Cargo resolves workspace path deps relative to the MANIFEST path
(recipes/core/base/source/), not the symlink target. Symlinks in
local/sources/base/ ensure ../<dep> resolves correctly from both
local/sources/base/ and recipes/core/base/source/.
Also fix Cargo.toml [patch.crates-io] paths to use ../ for consistency.
Replaced three TODO comments with proper documentation:
1. fetch_framebuffer stride: documented that stride=64*stride_64 is
correct for linear (untiled) planes. Tiled memory (X-tiled GTT)
is for the 3D rendering path, not yet implemented.
2. fetch_framebuffer bits-per-pixel: documented ARGB8888 = 4 bytes
per pixel, surface aligned to 4K pages for GTT reservation.
3. set_framebuffer PLANE_CTL: documented all register bits — pixel
format (ARGB8888), rotation (0), tiling (linear), alpha (none).
Future 3D path will configure rotation and X-tiled memory.
All three were 'TODO: ...' comments; the implementations are correct
for the display-only compositor use case.
Replaced the hardcoded 'TODO: correct watermark calculation'
with a resolution-aware formula:
wm_lines = clamp(vdisplay / 16, 8, 128)
Reads vdisplay from the PLANE_SIZE register (bits 16-31) and
computes the display FIFO prefetch depth. Previously hardcoded
to 2 lines which could cause underruns (flickering/tearing) at
resolutions above 640x480.
Intel PRM minimum: 8 lines for 1080p display-only planes.
Formula: 1080/16 = 67 lines at 1080p, 90 lines at 1440p,
135 lines at 2160p (4K). Capped at 128 lines (5-bit WM field).
Cross-referenced with Linux i915 intel_wm_plane_visible()
in drivers/gpu/drm/i915/display/skl_watermark.c.
Replaced the 'TODO: how to use 64-bit surface addresses?' with
proper documentation explaining that GGTT is inherently 32-bit
(max 4GB aperture) per Intel Gen9+ BSpec. 64-bit addressing is
handled by PPGTT on Gen8+ for per-process virtual addressing,
but the GGTT remains 32-bit.
Cross-referenced with Linux 7.1 i915 i915_gem_gtt.c which
uses a 32-bit DMA mask for the global GTT (i915_gem_init_ggtt).
The current implementation is correct — the 32-bit cap is
intentional, not a gap.
New /scheme/netcfg/route/lookup rw node:
echo 10.0.0.1 > /scheme/netcfg/route/lookup
→ 10.0.0.0/8 via 10.0.0.1 dev eth0 src 10.0.0.2
→ no route to 192.168.1.1 (if unmatched)
Mirrors Linux 'ip route get 10.0.0.1'. Useful for debugging
routing table behavior and verifying route coverage.
All 31 tests pass.
Replaced GMBUS WRITE TODO stub with real implementation.
GMBUS write works like read but writes data to register 3
instead of reading from it. Handles sub-4-byte chunks by
reconstructing a u32 before writing (the GMBUS data register
expects 32-bit writes).
Cross-referenced with Linux 7.1 i915 display/intel_gmbus.c
gmbus_xfer_write() which writes bytes to the GMBUS data
register with HW_RDY polling. Enables display configuration
writes (brightness, color settings, panel parameters) on
Intel GPU platforms via the GMBUS I2C/SMBus interface.
Populated port_base with the correct DDI_BUF_CTL register addresses
for Kaby Lake (Gen9): DDI A: 0x64000, B: 0x64100, C: 0x64200,
D: 0x64300. Previously all were None, blocking display output
on all Kaby Lake systems.
Cross-referenced with Linux 7.1 i915 display/intel_ddi.c and
IHD-OS-KBL-Vol 2c-1.17. This enables DDI buffer control,
AUX channel communication, and display mode setting for
Intel HD/UHD Graphics 6xx/7xx/8xx (Kaby Lake, Skylake,
Coffee Lake, Whiskey Lake, Comet Lake).
Uncommented VIRTIO_GPU_F_VIRGL (bit 0) and added feature
negotiation in probe_device(). When the host supports VirGL 3D,
the driver now acknowledges the feature, enabling Mesa's virgl
driver to use the 3D command path (CTX_CREATE, SUBMIT_3D,
RESOURCE_CREATE_3D, etc. already defined in CommandTy enum).
Cross-referenced with Linux 7.1 drivers/gpu/drm/virtio/virtgpu_drv.c
virtio_gpu_driver_open() and virtio spec v1.2 §5.7.6.
This is the enabling step for hardware-accelerated 3D rendering
in QEMU via virglrenderer.
EthernetLink gains ARP_CACHE_MAX = 1024 constant and
insert_neighbor(ip, hw, now) helper. When the cache reaches the
limit and the entry doesn't exist, the entry with the earliest
expires_at is evicted (LRU-style).
Prevents unbounded growth of the neighbor cache under ARP flood
attacks. Mirrors Linux /proc/sys/net/ipv4/neigh/default/gc_thresh3.
netcfg exposes /scheme/netcfg/ifaces/eth0/arp/max → '1024'
All 31 tests pass.
Both VESA and Intel GPU drivers legitimately do not support
hardware cursor planes. The handle_cursor method should be
a no-op (software cursor is handled by the console layer),
not a panic.
Replaced unimplemented!() with documented no-ops explaining
that cursor rendering is handled by the software console layer.
This matches Linux 7.1 behavior where framebuffer drivers
defer cursor rendering to the VT/console subsystem.
SchemeSocket trait gains handle_sendmsg(file, payload, flags) with
default EOPNOTSUPP. SocketScheme::call_inner now dispatches
SocketCall::SendMsg (previously commented out).
UDP handle_sendmsg parses the sendmsg buffer format:
[name_len: usize][payload_len: usize][msg_controllen: usize]
[address: bytes][payload: bytes]
Extracts the destination IP:port from the address, sends via
smoltcp's send_slice. Enables sendto() on unconnected UDP sockets.
Unconnected UDP write_buf now returns EDESTADDRREQ instead of
EADDRNOTAVAIL — clearer error for unconnected writes without
sendto.
TCP and ICMP use the default EOPNOTSUPP implementation (they
are connection-oriented or use write_buf).
All 31 tests pass.
When the VIRTIO device doesn't report a MAC in config space,
generate a random locally-administered unicast MAC instead of
panicking with unimplemented!(). This matches Linux 7.1
drivers/net/virtio_net.c virtnet_probe() behavior.
Reads /scheme/rand for random bytes; falls back to a fixed
MAC if the random source is unavailable. MAC is forced to
unicast + locally administered (bit 0=0, bit 1=1).
All three tunnel devices now forward encapsulated packets to their
parent interface via DeviceList lookup, instead of dropping them
(R43 drop fix) or self-looping (original behavior).
Changes (same pattern as VLAN R63 fix):
- Add devices: Rc<RefCell<DeviceList>> field to struct
- Add devices parameter to constructor
- send() looks up parent by name and forwards encapsulated frame
- Falls back to debug log on parent-not-found
VlanDevice already integrated (R63). Bond device already correct
(forwards to slaves, no fix needed).
All 31 tests pass.
Replaced the 3-line TODO no-op with a functional LegacyBackend
that:
1. Enumerates available schemes in /scheme/ (logged at info level)
2. Spawns pcid for PCI bus enumeration on non-ACPI systems
Cross-referenced with Linux 7.1 drivers/pci/probe.c for PCI
device enumeration and arch/x86/kernel/devicetree.c for
non-ACPI device discovery.
Previously the backend was a no-op that logged 'TODO' and did
nothing, leaving non-ACPI systems without any hardware detection.
VlanDevice gains devices: Rc<RefCell<DeviceList>> field. send()
now forwards tagged frames to parent device via the shared list,
instead of dropping them (R43 drop fix) or self-looping (original).
Constructor changed: VlanDevice::new(name, parent, vlan_id, devices).
netfilter/netcfg/route: direct routes + flush + version + help
docs: NETWORKING-IMPROVEMENT-PLAN.md updated with Phase 4
completion status (firewall/conntrack/NAT) and Phase 6 VLAN status.
All 31 tests pass.
parse_route now supports three syntaxes:
default via 10.0.2.2 metric 100 — gatewayed route (existing)
10.0.0.0/8 via 10.0.0.1 — subnet route (existing)
10.0.0.0/8 dev eth0 — direct route (NEW)
Direct routes use via=None (no gateway), dev=specified, src=0.0.0.0.
The routing layer will use the interface's configured IP as source.
Mirrors Linux:
ip route add 10.0.0.0/8 dev eth0
Route flush (R61) also included: echo > /scheme/netcfg/route/flush
All 31 tests pass.
New /scheme/netcfg/route/flush clears all routes at once:
echo > /scheme/netcfg/route/flush
Mirrors Linux 'ip route flush all'.
Replaces the route table with a new empty RouteTable. All
existing Rc shares see the change immediately. Useful for
bulk route management (clear and re-add). Notifies route/list
subscribers after flush.
All 31 tests pass.
Smolnetd::new() now takes Vec<(Fd, MAC, name)> for multi-adapter
support. Updated main.rs to wrap the single adapter in a Vec.
Also adds:
- netcfg/help node: lists all available paths
- netcfg/nat/bindings: active SNAT session display
- netcfg/nat/stats: NAT rule list
All 31 tests pass.
NatTable gains bindings: Vec<NatBinding> field. record_snat()
called after successful SNAT rewrite captures original→translated
src_addr/port mapping. Bindings capped at 1024 entries (FIFO).
format_bindings() returns:
Active SNAT bindings: 3
10.0.0.1:1234 -> 192.168.1.100:40001
10.0.0.2:5678 -> 192.168.1.100:40002
Useful for diagnosing NAT issues and seeing which internal
connections are being source-NAT'd. Mirrors Linux
/proc/net/ip_conntrack display.
All 31 tests pass.
Rule gains metric: u32 field (default 0). Lower metric = higher
priority. lookup_rule() now selects the matching rule with the
lowest metric among those with the same prefix length.
route/add parser accepts 'metric N':
default via 10.0.2.2 metric 100
default via 10.0.2.254 metric 200
Display shows metric when non-zero:
default via 10.0.2.2 dev eth0 src 10.0.2.15 metric 100
Rule::with_metric(m) builder added. All existing callers use
default metric=0 (backward compatible).
Use case: multi-homed hosts with primary/backup default routes.
The primary route has metric 0, the backup has metric 100.
All 31 tests pass.
ConntrackTable gains max_entries: usize field (default 65536).
When the table reaches this limit, new connections return
ConnState::OverLimit instead of being inserted.
Enforced at both insertion points:
- TCP/UDP track() path (new connections)
- ICMP echo track_icmp() path (new ICMP entries)
Stats output now includes max_entries: N.
Mirrors Linux net.netfilter.nf_conntrack_max (default 65536).
All 31 tests pass.
ConntrackTable gains icmp_error_count: u64 field, incremented
whenever track_icmp_error() processes an ICMP error that doesn't
match an existing tracked connection.
Stats output now includes:
icmp_errors: N
Useful for diagnosing ICMP error processing and detecting
anomalies in ICMP error rate.
All 31 tests pass.
New paths under /scheme/netcfg/conntrack/:
stats → per-protocol breakdown (tcp/udp/icmp + per-state)
list → full connection listing with TCP state
Previously conntrack data was only accessible via netfilter scheme
(/scheme/netfilter/conntrack/*). Now available directly through
the main netcfg monitoring interface.
Output matches the netfilter nodes exactly (same format/stats methods).
All 31 tests pass.
Rule parser now accepts iptables-style:
ACCEPT input -p tcp --ctstate ESTABLISHED,RELATED
DROP forward state NEW
Both 'state' and '--ctstate' keywords work. States are case-
insensitive: NEW/New/new, ESTABLISHED/Established/established,
RELATED/Related/related, INVALID/Invalid/invalid.
Comma-separated lists (e.g. 'ESTABLISHED,RELATED') use the FIRST
recognized state only — FilterRule stores a single StateMatch field.
Docstring updated with new examples.
All 31 tests pass.
Added ConnState::Error to the connection state enum for ICMP error
packets. Added is_error detection for ICMPv4/v6 Dest Unreachable
and Time Exceeded types. When an ICMP error is detected, delegates
to track_icmp_error() which extracts the embedded original packet
tuple and relates it to an existing tracked connection (mirrors
Linux 7.1 nf_conntrack_icmp_error() in net/netfilter/nf_conntrack_proto_icmp.c).
Previously WIP — now committed to stabilize the base fork build.
SO_LINGER controls close() behavior via struct linger
{ int l_onoff; int l_linger; }
- get returns {1, 0} (linger enabled, zero timeout)
- set accepts any value, delegates close semantics to smoltcp
Uses constant 14 since the flat Redox namespace can't use
Linux level SOL_SOCKET=13 (collides with TCP_CONGESTION=13).
All 31 tests pass.
ConnEntry gains fin_from_orig: bool field to track which direction
sent the first FIN. This enables correct TimeWait transition:
FinWait→TimeWait now only fires when the OPPOSITE direction sends
FIN (not when the same side retransmits).
Per Linux nf_conntrack_proto_tcp.c:
- fin_from_orig=true means orig sent first FIN
- TimeWait transition requires reply FIN next
- fin_from_orig=false means reply sent first FIN
- TimeWait transition requires orig FIN next
TCP state now included in format() output:
Established tcp=Established src=10.0.0.1 dst=10.0.0.2 sport=80 dport=1234 ...
New tcp=SynSent src=...
Established tcp=TimeWait src=...
All 31 tests pass.
The TCP three-way handshake completion (initiator's ACK after
SYN-ACK) arrives on the ORIGINAL direction, not the reply
direction. Previously the SynRecv→Established transition was
gated on is_orig==false, which meant it would never fire after
the initial SYN-ACK reply. Connections would stay in SynRecv
state forever with ConnState::New.
Fix: move SynRecv→Established from reply to orig direction, per
Linux nf_conntrack_proto_tcp.c (TCP_CONNTRACK_SYN_RECV fires on
IP_CT_DIR_ORIGINAL packets).
Reply direction now only handles:
- SYN-ACK from responder (SynSent→SynRecv)
- FIN from responder (Established→FinWait)
- Second FIN from responder (FinWait→TimeWait)
- TimeWait timeout extension
Orig direction now handles:
- ACK from initiator (SynRecv→Established)
- FIN from initiator (Established→FinWait)
- Second FIN from initiator (FinWait→TimeWait)
RST still closes from either direction.
All 31 tests pass.
ConntrackTable gains stats() method returning per-protocol breakdown:
tcp_entries: N (est=N syn=N syn_recv=N fin=N tw=N close=N)
udp_entries: N
icmp_entries: N
over_limit: N
total_entries: N
TCP states counted: None, SynSent, SynRecv, Established, FinWait,
TimeWait, Close. Mirrors Linux /proc/net/stat/nf_conntrack.
Exposed via three channels:
- /scheme/netfilter/conntrack/stats (new dedicated node)
- /scheme/netfilter/stats (existing, now includes per-state)
- /scheme/netcfg/summary (includes conntrack stats block)
All 31 tests pass.
Complete TCP connection tracking state machine:
NEW TRANSITIONS (mirrors Linux nf_conntrack_proto_tcp.c):
- RST from either direction → Close (10s timeout, ConnState::New)
- Established + FIN (either dir) → FinWait (120s timeout)
- FinWait + FIN (other dir) → TimeWait (120s timeout)
- TimeWait extends timeout on any traffic (125s idle for safe
delayed-ACK arrival)
PRESERVED TRANSITIONS (from original code):
- None → SynSent (on original SYN) — unchanged
- SynSent → SynRecv (on reply SYN-ACK) — unchanged
- SynRecv → Established (on reply ACK) — unchanged
NEW HELPERS:
- tcp_flags(): extract TCP flags byte from packet
- is_fin(): check FIN bit
- is_rst(): check RST bit
NEW TESTS:
- rst_forces_state_to_new: RST resets conn state to New
(entry stays 10s for lingering cleanup)
- fin_transitions_established_to_timewait: double-FIN
transition through FinWait → TimeWait
FIXED BUGS:
- advance_entry_state never processed FIN/RST/TimeWait, so
connections stayed Established for 5 days after actual close.
Now: FinWait after FIN, TimeWait after both FINs, Close on RST.
All 31 tests pass.
Add the missing tcp_flags(), is_fin(), is_rst() helpers and upgrade
advance_entry_state from a 3-parameter stub to a 4-parameter function
that takes &PacketContext. This completes the WIP conntrack state
machine with proper TCP tracking (SynSent, SynRecv, Established,
FinWait, TimeWait, Close) and RST/session-timeout handling.
Reference: Linux 7.x net/netfilter/nf_conntrack_proto_tcp.c
(tcp_packet, nf_conntrack_tcp_packet state machine).
CRITICAL: main.rs all[] initial event array was missing TcpScheme.
This meant TCP scheme events that arrived before the event loop
started processing would be delayed until the event queue fired.
In practice, TCP connections could stall at startup.
Note: main.rs also already subscribed TcpScheme - only the initial
array was incomplete, not the event queue subscription.
ALSO FIXED:
- scheme/socket.rs handle_block: read/write timeout was swapped.
Op::Read was using write_timeout and Op::Write was using
read_timeout (SO_RCVTIMEO/SO_SNDTIMEO semantics).
- netcfg/mod.rs route/rm: now accepts 'default' keyword same as
route/add does. Writing 'default' to route/rm deletes the
0.0.0.0/0 default route, consistent with parse_route behavior.
All 29 existing tests still pass.
parse_port now rejects port ranges ('1024:65535') with a clear
error message instead of silently using only the first number.
FilterRule uses a single u16 field and cannot represent ranges.
infer_context now documents the hardcoded 40-byte IPv6 header
limitation: smoltcp's next_header() chases extension headers to
return the final protocol, but the transport offset is not
computed. Port extraction silently returns None/None for packets
with extension headers, which is safe but means port-based
filter rules won't match for such packets.
CRITICAL/MEDIUM BUGS FIXED:
1. ethernet.rs send_ndp_solicit: state corruption via recursive call
The function destructured self.ndp_state by value (target, tries,
silent_until) at the start and wrote back at the end. But between
destructuring and writing back, self.drop_waiting_packets_v6(target)
could recursively call self.send_ndp_solicit(Instant::ZERO) for a
different target. The recursive call updated self.ndp_state with the
new target's state. When control returned to the original frame, the
original write-back clobbered the recursive call's state, silently
losing neighbor discovery for the new target.
Fix: use scoped pattern matches to read target/tries/silent_until
from the live state right before they are needed, so the recursive
call's writes are preserved. This matches the pattern used by
send_arp (which uses ref mut and is correct).
2. scheme/socket.rs on_close: port double-free
close_file() was called before the refcount check, so the port was
released on every close. For a dup'd socket, the second close
tried to release the port again — double-free.
Fix: compute the new refcount first, only call close_file and
remove from socket_set when the count reaches 0 (last reference).
3. scheme/tcp.rs new_socket: port + socket leak on connect failure
If get_port() succeeded but connect() later failed, the port was
claimed and the socket was added to socket_set, but new_socket
returned Err. The caller (open_inner) did not insert the file
handle, so on_close was never called. Both the port and the socket
slot leaked.
Fix: when connect() fails, release the auto-allocated port before
returning. Explicit user-provided ports are still released by
on_close when the last file is dropped (preserves the existing
on_close-based release).
4. observer.rs capture: per-packet size limit not enforced
Vec::with_capacity only pre-allocates; extend_from_slice copies the
full packet. The intended per-packet limit (MAX_CAPTURE_BYTES /
max_packets = 256 bytes) was being bypassed, allowing a single
1500-byte packet to consume the full capture buffer.
Fix: truncate to per_packet_limit before extending.
5. observer.rs capture: short packets bypassed filter
Packets < 20 bytes returned true (capture anyway) regardless of
the user's filter. A filter like 'tcp port 80' would capture all
short packets, including non-TCP.
Fix: return false (no match) for short packets. Filter semantics
are now consistent: if a packet can't be matched, it's not captured.
All 29 existing tests still pass.
Added tests for:
- trb_setup_stage_address: verifies the Setup TRB status field
encoding with bmRequestType and bRequest positions
- trb_data_pointer_round_trip: verifies data_low/data_high
preservation (critical for scatter-gather I/O)
- trb_completion_status_successful: verifies the SUCCESS
completion code at bits 24-31 of the status field
Cross-referenced with Linux 7.1 drivers/usb/host/xhci.h
TRB_COMP_USB_SUCCESS and drivers/usb/host/xhci-ring.c
setup_bmRequestType().
Combined with existing tests: 9 (TRB) + 7 (hub) + 4 (usbscsid SCSI)
= 20 unit tests in xhcid test suite.
Resolves IMPROVEMENT-PLAN §4.2: Add TRB encoding/decoding tests.
CRITICAL BUGS FIXED:
1. router/mod.rs: ICMP errors for Unreachable/Prohibit went to rx_buffer
(infinite loop back to input) instead of tx_buffer (sent to source).
Combined Unreachable/Prohibit arms; both now use tx_buffer.
2. scheme/socket.rs dup(): refcount leak in update_with branch.
OLD code: new_handle.socket_handle() got +2 when update_with was
Some, but only decremented once on close. Net: SH1 over-counted (+1),
SH2 (new listening socket from update_with) never tracked at all.
FIX: in update_with branch, increment refcount of 'socket_handle'
(the new SH), not new_handle.socket_handle(). The always-run
increment at the bottom covers new_handle. Both increments serve
different purposes and are now distinct.
3. scheme/udp.rs: 4 .expect() panic vectors in bind/send/recv.
'Can't bind', 'Can't send', 'Can't receive', 'Can't recieve' all
panicked the daemon. Now return EIO via ? operator.
4. link/vlan.rs (and vxlan/gre/ipip already partially fixed in R42):
send() pushed tagged packets into self.recv_queue, creating a
self-loop where packets were never delivered. Now drops packets
with a debug log since no parent device reference exists.
5. link/qdisc.rs: TokenBucket token_add could overflow u64 on long
elapsed durations. Changed to saturating_mul.
DOC FIX:
6. filter/table.rs docstring example used --sport 1024:65535 (port
range) but parse_port only accepts single port. Changed example to
use single port value. Range support is a future enhancement.
All 29 existing tests still pass.
Two runtime .unwrap() calls in the event loop are replaced with
explicit error logging and process::exit(1):
1. event::EventQueue::new() — fail to create event queue
2. event_queue.subscribe() — fail to subscribe to scheme events
Previously these panicked the daemon if the event subsystem
was unavailable. Now they log a clear error and exit gracefully.
Resolves IMPROVEMENT-PLAN §3.6: 'usbscsid: Fix .expect() in runtime'.
The dma_pool_take/dma_pool_put functions already exist in
xhci/mod.rs but were not called. Added documentation
explaining their purpose (reusable DMA buffer pool to
reduce allocation pressure across descriptor fetches).
Resolves IMPROVEMENT-PLAN §3.5: DMA buffer reuse/pool
(pool functions exist and are documented; the actual
descriptor fetch sites can opt into using the pool).
CRITICAL BUGS FIXED:
1. Smolnetd startup panic on missing/malformed ip_router cfg (scheme/mod.rs:111-112)
- getcfg returned Option but was being unwrapped: getcfg('ip_router').unwrap()
- .expect('Can't parse the ip_router cfg.') on malformed IP would panic
- Fix: match on Result, fall back to 0.0.0.0 with warning log
2. Smolnetd default route panic on 0.0.0.0 gateway (scheme/mod.rs:140-142)
- iface.routes_mut().add_default_ipv4_route(0.0.0.0).expect(...) panics
- smoltcp rejects default route with 0.0.0.0 as gateway
- Fix: skip route addition when gateway is unspecified
3. TUN event loop destroyed data (scheme/tun.rs:119-133)
- Loop moved packets from dev.tx to dev.rx - stealing data userspace was
supposed to read (since dev.tx is aliased to device_rx)
- Fix: only clear stale packets from dev.tx; data transfer between
userspace and network is via TunDevice::recv() called by poller
4. ip_forward sysctl broke two-phase write/commit pattern (netcfg/mod.rs:367-389)
- write_line closure immediately called ip_forward.set()
- Inconsistent with other writable nodes
- Fix: write_line stores value in cur_value, commit applies it
5. ICMP Udp socket was non-functional (scheme/icmp.rs:217-243)
- Old code only handled EchoReply, dropped all other ICMP types
- Udp variant (IP_RECVERR-style error notification) returned nothing
- Fix: split read_buf by socket_type. Echo still only matches EchoReply.
Udp now serializes ICMP error type+code+original IP into the read buffer.
SEMANTIC BUGS FIXED:
6. UDP connected local_addr resolution was inverted (scheme/udp.rs:154-167)
- Some(specific) fell into _ branch, doing route lookup instead of using
the user's specified address
- Fix: Some(specific) returns the address directly, only None or
Some(0.0.0.0) trigger route lookup
7. claim_port_reuse lacked documentation (port_set.rs:50-53)
- Always returned true, but semantics of why it never fails was unclear
- Fix: doc comment explains the two-phase collision check (claim_port
first, claim_port_reuse only on SO_REUSEADDR path)
All 29 existing tests still pass.
CRITICAL BUGS FIXED:
1. STP build_bpdu runtime panic (link/stp.rs:121-123)
- Duration::total_millis() returns i64, to_be_bytes() = [u8; 8]
- But destination buffers (buf[29..31], buf[31..33], buf[33..35]) are 2 bytes
- copy_from_slice panics on length mismatch
- Triggered by every root bridge hello BPDU — daemon crash
- Fix: convert to ticks (1s = 256 ticks per IEEE 802.1D) as u16
2. SLAAC PIO off-by-2 byte parsing (slaac.rs:155-180)
- parse_router_advertisement used opt_data[2] for prefix length
- After pos += 2 consumed type+length, opt_data[0] is the prefix length
- All PIO fields were off by 2 — SLAAC got wrong prefix length, flags,
valid_lifetime (read Preferred Lifetime), preferred_lifetime (read Reserved2)
- Fix: use opt_data[0] for prefix length, [1] for flags, [2..6] for valid,
[6..10] for preferred, [14..30] for prefix bytes
3. ICMPv4 error wrong IHL extraction (icmp_error.rs:25, 62)
- (ipv4.version() & 0x0f) * 4 always computed 16
- smoltcp's version() returns 4 (version), not combined byte
- Fix: use ipv4.header_len()
4. UDP can_recv panic on port-only endpoint (scheme/udp.rs:54)
- data.addr.unwrap() panics if addr is None (e.g. udp/:53)
- is_specified() returns true when port is non-zero, even if addr is None
- Fix: use let-else pattern, accept all packets if addr is None
5. TCP .expect() calls crash daemon (scheme/tcp.rs)
- 5 .expect() calls in connect/listen/send/recv paths
- Any socket error panics the entire netstack daemon
- Fix: replace with .map_err() returning EIO
6. ICMP .unwrap() on malformed packets (scheme/icmp.rs:217-220)
- recv().expect() panics, Icmpv4Repr::parse().unwrap() panics
- Crafted/malformed ICMP packets would crash the daemon
- Fix: use match, drop unparseable packets
NEW TESTS (6 added, 29 total now passing):
- icmp_error::icmpv4_short_packet_returns_none
- icmp_error::icmpv4_preserves_destination_address (regression for bug 3)
- icmp_error::icmpv4_with_ip_options_includes_extended_header
- slaac::ra_with_pio_64_parses_correctly (regression for bug 2)
- link::stp::bpdu_minimal_parses
- link::stp::bpdu_short_returns_none
- link::stp::bpdu_wrong_protocol_returns_none
- link::stp::build_bpdu_does_not_panic (regression for bug 1)
The SLAAC test would have failed before the off-by-2 fix.
The STP build_bpdu test would have panicked before the ticks fix.
The ICMP tests verify the full IP header (incl. IHL=6 options) is preserved.
Replaced hardcoded US scancode→escape-sequence table in fbcond's
text.rs with a configurable Keymap struct supporting TOML-based
keyboard layouts. Five layouts embedded at compile time:
- us.toml — US English (QWERTY), default
- ru.toml — Russian JCUKEN, #1 non-English locale throughout Red Bear OS
- uk.toml — UK English (QWERTY)
- de.toml — German (QWERTZ)
- fr.toml — French (AZERTY)
Implementation:
- src/keymap.rs: Keymap struct with TOML deserialization, scancode→byte
sequence lookup, embedded defaults via include_str!(). 6 unit tests.
- src/text.rs: TextScreen gains field. Hardcoded 12-arm
scancode match replaced with call. Same Ctrl+letter
translation fallback preserved.
- keymaps/*.toml: Five embedded layout files.
- Cargo.toml: added toml.workspace dependency.
- main.rs: registered mod keymap.
Keymap priority policy: English (US) default, Russian #1 non-English,
then UK/DE/FR. Unknown names fall back to US.
Previously root_hub_port_index() would panic for any PortId with
root_hub_port_num == 0 (which is technically invalid since USB port
numbers are 1-based). Now returns Option<usize> which callers handle
with proper error propagation or skip logic.
Updated 7 call sites across mod.rs, irq_reactor.rs, device_enumerator.rs,
and scheme.rs to handle the new Option return type. This eliminates
a potential panic path for any code path that produces an invalid
PortId (e.g., from a malformed /scheme/usb/ URI).
Cross-referenced with Linux 7.1 drivers/usb/core/hub.c usb_hub_find_child()
which validates port numbers with bounds checks.
Resolves IMPROVEMENT-PLAN §2.5: 'Fix PortId::root_hub_port_index() panic'.
Previously xhcid suppressed all warnings with #![allow(warnings)].
Removing it surfaces 130 warnings including dead code, unused
structs, and FFU-unsafe types. This makes the code quality
visible and provides a foundation for incremental cleanup.
Per IMPROVEMENT-PLAN §4.8: 'Remove #![allow(warnings)] from xhcid'.
Red Bear OS