "stage 1 runs no AML", which is false from this head; it says no query's method is evaluated yet.
The track's issue: two sentences that said nothing evaluates AML and the server does not link the interpreter are corrected.

The lines `toyos-aml` changes, for the merge with #750

userland/acpiserver/aml/src/lib.rs: six lines added after Host(String), in enum Error (the Bridge variant and its doc). The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750's hunks in that file are at its header, at MAX_LIVE, and from Interpreter::new down.
userland/acpiserver/aml/src/field.rs, in pci: the two return Err(Error::Rule(…)) of the bridge walk and the line that reads the Header Type, five lines for three. The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750's hunk in pci ends 14 lines above, at below.push(host).
userland/acpiserver/aml/tests/regions.rs: two assertions in a_pci_config_region_below_bridges_is_on_the_nearest_ones_secondary_bus, a line each. The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750 adds a test after that function's end, 12 lines below the second.
The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750 landed on main as 017451624 and is merged into this head: no conflict, and the interpreter's and the server's host tests are green on the merge (Gates).

What a line may be quoted from

A line anyone may quote carries a table's place and whether it is the DSDT or an SSDT, a refusal's kind, the address space, the kernel's name for a refusal, the memory type and counts. Every address, PCI function, table offset, bridge register and name the firmware chose is on a separate line that opens acpiserver: (this machine's own, quoted in no record) . every_refusals_kind_is_free_of_what_the_firmware_chose holds the first kind for the interpreter's errors that carry such a thing.

Tests, by tier

Type: kind matches toyos_aml::Error without a wildcard, so a new error is a compile error until it has a quotable name.
Host, toyos-acpi (4 new tests, and one line in the corpus's single-byte mutation walk): QEMU's own tables yield its DSDT alone; a crafted XSDT yields the DSDT first, the SSDTs in order, each refusal in its place; a DSDT that cannot be found is the first item refused and the SSDTs follow.
Host, acpiserver: the host's reads, refusals and denials against the scripted kernel, a held Global Lock's among them; the fetch's widths and refusals; the ledger; and the load end to end — QEMU 11.1.1's own tables through the whole path every guest boot takes (walk, fetch, checksum, load, \_S5 = 0), a refused SSDT, a refused DSDT, tables the kernel will not read, a stop mid-load, and a Lock field read at load that takes the lock and is refused, unread, where the firmware holds it.
Host, toyos-aml: the two bridge assertions now name the registers answered.
Guest: acpi_power_button reads every table line as loaded, the DSDT first, and \_S5's SLP_TYPa equal to the kernel's ACPI: PM1a=… SLP_TYPa= line, and that the press was served after it. Why a guest: the host test loads the same DSDT against a stand-in for the kernel; what is left is the kernel's mediation answering a real firmware's table memory, on the boot path every guest test shares, and the T14 row reads another firmware. No new guest test: the assertions ride a boot that exists.
T14: acpi_tables_loaded, booted green at edfd5220a, below.

Checks of the high-risk code

Negative control (the brief's): the policy reverted to pass everything, g00. Both arms run and red: the policy's host tests at 2484aa3a5 (11 of 14), and the probe at 88f38a289, at "acpi: RAM was read".
What reds if the server's host answers what it should refuse: s1 (a write passed to the kernel), s2 (the controller's space reads all ones) and s3 (a refused read answers zero), each against a named host test in host.rs. The server has no policy of its own over reads, so "a read it should refuse" is a read the kernel refused and the host passed off as made: s3.
Independent oracles: QEMU's hardware model and its own published tables; the kernel's byte scan of \_S5, a second implementation over the same bytes read another way; each table's checksum, which is its firmware's seal over bytes the server read through SYS_ACPI; and the real machine, booted at edfd5220a, with Linux's count of its definition blocks (14 ACPI AML tables successfully acquired and loaded).
Mutations: 42 patches across the mutation comments — round 4's four and round 3's seven, at the top, and 31 before them: round 2's eight, the review's own (k1), 16 for this half, three for the runtime-services arm and three for the unlisted-register arm, the last six in their own sections above. Each passes git apply --check at 88f38a289; p1 to p3 are restated there, their context having changed, and were run at 253d4f5f4. Nine were run at 2484aa3a5, once each, applied as a checked patch, run, and reversed by one script, the tree clean after each; every one is red by a failed assertion and none by a build error:

Patch	Command	Exit	Red at
`g00` policy passes everything	`cargo test -p toyos-userbound --test firmware`	101	11 of 14 tests, `ram_is_refused_both_ways_whatever_usable_type_it_is` among them
`m5` no page rounding	same	101	`every_page_a_window_the_kernel_drives_lies_in_is_refused_inside_any_type`, and the BAR test
`m7` first byte typed	same	101	`the_lock_word_is_exchanged_only_where_all_four_bytes_are_the_firmwares_own`
`m8` config write passes	same	101	`every_configuration_write_is_refused_by_one_name`
`m6` FACS aligned to four	`cargo test -p toyos-acpi --test facs`	101	`a_facs_off_its_sixty_four_byte_boundary_is_refused`
`i1` a refused SSDT passed over	`cargo test -p toyos-acpi --test corpus definition_blocks`	101	`the_definition_blocks_are_the_dsdt_and_then_each_ssdt_in_the_xsdts_order`
`i2` the DSDT not first	`cargo test -p toyos-acpi --test corpus --test fixtures definition_blocks`	101	the same test; cargo stopped there, so `fixtures.rs` did not run
`i3` an unread FADT is an absent DSDT	`cargo test -p toyos-acpi --test corpus a_dsdt_whose_fadt`	101	`a_dsdt_whose_fadt_could_not_be_read_is_refused_as_unread_and_not_as_absent`
`b1` a bridge on its own bus walked	`cargo test --manifest-path userland/acpiserver/aml/Cargo.toml --target aarch64-apple-darwin --test regions a_pci_config_region_below_bridges`	101	`a_pci_config_region_below_bridges_is_on_the_nearest_ones_secondary_bus`

g00 is the negative control's host arm; its guest arm, the probe, is unrun. i3's test is new at this head, so its green arm is CI's next run.

The rest, run once each at 88f38a289, by the same script, the tree clean after each:

Patch	Command	Exit	Red at
`g00` policy passes everything	`cargo test --test toyos-build -- acpi_mediated_access`	1	the probe: "acpi: RAM was read"
`k1` the review's patch	same	1	a build error, not a test: `settle` is never used
`k1b` `settle` named, not called	same	1	the test stalls waiting for "(the machine is stopping)"
`k2` a stop leaves the lock taken	same	1	the same
`m1` no window recorded	same	1	the probe: "acpi: 0xfec00000 was read"
`m2` no `GBL_RLS`	same	1	the probe: "a release the firmware had asked for wrote no GBL_RLS"
`m3` another row's port free	same	1	the probe: "acpi: port 0x60 was read"
`m4` no BAR fed	same	1	the probe: "a function's BAR at … was read"
`s10` the server loads nothing	`cargo test --test toyos-build -- acpi_power_button`	1	"the server said nothing of a first table"
`s1` a write passed to the kernel	`cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin`	101	`nothing_is_written_and_the_controllers_space_is_not_reached`
`s2` the controller's space reads all ones	same	101	the same test
`s3` a refused read answers zero	same	101	`a_read_the_kernel_refuses_is_denied_under_the_kernels_name_and_counted`
`s4` a pending lock reported taken	same	101	at `88f38a289`, the wait's tests, since deleted; restated for this head as `r3`, at the top
`s5` the lock wait not spent	same	101	at `88f38a289`, a test of the wait; the wait and the patch's subject are deleted
`s6` a fetch reads whole qwords	same	101	`a_range_is_fetched_whole_in_qwords_and_then_bytes_and_kept`, and eight more
`s7` SSDTs load onto a refused DSDT	same	101	`a_refused_dsdt_leaves_no_namespace_and_loads_no_ssdt`, and one more
`s8` a refused SSDT ends the load	same	101	`a_refused_ssdt_is_one_block_refused_and_the_rest_load`
`s9` a refusal's kind names what the firmware chose	same	101	`every_refusals_kind_is_free_of_what_the_firmware_chose`

No patch of this pull request is unrun; s5 has no subject left. One thing still has no test and so no patch: the take a refused FACS answers NotSupported.

The T14 row

acpi_tables_loaded, on the boot acpi_server_events already takes (testcases-hold). Booted at 4284062c1, 2484aa3a5 and 253d4f5f4, red each time for the next thing, as the top of this body says; green as staged at 88f38a289, at 3a18a85e6 and at edfd5220a. Its judge reads:

a line of the kernel's for every CPU but the boot processor saying how its range registers stand beside the boot processor's, as many as the roster brought up, and none on and different; it prints how many are off;
every table line, as many as Linux loads on that machine (14), each loaded, the DSDT first;
\_S5's SLP_TYPa equal to the kernel's own line;
no refusal line of any kind, which holds no bridge refusal, no Unmapped, and no access the policy kept from the load;
that the load's AML read memory, read configuration space and took the Global Lock at least once each — the scouts measured all three for these tables — so the real lock word was exchanged and given back;
and prints the load's time, the reads by address space, the takes that found the firmware holding the lock, and the pages of memory by UEFI type, for the tables' bytes and for the AML's reads apart.

Of what review round 2 lists for the metal machine, this row reaches: the mediated reads against an independent reading, for the memory the tables are in only (their checksums, and \_S5 against the scan); the memory type of every page touched, none Unmapped; the configuration reads through the real ECAM window; takes and releases of the real lock word. It does not hold a value read from ACPI NVS or reserved memory against an independent reading: the load's AML reads such memory, and nothing else in this slice reads the same bytes another way. The server reads no FACS signature, which would be that check, because it has no other use for one. Later slices own: what the refused SMI_CMD write breaks in the methods that make it (S3a/S3b, where a write is first made); a port access that traps into SMM under the mediation's lock (S3b); a release that owes the firmware its signal, read by the SMI count (S3b, if contention is ever counted); the power-off with the server alive and holding the lock (S2, and no row powers the T14 off); the server killed mid-load with the lock held (no slice stages it). acpi_server_death kills the server as soon as it says it armed, which from this head is as its load begins, so that row now reads legacy mode again after a server killed while loading; whether a take was in flight at the kill is chance. It was green at 3a18a85e6 and at edfd5220a.

Gates

Command	Exit	At
`host` (job 113216910123, 78 steps all green), `toolchain / build` (job 113216910735), `guest / suite` (job 113220132648, 31 of 31), CI run 37748731067	success, each	`edfd5220a`
`acpi_tables_loaded`, the test machine, the image `6c0e19dc…e4ebad19` (comment 6055804005)	boot 0, judge 0: `[metal] 1 passed, 0 failed, 1 boot(s)`; seven comparison lines, each the boot processor's	`edfd5220a`
`acpi_server_death`, the test machine, the image `c6d36024…7a611a6e` (comment 6055804005)	boot 0, judge 0: `[metal] 1 passed, 0 failed, 1 boot(s)`	`edfd5220a`
`cargo test --test toyos-checks`	0, 36 passed	`54e08c632`
`host`, `toolchain / build`, `guest / suite` (31 of 31), CI run 37740095844	success, each	`88f38a289`
`toolchain / build`, `guest / suite` (31 of 31), CI run 37746496416	success, each	`3a18a85e6`
`host`, CI run 37746496416	red: the kernel's clippy shapes, two lints in `kernel/pure/mtrr.rs`; then cancelled by the push of `9b928ca4e`	`3a18a85e6`
clippy 0.1.98 over the kernel's library and tests, the x86-64 kernel with and without `boot-actuators,test-actuators`, the AArch64 kernel, and `-p toyos-userbound -p toyos-abi -p toyos-build --all-targets`, with `src/clippy.rs`'s adopted lints and `-D warnings`	0, each; not CI's clippy, which is 1.99	`edfd5220a`'s tree
`acpi_tables_loaded`, the test machine	0: 1 passed, 0 failed	`88f38a289`, and `3a18a85e6`
`acpi_server_death`, the test machine	0	`4284062c1`, and `3a18a85e6`
`acpi_tables_loaded`, the test machine, three earlier boots	1 each, for the next thing	`4284062c1`, `2484aa3a5`, `253d4f5f4`
`cargo test -p toyos-userbound --test firmware`	0, 20 passed	`9b928ca4e`
`cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr`	0, 9 passed	`9b928ca4e`, and `edfd5220a`'s tree
`cargo test --test toyos-build -- acpi_mediated_access`	0, 1 passed	`9b928ca4e`'s tree before its commit
`cargo run -- --build-only`	0	`dbdc05f35`
`cargo test --test toyos-build -- acpi_power_button`	0, 1 passed	`dbdc05f35`
`cargo test --test toyos-build -- acpi_mediated_access`	1: the read of the PCI hole refused on the second CPU	`dbdc05f35`
the same, with the measuring line	2, invalidated by the harness for a host suspend of 9 s; then 1, with the measurement	`dbdc05f35` and a one-line patch
`cargo test --manifest-path userland/acpiserver/aml/Cargo.toml --target aarch64-apple-darwin`	0	`87bf03b60`
`cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin`	0, 26 passed	`87bf03b60`
`cargo test --test toyos-build -- --metal --metal-readback <dir> acpi_tables_loaded`	2, the staging's own exit: one image, sha256 `6c0e19dc…e4ebad19`	`edfd5220a`, clean tree
`cargo test --test toyos-build -- --metal --metal-readback <dir> acpi_server_death`	2, the staging's own exit: one image, sha256 `c6d36024…7a611a6e`	`edfd5220a`, clean tree
`cargo run -- --ci host`, the guest suite, `toolchain / build`	not run locally; CI's, the first row	`edfd5220a`
`host`, `toolchain / build`, `guest / suite`	no result as this is written; the head differs from `edfd5220a` in one issue file	`54e08c632`

The stagings compiled the kernel, userland, the guest test binaries and tests/toyos.rs at edfd5220a; the probe's run before them rebuilt the sysroot for toyos-abi's new variant.

The server half: unsure, and reached by no tier

The denial of a held Global Lock is reached by no machine yet: the host tests hold it, no guest's AML takes the lock, and the test machine's 241 takes found it free. A firmware that holds it at a take costs that table or method its load, said by name.
The load's time on the T14 is one measurement, 77 ms: one syscall for each qword of every table and each access. A press waits for it (the stage's issue).
S1's exit in the design also asks for the Secondary Bus of three bridges to be logged. The brief's row does not, and its privacy rule keeps bus numbers out of quotable lines; nothing logs them. A bridge the interpreter refuses is logged with its registers on the machine's own line.
aml::load returns what became of each block and \_S5, and main acts on neither. Its tests read it; its doc says which later slice reads which field. If the reviewer holds that to be a return for the tests alone, the alternative is tests that read the server's lines.
toyos-abi's wrappers are called through toyos::AcpiDev in the server and directly in the probe, which must ask on an unbound raw claim.

Lines

git diff --shortstat origin/main...54e08c632: 53 files changed, 4786 insertions(+), 195 deletions(-).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…ation space read and written by the kernel, and the Global Lock The holder of the `acpi` claim runs the firmware's AML, which names memory, ports and PCI configuration space the claim's row does not hold. One syscall, SYS_ACPI, has the kernel make each access or refuse it by name, and take and give back the FACS's Global Lock. The policy is pure, in toyos-userbound::firmware, and answers a witness or a refusal: memory by the UEFI type firmware's map gives it, a port by what its declaration says (pio::declare and FIXED now take the answer), configuration space read whole and written only past the header, outside the capabilities the kernel programs, on a function nothing drives. The kernel keeps firmware's map by withholding the loader's copy from the allocator; pcidev::publish read that copy after mm::init could have handed its page out. Every window map_mmio makes is recorded, and refused to the holder. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-07T22:08:47Z

Mutation patches for this pull request, each applied to head 27e5cfb's tree as a checked patch, run and restored by one script; the tree was clean after (git status --porcelain empty). m01–m32 ran cargo test -p toyos-userbound --test firmware or cargo test -p toyos-acpi --test facs; g00–g12 ran cargo test --test toyos-build -- acpi_mediated_access. Every one is RED by a failed assertion, none by a build error.

m01-ram-passes: EXIT=101 RED every_other_type_and_an_unlisted_address_is_refused_with_its_type,ram_is_refused_
m02-table-write-passes: EXIT=101 RED the_tables_memory_is_read_and_never_written,every_other_type_and_an_unlis
m03-no-straddle-check: EXIT=101 RED nvs_and_reserved_memory_pass_both_ways_to_their_last_byte_and_no_further,t
m04-kernel-windows-pass: EXIT=101 RED a_window_the_kernel_drives_a_device_through_is_refused_inside_any_type
m05-local-apic-passes: EXIT=101 RED a_window_the_kernel_drives_a_device_through_is_refused_inside_any_type
m06-past-the-map-passes: EXIT=101 RED memory_past_what_the_kernel_maps_is_refused
m07-mapped-end-off-by-one: EXIT=101 RED memory_past_what_the_kernel_maps_is_refused
m08-facs-write-passes: EXIT=101 RED the_facs_is_read_and_its_bytes_are_never_written
m09-ecam-is-plain-memory: EXIT=101 RED an_address_in_the_ecam_window_is_a_configuration_access_whatever_the_ma
m10-other-types-pass: EXIT=101 RED every_other_type_and_an_unlisted_address_is_refused_with_its_type
m11-unlisted-passes: EXIT=101 RED every_other_type_and_an_unlisted_address_is_refused_with_its_type
m12-overlap-misses-the-last-byte: EXIT=101 RED a_window_the_kernel_drives_a_device_through_is_refused_inside_a
m13-kept-port-passes: EXIT=101 RED a_port_answers_as_its_declaration_says,a_wide_access_is_held_to_every_port_
m14-read-only-port-written: EXIT=101 RED a_wide_access_is_held_to_every_port_it_spans,a_port_answers_as_its_de
m15-row-port-passes: EXIT=101 RED a_wide_access_is_held_to_every_port_it_spans,a_port_answers_as_its_declarati
m16-only-the-first-port-asked: EXIT=101 RED a_wide_access_is_held_to_every_port_it_spans
m17-qword-port-passes: EXIT=101 RED a_wide_access_is_held_to_every_port_it_spans
m18-header-written: EXIT=101 RED a_configuration_write_lands_only_where_the_kernel_decides_nothing
m19-extended-written: EXIT=101 RED a_configuration_write_lands_only_where_the_kernel_decides_nothing
m20-driven-function-written: EXIT=101 RED a_configuration_write_lands_only_where_the_kernel_decides_nothing
m21-capability-written: EXIT=101 RED a_configuration_write_lands_only_where_the_kernel_decides_nothing
m22-capability-end-off-by-one: EXIT=101 RED a_configuration_write_lands_only_where_the_kernel_decides_nothing
m23-any-segment-reached: EXIT=101 RED a_configuration_read_is_held_to_the_window_and_to_one_register
m24-any-bus-reached: EXIT=101 RED a_configuration_read_is_held_to_the_window_and_to_one_register
m25-config-crosses-a-dword: EXIT=101 RED a_configuration_read_is_held_to_the_window_and_to_one_register
m26-config-past-the-function: EXIT=101 RED a_configuration_read_is_held_to_the_window_and_to_one_register
m27-ecam-first-bus-ignored: EXIT=101 RED an_address_in_the_ecam_window_is_a_configuration_access_whatever_the_
m28-owned-lock-taken: EXIT=101 RED both_transitions_are_the_specifications_own_sequences
m29-pending-never-set: EXIT=101 RED both_transitions_are_the_specifications_own_sequences
m30-release-never-signals: EXIT=101 RED both_transitions_are_the_specifications_own_sequences
m31-release-keeps-pending: EXIT=101 RED both_transitions_are_the_specifications_own_sequences
m32-narrow-facs-address-wins: EXIT=101 RED the_wide_address_wins_where_it_is_not_zero_and_the_narrow_one_serve
g01-unbound-claim-answers: EXIT=1 RED ran=True 21:47:06 FAIL
g02-claim-end-keeps-the-lock: EXIT=1 RED ran=True 21:47:16 F
g03-runtime-declarations-unasked: EXIT=1 RED ran=True 21:47:
g04-fixed-declarations-unasked: EXIT=1 RED ran=True 21:47:37
g07-every-function-free: EXIT=1 RED ran=True 21:47:51 FAIL a
g08-memory-write-dropped: EXIT=1 RED ran=True 21:48:02 FAIL 
g10-wide-value-taken: EXIT=1 RED ran=True 21:48:12 FAIL acpi
g11-reserved-bytes-unread: EXIT=1 RED ran=True 21:48:22 FAIL
g12-pending-not-left: EXIT=1 RED ran=True 21:48:32 FAIL acpi
g00-policy-passes-everything: EXIT=1 RED ran=True 21:48:56 F
g06-take-not-recorded: EXIT=1 RED ran=True 21:49:12 FAIL acp

m01-ram-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..5ba743f94 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -158,7 +158,7 @@ impl Memory<'_> {
             return No(Refused::Straddles);
         }
         match ty {
-            Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
+            Some(ty) if toyos_bootmap::is_usable_type(ty) => {}
             Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
             Some(_) | None => return No(Refused::MemoryType),

m02-table-write-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..8bbb56ab3 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -159,7 +159,6 @@ impl Memory<'_> {
         }
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
-            Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
             Some(_) | None => return No(Refused::MemoryType),
         }

m03-no-straddle-check

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..3e90e891f 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -154,9 +154,6 @@ impl Memory<'_> {
             return No(Refused::KernelDevice);
         }
         let ty = self.type_of(at);
-        if self.type_of(last) != ty {
-            return No(Refused::Straddles);
-        }
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),

m04-kernel-windows-pass

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..6495d1bf0 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -150,9 +150,6 @@ impl Memory<'_> {
                 _ => return No(Refused::Straddles),
             }
         }
-        if overlaps(at, last, LOCAL_APIC) || self.driven.iter().any(|&window| overlaps(at, last, window)) {
-            return No(Refused::KernelDevice);
-        }
         let ty = self.type_of(at);
         if self.type_of(last) != ty {
             return No(Refused::Straddles);

m05-local-apic-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..14c41ecc9 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -150,7 +150,7 @@ impl Memory<'_> {
                 _ => return No(Refused::Straddles),
             }
         }
-        if overlaps(at, last, LOCAL_APIC) || self.driven.iter().any(|&window| overlaps(at, last, window)) {
+        if self.driven.iter().any(|&window| overlaps(at, last, window)) {
             return No(Refused::KernelDevice);
         }
         let ty = self.type_of(at);

m06-past-the-map-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..bb4826901 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -163,9 +163,6 @@ impl Memory<'_> {
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
             Some(_) | None => return No(Refused::MemoryType),
         }
-        if last >= self.mapped_end {
-            return No(Refused::Unmapped);
-        }
         if write && self.facs.is_some_and(|facs| overlaps(at, last, facs)) {
             return No(Refused::FacsWrite);
         }

m07-mapped-end-off-by-one

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..1a225ef6a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -163,7 +163,7 @@ impl Memory<'_> {
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
             Some(_) | None => return No(Refused::MemoryType),
         }
-        if last >= self.mapped_end {
+        if last > self.mapped_end {
             return No(Refused::Unmapped);
         }
         if write && self.facs.is_some_and(|facs| overlaps(at, last, facs)) {

m08-facs-write-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..ae1888292 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -166,9 +166,6 @@ impl Memory<'_> {
         if last >= self.mapped_end {
             return No(Refused::Unmapped);
         }
-        if write && self.facs.is_some_and(|facs| overlaps(at, last, facs)) {
-            return No(Refused::FacsWrite);
-        }
         MemoryVerdict::Through(MemoryAt { at, width })
     }
 }

m09-ecam-is-plain-memory

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..10e3c4030 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -138,7 +138,7 @@ impl Memory<'_> {
     pub fn decide(&self, at: u64, width: Width, write: bool) -> MemoryVerdict {
         use MemoryVerdict::Refused as No;
         let Some(last) = at.checked_add(width.bytes() - 1) else { return No(Refused::Unmapped) };
-        if let Some(ecam) = self.ecam {
+        if let Some(ecam) = self.ecam.filter(|_| false) {
             match (ecam.holds(at), ecam.holds(last)) {
                 (true, true) => {
                     let offset = at - ecam.base;

m10-other-types-pass

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..099445dc7 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -161,7 +161,8 @@ impl Memory<'_> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
-            Some(_) | None => return No(Refused::MemoryType),
+            Some(_) => {}
+            None => return No(Refused::MemoryType),
         }
         if last >= self.mapped_end {
             return No(Refused::Unmapped);

m11-unlisted-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..37610f8e7 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -161,7 +161,8 @@ impl Memory<'_> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
-            Some(_) | None => return No(Refused::MemoryType),
+            Some(_) => return No(Refused::MemoryType),
+            None => {}
         }
         if last >= self.mapped_end {
             return No(Refused::Unmapped);

m12-overlap-misses-the-last-byte

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..5a3cfe757 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -119,7 +119,7 @@ pub enum MemoryVerdict {
 }
 
 fn overlaps(first: u64, last: u64, (start, end): (u64, u64)) -> bool {
-    first < end && start <= last
+    first < end && start < last
 }
 
 impl Memory<'_> {

m13-kept-port-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..c2a5207c6 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -216,7 +216,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}
             Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
-            Standing::Declared(Mediated::Kept) => return Err(Refused::KernelPort),
+            Standing::Declared(Mediated::Kept) => {}
             Standing::Row => return Err(Refused::ClaimedPort),
         }
     }

m14-read-only-port-written

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..425edb76f 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -215,7 +215,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
         match standing(port) {
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}
-            Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
+            Standing::Declared(Mediated::ReadOnly) => {}
             Standing::Declared(Mediated::Kept) => return Err(Refused::KernelPort),
             Standing::Row => return Err(Refused::ClaimedPort),
         }

m15-row-port-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..5ea8ca39b 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -217,7 +217,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
             Standing::Declared(Mediated::ReadOnly) if !write => {}
             Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
             Standing::Declared(Mediated::Kept) => return Err(Refused::KernelPort),
-            Standing::Row => return Err(Refused::ClaimedPort),
+            Standing::Row => {}
         }
     }
     Ok(PortAt { port, width })

m16-only-the-first-port-asked

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..76fe4cb79 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -211,7 +211,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
     if width == Width::QWord || port as usize + width.bytes() as usize > IO_PORTS {
         return Err(Refused::PortSpan);
     }
-    for port in port..=port + (width.bytes() as u16 - 1) {
+    for port in port..=port {
         match standing(port) {
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}

m17-qword-port-passes

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..1d149eb2c 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -208,7 +208,7 @@ impl PortAt {
 /// Decide an access of `width` at `port`: every port it spans is asked of
 /// `standing`.
 pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write: bool) -> Result<PortAt, Refused> {
-    if width == Width::QWord || port as usize + width.bytes() as usize > IO_PORTS {
+    if port as usize + width.bytes() as usize > IO_PORTS {
         return Err(Refused::PortSpan);
     }
     for port in port..=port + (width.bytes() as u16 - 1) {

m18-header-written

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..057b9b120 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -284,9 +284,6 @@ impl ConfigWrite {
 /// its offset and length.
 pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item = (u8, u8)>) -> Result<ConfigWrite, Refused> {
     let (first, last) = (at.offset, at.offset + (at.width.bytes() as u16 - 1));
-    if first < CONFIG_HEADER {
-        return Err(Refused::ConfigHeader);
-    }
     if last >= CONFIG_EXTENDED {
         return Err(Refused::ConfigExtended);
     }

m19-extended-written

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..f16a999fa 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -287,9 +287,6 @@ pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item
     if first < CONFIG_HEADER {
         return Err(Refused::ConfigHeader);
     }
-    if last >= CONFIG_EXTENDED {
-        return Err(Refused::ConfigExtended);
-    }
     if !free {
         return Err(Refused::ConfigDriven);
     }

m20-driven-function-written

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..35f2b3876 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -290,9 +290,6 @@ pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item
     if last >= CONFIG_EXTENDED {
         return Err(Refused::ConfigExtended);
     }
-    if !free {
-        return Err(Refused::ConfigDriven);
-    }
     for (offset, len) in programmed {
         if first < u16::from(offset) + u16::from(len) && u16::from(offset) <= last {
             return Err(Refused::ConfigCapability);

m21-capability-written

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..d11fc437a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -295,7 +295,7 @@ pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item
     }
     for (offset, len) in programmed {
         if first < u16::from(offset) + u16::from(len) && u16::from(offset) <= last {
-            return Err(Refused::ConfigCapability);
+            continue;
         }
     }
     Ok(ConfigWrite(at))

m22-capability-end-off-by-one

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..3ba765ff2 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -294,7 +294,7 @@ pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item
         return Err(Refused::ConfigDriven);
     }
     for (offset, len) in programmed {
-        if first < u16::from(offset) + u16::from(len) && u16::from(offset) <= last {
+        if first + 1 < u16::from(offset) + u16::from(len) && u16::from(offset) <= last {
             return Err(Refused::ConfigCapability);
         }
     }

m23-any-segment-reached

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..b568d68d7 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -250,7 +250,7 @@ impl ConfigAt {
 /// dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width) -> Result<ConfigAt, Refused> {
     let reached = ecam.is_some_and(|ecam| {
-        ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
+        (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });
     if !reached || function.device > 31 || function.function > 7 {
         return Err(Refused::ConfigUnreachable);

m24-any-bus-reached

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..9e2fd339b 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -250,7 +250,7 @@ impl ConfigAt {
 /// dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width) -> Result<ConfigAt, Refused> {
     let reached = ecam.is_some_and(|ecam| {
-        ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
+        ecam.segment == segment
     });
     if !reached || function.device > 31 || function.function > 7 {
         return Err(Refused::ConfigUnreachable);

m25-config-crosses-a-dword

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..38c99c74a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -256,7 +256,7 @@ pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16,
         return Err(Refused::ConfigUnreachable);
     }
     let bytes = width.bytes() as u16;
-    if width == Width::QWord || offset % 4 + bytes > 4 || offset >= CONFIG_BYTES {
+    if width == Width::QWord || offset >= CONFIG_BYTES {
         return Err(Refused::ConfigSpan);
     }
     Ok(ConfigAt { function, offset, width })

m26-config-past-the-function

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..39683b5f5 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -256,7 +256,7 @@ pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16,
         return Err(Refused::ConfigUnreachable);
     }
     let bytes = width.bytes() as u16;
-    if width == Width::QWord || offset % 4 + bytes > 4 || offset >= CONFIG_BYTES {
+    if width == Width::QWord || offset % 4 + bytes > 4 {
         return Err(Refused::ConfigSpan);
     }
     Ok(ConfigAt { function, offset, width })

m27-ecam-first-bus-ignored

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..fe8cde6d2 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -60,7 +60,7 @@ pub struct Ecam {
 impl Ecam {
     fn holds(&self, at: u64) -> bool {
         // Saturating: the base is firmware's word.
-        let start = self.base.saturating_add(u64::from(self.first_bus) << 20);
+        let start = self.base;
         let end = self.base.saturating_add((u64::from(self.last_bus) + 1) << 20);
         (start..end).contains(&at)
     }

m28-owned-lock-taken

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index db2c08d9f..168b869d1 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -75,7 +75,7 @@ pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
 pub const fn acquire(word: u32) -> (u32, bool) {
     let owned = word & OWNED != 0;
     let new = word & !PENDING | OWNED | if owned { PENDING } else { 0 };
-    (new, !owned)
+    (new, true)
 }
 
 /// §5.2.10.1's `ReleaseGlobalLock`: the word to exchange `word` for, and

m29-pending-never-set

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index db2c08d9f..da294a278 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -74,7 +74,7 @@ pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
 /// the two agree while bits 2 to 7 are zero, as Table 5.16 reserves them.
 pub const fn acquire(word: u32) -> (u32, bool) {
     let owned = word & OWNED != 0;
-    let new = word & !PENDING | OWNED | if owned { PENDING } else { 0 };
+    let new = word & !PENDING | OWNED;
     (new, !owned)
 }

m30-release-never-signals

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index db2c08d9f..5aecb8026 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -82,5 +82,5 @@ pub const fn acquire(word: u32) -> (u32, bool) {
 /// whether the other side asked while the lock was held and is owed the
 /// release's signal.
 pub const fn release(word: u32) -> (u32, bool) {
-    (word & !(PENDING | OWNED), word & PENDING != 0)
+    (word & !(PENDING | OWNED), false)
 }

m31-release-keeps-pending

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index db2c08d9f..b38229bce 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -82,5 +82,5 @@ pub const fn acquire(word: u32) -> (u32, bool) {
 /// whether the other side asked while the lock was held and is owed the
 /// release's signal.
 pub const fn release(word: u32) -> (u32, bool) {
-    (word & !(PENDING | OWNED), word & PENDING != 0)
+    (word & !OWNED, word & PENDING != 0)
 }

m32-narrow-facs-address-wins

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index db2c08d9f..09a42b4f4 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -44,7 +44,7 @@ pub enum FacsRefused {
 /// holds a non-zero one, else `FIRMWARE_CTRL` (Table 5.9).
 pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
     let wide = match fadt.byte(SDT_REVISION) {
-        Some(r) if r >= 2 => fadt.u64_at(FADT_X_FIRMWARE_CTRL).filter(|a| *a != 0),
+        Some(r) if r >= 2 => fadt.u64_at(FADT_X_FIRMWARE_CTRL).filter(|_| false),
         _ => None,
     };
     let base = wide.unwrap_or_else(|| u64::from(fadt.u32_at(FADT_FIRMWARE_CTRL).unwrap_or(0)));

g00-policy-passes-everything

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index fab170718..8ce274949 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -150,6 +150,9 @@ impl Memory<'_> {
                 _ => return No(Refused::Straddles),
             }
         }
+        if true {
+            return MemoryVerdict::Through(MemoryAt { at, width });
+        }
         if overlaps(at, last, LOCAL_APIC) || self.driven.iter().any(|&window| overlaps(at, last, window)) {
             return No(Refused::KernelDevice);
         }
@@ -212,7 +215,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
         return Err(Refused::PortSpan);
     }
     for port in port..=port + (width.bytes() as u16 - 1) {
-        match standing(port) {
+        match { let _ = standing(port); Standing::Free } {
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}
             Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
@@ -284,6 +287,9 @@ impl ConfigWrite {
 /// its offset and length.
 pub fn config_write(at: ConfigAt, free: bool, programmed: impl IntoIterator<Item = (u8, u8)>) -> Result<ConfigWrite, Refused> {
     let (first, last) = (at.offset, at.offset + (at.width.bytes() as u16 - 1));
+    if true {
+        return Ok(ConfigWrite(at));
+    }
     if first < CONFIG_HEADER {
         return Err(Refused::ConfigHeader);
     }

g01-unbound-claim-answers

diff --git a/kernel/src/syscall/device.rs b/kernel/src/syscall/device.rs
index 231a0b1c2..a15612e5b 100644
--- a/kernel/src/syscall/device.rs
+++ b/kernel/src/syscall/device.rs
@@ -131,9 +131,6 @@ pub(super) fn sys_acpi(ctx: &SyscallContext, handle: RawHandle, op: u64, at: u64
         }
         Err(e) => return e.refuse(),
     };
-    if !crate::isa::bound_to(row, process::current_process()) {
-        return SyscallError::PermissionDenied.to_u64();
-    }
     let done = match op {
         ops::ACCESS => ctx.copy_in::<toyos_abi::acpi::Access>(UserAddr::new(at)).and_then(|mut request| {
             crate::arch::acpi_mode::access(row, &mut request)?;

g02-claim-end-keeps-the-lock

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..a4c012e71 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -372,7 +372,6 @@ pub fn release(row: usize) {
     {
         let mut lock = GLOBAL_LOCK.lock();
         lock.claimed = false;
-        give_back(hardware, &mut lock, "its claim is gone");
     }
     if ENABLED.load(Ordering::Relaxed) {
         leave(hardware);

g03-runtime-declarations-unasked

diff --git a/kernel/src/arch/x86_64/pio.rs b/kernel/src/arch/x86_64/pio.rs
index 05b014183..de85c6ba7 100644
--- a/kernel/src/arch/x86_64/pio.rs
+++ b/kernel/src/arch/x86_64/pio.rs
@@ -125,9 +125,6 @@ pub fn standing(port: u16, row: usize) -> Standing {
     if let Some(&(.., mediated)) = FIXED.iter().find(|(_, fixed, _)| fixed.0.overlaps(one)) {
         return Standing::Declared(mediated);
     }
-    if let Some(mediated) = RUNTIME.lock().mediated(port) {
-        return Standing::Declared(mediated);
-    }
     let others = (0..crate::isa::MAX_ROWS).filter(|&other| other != row).filter_map(crate::isa::runs);
     if others.flatten().any(|run| run.overlaps(one)) { Standing::Row } else { Standing::Free }
 }

g04-fixed-declarations-unasked

diff --git a/kernel/src/arch/x86_64/pio.rs b/kernel/src/arch/x86_64/pio.rs
index 05b014183..ab39896a0 100644
--- a/kernel/src/arch/x86_64/pio.rs
+++ b/kernel/src/arch/x86_64/pio.rs
@@ -122,9 +122,6 @@ pub fn holder(ports: Ports) -> Option<&'static str> {
 /// free. Its own row's ports are free: it holds them already.
 pub fn standing(port: u16, row: usize) -> Standing {
     let one = Ports::one(port);
-    if let Some(&(.., mediated)) = FIXED.iter().find(|(_, fixed, _)| fixed.0.overlaps(one)) {
-        return Standing::Declared(mediated);
-    }
     if let Some(mediated) = RUNTIME.lock().mediated(port) {
         return Standing::Declared(mediated);
     }

g06-take-not-recorded

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..aebacfa67 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -490,7 +490,7 @@ pub fn lock_take() -> Result<bool, SyscallError> {
             }
         }
     };
-    lock.held = taken;
+    lock.held = taken && false;
     Ok(taken)
 }

g07-every-function-free

diff --git a/kernel/src/pcidev/mod.rs b/kernel/src/pcidev/mod.rs
index 0bab2120c..15e4d1b03 100644
--- a/kernel/src/pcidev/mod.rs
+++ b/kernel/src/pcidev/mod.rs
@@ -415,7 +415,7 @@ pub fn mediated_standing(bus: u8, dev: u8, func: u8) -> (bool, Vec<(u8, u8)>) {
         let driven = machine.kernel_driven.contains(&who) || machine.resetting.iter().any(|&(reset, ..)| reset == who);
         match machine.functions.iter().find(|pci| requester(pci) == who) {
             Some(pci) if !driven => *pci,
-            _ => return (false, Vec::new()),
+            _ => return (true, Vec::new()),
         }
     };
     if SLOTS.lock().contains(&Slot::Held(who)) {

g08-memory-write-dropped

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..ac29368d4 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -579,7 +579,7 @@ fn write_memory(passed: &MemoryAt, value: u64) {
             Width::Byte => at.as_mut_ptr::<u8>().write_volatile(value as u8),
             Width::Word => at.as_mut_ptr::<Unaligned<u16>>().write_volatile(Unaligned(value as u16)),
             Width::DWord => at.as_mut_ptr::<Unaligned<u32>>().write_volatile(Unaligned(value as u32)),
-            Width::QWord => at.as_mut_ptr::<Unaligned<u64>>().write_volatile(Unaligned(value)),
+            Width::QWord => {}
         }
     }
 }

g10-wide-value-taken

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..458fac23b 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -697,7 +697,7 @@ pub fn access(row: usize, request: &mut Access) -> Result<(), SyscallError> {
     };
     let write = match request.write {
         0 => None,
-        1 if request.value <= width.max_value() => Some(request.value),
+        1 => Some(request.value),
         _ => return Err(SyscallError::InvalidArgument),
     };
     if request.reserved != [0; 3] {

g11-reserved-bytes-unread

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..f2cdc6aa6 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -700,9 +700,6 @@ pub fn access(row: usize, request: &mut Access) -> Result<(), SyscallError> {
         1 if request.value <= width.max_value() => Some(request.value),
         _ => return Err(SyscallError::InvalidArgument),
     };
-    if request.reserved != [0; 3] {
-        return Err(SyscallError::InvalidArgument);
-    }
     request.memory_type = toyos_abi::acpi::UNLISTED;
     let made = match space {
         Space::SystemMemory => memory(hardware, request, width, write),

g12-pending-not-left

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index ea08160cb..b5b9b5f04 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -483,7 +483,7 @@ pub fn lock_take() -> Result<bool, SyscallError> {
             let mut read = word.load(Ordering::Acquire);
             loop {
                 let (new, acquired) = toyos_acpi::acquire(read);
-                match word.compare_exchange(read, new, Ordering::AcqRel, Ordering::Acquire) {
+                match word.compare_exchange(read, if acquired { new } else { read }, Ordering::AcqRel, Ordering::Acquire) {
                     Ok(_) => break acquired,
                     Err(now) => read = now,
                 }

Japabu · 2026-10-07T22:33:50Z

Review round 1 of 27e5cfb6f against origin/main. Read only: no build or test was run for this review.

Net lines, git diff --shortstat origin/main...27e5cfb6f: 33 files, +2122 −50. Production +1278 −49, tests +788 −1, one issue +48.

CI at this head, run 37694294491 on 27e5cfb6f: host pass, toolchain / build pass, guest / suite pass (cargo run -- --ci guest, 31 of 31, acpi_mediated_access PASS in its log).

BLOCKER

toyos-userbound/src/firmware.rs:285, kernel/src/pcidev/mod.rs:411 — the configuration-write arm lets the holder rewrite registers the kernel relies on — mediated_standing calls a function free unless a kernel driver enabled bus mastering on it or a claim holds or held it, so the host bridge, the ISA/LPC bridge, every root port and any IOMMU function are free, and everything from 0x40 to 0xFF outside five capability ids is written for the asking. Three writes the policy passes, by reading:
- The host bridge's ECAM base register. The scout report's own ecam variant has the target machine's host bridge answer the MCFG base at 0x60, and QEMU's q35 host bridge has its ECAM base register at the same offset (the q35 half is from my knowledge of the model, not measured here). Moving or disabling it takes away the window every kernel configuration access goes through.
- The power-management I/O base and its enable on the ISA/LPC bridge of the guest's chipset. Moving the block puts PM1a_CNT and the TCO block on ports nothing declared, where the port policy answers Free: the ReadOnly refusal the body claims for both is bypassed, and the holder writes SLP_EN itself.
- The same bridge's legacy decode enables, which gate COM1 and the i8042 the kernel declared Kept.
The probe's only passing write is the value a register already held, so no test meets any of this. The arm has no measured caller (the scout report: no PCI write anywhere), and kernel/pci/src/caps.rs:16's lengths are, by the body, from memory, held only by a test that restates the table. The smallest fix deletes the arm: every configuration write refused by one name until a machine's AML makes one, which removes config_write, ConfigWrite, mediated_standing, programmed_len and its test, and three Refused variants. That contradicts the orchestrator's ruling that the arm is built, so it is his to re-rule; if the arm stays, it refuses by class every bridge and every function the kernel reads its own configuration from, and the implementer runs the three writes above in the probe as refusals.
kernel/src/arch/x86_64/paging.rs:880, kernel/src/arch/x86_64/ioapic.rs:128 — the record of kernel-driven windows is the byte span the caller asked for, not what the kernel drives — the I/O APIC is recorded as 0x20 bytes, and its EOI register sits at +0x40 of the same page. Where firmware types that page reserved, the holder writes it and clears Remote IRR under the kernel. toyos-userbound/tests/firmware.rs asserts the hole as intended: in a_window_the_kernel_drives_a_device_through_is_refused_inside_any_type, the dword directly after the recorded 0x20 bytes must pass, under "the bytes either side of each window are the firmware's". Record whole pages at least.
toyos-userbound/src/firmware.rs:153 — another process's device is reachable where firmware types its BAR's range reserved — a BAR a claim's holder maps (sys_device_bar_map) never passes through map_mmio, so it is not in the record, and reserved memory passes both ways. The kernel already keeps every decoded BAR (pcidev's Machine::decoded and windows); the policy does not read them. The filed issue names I/O BARs and not this. Which types the metal machine's BAR ranges carry is one read of a boot log the tree's rows already capture; the branch guessed instead.
kernel/src/arch/x86_64/acpi_mode.rs:241, toyos-acpi/src/facs.rs — a broken or hostile FADT can aim the compare-exchange at RAM — the kernel types only the FACS's first byte, and the decoder accepts any base aligned to four where §5.2.10 says 64. A base within 20 bytes of the end of a firmware-typed range that is followed by RAM puts the lock word, at +16, in memory the allocator hands out; lock_word's safety comment claims otherwise. Require the 64-byte alignment, or type the word's own last byte. No test holds either: m32 covers which address field wins, nothing covers where the word lands.
kernel/src/arch/x86_64/acpi_mode.rs:693, kernel/src/arch/x86_64/pio.rs:132 — a mediated access races the power-off — lock_take and smi_cmd_write refuse once quiesce::begun(), and settle waits each out; access checks nothing and nothing waits for it. A thread already inside SYS_ACPI finishes its access after pio::take_back, and standing answers the holder's own row Free, so a write to its PM1 or GPE enable can land between acpi_mode::quiet and SLP_EN. The module header's own rule for SMI_CMD (waited out, then the power-off owns the hardware) is not kept for the surface this change adds.
Three claims the change makes that no test can fail on, each a mutation that stays green; the implementer runs them. The body admits all three as reached by no tier.
- kernel/src/arch/x86_64/paging.rs:883 — delete driven.push((phys, phys + size)). acpi_mediated_access accepts KernelDevice | MemoryType for the I/O APIC and the HPET and the guest's map lists neither, so it must turn red and will not.
- kernel/src/arch/x86_64/acpi_mode.rs:529 — delete the outw that writes GBL_RLS. The log line says "told by GBL_RLS" either way.
- kernel/src/arch/x86_64/pio.rs:132 — answer Standing::Free where another row names the port. Only the pure policy's ClaimedPort arm is tested, never the kernel's answer that feeds it.
Evidence missing at this head.
- No reading from hardware. The change exists for a real machine's firmware memory, and three things rest on that machine alone: that firmware-typed memory reads correctly through the direct map's write-back leaves with the MTRRs deciding, which UEFI types its AML's addresses carry, and that main.rs's new assertion on the firmware map's own region holds for the map its loader hands over. QEMU is not that machine.
- The body's gate table says the guest suite was not run and gives the probe at another tree; CI's run above is the measurement at this head, and the body does not carry it.
toyos-abi/src/syscall.rs (SYS_ACPI), kernel/src/syscall/device.rs:120 — the syscall ships for a test alone — its only caller is the guest probe. It does not land by itself: it lands in the same merge as the server half, whose metal row is also the hardware reading item 7 asks for. The body says as much ("with, or directly before"); "directly before" leaves main holding a security-boundary syscall nothing but a test calls.

NOTE

kernel/src/arch/x86_64/acpi_mode.rs:651 — the verdict is taken under the windows' lock and the access made after it is dropped, and mediated_standing's answer is likewise stale by the write. Neither gains the holder anything it did not have a moment earlier, but one lock held across verdict and access closes both, and item 5 with them.
The departure from the design on firmware memory stands by reading: paging::init maps every 2 MiB page below the direct map's end whatever its type, guard_4k removes pages only from memory the kernel owns, and past the end is refused. Its one open claim is the hardware reading in item 7.
Withholding the loader's copy of the firmware map stands by reading: on main, pcidev::publish reads maps after mm::init, and reserved did not hold it.
issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md — true as far as it goes, with an owner and an exit. It omits what items 1 and 3 found (a memory BAR another claim maps, and a base register whose move takes a kernel-declared port out of its declaration), and that an undeclared port with a firmware I/O trap is an unbounded stay in SMM the kernel neither bounds nor counts.
kernel/src/arch/x86_64/acpi_mode.rs:172 — on a machine whose FADT names no SMI_CMD, nothing is declared, and the chipset's software-SMI port is a free port the holder writes. The ruling refuses the write by name only where the FADT names the port.
kernel/src/arch/x86_64/paging.rs:868 — the record only grows and matches on the exact pair; bounded today by the callers, with nothing saying so.

SEND BACK

…BAR refused, the lock word typed, the stop obeyed - Every configuration write is refused by one name, `ConfigWrite`. The allow arm, `ConfigWrite` the witness, `pcidev::mediated_standing`, `caps::programmed_len` and four refusal names go: no path of the measured tables writes configuration space, and the arm let a holder move the ECAM base and the power-management block. - A device's memory is refused by the page: each window `map_mmio` made and each memory BAR `pcidev` keeps, where firmware put it and where a claim moved it, grown to the 4 KiB pages it lies in. `KernelDevice` becomes `DeviceMemory`. - The FACS is held to §5.2.10's 64-byte boundary, and the lock word is exchanged only through a witness the policy answers where all four of its bytes are in ACPI NVS or reserved memory. - One lock, `HOLDER`, is held from the decision to the last instruction of every access and every lock exchange, refuses each once the stop has begun, and is taken by `settle` before the power-off owns the hardware. - The probe turns red on a window nobody recorded, a BAR nobody fed the policy, another row's port answered free and a release that wrote no `GBL_RLS`; it boots with the i8042 withheld so that row is a claim's. - The `acpi_server_death` row reads where the machine's lock word is. - The issue records what the review found the surface still passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-07T23:18:12Z

Round 2's mutations at 377153444, as patches. None has been built or run: this machine's compute is reserved. Each passes git apply --check at that head, and each names the test it must turn red. The first three are review round 1's item 6.

m1-window-not-recorded — must red acpi_mediated_access, at "acpi: 0xfec00000 was read" (answers MemoryType). Unrun.

diff --git a/kernel/src/arch/x86_64/paging.rs b/kernel/src/arch/x86_64/paging.rs
index 38525436e..6b2e4a77d 100644
--- a/kernel/src/arch/x86_64/paging.rs
+++ b/kernel/src/arch/x86_64/paging.rs
@@ -883,9 +883,7 @@ pub fn map_mmio(phys: u64, size: u64, policy: MmioPolicy) -> crate::mm::Mmio {
     let mmio = kernel().lock().map_mmio(phys, size, policy.cache());
     {
         let mut driven = DRIVEN.lock();
-        if !driven.contains(&(phys, phys + size)) {
-            driven.push((phys, phys + size));
-        }
+        let _ = &mut driven;
     }
     crate::arch::tlb::shootdown(crate::invalidation::Origin::Mmio);
     // Read back off the table and logged beside firmware's MTRR verdict: the

m2-no-gbl-rls — must red acpi_mediated_access, at "a release the firmware had asked for wrote no GBL_RLS". Unrun.

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index aea86e0eb..dfdf9935b 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -554,7 +554,7 @@ fn give_back(hardware: &Hardware, holder: &mut Holder, orphaned: &str) {
             let control = hardware.control.port(0);
             // SAFETY: the PM1a control block, declared; `GBL_RLS` over the
             // register as it reads, whose `SLP_EN` reads clear (§4.8.3.2).
-            unsafe { cpu::outw(control, cpu::inw(control) | GBL_RLS) };
+            let _ = (control, GBL_RLS);
         }
         signal
     });

m3-another-rows-port-is-free — must red acpi_mediated_access, at "acpi: port 0x60 was read". Unrun.

diff --git a/kernel/src/arch/x86_64/pio.rs b/kernel/src/arch/x86_64/pio.rs
index 05b014183..f43523109 100644
--- a/kernel/src/arch/x86_64/pio.rs
+++ b/kernel/src/arch/x86_64/pio.rs
@@ -129,7 +129,8 @@ pub fn standing(port: u16, row: usize) -> Standing {
         return Standing::Declared(mediated);
     }
     let others = (0..crate::isa::MAX_ROWS).filter(|&other| other != row).filter_map(crate::isa::runs);
-    if others.flatten().any(|run| run.overlaps(one)) { Standing::Row } else { Standing::Free }
+    let _ = others.flatten().any(|run| run.overlaps(one));
+    Standing::Free
 }
 
 /// The port an access the mediation policy passed begins at.

m4-no-bar-fed-to-the-policy — must red acpi_mediated_access, at "a function's BAR at ... was read". Unrun.

diff --git a/kernel/src/pcidev/mod.rs b/kernel/src/pcidev/mod.rs
index 175f9a494..930481e52 100644
--- a/kernel/src/pcidev/mod.rs
+++ b/kernel/src/pcidev/mod.rs
@@ -413,7 +413,8 @@ pub fn with_bar_memory<T>(f: impl FnOnce(&mut dyn Iterator<Item = (u64, u64)>) -
     let machine = MACHINE.lock();
     let firmware = machine.decoded.iter().map(|&(_, start, end)| (start, end));
     let cut = machine.windows.iter().map(|&(_, _, at, span)| (at, at.saturating_add(span)));
-    f(&mut firmware.chain(cut))
+    let _ = firmware.chain(cut);
+    f(&mut core::iter::empty())
 }
 
 /// The PCI segment group every enumerated function is on.

m5-eoi-page-not-rounded — must red toyos-userbound/tests/firmware.rs, every_page_a_window_the_kernel_drives_lies_in_is_refused_inside_any_type; and the probe at 0xfec00040. Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..c2e7e4813 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -126,7 +126,8 @@ fn overlaps(first: u64, last: u64, (start, end): (u64, u64)) -> bool {
 /// driven through its first 0x20 bytes, and a chipset's keeps an EOI register
 /// further into the same page.
 fn pages((start, end): (u64, u64)) -> (u64, u64) {
-    (start & !(PAGE_4K - 1), end.saturating_add(PAGE_4K - 1) & !(PAGE_4K - 1))
+    let _ = PAGE_4K;
+    (start, end)
 }
 
 /// The UEFI type of the range of `map` holding `at`, or `None` where it lists

m6-facs-aligned-to-four — must red toyos-acpi/tests/facs.rs, a_facs_off_its_sixty_four_byte_boundary_is_refused. Unrun.

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index 23f2ccf1f..9dd3b65dc 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -52,7 +52,7 @@ pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
     if base == 0 {
         return Err(FacsRefused::Absent);
     }
-    if !base.is_multiple_of(FACS_ALIGN) {
+    if !base.is_multiple_of(FACS_ALIGN / 16) {
         return Err(FacsRefused::Misaligned(base));
     }
     if !phys.readable(base, FACS_MIN_LEN as usize) {

m7-lock-word-typed-by-its-first-byte — must red toyos-userbound/tests/firmware.rs, the_lock_word_is_exchanged_only_where_all_four_bytes_are_the_firmwares_own. Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..6085dfa6a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -219,7 +219,7 @@ pub fn lock_word(map: &[MemoryMapEntry], mapped_end: u64, at: u64) -> Result<Loc
     }
     // No overflow: `at` is on a dword boundary.
     let last = at + 3;
-    for byte in at..=last {
+    for byte in at..=at {
         match type_of(map, byte) {
             Some(EFI_RESERVED | EFI_ACPI_NVS) => {}
             other => return Err(NoLockWord::Type(other)),

m8-config-write-passes — must red toyos-userbound/tests/firmware.rs, every_configuration_write_is_refused_by_one_name; and the probe at "0x4 by address". Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..22a5cf752 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -315,9 +315,7 @@ impl ConfigAt {
 /// its shape: a function the window reaches, and at most a dword that crosses
 /// no dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width, write: bool) -> Result<ConfigAt, Refused> {
-    if write {
-        return Err(Refused::ConfigWrite);
-    }
+    let _ = write;
     let reached = ecam.is_some_and(|ecam| {
         ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });

Japabu · 2026-10-07T23:20:03Z

T14 at 377153444, run by the orchestrator: one unattended boot of the staged acpicase image (rc=0; the worktree clean at the head), judged --metal --metal-readback … acpi_server_death → EXIT=0, [metal] 1 passed, 0 failed, 1 boot(s). The judge at this head requires the kernel's line placing the lock word in firmware-typed memory, so the boot read main.rs's assertion on the firmware map and a read of firmware memory through the direct map on the real machine; it does not call SYS_ACPI, whose probe cannot run there.

`Memory::decide` takes the record of device memory by value, and one test called it twice on the same value: CI's host step did not compile it, so no workspace test ran at 3771534. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…s's branch - toyos-abi/src/acpi.rs: `AcpiInfo`, with this branch's `rsdp` and `reserved`, and `Access` are declared through `user_safe!`; their hand size assertions and `as_bytes` go with main's. - kernel/src/user_ptr.rs: main's side whole; the hand impl for `Access` goes with every other. - kernel/src/arch/x86_64/acpi_mode.rs: main's `smi_cmd` owns the port, its lock and its declaration; `settle` here keeps the holder's half alone. - kernel/src/arch/x86_64/smi_cmd.rs: the declaration says `ReadOnly`, the argument this branch made `pio::declare` require. - kernel/src/arch/x86_64/power.rs: the power-off calls both settles. The merge had taken main's line, which replaced the call this branch's wait hangs off, without a conflict. - tests/toyos.rs: `acpi_death_on_metal` reads main's line shape and its boot-processor judgement, and this branch's lock-word line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T00:36:11Z

T14 at the merged head 18cf656e1, run by the orchestrator: one unattended boot of the staged acpicase image (rc=0; the worktree clean at the head), judged --metal --metal-readback … acpi_server_death → EXIT=0, [metal] 1 passed, 0 failed, 1 boot(s). The judge reads #748's two lines and this branch's lock-word line: the enable was written on cpu0, asked from cpu1 (held 2109501 ns, SMI count 4819 to 4820); the disable on cpu0, asked from cpu2 (held 144729 ns), SCI_EN clear after.

Japabu · 2026-10-08T01:05:50Z

Review round 2 of 18cf656e1 against origin/main (8506640f1). Read only: no build, test or cargo command was run for this review, and none of this round's code has been seen red by anyone.

Net lines, git diff --shortstat origin/main...18cf656e1: 33 files, +2338 −49. Production +1290 −46, lockfiles +8, tests +962 −3, one issue +78. The production growth over round 1 is the lock word's policy, the BAR record's reader and the one lock, each an answer to a round-1 item; accepted.

CI at this head, run 37708432612 on 18cf656e1: host success (Host: 78 step(s), all green; tests/firmware.rs and tests/facs.rs ran, the four new tests ... ok), toolchain / build success, guest / suite success (PASS acpi_mediated_access (3s)). One boot of the metal test machine at this head, acpi_server_death EXIT=0, which calls no SYS_ACPI.

Round 1's BLOCKERs

CLOSED. The write arm is gone: firmware::config refuses a write before anything else, the kernel's config has no write path, and config_write, ConfigWrite, mediated_standing and programmed_len are deleted. every_configuration_write_is_refused_by_one_name green in CI's host log; the probe's twelve writes green in the guest run.
CLOSED. firmware::pages grows every device range to its 4 KiB pages; the test that asserted the hole asserts the refusal at the dword after the mapped bytes, the EOI register and the page's last byte, green in CI. The kernel maps the whole 256-bus ECAM span, so what a narrower MCFG leaves outside the policy's window is refused as a device's too.
CLOSED. The policy reads pcidev's decoded and windows under MACHINE; the body carries the read of the metal machine's boot log that round 1 asked for instead of a guess. a_memory_bar_is_refused_where_firmware_types_its_range_as_its_own green in CI; the probe's BAR read green.
CLOSED. The decoder requires the 64-byte boundary and firmware::lock_word types all four bytes and bounds the last by the direct map; lock_word's only maker of the AtomicU32 takes the witness. Both tests green in CI.
CLOSED, by reading only. Every access and both lock exchanges run under HOLDER from acting(), which refuses once quiesce::begun(); power::off holds a Stopping before acpi_mode::settle takes the same lock, so an access in flight is waited out and none follows. The syscall's bound_to check sits outside the lock and cannot go stale against it: isa::claim_row mints nothing while a process is bound, and a binding ends only when every thread has left. No measurement stands behind this item; see the new BLOCKER.
OPEN. The three mutations now each have an assertion that names them, and five ride with them; none of the eight was run. By reading, each turns its named test red:
- m1 (no window recorded): the I/O APIC's page answers MemoryType, not DeviceMemory; the probe's device loop fails at its second address.
- m2 (no GBL_RLS): told reads 0 after the release; the green run shows this guest's model keeps the bit, so the assertion can fail.
- m3 (another row's port free): the read of the i8042's data port is made and answers Ok, not ClaimedPort; the judge requires the withheld line, so the row is a claim's.
- m4 (no BAR fed): the network card's BAR answers MemoryType.
- m5 (no page rounding): refused panics at the dword after the mapped bytes.
- m6 (aligned to four): the 4-off base decodes Ok.
- m7 (first byte typed): the range that ends one byte short of the word answers Ok.
- m8 (write passes): config answers Ok; in the probe the kernel then reads and answers Ok(()).
  I found no new test that passes with its defect present. The item closes on the implementer's run of the eight, exit code and failing assertion each, and on the negative control of the whole change at the head that lands; reading is not that measurement.
OPEN.
- No reading through SYS_ACPI from hardware. The boot at this head read main.rs's assertion on the firmware map's own region, one read of firmware memory through the direct map, and the lock word's type against the real map; that is three of the things this item named and not the mediated access. By ruling it closes with the server half's metal row.
- The body at this head says CI has not run the new host tests at any head and tabulates no run at 18cf656e1. The run above is the measurement; the body does not carry it.
OPEN, by ruling. At this head SYS_ACPI's only caller is the guest probe. It closes when the server half is in the same diff.

BLOCKER

kernel/src/arch/x86_64/power.rs:174 — nothing fails when the power-off stops settling the holder — the line was lost once already, by a clean merge hunk, with every check green; only the implementer's reading caught it. The patch that must turn a test red and turns none:
```
--- a/kernel/src/arch/x86_64/power.rs
+++ b/kernel/src/arch/x86_64/power.rs
@@ -171,7 +171,6 @@ pub fn off(stopping: crate::quiesce::Stopping) -> ! {
     let control = control.port(0);
     let taken = pio::take_back(&stopping);
     super::smi_cmd::settle(&taken);
-    super::acpi_mode::settle(&taken);
     let held = cpu::inw(control);
```
The wait on an access in flight has no tier without an actuator, and the guard's type holds it. The other half of settle has one: a holder that takes the Global Lock and is alive at the power-off must leave acpi: the Global Lock given back for a holder that left it taken (the machine is stopping) in the log, and no judge reads that line (tests/toyos.rs:1731 reads only the claim's-end form). A stop parks threads and ends no process, so a job on tests/acpicase that binds the claim, takes the lock and asks for the power-off reaches it, as stop_short reaches quiet. The implementer adds that judgement and runs the patch above against it.

NOTE

kernel/src/arch/x86_64/acpi_mode.rs:483 — a FACS the FADT names and the kernel refuses (off its boundary, wrong signature, a lock word in memory of the wrong type) answers every take TAKEN, as a machine with no FACS does — the holder is told it holds a lock that excludes nothing, and the boundary rule added this round widens that case. Answer taken only for FacsRefused::Absent, and a refusal by name for the rest.
kernel/src/pcidev/mod.rs:415 — the windows half of the BAR record cannot overlap memory the policy passes: publish seeds taken with every range of firmware's map, so a window is cut only at addresses the map does not list, which already answer MemoryType. Round 1 asked for it; by reading it changes only the refusal's name. Keep it for the name or delete it and its host case, and say which.
The body: "CI has not run the host tests this branch adds, at any head", "What CI must show", and "that image has not been booted" are false of the record since run 37708432612 and the boot at this head.

What the server half has to read on the metal machine

A value read through SYS_ACPI from ACPI NVS and from reserved memory, held against an independent reading of the same bytes: that firmware memory reads correctly through the direct map's write-back leaves with the range registers deciding.
The UEFI type of every address its tables touch at load and across the initialisation and query methods, from the refusal ledger: every refusal in it ruled, and none Unmapped, since most of that machine's device memory lies past the direct map's end and an operation region there would mean a window has to be mapped after all.
The configuration reads its load makes, through the real ECAM window.
What the refused write to SMI_CMD breaks in the methods that make it.
The Global Lock against real firmware: one take and one release on the real word, and a release that owes the signal. The guest's assertion rests on a model that keeps GBL_RLS as written; a chipset reads it back clear, so the hardware evidence is the SMI count either side of the write.
A port access that traps into SMM, made under the mediation's lock: how long it held the CPU, as smi_cmd reports its own.
The power-off with the server alive and holding the lock: the lock given back, the events quieted, and S5 taken.
The server killed mid-load: the lock given back and legacy mode again.

SEND BACK

…s, and evaluates \_S5 The server half of slice S1, on the kernel half's branch. toyos-acpi: definition_blocks walks the DSDT the FADT names and then every SSDT the XSDT lists, in order, each validated or answered as its refusal. acpiserver: after arming, so a press during the load latches, the server fetches every definition block through SYS_ACPI into its own memory (tables.rs), loads each with toyos_aml (aml.rs) through a Host over the same access (host.rs), and evaluates \_S5. Nothing is written: a write in any space and every access to the embedded controller's space are denied by name. The Global Lock is the kernel's to exchange; a take that finds the firmware holding it waits for GBL_STS with every other event disabled, for at most 10 s an evaluation. A refused SSDT is said and the load goes on; a refused DSDT leaves no namespace and the power button served (the owner's ruling: "Go on, say it loudly"). A line anyone may quote carries the address space, the kernel's name for the refusal, the memory type and counts; what the firmware chose goes on a line of its own. toyos-aml: the two refusals of a bridge's registers are Error::Bridge, carrying the function, its Header Type and its Secondary Bus Number. toyos: AcpiDev gains access, lock_take and lock_release. Review round 2 of the kernel half: - the probe ends by taking the Global Lock and asking for the power-off, and acpi_mediated_access reads the kernel's "(the machine is stopping)" line: what fails when the power-off stops settling the holder; - a FACS the kernel refuses answers a take NotSupported, and only an absent one answers taken; - the BAR record keeps firmware's half: a window pcidev cuts is only ever at an address firmware's map does not list, which is refused by that. Tests: the iterator on QEMU's fixtures, on crafted tables and under the corpus's single-byte mutations; the host, the fetch, the ledger and the load against a scripted kernel, QEMU's own tables among them; acpi_power_button reads the DSDT's load line and \_S5 beside the kernel's decode; the metal row acpi_tables_loaded reads the same on the T14 with the load's counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T01:27:04Z

Mutations at 4284062c1, as patches. None has been built or run: this machine's compute is reserved by the owner. Each passes git apply --check at that head, made by editing the tree, taking git diff and restoring it (git status --porcelain empty after). Each names the test it must turn red, by reading. m1 to m8 are review round 2's, m4 restated because the function it patches changed; k1 is that review's own patch; g00 is the negative control.

No patch here reaches the take a refused FACS answers NotSupported, nor Claim::released's port sequence: no test does either, and the body says so.

g00-policy-passes-everything — must red the negative control: acpi_mediated_access, at "acpi: RAM was read". Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..00b36a701 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -156,6 +156,9 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
                 _ => return No(Refused::Straddles),
             }
         }
+        if true {
+            return MemoryVerdict::Through(MemoryAt { at, width });
+        }
         if overlaps(at, last, LOCAL_APIC) || self.devices.into_iter().any(|device| overlaps(at, last, pages(device))) {
             return No(Refused::DeviceMemory);
         }
@@ -270,7 +273,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
         return Err(Refused::PortSpan);
     }
     for port in port..=port + (width.bytes() as u16 - 1) {
-        match standing(port) {
+        match { let _ = standing(port); Standing::Free } {
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}
             Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
@@ -315,9 +318,7 @@ impl ConfigAt {
 /// its shape: a function the window reaches, and at most a dword that crosses
 /// no dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width, write: bool) -> Result<ConfigAt, Refused> {
-    if write {
-        return Err(Refused::ConfigWrite);
-    }
+    let _ = write;
     let reached = ecam.is_some_and(|ecam| {
         ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });

k1-the-power-off-does-not-settle-the-holder — must red review round 2's patch: acpi_mediated_access, which never reads the kernel's "(the machine is stopping)" line. Unrun.

diff --git a/kernel/src/arch/x86_64/power.rs b/kernel/src/arch/x86_64/power.rs
index 0eed43f94..ba48c92b6 100644
--- a/kernel/src/arch/x86_64/power.rs
+++ b/kernel/src/arch/x86_64/power.rs
@@ -171,7 +171,6 @@ pub fn off(stopping: crate::quiesce::Stopping) -> ! {
     let control = control.port(0);
     let taken = pio::take_back(&stopping);
     super::smi_cmd::settle(&taken);
-    super::acpi_mode::settle(&taken);
     let held = cpu::inw(control);
     if held & SCI_EN != 0 {
         super::acpi_mode::quiet(&taken);

k2-a-stop-leaves-the-lock-taken — must red acpi_mediated_access, the same line. Unrun.

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index 078444cfd..6263c37c9 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -173,7 +173,7 @@ static ENABLED: AtomicBool = AtomicBool::new(false);
 pub fn settle(_taken: &TakenBack) {
     let mut holder = HOLDER.lock();
     if let Some(hardware) = hardware() {
-        give_back(hardware, &mut holder, "the machine is stopping");
+        let _ = (hardware, &mut holder);
     }
 }

m1-window-not-recorded — must red acpi_mediated_access, at "acpi: 0xfec00000 was read". Unrun.

diff --git a/kernel/src/arch/x86_64/paging.rs b/kernel/src/arch/x86_64/paging.rs
index 38525436e..6b2e4a77d 100644
--- a/kernel/src/arch/x86_64/paging.rs
+++ b/kernel/src/arch/x86_64/paging.rs
@@ -883,9 +883,7 @@ pub fn map_mmio(phys: u64, size: u64, policy: MmioPolicy) -> crate::mm::Mmio {
     let mmio = kernel().lock().map_mmio(phys, size, policy.cache());
     {
         let mut driven = DRIVEN.lock();
-        if !driven.contains(&(phys, phys + size)) {
-            driven.push((phys, phys + size));
-        }
+        let _ = &mut driven;
     }
     crate::arch::tlb::shootdown(crate::invalidation::Origin::Mmio);
     // Read back off the table and logged beside firmware's MTRR verdict: the

m2-no-gbl-rls — must red acpi_mediated_access, at "a release the firmware had asked for wrote no GBL_RLS". Unrun.

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index aea86e0eb..dfdf9935b 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -554,7 +554,7 @@ fn give_back(hardware: &Hardware, holder: &mut Holder, orphaned: &str) {
             let control = hardware.control.port(0);
             // SAFETY: the PM1a control block, declared; `GBL_RLS` over the
             // register as it reads, whose `SLP_EN` reads clear (§4.8.3.2).
-            unsafe { cpu::outw(control, cpu::inw(control) | GBL_RLS) };
+            let _ = (control, GBL_RLS);
         }
         signal
     });

m3-another-rows-port-is-free — must red acpi_mediated_access, at "acpi: port 0x60 was read". Unrun.

diff --git a/kernel/src/arch/x86_64/pio.rs b/kernel/src/arch/x86_64/pio.rs
index 05b014183..f43523109 100644
--- a/kernel/src/arch/x86_64/pio.rs
+++ b/kernel/src/arch/x86_64/pio.rs
@@ -129,7 +129,8 @@ pub fn standing(port: u16, row: usize) -> Standing {
         return Standing::Declared(mediated);
     }
     let others = (0..crate::isa::MAX_ROWS).filter(|&other| other != row).filter_map(crate::isa::runs);
-    if others.flatten().any(|run| run.overlaps(one)) { Standing::Row } else { Standing::Free }
+    let _ = others.flatten().any(|run| run.overlaps(one));
+    Standing::Free
 }
 
 /// The port an access the mediation policy passed begins at.

m4-no-bar-fed-to-the-policy — must red restated at this head: acpi_mediated_access, at "a function's BAR at ... was read". Unrun.

diff --git a/kernel/src/pcidev/mod.rs b/kernel/src/pcidev/mod.rs
index c0ab7cba7..8a52a1e13 100644
--- a/kernel/src/pcidev/mod.rs
+++ b/kernel/src/pcidev/mod.rs
@@ -412,7 +412,8 @@ pub fn inventory() -> Vec<toyos_abi::inventory::Pci> {
 /// windows inside it, and nothing holding that record's lock takes this one.
 pub fn with_bar_memory<T>(f: impl FnOnce(&mut dyn Iterator<Item = (u64, u64)>) -> T) -> T {
     let machine = MACHINE.lock();
-    f(&mut machine.decoded.iter().map(|&(_, start, end)| (start, end)))
+    let _ = &machine;
+    f(&mut core::iter::empty())
 }
 
 /// The PCI segment group every enumerated function is on.

m5-eoi-page-not-rounded — must red toyos-userbound/tests/firmware.rs, every_page_a_window_the_kernel_drives_lies_in_is_refused_inside_any_type. Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..c2e7e4813 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -126,7 +126,8 @@ fn overlaps(first: u64, last: u64, (start, end): (u64, u64)) -> bool {
 /// driven through its first 0x20 bytes, and a chipset's keeps an EOI register
 /// further into the same page.
 fn pages((start, end): (u64, u64)) -> (u64, u64) {
-    (start & !(PAGE_4K - 1), end.saturating_add(PAGE_4K - 1) & !(PAGE_4K - 1))
+    let _ = PAGE_4K;
+    (start, end)
 }
 
 /// The UEFI type of the range of `map` holding `at`, or `None` where it lists

m6-facs-aligned-to-four — must red toyos-acpi/tests/facs.rs, a_facs_off_its_sixty_four_byte_boundary_is_refused. Unrun.

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index 23f2ccf1f..9dd3b65dc 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -52,7 +52,7 @@ pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
     if base == 0 {
         return Err(FacsRefused::Absent);
     }
-    if !base.is_multiple_of(FACS_ALIGN) {
+    if !base.is_multiple_of(FACS_ALIGN / 16) {
         return Err(FacsRefused::Misaligned(base));
     }
     if !phys.readable(base, FACS_MIN_LEN as usize) {

m7-lock-word-typed-by-its-first-byte — must red toyos-userbound/tests/firmware.rs, the_lock_word_is_exchanged_only_where_all_four_bytes_are_the_firmwares_own. Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..6085dfa6a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -219,7 +219,7 @@ pub fn lock_word(map: &[MemoryMapEntry], mapped_end: u64, at: u64) -> Result<Loc
     }
     // No overflow: `at` is on a dword boundary.
     let last = at + 3;
-    for byte in at..=last {
+    for byte in at..=at {
         match type_of(map, byte) {
             Some(EFI_RESERVED | EFI_ACPI_NVS) => {}
             other => return Err(NoLockWord::Type(other)),

m8-config-write-passes — must red toyos-userbound/tests/firmware.rs, every_configuration_write_is_refused_by_one_name. Unrun.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..22a5cf752 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -315,9 +315,7 @@ impl ConfigAt {
 /// its shape: a function the window reaches, and at most a dword that crosses
 /// no dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width, write: bool) -> Result<ConfigAt, Refused> {
-    if write {
-        return Err(Refused::ConfigWrite);
-    }
+    let _ = write;
     let reached = ecam.is_some_and(|ecam| {
         ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });

s1-a-write-is-passed-to-the-kernel — must red acpiserver, nothing_is_written_and_the_controllers_space_is_not_reached (the stand-in's own assertion that it is asked for no write). Unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..2b8821a36 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -236,6 +236,10 @@ impl<K: Kernel> Host for Firmware<'_, K> {
             Address::PciConfig { .. } => "a write to PCI_Config: this server writes nothing for AML yet".into(),
             Address::EmbeddedControl(_) => format!("a write to {NO_CONTROLLER}"),
         };
+        if let Address::Memory(address) = at {
+            let _ = self.kernel.access(Access::write(Space::SystemMemory, address, wide(width), value));
+            return Ok(());
+        }
         Err(self.deny(what, format_args!("{width:?} {value:#x} to {at:x?}")))
     }

s2-the-controllers-space-reads-all-ones — must red acpiserver, nothing_is_written_and_the_controllers_space_is_not_reached. Unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..628af2529 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -214,7 +214,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
             Address::Memory(address) => (Space::SystemMemory, address),
             Address::Io(port) => (Space::SystemIo, u64::from(port)),
             Address::PciConfig { segment, bus, device, function, offset } => (Space::PciConfig, pci_address(segment, bus, device, function, offset)),
-            Address::EmbeddedControl(_) => return Err(self.deny(format!("a read of {NO_CONTROLLER}"), format_args!("{at:x?}"))),
+            Address::EmbeddedControl(_) => return Ok(0xFF),
         };
         match read(self.kernel, space, address, wide(width)) {
             Ok((value, memory_type)) => {

s3-a-refused-read-answers-zero — must red acpiserver, a_read_the_kernel_refuses_is_denied_under_the_kernels_name_and_counted. Unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..75750633c 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -225,7 +225,10 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                 Ok(value)
             }
             Err(Refusal::Stopping) => Err(self.stopped()),
-            Err(refusal) => Err(self.deny(refusal.to_string(), format_args!("{width:?} at {at:x?}"))),
+            Err(refusal) => {
+                let _ = self.deny(refusal.to_string(), format_args!("{width:?} at {at:x?}"));
+                Ok(0)
+            }
         }
     }

s4-a-pending-lock-is-reported-taken — must red acpiserver, a_lock_the_firmware_holds_is_waited_for_and_taken_again. Unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..846f6cc6b 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -276,7 +276,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                 Ok(Take::Unusable) => {
                     return Err(self.deny("the Global Lock: the kernel exchanges no lock word in this machine's FACS".into(), format_args!("a take")))
                 }
-                Ok(Take::Pending) => {}
+                Ok(Take::Pending) => return Ok(()),
             }
             if !found_held {
                 found_held = true;

s5-the-lock-wait-is-not-spent — must red acpiserver, a_lock_the_firmware_keeps_past_the_wait_is_denied_by_name. Unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..d08a5d66f 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -290,7 +290,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                     format_args!("a take the firmware was left the request for"),
                 ));
             };
-            self.lock_wait = self.lock_wait.saturating_sub(waited);
+            let _ = waited;
         }
     }
 }

s6-a-fetch-reads-whole-qwords — must red acpiserver, a_range_is_fetched_whole_in_qwords_and_then_bytes_and_kept. Unrun.

diff --git a/userland/acpiserver/src/tables.rs b/userland/acpiserver/src/tables.rs
index a4e1180bd..3a2da0142 100644
--- a/userland/acpiserver/src/tables.rs
+++ b/userland/acpiserver/src/tables.rs
@@ -45,12 +45,12 @@ impl<'k, K: Kernel> Tables<'k, K> {
     fn fetch(&self, phys: u64, len: usize) -> Result<Vec<u8>, Refusal> {
         let mut bytes = Vec::with_capacity(len);
         while bytes.len() < len {
-            let width = if len - bytes.len() >= 8 { Width::QWord } else { Width::Byte };
+            let width = Width::QWord;
             let at = phys + bytes.len() as u64;
             let (value, memory_type) = host::read(self.kernel, Space::SystemMemory, at, width)?;
             self.reads.set(self.reads.get() + 1);
             self.pages.borrow_mut().read(at, memory_type);
-            bytes.extend_from_slice(&value.to_le_bytes()[..width.bytes() as usize]);
+            bytes.extend_from_slice(&value.to_le_bytes()[..(width.bytes() as usize).min(len - bytes.len())]);
         }
         Ok(bytes)
     }

s7-ssdts-load-onto-a-refused-dsdt — must red acpiserver, a_refused_dsdt_leaves_no_namespace_and_loads_no_ssdt. Unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..d89a1c72d 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -128,7 +128,7 @@ pub fn load<K: Kernel>(kernel: &K, rsdp: u64) -> Loaded {
             Err(kind) => println!("acpiserver: table {place} of {count} ({name}) refused: {kind}"),
         }
         loaded.blocks.push(done);
-        if place == 1 && loaded.blocks[0].is_err() {
+        if false {
             println!(
                 "acpiserver: no namespace: the DSDT was refused, so the {} SSDT(s) after it are not loaded; the power button is served, and nothing of this machine's AML",
                 count - 1

s8-a-refused-ssdt-ends-the-load — must red acpiserver, a_refused_ssdt_is_one_block_refused_and_the_rest_load. Unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..311d45b78 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -128,7 +128,7 @@ pub fn load<K: Kernel>(kernel: &K, rsdp: u64) -> Loaded {
             Err(kind) => println!("acpiserver: table {place} of {count} ({name}) refused: {kind}"),
         }
         loaded.blocks.push(done);
-        if place == 1 && loaded.blocks[0].is_err() {
+        if loaded.blocks.last().is_some_and(|block| block.is_err()) {
             println!(
                 "acpiserver: no namespace: the DSDT was refused, so the {} SSDT(s) after it are not loaded; the power button is served, and nothing of this machine's AML",
                 count - 1

s9-a-refusals-kind-names-what-the-firmware-chose — must red acpiserver, every_refusals_kind_is_free_of_what_the_firmware_chose. Unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..e9dc14b44 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -47,7 +47,7 @@ pub struct Loaded {
 fn kind(why: &Error) -> String {
     match why {
         Error::Malformed { why, .. } => format!("malformed AML: {why}"),
-        Error::NotFound(_) => "a name that does not resolve".into(),
+        Error::NotFound(name) => format!("{name} does not resolve"),
         Error::Exists(_) => "a name defined twice".into(),
         Error::Type(why) => format!("a type its operator refuses: {why}"),
         Error::Rule(why) | Error::Table(why) | Error::Bound(why) => (*why).into(),

s10-the-server-loads-nothing — must red acpi_power_button, at the first table line; and the row acpi_tables_loaded. Unrun.

diff --git a/userland/acpiserver/src/main.rs b/userland/acpiserver/src/main.rs
index 716ed4dc7..f0b14bec2 100644
--- a/userland/acpiserver/src/main.rs
+++ b/userland/acpiserver/src/main.rs
@@ -99,7 +99,7 @@ fn main() {
     server.arm();
     let waited = {
         let claim = Claim { dev: &server.dev, info: server.info, scis: Cell::new(0) };
-        aml::load(&claim, server.info.rsdp);
+        let _ = (&claim, aml::load::<Claim>);
         claim.scis.get()
     };
     server.scis += waited;

i1-a-refused-ssdt-is-passed-over — must red toyos-acpi/tests/corpus.rs, the_definition_blocks_are_the_dsdt_and_then_each_ssdt_in_the_xsdts_order. Unrun.

diff --git a/toyos-acpi/src/lib.rs b/toyos-acpi/src/lib.rs
index b62c359f6..f411a87e1 100644
--- a/toyos-acpi/src/lib.rs
+++ b/toyos-acpi/src/lib.rs
@@ -337,8 +337,7 @@ impl<P: Phys> Iterator for DefinitionBlocks<P> {
             let at = self.xsdt.u64_at(SDT_HEADER_LEN + self.next * 8)?;
             self.next += 1;
             match Table::open(self.xsdt.phys, at, b"SSDT", SDT_HEADER_LEN) {
-                Err(TableError::Absent) => continue,
-                Err(TableError::Unmapped { .. }) if at == 0 => continue,
+                Err(_) => continue,
                 block => return Some(block),
             }
         }

i2-the-dsdt-is-not-first — must red toyos-acpi/tests/corpus.rs, the same, and fixtures.rs's the_definition_blocks_of_qemu_are_its_dsdt_alone. Unrun.

diff --git a/toyos-acpi/src/lib.rs b/toyos-acpi/src/lib.rs
index b62c359f6..1bedcb211 100644
--- a/toyos-acpi/src/lib.rs
+++ b/toyos-acpi/src/lib.rs
@@ -328,7 +328,7 @@ impl<P: Phys> Iterator for DefinitionBlocks<P> {
     type Item = Result<Table<P>, TableError>;
 
     fn next(&mut self) -> Option<Self::Item> {
-        if !core::mem::replace(&mut self.dsdt, true) {
+        if self.next == entries(&self.xsdt) && !core::mem::replace(&mut self.dsdt, true) {
             return Some(find_in(&self.xsdt, b"FACP", FADT_DSDT + 4).and_then(|fadt| {
                 Table::open(self.xsdt.phys, dsdt_address(&fadt), b"DSDT", SDT_HEADER_LEN)
             }));

b1-a-bridge-on-its-own-bus-is-walked — must red toyos-aml's a_pci_config_region_below_bridges_is_on_the_nearest_ones_secondary_bus, at the bridge that answers its own bus. Unrun.

diff --git a/userland/acpiserver/aml/src/field.rs b/userland/acpiserver/aml/src/field.rs
index 31b7788e8..b5d16f43b 100644
--- a/userland/acpiserver/aml/src/field.rs
+++ b/userland/acpiserver/aml/src/field.rs
@@ -231,7 +231,7 @@ impl Machine<'_> {
             // The register resets to 0, and a bridge's secondary bus is
             // above the bus the bridge is on: any other answer would address
             // a device that is not below this bridge.
-            if answered <= bus {
+            if answered < bus {
                 return Err(refused(Some(answered)));
             }
             bus = answered;

…el's name for it The first load on the test machine said its DSDT was absent and counted 31 tables. Neither was what happened. The kernel refused the first read of 30 of the XSDT's 31 entries, the FADT's among them; the walk passed the unreadable FADT over as find_table does and answered Absent, and the load stopped at the DSDT before any line carried the kernel's refusal. The 31 are the DSDT's item and 30 entries whose header was not read, each answered Unmapped because nothing says it is no SSDT; the one entry that was read is no definition block and was passed over. definition_blocks now refuses the DSDT as the first entry that could not be read where no FADT was found, and says Absent only where every entry was read. The server keeps each range's refusal by its address, so a table's line carries the kernel's name and the memory type of that table's own refusal. Which type the tables' memory has on that machine is still unread: this boot's log does not carry it, and the next one's DSDT line does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T06:36:37Z

Mutations at 2484aa3a5, as patches; this replaces the comment for 4284062c1. Each passes git apply --check at this head. Nine were run here, once each, under the owner's exception for the host tests of toyos-userbound, toyos-acpi and userland/acpiserver/aml: applied as a checked patch, run, reversed, the tree clean after (clean=0 is git status --porcelain's line count). Each of the nine is red by a failed assertion; the failing tests are in the body's table. The rest are unrun: the guest probe, a guest test or acpiserver's own host tests judge them, and none of those may run locally.

g00-policy-passes-everything: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
m5-eoi-page-not-rounded: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
m6-facs-aligned-to-four: EXIT=101 clean=0 :: cargo test -p toyos-acpi --test facs
m7-lock-word-typed-by-its-first-byte: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
m8-config-write-passes: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
i1-a-refused-ssdt-is-passed-over: EXIT=101 clean=0 :: cargo test -p toyos-acpi --test corpus definition_blocks
i2-the-dsdt-is-not-first: EXIT=101 clean=0 :: cargo test -p toyos-acpi --test corpus --test fixtures definition_blocks
i3-an-unread-fadt-is-an-absent-dsdt: EXIT=101 clean=0 :: cargo test -p toyos-acpi --test corpus a_dsdt_whose_fadt
b1-a-bridge-on-its-own-bus-is-walked: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/aml/Cargo.toml --target aarch64-apple-darwin --test regions a_pci_config_region_below_bridges

g00-policy-passes-everything — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..00b36a701 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -156,6 +156,9 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
                 _ => return No(Refused::Straddles),
             }
         }
+        if true {
+            return MemoryVerdict::Through(MemoryAt { at, width });
+        }
         if overlaps(at, last, LOCAL_APIC) || self.devices.into_iter().any(|device| overlaps(at, last, pages(device))) {
             return No(Refused::DeviceMemory);
         }
@@ -270,7 +273,7 @@ pub fn port(standing: impl Fn(u16) -> Standing, port: u16, width: Width, write:
         return Err(Refused::PortSpan);
     }
     for port in port..=port + (width.bytes() as u16 - 1) {
-        match standing(port) {
+        match { let _ = standing(port); Standing::Free } {
             Standing::Free | Standing::Declared(Mediated::Open) => {}
             Standing::Declared(Mediated::ReadOnly) if !write => {}
             Standing::Declared(Mediated::ReadOnly) => return Err(Refused::ReadOnlyPort),
@@ -315,9 +318,7 @@ impl ConfigAt {
 /// its shape: a function the window reaches, and at most a dword that crosses
 /// no dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width, write: bool) -> Result<ConfigAt, Refused> {
-    if write {
-        return Err(Refused::ConfigWrite);
-    }
+    let _ = write;
     let reached = ecam.is_some_and(|ecam| {
         ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });

k1-the-power-off-does-not-settle-the-holder — unrun.

diff --git a/kernel/src/arch/x86_64/power.rs b/kernel/src/arch/x86_64/power.rs
index 0eed43f94..ba48c92b6 100644
--- a/kernel/src/arch/x86_64/power.rs
+++ b/kernel/src/arch/x86_64/power.rs
@@ -171,7 +171,6 @@ pub fn off(stopping: crate::quiesce::Stopping) -> ! {
     let control = control.port(0);
     let taken = pio::take_back(&stopping);
     super::smi_cmd::settle(&taken);
-    super::acpi_mode::settle(&taken);
     let held = cpu::inw(control);
     if held & SCI_EN != 0 {
         super::acpi_mode::quiet(&taken);

k2-a-stop-leaves-the-lock-taken — unrun.

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index 078444cfd..6263c37c9 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -173,7 +173,7 @@ static ENABLED: AtomicBool = AtomicBool::new(false);
 pub fn settle(_taken: &TakenBack) {
     let mut holder = HOLDER.lock();
     if let Some(hardware) = hardware() {
-        give_back(hardware, &mut holder, "the machine is stopping");
+        let _ = (hardware, &mut holder);
     }
 }

m1-window-not-recorded — unrun.

diff --git a/kernel/src/arch/x86_64/paging.rs b/kernel/src/arch/x86_64/paging.rs
index 38525436e..6b2e4a77d 100644
--- a/kernel/src/arch/x86_64/paging.rs
+++ b/kernel/src/arch/x86_64/paging.rs
@@ -883,9 +883,7 @@ pub fn map_mmio(phys: u64, size: u64, policy: MmioPolicy) -> crate::mm::Mmio {
     let mmio = kernel().lock().map_mmio(phys, size, policy.cache());
     {
         let mut driven = DRIVEN.lock();
-        if !driven.contains(&(phys, phys + size)) {
-            driven.push((phys, phys + size));
-        }
+        let _ = &mut driven;
     }
     crate::arch::tlb::shootdown(crate::invalidation::Origin::Mmio);
     // Read back off the table and logged beside firmware's MTRR verdict: the

m2-no-gbl-rls — unrun.

diff --git a/kernel/src/arch/x86_64/acpi_mode.rs b/kernel/src/arch/x86_64/acpi_mode.rs
index aea86e0eb..dfdf9935b 100644
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -554,7 +554,7 @@ fn give_back(hardware: &Hardware, holder: &mut Holder, orphaned: &str) {
             let control = hardware.control.port(0);
             // SAFETY: the PM1a control block, declared; `GBL_RLS` over the
             // register as it reads, whose `SLP_EN` reads clear (§4.8.3.2).
-            unsafe { cpu::outw(control, cpu::inw(control) | GBL_RLS) };
+            let _ = (control, GBL_RLS);
         }
         signal
     });

m3-another-rows-port-is-free — unrun.

diff --git a/kernel/src/arch/x86_64/pio.rs b/kernel/src/arch/x86_64/pio.rs
index 05b014183..f43523109 100644
--- a/kernel/src/arch/x86_64/pio.rs
+++ b/kernel/src/arch/x86_64/pio.rs
@@ -129,7 +129,8 @@ pub fn standing(port: u16, row: usize) -> Standing {
         return Standing::Declared(mediated);
     }
     let others = (0..crate::isa::MAX_ROWS).filter(|&other| other != row).filter_map(crate::isa::runs);
-    if others.flatten().any(|run| run.overlaps(one)) { Standing::Row } else { Standing::Free }
+    let _ = others.flatten().any(|run| run.overlaps(one));
+    Standing::Free
 }
 
 /// The port an access the mediation policy passed begins at.

m4-no-bar-fed-to-the-policy — unrun.

diff --git a/kernel/src/pcidev/mod.rs b/kernel/src/pcidev/mod.rs
index c0ab7cba7..8a52a1e13 100644
--- a/kernel/src/pcidev/mod.rs
+++ b/kernel/src/pcidev/mod.rs
@@ -412,7 +412,8 @@ pub fn inventory() -> Vec<toyos_abi::inventory::Pci> {
 /// windows inside it, and nothing holding that record's lock takes this one.
 pub fn with_bar_memory<T>(f: impl FnOnce(&mut dyn Iterator<Item = (u64, u64)>) -> T) -> T {
     let machine = MACHINE.lock();
-    f(&mut machine.decoded.iter().map(|&(_, start, end)| (start, end)))
+    let _ = &machine;
+    f(&mut core::iter::empty())
 }
 
 /// The PCI segment group every enumerated function is on.

m5-eoi-page-not-rounded — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..c2e7e4813 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -126,7 +126,8 @@ fn overlaps(first: u64, last: u64, (start, end): (u64, u64)) -> bool {
 /// driven through its first 0x20 bytes, and a chipset's keeps an EOI register
 /// further into the same page.
 fn pages((start, end): (u64, u64)) -> (u64, u64) {
-    (start & !(PAGE_4K - 1), end.saturating_add(PAGE_4K - 1) & !(PAGE_4K - 1))
+    let _ = PAGE_4K;
+    (start, end)
 }
 
 /// The UEFI type of the range of `map` holding `at`, or `None` where it lists

m6-facs-aligned-to-four — RUN, red.

diff --git a/toyos-acpi/src/facs.rs b/toyos-acpi/src/facs.rs
index 23f2ccf1f..9dd3b65dc 100644
--- a/toyos-acpi/src/facs.rs
+++ b/toyos-acpi/src/facs.rs
@@ -52,7 +52,7 @@ pub fn facs<P: Phys>(phys: P, fadt: &Table<P>) -> Result<Facs, FacsRefused> {
     if base == 0 {
         return Err(FacsRefused::Absent);
     }
-    if !base.is_multiple_of(FACS_ALIGN) {
+    if !base.is_multiple_of(FACS_ALIGN / 16) {
         return Err(FacsRefused::Misaligned(base));
     }
     if !phys.readable(base, FACS_MIN_LEN as usize) {

m7-lock-word-typed-by-its-first-byte — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..6085dfa6a 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -219,7 +219,7 @@ pub fn lock_word(map: &[MemoryMapEntry], mapped_end: u64, at: u64) -> Result<Loc
     }
     // No overflow: `at` is on a dword boundary.
     let last = at + 3;
-    for byte in at..=last {
+    for byte in at..=at {
         match type_of(map, byte) {
             Some(EFI_RESERVED | EFI_ACPI_NVS) => {}
             other => return Err(NoLockWord::Type(other)),

m8-config-write-passes — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index b1c22007a..22a5cf752 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -315,9 +315,7 @@ impl ConfigAt {
 /// its shape: a function the window reaches, and at most a dword that crosses
 /// no dword boundary, the unit a configuration register is defined in.
 pub fn config(ecam: Option<Ecam>, segment: u16, function: Function, offset: u16, width: Width, write: bool) -> Result<ConfigAt, Refused> {
-    if write {
-        return Err(Refused::ConfigWrite);
-    }
+    let _ = write;
     let reached = ecam.is_some_and(|ecam| {
         ecam.segment == segment && (ecam.first_bus..=ecam.last_bus).contains(&function.bus)
     });

s1-a-write-is-passed-to-the-kernel — unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..2b8821a36 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -236,6 +236,10 @@ impl<K: Kernel> Host for Firmware<'_, K> {
             Address::PciConfig { .. } => "a write to PCI_Config: this server writes nothing for AML yet".into(),
             Address::EmbeddedControl(_) => format!("a write to {NO_CONTROLLER}"),
         };
+        if let Address::Memory(address) = at {
+            let _ = self.kernel.access(Access::write(Space::SystemMemory, address, wide(width), value));
+            return Ok(());
+        }
         Err(self.deny(what, format_args!("{width:?} {value:#x} to {at:x?}")))
     }

s2-the-controllers-space-reads-all-ones — unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..628af2529 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -214,7 +214,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
             Address::Memory(address) => (Space::SystemMemory, address),
             Address::Io(port) => (Space::SystemIo, u64::from(port)),
             Address::PciConfig { segment, bus, device, function, offset } => (Space::PciConfig, pci_address(segment, bus, device, function, offset)),
-            Address::EmbeddedControl(_) => return Err(self.deny(format!("a read of {NO_CONTROLLER}"), format_args!("{at:x?}"))),
+            Address::EmbeddedControl(_) => return Ok(0xFF),
         };
         match read(self.kernel, space, address, wide(width)) {
             Ok((value, memory_type)) => {

s3-a-refused-read-answers-zero — unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..75750633c 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -225,7 +225,10 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                 Ok(value)
             }
             Err(Refusal::Stopping) => Err(self.stopped()),
-            Err(refusal) => Err(self.deny(refusal.to_string(), format_args!("{width:?} at {at:x?}"))),
+            Err(refusal) => {
+                let _ = self.deny(refusal.to_string(), format_args!("{width:?} at {at:x?}"));
+                Ok(0)
+            }
         }
     }

s4-a-pending-lock-is-reported-taken — unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..846f6cc6b 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -276,7 +276,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                 Ok(Take::Unusable) => {
                     return Err(self.deny("the Global Lock: the kernel exchanges no lock word in this machine's FACS".into(), format_args!("a take")))
                 }
-                Ok(Take::Pending) => {}
+                Ok(Take::Pending) => return Ok(()),
             }
             if !found_held {
                 found_held = true;

s5-the-lock-wait-is-not-spent — unrun.

diff --git a/userland/acpiserver/src/host.rs b/userland/acpiserver/src/host.rs
index d1f96d583..d08a5d66f 100644
--- a/userland/acpiserver/src/host.rs
+++ b/userland/acpiserver/src/host.rs
@@ -290,7 +290,7 @@ impl<K: Kernel> Host for Firmware<'_, K> {
                     format_args!("a take the firmware was left the request for"),
                 ));
             };
-            self.lock_wait = self.lock_wait.saturating_sub(waited);
+            let _ = waited;
         }
     }
 }

s6-a-fetch-reads-whole-qwords — unrun.

diff --git a/userland/acpiserver/src/tables.rs b/userland/acpiserver/src/tables.rs
index a4e1180bd..3a2da0142 100644
--- a/userland/acpiserver/src/tables.rs
+++ b/userland/acpiserver/src/tables.rs
@@ -45,12 +45,12 @@ impl<'k, K: Kernel> Tables<'k, K> {
     fn fetch(&self, phys: u64, len: usize) -> Result<Vec<u8>, Refusal> {
         let mut bytes = Vec::with_capacity(len);
         while bytes.len() < len {
-            let width = if len - bytes.len() >= 8 { Width::QWord } else { Width::Byte };
+            let width = Width::QWord;
             let at = phys + bytes.len() as u64;
             let (value, memory_type) = host::read(self.kernel, Space::SystemMemory, at, width)?;
             self.reads.set(self.reads.get() + 1);
             self.pages.borrow_mut().read(at, memory_type);
-            bytes.extend_from_slice(&value.to_le_bytes()[..width.bytes() as usize]);
+            bytes.extend_from_slice(&value.to_le_bytes()[..(width.bytes() as usize).min(len - bytes.len())]);
         }
         Ok(bytes)
     }

s7-ssdts-load-onto-a-refused-dsdt — unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..d89a1c72d 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -128,7 +128,7 @@ pub fn load<K: Kernel>(kernel: &K, rsdp: u64) -> Loaded {
             Err(kind) => println!("acpiserver: table {place} of {count} ({name}) refused: {kind}"),
         }
         loaded.blocks.push(done);
-        if place == 1 && loaded.blocks[0].is_err() {
+        if false {
             println!(
                 "acpiserver: no namespace: the DSDT was refused, so the {} SSDT(s) after it are not loaded; the power button is served, and nothing of this machine's AML",
                 count - 1

s8-a-refused-ssdt-ends-the-load — unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..311d45b78 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -128,7 +128,7 @@ pub fn load<K: Kernel>(kernel: &K, rsdp: u64) -> Loaded {
             Err(kind) => println!("acpiserver: table {place} of {count} ({name}) refused: {kind}"),
         }
         loaded.blocks.push(done);
-        if place == 1 && loaded.blocks[0].is_err() {
+        if loaded.blocks.last().is_some_and(|block| block.is_err()) {
             println!(
                 "acpiserver: no namespace: the DSDT was refused, so the {} SSDT(s) after it are not loaded; the power button is served, and nothing of this machine's AML",
                 count - 1

s9-a-refusals-kind-names-what-the-firmware-chose — unrun.

diff --git a/userland/acpiserver/src/aml.rs b/userland/acpiserver/src/aml.rs
index 00b48ab51..e9dc14b44 100644
--- a/userland/acpiserver/src/aml.rs
+++ b/userland/acpiserver/src/aml.rs
@@ -47,7 +47,7 @@ pub struct Loaded {
 fn kind(why: &Error) -> String {
     match why {
         Error::Malformed { why, .. } => format!("malformed AML: {why}"),
-        Error::NotFound(_) => "a name that does not resolve".into(),
+        Error::NotFound(name) => format!("{name} does not resolve"),
         Error::Exists(_) => "a name defined twice".into(),
         Error::Type(why) => format!("a type its operator refuses: {why}"),
         Error::Rule(why) | Error::Table(why) | Error::Bound(why) => (*why).into(),

s10-the-server-loads-nothing — unrun.

diff --git a/userland/acpiserver/src/main.rs b/userland/acpiserver/src/main.rs
index 716ed4dc7..f0b14bec2 100644
--- a/userland/acpiserver/src/main.rs
+++ b/userland/acpiserver/src/main.rs
@@ -99,7 +99,7 @@ fn main() {
     server.arm();
     let waited = {
         let claim = Claim { dev: &server.dev, info: server.info, scis: Cell::new(0) };
-        aml::load(&claim, server.info.rsdp);
+        let _ = (&claim, aml::load::<Claim>);
         claim.scis.get()
     };
     server.scis += waited;

i1-a-refused-ssdt-is-passed-over — RUN, red.

diff --git a/toyos-acpi/src/lib.rs b/toyos-acpi/src/lib.rs
index b62c359f6..f411a87e1 100644
--- a/toyos-acpi/src/lib.rs
+++ b/toyos-acpi/src/lib.rs
@@ -337,8 +337,7 @@ impl<P: Phys> Iterator for DefinitionBlocks<P> {
             let at = self.xsdt.u64_at(SDT_HEADER_LEN + self.next * 8)?;
             self.next += 1;
             match Table::open(self.xsdt.phys, at, b"SSDT", SDT_HEADER_LEN) {
-                Err(TableError::Absent) => continue,
-                Err(TableError::Unmapped { .. }) if at == 0 => continue,
+                Err(_) => continue,
                 block => return Some(block),
             }
         }

i2-the-dsdt-is-not-first — RUN, red.

diff --git a/toyos-acpi/src/lib.rs b/toyos-acpi/src/lib.rs
index ece5e687d..4eb36eaf1 100644
--- a/toyos-acpi/src/lib.rs
+++ b/toyos-acpi/src/lib.rs
@@ -347,7 +347,7 @@ impl<P: Phys> Iterator for DefinitionBlocks<P> {
     type Item = Result<Table<P>, TableError>;
 
     fn next(&mut self) -> Option<Self::Item> {
-        if !core::mem::replace(&mut self.dsdt, true) {
+        if self.next == entries(&self.xsdt) && !core::mem::replace(&mut self.dsdt, true) {
             return Some(self.fadt().and_then(|fadt| Table::open(self.xsdt.phys, dsdt_address(&fadt), b"DSDT", SDT_HEADER_LEN)));
         }
         while self.next < entries(&self.xsdt) {

i3-an-unread-fadt-is-an-absent-dsdt — RUN, red.

diff --git a/toyos-acpi/src/lib.rs b/toyos-acpi/src/lib.rs
index ece5e687d..13f893dab 100644
--- a/toyos-acpi/src/lib.rs
+++ b/toyos-acpi/src/lib.rs
@@ -339,7 +339,8 @@ impl<P: Phys> DefinitionBlocks<P> {
                 found => return found,
             }
         }
-        Err(unread.unwrap_or(TableError::Absent))
+        let _ = unread;
+        Err(TableError::Absent)
     }
 }

b1-a-bridge-on-its-own-bus-is-walked — RUN, red.

diff --git a/userland/acpiserver/aml/src/field.rs b/userland/acpiserver/aml/src/field.rs
index 31b7788e8..b5d16f43b 100644
--- a/userland/acpiserver/aml/src/field.rs
+++ b/userland/acpiserver/aml/src/field.rs
@@ -231,7 +231,7 @@ impl Machine<'_> {
             // The register resets to 0, and a bridge's secondary bus is
             // above the bus the bridge is on: any other answer would address
             // a device that is not below this bridge.
-            if answered <= bus {
+            if answered < bus {
                 return Err(refused(Some(answered)));
             }
             bus = answered;

…keeps its tables The test machine's firmware keeps its FADT and every definition block its XSDT lists in EfiRuntimeServicesData: the server's load there read "a SystemMemory read the kernel refused MemoryType, in memory of type 6 x60". UEFI 2.10 §2.3.4 puts tables in ACPI reclaim or NVS memory; this firmware does otherwise, and the kernel's own reader already reads them there. By the orchestrator's ruling (his, not the owner's): a read passes in type 6 as in reserved, ACPI reclaim and ACPI NVS; a write there is refused TableWrite until a machine's AML is measured making one; runtime-services code stays refused both ways. No memory the allocator hands out carries either type. The cost, that the holder reads whatever else a firmware keeps in runtime-services data, is recorded in the claim's issue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T06:42:25Z

Mutations for the runtime-services arm at 253d4f5f4, as patches; the 25 in the comment for 2484aa3a5 still pass git apply --check here. Each was applied as a checked patch, run once, and reversed, the tree clean after; each is red by failed assertions, named in the body.

p1-runtime-data-is-written: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
p2-runtime-data-is-not-read: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
p3-runtime-code-is-read: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware

p1-runtime-data-is-written — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index de0eb794b..e79116869 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -177,7 +177,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         }
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
-            Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
+            Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
             Some(_) | None => return No(Refused::MemoryType),
         }

p2-runtime-data-is-not-read — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index de0eb794b..d4b90bb0c 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -178,7 +178,8 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
-            Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
+            Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
+            Some(EFI_RUNTIME_DATA) if write => unreachable!(),
             Some(_) | None => return No(Refused::MemoryType),
         }
         if last >= self.mapped_end {

p3-runtime-code-is-read — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index de0eb794b..ce5e3b094 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -179,6 +179,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
+            Some(5) if !write => {}
             Some(_) | None => return No(Refused::MemoryType),
         }
         if last >= self.mapped_end {

…ype uncacheable With its tables readable, the test machine's load ran 13 of 14: one SSDT reads a byte at an address firmware's map lists nowhere, below 4 GiB, outside the ECAM window, in no page the kernel drives and no function's BAR. By its place it is the chipset's own register space. By the orchestrator's ruling (his, not the owner's): such a read passes where the kernel maps the address and the range registers type it uncacheable; a write stays refused. The direct map's leaves select the PAT's write-back entry, under which the range registers decide, so the kernel reads them at each such access (mtrr::range_type) instead of assuming. That check is also what keeps RAM a truncated map left out refused. Below 1 MiB the fixed range registers decide and this kernel reads none, so nothing unlisted is read there. A read that is refused for it is UnlistedCached. The probe reads q35's PCI hole, where OVMF types everything from the top of low RAM to 4 GiB uncacheable, is refused its write, and is refused the legacy video hole. The server calls such a page "unlisted firmware memory" in its counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T06:52:56Z

Mutations for the unlisted-register arm at 88f38a289, as patches, each applied as a checked patch, run once, and reversed, the tree clean after; each is red by failed assertions, named in the body. Below them, p1 to p3 restated for this head, where their context changed: those were run at 253d4f5f4 and not again. Every other patch of the earlier comments still passes git apply --check here.

u1-an-unlisted-address-is-written: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
u2-an-unlisted-read-is-not-asked-of-the-range-registers: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
u3-an-unlisted-register-is-not-read: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware

u1-an-unlisted-address-is-written — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..9bbab6045 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -191,7 +191,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
-            None if !write => {}
+            None => {}
             Some(_) | None => return No(Refused::MemoryType),
         }
         if last >= self.mapped_end {

u2-an-unlisted-read-is-not-asked-of-the-range-registers — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..9f7dd22d2 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -197,7 +197,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         if last >= self.mapped_end {
             return No(Refused::Unmapped);
         }
-        if ty.is_none() && !(self.uncached)(at, width.bytes()) {
+        if false && ty.is_none() && !(self.uncached)(at, width.bytes()) {
             return No(Refused::UnlistedCached);
         }
         if write && self.facs.is_some_and(|facs| overlaps(at, last, facs)) {

u3-an-unlisted-register-is-not-read — RUN, red.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..b3b1e26d2 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -191,7 +191,6 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
-            None if !write => {}
             Some(_) | None => return No(Refused::MemoryType),
         }
         if last >= self.mapped_end {

p1-runtime-data-is-written — restated; run red at 253d4f5f4.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..6205e6a8d 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -189,7 +189,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         }
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
-            Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
+            Some(EFI_ACPI_RECLAIM) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
             None if !write => {}
             Some(_) | None => return No(Refused::MemoryType),

p2-runtime-data-is-not-read — restated; run red at 253d4f5f4.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..9f841ef5f 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -190,7 +190,8 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         match ty {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
-            Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
+            Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM) => {}
+            Some(EFI_RUNTIME_DATA) if write => unreachable!(),
             None if !write => {}
             Some(_) | None => return No(Refused::MemoryType),
         }

p3-runtime-code-is-read — restated; run red at 253d4f5f4.

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index bd4986956..60041eb3d 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -191,6 +191,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
             Some(ty) if toyos_bootmap::is_usable_type(ty) => return No(Refused::UsableMemory),
             Some(EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) if write => return No(Refused::TableWrite),
             Some(EFI_RESERVED | EFI_ACPI_NVS | EFI_ACPI_RECLAIM | EFI_RUNTIME_DATA) => {}
+            Some(5) if !write => {}
             None if !write => {}
             Some(_) | None => return No(Refused::MemoryType),
         }

Japabu · 2026-10-08T06:57:24Z

Every mutation not yet run, run once each at 88f38a289 after the owner lifted the compute restriction: applied as a checked patch, run, reversed, the tree clean after (clean=0). The patches are those of the earlier comments, unchanged, and one new one. k1, the review's patch as written, is a build error and not a red test: without the call acpi_mode::settle is dead code and the kernel's build refuses it. k1b is that loss in a form that builds.

g00-policy-passes-everything: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
k1-the-power-off-does-not-settle-the-holder: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
k2-a-stop-leaves-the-lock-taken: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
m1-window-not-recorded: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
k1b-the-power-off-names-settle-and-does-not-call-it: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
m2-no-gbl-rls: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
m3-another-rows-port-is-free: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
m4-no-bar-fed-to-the-policy: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_mediated_access
s10-the-server-loads-nothing: EXIT=1 clean=0 :: cargo test --test toyos-build -- acpi_power_button
s1-a-write-is-passed-to-the-kernel: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s2-the-controllers-space-reads-all-ones: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s3-a-refused-read-answers-zero: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s4-a-pending-lock-is-reported-taken: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s5-the-lock-wait-is-not-spent: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s6-a-fetch-reads-whole-qwords: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s7-ssdts-load-onto-a-refused-dsdt: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s8-a-refused-ssdt-ends-the-load: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin
s9-a-refusals-kind-names-what-the-firmware-chose: EXIT=101 clean=0 :: cargo test --manifest-path userland/acpiserver/Cargo.toml --target aarch64-apple-darwin

k1b-the-power-off-names-settle-and-does-not-call-it — RUN, red.

diff --git a/kernel/src/arch/x86_64/power.rs b/kernel/src/arch/x86_64/power.rs
index 0eed43f94..01e6c4963 100644
--- a/kernel/src/arch/x86_64/power.rs
+++ b/kernel/src/arch/x86_64/power.rs
@@ -171,7 +171,7 @@ pub fn off(stopping: crate::quiesce::Stopping) -> ! {
     let control = control.port(0);
     let taken = pio::take_back(&stopping);
     super::smi_cmd::settle(&taken);
-    super::acpi_mode::settle(&taken);
+    let _ = super::acpi_mode::settle;
     let held = cpu::inw(control);
     if held & SCI_EN != 0 {
         super::acpi_mode::quiet(&taken);

Japabu · 2026-10-08T07:01:54Z

T14 at 88f38a289, run by the orchestrator: one unattended boot of the staged testcases-hold image (rc=0, its sha256 the request's, the worktree clean at the head), judged --metal --metal-readback … acpi_tables_loaded → EXIT=0, [metal] 1 passed, 0 failed, 1 boot(s). The server's lines:

14 of 14 tables loaded in 77 ms
the tables' bytes took 42893 reads of firmware memory, in pages: 109 of type 6, 2 of type 9, 1 of type 10
the tables' AML read SystemMemory 385 times, SystemIO 0 and PCI_Config 10, its memory in pages: 6 of type 10, 5 of type 11, 1 of unlisted firmware memory; took the Global Lock 241 times, 0 of them from the firmware; and ran Notify 0 times
\_S5 evaluated: SLP_TYPa=7 SLP_TYPb=7, beside the kernel's own SLP_TYPa=7

The three boots before it, each red on one refusal the next head answered: 4284062c1 (the tables' memory, type 6, refused: 0 of 31), 253d4f5f4 (13 of 14; one read at an unlisted address refused), and this one.

Japabu · 2026-10-08T07:15:46Z

Review round 3 of 88f38a289 against origin/main (b432ed21c). Read only: no build, test or cargo command was run for this review.

Net lines, git diff --shortstat origin/main...88f38a289: 49 files, +4275 −71. Production about +2230 −60, tests about +1920 −8 (the four #[cfg(test)] modules of acpiserver counted as tests), lockfiles +10, issues +114 −3. The growth since round 2 is the server half; accepted but for what BLOCKER 3 and the NOTEs name.

Measurements read at this head: CI run 37740095844 on 88f38a289, host success (Host: 78 step(s), all green; the two new policy tests and a_dsdt_whose_fadt_… each ... ok), toolchain / build success, guest / suite success under KVM (PASS acpi_power_button, PASS acpi_mediated_access, 31 of 31). The metal test machine's readback of one boot of the image staged at this head: acpi_tables_loaded judged 1 passed, 0 failed; in its log 14 of 14 tables loaded in 77 ms, 42893 reads for the tables' bytes, 385 SystemMemory and 10 PCI_Config reads by the AML, one page of unlisted memory, 241 takes of the Global Lock and none contended, \_S5 7 beside the kernel's 7, and no refusal line.

Earlier BLOCKERs

Round 2's new BLOCKER (nothing fails when the power-off stops settling the holder): CLOSED. k1b (the call replaced by a use of the name) and k2 (no give-back inside settle), each cargo test --test toyos-build -- acpi_mediated_access, EXIT=1, STALLED: waiting for the probe's power-off to give the lock back; the unmutated run at this head EXIT=0 with the kernel's (the machine is stopping) line after the probe's. The review's own patch is a build error (settle never used), which is a refusal too.
Round 1 item 6 (the eight mutations unrun): CLOSED. m1 to m4 at this head against the probe, EXIT=1 at the assertion each names; m5 to m8 at 2484aa3a5, EXIT=101 at the named host tests; the negative control g00 red on both arms, the guest arm at this head at acpi: RAM was read.
Round 1 item 7 (no reading through SYS_ACPI from hardware; no CI at the head): CLOSED by the two measurements above. Neither is in the body; see NOTE.
Round 1 item 8 (the syscall ships for a test alone): CLOSED. userland/acpiserver/src/main.rs:143 calls it on the boot path.
Round 2's NOTEs: the refused FACS answers NotSupported (by reading, acpi_mode.rs:515; the server's side host-tested); the windows half is deleted. Its stated ground ("an unlisted address already answers MemoryType") is no longer true of a read at this head, and the deletion still holds for another reason: place_bar reads every address it tries through map_mmio, so a cut window is in DRIVEN before it is a BAR's.

BLOCKER

kernel/src/arch/x86_64/acpi_mode.rs:670 — nothing fails when the bound under 1 MiB is gone — the body, the issue and the probe's own line claim "nothing unlisted below 1 MiB is read", and the probe's assertion is refused by the range registers on its guest with or without the bound: that firmware's default type is write-back and it types the legacy hole by the fixed registers, which range_type does not read, so the address answers write-back and UnlistedCached either way. On a machine whose default type is uncacheable the bound is the only thing between the holder and the legacy hole, and the two machines measured do not show which arm refused. The patch I expect to stay green, which must turn acpi_mediated_access red at acpi: an unlisted address below 1 MiB:
```
--- a/kernel/src/arch/x86_64/acpi_mode.rs
+++ b/kernel/src/arch/x86_64/acpi_mode.rs
@@ -668,4 +668,4 @@
 fn uncached(at: u64, len: u64) -> bool {
     use super::mtrr::{Effective, MemoryType};
-    at >= 0x10_0000 && matches!(super::mtrr::range_type(at, len), Effective::Known(MemoryType::Uncacheable) | Effective::MtrrsDisabled)
+    matches!(super::mtrr::range_type(at, len), Effective::Known(MemoryType::Uncacheable) | Effective::MtrrsDisabled)
 }
```
The bound is an address rule and belongs in Memory::decide, where a host case holds it on the tier that reaches it (an unlisted read below 1 MiB refused whatever uncached answers); the kernel's function is then the register read and nothing else. The implementer runs the patch against whichever test is to hold it.
kernel/src/arch/x86_64/acpi_mode.rs:670 — | Effective::MtrrsDisabled passes every unlisted, mapped address above 1 MiB on a machine whose range registers are off — there all RAM is uncacheable as well, so the answer is evidence of nothing, and firmware.rs's "it is also what no RAM is, so a range of RAM a truncated map left out is refused by it" is false on exactly that arm. No guest and no machine measured has the registers off, and deleting the arm reds nothing. It is a second way through a security boundary that nothing asked for: delete it, so registers that are off refuse.
userland/acpiserver/src/main.rs:162 (Claim::released), with host.rs:287 and LOCK_WAIT — the wait for a contended Global Lock is reached by no tier and has no measured need — it zeroes every GPE enable and rewrites the PM1 enable on real hardware, the body's claim for it ("every other event stays latched … and raises the line again once its enable is back") has no test that can fail, the metal machine's 241 takes found the firmware holding the lock zero times, and no guest's AML takes the lock. Either a test reaches the port sequence, or it goes: a take answered Pending is denied by name and counted, as every other thing this server does not do yet is, and released, LOCK_WAIT, sci::GBL, Claim::scis and the wait's three host tests are deleted until a machine's ledger counts a contended take.

NOTE

toyos-userbound/tests/firmware.rs:177 — the test's register address is the one the metal readback prints on its (this machine's own, quoted in no record) line, committed under a doc that calls the map's addresses "this test's own" — the body's rule keeps that address out of every record, and the tree is one; any address inside the test's REGISTERS range does the job.
toyos-userbound/src/firmware.rs:33 and the issue's "no firmware types RAM uncacheable" — mtrr::range_type is not the effective type everywhere: a processor that types RAM from 4 GiB to its top of memory write-back by a configuration bit outside the range registers (AMD's SYSCFG forcing for TOM2) answers the default type for that RAM, uncacheable on such firmware — so an unlisted range of RAM above 4 GiB inside the direct map passes as a register there. What keeps kernel and process memory out is not this check: the allocator hands out only listed usable memory (toyos_bootmap::is_usable_type), so unlisted memory holds nothing ToyOS put there. The issue records the first as unchecked and names the second as the ground.
kernel/src/arch/x86_64/mtrr.rs:108 — range_type decided a log line until this head and decides a security boundary from it; its overlap rules (uncacheable over anything, write-through over write-back, a partly covered range and a reserved encoding unknown) are correct by reading and held by no test — lift the decision to a pure function over the default word and the base and mask pairs and table it on the host; the MSR reads stay where they are.
toyos-userbound/src/firmware.rs:159 — type_of answers the first range holding an address, and the allocator takes every usable range (pmm.rs:156 already allows that usable ranges overlap) — a map that lists one range twice, firmware's type first, is read and written here and handed out there. Refuse UsableMemory where any range holding a byte of the access is usable.
userland/acpiserver/src/aml.rs:42 and :173 — Loaded is returned for the tests alone (main drops it), and the evaluations ledger sees one entry and is always new — say what S2 reads of the first or drop the return; delete the second until a second evaluation exists.
userland/acpiserver/src/main.rs:102 — the load runs before the serving loop, so a press waits for it: 77 ms measured, and bounded only by the interpreter's 10 s of Sleep for each table — recorded only in the body's "unsure" list; it goes in the stage's issue with that number and an exit.
Prose: the body says "no CI check has run" at this head, "Staged at 88f38a289, not booted", gates the metal row red, and gives round 2's deleted windows half a ground this head removed; the measurements at the top of this report are what it should carry.

Judged, and no finding

The read in runtime-services data. The ground holds in the tree: is_usable_type is types 1, 2, 3, 4 and 7; every loader allocation is LoaderData (rootimage.rs:215, blackbox.rs:59, the exit's own map) and kernel/src/main.rs:381 panics on a loader region the map does not hold as that — the image, the ELF, the black box, ROOT and the map's copy; page tables and everything later come from the allocator; the kernel calls no runtime service, so it wrote nothing there. A write is TableWrite and type 5 is refused both ways, each with a host test and a red mutation. What it costs is disclosure of the firmware's own runtime data to a server that already writes ACPI NVS; the issue says so.
The unlisted read. Variable ranges: an uncacheable range wins every overlap, a range the access only partly lies in and an undefined pair answer unknown, and unknown is refused. Device pages the kernel knows are decided before the arm, a placed BAR among them. What remains is what the ruling accepted and the issue records: on a machine whose default type is uncacheable the arm passes the whole unlisted hole under the direct map's end that no recorded device page covers, which on the metal machine includes the register window of a function its firmware hides from enumeration; "uncacheable" is evidence that a read is one read, and by itself not that the address is no RAM (first two NOTEs, second BLOCKER); and a read there can change a device. The measured need is one page.
What a hostile or broken table makes the server do. It reads only: every write and the controller's space are denied before the kernel is asked (s1, s2 red). It cannot keep the Global Lock past an evaluation (finish gives it back on every path, and the kernel at the claim's end and at the stop). It is bounded in steps, depth, live bytes and sleep by the interpreter, and a refused block's names are removed. It can delay the power button by its Sleeps (NOTE), and choose which unlisted registers are read.
The load on the default boot path. One syscall a qword is the price of the kernel deciding each access by its own address; 77 ms off the boot's critical path, in a process of its own. Accepted as measured.
The owner's ruling is quoted as given and applied no wider: a refused SSDT is one line and the load goes on, a refused DSDT leaves no namespace and the button served; both host-tested with a red mutation each. The two widenings of the policy are stated as the orchestrator's, in the body and in the issue.
The log's own-machine lines. Acceptable in a boot log that stays on the machine and in the readback: the kernel's log on the same boot already carries every table's and every BAR's address. The metal judge prints only the quotable lines. The one leak is the first NOTE.

What the next slices must still prove on the metal machine

A value read through SYS_ACPI from ACPI NVS, from reserved memory and from the unlisted register, each held against an independent reading of the same bytes. This row holds only the tables' own memory, by checksum.
Every unlisted page the initialisation and query methods read, counted by method, and that none lies in a device anything in the tree drives; a read there with an effect in the device is found by what the device does after, not by the ledger.
The first write AML makes: the UEFI type of its page, and what the refused SMI_CMD write breaks in the methods that make it.
A take that finds the firmware holding the lock, and a release that owes the signal, read by the SMI count either side.
A port access that traps into SMM under the mediation's lock: how long it held the CPU.
The power-off with the server alive and holding the lock, and the server killed mid-load with it.
A press made during the load: when it is served.
The same row on a second firmware: one whose default range type is not this machine's, and a processor that types high RAM outside the range registers.

SEND BACK

…rs that are off refuse, and a held Global Lock is denied The bound under 1 MiB was in the kernel's cache check, where no tier could tell it from the range registers' own answer: QEMU's firmware types the legacy hole write-back by the variable registers, so the probe's refusal there was made with or without it. It is `Memory::decide`'s now (`FIXED_RANGE_END`), held by a host case whose cache check answers yes to everything, and the kernel's function is the register read alone. Range registers that are off no longer pass an unlisted read: all RAM is uncacheable under them too, so the answer told a register from nothing. `Effective::typed_uncacheable` is the one place that says so, tabled. `mtrr::range_type` decided a log line until this branch and decides a security boundary from it, so its decision moves to `kernel::mtrr`, pure over the default-type word and the base and mask pairs, and is tabled on the host: the default, a region's last byte, a partly covered range, the overlap rules and the undefined encodings. A valid mask with no address bit, which shifted by 64 in the kernel, matches every address. A map may list a byte twice and the allocator takes every usable range, so `decide` and `lock_word` refuse wherever any usable range holds a byte of the access, whichever range lists it first. The wait for a contended Global Lock goes (the orchestrator's ruling): it zeroed every GPE enable on real hardware, no tier reached it, and the T14's 241 takes found the firmware holding the lock in none. A take answered `Pending` is denied by name and counted; `Claim::released`, `LOCK_WAIT`, `sci::GBL`, `Claim::scis` and the wait's tests are deleted, and the stage's issue records the exit that brings the wait back. The one-entry `evaluations` ledger goes with it; `Loaded` says who reads it. The test's register address is one of the test's own, and the issues record that the range registers are not the effective type everywhere, that the allocator's rule is what keeps RAM out, and that a press waits for the load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…nce at boot With the arm that passed range registers that are off deleted, the probe's read of q35's PCI hole went red: the probe ran on the guest's second CPU, whose IA32_MTRR_DEF_TYPE reads 0 on QEMU 11.1.1 under TCG, where the boot processor's registers type the same address uncacheable. So that read was passed by the deleted arm at the last head, and which CPU a call ran on decided what the kernel answered. The kernel reads the boot processor's default-type word and base and mask pairs once, in `acpi_mode::init`, and `kernel::mtrr` decides every unlisted read from them: one answer whichever CPU asks, and no MSR read at an access. That every other CPU's registers are the boot processor's is the SDM's rule for firmware and is not checked; the claim's issue records it with the guest's measurement and an exit. `acting` says why a claim that exists is the caller's: the ISA row mints no next claim while the process that bound it has a thread left. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…address Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T08:01:48Z

Review round 4 of 3a18a85e6 against origin/main (017451624). Read only: no build, test or cargo command was run for this review.

Net lines, git diff --shortstat origin/main...3a18a85e6: 51 files, +4560 −207. Production about +2340 −196, tests about +2045 −8 (the five in-file #[cfg(test)] modules, 660 lines, counted as tests), lockfiles +10, issues +164 −3. Since round 3 the server lost the wait and its three tests, and the kernel's range-register decision moved to kernel/pure/mtrr.rs with a table of six tests; that move is growth I asked for.

Measurements read at this head: CI run 37746496416, toolchain / build success; host and guest / suite pending when this was written. The round's mutation logs (r1 to r7, EXIT=101 each, run at e3449c6f5); none of the three files they patch differs between e3449c6f5 and this head. acpi_mediated_access EXIT=1 at dbdc05f35 and EXIT=0 at c62f75db4, with the measuring line's output on the guest's second CPU. The orchestrator's readback of one boot of the metal row staged at this head, which he posts.

Earlier BLOCKERs

Round 3, 1 (nothing fails when the bound under 1 MiB is gone): CLOSED. The bound is Memory::decide's (FIXED_RANGE_END), the kernel's function is the register decision alone, and an_unlisted_address_below_1_mib_is_refused_whatever_the_range_registers_answer holds it with a cache check that answers yes to everything, to the last byte and for a read that begins below it. r1, cargo test -p toyos-userbound --test firmware, EXIT=101.
Round 3, 2 (registers that are off pass): CLOSED as stated: the arm is gone, typed_uncacheable is the one place, tabled, and r2 EXIT=101. What its deletion uncovered is this round's BLOCKER.
Round 3, 3 (the Global Lock wait): CLOSED. See "The wait" below. r3 EXIT=101.
Round 3's NOTEs: the test's register address is one of the test's own, and the earlier one is nowhere in the tree at this head; the processor's own typing of high RAM, the allocator's rule as the ground, and the press that waits for the load are each in an issue with an exit; range_type is pure and tabled (r6, r7 EXIT=101); a byte any usable range holds is refused in decide and in lock_word, with a test over both orders and both overlaps (r4, r5 EXIT=101); the one-entry evaluations ledger is deleted and Loaded says who reads it.

BLOCKER

kernel/src/arch/x86_64/acpi_mode.rs:673 (uncached) with :251 — the read is passed on the boot processor's registers and made on whichever CPU the call runs on, and that the two agree is assumed on the one machine this change targets — the head before this one read the registers of the CPU that makes the read, which is the exact answer; this head replaces it with a stand-in because the exact answer was red on the guest, and the only measurement of the stand-in is that it is false there. On the metal machine nothing has read any other CPU's registers: all twelve of its mmio: … (MTRR …) lines in the readback at this head are cpu0's. The assumption carries the whole of "a read of a register is one read of it": a CPU whose own registers type the range write-back reads a device register through the cache. It is one cheap measurement, and the issue's own exit names it. Judged in three parts:
- The snapshot is sound. No wrmsr in the kernel names a range register (the module says the kernel programs none, and the tree agrees); the kernel calls no firmware service after the loader, so only SMM could change them, and a read at each access is no better against that. acpi_mode::init runs on the boot path before any task runs, so "the boot processor's" is true of what it stores. One answer whichever CPU asks, and no MSR read on the access path, are both better than the last head.
- The boot processor's view is the right one for what the address is, and not for how the read is made. "Firmware typed this range a register's" is a fact of the machine, and the boot processor's registers are where firmware wrote it. "This read is uncached" is a fact of the CPU that executes it. On a CPU whose registers are off it is uncached anyway, so the guest's second CPU is safe by the architecture; on one whose registers are on and differ, it is not known.
- Compare, say and refuse; do not assert. Root CLAUDE.md's "CPU state" is about registers the kernel declares, applies and then asserts. These are firmware's, the kernel applies nothing, and a panic on them would stop every guest boot at its second CPU as measured. Making the rule apply in full means the kernel programs every other CPU's range registers from the boot processor's, which is a decision about who owns those registers and is the owner's, not this slice's. What this slice owes: each CPU reads its own registers as it comes up; where they are not the boot processor's it says so by name, once for a CPU whose are off and once for one whose are on and differ; and an unlisted read is refused, by a name of its own, on a machine where any CPU's are on and differ. The comparison is pure over two snapshots and belongs beside range_type with a host case for equal, off, and on-and-different. The measurement it yields is what the metal row must then carry: every CPU of that machine compared, and none different.
Evidence at this head — host and guest / suite have no result yet — the branch's --ci host and the guest tests it reaches are not measured at 3a18a85e6, and nothing was run locally after the merge with The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750 but the stagings. This closes by the run finishing green, with what "What each measurement must show" names.

NOTE

issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md, the bullet on the other CPUs' registers — it has an exit and no owner, where the stage issue's two new bullets name theirs; with the BLOCKER answered the bullet records what was measured instead, and why the guest's second CPU has its registers off stays there as unread, with an owner.
Prose: the body says the metal row is staged at this head and not booted, and that CI's result is not in it; both are the orchestrator's to correct once the readback and the run are posted.

Judged, and no finding

The outside finding (an old call acting for a replacement claim, the next holder's Global Lock given back among it): it does not hold, at 88f38a289 or here. Traced independently. sys_acpi passes only for the process the row is bound to (isa::bound_to). The binding leaves that process in one place, isa::process_ends, called from teardown_resources, which runs in process::leave only on the Last arm: the thread that runs it is the last one out, and a thread inside SYS_ACPI has not left, since leaving is something a thread does itself and a kill only posts a retire it meets later. isa::claim_row refuses Owned while the binding is anyone's, whether or not a claim exists, under the row's own lock. So between an old call's check and its acting() no claim can be minted, for another process or for the same one: after the close it finds claimed false and answers Gone; before it, it acts for its own claim. The two variations I looked for also fail: a handle moved on to another process answers PermissionDenied there and never rebinds (info_read is already set); and a claim minted and never read is bound to nobody and passes for nobody. What the finding is right about is that Holder carries no identity and the property lives in another module; acting's doc now says where. No new test. The half of it that a test can reach cheaply is already held on main by the ISA row's guest test, which closes a claim in a child and asserts that a second claim answers AlreadyExists while the process that bound the ports lives; the ACPI claim mints through the same claim_row. Staging the interleaving itself needs a pause inside the syscall, which is kernel code shipped for a test to guard two lines a reader checks.
The wait. Nothing of it is left: no released in the Kernel trait or its double, no LOCK_WAIT, sci::GBL, Claim::scis, begin, or the enable-zeroing port sequence; main loads through a claim that holds only the device. A take answered Pending is denied under one name, counted, and not asked again within the call; the access under it is not made, which the load's test asserts by the last access asked. The ruling is recorded as the orchestrator's and not the owner's, with an exit a metal row reds on. The kernel still leaves the firmware its request on such a take, as the specification has it, and nothing consumes the status bit the firmware then raises; the slice that brings the wait back owns that.
The kernel still gives the lock back. release clears claimed and calls give_back under HOLDER before the row is released, and settle calls it from the power-off before the hardware is taken; neither is touched since round 3, where k1b and k2 turned the probe red on the second. The probe's own line for the first, and the kernel's (the machine is stopping) line for the second, are in the local green run at c62f75db4.
The pure decision. A valid mask with no address bit matches every address without a shift by 64; a region's last byte and the byte after it are each tabled; a third register does not undo a conflict; an encoding the architecture does not define is unknown only where its register covers the range. The fixed registers and anything outside the range registers are said to be outside it, in the module and in the issue.

What each measurement must show

host at the head that answers this round: green, with toyos-userbound's firmware tests, the kernel library's mtrr tests and acpiserver's each ... ok by name, and clippy over both architectures, which nothing has run since the merge with The AML interpreter's 16 MiB counts the heap it holds, and a refused load gives its memory back #750.
guest / suite: PASS acpi_mediated_access and PASS acpi_power_button under KVM. The first is the only reading of the boot-processor decision on a second hypervisor: its read of the guest's PCI hole must pass and its read below 1 MiB be refused. Once the comparison exists, the kernel's line for the second CPU there says which of equal, off or different KVM gives it.
acpi_tables_loaded on the metal machine: every table loaded, \_S5 beside the kernel's own decode, the one page of unlisted memory still read, which at this head says the boot processor's registers are on and type it uncacheable where the last head could not tell that from registers that were off; no refusal line, no the Global Lock: the firmware holds it, and the count of takes found held; and, with the BLOCKER answered, the comparison's line for every CPU.
acpi_server_death on the metal machine: the kernel's ACPI_DISABLE written as the claim goes and SCI_EN read clear after, the ports gone back with the dead process, and, where the server died inside a take, the kernel's line that it gave the lock back for a claim that is gone.
Still owed by later slices, unchanged from round 3: a take that finds the firmware holding the lock, and every unlisted page the initialisation and query methods read.

SEND BACK

…he boot processor's, and one that differs stops the unlisted read An unlisted read was passed on the boot processor's range registers and made on whichever CPU ran the call; that the two agree was assumed, and on a q35 guest under TCG it is false: the second CPU's are off. - `kernel::mtrr::beside` is the comparison, pure over two snapshots: the same words, off, or on and not the same. Three host cases. - `arch::mtrr` keeps the boot processor's registers, read before any other CPU starts; each other CPU reads its own in `ap_entry` before it echoes and says which of the three it is, by name. Nothing is asserted: firmware owns these registers, and a guest's second CPU holds them off. - A CPU whose registers are off reads everything uncached, so a register is still read once. On a machine where any CPU's are on and not the boot processor's, `firmware::Memory::decide` refuses every read of an unlisted address `RangeRegistersDiffer`, a name of its own. - `acpi_mode` no longer keeps its own snapshot. - The metal row's judge reads a line for every other CPU and refuses one that is on and different; the guest probe prints the boot processor's line and the second CPU's. - The kernel programs no range register. Who owns the other CPUs' is the owner's question, recorded in the issue with why the guest's second CPU has them off, each with an owner and an exit. Measured, QEMU 11.1.1 q35 under TCG: the boot processor reads IA32_MTRR_DEF_TYPE 0xc06 with 8 variable pairs, cpu1 reads 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T08:12:48Z

Mutations of round 5, at 9b928ca4e: each applied as a checked patch (git apply --check), run once, and reversed by one script, the tree clean after each (clean=0 is git status --porcelain | wc -l).

c4-an-unlisted-read-passes-where-registers-differ: EXIT=101 clean=0 :: cargo test -p toyos-userbound --test firmware
c1-the-same-words-are-not-the-same: EXIT=101 clean=0 :: cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr
c2-registers-that-are-off-read-as-different: EXIT=101 clean=0 :: cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr
c3-only-the-default-type-is-compared: EXIT=101 clean=0 :: cargo test --manifest-path kernel/Cargo.toml --target-dir target --lib mtrr

A first invocation of c1 to c3 passed the command to the script as one word, so cargo never started (EXIT=127, the shell's "No such file or directory"); those three lines are no result and the ones above are the first run of each test.

c1-the-same-words-are-not-the-same.patch

diff --git a/kernel/pure/mtrr.rs b/kernel/pure/mtrr.rs
index 564421c47..b70f94c1a 100644
--- a/kernel/pure/mtrr.rs
+++ b/kernel/pure/mtrr.rs
@@ -177,7 +177,7 @@ pub enum Beside {
 /// snapshots that type every range alike and are not the same words are
 /// [`Beside::Different`], which refuses and never passes.
 pub fn beside(boot: (u64, &[(u64, u64)]), other: (u64, &[(u64, u64)])) -> Beside {
-    if other == boot {
+    if false {
         Beside::Same
     } else if other.0 & DEF_TYPE_ENABLE == 0 {
         Beside::Off

c2-registers-that-are-off-read-as-different.patch

diff --git a/kernel/pure/mtrr.rs b/kernel/pure/mtrr.rs
index 564421c47..dacbc3046 100644
--- a/kernel/pure/mtrr.rs
+++ b/kernel/pure/mtrr.rs
@@ -179,7 +179,7 @@ pub enum Beside {
 pub fn beside(boot: (u64, &[(u64, u64)]), other: (u64, &[(u64, u64)])) -> Beside {
     if other == boot {
         Beside::Same
-    } else if other.0 & DEF_TYPE_ENABLE == 0 {
+    } else if false {
         Beside::Off
     } else {
         Beside::Different

c3-only-the-default-type-is-compared.patch

diff --git a/kernel/pure/mtrr.rs b/kernel/pure/mtrr.rs
index 564421c47..5d9e72382 100644
--- a/kernel/pure/mtrr.rs
+++ b/kernel/pure/mtrr.rs
@@ -177,7 +177,7 @@ pub enum Beside {
 /// snapshots that type every range alike and are not the same words are
 /// [`Beside::Different`], which refuses and never passes.
 pub fn beside(boot: (u64, &[(u64, u64)]), other: (u64, &[(u64, u64)])) -> Beside {
-    if other == boot {
+    if other.0 == boot.0 {
         Beside::Same
     } else if other.0 & DEF_TYPE_ENABLE == 0 {
         Beside::Off

c4-an-unlisted-read-passes-where-registers-differ.patch

diff --git a/toyos-userbound/src/firmware.rs b/toyos-userbound/src/firmware.rs
index 67ed7691d..392cdd6dd 100644
--- a/toyos-userbound/src/firmware.rs
+++ b/toyos-userbound/src/firmware.rs
@@ -228,7 +228,7 @@ impl<D: IntoIterator<Item = (u64, u64)>> Memory<'_, D> {
         if last >= self.mapped_end {
             return No(Refused::Unmapped);
         }
-        if ty.is_none() && self.registers_differ {
+        if false {
             return No(Refused::RangeRegistersDiffer);
         }
         if ty.is_none() && (at < FIXED_RANGE_END || !(self.uncached)(at, width.bytes())) {

CI's `host` at 3a18a85 (run 37746496416) failed `could not compile kernel (lib)` in every clippy shape of the kernel, on two lints its clippy 1.99 has and this machine's 0.1.98 does not raise: `manual_isolate_lowest_one` at the region's size in `range_type`, and `manual_is_multiple_of` in the tests' `pair`. Both are written as it suggests; neither changes a value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T08:21:56Z

T14 at head edfd5220a (orchestrator's run; images staged by the implementer from the clean tree, hashes as its request names them, each printed by the command that flashed it):

row	image sha256	boot	judge (`--metal --metal-readback`, clean tree at the head)
`acpi_tables_loaded`	`6c0e19dc…e4ebad19`	exit 0	exit 0, `[metal] 1 passed, 0 failed, 1 boot(s)`
`acpi_server_death`	`c6d36024…7a611a6e`	exit 0	exit 0, `[metal] 1 passed, 0 failed, 1 boot(s)`

The comparison lines of the acpi_tables_loaded boot:

mtrr: the boot processor's range registers: IA32_MTRR_DEF_TYPE 0xc06 and 10 variable pairs
mtrr: cpu1's range registers are the boot processor's
mtrr: cpu2's range registers are the boot processor's
mtrr: cpu3's range registers are the boot processor's
mtrr: cpu4's range registers are the boot processor's
mtrr: cpu5's range registers are the boot processor's
mtrr: cpu6's range registers are the boot processor's
mtrr: cpu7's range registers are the boot processor's

So on this machine every CPU's range registers equal the boot processor's; the on-and-different arm ran on no machine. One earlier boot of acpi_tables_loaded in this round was of the image staged at 9b928ca4e and is not counted: the head moved under it.

Japabu · 2026-10-08T08:25:41Z

Review round 5 of edfd5220a against origin/main (017451624, the merge base). Read only: no build, test or cargo command was run for this review.

Net lines, git diff --shortstat origin/main...edfd5220a: 53 files, +4779 −195. Production about +2450 −185, tests about +2135 −8 (the in-file #[cfg(test)] modules counted as tests), issues +182 −3, lockfiles +10. This round (3a18a85e6..edfd5220a): 10 files, +264 −33; production about +125 −13, tests about +97 −7, the issue +31 −13. The round's growth is what round 4 asked for and nothing beside it; acpi_mode lost its own snapshot.

Measurements read at this head: the orchestrator's two metal boots (comment 6055804005), judge exit 0 each, seven comparison lines, all "are the boot processor's". The implementer's logs: the kernel library's mtrr tests EXIT=0, 9 passed, the three new ones ... ok by name, on edfd5220a's tree; toyos-userbound --test firmware EXIT=0, 20 passed, no_unlisted_address_is_read_where_a_cpus_range_registers_differ ... ok, at 9b928ca4e (no file it builds differs at edfd5220a); acpi_mediated_access EXIT=0 under TCG on 9b928ca4e's tree, cpu1's line "off"; c1 to c4 EXIT=101 each, tree clean after each. CI run 37748731067 at edfd5220a, read once as this was written: in progress, host and toolchain / build running, guest / suite not started.

Earlier BLOCKERs

Round 4, 1 (the unlisted read passed on the boot processor's registers alone): CLOSED. Compared, said and refused, nothing asserted, the kernel programs none. kernel::mtrr::beside is pure beside range_type with a host case for each answer; c1, c2, c3 EXIT=101 at the three tests, c4 EXIT=101 at the policy's. The metal row carries what it was owed: every other CPU compared, as many lines as the roster brought up, none different.
Round 4, 2 (host and guest / suite unmeasured at the head): OPEN, and the only thing open. At 3a18a85e6 host was red on two clippy lints and then cancelled; at edfd5220a no check has concluded. Nothing local stands in for it: the local clippy is an older one that raises neither lint, and no --ci host and no guest test but the probe ran at this head. See BLOCKER.

BLOCKER

Evidence at edfd5220a — cargo run -- --ci host and the guest tests the change reaches have no result at this head — run 37748731067 is in progress. No change to the tree is asked for. It closes by that run, at this head and with no further push, showing: host success, with the kernel's clippy shapes compiling kernel/pure/mtrr.rs on both architectures (the two lints of the last run gone), the kernel library's nine mtrr tests, toyos-userbound's twenty firmware tests and acpiserver's each ... ok; toolchain / build success; guest / suite success with PASS acpi_mediated_access and PASS acpi_power_button by name, the first printing the boot processor's line and cpu1's line under KVM. If KVM gives cpu1 "on and not the boot processor's", that test is red at the probe's read of the PCI hole, which is the refusal working and a finding about that hypervisor, not a flake: it comes back here.

NOTE

issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md, the bullet on a CPU whose registers differ — its second open thing's exit asks for the line read on the metal machine and under KVM; the first now exists (every other CPU the same, comment 6055804005) and the bullet's "Measured" still has the TCG guest alone — the reading goes into the bullet, by count and kind only, and KVM's beside it once the run prints it; what then stays open is why TCG's second CPU is off.
Prose: the body says both rows are "staged again at this head and not booted" and that no boot has printed the comparison's lines; both are false since comment 6055804005, and the Gates table has no row for those boots. The orchestrator's to correct, with CI's result.

Judged, and no finding

Is the verdict true on the CPU that makes the read: yes, twice over. By construction: the answer is the boot processor's snapshot and one machine-wide flag, so it does not depend on which CPU asks. Every CPU that can run a thread is one of three: the boot processor, whose registers the snapshot is; one that compared Same or Off, where the snapshot's "uncacheable" is true of its read, by equality or by the architecture's rule for registers that are off; or one that compared Different, which set the flag before it echoed and so before it ran anything. compare precedes ROSTER.echo and ap_idle in ap_entry, so this holds for an AP that echoes past the budget too. mtrr::init runs in start_other_cpus, which main calls unconditionally before process::init, so boot() cannot panic under a holder's call on a machine of one CPU. And by the lock: acting() takes HOLDER, a sync::Lock, which raises the preemption count, and holds it from decide through read_memory; a thread does not migrate between the check and the read. No wrmsr in the kernel names a range register at this head.
What "the same" compares is enough for what is passed. The default-type word whole (the fixed registers' enable bit in it) and every variable pair, count included. The fixed registers themselves are not compared and decide nothing here: an unlisted address below 1 MiB is refused before the cache check, and with the flag set it is refused under the new name first; both refuse. Words that differ in an unused pair refuse, the safe side.
The Different arm ran on no machine, and its host cases and mutations carry it. What decides it (beside) and what it costs (Memory::decide) are each host-tested with a mutation red. Between them are two lines no test runs: DIFFERS.store(true, …) in compare (kernel/src/arch/x86_64/mtrr.rs:81) and registers_differ: super::mtrr::any_differs() in acpi_mode::memory (:695). One static, one writer, one reader, both read here; a patch that drops either is one a reader of the diff sees, so no mutation is named. The arm's log line indexes pairs[n] and boot.1[n] only at a position zip produced, so it cannot panic. The cheap check that would run it is a write to an AP's range registers behind an actuator: kernel code shipped for a test alone, which this review would send back. No QEMU option gives it. Nothing further is owed.
The policy's order. RangeRegistersDiffer is decided after the device pages, the straddle, usable memory, the type match and Unmapped, and only where the map lists nothing: listed memory, a write (MemoryType), a device's page and an unmapped address answer as before, each asserted in the new test.
edfd5220a. Two expressions: isolate_lowest_one() equals m & m.wrapping_neg() for every m, zero included, and the mask-of-no-address-bit test is green on it; is_multiple_of sits beside is_power_of_two, so its zero case is unreachable. Nothing else differs from 9b928ca4e.
The guest test's change has its reason in the body: what a hypervisor hands its second CPU is that hypervisor's answer, no host test has one, and the metal row reads the same lines. It requires both lines, so it fails without them.
The outside finding T001-PR-01: the body's section is still true at this head. kernel/src/isa.rs, kernel/src/syscall/device.rs, kernel/src/device.rs and kernel/src/process.rs have no diff between 88f38a289 and edfd5220a, and this round's hunks in acpi_mode.rs touch neither acting, claim nor release. Read again here: sys_acpi passes only where isa::bound_to(row, current); BOUND[row] returns to nobody only in isa::process_ends, called in teardown_resources after close_all, reached from process::leave on its Last arm alone; claim_row answers Owned while *minted || BOUND[row] != NOBODY, under MINTED[row]; claim sets claimed only after claim_row passed; release clears it under HOLDER. So a thread of the binding process that is still inside the call keeps every next claim from being minted, and after the close it finds claimed false and answers Gone. The previous reviewer's reason for no new test stands: the interleaving needs a pause inside the syscall.

What the landing rests on

Run 37748731067 at edfd5220a, as the BLOCKER lists it. The metal reading is in at this head and needs no repeat unless the head moves in the kernel.

SEND BACK

Review round 5's NOTE. The bullet on a CPU whose range registers differ had the TCG guest's reading alone. Beside it now: the T14's acpi_tables_loaded boot at edfd522, where each of the seven other CPUs has the boot processor's words, and the KVM guest of CI run 37748731067 at edfd522, whose second CPU has them too. What stays open is why the second CPU under TCG has them off, and its exit no longer asks for the two readings that exist. No source, test or manifest changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu · 2026-10-08T08:48:41Z

Review round 6 of 54e08c632 against origin/main (017451624, the merge base still). Read only: no build, test or cargo command was run for this review, and the change was not read again; round 5 read it whole at edfd5220a.

Net lines, git diff --shortstat origin/main...54e08c632: 53 files, +4786 −195. This round (edfd5220a..54e08c632): 1 file, +16 −9, all of it in issues/; production 0, tests 0.

Earlier BLOCKER

Round 5 (cargo run -- --ci host and the guest tests the change reaches had no result at edfd5220a): CLOSED, by run 37748731067, gh run view: head edfd5220a102562609d34ec0fe3f784bebeb4174, completed, success; host (113216910123), toolchain / build (113216910735) and guest / suite (113220132648) each success. Both saved logs check out 25d187a Merge edfd5220a… into 0174516240…, which is today's origin/main. Line by line as the BLOCKER listed it:
- host success: [ci] Host: 78 step(s), all green.
- The kernel's clippy shapes on both architectures: under [ci] clippy, warnings denied, the kernel's library and tests in two shapes, --target x86_64-unknown-none in six and --target aarch64-unknown-none-softfloat in four, each followed by Finished, then [ci] clippy, warnings denied: clean. manual_isolate_lowest_one, manual_is_multiple_of and could not compile occur 0 times in the log.
- The kernel library's nine mtrr tests: nine test mtrr::tests::… ... ok lines under [ci] the kernel's library, round 4's three among them by name; 168 passed, 0 failed.
- toyos-userbound's twenty: Running tests/firmware.rs, running 20 tests, twenty ... ok lines, no_unlisted_address_is_read_where_a_cpus_range_registers_differ ... ok among them.
- acpiserver's: running 26 tests, twenty-six ... ok lines, under [ci] userland/acpiserver; userland/acpiserver/aml after it, 27, 18, 22, 18 and 18, each line ... ok.
- Nothing else red: all 187 FAILED or panicked lines lie between the first [ci] control heading and [ci] userland/acpiserver, each control ending 1 verdict(s) reached; the one error: outside them is a build-system test's malformed manifest, among tests that pass.
- toolchain / build success.
- guest / suite success: the x86_64 instrument: QEMU 11.1.1, … /dev/kvm opens; PASS acpi_power_button (3s), PASS acpi_mediated_access (3s); test result: ok. 31 passed, 31 total. The probe's two lines under KVM: [ 1.831 cpu0 kernel] mtrr: the boot processor's range registers: IA32_MTRR_DEF_TYPE 0xc06 and 8 variable pairs and [ 1.846 cpu1 kernel] mtrr: cpu1's range registers are the boot processor's. KVM does not give the on-and-different answer, so the case the BLOCKER reserved did not arise.

The diff since the last reviewed head

git diff --stat edfd5220a 54e08c632: issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md alone, +16 −9, frontmatter untouched. What it now says, against the three readings:

The T14: "10 variable pairs and each of its seven other CPUs has the boot processor's words" — comment 6055804005 has 0xc06 and 10 variable pairs and seven lines, cpu1 to cpu7, each are the boot processor's. True.
KVM: "IA32_MTRR_DEF_TYPE as 0xc06 with 8 variable pairs and the second CPU has the boot processor's words", QEMU 11.1.1 — the guest log's two lines and its instrument line. True.
TCG: "reads the same and the second CPU reads IA32_MTRR_DEF_TYPE as 0, off" — the implementer's log, EXIT=0: 0xc06 and 8 variable pairs, cpu1's range registers are off (IA32_MTRR_DEF_TYPE 0x0). True. That log does not print its QEMU; qemu-system-x86_64 --version on that host answers 11.1.1 on an arm64 machine, where an x86-64 guest has no accelerator but TCG.
"the on-and-different arm has run on no machine, and only TCG's second CPU is not the same": true of all three.
The second open thing is narrowed to what is still unread, why TCG's second CPU is off, and says the firmware builds of the two guests are unread; its owner, issues/toyos-runs-the-machine-in-acpi-mode-and-interprets-its-aml.md, exists; its exit no longer asks for the two readings that exist. The first open thing is unchanged.
No machine identifier: the added lines carry a model name the tree already uses, counts, one register value and a QEMU version; no address, serial or host name.

BLOCKER

None.

NOTE

Prose: issues/the-acpi-claims-holder-reaches-every-port-and-firmware-range-the-kernel-did-not-declare.md:107 — "Three things are not checked:" stands over four bullets — false of the record it heads; unchanged by this round, and not worth a head move of its own: it goes with the next change to that file.

The body

True of the head: it names 54e08c632, says what differs from edfd5220a and that no check has a result at 54e08c632; its account of run 37748731067 matches the logs item for item (job ids, 78 steps, 168, 20, 26, six and four shapes, the two KVM lines, 31 of 31); its account of the metal boots matches comment 6055804005; its Gates table has the rows round 5 found missing; its --shortstat is the command's output.

What the landing rests on

Run 37748731067 at edfd5220a and the merge queue's run, and not on the pull request's run at 54e08c632. The two heads differ in prose inside one issue file: nothing a compiler, clippy, a test binary or a guest image is built from, and the run at edfd5220a was of that code merged into the main that is still the base. Of the host suite, what reads that file's bytes is the source gate's scan of tracked files for identifying shapes, and the added lines have none, read here; the gates that read an issue's existence or status read nothing this diff moved. cargo test --test toyos-checks at 54e08c632: 36 passed, each by name in its saved log. The queue is required and runs all three checks on the merge group, which holds 54e08c632 itself: a red there keeps main where it is and brings the branch back here. The metal reading needs no repeat; the kernel did not move.

LAND

#749 wrote its new dependency edges into `kernel/Cargo.lock` and `userland/Cargo.lock`, which this branch deletes: both modify/delete conflicts are resolved by deleting the file. Git merged the root `Cargo.lock` without a conflict into a lock `cargo metadata --locked` refuses (exit 101): it took `toyos-userbound`'s edges to `toyos-abi` and `toyos-bootmap`, which #749 also wrote into the root lock, and not `acpiserver`'s to `toyos-acpi` and `toyos-aml`, which it wrote into userland's alone. `cargo metadata --offline` re-resolved it; the only change against git's merge is those two lines, no package is added and no version moves, and `cargo metadata --locked` exits 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

#749 landed sys_acpi and acpi_mode's access and Global Lock calls, which read the row number out of the claim and acted on it with the claim let go: the shape this branch removes, on the row. Resolved onto the borrow: - sys_acpi resolves the claim, copies an access request in, and makes all three operations inside one DeviceClaim::isa borrow, the holder's check (isa::held_by) included; the answer is copied out after the borrow, so no user copy is made under the claim's lock. A claim released under the call answers Gone. - acpi_mode::access, lock_take and lock_release take &isa::Row on both architectures. The port standing is asked about ROW, the one row an acpi claim is on. - Holder::claimed is deleted. It answered Gone to a call that reached acting() after the release had begun; a call now holds the lock the release takes the row with for the whole of the act, and acpi_mode::release runs only after that take, so the flag was never false where it was read. acting() takes the row as its witness and still refuses, under HOLDER, once the stop has begun. - acpi_mode::release gives the Global Lock back and leaves ACPI mode; the row's own release is the drop of the Row that follows it. Lock order of an access: the claim's Held, HOLDER, pcidev's MACHINE (with_bar_memory), paging's DRIVEN (with_driven_windows). inventory::claims takes process data, the claim's Held, MACHINE; settle takes HOLDER alone. Nothing takes a claim's Held or HOLDER under MACHINE or DRIVEN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Brings in #749, #757, #759 and #762. #762 changes kernel/src/object/mod.rs and toyos-abi/src/syscall.rs in hunks disjoint from this branch's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…nd the SDK resolve together (#746) Stage 3 of `issues/the-tree-says-who-uses-each-thing.md`. The root, `kernel/`, `bootloader/`, `userland/` and `toyos/` were five Cargo resolutions; they are one workspace with one `Cargo.lock`, one `[profile.toyos]`, one `[patch]` table and one tracked `.cargo/config.toml`. No directory moves. Head `dd12c0b32`, on `origin/main` `6f87cdb9c` (#749; none of #757, #759 or #762 had landed when it was merged and measured). It is `9ef866436`, where the CI readings of the fold itself were taken, plus two merges of `main` and the close of the stage's issue. Everything owed at the merged head is in the next section, measured at `dd12c0b32`. ## The merge of #749, measured at `dd12c0b32` #749 wrote its new dependency edges into `kernel/Cargo.lock` and `userland/Cargo.lock`, which this branch deletes. Both modify/delete conflicts are resolved by deleting the file and re-resolving the root lock. Git merged the root `Cargo.lock` without a conflict into a lock that is wrong, as the review found: `cargo metadata --locked` on it exits 101 (`cannot update the lock file … because --locked was passed`). It had `toyos-userbound`'s edges to `toyos-abi` and `toyos-bootmap`, which #749 also wrote into the root lock, and not `acpiserver`'s to `toyos-acpi` and `toyos-aml`, which #749 wrote into userland's alone. `cargo metadata --offline` re-resolved it. `diff` of git's merged lock against the re-resolved one is those two lines under `acpiserver` and nothing else: no package added, no version moved. | Owed | Command | Result | |---|---|---| | The lock resolves as committed | `cargo metadata --locked --format-version 1` | exit 0 at this head by the host suite's step "the licences of what ships", which runs `cargo metadata --locked` for every shipped crate's manifest and is green in `host.log` and in run 37757675374; the hand run's empty stderr (`metadata-locked.err`) predates the merge commit and recorded no exit | | The lock's (name, version) pairs are the union of `main`'s five | `pairs.sh <worktree> 6f87cdb`: the pairs of `Cargo.lock`, `kernel/`, `bootloader/`, `userland/` and `toyos/Cargo.lock` at `6f87cdb9c`, `sort -u`, against the root lock's | 692 against 692, `diff` exit 0 (`pairs.out`) | | The folded kernel and loader are the control's bytes | `prove.sh 6f87cdb dd12c0b …`, the round 3 script unchanged | exit 0; all four `control vs fold` byte rows `cmp` exit 0; every row in "The checks" below (`prove.out`) | | No new reader of a compiled-in path | `git diff -U0 e3bdff8 dd12c0b -- tests src toyos-blackbox toyos-symbols userland/symbolize`, its added lines searched for `\.rs`, `taken at`, `panicked at`, `Location`, `file()`, `PREVIOUS_PANIC`, `strip_prefix`, `src/`, `pure/` | the merge touches five files there, all under `tests/`; 13 hits, of which 4 are diff headers and 9 the field `info.rsdp`; none reads a path. `tests/common/power.rs:429` is still the one reader outside fixtures, and reads `taken at kernel/src/hardlockup/probe.rs` (`readers-merge.diff`, `readers-hits.txt`) | | `cargo run -- --ci host`, once, on the development machine | at `dd12c0b32`, `cargo run -- --ci host > host.log 2>&1; echo EXIT=$?` | exit 0; the log ends `[ci] Host: 77 step(s), all green`; 1-minute load 26.60 when it started (`host.log`) | The logs are in the round's scratch directory (`orch/oneworkspace-r4/`), which a reader of this pull request cannot reach; `prove.out` and `pairs.sh` are in the round 4 comment. ## What changed, per decision - **Members.** `kernel`, `bootloader`, `toyos` and userland's 40 packages join the root `[workspace]`. `userland/Cargo.toml`, four locks, three `rust-toolchain.toml` and three per-directory `.cargo/config.toml` are deleted. The toolchain files chose nothing the build read: every guest `cargo` already runs under `RUSTUP_TOOLCHAIN` naming its sysroot. - **Flags.** `build.target` is gone, since every guest build already passes `--target`. The root config holds one `[target.<triple>]` table per guest triple, six, each with the flags its directory's config gave it. A host build takes none, as before. Two things do change: - The guest crates outside the workspace that are built from their own directory for a ToyOS triple (`tests/toyos-rust-tests` and its `tls-*` crates) now take `-Dwarnings`, because cargo reads the tracked root config from above them. On a checkout without a local config they took no flags. - The one build that sets `RUSTFLAGS` itself (the test binaries linked against a `cdylib`, `src/build.rs`) takes none of the table: the variable replaces it. - **Profiles.** The root's `[profile.dev]` is `opt-level = 2`. The kernel library's host tests, its model controls, the SDK's tests and every surveyed userland crate's host tests used to resolve in their own workspaces and ran at `opt-level = 0`; they now run at 2. - **What stays apart** (the root manifest's `exclude` says why at each entry): `rust/`; `tests/toyos-rust-tests` and its `tls-*` crates and `tests/ssh-client-host`, because `[patch]` is workspace-wide and they patch or refuse what the root patches; and `userland/libc`. libc keeps its own lock because that lock is an input of the sysroot key: as a member it would be resolved by the root lock, and every dependency change of any member would move the key and rebuild every sysroot. The price is a sixth resolution of `toyos`, `toyos-abi`, `toyos-elf`, `toyos-osrelease` and `dlmalloc` that nothing holds to the root's (both carry `dlmalloc` 0.2.13 today). - **The lock** is every `[[package]]` of the five locks, deduplicated and resolved by `cargo metadata`. Nothing was `cargo update`d. Since the lock reviewed at `88bcbf4d3` it has changed by #749's four edges alone (see the section above); `cargo metadata --locked` exits 0 at this head. - **One target directory.** Every guest is built at the root with `-p` into `target/`. A stale sysroot used to `cargo clean` a crate's own target; that would now empty the build system's own, so `Stale::All` removes `target/toyos` and the guest triples' directories instead, and the `cargo clean` path, its member assertion and its test are deleted. - **Kernel and loader build one after the other.** They were built on two threads. In one target directory cargo serialises them anyway (measured in round 1: the second prints `Blocking waiting for file lock on artifact directory`), so the thread scope is deleted. - **The host suite** can no longer be `--workspace`: the kernel binary, the loader and most of userland do not build for a host. `src/hostws.rs` says which members a host tests, and the workspace test and clippy runs `--exclude` the rest by package name. - **Fork clones.** The tracked config includes the gitignored `.cargo/local.toml` when it exists, and `implementer.md` names it. - **The merge of #745.** `src/sysroot.rs` keeps both sides: `SYSROOT_SOURCES` carries `"sdk/std"` and `SYSROOT_MANIFESTS` ends in `".cargo/config.toml"`; its test keeps both loops; `issues/toyos-has-its-own-allocator.md` keeps `sdk/std/sys/alloc.rs` and "from the kernel's graph in `Cargo.lock`". Git merged all three without a conflict. - **The host's own apps build where the userland tests build.** `src/ci.rs`'s apps step passes `--target` only where it checks another host's triple. On `main` the `userland/*` test steps and the host's apps step both named the host triple and shared `userland/target/<host triple>`. The fold took `--target` off the test steps, which no longer need it to keep a guest triple out, and left it on the apps step: the tests filled `target/debug`, the apps `target/<host triple>`, and every dependency was compiled twice. That is what made the sealed tree larger than `main`'s (see CI). - **The merges of `main`.** #747, #748, #750, #751, #753 and #755 merged without a conflict. #749 did not: see the section above. - **The merge of #752.** Git merged it without a conflict: both workflows' `host` jobs keep `CARGO_PROFILE_DEV_DEBUG: line-tables-only` in `env:`, and `carry()` no longer sets it. No manifest and no lock moved in the merge. - **Issues.** `issues/the-tree-resolves-in-five-cargo-locks-not-one.md` is deleted: the one thing it named as left, the T14's run of the metal profile on the folded build, ran green at `db55db96a`, and review round 2 ruled no boot owed for what followed on two conditions, both in the section above. Stages 2 and 3 of `issues/the-tree-says-who-uses-each-thing.md` now read "Landed in #724, #732 and #738" and "Landed in #746". What the file carried that stays true is the root manifest's `exclude`, which says why each excluded directory keeps its own resolution; the deleting commit's message carries the rest (libc's second resolution of five crates, and `miniz_oxide` 0.8.9 beside 0.9.1 until `png` takes 0.9). `issues/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md` is closed on the two in-directory runs at `9ef866436`. `issues/the-sdk-is-linted-by-no-clippy-run.md` is filed and names its owner, the build system. ## The fold changed the kernel's source paths, and the proof did not see it The T14's run of the whole metal profile at `88bcbf4d3` exited 1: 295 passed, 1 failed, 30 boots. The red row was `hard_lockup_ends_a_deaf_cpu`. Its judge looked for `taken at src/hardlockup/probe.rs` in the previous boot's panic record, and the readback's loader log says `taken at kernel/src/hardlockup/probe.rs:145:29`. **What changed in the kernel's strings.** Cargo hands rustc a workspace member's source by its path from the workspace root, and rustc writes that path into every panic and `Location`. The kernel's root was `kernel/`; it is now the repository. So `src/...` became `kernel/src/...`, and a path dependency outside the old root, which the base named by the checkout's absolute path, is now named from the repository root (`toyos-abi/src/...`). Read from the actuator kernel staged at this head: 254 distinct `.rs` paths, 158 under `kernel/`, 38 under a `toyos-*` crate or `bcachefs`, none bare `src/` or `pure/`, none naming the worktree. **Why the proof did not see it.** Both of its oracles were blind to it by construction: - The byte row compared the fold against a control that is the base with its workspace root moved up. The control moved the root too, so it carries the same new paths and the bytes agree. - The `rustc`-lines row compared base against fold after a `sed` that rewrites `(kernel/|bootloader/)?(src|pure)/x.rs` and `ROOT/<crate>/src/lib.rs` to one form. That rewrite is needed, or every path crate's line differs and the row can show nothing else; but it absorbed the change without reporting it. `prove.sh` now reports what that rewrite absorbs: per artifact, how many crates' source arguments were renamed, and a diff of the `.rs` paths the artifact carries, base against fold and control against fold. The script is in the round 3 comment and has run twice since, at `9ef866436` and at this head. **Every reader of a compiled-in path.** I searched the harness, the guest tests, the build system, `toyos-blackbox`, `toyos-symbols`, `userland/symbolize`, the loader and the kernel's panic path for path literals, prefix strips and `Location` readers. One reader matches a compiled-in path by its prefix: `tests/common/power.rs`, the red row's judge, now fixed to the path the kernel records. Everything else is prefix-blind (`panicked at`, a file name with its line) or a synthetic fixture. The kernel's panic slot keeps the last 96 bytes of a path; the longest kernel path is 46, so nothing is cut. Userland's panic sites gain a `userland/` prefix the same way; no test reads one. **The record rows.** The judging asked to record three `boot.testcases-bounds.*` rows. They are not this change's: that boot was already staged on the base and unrecorded, and `main` recorded it in #745. They arrive with the merge and nothing is committed here. ## What the fold changes in what is built The lock row was measured at `dd12c0b32` against `6f87cdb9c`, the `rustc` row by `prove.sh` at the same pair; the two `cargo tree` rows at `88bcbf4d3`, and were not taken again. | Measured | Result | |---|---| | Lock: (name, version) pairs, the fold's against the union of `origin/main`'s five | identical, 692 pairs, `diff` exit 0 | | Lock: sources | registry `getrandom` 0.2.17, 0.3.4, 0.4.2 are gone; the forks at the same versions remain | | Kernel and loader, both arches: every `rustc` command line of `cargo build -v`, base against fold, path and cargo's path-derived hashes taken out | identical, `diff` exit 0: 31 units per kernel, 55 and 37 per loader | | Userland, both triples: `cargo tree -e features` over every program, base against fold | identical, `cmp` exit 0 | | Host members: the same | `diff` exit 1, on `getrandom`'s source alone | So one resolved crate changes: the build system and the other host members compile the ToyOS forks of `getrandom` 0.2.17, 0.3.4 and 0.4.2 instead of the registry's, same versions, same features. And every source path compiled into the kernel and the loader changes, as above. ## The checks (high-risk: build system) Measured at `dd12c0b32` against `origin/main` `6f87cdb9c` by `prove.sh` (the script of the round 3 comment, unchanged), exit 0; its output is in the round 4 comment. Round 3 measured the same rows at `9ef866436` against `b432ed21c`, round 1 at `88bcbf4d3` against `e7010129f`. **Negative control.** The whole change reverted is the base. A second control is the base with only its workspace root moved up, keeping the crate's own base lock and its profile. It is given the fold's root `.cargo/config.toml`, so the control does not hold the flags: the one row that does is base against fold on normalised `rustc` lines. **Oracle.** Bytes and cargo's own command lines. Each cell is its own `cmp` or `diff` exit: | | kernel x86_64 | kernel AArch64 | loader x86_64 | loader AArch64 | |---|---|---|---|---| | control vs fold, bytes | 0 | 0 | 0 | 0 | | fold vs fold rebuilt, bytes | 0 | 0 | 0 | 0 | | base vs fold, bytes | 1 | 1 | 1 | 1 | | base vs fold, `rustc` lines normalised | 0 | 0 | 0 | 0 | | control vs fold, `rustc` lines verbatim | 0 | 0 | 0 | 0 | What the normalisation absorbs, reported by the three `paths` rows: base against fold, cargo hands rustc another source path for 29 of 31 crates of each kernel and for 35 of 50 and 13 of 35 crates of the loaders (`diff` exit 1 each, as expected); the `.rs` paths the x86-64 kernel carries are 250 on both sides, of which the base has 39 under the tree's absolute path and 150 from the crate's own root and the fold none of either (`diff` exit 1); control against fold the artifacts' paths are identical (`diff` exit 0, all four). **Mutations**, each on a fresh copy of the fold: M1 (drop the `[target.x86_64-unknown-uefi]` table) loader build exit 101; M2 (lock `dlmalloc` at 0.2.12) `cmp` exit 1 and lines `diff` exit 1; M3 (select `bcachefs` beside the kernel in one `cargo`) kernel build exit 101. ## Gates The rows of the section "The merge of #749" were read at `dd12c0b32`. Every row below was read at `9ef866436` unless it says otherwise, each once, the narrowest that judges it. `ci.yml` runs on the push of `dd12c0b32`; its result is not in this body. | Gate | Result | |---|---| | `cargo run -- --ci host` | at `dd12c0b32`, development machine: exit 0, `[ci] Host: 77 step(s), all green`. Linux runner at `9ef866436`: `ci.yml` run 37740454881 `host` success; cold inside `--ci seal`, nightly run 37740449787: `[ci] Seal: 80 step(s), all green`; on macOS, the same nightly's `portability-macos`: success | | `cargo test --lib ci::tests` (the changed step's own test) | exit 0, 13 passed | | The images and the guest suite | at `9ef866436`, run 37740454881: `toolchain / build` and `guest / suite` success (KVM); run 37740449787: `toolchain / build` and `tcg / suite` success. At `e3bdff8af`, run 37755369755: `host` and `toolchain / build` success, `guest / suite` still running when read. Not run locally, and not read at `dd12c0b32` | | `prove.sh 6f87cdb dd12c0b …` | exit 0; every row as in the table above | | `cargo test` inside `kernel/loom` | exit 0 | | `cargo test` inside `kernel/sim` | exit 0 | | Cold wall clock, x86-64 kernel and loader (`wall.sh`, one run) | base, two cargos side by side: 24 s, 1-minute load 34.92 before it. Fold, one after the other: 20 s, load 42.23. Other agents' builds were running, so the two are not a controlled pair; the fold was not slower | | Metal profile | every row green at `db55db96a` (comment 6048782042). Since then the branch changed `src/ci.rs` and the root lock's two `acpiserver` edges; the kernel sources that moved are `main`'s own landings (#747, #748, #749), merged in. Review round 2, ruling (3), owes no boot for the merge of #749 on two conditions, both met above | | `cargo test --manifest-path userland/acpiserver/aml/Cargo.toml` at `e3bdff8af` | exit 0 | | `git status --porcelain --ignore-submodules=none` at `dd12c0b32` | empty | `issues/cargo-run-inside-kernel-loom-or-kernel-sim-builds-for-a-bare-target.md`'s close now stands on the two in-directory runs at `9ef866436`. The logs of these rows are files in the scratch directory of the round that took them (`orch/oneworkspace-r3/`), which a reader of this pull request cannot reach; the proof's and the measurements' outputs are in the round 3 comment. ## CI **Why the sealed tree was larger than `main`'s, measured.** A `workflow_dispatch` of `nightly.yml` at `88bcbf4d3` (run 37685714260) sealed `9348536345 B in 20064 files`, red. Units compiled per step, counted from that log and from `main`'s nightly at `b432ed21c` (run 37717000719, sealed `18708 files, 7664839895 B`): | step | `88bcbf4d3` | `main` | |---|---|---| | the driver's own build | 203 | 203 | | the build system | 207 | 207 | | the workspace's host members | 99 | 99 | | clippy, warnings denied | 412 | 417 | | the controls | 56 | 56 | | `userland/*` | 225 | 289 | | the apps for linux | 282 | 47 | | the apps for macos | 248 | 248 | | the apps for windows | 239 | 239 | Of the 256 distinct crates the apps-for-linux step compiled at `88bcbf4d3`, 226 had been compiled by an earlier step of the same run; 30 by none. The cause is the target directory: the test steps built without `--target` into `target/debug`, the apps step with `--target x86_64-unknown-linux-gnu` into `target/x86_64-unknown-linux-gnu`. Profile, features and `RUSTFLAGS` are the same in both. **The fix, measured once on the development machine** (`share.sh` in the round 3 comment; cold, a target of its own, `aarch64-apple-darwin`): after the fourteen test steps' builds (271 units), the ten apps with `--target <host>` compile 270 units and add 616,616 KiB under `target/<host>` and 135,064 KiB under `target/debug`; the same ten without `--target` then compile 47 units and add 107,856 KiB. The 47 are the same crates `main`'s step compiles on the runner. **The seal at `9ef866436`, nightly run 37740449787** (conclusion success: `host`, `portability-linux`, `portability-macos`, `toolchain / build`, `tcg / suite`): ``` the cache entry, read by content: none restored: the run is cold the apps for linux: 10 app(s) pass `cargo build`; … the tree, sealed as the host cache's entry: 17010 files, 7493968284 B of the 8000000000 B an entry may hold; sealed: 2496 sources, built on Linux X64 ubuntu24 20261004.327.1, every target dated as built [ci] Seal: 80 step(s), all green ``` Units per step in its log, against the two columns above: | step | `9ef866436` | `88bcbf4d3` | `main` | |---|---|---|---| | `userland/*` | 225 | 225 | 289 | | the apps for linux | 42 | 282 | 47 | | the apps for macos | 264 | 248 | 248 | | the apps for windows | 240 | 239 | 239 | Every other step compiles what it did at `88bcbf4d3`. I expected 47 for the Linux apps: it is `main`'s 47 less `crc32fast`, `log`, `memchr`, `smallvec` and `toyos-keymap`, which an earlier step had compiled. I did not expect the macOS step's 16 more: all are host-side units (`syn`, `thiserror-impl`, `tokio-macros`, `futures-macro`, `autocfg` and the like), which the Linux step's `--target` build used to compile for the host and which the first `--target` step now compiles instead. The four steps together compile 771 units against 994 at `88bcbf4d3` and 823 on `main`. - Margin: 506,031,716 B under the limit, 6.3 %, on image 20261004.327.1. `main`'s 7,664,839,895 B was sealed on 20260927.320.1. The one pair of figures there is for the two images is `f260e0b98`, built with full debuginfo before #752 cut it to line tables: 8,540,783,725 B on 20260927.320.1 (run 37292450697) against 8,182,940,473 B on 20261004.327.1 (run 37601225884), 357,843,252 B or 4.2 % less on the newer. So this head's figure and `main`'s are not a pair, and this head is unmeasured on the older image. - Against the same branch before the fix and before #752: 9,348,536,345 B at `88bcbf4d3` on 20260927.320.1. **`ci.yml` run 37740454881 at `9ef866436`:** `host`, `toolchain / build` and `guest / suite` success. After this lands every `host` check runs cold until the first nightly on `main` seals and saves: the path list is the cache's version. **Toolchain keys.** The fold moves the sysroot key once: `userland/.cargo/config.toml` was one of its inputs and `.cargo/config.toml` replaces it. From now on a change to any guest triple's flags moves that key. The merges of #747 and #749 moved `toyos-abi` and `toyos`, so the sysroot key moved with `main`; the key at this head was not read here. ## No new gate, test or dependency No guest test is added or changed. No dependency is added. The proof is a one-off script because its subject is this one change against its base. ## Size `git diff --shortstat origin/main...HEAD` at `dd12c0b32`: 53 files, +5454 −7765. Without the locks: 48 files, +446 −704. `src/`, `tests/toyos.rs` and `tests/common/`: 12 files, +237 −360, of which tests are roughly +65 −115 by my reading of the hunks (an estimate, not a count). `issues/`: 16 files, +49 −115. ## What I am unsure of - **The seal on the older runner image.** GitHub serves two; this branch was sealed on the newer one, at `9ef866436`. The only pair of figures for the two is `f260e0b98` with full debuginfo (above): the older image sealed it 357,843,252 B larger. Carried unscaled onto this tree that leaves 148,188,464 B under the limit on the older image; scaled by the pair's ratio, about 178 MB. Both are arithmetic, not a run. - **`dd12c0b32` itself:** `ci.yml` run 37757675374 has `host` and `toolchain / build` success at it; its `guest / suite` is what the landing waits on. #757 (`b6bcb9691`) landed on `main` after this head was merged and measured: ten source files under `kernel/src`, `toyos-abi/src`, `toyos-userbound/src` and `tests/toyos-rust-tests`, no manifest and no lock; `git merge-tree --write-tree dd12c0b b6bcb96` exits 0. Nothing here was measured with it in. It differs from the sealed head by `main`'s #749, #750, #753 and #755 and the root lock's two edges; the seal's byte count at this head is unmeasured. - **Build wall clock.** One run under load; the fold was not slower. - **Clippy reaches further.** The bare-target shapes now also lint the kernel's and the loader's path dependencies for those targets. - **The licence gate reads a superset.** `--all-features` for the kernel now turns on every member's features. It judges more than ships. - **The runner's cargo.** The nightly's `host` at `88bcbf4d3` parsed the optional `include`, so the runner's cargo accepts it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

…pinned in its row, and the dropped press decided where a host test reads it A holder supplied `\_S5`'s sleep type as often as it liked and each call wrote a kernel record. `acpi_mode::s5` now refuses a second under one claim (`AlreadyExists`), and `release` clears the flag, so "replaceable" means by the next claim's holder and the log carries one line a claim. The guest probe reads both: its keeper supplies a sleep type q35 does not power off on and is refused a second; the probe, the next holder, supplies q35's over it and is refused a second in its turn; the harness reads exactly those two kernel lines and that QEMU stopped the guest for `guest-shutdown`, which it does on the probe's value alone. The probe's first refused shutdown moves ahead of the keeper, since the keeper's value outlives it. The `acpi_tables_loaded` row compared the server's line with the kernel's echo of the same word. It now takes the kernel's line whole to the value, as `Q35_S5_SUPPLIED` holds q35's, and the T14's is `T14_S5_SUPPLIED`: PM1a control at 0x1804 and SLP_TYPa 7, which the kernel's byte scan of that machine's DSDT logged on the boot #749 landed on (`ACPI: PM1a=0x1804 SLP_TYPa=7`). The row also reds on the server's word that the machine has no power-off. What a press is whose power-off came back refused was a match arm in `Server::press` that no test reached. It is `sci::unstopped`, pure, with a host test: only the kernel's `NotSupported` on a machine this server handed no sleep type drops the press. The track records what the claim's holder gains, the sleep type a power-off enters, with its owner and exit; says which machines without a power-off are the ruled state and which a weakness with an exit; says the refusal during the load stays; and gives "Go on, say it loudly" the breadth it was ruled with. The T14 power-off issue names the re-owning as this slice's placement. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu marked this pull request as ready for review October 7, 2026 22:09

Japabu and others added 2 commits October 8, 2026 00:36

Merge remote-tracking branch 'origin/main' into wt/toyos-acpis1

ed522dd

Japabu changed the title ~~The acpi claim's mediated access: firmware memory, ports and configuration space through the kernel, and the Global Lock~~ The acpi claim's mediated access: firmware memory and ports through the kernel, configuration space read, and the Global Lock Oct 7, 2026

Japabu and others added 2 commits October 8, 2026 01:40

Japabu changed the title ~~The acpi claim's mediated access: firmware memory and ports through the kernel, configuration space read, and the Global Lock~~ The acpi claim's mediated access and the Global Lock, and acpiserver loading the machine's tables through them Oct 8, 2026

Japabu and others added 5 commits October 8, 2026 09:24

Merge remote-tracking branch 'origin/main' into wt/toyos-acpis1

dbdc05f

Merge remote-tracking branch 'origin/main' into wt/toyos-acpis1

87bf03b

The ACPI module's header says whose range registers type an unlisted …

3a18a85

…address Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A

Japabu mentioned this pull request Oct 8, 2026

The panel test boots an image without sshserver, and a CI step's cargo finds fresh what the job's cargo built #756

Merged

Japabu changed the title ~~The acpi claim's mediated access and the Global Lock, and acpiserver loading the machine's tables through them~~ ACPI S1: the kernel reads and writes for the acpi claim's holder what its AML names, and acpiserver loads the machine's tables through it Oct 8, 2026

Japabu changed the title ~~ACPI S1: the kernel reads and writes for the acpi claim's holder what its AML names, and acpiserver loads the machine's tables through it~~ The acpi claim's mediated access and the Global Lock, and acpiserver loading the machine's tables through them Oct 8, 2026

Japabu enabled auto-merge October 8, 2026 08:49

Japabu added this pull request to the merge queue Oct 8, 2026

Merged via the queue into main with commit 6f87cdb Oct 8, 2026
3 checks passed

Japabu deleted the wt/toyos-acpis1 branch October 8, 2026 09:27

This was referenced Oct 8, 2026

An IPC setup no longer takes back a handle it installed: connect, inbox setup, pipe and port #758

Merged

Power-off goes through the ACPI server: the claim's holder supplies the sleep type, and the kernel's S5 byte scan is deleted #764

Merged

Japabu mentioned this pull request Oct 8, 2026

A claim keeps where its BARs are and no object over them: a BAR asked for again after its handle closed no longer panics the kernel, and two answers held at once map apart #761

Merged

Conversation

Japabu commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Answers to review round 5

Answers to review round 4

Answers to review round 3

The boot processor's range registers decide, read once (c62f75db4)

Outside finding T001-PR-01

The read passes at an unlisted register (88f38a289)

The read passes in runtime-services data (253d4f5f4)

The first load on the real machine, and what 2484aa3a5 changes

The merge with main, hunk by hunk

What changed, per decision

Answers to review round 1

The test machine's memory, read

Answers to review round 2

Why the probe is a guest test

The kernel half: unsure, and reached by no tier

The server half

What changed, per decision

The lines toyos-aml changes, for the merge with #750

What a line may be quoted from

Tests, by tier

Checks of the high-risk code

The T14 row

Gates

The server half: unsure, and reached by no tier

Lines

Uh oh!

Japabu commented Oct 7, 2026

m01-ram-passes

m02-table-write-passes

m03-no-straddle-check

m04-kernel-windows-pass

m05-local-apic-passes

m06-past-the-map-passes

m07-mapped-end-off-by-one

m08-facs-write-passes

m09-ecam-is-plain-memory

m10-other-types-pass

m11-unlisted-passes

m12-overlap-misses-the-last-byte

m13-kept-port-passes

m14-read-only-port-written

m15-row-port-passes

m16-only-the-first-port-asked

m17-qword-port-passes

m18-header-written

m19-extended-written

m20-driven-function-written

m21-capability-written

m22-capability-end-off-by-one

m23-any-segment-reached

m24-any-bus-reached

m25-config-crosses-a-dword

m26-config-past-the-function

m27-ecam-first-bus-ignored

m28-owned-lock-taken

m29-pending-never-set

m30-release-never-signals

m31-release-keeps-pending

m32-narrow-facs-address-wins

g00-policy-passes-everything

g01-unbound-claim-answers

g02-claim-end-keeps-the-lock

g03-runtime-declarations-unasked

g04-fixed-declarations-unasked

g06-take-not-recorded

g07-every-function-free

g08-memory-write-dropped

g10-wide-value-taken

g11-reserved-bytes-unread

g12-pending-not-left

Uh oh!

Japabu commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BLOCKER

NOTE

Uh oh!

Japabu commented Oct 7, 2026

Japabu commented Oct 7, 2026 •

edited

Loading

The boot processor's range registers decide, read once (`c62f75db4`)

The read passes at an unlisted register (`88f38a289`)

The read passes in runtime-services data (`253d4f5f4`)

The first load on the real machine, and what `2484aa3a5` changes

The merge with `main`, hunk by hunk

The lines `toyos-aml` changes, for the merge with #750

Japabu commented Oct 7, 2026 •

edited

Loading