Claim: the boots page gains Phase 5's aarch64 milestone: the test guest writes its lines to a PL011 at 0x09000000, each store trapping to Glint and reaching the PL011 model with its size and register. Passage: the maintainer's request for a recording at each milestone (ocx-console 40c80385db). Demonstration: the cast is the file bin/glint-run wrote on x86-1 at slice/5.3-aarch64 64ff299e04 (merged as 912a6c0463), built inside BQ2's seed; it exited 0 with the lines the entry quotes. Size: one cast, one page entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KMXZyLk8eDgCjvQ9hX check-in: 36bf62555c user: x86-1-glint tags: trunk

Claim: Arm hypervisor mode registers a PL011 in the memory space at 0x09000000/0x1000; the test and fault guests poll FR and write DR with single non-writeback 32-bit accesses. The retained GLINT_CONSOLE_WRITE line still exercises the call path. The device filters output, holds QEMU-masked divisors/control registers, and exposes the ARM IDs. Lazy backing remains 20 KiB and cannot allocate a page for the PL011. x86 keeps only its 16550.

Passage: Hailperin 7.5.2, paraphrase (text absent locally): a trapped device access lets the hypervisor emulate its operation. xv6 5.1, Lazy allocation, and Hailperin 6.2.7, Efficient Zero Filling, paraphrased: defer memory backing until an in-range first touch needs it. QEMU 11.1.2 hw/arm/virt.c:202 supplies the aperture; hw/char/pl011.c:53-56,94-100,285-345,429-495 and include/hw/char/pl011.h:36-40 supply flags, IDs, offsets and masks.

Demonstration: inside docs/tasks/4.1a.md's exact BQ2 namespace/environment, crystal spec spec/pl011_spec.cr spec/mmio_spec.cr spec/run/pl011_spec.cr spec/run/fault_spec.cr spec/run/phase4_spec.cr spec/run/vcpu_spec.cr spec/image_initialization_spec.cr: 32 examples, 0 failures/errors/pending. The PL011 boot prints started, PSCI version, the console-call line, powered off, 20 KiB backed, then the prompt, in order. The fault variant reports read 0x41000000 size 1 x9. Additional host, phase 2/3, backtrace, Arm lazy-memory, outside x86 boot and full-host results are recorded in the final task report. crystal tool format --check passes. Seed llvm-objdump confirms ldr w0,[x0] and str w1,[x0], each followed by ret.

Size: 101 non-spec lines added, 4 removed (105 changed lines; 97 net). Non-spec files: boot/pl011.cr, boot/vcpu.cr, guest/test/main.cr, guest/test/call_aarch64.S, guest/test/README.md. Specs: spec/pl011_spec.cr, spec/run/pl011_spec.cr, spec/lazy_guest_space_spec.cr. EFI bytes before/after: aarch64 205824/205824, x86_64 217600/217600. Largest new function: PL011 write, 820 bytes on Arm. Existing Matcher.result remains 8404 bytes on Arm and 11410 on x86, so the global 2 KiB function constraint remains unmet; no new function exceeds it. Twenty KiB is four image pages plus a stack page, no guest stage-1 tables and no device page. The polling model supports aligned 32-bit register operations. The slice retains (a)'s documented aperture gate to reconcile the task's unclaimed-bus semantics and required fault stop.

Signed-off-by: Codex <noreply@openai.com>

Final demonstration results: seed crystal spec spec/*_spec.cr spec/run/phase2_spec.cr spec/run/phase3_spec.cr spec/run/backtrace_spec.cr: 1183 examples, 0 failures/errors/pending. Seed -Dglint_aarch64_test selections spec/lazy_guest_space_spec.cr:23,:49,:67,:83 and spec/guest_range_spec.cr:27,:40,:51,:69: 9 examples, all passing. Outside LD_LIBRARY_PATH=/usr/lib64 ZEPHYR_SRC=/workspace/src/zephyr-src crystal spec: 1340 examples, 0 failures, 0 errors, 51 pending. Outside with QEMU_SRC, UBOOT_SRC and GLINT_UBOOT_BUILD_DIR=build/uboot set, crystal spec spec/run/phase4_spec.cr spec/run/vcpu_spec.cr spec/run/fault_spec.cr spec/run/uart16550_spec.cr --example x86_64: 10 passing examples. Outside x86 demo reports 32 KiB backed (four image pages, three guest page-table pages, one stack page). One exploratory Arm-layout run included an x86-only SVM fixture and failed its CPU creation; the supported memory selections pass and actual Arm vCPU/lazy backing is covered by the seed boots. Leaf check-in: 64ff299e04 user: x86-1-glint tags: slice/5.3-aarch64

Claim: the maintainer's answer on Phase 5 is in the plan. On x86_64 guests reach Glint's devices only through I/O ports, with no instruction decoder; 5.5's virtio-pci uses configuration ports 0xcf8/0xcfc and virtio's legacy I/O-port BAR. On aarch64 the data-abort syndrome gives size and register for single-register loads and stores, so no decoder is needed there. A new Track U (docs/phases/U-usb.md) places USB, Glint's primary peripheral: guests see an emulated xHCI; Glint keeps the real controller. U.1 (register file) after Phase 5; U.2-U.5 (rings, a virtual keyboard, Glint's own xHCI driver, forwarding) after Phase 6 and before Phase 7; U.6 on Beagle hardware with Phase 13. The emulated controller is aarch64-only, since xHCI's registers are only memory-mapped. Open question 2 is answered. Passage: the maintainer, relayed in glint 366ac226de: 'For x86, that sounds like it makes sense... Emulating the USB controller is the primary peripheral to be captured by Glint.' xv6 6, on what a driver does. Demonstration: each fact is cited. QEMU 11.1.2 translate-a64.c sets iss_valid only for LDR/STR without writeback; hcd-xhci-pci.c:165 registers xHCI's BAR 0 as 64-bit memory; virtio-pci.c:2155 the legacy I/O BAR. U-Boot 2026.07: AM62x has snps,dwc3 and J722S cdns,usb3, both calling xhci_register in host mode; xhci-generic.c binds generic-xhci. Linux's generic-xhci binding is marked unverified (no Linux source here). Size: PLAN.md about 35 lines, 05-page-faults.md 5 lines, U-usb.md 100 lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KMXZyLk8eDgCjvQ9hX check-in: dd05f46cdb user: x86-1-glint tags: trunk