{"id":"dma-visibility-ownership","name":"DMA visibility, ordering and buffer lifetime","shortName":"Visible bits are not permission to reuse","role":"Separate coherent values, ordered descriptor publication and ownership of in-flight storage.","description":"A CPU and a device can refer to the same physical storage while observing different versions of its data. The noncoherent teaching mode makes that discrepancy explicit with a CPU-visible copy and a memory copy. Inputs start as dirty CPU values over zeroed memory; output begins with a sentinel in both copies. Visibility handoffs reconcile them at the chosen ownership boundary. Coherent mode keeps the values equal without these copies, but it does not authorize reuse of storage still owned by a running job. Nor does it remove the need to publish descriptor fields before making the descriptor valid. The model treats those as separate actions. This separation explains why replacing a cache flush with a completion wait, or replacing a lifetime check with coherence, addresses the wrong condition. A result can be mathematically correct in physical memory while the consumer still reads an old cached output.","mechanism":["CPU writes create input values; in noncoherent mode physical memory initially remains zero.","The input handoff makes those values visible before device consumption.","Descriptor fields are prepared before ordered publication makes the job available.","Publication transfers buffer ownership to the device; early host overwrite is rejected before mutation.","Device output writes update memory. The noncoherent CPU copy still contains the sentinel until its output handoff.","Completion, output visibility and ownership return precede the consumer read and subsequent buffer reuse."],"prerequisites":["process-dma-address-spaces","l1-cache"],"related":["iommu-buffer-identity","device-completion-reset-epochs","pcie-cxl-semantics"],"specs":[{"label":"Noncoherent toy","value":"CPU copy and memory copy","context":"No line size, coherence state machine, cache replacement or ISA barriers are simulated."},{"label":"Sentinel output","value":"−777 in each initial C word","context":"A chosen fixture value, not uninitialized real memory."},{"label":"Ordering and lifetime","value":"Descriptor then valid; complete before reuse","context":"These conditions remain necessary with coherent values."}],"interfaces":[{"name":"Declared runtime inputs","direction":"in","signal":"Stable matrix job, buffer identities and the stated device/visibility contract"},{"name":"Inspectable accepted or rejected result","direction":"out","signal":"Event trace, actual buffer values and bounded completion/work ledger"}],"science":[{"title":"Input visibility changes the actual operand","equation":"The device reads A when values are coherent or synchronized; it reads the zeroed memory copy when the noncoherent input handoff is omitted.","explanation":"B follows the same rule in this fixture, so omitting both input handoffs yields a zero output even though the CPU matrices are populated.","assumptions":"The initial physical input copies are explicitly zero. This is not a universal prediction of stale cache contents."},{"title":"Buffer reuse follows ownership","equation":"The reuse gate accepts a buffer only while its declared owner is the host.","explanation":"Device publication transfers ownership; validated completion and visibility handoff return it. A coherent value does not change this lifetime rule.","assumptions":"Single host and device, one in-flight job, explicit whole-buffer ownership; no shared-reader or fine-grained ownership protocol."}],"engineeringExample":"With default noncoherent mode, omitting input visibility produces [[0,0],[0,0]]. Omitting only output visibility lets memory contain [[19,22],[43,50]], but the consumer reads [[−777,−777],[−777,−777]]. Coherent mode removes these two-copy discrepancies. An early attempt to reuse B is still rejected in either mode; its CPU and memory values remain unchanged and the original job can complete correctly.","learningObjective":"Diagnose whether a failed job violated data visibility, descriptor ordering or buffer lifetime, using the actual copies and ownership trace.","misconception":"Coherence makes values visible; it does not grant permission to mutate an in-flight buffer or order every required control action.","check":{"question":"Physical C is correct, but the noncoherent CPU output handoff was omitted. What does the fixture consumer read?","options":["The stale sentinel matrix","The independent mathematical reference","An automatically corrected version of C"],"answer":0,"explanation":"The consumer reads its actual CPU-visible copy, which still contains −777 in this fixture."},"checks":[],"whyAI":"Accelerator runtimes overlap transfers and execution. That overlap is useful only when completion and ownership make the next read or overwrite valid.","tradeoff":"Copies and synchronization have costs in real machines, but no such timing is assigned here. Removing a handoff is valid only when a different declared mechanism establishes visibility and lifetime.","evidenceNotes":"Primary sources establish the cited runtime mechanisms. Numerical values, address ranges, ABI strings, event schedule and reset/retry epochs are authored teaching contracts. No real device, firmware image, operating-system driver, page table, cache protocol or security verification is executed.","sourceIds":["runtime-linux-dma-616","runtime-virtio-13"],"sources":[{"title":"Linux 6.16 — Dynamic DMA mapping Guide","url":"https://docs.kernel.org/6.16/core-api/dma-api-howto.html"},{"title":"OASIS — Virtual I/O Device (VIRTIO) Version 1.3","url":"https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html"}],"workedTrace":{"modelVersion":"commissioning-execution-1","scenarios":["skip-to-device","skip-to-cpu","early-reuse"],"expected":{"staleInputs":[[0,0],[0,0]],"staleOutput":[[-777,-777],[-777,-777]],"rejectedReuse":1}},"level":"software","branch":"Executable software","subbranch":"Commissioning and runtime boundaries","scale":"One process and device job; logical states and byte addresses, no timing or physical geometry","kind":"system","workstream":"N12","visualFamily":"software-flow","labId":"library","investigationId":"execution","labScope":"The commissioning-execution-1 studio executes this bounded 2×2 matrix, buffer and completion contract. The surrounding atlas scene is conceptual; it is not a firmware emulator or system simulator.","history":[]}