PCI apertures are a declaration the kernel holds, made from each root's _CRS (design; stage A: the declaration and the hybrid IOMMU rule)

[Japabu]

Status: draft. Stage A, final head 01f59e28c (main 9842eeda5 merged). Review round 3 asked for a comment fix only. Both machines ran 5dabb22b5: the T14 3 of 3, the AMD bench 1 of 1. Since then only comments and the merge changed, and --ci host is green at the head.

Problem

cargo run -- --arch aarch64 hands over none of its four PCI functions (diskserver's NVMe, soundserver, netstack, vdagent). Each BAR is moved onto 2 MiB slots inside ECAM at 0x4010000000, and none of them answers (the issue's log, lines 212–233 and 326–343).

The cause is the window list the loader declares. It concatenates two reads:

• what firmware reports as each root bridge's current windows: 0x10000000..0x10100000 and 0x8000000000..0x8000100000, 1 MiB each, too small for a 2 MiB slot;
• every unowned MMIO range in firmware's memory map (loader/src/gcd.rs): flash 0x4000000..0x8000000, 0x10100000..0x3f000000 (which takes in the PCI I/O window), ECAM 0x4010000000..0x4020000000, and high MMIO.

Only some of the second read are bridge windows. #869 was closed because excluding ECAM in the kernel fixes one reader of that false list and leaves the rest. The owner's ruling: aperture discovery does not go in the loader; AML stays in acpiserver; the redesign builds on #875's root walk; and a refused or partial declaration fails closed for the IOMMU as well as for placement.

What _CRS says on virt (measured)

I dumped the virt DSDT that QEMU 11.1.1 / edk2 publishes (same machine options as cargo run, HVF), loaded it in toyos-aml on the host and evaluated \_SB.PCI0._CRS. No hardware access happened during the load or the evaluation. The root is PNP0A08 (_CID PNP0A03), segment 0, bus 0. Its resource list:

• 16-bit bus numbers 0..=0xff;
• 32-bit memory 0x10000000..=0x3efeffff;
• 32-bit I/O 0..=0xffff, translated to 0x3eff0000;
• 64-bit memory 0x8000000000..=0xffffffffff.

That excludes ECAM, flash and the I/O window, and the 64-bit window has room for all four functions. toyos_acpi::memory_windows reads only 64-bit entries today, so it must learn the 16- and 32-bit ones.

Design

Ownership. acpiserver declares the root bridges' memory, and the kernel holds the declaration. The kernel's state is unknown, declared (checked whole, never replaced) or refused (by name). A PCI claim is handed over only under a declaration, and places BARs only inside its windows.

Stage A (this branch).

1. Done in 151046b1c. toyos_pci::aperture::check refuses a declaration as a whole if it is empty, has a window of no length or one past the address space, or has two windows sharing an address. pcidev holds the three states. A claim is refused before it reserves a slot or touches the function when nothing is declared, or the declaration was refused. The loader's list is still what gets declared, at publish, so x86 is unchanged: the T14's recorded seven-window list is the test's accepted case, and q35's list is accepted (bar_map_again passes).
2. Done in 2c166146f. The hybrid IOMMU rule (kernel/src/iommu/window.rs, bounds).
   • Where the unit translates more bits than the CPU's physical addresses, a domain sits above every address the CPU can issue and needs no declaration. The unit's width is VT-d §11.4.2's MGAW/SAGAW, or the SMMUv3 tables' 48-bit input; the CPU's is CPUID 8000_0008H EAX[7:0] or ID_AA64MMFR0_EL1.PARange (new arch::cpu::physical_address_bits).
   • Otherwise the old rule applies: a quarter of the way up the unit's range, ending under the first declared window or RMRR above that. It now reads pcidev's accepted declaration instead of the loader's raw list, and with no declaration held there is no domain (IommuError::Undeclared).
   • The T14 (aw=48 mgaw=39 against windows reaching 2^39) stays on the old rule, so its domains are placed as before. virt and q35 move above the CPU's width.
   • AMD-Vi (AMD-Vi translates: a blocked device table, identity and own domains, the event log, and one domain registry for every backend #909) takes the same declaration through the shared registry (iommu/domains.rs): amdvi::init reserves its IVMDs only beside declared windows, as vtd does its RMRRs. Its domains are 48 bits (mode-4 host tables, 48882 §2.2.3).
   • pcidev hands the IOMMU a toyos_pci::aperture::Declaration, which only check constructs. iommu::init logs the CPUs' physical width once, so every boot shows which rule applied.
   • PARange 0b0111 is 56 bits (FEAT_D128). It is mapped now instead of panicking.
3. Moved to stage B by ruling: the supervisor start order and the bounded wait for the declaration.
4. 97a2253fe. The issue records the cause, that PCI apertures are a declaration the kernel holds, made from each root's _CRS (design; stage A: the declaration and the hybrid IOMMU rule) #916 has taken it up (status: assigned), and that stage B hands over the four claims.

The AMD bench.

• Its recorded loader list (AMD-Vi translates: a blocked device table, identity and own domains, the event log, and one domain registry for every backend #909's bench log) is accepted by check and is now a case in the host test.
• Its unit reports va=64 pa=48, but its domains are 48-bit mode-4 tables, so the width the rule compares is 48.
• Measured on its boot at 5dabb22b5: iommu: the CPUs issue 48-bit physical addresses. So the bench takes the declared rule. Its domains run from 2^46 to 2^48 with no window above 2^46, as before (addresses from 0x400000000000 to 0x1000000000000), and a const assertion holds that case.
• The T14 logs iommu: the CPUs issue 39-bit physical addresses against its mgaw=39 unit, so it also takes the declared rule (0x2000000000 to 0x4000000000, as before).
• QEMU's q35 and virt take the above-the-CPU rule (virt_smmu's domain at 2^40).

Stage B.

• acpiserver evaluates _CRS on each PCI root The AML interpreter finished to ACPI 6.5: Load and _OSC, the namespace initialised, every address space, every event, and the bounds stated #875's walk finds, keeps memory windows only, and declares them once through a new operation on its acpi claim. The kernel admits a declaration only from the unknown state and only from the acpi claim's holder.
• AArch64 gets a hardware-reduced acpi claim: AML's mediated memory and configuration access, no PM1, SCI or fixed hardware.
• acpiserver starts before every PCI claimant. A PCI claim made while nothing is declared waits on the declaration's watch until it is declared or refused, or until a stated deadline passes. If acpiserver's claim ends without declaring, the state becomes refused.
• Deleted: loader/src/gcd.rs, loader/src/rootbridge.rs, PciRootBridgeIo, and KernelArgs::root_bridge_windows with its count.
• The T14's DSDT load time before diskserver is measured on the bench.
• The kernel's xHCI and HDA, on machines of the T14's kind (a unit no wider than the CPU), wait a bounded time for acpiserver's declaration before making their domains. That cost is measured on the T14.
• The ARM machine's four claims arrive here, and the issue closes at its exit.
• A _CRS memory window with a non-zero _TRA (a bus address that differs from the CPU address) is refused by name. The declaration stays in CPU addresses, which the above-the-CPU premise rests on.

IOMMU: why the hybrid rule

Option 2 (above the CPU's width in all cases) leaves the T14 no room. Its unit translates 39 bits (iommu: domain2 root=0xa31000 aw=48 mgaw=39), and its declared windows reach 0x8000000000 = 2^39 (tests/checks/claims.rs:11-13). So the CPU issues at least 39-bit addresses, and a floor at 2^39 meets the unit's ceiling.

The hybrid rule keeps option 2 wherever the unit has room, and falls back to the declared windows, failing closed, only where it does not. I chose not to take a firmware over-approximation for the IOMMU alone, because it keeps a loader read the ruling removes.

"Nothing the CPU reaches lies above its physical width" is the premise of the above-the-CPU placement: a root-bridge window is MMIO the CPU must address.

Roast

• Stage A alone changes little. Lists that are empty or contradict themselves are refused by name. A claim depends on a typed state instead of a bare list. On machines whose unit is wider than the CPU, domains no longer depend on any window list. Its value is the seam stage B declares through.
• The fail-closed claim on a refused or missing declaration has no guest that reaches it. In stage A the loader's list on q35, virt and the recorded T14 is always accepted. It rests on check's host test and on reading the code; stage B's wait gives it a guest test.
• A q35 or virt domain now starts at 2^40 instead of 2^46. Every device in those guests reaches it (4 x86 and 3 aarch64 guests pass).
• The AMD bench's domains now depend on check accepting its loader list (measured to be accepted) and on bounds (see above).
• Stage B moves every machine's apertures into userland, which puts x86 metal on its critical path: the T14 rows, a T14 boot and the DSDT load time.

Checks

Evidence, all at 6f5f5e759 (every file re-masked): metal round 2 agents/arm-aperture/metal-r2/; round 1 round2/ at 79c0224a9. Earlier: pr-916 at 516afa638 (T14), and stage A at 47f3a9be0. Paths are masked; the README lists every command, exit code and revision.

check	revision	result
Round 3, merged with main 9842eeda5: cargo run -- --ci host	01f59e28c	exit 0, 77 steps green (log)
Round 1, merged with main 5b48a3d17: cargo run -- --ci host	5dabb22b5	exit 0, 77 steps green (log)
cargo test --test toyos-build -- bar_map_again lent_device_memory_refused usbd_drives_the_spare iommu_virtio_platform amdvi_selftest amdvi_firmware_left (q35: VT-d, and QEMU's amd-iommu)	5dabb22b5	exit 0, 6 passed (log)
cargo test --test toyos-build -- virt_smmu virt_claim_lpi virt_low_ecam (virt, HVF)	5dabb22b5	exit 0, 3 passed (log)
T14 (2 boots, orchestrator): claim_reuses_its_remapping_entry, domain_ends_below_the_host_bridges, usbd_drives_the_type_c_controller	5dabb22b5	3 passed, 0 failed. CPU 39 bits, unit 39 bits: declared rule, domains 0x2000000000..0x4000000000 (judge, runner, readbacks)
AMD bench (1 boot, orchestrator): amdvi_translates_the_stick_controller	5dabb22b5	1 passed, 0 failed. CPU 48 bits, mode-4 domains 48 bits: declared rule, domains 0x400000000000..0x1000000000000 (judge, runner, kernel log)
Staging for the two rows above	5dabb22b5	exit 2 each, no machine touched (request)
cargo run -- --ci host	3f421a7a8	exit 0, 77 steps green (log)
cargo test --test toyos-build -- bar_map_again lent_device_memory_refused usbd_drives_the_spare iommu_virtio_platform (x86_64 q35, TCG)	3f421a7a8	exit 0, 4 passed (log)
cargo test --test toyos-build -- virt_smmu virt_claim_lpi virt_low_ecam (aarch64 virt, HVF)	3f421a7a8	exit 0, 3 passed. virt_smmu's domain write lands at 0x10000000040 (2^40) (log)
Negative control, whole production change reversed: virt_smmu	3f421a7a8 minus production.patch	exit 0, the write at 0x400000000040, the old 2^46 floor. The test judges translation, not placement, so the control shows the change's effect rather than a red (log)
Mutation: overlap refusal weakened in check	mutation-overlap.patch	exit 101, a_declaration_is_held_only_whole_and_disjoint red (log)
Mutation: no declaration treated as an empty one in bounds	mutation-undeclared.patch	exit 101, the const assertion at window.rs:183 fails the kernel build (log)
T14 (two boots, run by the orchestrator): claim_reuses_its_remapping_entry, domain_ends_below_the_host_bridges, usbd_drives_the_type_c_controller	3f421a7a8	3 passed, 0 failed, both boots rc=0 (judge, republished with its provenance, runner, readbacks). Every domain is aw=48 mgaw=39 addresses from 0x2000000000 to 0x4000000000, the old rule unchanged
virt DSDT _CRS probe (host, a throwaway test deleted afterwards)	abc2bfc15	windows as listed above (dsdt.bin)

Not established yet: the ARM machine's four claims, which are stage B.

No metal exists for AArch64. The cargo run aarch64 boot still refuses its claims at placement inside ECAM, as the issue records, until stage B.

🤖 Generated with Claude Code

https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy

[Japabu]

Orchestrator rulings on the two open decisions.

1. IOMMU: (ii), the hybrid. Where the unit has room above the CPU's address width (the AMD bench, virt), a domain is placed there and needs no window declaration. Where it has none (the T14: mgaw=39 and windows up to 2^39), domains are placed from the kernel's accepted declaration and fail closed without one. In stage A the declaration is still the loader's list, so nothing changes on any machine. In stage B, on a machine of the second kind, the kernel's own drivers that DMA (xHCI, HDA) wait on the declaration event, bounded, before creating their domains; the loader has already read ROOT into memory, so acpiserver can start first. The cost of that wait on the T14 is measured in stage B, not argued. Option (iii) keeps the loader read the owner's ruling removes, so it is out.
2. The bounded wait and the supervisor order move to stage B, where a claim can first see "unknown".

Finish stage A on that: the state machine and the fail-closed claim as built, plus the hybrid placement rule keyed on the unit's width against the CPU's; then the checks (--ci host, the virt_* guests under HVF, the negative control) and the staged T14 image.

[Japabu]

Review of #916 at 3f421a7a8 (main 3ba4a4a2f merged)

Architecture

Stage A fits the owner's #869 ruling and the orchestrator's ruling 6154625383. pcidev owns the declaration as Unknown / Declared / Refused. The pure crate owns the whole-list check, and bounds makes the IOMMU depend on an accepted declaration only where the unit is no wider than the CPU. No loader read is added, and stage B removes the existing one. Production grows by about 200 lines net, with one host test and one const-assert block. The changes are proportionate: most of the diff threads Option<&[..]> through the backends, and that is the real change in contract. Two parts of the evidence and docs are correct:

• The state-machine wiring in claim is correct. The match on apertures (kernel/src/pcidev/mod.rs:804-816) comes before reserve(who) and bring_up. Before it there are only cached machine.functions lookups, so a refused or missing declaration touches no register and spends no slot. place_bar now receives the snapshot instead of re-reading MACHINE, so one claim sees one declaration.
• The T14 claim holds. Its windows reach 2^39, so the CPU reports at least 39 bits, and mgaw=39 can never satisfy translatable > cpu. The old rule applies whatever its CPUID says. The coordinator's run at 3f421a7a8 confirms it: 3 passed over 2 boots, and domain2..5 ... aw=48 mgaw=39 addresses from 0x2000000000 to 0x4000000000 matches the bounds(39, 39, Some(&T14)) const assert. The firmware declared root bridge memory: line that claims.rs parses is unchanged.

Findings

BLOCKER — the branch conflicts with current main, and its AMD-Vi premise has gone stale. GitHub reports mergeable: CONFLICTING. git merge-tree HEAD origin/main conflicts in smmu/domain.rs, smmu/mod.rs, iommu_unit.rs, vtd/domain.rs and vtd/table.rs.

• AMD-Vi translates: a blocked device table, identity and own domains, the event log, and one domain registry for every backend #909 (9b2b128) has landed. It adds the shared kernel/src/iommu/domains.rs registry, which calls Window::new(translatable, &self.reserved, room) for every backend. It also makes amdvi::init(rsdp, devices, windows: &[RootBridgeWindow]) build domains at 9 * ROOT_LEVEL + 12 = 48 bits, clear of windows and the IVMDs.
• The body's line "AMD-Vi makes no domain on main, so 48882's width has no site yet" is now false. The resolution has to carry Option through Domains::avoid/prepare and amdvi::init, treating IVMDs as vtd treats RMRRs.
• The AMD bench is a declared metal machine (amdvi_translates_the_stick_controller). Its domains will start depending on check accepting its loader list and on bounds.
• The orchestrator ruling counts the AMD bench among machines with room above the CPU. That is an inference. AMD-Vi here is 48 bits. If the bench's Zen 2 part reports PhysAddrSize 48, it takes the old rule and needs the declaration.
• Required evidence after re-merging:
  • --ci host;
  • the q35 and virt rows already run;
  • amdvi_selftest and amdvi_firmware_left (QEMU, phys-bits 40, so the above-CPU branch);
  • the AMD bench's amdvi_translates_the_stick_controller row, staged with --metal-readback. At minimum, run the bench's recorded firmware declared root bridge memory list through check and state its CPU width.

BLOCKER — kernel/src/arch/aarch64/cpu.rs:5-21: PARange 0b0111 is valid, not reserved. Current Arm ARM DDI 0487 defines 0b0111 as 56 bits when FEAT_D128 (Armv9.4) is implemented.

• The function panics on it, and the comment "encodings past 0b0110 are reserved" is false.
• The panic fires at the first domain creation on a capable CPU. The boot path already passes the same field into TCR_EL1.IPS (control_regs.rs:97, boot.rs:122) without objecting.
• Fix: add 7 => 56 and cite the revision that defines it. Panicking on a value the cited document still reserves is fine.

SUGGESTION — kernel/pci/src/aperture.rs:76-93. check returns Result<(), Refused>, and pcidev then stores a bare Vec. A Declaration newtype that only check constructs would carry "held whole and disjoint" in the type, matching root's "validate once before constructing typed values". declared() and bounds could then take it. Optional, since today's single construction site is easy to inspect.

SUGGESTION — kernel/src/iommu/window.rs:4-15. The header is acceptable as a contract, but "as on the T14" names one machine in a module contract. Cut it. The const-assert doc already names the T14.

SUGGESTION (stage B design, not this branch). The hybrid premise compares device addresses with CPU addresses. _CRS windows can carry a _TRA offset, and peer-to-peer routing happens on bus addresses. Stage B's reader should keep the translation and state that the declaration is in bus addresses, or refuse a non-zero memory _TRA by name, so the "above every address the CPU can issue" premise does not rest on an unstated identity mapping.

Other points checked

• check and its host test. Each of the empty, zero-length, wrap and overlap refusals is covered. The recorded T14 list really is disjoint: I checked each end against the next base. The overlap mutation reds the test.
• Loader list. In edk2, PciHostBridgeDxe allocates each root's current aperture out of the GCD, so free_mmio and Configuration() do not overlap. q35, virt and the T14 are measured as accepted.
• bounds and the CPU width.
  • CPUID 8000_0008H EAX[7:0] is the right field on both vendors. TME-MK and SME report the full width there, so it remains an upper bound, which is the safe direction.
  • A device issuing more bits than the CPU is safe. Every root-bridge window is MMIO the CPU must reach, so bridges route only below 2^cpu.
  • Anything above 1 << translatable exceeds the domain's AGAW or T0SZ and faults at the unit.
  • VT-d's translatable_bits = min(SAGAW width, MGAW) is the cap that matters.
  • The SMMU's stage-1 48-bit input with 4 KiB granules is architecturally guaranteed.
• virt_smmu move from 2^46 to 2^40 and the revert control. The test judges translation, not placement, so a green under revert is expected. The log shows 0x400000000040 against 0x10000000040, and the placement oracle is the const-assert block. The Undeclared mutation breaks the build at it. Adequate.
• Fail-closed path reachable by no guest in stage A. Acceptable. The refusal decision is host-tested in check, and the kernel wiring is a five-line match before any side effect, established by inspection. Under root's policy that needs no guest test. Stage B's wait is where Unknown is first observable.
• Issue edit. status: assigned with the taking task named obeys issues/README.md. The _CRS figures match the body's measurement (..=0x3efeffff, ..=0xffffffffff).
• Comments. They are concise and true, apart from the PARange one above.
• Roast. Honest. Its last item should add the AMD bench once the merge lands.

SEND BACK

[Japabu]

Addendum: the published T14 evidence (ToyOSOrg/evidence pr-916 516afa638, t14/)

What the published copy establishes.

• Both boots ran the images staged at 3f421a7a8 (stage-a/request.txt).
• m916-t14.log records boot rc=0 for both images and a judge EXIT=0. Each boot's verdict.txt reads passed.
• testcases/kernel.log declares the T14's seven recorded windows. It shows domain2, domain3, domain4 and domain5 at aw=48 mgaw=39 addresses from 0x2000000000 to 0x4000000000, which matches the bounds(39, 39, Some(&T14)) const assert. The T14 stays on the old rule, and its domains land where they did. This settles the open T14 rows on the substance.

BLOCKER (evidence, cheap): t14/judge-a.log is published empty. GitHub's contents API reports size: 0 at 516afa638. The README cites it for "3 passed, 0 failed, 2 boots" and the three row names. The orchestrator's local readback does contain those lines. As published, the per-row PASS of claim_reuses_its_remapping_entry, domain_ends_below_the_host_bridges and usbd_drives_the_type_c_controller has no record, only the aggregate EXIT=0. Fix: republish the non-empty judge log and update the cited revision. No rerun is needed.

The earlier two blockers stand: the conflict with main (#909's AMD-Vi domains) and PARange 0b0111. The verdict is unchanged.

SEND BACK

[Japabu]

Round 1 answered at 5dabb22b5 (merged with main 5b48a3d17).

• BLOCKER 1 (conflicts and AMD-Vi):
  • Merged. Domains holds Option<Vec<_>>. amdvi::init takes the optional declaration and reserves its IVMDs only beside declared windows, as vtd does its RMRRs.
  • The AMD bench's recorded list is accepted by check and is now a case in the host test.
  • Its domains are 48-bit (mode 4, 48882 §2.2.3). If its CPU reports 48 bits, it takes the declared rule: 2^46 to 2^48, unchanged from its log, held by a const assertion. If the CPU reports fewer, it takes the above-the-CPU rule, which is equally clear of its windows (all below 2^40).
  • The CPU width was in no boot log, so iommu::init now logs it, and the staged boot will show which rule the bench takes.
  • Checks: --ci host green (77 steps); 6 x86 guests including amdvi_selftest and amdvi_firmware_left; 3 virt guests. The T14 rows and amdvi_translates_the_stick_controller are staged.
• BLOCKER 2 (PARange): 7 => 56 is in, citing DDI 0487 (FEAT_D128). I could not open DDI 0487 from this sandbox: Arm's site serves the register pages only through a script. The encoding rests on your reading of DDI 0487 and is not independently checked by me.
• Suggestions taken:
  • the Declaration newtype, constructed only by check and carried to iommu::init;
  • the window header no longer names a machine;
  • stage B refuses a non-zero memory _TRA by name (now in the body).
• Addendum (empty judge-a.log): my masking script truncated the local file before it published it, so the original bytes are lost. I republished the judge's lines exactly as my session read them before the truncation, with provenance.
  • With the head's judges, the usbd row reads red on those readbacks: pcidev: a claim takes an interrupt and gives it back; the four-slot limit goes #918 changed the hand-over line it looks for, and the readbacks come from the older kernel. I published that re-judge log too.
  • The 3f421a7a8 judges no longer build beside this tree's guest crates, so I could not rerun them.

Evidence: https://github.com/ToyOSOrg/evidence/blob/79c0224a9a354773bb77d3f960d508fe5dc0fb67/round2/README.md

[Japabu]

Round 2 on metal published: evidence commit f784edd1104bbbea082097f801aa42492dd3c56e, agents/arm-aperture/metal-r2/ (README). Images built at 5dabb22b5; image hashes match the manifests.

• T14: 3 of 3 over two boots. The CPU and the unit are both 39-bit, so it takes the declared rule (0x2000000000..0x4000000000).
• AMD bench: amdvi_translates_the_stick_controller passed. The CPU and its mode-4 tables are both 48-bit, so it also takes the declared rule (0x400000000000..0x1000000000000).

Every file is whole (none is 0 bytes) and masked with mask.sh. The same commit re-masks the earlier files on the branch that carried model or BIOS strings, and the PR body now links only this commit.

[Japabu]

Round 2 review of #916 at 5dabb22b5 (main 5b48a3d17 merged)

Architecture

The final change matches the orchestrator's rulings.

• pcidev holds Apertures::{Unknown, Declared, Refused}. toyos_pci::aperture::check is the only constructor of Declaration, so the "whole and disjoint" property is now in the type. The generic W is justified because toyos-pci is no_std with no allocation.
• The hybrid rule is implemented once, in iommu/window.rs::bounds, and reached through Domains::prepare → Window::new. VT-d, AMD-Vi and SMMU all go through that path.
• amdvi::init receives the declaration through iommu::init → unit::init, and drops IVMDs together with the windows when nothing is declared, as vtd does with RMRRs. With None, both backends produce Undeclared on the declared branch, and on the above-CPU branch they ignore regions that all lie below 2^cpu.
• PARange 0b0111 maps to 56 bits.
• No stage B work has leaked into this PR. There is no new ABI, no wait, and no change to the supervisor or loader. Unknown is only the static's initial state before publish, as the ruling's "state machine as built" allows.

Production grows by about 230 lines net, most of it threading Option through the backends. That is the actual change in contract.

Against current main (f0a987bc6), git merge-tree is clean. #919 touches none of this branch's files apart from vtd/fault.rs and vtd/queue.rs, which the branch leaves unchanged.

Round-1 items

• BLOCKER 1 (conflict, AMD-Vi): resolved.
  • Domains.reserved is now Option<Vec<_>> (kernel/src/iommu/domains.rs:22), and amdvi/mod.rs:262-266 reserves IVMDs only next to declared windows.
  • I checked the bench's recorded list in the host test (aperture.rs:134-142) entry by entry against the published bench kernel.log:94. All seven windows match.
  • The bench boot at the head logs iommu: the CPUs issue 48-bit physical addresses (kernel.log:102) and domain2..4 mode=4 addresses from 0x400000000000 to 0x1000000000000 (:200,221,272). That is the declared rule, and the const assertion window.rs:187 encodes it.
• BLOCKER 2 (PARange): resolved. cpu.rs:8-21 now has 7 => 56, citing FEAT_D128, which agrees with DDI 0487's definition. The panic is kept only for encodings that are still reserved.
• Addendum (empty judge-a.log): resolved for the head. metal-r2/ supersedes it with whole logs at 5dabb22b5. The earlier republication is labelled with its provenance, and the body cites it only for 3f421a7a8.
• Suggestions: all three were taken. These are the Declaration newtype, the header that no longer names a machine, and _TRA refused by name in stage B (in the body).

Evidence checked

• Evidence f784edd11, agents/arm-aperture/metal-r2/. No file is empty (the smallest are the 7-byte verdict.txt files, each reading passed).
  • The three image SHA-256s in the README equal those in t14/m916-r2-t14.txt and amd/m916-r2-amd.txt, and every manifest line names 5dabb22b5.
  • Every booted kernel log carries supervisor: build 5dabb22b51ff01b93133df58218480233878ddb9 clean: T14 testcases:320, T14 testcases-xhci-leave:301, AMD testcases:300. So the judges read the head's image.
• T14 judge. 2 boots, 3 PASS, 3 passed, 0 failed, 2 boot(s), runner boot rc=0 ×2 and judge EXIT=0.
  • Both logs show the CPUs issue 39-bit physical addresses.
  • Both show the seven recorded windows and aw=48 mgaw=39 addresses from 0x2000000000 to 0x4000000000.
• AMD judge. PASS amdvi_translates_the_stick_controller, 1 passed, 0 failed, 1 boot(s), runner boot rc=0 and judge EXIT=0. The README rows match the logs.
• Host checks, which I ran myself in a fresh worktree at 5dabb22b5.
  • cargo run -- --ci host: exit 0, Host: 77 step(s), all green.
  • cargo test -p toyos-pci aperture: 3 passed, including a_declaration_is_held_only_whole_and_disjoint.

Findings

BLOCKER — kernel/src/iommu/window.rs:10-11: the module header says the declared rule is the VT-d case.

• Problem. The header reads "Where it does not — a VT-d unit's MGAW (VT-d §11.4.2) no wider than the CPU's physical addresses — they start a quarter of the way up". The dash clause presents the declared rule as VT-d's case. In this module ("for every backend"), it applies to any unit with translatable <= cpu. This PR's own measurement puts the AMD bench there: AMD-Vi mode-4, 48 bits, on a 48-bit CPU. An SMMU on a CPU with PARange ≥ 48 bits lands there too.
• Consequence. A reader who changes AMD-Vi or the SMMU will conclude that those backends never depend on the declaration. That is exactly the dependency this round had to establish for the bench.
• Fix. Make it backend-neutral, for example "Where it does not — the unit translates no more bits than the CPU's physical addresses — …". Then cite each backend's width where it is computed, as amdvi/domain.rs:86 already does.
• Same paragraph. It says "above all memory" twice (lines 4 and 9). The second clause can just be "they lie above every address the CPU issues, and nothing needs declaring."
• Evidence. Comment-only, so no rerun is needed.

SUGGESTION — kernel/pci/src/aperture.rs:118-120. The doc comment's second line is about 110 columns, against roughly 80 elsewhere in the file. "Seven windows each that meet end to end" overstates the lists: on the T14, 0xc0000000..0xff000000 lies between windows. "Seven windows, some meeting end to end" says what the case actually exercises.

SUGGESTION (evidence, orchestrator's masking) — metal-r2/t14/testcases*/boot.txt. These still read machine_bios <bios> (1.71 ), while the README says BIOS strings are masked. A BIOS version does not identify one machine, so this does not block. The masking script misses a parenthesised suffix, though.

SEND BACK. The only required item is the one-paragraph header correction above. After it, I see nothing else needed for landing stage A.

[Japabu]

Round 3 at 01f59e28c423572d52be343fa5eca0c00789e79f.

• BLOCKER (window.rs:10-11), fixed in efdc1e8b3: the header now states the declared rule for any unit that translates no more bits than the CPU, whatever the backend. The reserved regions are named as RMRR or IVMD, and the repeated "above all memory" is gone. Each backend's width stays cited where it is computed.
• aperture.rs:118-120 suggestion: taken. The doc is wrapped, and it says "seven windows each, some meeting end to end".
• Merged origin/main 9842eeda5 (Microcode is a file per CPU on ROOT: the loader hands the kernel its CPU's patch, and the kernel loads Intel's and AMD's #923) without conflict. cargo run -- --ci host at the merge: exit 0, 77 steps green (log).
• No bench or guest rerun. This round changes comments only. In the IOMMU, pcidev, the backends and toyos-pci, the merge brings in only two comment edits from main (vtd/fault.rs, vtd/queue.rs); git diff 5dabb22b5 HEAD over those paths shows no other change. The metal results at 5dabb22b5 stand: T14 3 of 3, AMD bench 1 of 1.
• Evidence: the BIOS version suffix that mask.sh leaves after <bios> in every boot.txt is masked at the tip of pr-916 (f6c76870d), and the metal-r2 README says so. Latest evidence commit: 6f5f5e759b6f81021569b74234649adf9bf5ebb7.

[Japabu]

Evidence branch pr-916 was rewritten (owner-authorized) to mask machine identifiers in its history: tip is now c5429142f (was 6f5f5e7); file contents at the tip are unchanged apart from the masked strings, so commit hashes cited above no longer resolve — read the same paths at the new tip.