A partition is a claimable device, named by its unique GUID: the ABI names one and moves its blocks

[Japabu]

The ABI half of the owner's ruling that a GPT partition is a claimable device, exactly as a PCI function is. The kernel here refuses every new call by name; the implementation, init's live grant and the tests are the stacked second PR (#489).

What changed, per decision

• Spelling. part:<GUID> names a partition by its unique partition GUID, and that is the only name a partition has: one device class, Partition = 8. The GUID is the uppercase registry form and nothing else — one spelling per partition, as PciId has one per card. DeviceRequest::MAX_NAME 16 -> 48 (part: and a GUID is 41 bytes, rounded up to a multiple of eight). A static row names a slot by its unique GUID because whoever writes the GPT also writes the system.toml that names it and fixes the GUID; a type GUID would not name an A/B slot (both carry TOYOS-ROOT's), and whether one resolved would depend on which other disks are plugged in.
• PartGuid (toyos-abi/src/part.rs) holds the sixteen bytes a GPT entry stores (UEFI 2.10 §5.3.3); text <-> bytes is the mixed-endian registry mapping.
• No new claim syscall. SYS_DEVICE_CLAIM already carried a fourth argument word as zero; the GUID's sixteen bytes ride the selector and that word. A selector word a class does not read is refused (InvalidArgument) rather than dropped: both words for a class that names at most one device, the second for pci.
• Transfers. SYS_PARTITION_READ = 119, SYS_PARTITION_WRITE = 120: (claim, first, buf, count). Block numbers are the partition's own, from 0 — no argument can spell a device block, so a neighbour's blocks are unrepresentable; the end of the partition is the kernel's refusal (InvalidArgument). Buffers are typed [[u8; 4096]], so a partial block is unrepresentable and the count is the slice length. At most 32 blocks per call (MAX_BLOCKS_PER_CALL); a later, larger bound does not break a caller compiled against 32.
• Durability is SYS_FSYNC on the claim: the same number and the same promise a file has. No new flush syscall.
• Description. A claim reads once as PartitionInfo { blocks, unique_guid } (24 bytes, no padding, asserted).
• SDK. SysCap::claim_partition(PartGuid), endow::partition(PartGuid), PartitionDev { describe, read, write, sync }. endow::partition's caller is A partition is claimed by its unique GUID, held by one holder, its blocks move through the claim, and its fsync answers for its own writes #489's guest, which takes the claim init minted from a part: row.
• Kernel matches. The four exhaustive matches on a device class in object/ops.rs answer the new class (no readiness source; a read is the description; Unknown on stat; always readable) — unreachable until the claim is served.
• init gains the one match arm the new variant forces (claim_partition), and its refusal lines stop saying "function" and "pcidev:" only.
• Kernel (this PR). try_claim takes both selector words; the partition class answers NotSupported with a partclaim: line, and 119/120 answer NotSupported naming themselves.
• toyos-abi 0.6.0 -> 0.7.0, toyos 0.7.0 -> 0.8.0, toyos-window 0.7.0 -> 0.8.0 for its pins; lockfiles follow.

Gates (head 6d030c13, each run once)

• cargo run -- --build-only --claim-sysroot: EXIT=0
• cargo test -p toyos-build --lib: EXIT=0
• cargo test --workspace --exclude toyos-build: EXIT=0 (toyos-abi's partition tests among them)
• cargo run -- --sdk-version-check: EXIT=0
• cargo run -- --abi-split-check: EXIT=0
• cargo run -- --clippy: EXIT=0
• cargo test (fast tier): EXIT=0 — 356 passed, 8 quarantined and green, 356 total (233.4s). sshd_fail_closed, red once at cb4d26ec beside another worktree's suite, is green in this run.

Oracle

UEFI 2.10 §5.3.3 / Appendix A: the ESP type's registry text C12A7328-F81F-11D2-BA4B-00A0C93EC93B and its on-disk bytes are the test of PartGuid in both directions. The negative controls for the mechanism, and the guest arm that sends the selector words no typed wrapper can spell, are in #489, where the checks they remove live.

Unsure

• The migration from the stick to the NVMe by whole-disk clone puts every unique GUID on two disks while both are attached, and every part: claim is then refused as ambiguous: that plan has to give the clone's partitions GUIDs of their own.

🤖 Generated with Claude Code

https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK

[Japabu]

Review of #487 at cb4d26ec, round 1.

CI at cb4d26ec, checked during the review: host SUCCESS, abi-split SUCCESS, gate-stage SUCCESS, toolchain-ready IN_PROGRESS. The brief had me review alongside CI, so I did not wait for it. I ran cargo test -p toyos-abi at cef986e5 (which touches no toyos-abi file): EXIT=0, 34 passed, the three part::tests among them.

BLOCKER

• toyos-abi/src/syscall.rs:1208: part-type: / PartitionOfType is a second name for the same kind of object, and nothing uses it except the test. The A/B slots share TOYOS-ROOT's type, so it can never name either slot. The one-disk ambiguity refusal is measured green: the guest prints "a type two partitions carry refused with InvalidArgument". Whether a working grant resolves also depends on which other disks are plugged in: a second ToyOS stick, or for EBD0A0A2 nearly any stick, turns it into InvalidArgument at boot. The argument that "a static row cannot name a random GUID" does not hold: src/image.rs and the test's craft() write both the GPT and the system.toml, so each can fix a slot's unique GUID and spell part:. For the updater, grant part:<A> and part:<B>. The mounted slot is refused PermissionDenied by name, and the idle slot is granted. Remove the class and the prefix now, while no class number has shipped.

NOTE

• toyos-abi/src/part.rs:30: 32 blocks per call is an adequate shape for a slot write. The throughput limit is one synchronous command per call under Handle::lock, plus a 128 KiB bounce, not the count. A later larger bound does not break callers compiled against 32. There is no hardware reading behind any of this; it is an estimate.
• toyos-abi/src/syscall.rs:979: fsync on the claim is the right shape for marker-last (slot, fsync, marker, fsync), but only when the marker is inside a claimable partition. The ESP is kernel-held (measured PermissionDenied), and the GPT lies outside every partition, so a boot-selection marker in /boot or in GPT attributes is out of this ABI's reach. On a USB disk the promise in this doc line is not kept; see A partition is claimed by its unique GUID, held by one holder, its blocks move through the claim, and its fsync answers for its own writes #489.
• kernel/src/arch/syscall/dispatch.rs:428: every class except the two partition classes silently ignores the second selector word. A nonzero word for pci: or a bare class should be refused, not dropped.
• part: across disks: a whole-disk clone (the NVMe taking over from the stick by copying the image) carries every unique GUID twice, so every part: grant is refused InvalidArgument while both disks are attached. The migration plan has to allow for this.
• toyos/src/endow.rs:214: endow::partition has no caller and no test. The guest mints with claim_partition and never takes the endowment init made. Delete it until the consumer exists, or cover it.
• The author's fast-tier red sshd_fail_closed (per the body, --known-red says NO) is not adjudicated. I did not re-run it.

REMOVE

• toyos-abi/src/part.rs:27-29: "the run the kernel's own page cache writes back in, so a claimant holds its disk no longer per call than the kernel does". page_cache.rs Cached::lock holds handle().lock() for the whole sync, and that sync's 32 is its own literal (page_cache.rs:366,376). Nothing ties it to this constant.

SEND BACK

[Japabu]

Review of #487 at 6d030c13, round 2.

CI at 6d030c13, checked at 10:51 UTC: host, abi-split and gate-stage SUCCESS; toolchain-ready (the ci workflow) IN_PROGRESS since 10:07. Locally cargo test -p toyos-abi -p toyos-xhci gave EXIT=0: 34 and 114 passed. toyos-abi is identical at 6d030c13 and at #489's fff0a7cf.

Round-1 BLOCKER

• part-type: / PartitionOfType: CLOSED. rg 'part-type|PartitionOfType|OfType|PART_TYPE' outside issues/ finds one hit, the negative parse test toyos-abi/src/syscall.rs:2246. It asserts that part-type: parses to None. device_classes! ends at Partition = 8, so class 9 never shipped and there is no number to retire. PartitionInfo is 24 bytes, and that is asserted.

BLOCKER

(none)

NOTE

• kernel/src/arch/syscall/device.rs:127 refuses a selector word the class does not read. Its tests are in A partition is claimed by its unique GUID, held by one holder, its blocks move through the claim, and its fsync answers for its own writes #489: unread_selector_words sends mouse [1,0], mouse [0,1], and pci [id,1]. Each would reach a real claim, not InvalidArgument, if the check were removed. I did not measure that mutation.
• The round-1 NOTE on endow::partition is closed: A partition is claimed by its unique GUID, held by one holder, its blocks move through the claim, and its fsync answers for its own writes #489's guest endowed() takes the claim through it.

REMOVE

(none)

NOT READY FOR REVIEW