Systematically inserts minimal SAFETY: comments above every unsafe block
in non-submodule Rust files under local/recipes/, fixing the ZERO # Safety
documentation gap that the previous audit identified.
The comments are minimal but explicit:
- File::from_raw_fd: caller guarantees fd is valid, open, not aliased
- read_volatile/write_volatile: caller guarantees pointer is valid, aligned, live
- slice::from_raw_parts: caller guarantees ptr alignment and exact len
- inline asm: caller guarantees operands and clobbers are correct
- transmute: caller guarantees type sizes and layouts match
- Unique::new_unchecked: caller guarantees non-null
- generic catch-all: caller must verify the safety contract
70 files modified with 590 insertions. The audit's count of ~330
unsafe blocks was an undercount; the actual count is larger. Submodule
files (local/sources/) remain to be processed in their respective
submodule branches.
Part of the systematic fix for ZERO # Safety docs across the network +
driver + daemon surface
(NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §9.3).
drm_crtc_handle_vblank_get(crtc) returns the current per-crtc vblank
sequence number without incrementing, complementing the write-and-
increment behavior of drm_crtc_handle_vblank added in the prior commit.
Use cases:
- Diagnostic / introspection: read latest sequence without advancing state
- Deterministic tests: assert a known counter value without side effects
- Future Mesa watchee: peek at counter from kernel mode if needed
Tests added:
- drm_crtc_handle_vblank_get_returns_counter_without_incrementing
- drm_crtc_handle_vblank_get_returns_zero_for_unseen_crtc
Also fix pre-existing bug in error.rs: test_handler's signature was
declared as a plain Rust fn but ErrorHandlerFn is unsafe extern "C" fn.
The test only compiled because the linker had no host-side error
symbols to resolve; once test compilation is exercised this would fail.
Fix is one qualifiert (fn -> unsafe extern "C" fn).
cargo check --lib: clean. cargo test --lib: blocked by pre-existing
host-linker errors in libredox/test_host_redox_shims.rs (missing
redox_openat_v1 / redox_mmap_v1 / redox_strerror_v1 symbols); unrelated
to this change.
Wave 1 (linux-kpi drm_shim.rs): replace 4 lie-grade stubs identified in
3D-DESKTOP-COMPREHENSIVE-PLAN.md §3.4.
- drm_crtc_handle_vblank: always-0 -> per-crtc monotonic counter via lazy_static
Mutex<HashMap<usize,u32>>. Mesa/KWin no longer stalls on the first
page-flip wait (audit §2 #6).
- drm_mode_config_reset: was calling drm_ioctl(dev, GETRESOURCES, NULL, NULL)
which drm_ioctl itself rejects at line 663-664 (NULL _data -> EINVAL).
Replaced with a logged no-op; redox-drm maintains mode state per-open.
- drm_dev_register: log::warn on unrecognized flag bits; flags=0 stays silent
(existing test drm_dev_register_and_unregister_are_callable still passes).
- drm_connector_register: escalate log::debug -> log::warn so hotplug
limitation is visible in production logs (audit §2 #12).
Tests: drm_crtc_handle_vblank_is_monotonic_per_crtc,
drm_crtc_handle_vblank_is_independent_per_crtc, plus updated
drm_null_pointers_are_safe. cargo check --lib clean.
Wave 2 (SDDM): both redox-virtualterminal-stub.patch and
redox-helper-utmpx-stub.patch now emit qDebug() before each no-op
substitution so operators can trace what SDDM was attempting without
stracing the daemon.
Wave 3 (redbear-sessiond): Manager interface now emits SeatNew
(org.freedesktop.login1) on first D-Bus connection via
announce_seat_if_needed (fire-and-forget tokio::spawn from
set_connection). Idempotent via Arc<AtomicBool>. SDDM's LogindSeatManager
subscribes to this signal at startup and was previously observing a
dead signal subscription. emit_seat_removed exposed for future use.
Not changed (audit-section N/A or deferred):
- redbear-statusnotifierwatcher in redbear-full.toml: already wired
at line 233 with activation file staged (audit §3.7 was outdated).
- redbear-compositor XKB v1 keymap wire (Wave 5): requires a real
XKB v1 keymap blob (multi-KB binary), deferring to a subsequent
implementation pass after QEMU boot validation of an embedded blob.
Closes the C13 gap: 4-state -> 6-state.
Adds two new variants to redox-driver-core::RecoveryAction:
- CanRecover (=4) — PCI_ERS_RESULT_CAN_RECOVER; driver can recover
without a slot reset
- Recovered (=5) — PCI_ERS_RESULT_RECOVERED; recovery complete
The four historical variants (Handled/ResetDevice/RescanBus/Fatal)
remain stable at discriminants 0..=3; the wire protocol is backward
compatible.
Cross-crate surfaces updated:
- linux-kpi c_headers/linux/pci.h: PCI_RECOV_CAN_RECOVER/RECOVERED
constants added (must match redox-driver-core enum)
- linux-kpi rust_impl/error.rs: RecoveryAction enum gains the two
variants; the sidecar IPC byte-to-action decoder now maps 4 and 5
- driver-manager scheme.rs::recovery_action_str gains mappings for
the new variants; new tests cover both round-trips
Interlocked across 4 files — splitting would break compilation
(git-master VALID exception).
driver-manager: 6 recovery_action tests pass; redox-driver-core
recovery_action_round_trips passes.
Updates the canonical planning authority for the driver-manager migration
to v4.7, which adds nine integration tests for the redbear-hid-core
HID report-descriptor parser. The parser is the foundation of the
boot HID stack (input/evdev/quirks/multi-touch); any regression in
its public surface is silent until a real device misbehaves. v4.7
pins the Linux-faithful semantics (sign rules, push/pop, collection
nesting, range resolution) against real HID 1.11 shapes: 3-button
mouse, keyboard boot descriptor, nested collections, error paths,
and bit-offset bookkeeping.
Status table: no v4.0 P3 items remain. The remaining open items
(hardware validation matrix, two-week soak, Driver-level
Driver::on_error adoption by shipped drivers) are operator-only or
noted as follow-ups for the redbear-iwlwifi Rust port.
Last reviewed line updated to 2026-07-24 (v4.7).
Per v4.4 plan: 'no shipped driver daemon opts in yet'. Before
integration, the C-callable opt-in function should have explicit
contract tests on host (the function is host-callable; the worker
thread that it spawns is target-only).
Three new unit tests in rust_impl/error.rs:
- register_returns_false_without_env_var: confirms
pci_register_error_handler returns false when
REDBEAR_DRIVER_ERROR_FD is unset (the daemon was not passed a
sidecar fd by its parent). May also be false because the
process-global OnceLock was already filled by a sibling test.
- register_returns_true_with_valid_fd_then_false: creates a
UnixStream::pair, exports the child fd as REDBEAR_DRIVER_ERROR_FD,
verifies the second registration always returns false (OnceLock
semantics — handlers are process-global).
- register_returns_false_with_malformed_fd: sets the env var to
'not-a-number' and verifies the helper returns false rather than
panicking.
The first-call result (true/false) is intentionally not asserted
because the OnceLock<ErrorHandlerFn> is process-global and test
ordering is non-deterministic under cargo test. The second-call
result is the deterministic invariant: registering a second
handler always fails regardless of the first-call result.
Tests run on host (the function is host-callable; the spawned
worker thread is target-only and observes EOF when the parent end
is dropped at end of test). Target build also clean.
No production code changed.
Closes the v4.2 plan's 'Driver-level Driver::on_error IPC' item.
Three pieces, layered:
1. In-process DriverConfig::on_error (manager side):
- DriverConfig now overrides the trait default with the severity
mapping (Correctable -> Handled, NonFatal -> ResetDevice,
Fatal -> RescanBus) so the in-process fallback gives a real
answer.
- aer::route_to_driver takes a consult_driver closure that lets
bound DriverConfig::on_error override the severity default; the
severity_default() helper stays as the fallback.
2. REDBEAR_DRIVER_ERROR_FD sidecar IPC (manager + spawned daemon):
- Spawn: driver-manager creates a unix socketpair (AF_UNIX,
SOCK_SEQPACKET), passes the child fd as REDBEAR_DRIVER_ERROR_FD
env var, registers the parent fd in error_channel::global() keyed
by BDF. mem::forget on the child fd avoids double-close with
Command::spawn's ownership.
- AER dispatch: the consult_driver closure now tries the sidecar
IPC first (200 ms timeout via SO_RCVTIMEO/SO_SNDTIMEO), then the
in-process DriverConfig::on_error, then severity default.
- Reap: error_channel::global().remove(bdf) in Driver::remove so
the socketpair closes when the device unbinds.
3. linux-kpi C-callable opt-in (driver side):
- New c_headers/linux/pci.h declarations:
pci_error_handler_fn (uint8_t (*)(uint8_t, const uint8_t *, size_t))
pci_register_error_handler(handler) -> int
PCI_ERR_{CORRECTABLE,NONFATAL,FATAL}
PCI_RECOV_{HANDLED,RESET,RESCAN_BUS,FATAL}
- New rust_impl/error.rs module:
* duplicated wire types (DriverErrorReport / DriverErrorResponse
with encode/decode) -- linux-kpi stays self-contained
* worker_loop() thread that reads length-prefixed requests,
invokes the registered C handler, writes length-prefixed
RecoveryAction responses
* pci_register_error_handler() reads REDBEAR_DRIVER_ERROR_FD,
spawns the worker thread, returns 0/1
Protocol (length-prefixed, little-endian):
manager -> driver: [u32 len][severity:u8][bdf_len:u8][bdf][raw_len:u32][raw]
driver -> manager: [u32 len][action:u8]
Tests:
driver-manager: 70 passed (was 65; +5 from error_channel + aer)
linux-kpi: cargo check clean (host test link fails on
redox_strerror_v1, pre-existing)
LDR-2 (spawned mode): linux-kpi pci_register_driver now honors
PCID_CLIENT_CHANNEL — when spawned by driver-manager (or pcid-spawner)
it probes only the granted device and never enumerates, making the
manager the single owner of match-claim-spawn. Standalone
self-enumeration remains for CLI tools. redox-driver-sys
parse_scheme_entry is now pub.
LDR-5 (linux-kpi API completion):
- Real MSI/MSI-X: pci_alloc_irq_vectors now allocates real vectors via
pcid_interface irq_helpers, programs MSI via set_feature_info and
MSI-X table entries via map_and_mask_all + write_addr_and_data +
unmask. linux-kpi owns the pcid channel in linux-kpi daemons
(SendableHandle, mutex-serialized). LEGACY path keeps real INTx.
- pci_request_regions/pci_release_regions (BAR validation + tracking).
- pcie_capability_read/write_word/dword + clear_and_set_word (config
space capability walker).
- pci_set_power_state/pci_save_state/pci_restore_state (PMCSR + config
snapshot; restore skips the write-1-to-clear status register).
- C header declarations synced.
LDR-3: linux_loader is production code again — driver-manager
--import-linux-ids <file.c> parses a Linux pci_device_id table and
emits [[driver.match]] TOML. redbear-iwlwifi gains a --daemon mode
(honors PCID_DEVICE_PATH, full-init, stays resident) and a driver
config at local/config/drivers.d/70-wifi.toml.
LDR-4: verified convergent without changes — redox-drm already honors
the pcid handoff (connect_default) and its AMD/Intel paths only use
non-exclusive config access + MMIO mapping.
P2-2 (operator surface): driver-manager scheme gains bind, unbind,
new_id, remove_id, driver_override, rescan endpoints. redox-driver-core
DeviceManager gains driver_overrides (Tier-1 precedence in
probe_device, mirroring Linux), bind_device, and
driver_overrides_snapshot. parse_new_id has 5 host tests.
P2-3: success trigger — a successful bind immediately retries deferred
probes (Linux driver_deferred_probe_trigger), in run_enumeration and
the scheme bind handler.
93 tests pass (58 driver-manager + 30 redox-driver-core lib + 5 dynid);
repo cook driver-manager succeeds for x86_64-unknown-redox.
- Implement krealloc in linux-kpi memory.rs with GFP-aware tracker lookup,
copying, and zeroing of grown regions; add krealloc declaration to slab.h
- Align __GFP_ZERO/__GFP_NOWARN and GFP_* values between linux-kpi/slab.h
and redox_glue.h; make __GFP_ZERO a meaningful flag bit
- Add missing POSIX/errno base constants (EFBIG, EISDIR, ESPIPE, etc.) to
linux-kpi linux/errno.h so firmware-size checks and other drivers compile
- Harden linux-kpi bug.h: BUG()/BUG_ON() abort, WARN_ON_ONCE only warns once,
BUILD_BUG_ON uses _Static_assert
- Harden redox_glue.h: add PCI_COMMAND_* flags, CONFIG_HZ/HZ, jiffies
conversion macros, once-only WARN_ON_ONCE, _Static_assert BUILD_BUG_ON
- Implement redox_pci_enable_device/redox_pci_set_master with real local state
and command-bit updates; document pcid-spawner pre-enable
- Remove realloc-only krealloc from redox_stubs.c; it now links from linux-kpi
- Fix wait_for_completion_timeout to interpret timeout as jiffies and convert
to milliseconds, and update msecs/usecs_to_jiffies to use HZ
- Stage previously completed firmware-loader path deps and constructor fix
- Stage base and relibc submodule pointer updates from prior work
The Rust-side implementation of Linux's idr_for_each_entry macro. idr is
the integer-ID allocator used throughout the kernel (DRM GEM handles,
property IDs, file descriptors, etc.). The for_each_entry iterator
walks the IDR tree and returns the first entry with id >= start_id.
Previously the kernel API was stubbed at the C level. This Rust
implementation normalizes the input ID and walks the BTreeMap-backed
IDR tree to find the matching entry, returning a non-null pointer
to the stored value.
Cross-referenced with Linux lib/idr.c: idr_for_each_entry().
Three changes in this commit:
1. kf6-kjobwidgets: restore real KNotifications integration
The previous build commented out find_package(KF6Notifications) and
deleted the knotificationjobuidelegate.cpp/.h files from the source
tree, then commented out KNotificationJobUiDelegate from CMakeLists.
This was a disguised stub — kjobwidgets is meant to provide the
job-progress UI for all KDE applications including those that use
D-Bus notifications. Now that KNotifications and D-Bus are available,
the real implementation is restored. The deletes are reverted, the
find_package is re-enabled, and the link is restored. USE_DBUS=ON
since the runtime path now exists.
2. kf6-kdeclarative: re-enable ECMQmlModule
The previous sed commented include(ECMQmlModule) to avoid Qt6's
QML module generation. Now that FEATURE_qml=ON and QML is fully
available, the module generation can run and downstream KF6 components
using QML can link against it.
3. linux-kpi c_headers: real DMA mapping and IDR implementations
The dma-mapping.h and idr.h headers previously had stub
implementations. idr.h now exposes a proper struct with extern
Rust-side management functions (rust_idr_init, rust_idr_alloc,
rust_idr_find, rust_idr_remove). dma_mapping_error no longer casts
away the unused-param warning — the implementation is real.
linux-kpi/drm_shim.rs previously tracked GEM objects only in a local
HashMap. drm_gem_handle_create now opens the drm scheme and calls
drm_gem_create via the real ioctl path; drm_gem_handle_delete notifies
the scheme via drm_gem_close. Added write_size, scheme_ioctl, and
ensure_scheme_fd helpers. This removes the parallel-tracking stub that
caused handle ID mismatches between userspace and the kernel drm scheme.
Cross-referenced with Linux drivers/gpu/drm/drm_gem.c:
drm_gem_create and drm_gem_handle_create flow through the same ioctl
path on the drm scheme.
linux-kpi/drm_shim.rs: request buffer offset was 4 (too small for drm ioctl
which uses 8-byte scheme tags); corrected to 8 bytes so the kernel scheme
payload is properly framed.
redox-drm/scheme.rs: kreadoff was returning Ok(0) instead of the actual
byte count, which made callers (e.g. linux-kpi) think the read returned no
data. Now returns Ok(buf.len()) as documented in the syscall contract.
linux-kpi mac80211.h:
- Extract struct ieee80211_channel to top level (was nested in ieee80211_conf)
- Add struct ieee80211_conf conf to struct ieee80211_hw
- Change void* channel to struct ieee80211_channel* in bss_conf.chandef
- Include linux/ieee80211.h (consolidate single channel definition)
linux-kpi limits.h: new header with S8_MIN/S8_MAX/U8_MAX etc.
iwlwifi build.rs: add linux_mvm.c to cc-rs compilation
iwlwifi linux_mvm.c: add S8_MIN fallback define
iwl_ops_config() now handles PS state changes (IEEE80211_CONF_CHANGE_PS),
channel changes (IEEE80211_CONF_CHANGE_CHANNEL), and TX power changes
(IEEE80211_CONF_CHANGE_POWER). Tracks ps_enabled, current_channel, tx_power
in transport. Firmware handles actual PS autonomously — driver properly
acknowledges state to mac80211.
Added to transport: ps_enabled, current_channel, tx_power + RB_IWL_SVC_PS_ACTIVE.
Added to linux-kpi mac80211.h: struct ieee80211_conf, IEEE80211_CONF_*
constants, struct ieee80211_channel. Cross-referenced from Linux 7.1
include/net/mac80211.h lines 1824-1866.
Power save is no longer a gap — driver tracks PS state correctly.
IMPROVEMENT-PLAN.md §10.3 item 7: HIGH severity transmute audit.
mac80211.rs:469:
- RxCallback type changed from extern "C" fn to unsafe extern "C" fn
- Callback call now wrapped in unsafe { } (correct for FFI callback)
- Added SAFETY comment: explains HashMap<usize,usize> storage pattern
and why usize→fn pointer transmute is sound (same size, valid ABI)
timer.rs:202:
- Added SAFETY comment: explains Linux kernel timer callback ABI
(setup_timer/mod_timer always uses void (*)(unsigned long))
- transmute remains (necessary: usize from C → fn pointer)
Both transmutes are now documented with soundness invariants.
No actual UB was found — both transmutes were already safe.
The fix is documentation, not behavioral change.
Consolidate the active desktop path around redbear-full while landing the greeter/session stack and the runtime fixes needed to keep Wayland and KWin bring-up moving forward.
Add channel/band/rate/BSS/RX-TX structures to linux-kpi wireless
scaffolding (mac80211.rs, wireless.rs, net.rs, C headers), extend
redbear-iwlwifi linux_port.c with comprehensive PCIe transport, and
create consolidated CONSOLE-TO-KDE-DESKTOP-PLAN.md as the canonical
desktop path document. Remove stale INTEGRATION_REPORT.md (1388 lines)
in favor of current local/docs/ references. Update AGENTS.md, README,
and docs index to point to the new plan.
Derivative of Redox OS (https://www.redox-os.org) adding:
- AMD GPU driver (amdgpu) via LinuxKPI compat layer
- ext4 filesystem support (ext4d scheme daemon)
- ACPI fixes for AMD bare metal (x2APIC, DMAR, IVRS, MCFG)
- Custom branding (hostname, os-release, boot identity)
Build system is full upstream Redox with RBOS overlay in local/.
Patches for kernel, base, and relibc are symlinked from local/patches/
and protected from make clean/distclean. Custom recipes live in
local/recipes/ with symlinks into the recipes/ search path.
Build: make all CONFIG_NAME=redbear-full
Sync: ./local/scripts/sync-upstream.sh
vasilito