pcidev: a claim takes an interrupt and gives it back; the four-slot limit goes

issues/a-claimed-function-can-storm-its-cpu.md

@@ -6,9 +6,9 @@ opened: 2026-10-04
 
 # A claimed function can storm its CPU
 
-A function a process drives raises its claim slot's interrupt on cpu0 for
-every message it sends — on x86-64 the slot's vector
-(`kernel/src/arch/x86_64/idt/user_dev.rs`), on AArch64 the slot's LPI through
+A function a process drives raises its claim's interrupt on cpu0 for
+every message it sends — on x86-64 the claim's vector
+(`kernel/src/arch/x86_64/idt/user_dev.rs`), on AArch64 the function's LPI through
 the ITS (`kernel/src/arch/aarch64/irqchip/its.rs`) — and `pcidev::isr`
 (`kernel/src/pcidev/mod.rs`) takes each one; nothing bounds how often. Its
 holder programs the device through the BARs it maps, so a hostile or broken
@@ -18,7 +18,7 @@ them, and each one is an interrupt cpu0 takes before anything else it runs.
 that does to a CPU for a kernel driver's source; a claim is the same source
 with its holder outside the kernel.
 
-The lever is the slot's own translation: on x86-64 its remapping entry, which
+The lever is the claim's own translation: on x86-64 its remapping entry, which
 made not present stops the function's messages at the unit; on AArch64 its
 LPI's configuration byte, which cleared and followed by an `INV` disables
 the LPI at the redistributor. Masking through the device would need the

issues/a-claims-own-refusals-are-read-by-nothing.md

@@ -14,7 +14,8 @@ Refusals of `kernel/src/pcidev/mod.rs` that no test reaches:
 - `ClaimError::Ambiguous`, a config naming a device this machine has two of;
 - `ClaimError::KernelDriven`, a claim on a function one of this kernel's own
   drivers bound;
-- `ClaimError::Exhausted`, a claim past `MAX_FUNCTIONS` slots;
+- `ClaimError::Exhausted`, a claim past the vectors, remapping entries or
+  LPIs a machine has;
 - every window refusal — `Refusal::NoWindow`, `BarUnsizable`, `BarUnplaceable`,
   `BarResized` and `Dead`;
 - every bound `SYS_DEVICE_BAR_MAP` and `SYS_DEVICE_DMA_ALLOC` check, which is

issues/a-late-write-from-a-released-function-halts-the-machine.md

@@ -6,9 +6,9 @@ opened: 2026-10-10
 
 # A late write from a released function halts the machine
 
-`kernel/src/pcidev/mod.rs`'s `tear_down` clears the function's ownership
-(`crate::iommu::note_user_owned(…, None)`) before its reset has quiesced what
-it already issued: Bus Master Enable is cleared first, so it starts nothing
+`kernel/src/pcidev/mod.rs`'s `release` clears the function's ownership
+(`Function::held`, which `pcidev::note_fault` reads) at its end, before its
+reset has quiesced what it already issued: Bus Master Enable is cleared first, so it starts nothing
 new, and its grants stay mapped until it is quiet, so nothing it issued lands
 in a page handed on. A transaction already in flight that faults after the
 ownership is cleared — at an address a grant never covered, or one an

issues/a-released-function-never-claimed-again-keeps-its-retired-grants.md

@@ -0,0 +1,22 @@
+---
+status: open
+kind: defect
+opened: 2026-10-14
+---
+
+# A released function never claimed again keeps its retired grants
+
+`kernel/src/pcidev/mod.rs`'s `release` resets a function whose holder ended
+and parks that holder's grants in `Function::retired`, mapped in its domain
+until the reset is quiet, so nothing the function had issued lands in a page
+handed on. Only that function's next claim frees them (`finish_retired`). A
+function reset, released and never claimed again keeps up to
+`MAX_GRANT_TOTAL` (32 MiB) of grant pages for the rest of the boot. Across
+the machine that is bounded only by the functions released and not reclaimed.
+
+Owner: `issues/a-device-function-is-driven-from-its-arrival-to-its-end.md`,
+whose stage 2 ends a function's claim with `Gone`.
+
+Exit condition: a released function's retired grants are freed once its
+reset is quiet, whether or not it is claimed again, and a test that releases
+a reset-capable function and never claims it again sees the pages go back.

issues/toyos-runs-on-arm64.md

@@ -367,7 +367,7 @@ Each stage names its exit; "measured" means a number from a run.
    before its body) get a test here that reds with `put` written back as one
    `self.buf.write(off, trb)`; x86's TSO hides all three from every guest
    test until then.
-   A claimed function's message is its claim slot's LPI through the GICv3
+   A claimed function's message is its function's LPI through the GICv3
    ITS (`kernel/src/arch/aarch64/irqchip/its.rs`), which `Arch::irqchip`
    gives `cargo run`'s machine and `Profile::VirtIts`, on QEMU's own GIC
    under HVF, whose in-kernel vGIC refuses an ITS. QEMU's SMMUv3
@@ -378,16 +378,16 @@ Each stage names its exit; "measured" means a number from a run.
    the claim the IORT routes past the SMMUv3 and a fault in a claimed BAR.
    `irq()` holds the preempt count across every device arm, as x86-64's
    `device_irq_entry` does, and `pcidev::isr` asserts it.
-   A released function's stream stays on its slot's domain, which maps
+   A released function's stream stays on its own domain, which maps
    the doorbell; its bus mastering off and its message masked are what
    stop its writes, and a write it makes regardless reaches the ITS, where
    the release's `DISCARD` and `MAPD` with `V` clear leave its DeviceID
    translating nothing. That last is read, not tested: no function QEMU
    offers writes once mastering is off but `iommu-testdev`, which no claim
    can tell to write. **Owed**: a `smmu-selftest` arm that puts an
-   `iommu-testdev` on a domain, maps its DeviceID to a slot and unmaps it as
+   `iommu-testdev` on a domain, maps its DeviceID to an LPI and unmaps it as
    a release does, has it write event 0 to `GITS_TRANSLATER`, and is red
-   when the slot's LPI is raised.
+   when that LPI is raised.
 
 7. **Userland boots.** `init`, `logd`, the compositor, netd, soundd and sshd,
    built for `aarch64-unknown-toyos`. Every program of `system.toml` builds

kernel/pci/src/lib.rs

@@ -39,6 +39,5 @@ pub mod msix;
 pub mod placement;
 pub mod pm;
 pub mod probe;
-pub mod slot;
 
 pub use choose::{claimed, console, Unclaimable};

kernel/pure/lib.rs

@@ -14,6 +14,7 @@ pub mod clock;
 pub mod cpu;
 pub mod dirnodes;
 pub mod mtrr;
+pub mod owners;
 pub mod pcid;
 pub mod pipe;
 pub mod pointers;