diff --git a/local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md b/local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md index 2e40fb5754..c2269e2eb1 100644 --- a/local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md +++ b/local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md @@ -62,7 +62,7 @@ Synthesizes 5 parallel deep audits (2026-07-27): 1. **Wired TCP/IP stack is the most mature userspace subsystem.** smolnetd/netstack implements IPv4+IPv6, TCP (CUBIC), UDP, ICMP, netfilter, conntrack, NAT, TUN, VLAN, VXLAN, GRE, IPIP, Bridge, Bond, STP, packet capture. ~80-85% POSIX socket coverage. QEMU-proven. 2. **Wireless + Bluetooth stack is software-complete but hardware-unvalidated.** redbear-iwlwifi is 3,368 LOC; redbear-btusb has 151 tests; redbear-btctl has 56 tests; linux-kpi has 93 tests; redbear-wifictl has 20 tests. **No Intel Wi-Fi hardware, no USB Bluetooth adapter** for runtime validation. -3. **~110 components across drivers/daemons largely builds-clean.** Driver-manager replaced pcid-spawner (v5.0). Shared-IRQ re-arm bug class swept across 11 drivers (2026-07-20). USB xHCI is QEMU-proven for hub + hub-child + storage BOT. **6 missing/skeleton daemons**: audiodevd, usbd, redbear-dnsd, redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}, redbear-wayland-guard. +3. **~110 components across drivers/daemons largely builds-clean.** Driver-manager replaced pcid-spawner (v5.0). Shared-IRQ re-arm bug class swept across 11 drivers (2026-07-20). USB xHCI is QEMU-proven for hub + hub-child + storage BOT. **5 missing/skeleton daemons**: audiodevd, usbd, redbear-dnsd, redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}. (~~redbear-wayland-guard~~ removed 2026-07-27 — was an LD_PRELOAD stub violating zero-stub policy; correct fix lives in libwayland per `QT6-WAYLAND-NULL8-DIAGNOSIS.md`.) 4. **Documentation is exceptionally well-organized.** 13 networking docs: 8 canonical, 2 already in `legacy-obsolete-2026-07-25/`, 3 reference. **No genuinely stale docs need moving.** Cross-reference gaps exist (`NETWORKING-IMPROVEMENT-PLAN.md` should back-reference `HARDWARE-NETWORKING-INVENTORY.md`, `HARDWARE-VALIDATION-MATRIX.md`, `FIREWALL-VALIDATION-LOG.md`). 5. **Single worst systemic issue: ZERO `# Safety` documentation on ~250 unsafe blocks** across relibc socket.rs (99), libredox lib.rs (49), ethernet drivers (52), netstack (7), daemons (43), driver libraries (~80). Future refactors / edition upgrades / compiler changes can introduce UB silently. @@ -341,7 +341,7 @@ All 13 networking docs reviewed. All current except `NETWORKING-IMPROVEMENT-PLAN |--------|------|----------| | redbear-authd / -sessiond / -greeter | `local/recipes/system/` | builds + qemu-proven | | redbear-session-launch / -polkit / -upower / -udisks / -notifications / -statusnotifierwatcher | `local/recipes/system/` | builds | -| redbear-wayland-guard | `local/recipes/system/redbear-wayland-guard/` | **source only** (no recipe.toml) | +| ~~redbear-wayland-guard~~ | ~~`local/recipes/system/redbear-wayland-guard/`~~ | **REMOVED 2026-07-27** — LD_PRELOAD stub violation of zero-stub policy. The proper null guards belong in libwayland upstream (see `QT6-WAYLAND-NULL8-DIAGNOSIS.md`). | | redbear-accessibility / -ime / -passwd / -keymapd / -ftdi / -login-protocol / -acmd / -ecmd / -info | `local/recipes/system/` | builds | ### 4.13 Network Daemons & Utils @@ -394,7 +394,7 @@ IPv4/IPv6 TCP/UDP/ICMP · TCP_CUBIC · socket options (most) · Raw IP · Loopba ### 5.2 Implemented & Compiles (No Runtime Proof) -rtl8168d · ixgbed · VLAN/VXLAN/GRE/Bridge/Bond/STP/IPIP/QoS link modules · Intel HDA (ihdad) · all redbear-firmware recipe skeletons · redbear-wayland-guard (source only) · audiodevd/usbd/netd (recipe skeletons). +rtl8168d · ixgbed · VLAN/VXLAN/GRE/Bridge/Bond/STP/IPIP/QoS link modules · Intel HDA (ihdad) · all redbear-firmware recipe skeletons · ~~redbear-wayland-guard (source only; removed 2026-07-27)~~ · audiodevd/usbd/netd (recipe skeletons). ### 5.3 Partially Implemented (Stubs / TODO) @@ -411,7 +411,6 @@ See §14.2 for full list. 32 TODO/FIXME markers in network code. Highlights: - `audiodevd` / `usbd` / `netd` source - `redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}` source -- `redbear-wayland-guard` recipe.toml - `usbctl` (USB control endpoint) - DHCPv6 client - Raw Ethernet sockets (AF_PACKET) @@ -794,7 +793,7 @@ This document is consistent with all canonical sub-plans. The drift identified i | P3-5 | Implement `audiodevd` source | §5.4 | 2-3 weeks | | P3-6 | Implement `usbd` source | §5.4 | 2-3 weeks | | P3-7 | Wire `redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}` download recipes | §5.4 | 1-2 days each | -| P3-8 | Wire `redbear-wayland-guard` recipe.toml | §5.4 | 30 min | +| ~~P3-8 Wire `redbear-wayland-guard` recipe.toml~~ | ~~REMOVED 2026-07-27 — was LD_PRELOAD stub; fix lives in libwayland per `QT6-WAYLAND-NULL8-DIAGNOSIS.md`~~ | — | — | | P3-9 | DHCPv6 client | §7.2 | 2-4 weeks | | P3-10 | A2DP / HFP / AVRCP Bluetooth profiles | §7.4 | 4-8 weeks | | P3-11 | WPA3-SAE for Wi-Fi | §7.3 | 2-4 weeks | diff --git a/local/docs/SUPERSEDED-DOC-LOG.md b/local/docs/SUPERSEDED-DOC-LOG.md index 89926d95b8..e2e5c13b37 100644 --- a/local/docs/SUPERSEDED-DOC-LOG.md +++ b/local/docs/SUPERSEDED-DOC-LOG.md @@ -148,3 +148,51 @@ Companion plans (referenced from §12 of the new doc) are NOT touched: - **Net effect:** 38 files removed from git's working tree; 1 file moved from `legacy-obsolete-2026-07-25/` to top-level. The 3D-desktop subsystem is now expressible as a single canonical doc (`3D-DESKTOP-COMPREHENSIVE-PLAN.md`) plus 35 companion plans. + +## Rounds 11–14 — Source-Level Supersessions (2026-07-27) + +The above consolidation was a *document* pass. Subsequent rounds fixed +lie-grade code and stale references that the consolidation had left +behind or that came up in follow-up audits. Logged here for parity +with the deletion log. + +| Round | Item | Resolution commit | Note | +|-------|------|---------------------|------| +| 9 (post-doc) | `relibc` RTLD_NOLOAD\|NOW + `readdir_r` panics | `2a2d1f354c` + submodule `dff28f00` | Replaced `todo!`/`unimplemented!` with proper `Result` propagation | +| 9 (post-doc) | `redbear-iwlwifi` MAC offset ≥ 6 fake-zero packet | `c21c70912e` | Returns `Err(ERANGE)` instead | +| 9 (post-doc) | `redbear-iwlwifi` `iwl_ops_tx` empty body | `c21c70912e` | Drains `iwl_pcie_txq_reclaim` overflow queue | +| 9 (post-doc) | Mesa redox_drm_fence type-mismatch UB | `aae6c36b80` | Allocates real `pipe_fence_handle` | +| 9 (post-doc) | Mesa redox_drm_surface stale "no-op" comment | `aae6c36b80` | Rewrote to describe real `REDOX_SCANOUT_FLIP` | +| 9 (post-doc) | `redbear-dnsd` `Ok(())` lie-grade config accept | `aae6c36b80` | Bound-checked parser mutates `self.upstream` | +| 9 (post-doc) | 24 broken doc cross-references (deleted-doc paths) | `163d6f0a59` | Replaced with post-Round-9 doc map | +| 9 (post-doc) | 7 stale `pcid-spawner` references in docs | `163d6f0a59` | Rewritten to `driver-manager` | +| 9 (post-doc) | `local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md` §10 pre-execution audit | `163d6f0a59` | Marked ✅ REPLACE/RESTORE/DELETE as completed | +| 10 | xwayland patch timestamp + DRM-only stubs | `d6a8159840` | Stripped `diff -ruN` timestamps, dropped DRM hunks (recipe has `-Ddrm=false`), replaced hardcoded button constants with `BTN_*` symbols | +| 10 | 5 stale `redbear-minimal` config refs | `d6a8159840` | Renamed to `redbear-mini` | +| 10 | `relibc` ld_so/dso.rs:1129/1203 panic sites | `5fac5f6edb` + submodule `90168f56` | `unimplemented!()` → `Err(format!(...))` | +| 11 | `local/recipes/system/redbear-passwd/recipe.toml` missing `[source]` | `a9e1c34e27` | Added `[source] path = "source"` | +| 11 | `local/recipes/dev/libclc/recipe.toml` no post-install verify | `a9e1c34e27` | Added 3 `test -f` checks for `libclc.pc` and `.bc` | +| 11 | `redbear-sessiond` `can_suspend/can_reboot/can_power_off` lie-grade | `a9e1c34e27` | `kstop_writable()` probes `/scheme/sys/kstop` | +| 11 | `redbear-dnsd` hardcoded 8.8.8.8/1.1.1.1 fallback | `a9e1c34e27` | Empty `Vec` — main() reads netcfg upstreams | +| 11 | 16+7 stale `redbear-kde-session` binary refs in 2 docs | `a9e1c34e27` | Renamed to `redbear-session-launch` | +| 11 | `relibc` TLSDESC misleading message | `2a0c747bc0` + submodule `688e76ca` | "riscv64 and x86" → "this target" | +| 12 | Mesa `04-sys-ioccom-stub-header.patch` | `f145e9e768` + submodule `ca7a7edb` | Moved to `relibc::include/sys/ioccom.h` (proper Linux IOC encoding). Patch removed. | +| 12 | `udev-shim` eth0 fallback collision | `6eed30f072` | `predictable_net_name` returns `net-malformed-` | +| 12 | `netcfg` summary hardcoded eth0 | `6eed30f072` | Iterates full devices map | +| 12 | 2 final `redbear-kde-session` refs | `6eed30f072` | Renamed to `redbear-session-launch` | +| 13 | `base::vesad` bare `panic!()` at loop exit | `c79333cd1d` + submodule `c5b32f9f` | `eprintln!` + `process::exit(0)` | +| 13 | `base::nvmed` `panic!("timeout on init")` | `c79333cd1d` + submodule `c5b32f9f` | Log + `process::exit(1)` so init can fall back | +| 13 | `base::nvmed` queue-error panics (commented out) | `c79333cd1d` + submodule `c5b32f9f` | Deleted dead commented-out panics | +| 13 | Stale `redbear-passwd` and `redbear-minimal.toml` refs in assessment doc | `e1adf3e9c8` | Struck through with ✅ RESOLVED 2026-07-27 | +| 14 | `local/recipes/system/redbear-wayland-guard/` LD_PRELOAD stub | (this commit) | **REMOVED** — violated STUB AND WORKAROUND POLICY ("No LD_PRELOAD tricks"). Correct fix lives in libwayland per `QT6-WAYLAND-NULL8-DIAGNOSIS.md`. | +| 14 | `local/recipes/system/firmware-loader` daemon 9-`.expect()` chain | (this commit) | All converted to `Result` propagation with log+exit | +| 14 | `redbear-{keymapd,ime,accessibility}` scheme daemon `.expect()` | (this commit) | Converted to `Result` propagation with `log_msg("ERROR", …)` + `process::exit(1)` | +| 14 | `local/recipes/AGENTS.md` redbear-wayland-guard entry marked "Rust" | (this commit) | Struck through — was actually a C LD_PRELOAD stub | + +**Pattern emerging:** Lie-grade code in Red Bear is concentrated in +three places — (a) relibc fork panic-site catch-alls, (b) scheme daemon +init paths that use `.expect()` instead of `Result`, (c) Mesa DRM/wayland +stubbing. The first two are addressed by rounds 9–14. Mesa DRM and +Wayland null-guard work remains (EGL platform, PRIME/dma-buf, sync objects, +single-context CS, libwayland null safety) and is tracked in +`local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md` § current state. diff --git a/local/recipes/AGENTS.md b/local/recipes/AGENTS.md index 70e8bf3060..cecb36067a 100644 --- a/local/recipes/AGENTS.md +++ b/local/recipes/AGENTS.md @@ -214,7 +214,7 @@ live in `local/patches//`, never here. | redbear-udisks | cargo | Rust | UDisks2 daemon — storage device management via D-Bus | | redbear-upower | cargo | Rust | UPower daemon — power management and battery status via D-Bus | | redbear-usbaudiod | cargo | Rust | USB audio daemon — USB audio class device driver | -| redbear-wayland-guard | custom | Rust | Wayland security guard — validates compositor/client permissions | +| ~~redbear-wayland-guard~~ | ~~custom~~ | ~~Rust~~ | **REMOVED 2026-07-27** — was an LD_PRELOAD stub (C, not Rust) violating local/AGENTS.md STUB AND WORKAROUND POLICY. The correct fix lives in libwayland itself (Qt6 Wayland null+8 guards); see `local/docs/QT6-WAYLAND-NULL8-DIAGNOSIS.md` for the proper implementation location. | | redbear-wifictl | cargo | Rust | Wi-Fi control utility — scan, connect, manage wireless networks | | seatd | meson | C | seatd — seat management daemon for DRM master access | | thermald | cargo | Rust | Thermal management daemon — monitors and controls CPU temperature | diff --git a/local/recipes/system/firmware-loader/source/src/main.rs b/local/recipes/system/firmware-loader/source/src/main.rs index 2f6c0f554e..68b8999355 100644 --- a/local/recipes/system/firmware-loader/source/src/main.rs +++ b/local/recipes/system/firmware-loader/source/src/main.rs @@ -45,23 +45,21 @@ fn default_firmware_dir() -> PathBuf { } #[cfg(target_os = "redox")] -unsafe fn get_init_notify_fd() -> RawFd { +fn get_init_notify_fd() -> Result { let fd: RawFd = env::var("INIT_NOTIFY") - .expect("firmware-loader: INIT_NOTIFY not set") + .map_err(|_| "INIT_NOTIFY not set".to_string())? .parse() - .expect("firmware-loader: INIT_NOTIFY is not a valid fd"); + .map_err(|e| format!("INIT_NOTIFY is not a valid fd: {e}"))?; libc::fcntl(fd, libc::F_SETFD, libc::FD_CLOEXEC); - fd + Ok(fd) } #[cfg(target_os = "redox")] -fn notify_scheme_ready(notify_fd: RawFd, socket: &Socket, scheme: &mut FirmwareScheme) { - let cap_id = scheme - .scheme_root() - .expect("firmware-loader: scheme_root failed"); +fn notify_scheme_ready(notify_fd: RawFd, socket: &Socket, scheme: &mut FirmwareScheme) -> Result<(), String> { + let cap_id = scheme.scheme_root().map_err(|e| format!("scheme_root: {e}"))?; let cap_fd = socket .create_this_scheme_fd(0, cap_id, 0, 0) - .expect("firmware-loader: create_this_scheme_fd failed"); + .map_err(|e| format!("create_this_scheme_fd: {e}"))?; syscall::call_wo( notify_fd as usize, @@ -69,23 +67,23 @@ fn notify_scheme_ready(notify_fd: RawFd, socket: &Socket, scheme: &mut FirmwareS syscall::CallFlags::FD, &[], ) - .expect("firmware-loader: failed to notify init that scheme is ready"); + .map_err(|e| format!("notify init: {e}")) } #[cfg(target_os = "redox")] -fn run_daemon(notify_fd: RawFd, registry: FirmwareRegistry) -> ! { - let socket = Socket::create().expect("firmware-loader: failed to create scheme socket"); +fn run_daemon(notify_fd: RawFd, registry: FirmwareRegistry) -> Result<(), String> { + let socket = Socket::create().map_err(|e| format!("scheme socket: {e}"))?; let mut scheme = FirmwareScheme::new(registry); - notify_scheme_ready(notify_fd, &socket, &mut scheme); + notify_scheme_ready(notify_fd, &socket, &mut scheme)?; info!("firmware-loader: registered scheme:firmware"); - libredox::call::setrens(0, 0).expect("firmware-loader: failed to enter null namespace"); + libredox::call::setrens(0, 0).map_err(|e| format!("setrens null ns: {e}"))?; while let Some(request) = socket .next_request(SignalBehavior::Restart) - .expect("firmware-loader: failed to read scheme request") + .map_err(|e| format!("next_request: {e}"))? { match request.kind() { redox_scheme::RequestKind::Call(request) => { @@ -93,13 +91,13 @@ fn run_daemon(notify_fd: RawFd, registry: FirmwareRegistry) -> ! { let response = request.handle_sync(&mut scheme, &mut state); socket .write_response(response, SignalBehavior::Restart) - .expect("firmware-loader: failed to write response"); + .map_err(|e| format!("write_response: {e}"))?; } _ => (), } } - process::exit(0); + Ok(()) } fn main() { @@ -161,7 +159,16 @@ fn main() { #[cfg(target_os = "redox")] { - let notify_fd = unsafe { get_init_notify_fd() }; - run_daemon(notify_fd, registry); + let notify_fd = match unsafe { get_init_notify_fd() } { + Ok(fd) => fd, + Err(e) => { + error!("firmware-loader: {e}"); + process::exit(1); + } + }; + if let Err(e) = run_daemon(notify_fd, registry) { + error!("firmware-loader: {e}"); + process::exit(1); + } } } diff --git a/local/recipes/system/redbear-accessibility/source/src/main.rs b/local/recipes/system/redbear-accessibility/source/src/main.rs index 9b9340c609..bcdf78b279 100644 --- a/local/recipes/system/redbear-accessibility/source/src/main.rs +++ b/local/recipes/system/redbear-accessibility/source/src/main.rs @@ -14,10 +14,17 @@ fn main() { let mut scheme = AccessibilityScheme::new(); let mut state = SchemeState::new(); - let socket = Socket::create() - .expect("accessibility: failed to create scheme socket"); - register_sync_scheme(&socket, "accessibility", &mut scheme) - .expect("accessibility: failed to register scheme:accessibility"); + let socket = match Socket::create() { + Ok(s) => s, + Err(e) => { + log_msg("ERROR", &format!("failed to create scheme socket: {}", e)); + std::process::exit(1); + } + }; + if let Err(e) = register_sync_scheme(&socket, "accessibility", &mut scheme) { + log_msg("ERROR", &format!("failed to register scheme:accessibility: {}", e)); + std::process::exit(1); + } log_msg("INFO", "registered scheme:accessibility"); loop { diff --git a/local/recipes/system/redbear-ime/source/src/main.rs b/local/recipes/system/redbear-ime/source/src/main.rs index 5a221b8546..7c7a1caa06 100644 --- a/local/recipes/system/redbear-ime/source/src/main.rs +++ b/local/recipes/system/redbear-ime/source/src/main.rs @@ -14,8 +14,17 @@ fn main() { let mut scheme = ImeScheme::new(); let mut state = SchemeState::new(); - let socket = Socket::create().expect("ime: failed to create scheme socket"); - register_sync_scheme(&socket, "ime", &mut scheme).expect("ime: failed to register scheme:ime"); + let socket = match Socket::create() { + Ok(s) => s, + Err(e) => { + log_msg("ERROR", &format!("failed to create scheme socket: {}", e)); + std::process::exit(1); + } + }; + if let Err(e) = register_sync_scheme(&socket, "ime", &mut scheme) { + log_msg("ERROR", &format!("failed to register scheme:ime: {}", e)); + std::process::exit(1); + } log_msg("INFO", "registered scheme:ime"); loop { diff --git a/local/recipes/system/redbear-keymapd/source/src/main.rs b/local/recipes/system/redbear-keymapd/source/src/main.rs index 512033064b..7e17c935bc 100644 --- a/local/recipes/system/redbear-keymapd/source/src/main.rs +++ b/local/recipes/system/redbear-keymapd/source/src/main.rs @@ -50,9 +50,17 @@ fn main() { &format!("loaded {} keymap(s)", scheme.keymap_count()), ); - let socket = Socket::create().expect("keymapd: failed to create scheme socket"); - register_sync_scheme(&socket, "keymap", &mut scheme) - .expect("keymapd: failed to register scheme:keymap"); + let socket = match Socket::create() { + Ok(s) => s, + Err(e) => { + log_msg("ERROR", &format!("failed to create scheme socket: {}", e)); + std::process::exit(1); + } + }; + if let Err(e) = register_sync_scheme(&socket, "keymap", &mut scheme) { + log_msg("ERROR", &format!("failed to register scheme:keymap: {}", e)); + std::process::exit(1); + } log_msg("INFO", "registered scheme:keymap"); loop { diff --git a/local/recipes/system/redbear-wayland-guard/source/wayland_guard.c b/local/recipes/system/redbear-wayland-guard/source/wayland_guard.c deleted file mode 100644 index 691a6b1ee3..0000000000 --- a/local/recipes/system/redbear-wayland-guard/source/wayland_guard.c +++ /dev/null @@ -1,46 +0,0 @@ -/* Runtime null guard for wl_proxy_add_listener — interposed via LD_PRELOAD. - * Qt6 Wayland QPA passes NULL proxies during initialization on Redox. - * This shim prevents the page fault at null+8 (proxy->object.implementation) - * by returning an error code instead of crashing. - * - * Cross-referenced with libwayland wayland-client.c:649. - */ -#define _GNU_SOURCE -#include -#include -#include - -/* Original function pointer */ -static int (*real_wl_proxy_add_listener)(void *proxy, - void (**implementation)(void), void *data) = NULL; - -static void *(*real_wl_proxy_get_display)(void *proxy) = NULL; -static unsigned int (*real_wl_proxy_get_version)(void *proxy) = NULL; - -static void init(void) { - real_wl_proxy_add_listener = dlsym(RTLD_NEXT, "wl_proxy_add_listener"); - real_wl_proxy_get_display = dlsym(RTLD_NEXT, "wl_proxy_get_display"); - real_wl_proxy_get_version = dlsym(RTLD_NEXT, "wl_proxy_get_version"); -} - -int wl_proxy_add_listener(void *proxy, - void (**implementation)(void), void *data) { - if (!real_wl_proxy_add_listener) init(); - if (!proxy) { - fprintf(stderr, "wayland-guard: wl_proxy_add_listener(NULL) prevented crash\n"); - return -1; - } - return real_wl_proxy_add_listener(proxy, implementation, data); -} - -void *wl_proxy_get_display(void *proxy) { - if (!real_wl_proxy_get_display) init(); - if (!proxy) return NULL; - return real_wl_proxy_get_display(proxy); -} - -unsigned int wl_proxy_get_version(void *proxy) { - if (!real_wl_proxy_get_version) init(); - if (!proxy) return 0; - return real_wl_proxy_get_version(proxy); -} diff --git a/recipes/system/redbear-wayland-guard b/recipes/system/redbear-wayland-guard deleted file mode 120000 index e006beb06a..0000000000 --- a/recipes/system/redbear-wayland-guard +++ /dev/null @@ -1 +0,0 @@ -../../local/recipes/system/redbear-wayland-guard \ No newline at end of file