PCI root bridges are acpiserver's declaration: each root's _CRS windows and _OSC offer, held by the kernel; the loader's window reads go (PCI apertures stage B)

[Japabu]

Status: draft, blocked on step 10 (the kernel's xHCI and HDA removed); rebases after. Head a18b42b88 (main 3b77b9b2f merged). Review round 1's items are answered (see the round-1 comment). Host CI and the affected QEMU rows are green at this head. No bench is staged: until step 10 lands, a bench whose IOMMU translates no wider than its CPU (the T14, the AMD bench) gives the kernel's xHCI no domain, because no declaration exists when that driver comes up. Its boot rows would fail by design. The T14 and AMD rows passed at 4f5142fea under the since-withdrawn identity-domain arrangement (readbacks).

Problem

cargo run -- --arch aarch64 handed over none of its four PCI claims. The loader's window list (each root bridge's Configuration() plus every unowned GCD MMIO range) counted ECAM and flash among the declared windows, so BARs were moved into ECAM (#916). The owner's ruling: aperture discovery leaves the loader, AML stays in acpiserver, and a refused or missing declaration fails closed.

What this changes

• acpiserver declares the PCI roots, once, from the initialised namespace (system/acpiserver/src/apertures.rs).
  • A root is a PNP0A03/PNP0A08 device below no other.
  • For each present root it reads _SEG, the bus range and the memory windows of _CRS (toyos_acpi::root_bridge). It reads Word, DWord, QWord and Extended Address Space descriptors and steps over the I/O ones.
  • It queries the root's _OSC under the PCI host bridge UUID: revision 1, Support = extended config space and MSI, Control asked = native hot-plug (bit 0) and the PCIe capability structure (bit 4). It records what the query offers. It makes no commit. Lifecycle 2 (Functions arrive and leave: the device set, native PCIe hot-plug, Gone (lifecycle stage 2) #934), which services hot-plug, commits, so the osc module's condition (no capability claimed that ToyOS does not perform) holds.
  • Refused by name: a non-zero _TRA on a memory window, a consumed range, an unknown descriptor, a second or out-of-range bus range, a root with no bus range, more than 16 roots, and more windows than the declaration's bound (MAX_WINDOWS = 64, one list across every root). Measured window counts: virt 2, q35 4, the T14 3, the AMD bench more than 8, the per-root bound that refused it at 4f5142fea. Any of these refusals declares no root, which the kernel refuses. acpiserver logs each root's window count and its _CRS bytes as the machine's own line.
• The declaration is per host bridge (toyos_abi::acpi::Apertures): each HostBridge carries segment, first_bus, last_bus, its _OSC offer, the grant of a commit (none in stage B; Functions arrive and leave: the device set, native PCIe hot-plug, Gone (lifecycle stage 2) #934 commits and declares it) and its run of one shared window list. A commit beside no offer, or of bits not offered, refuses the declaration. It travels through a new op::DECLARE on the acpi claim. Lifecycle 2 (Functions arrive and leave: the device set, native PCIe hot-plug, Gone (lifecycle stage 2) #934) depends on this shape and consumes the record through an adapter at the declare handler.
• The kernel holds it (kernel/src/pcidev):
  • It accepts a declaration only from the acpi claim's holder (held_by) and only from Unknown (toyos_pci::aperture::Held).
  • aperture::records checks each record against the ABI: counts and window runs inside their arrays, an _OSC word the ABI names, an ordered bus range, and no two roots of one segment sharing a bus. Then check takes every root's windows together: whole, disjoint, none over RAM. Any failure refuses the declaration by name, logs it, wakes the waiters and stands as the answer.
  • Each root's offer is logged as pci: root 0000:00 _OSC: native hot-plug offered | not offered | no _OSC, buses 0x00..=0xff.
  • The acpi claim ending without a declaration withholds it (Ended).
• A PCI claim made before the declaration waits on the declaration's watch, on the claimant's syscall thread, until the declaration is made or withheld, or 30 s pass (DECLARATION_DEADLINE, a failure ceiling). A claim that waits out the deadline withholds the declaration for the boot (Unanswered).
• Every metal boot now fails on a refused declaration (Readback::declaration_not_refused, run beside the other shared boot checks), and the AMD row requires the declared-windows record. That closes the hole the AMD bench's refused declaration slipped through.
• The supervisor starts the acpi claim's holder first. Every image that claims a PCI function starts acpiserver. acpicase's probe stays the claim's holder, so that image drops diskserver, and the probe's held-function arm moves to the kernel's xHCI. Lost coverage: no booted test exercises pcidev::enumerated's claim-held branch any more.
• AArch64 gets the hardware-reduced acpi claim: a row with no port and no line, HARDWARE_REDUCED, ECAM for configuration access, firmware's own memory through the direct map, registers refused NoRegisters, ports refused NoPorts. No new privilege. acpiserver skips arming and \_S5 there.
• IOMMU: one rule (owner's ruling, withdrawing option 1). A domain lies above the CPU's addresses where the unit has room. Otherwise it lies clear of the declared windows, and with nothing declared there is no domain. A claim passes its declaration (OwnSpace::create(room, Some(windows))). A kernel driver comes up before any declaration and passes none (DeviceSpace::create). The backends keep only their RMRRs and IVMDs.
• Deleted: loader/src/gcd.rs, loader/src/rootbridge.rs, PciRootBridgeIo, and KernelArgs::root_bridge_windows with its count (KernelArgs 1488 → 456 bytes), plus the OVMF Configuration() fixture and its tests.
• Issues:
  • an-aarch64-cargo-run-boot-hands-over-no-pci-claim.md is deleted; its exit is met.
  • an-x86-machine-with-no-acpi-row-hands-over-no-pci-claim.md is new. It records the loss on an x86 machine with no acpi row; owner: this track.
  • The exit condition of no-boot-reaches-the-retry-… now says a new way to arrange its case is owed.
• Size: 70 files, +1972/−1047 against origin/main, tests included (measured).

What each judge establishes

• virt, cargo run -- --arch aarch64 at 4f5142fea (log): all four claims handed over (diskserver's NVMe, soundserver, netstack, vdagent), plus the compositor's virtio-gpu. Since then the IOMMU's kernel-driver path and the _OSC commit changed; neither affects a claim on virt, whose unit is wider than its CPU.
• virt_claim_lpi requires pci: root 0000:00 _OSC: native hot-plug offered. VirtIts has a second root at bus 8.
• a_drives_row_holds_one_process_per_function requires q35's not offered.
• a_claim_waits_out_an_undeclared_machine (q35, no acpiserver): the first claim waits 30 s, and both are refused by name.
• acpi_mediated_access judges the Ended transition.
• clear_of_host_bridges reads the acpi claim's declared windows.
• amdvi_translates_the_stick_controller also requires the declaration.

Checks

check	revision	result
cargo run -- --ci host	merge before de8e9883a (that commit changes one guest judge)	exit 0, 86 green (log)
18 QEMU rows (q35, virt)	same	17 passed; virt_claim_lpi red on its own judge (log)
virt_claim_lpi	de8e9883a	exit 0 (log)
host tests	in --ci host	_CRS: both QEMU DSDTs, every descriptor width, _TRA and hostile lists, an 18-window root, an absurd one, a single-byte sweep. _OSC: offered, firmware failure, unrecognised revision, all masked, QEMU's 0x1F and 0x1E masks, extra bits dropped, absent, malformed answers, never committed. Records: each malformed field, shared buses, a refusal being the answer. State machine, RAM fence, ABI records
controls	see READMEs	_TRA accepted, RAM fence off, second declaration replacing, claim not waiting (round 0); old per-root bound, _OSC committed, malformed record left Unknown (round 1): each red
metal	4f5142fea	T14 4/4, AMD 1/1 under option 1; the AMD declaration refused, the finding fixed here. Not re-staged: blocked on step 10

Risks and open points

• Every machine's claims depend on acpiserver, metal included. An x86 machine with no acpi row loses every PCI claim (the new issue).
• The AMD bench's _CRS is still unmeasured byte for byte. Its next boot logs the bytes and the window count. The host case taken from it, which the orchestrator asked for, is owed until then. The 18-window test is crafted.
• Until step 10, a T14- or AMD-like machine gives the kernel's xHCI and HDA no domain on this branch, by design under the migration rule.
• The T14's firmware offers native hot-plug (measured at 4f5142fea, when it was committed). Lifecycle 2 commits it.

🤖 Generated with Claude Code

https://claude.ai/code/session_016UzbDnM9m6nQWhbjGi6Lv1

[Japabu]

Metal at 4f5142fea, run by the orchestrator: evidence commit 42550608c1e282100d36de07febe6b3cb9f83b80, stage-b/README.md, "Metal".

• T14: 4 passed over 2 boots (acpi_tables_loaded, claim_reuses_its_remapping_entry, domain_ends_below_the_host_bridges, usbd_drives_the_type_c_controller). Tables loaded in 54 ms and 55 ms; acpiserver started 1-2 ms before diskserver; declared mem 0xa0000..0xc0000, mem 0xa0800000..0xc0000000, mem 0x4000000000..0x8000000000; one claim waited 37 ms. The granted 0x0 of 0x0 lines are \_SB._OSC and the processors'. The host bridge's line is pci: root 0000:00 _OSC: native hot-plug granted.
• AMD bench: amdvi_translates_the_stick_controller passed: each kernel xHCI domain maps its one pool at identity. Tables loaded in 45 ms.
• Finding, a defect of this PR: the AMD bench's \_SB.PCI0._CRS has more than MAX_BRIDGE_WINDOWS (8) memory windows. So acpiserver declared no root and the kernel refused the declaration. No claim was made on that boot, so no row went red, but every process claim on that bench would be refused at this head. The fix is a larger per-root bound, or one window pool shared across roots, plus a host case from that bench's _CRS. I have not changed it while the review runs.

[Japabu]

Review of #935 at 4f5142fea (PCI apertures stage B)

Architecture

The ownership matches #916's design and the stage-B rulings. AML stays in acpiserver. The kernel holds a typed, write-once aperture::Held. The loader no longer asks UEFI about apertures. gcd.rs, rootbridge.rs, PciRootBridgeIo and KernelArgs::root_bridge_windows are gone with no residue: the only remaining match is a historical string in build/identity.rs:208's test fixture. KernelArgs is 456 bytes in the ABI's const assertions, the loader's initializer and the kernel's reader, all in one landing.

Admission is enforced by sys_acpi's held_by check and by Held::declare accepting only from Unknown. The claim's Drop calls declarer_gone, so a claim that ends without declaring moves the state to Ended. Both paths are host-tested.

Option 1 is implemented as ruled:

• Placement::Identity is used only by DeviceSpace::create, which serves the kernel's own drivers.
• Its map returns Iova::translated(phys). Nothing else is mapped into such a domain on VT-d or AMD-Vi; on the SMMU the ITS doorbell page is also mapped, which MSI requires and which is MMIO.
• It is refused when pmm::top() reaches past what the unit translates.
• Claimed functions keep Window::new, now taking the declaration as a parameter. IommuError::Undeclared and the Option threading are gone.

The RAM fence takes firmware_map() filtered by is_read_as_memory: usable memory plus ACPI reclaim and NVS. That covers every type the pmm hands pools out of, which is what the premise needs. It is a different source from the IOMMU's reserved regions, which come from RMRRs and IVMDs, and it should be. The fence runs after the kernel drivers' domains already exist, so it is a bug fence on the declaration, not a gate on option 1. The premise itself is a hardware fact.

window.rs's header was rewritten, not appended to.

The wait is sound:

• wait_until on DECLARATION runs with a Parkable::at_entry() on the claimant's syscall thread. For an endowed claim that is the supervisor's thread.
• It has a 30 s Deadline and never spins.
• A kill returns None, so the claim fails as Unusable.
• One expired deadline answers Unanswered for the whole boot. This is stated in the pcidev header and in DECLARATION_DEADLINE's doc. The undeclared row tests it: exactly one waited line, and both claims refused. It hides no transient: a declarer slower than 30 s leaves a named refusal on every claim.

Required

1. kernel/src/syscall/device.rs:181 / kernel/src/pcidev/mod.rs:425 / sdk/abi/src/syscall.rs:2119: a malformed record is refused silently and without becoming the answer.

   • RootBridge::decode returns None for a count > 16, a window_count > 8, an unknown _OSC word, a grant beside no answer, or first_bus > last_bus. That answers InvalidArgument, but the state stays Unknown, nothing is logged and nothing is posted.
   • acpi_declare's contract says InvalidArgument means a declaration "said in its log by name and leaving every PCI claim refused". For this path that is false.
   • Scenario: a hostile or buggy acpiserver sends count = 17. Every waiting claim keeps waiting toward its 30 s deadline with no line saying why, and a second, valid DECLARE is then admitted. That breaks "once", because a refused declaration is supposed to be the answer.
   • Fix: make a decode failure a named refusal through Held (for example a Refused::Record variant, logged and posted). decode currently has no test, so move it beside Held in toyos-pci and host-test each malformed field there.
   • Overlapping bus ranges of two roots on one segment are not refused either. That is harmless today, since only the windows are consumed and overlapping windows are caught by check, but see suggestion 2.

2. system/acpiserver/src/osc.rs:8-11 against :157-178: ToyOS commits native PCIe hot-plug control it does not perform, and the module header now states something false.

   • The header holds _OSC to the owner's _OSI condition: "each bit set only where ToyOS does what the bit promises". negotiate_root commits NATIVE_HOT_PLUG, and nothing services it until lifecycle 2. The PR's own risk section admits that on virt firmware hands hot-plug to an OS that does not act on it.
   • The stage-B ruling asks for the grant to be negotiated and logged. It does not set aside the owner's condition. That conflict is the owner's to settle, not the implementer's.
   • Smallest compliant fix: send the query only (Query flag set) and record what would be granted, then let lifecycle 2 commit once it can service hot-plug. Otherwise, get the owner's explicit agreement and rewrite the header to state the exception.

3. No silent debt: an x86 machine with no acpi row now loses every PCI claim.

   • kernel/src/arch/x86_64/acpi_mode.rs:234-250 mints no row for any of these: an unusable FADT, no PM1a block, no SMI_CMD, no I/O APIC carrying the SCI, an SCI line shared with another row, or HW_REDUCED_ACPI.
   • On main such a machine still handed over its NVMe and NIC claims from the loader's list. On this branch its first claim waits 30 s and every claim of the boot is refused.
   • This is a fail-closed consequence of the accepted design, but it is recorded only in the PR body. issues/a-hardware-reduced-x86-machine-has-no-power-off-and-no-power-button.md covers power alone.
   • It needs an issues/ record with its evidence, owner and exit, per root CLAUDE.md.

4. Evidence: tests/images/acpicase.toml changed, and its metal row was not staged.

   • Dropping diskserver changes the image of acpi_server_death (tests/toyos.rs:700), a T14-only row. Its fileserver still lists the data role with no block service.
   • The guest rows on this image pass under QEMU (guests-merged.log). Nothing shows that the T14 boot still reaches its job and readback without the NVMe.
   • The staged T14 batch has only testcases and testcases-xhci-leave (metal/t14-request.txt).
   • Cheapest fix: add acpi_server_death (one acpicase boot) to the T14 run the orchestrator is already making, or explain why the change cannot affect it.

5. kernel/src/iommu/window.rs:87: false contract. Addresses::map is documented "never handed out before". For Identity that is not true: it answers phys for any call. The sentence belongs to the Window arm alone, so say so or drop it.

Suggestions

1. sdk/abi/src/acpi.rs:358: MAX_BRIDGE_WINDOWS = 8 is unmeasured. The old bound was 64. Exceeding it refuses the whole declaration, which on the T14 would refuse every claim on the bench.
   • Inference, not measured: Intel root _CRS lists commonly produce the sixteen-KiB legacy windows at 0xc0000..0xdffff beside VGA and the 32- and 64-bit windows, which would exceed 8.
   • Raising the bound costs 16 bytes per window per bridge. The staged acpi_tables_loaded row will show the real count either way.
2. kernel/src/pcidev/mod.rs:417: the kernel keeps first_bus and drops last_bus. Lifecycle 2 will need the range, and it is easier to validate once at this boundary now: refuse overlapping ranges on one segment.
3. Lost coverage. The acpi_mediated probe's HeldFunction arm now checks the kernel-driven branch of pcidev::enumerated (:512). Nothing booted exercises the claim-held branch (f.held) any more, and only acpi_mediated checks HeldFunction in a guest. The PR body should say so, and if it can be restored cheaply, it should be. One way: a probe arm that declares q35's measured windows itself as the claim's holder, then holds an edu.
4. amdvi/selftest.rs:44, smmu/selftest.rs:62: the comment "the unit translates past the CPU's addresses" is an unchecked premise behind passing &[]. An assert! costs as little and holds it.
5. Kernel stall at boot (inference). The supervisor blocks inside its first PCI claim until acpiserver declares. On the T14, earlier namespace initialisation asked for about 10 s of sleeps (The AML interpreter finished to ACPI 6.5: Load and _OSC, the namespace initialised, every address space, every event, and the bounds stated #875), and the staged acpi_tables_loaded row prints each claim's wait. The orchestrator should read that row as a boot-time cost, not only as a pass.

Evidence checked

• ci-host-4.log: --ci host at 4f5142fea, EXIT=0, "86 step(s), all green". The FAILED lines in it are the proclife mutation controls reaching their verdicts.
• guests-merged.log: 18 passed at 4f5142fea.
• x86-undeclared-2.log: at d84d8c345, "waited 30006ms", and both edu claims refused by name. The test's lower bound of 30 s is a deadline that cannot fire early, so it is not a QEMU timing claim. The ceiling is three times the deadline.
• arm-cargo-run-final.log: _OSC: native hot-plug granted, the declared windows 0x10000000..0x3eff0000 and 0x8000000000..0x10000000000, "waited 5ms", 00:02.0, 00:03.0, 00:05.0 and 00:06.0 handed over, diskserver: partition … at block 256, vdagent: port 1 open, and domain1 "maps each pool at identity". The closed issue's exit is met.
• Controls: _TRA, the RAM fence, a second declaration replacing the first, and the claim not waiting are each red as stated, at revisions whose later edits do not touch the mutated lines.
• The _CRS reader handles Word, DWord, QWord and Extended descriptors, skips zero-length ranges, refuses _TRA, consumed, unknown and second-bus descriptors, and is swept over both QEMU _CRS lists.
• _OSC uses UUID 33DB4D5B-…, revision 1 and three DWORDs. The Control field is masked to what was asked, then to what was offered. Failure, an unrecognised UUID or revision, an absent _OSC and malformed answers are each host-tested.
• The judges are restated as claimed: clear_of_host_bridges (identity mappings at phys, outside every declared window, with red cases) and amdvi_translates (exactly one mapping, at identity).
• PR body correction (orchestrator's): the measured diff against origin/main is 69 files, +1940/−1113, not "+1621/−1100 over 67 files".

SEND BACK: required items 1 to 5. The T14 and AMD rows remain the orchestrator's to judge.

[Japabu]

Round 1 at de8e9883a (main 3b77b9b2f merged). Evidence: pr-935 64646e491, stage-b/round2/README.md.

1. Malformed records: toyos_pci::aperture::records checks every record before a window is read. It refuses a count or window run past its array, an unnamed _OSC word or a grant beside no answer, a reversed bus range, and two roots of one segment sharing a bus (your suggestion 2). The kernel keeps both bus ends. The refusal goes through Held::refuse: it is logged, the waiters are woken, and it stands as the answer, so a later declaration is late. Host-tested per field. The control that leaves the state Unknown reds the test.
2. _OSC: a query alone, revision 1, Control bits 0 and 4; the offer is recorded and logged as offered. Functions arrive and leave: the device set, native PCIe hot-plug, Gone (lifecycle stage 2) #934 commits. The osc header states this. A host test shows the firmware is called once, with the Query flag set; a control that commits reds it. QEMU q35's 0x1F and 0x1E masks are now cases.
3. Recorded as issues/an-x86-machine-with-no-acpi-row-hands-over-no-pci-claim.md, with each condition that leaves no row, the measured machines, owner and exit as ruled.
4. acpi_server_death: not staged. By the owner's ruling the branch is blocked on step 10 and no bench is re-staged before it. The body says the bench boots would fail by design until then. This row joins the batch when the branch rebases.
5. window.rs:87: gone with option 1, which the owner withdrew. window.rs is main's again, the one rule. Claims pass their declaration; kernel drivers, which come up before any declaration, pass none.

Also in this round:

• Window bound: the AMD finding is fixed with one list of 64 windows across every root. An 18-window root is a host case, and a control with the old per-root bound reds it.
• Shared metal check: every metal boot now fails on pcidev: the root bridges' memory is refused as declared, and the AMD row requires the declared-windows record.
• Lost coverage: your suggestion 3 is stated in the body.
• Size: measured at 70 files, +1972/−1047.
• Not taken: suggestion 4 (the selftests pass None now, so the premise is the window rule's own refusal); suggestion 5 (no bench boot happens before step 10).

[Japabu]

a18b42b88: the per-root record carries the _OSC commit beside the offer, so #934 needs no ABI change.

• HostBridge gains commit/committed beside osc/offered (renamed from granted).
• HostBridge::commit() answers Some(None) where no commit was made, as in all of stage B. It answers Some(Some(bits)) for a commit that granted no more than was offered. It answers None for a commit beside no offer, bits not offered, or an unnamed word.
• toyos_pci::aperture::records refuses any of those cases by name (Refused::Record) with the whole declaration.
• The kernel keeps the commit with the root's record and logs …, buses 0x00..=0xff, no commit (or committed 0x…).
• acpiserver still sends the query alone and declares None for the commit. Functions arrive and leave: the device set, native PCIe hot-plug, Gone (lifecycle stage 2) #934 performs the commit beside the query in osc.rs and declares the committed bits.

Host tests: an offer with no commit decodes; a commit decodes beside an offer covering it; a commit beside no offer, beyond the offer, or under an unnamed word is none; records refuses a commit with no offer and accepts an offer with none. cargo run -- --ci host at a18b42b88: exit 0, 86 steps green (log). No guest row was rerun: the kernel's log line gained a trailing clause, and the two judges that read it match prefixes that still hold.