The loader-slimming track, and the firmware rule in CLAUDE.md

[Japabu]

Places the owner's rulings on the loader audit: the loader-slimming track (issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md), one rule in root CLAUDE.md, and the accepted cost of a security-version floor. PR #539 is closed in favour of the track; each of its pieces is placed in a stage or listed as deleted.

• CLAUDE.md, Architecture: Firmware — the kernel calls no UEFI service; every UEFI call ToyOS makes is the loader's, before ExitBootServices. The loader's GetVariable, SetVariable, GetTime and ResetSystem all come before the handover, so the rule holds of the tree. kernel/src/arch/aarch64/rtc.rs' header loses the GetTime clause the rule forbids.
• issues/boot-media/the-anti-rollback-floor-is-a-firmware-variable.md: one bullet records the accepted cost. Once the floor counts a security version, an older build the same key signed at that version boots.
• issues/boot-media/the-machine-updates-itself-without-ubuntu.md: stage 2 gets an exit and names its wait on the track's --boot-first; the A/B later stage is the track's stage 5.

Gates

gate	exit
cargo test -p toyos-build --lib	0 (412 passed, 3 ignored), at 8a9af8e
cargo run -- --clippy (x86_64 and aarch64 kernel, bootloader, workspace)	0, at 8e382e0

No QEMU run and no T14 run: the only code line is a comment.

Unsure

• 3 tries is my number: it follows Android and libabr's small counts and bounds a T14 hang loop at three bounded boots.
• update --good as the writer of the good flag is my choice. Init already mints the slots claim, and only update holds it. An image that grants no program the claim is never good and boots three times.
• The ready pipe and [boot] up are my choice for the health gate's signal: the tree has none, and a swap's probation only asks whether a process still runs.
• Stage 8 needs a boot map that maps bus 0's ECAM window before mm::init. Whether toyos-bootmap can do that cheaply is unmeasured.

🤖 Generated with Claude Code

[Japabu]

Review, round 1, at 97e8fb3

CI: host success at 97e8fb3 (run 36460912313; steps --ci host and --ci gate-stage both success). git merge-tree against origin/main a2c74f2 is clean. Size: +167/-22, all prose. No production or test lines change.

BLOCKER

• CLAUDE.md:53 — "ToyOS calls no firmware after ExitBootServices" is false of the tree today. kernel/src/drivers/xhci/legacy.rs:101 ("Asks firmware for the controller") sets USBLEGSUP.OS_OWNED at :131, then spins up to 1 s at :134-138 waiting for firmware's SMM handler to answer. That is a firmware request made by the kernel after the handover. Either the owner rules that the ownership semaphore is not a call, or the breach gets an issue with an exit (for example: clear the SMI enables and reset without asking).
• CLAUDE.md:53 — the rule forbids a stage of an open track. Stage 5 of issues/kernel/toyos-runs-on-arm64.md (:302-306, also :231) plans PSCI CPU_ON/CPU_OFF/SYSTEM_RESET/SYSTEM_OFF. These are SMC calls into EL3 firmware from the kernel. Nothing reconciles the two.
• track:36-41 — stage 1 deletes the only reader of the evidence that an-armed-tco-has-never-reset-the-t14.md's exit needs (TCO1_STS, and no_reboot/timeout from bootloader/src/watchdog.rs:111-130, judged by the T14 row loader_watchdog_arms at tests/toyos.rs:1765-1776). The track says that evidence "moves to the kernel's read-back", but kernel/src/arch/x86_64/watchdog.rs:84-99 reads neither TCO1_STS nor no_reboot. The same stage also leaves ARMED_ON_ARRIVAL (kernel watchdog.rs:37, :86-90) and tests/common/power.rs:565-581,652-713 dead. The stage must name the kernel read-back it adds and the predicates it moves or deletes.
• track:52-53 — stage 1's negative control cannot fail. After wall_clock_zone goes, no wall_clock_* test reads SYS_CLOCK_EPOCH against the staged RTC: probed_epoch (tests/common/wallclock.rs:85) has one caller, zone_from_firmware (:232). A zone only moves the epoch (kernel/src/clock.rs:160-163); names and FAT stamps stay local. Patch let offset_secs = -7200; into init_wall, and every remaining wall_clock_* stays green. Name the test that reds on it. This stage changes the ABI.
• track:89 — stage 4 deletes the dead-slot retry (bootloader/src/slot.rs:95-107). Its reason is at slot.rs:13-16: "a machine with one slot, or with two that both died, boots what it has". The track never says what slot A's good flag and tries are on a freshly built image. Every QEMU image and every stick carries slot A alone. It also never says what a table with no bootable slot does. As written, a one-slot image whose kernel dies before marking itself good boots nothing once its tries run out.
• track:88-107 — stage 4 names no control for a slot rewrite that leaves the good flag set. Patch: update installs into a previously-good idle slot without clearing good. That slot then skips the countdown and raises the floor on its first boot. None of the three named controls reds on it, and update_hang_kills_an_unproven_image installs into a never-good slot. Add a test that updates twice over the same slot.
• track:93-95 — slot::proven's removal is sound only if the floor rises to the verified header's version, and no control holds that. Patch: raise to the slot table's version field. Honest tests plant equal versions, so every named update_* stays green. The test must plant a table version above the header's and see the floor stay at the header's.

NOTE

• track:47-48 — on aarch64, counter_origin (bootloader/src/arch/aarch64.rs:29-34) is a deletion, not a move: the kernel already reads CNTFRQ_EL0 (kernel/src/arch/aarch64/cpu.rs:18-23). On x86, nothing checks the moved line: tests/toyos.rs:19630-19632 prints "unsaid" and does not fail.
• track:37-39 — the span left unbounded is ExitBootServices (bootloader/src/main.rs:752) to deadline::start (kernel/src/main.rs:392) on boot-deadline= boots. It reaches arch::watchdog::init (:415) only on the others. It does not start at "the jump".
• track:42-45 — once the zone goes, the kernel's local/UTC split (kernel/src/clock.rs:137-139, UTC_OFFSET_SECS) is constant zero. The stage names only the loader's side and the actuator.
• track:61-79 — stage 3 is high-risk and names no independent oracle. The candidate is the host reading the vars store: UEFI 2.10 §8.2 attributes plus the name.
• track:74-79 — the machine this changes is the T14: QEMU gets fresh vars per boot (tests/common/qemu.rs:3157-3164), and the exit is QEMU-only. There, one variable per checkout key accumulates with nothing deleting it. A refused older image has no reset path but firmware setup (bootloader/src/floor.rs:72-76), and "deliberately reset" names no tool.
• track:61-79 — stage 3 makes the throwaway-key bullet of the-anti-rollback-floor-is-a-firmware-variable.md false and does not say it is deleted.
• track:99 — "--boot-first is the only boot-variable write" is false from stage 4 until stage 6, while bootnext::point_at_us (bootloader/src/main.rs:1069) still writes BootNext on every pass.
• track:96-98 — nothing says what keeps the running system on a --once slot from marking it good.
• track:147-156 — stage 7 makes the exit of issues/diagnostics/a-wedged-reports-newest-records-were-cut-by-the-loaders-own-log-file.md (ENDS_AT_CHAIN on the stick) unreachable, and does not dispose of that issue. The stage also does not say that the kernel takes over harvest's log-GUID stale-record check.
• track:24 — "Its pieces are placed in the stages below" is not true of these In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539 pieces, and no stage names them:
  • toybox date;
  • Guid::parse;
  • Ssh::probe/fetch and ssh-client-host;
  • AUTHORIZED_ON_ROOT;
  • SLOT_ONCE;
  • the src/bootlog.rs constants.
• issues/boot-media/the-machine-updates-itself-without-ubuntu.md:39-44 — stage 2 lost its exit, and does not say that it depends on the new track's stage 4 (--boot-first).

REMOVE

• track:17 — quotes CLAUDE.md in the wording 97e8fb3 withdrew as false of SMM ("no firmware code runs").
• track:9-13 — narration no stage needs.
• track:20-22 — an estimate from a document outside the tree.
• track:49 — "the audit's ten worst comments": the list is not in the tree, so the item cannot be executed.

SEND BACK

[Japabu]

Review, round 2, at dc6aebc

CI: host SUCCESS at dc6aebc (run 36466099535; --ci host and --ci gate-stage both success). git merge-tree --write-tree is clean against origin/main bc9ccad, and clean against PR #578's head bce73ab (it edits Build & test, not Architecture). Size: +293 −21, all prose: CLAUDE.md +2, issues +291 −21. No production or test lines change.

Round-1 BLOCKERs

1. CLOSED: CLAUDE.md vs the xHCI legacy handoff. CLAUDE.md:53 now names UEFI calls, and USBLEGSUP is a PCI capability handshake, not a UEFI call.
2. CLOSED: CLAUDE.md vs PSCI. PSCI is an SMC, not a UEFI call.
3. CLOSED: the TCO evidence. The loader's arm stays (track:52). Stage 8 (track:241-257) names the read-back and each predicate it moves or deletes, and every name exists in the tree.
4. CLOSED: stage 1's control. It is now wall_clock_utc (track:56-60). At Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's local 8565cc5, rtc_is_utc judges both SYS_CLOCK_EPOCH and realtime= against RTC_BASE (tests/common/wallclock.rs:262-281). A local-time kernel moves the epoch by −7200, and REALTIME + 7200 moves the time of day by +7200. Both are red by construction. The red run is Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's to post.
5. CLOSED: a fresh image with no bootable slot. A fresh slot A starts untried (track:150), and with no bootable slot the machine powers off (track:159-160).
6. CLOSED: the good flag left set by an install. The control is named (track:193-196). See the priority NOTE below.
7. CLOSED: the floor raised to the table's version. The control is named (track:197-199). The table carries a per-slot version that the loader does not trust (toyos-update/src/slots.rs:12, 16-19), so the test can plant one.

BLOCKER

• track:122-123, 138-140 — The loader's panic handler "resets the machine". A panic with a fixed cause then resets into the same panic, with no bound. Today uefi-services powers the machine off. The reset also contradicts stage 5's rule that a pass with nothing to boot powers off. Fix: write loader.log, then power off. The exit test expects QEMU's guest-shutdown, not a reset.
• track:139, 155-158 — Take an update whose signed kernel does not load: not an ELF, the wrong machine, or a refused relocation.
  • Today, attempt::write_chosen (bootloader/src/main.rs:1017) runs before load_kernel_elf (:1057), which panics at :340-402. The next pass books the death and boots the other slot.
  • Stage 5 makes the decrement the pass's last write, and books no loader failure against the image. So that slot is chosen on every pass, its tries never fall, and the kept slot never boots. That is a regression that bricks the machine.
  • Fix: a kernel the loader cannot load is a refusal of that slot inside verify, and the pass falls to the other slot. Stage 4's panic test uses a failure the machine causes instead.
  • Control: update B with a signed non-ELF kernel, and A boots. Turning that refusal back into a panic must turn the test red.
• track:192 — "Raising the floor on a slot not yet good fails an update_* test" names no test, and none can fail.
  • The security version is now constant across builds, so every update_* test installs images of equal version. Raising the floor on an untried slot changes nothing any of them sees.
  • Patch: raise the floor on any pass that boots a slot, good or untried.
  • The test that must go red: install into B an image signed at the running security version + 1 whose kernel hangs. B spends its tries and A boots, and vars::live reads the floor at A's version.
• track:200 — "Booting after a failed decrement fails a host test of decide" cannot catch the loader's wiring. decide takes "whether the last write persisted" as an input, so a loader that passes true without reading the write's status stays green.
  • Name a guest control: boot the image with the stick read-only (In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539's stick_readonly). Nothing boots, the no-bootable-slot line is on the console, and QEMU reports guest-shutdown.
  • Patch: let persisted = true; in the loader must turn it red.
• track:134-135, 138-143 — Stage 4 changes the KernelArgs layout, which is high-risk ABI, and its exit names no control that the layout identity moved. Every listed test boots a loader and kernel from one build.
  • Patch: leave the identity constant as stage 1 set it. Every listed test stays green.
  • Control: a stage-1 loader handing a stage-4 kernel is refused by the identity check's name.
• track:102-107 — "Why nothing is weaker" is false.
  • Today's build-time floor refuses every build older than the newest one a boot proved. Stage 3 admits any older image the same key signed at the same security version.
  • So anyone who can write a slot can roll the machine back to a build whose hole nobody declared.
  • The ruling accepts that cost, and the track hides it. Delete the heading's claim. Add the gap to the "does not hold against" list of issues/boot-media/the-anti-rollback-floor-is-a-firmware-variable.md, which stage 3 already edits.

NOTE

• track:39-62 — Stage 1 does not match Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583.
  • Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's pushed head 6d42256 has neither the layout identity nor the kernel's IA32_TSC_ADJUST line.
  • Its local head 8565cc5 has both, but:
    • the probe prints realtime=, not local= (track:57);
    • boot_from_power_on still prints "unsaid" and does not fail when the line is missing (tests/toyos.rs:19652 at 8565cc5), against track:61-62;
    • the refusal is proven by an actuator that writes 0, not by a base loader handing a head kernel (track:59-61).
  • Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's uncommitted worktree deletes the layout word altogether. Re-check stage 1 against Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's landing head.
• track:33-34 — SLOT_ONCE is deleted "because stage 4's KernelArgs carries a once boot as a field", but stage 4's field list (track:127-131) has no such field.
• track:132-133 — The rename does not meet the exit of the-kernel-reserves-its-stack-offset-as-a-physical-region.md, which needs the region gone. PR Kernel: stop reserving the stack's image offset as a physical range #584 (b0c5640) deletes that region. Drop "which closes …": as written it is a sibling of Kernel: stop reserving the stack's image offset as a physical range #584.
• track:18-35 — These In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539 pieces are neither placed nor deleted:
  • the loader's request.rs, bootvars.rs and REMOVABLE_PATH;
  • policy::order's once and policy::told;
  • record.rs's once;
  • src/image.rs::update_of;
  • the harness's recovery_stick, stick_readonly and RECOVERY_STICK_*;
  • tests/common/metal.rs;
  • --metal-via-ubuntu;
  • the tests update_trial_writes_nothing_of_the_kept_slot, update_no_slot_boots_the_recovery_stick and update_boot_next_boots_the_entry_once.
• track:150-153 — Nothing says an install raises its slot's priority above the kept slot's. Without that, update_over_a_good_slot_starts_it_untried passes with B booting at once. The control must assert that A's kernel booted three times, from the slot table read after each pass.
• track:161-163 — The Unsure about the health gate: the rule is workable, but it names no writer of the good flag and no claim for it.
  • Only system.toml:94-95 and tests/updatecase grant slots = true. The other 35 images can never mark good, so each of their boots spends a try.
  • That is harmless for a test that boots once. Say that an image without the claim is never good, and list the tests that boot one image more than three times (hang_bounded_by_the_stick's Carried image; blackbox_foreign_record).
• track:172-174 — Under the new Firmware rule, the loader writes the HD(…)/File(…) entry on the table's request, as In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539 did. update writes only the request.
• track:204-207 — "The slot table the host reads off the disk" is not an independent oracle if the host decodes it with toyos_update::slots::Table::decode. The host must decode it without production code.
• track:84-86 — Nothing makes a security fix raise the version: no gate, no owner. A fix that forgets to raise it leaves the floor where it was.
• PR body, Unsure "Old build-time floors": one NVRAM variable per key stays for ever, and only the PR body records it. Stage 3 either deletes its own key's old-named floor or records the leftover in issues/.
• track:161-166 — Stage 5 makes true the second half of the floor issue's exit and its "a floor that never rises" bullet. The stage does not say it edits them.
• CLAUDE.md:53 — For the orchestrator, not the implementer: read literally, "calls no UEFI runtime service" is false of the loader. It calls GetVariable, SetVariable, GetTime and ResetSystem through the runtime table (bootloader/src/floor.rs:104, main.rs:845), and stages 3 to 5 keep doing so. The ruling's words are the owner's to confirm, for example "after ExitBootServices".

REMOVE

• track:204 — "which these are": false. libabr boots the slot anyway when the decrement write fails; stage 5 does not.
• track:29-32 — the names of two issue files that exist only in closed In QEMU, the loader writes boot variables on the running system's request and a failed pass falls to the entry behind its own or powers off; toyos-metal drives a boot through a machine running ToyOS alone #539.
• PR body, "## Round 1, finding by finding" and "Also from the roast and prior art": review chronology and out-of-tree provenance in main's merge record.

SEND BACK

[Japabu]

Review, round 3, at 0a76929

CI: host SUCCESS at 0a76929 (run 36474642506, the only job, success). git merge-tree --write-tree origin/main 0a76929a is clean against e3a1cdc (exit 0). Size: +351 −21, all prose (CLAUDE.md +2, issues +349 −21). No production or test lines. Stage 1 matches #583 at 8565cc5: layout at 164, LAYOUT 0x5459_0001, the check after panic_console::arm and before blackbox::arm naming both words, loader-writes-no-layout writing 0, wall_clock_utc with a −120 zone and realtime=, the kernel's IA32_TSC_ADJUST line, and no counter_origin or TSC_ADJUST read left in bootloader/src.

Round-2 BLOCKERs

1. CLOSED: the panic handler resetting. track:141-143 now says write loader.log, then power off. Its control is a new BLOCKER below.
2. CLOSED: an unloadable signed kernel. track:183-185 makes it a verify refusal. Under the named mutation, B is chosen, the loader panics and powers off, and A never boots, so update_unloadable_kernel_boots_the_other_slot goes red.
3. CLOSED: update_floor_waits_for_good (track:234-237). Under "raise on any booted slot", B's untried pass raises the floor to v+1. A is then refused, nothing boots, and the floor does not read at A's version.
4. CLOSED: update_readonly_stick_boots_nothing (track:246-249). Under let persisted = true;, A boots and the test goes red.
5. CLOSED: the identity bump. Under LAYOUT left at 0x5459_0001, LAST_LAYOUT equals LAYOUT and the kernel accepts. The offset half is a new BLOCKER below.
6. CLOSED: "Why nothing is weaker" is gone, and the cost is on the floor issue's list (floor issue:37-41).

BLOCKER

• track:147-149, 155-156 — Stage 4 deletes "the hand offset asserts", and with them 8565cc5's offset_of!(KernelArgs, layout) == 164 and every prefix offset. It also turns "u32 presence flags" into #[repr(C, u32)] enums, and boot_partition_present (144) and the boot-partition fields (112-148) sit before the word.
  • The claim "Every field before the layout word keeps its offset" is then checked by nothing, and the enum plan breaks it.
  • Patch: move pub layout: u32 after root_read_tsc in stage 4's KernelArgs. kernel_args_last_layout_refused stays green, because loader and kernel share the struct. A real stage-1 loader then hands the word at 164 to a kernel that reads it elsewhere.
  • Fix: stage 4 keeps compile-time offset_of! asserts for layout and every field before it. It says the prefix stays flat, so the enums are only after the word. That patch must then fail to build.
• track:163-165 — loader_panic_powers_off can stay green under the mutation it names.
  • The refused-floor site writes its reason to loader.log itself before panic! (bootloader/src/main.rs:895-902).
  • uefi::helpers' handler also ends in ResetSystem(SHUTDOWN), so QEMU still reports guest-shutdown.
  • A test that finds "the loader's panic" by the refusal text is green under uefi::helpers.
  • Fix: name the needle as a line only the new handler writes (its panic message with location). The site's own pre-panic loader.log write goes, since the handler now owns that write.
• track:192-196 — "once every service the image's system.toml names is up" / "Init starting is not the gate" defines "up" nowhere. Init has no readiness signal: services are spawned, and only a swap has a probation deadline (userland/init/src/main.rs:521-534).
  • This is high-risk: the good flag decides the floor's rise and whether a broken image is kept.
  • No control can fail on the claim. The hang tests hang before init, so they cannot tell a real gate from none.
  • Patch: init runs update --good right after spawning the [boot] start list. No named test goes red.
  • Fix: define "up" and name a control. An image with a named service that exits at start is never marked good and falls back after three boots. The patch above must turn it red.
• track:103-105 — "this stage adds that check to .claude/agents/reviewer.md" does not say what line it adds. A stage that edits the review prompt quotes the exact line it adds.

NOTE

• track:183-189 — The closed list "not an ELF, another machine's, or a relocation" leaves every other failure after verify in start_kernel looping on B with no fallback, because the decrement is the pass's last write. An example is a PT_LOAD memsz that alloc_kernel_memory cannot place. The list should be every refusal load_kernel_elf makes from the kernel's bytes.
• track:250-252 — update_unloadable_kernel_boots_the_other_slot asserts only "A booted". It should also assert the loader's refusal of B with the non-ELF reason, so an install that never reached B cannot pass it.
• track:149-152 — Stage 4 adds a "once on the running system's request" variant that nothing writes until stage 5. That is a dead variant at stage 4's landing: it belongs to stage 5, with its own LAYOUT bump.
• track:116-117 — Stage 3's "at or above" makes the floor issue's "/system/bin/update's own check — newer than the running image" line false (floor issue:43-45). Stage 3 does not list deleting it.
• track:234-236 — Once stage 3 makes the version one constant, nothing says how the test signs an image at "the running security version + 1". Name the harness path.

REMOVE

• track:15 — "ToyOS ends at least as secure as it starts": false once stage 3 admits an older build at the floor's version.
• kernel/src/arch/aarch64/rtc.rs:1-2 — "the UEFI runtime's GetTime or": it contradicts the Firmware rule this branch adds.
• PR body, "What changed, per decision" (the stage list) and "The controls the track names" table: they restate the track in main's record.
• PR body, Unsure: "I found them by counting boot sites and loops in tests/": provenance.

SEND BACK

[Japabu]

Review, round 4, at 8e382e0

CI: host COMPLETED/SUCCESS at 8e382e0 (run 36477397591, the only check). git merge-tree --write-tree origin/main 8e382e0c against e3a1cdc exits 0 with no conflicts. Size: +377 −23. Everything is prose except two comment lines in kernel/src/arch/aarch64/rtc.rs. grep finds no UEFI runtime call in kernel/src, so the Firmware rule holds of the tree.

Round-3 BLOCKERs

1. CLOSED: the stage-4 prefix. track:155-157 pins layout and every field before it with offset_of!, and "a field the typing changes moves after the word". The exit (track:179) makes moving layout after root_read_tsc fail to build. Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's own asserts at 8565cc5 (toyos-abi/src/boot.rs 211-229) are what that exit keeps.
2. CLOSED: loader_panic_powers_off. The needle is loader: panicked at bootloader/src/ (track:172-175), and the refused-floor site's pre-panic write goes (track:150-151; today it is bootloader/src/main.rs 895-902). uefi::helpers' handler writes neither the loader: prefix nor to loader.log.
3. CLOSED: the health gate. Readiness is defined as [boot] up plus a ready pipe endowed by init (track:203-211). The control is update_dead_service_is_never_good (track:273-276): under "update --good right after spawn", B turns good and A never boots, so the test goes red. The design fits the capability model. Init mints the pipe and moves the write end in under a label, as it already does with ALIVE (userland/init/src/main.rs 1608-1616). There is no registry and nothing named. ALIVE's read end goes to logd, so it cannot carry init's signal, and a second pipe is the smallest mechanism.
4. CLOSED: the reviewer.md line is quoted verbatim (track:106-108).

BLOCKER

None.

NOTE

• Named change, track:59, 166-168, 178-179, 226-228. Under Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's derived LAYOUT = 0x5459_0000 | size_of::<KernelArgs>(), 0x5459_0001/2/3 and the LAST_LAYOUT literals are wrong.
  • Stage 1's word is 0x5459_0000 | 1272 (8565cc5 asserts size_of::<KernelArgs>() == 1272).
  • Each later LAST_LAYOUT is the prior stage's derived value, written as a literal.
  • Stage 4's control "leaving LAYOUT at 0x5459_0001" is no longer a patch anyone can apply.
  • Restate these values and say which check catches which change:
    • A size change moves the word, and kernel_args_last_layout_refused catches it.
    • A moved prefix field fails the prefix offset_of! asserts.
    • A change that keeps the size and happens after the word (a reorder, a type swap of equal size) is caught by neither.
  • So stage 4 keeps an offset_of! assert on every field, not only the prefix, and adds const _: () = assert!(LAYOUT != LAST_LAYOUT);. A stage that keeps the size then fails to build.
  • Control: stage 4's struct padded back to 1272 bytes must fail to build.
• Named change, track:226-228. Stage 5's once variant keeps both the size and every offset, so with a derived word LAYOUT does not rise.
  • Stage 3's "at or above" admits an older kernel at the same security version into a slot.
  • A stage-5 loader writing the once discriminant to a stage-4 kernel is then an out-of-range repr(C, u32) discriminant read in the kernel, which is UB.
  • The track must say how stage 5 moves the word (the assert above forces it), or that the kernel reads each discriminant as a u32 and refuses an unknown one by name.
• track:273-276 — update_dead_service_is_never_good stays green under "update --good once any named service wrote its byte" if the test image's [boot] up names only the dead service. Name a live service beside it.
• track:194-196 — "any failure after verify … that the image causes" replaces the closed list with a judgment. Stage 5's PR should list which start_kernel refusals are the image's (every load_kernel_elf refusal of the kernel's bytes) and which are the loader's.

REMOVE

• PR body, Unsure: "Stage 1 follows Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583 at 8565cc5, which is not its pushed head…". It is false now (8565cc5 is Loader slimming stage 1: the RTC is UTC, KernelArgs refuses another layout by name, IA32_TSC_ADJUST moves to the kernel #583's head), and the rest of the bullet restates track:78-79.

LAND AFTER NAMED CHANGES