toyos-acpi decodes the IORT; toyos-smmu and toyos-its hold the SMMUv3's and the ITS's encodings, over toyos-phys's one address type

Cargo.toml

@@ -45,6 +45,7 @@ members = [
     "toyos-hda",
     "toyos-i219",
     "toyos-inspect",
+    "toyos-its",
     "toyos-keymap",
     "toyos-logstream",
     "toyos-manifest",
@@ -56,8 +57,10 @@ members = [
     "toyos-net-udp",
     "toyos-net-wire",
     "toyos-osrelease",
+    "toyos-phys",
     "toyos-quiesce",
     "toyos-rootimage",
+    "toyos-smmu",
     "toyos-swap",
     "toyos-symbols",
     "toyos-tco",

issues/the-smmuv3-and-its-crates-declare-what-the-aarch64-kernel-also-declares.md

@@ -0,0 +1,47 @@
+---
+status: open
+kind: defect
+opened: 2026-10-09
+---
+
+# The SMMUv3 and ITS crates declare what the AArch64 kernel also declares
+
+`toyos-smmu` and `toyos-its` came in with no kernel file touched, so each
+declaration below has a second home in `kernel/`, and nothing holds the two
+equal. `toyos-smmu` takes the stage 1 descriptors, the `MAIR` and `PXN` from
+`toyos-bootmap::aarch64` already; what is left is what `toyos-bootmap` does not
+declare.
+
+**The stage 1 descriptor.** `toyos-smmu/src/table.rs` declares `VALID` (bit
+0), `TABLE_OR_PAGE` (bit 1), `AP_UNPRIVILEGED` (bit 6), `AP_READ_ONLY` (bit
+7), `NOT_GLOBAL` (bit 11) and the level index `at >> (39 - 9 * level) & 0x1FF`.
+`kernel/src/arch/aarch64/paging.rs` declares the same bits as `VALID`,
+`TABLE`, `AP_EL0`, `AP_READ_ONLY` and `NOT_GLOBAL`, and the same `index`. It
+also declares `INNER_SHAREABLE`, `OUTER_SHAREABLE`, `AF`, `PXN` and `UXN`,
+which `toyos-bootmap/src/aarch64.rs` holds: the kernel's own copy of that
+crate's.
+
+**The redistributor.** `toyos-its/src/lpi.rs` declares `GICR_CTLR.EnableLPIs`,
+`GICR_TYPER.PLPIS` and `GICR_TYPER.Processor_Number`. `GICR_TYPER`'s other
+fields (`VLPIS`, `Last`, the affinity) are `kernel/gicv3/src/lib.rs`'s, and
+the two registers' offsets are `kernel/src/arch/aarch64/irqchip.rs`'s: one
+register's fields have two crates. `toyos_its::TRANSLATION_FRAME` and
+`toyos_gicv3::FRAME` are both the GIC's 64 KiB frame.
+
+**Owner.** `issues/toyos-runs-on-arm64.md`'s stage 6: the SMMUv3 unit, which
+writes these tables from `kernel/src/arch/aarch64/` beside `paging.rs`, owns
+the descriptor; the ITS, which edits `irqchip.rs` and reads `GICR_TYPER` for
+every CPU, owns the redistributor.
+
+**Exit.** Each bit and the level index has one declaration that the kernel's
+tables, the loader's and the unit's are all written from, and each
+redistributor register's fields have one crate:
+
+```
+rg -n 'const (VALID|TABLE|TABLE_OR_PAGE|AP_\w+|NOT_GLOBAL|INNER_SHAREABLE|OUTER_SHAREABLE|AF|PXN|UXN): u64' \
+    kernel/src/arch/aarch64/paging.rs toyos-smmu/src/table.rs
+rg -n 'fn index' kernel/src/arch/aarch64/paging.rs toyos-smmu/src/table.rs
+```
+
+print nothing, and `rg -l 'GICR_TYPER' toyos-its kernel/gicv3` names one
+directory.

src/licence.rs

@@ -270,6 +270,46 @@ pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[
         "ours: QEMU's own XSDT, captured by the commit that added toyos-acpi",
         Terms::Spdx("MIT OR Apache-2.0"),
     ),
+    // The tables QEMU 11.1.1 published to its `virt` machine in both of its
+    // GIC modes, read out of guest physical memory over the monitor with no
+    // operating system in the guest. Firmware output, as the q35 tables above:
+    // `toyos-acpi/tests/iort.rs` decodes them.
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/hwgic/apic.bin",
+        "5f65e29aa3c1d4b7afce9f22c144797f2d4234a58e7fbeaae48c1744d0713976",
+        "ours: QEMU `virt`'s own MADT under the hypervisor's GIC, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/hwgic/iort.bin",
+        "6b0a25a264422e32097f761d5d82cd7d5142bbe20a6d6ef22b7750c9ff7cd8e2",
+        "ours: QEMU `virt`'s own IORT under the hypervisor's GIC, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/its/apic.bin",
+        "ca5ef1376c5e30ee314a9a22c225fe34e9721889a6884bc36239c9d145759452",
+        "ours: QEMU `virt`'s own MADT under its emulated GIC and ITS, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/its/iort.bin",
+        "57b1d81a2995c018d623a8d4a0ecb7318624f03065c3deb820773f3c7d5c7a93",
+        "ours: QEMU `virt`'s own IORT under its emulated GIC and ITS, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/rsdp.bin",
+        "88f4591b661d951ae67bca4b740dbebf8e0382b1e27dc915ae44ceddb3a09df7",
+        "ours: QEMU `virt`'s own RSDP, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
+    (
+        "toyos-acpi/fixtures/qemu-11.1.1-virt/xsdt.bin",
+        "8129cb6793e7b6f375e60f6e9780feff0b11b1e99da8c0b1dc4135700123725d",
+        "ours: QEMU `virt`'s own XSDT, captured by the commit that decodes the IORT",
+        Terms::Spdx("MIT OR Apache-2.0"),
+    ),
     (
         "toyos-acpi/fixtures/ovmf-pure-efi/root-bridge-0.bin",
         "eb00e68be746a09ac7f0ce1ca492ce8c858e3af1152112b49ffb4708883acbfb",

toyos-acpi/fixtures/qemu-11.1.1-virt/SOURCE

@@ -0,0 +1,28 @@
+The RSDP, the XSDT, the MADT and the IORT QEMU 11.1.1 published to its `virt`
+machine under edk2-stable202408 (QEMU's own `edk2-aarch64-code.fd`), with no
+operating system in the guest: the firmware was left to reach its shell, and
+the guest's memory was then written out by the monitor's `pmemsave`. Every
+address was walked host-side from the RSDP, found by its signature and both
+checksums, so no byte here came through the decoder these fixtures judge. Each
+table sums to zero.
+
+  qemu-system-aarch64 -M <machine> -accel hvf -cpu host -smp 4 -m 256 \
+      -nodefaults -display none \
+      -drive if=pflash,format=raw,readonly=on,file=edk2-aarch64-code.fd
+
+  hwgic/  -M virt,gic-version=3,iommu=smmuv3
+          the hypervisor's own GICv3, which has no ITS: the MADT ends in a
+          GIC MSI Frame structure, and the IORT is an SMMUv3 and a root complex
+  its/    -M virt,gic-version=3,its=on,iommu=smmuv3,kernel-irqchip=off
+          QEMU's emulated GICv3 with its ITS: the MADT ends in a GIC ITS
+          structure, and the IORT is an ITS group, an SMMUv3 and a root complex
+
+Both boots put every table at the same address, so the RSDP and the XSDT are
+one file each:
+
+  rsdp.bin  0x4cb43018      xsdt.bin  0x4cb43f18
+  apic.bin  0x4cb43c98      iort.bin  0x4cb43198
+
+Those are `tests/iort.rs`'s regions, so the XSDT's own entries point at them
+and the walk under test is the real one. The XSDT's other six entries (FACP,
+PPTT, GTDT, MCFG, SPCR, DBG2) name tables that are not here.