Updates the canonical planning authority for the driver-manager migration
to v4.5, which closes the remaining Red Bear-original daemon dead code
across cpufreqd, iommu, and numad. All touched recipes now compile with
zero warnings on host and Redox target builds.
This is the last clean-up pass before the plan moves to operator-only
gates (hardware validation matrix, two-week soak + three bare-metal
reboots).
Last reviewed line updated to 2026-07-24 (v4.5).
Updates the hardware-acceleration status table to mark iris,
radeonsi, and Vulkan (anv, radv) as 🟡 Compiles (libclc OK).
This is the state after the libclc recipe was added as a proper
Cat 1 in-house project at local/recipes/dev/libclc/.
Status changes:
- iris: ❌ Not built → 🟡 Compiles (libclc OK)
- radeonsi: ❌ Not built → 🟡 Compiles (libclc OK)
- Vulkan anv: ❌ Not built → 🟡 Compiles
- Vulkan radv: ❌ Not built → 🟡 Compiles
- Lunar Lake/PTL: still ❌ Runtime but ✅ Recognized in kernel
The runtime path remains blocked on Phase 4 (Redox gallium winsys).
libclc provides the .bc bitcode but Mesa iris/radeonsi need a
Redox-specific winsys to translate pipe_screen ops into the
redox-drm ioctl surface. Once Phase 4 lands, iris/radeonsi/Vulkan
should work end-to-end.
Adds a callout note explaining the libclc port status with link
to local/recipes/dev/libclc/.
Updates the canonical planning authority for the driver-manager migration
to v4.4, which closes the remaining boot-log noise items
identified during a real QEMU boot:
- initfs sidecar-IPC ENODEV warning: detect initfs mode and skip
UnixStream::pair() (the initfs kernel namespace does not support
AF_UNIX socketpair and the initfs driver-manager is transient).
- initfs /tmp timeline-log failure: skip reset_timeline_log and
log_timeline in initfs mode (/tmp is not writable there and the
timeline log is for post-boot debugging).
- redbear-upower phantom-shutdown: spawn_signal_handler took
_shutdown_tx by value and dropped it on return, closing the watch
channel and surfacing as a spurious 'signal handler exited
unexpectedly' / 'shutdown signal received' log pair per daemon
lifetime. Fix: pass shutdown_tx.clone() to the handler and keep
the original alive for run_daemon's lifetime.
- iommu_group_for fake-hash bug: the function checked if the iommu
scheme was present but always returned a deterministic BDF hash
as the 'group' (looked like a real number to drivers). Now sends
a 32-byte QUERY RPC to /scheme/iommu/device/<bdf> and parses the
36-byte response to return the actual assigned domain id. Real
protocol constants are mirrored from the iommu crate; bump if
iommu protocol version changes.
- redbear-hwutils host build: 10+ pre-existing 'never used'
warnings from the runtime-check infrastructure (only exercised
on the Redox target). Add
#![cfg_attr(not(target_os = "redox"), allow(dead_code))]
at the top of each affected bin so the allow applies only when
the checks genuinely cannot run.
Status table: v4.4 closes the last boot-noise issues from the v4.3
status. Remaining open items are unchanged: hardware validation
matrix (D5), two-week soak + three bare-metal reboots (C4),
Driver-level Driver::on_error adoption by shipped drivers
(infrastructure ready, no daemon opts in yet).
Last reviewed line updated to 2026-07-24 (v4.4).
Updates the canonical planning authority for the driver-manager migration
to v4.3, which closes the last open v4.0 P3 item ('Driver-level
Driver::on_error IPC') via a three-layer architecture:
1. Manager-side trait: DriverConfig::on_error override returns the
severity mapping by default; consultable from the AER dispatch.
2. Sidecar IPC (manager): UnixStream::pair(), child fd as
REDBEAR_DRIVER_ERROR_FD env var, parent fd registered by BDF,
200ms timeout on the IPC roundtrip, fall-back chain (IPC -> in-
process -> severity default).
3. Sidecar IPC (driver): linux-kpi pci_register_error_handler() +
worker thread that services the sidecar fd.
Documents the wire protocol, the C-side API contract, the
discriminant mappings, and the explicit decision to keep wire types
duplicated between driver-manager and linux-kpi rather than extract
a shared crate.
Status table: Open items now empty of v4.0 P3 list items. Remaining
operator-only gates (hardware validation matrix, two-week soak) are
noted but are out of scope for code work. Driver-level Driver::on_error
adoption by shipped drivers is now possible (the IPC layer is ready)
but no daemon opts in yet -- that is an integration task for future
driver work.
Last reviewed line updated to 2026-07-24 (v4.3).
Entire greeter-critical stack (Qt 6.11.1 + mesa + 9 kf6 core + sddm +
redbear-compositor + redbear-greeter) compiles. Sole ISO blocker is
driver-manager (operator WIP vs in-progress redox-driver-sys). Documents the
GREETER-DEFER re-enable path for the full Plasma desktop.
Comprehensive 3D userland plan based on direct code audit of the
Mesa 26.1.4 build, redox-drm Intel backend, virgl runtime path,
amdgpu C port, and libdrm enablement. Seven critical gaps identified
that block all hardware-accelerated 3D rendering on Red Bear OS
beyond llvmpipe fallback:
1. Mesa gallium-drivers=softpipe,llvmpipe,virgl — NO iris, NO crocus,
NO radeonsi. The README/CHANGELOG claim that 'all 6 Red Bear
Mesa patches are wired' is incorrect: only 5 are wired; patches
03 and 06 are orphans because patch 03 targets
src/egl/drivers/dri2/platform_redox.c which does not exist in
Mesa 26.1.4 upstream (the file was removed). Patches 03/06
cannot be cleanly reapplied — they need re-creation against
the current Mesa API.
2. No 'redox' EGL platform in Mesa 26.1.4. EGL_PLATFORM=wayland
resolves to swrast (llvmpipe) on Redox. virgl and iris are
never auto-selected.
3. No Mesa winsys for Redox (src/gallium/winsys/redox/ does not
exist). The virgl driver uses upstream's generic
virgl_drm_winsys which depends on libdrm's redox.patch to
redirect ioctls to scheme:drm.
4. Intel kernel backend supports only Gen9–Gen14 (Meteor Lake).
No Lunar Lake (Xe2, Gen15) device IDs. No Panther Lake (Xe3,
Gen16) device IDs. The display version table stops at 14.
5. No Vulkan built (vulkan-drivers= empty). No anv (Intel), no
radv (AMD), no venus (virtio-gpu Vulkan).
6. The redox_private_cs_submit ABI exists in redox-drm (real
implementation for Intel ring submission with seqno tracking,
space-wait, MI_FLUSH_DW) but no Mesa gallium driver consumes it.
7. The amdgpu C port is display-only (DC modeset, no render/3D).
It does NOT provide a Mesa radeonsi winsys. Stages 2-4 of the
amdgpu recipe are intentionally empty (no Linux TTM/core
source).
The plan file (786 lines) covers:
- Verified code state from direct read (Mesa recipe, Intel
backend, virgl, amdgpu, libdrm)
- Reality-vs-claim corrections (6 overclaims in current docs)
- Hardware-acceleration status table (10 paths)
- 7-phase execution plan with explicit acceptance criteria
for each phase:
Phase 1: Validate current virgl runtime path (1-2 weeks)
Phase 2: Add Lunar Lake and Panther Lake device IDs
Phase 3: Restore the Redox EGL platform (re-create)
Phase 4: Add Intel iris (Gen8-Gen14) — biggest piece, 8-12 weeks
Phase 5: Add AMD radeonsi — 6-8 weeks
Phase 6: Vulkan (enables anv/radv) — 2-4 weeks
Phase 7: Panther Lake kernel driver — 12-16 weeks
- Validation matrix per vendor
- File-level change catalog
- Risk register
- Operating rule: 'code presence is not support; build success
is not support; llvmpipe is not acceleration; an env-override
that requires manual setup is not a runtime path'.
Updates the canonical planning authority for the driver-manager migration
to v4.2, which closes:
* 'acpid pci_fd is not registered' (ACPI session) — was the last
open P3 item from v4.0. Fixed in commit b906ad68 / submodule bump
4db58bd1e0.
* Per-vendor firmware packaging — split redbear-firmware into four
per-vendor recipes (redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth}).
Also captures the v4.2 self-review followups:
* UnifiedEvent::Aer threads the RecoveryAction through, so the
callback no longer recomputes route_to_driver per event.
* iommu/numad scheme paths corrected: iommu was checking a
hash-keyed path the daemon does not expose, numa was checking
/scheme/numad/device/<bdf> when the numad daemon actually writes
to /scheme/proc/numa.
* RecoveryAction::Fatal now emits an ERROR-level operator-tooling
marker (AER-FATAL: ...) instead of being silently dropped.
Status table: AER row + Quirks row reflect v4.2 state. Adjacent-
technology matrix unchanged: cpufreq/thermald remain compatible,
iommu/numad now honest via scheme-presence detection.
Last reviewed line updated to 2026-07-24 (v4.2).
Self-review found the v4.1 update's AER row claimed 'Driver::on_error
→ RecoveryAction on bound devices is now end-to-end rather than
discarded.' That is misleading: DriverConfig does not override
Driver::on_error (the trait method keeps its default Ok(Handled)
impl), so the trait callback is never invoked. The v4.1 fix wires
manager-level auto-dispatch (AER event → route_to_driver →
dispatch_recovery), not driver-level on_error IPC. The driver-IPC
item remains open.
Reword the row to say manager-level dispatch and note that
Driver::on_error IPC is a separate item.
Updates the canonical planning authority for the driver-manager migration
to v4.1, which closes the three P3 items v4.0 had declared open.
Adds:
* v4.1 update block with the table mapping each v4.0 P3 item to its
v4.1 resolution (QuirkPhase::Early gating, AER auto-dispatch,
per-vendor firmware assessment) and the IOMMU/NUMA honest-absence
fix in redox-driver-core::modern_technology.
* Driver-by-driver audit summary — every PCI driver invoked from
/lib/drivers.d/*.toml plus the modern-tech daemons and bridging
consumers. No stubs, no todo!()/unimplemented!() in production
paths.
* Adjacent-technology compatibility matrix — cpufreqd/thermald
verified compatible; iommu now honest; udev-shim/driver-params
wired correctly; redox-drm/xhcid/iwlwifi/amdgpu use the granted
channel contract.
Refreshes the v4.0 post-cutover table to reflect the v4.1 AER row
('auto-dispatch from listener; RecoveryAction::ResetDevice/RescanBus
execute via shared dispatch_recovery helper') and the v4.1 quirks
row (phase = early/enable consulted at probe time).
Replaces the now-stale v4.0 'Open items (updated)' line with the v4.1
list — none from v4.0 P3, plus the operator-only gates that remain
(ACPI session, hardware validation matrix, two-week soak).
Updates Last reviewed line to 2026-07-24.
Add a "Canonical build — do NOT bypass" subsection to AGENTS.md and
local/AGENTS.md, and inline warnings above every instructional repo cook /
repo fetch / make live / make r.<recipe> mention across the build/patch/plan
docs. Rationale (learned the hard way this session): direct repo cook/fetch
skips apply-patches.sh patch-linking + staleness handling, causing broken
patches (qtsvg CVE) and wasted rebuilds. Always build via
local/scripts/build-redbear.sh.
redbear-info's integration check list still labeled the PCI spawner as
'pcid-spawner' and pointed at /usr/bin/pcid-spawner (deleted). Updated
to 'driver-manager' with /usr/bin/driver-manager and a note about
/scheme/driver-manager/bound. Plan v3.2 marks P2-1 done (pcid AER +
pciehp producers validated in QEMU).
SDDM greeter renders on redbear-compositor (per /etc/sddm.conf CompositorCommand);
KWin is the post-login session compositor. Runtime chain (driver-manager →
redox-drm → card0 → sddm → redbear-compositor → greeter) is coherent, BUT three
display entry points (20_display redbear-session-launch, 20_greeter
redbear-greeterd, 21_sddm) all fire oneshot_async and would contend for the
single-owner GPU/card0. For a clean SDDM path the first two must be disabled
(operator sign-off required).
Phase status for making redbear-full compile + run to the SDDM Wayland greeter:
build-system llvm fix, Mesa EGL gate persisted, VirGL priority (all done);
Rust components (redox-drm, redbear-compositor) compile-verified; remaining =
full C/C++ cook campaign (mesa/qt6/kf6/kwin/sddm) + Qt6 null+8 runtime validation
+ boot. Records upstream cherry-pick candidates and component homes.
Record the two concrete prerequisites for compositor input wiring, found by
reading the compositor source: (1) an event-loop restructure — it uses a
blocking accept loop, drains keys only reactively, and ClientState stores no
UnixStream, so no input source can push wl_keyboard to a client; (2) the
desktop cannot run without DRM/Mesa (no /scheme/drm/card0 on mini), so the
wiring is unvalidatable until the Mesa EGL/DRI port lands. Defines the exact
wiring for when those clear (read /scheme/evdev, set_vt_mode, real XKB keymap
fd, keycode = evdev - 8).
P0 green (acpid compiles). Fresh redbear-mini boot confirms: no console
regression (login + shell command execution intact) and the raw tap is live
(evdevd reads consumer_raw, evdev scheme functional). Boot-log errors observed
are pre-existing and unrelated to the input stack.
Record what landed (S1 raw evdev tap, S4-core VT graphics-mode op, S5 seatd
local package; all compile-checked, boot-validation P0-gated) and correct the
Defect-3 framing: fbcond is a byte-queue + CR/LF + special-key escapes, not a
second canonical line discipline (ptyd is the only one), and the console login
works — so the old "collapse two disciplines" console surgery is deferred as
unnecessary and risky. Grab arbitration + compositor wiring remain gated on the
Mesa desktop bring-up.
Cross-referenced the console-input path against Linux/CachyOS
(local/reference/linux-7.1/drivers/{input,tty}/). Linux applies the
keymap once (vt/keyboard.c) and runs one line discipline (n_tty.c)
shared by the console tty and ptys; RedBear duplicates the keymap
(inputd + fbcond) and CR/LF (fbcond + ptyd) and runs two disciplines
bridged by getty — which is where typed characters are lost (echoed but
not executed). Plan: inputd owns the keymap and emits the full byte
stream (incl. escape sequences); fbcond becomes display-only passthrough
(no keymap, no CR/LF, no cooking); ptyd is the sole line discipline.
Staged, each stage independently bootable; validation needs the build
green (acpi-rs currently blocks it).
- AGENTS.md + docs/README.md: pcid-spawner is retired and removed
(2026-07-24); driver-manager owns the path unconditionally; services
list and networking description updated.
- Migration plan v3.1 section: fallback framing replaced with the full
retirement (crate, service files, build wiring removed; source in git
history).
- Assessment: pcid-spawner row updated to retired; the never-delete
constraint noted as superseded by the operator's retirement decision.
Redesign grounded in the Linux 7.1 quirk-consumption cross-reference
(9 families, one three-layer invariant: match -> store -> consume):
- New open domain channel: [[<domain>_quirk]] TOML tables matched by
(vendor, device) with wildcards, accumulated as string flags by
quirks::lookup_driver_quirks(domain, vid, did). The table name IS the
domain key — new driver domains need zero registry code (Linux Type-C
model: driver-owned fixup tables like HDA's per-codec lists).
- lookup_audio_quirks(vid, did) as the first domain convenience API for
ihdad's future integration.
- quirks.d/15-audio.toml converted from [[pci_quirk]] to [[audio_quirk]]
— the audio_* flags (force_eapd, single_cmd, position_fix_lpib,
mirroring Linux sound/pci/hda) are now carried as data instead of
warned-and-dropped on every probe cycle.
- Docs: three-layer model in QUIRKS-SYSTEM.md + consumption contract
(bind-time / core-runtime / driver-runtime); QUIRKS-IMPROVEMENT-PLAN.md
v2.0 with the redesign assessment and cutover-era reality (stale
pcid-spawner broker references removed).
- 75/75 redox-driver-sys tests pass (new domain loader test).
- Plan v3.2: runtime gate PASSED (initfs ahcid bind, switchroot, rootfs
e1000d concurrent bind with zero deferred, scheme live, resident
hotplug loop); the four runtime-only bugs it found and their fixes;
cookbook cargo-path-dep staleness fix verified.
- Assessment § 12: gate evidence table + runtime-only bug register.
- PACKAGE-BUILD-QUIRKS.md: new platform quirk — std::thread::scope
hangs on the Redox target (park/unpark unvalidated); spawn+join is
the required pattern; RwLock::write and park/scope remain unvalidated.
- Pointers bumped to v3.2.
Record that redbear-mini now boots to the Red Bear login: prompt in QEMU.
Document the root cause (dw_i2c::endpoint::serve register_sync_scheme
never returned the cap fd to init — ptyd-class deadlock on type={scheme}
services) and the fix (deliver cap fd via INIT_NOTIFY). Note follow-ups:
_REG opregion-connect is dead code (initialize_namespace never called),
and driver-manager maps class=0x03 to full-only redox-drm in mini.
Plan v3.1 records the completed P0/LDR/P2 work program and the
operator-ratified cutover (driver-manager owns the boot path in all
redbear-* configs; pcid-spawner gated as fallback). Assessment § 11
documents the OS-services integration: init ConditionPathExists gate,
live driver-params bridge, udev-shim driver-binding gap (P3), and the
correct absence of D-Bus (bridge-on-demand pattern).
- redox-driver-core: DeviceManager stores drivers as Arc<dyn Driver>;
ConcurrentDeviceManager jobs carry priority-ordered candidate lists
(static match + dynids); workers invoke the real Driver::probe() with
serial-equivalent per-device semantics. The previous synthetic-Bound
dispatcher reported bindings with no driver spawned and bypassed
exclusive_with/quirks/blacklist on buses with >= 4 devices.
- scheme.rs: SchemeSync::write matches the redox-scheme trait (&[u8]);
/modalias write stores the lookup result per-handle, read returns it;
O_WRONLY/O_RDWR from syscall::flag (usize) not libc (i32).
- config.rs: fix double-claim bug — probe() claimed the device before
exclusive_with and again before spawn; the second pcid bind would
always fail EALREADY on real hardware. One claim threaded to spawn.
- main.rs: set_registered_drivers() at startup (exclusive_with and
/modalias were no-ops against an empty registry); heartbeat handle
threaded into enumerate + hotplug; end_to_end_test/linux_loader
cfg(test)-gated.
- reaper.rs/sighup.rs: really install SIGCHLD/SIGHUP handlers via
libc::signal (previous install fns were empty placeholders; the reaper
and blacklist reload never fired in production).
- unified_events.rs: AER events routed through route_to_driver with a
live bound-device snapshot (new bound_device_pairs scheme accessor).
- Dead code removed or test-gated: standalone pciehp/AER listener
threads, ProbeOutcome enum, SharedBlacklist::len/snapshot, placeholder
install fns, heartbeat cv/stop, set_reload_flag.
- 94 tests pass (56 driver-manager + 33 redox-driver-core lib + 5
dynid); zero crate-local warnings on host and x86_64-unknown-redox;
audit-no-stubs: 0 violations.
Eighth-round integrations of the driver-manager migration's D-phase.
This round closes the remaining gaps from the v1.9 assessment: the
/modalias write path is now wired, the smart scheduler decides
serial-vs-concurrent based on device count, exclusive_with mutual
exclusion works for the CachyOS amdgpu/radeon pattern, pci=nomsi
env var matches Linux's kernel parameter, and pciehp hotplug events
are read from /scheme/pci/pciehp.
scheme.rs:
- Added /modalias write path. Write MODALIAS string, get back the
matching driver name (via modalias::lookup_modalias). The endpoint
is now a real read/write interface, not a static hint.
modalias.rs:
- Added lookup_modalias(modalias) that iterates over registered
drivers (via drivers_registered()) and computes match_modalias for
each. Returns the driver's name if a match is found.
config.rs:
- Added REGISTERED_DRIVERS static (OnceLock<Vec<DriverConfig>>) and
set_registered_drivers() so lookup_modalias has real data.
- Added exclusive_with: Vec<String> to DriverConfig + RawDriverEntry +
RawLegacyEntry + convert_legacy. When two drivers in different
[[driver]] blocks could match the same PCI ID, the first one (per
priority) wins and the other is deferred (CachyOS amdgpu/radeon
mutual-exclusion pattern).
- Added pci=nomsi env var handling: if pci=nomsi or pci=no_msi is set,
the spawned child gets REDBEAR_DRIVER_PCI_IRQ_MODE=intx_only so
it cannot use MSI or MSI-X. Matches Linux's pci=nomsi kernel parameter.
main.rs:
- Declared pciehp module. Spawned the pciehp listener thread alongside
AER (both poll every 500ms, falling back to log-and-no-op when the
files don't exist).
pciehp.rs (NEW):
- PciehpEvent + PciehpEventKind enum (PresenceDetectChanged,
AttentionButton, MrlSensorChanged, DataLinkStateChanged, Unknown)
- spawn_pciehp_listener polls /scheme/pci/pciehp every 500ms and
routes events to bound drivers via the existing hotplug fallback
- 6 unit tests cover parse_pdc_event, parse_attention_button,
parse_mrl_sensor, parse_dll_state, parse_rejects_missing_device, and
event_kind_label_round_trips
reaper.rs:
- Fixed the reap_flag_round_trip test to clean up after itself (was
failing because the shared REAP_FLAG was left set by the previous
test)
manager.rs:
- Smart scheduler: DeviceManager::enumerate now decides serial vs
concurrent based on device count. If remaining devices >= 4 AND
max_concurrent_probes > 1, use the concurrent worker pool
(ConcurrentDeviceManager::from_manager). Otherwise, use serial.
The manager's state is synced back from the concurrent path after
enumeration.
concurrent.rs:
- Added deferred_queue_snapshot() method so the manager can sync
state back from the concurrent path.
Test totals: 46 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Seventh-round integrations of the driver-manager migration's D-phase.
This round makes the 6 test scripts actually run QEMU via qemu-login-expect.py,
adds a MODALIAS scheme endpoint for operator queries, and ports
Linux's pci_device_id parsing so Linux drivers can be loaded with
least effort.
Test scripts (6, all functional now):
- test-driver-manager-parity.sh (C1 dual-mode observation): runs QEMU with
redbear-mini live.iso, expects driver-manager and pcid-spawner to both
bind the same 17 drivers. Exits 0 on PASS, 1 on FAIL, 0 on SKIP
(QEMU not available).
- test-driver-manager-active.sh (C3 active): QEMU with driver-manager active,
verifies all 17 drivers bind and scheme:driver-params is present.
- test-driver-manager-initfs.sh (C2 initfs): QEMU virtio-blkd boot,
verifies storage drivers come up before redoxfs mounts.
- test-driver-manager-hotplug.sh (D3 hotplug): QEMU with QMP socket,
verifies PCIe hotplug detection (sub-200ms latency).
- test-driver-manager-pm.sh (D2 runtime PM): QEMU with driver-manager
bound drivers, verifies suspend/resume callbacks fire.
- test-driver-manager-cutover.sh (C4 production): QEMU 3-reboot bound-set
identity check.
modalias.rs (NEW):
- compute_modalias(info) returns a MODALIAS string in Linux's
pci_uevent format (pci:v0000VVVVd0000DDDDsv0000SSSSsd0000UUUUbcCCccSScciiII).
- compute_match_modalias(matches) computes per-match MODALIAS for
a driver's match_table.
linux_loader.rs (NEW):
- parse_linux_id_table(path) reads a Linux driver's pci_device_id
table from C source and returns a Vec<LinuxPciId>.
- parse_linux_id_table_from_source(source) parses from a string.
- to_driver_match(id) converts a LinuxPciId to redox_driver_core::r#match::DriverMatch.
- Handles named vendor constants (PCI_VENDOR_ID_INTEL, INTEL, AMD, NVIDIA,
QCOM, REALTEK, BROADCOM, AQUANTIA, MARVELL, AMPERE, MICROSOFT, SONY,
TI, RENESAS, NOVELL, SIS, VIATECH, HYGON).
- Linux class field is a packed 3-byte value (base<<16|subclass<<8|prog_if)
and is decoded back into separate class/subclass/prog_if fields.
scheme.rs:
- Added /modalias endpoint. Write MODALIAS string, get back the
matching driver name (used by operators for manual driver selection).
main.rs:
- Declared modalias.rs and linux_loader.rs.
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.9 status table
- D5-AUDIT.md v1.9 update
- AGENTS.md + docs/README.md pointers to v1.9
Test totals: 39 tests across 4 crates, all passing.
§ 0.5 audit gate: 0 violations across 38 files.
Also: btusb firmware download command sequence + plan doc updates.
- btintel.rs extended: firmware_download_commands() generates the
full HCI command sequence for SFI firmware download (CSS header +
PKey + Signature + payload fragments). RSA and ECDSA header types
supported. secure_send_commands() splits data into 252-byte
fragments with type prefix. extract_boot_param() finds the
CMD_WRITE_BOOT_PARAMS record in firmware data. 5 new unit tests
(160 total pass).
- acpid/scheme.rs: ThermalZone handle kind for per-zone ACPI thermal
data. /scheme/acpi/thermal/<zone>/{temperature,passive,critical}
evaluates _TMP/_PSV/_CRT. thermald can now read real thresholds.
- Plan doc: Phase 7.1 updated with download command sequence.
ACPICA assessment updated with thermal zone methods.
Sixth-round integrations of the driver-manager migration's D-phase.
Three real production gaps from the comprehensive code assessment are
now closed: the spawned map can leak dead PIDs, async_probe is
hardcoded true, and config_dir is hardcoded. Four real unit tests
are added to concurrent.rs.
reaper.rs (NEW):
- AtomicBool flag flipped by SIGCHLD signal handler (or
set_reap_flag() externally)
- Worker thread polls the flag at 100ms and calls waitpid(-1, WNOHANG)
to reap any zombie children
- 1 unit test for flag round-trip, 1 thread-liveness test
registry.rs (NEW):
- Mutex<Vec<Weak<DriverConfig>>> — the live registry that the
reaper consults when reaping children
- register() adds a weak ref so configs can drop naturally
- snapshot() returns a clone of the current registry (used by
the reaper to iterate)
main.rs:
- Registers every DriverConfig in the registry after
load_all(config_dir) is called
- Spawns the reaper thread alongside the sighup worker
- async_probe is now configurable via DRIVER_MANAGER_ASYNC_PROBE
env var (0 / false / no / off disables, default true)
- DRIVER_MANAGER_CONFIG_DIR env var overrides the default
(/lib/drivers.d or /scheme/initfs/lib/drivers.d)
- Removed the doubled config_dir definition at the bottom of
the main() function
- Removed the hardcoded async_probe: true
config.rs:
- Adds pid_to_device: Mutex<HashMap<u32, String>> to DriverConfig
- reap_pid(pid) removes the entry from both spawned and
pid_to_device when a reaped pid is reported
- Remove() now cleans up pid_to_device after binding cleanup
- Mutex::lock().unwrap() replaced with
unwrap_or_else(|e| e.into_inner()) for consistency with main.rs
Cargo.toml:
- Adds libc = 0.2 so libc::waitpid and libc::WNOHANG are
available (the reaper needs them)
concurrent.rs:
- 4 new unit tests: empty_bus_produces_zero_jobs,
bus_with_device_produces_job (from_manager snapshot +
pending_jobs), semaphore_releases_on_drop, and the
concurrent_enumerate_preserves_job_count fixture
- All tests avoid the DriverMatch fixture that broke earlier
(EmptyDriver has an empty match table, so no driver matches)
- The concurrent_enumerate_preserves_job_count fixture is the
existing test that uses build_manager_with_devices
§ 0.5 audit gate: 0 violations across 38 files.
Test totals: 71 tests across 4 crates, all passing.
Also update LG Gram plan doc: ACPICA assessment (port algorithms,
not the C library), pcid assessment (correct, no changes needed),
Phase 9.1 marked partial (LPIT + _PRW + S0-idle done; MWAIT loop
remains), status updated to reflect completed phases.
Investigated the bootstrap thread bring-up needed for Design A
(worker-offload). Finding: `rlct_clone_impl` requires a fully-built TCB
for the new thread, but bootstrap's freestanding redox_rt has no
Tcb::new / TLS allocator / thread shim (only initialize_freestanding's
single TCB). So Design A needs, as a prerequisite, a freestanding
thread-spawn helper in redox_rt (its own task) — open-coding TCB/TLS in
initnsmgr is not acceptable.
Revised ordering: keep Step 1 (Arc<Mutex> Send refactor, inert until A),
boot-validate on idle + commit; then prefer Design B (kernel O_NONBLOCK
on open + single-thread deferred, no bootstrap threads) as the first
functional step; Design A later once redox_rt grows the freestanding
thread helper. All still require an idle host to validate.
Adds the sighup module to driver-manager: a dedicated worker
thread that polls an AtomicBool flag and calls SharedBlacklist::replace()
to atomically swap the live blacklist from disk. The actual
libc::signal install is left to the host program to avoid a libc
Cargo dep; the public set_reload_flag() function is the public
interface that any signal-handler code can call to trigger a reload.
sighup.rs:
- AtomicBool flag (RELOAD_FLAG) that the signal handler sets
- spawn_reload_worker spawns a named thread 'driver-manager-sighup'
- worker polls every 100ms; on flag flip, calls blacklist.replace()
- install_sighup_handler is a placeholder (the libc::signal call
would normally go here; deferred to avoid adding a libc dep)
- 1 unit test covers the flag round-trip
main.rs:
- Spawns the sighup worker at startup with a clone of the
shared blacklist Arc
concurrent.rs:
- Trivial whitespace-only change from earlier round
(DriverMatch type cleanup)
Test totals: 67 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 38 files.
Docs: DRIVER-MANAGER-MIGRATION-PLAN.md v1.7 header + status table;
D5-AUDIT.md v1.7; HARDWARE-VALIDATION-MATRIX.md adds SIGHUP row;
AGENTS.md + docs/README.md pointers to v1.7.
Fourth-round integrations of the driver-manager migration's D-phase.
Three new modules in driver-manager: heartbeat, aer, plus a
SharedBlacklist wrapper around the existing Blacklist that supports
live reload.
heartbeat.rs:
- Heartbeat struct with a publishing thread that writes a JSON
status line to /var/run/driver-manager.heartbeat.json every 5s
- Tracks bound / deferred / spawned / unbound / on_error counters
- 3 unit tests cover counter updates, JSON output, and clone semantics
aer.rs:
- AER (PCI Express Advanced Error Reporting) listener thread
- Reads /scheme/acpi/aer for events (parses severity + device bdf)
- Routes to bound driver via scheme:driver-manager lookup
- Returns RecoveryAction (Handled / ResetDevice / RescanBus) based
on severity
- Falls back to log-and-no-op when /scheme/acpi is absent
- 7 unit tests cover parsing, routing, and severity mapping
policy.rs:
- Adds SharedBlacklist = Arc<RwLock<Blacklist>> + source_path
- Supports live reload via replace() (re-reads from source_path)
- is_blacklisted() takes a read lock (lock-free for the probe hot path)
- set_global_shared_blacklist in config.rs wires it into the manager
- 2 new unit tests cover replace() and snapshot isolation
main.rs:
- Spawns the heartbeat thread at startup (file at /var/run)
- Constructs the SharedBlacklist from the policy directory
config.rs:
- Replaces GLOBAL_BLACKLIST OnceLock<Blacklist> with
OnceLock<SharedBlacklist>; the probe hot path reads via
Arc<RwLock>, not the OnceLock directly
Docs:
- DRIVER-MANAGER-MIGRATION-PLAN.md v1.6 status table (64 tests)
- D5-AUDIT.md v1.6 update
- HARDWARE-VALIDATION-MATRIX.md adds heartbeat and AER rows
- AGENTS.md + docs/README.md pointers to v1.6
Test totals: 64 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 37 files.
SIGHUP trampoline for the SharedBlacklist is left for a future round;
the replace() infrastructure is in place today so an operator can
add the signal handler without changing the policy module.
Third-round integrations of the driver-manager migration's D-phase.
The pcid_interface crate (in local/sources/base submodule, see
upstream commit ddcd0870) now reads REDBEAR_DRIVER_PCI_IRQ_MODE
and REDBEAR_DRIVER_DISABLE_ACCEL at connect_default time, exposing
them as PciFunctionHandle accessors. The quirk integration is
end-to-end: driver-manager emits the env vars on spawn, pcid_interface
parses them, and the child driver reads the hints from its
PciFunctionHandle.
driver-manager (16 tests, unchanged count + 3 new for observability):
- main.rs: --list-drivers prints the config table, --dry-run
prints how many drivers would-bind/defer/blacklisted without
spawning, --export-blacklist prints the loaded blacklist.
- policy.rs: adds blacklist_module_names() iterator for export.
driver-manager v1.5 quirks.rs (created earlier at v1.4 PciQuirkFlags
work) is in the staging area and is unchanged this round.
local/scripts/driver-manager-audit-no-stubs.py:
- Drops R4 (was: 'let _ = ...' no-op detection) because Rust's
'let _ = expression' is idiomatic and not actually a stub.
- Adds R5 (stub-macro callbacks: unimplemented!/todo!/unreachable!
in callback / fn bodies) to detect dead-end fallbacks.
- Audit gate now reports 0 violations across 35 files (was 34,
pcid_interface is now in scope).
local/sources/base submodule pointer: updated to upstream commit
ddcd0870 (the pcid_interface env-var-reading commit).
Test totals: 58 tests across 4 crates, all passing.
§ 0.5 audit-no-stubs.py: 0 violations across 35 files.
Base submodule bump (6db0f481): hardware-correct DesignWare engine
(disable/program/enable ordering, abort-first polling, corrected SCL
timing, recovery, validation) and proper Intel LPSS PCI bring-up.
- iwlwifi candidate tables: remove the c-prefixed iwlmld series from
the current Mini-MVM candidate lists — the MVM transport cannot
drive MLD firmware, and selecting it would fail firmware boot
instead of falling back to a compatible image (review MAJOR). c-series
returns with the MLD op-mode (Phase 6/W). Fallback TOML chains no
longer mix MLD and MVM series.
- redbear-iwlwifi + redbear-wifictl candidate detection now probes
both the flat /lib/firmware/iwlwifi-* and the post-2026
/lib/firmware/intel/iwlwifi/ layouts (review MAJOR).
- plan doc: review-fix round recorded; precision fixes — amd-mp2-i2cd
remains registration-only until its mailbox engine lands, and the
system-quirk flags parse but have no consumers until Phase 5.
Validation: iwlwifi 8 + wifictl 21 tests pass, base cooks for
x86_64-unknown-redox.
vasilito