From c7505cf55cdeef0a60ac99635e5f0aca1a9627f0 Mon Sep 17 00:00:00 2001 From: japabu Date: Mon, 12 Oct 2026 16:33:20 +0200 Subject: [PATCH 1/3] issues: the Wi-Fi track is #876's accepted design, and its owed issues are filed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit issues/there-is-no-wifi.md becomes the track of the design #876 carries, accepted by the orchestrator in issuecomment-6125972534 with seven named changes. It lists stages S1, S2, the specification, P1 to P6 and P8, and W1 to W11, each with its owner, what it depends on and an exit something can read. It quotes the owner's rulings as the orchestrator recorded them, and records the two weaknesses those rulings leave: saved networks in plain text from W11, and a network's Transition Disable mark lost at reboot from W4 until W11. P7, the key store, went with Q4. The old body's estimates and licensing facts were about porting another driver's source, which the clean room ruling replaced. Filed, as #876 §8 lists them: - pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards: placement treats every bridge's forwarded range as taken, so a function on a secondary bus is offered only addresses its bridge does not forward. The demo's AX200 on the AMD bench was refused that way. P1 owns it. - netstack-drives-one-card: P5's. - no-access-point-answers-to-the-harness: the orchestrator's instrument. - acpiserver-serves-no-client: P8's. - a-platform-with-no-transmit-power-table-joins-no-wifi-network: W6's. - the-wifi-demos-branches-are-on-origin: 11 branches on origin hold the demo's first commit and touch a Wi-Fi-named path, measured over origin at c0cdddf4e (E10 and E11 on ToyOSOrg/evidence pr-876). The specification stays on ToyOSOrg/evidence pr-876, outside the tree. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy --- ...nsmit-power-table-joins-no-wifi-network.md | 31 ++ issues/acpiserver-serves-no-client.md | 27 ++ issues/netstack-drives-one-card.md | 29 ++ .../no-access-point-answers-to-the-harness.md | 24 ++ ...ge-out-of-the-range-the-bridge-forwards.md | 39 ++ .../the-wifi-demos-branches-are-on-origin.md | 30 ++ issues/there-is-no-wifi.md | 361 ++++++++++++++++-- 7 files changed, 504 insertions(+), 37 deletions(-) create mode 100644 issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md create mode 100644 issues/acpiserver-serves-no-client.md create mode 100644 issues/netstack-drives-one-card.md create mode 100644 issues/no-access-point-answers-to-the-harness.md create mode 100644 issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md create mode 100644 issues/the-wifi-demos-branches-are-on-origin.md diff --git a/issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md b/issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md new file mode 100644 index 00000000000..91c315a9d9c --- /dev/null +++ b/issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md @@ -0,0 +1,31 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# A platform with no transmit power table joins no Wi-Fi network + +The accepted Wi-Fi design (#876 §4) sets each channel's transmit limit to the +tighter of two values: + +- the platform's per-device power table, which its ACPI namespace carries + under the radio's device; +- the access point's country element. + +The design gives no limit at all where the platform has no table. There, +`ax2xx` joins no network and says so: "no transmit limits for this +platform". Its passive scan still runs. + +What such a platform may transmit at is unknown. So is what the firmware +enforces where the platform gives no limit (#876 §11). From W6's landing, a +machine whose firmware carries no table has no Wi-Fi. + +Owner: W6 of `issues/there-is-no-wifi.md`. + +**Exit**: +- the specification or a measurement says what the firmware enforces and + what such a platform may transmit at; +- the owner rules on it; +- a platform with no table joins under that ruling, with a host test of the + limit it uses. diff --git a/issues/acpiserver-serves-no-client.md b/issues/acpiserver-serves-no-client.md new file mode 100644 index 00000000000..218fd0ae105 --- /dev/null +++ b/issues/acpiserver-serves-no-client.md @@ -0,0 +1,27 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# acpiserver serves no client, so no driver can read its own device's ACPI methods + +`[programs.acpiserver]` in `images/system.toml` serves nothing: it holds the +`acpi` claim and receives `power`. Its module doc (`system/acpiserver/src/main.rs`) +names everything it evaluates: the fixed hardware, the embedded controller, +and the batteries and AC adapters. + +A userland driver whose device keeps something in the ACPI namespace has no +way to reach it. The Wi-Fi driver needs the per-device transmit power table +that the platform keeps under the radio's ACPI device, before it sends its +first frame (#876 §4, P8). + +Owner: P8 of `issues/there-is-no-wifi.md`. + +**Exit**: +- acpiserver evaluates the methods under one PCI function's ACPI device for + that function's driver alone, over a connection the supervisor opens for + that binding; +- nothing names another device's scope; +- host tests hold the binding's refusals; +- a T14 row reads the AX210's tables. diff --git a/issues/netstack-drives-one-card.md b/issues/netstack-drives-one-card.md new file mode 100644 index 00000000000..f6801c1aaea --- /dev/null +++ b/issues/netstack-drives-one-card.md @@ -0,0 +1,29 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# netstack drives one card + +netstack opens the first of `CARDS` the supervisor endowed, and no other +(`system/netstack/src/main.rs`, `main`). It opens it behind `Card`, an enum +of its in-process drivers (`system/netstack/src/card.rs`). Its node is one +interface with one DHCP client (`system/netstack/node/src/lib.rs`). So a +machine with a wired and a wireless link uses only one of them. [ip] already +routes over several interfaces, the lower index winning a tie +(`system/netstack/ip/src/lib.rs`). + +The owner ruled for several interfaces over one chosen by the manifest. He +also ruled that "netstack runs every link a driver brings, wired first, with +failover" (#876, issuecomment-6120490125, ruling 3). + +Owner: P5 of `issues/there-is-no-wifi.md`, after the LAN track's stage 3 +moves the drivers out (`issues/the-lan-is-not-yet-production-grade.md`). + +**Exit**: +- one interface per link, each with its own DHCP client, lease and mDNS + responder, under one host name; +- links ranked wired before wireless, then by arrival; +- a guest with two virtio NICs in which the first's link is set off over + QMP, and traffic leaves on the second. diff --git a/issues/no-access-point-answers-to-the-harness.md b/issues/no-access-point-answers-to-the-harness.md new file mode 100644 index 00000000000..4b9569a6f57 --- /dev/null +++ b/issues/no-access-point-answers-to-the-harness.md @@ -0,0 +1,24 @@ +--- +status: open +kind: tooling +opened: 2026-10-12 +--- + +# No access point answers to the harness + +Two Wi-Fi behaviours have no instrument (#876 §9, item 9): + +- an access point deauthenticating the station; +- an access point rekeying its group on demand. + +Each needs an access point that the harness commands. Nothing in the tree +names one: `git grep -i 'access point' c0cdddf4e -- tests build system lib +kernel` finds nothing and exits 1. A host program that runs one is declared +under Arrivals, in +`issues/the-build-runs-host-tools-outside-rust-and-qemu.md`. + +Owner: the orchestrator, whose benches they are. + +**Exit**: a T14 row has the harness make the access point deauthenticate the +station and rekey its group. In that row the station rejoins and installs +the new group key. diff --git a/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md b/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md new file mode 100644 index 00000000000..e9654a8ebd0 --- /dev/null +++ b/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md @@ -0,0 +1,39 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# pcidev moves a BAR behind a bridge out of the range the bridge forwards + +Before a hand-over, `kernel/src/pcidev/mod.rs` re-places each BAR onto a +2 MiB boundary of its own (`place_bar`). The candidates come from +`placement::reserve` (`kernel/pci/src/placement.rs`), and a candidate is one +of the free runs: a gap left by everything the machine decodes, inside a +root bridge's window. + +The range every bridge forwards to its secondary bus is part of that +"everything" (the `forwarded()` loop that feeds `placement::free_runs`). So no +candidate ever lies inside the range a function's own bridge forwards. A +function on a secondary bus decodes at none of the `MAX_CANDIDATES` (8) +addresses it is offered, and its claim is refused. + +Measured on the AMD bench, by the Wi-Fi demo's run (#876 §1, from its log): + +- the AX200 has one BAR, BAR 0, 16 KiB, with its MSI-X table at +0x2000; +- it sits behind a bridge that forwards 1 MiB; +- pcidev moved the BAR onto eight 2 MiB windows outside that range, the + function answered at none of them, and the claim was refused. + +The demo then kept the BAR in place, untranslated and unremapped, which +`main` never does. + +Owner: P1 of `issues/there-is-no-wifi.md`. + +**Exit**: +- a BAR inside every window on its path to the root is mapped in place, in + 4 KiB pages; +- a BAR that shares a 4 KiB page with another function's is moved within + those windows, never out of them, or is refused by name; +- a host test places a BAR behind a bridge; +- the T14's AX210 is claimed with its BAR in place. diff --git a/issues/the-wifi-demos-branches-are-on-origin.md b/issues/the-wifi-demos-branches-are-on-origin.md new file mode 100644 index 00000000000..625b3009076 --- /dev/null +++ b/issues/the-wifi-demos-branches-are-on-origin.md @@ -0,0 +1,30 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# The Wi-Fi demo's branches are on origin + +The Wi-Fi demo ran on the AMD bench, and its branches never land. Eleven of +them are on `origin`, a public repository, and touch a Wi-Fi-named path. +Read at `origin/main` `c0cdddf4e`: + +- 13 branches on `origin` hold the demo's first commit, `a8e1c96`, and 11 of + them touch a Wi-Fi-named path past `origin/main` (E10, + https://github.com/ToyOSOrg/evidence/blob/5d27b8209199228ccc1e133b69ad4c3758f18510/e10-demo-branches-on-origin.log); +- each of the 11 adds one `NOTICE` entry, the AX200 firmware's, and none + adds a line naming a reference (E10, and E11, + https://github.com/ToyOSOrg/evidence/blob/de051da9eaff0cfae26a16695b478f0d6f46648d/e11-demo-notice-entries.log). + +#876 §8 records them as written by an agent that read the references, so +they carry no notice of their source [I]. The owner ruled the references +"clean room information" with "no notice for it" (#876 §0). The branches' +names, and the heading of the firmware entry they add, also carry the AMD +bench's model name, which E10 and E11 mask. + +Owner: the orchestrator. + +**Exit**: E10's count of branches on `origin` that hold `a8e1c96` and touch a +Wi-Fi-named path reads 0. The local branches are kept for readers' scouts, +and every reader's scout stays off `origin` (#876 §7). diff --git a/issues/there-is-no-wifi.md b/issues/there-is-no-wifi.md index 4957cbda5c7..4d63868dc6e 100644 --- a/issues/there-is-no-wifi.md +++ b/issues/there-is-no-wifi.md @@ -4,40 +4,327 @@ kind: track opened: 2026-08-03 --- -# There is no wifi, and the top half of it can be built today with no hardware - -Nothing 802.11 exists in the tree. The T14's radio is an Intel AX210 and the -plan for it is roughly 18,000 lines of transport and firmware op-mode with no -harness — the uncomfortable core, and nothing has reduced it. - -**But the top half is independent of all of it and fully host-verifiable.** A -frame and element crate, a WPA supplicant crate (reusable by any future -supplicant), a station state machine, and the firmware TLV pipeline can all be -written today with no hardware and no IOMMU. They are blocked on sequencing -alone. - -**The bottom half needs what the LAN now uses**: a userland driver holding one -PCI function in its own IOMMU domain, with `SYS_DEVICE_DMA_ALLOC` for its rings -and its interrupt delivered as a message on the claim. netd drives the T14's -I219 that way. The radio's firmware is admitted by the dependency rules only as -vendor-signed and device-verified, pinned by version and hash, recorded in -`NOTICE`, and loaded by that radio's own driver through its own domain. - -**One diagnostic should run before any of the bottom half is costed**, because -it is the only thing that can invalidate the architecture: read the radio -function's isolation scope and reserved regions off the real machine. It is -about 200 lines on a boot the owner is already doing, and it has never been run. - -Facts that cost real time to establish: - -- The firmware pin is exact and single-valued — one API version, two files - totalling **1,733,880 bytes** against a 35,651,584-byte boot partition. -- Licensing is settled: 238 of 285 upstream files are dual GPL/BSD (elect BSD); - the 15 GPL-only files in the AX210 path are never read; the mac80211 and - cfg80211 headers and the simulator are GPL-only and excluded. -- The declarative/imperative boundary is a measured cliff, not taste: the - firmware API headers need **6** distinct Linux headers and the device configs - **2**, against **44** for the op-mode and 75 for the subset as a whole. -- C is compiled by the toolchain's clang, which lays out `__packed` structs and - their bitfields as GCC does, so the 635 `__packed` uses are no longer a - compiler question. +# There is no Wi-Fi + +Nothing 802.11 exists in the tree. What is to be built is #876's design, +accepted by the orchestrator in issuecomment-6125972534 with the seven +changes its body carries: + +- `ax2xx`, one driver program per Intel AX2xx radio function: the AX210 on + the T14, the AX200 on the AMD bench; +- `wlan`, a supplicant program apart from it, alone holding a network's + credential; +- `wifi`, the network settings program; +- the ports between them: `link` (netstack to each NIC driver), `radio` + (`ax2xx` to `wlan`) and `wifi` (`wlan` to settings programs); +- netstack running every link a driver brings. + +The first version, W6, is an HT, VHT and HE station with block-ack both ways +that joins WPA2-Personal and WPA3-Personal networks with PMF. The design is +#876's body; this file repeats only what a stage needs. The specification +the driver is written from lives outside the tree, revision by revision, on +`ToyOSOrg/evidence` branch `pr-876`. + +## Lines the owner drew + +As the orchestrator recorded them on #876, quoted in its body's §0: + +- **The clean room** (issuecomment-6125437246): "one reads source writes a + doc. the other reads from the doc not the source." + - A reader reads the references and the demo and writes the + specification. + - A writer writes the driver from it and the public standards, and never + reads the references or the demo: "a sentence in the writer's brief and + role, not machinery". +- **The references**: "reference code may only be used as clean room + information. we want no notice for it. full speed from start." #876 reads + full speed as HT, VHT and HE rates and block-ack in the first version. +- **The split** (issuecomment-6120490125, ruling 3): "Each card's driver is + its own program, and netstack runs every link a driver brings, wired + first, with failover. The LAN track's stage 3 (every card behind a link + session) is a prerequisite, as the design reads it." The owner chose + several interfaces over one picked by the manifest. +- **WPA3 and PMF in the first version** (ruling 2): "The crypto crate + (`lib/crypto`, still being written outside the tree) gains SAE over P-256 + and AES-CMAC first." +- **The MSI-X table's page** (issuecomment-6121747502, Q2): "The page is + handed over only where interrupt remapping verifies the source, and only + once S1's T14 boots read compatibility format blocked. If they don't, that + is filed as a kernel-wide defect." +- **6 GHz** (Q3): "right after the first version, as W9, once a 6 GHz access + point is at the bench." +- **Saved networks** (Q4): "plain text whatever until the key store concept + exists", held by the supplicant alone. This overrides ruling 1's + "encrypted at rest", and stage P7, the key store, went with it. +- **Throughput and the link hop's cost are reported, never gated**: the + standing ruling's "Bench numbers are reported and never block", as #876 §0 + applies it. `.claude/agents/implementer.md` carries that ruling. + +## Stages + +Each stage is its own design round. The orchestrator dispatches every stage +and owns each one this list gives no other owner. + +- **Writers.** Every W stage's owner is the orchestrator, who briefs a + writer for it: an implementer told never to read the references or the + demo. The stage's design round is that writer's. The first W stage's pull + request, briefed to, adds that sentence to `.claude/agents/implementer.md`. +- **Reviews.** The orchestrator's brief for each W stage's review and design + acceptance says that they quote no reference. A defect found through a + reference reaches the writer only as a reader's revision of the + specification. +- **The S and P stages** are no part of the driver and need neither role. +- **Metal rows.** Every stage with a row on the T14 or the AMD bench first + needs `issues/a-metal-row-names-no-hardware-and-a-bench-without-it-reds.md`. + +**S1, the T14's read-out and the compatibility-format A/B.** A scout of two +boots in one session, never landing. Owner: the orchestrator. Depends on: +nothing; it runs first. +- **Exit, the read-out**, on `pr-876`: the AX210's position, every bridge + window on its path to the root, its BARs, its MSI and MSI-X capabilities + (table and PBA BIR and offset), the DMAR scope and reserved regions naming + it, the ACPI names under its device, and where the T14's NVMe keeps its + MSI-X table. +- **Exit, the A/B**, the one exit 1 of + `issues/qemu-passes-compatibility-format-interrupts.md` asks for. Boot A + leaves one kernel-armed MSI source in compatibility format with `IRE` set + and `CFIS` clear; boot B leaves it remapped. Green is fault 0x25 and no + delivery in A, and delivery in B. A red A is filed as a kernel-wide + isolation defect against every claim, and P1 waits. + +**S2, the link hop's cost on the T14.** A scout, never landing: two +processes over `toyos-transport`, one entry per 1,514-byte frame, batches of +1, 8 and 32, both directions, each side copying each frame once. Owner: the +orchestrator. Depends on: nothing. Exit: cycles per frame and frames a +second on one CPU, reported in P4's design round. Beside them stands the +200,163 packets of 1,500 bytes a second each way that full rate needs: +HE-MCS 11, two streams, 160 MHz, 0.8 µs GI, a standard's bound, not a +measurement +(https://github.com/ToyOSOrg/evidence/blob/1e0625eaf0feb22df2a760976b7ac3a2858b4e2c/e4-ceiling.log). +It gates nothing. + +**The specification.** Owner: the orchestrator, who briefs its readers. +Depends on: nothing. +- **Exit, per W stage:** the revision that stage's brief names, committed + to `pr-876`, carries every fact the stage needs. Each fact is a sentence + of meaning with its source: a reference by name, a firmware container, a + measurement with its run, or a standard's clause. The revision holds no + code or pseudo-code of a reference. +- **Its sources.** Where Intel's published firmware-interface headers state + a fact, the specification takes it from them. A fact the references leave + unsaid, or disagree on, stays open until a reader's scout measures it. + The scout runs on a branch kept off `origin`. + +**P1, a BAR stays where firmware put it, in 4 KiB pages, its MSI-X table's +page included.** Owner: the orchestrator. +- **Depends on:** S1 reading compatibility format blocked (Q2), and 4 KiB + user leaves for device windows: stage 3 of + `issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`, + or the slice its holder accepts. +- **Exit:** + - on the T14, the AX210 claimed with its BAR in place, and + `claim_reuses_its_remapping_entry` and `claim_refused_without_remapping` + unchanged; + - `msix-exclusive-bar=on` gone from `tests/common/qemu.rs` and + `build/qemu.rs`, so the NVMe guests drive QEMU's default controller + through its table in BAR 0; + - `issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md` + closed; + - the exit of + `issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md` + rewritten, from a refused write to the table's page to the NVMe driven + through a table in BAR 0. + +**P2 and P3, AMD-Vi translation and interrupt remapping.** Owner: +`issues/an-amd-vi-machine-isolates-no-device.md`, held by the orchestrator's +AMD track. Depends on: that track. +- **Exit:** that track's exit, and three readings on the AMD bench: + - the stick's xHCI and the NVMe working in their domains under + translation; + - the AX200's claim handed over with its own remapping table; + - before the table's page is mapped there, a message naming no valid entry + of the radio's own table, refused into the event log. +- Only W7 waits on them. + +**P4, the LAN track's stage 3, whole.** Owner: stage 3 of +`issues/the-lan-is-not-yet-production-grade.md`. +- **Depends on:** the T14's outbound rows, which + `issues/toyos-has-its-own-network-stack.md` owns; and S2, which its round + reports. +- **Exit:** that stage's exit, a driver killed and restarted with the + stack's connections intact (held in a guest) and an unlisted but matching + NIC up with no configuration change; and with it: + - the `link` protocol on `toyos-transport`, adding no transport primitive; + - `Card` gone; + - the supervisor binding drivers from a declared match table by vendor, + device and class; + - the network suite unchanged under QEMU; + - a T14 row reading the I219 working, with nothing regressed; + - S2 rerun and reported. + +**P5, netstack over several links.** Owner: the orchestrator; its defect is +`issues/netstack-drives-one-card.md`. Depends on: P4. +- **Exit:** + - host tests of rank (wired before wireless, then arrival), failover and + return, resolvers, mDNS per link, and a flow bound to a lost address; + - a guest with two virtio NICs, in which the first's link is set off over + QMP and traffic leaves on the second; + - a T14 row, after W6 and the image giving netstack the I219, in which + both links lease and the default route is the wired one. + +**P6, `lib/crypto`'s AES-CMAC and SAE.** Owner: the orchestrator, whose +pull request brings the crate in unchanged at the commit the crypto agent, +who writes it outside the tree, names as qualified. Depends on: that commit. +- **Exit:** `lib/crypto` in the tree with these, each with the crypto + agent's vectors: + - AES-CMAC-128 (RFC 4493); + - SAE over P-256 by hash-to-element (IEEE 802.11 Annex J, RFC 9380); + - a constant-time comparison; + - an owned secret that wipes on drop. +- **Nothing more enters:** no RustCrypto crate, and none of the crate's + `tools/*.py`. + +**P8, acpiserver serves a driver its own device's tables.** Owner: the +orchestrator; its defect is `issues/acpiserver-serves-no-client.md`. +Depends on: nothing; W6 waits on it. +- **Exit:** + - acpiserver evaluates the methods under one PCI function's ACPI device for + that function's driver alone, over a connection the supervisor opens for + that binding; + - host tests of the binding's refusals; + - a T14 row reads the AX210's tables. + +**W1, frames**, a `lib/` crate. Depends on: nothing. +- **Scope:** + - management, control (BAR, BA) and data frames; + - the elements: SSID, rates, DS, TIM, country, RSN, RSNXE, HT, VHT, HE, + extended capabilities and WMM; + - A-MSDU; + - 802.11 to Ethernet and back (RFC 1042, bridge-tunnel); + - the reorder window. +- **Exit:** host tests of every refusal and hostile length, a malformed + country element among them; a seeded structured fuzz of a fixed count, as + `build/ssh/tests/fuzz.rs`; and a third-party capture corpus from outside the + references, beside the crate, with provenance, terms and `NOTICE` rows, + pinned by hash. + +**W2, the handshakes, in `wlan`**, sans-IO: the 4-way and group-key +handshakes, SAE by hash-to-element, PMF's keys, and the Transition Disable +KDE read from message 3 of an SAE join once its MIC verifies. Depends on: +W1, P6. +- **Exit:** host tests against Annex J, RFCs 6070, 3394, 4493 and 9380, and + a captured handshake; and these refusals, each tested: + - a replayed counter; + - a retransmitted message 3 that reinstalls nothing; + - a resent message 1 keeping its SNonce; + - message 3's RSNE or RSNXE differing from the beacon's; + - group key ID 0; + - a MIC mismatch; + - an SAE Confirm that does not verify; + - an SAE Commit with an invalid scalar or element; + - a PSK handshake for a network marked by Transition Disable. + +**W3, the firmware.** Depends on: the specification's first revision. +- **Scope:** + - the firmware containers; + - commands and notifications typed per declared version; + - the parts served, and any other refused by name; + - each part's newest linux-firmware build at the pin: one file for the + AX200, two for the AX210, committed unmodified in + `system/ax2xx/firmware/` with `NOTICE` and `COMMITTED_FILES` rows. +- **A file ships only once the specification shows, from a vendor + statement, that its part verifies it**; one nothing shows verified waits + for the owner. +- **Its licence forbids reverse engineering**, so of a file, only the + container a loader parses is read. +- **Exit:** host tests that the pinned files decode; that every command + sent is declared at a typed version; that sizes match those the + specification asserts; and that recorded bench traces, addresses + scrubbed, are answered. + +**W4, `wlan`, `radio`, `wifi` and the settings program.** Depends on: W1, +W2. +- **Exit:** host tests of: + - BSS choice: joinable security, SAE before PSK, band, signal, and a + marked network's PSK-only BSS refused by name ("transition disabled: + this network is WPA3-only"); + - the mark, kept per network for the boot; + - connect, disconnect and status; + - the wrong-credential refusal, on evidence the station holds; + - hostile `radio` answers. +- The pull request landing it files the Transition Disable weakness below. + +**W5, bring-up and passive scan on the T14**, the first stage that ships +`ax2xx`. Depends on: S1, P1, P4 (its match table), W3, W4. Exit: a T14 row +reads the firmware up, its MAC address, and the test network seen. The +network's name arrives per run through a test job holding `wifi`, so no +shipping path reads the ESP. + +**W6, the first version: a full-rate join.** Depends on: W5, P4, P5, P6, P8. +- **Exit, host tests:** + - block-ack state; + - a firmware restart's decisions; + - each channel's limit as the tighter of the platform's table and the + AP's country element; + - a country element that would raise a limit; + - a platform with no table, refused by name. +- **Exit, T14 rows:** + - WPA2 and WPA3 joins, each with a lease, DNS and TCP; + - HE, else VHT, at the AP's width; + - block-ack both ways; + - transmit limits applied before the first frame; + - a wrong credential refused with its evidence; + - `ax2xx` killed, and rejoining. +- **Reported, never gated:** the HT, VHT and HE rates, and throughput + against Linux on the same machine, AP and position. +- `issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md` + is its. + +**W7, the AX200 on the AMD bench.** Depends on: P2, P3, W6. Exit: W5's and +W6's rows, on the AMD bench. + +**W8, power save, background scan, roaming, beacon loss and RF-kill.** +Depends on: W6. Exit: host tests of the decisions, and rows on both benches; +power and latency are reported. + +**W9, 6 GHz on the AX210**, directly after W6. Depends on: W6, and a 6 GHz +access point at the T14's bench, an instrument the orchestrator owns (Q3). +Exit: host tests of 6 GHz discovery's rules, and a T14 row joining the +6 GHz access point. + +**W10, the desktop's Wi-Fi status and settings.** Depends on: W4. Exit: a +host test of its state machine, and a guest test on the compositor's +surface whose round says why no cheaper tier holds it. + +**W11, saved networks**: for each network, its passphrase as typed and its +Transition Disable mark, in a plain-text file in `wlan`'s own state that no +other row names. Depends on: W6, and stage 2 of +`issues/every-program-sees-only-the-files-it-was-given.md`, with `wlan`'s +row the only one whose view holds the file. Exit: host tests of the file's +format (a mark included) and its refusals, and a T14 row joining a saved +network at boot. The pull request landing it files the plain-text weakness +below. + +## Weaknesses the rulings record + +**Saved networks are plain text** (Q4). From W11's landing, whoever reads the +disk reads every saved network's passphrase: another OS booted on the +machine, the disk taken out, or a program holding the disk's claim or +serving the file. With it they join that network, decrypt every handshake +they saw under PSK, and hold the passphrase wherever else it is used. +- **Owner:** the orchestrator. +- **Exit:** a ToyOS key store, a concept the owner rules on. + +**A network's Transition Disable mark lasts only the boot until W11.** From +W4's landing a reboot loses every mark. Until a network's first SAE join of +the boot, a BSS offering its SSID with PSK alone draws the station's message +2 and attacks the passphrase offline. That is the downgrade of Vanhoef and +Ronen, "Dragonblood" (IEEE S&P 2020, §4.1.1). +- **Owner:** the orchestrator. +- **Exit:** W11 keeps the mark in the saved file. + +## Owed beside the stages + +- `issues/no-access-point-answers-to-the-harness.md`: deauthentication and a + group rekey on demand. +- `issues/the-wifi-demos-branches-are-on-origin.md`. From 24b0fbc637a6520898266c2661a09ac2c0168041 Mon Sep 17 00:00:00 2001 From: japabu Date: Mon, 12 Oct 2026 20:12:05 +0200 Subject: [PATCH 2/3] issues: the Wi-Fi track answers review round 1 of #876's track MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - P4's owner is the orchestrator: P4 is the LAN track's stage 3, whole, and that track names no holder. - The specification's sources are #876 §7's again: a fact Intel's headers state is not reopened by another reference disagreeing, a fact they leave unsaid is taken from the other references, and only one those disagree on or all leave unsaid stays open. - The link hop's cost cites the standing ruling's merits clause; "never block" stays with throughput. - P5's T14 row moves into W6's exit, which it needs a radio for; W7 runs W6's rows but the I219's. - The access points the W stages need are named: W5's and W6's test networks as an instrument the orchestrator owns, and W8's silenced and paired access points in issues/no-access-point-answers-to-the-harness.md. - The pcidev issue names the two placement issues P1 takes up with it, and rests its readings on main's kernel on the AMD bench (E13 §1, from #884's metal run), S1's T14 read-out and the demo's commit messages, masked (E13 §2), all on ToyOSOrg/evidence. - netstack-drives-one-card names the rejected first-match entry it reverses, and P5 takes the NIC out of its virtio bullet. - The demo's issue is renamed to what still holds. Its branches went from origin before this round: E12 at origin/main ab655a115 finds no ref there carrying the AMD bench's model name, and none holding the demo's first commit that touches a Wi-Fi-named path, where E10 at c0cdddf4e counted 11. The 12 tips E10 prints still resolve through GitHub's commit API for origin, each answer carrying the model name, so the exit is that no ref carries the name and none of those tips resolves. The citation of #876 §8 is replaced by the demo's own commit message (E12 §3). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy --- issues/netstack-drives-one-card.md | 9 ++- .../no-access-point-answers-to-the-harness.md | 20 ++++-- ...ge-out-of-the-range-the-bridge-forwards.md | 42 ++++++++--- .../the-wifi-demos-branches-are-on-origin.md | 30 -------- ...i-demos-commits-still-resolve-on-origin.md | 48 +++++++++++++ issues/there-is-no-wifi.md | 70 ++++++++++++------- 6 files changed, 146 insertions(+), 73 deletions(-) delete mode 100644 issues/the-wifi-demos-branches-are-on-origin.md create mode 100644 issues/the-wifi-demos-commits-still-resolve-on-origin.md diff --git a/issues/netstack-drives-one-card.md b/issues/netstack-drives-one-card.md index f6801c1aaea..19821a1f369 100644 --- a/issues/netstack-drives-one-card.md +++ b/issues/netstack-drives-one-card.md @@ -18,6 +18,11 @@ The owner ruled for several interfaces over one chosen by the manifest. He also ruled that "netstack runs every link a driver brings, wired first, with failover" (#876, issuecomment-6120490125, ruling 3). +That reverses part of `issues/first-match-selection-that-remains.md` +(`kind: rejected`), whose virtio bullet says a second virtio NIC "would be +dropped" and that "Neither is a defect today". Under ruling 3 a second NIC +dropped is this defect. + Owner: P5 of `issues/there-is-no-wifi.md`, after the LAN track's stage 3 moves the drivers out (`issues/the-lan-is-not-yet-production-grade.md`). @@ -26,4 +31,6 @@ moves the drivers out (`issues/the-lan-is-not-yet-production-grade.md`). responder, under one host name; - links ranked wired before wireless, then by arrival; - a guest with two virtio NICs in which the first's link is set off over - QMP, and traffic leaves on the second. + QMP, and traffic leaves on the second; +- the NIC taken out of the virtio bullet of + `issues/first-match-selection-that-remains.md`. diff --git a/issues/no-access-point-answers-to-the-harness.md b/issues/no-access-point-answers-to-the-harness.md index 4b9569a6f57..be69e922db5 100644 --- a/issues/no-access-point-answers-to-the-harness.md +++ b/issues/no-access-point-answers-to-the-harness.md @@ -6,19 +6,25 @@ opened: 2026-10-12 # No access point answers to the harness -Two Wi-Fi behaviours have no instrument (#876 §9, item 9): +Four Wi-Fi behaviours have no instrument (#876 §9, item 9, and W8 of +`issues/there-is-no-wifi.md`): - an access point deauthenticating the station; -- an access point rekeying its group on demand. +- an access point rekeying its group on demand; +- beacon loss: an access point the harness silences; +- roaming: two access points of one network, the harness silencing the one + the station is on. -Each needs an access point that the harness commands. Nothing in the tree -names one: `git grep -i 'access point' c0cdddf4e -- tests build system lib +Each needs access points that the harness commands. Nothing in the tree +names one: `git grep -i 'access point' ab655a115 -- tests build system lib kernel` finds nothing and exits 1. A host program that runs one is declared under Arrivals, in `issues/the-build-runs-host-tools-outside-rust-and-qemu.md`. Owner: the orchestrator, whose benches they are. -**Exit**: a T14 row has the harness make the access point deauthenticate the -station and rekey its group. In that row the station rejoins and installs -the new group key. +**Exit**: a T14 row, and once W7 has landed an AMD bench row, in which the +harness makes an access point deauthenticate the station, rekey its group and +fall silent, and silences one of two access points of one network. In it the +station rejoins, installs the new group key, recovers from the silence as W8 +decides, and roams to the other access point. diff --git a/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md b/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md index e9654a8ebd0..79f0da9cbc3 100644 --- a/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md +++ b/issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md @@ -18,15 +18,35 @@ candidate ever lies inside the range a function's own bridge forwards. A function on a secondary bus decodes at none of the `MAX_CANDIDATES` (8) addresses it is offered, and its claim is refused. -Measured on the AMD bench, by the Wi-Fi demo's run (#876 §1, from its log): - -- the AX200 has one BAR, BAR 0, 16 KiB, with its MSI-X table at +0x2000; -- it sits behind a bridge that forwards 1 MiB; -- pcidev moved the BAR onto eight 2 MiB windows outside that range, the - function answered at none of them, and the claim was refused. - -The demo then kept the BAR in place, untranslated and unremapped, which -`main` never does. +Both benches put their radio there: + +- **The AMD bench**, as `main`'s kernel logged it in #884's metal run (E13 §1, + https://github.com/ToyOSOrg/evidence/blob/2eb315326d1b4d0363b4c918da8dd2bfaabd1234/e13-amd-ax200-bar.log): + the AX200 at 01:00.0 has BAR 0 at 0xd0600000, behind bridge 00:02.2, which + forwards 0xd0600000..0xd0700000; no free run reaches into that range. +- **The T14**, as S1 read it (lines 111 to 116, + https://github.com/ToyOSOrg/evidence/blob/cd368b25b2259a76b80dc31f4219dac1c91d84dc/s1/wifi-s1-a-kernel.log): + the AX210 at 09:00.0 has BAR 0 at 0xbc300000, 16 KiB, behind root port + 00:1c.4, which forwards 0xbc300000..0xbc400000. + +The Wi-Fi demo's run on the AMD bench took this path, as its commit messages +record (E13 §2): pcidev moved the AX200's BAR 0 onto eight 2 MiB windows from +0x450200000, all outside the 1 MiB that 00:02.2 forwards; every moved BAR read +0xffffffff, and the claim was refused. The demo then kept the BAR in place, +untranslated and unremapped, which `main` never does. + +Two placement issues rest on placement as it is, and P1 takes them up with +this one: + +- `issues/nothing-reds-when-the-bar-survey-drops-an-assigned-bar.md` asks for + a guest that reds when the forwarded-range push is deleted. That push is + what puts every candidate outside its bridge. Its "No machine in reach puts + a BAR it hands over behind a bridge" holds only until a radio is handed + over: both benches put theirs behind one. +- `issues/no-boot-reaches-the-retry-that-undoes-a-placement-nothing-answered.md` + wants a function behind a `pcie-root-port` to settle at a later candidate. + Under this issue no candidate lies inside a port's window, so none ever + answers there. Owner: P1 of `issues/there-is-no-wifi.md`. @@ -36,4 +56,6 @@ Owner: P1 of `issues/there-is-no-wifi.md`. - a BAR that shares a 4 KiB page with another function's is moved within those windows, never out of them, or is refused by name; - a host test places a BAR behind a bridge; -- the T14's AX210 is claimed with its BAR in place. +- the T14's AX210 is claimed with its BAR in place; +- each of the two placement issues above closed, or its exit rewritten to the + placement P1 lands. diff --git a/issues/the-wifi-demos-branches-are-on-origin.md b/issues/the-wifi-demos-branches-are-on-origin.md deleted file mode 100644 index 625b3009076..00000000000 --- a/issues/the-wifi-demos-branches-are-on-origin.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -status: open -kind: defect -opened: 2026-10-12 ---- - -# The Wi-Fi demo's branches are on origin - -The Wi-Fi demo ran on the AMD bench, and its branches never land. Eleven of -them are on `origin`, a public repository, and touch a Wi-Fi-named path. -Read at `origin/main` `c0cdddf4e`: - -- 13 branches on `origin` hold the demo's first commit, `a8e1c96`, and 11 of - them touch a Wi-Fi-named path past `origin/main` (E10, - https://github.com/ToyOSOrg/evidence/blob/5d27b8209199228ccc1e133b69ad4c3758f18510/e10-demo-branches-on-origin.log); -- each of the 11 adds one `NOTICE` entry, the AX200 firmware's, and none - adds a line naming a reference (E10, and E11, - https://github.com/ToyOSOrg/evidence/blob/de051da9eaff0cfae26a16695b478f0d6f46648d/e11-demo-notice-entries.log). - -#876 §8 records them as written by an agent that read the references, so -they carry no notice of their source [I]. The owner ruled the references -"clean room information" with "no notice for it" (#876 §0). The branches' -names, and the heading of the firmware entry they add, also carry the AMD -bench's model name, which E10 and E11 mask. - -Owner: the orchestrator. - -**Exit**: E10's count of branches on `origin` that hold `a8e1c96` and touch a -Wi-Fi-named path reads 0. The local branches are kept for readers' scouts, -and every reader's scout stays off `origin` (#876 §7). diff --git a/issues/the-wifi-demos-commits-still-resolve-on-origin.md b/issues/the-wifi-demos-commits-still-resolve-on-origin.md new file mode 100644 index 00000000000..370b722a8a5 --- /dev/null +++ b/issues/the-wifi-demos-commits-still-resolve-on-origin.md @@ -0,0 +1,48 @@ +--- +status: open +kind: defect +opened: 2026-10-12 +--- + +# The Wi-Fi demo's commits still resolve on origin + +The Wi-Fi demo ran on the AMD bench and never lands. Its branches are gone +from `origin`, a public repository. Read at `origin/main` `ab655a115` (E12 §1, +https://github.com/ToyOSOrg/evidence/blob/2eb315326d1b4d0363b4c918da8dd2bfaabd1234/e12-demo-on-origin.log): + +- no ref on `origin` carries the AMD bench's model name; +- the two refs that still hold the demo's first commit, `a8e1c96`, touch no + Wi-Fi-named path and carry no line with that name past `origin/main`. + +At `c0cdddf4e` E10 had counted 11 branches holding it that touched a +Wi-Fi-named path +(https://github.com/ToyOSOrg/evidence/blob/5d27b8209199228ccc1e133b69ad4c3758f18510/e10-demo-branches-on-origin.log). + +Their commits still resolve there by hash. GitHub's commit API for `origin` +answers each of the 12 tips E10 prints past `wt/toyos-survey`, and each +answer carries the model name (E12 §2). E10 and E11 print those tips in full +on `ToyOSOrg/evidence`, whose branches only grow. + +What they carry: + +- the model name, which E10 to E13 mask: in commit subjects (E13 §2 quotes + two, + https://github.com/ToyOSOrg/evidence/blob/2eb315326d1b4d0363b4c918da8dd2bfaabd1234/e13-amd-ax200-bar.log), + and in the heading of the firmware entry they add to `NOTICE` (E11, + https://github.com/ToyOSOrg/evidence/blob/de051da9eaff0cfae26a16695b478f0d6f46648d/e11-demo-notice-entries.log); +- a driver written against a reference rather than from a specification: the + message of E10 line 52's tip says its `netstack/src/wifi.rs` was "written + against OpenBSD's ISC-licensed if_iwx (22000 family)" (E12 §3), and no + demo branch adds a `NOTICE` line naming a reference (E10). The owner's + ruling admits a reference only as clean-room information, which takes no + notice (#876 §0); code written against one is not that, and carries none + [I]. + +Owner: the orchestrator, who takes it to the owner, whose call the demo's +branches were. + +**Exit**: no ref on `origin` carries the model name, which E12 §1 already +reads; and GitHub's commit API for `origin` answers none of the 12 tips E10 +prints past `wt/toyos-survey`, where E12 §2 reads 12 of 12. The local branches +are kept for readers' scouts, and every reader's scout stays off `origin` +(#876 §7). diff --git a/issues/there-is-no-wifi.md b/issues/there-is-no-wifi.md index 4d63868dc6e..d32b1c8729c 100644 --- a/issues/there-is-no-wifi.md +++ b/issues/there-is-no-wifi.md @@ -56,9 +56,15 @@ As the orchestrator recorded them on #876, quoted in its body's §0: - **Saved networks** (Q4): "plain text whatever until the key store concept exists", held by the supplicant alone. This overrides ruling 1's "encrypted at rest", and stage P7, the key store, went with it. -- **Throughput and the link hop's cost are reported, never gated**: the - standing ruling's "Bench numbers are reported and never block", as #876 §0 - applies it. `.claude/agents/implementer.md` carries that ruling. +- **Throughput is reported and never blocks**: the standing ruling's "Bench + numbers are reported and never block", for a design the manufacturers back, + as #876 §0 applies it to the driver. +- **The link hop's cost is measured and reported, and decides nothing by + itself**: the split and `link` are this design's, so the standing ruling's + "Review on merits" applies, "reviewed on correctness and simplicity like + any code. A speed claim is measured and reported but does not decide by + itself, unless the design's only purpose is speed" (#876 §0). + `.claude/agents/implementer.md` carries both clauses. ## Stages @@ -101,7 +107,7 @@ second on one CPU, reported in P4's design round. Beside them stands the HE-MCS 11, two streams, 160 MHz, 0.8 µs GI, a standard's bound, not a measurement (https://github.com/ToyOSOrg/evidence/blob/1e0625eaf0feb22df2a760976b7ac3a2858b4e2c/e4-ceiling.log). -It gates nothing. +By itself it decides nothing (the link hop's line above). **The specification.** Owner: the orchestrator, who briefs its readers. Depends on: nothing. @@ -111,9 +117,11 @@ Depends on: nothing. measurement with its run, or a standard's clause. The revision holds no code or pseudo-code of a reference. - **Its sources.** Where Intel's published firmware-interface headers state - a fact, the specification takes it from them. A fact the references leave - unsaid, or disagree on, stays open until a reader's scout measures it. - The scout runs on a branch kept off `origin`. + a fact, the specification takes it from them and the bench checks that it + works; another reference disagreeing does not reopen it. A fact those + headers leave unsaid is taken from the other references. Only a fact those + disagree on, or all of them leave unsaid, stays open until a reader's scout + measures it. The scout runs on a branch kept off `origin`. **P1, a BAR stays where firmware put it, in 4 KiB pages, its MSI-X table's page included.** Owner: the orchestrator. @@ -129,7 +137,8 @@ page included.** Owner: the orchestrator. `build/qemu.rs`, so the NVMe guests drive QEMU's default controller through its table in BAR 0; - `issues/pcidev-moves-a-bar-behind-a-bridge-out-of-the-range-the-bridge-forwards.md` - closed; + closed, and each of the two placement issues it names closed or its exit + rewritten to the placement P1 lands; - the exit of `issues/a-controller-whose-msix-table-is-in-bar-0-cannot-be-driven-from-userland.md` rewritten, from a refused write to the table's page to the NVMe driven @@ -146,8 +155,8 @@ AMD track. Depends on: that track. of the radio's own table, refused into the event log. - Only W7 waits on them. -**P4, the LAN track's stage 3, whole.** Owner: stage 3 of -`issues/the-lan-is-not-yet-production-grade.md`. +**P4, the LAN track's stage 3, whole.** Owner: the orchestrator; P4 is +stage 3 of `issues/the-lan-is-not-yet-production-grade.md`, whole. - **Depends on:** the T14's outbound rows, which `issues/toyos-has-its-own-network-stack.md` owns; and S2, which its round reports. @@ -169,8 +178,10 @@ AMD track. Depends on: that track. return, resolvers, mDNS per link, and a flow bound to a lost address; - a guest with two virtio NICs, in which the first's link is set off over QMP and traffic leaves on the second; - - a T14 row, after W6 and the image giving netstack the I219, in which - both links lease and the default route is the wired one. + - `issues/netstack-drives-one-card.md` closed, and the NIC taken out of + the virtio bullet of `issues/first-match-selection-that-remains.md`. +- Its T14 row, both links leasing with the wired one the default route, is + W6's: it needs a radio. **P6, `lib/crypto`'s AES-CMAC and SAE.** Owner: the orchestrator, whose pull request brings the crate in unchanged at the commit the crypto agent, @@ -255,12 +266,15 @@ W2. - The pull request landing it files the Transition Disable weakness below. **W5, bring-up and passive scan on the T14**, the first stage that ships -`ax2xx`. Depends on: S1, P1, P4 (its match table), W3, W4. Exit: a T14 row -reads the firmware up, its MAC address, and the test network seen. The -network's name arrives per run through a test job holding `wifi`, so no -shipping path reads the ESP. - -**W6, the first version: a full-rate join.** Depends on: W5, P4, P5, P6, P8. +`ax2xx`. Depends on: S1, P1, P4 (its match table), W3, W4; and the test +networks, an access point at the T14's bench serving a WPA2-Personal network +and a WPA3-Personal one by hash-to-element, with PMF and HE, an instrument +the orchestrator owns. Exit: a T14 row reads the firmware up, its MAC +address, and the test network seen. The network's name arrives per run +through a test job holding `wifi`, so no shipping path reads the ESP. + +**W6, the first version: a full-rate join.** Depends on: W5 and its test +networks, P4, P5, P6, P8. - **Exit, host tests:** - block-ack state; - a firmware restart's decisions; @@ -274,18 +288,24 @@ shipping path reads the ESP. - block-ack both ways; - transmit limits applied before the first frame; - a wrong credential refused with its evidence; - - `ax2xx` killed, and rejoining. + - `ax2xx` killed, and rejoining; + - both links leasing, the I219's and the radio's, with the wired one the + default route (P5's). - **Reported, never gated:** the HT, VHT and HE rates, and throughput against Linux on the same machine, AP and position. - `issues/a-platform-with-no-transmit-power-table-joins-no-wifi-network.md` is its. -**W7, the AX200 on the AMD bench.** Depends on: P2, P3, W6. Exit: W5's and -W6's rows, on the AMD bench. +**W7, the AX200 on the AMD bench.** Depends on: P2, P3, W6, and W5's test +networks in reach of the AMD bench. Exit: W5's and W6's rows on the AMD +bench, all but the I219's. **W8, power save, background scan, roaming, beacon loss and RF-kill.** -Depends on: W6. Exit: host tests of the decisions, and rows on both benches; -power and latency are reported. +Depends on: W6; W7, for the AMD bench's rows; and, at each bench, two +instruments of `issues/no-access-point-answers-to-the-harness.md`: an +access point the harness silences, for beacon loss, and two access points of +one network, for roaming. Exit: host tests of the decisions, and rows on both +benches; power and latency are reported. **W9, 6 GHz on the AX210**, directly after W6. Depends on: W6, and a 6 GHz access point at the T14's bench, an instrument the orchestrator owns (Q3). @@ -326,5 +346,5 @@ Ronen, "Dragonblood" (IEEE S&P 2020, §4.1.1). ## Owed beside the stages - `issues/no-access-point-answers-to-the-harness.md`: deauthentication and a - group rekey on demand. -- `issues/the-wifi-demos-branches-are-on-origin.md`. + group rekey on demand, and W8's access points. +- `issues/the-wifi-demos-commits-still-resolve-on-origin.md`. From f0c1e1c2b8169d95ffc2daa15a5ff0aa9b08264c Mon Sep 17 00:00:00 2001 From: japabu Date: Mon, 12 Oct 2026 20:58:55 +0200 Subject: [PATCH 3/3] issues: the Wi-Fi track records S1 done, and the demo's every commit is the exit's Review round 2 of #876's track (issuecomment-6130506978) named four changes; this commit makes the three in the tree. The track records S1 done with both exits met. Its A/B, on the T14 at wt/toyos-wifi-s1 bd135c4db, read compatibility format blocked: fault 0x25 and no delivery in boot A, delivery in boot B (pr-876 s1/judge.log). Its read-out, completed by a re-run of boot B at a6934ff22, passed (pr-876 s1-r2/judge.log). So P1's Q2 condition and W5's S1 dependency are met. The record carries two consequences: - S1 does not separate CFIS=0. The T14 runs with EIME set on every unit, and VT-d 4.0 section 5.1.4 blocks compatibility format where either holds, so exit 1 of issues/qemu-passes-compatibility-format-interrupts.md still asks for a reading under CFIS=0 alone. - The T14's NVMe keeps its MSI-X table at BAR 0 + 0x2000, so P1's T14 exit now drives that NVMe through it, the row #876 section 8 made due if S1 found one. The record cites the read-out on pr-876 and quotes none of the machine's ACPI paths. The demo-commits issue's exit now reads every commit git rev-list --not --remotes=origin prints, not the tips alone. E15 (pr-876 6196aad98) counts 52 such commits at origin/main 97f07c381: no ref on origin holds any, pull requests' refs included, origin has no fork, and GitHub's commit API answers all 52. The issue names E13 beside E10 and E11 as a log printing a hash that resolves: its line 80 quotes a build nine of the tips hold. The owner ruled to leave the commits on GitHub ("leave it"), so the exit waits for GitHub's garbage collection. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015xhaydXCVRNscoccHYFUWy --- ...i-demos-commits-still-resolve-on-origin.md | 34 +++++++++---- issues/there-is-no-wifi.md | 50 ++++++++++++------- 2 files changed, 54 insertions(+), 30 deletions(-) diff --git a/issues/the-wifi-demos-commits-still-resolve-on-origin.md b/issues/the-wifi-demos-commits-still-resolve-on-origin.md index 370b722a8a5..d3a16311bb5 100644 --- a/issues/the-wifi-demos-commits-still-resolve-on-origin.md +++ b/issues/the-wifi-demos-commits-still-resolve-on-origin.md @@ -18,12 +18,22 @@ At `c0cdddf4e` E10 had counted 11 branches holding it that touched a Wi-Fi-named path (https://github.com/ToyOSOrg/evidence/blob/5d27b8209199228ccc1e133b69ad4c3758f18510/e10-demo-branches-on-origin.log). -Their commits still resolve there by hash. GitHub's commit API for `origin` -answers each of the 12 tips E10 prints past `wt/toyos-survey`, and each -answer carries the model name (E12 §2). E10 and E11 print those tips in full -on `ToyOSOrg/evidence`, whose branches only grow. +Their commits still resolve there by hash. Over the 12 tips E10 prints past +`wt/toyos-survey`, `git rev-list --not --remotes=origin` prints 52 +commits. No ref on `origin` holds any of them, pull requests' refs included, +`origin` has no fork, and GitHub's commit API for `origin` answers all 52 +(E15, +https://github.com/ToyOSOrg/evidence/blob/6196aad98a0bf5eff937a25b9dad4ec10e59376f/e15-demo-commits-on-origin.log). +The API's answer for each of the 12 tips carries the model name (E12 §2). -What they carry: +Three logs on `ToyOSOrg/evidence`, whose branches only grow, print hashes +that resolve there: + +- E10 and E11 print the 12 tips in full; +- E13 §2 quotes a build by its hash, abbreviated to nine hex digits (its + line 80). Nine of the tips hold that commit, and it is one of the 52. + +What the demo's commits carry: - the model name, which E10 to E13 mask: in commit subjects (E13 §2 quotes two, @@ -38,11 +48,13 @@ What they carry: notice (#876 §0); code written against one is not that, and carries none [I]. -Owner: the orchestrator, who takes it to the owner, whose call the demo's -branches were. +Owner: the orchestrator. The owner, whose call the demo's branches were, +ruled to leave the commits on GitHub: "leave it". Nothing asks GitHub to +remove them, so the exit waits for GitHub's garbage collection of commits no +ref holds. **Exit**: no ref on `origin` carries the model name, which E12 §1 already -reads; and GitHub's commit API for `origin` answers none of the 12 tips E10 -prints past `wt/toyos-survey`, where E12 §2 reads 12 of 12. The local branches -are kept for readers' scouts, and every reader's scout stays off `origin` -(#876 §7). +reads; and GitHub's commit API for `origin` answers none of the commits +`git rev-list --not --remotes=origin` prints over those 12 tips, where +E15 reads 52 of 52. The local branches are kept for readers' scouts, and +every reader's scout stays off `origin` (#876 §7). diff --git a/issues/there-is-no-wifi.md b/issues/there-is-no-wifi.md index d32b1c8729c..69ede7aa4a2 100644 --- a/issues/there-is-no-wifi.md +++ b/issues/there-is-no-wifi.md @@ -83,20 +83,31 @@ and owns each one this list gives no other owner. - **Metal rows.** Every stage with a row on the T14 or the AMD bench first needs `issues/a-metal-row-names-no-hardware-and-a-bench-without-it-reds.md`. -**S1, the T14's read-out and the compatibility-format A/B.** A scout of two -boots in one session, never landing. Owner: the orchestrator. Depends on: -nothing; it runs first. -- **Exit, the read-out**, on `pr-876`: the AX210's position, every bridge - window on its path to the root, its BARs, its MSI and MSI-X capabilities - (table and PBA BIR and offset), the DMAR scope and reserved regions naming - it, the ACPI names under its device, and where the T14's NVMe keeps its - MSI-X table. -- **Exit, the A/B**, the one exit 1 of - `issues/qemu-passes-compatibility-format-interrupts.md` asks for. Boot A - leaves one kernel-armed MSI source in compatibility format with `IRE` set - and `CFIS` clear; boot B leaves it remapped. Green is fault 0x25 and no - delivery in A, and delivery in B. A red A is filed as a kernel-wide - isolation defect against every claim, and P1 waits. +**S1, the T14's read-out and the compatibility-format A/B: done, both exits +met.** The orchestrator's scout, never landing, on `ToyOSOrg/evidence` +`pr-876`: the A/B and the PCI and DMAR read-out in `s1/` +(https://github.com/ToyOSOrg/evidence/blob/cd368b25b2259a76b80dc31f4219dac1c91d84dc/s1/judge.log), +and the ACPI read-out in `s1-r2/` +(https://github.com/ToyOSOrg/evidence/blob/abd63019cfc896d69b59a8acba29fedaec0b48cc/s1-r2/judge.log). +- **The A/B: compatibility format blocked.** Boot A left the MSI of the xHCI + at 00:0d.0 in compatibility format with `IRE` set and `CFIS` clear: fault + 0x25 and no delivery. Boot B left it remapped: delivered, no fault. P1's + Q2 condition and W5's S1 dependency are met. +- **The read-out.** The AX210 is 09:00.0, behind root port 00:1c.4: BAR 0 + alone, 16 KiB, mem64, with its MSI-X table at BAR 0 + 0x2000, its PBA at + BAR 0 + 0x3000, and MSI with one vector. No DMAR unit's scope names it, so + it is the INCLUDE_PCI_ALL unit's, and no reserved region names it. The + ACPI read-out found the radio's device under its root port, with its names + below it. The T14's NVMe keeps its MSI-X table at BAR 0 + 0x2000 too, + which puts it in P1's T14 exit. +- **What S1 does not separate.** The T14 runs with `EIME` set, and VT-d + §5.1.4 blocks compatibility format where `EIME` is set or `CFIS` is + clear. Boot A read the block with both true on every unit, so S1 does not + show `CFIS=0` alone blocking it, which exit 1 of + `issues/qemu-passes-compatibility-format-interrupts.md` still asks. A VT-d + machine the kernel leaves without `EIME` (an xAPIC machine, or a unit + without `ECAP.EIM`: `kernel/src/arch/x86_64/vtd/mod.rs`) rests on `CFIS=0` + alone. **S2, the link hop's cost on the T14.** A scout, never landing: two processes over `toyos-transport`, one entry per 1,514-byte frame, batches of @@ -125,12 +136,13 @@ Depends on: nothing. **P1, a BAR stays where firmware put it, in 4 KiB pages, its MSI-X table's page included.** Owner: the orchestrator. -- **Depends on:** S1 reading compatibility format blocked (Q2), and 4 KiB - user leaves for device windows: stage 3 of +- **Depends on:** 4 KiB user leaves for device windows: stage 3 of `issues/process-memory-is-2-mib-pages-and-that-caps-the-process-count.md`, - or the slice its holder accepts. + or the slice its holder accepts. Its Q2 condition, S1 reading + compatibility format blocked, is met. - **Exit:** - - on the T14, the AX210 claimed with its BAR in place, and + - on the T14, the AX210 claimed with its BAR in place; the NVMe driven + through its MSI-X table at BAR 0 + 0x2000 (S1); and `claim_reuses_its_remapping_entry` and `claim_refused_without_remapping` unchanged; - `msix-exclusive-bar=on` gone from `tests/common/qemu.rs` and @@ -266,7 +278,7 @@ W2. - The pull request landing it files the Transition Disable weakness below. **W5, bring-up and passive scan on the T14**, the first stage that ships -`ax2xx`. Depends on: S1, P1, P4 (its match table), W3, W4; and the test +`ax2xx`. Depends on: S1 (met), P1, P4 (its match table), W3, W4; and the test networks, an access point at the T14's bench serving a WPA2-Personal network and a WPA3-Personal one by hash-to-element, with PMF and HE, an instrument the orchestrator owns. Exit: a T14 row reads the firmware up, its MAC