From 2e3b7ebe66707e89429533599f6b0eaa1a0d86ed Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Sat, 26 Sep 2026 14:29:22 -0400 Subject: [PATCH] =?UTF-8?q?FABRIC-3.10.8=20=C2=A77:=20MC-3=20rulings=20(sp?= =?UTF-8?q?lit=203a/3b/3c;=20core=200=20keeps=20polling);=20MC-3a=20plan?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- FABRIC-3.10.8.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/FABRIC-3.10.8.md b/FABRIC-3.10.8.md index c1152cc3..3aee589d 100644 --- a/FABRIC-3.10.8.md +++ b/FABRIC-3.10.8.md @@ -1039,3 +1039,21 @@ The boot hart HSM chose (0) is the one OpenSBI names as `Boot HART ID`. 1. **Stage split.** Proposed: **MC-3a** is the claim and release, `running_on`, the physics lock, the atomic stamps and the per-core decision flag. It changes nothing observable with one worker core, and a probe shows 0 double claims. **MC-3b** is each worker core's interrupt controller and the IPI: core 0 wakes core 1, which counts it and parks again. **MC-3c** is the per-core idle context and wake on work, where workers actually run on core 1. Or all of it as one stage. 2. **Core 0 when idle** (finding §5.2): it polls at about 64% of a host CPU. Proposed: **leave it** in MC-3, since core 0 is the console, USB and timer core and polls by design. Or: core 0 halts until its timer or a device interrupt (a change to the idle point's input path). + +**Ruled (Captain Bob, 2026-09-26):** (1) **split into MC-3a / MC-3b / MC-3c** as proposed; (2) **core 0 keeps polling**. MC-3's "idle cores halted" applies to worker cores only. + +### 7.5 MC-3a — the claim, the physics lock, per-core decision state (plan) + +**Change** (§7.2 items 1, 4, 5 and 6; nothing yet runs on a worker core): +- **`VM.running_on`:** 0 = nobody, else core_id + 1, the same encoding as a lock owner, so a zeroed VM is unclaimed. + - Hera is claimed by core 0 when she becomes current at boot. + - `sk_vm_context_switch()` claims `to` by compare-and-swap. A lost claim returns "not taken" (1), is counted, and its caller re-decides: the trampoline and the idle point go round again, the checkpoint returns. + - `from` is released by whatever next runs on this core (`sk_vm_switch_finish()`): the resumed VM's return from its own switch, or a first-entry trampoline. + - A switch-in that finds its VM claimed by another core counts a **double claim**. +- **Fleet physics lock** `g_lock_physics`, ranked between switch and registry. The public functions of `capsule_vm_physics.c` lock over `*_locked` bodies. +- **Stamps** by atomic fetch-add. **"Decision due"** is per core: a beat sets this core's flag; admitted mail sets every online core's. The switch counter is atomic. +- **`KILL`** refuses a VM whose `running_on` is set, naming the core. + +**Evidence (named in advance):** +- **Standard sequence on all three ISAs:** K-10 hashes, G byte-identical (one worker core), all ok `3`, 0 B idle growth, **0 lock-order violations** (so the new rank fits), 0 observer refusals. +- **Probe** (temporary word, amd64): the claim counters after O-A are claims > 0, **lost claims 0, double claims 0**. Posing as core 1, a claim of Hera (held by core 0) **fails** and is counted as lost; with `core_id` back at 0, nothing else changed.