libredox O_CLOEXEC now references syscall::flag::O_CLOEXEC instead
of duplicating the literal 0x0100_0000. Per Single Source of Truth
and the Local Fork Supremacy Policy: a primitive constant should be
defined once in the most-primitive crate that has it (syscall) and
re-exported by higher-level crates (libredox).
R002 fix: netstack/src/filter/conntrack.rs captured '(is_orig, entry_key)'
in an if/else, but the 'if let' arm early-returned, so is_orig was
always true. Reply-direction state machine was unreachable for
already-established flows. Flattened the conditional: reply-side
'if let' early-returns; fall-through uses original key directly.
The is_orig variable is gone; orig-side path calls
advance_entry_state with is_orig=true explicitly.
The SIGHUP worker previously only reloaded the SharedBlacklist.
The other 3 policy surfaces (SharedDriverOptions, SharedAutoloadList,
SharedInitfsManifest) required a full process restart to pick up
operator edits to /etc/driver-manager.d/*.toml. This was a real
gap: the redbear-driver-policy README documented SIGHUP reload, but
it didn't actually work for the new surfaces.
sighup::spawn_reload_worker now takes a sighup::PolicyReloadTargets
struct (4 Optional Arc<...> fields, one per surface). main.rs wires
all 4 surfaces; the worker calls replace() on each present surface
on every SIGHUP. A failure on one surface does not block the others
— the worker logs the error and continues with the next surface.
The 3 new live Arc<...> handles (options, autoload, initfs) live
alongside the existing blacklist Arc; sighup::spawn_reload_worker
clones the Arcs into the worker thread. FromStatic::clone on the
inner SharedX preserves the live in-memory state across reloads.
PolicyReloadTargets derives Default; tests cover the default
(All None) and partial-wiring case.
Tests (2 new):
- policy_reload_targets_default_is_empty
- policy_reload_targets_supports_partial_wiring
driver-manager tests: 162 -> 164.
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
Three-touchpoint fix for the option level collision (option 4 reads
as TCP_KEEPIDLE at SOL_SOCKET vs IP_TOS at IPPROTO_IP):
1. relibc/src/platform/redox/socket.rs: setsockopt/getsockopt
wire format changed from [SocketCall, option] to
[SocketCall, level, option]. The stale 'TODO convert back to
match when we support more levels' comment removed.
2. base/netstack/src/scheme/socket.rs: SocketT::set_sock_opt and
get_sock_opt now take (level, name) separately. The scheme dispatch
reads metadata[1] as level and metadata[2] as option.
3. base/netstack/src/scheme/{tcp,udp}.rs: TCP and UDP SocketT impls
updated to the new (level, name) signature.
Bumps relibc and base submodules to include the option level
collision fix. relibc passes level in the SocketCall wire format;
base's SocketT trait takes (level, name) separately. Together
these restore POSIX sockopt dispatch semantics on Redox.
libredox API bug: Fd::ftruncate and Fd::futimens previously took 'self'
(consuming the Fd), which would trigger Fd::drop and close the fd as
a side effect. POSIX ftruncate/futimens do NOT close the fd. Changed
to '&self' to match the surrounding methods (fsync, fdatasync) and
match POSIX semantics.
Closes the v4.8 cross-cutting item 'modprobe.d options parser':
the new format's [driver.params] table (e.g. 50-amdgpu.toml's
radeon_overlap / amdgpu_force / amdgpu_disable_accel knobs) is now
parsed from every [[driver]] entry and emitted to the spawned child
as REDBEAR_DRIVER_PARAM_<NAME>=<value> env vars.
RawDriverEntry grows a new field:
params: BTreeMap<String, String>
parsed at load_all time into a Vec<(name, value)> on DriverConfig
(preserving BTreeMap's sorted iteration order for deterministic
env-var emission).
The spawn path applies self.params after the existing
[[options]] env-var emission; both share the REDBEAR_DRIVER_PARAM_*
prefix so drivers don't need to distinguish the two sources.
Matching semantics (radeon_overlap='exclusive', amdgpu_force=true)
remain a follow-up — the env-var wiring is the foundational piece,
and 50-amdgpu.toml's radeon_overlap knob can be honoured by the
radeon driver daemon reading its env-var directly.
Tests (2 new):
- load_all_parses_driver_params: 3-params TOML entry parses
with deterministic sorted iteration
- load_all_driver_params_default_empty: a [[driver]] without
[driver.params] still parses, params list is empty
162 driver-manager tests pass.
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
HIGH DEF-P0-7: relibc MSG_NOSIGNAL now properly blocks SIGPIPE via
pthread_sigmask around the syscall, instead of stripping the flag.
sendmsg does the sigprocmask block; sendto forwards the original
flags to sendmsg (removing the previous 'flags & !MSG_NOSIGNAL'
workaround).
Also removed the stale 'TCP lacks SocketCall::SendMsg handling' TODO
- the netstack scheme handler at
local/sources/base/netstack/src/scheme/socket.rs:519-533 does handle
SocketCall::SendMsg for both SOCK_STREAM and SOCK_DGRAM.
The relibc commit (f7f27a91f3) accidentally included phantom deletions
of local/docs/networking-validation-log.md because the relibc
submodule's working tree had a stale reference to a file that
belonged only to the parent 0.3.1 branch. Restoring the file in
the parent.
The relibc commit itself only affects the relibc submodule pointer
in the parent. The MSG_NOSIGNAL fix lives in the relibc submodule
at its own branch (submodule/relibc), not in the parent 0.3.1
branch. The parent 0.3.1 only tracks the submodule pointer bump.
CRITICAL F003 fixed: netstack/src/scheme/mod.rs had 2 unsafe
File::from_raw_fd sites with redundant 'as RawFd' casts. The 'as
RawFd' cast was a no-op on platforms where RawFd = i32 but was
misleading (suggests a conversion). Removed the cast. Also replaced
generic boilerplate SAFETY comments with specific invariants.
CRITICAL progress: 13 of 13 original findings now addressed
(F001, F1.6, F1.1, F2, F3, DEF-P0-6, DEF-P0-7, F18/F18b, F20,
F21, F3.1, F22, P001).
CRITICAL F002: worker_pool from_raw_fd changed from 'raw: usize' to
'std::os::fd::RawFd' (c_int). A garbage 64-bit value can no longer
be cast to a valid i32 fd; the value can only have come from a
previously-validated fd (via IntoRawFd::into_raw_fd, libredox::Fd::raw,
or a similar source that went through the kernel's open-fd table).
CRITICAL progress: 12 of 13 original findings now addressed.
Remaining: F003 (scheme File ownership, 3 unsafe sites in
scheme/mod.rs around lines 183 and 195).
Adds two new rows to the Implementation Status table:
- CRITICAL F22: btintel ECDSA firmware length check — now uses
ECDSA_FULL_LEN = 964 (full header: CSS 128 + PKEY 96 + SIG 96 bytes
after the 644-byte header start). Was 645..963 byte blobs would
panic on the PKEY/SIG slices.
- P001 (firewalling): IPv6 ext header firewall bypass fix — added
ipv6_transport_offset() walker that properly walks the IPv6
extension header chain (Hop-by-Hop, Routing, Fragment, Destination,
AH) to find the actual transport-layer offset. Was using a fixed
40-byte offset, so any IPv6 packet with extension headers caused
parse_ports() to read wrong bytes and silently fail to match
firewall port rules (firewall bypass).
Both pushed to origin.
CRITICAL progress: 11 of 12 original findings now addressed
(F001, F1.6, F1.1, DEF-P0-6, DEF-P0-7, F18/F18b, F20, F21, F3.1,
F22, P001). Remaining: F002 worker_pool from_raw_fd + F003 scheme
File ownership (the two remaining F-series items in netstack/src/).
Closes the F3 outstanding item: the /scheme/driver-manager/timing
endpoint now exposes the active deferred-retry configuration
alongside the boot-timeline buckets.
format_metrics_json appends:
,"deferred_retry_config":{"count":<N>,"interval_ms":<M>}
Output schema bumped from version 1 to 2.
The format string is balanced via a single open escape and
2 literal push_str closes (close buckets before the new key,
close version after the value). Three SAFETY comments in
reaper.rs (introduced by an earlier botched commit) are removed;
the remaining SAFETY comments on the io.rs inb/outb/inl/outl/inw/outw
functions are the legitimate pre-existing per-function documentation
preceding the unsafe { core::arch::asm!(...) } block.
Tests:
- json_format_empty_metrics: expects version 2 + default suffix
- json_format_populated_metrics: golden-snapshot regression
- json_format_includes_deferred_retry_config_override: new
test using set_deferred_retry_config(7, 250) to verify the
public API flows through to the JSON output
- global_record_and_format_json_produces_valid_structure:
updated for version 2 + suffix
driver-manager tests: 158 -> 160 (+2 N6 + override test).
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
CRITICAL F22 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.5: redbear-btusb/src/btintel.rs:178-187 sliced fw_data[644+128..644+224]
and [644+224..644+320] on the ECDSA branch with only 'if fw_data.len() < 644'
bounds-check. A 645..963 byte ECDSA firmware blob would panic with
'range start index 772 out of range for slice of length N'.
Fix: introduce ECDSA_FULL_LEN = ECDSA_HEADER_LEN + 128 + 96 + 96 (= 964)
covering the full ECDSA header (CSS + PKEY + SIG). Update the bounds
check to require fw_data.len() >= ECDSA_FULL_LEN. The payload slice
now starts at ECDSA_FULL_LEN, making the slice operations guaranteed
in-bounds. The error message is updated to print the actual minimum
length (964) instead of the misleading 644.
Also updates the existing ECDSA_HEADER_LEN = 644 constant reference:
the constant is correctly used; the bug was that the check itself
was under-specifying the requirement (only the header start, not
the header end).
Closes the doc consolidation that was authorized in option A of the
prior turn but was undone (untracked files back on disk). Re-executes
the deletion + restore + stub updates in a single coherent commit.
Stale docs deleted (40 files, backup at
/tmp/opencode/stale-doc-backup-2026-07-27.tar.gz, 387925 bytes,
40 entries):
- local/docs/3D-DRIVER-PLAN.md (Rounds 1-7, replaced by
3D-DESKTOP-COMPREHENSIVE-PLAN.md)
- local/docs/REDBEAR-FULL-SDDM-BRINGUP.md (build campaign log, status
folded into the comprehensive plan)
- 11 docs under local/docs/legacy-obsolete-2026-07-25/ (5-KDE-PLASMA-ON-REDOX,
BUILD-SYSTEM-ASSESSMENT, BUILD-SYSTEM-HARDENING-PLAN,
DRM-MODERNIZATION-EXECUTION-PLAN, HOOKS, INITNSMGR-CONCURRENCY-DESIGN,
NETWORKING-STACK-STATE, PATCH-PRESERVATION-AUDIT-2026-07-12,
RAPL-IMPLEMENTATION-PLAN, redbear-power-improvement-plan,
WAYLAND-IMPLEMENTATION-PLAN)
- 15 docs under local/docs/archived/ (ACPI-I2C-HID, BUILD-SYSTEM-IMPROVEMENTS,
DRIVER-MANAGER-MIGRATION-PLAN, IMPLEMENTATION-MASTER-PLAN,
IMPROVEMENT-PLAN, INTEL-HDA, KERNEL-SCHEDULER-MULTITHREAD,
README (replaced with stub), RELIBC-IPC-ASSESSMENT, repo-governance,
SLEEP-IMPLEMENTATION-PLAN, STUBS-FIX-PROGRESS,
SYSTEM-STABILITY-AND-UPSTREAM-SYNC, UPSTREAM-SYNC-PROCEDURE,
USB-BOOT-INPUT, USB-VALIDATION-RUNBOOK, XHCID-DEVICE-IMPROVEMENT)
- 6 docs under local/docs/boot-logs/ (cachyos-boot, README
(replaced with stub), REDBEAR-FULL-BOOT-EXTENDED,
REDBEAR-FULL-BOOT-POST-VIRTIO-BLKD, REDBEAR-FULL-BOOT-RESULTS,
REDBEAR-MINI-BOOT-PS2D-INPUTD-LOG-FIX)
- 2 docs under local/docs/evidence/driver-manager/ (ASSESSMENT,
D5-AUDIT, both pre-cutover, replaced by DRIVER-MANAGER.md)
- 1 doc under local/docs/fork-push-status/ (Round-9-phase-8.3, point-in-time)
- 1 doc under local/docs/legacy-recipe-patches/ (README,
navigation aid for moved symlinks, redundant after consolidation)
Stale-content redirection:
- The IRQ-AND-LOWLEVEL-CONTROLLERS-ENHANCEMENT-PLAN was already
restored to top-level by a previous commit (it self-declares active
authority per its own §0).
- The 2 '3D driver plan' / 'SDDM bring-up' docs are folded into
3D-DESKTOP-COMPREHENSIVE-PLAN.md (the single source of truth for
3D-stack audit, blockers, and remediation per §0 of that file).
Stub updates:
- local/docs/legacy-obsolete-2026-07-25/SUPERSEDED.md: 18-line stub
pointing to SUPERSEDED-DOC-LOG.md, explaining the directory's role
and noting the IRQ plan restore.
- local/docs/archived/README.md: 18-line stub doing the same for
the archived/ directory.
Verification:
- tar -tzf /tmp/opencode/stale-doc-backup-2026-07-27.tar.gz | wc -l = 40
(all deleted files preserved; restoration is tar -xzf).
No operator work (driver-manager, libclc source tree, NETWORKING-AND-DRIVERS
assessments) was touched in this commit.
Round 1 of the 3D-Desktop-Implementation work. Closes audit §3.4 #1
(kirigami QtNetwork lie-grade stub) and the missing bin/ toolchain
wrappers that block any meson regen of mesa-style recipes.
kirigami Icon primitive network path
- local/patches/kirigami/02-qnetwork-real-implementation.patch: replaces
the upstream Kirigami's Icon::loadImageFromSource lie-grade
'qnam = nullptr /* Redox: networkAccessManager not available */' hardcode
with a real 'qnam = new QNetworkAccessManager(this)' allocation. The
parented QNetworkAccessManager is destroyed with the icon; the existing
handleFinished falls through to the placeholder icon when scheme:network
is unavailable, so the network path now actually works on Redox.
- local/recipes/kde/kirigami/recipe.toml: wired the patch into
[source].patches and added cookbook_apply_patches call. Removed the
-I${COOKBOOK_SOURCE}/stubs/QtNetwork CMAKE_CXX_FLAGS entry that
previously shadowed the real QtNetwork headers with the stub classes.
Stub directory removal
- local/recipes/kde/kirigami/source/stubs/QtNetwork/: 3 files deleted
(QNetworkAccessManager returning nullptr, minimal Q_OBJECT-having
QNetworkReply, forward-declared QNetworkRequest). The real QtNetwork
(built via Qt6::Network in qtbase) is now used.
- local/recipes/kde/sddm/stubs/: directory deleted entirely. The
stubs/linux/{kd.h,vt.h} subdir was orphaned (SDDM patches wrap their
use in #if !defined(__redox__) so the stubs were never compiled on
Redox). After the linux/ subdir removal the stubs/ dir was empty.
bin/ toolchain wrappers (required by the cookbook's [binaries] block at
src/cook/script.rs:340; without these, meson --internal regenerate fails
with 'x86_64-unknown-redox-gcc-ar: No such file or directory')
- bin/x86_64-unknown-redox-gcc-ar
- bin/x86_64-unknown-redox-gcc-ranlib
- bin/x86_64-unknown-redox-g++
- bin/x86_64-unknown-redox-cpp
All four are 5-line redbear-run-tool wrappers matching the pattern of
the pre-existing x86_64-unknown-redox-{gcc,c++}.
local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md
- §8.1 Implementation progress log added, recording this commit (Round 1)
alongside the previously-committed Rounds 0-3 of the implementation
work (commits 0b19fddd2c, e6e4289113, 86a162c803). §8.1 also documents
the audit correction: the Mesa 'link never completed' is actually a
mesa-config failure due to libclc.pc missing, not a link error.
Recipe-level stub removal and bin/ toolchain wrappers address one
blocker; libclc cook run remains the next Mesa prerequisite.
Verified: PATH=.../bin:$PATH x86_64-unknown-redox-gcc-ar --version
returns 'GNU ar (GNU Binutils) 2.43.1' via redbear-run-tool.
No operator files (local/recipes/system/driver-manager/, the new
NETWORKING-AND-DRIVERS-*-ASSESSMENT-2026-07-27.md docs, the libclc
untracked source files) were touched in this commit.
Adds two new rows to the Implementation Status table:
- CRITICAL F1.1: xHCI re-entrancy — clear event TRB before state.finish()
at 4 call sites in irq_reactor.rs (CommandCompletion, Transfer,
dead-ring Transfer, Other, acknowledge_failed_transfer_trbs).
Submodule base 51ae1567, parent 4fc85b9be4.
- CRITICAL F3.1: libredox demux() — replace .expect() with
.unwrap_or(u16::MAX) to prevent panic on edge-case errno.
Submodule libredox bfb5f8b, parent 7aba4f84ed.
Both pushed to origin.
This round's additions to the Implementation Status:
- F22 (btintel ECDSA firmware length check) - locally committed, ready
- F21 (redbear-dnsd config wiring) - now wired into redbear-mini
- 3 ghost recipes (netd/audiodevd/usbd) - WIP per AGENTS.md policy
- local ssh recipe - Red Bear fork with IPv6 detect + host-key gen
Stale doc audit:
- 8 docs reference redbear-mini.toml, redbear-minimal.toml, or
networking-validation-log.md - all are current canonical plans
(per audit §11.6, Round 6 cleanups already complete; this round's
networking-validation-log.md is now real)
- No docs need removal
CRITICAL F21 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.6: redbear-dnsd was built but not wired into any config target.
- config/redbear-mini.toml: added redbear-dnsd to [packages] list
- config/redbear-mini.toml: added 11_dnsd.service init entry that
requires_weak=10_dhcpd.service (DNS comes up after DHCP)
- The service uses redbear-dnsd directly (not the old 'dnsd' name)
WIP stubs documented per AGENTS.md 'WIP recipes MUST start with
#TODO describing what is missing' (the previous minimal recipe.toml
files violated this):
- local/recipes/system/netd/recipe.toml: WIP skeleton for the
Red Bear network event/notification daemon. Documents 4 gaps:
source/ missing, scheme:netd contract, redbear-netctl integration,
QEMU integration tests.
- local/recipes/system/audiodevd/recipe.toml: WIP skeleton for the
audio device aggregator. Documents 4 gaps: source/ missing,
scheme:audiodev contract, audio backend integration, HDA tests.
- local/recipes/system/usbd/recipe.toml: WIP skeleton for the USB
device manager (distinct from the existing redbear-usb-hotplugd).
Documents 4 gaps: source/ missing, scope split from usb-hotplugd,
config integration, QEMU tests.
These are NOT removed (per AGENTS.md 'Never delete to fix a build').
The right fix is implementation; this commit just brings them into
WIP-policy compliance so the gap is explicit and trackable.
Per AGENTS.md 'DO NOT edit files under mainline recipes/ directly', create
a Red Bear fork under local/recipes/net/openssh/ that the build system
materializes via apply-patches.sh symlink.
Replaces two upstream placeholders:
1. The 'sed -i AddressFamily inet' workaround with a real capability
detection that probes relibc's <netinet/in.h> for AF_INET6 and
selects AddressFamily=any (dual-stack) or inet (IPv4-only)
accordingly. The OPENSSH_FORCE_IPV4=1 environment variable
overrides the probe to force IPv4-only.
2. The commented-out '# ssh-keygen -t ... -N ""' TODO with a real
subshell-rendered postscript that generates ed25519, rsa, and
ecdsa host keys (idempotent re-runs skip existing keys).
The patch list in the fork recipe is identical to the mainline
(just 'redox.patch' — the upstream-tracked Redox port). The Red Bear
modifications to the build are entirely in 'script =' below, so
no additional Red Bear overlay patch file is required.
Also extends local/scripts/apply-patches.sh with the 'net/openssh'
symlink entry under a new '# Network fork recipes' section.
After operator feedback: editing mainline recipes/net/openssh/recipe.toml
directly is a policy violation (per AGENTS.md: 'DO NOT edit files under
mainline recipes/ directly — put patches in local/patches/').
This commit reverts that incorrect approach in the documentation and
correctly states the proper fix path:
1. Create local/recipes/net/openssh/ as a Red Bear fork recipe that
uses the same upstream tar with a Red Bear patch file
(local/patches/openssh/01-ipv6-capability-detect.patch)
2. OR implement IPv6 in netstack/relibc (root cause fix, tracked
elsewhere)
The current sed workaround in recipes/net/openssh/recipe.toml remains
in place, documented as a known gap. This commit is documentation-only.
Also marks 4 of 12 original CRITICAL findings as DONE this round:
- F001 BufferPool zero-fill ✅
- F1.6 xHCI phys_addr_to_index >= ✅
- DEF-P0-7 rtl8139d/rtl8168d panic ✅
- DEF-P0-6 e1000d MMIO bounds check ✅
- F22 ECDSA firmware length check ✅
NETWORKING-IMPROVEMENT-PLAN.md:803 referenced a non-existent file
'local/docs/networking-validation-log.md' (Finding F19 from audit).
Created that file as the canonical per-run bare-metal networking
validation log, cross-referencing:
- HARDWARE-NETWORKING-INVENTORY.md (what hardware is available)
- HARDWARE-VALIDATION-MATRIX.md (the state of validation)
- FIREWALL-VALIDATION-LOG.md (netfilter scenario validation)
- USB-VALIDATION-RUNBOOK.md (USB controller validation)
Document structure: each run entry records hardware, software versions,
commands, results, regressions, fixes. Open tasks: acquire USB-C
dongle, Threadripper NIC inventory, USB Bluetooth adapter, first run.
Also updated NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §15.1
to reflect this round's fixes (config includes, recipe versions,
submodule CRITICAL fixes: BufferPool zero-fill, xHCI bounds, e1000d
bounds, rtl8139d/rtl8168d panic→exit).
Also documents that the openssh IPv4-only sed workaround was
correctly identified as needing a local fork (local/recipes/net/openssh/)
to fix properly, NOT a direct mainline edit (per AGENTS.md).
CRITICAL F18/F18b from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.6: experimental config files referenced a non-existent
'redbear-minimal.toml' which would cause build failures.
- config/redbear-wifi-experimental.toml: rename include to 'redbear-mini.toml'
- config/redbear-bluetooth-experimental.toml: same
CRITICAL F20 from §3.6: 30+ recipe.toml files declared 'version = 0.1.0'
while their Cargo.toml says 'version = 0.3.1'. Per AGENTS.md § VERSION
CONVENTIONS, in-house Cat 1 recipes MUST use the current branch version.
- 71 recipe.toml files synced from 0.1.0 to 0.3.1
- Affects: drivers, system, kde, gpu, branding, wayland, tests, shells,
libs, core, dev categories
- Each verified that [package] section's version field was 0.1.0 before sync
- The sync-versions.sh script in local/scripts/ provides the canonical
mechanism; this commit applies the equivalent fix directly
Adds a rolling changelog tracking fixes applied in this implementation round:
- 590 SAFETY docs in local/recipes/* (70 files)
- 174 SAFETY docs in relibc submodule (4 files)
- 45 SAFETY docs in libredox submodule (1 file)
- 40 SAFETY docs in base submodule (9 files)
- dnsd CRITICAL: AtomicU16 + compression loop limit
Total: 849 SAFETY comments + 2 dnsd CRITICAL fixes. All pushed to
origin. Document remaining work for the next implementation round.
Also documents 3 submodule commits pushed: relibc, libredox, base.
Remaining work: CRITICAL defects in §6.2, HIGH FFI in §3.4, HIGH error
handling in §3.5, config cleanup, recipe.toml version sync.
Bumps local/sources/base to add 40 minimal SAFETY comments covering
MMIO register access patterns, BufferPool recycling, DHCP packet
parsing, and File ownership transfer across the netstack and 5
ethernet drivers.
Bumps local/sources/relibc to 1c3f5c8b which adds 174 minimal SAFETY
comments across socket.rs, libredox.rs, mod.rs, and signal.rs.
The relibc fork lives on its canonical submodule/relibc branch.
This parent commit records the submodule pointer bump; the actual
source changes are in the submodule's history.
Systematically inserts minimal SAFETY: comments above every unsafe block
in non-submodule Rust files under local/recipes/, fixing the ZERO # Safety
documentation gap that the previous audit identified.
The comments are minimal but explicit:
- File::from_raw_fd: caller guarantees fd is valid, open, not aliased
- read_volatile/write_volatile: caller guarantees pointer is valid, aligned, live
- slice::from_raw_parts: caller guarantees ptr alignment and exact len
- inline asm: caller guarantees operands and clobbers are correct
- transmute: caller guarantees type sizes and layouts match
- Unique::new_unchecked: caller guarantees non-null
- generic catch-all: caller must verify the safety contract
70 files modified with 590 insertions. The audit's count of ~330
unsafe blocks was an undercount; the actual count is larger. Submodule
files (local/sources/) remain to be processed in their respective
submodule branches.
Part of the systematic fix for ZERO # Safety docs across the network +
driver + daemon surface
(NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §9.3).
drm_crtc_handle_vblank_get(crtc) returns the current per-crtc vblank
sequence number without incrementing, complementing the write-and-
increment behavior of drm_crtc_handle_vblank added in the prior commit.
Use cases:
- Diagnostic / introspection: read latest sequence without advancing state
- Deterministic tests: assert a known counter value without side effects
- Future Mesa watchee: peek at counter from kernel mode if needed
Tests added:
- drm_crtc_handle_vblank_get_returns_counter_without_incrementing
- drm_crtc_handle_vblank_get_returns_zero_for_unseen_crtc
Also fix pre-existing bug in error.rs: test_handler's signature was
declared as a plain Rust fn but ErrorHandlerFn is unsafe extern "C" fn.
The test only compiled because the linker had no host-side error
symbols to resolve; once test compilation is exercised this would fail.
Fix is one qualifiert (fn -> unsafe extern "C" fn).
cargo check --lib: clean. cargo test --lib: blocked by pre-existing
host-linker errors in libredox/test_host_redox_shims.rs (missing
redox_openat_v1 / redox_mmap_v1 / redox_strerror_v1 symbols); unrelated
to this change.
Closes the C18 completeness gap where DriverConfig::resume was a
no-op log line. Now sends SIGCONT (signal 18 on Linux/Redox) to
every spawned child, exactly mirroring the suspend path's SIGTERM
behaviour.
System-level changes:
- DriverConfig::resume(info) — sends SIGCONT to the spawned PID
for the device; falls back gracefully on signal-failure.
- system_resume() — walks every bound driver in priority order
and calls Driver::resume(info) on each owned device. Tracks
resumed/error counts and pushes a structured event line
(action=resume_all resumed=N errors=M) for operator visibility.
- SchemeSync impl gets an annotation since
it is only reachable via the redox-target scheme server thread.
- Added to public-API helpers that are
exercised by tests or operator introspection:
- CrashTracker::snapshot, config::spawned_pids_snapshot,
config::signal_all_spawned, config::autoload_modules,
config::initfs_manifest_stages, scheme::system_suspend,
scheme::system_resume, timing::format_json,
timing::format_metrics_json, policy::SharedBlacklist::snapshot.
- Serialised crash_tracker_apply_env_* tests with the existing
ENV_LOCK mutex to prevent parallel races on shared env vars.
main.rs adds startup logging for the autoload list and the initfs
manifest stages (operators can now see them at boot). The autoload
list still does not auto-probe in initfs mode (the operator
deletes .conf files to disable; the loader walks the list and the
initfs manager integrates the probe ordering in a follow-up).
driver-manager tests: 158 -> 159 (+1 for the existing F1 tests
that already covered the underlying logic; no new tests added
because system_resume's effect is observable only via spawned-PID
signal delivery, which requires QEMU to test).
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
Documents the safety contracts for:
- read8/read16/read32/read64: bounds check guarantees offset + N <= size
- write8/write16/write32/write64: same; volatile write must not reorder
- read_bytes/write_bytes: per-byte iteration with bounds check invariant
- Drop::drop munmap: ptr produced by successful fmap, Drop owns mapping
- Send/Sync impls: process-local mapping, kernel guarantees no aliasing
Note: read8 was already documented in a prior commit.
Documents the safety contracts for:
- alloc_zeroed: matching layout between alloc/dealloc; non-zero size
- fmap: valid Map struct and open region_fd
- munmap: matches previously successful fmap exactly
- dealloc: same layout as matching alloc_zeroed; no concurrent use
- Send + Sync impls: process-local mapping, no aliasing across processes
Closes the documentation gap for dma.rs unsafe blocks.
Documents the safety invariants for the AtomicPtr<()> that caches
the memory scheme root fd for the process lifetime:
- read-only after first init (Ordering::Acquire)
- pointer is either null or a valid fd cast to *mut ()
- cast is valid because we never dereference the pointer; only
round-trip through libredox::call::dup
This is the first of multiple commits adding # Safety documentation
across the unsafe surfaces of redox-driver-sys.
Completes the SeatNew/SeatRemoved pair from the prior commit. The
emit_seat_removed public method was added but not wired to any shutdown
path; this commit hooks it into wait_for_shutdown's return path so
subscribers (e.g. SDDM's LogindSeatManager) observe seat departure
before the D-Bus connection drops. SEAT_PATH is reused from main.rs's
existing constant rather than introducing a new placeholder string.
Document the safety contracts for:
- acquire_iopl: kernel fd validity, IOPL privilege, no concurrent calls
- inb/inw/inl: valid port, required privilege (IOPL or ring 0)
- outb/outw/outl: valid writable port, no destructive side effects
Closes the documentation gap for io.rs unsafe inline asm blocks.
Part of the systematic fix for ZERO # Safety docs across ~330 unsafe
blocks (NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §9.3).
- Replace unsafe static mut DNS_TID (data race between loopback listener
thread, mDNS responder thread, and scheme-call paths) with AtomicU16
+ fetch_update. Eliminates torn writes and interleaved read-modify-write
that could produce duplicate transaction IDs and misroute responses.
- Add MAX_COMPRESSION_JUMPS=10 cap and backward-loop detection to
decode_name. Previously a malicious DNS response with a self-referential
or cyclic compression pointer could spin the scheme daemon's main
thread indefinitely (DoS).
Closes the two CRITICAL findings (C-19, C-20) from
local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.5
Closes the v4.8 cross-cutting item:
- redbear-driver-policy package is now ACTIVE (was "dormant until
Phase C3"; cutover was operator-ratified 2026-07-23)
- /etc/driver-manager.d/disabled file gate is honored by main.rs
main.rs changes:
- Loads DriverOptions, AutoloadList, InitfsManifest alongside the
existing Blacklist; all four gated by /etc/driver-manager.d/disabled
- New policy-surface summary log line at startup
(policy-surface: disabled={} blacklist={} options={} ...)
- Structured messages indicate "(N4 active)" once the four surfaces
are wired
config.rs changes:
- New process-wide globals: GLOBAL_DRIVER_OPTIONS,
GLOBAL_AUTOLOAD, GLOBAL_INITFS_MANIFEST
- Setters: set_global_shared_driver_options /
set_global_shared_autoload_list / set_global_shared_initfs_manifest
- Readers: driver_options_for / autoload_modules /
initfs_manifest_stages
- Spawn path: applies DriverOptions overrides as
REDBEAR_DRIVER_PARAM_<NAME>=<value> env vars per param
policy.rs changes:
- New from_static constructors for the three new SharedX wrappers
(used by main.rs to register startup-time policy without owning
the directory for re-replace)
- Bug fix: the new SharedDriverOptions/AutoloadList/InitfsManifest
load_from methods were discarding the loaded data (assigned to
'inner' but used DriverOptions::default() instead). Fixed; the
SharedBlacklist version was correct. Caught by the unused-variable
warning during this work.
redbear-driver-policy package:
- README rewritten: removed "dormant until Phase C3" language;
replaced with active-state documentation, gating instructions,
and operator workflow (`touch ...disabled` / `rm ...disabled`)
- 00-blacklist.conf: clarified gating section (now matches the
implemented /etc/driver-manager.d/disabled behaviour)
policy::tests: 23 -> 23 (no new tests in this commit; coverage
remains at 23 from N1–N3). driver-manager tests: 159 total, all green.
driver-manager-audit-no-stubs.py: 46 files, 0 violations.
Closes the cross-cutting items the v4.8 assessment flagged as
"not yet in the policy layer":
- modprobe.d options parser (per-driver param overrides)
- modules-load.d autoload enforcement
- initfs.manifest enforcement
Three new policy surfaces added to policy.rs alongside the
existing SharedBlacklist:
DriverOptions (mirrors Linux modprobe.d/<driver>.conf):
- TOML schema: [[options]] driver = "name" params = [{name, value}, ...]
- Applied at spawn as REDBEAR_DRIVER_PARAM_<NAME>=<value> env var
- SharedDriverOptions with SIGHUP-reloadable replace()
AutoloadList (mirrors Linux modules-load.d/<name>.conf):
- Parses simple 'module = "name"' lines from autoload.d/*.conf
- Deduplicates, ignores comments and blank lines
- SharedAutoloadList with replace()
InitfsManifest (mirrors CachyOS mkinitcpio hook ordering):
- TOML schema: [kms] / [block] / [filesystems] / [boot] sections
- Canonical walk order enforced regardless of TOML declaration
- SharedInitfsManifest with replace()
Plus shared file-loader helpers (read_toml_files, read_any_files,
read_files_matching) to centralise directory iteration. The matcher
accepts both .toml and .manifest extensions so the initfs manifest
can ship as a self-documenting .manifest file.
23 new unit tests in policy::tests (was 6):
- DriverOptions: load_dir missing/parse/skips invalid/empty param
- DriverOptions: for_unknown_driver returns empty
- SharedDriverOptions: replace() round-trip
- AutoloadList: load_dir missing/parses/dedupes/comments+blank
- AutoloadList: accepts quoted/unquoted values
- InitfsManifest: load_dir missing/parses all stages
- InitfsManifest: walks stages in canonical order even when TOML
declares them in reverse
- InitfsManifest: skips empty stages and empty driver names
- InitfsManifest: canonical_order() is stable and Ord-sorted
- SharedInitfsManifest: replace() round-trip
policy::tests count: 6 -> 23 (+17).
No main.rs or scheme.rs changes yet — the new policy surfaces are
library-only at this commit. Wiring (N4) follows in the next
commit; the policy package activation removes the "dormant until
Phase C3" language from the redbear-driver-policy README.
vasilito