The amdgpu recipe's idr_* / ida_* header conflict with linux-kpi is
now resolved (see the preceding commit). Re-enable amdgpu in
redbear-full.toml by changing amdgpu = "ignore" to amdgpu = {} and
add a [package] section to the amdgpu recipe marking the 0.2.3
release and describing the bounded display-glue compile surface
(DCN20 / DCN30 / DCN31 backend files plus the Rust-side init /
connector detection / modeset glue).
The redbear-full desktop target now pulls in pipewire and wireplumber
as the audio backend for KDE Plasma (Phonon, KMix, the Plasma audio
widget). This wires up the packages built by the new
local/recipes/libs/pipewire and local/recipes/libs/wireplumber
recipes on top of the existing audiod scheme daemon in the base
package.
Changes:
* config/redbear-full.toml
- new [packages] entries for pipewire and wireplumber
- two new [[files]] init services: 15_pipewire.service and
16_wireplumber.service (both oneshot_async, depend on
12_dbus.service)
* local/recipes/system/redbear-dbus-services/files/
- new org.freedesktop.PipeWire.service (system bus, runs
/usr/bin/pipewire) and org.pulseaudio.Server.service
(system bus, runs /usr/bin/pipewire-pulse)
- new org.freedesktop.impl.pulseaudio.service (session bus,
runs /usr/bin/pipewire-pulse) for KDE Phonon / KMix
- matching .conf policy files for org.freedesktop.PipeWire
and org.pulseaudio.Server that allow the expected
Introspectable / Properties / *Manager / *Node / *Link /
*Client / *Device / *Meter / *Core / *Port send and
receive patterns
* config/protected-recipes.toml
- new [libs] entries for pipewire and wireplumber, so the
cookbook never silently re-fetches them; sources are
directly editable in local/sources/
* recipes/wip/services/{pipewire,wireplumber}
- replaced the tracked WIP directories with symlinks to
local/recipes/libs/{pipewire,wireplumber}, per the
local-over-WIP convention enforced by
local/scripts/build-redbear.sh
Known build state (documented in the upstream README-redbear.md
files in each source fork):
* pipewire build reaches ~24/603 C files compiled before
hitting relibc gaps (sys/prctl.h, sys/mount.h, and a few
Linux-specific ioctls). The recipe, source fork, and
Redox-compat shims are in place; the remaining work is
upstream relibc headers, not PipeWire porting decisions.
* wireplumber recipe is in place but the build has not been
attempted yet — wireplumber depends on the pipewire build
completing first.
The audiod integration (the scheme backend that pipewire would
talk to) is not implemented in this commit. That is the next
gating work item and is tracked in
local/sources/pipewire/README-redbear.md.
The initfs already starts inputd (in phase 1) and registers the
'scheme input/evdev'. The rootfs 29_activate_console.service was
calling 'inputd -A 2' from minimal.toml, which the v6.0 inputd
binary does not accept (no -A flag; v6.0 inputd is a pure scheme
daemon that registers the single-producer evdev ring buffer).
Override the rootfs service with a no-op ('true') that satisfies
the unit dependency chain without re-spawning inputd. The actual
input pipeline (drivers writing Linux evdev, evdevd reading from
the scheme, libinput/KWin consuming /dev/input/eventN) works
without this redundant rootfs invocation.
Cross-cutting changes tied to the libepoxy/libxcvt/libdisplay-info/
lcms2/libudev stub-removal work:
- config/protected-recipes.toml [graphics]: add libepoxy, libxcvt,
libdisplay-info, lcms2 (real Red Bear recipes under local/recipes)
- config/protected-recipes.toml [libs]: drop the 5 *-stub entries,
add 'libudev' (renamed from libudev-stub)
- local/recipes/AGENTS.md catalog: drop the 5 *-stub rows, update
the 5 real lib rows to reflect the v6.0 2026 fork
- local/scripts/apply-patches.sh: drop the 5 *-stub symlink
creation entries; add libudev symlink entry
(The redbear-full.toml package list was already updated to enable
libdisplay-info, libxcvt, lcms2 and add libudev, as part of the
pam-redbear commit that included both changes.)
- /var/log and /var/run: override base.toml's 0o755 (root-only write) to
0o1777 (sticky-bit world-writable) so log/run daemons running under
non-root users (messagebus, etc.) can create files in them.
- 00_rtcd.service: remove invalid uid=0 field. The init service parser
uses serde(deny_unknown_fields) and only accepts cmd, args, envs,
inherit_envs, type — uid caused 'unknown field uid' parse error.
Two parallel review agents cross-checked the virtio-inputd driver against
the Linux 7.1 reference (drivers/virtio/virtio_input.c, virtio_input.h)
and the proven redox-drm virtio transport. 12 issues were found across
BLOCKER, MAJOR, MINOR, and NIT severity, all fixed in this commit before
runtime testing.
BLOCKERs (would have prevented the driver from working in QEMU):
1. fill_avail() never wrote avail_idx after pushing the 64 ring
entries. The device reads avail_ring[avail_idx % size] to discover
new buffers, so without publishing avail_idx = size, the device
saw avail_idx = 0 and ignored all initial buffers. Fix: explicit
'fence(Release); write_avail_idx(self.size)' with a spec citation.
2. drain() recycled IDs derived from 'last_used_idx - drained_count',
which is wrong when the used ring wraps and a single drain cycle
spans more than one full ring revolution. Fix: collect the actual
drained 'id' values in a stack '[u16; 64]' array during the drain
loop, then push those exact ids back to the avail ring. The
doc-comment explains why the derivation is unsafe.
3. config_read_string() and config_read_bitmap() used
'self.device_cfg.size()' (the MMIO region size = 40) instead of
the device-reported config size from offset 2. Fix: use
'config_read_size()' to read the actual size field.
4. config/redbear-full.toml: device_id_range was a TOML string
('0x1042..=0x107F') but serde's Range<u16> deserializes from a
sequence, not a string. pcid-spawner would have silently failed
to load the fragment. Fix: use serde array form
'device_id_range = [0x1042, 0x107F]'.
MAJORs (silent failure modes or runtime bugs):
5. activate_queue() had no fence between address writes and
'queue_enable = 1'. A CPU write buffer may reorder writes to
distinct MMIO addresses. Fix: explicit 'fence(SeqCst)' with
a comment citing virtio spec 2.8 and Linux's virtio_wmb.
6. No 'reset_device()' on error path after partial init. The device
would be left in ACKNOWLEDGE|DRIVER with no driver active,
requiring a guest reboot to recover. Fix: wrap init in a closure;
any error calls 'transport.reset_device()' before propagating.
7. Drain loop never checked DEVICE_NEEDS_RESET or DEVICE_STATUS_FAILED.
If the device entered an unrecoverable state, the driver would
poll forever with stale state. Fix: 'device_in_error_state()' on
the transport; loop checks it each iteration and exits cleanly.
8. The abs_count probe used 'config_read_size() == 24', which was
always false (virtio_input_absinfo is 20 bytes, not 24). The
count was always logged as 0. Fix: '>= 20' per spec.
MINORs / NITs (hardening, no functional impact):
9. config_read_absinfo() returned AbsInfo without validating
device-reported size. Now returns Option<AbsInfo> and validates
size >= 20.
10. map_cap_region() missing bounds check: capability range may
extend past BAR end (QEMU is permissive; bare-metal is not).
Added 'cap_end > bar_size' check with spec reference.
11. Legacy device 0x1052 entry in pcid fragment caused spurious
spawn + log noise. Removed.
12. notify_queue() error silently dropped with .ok(). Now logs warn
and continues.
Plan update:
The CONSOLE-TO-KDE-DESKTOP-PLAN.md v5.1 changelog now has a new
'9.1.1 Phase 5.1 review-driven fixes' section documenting all 12
findings with file:line, severity, and fix. Future maintainers can
trace the BLOCKERs back to specific commits to understand the
critical-path safety net this review provided.
Verification: cargo check zero errors, 64 warnings (all unused
keycode constants reserved for Phase 5.2 expansion). The driver
is now ready for runtime testing in QEMU.
Add a real, QEMU-targeted virtio-input driver as a new Red Bear recipe at
local/recipes/drivers/virtio-inputd/. The driver handles virtio-input-host-pci,
virtio-input-keyboard, virtio-input-mouse, and virtio-input-tablet devices and
closes Gap #19 of the v5.0 desktop plan.
The driver:
* Walks the PCI capability list to find the modern virtio 1.0 capability
block (common_cfg, notify_cfg, isr_cfg, device_cfg) using MmioRegion
mappings via redox-driver-sys. Rejects legacy virtio-input (device 0x1052)
which lacks the modern transport.
* Negotiates VIRTIO_F_VERSION_1 only (the only required feature).
* Allocates one event virtqueue (size up to 64) backed by four DMA buffers
(desc, avail, used, event_buffers) and pre-fills the avail ring.
* Polls the used ring at 60 Hz, drains completed events, decodes each
virtio_input_event (8-byte type/code/value), and recycles drained buffers
back to the avail ring.
* Translates events to orbclient format and pushes them to inputd via
ProducerHandle (Orbital path):
- EV_KEY -> KeyEvent (with US-QWERTY character mapping)
- EV_REL -> MouseRelativeEvent (REL_X/REL_Y) or ScrollEvent (REL_WHEEL)
- EV_SYN -> dropped (inputd multiplexes)
- Other -> dropped (Phase 5.2 will add evdevd path)
Probe-time checks:
* Vendor 0x1AF4, device_id >= 0x1042, revision >= 1
* Caps include a device_cfg block with virtio type == 18 (virtio_input)
Configuration: a pcid-spawner fragment is added to config/redbear-full.toml
under /etc/pcid.d/virtio-inputd.toml matching class=0x09 vendor=0x1AF4 with
device_id_range 0x1042..=0x107F (and a separate 0x1052 entry that the driver
intentionally rejects).
Verification: cargo check produces 0 errors and 65 warnings, all of which are
unused input-event-codes.h constants reserved for the Phase 5.2 expansion.
Linking the binary requires the Redox cross-toolchain (relibc provides
redox_sys_call_v0); this is provided by the build system, not the host
toolchain.
Plan: this is Phase 5.1 of CONSOLE-TO-KDE-DESKTOP-PLAN.md v5.0. The plan is
updated to v5.1 with: (a) a 'What Changed Since v5.0' section, (b) Gap #19
marked DONE, (c) Phase 5 row marked DONE with sub-task status, (d) Gate E
updated, (e) Input pipeline section updated to reflect the (c) path is now
implemented. Phase 5.2 (evdevd producer path + virtio-snd) is documented as
the next planned work but not yet implemented.
Two findings from the R7 comprehensive review:
1. Boot order race (CRITICAL)
00_driver_manager.service and 00_acpid.service both have the
00_ prefix and no explicit dependency. If driver-manager
enumerates PCI before acpid publishes /scheme/acpi/dmi, every
device gets empty quirk_flags because
redox_driver_sys::quirks::dmi::read_dmi_info() returns Err(())
when the file doesn't exist yet. The OR-accumulation is frozen
at enumeration time so hotplug won't pick up later-published
DMI data.
Fix: add 00_acpid.service to requires_weak for both
00_driver_manager.service (redbear-device-services.toml) and
13_iommu.service (redbear-mini.toml + redbear-full.toml).
2. xHCI typo (CRITICAL)
quirks.d/25-xhci.toml:38 has 'broken_port_pec' which doesn't
exist in the flag name table. The correct flag is
'broken_port_ped' (Port Enabled/Disabled, bit 25 in
XhciControllerQuirkFlags). The typo causes the flag to be
silently dropped at runtime, leaving Intel ICH6 xHCI
(vendor=0x8086, device=0x1E31) without the intended
BROKEN_PORT_PED quirk.
Fix: corrected typo to 'broken_port_ped'.
On Redox there is no udev-based DRM device enumeration. KWin's DRM
backend relies on m_udev->listGPUs() which returns nothing without udev.
Add a fallback: when no KWIN_DRM_DEVICES is set and the session is
kde-wayland, inject KWIN_DRM_DEVICES=/scheme/drm/card0 so KWin knows
which device to open. This fixes the 'No suitable DRM devices' error
that prevented KWin from starting on Redox.
Added test: build_environment_sets_kwin_drm_devices_default_for_kde_wayland
to verify the fallback is applied correctly.
redox-drm = "ignore" was left from earlier GPU-suppression tests.
Restored to active so the DRM/KMS display driver is included in
the full ISO image. Without it, no GPU output or SDDM compositor.
VIRTGPU_GETPARAM: expand from 1 to 8 sub-parameters for Mesa
compatibility. Mesa virgl driver probes CAPSET_QUERY_FIX,
RESOURCE_BLOB, CONTEXT_INIT, SUPPORTED_CAPSET_IDS, and
EXPLICIT_DEBUG_NAME during initialization.
set_property: add doc comment explaining that virtio-gpu has
no per-object property tables — all mode/fb/active changes
flow through atomic commit, not set_property.
cursor_move: replace x.max(0) as u32 / y.max(0) as u32 with
explicit if-else for clarity. Negative coordinates now clamp
to zero at screen edges (same behavior, more readable code).
Extract protocol-agnostic FenceTimeline from Intel to shared
src/drivers/fence.rs — atomic-based fence tracking suitable
for Intel, VIRGL, and AMD drivers.
Extract protocol-agnostic SyncobjManager from Intel to shared
src/drivers/syncobj.rs — syncobj create/destroy/signal/reset/
wait/query and sync_file fd export/import.
Wire both into VirtioDriver:
- Add FenceTimeline + SyncobjManager fields
- Implement all 5 GpuDriver syncobj trait methods
(create, destroy, wait, export_fd, import_fd)
- Track fence seqnos in virgl_submit_3d (allocate
before submit, signal after completion)
Intel fence.rs and syncobj.rs converted to thin re-export
modules pointing at shared sources — no behavioral change
for Intel driver.
This gives Mesa VIRGL userspace the standard DRM syncobj
API for GPU/compositor synchronization.
29_activate_console: changed from oneshot back to oneshot_async.
The oneshot type calls child.wait() which blocks the entire init
scheduler. If inputd doesn't drain its control channel promptly,
ControlHandle::write() hangs forever, freezing boot.
30_console: added 'sleep 0.2' before 'exec getty 2' to give
inputd time to process the VT activation before getty opens
/scheme/fbcon/2. Eliminates the race condition without
blocking the init scheduler.
Kernel has a use-after-free bug in sys_read triggered by /scheme/sys/msr
access. The probe guard prevents most crashes but the kernel bug can still
trigger during MSR read paths. Removing the MSR fallback eliminates this
crash path entirely. Vendor detection now uses /scheme/sys/cpu only.
The cross-compiler's GCC built-in stddef.h is blocked by relibc's
_STDDEF_H guard, causing size_t/off_t/ptrdiff_t to be undefined.
Add fix_types.h with guarded typedefs and force-include via CPPFLAGS.
Also: comprehensive upstream relibc comparison for systematic import.
Remaining: redoxer env overrides CC, injecting broken stdint typedefs
from its toolchain. This needs a redoxer-level fix to clean the
injected flags before passing to build commands.
coretempd uses syscall::call::write() for init notification, which
sends raw bytes — not an fd transfer via CallFlags::FD that the Scheme
init type expects. Changing to Scheme would cause init to block forever
in call_ro waiting for an fd that never arrives in the expected format.
The oneshot_async + resilience pattern is correct for coretempd.
- 29_activate_console.service: oneshot -> oneshot_async (unblocks init
scheduler, enabling getty 2 -> login)
- 15_coretempd.service: oneshot_async -> {scheme="coretemp"} (init
now correctly registers the scheme fd)
- cpufreqd: child-process MSR probe detects QEMU's lack of MSR 0x199
and gracefully degrades to monitoring-only mode
- coretempd: notification failure is now non-fatal (WARN instead of ?)
- driver-manager: "no match entries" downgraded from warn to debug
(infrastructure daemons intentionally have no hw match)
- ps2d: PS/2 keyboard/mouse (init service + driver-manager wildcard match)
- i2c-hidd: I2C HID keyboard/touchpad (init service + driver-manager match)
- intel-thc-hidd: Intel Touch Host Controller HID (init service + PCI match)
Fixes i2c-hidd path: /usr/bin/i2c-hidd (not /usr/lib/drivers/).
These drivers were already built in the base package but were not wired
into the boot process. Modern Intel notebooks typically use either
i8042 EC emulation (PS/2) or I2C HID for keyboard/touchpad.
- login.rs: drop privileges via setresugid after authentication
- login.rs: add namespace isolation to password auth path (was missing)
- login.rs: add drm, input schemes to DEFAULT_SCHEMES
- sudo service: rename 00_sudo -> 12_sudo, type daemon (no boot block)
- Branded login screen with figlet RedBear OS v0.2.2 'Liliya'
- Root user kept but not advertised on login screen
- P6-login-privilege-drop.patch generated and wired
Implements Phase 1 of Plan 9 namespace privilege model:
login creates restricted namespace (mkns/setns) then drops
uid/gid to authenticated user before spawning shell.
Three fixes for the KWin DRM device discovery failure:
1. drm_scheme_ready(): replace head -c 1 with exec 3< open test.
Reading from a DRM scheme fd blocks because the scheme expects
ioctl-style request/response, not streaming reads. Use open()
success as the scheme availability probe instead.
2. ConsoleKitSession::create(): return nullptr immediately.
The D-Bus isServiceRegistered() call can block indefinitely when
the bus daemon doesn't fully implement org.freedesktop.DBus.
With both LogindSession and ConsoleKitSession returning nullptr,
Session::create() falls through to NoopSession which uses plain
open() for DRM device access.
3. Boot chain deps: redox-drm depends on driver-manager,
greeter depends on evdevd (keyboard/mouse ready before login).
Also includes: KF6 CMake build fixes, Qt6 platform patches,
libdrm Redox ioctl shim, and wayland.toml scheme check fix.
New local recipe coretempd reads IA32_THERM_STATUS MSR via the
new sys:msr scheme and exposes per-CPU temperatures via scheme:coretemp.
- Reads IA32_THERM_STATUS (0x19C) and IA32_TEMPERATURE_TARGET (0x1A2)
- Calculates Celsius from digital readout relative to TjMax
- Exposes /scheme/coretemp/ directory with per-CPU temperature files
- Added to redbear-mini.toml (inherited by redbear-full)
- Added 15_coretempd.service init file
vasilito
Vasili